Commit graph

800 commits

Author SHA1 Message Date
Richard Levitte
50f0a9b3dd Correct test name
Some tests were copied from test_jpake, but the title wasn't changed
accordingly.  This might seem like a small thing, but it does affect
the log file name...

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
c27a404947 Remake test/sslsessionticktest.pl into a recipe
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
25be5f44b8 Adapt the libssl test harness testing scripts to new testing framework
This involves adding $TOP/util as perl library in test/run_tests.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
53520ebe87 Check the validity of MINFO
MINFO may be an old file lying around, which might have
00-check_testexes.t produce incorrect results.  To make sure this
doesn't happen, check the variable VERSION in it against the same
variable in the top Makefile.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
2511c12bf2 Better method of skipping all the tests in 00-check_testexes.t
Before trying to read MINFO, we have no idea how many to test for, and
because skip expects to get an exact number somehow, it's better to
use 'plan skip_all'.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
8de4f3d3a6 Remove special x509 test conversions
Following the commit from July 2 that removed netscape formated certs,
it is no longer necessary to have conversion tests for it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
2a74b62e3a Add a few missing tests
test_clienthello
test_packet
test_verify_extra
test_secmem

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
ca904707b6 Push the line buffer filter on the out BIO on VMS
VMS files are normally record oriented rather than stream oriented.
This means that every write() will create a new record, which is seen
as a line of its own, regardless of if there was a \n in there or not.
bntest uses BN_print, which prints out number with more than one
write(), thereby dividing up the numbers in several lines, which
greatly disturbs the post-bntest checks that expect to find a full
formula to calculate on one line.

So, for VMS, we need to push the linebuffer filter on the out BIO.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
8368d46bca Rework 00-test_checkexes.t for VMS
Unfortunately, a file spec with character range globs interfere with
paths on VMS, and are therefore disabled.  Rework this test to collect
a list of expected tests and a list of all recipes and compare the two
using grep.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
f5098edb14 Document OpenSSL::Test and OpenSSL::Test::Simple
For OpenSSL::Test, it meant rearranging the code to better suite the
structure of the documentation.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
fd99c6b599 Change OpenSSL::Test to be an extension of Test::More
It became tedious as well as error prone to have all recipes use
Test::More as well as OpenSSL::Test.  The easier way is to make
OpenSSL::Test an extension of Test::More, thereby having all version
checks as well as future checks firmly there.  Additionally, that
allows us to extend existing Test::More functions if the need would
arise.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
caadc54381 New feature: STOPTEST
When the environment variable STOPTEST is defined (with any value other
than the empty string), the test machinery in OpenSSL::Test goes into a
different mode that will stop all testing at the end of a failing recipe.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
fb921436f3 Add version numbers on some modules we use.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
d6c5b66c1c Have 'make clean' clean away the log files.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
204e41ed50 Tone down the requirements of a test that will go away.
00-check_testexes.t was a way for me to check that I didn't forget a
compiled test app.  The way it worked was to require MINFO to be present.
Considering the need for this test has diminished considerably at this
point, I might as well tone down the requirement, and have it skip the
test (and not fail it) if MINFO isn't present.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
71a4f2832c Remove old testing scripts out of the way.
For now, I'm moving them into Attic/.  They will be removed later.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
93de4f58ef Simplify very simple test recipes further.
Very simple test recipes easily become tedious, so they might benefit
from being made as simple as possible.  Therefore, OpenSSL::Test::Simple
is born.  It currently provides but one function, simple_test(), which
takes a minimum of two parameters (test name and program to run), with
the optional third, being the algorithm to be checked for before
running the test itself.

All recipes with that simple thing to do have been rewritten to be as
minimal as possible.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
d11b43fdd3 Remove test targets from Makefile, have it use run_tests.pl
Also remove recipes/00-check_testalltests.t, since it will lack the
information from the now gone alltests target.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:58 +02:00
Richard Levitte
127d25903f Add recipes for misc other things we want to test
Note that this required a change in constant_time_test.c, as it says
"ok", which interferes with what Test::Harness expects to see.  I had
constant_time_test.c say "success" instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
88b8a5279f Add recipes for the larger protocols
This covers the certificate authority commands, the cms and smime
commands, OCSP, SSL and TSA.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
4fb35f8fcb Add engine and evp test recipes.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
4650de3e43 Add recipes for tests related to certificates
Some of them make use of recipes/tconversion.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
0c85cc5069 Add asymetric cipher test recipes
Some of them make use of recipes/tconversion.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
904ae33426 Add a helper script for key file format conversion tests
As tests are done until now, there are a few scripts that look almost,
but not quite the same.  tkey, tx509, tcrl, tpkcs7, treq, tsid and
probably a few more.

recipes/tconversions.pl is a helper script that generalises the
function of each of those, and can then be used in a general manner
from test recipes.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
13350a0c0e Add the encryption test recipe
This tests all available openssl cipher commands.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
894025c642 Add recipes for individual block ciphers, stream ciphers and digests
These recipes all correspond to a compiled test program.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
f3356b7f49 Add math tests recipes
The math recipes are among the heavier, but also quite important.
For the BN test, we have previously relied on bc to verify the numbers.
Unfortunately, bc doesn't exist everywhere, making tests on some platforms
rather painful.  With the new recipe (recipes/10-test_bn.t), we rely
on perl's Math::BigInt and a homegrown simple calculator (recipes/bc.pl)
that can do enough to cover for bc.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
aec27d4d52 Groundwork for a perl based testing framework
The idea with this perl based testing framework is to make use of
what's delivered with perl and exists on all sorts of platforms.

The choice came to using Test::More and Test::Harness, as that seems
to be the most widely spread foundation, even if perl is aged.

The main runner of the show is run_tests.pl.  As it currently stands,
it's designed to run from inside Makefile, but it's absolutely
possible to run it from the command line as well, like so:

	cd test
	OPENSSL_SRCDIR=.. perl run_tests.pl

The tester scripts themselves are stored in the subdirectory recipes/,
and initially, we have two such scripts, recipes/00-check_testalltests.t
and recipes/00-check_testexes.t.  recipes/00-check_testalltests.t will
pick out the dependencies of "alltests" in test/Makefile, and check if
it can find recipes with corresponding names.  recipes/00-check_testexes.t
does something similar, but bases it on existing compiled test binaries.
They make it easy to figure out what's to be added, and will be
removed when this effort is finished.

Individual recipes can be run as well, of course, as they are perl
scripts in themselves.  For example, you can run only
recipes/00-check_testexes.t like so:

	cd test
	OPENSSL_SRCDIR=.. perl recipes/00-check_testexes.t

To make coding easier, there's a routine library OpenSSL::Test, which
is reachable in a perl script like so:

	use lib 'testlib';
	use OpenSSL::Test;

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-07 16:10:57 +02:00
Richard Levitte
0f81f5f78c Have the test executables output in text mode
The test executables use standard output and standard error for text output,
so let's open the corresponding BIOs in text mode.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-06 01:35:54 +02:00
Richard Levitte
e9daa8150a Make the verify_extra test location agnostic
Depending on platform, verify_extra_test may fail because it relies on
test/ being the current working directory.  Make it get all the required
files on the command line instead to solve that issue.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-06 01:28:40 +02:00
Dr. Stephen Henson
a8d8e06b0a Avoid direct X509 structure access
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-06 00:17:37 +01:00
Rich Salz
fda23e2d93 Cleanup testtsa script
Add RUN function; remove single-use functions and use their body inline.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-05 18:01:45 -04:00
Alessandro Ghedini
2519b4e181 Use the shlib wrapper when running nptest
Since there seems to be no way to avoid linking to libssl and libcrypto,
just wrap the test. This unbreaks "shared" builds when using clang and/or
OS X.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>
2015-09-05 15:56:29 -04:00
Benjamin Kaduk
18716ba256 Supply a build rule for the recently added nptest
Commit d4ab70f27c added a test program
to check that the NULL pointer is represented as all zero bits, but
did not specify a build rule for that new executable.  On many platforms,
the implicit rule sufficed, since nptest is a very simple program, but
for at least darwin-i386-cc, an explicit rule is needed.  On darwin-i386-cc,
the implicit rule targetted a 64-bit executable, but the object file
containing the definition of main was a 32-bit object, which the linker
excluded from consideration, resulting in a link failure due to no
definition for _main.

Add the missing build rule to fix the build on such platforms.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2015-09-04 23:00:58 -04:00
Rich Salz
d4ab70f27c Test for NULL ptr == 0
Add a test to ensure that "char *p = NULL" is equivalent to
all-bytes-zero.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-04 14:30:38 -04:00
Rich Salz
b0809bc8ff RT3998: Allow scrypt to be disabled
This does 64-bit division and multiplication, and on 32-bit platforms
pulls in libgcc symbols (and MSVC does similar) which may not be
available.  Mostly done by David Woodhouse.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2015-09-04 14:09:14 -04:00
David Bar
e968561d5e RT3674: Make no-cms build work.
Also has changes from from David Woodhouse <David.Woodhouse@intel.com>
and some tweaks from me.

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-03 14:45:15 -04:00
Dr. Stephen Henson
231efb9365 make update
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-09-03 18:37:27 +01:00
Dr. Stephen Henson
d95466931d PBE lookup test
Add test to check PBE lookups: these can fail if the PBE table is not
correctly orders. Add to "make test".

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-09-03 18:37:27 +01:00
Rich Salz
3a3cb629d9 Check OPENSSL_gmtime_diff
It's test code that only runs on 64bit time_t machines.
Move it to a standalone test/gmdifftest

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-09-02 23:03:43 -04:00
Rich Salz
b51bce9420 Add and use OPENSSL_zalloc
There are many places (nearly 50) where we malloc and then memset.
Add an OPENSSL_zalloc routine to encapsulate that.
(Missed one conversion; thanks Richard)
Also fixes GH328

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-09-02 22:05:37 -04:00
Dr. Stephen Henson
cf170f558b Extend ciphersuite test coverage.
Add support for testing ECDSA and DSA ciphersuites.

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-09-02 21:23:12 +01:00
Dr. Stephen Henson
6a096889d7 Update ssltest certificate handling.
Use SSL_CONF for certificate handling is ssltest.c, this changes the
behaviour slightly: the -cert and -key options are no longer recognised
and a default certificate file is not used.

This change means that -s_cert and -c_cert can be used mode than once
to support use of multiple certificates.

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-09-02 21:22:44 +01:00
Dr. Stephen Henson
cb0585c2cb Create DSA and ECDSA certificates.
If supported create DSA and ECDSA certificates and test them.

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-09-02 21:22:44 +01:00
Emilia Kasper
25d6b3401c RT 3493: fix RSA test
- Pass in the right ciphertext length to ensure we're indeed testing
  ciphertext corruption (and not truncation).
- Only test one mutation per byte to not make the test too slow.
- Add a separate test for truncated ciphertexts.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-09-01 20:01:24 +02:00
Emilia Kasper
a9009e518c BN_mod_exp_mont_consttime: check for zero modulus.
Don't dereference |d| when |top| is zero. Also test that various BIGNUM methods behave correctly on zero/even inputs.

Follow-up to b11980d79a

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-08-31 19:25:59 +02:00
Emilia Kasper
4d04226c2e Fix spurious bntest failures.
BN_bntest_rand generates a single-word zero BIGNUM with quite a large probability.

A zero BIGNUM in turn will end up having a NULL |d|-buffer, which we shouldn't dereference without checking.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-08-31 16:31:45 +02:00
Alessandro Ghedini
55500ea7c4 GH354: Memory leak fixes
Fix more potential leaks in X509_verify_cert()
Fix memory leak in ClientHello test
Fix memory leak in gost2814789 test
Fix potential memory leak in PKCS7_verify()
Fix potential memory leaks in X509_add1_reject_object()
Refactor to use "goto err" in cleanup.

Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-08-28 11:18:04 -04:00
Emilia Kasper
ec30e8566e PACKET: add methods for reading length-prefixed TLS vectors.
Rewrite ssl3_get_client_hello to use the new methods.

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-08-26 13:25:48 +02:00
Matt Caswell
ddcc5e5b60 Add NewSessionTicket test suite
Add a set of tests for checking that NewSessionTicket messages are
behaving as expected.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-08-26 10:38:02 +01:00
Dr. Stephen Henson
80eab79de0 More test cases.
Add DSA tests.

Add tests to verify signatures against public keys. This will also check
that a public key is read in correctly.

Reviewed-by: Ben Laurie <ben@openssl.org>
2015-08-24 15:12:52 +01:00
Richard Levitte
b3a231db49 Use -I to add to @INC, and use -w to produce warnings
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-08-13 22:05:25 +02:00
Matt Caswell
bc6616a434 Enhance PACKET readability
Enhance the PACKET code readability, and fix a stale comment. Thanks
to Ben Kaduk (bkaduk@akamai.com) for pointing this out.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-08-13 20:34:51 +01:00
Richard Levitte
c0cbb4c19b Use dynamic engine for libssl test harness
Use a dynamic engine for ossltest engine so that we can build it without
subsequently deploying it during install. We do not want people accidentally
using this engine.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-08-11 20:27:46 +01:00
Matt Caswell
c2a34c58f5 Add a test for 0 p value in anon DH SKE
When using an anon DH ciphersuite a client should reject a 0 value for p.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-08-11 20:27:46 +01:00
Matt Caswell
011467ee55 Add some libssl tests
Two tests are added: one is a simple version tolerance test; the second is
a test to ensure that OpenSSL operates correctly in the case of a zero
length extensions block. The latter was broken inadvertently (now fixed)
and it would have been helpful to have a test case for it.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-08-11 20:27:46 +01:00
Adam Eijdenberg
e23a3fc8e3 Fix clang uninitialized variable warning.
We could just initialize it, but to be consistent with the rest of the file
it seemed to make more sense to just drop.

Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-08-06 22:45:29 +01:00
Matt Caswell
04fe876b56 Revert "Fix uninitalised warning."
This reverts commit 704563f04a.

Reverting in favour of the next commit which removes the underlying cause
of the warning.

Reviewed-by: Ben Laurie <ben@openssl.org>
2015-08-06 22:44:29 +01:00
Ben Laurie
704563f04a Fix uninitalised warning.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-08-06 21:32:58 +01:00
Matt Caswell
44128847e8 Fix a bug in the new PACKET implementation
Some of the PACKET functions were returning incorrect data. An unfortunate
choice of test data in the unit test was masking the failure.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-08-04 13:06:58 +01:00
Matt Caswell
6fc2ef20a9 PACKET unit tests
Add some unit tests for the new PACKET API

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-08-03 11:01:42 +01:00
Matt Caswell
7e729bb5a3 Add initial packet parsing code
Provide more robust (inline) functions to replace n2s, n2l, etc. These
functions do the same thing as the previous macros, but also keep track
of the amount of data remaining and return an error if we try to read more
data than we've got.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-08-03 11:01:42 +01:00
Matt Caswell
3b848c642c Add test for SSL_set_session_ticket_ext
The function SSL_set_session_ticket_ext sets the ticket data to be sent in
the ClientHello. This is useful for EAP-FAST. This commit adds a test to
ensure that when this function is called the expected ticket data actually
appears in the ClientHello.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-07-27 16:52:00 +01:00
Rich Salz
0bc2f36555 Remove obsolete key formats.
Remove support for RSA_NET and Netscape key format (-keyform n).

Also removed documentation of SGC.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-07-16 01:06:48 -04:00
Matt Caswell
040b93353e Apply some missing updates from previous commits
Reviewed-by: Stephen Henson <steve@openssl.org>
2015-07-09 09:45:22 +01:00
Matt Caswell
593e9c638c Add test for CVE-2015-1793
This adds a test for CVE-2015-1793. This adds a new test file
verify_extra_test.c, which could form the basis for additional
verification tests.

Reviewed-by: Stephen Henson <steve@openssl.org>
2015-07-07 21:57:11 +01:00
Dr. Stephen Henson
5fced2395d Check for errors with SRP
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-29 19:20:23 +01:00
Rich Salz
74924dcb38 More secure storage of key material.
Add secure heap for storage of private keys (when possible).
Add BIO_s_secmem(), CBIGNUM, etc.
Add BIO_CTX_secure_new so all BIGNUM's in the context are secure.
Contributed by Akamai Technologies under the Corporate CLA.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-06-23 17:09:35 -04:00
Russell Webb
2d540402aa RT3856: Fix memory leaks in test code
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-23 07:59:15 -04:00
Rich Salz
cc3f3fc2b1 RT3907-fix
Typo in local variable name; introduced by previous fix.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-06-22 20:49:21 -04:00
Rich Salz
75ba5c58c6 RT3907: avoid "local" in testssl script
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-06-22 15:49:33 -04:00
Matt Caswell
4b464e7b46 Fix ABI break with HMAC
Recent HMAC changes broke ABI compatibility due to a new field in HMAC_CTX.
This backs that change out, and does it a different way.

Thanks to Timo Teras for the concept.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-06-12 13:16:09 +01:00
Matt Caswell
68886be7e2 EC_POINT_is_on_curve does not return a boolean
The function EC_POINT_is_on_curve does not return a boolean value.
It returns 1 if the point is on the curve, 0 if it is not, and -1
on error. Many usages within OpenSSL were incorrectly using this
function and therefore not correctly handling error conditions.

With thanks to the Open Crypto Audit Project for reporting this issue.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-06-10 10:43:53 +01:00
Richard Levitte
e36c5fc4f5 Make sure test/gost2814789test.c can see configuration macros
test/gost2814789test.c needs to include openssl/e_os2.h or it wouldn't
see the defined OPENSSL_NO_* macros.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-06-10 02:03:03 +02:00
Richard Levitte
acaff3b797 When making libcrypto from apps or test, make sure to include engines
For librypto to be complete, the stuff in both crypto/ and engines/
have to be built.  Doing 'make test' or 'make apps' from a clean
source tree failed to do so.
Corrected by using the new 'build_libcrypto' in the top Makefile.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-06-10 02:01:49 +02:00
Rich Salz
51b04a6117 No fprintf in the txt_db component
Also removed a source file that isn't built, and moved
another one to test for eventual fixing.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-06-09 12:39:08 -04:00
Richard Levitte
7ea9f90d77 Remove OPENSSL_CONF=/dev/null from tests
Almost two months ago, the warning about non-existing config file was
supressed by setting the environment variable OPENSSL_CONF to /dev/null
everywhere.  Now that this warning is gone, that practice is no longer
needed.

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-29 12:41:50 +02:00
Emilia Kasper
15a06488fc Enable DH tests
In master, the 'dh' command is gone, so use 'dhparam' instead to
determine if we're compiled with DH.

Also, set "@SECLEVEL=1" for the weak DH test, so that it actually
passes.

Reviewed-by: Dr Stephen Henson <steve@openssl.org>
2015-05-27 17:22:56 +02:00
Dr. Stephen Henson
f2e19cb15e make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-26 13:24:59 +01:00
Dr. Stephen Henson
351fe21402 Add PBE tests.
Add support for PKCS#12 and PBKDF2 password based encryption tests. Add
additional test data.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-26 13:04:13 +01:00
Emilia Kasper
e8356e32ae Fix ssltest to use 1024-bit DHE parameters
Also add more ciphersuite test coverage, and a negative test for
512-bit DHE.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 1ee85aab75)
2015-05-26 12:49:26 +02:00
Richard Levitte
0f539dc1a2 Fix the update target and remove duplicate file updates
We had updates of certain header files in both Makefile.org and the
Makefile in the directory the header file lived in.  This is error
prone and also sometimes generates slightly different results (usually
just a comment that differs) depending on which way the update was
done.

This removes the file update targets from the top level Makefile, adds
an update: target in all Makefiles and has it depend on the depend: or
local_depend: targets, whichever is appropriate, so we don't get a
double run through the whole file tree.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-22 18:44:33 +02:00
Dr. Stephen Henson
941fbf711a correction
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-21 12:48:03 +01:00
Emilia Kasper
de57d23729 Only support >= 256-bit elliptic curves with ecdh_auto (server) or by default (client).
Also reorder preferences to prefer prime curves to binary curves, and P-256 to everything else.

The result:

$ openssl s_server -named_curves "auto"

This command will negotiate an ECDHE ciphersuite with P-256:

$ openssl s_client

This command will negotiate P-384:

$ openssl s_client -curves "P-384"

This command will not negotiate ECDHE because P-224 is disabled with "auto":

$ openssl s_client -curves "P-224"

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-20 15:47:51 +02:00
Dr. Stephen Henson
5a1d250906 make update
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-05-20 14:01:19 +01:00
Dr. Stephen Henson
3b53e18a4f Add scrypt tests.
Add scrypt test support to evp_test and add test values from
from draft-josefsson-scrypt-kdf-03.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-20 12:21:31 +01:00
Matt Caswell
a3680c8f9c Version negotiation rewrite cleanup
Following the version negotiation rewrite all of the previous code that was
dedicated to version negotiation can now be deleted - all six source files
of it!!

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-05-16 09:20:38 +01:00
Matt Caswell
32ec41539b Server side version negotiation rewrite
This commit changes the way that we do server side protocol version
negotiation. Previously we had a whole set of code that had an "up front"
state machine dedicated to the negotiating the protocol version. This adds
significant complexity to the state machine. Historically the justification
for doing this was the support of SSLv2 which works quite differently to
SSLv3+. However, we have now removed support for SSLv2 so there is little
reason to maintain this complexity.

The one slight difficulty is that, although we no longer support SSLv2, we
do still support an SSLv3+ ClientHello in an SSLv2 backward compatible
ClientHello format. This is generally only used by legacy clients. This
commit adds support within the SSLv3 code for these legacy format
ClientHellos.

Server side version negotiation now works in much the same was as DTLS,
i.e. we introduce the concept of TLS_ANY_VERSION. If s->version is set to
that then when a ClientHello is received it will work out the most
appropriate version to respond with. Also, SSLv23_method and
SSLv23_server_method have been replaced with TLS_method and
TLS_server_method respectively. The old SSLv23* names still exist as
macros pointing at the new name, although they are deprecated.

Subsequent commits will look at client side version negotiation, as well of
removal of the old s23* code.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-05-16 09:19:56 +01:00
Richard Levitte
7a05eaac5e Adjust unixly mk1mf after introduction of tkey
Added depencies on the public variants of some keys in test to Makefile.
Added the newly introduced key files from test/ in the list of files
to copy in util/pl/unix.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-14 15:55:59 +02:00
Richard Levitte
c40dba984a make depend
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-05-14 15:14:25 +02:00
Richard Levitte
6857079791 Identify and move OpenSSL internal header files
There are header files in crypto/ that are used by the rest of
OpenSSL.  Move those to include/internal and adapt the affected source
code, Makefiles and scripts.

The header files that got moved are:

crypto/constant_time_locl.h
crypto/o_dir.h
crypto/o_str.h

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-05-14 15:13:49 +02:00
Matt Caswell
e36827f6d1 Remove remaining Kerberos references
Following on from the removal of libcrypto and libssl support for Kerberos
this commit removes all remaining references to Kerberos.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-13 15:08:10 +01:00
Matt Caswell
55a9a16f1c Remove Kerberos support from libssl
Remove RFC2712 Kerberos support from libssl. This code and the associated
standard is no longer considered fit-for-purpose.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-13 15:07:57 +01:00
Rich Salz
9a555706a3 Make COMP_CTX and COMP_METHOD opaque
Since COMP_METHOD is now defined in comp_lcl.h, it is no
longer possible to create new TLS compression methods without
using the OpenSSL source.  Only ZLIB is supported by default.
Also, since the types are opaque, #ifdef guards to use "char *"
instead of the real type aren't necessary.

The changes are actually minor.  Adding missing copyright to some
files makes the diff misleadingly big.

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-05-12 10:24:48 -04:00
Rich Salz
75ebbd9aa4 Use p==NULL not !p (in if statements, mainly)
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-11 10:06:38 -04:00
Rich Salz
86885c2895 Use "==0" instead of "!strcmp" etc
For the various string-compare routines (strcmp, strcasecmp, str.*cmp)
use "strcmp()==0" instead of "!strcmp()"

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-06 22:37:53 -04:00
Richard Levitte
2455eaf43f Add a -CAserial argument for signing the user cert request
This is just to make sure that option is tested on a Unix build.  This
option is already present in ms/testss.bat, so it's an easy steal.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-06 19:43:59 +02:00
Gunnar Kudrjavets
4c9b0a0314 Initialize potentially uninitialized local variables
Compiling OpenSSL code with MSVC and /W4 results in a number of warnings.
One category of warnings is particularly interesting - C4701 (potentially
uninitialized local variable 'name' used). This warning pretty much means
that there's a code path which results in uninitialized variables being used
or returned. Depending on compiler, its options, OS, values in registers
and/or stack, the results can be nondeterministic. Cases like this are very
hard to debug so it's rational to fix these issues.

This patch contains a set of trivial fixes for all the C4701 warnings (just
initializing variables to 0 or NULL or appropriate error code) to make sure
that deterministic values will be returned from all the execution paths.

RT#3835

Signed-off-by: Matt Caswell <matt@openssl.org>

Matt's note: All of these appear to be bogus warnings, i.e. there isn't
actually a code path where an unitialised variable could be used - its just
that the compiler hasn't been able to figure that out from the logic. So
this commit is just about silencing spurious warnings.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-06 13:06:46 +01:00
Rich Salz
16f8d4ebf0 memset, memcpy, sizeof consistency fixes
Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr)
for memset and memcpy.  Remove needless casts for those functions.
For memset, replace alternative forms of zero with 0.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-05 22:18:59 -04:00
Rich Salz
45ddce21fa Remove the fake RLE compression method.
RLE is a no-op only for testing.  Remove it.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-04 15:14:26 -04:00
Rich Salz
b4faea50c3 Use safer sizeof variant in malloc
For a local variable:
        TYPE *p;
Allocations like this are "risky":
        p = OPENSSL_malloc(sizeof(TYPE));
if the type of p changes, and the malloc call isn't updated, you
could get memory corruption.  Instead do this:
        p = OPENSSL_malloc(sizeof(*p));
Also fixed a few memset() calls that I noticed while doing this.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-04 15:00:13 -04:00
Dr. Stephen Henson
bdcb1a2cf5 more OSSL_NELEM cases
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-04 13:03:49 +01:00
Rich Salz
25aaa98aa2 free NULL cleanup -- coda
After the finale, the "real" final part. :)  Do a recursive grep with
"-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are
an "if NULL" check that can be removed.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-01 14:37:16 -04:00
Ben Laurie
8b68b7e97b Use BN_ULONG format.
Reviewed-by: Andy Polyakov
2015-05-01 17:46:17 +01:00
Rich Salz
efa7dd6444 free NULL cleanup 11
Don't check for NULL before calling free functions. This gets:
        ERR_STATE_free
        ENGINE_free
        DSO_free
        CMAC_CTX_free
        COMP_CTX_free
        CONF_free
        NCONF_free NCONF_free_data _CONF_free_data
        A sk_free use within OBJ_sigid_free
        TS_TST_INFO_free (rest of TS_ API was okay)
        Doc update for UI_free (all uses were fine)
        X509V3_conf_free
        X509V3_section_free
        X509V3_string_free

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-01 10:15:18 -04:00
Rich Salz
b548a1f11c free null cleanup finale
Don't check for NULL before calling OPENSSL_free

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-01 10:02:07 -04:00
Rich Salz
23a1d5e97c free NULL cleanup 7
This gets BN_.*free:
    BN_BLINDING_free BN_CTX_free BN_FLG_FREE BN_GENCB_free
    BN_MONT_CTX_free BN_RECP_CTX_free BN_clear_free BN_free BUF_MEM_free

Also fix a call to DSA_SIG_free to ccgost engine and remove some #ifdef'd
dead code in engines/e_ubsec.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30 21:37:06 -04:00
Rich Salz
b196e7d936 remove malloc casts
Following ANSI C rules, remove the casts from calls to
OPENSSL_malloc and OPENSSL_realloc.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-28 15:28:14 -04:00
Rich Salz
2f58faad66 Remove the special list-xxxx commands
There's a new "list" command, which takes a flag to say what
to list.  Removing the old hacky commands.  Re-ordered some
functions to remove some needless declarations.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-26 10:31:48 -04:00
Rich Salz
3dca57f8ca ssltest output cleanup
Make only errors go to stderr.
Print count and size before the loop, so you can see it's an 838K
message that will take a few moments.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-21 15:52:51 -04:00
Richard Levitte
a169a93a6f test/Makefile dclean cleans out a few files too many.
The files removed are the ones that were symbolic links before, but
aren't now, so we should not remove them any more.

Reviewed-by: Stephen Henson <steve@openssl.org>
2015-04-21 21:16:54 +02:00
Rich Salz
fec669388c Use 2K RSA and SHA256 in tests
Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-04-20 07:23:04 -04:00
Viktor Dukhovni
323daa74fc SunOS non-posix shells do not grok export name=value
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-17 01:33:51 -04:00
Viktor Dukhovni
61986d32f3 Code style: space after 'if'
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-16 13:44:59 -04:00
Rich Salz
e0e920b1a0 free NULL cleanup 9
Ongoing work to skip NULL check before calling free routine.  This gets:
    ecp_nistz256_pre_comp_free nistp224_pre_comp_free nistp256_pre_comp_free
    nistp521_pre_comp_free PKCS7_free PKCS7_RECIP_INFO_free
    PKCS7_SIGNER_INFO_free sk_PKCS7_pop_free PKCS8_PRIV_KEY_INFO_free
    PKCS12_free PKCS12_SAFEBAG_free PKCS12_free sk_PKCS12_SAFEBAG_pop_free
    SSL_CONF_CTX_free SSL_CTX_free SSL_SESSION_free SSL_free ssl_cert_free
    ssl_sess_cert_free

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-04-11 16:32:54 -04:00
Rich Salz
62adbcee39 free NULL cleanup 10
Avoid checking for NULL before calling free functions.  This gets
ssl.*free:
    ssl_sess_cert_free ssl_free ssl_excert_free ssl_cert_free
    SSL_free SSL_SRP_CTX_free SSL_SESSION_free SSL_CTX_free
    SSL_CTX_SRP_CTX_free SSL_CONF_CTX_free

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-04-11 10:22:36 -04:00
Dr. Stephen Henson
9fdbc9df76 Fix ECDH detection, add ECDH keyid test.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-10 18:51:52 +01:00
Viktor Dukhovni
34b0a927ab Polish shell script to avoid needless complexity.
No need for here documents, just use "yes" or </dev/null.
No need for "|| exit 1" clauses, just use "set -e".

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-10 12:28:07 -04:00
Rich Salz
e71cecd551 fix to "test script cleanup"
Fix commit 30f54ad295 which used
non-portable syntax for checking exit status.

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-10 11:40:25 -04:00
Rich Salz
30f54ad295 test script cleanup
Removed commented-out tests

Standardize on doing
        cmd ... || exit 1
instead of
        cmd ...
        if [ $? != 0] ; then
           exit 1
        fi
where that if statement has ben one, three, or four lines, variously.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-10 10:06:17 -04:00
Rich Salz
be739b0cc0 Drop CA.sh for CA.pl
Remove CA.sh script and use CA.pl for testing, etc.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-08 14:07:39 -04:00
Rich Salz
5adac91eab consistent test-start logging
Output a consistent "start" marker for each test.
Remove "2>/dev/null" from Makefile command lines.
Add OPENSSL_CONFIG=/dev/null for places where it's needed, in
order to suppress a warning message from the openssl CLI.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-08 12:28:15 -04:00
Rich Salz
22ebaae08c Fewer newlines in comp method output
Print "supported compression methods" all on one line.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-04-02 15:58:10 -04:00
Emilia Kasper
11305038e9 make update
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-01 22:31:28 +02:00
Richard Levitte
a80e33b991 Remove EXHEADER, TEST, APPS, links:, install: and uninstall: where relevant
With no more symlinks, there's no need for those variables, or the links
target.  This also goes for all install: and uninstall: targets that do
nothing but copy $(EXHEADER) files, since that's now taken care of by the
top Makefile.

Also, removed METHTEST from test/Makefile.  It looks like an old test that's
forgotten...

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-03-31 20:16:01 +02:00
Richard Levitte
dee502be89 Stop symlinking, move files to intended directory
Rather than making include/openssl/foo.h a symlink to
crypto/foo/foo.h, this change moves the file to include/openssl/foo.h
once and for all.

Likewise, move crypto/foo/footest.c to test/footest.c, instead of
symlinking it there.

Originally-by: Geoff Thorpe <geoff@openssl.org>

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-03-31 20:16:01 +02:00
Dr. Stephen Henson
79a578b902 Add private/public key conversion tests
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-03-29 03:26:12 +01:00
Matt Caswell
266483d2f5 RAND_bytes updates
Ensure RAND_bytes return value is checked correctly, and that we no longer
use RAND_pseudo_bytes.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-25 12:38:07 +00:00
Dr. Stephen Henson
86d20cb6fd make depend
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-03-24 12:05:05 +00:00
Matt Caswell
3c381e5423 Add DTLS tests to make test
Updated test/testssl script to include the new DTLS capability in ssltest.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-03-20 12:00:56 +00:00
Richard Levitte
cdca82dcde Catch up the VMS build.
crypto/crypto-lib.com - catch up with the OCSP changes
test/maketest.com and test/tests.com - catch up with the addition of test_evp_extra

Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-03-05 18:20:06 +01:00
Matt Caswell
71ea6b4836 Import evp_test.c from BoringSSL. Unfortunately we already have a file
called evp_test.c, so I have called this one evp_extra_test.c

Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-02-25 17:12:53 +00:00
Rich Salz
05c3234ddf ui_compat cleanup; makefiles and vms
Remove ui_compat.h from Makefile dependencies
And from two VMS build/install scripts.

Reviewed-by: Matt Caswell <matt@openssl.org>
2015-02-06 16:49:17 -05:00
Dr. Stephen Henson
5496cd3e5d More unused FIPS module code.
Remove fips_algvs.c

Remove unused fips module build code from Configure and Makefile.org
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-02-04 18:54:36 +00:00
Rich Salz
24956ca00f Remove old DES API
Includes VMS fixes from Richard.
Includes Kurt's destest fixes (RT 1290).
Closes tickets 1290 and 1291

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-02-02 18:46:01 -05:00
Andy Polyakov
5da05a26f2 cms-test.pl: "localize" /dev/null even further [as follow-up to VMS].
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-02-02 15:27:07 +01:00
Richard Levitte
4938ebc406 Since SHA0 was completely removed, also remove the related test
Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-01-30 15:14:48 +01:00
Richard Levitte
e00ab250c8 VMS exit codes weren't handled well enough and were unclear
Making a specific variable $failure_code and a bit of commenting in the
VMS section should help clear things up.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-01-30 14:44:36 +01:00
Richard Levitte
36ed7adfbc VMS adjustments:
test/cms-test.pl adjusted to handle NL: instead of /dev/null on VMS

Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-01-30 14:44:18 +01:00
Richard Levitte
132536f96e VMS adjustments:
catch up with the Unix build.
A number of new tests, among others test/tocsp.com
Define INTERNAL in ssl/ssl-lib.com to allow for '#include "internal/foo.h"'

Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-01-30 14:43:57 +01:00
Matt Caswell
35a1cc90bc More comment realignment
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 09:20:10 +00:00
Matt Caswell
0f113f3ee4 Run util/openssl-format-source -v -c .
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22 09:20:09 +00:00
Rich Salz
9405a9a2e1 RT478: Add uninstall make target
Add INSTALLDIRS variable, list of directories where things get
installed. Change install_html_docs to use perl mkdir-p script.

Add uninstall, uninstall_sw, uninstall_docs, uninstall_html_docs
to Makefile.org.  The actions of these targets were figured out
by "inverting" the install target.

Recurse into subdirs to do uninstall as needed.  Added uninstall
targets whose actions were similarly figured out by "inverting"
the install target.

Also remove some 'space before tab' complaints in Makefile.org

Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-12 10:28:05 -05:00
Tim Hudson
1d97c84351 mark all block comments that need format preserving so that
indent will not alter them when reformatting comments

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2014-12-30 22:10:26 +00:00
Matt Caswell
6385043fa1 make update following changes to default config settings
Reviewed-by: Rich Salz <rsalz@openssl.org>
2014-12-18 19:57:22 +00:00
Matt Caswell
ad500fdc49 Rename gost2814789t.c to gost2814789test.c. The old name caused problems
for dummytest if gost is compiled out, since the name of the test is not
standard (dummytest segfaults). Also the old name caused problems for git
because the executable was not in the .gitignore file

Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-12-16 14:14:03 +00:00
Matt Caswell
af6e2d51bf Add OPENSSL_NO_ECDH guards
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-12-16 14:13:45 +00:00
Matt Caswell
fd0ba77717 make update
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-11 23:52:47 +00:00
Matt Caswell
85bcf27ccc Prepare for bn opaquify. Implement internal helper functions.
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-08 21:40:12 +00:00
Dr. Stephen Henson
cc2f1045d1 make depend
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-08 13:25:38 +00:00
Dr. Stephen Henson
a42366a406 Remove fips utility build rules from test/Makefile
The fips test utilities are only build if an FIPS module is being
built from source. As this isn't done in master these are redundant.
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-08 13:23:48 +00:00
Kurt Roeckx
45f55f6a5b Remove SSLv2 support
The only support for SSLv2 left is receiving a SSLv2 compatible client hello.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2014-12-04 11:55:03 +01:00
Rich Salz
8cfe08b4ec Remove all .cvsignore files
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-11-28 18:32:43 -05:00
Matt Caswell
d253c9cd30 Fixed cms-test.pl for no-ec2m
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2014-11-18 13:01:45 +00:00
Emilia Kasper
51b7be8d5f make update
Sync libeay.num from 1.0.2

Reviewed-by: Dr Stephen Henson <steve@openssl.org>
2014-09-23 18:37:23 +02:00
Emilia Kasper
2f32016bb9 make update
Reviewed-by: Dr Stephen Henson <steve@openssl.org>
2014-09-05 17:19:36 +02:00
Emilia Kasper
5a3d21c058 Constant-time utilities
Pull constant-time methods out to a separate header, add tests.

Reviewed-by: Bodo Moeller <bodo@openssl.org>
2014-08-28 15:48:45 +02:00
Emilia Kasper
f0ca9ccaef make depend
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2014-08-14 15:24:58 +02:00
Dr. Stephen Henson
562fd0d883 Test SRP authentication ciphersuites.
Reviewed-by: Matt Caswell <matt@openssl.org>
2014-08-09 13:21:29 +01:00
Dr. Stephen Henson
8e55e6de45 Don't call setenv in gost2814789t.c
The call to setenv in gost2814789t.c is not portable and may
not reflect the location of the GOST ENGINE on all platforms anyway.
Instead set OPENSSL_ENGINES in test/Makefile
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
2014-07-24 18:18:54 +01:00
Dr. Stephen Henson
841072ef65 Add test header, sync ordinals with 1.0.2
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-20 20:51:06 +01:00
Mike Bland
b2e50bcd0e Check the test registry size during add_test()
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-19 19:24:36 +01:00
Mike Bland
6017a55143 Use testutil registry in heartbeat_test
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-19 19:24:35 +01:00
Mike Bland
5e3de8e609 test/testutil.c test registry functions.
These help standardize the structure of main() and result reporting.

Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-19 19:24:35 +01:00
Ben Laurie
e3ba6a5f83 Make depend. 2014-06-30 16:03:29 +01:00
Andy Polyakov
77a27a5066 Enable multi-block support by default. 2014-06-11 20:40:51 +02:00
Mike Bland
3ead9f3798 Create test/testutil.h for unit test helper macros
Defines SETUP_TEST_FIXTURE and EXECUTE_TEST, and updates ssl/heartbeat_test.c
using these macros. SETUP_TEST_FIXTURE makes use of the new TEST_CASE_NAME
macro, defined to use __func__ or __FUNCTION__ on platforms that support those
symbols, or to use the file name and line number otherwise. This should fix
several reported build problems related to lack of C99 support.
2014-06-10 19:20:25 +01:00
Kurt Roeckx
95fe635d90 Link heartbeat_test with the static version of the libraries
It's using an internal API that that might not be available in the shared
library.
2014-06-09 00:10:24 +01:00
Peter Mosmans
028bac0670 Fix for test_bn regular expression to work on Windows using MSYS. PR#3346 2014-05-27 23:29:32 +01:00
Christian Heimes
56431240ae add test case to makefiles 2014-05-25 17:35:04 +01:00
Ben Laurie
f41231d62a Make it build/run. 2014-05-19 17:39:41 +01:00
Mike Bland
6af080acaf Unit/regression test for TLS heartbeats.
Regression test against CVE-2014-0160 (Heartbleed).

More info: http://mike-bland.com/tags/heartbleed.html
2014-05-19 17:39:41 +01:00
Andy Polyakov
687403fb24 test/Makefile: allow emulated test (e.g. under wine).
Submitted by: Roumen Petrov
2014-03-06 14:08:02 +01:00
Dr. Stephen Henson
4cfeb00be9 make depend 2014-02-19 20:09:08 +00:00
Trevor Perrin
c655f40ed2 Require ServerInfo PEMs to be named "BEGIN SERVERINFO FOR"... 2013-09-13 19:32:55 -07:00
Veres Lajos
478b50cf67 misspellings fixes by https://github.com/vlajos/misspell_fixer 2013-09-05 21:39:42 +01:00
Ben Laurie
d5605699a1 Correctly test for no-ec. 2013-08-21 04:21:57 +01:00
Dr. Stephen Henson
b85f8afe37 Don't run ECDH CMS tests if EC disabled. 2013-08-17 17:41:14 +01:00
Dr. Stephen Henson
bbc098ffb3 Add X9.42 DH test. 2013-08-05 16:23:22 +01:00
Dr. Stephen Henson
75787fd833 Add X9.42 DH certificate to S/MIME test 2013-08-05 16:23:22 +01:00
Adam Langley
a898936218 Add tests for ALPN functionality.
Conflicts:
	ssl/ssltest.c
2013-07-22 15:47:48 +01:00
Dr. Stephen Henson
584ac22110 Make ecdsatest work with nonces.
Update ecdsatest to use ECDSA_sign_setup and ECDSA_sign_ex, this
avoids the nonce generation which would otherwise break the test.

Reinstate ecdsatest.
2013-07-19 14:11:43 +01:00
Dr. Stephen Henson
527c898ce8 Temporarily disable ECDSA test.
Disable ECDSA test temporarily: it is incompatible with ECDSA nonces.
2013-07-19 13:46:48 +01:00
Dr. Stephen Henson
5cdc25a754 New CMS tests.
Add some ECDH CMS tests.
2013-07-17 21:45:01 +01:00
Dr. Stephen Henson
a0957d5505 Scripts to recreate S/MIME test certificates.
Add a script to generate keys and certificates for the S/MIME and CMS
tests.

Update certificates and add EC examples.
2013-07-17 21:45:01 +01:00
Dr. Stephen Henson
32b18e0338 Add new CMS tests.
Add new tests to cms-test.pl covering PSS and OAEP.
2013-06-21 23:43:06 +01:00
Trevor
9cd50f738f Cleanup of custom extension stuff.
serverinfo rejects non-empty extensions.

Omit extension if no relevant serverinfo data.

Improve error-handling in serverinfo callback.

Cosmetic cleanups.

s_client documentation.

s_server documentation.

SSL_CTX_serverinfo documentation.

Cleaup -1 and NULL callback handling for custom extensions, add tests.

Cleanup ssl_rsa.c serverinfo code.

Whitespace cleanup.

Improve comments in ssl.h for serverinfo.

Whitespace.

Cosmetic cleanup.

Reject non-zero-len serverinfo extensions.

Whitespace.

Make it build.
2013-06-18 16:13:08 +01:00
Trevor
a398f821fa Add support for arbitrary TLS extensions.
Contributed by Trevor Perrin.
2013-06-12 17:01:13 +01:00
Ben Laurie
92584bd3d5 Tests pass! 2013-05-05 16:15:34 +01:00
Ben Laurie
29d422e2a0 Make sure all tests are actually run, plus some fixups for things that
turn out to be made somewhere by existing Makefiles.
2013-04-07 16:52:54 +01:00
Ben Laurie
ea4507ee1c Fix test_ss. 2013-04-06 15:13:12 +01:00
Ben Laurie
3426b8ed3f Avoid collisions. 2013-04-06 15:13:12 +01:00
Ben Laurie
f5cd3db541 Make session ID test work. 2013-04-06 15:13:12 +01:00
Ben Laurie
15e5f592c1 Make S/MIME test work. 2013-04-06 15:13:11 +01:00
Ben Laurie
509a83dd36 Make RSA test work. 2013-04-06 15:13:11 +01:00
Ben Laurie
8c7f5f3bec Make PKCS#7 test work. 2013-04-06 15:13:11 +01:00
Ben Laurie
3675fb882c More progress towards working tests. 2013-04-06 15:13:11 +01:00
Ben Laurie
3b4d86bff5 Get closer to a working single Makefile with test support. 2013-04-06 15:11:11 +01:00
Andy Polyakov
c5d975a743 Add support for SPARC T4 DES opcode. 2013-03-31 14:32:05 +02:00
Ben Laurie
975dfb1c6c make depend. 2013-02-21 18:17:38 +00:00
Adam Langley
32620fe9d1 Fix for EXP-RC2-CBC-MD5
MD5 should use little endian order. Fortunately the only ciphersuite
affected is EXP-RC2-CBC-MD5 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) which
is a rarely used export grade ciphersuite.
(cherry picked from commit f306b87d76)
2013-02-06 16:11:31 +00:00
Ben Laurie
6f0a93b069 Merge branch 'master' of openssl.net:openssl 2013-01-19 17:35:41 +00:00
Andy Polyakov
26906f2d93 engines/ccgost: add test case.
Submitted by: Serguei Leontiev
PR: 2821
2013-01-19 17:56:56 +01:00
Ben Laurie
a6bbbf2ff5 Make "make depend" work on MacOS out of the box. 2013-01-19 14:14:30 +00:00
Dr. Stephen Henson
48b0951681 Fix tocsp: we don't need -trust_other any more.
Fix typo.
2012-12-21 18:32:33 +00:00
Dr. Stephen Henson
032b33059e Update test OCSP script "tocsp" to use shell functions and to use
December 17th as check date to avoid certificate expiry errors.
2012-12-20 18:48:11 +00:00
Ben Laurie
fefc111a2a Make openssl verify return errors. 2012-12-11 16:05:14 +00:00
Ben Laurie
ec40e5ff42 Tabification. Remove accidental duplication. 2012-12-10 16:52:17 +00:00
Ben Laurie
30c278aa6b Fix OCSP checking. 2012-12-07 18:47:47 +00:00
Dr. Stephen Henson
98a7edf9f0 make depend 2012-11-19 13:18:09 +00:00
Dr. Stephen Henson
d88926f181 PR: 2909
Contributed by: Florian Weimer <fweimer@redhat.com>

Fixes to X509 hostname and email address checking. Wildcard matching support.
New test program and manual page.
2012-11-18 15:13:55 +00:00
Andy Polyakov
536a16435b util/fipslink.pl: further adjustments. 2012-10-27 23:36:43 +00:00
Andy Polyakov
cfb399ad55 test_t4: cover even Camellia. 2012-10-25 12:10:44 +00:00
Andy Polyakov
c5f6da54fc Add SPARC T4 AES support.
Submitted by: David Miller
2012-10-06 18:08:09 +00:00
Andy Polyakov
799379215e test_aesni: harmonize with AES-NI support at EVP layer. 2012-07-15 13:38:51 +00:00
Ben Laurie
71fa451343 Version skew reduction: trivia (I hope). 2012-06-03 22:00:21 +00:00
Dr. Stephen Henson
84b6e277d4 make update 2011-12-27 14:46:03 +00:00
Dr. Stephen Henson
be16cc23c6 detect and use older PKITS data 2011-12-11 16:39:25 +00:00
Dr. Stephen Henson
3bfe583b8d add commented out option to allow use of older PKITS data 2011-12-10 00:49:55 +00:00
Dr. Stephen Henson
69569dd168 Add support for memory leak checking in fips_algvs.
Fix many memory leaks in algorithm test utilities.
2011-11-02 19:17:30 +00:00
Dr. Stephen Henson
3ec9dceb15 Add fips_algvs utility (from FIPS 2.0 stable branch). 2011-11-02 00:57:22 +00:00
Bodo Möller
f391750205 "make update" (partial) 2011-10-19 15:29:14 +00:00
Bodo Möller
8bfc6479a8 use -no_ecdhe when using -no_dhe 2011-10-13 15:07:08 +00:00
Dr. Stephen Henson
35882b60d8 increase test RSA key size to 1024 bits 2011-10-12 21:55:03 +00:00
Bodo Möller
2c472780c0 oops 2011-09-05 13:43:56 +00:00
Bodo Möller
c519e89f5c Fix session handling. 2011-09-05 13:36:23 +00:00
Bodo Möller
ae53b299fa make update 2011-09-05 09:46:15 +00:00
Andy Polyakov
9c437e2fad cms-test.pl: make it work with not-so-latest perl. 2011-05-16 18:11:45 +00:00
Dr. Stephen Henson
79837e8c10 Update .cvsignore 2011-03-25 16:41:11 +00:00
Richard Levitte
3a660e7364 Corrections to the VMS build system.
Submitted by Steven M. Schweda <sms@antinode.info>
2011-03-25 16:20:35 +00:00
Richard Levitte
4ec3e8ca51 For VMS, implement the possibility to choose 64-bit pointers with
different options:
"64"		The build system will choose /POINTER_SIZE=64=ARGV if
		the compiler supports it, otherwise /POINTER_SIZE=64.
"64="		The build system will force /POINTER_SIZE=64.
"64=ARGV"	The build system will force /POINTER_SIZE=64=ARGV.
2011-03-25 09:40:48 +00:00
Richard Levitte
37942b93af Implement FIPS CMAC.
* fips/fips_test_suite.c, fips/fipsalgtest.pl, test/Makefile: Hook in
  test cases and build test program.
2011-03-24 22:57:52 +00:00
Richard Levitte
487b023f3d make update (1.1.0-dev)
This meant alarger renumbering in util/libeay.num due to symbols
appearing in 1.0.0-stable and 1.0.1-stable.  However, since there's
been no release on this branch yet, it should be harmless.
2011-03-23 00:11:32 +00:00
Richard Levitte
f0d9196237 * apps/makeapps.com: Forgot to end the check for /POINTER_SIZE=64=ARGV
with turning trapping back on.
* test/maketests.com: Do the same check for /POINTER_SIZE=64=ARGV
  here.
* test/clean-test.com: A new script for cleaning up.
2011-03-20 14:02:20 +00:00
Richard Levitte
537c982306 After some adjustments, apply the changes OpenSSL 1.0.0d on OpenVMS
submitted by Steven M. Schweda <sms@antinode.info>
2011-03-19 10:58:14 +00:00
Ben Laurie
edc032b5e3 Add SRP support. 2011-03-12 17:01:19 +00:00
Dr. Stephen Henson
8857b380e2 Add ECDH to validated module. 2011-03-09 23:44:06 +00:00
Dr. Stephen Henson
3c9baf25f1 Update .cvsignore 2011-03-09 14:35:31 +00:00
Dr. Stephen Henson
11e80de3ee New initial DH algorithm test driver. 2011-03-08 19:10:17 +00:00
Dr. Stephen Henson
868f12988c Updates to DRBG: fix bugs in infrastructure. Add initial experimental
algorithm test generator.
2011-03-06 12:35:09 +00:00
Dr. Stephen Henson
b7056b6414 Update dependencies. 2011-02-21 17:51:59 +00:00
Dr. Stephen Henson
e3496215a2 *** empty log message *** 2011-02-21 15:15:58 +00:00
Dr. Stephen Henson
a3654f0586 Include openssl/crypto.h first in several other files so FIPS renaming
is picked up.
2011-02-16 17:25:01 +00:00
Dr. Stephen Henson
fe26d066ff Add ECDSA functionality to fips module. Initial very incomplete version
of algorithm test program.
2011-02-14 17:14:55 +00:00
Dr. Stephen Henson
30b56225cc New "fispcanisteronly" build option: only build fipscanister.o and
associated utilities. This functionality will be used by the validated
tarball.
2011-02-11 19:02:34 +00:00
Dr. Stephen Henson
9dd346c90d Experimental incomplete AES GCM algorithm test program. 2011-02-08 18:15:59 +00:00
Bodo Möller
9d0397e977 make update 2011-02-03 10:17:53 +00:00
Dr. Stephen Henson
54e02a234c update .cvsignore 2011-01-27 13:33:47 +00:00
Dr. Stephen Henson
6f1a3a310c FIPS changes to test/Makefile: rules to build FIPS test applications. 2011-01-26 16:47:51 +00:00
Dr. Stephen Henson
9bafd8f7b3 FIPS_allow_md5() no longer exists and is no longer required 2011-01-26 12:23:58 +00:00