openssl/test
Viktor Dukhovni c0a445a9f2 Suppress DANE TLSA reflection when verification fails
As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa()
are expected to return a negative match depth and nothing else when
verification fails.  However, this only happened when verification
failed during chain construction.  Errors in verification of the
constructed chain did not have the intended effect on these functions.

This commit updates the functions to check for verify_result ==
X509_V_OK, and no longer erases any accumulated match information
when chain construction fails.  Sophisticated developers can, with
care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA
info even when verification fail.  They must of course first check
and save the real error, and restore the original error as quickly
as possible.  Hiding by default seems to be the safer interface.

Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find
matching TLSA records.  Previously reported via X509_V_ERR_CERT_UNTRUSTED.

This also changes the "-brief" output from s_client to include
verification results and TLSA match information.

Mentioned session resumption in code example in SSL_CTX_dane_enable(3).
Also mentioned that depths returned are relative to the verified chain
which is now available via SSL_get0_verified_chain(3).

Added a few more test-cases to danetest, that exercise the new
code.

Resolved thread safety issue in use of static buffer in
X509_verify_cert_error_string().

Fixed long-stating issue in apps/s_cb.c which always sets verify_error
to either X509_V_OK or "chain to long", code elsewhere (e.g.
s_time.c), seems to expect the actual error.  [ The new chain
construction code is expected to correctly generate "chain
too long" errors, so at some point we need to drop the
work-arounds, once SSL_set_verify_depth() is also fixed to
propagate the depth to X509_STORE_CTX reliably. ]

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08 14:46:09 -05:00
..
Attic Remove old testing scripts out of the way. 2015-09-07 16:10:58 +02:00
certs Suppress DANE TLSA reflection when verification fails 2016-02-08 14:46:09 -05:00
ocsp-tests Fix OCSP checking. 2012-12-07 18:47:47 +00:00
recipes Add tests for DTLSv1_listen 2016-02-05 20:47:36 +00:00
smime-certs Add X9.42 DH certificate to S/MIME test 2013-08-05 16:23:22 +01:00
testlib/OpenSSL Use File::Path::rmtree rather than File::Path::remove_tree 2016-02-08 17:03:37 +01:00
asynctest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
bftest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
bntest.c Move more BN internals to bn_lcl.h 2016-01-30 16:54:35 -05:00
build.info dtlsv1listentest includes e_os.h, reflect that in include dirs 2016-02-08 12:05:41 +01:00
CAss.cnf Use 2K RSA and SHA256 in tests 2015-04-20 07:23:04 -04:00
CAssdh.cnf Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
CAssdsa.cnf Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
CAssrsa.cnf Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
casttest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
CAtsa.cnf Use better defaults for TSA. 2015-11-20 13:40:53 +00:00
clean_test.com * apps/makeapps.com: Forgot to end the check for /POINTER_SIZE=64=ARGV 2011-03-20 14:02:20 +00:00
clienthellotest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
cms-examples.pl Use "cont" consistently in cms-examples.pl 2008-05-01 23:30:06 +00:00
constant_time_test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
danetest.c Suppress DANE TLSA reflection when verification fails 2016-02-08 14:46:09 -05:00
danetest.in Suppress DANE TLSA reflection when verification fails 2016-02-08 14:46:09 -05:00
danetest.pem DANE support for X509_verify_cert() 2016-01-07 13:48:59 -05:00
destest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
dhtest.c Add a test for small subgroup attacks on DH/DHE 2016-01-28 14:41:19 +00:00
dsatest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
dtlsv1listentest.c Fix memory leak in dtlsv1listentest 2016-02-06 21:45:24 +01:00
dummytest.c Rename some BUF_xxx to OPENSSL_xxx 2015-12-16 16:14:49 -05:00
ecdhtest.c GH587: Extend ECDH tests to more curves. Add more ECDH KATs. 2016-02-06 10:59:26 -05:00
ecdsatest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
ectest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
enginetest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
evp_extra_test.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
evp_test.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
evptests.txt Use PKCS#8 format EC key so test is skipped with no-ec 2016-02-01 13:18:19 +00:00
exdatatest.c ex_data part 2: doc fixes and CRYPTO_free_ex_index. 2015-12-01 11:48:37 -05:00
exptest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
gmdifftest.c Check OPENSSL_gmtime_diff 2015-09-02 23:03:43 -04:00
heartbeat_test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
hmactest.c RT3095: allow NULL key for single-shot HMAC 2016-02-04 13:01:32 +01:00
ideatest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
igetest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
jpaketest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
Makefile.in Enhance and clear the support of linker flags 2016-02-06 17:57:19 +01:00
maketests.com Catch up the VMS build. 2015-03-05 18:20:06 +01:00
md2test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
md4test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
md5test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
mdc2test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
memleaktest.c Update leak test to check return values. 2016-01-11 02:41:16 +00:00
methtest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
nptest.c Test for NULL ptr == 0 2015-09-04 14:30:38 -04:00
P1ss.cnf Use 2K RSA and SHA256 in tests 2015-04-20 07:23:04 -04:00
P2ss.cnf Use 2K RSA and SHA256 in tests 2015-04-20 07:23:04 -04:00
p5_crpt2_test.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
packettest.c constify PACKET 2016-02-01 16:21:57 +01:00
pbelutest.c PBE lookup test 2015-09-03 18:37:27 +01:00
pkcs7-1.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
pkcs7.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
pkits-test.pl detect and use older PKITS data 2011-12-11 16:39:25 +00:00
r160test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
randtest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
rc2test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
rc4test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
rc5test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
README Add documentation for the new testing framework 2015-09-07 16:10:58 +02:00
rmdtest.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
rsa_test.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
run_tests.pl few typo fixes 2016-01-22 11:47:24 -05:00
secmemtest.c More secure storage of key material. 2015-06-23 17:09:35 -04:00
serverinfo.pem Require ServerInfo PEMs to be named "BEGIN SERVERINFO FOR"... 2013-09-13 19:32:55 -07:00
sha1test.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
sha256t.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
sha512t.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
smcont.txt Add extensive PCKS7 and CMS consistency test script. 2008-03-18 14:37:59 +00:00
srptest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
ssltest.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
Sssdsa.cnf Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
Sssrsa.cnf Import of old SSLeay release: SSLeay 0.9.0b 1998-12-21 10:56:39 +00:00
test.cnf Use 2K RSA and SHA256 in tests 2015-04-20 07:23:04 -04:00
test_aesni test_aesni: harmonize with AES-NI support at EVP layer. 2012-07-15 13:38:51 +00:00
test_padlock Update test/test_padlock script. 2009-04-27 19:04:23 +00:00
test_t4 Add support for SPARC T4 DES opcode. 2013-03-31 14:32:05 +02:00
testcrl.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
testdsa.pem Add private/public key conversion tests 2015-03-29 03:26:12 +01:00
testdsapub.pem Add private/public key conversion tests 2015-03-29 03:26:12 +01:00
testec-p256.pem Add private/public key conversion tests 2015-03-29 03:26:12 +01:00
testecpub-p256.pem Add private/public key conversion tests 2015-03-29 03:26:12 +01:00
testp7.pem Change PKCS#7 test data to take account of removal of 2000-08-25 01:29:41 +00:00
testreq2.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
testrsa.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
testrsapub.pem Add private/public key conversion tests 2015-03-29 03:26:12 +01:00
tests.com Catch up the VMS build. 2015-03-05 18:20:06 +01:00
testsid.pem Remove SSLv2 support 2014-12-04 11:55:03 +01:00
testutil.c Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
testutil.h Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
testx509.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
times Updates from 1.0.0-stable branch. 2009-04-20 11:33:12 +00:00
Uss.cnf Create DSA and ECDSA certificates. 2015-09-02 21:22:44 +01:00
v3-cert1.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
v3-cert2.pem Import of old SSLeay release: SSLeay 0.8.1b 1998-12-21 10:52:47 +00:00
v3nametest.c NGX-2040 - fix wildcard match on punycode/IDNA DNS names 2016-01-15 14:46:58 -05:00
verify_extra_test.c If memory debugging enabled return error on leaks. 2016-02-05 16:02:21 +00:00
wp_test.c Enable -Wmissing-variable-declarations and 2015-09-11 04:51:55 +01:00

How to add recipes
==================

For any test that you want to perform, you write a script located in
test/recipes/, named {nn}-test_{name}.t, where {nn} is a two digit number and
{name} is a unique name of your choice.

Please note that if a test involves a new testing executable, you will need to
do some additions in test/Makefile.  More on this later.


Naming convetions
=================

A test executable is named test/{name}test.c

A test recipe is named test/recipes/{nn}-test_{name}.t, where {nn} is a two
digit number and {name} is a unique name of your choice.

The number {nn} is (somewhat loosely) grouped as follows:

05  individual symmetric cipher algorithms
10  math (bignum)
15  individual asymmetric cipher algorithms
20  openssl enc
25  certificate forms, generation and verification
30  engine and evp
70  PACKET layer
80  "larger" protocols (CA, CMS, OCSP, SSL, TSA)
90  misc


A recipe that just runs a test executable
=========================================

A script that just runs a program looks like this:

    #! /usr/bin/perl
    
    use OpenSSL::Test::Simple;
    
    simple_test("test_{name}", "{name}test", "{name}");

{name} is the unique name you have chosen for your test.

The second argument to `simple_test' is the test executable, and `simple_test'
expects it to be located in test/

For documentation on OpenSSL::Test::Simple, do
`perldoc test/testlib/OpenSSL/Test/Simple.pm'.


A recipe that runs a more complex test
======================================

For more complex tests, you will need to read up on Test::More and
OpenSSL::Test.  Test::More is normally preinstalled, do `man Test::More' for
documentation.  For OpenSSL::Test, do `perldoc test/testlib/OpenSSL/Test.pm'.

A script to start from could be this:

    #! /usr/bin/perl
    
    use strict;
    use warnings;
    use OpenSSL::Test;
    
    setup("test_{name}");
    
    plan tests => 2;                # The number of tests being performed
    
    ok(test1, "test1");
    ok(test2, "test1");
    
    sub test1
    {
        # test feature 1
    }
    
    sub test2
    {
        # test feature 2
    }
    

Changes to test/Makefile
========================

Whenever a new test involves a new test executable you need to do the
following (at all times, replace {NAME} and {name} with the name of your
test):

* among the variables for test executables at the beginning, add a line like
  this:

    {NAME}TEST= {name}test

* add `$({NAME}TEST)$(EXE_EXT)' to the assignment of EXE:

* add `$({NAME}TEST).o' to the assignment of OBJ:

* add `$({NAME}TEST).c' to the assignment of SRC:

* add the following lines for building the executable:

    $({NAME}TEST)$(EXE_EXT): $({NAME}TEST).o $(DLIBCRYPTO)
           @target=$({NAME}TEST); $(BUILD_CMD)