A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v3.8.0 2023-05-24T09:15:14+00:00 2023-05-24T09:15:14+00:00 tb 2023-05-24T09:15:14+00:00 urn:sha1:cb416a0ac54838a4c54249c6c74fbaa3aafa6d6b Without this, hostflags set on the SSL_CTX would not propagate to newly created SSL. This is surprising behavior that was changed in OpenSSL 1.1 by Christian Heimes after the issue was flagged by Quentin Pradet: https://bugs.python.org/issue43522 This is a version of the fix that landed in OpenSSL. There used to be a workaround in place in urllib3, but that was removed at some point. We haven't fixed this earlier since it wasn't reported. It only showed up after recent fallout of extraordinarily strict library checking in urllib3 coming from their own interpretation of the implications of PEP 644. ok jsing 2023-05-24T08:54:59+00:00 tb 2023-05-24T08:54:59+00:00 urn:sha1:0151931d7b9060a9d578a30bd59113ee37d19c9d This is currently an expected failure that will be fixed shortly. 2023-05-24T08:49:06+00:00 tb 2023-05-24T08:49:06+00:00 urn:sha1:c30d8915b92324dbd7b7e4ae1afec4b16a034358 This will be needed for the ssl_verify_param test 2023-04-27T10:53:58+00:00 tb 2023-04-27T10:53:58+00:00 urn:sha1:7e4f1618bbb0aff3c288e85be3ef058031f36db8 This verifies that we put PSK always last and that the Apache 2 special does what it is supposed to do. There is also some weak validation of the Fisher-Yates shuffle that will likely catch errors introduced in tlsext_randomize_build_order() 2023-04-23T18:59:41+00:00 tb 2023-04-23T18:59:41+00:00 urn:sha1:13ba643374d5ff84130d05ec7c88f7fd1e4c2308 TLS extensions (this involves unrandomizing the extension order for the tests that rely on golden numbers. 2023-04-19T15:34:23+00:00 tb 2023-04-19T15:34:23+00:00 urn:sha1:73798ebfda5eeaa9a9f42af994c4ac301b83b075 A few years back beck introduced REGRESS_SKIP_SLOW dances with the idea that this should speed up the interop tests for us devs because this also checked interop between opensslX and opensslY, which we don't particularly care about. This never really worked. On a mac m1 mini the result is this: REGRESS_SKIP_SLOW unset 9m56.69s real 3m42.24s user 3m00.70s system REGRESS_SKIP_SLOW=yes 11m04.61s real 7m29.61s user 1m40.29s system The problem is that REGRESS_SKIP_SLOW simply wasn't designed to handle the huge number of tests we have here. There are many nested .for loops resulting in several thousand tests. Each test has a name of length ~80. REGRESS_SKIP_SLOW concatenates them into a several hundred kilobytes long string in REGRESS_SKIP_TARGETS, iterates over all regress targets and tests with ".if ${REGRESS_SKIP_TARGETS:M${RT}}" if it should skip them. This means that during a regress run, make spends a lot of time linearly scanning a huge string. I ran into this when I added OpenSSL 3.0 tests to the already existing 1.0.2 and 1.1 tests with the result that with REGRESS_SLOW_TARGTS set it took the better part of an hour while without it it took about 15 min. The hack here is simply to avoid using REGRESS_SLOW_TARGTES here and handle the situation differently. patch, REGRESS_SKIP_SLOW=yes 5m42.32s real 2m09.98s user 1m45.21s system The real solution would be to fix this in bsd.regress.mk, which someone who understands make well is very welcome to do. For now, I'm happy with this. Debugged with jsing a few months ago 2023-04-15T16:50:05+00:00 tb 2023-04-15T16:50:05+00:00 urn:sha1:9f05de38a30ac8f2e70977a361fc0d26b403940b Hopefully that is all. What an absolutely horrid mess. 2023-04-15T16:17:57+00:00 tb 2023-04-15T16:17:57+00:00 urn:sha1:3cf1029b1f3ee136a9ab977a03e1380542e80a04 2023-04-14T14:23:05+00:00 tb 2023-04-14T14:23:05+00:00 urn:sha1:7b57dcb394d0aaac0cf490836327e3ebbd9a773c SSL_set_session() should really be called SSL_set1_session()... 2023-04-14T12:38:30+00:00 tb 2023-04-14T12:38:30+00:00 urn:sha1:6bb4483341557dcbf393fca6e20ef7f87a276345