openbsd/src/regress/lib/libssl/dtls, branch OPENBSD_7_6_BASE

Use the new certificates/chains in regress.

2024-03-20T10:38:05+00:00

The new certificates are more representative of the real world. The old certificates use weak algorithms and expire in the very near future. Most of our regress has already been switched over, this changes the remainder. Thanks to Bernhard M. Wiedemann for reminding us of the upcoming expiry. ok tb@

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

dtlstest: Ensure the timeouts are at least 10 ms. This makes these tests

2022-10-26T20:31:38+00:00

a bit less flaky if the machine is otherwise under load. from jsing

Revise for SSL_CTX_INTERNAL and SSL_INTERNAL removal.

2022-10-02T16:38:23+00:00

Let dtlstest peek into bio_local.h

2022-01-07T09:07:00+00:00

zap trailing whitespace

2021-06-19T18:28:51+00:00

Add DTLS test cases that use non-zero initial epochs.

2021-06-19T17:11:34+00:00

In particular, test handling of 0xfffe and 0xffff - the latter results in wrapping to zero for the next epoch. One of these tests triggers a known bug in libssl, which will be fixed following this commit.

Add more complex DTLS tests for delay/reordering.

2021-06-19T16:29:51+00:00

These tests exercise the various queues and delayed processing that exists in the DTLS code.

Expand comment that details why two DTLS tests currently fail.

2021-06-19T15:52:41+00:00

Two tests currently fail (and are disabled) due to a flaw in the DTLSv1.0 specification - this flaw was addressed in DTLSv1.2, however our DTLS server code still needs to support the fix. Quoting RFC 6347 section 4.2.4: "This requirement applies to DTLS 1.0 as well, and though not explicit in [DTLS1], it was always required for the state machine to function correctly." In otherwords, both the original DTLS implementation and the DTLSv1.0 specification have a broken state machine, resulting in possible dead lock.

Provide the ability to delay/reorder DTLS packets.

2021-06-19T15:33:37+00:00

Add a test that delays the client CCS, resulting in it arriving after the client Finished message.