openbsd/src/regress/lib/libssl/interop, branch OPENBSD_7_3A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_32023-02-01T16:03:47+00:00Don't run session tests with openssl 3.0 - these tests aren't TLSv1.3 ready2023-02-01T16:03:47+00:00tb2023-02-01T16:03:47+00:00urn:sha1:18e41f44e8da16fa34d9627787df9e72e6d1bf09Hopefully the last one.2023-02-01T15:59:50+00:00tb2023-02-01T15:59:50+00:00urn:sha1:397f620c6d0e0e10db7eca8d1f7cdcf96e4ef3dcOne more openssl 1.0.2 thing missed.2023-02-01T15:58:20+00:00tb2023-02-01T15:58:20+00:00urn:sha1:544a66582d11ee6b8e488dc93ef69d2187f787c7Switch from eopenssl to eopenssl30. Missed in both previous commits2023-02-01T15:38:57+00:00tb2023-02-01T15:38:57+00:00urn:sha1:09fb96cdc9f31f63544c6888bb2e8c8c30025bc5
for some reason.
Retire OpenSSL 1.0.2 interop2023-02-01T14:39:09+00:00tb2023-02-01T14:39:09+00:00urn:sha1:17e85e0d750477ecd6d94c4da3d089193c536e8f
Now that the OpenSSL 1.0.2 port is gone, there's no need to keep the
interop tests anymore. anton's and bluhm's regress tests will switch
to testing interoperability with OpenSSL 3.0.
Add openssl 3.0 interop tests2023-01-27T08:28:36+00:00tb2023-01-27T08:28:36+00:00urn:sha1:971c759a469620704a18f7c93e7d71fbae75e7c2
The plan is to retire the 1.0.2 interop tests soon so as to be able to
drop the dead and dangerous OpenSSL 1.0.2 port.
The cert part is extremely slow on arm64: the whole interop test on an m1
is about 10x slower (~45 min!) than on a modern amd64 laptop, so people
running regress may want to wait a bit with adding OpenSSL 3 to their test
boxes until this is sorted out.
Only run tests against ciphers supported by the method.2022-07-07T13:12:57+00:00tb2022-07-07T13:12:57+00:00urn:sha1:6c30e945e931211223b0bbf8f86a8754ce7d65d7Add a workaround due to OpenSSL's limitation of SSL_CTX_set_cipher_list2022-02-05T18:34:06+00:00tb2022-02-05T18:34:06+00:00urn:sha1:5ca2668e5b3228e2b85bc6198b8c7dce04c22d65
SSL_CTX_set_cipher_list() in OpenSSL 1.1 does not accept TLSv1.3 ciphers.
This wasn't a problem until now since the AEAD- ciphers were counted as
distinct from TLS_ ciphers by the regress test, so they were never used
in the {run,check}-cipher-${cipher}-client-${clib}-server-${slib} tests
With the renaming, the TLSv1.3 ciphers are now considered as common
ciphers, so they're tested. With openssl11 this results in
0:error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match:ssl/ssl_lib.c:2573:
The design of these tests doesn't allow easily adding a call to
SSL_CTX_set_ciphersuites (since they also need to work with openssl 1.0.2)
so skip the TLS_* ciphers for the time being.
Mechanically adjust from AEAD- to TLS_ to adjust to the new cipher names.2022-02-05T18:21:09+00:00tb2022-02-05T18:21:09+00:00urn:sha1:ebd49daf0f01ffb595c4642dd2982bf31d7b9cd3Tell testers which packages to install right away (and why)2021-12-02T17:10:53+00:00kn2021-12-02T17:10:53+00:00urn:sha1:5f76eb00e8dae262a9b0c52bae0d3b6fe1ed6ce0
Other regress tests do it differently; just fix/thouch those that did not
mention any package name at all.
This helps grepping logs for SKIPPED to find instructions for the next run.