Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2019-07-13 19:13:22 +09:00
parent 9a23f88dc2
commit 2e57f602ae
542 changed files with 17287 additions and 6184 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/recipes/02-test_errstr.t
+20 -7
View File
@@ -104,18 +104,31 @@ foreach my $errname (@posix_errors) {
my @oerr = run(app([ qw(openssl errstr), sprintf("2%06x", $errnum) ]),
capture => 1);
$oerr[0] =~ s|\R$||;
$oerr[0] =~ s|.*system library:||g; # The actual message is last
ok($oerr[0] eq $perr, "($errnum) '$oerr[0]' == '$perr'");
@oerr = split_error($oerr[0]);
ok($oerr[3] eq $perr, "($errnum) '$oerr[3]' == '$perr'");
}
}
my @after = run(app([ qw(openssl errstr 2000080) ]), capture => 1);
$after[0] =~ s|\R$||;
$after[0] =~ s|.*system library:||g;
ok($after[0] eq "reason(128)", "(128) '$after[0]' == 'reason(128)'");
@after = split_error($after[0]);
ok($after[3] eq "reason(128)", "(128) '$after[3]' == 'reason(128)'");
my @zero = run(app([ qw(openssl errstr 2000000) ]), capture => 1);
$zero[0] =~ s|\R$||;
$zero[0] =~ s|.*system library:||g;
ok($zero[0] eq "system library", "(0) '$zero[0]' == 'system library'");
@zero = split_error($zero[0]);
ok($zero[3] eq "system library", "(0) '$zero[3]' == 'system library'");
# For an error string "error:xxxxxxxx:lib:func:reason", this returns
# the following array:
#
# ( "xxxxxxxx", "lib", "func", "reason" )
sub split_error {
# Limit to 5 items, in case the reason contains a colon
my @erritems = split /:/, $_[0], 5;
# Remove the first item, which is always "error"
shift @erritems;
return @erritems;
}
test/recipes/03-test_internal_namemap.t
+16
View File
@@ -0,0 +1,16 @@
#! /usr/bin/env perl
# Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use strict;
use OpenSSL::Test; # get 'plan'
use OpenSSL::Test::Simple;
use OpenSSL::Test::Utils;
setup("test_internal_namemap");
simple_test("test_internal_namemap", "namemap_internal_test");
test/recipes/05-test_mdc2.t
+16 -2
View File
@@ -7,6 +7,20 @@
# https://www.openssl.org/source/license.html
use OpenSSL::Test::Simple;
use strict;
use warnings;
simple_test("test_mdc2", "mdc2test", "mdc2");
use OpenSSL::Test qw/:DEFAULT bldtop_dir/;
use OpenSSL::Test::Utils;
setup("test_mdc2");
if (disabled("mdc2") || disabled("legacy")) {
plan skip_all => "mdc2 is not supported by this OpenSSL build";
}
plan tests => 1;
$ENV{OPENSSL_MODULES} = bldtop_dir("providers");
ok(run(test(["mdc2test"])), "running mdc2test");
test/recipes/20-test_kdf.t
+2 -2
View File
@@ -25,8 +25,8 @@ my @kdf_tests = (
{ cmd => [qw{openssl kdf -keylen 10 -kdfopt digest:SHA256 -kdfopt key:secret -kdfopt salt:salt -kdfopt info:label HKDF}],
expected => '2a:c4:36:9f:52:59:96:f8:de:13',
desc => 'HKDF SHA256' },
{ cmd => [qw{openssl kdf -keylen 32 -kdfopt digest:SHA256 -kdfopt pass:password -kdfopt salt:salt -kdfopt iter:2 PBKDF2}],
expected => 'ae:4d:0c:95:af:6b:46:d3:2d:0a:df:f9:28:f0:6d:d0:2a:30:3f:8e:f3:c2:51:df:d6:e2:d8:5a:95:47:4c:43',
{ cmd => [qw{openssl kdf -keylen 25 -kdfopt digest:SHA256 -kdfopt pass:passwordPASSWORDpassword -kdfopt salt:saltSALTsaltSALTsaltSALTsaltSALTsalt -kdfopt iter:4096 PBKDF2}],
expected => '34:8C:89:DB:CB:D3:2B:2F:32:D8:14:B8:11:6E:84:CF:2B:17:34:7E:BC:18:00:18:1C',
desc => 'PBKDF2 SHA256'},
{ cmd => [qw{openssl kdf -keylen 64 -kdfopt mac:KMAC128 -kdfopt maclen:20 -kdfopt hexkey:b74a149a161546f8c20b06ac4ed4 -kdfopt hexinfo:348a37a27ef1282f5f020dcc -kdfopt hexsalt:3638271ccd68a25dc24ecddd39ef3f89 SSKDF}],
expected => 'e9:c1:84:53:a0:62:b5:3b:db:fc:bb:5a:34:bd:b8:e5:e7:07:ee:bb:5d:d1:34:42:43:d8:cf:c2:c2:e6:33:2f:91:bd:a5:86:f3:7d:e4:8a:65:d4:c5:14:fd:ef:aa:1e:67:54:f3:73:d2:38:e1:95:ae:15:7e:1d:e8:14:98:03',
test/recipes/20-test_pkeyutl.t
+3 -3
View File
@@ -10,7 +10,7 @@ use strict;
use warnings;
use File::Spec;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
use OpenSSL::Test qw/:DEFAULT srctop_file ok_nofips/;
use OpenSSL::Test::Utils;
setup("test_pkeyutl");
@@ -24,13 +24,13 @@ SKIP: {
if disabled("ec") || disabled("sm2") || disabled("sm3");
# SM2
ok(run(app(([ 'openssl', 'pkeyutl', '-sign',
ok_nofips(run(app(([ 'openssl', 'pkeyutl', '-sign',
'-in', srctop_file('test', 'certs', 'sm2.pem'),
'-inkey', srctop_file('test', 'certs', 'sm2.key'),
'-out', 'signature.dat', '-rawin',
'-digest', 'sm3', '-pkeyopt', 'sm2_id:someid']))),
"Sign a piece of data using SM2");
ok(run(app(([ 'openssl', 'pkeyutl', '-verify', '-certin',
ok_nofips(run(app(([ 'openssl', 'pkeyutl', '-verify', '-certin',
'-in', srctop_file('test', 'certs', 'sm2.pem'),
'-inkey', srctop_file('test', 'certs', 'sm2.pem'),
'-sigfile', 'signature.dat', '-rawin',
test/recipes/25-test_req.t
+20 -1
View File
@@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;
setup("test_req");
plan tests => 9;
plan tests => 10;
require_ok(srctop_file('test','recipes','tconversion.pl'));
@@ -58,6 +58,25 @@ subtest "generating certificate requests" => sub {
"Verifying signature on request");
};
subtest "generating SM2 certificate requests" => sub {
plan tests => 2;
SKIP: {
skip "SM2 is not supported by this OpenSSL build", 2
if disabled("sm2");
ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
"-new", "-key", srctop_file("test", "certs", "sm2.key"),
"-sigopt", "sm2_id:1234567812345678",
"-out", "testreq.pem", "-sm3"])),
"Generating SM2 certificate request");
ok(run(app(["openssl", "req", "-config", srctop_file("test", "test.cnf"),
"-verify", "-in", "testreq.pem", "-noout",
"-sm2-id", "1234567812345678", "-sm3"])),
"Verifying signature on SM2 certificate request");
}
};
my @openssl_args = ("req", "-config", srctop_file("apps", "openssl.cnf"));
run_conversion('req conversions',
test/recipes/25-test_verify.t
+3 -3
View File
@@ -11,7 +11,7 @@ use strict;
use warnings;
use File::Spec::Functions qw/canonpath/;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
use OpenSSL::Test qw/:DEFAULT srctop_file ok_nofips/;
use OpenSSL::Test::Utils;
setup("test_verify");
@@ -379,9 +379,9 @@ SKIP: {
if disabled("sm2");
# Test '-sm2-id' and '-sm2-hex-id' option
ok(verify("sm2", "any", ["sm2-ca-cert"], [], "-sm2-id", "1234567812345678"),
ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-sm2-id", "1234567812345678"),
"SM2 ID test");
ok(verify("sm2", "any", ["sm2-ca-cert"], [], "-sm2-hex-id",
ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-sm2-hex-id",
"31323334353637383132333435363738"),
"SM2 hex ID test");
}
test/recipes/30-test_evp.t
+3 -1
View File
@@ -10,7 +10,7 @@
use strict;
use warnings;
use OpenSSL::Test qw/:DEFAULT data_file/;
use OpenSSL::Test qw(:DEFAULT data_file bldtop_dir);
setup("test_evp");
@@ -20,6 +20,8 @@ my @files = ( "evpciph.txt", "evpdigest.txt", "evpencod.txt", "evpkdf.txt",
plan tests => scalar(@files);
$ENV{OPENSSL_MODULES} = bldtop_dir("providers");
foreach my $f ( @files ) {
ok(run(test(["evp_test", data_file("$f")])),
"running evp_test $f");
test/recipes/30-test_evp_data/evpciph.txt
+21
View File
@@ -1190,13 +1190,34 @@ Result = CIPHERFINAL_ERROR
Title = AES XTS test vectors from IEEE Std 1619-2007
# Using the same key twice for encryption is always banned.
Cipher = aes-128-xts
Operation = ENCRYPT
Key = 0000000000000000000000000000000000000000000000000000000000000000
IV = 00000000000000000000000000000000
Plaintext = 0000000000000000000000000000000000000000000000000000000000000000
Ciphertext = 917cf69ebd68b2ec9b9fe9a3eadda692cd43d2f59598ed858c02c2652fbf922e
Result = KEY_SET_ERROR
# Using the same key twice for decryption is banned in FIPS mode.
#Cipher = aes-128-xts
#FIPS = YES
#Operation = DECRYPT
#Key = 0000000000000000000000000000000000000000000000000000000000000000
#IV = 00000000000000000000000000000000
#Plaintext = 0000000000000000000000000000000000000000000000000000000000000000
#Ciphertext = 917cf69ebd68b2ec9b9fe9a3eadda692cd43d2f59598ed858c02c2652fbf922e
#Result = KEY_SET_ERROR
# Using the same key twice for decryption is allowed outside of FIPS mode.
Cipher = aes-128-xts
#FIPS = NO
Operation = DECRYPT
Key = 0000000000000000000000000000000000000000000000000000000000000000
IV = 00000000000000000000000000000000
Plaintext = 0000000000000000000000000000000000000000000000000000000000000000
Ciphertext = 917cf69ebd68b2ec9b9fe9a3eadda692cd43d2f59598ed858c02c2652fbf922e
Cipher = aes-128-xts
Key = 1111111111111111111111111111111122222222222222222222222222222222
IV = 33333333330000000000000000000000
test/recipes/30-test_evp_data/evpdigest.txt
+24 -1
View File
@@ -276,104 +276,127 @@ Title = MD4 tests
Digest = MD4
Input = ""
Output = 31d6cfe0d16ae931b73c59d7e0c089c0
Legacy = 1
Digest = MD4
Input = "a"
Output = bde52cb31de33e46245e05fbdbd6fb24
Legacy = 1
Digest = MD4
Input = "abc"
Output = a448017aaf21d8525fc10ae87aa6729d
Legacy = 1
Digest = MD4
Input = "message digest"
Output = d9130a8164549fe818874806e1c7014b
Legacy = 1
Digest = MD4
Input = "abcdefghijklmnopqrstuvwxyz"
Output = d79e1c308aa5bbcdeea8ed63df412da9
Legacy = 1
Digest = MD4
Input = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
Output = 043f8582f241db351ce627e153e7f0e4
Legacy = 1
Digest = MD4
Input = "12345678901234567890123456789012345678901234567890123456789012345678901234567890"
Output = e33b4ddc9c38f2199c3e7b164fcc0536
Legacy = 1
Title = RIPEMD160 tests
Digest = RIPEMD160
Input = ""
Output = 9c1185a5c5e9fc54612808977ee8f548b2258d31
Legacy = 1
Digest = RIPEMD160
Input = "a"
Output = 0bdc9d2d256b3ee9daae347be6f4dc835a467ffe
Legacy = 1
Digest = RIPEMD160
Input = "abc"
Output = 8eb208f7e05d987a9b044a8e98c6b087f15a0bfc
Legacy = 1
Digest = RIPEMD160
Input = "message digest"
Output = 5d0689ef49d2fae572b881b123a85ffa21595f36
Legacy = 1
Digest = RIPEMD160
Input = "abcdefghijklmnopqrstuvwxyz"
Output = f71c27109c692c1b56bbdceb5b9d2865b3708dbc
Legacy = 1
Digest = RIPEMD160
Input = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
Output = 12a053384a9c0c88e405a06c27dcf49ada62eb2b
Legacy = 1
Digest = RIPEMD160
Input = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
Output = b0e20b6e3116640286ed3a87a5713079b21f5189
Legacy = 1
Digest = RIPEMD160
Input = "12345678901234567890123456789012345678901234567890123456789012345678901234567890"
Output = 9b752e45573d4b39f4dbd3323cab82bf63326bfb
Legacy = 1
Title = Whirlpool (from ISO/IEC 10118-3 test vector set)
Digest = whirlpool
Input = ""
Output = 19FA61D75522A4669B44E39C1D2E1726C530232130D407F89AFEE0964997F7A73E83BE698B288FEBCF88E3E03C4F0757EA8964E59B63D93708B138CC42A66EB3
Legacy = 1
Digest = whirlpool
Input = "a"
Output = 8ACA2602792AEC6F11A67206531FB7D7F0DFF59413145E6973C45001D0087B42D11BC645413AEFF63A42391A39145A591A92200D560195E53B478584FDAE231A
Legacy = 1
Digest = whirlpool
Input = "abc"
Output = 4E2448A4C6F486BB16B6562C73B4020BF3043E3A731BCE721AE1B303D97E6D4C7181EEBDB6C57E277D0E34957114CBD6C797FC9D95D8B582D225292076D4EEF5
Legacy = 1
Digest = whirlpool
Input = "message digest"
Output = 378C84A4126E2DC6E56DCC7458377AAC838D00032230F53CE1F5700C0FFB4D3B8421557659EF55C106B4B52AC5A4AAA692ED920052838F3362E86DBD37A8903E
Legacy = 1
Digest = whirlpool
Input = "abcdefghijklmnopqrstuvwxyz"
Output = F1D754662636FFE92C82EBB9212A484A8D38631EAD4238F5442EE13B8054E41B08BF2A9251C30B6A0B8AAE86177AB4A6F68F673E7207865D5D9819A3DBA4EB3B
Legacy = 1
Digest = whirlpool
Input = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
Output = DC37E008CF9EE69BF11F00ED9ABA26901DD7C28CDEC066CC6AF42E40F82F3A1E08EBA26629129D8FB7CB57211B9281A65517CC879D7B962142C65F5A7AF01467
Legacy = 1
Digest = whirlpool
Input = "12345678901234567890123456789012345678901234567890123456789012345678901234567890"
Output = 466EF18BABB0154D25B9D38A6414F5C08784372BCCB204D6549C4AFADB6014294D5BD8DF2A6C44E538CD047B2681A51A2C60481E88C5A20B2C2A80CF3A9A083B
Legacy = 1
Digest = whirlpool
Input = "abcdbcdecdefdefgefghfghighijhijk"
Output = 2A987EA40F917061F5D6F0A0E4644F488A7A5A52DEEE656207C562F988E95C6916BDC8031BC5BE1B7B947639FE050B56939BAAA0ADFF9AE6745B7B181C3BE3FD
Legacy = 1
Digest = whirlpool
Input = "aaaaaaaaaa"
Count = 100000
Output = 0C99005BEB57EFF50A7CF005560DDF5D29057FD86B20BFD62DECA0F1CCEA4AF51FC15490EDDC47AF32BB2B66C34FF9AD8C6008AD677F77126953B226E4ED8B01
Legacy = 1
Title = SHA3
test/recipes/30-test_evp_data/evpkdf.txt
+30
View File
@@ -306,6 +306,7 @@ Result = INTERNAL_ERROR
Title = PBKDF2 tests
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:1
@@ -313,6 +314,7 @@ Ctrl.digest = digest:sha1
Output = 0c60c80f961f0e71f3a9b524af6012062fe037a6
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:1
@@ -320,6 +322,7 @@ Ctrl.digest = digest:sha256
Output = 120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:1
@@ -327,6 +330,7 @@ Ctrl.digest = digest:sha512
Output = 867f70cf1ade02cff3752599a3a53dc4af34c7a669815ae5d513554e1c8cf252c02d470a285a0501bad999bfe943c08f050235d7d68b1da55e63f73b60a57fce
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:2
@@ -334,6 +338,7 @@ Ctrl.digest = digest:sha1
Output = ea6c014dc72d6f8ccd1ed92ace1d41f0d8de8957
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:2
@@ -341,6 +346,7 @@ Ctrl.digest = digest:sha256
Output = ae4d0c95af6b46d32d0adff928f06dd02a303f8ef3c251dfd6e2d85a95474c43
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:2
@@ -348,6 +354,7 @@ Ctrl.digest = digest:sha512
Output = e1d9c16aa681708a45f5c7c4e215ceb66e011a2e9f0040713f18aefdb866d53cf76cab2868a39b9f7840edce4fef5a82be67335c77a6068e04112754f27ccf4e
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:4096
@@ -355,6 +362,7 @@ Ctrl.digest = digest:sha1
Output = 4b007901b765489abead49d926f721d065a429c1
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:4096
@@ -362,6 +370,7 @@ Ctrl.digest = digest:sha256
Output = c5e478d59288c841aa530db6845c4c8d962893a001ce4e11a4963873aa98134a
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:password
Ctrl.salt = salt:salt
Ctrl.iter = iter:4096
@@ -390,6 +399,7 @@ Ctrl.digest = digest:sha512
Output = 8c0511f4c6e597c6ac6315d8f0362e225f3c501495ba23b868c005174dc4ee71115b59f9e60cd9532fa33e0f75aefe30225c583a186cd82bd4daea9724a3d3b8
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.hexpass = hexpass:7061737300776f7264
Ctrl.hexsalt = hexsalt:7361006c74
Ctrl.iter = iter:4096
@@ -397,6 +407,7 @@ Ctrl.digest = digest:sha1
Output = 56fa6aa75548099dcc37d7f03425e0c3
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.hexpass = hexpass:7061737300776f7264
Ctrl.hexsalt = hexsalt:7361006c74
Ctrl.iter = iter:4096
@@ -404,6 +415,7 @@ Ctrl.digest = digest:sha256
Output = 89b69d0516f829893c696226650a8687
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.hexpass = hexpass:7061737300776f7264
Ctrl.hexsalt = hexsalt:7361006c74
Ctrl.iter = iter:4096
@@ -413,6 +425,7 @@ Output = 9d9e9c4cd21fe4be24d5b8244c759665
Title = PBKDF2 tests for empty inputs
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:
Ctrl.salt = salt:salt
Ctrl.iter = iter:1
@@ -420,6 +433,7 @@ Ctrl.digest = digest:sha1
Output = a33dddc30478185515311f8752895d36ea4363a2
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:
Ctrl.salt = salt:salt
Ctrl.iter = iter:1
@@ -427,6 +441,7 @@ Ctrl.digest = digest:sha256
Output = f135c27993baf98773c5cdb40a5706ce6a345cde
KDF = PBKDF2
Ctrl.pkcs5 = pkcs5:1
Ctrl.pass = pass:
Ctrl.salt = salt:salt
Ctrl.iter = iter:1
@@ -6473,3 +6488,18 @@ Ctrl.digest = digest:SHA512
Ctrl.hexsecret = hexsecret:0037cd001a0ad87f35ddf58ab355d6144ba2ed0749a7435dab548ba0bfbe723c047e2396b4eef99653412a92c8db74bb5c03063f2eb0525ae87356750ae3676faa86
Ctrl.hexinfo = hexinfo:eb17da8851c41c7ac6710b1c49f324f8
Output = 829a28b81f9e95b5f306604067499c07d5944ca034ed130d513951f7143e4e162bad8adb2833e53b8235c293cd2a809659ac7f7e392cba6a543660e5d95070c0c9e6a9cdc38123e22da61bb4cbb6ad6d1a58a069e934fc231bd9fe39a24afcbf322ccea385f0418f3b01c1edd6e7124593a1cefe3e48fcd95daaf72cfd973c59
Title = X9.42 KDF tests (from RFC2631 test vectors)
KDF = X942KDF
Ctrl.digest = digest:SHA1
Ctrl.hexsecret = hexsecret:000102030405060708090a0b0c0d0e0f10111213
Ctrl.cekalg = cekalg:id-smime-alg-CMS3DESwrap
Output = a09661392376f7044d9052a397883246b67f5f1ef63eb5fb
KDF = X942KDF
Ctrl.digest = digest:SHA1
Ctrl.hexsecret = hexsecret:000102030405060708090a0b0c0d0e0f10111213
Ctrl.cekalg = cekalg:id-smime-alg-CMSRC2wrap
Ctrl.hexukm = hexukm:0123456789abcdeffedcba98765432010123456789abcdeffedcba98765432010123456789abcdeffedcba98765432010123456789abcdeffedcba9876543201
Output = 48950c46e0530075403cce72889604e0
test/recipes/70-test_clienthello.t
+4
View File
@@ -15,6 +15,10 @@ setup("test_clienthello");
plan skip_all => "No TLS/SSL protocols are supported by this OpenSSL build"
if alldisabled(grep { $_ ne "ssl3" } available_protocols("tls"));
#No EC with TLSv1.3 confuses the padding calculations in this test
plan skip_all => "No EC with TLSv1.3 is not supported by this test"
if disabled("ec") && !disabled("tls1_3");
plan tests => 1;
ok(run(test(["clienthellotest", srctop_file("test", "session.pem")])),
test/recipes/70-test_key_share.t
+73 -19
View File
@@ -36,7 +36,9 @@ use constant {
use constant {
X25519 => 0x1d,
P_256 => 0x17
P_256 => 0x17,
FFDHE2048 => 0x0100,
FFDHE3072 => 0x0101
};
my $testtype;
@@ -74,7 +76,11 @@ my $proxy = TLSProxy::Proxy->new(
$testtype = EMPTY_EXTENSION;
$direction = CLIENT_TO_SERVER;
$proxy->filter(\&modify_key_shares_filter);
$proxy->serverflags("-curves P-256");
if (disabled("ec")) {
$proxy->serverflags("-groups ffdhe3072");
} else {
$proxy->serverflags("-groups P-256");
}
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 22;
ok(TLSProxy::Message->success(), "Success after HRR");
@@ -95,31 +101,52 @@ ok(TLSProxy::Message->fail(), "Missing key_shares extension");
# HelloRetryRequest
$proxy->clear();
$proxy->filter(undef);
$proxy->serverflags("-curves P-256");
if (disabled("ec")) {
$proxy->serverflags("-groups ffdhe3072");
} else {
$proxy->serverflags("-groups P-256");
}
$proxy->start();
ok(TLSProxy::Message->success(), "No initial acceptable key_shares");
#Test 5: No acceptable key_shares and no shared groups should fail
$proxy->clear();
$proxy->filter(undef);
$proxy->serverflags("-curves P-256");
$proxy->clientflags("-curves P-384");
if (disabled("ec")) {
$proxy->serverflags("-groups ffdhe2048");
} else {
$proxy->serverflags("-groups P-256");
}
if (disabled("ec")) {
$proxy->clientflags("-groups ffdhe3072");
} else {
$proxy->clientflags("-groups P-384");
}
$proxy->start();
ok(TLSProxy::Message->fail(), "No acceptable key_shares");
#Test 6: A non preferred but acceptable key_share should succeed
$proxy->clear();
$proxy->clientflags("-curves P-256");
if (disabled("ec")) {
$proxy->clientflags("-groups ffdhe3072");
} else {
$proxy->clientflags("-groups P-256");
}
$proxy->start();
ok(TLSProxy::Message->success(), "Non preferred key_share");
$proxy->filter(\&modify_key_shares_filter);
#Test 7: An acceptable key_share after a list of non-acceptable ones should
#succeed
$proxy->clear();
$testtype = ACCEPTABLE_AT_END;
$proxy->start();
ok(TLSProxy::Message->success(), "Acceptable key_share at end of list");
SKIP: {
skip "No ec support in this OpenSSL build", 1 if disabled("ec");
#Test 7: An acceptable key_share after a list of non-acceptable ones should
#succeed
$proxy->clear();
$testtype = ACCEPTABLE_AT_END;
$proxy->start();
ok(TLSProxy::Message->success(), "Acceptable key_share at end of list");
}
#Test 8: An acceptable key_share but for a group not in supported_groups should
#fail
@@ -156,22 +183,45 @@ ok(TLSProxy::Message->fail(), "key_share list trailing data");
$proxy->clear();
$direction = SERVER_TO_CLIENT;
$testtype = LOOK_ONLY;
$proxy->clientflags("-curves P-256:X25519");
$selectedgroupid = 0;
if (disabled("ec")) {
$proxy->clientflags("-groups ffdhe3072:ffdhe2048");
} else {
$proxy->clientflags("-groups P-256:X25519");
}
$proxy->start();
ok(TLSProxy::Message->success() && ($selectedgroupid == P_256),
"Multiple acceptable key_shares");
if (disabled("ec")) {
ok(TLSProxy::Message->success() && ($selectedgroupid == FFDHE3072),
"Multiple acceptable key_shares");
} else {
ok(TLSProxy::Message->success() && ($selectedgroupid == P_256),
"Multiple acceptable key_shares");
}
#Test 14: Multiple acceptable key_shares - we choose the first one (part 2)
$proxy->clear();
$proxy->clientflags("-curves X25519:P-256");
if (disabled("ec")) {
$proxy->clientflags("-curves ffdhe2048:ffdhe3072");
} else {
$proxy->clientflags("-curves X25519:P-256");
}
$proxy->start();
ok(TLSProxy::Message->success() && ($selectedgroupid == X25519),
"Multiple acceptable key_shares (part 2)");
if (disabled("ec")) {
ok(TLSProxy::Message->success() && ($selectedgroupid == FFDHE2048),
"Multiple acceptable key_shares (part 2)");
} else {
ok(TLSProxy::Message->success() && ($selectedgroupid == X25519),
"Multiple acceptable key_shares (part 2)");
}
#Test 15: Server sends key_share that wasn't offered should fail
$proxy->clear();
$testtype = SELECT_X25519;
$proxy->clientflags("-curves P-256");
if (disabled("ec")) {
$proxy->clientflags("-groups ffdhe3072");
} else {
$proxy->clientflags("-groups P-256");
}
$proxy->start();
ok(TLSProxy::Message->fail(), "Non offered key_share");
@@ -229,7 +279,11 @@ SKIP: {
$proxy->clear();
$direction = SERVER_TO_CLIENT;
$testtype = NO_KEY_SHARES_IN_HRR;
$proxy->serverflags("-curves X25519");
if (disabled("ec")) {
$proxy->serverflags("-groups ffdhe2048");
} else {
$proxy->serverflags("-groups X25519");
}
$proxy->start();
ok(TLSProxy::Message->fail(), "Server sends HRR with no key_shares");
test/recipes/70-test_sslextension.t
+4 -1
View File
@@ -217,7 +217,10 @@ SKIP: {
$proxy->clientflags("-no_tls1_3 -noservername");
$proxy->start();
ok($fatal_alert, "Unsolicited server name extension");
}
SKIP: {
skip "TLS <= 1.2 disabled or EC disabled", 1
if $no_below_tls13 || disabled("ec");
#Test 5: Inject a noncompliant supported_groups extension (<= TLSv1.2)
$proxy->clear();
$proxy->filter(\&inject_unsolicited_extension);
test/recipes/70-test_tls13cookie.t
+14 -4
View File
@@ -46,17 +46,27 @@ my $testtype;
#Test 1: Inserting a cookie into an HRR should see it echoed in the ClientHello
$testtype = COOKIE_ONLY;
$proxy->filter(\&cookie_filter);
$proxy->serverflags("-curves X25519");
$proxy->serverflags("-curves X25519") if !disabled("ec");
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 2;
ok(TLSProxy::Message->success() && $cookieseen == 1, "Cookie seen");
SKIP: {
skip "EC disabled", 1, if disabled("ec");
ok(TLSProxy::Message->success() && $cookieseen == 1, "Cookie seen");
}
#Test 2: Same as test 1 but should also work where a new key_share is also
# required
$testtype = COOKIE_AND_KEY_SHARE;
$proxy->clear();
$proxy->clientflags("-curves P-256:X25519");
$proxy->serverflags("-curves X25519");
if (disabled("ec")) {
$proxy->clientflags("-curves ffdhe3072:ffdhe2048");
$proxy->serverflags("-curves ffdhe2048");
} else {
$proxy->clientflags("-curves P-256:X25519");
$proxy->serverflags("-curves X25519");
}
$proxy->start();
ok(TLSProxy::Message->success() && $cookieseen == 1, "Cookie seen");
test/recipes/70-test_tls13hrr.t
+10 -2
View File
@@ -43,7 +43,11 @@ use constant {
#Test 1: A client should fail if the server changes the ciphersuite between the
# HRR and the SH
$proxy->filter(\&hrr_filter);
$proxy->serverflags("-curves P-256");
if (disabled("ec")) {
$proxy->serverflags("-curves ffdhe3072");
} else {
$proxy->serverflags("-curves P-256");
}
my $testtype = CHANGE_HRR_CIPHERSUITE;
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 2;
@@ -52,7 +56,11 @@ ok(TLSProxy::Message->fail(), "Server ciphersuite changes");
#Test 2: It is an error if the client changes the offered ciphersuites so that
# we end up selecting a different ciphersuite between HRR and the SH
$proxy->clear();
$proxy->serverflags("-curves P-256");
if (disabled("ec")) {
$proxy->serverflags("-curves ffdhe3072");
} else {
$proxy->serverflags("-curves P-256");
}
$proxy->ciphersuitess("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384");
$testtype = CHANGE_CH1_CIPHERSUITE;
$proxy->start();
test/recipes/70-test_tls13kexmodes.t
+3
View File
@@ -28,6 +28,9 @@ plan skip_all => "$test_name needs the sock feature enabled"
plan skip_all => "$test_name needs TLSv1.3 enabled"
if disabled("tls1_3");
plan skip_all => "$test_name needs EC enabled"
if disabled("ec");
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
test/recipes/70-test_tls13messages.t
+3
View File
@@ -28,6 +28,9 @@ plan skip_all => "$test_name needs the sock feature enabled"
plan skip_all => "$test_name needs TLSv1.3 enabled"
if disabled("tls1_3");
plan skip_all => "$test_name needs EC enabled"
if disabled("ec");
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
test/recipes/70-test_tls13psk.t
+10 -2
View File
@@ -66,7 +66,11 @@ ok(TLSProxy::Message->fail(), "PSK not last");
# ciphersuite. Should see PSK on second ClientHello
$proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->serverflags("-curves P-256");
if (disabled("ec")) {
$proxy->serverflags("-curves ffdhe3072");
} else {
$proxy->serverflags("-curves P-256");
}
$proxy->filter(undef);
$proxy->start();
#Check if the PSK is present in the second ClientHello
@@ -81,7 +85,11 @@ ok($pskseen, "PSK hash matches");
$proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->filter(\&modify_psk_filter);
$proxy->serverflags("-curves P-256");
if (disabled("ec")) {
$proxy->serverflags("-curves ffdhe3072");
} else {
$proxy->serverflags("-curves P-256");
}
$proxy->ciphersuitesc("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384");
$proxy->ciphersuitess("TLS_AES_256_GCM_SHA384");
#We force an early failure because TLS Proxy doesn't actually support
test/recipes/70-test_verify_extra.t
+2 -1
View File
@@ -16,4 +16,5 @@ plan tests => 1;
ok(run(test(["verify_extra_test",
srctop_file("test", "certs", "roots.pem"),
srctop_file("test", "certs", "untrusted.pem"),
srctop_file("test", "certs", "bad.pem")])));
srctop_file("test", "certs", "bad.pem"),
srctop_file("test", "certs", "sm2-csr.pem")])));
test/recipes/80-test_ca.t
+18 -2
View File
@@ -23,7 +23,7 @@ my $std_openssl_cnf =
rmtree("demoCA", { safe => 0 });
plan tests => 5;
plan tests => 6;
SKIP: {
$ENV{OPENSSL_CONFIG} = '-config "'.srctop_file("test", "CAss.cnf").'"';
skip "failed creating CA structure", 4
@@ -51,9 +51,25 @@ plan tests => 5;
'creating new pre-certificate');
}
SKIP: {
skip "SM2 is not supported by this OpenSSL build", 1
if disabled("sm2");
is(yes(cmdstr(app(["openssl", "ca", "-config",
srctop_file("test", "CAss.cnf"),
"-in", srctop_file("test", "certs", "sm2-csr.pem"),
"-out", "sm2-test.crt",
"-sigopt", "sm2_id:1234567812345678",
"-sm2-id", "1234567812345678",
"-md", "sm3",
"-cert", srctop_file("test", "certs", "sm2-root.crt"),
"-keyfile", srctop_file("test", "certs", "sm2-root.key")]))),
0,
"Signing SM2 certificate request");
}
rmtree("demoCA", { safe => 0 });
unlink "newcert.pem", "newreq.pem", "newkey.pem";
unlink "newcert.pem", "newreq.pem", "newkey.pem", "sm2-test.crt";
sub yes {
test/recipes/80-test_cms.t
+68 -1
View File
@@ -21,12 +21,13 @@ setup("test_cms");
plan skip_all => "CMS is not supported by this OpenSSL build"
if disabled("cms");
my $datadir = srctop_dir("test", "recipes", "80-test_cms_data");
my $smdir = srctop_dir("test", "smime-certs");
my $smcont = srctop_file("test", "smcont.txt");
my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib)
= disabled qw/des dh dsa ec ec2m rc2 zlib/;
plan tests => 4;
plan tests => 6;
my @smime_pkcs7_tests = (
@@ -416,6 +417,26 @@ my @smime_cms_param_tests = (
]
);
my @contenttype_cms_test = (
[ "signed content test - check that content type is added to additional signerinfo, RSA keys",
[ "-sign", "-binary", "-nodetach", "-stream", "-in", $smcont, "-outform", "DER",
"-signer", catfile($smdir, "smrsa1.pem"), "-md", "SHA256",
"-out", "test.cms" ],
[ "-resign", "-binary", "-nodetach", "-in", "test.cms", "-inform", "DER", "-outform", "DER",
"-signer", catfile($smdir, "smrsa2.pem"), "-md", "SHA256",
"-out", "test2.cms" ],
[ "-verify", "-in", "test2.cms", "-inform", "DER",
"-CAfile", catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ]
],
);
my @incorrect_attribute_cms_test = (
"bad_signtime_attr.cms",
"no_ct_attr.cms",
"no_md_attr.cms",
"ct_multiple_attr.cms"
);
subtest "CMS => PKCS#7 compatibility tests\n" => sub {
plan tests => scalar @smime_pkcs7_tests;
@@ -509,6 +530,52 @@ subtest "CMS <=> CMS consistency tests, modified key parameters\n" => sub {
}
};
# Returns the number of matches of a Content Type Attribute in a binary file.
sub contentType_matches {
# Read in a binary file
my ($in) = @_;
open (HEX_IN, "$in") or die("open failed for $in : $!");
binmode(HEX_IN);
local $/;
my $str = <HEX_IN>;
# Find ASN1 data for a Content Type Attribute (with a OID of PKCS7 data)
my @c = $str =~ /\x30\x18\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x09\x03\x31\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x01/gs;
close(HEX_IN);
return scalar(@c);
}
subtest "CMS Check the content type attribute is added for additional signers\n" => sub {
plan tests =>
(scalar @contenttype_cms_test);
foreach (@contenttype_cms_test) {
SKIP: {
my $skip_reason = check_availability($$_[0]);
skip $skip_reason, 1 if $skip_reason;
ok(run(app(["openssl", "cms", @{$$_[1]}]))
&& run(app(["openssl", "cms", @{$$_[2]}]))
&& contentType_matches("test2.cms") == 2
&& run(app(["openssl", "cms", @{$$_[3]}])),
$$_[0]);
}
}
};
subtest "CMS Check that bad attributes fail when verifying signers\n" => sub {
plan tests =>
(scalar @incorrect_attribute_cms_test);
foreach my $name (@incorrect_attribute_cms_test) {
ok(!run(app(["openssl", "cms", "-verify", "-in",
catfile($datadir, $name), "-inform", "DER", "-CAfile",
catfile($smdir, "smroot.pem"), "-out", "smtst.txt" ])),
$name);
}
};
unlink "test.cms";
unlink "test2.cms";
unlink "smtst.txt";
test/recipes/80-test_cms_data/bad_signtime_attr.cms
BIN
View File
Binary file not shown.
test/recipes/80-test_cms_data/ct_multiple_attr.cms
BIN
View File
Binary file not shown.
test/recipes/80-test_cms_data/no_ct_attr.cms
BIN
View File
Binary file not shown.
test/recipes/80-test_cms_data/no_md_attr.cms
BIN
View File
Binary file not shown.
test/recipes/80-test_ssl_new.t
+1 -1
View File
@@ -59,7 +59,7 @@ my %conf_dependent_tests = (
|| !disabled("sctp"),
"05-sni.conf" => disabled("tls1_1"),
"07-dtls-protocol-version.conf" => !$is_default_dtls || !disabled("sctp"),
"10-resumption.conf" => !$is_default_tls,
"10-resumption.conf" => !$is_default_tls || $no_ec,
"11-dtls_resumption.conf" => !$is_default_dtls || !disabled("sctp"),
"16-dtls-certstatus.conf" => !$is_default_dtls || !disabled("sctp"),
"17-renegotiate.conf" => disabled("tls1_2"),
test/recipes/90-test_gost.t
+4
View File
@@ -21,6 +21,10 @@ plan skip_all => "GOST support is disabled in this OpenSSL build"
plan skip_all => "TLSv1.3 or TLSv1.2 are disabled in this OpenSSL build"
if disabled("tls1_3") || disabled("tls1_2");
plan skip_all => "EC is disabled in this OpenSSL build"
if disabled("ec");
plan skip_all => "No test GOST engine found"
if !$ENV{OPENSSL_GOST_ENGINE_SO};