A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_6_BASE 2024-08-18T10:02:10+00:00 2024-08-18T10:02:10+00:00 tb 2024-08-18T10:02:10+00:00 urn:sha1:2a58c3044aacc0248cdd590f557266a1974bec55 The openssl 3.0 port was removed nearly a year ago shortly after the 7.4 release. 2024-08-18T09:14:17+00:00 tb 2024-08-18T09:14:17+00:00 urn:sha1:b3e075767e19536c9eb560beb39f7477834ccb45 2024-02-03T15:58:34+00:00 beck 2024-02-03T15:58:34+00:00 urn:sha1:20afa90e552d2efed2187dbafc92170a3895e921 This version of GOST is old and not anywhere close to compliant with modern GOST standards. It is also very intrusive in libssl and makes a mess everywhere. Efforts to entice a suitably minded anyone to care about it have been unsuccessful. At this point it is probably best to remove this, and if someone ever showed up who truly needed a working version, it should be a clean implementation from scratch, and have it use something closer to the typical API in libcrypto so it would integrate less painfully here. This removes it from libssl in preparation for it's removal from libcrypto with a future major bump ok tb@ 2023-10-30T17:15:21+00:00 tb 2023-10-30T17:15:21+00:00 urn:sha1:ef5d46388987ae46b79c7f8da6d2d73458c3d294 Until OpenSSL 3.1 has replaced OpenSSL 3.0 on most architectures, run both tests. Installed packages of OpenSSL 3.0 will update automatically to 3.1, so regress runners should not need to do anything. 2023-04-19T15:34:23+00:00 tb 2023-04-19T15:34:23+00:00 urn:sha1:73798ebfda5eeaa9a9f42af994c4ac301b83b075 A few years back beck introduced REGRESS_SKIP_SLOW dances with the idea that this should speed up the interop tests for us devs because this also checked interop between opensslX and opensslY, which we don't particularly care about. This never really worked. On a mac m1 mini the result is this: REGRESS_SKIP_SLOW unset 9m56.69s real 3m42.24s user 3m00.70s system REGRESS_SKIP_SLOW=yes 11m04.61s real 7m29.61s user 1m40.29s system The problem is that REGRESS_SKIP_SLOW simply wasn't designed to handle the huge number of tests we have here. There are many nested .for loops resulting in several thousand tests. Each test has a name of length ~80. REGRESS_SKIP_SLOW concatenates them into a several hundred kilobytes long string in REGRESS_SKIP_TARGETS, iterates over all regress targets and tests with ".if ${REGRESS_SKIP_TARGETS:M${RT}}" if it should skip them. This means that during a regress run, make spends a lot of time linearly scanning a huge string. I ran into this when I added OpenSSL 3.0 tests to the already existing 1.0.2 and 1.1 tests with the result that with REGRESS_SLOW_TARGTS set it took the better part of an hour while without it it took about 15 min. The hack here is simply to avoid using REGRESS_SLOW_TARGTES here and handle the situation differently. patch, REGRESS_SKIP_SLOW=yes 5m42.32s real 2m09.98s user 1m45.21s system The real solution would be to fix this in bsd.regress.mk, which someone who understands make well is very welcome to do. For now, I'm happy with this. Debugged with jsing a few months ago 2023-02-01T14:39:09+00:00 tb 2023-02-01T14:39:09+00:00 urn:sha1:17e85e0d750477ecd6d94c4da3d089193c536e8f Now that the OpenSSL 1.0.2 port is gone, there's no need to keep the interop tests anymore. anton's and bluhm's regress tests will switch to testing interoperability with OpenSSL 3.0. 2023-01-27T08:28:36+00:00 tb 2023-01-27T08:28:36+00:00 urn:sha1:971c759a469620704a18f7c93e7d71fbae75e7c2 The plan is to retire the 1.0.2 interop tests soon so as to be able to drop the dead and dangerous OpenSSL 1.0.2 port. The cert part is extremely slow on arm64: the whole interop test on an m1 is about 10x slower (~45 min!) than on a modern amd64 laptop, so people running regress may want to wait a bit with adding OpenSSL 3 to their test boxes until this is sorted out. 2022-02-05T18:34:06+00:00 tb 2022-02-05T18:34:06+00:00 urn:sha1:5ca2668e5b3228e2b85bc6198b8c7dce04c22d65 SSL_CTX_set_cipher_list() in OpenSSL 1.1 does not accept TLSv1.3 ciphers. This wasn't a problem until now since the AEAD- ciphers were counted as distinct from TLS_ ciphers by the regress test, so they were never used in the {run,check}-cipher-${cipher}-client-${clib}-server-${slib} tests With the renaming, the TLSv1.3 ciphers are now considered as common ciphers, so they're tested. With openssl11 this results in 0:error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match:ssl/ssl_lib.c:2573: The design of these tests doesn't allow easily adding a call to SSL_CTX_set_ciphersuites (since they also need to work with openssl 1.0.2) so skip the TLS_* ciphers for the time being. 2022-02-05T18:21:09+00:00 tb 2022-02-05T18:21:09+00:00 urn:sha1:ebd49daf0f01ffb595c4642dd2982bf31d7b9cd3 2020-12-17T00:51:12+00:00 bluhm 2020-12-17T00:51:12+00:00 urn:sha1:c7cbfcf2a0ad5dc204129e5fbf99dd57cc33e72a