summaryrefslogtreecommitdiff
path: root/regress/lib
AgeCommit message (Collapse)Author
2020-09-18Move variable declaration to beginning of scope in order to make thisTheo Buehler
test compile and pass on sparc64.
2020-09-18make this test compile and pass on sparc64 by moving variable declarationsTheo Buehler
to the beginning of the respective scopes (and out of for loops)
2020-09-18move variable declaration up to top to make this compile and passTheo Buehler
on sparc64
2020-09-18Use void function argument to appease gcc 4.2.1Theo Buehler
2020-09-18fix "warning: value computed is not used"Theo Buehler
Add a cast to tell gcc 4.2.1 that the return value is deliberately ignored. This makes the test compile and pass on sparc64.
2020-09-18fix "warning: function declaration isn't a prototype"Theo Buehler
Make tests compile and pass on sparc64 with gcc 4.2.1 by properly declaring "static int foo()" as "static int foo(void)".
2020-09-18zap redundant lineTheo Buehler
2020-09-18hook symbols test to regressTheo Buehler
2020-09-18Check availability of the symbols in Symbols.listTheo Buehler
This regress parses Symbols.list and pulls all public headers out of libcrypto's Makefile to generate a simple program that uses all public symbols. A number of symbols need to be declared extern since they are unavailable in public headers and a handful must be skipped since they are apparently architecture dependent. This would have caught the recent breakage due to the accidental removal of the NAME_CONSTRAINTS_check() function and points out a number of places where cleanup may happen in the future. discussed with beck
2020-09-16Add cipher set tests with empty SSL_set_ciphersuites().Joel Sing
2020-09-16Correct cipher_set_test() when run on a machine without AES acceleration.Joel Sing
Noted by bcook@ and inoguchi@ while working on portable.
2020-09-16Make cipher_set_test() log failures and continue, rather than aborting.Joel Sing
2020-09-15Test botan TLS client with libressl, openssl, openssl11 server.Alexander Bluhm
2020-09-14Change the known output to be the expected output, so that weBob Beck
no longer ignore the expected failures from the legacy name constraints validation, and will have a regress failure if we regress.
2020-09-14Use a fixed validation time in these tests so we neverBob Beck
have to re-generate these certificates and this should just keep working even if the certs get old
2020-09-14Connect a client to a server. Both can be current libressl, orAlexander Bluhm
openssl 1.0.2, or openssl 1.1. Pin client or server to a fixed TLS version number. Incompatible versions must fail. Check that client and server have used correct version by grepping in their session print out.
2020-09-13Add regress for SSL_{CTX_,}set_ciphersuites().Joel Sing
2020-09-13Add new x509 certificate chain validator in x509_verify.cBob Beck
The new validator finds multiple validated chains to handle the modern PKI cases which may frequently have multiple paths via different intermediates to different roots. It is loosely based on golang's x509 validator This includes integration so that the new validator can be used via X509_verify_cert() as well as a new api x509_verify() which will return multiple chains (similar to go). The new validator is not enabled by default with this commit, this will be changed in a follow on commit. The new public API is not yet exposed, and will be finalized and exposed with a man page and a library minor bump later. ok tb@ inoguchi@ jsing@
2020-09-12If CPU does not support AES-NI, LibreSSL TLS 1.3 client prefersAlexander Bluhm
chacha-poly over aes-gcm. Expect both fallbacks for non 1.3 ciphers.
2020-09-12remove unused include that breaks regressBob Beck
2020-09-11Enable cert and cipher interop tests. cert just works. cipher hasAlexander Bluhm
been fixed to work with libressl TLS 1.3. Both libressl and openssl11 replace obsolete TLS 1.2 ciphers with AEAD-AES256-GCM-SHA384 or TLS_AES_256_GCM_SHA384 in TLS 1.3 respectively. The test expects that now. Currently GOST does not work with libressl and TLS 1.3 and is disabled.
2020-09-11Add x509_constraints.c - a new implementation of x509 name constraints, withBob Beck
regression tests. The use of the new name constraints is not yet activated in x509_vfy.c and will be activated in a follow on commit ok jsing@
2020-09-10Enable test-tls13-large-number-of-extensions.pyTheo Buehler
Skip sending an empty ECPF extension for now: we don't accept it since according to RFC 4492 and 8422 it needs to advertise uncompressed point formats.
2020-08-17Fix append mode so it always writes to the end and expand regress.Todd C. Miller
OK deraadt@ martijn@
2020-08-17Also print a list of missing scripts in summaryTheo Buehler
2020-08-17Avoid test failures due to outdated packagesTheo Buehler
Indicate missing test scripts prominently in the result but do not count them as an error.
2020-08-15enable jsing's zero content type testTheo Buehler
2020-08-11I accidentally zeored out a few bytes of the TLSv1.0 session ID.Theo Buehler
Restore them to their previous values.
2020-08-09Update TLS versions to match TLSv1.3 being enabled for TLS_method().Joel Sing
2020-08-09Fix regress test so that it exits non-zero for failure cases.Joel Sing
2020-08-09Update golden values to match P-521 being enabled by default in the client.Joel Sing
Diff from tb@
2020-08-09Update golden values to match P-521 being enabled by default in the client.Joel Sing
2020-08-08Session resumption is not currently supported for TLSv1.3.Theo Buehler
2020-08-08Enable P-521 and run the tests that use it.Theo Buehler
2020-07-23Fix a bug in PEM_X509_INFO_read_bio(3) that is very likely to causeIngo Schwarze
use-after-free and double-free issues in calling programs. The bug was introduced in SSLeay-0.6.0 released on June 21, 1996 and has been present since OpenBSD 2.4. I found the bug while documenting the function. The bug could bite in two ways that looked quite different from the perspective of the calling code: * If a stack was passed in that already contained some X509_INFO objects and an error occurred, all the objects passed in would be freed, but without removing the freed pointers from the stack, so the calling code would probable continue to access the freed pointers and eventually free them a second time. * If the input BIO contained at least two valid PEM objects followed by at least one PEM object causing an error, at least one freed pointer would be put onto the stack, even though the function would return NULL rather than the stack. But the calling code would still have a pointer to the stack, so it would be likely to access the new bogus pointers sooner or later. Fix all this by remembering the size of the input stack on entry and cutting it back to exactly that size when exiting due to an error, but no further. While here, do some related cleanup: * Garbage collect the automatic variables "error" and "i" which were only used at one single place each. * Use NULL rather than 0 for pointers. I like bugfixes that make the code four lines shorter, reduce the number of variables by one, reduce the number of brace-blocks by one, reduce the number if if-statements by one, and reduce the number of else-clauses by one. Tweaks and OK tb@.
2020-07-16Fix perl bugs that had me printing the wrong cert number for errorsBob Beck
2020-07-15The exit code from the perl matters hereBob Beck
2020-07-15Don't leak the X509_STOREBob Beck
2020-07-15Add certificate validation tests generated using the tools fromBob Beck
bettertls.com, and a verification suite to try each certificate in the same manner as the web based tests do using X509_verify. This includes the list of "known" failures today in our validaion code so we can move forward without moving back.
2020-07-14Enter the certs regress directory.Joel Sing
2020-07-14Add regress for X509_verify() using the new bundles.Joel Sing
A number of these tests are known to fail due to bugs/incorrect verification implementation.
2020-07-14Provide generated certificate bundles and roots for regress.Joel Sing
ok beck@ tb@
2020-07-14Provide tools to build certificate changes for verify regress.Joel Sing
This provides a script that generates a variety of certificate chains and assembles them into bundles containing various permutations, which can be used to test our X.509 verification. A Go program is included to verify each of these bundles. ok beck@ tb@
2020-07-14Force TLSv1.2 when testing SSLv3/TLSv1.2 cipher suites.Joel Sing
Otherwise we end up switching to TLSv1.3 and using a TLSv1.3 cipher suite.
2020-07-14Add a -tls1_2 option so we can force TLSv1.2 for testing.Joel Sing
2020-07-14getopt(3) returns an int so don't use a char to store its return value.Mark Kettenis
Makes the test work on architectures where char is unsigned. ok deraadt@, millert@
2020-07-09New regression tests for integral type conversionsIngo Schwarze
and for their modifiers, written from scratch.
2020-07-08New regression tests for character and string conversionsIngo Schwarze
and for their modifiers, written from scratch.
2020-07-07Remove temporary RSA keys/callbacks code.Joel Sing
This was removed from libssl a very long time ago...
2020-07-07Test TLSv1.3 ciphersuites now that TLS_method() supports TLSv1.3.Joel Sing
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-28 00:17:46 +0000