From df1ed6bb4ec3e72c20a7082cc168a45ae67704ba Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 19 Jul 2026 18:08:07 +0900 Subject: add libssl verify test Copy regress/lib/libssl/verify/verify.c as ssl_verify.c to avoid basename collisions when regress tests are flattened into tests. Copy create-libressl-test-certs.pl and add a wrapper that generates the test certificates before running ssl_verify. Detect the required IO::Socket::SSL::Utils Perl module and register the test with both autotools and CMake when it is available. Also document x509/bettertls is not included. --- .gitignore | 2 ++ CMakeLists.txt | 9 ++++++++ configure.ac | 11 ++++++++++ tests/CMakeLists.txt | 11 ++++++++++ tests/Makefile.am | 10 +++++++++ tests/ssl_verify.sh | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++ update.sh | 6 ++++++ 7 files changed, 109 insertions(+) create mode 100755 tests/ssl_verify.sh diff --git a/.gitignore b/.gitignore index 8a72400..d85df81 100644 --- a/.gitignore +++ b/.gitignore @@ -141,10 +141,12 @@ tests/*test.c tests/pbkdf2* tests/*.pem tests/certs/ +tests/create-libressl-test-certs.pl tests/make-dir-roots.pl tests/testssl tests/*.txt tests/compat/*.c +tests/ssl_verify.c tests/verify* tests/x509_verify* !tests/x509_verify.sh diff --git a/CMakeLists.txt b/CMakeLists.txt index 699603b..4ffe67b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -33,6 +33,15 @@ include(GNUInstallDirs) enable_testing() find_program(PERL_EXECUTABLE perl perl5) +set(HAVE_PERL_IO_SOCKET_SSL_UTILS FALSE) +if(PERL_EXECUTABLE) + execute_process(COMMAND ${PERL_EXECUTABLE} -MIO::Socket::SSL::Utils -e 1 + RESULT_VARIABLE PERL_IO_SOCKET_SSL_UTILS_RESULT + OUTPUT_QUIET ERROR_QUIET) + if(PERL_IO_SOCKET_SSL_UTILS_RESULT EQUAL 0) + set(HAVE_PERL_IO_SOCKET_SSL_UTILS TRUE) + endif() +endif() file(READ ${CMAKE_CURRENT_SOURCE_DIR}/ssl/VERSION SSL_VERSION) string(STRIP ${SSL_VERSION} SSL_VERSION) diff --git a/configure.ac b/configure.ac index 9012535..23f0c38 100644 --- a/configure.ac +++ b/configure.ac @@ -34,6 +34,17 @@ LT_INIT([pic-only]) AC_CHECK_PROGS([PERL], [perl perl5]) AM_CONDITIONAL([HAVE_PERL], [test "x$PERL" != x]) +AC_CACHE_CHECK([for IO::Socket::SSL::Utils], + [ac_cv_perl_io_socket_ssl_utils], + [if test "x$PERL" = x; then + ac_cv_perl_io_socket_ssl_utils=no + elif "$PERL" -MIO::Socket::SSL::Utils -e 1 >/dev/null 2>&1; then + ac_cv_perl_io_socket_ssl_utils=yes + else + ac_cv_perl_io_socket_ssl_utils=no + fi]) +AM_CONDITIONAL([HAVE_PERL_IO_SOCKET_SSL_UTILS], + [test "x$ac_cv_perl_io_socket_ssl_utils" = xyes]) CHECK_OS_OPTIONS diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ede7463..45681a1 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -844,6 +844,17 @@ add_executable(ssl_verify_param ssl_verify_param.c) target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS}) add_platform_test(ssl_verify_param ssl_verify_param) +# ssl_verify +add_executable(ssl_verify ssl_verify.c) +target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS}) +if(NOT WIN32 AND NOT EMSCRIPTEN AND HAVE_PERL_IO_SOCKET_SSL_UTILS) + add_test(NAME ssl_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh + $) + set_tests_properties(ssl_verify PROPERTIES + ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}" + WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}) +endif() + # ssl_versions add_executable(ssl_versions ssl_versions.c) target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 9b58724..7d581c8 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -104,6 +104,7 @@ EXTRA_DIST = CMakeLists.txt DISTCLEANFILES = pidwraptest.txt distclean-local: + rm -rf ssl_verify-certs rm -rf x509_verify-certs # XXX - should probably be in their own static lib @@ -855,6 +856,15 @@ TESTS += ssl_verify_param check_PROGRAMS += ssl_verify_param ssl_verify_param_SOURCES = ssl_verify_param.c +# ssl_verify +if HAVE_PERL_IO_SOCKET_SSL_UTILS +TESTS += ssl_verify.sh +check_PROGRAMS += ssl_verify +endif +ssl_verify_SOURCES = ssl_verify.c +EXTRA_DIST += ssl_verify.sh +EXTRA_DIST += create-libressl-test-certs.pl + # ssl_versions TESTS += ssl_versions check_PROGRAMS += ssl_versions diff --git a/tests/ssl_verify.sh b/tests/ssl_verify.sh new file mode 100755 index 0000000..ed32911 --- /dev/null +++ b/tests/ssl_verify.sh @@ -0,0 +1,60 @@ +#!/bin/sh +# +# Copyright (c) 2026 Kenjiro Nakayama +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +set -e + +if [ -z "$srcdir" ]; then + srcdir=. +fi + +if [ -z "$PERL" ]; then + PERL=perl +fi + +case "$srcdir" in +/*) + create_certs="$srcdir/create-libressl-test-certs.pl" + ;; +*) + create_certs="`pwd`/$srcdir/create-libressl-test-certs.pl" + ;; +esac + +if [ $# -ge 1 ]; then + verify_bin=$1 +else + verify_bin="`pwd`/ssl_verify" + if [ -e ./ssl_verify.exe ]; then + verify_bin="`pwd`/ssl_verify.exe" + fi +fi + +workdir=ssl_verify-certs + +cleanup() +{ + rm -rf "$workdir" +} +trap cleanup EXIT + +rm -rf "$workdir" +mkdir "$workdir" + +( + cd "$workdir" + "$PERL" "$create_certs" + "$verify_bin" +) diff --git a/update.sh b/update.sh index a6d0ebd..83864d3 100755 --- a/update.sh +++ b/update.sh @@ -336,6 +336,8 @@ for i in `find $libcrypto_regress -name '*.[ch]'`; do done # x509/verify.c collides with x509/bettertls/verify.c when flattened. $CP $libcrypto_regress/x509/verify.c tests/x509_verify.c +# Do not copy x509/bettertls/verify.c: it requires the large bettertls +# certificate corpus, which is not worth bundling in release tarballs. $CP $libcrypto_regress/evp/evptests.txt tests $CP $libcrypto_regress/aead/*.txt tests $CP $libcrypto_regress/ct/ctlog.conf tests @@ -371,6 +373,10 @@ for i in `find $libssl_regress -name '*.c'`; do done # tls/tlstest.c collides with libtls/tls/tlstest.c when flattened. $CP $libssl_regress/tls/tlstest.c tests/ssl_tlstest.c +# verify/verify.c collides with other verify tests when flattened. +rm -f tests/verify.c +$CP $libssl_regress/verify/verify.c tests/ssl_verify.c +$CP $libssl_regress/verify/create-libressl-test-certs.pl tests $CP $libssl_regress/unit/tests.h tests $CP $libssl_regress/certs/*.pem tests $CP $libssl_regress/certs/*.crl tests -- cgit v1.2.3-55-g6feb