aboutsummaryrefslogtreecommitdiff
path: root/test
AgeCommit message (Collapse)AuthorFilesLines
2020-06-13Improve ossl_cmp_msg_check_received() and rename to ossl_cmp_msg_check_update()Dr. David von Oheimb2-42/+40
Bugfix: allow using extraCerts contained in msg already while checking signature Improve function name, simplify its return value, and update its documentation Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11998)
2020-06-13Fix two additional instances of the old EVP_MAC_CTX_ functions being used.Pauli1-1/+1
[extended tests] Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12121)
2020-06-11The EVP_MAC functions have been renamed for consistency. The EVP_MAC_CTX_*Pauli3-7/+7
functions are now EVP_MAC functions, usually with ctx in their names. Before 3.0 is released, the names are mutable and this prevents more inconsistencies being introduced. There are no functional or code changes. Just the renaming and a little reformatting. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11997)
2020-06-11kdf: make function naming consistent.Pauli2-37/+38
The EVP_KDF_CTX_* functions have been relocated to the EVP_KDF_* namespace for consistency. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11996)
2020-06-10Add a CMAC testMatt Caswell3-0/+237
We did not have a test of the low level CMAC APIs so we add one. This is heavily based on the HMAC test. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11972)
2020-06-10run_tests.pl: Add options for focussing output on failed (sub-)testsDr. David von Oheimb1-11/+48
VERBOSE_FAILURES_ONLY (VFO): verbose output only of failed (sub-)tests VERBOSE_FAILURES_PROGRESS (VFP): in addition summary for passed tests This adds a workaroud for TAP::Parser not coping well with indentation. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12088)
2020-06-10Silence gcc false positive warning on refdatalen in test/tls13encryptiontest.cDr. David von Oheimb1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12042)
2020-06-10Silence gcc false positive warning on alpn_protos_len in test/handshake_helper.cDr. David von Oheimb1-1/+2
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12042)
2020-06-10Update RSA keygen to use sp800-56b by defaultShane Lontis1-4/+19
Fixes #11742 Fixes #11764 The newer RSA sp800-56b algorithm is being used for the normal case of a non multiprime key of at least length 2048. Insecure key lengths and mutltiprime RSA will use the old method. Bad public exponents are no longer allowed (i.e values less than 65537 or even). Values such as 2 that would cause a infinite loop now result in an error. The value of 3 has been marked as deprecated but is still allowed for legacy purposes. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11765)
2020-06-09Add a test for renegotiation with EXTMS droppedTomas Mraz5-3/+66
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12045)
2020-06-08test: TLS1.3 and new ciphers for kTLSVadim Fedorenko2-104/+400
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11589)
2020-06-08Fix 90-test_store.t for latest config, limits, providers, and disabled algosDr. David von Oheimb5-104/+99
Also make sure that the test do not 'pass' if their initialization fails. Leave out the expensive parts of DSA key gen and RSA keygen for efficiency. Fix use of the new CA configuration file test/ca-and-certs.cnf. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11733)
2020-06-08Add chain to PKCS#12 test file generation in 90-test_store.tDr. David von Oheimb1-0/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11733)
2020-06-06TEST: Adjust test/bioprinttest.c to behave like the testutil routinesRichard Levitte1-2/+32
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12057)
2020-06-06TESTUTIL: Adjust the rest of testutilRichard Levitte2-20/+18
Fixes #12054 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12057)
2020-06-06TESTUTIL: Separate TAP output and other output by BIO filterRichard Levitte5-163/+87
Output that's supposed to be understood by a TAP parser gets its own BIOs (|tap_out| and |tap_err|), and is only used internally within testutils. |bio_out| and |bio_err| is now only used for output that shouldn't be parsed by the TAP parser, and all output written to those BIOs are therefore always made to look like comments (it gets prefixed with "# "). Indentation and prefixing with "# " is reworked to use BIO_f_prefix(), which allows us to throw away the internal BIO_f_tap(). The indentation level is now adjusted via a special function. Fixes #12054 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12057)
2020-06-05When asked if an ECX key has parameters we should answer "true"Matt Caswell1-1/+2
An ECX key doesn't have any parameters associated with it. Therefore it always has all the parameters it needs, and the "has" function should return 1 if asked about parameters. Without this EVP_PKEY_missing_parameters() fails for ECX keys. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11898)
2020-06-05Fix error path in int create_ssl_ctx_pair()Matt Caswell1-2/+4
If we hit the error path and create_ssl_ctx_pair has been passed a pre-created SSL_CTX then we could end up with a double free. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11834)
2020-06-05Implement a test for sigalgs not being presentMatt Caswell1-5/+155
If sigalgs are not present we should not offer or accept them. We should test that we handle this correctly. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11834)
2020-06-05Implement a Filtering ProviderMatt Caswell2-1/+200
The filtering provider can be used to place a filter in front of the default provider. Initially to filter out certain algorithms from being available for test purposes. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11834)
2020-06-05fips: add additional algorithms to the FIPS provider.Pauli1-11/+0
Discussions are ongoing but the OMC has approved the in-principle addition of these algorithms to the upcoming FIPS validation. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12020)
2020-06-04TEST: Add provider_fallback_test, to test aspects of fallback providersRichard Levitte3-0/+80
There are cases where the fallback providers aren't treated right. For example, the following calls, in that order, will end up with a failed EVP_KEYMGMT_fetch(), even thought the default provider does supply an implementation of the "RSA" keytype. EVP_KEYMGMT *rsameth = NULL; OSSL_PROVIDER_available(NULL, "default"); rsameth = EVP_KEYMGMT_fetch(NULL, "RSA", NULL); For good measure, this also tests that explicit loading of the default provider won't fail. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11926)
2020-06-04Update copyright yearMatt Caswell8-8/+8
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12043)
2020-06-03ossl_shim: const cast the param arguments to avoid errorsPauli1-2/+4
[extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12022)
2020-06-03Update manpage to fix examples, other minor tweaksRich Salz3-4/+4
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11347)
2020-06-03Cleanup cert config files for testsRich Salz10-225/+196
Merge test/P[12]ss.cnf into one config file Merge CAss.cnf and Uss.cnf into ca-and-certs.cnf Remove Netscape cert extensions, add keyUsage comment from some cnf files Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11347)
2020-06-03ossl_shim: include core_names.h to resolve undeclared symbolsPauli1-0/+1
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/12018)
2020-06-02TEST: Test i2d_PKCS8PrivateKey_bio() and PEM_write_bio_PKCS8PrivateKey()Richard Levitte1-0/+35
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11855)
2020-06-02Move EC_METHOD to internal-onlyBilly Brumley1-83/+31
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11928)
2020-06-01Revert the check for NaN in %f formatBernd Edlinger1-33/+0
Unfortunately -Ofast seems to break that check. Fixes #11994 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12003)
2020-05-29bio printf: Avoid using rounding errors in range checkBernd Edlinger1-0/+34
There is a problem casting ULONG_MAX to double which clang-10 is warning about. ULONG_MAX typically cannot be exactly represented as a double. ULONG_MAX + 1 can be and this fix uses the latter, however since ULONG_MAX cannot be represented exactly as a double number we subtract 65535 from this number, and the result has at most 48 leading one bits, and can therefore be represented as a double integer without rounding error. By adding 65536.0 to this number we achive the correct result, which should avoid the warning. The addresses a symptom of the underlying problem: we print doubles via an unsigned long integer. Doubles have a far greater range and should be printed better. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11955)
2020-05-28test HKDF with empty IKMBenjamin Kaduk1-0/+42
Add an extra EVP test that provides empty input key material. It currently fails, since we lose the information about "key present but zero length" as we deserialize parameters in the provider. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11920)
2020-05-28Add a test for fetching EVP_PKEY style algs without a providerMatt Caswell1-0/+42
Following on from the previous commit, add a test to check that we fail to create an EVP_PKEY_CTX if an algorithm is not available in any provider, *unless* it is an algorithm that has no provider support. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11826)
2020-05-28Fail if we fail to fetch the EVP_KEYMGMTMatt Caswell1-1/+2
If we failed to fetch an EVP_KEYMGMT then we were falling back to legacy. This is because some algorithms (such as MACs and KDFs used via an old style EVP_PKEY) have not been transferred to providers. Unfortunately this means that you cannot stop some algorithms from being used by not loading the provider. For example if you wanted to prevent RSA from being used, you might expect to just not load any providers that make it available. Unfortunately that doesn't work because we simply fall back to legacy if we fail to fetch the EVP_KEYMGMT. Instead we should fail *unless* the key type is one of those legacy key types that we have not transferred. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11826)
2020-05-28Fix errtest for older compilersShane Lontis1-2/+6
Some older compilers use "unknown function" if they dont support __func, so the test using ERR_PUT_error needed to compensate for this when comparing against the expected value. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11967)
2020-05-28ossl_shim: use the correct ticket key call back.Pauli3-17/+12
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11966)
2020-05-28fips: add AES OFB mode ciphers to FIPS provider.Pauli1-24/+0
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11908)
2020-05-28fips: add AES CFB mode ciphers to FIPS provider.Pauli1-24/+0
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11908)
2020-05-27Rename EVP_PKEY_cmp() to EVP_PKEY_eq() and EVP_PKEY_cmp_parameters() to ↵Dr. David von Oheimb1-1/+1
EVP_PKEY_parameters_eq() Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11953)
2020-05-27crypto/cms: add CAdES-BES signed attributes validationFdaSilvaYY1-23/+114
for signing certificate V2 and signing certificate extensions. CAdES: lowercase name for now internal methods. crypto/cms: generated file changes. Add some CHANGES entries. [extended tests] Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8098)
2020-05-26Update core_names.h fields and document most fields.Shane Lontis2-6/+6
Renamed some values in core_names i.e Some DH specific names were changed to use DH instead of FFC. Added some strings values related to RSA keys. Moved set_params related docs out of EVP_PKEY_CTX_ctrl.pod into its own file. Updated Keyexchange and signature code and docs. Moved some common DSA/DH docs into a shared EVP_PKEY-FFC.pod. Moved Ed25519.pod into EVP_SIGNATURE-ED25519.pod and reworked it. Added some usage examples. As a result of the usage examples the following change was also made: ec allows OSSL_PKEY_PARAM_USE_COFACTOR_ECDH as a settable gen parameter. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11610)
2020-05-26Fix ERR_print_errors so that it matches the documented format in ↵Shane Lontis4-1/+198
doc/man3/ERR_error_string.pod Fixes #11743 The ouput format had 2 issues that caused it not to match the expected documented format: (1) At some point the thread id printing was changed to use the OPENSSL_hex2str method which puts ':' between hex bytes. An internal function that skips the seperator has been added. (2) The error code no longer exists. So this was completely removed from the string. It is now replaced by :: As an example: 00:77:6E:52:14:7F:00:00:error:asn1 encoding routines:asn1_check_tlen:wrong tag:crypto/asn1/tasn_dec.c:1135: Is now: 00776E52147F0000:error::asn1 encoding routines:asn1_check_tlen:wrong tag:crypto/asn1/tasn_dec.c:1135: Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11789)
2020-05-26ossl_shim: add deprecation guards around the -use-ticket-callback option.Pauli3-0/+15
The ticket callback is deprecated in 3.0 and can't be used in a no-deprecated build. [extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11944)
2020-05-23GOST external testsDmitry Belyavskiy3-0/+93
[extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11792)
2020-05-23Fix the parameter types of the CRYPTO_EX_dup function type.Bernd Edlinger1-2/+2
This fixes a strict aliasing issue in ui_dup_method_data. The parameter type of CRYPTO_EX_dup's from_d parameter is in fact void **, since it points to a pointer. This function is rarely used, therefore fix the param type although that may be considered an API breaking change. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2986)
2020-05-19Test for the SSL_OP_IGNORE_UNEXPECTED_EOF optionDmitry Belyavskiy1-0/+56
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11735)
2020-05-19deprecate EC precomputation functionalityBilly Brumley1-9/+10
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11851)
2020-05-18Delete the sslprovider testMatt Caswell3-198/+1
This was added before the changes to the sslap/ssl_new/ssl_old tests which run those tests with a non-default library context. It no longer adds anything that those tests don't already do, so it can be deleted. This also fixes a number of run-checker build failures which were failing in this test if TLSv1.2 was disabled. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11832)
2020-05-16deprecate EC_POINTs_mul functionBilly Brumley1-10/+26
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11807)
2020-05-16Maintain strict type discipline between the core and providersMatt Caswell1-5/+5
A provider could be linked against a different version of libcrypto than the version of libcrypto that loaded the provider. Different versions of libcrypto could define opaque types differently. It must never occur that a type created in one libcrypto is used directly by the other libcrypto. This will cause crashes. We can "cheat" for "built-in" providers that are part of libcrypto itself, because we know that the two libcrypto versions are the same - but not for other providers. To ensure this does not occur we use different types names for the handful of opaque types that are passed between the core and providers. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11758)
generated by cgit v1.1 at 2024-07-13 15:04:16 +0000