summaryrefslogtreecommitdiff
path: root/src/regress/lib/libssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Remove the ciphers_by_values_test()tb2024-03-011-56/+0
|
* exporter: use the atrocious SSL_CIPHER_find() rather than get_by_id()tb2024-03-011-2/+5
|
* ssltest: drop another use of CRYPTO_mem_leaks()tb2024-03-011-2/+1
|
* Remove GOST and STREEBOG support from libssl.beck2024-02-034-189/+115
| | | | | | | | | | | | | | | | | | This version of GOST is old and not anywhere close to compliant with modern GOST standards. It is also very intrusive in libssl and makes a mess everywhere. Efforts to entice a suitably minded anyone to care about it have been unsuccessful. At this point it is probably best to remove this, and if someone ever showed up who truly needed a working version, it should be a clean implementation from scratch, and have it use something closer to the typical API in libcrypto so it would integrate less painfully here. This removes it from libssl in preparation for it's removal from libcrypto with a future major bump ok tb@
* Add a shutdown sequence regress test.jsing2024-01-301-3/+133
| | | | | | | | | | Some software relies on SSL_shutdown() returning 0 (indicating close-notify sent) before returning 1 on a subsequent call (indicating close-notify sent and received). It is worth noting that there is no guarantee that this will occur in normal operation, as the peer could send a close-notify prior to SSL_shutdown() being called. This is currently failing for TLSv1.3.
* Enable for TLSv1.3 now that shutdown behaviour matches the legacy stack.jsing2024-01-271-3/+1
|
* Enable shutdown regress test.jsing2024-01-191-1/+2
|
* Add regress test coverage for SSL_shutdown().jsing2024-01-192-0/+546
| | | | | | | This tests and codifies the behaviour of SSL_shutdown() with respect to SSL_quiet_shutdown() and SSL_set_shutdown(). For now, only the legacy stack (TLSv1.2) is tested, as there are currently some subtle differences with the TLSv1.3 stack.
* tlsexttest: \178 isn't a valid octal escape sequencetb2023-12-131-2/+2
|
* Remove last OPENSSL_NO_ENGINE from libssl regresstb2023-11-191-7/+1
|
* Add support for OpenSSL 3.1 interop teststb2023-10-308-11/+74
| | | | | | Until OpenSSL 3.1 has replaced OpenSSL 3.0 on most architectures, run both tests. Installed packages of OpenSSL 3.0 will update automatically to 3.1, so regress runners should not need to do anything.
* Make libssl interop server/client tests less flaky by ensuring theanton2023-10-181-1/+3
| | | | server has terminated before examining the outcome.
* openssl-ruby tests: remove fallback to ruby31tb2023-09-241-5/+1
|
* Avoid memcmp() with NULL pointer and 0 lengthtb2023-08-151-3/+3
|
* Prepare tlsfuzzer.py for ports updatetb2023-08-141-3/+13
|
* Link new ccs test to buildtb2023-08-031-1/+7
| | | | | Exception needed since the test expects an unexpected_message alert, while we throw a decode_error.
* Prepare the ssltest for the upcoming bumptb2023-07-271-1/+8
| | | | | | | This is a hack. The test is in rather poor shape and it is hard to tell whether it still does what it is supposed to be doing. Hopefully somemone will rewrite this in a style that doesn't make me squeal on opening this file...
* Don't rely on the libssl headers pulling in stdio.h somehowtb2023-07-191-1/+3
|
* fix include directive - this is make, not Ctb2023-07-151-2/+2
|
* Link symbols test to buildtb2023-07-151-1/+2
|
* remove accidentally imported files againtb2023-07-153-2713/+0
|
* Import a version of libcrypto's symbols test for libssltb2023-07-155-0/+2798
|
* Reenable clienttest and servertesttb2023-07-121-3/+3
|
* Fix last bit of the clienttest, needs ssl_pkt.c r1.66tb2023-07-111-2/+2
|
* Keep servertest silent and align with clienttesttb2023-07-111-2/+3
|
* Neuter expected server test failures with SSLv2tb2023-07-111-1/+6
| | | | This test should either be extended or retired. As it is it is useless.
* Fix most of the clienttest. With this only test cases 9 and 13 fail.tb2023-07-111-23/+39
|
* Avoid undefined behavior in tlsexttesttb2023-07-051-11/+18
| | | | | | | | | An empty array cannot be initialized and it is an incomplete type, so the sizeof() operator can't be applied to it. Therefore initialize it with a zero byte and replace sizeof() use with lengths. Slightly tweaked version of a patch by inoguchi in portable. Discussed with bcook, beck, kettenis
* Plug leak in the ssltesttb2023-07-041-1/+2
| | | | | | | | Removing -tls1 moved some tests from the legacy stack to the TLSv1.3 stack. On a HRR, the alpn callback would be called twice and allocate the global twice, thereby leaking. So free it up front. Joint suffering with bcook and beck
* Disable TLS 1.0 and TLS 1.1 in libsslbeck2023-07-027-149/+102
| | | | | | | | | | | | Their time has long since past, and they should not be used. This change restricts ssl to versions 1.2 and 1.3, and changes the regression tests to understand we no longer speak the legacy protocols. For the moment the magical "golden" byte for byte comparison tests of raw handshake values are disabled util jsing fixes them. ok jsing@ tb@
* File new test-bleichenbacher-timing-pregenerate.py under failing teststb2023-06-101-1/+3
| | | | until someone finds time and motivation to figure out how to use this.
* Make ruby-openssl cope with default ruby changetb2023-06-041-2/+2
|
* Copy the verify param hostflags independently of the host listtb2023-05-241-3/+1
| | | | | | | | | | | | | | | | Without this, hostflags set on the SSL_CTX would not propagate to newly created SSL. This is surprising behavior that was changed in OpenSSL 1.1 by Christian Heimes after the issue was flagged by Quentin Pradet: https://bugs.python.org/issue43522 This is a version of the fix that landed in OpenSSL. There used to be a workaround in place in urllib3, but that was removed at some point. We haven't fixed this earlier since it wasn't reported. It only showed up after recent fallout of extraordinarily strict library checking in urllib3 coming from their own interpretation of the implications of PEP 644. ok jsing
* Add a test to verify that an SSL inherits the hostflags from the SSL_CTXtb2023-05-242-1/+105
| | | | This is currently an expected failure that will be fixed shortly.
* Provide CRYPTO_INT for statically linking libcrypto for libssl regresstb2023-05-241-0/+2
| | | | This will be needed for the ssl_verify_param test
* tlsexttest: check additional logic in tlsext randomizationtb2023-04-271-1/+103
| | | | | | | This verifies that we put PSK always last and that the Apache 2 special does what it is supposed to do. There is also some weak validation of the Fisher-Yates shuffle that will likely catch errors introduced in tlsext_randomize_build_order()
* Fix the client test and the tlsext test to work with randomizedtb2023-04-233-4/+21
| | | | | TLS extensions (this involves unrandomizing the extension order for the tests that rely on golden numbers.
* interop: work around extreme REGRESS_SKIP_SLOW slownesstb2023-04-193-8/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A few years back beck introduced REGRESS_SKIP_SLOW dances with the idea that this should speed up the interop tests for us devs because this also checked interop between opensslX and opensslY, which we don't particularly care about. This never really worked. On a mac m1 mini the result is this: REGRESS_SKIP_SLOW unset 9m56.69s real 3m42.24s user 3m00.70s system REGRESS_SKIP_SLOW=yes 11m04.61s real 7m29.61s user 1m40.29s system The problem is that REGRESS_SKIP_SLOW simply wasn't designed to handle the huge number of tests we have here. There are many nested .for loops resulting in several thousand tests. Each test has a name of length ~80. REGRESS_SKIP_SLOW concatenates them into a several hundred kilobytes long string in REGRESS_SKIP_TARGETS, iterates over all regress targets and tests with ".if ${REGRESS_SKIP_TARGETS:M${RT}}" if it should skip them. This means that during a regress run, make spends a lot of time linearly scanning a huge string. I ran into this when I added OpenSSL 3.0 tests to the already existing 1.0.2 and 1.1 tests with the result that with REGRESS_SLOW_TARGTS set it took the better part of an hour while without it it took about 15 min. The hack here is simply to avoid using REGRESS_SLOW_TARGTES here and handle the situation differently. patch, REGRESS_SKIP_SLOW=yes 5m42.32s real 2m09.98s user 1m45.21s system The real solution would be to fix this in bsd.regress.mk, which someone who understands make well is very welcome to do. For now, I'm happy with this. Debugged with jsing a few months ago
* ssltest: Drop more policy go from this test.tb2023-04-151-357/+21
| | | | Hopefully that is all. What an absolutely horrid mess.
* ssltest: initial pass of dropping proxy cert gootb2023-04-151-89/+1
|
* Plug a memleak caused by an extra bump of a refcounttb2023-04-141-2/+1
| | | | SSL_set_session() should really be called SSL_set1_session()...
* Make the apitest work better with the portable tets frameworktb2023-04-142-13/+12
|
* Sync function prototypes and declarations to satisfy clang 15.anton2023-02-021-3/+3
| | | | ok jsing@
* Don't run session tests with openssl 3.0 - these tests aren't TLSv1.3 readytb2023-02-011-2/+2
|
* Hopefully the last one.tb2023-02-011-4/+4
|
* One more openssl 1.0.2 thing missed.tb2023-02-011-4/+4
|
* Switch from eopenssl to eopenssl30. Missed in both previous commitstb2023-02-011-4/+4
| | | | for some reason.
* Retire OpenSSL 1.0.2 interoptb2023-02-017-93/+13
| | | | | | Now that the OpenSSL 1.0.2 port is gone, there's no need to keep the interop tests anymore. anton's and bluhm's regress tests will switch to testing interoperability with OpenSSL 3.0.
* Add openssl 3.0 interop teststb2023-01-275-12/+70
| | | | | | | | | | The plan is to retire the 1.0.2 interop tests soon so as to be able to drop the dead and dangerous OpenSSL 1.0.2 port. The cert part is extremely slow on arm64: the whole interop test on an m1 is about 10x slower (~45 min!) than on a modern amd64 laptop, so people running regress may want to wait a bit with adding OpenSSL 3 to their test boxes until this is sorted out.
* tlsfuzzer: hook up new connection abort tests while skipping the NSTtb2023-01-061-1/+5
| | | | tests for TLSv1.3 since that's not currently handled.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 06:50:46 +0000