Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-02-11 23:20:44 +09:00
parent 047a30700b
commit 9dfeec3942
639 changed files with 14024 additions and 31198 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/asynciotest.c
+5
View File
@@ -397,6 +397,11 @@ OPT_TEST_DECLARE_USAGE("certname privkey\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(privkey = test_get_argument(1)))
return 0;
test/bad_dtls_test.c
+23 -11
View File
@@ -29,6 +29,8 @@
*/
#include <string.h>
#include <openssl/core_names.h>
#include <openssl/params.h>
#include <openssl/opensslconf.h>
#include <openssl/bio.h>
#include <openssl/crypto.h>
@@ -278,11 +280,13 @@ static int send_record(BIO *rbio, unsigned char type, uint64_t seqnr,
static unsigned char seq[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
static unsigned char ver[2] = { 0x01, 0x00 }; /* DTLS1_BAD_VER */
unsigned char lenbytes[2];
HMAC_CTX *ctx;
EVP_MAC *hmac;
EVP_MAC_CTX *ctx;
EVP_CIPHER_CTX *enc_ctx;
unsigned char iv[16];
unsigned char pad;
unsigned char *enc;
OSSL_PARAM params[3];
seq[0] = (seqnr >> 40) & 0xff;
seq[1] = (seqnr >> 32) & 0xff;
@@ -300,18 +304,26 @@ static int send_record(BIO *rbio, unsigned char type, uint64_t seqnr,
memcpy(enc, msg, len);
/* Append HMAC to data */
ctx = HMAC_CTX_new();
HMAC_Init_ex(ctx, mac_key, 20, EVP_sha1(), NULL);
HMAC_Update(ctx, epoch, 2);
HMAC_Update(ctx, seq, 6);
HMAC_Update(ctx, &type, 1);
HMAC_Update(ctx, ver, 2); /* Version */
hmac = EVP_MAC_fetch(NULL, "HMAC", NULL);
ctx = EVP_MAC_CTX_new(hmac);
EVP_MAC_free(hmac);
params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
"SHA1", 0);
params[1] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
mac_key, 20);
params[2] = OSSL_PARAM_construct_end();
EVP_MAC_CTX_set_params(ctx, params);
EVP_MAC_init(ctx);
EVP_MAC_update(ctx, epoch, 2);
EVP_MAC_update(ctx, seq, 6);
EVP_MAC_update(ctx, &type, 1);
EVP_MAC_update(ctx, ver, 2); /* Version */
lenbytes[0] = (unsigned char)(len >> 8);
lenbytes[1] = (unsigned char)(len);
HMAC_Update(ctx, lenbytes, 2); /* Length */
HMAC_Update(ctx, enc, len); /* Finally the data itself */
HMAC_Final(ctx, enc + len, NULL);
HMAC_CTX_free(ctx);
EVP_MAC_update(ctx, lenbytes, 2); /* Length */
EVP_MAC_update(ctx, enc, len); /* Finally the data itself */
EVP_MAC_final(ctx, enc + len, NULL, SHA_DIGEST_LENGTH);
EVP_MAC_CTX_free(ctx);
/* Append padding bytes */
len += SHA_DIGEST_LENGTH;
test/build.info
+30 -20
View File
@@ -32,8 +32,7 @@ IF[{- !$disabled{tests} -}]
versions \
aborttest test_test \
sanitytest rsa_complex exdatatest bntest \
ectest ecstresstest ecdsatest gmdifftest pbelutest \
hmactest \
ectest ecstresstest gmdifftest pbelutest \
destest mdc2test \
dhtest enginetest \
ssltest_old dsatest dsa_no_digest_size_test exptest rsa_test \
@@ -46,8 +45,8 @@ IF[{- !$disabled{tests} -}]
dtlsv1listentest ct_test threadstest afalgtest d2i_test \
ssl_test_ctx_test ssl_test x509aux cipherlist_test asynciotest \
bio_callback_test bio_memleak_test param_build_test \
bioprinttest sslapitest dtlstest sslcorrupttest bio_enc_test \
pkey_meth_test pkey_meth_kdf_test evp_kdf_test uitest \
bioprinttest sslapitest sslprovidertest dtlstest sslcorrupttest \
bio_enc_test pkey_meth_test pkey_meth_kdf_test evp_kdf_test uitest \
cipherbytes_test \
asn1_encode_test asn1_decode_test asn1_string_table_test \
x509_time_test x509_dup_cert_test x509_check_cert_pkey_test \
@@ -98,10 +97,6 @@ IF[{- !$disabled{tests} -}]
INCLUDE[ecstresstest]=../include ../apps/include
DEPEND[ecstresstest]=../libcrypto libtestutil.a
SOURCE[ecdsatest]=ecdsatest.c
INCLUDE[ecdsatest]=../include ../apps/include
DEPEND[ecdsatest]=../libcrypto libtestutil.a
SOURCE[gmdifftest]=gmdifftest.c
INCLUDE[gmdifftest]=../include ../apps/include
DEPEND[gmdifftest]=../libcrypto libtestutil.a
@@ -110,14 +105,6 @@ IF[{- !$disabled{tests} -}]
INCLUDE[pbelutest]=../include ../apps/include
DEPEND[pbelutest]=../libcrypto libtestutil.a
SOURCE[hmactest]=hmactest.c
INCLUDE[hmactest]=../include ../apps/include
DEPEND[hmactest]=../libcrypto libtestutil.a
SOURCE[destest]=destest.c
INCLUDE[destest]=../include ../apps/include
DEPEND[destest]=../libcrypto libtestutil.a
SOURCE[mdc2test]=mdc2test.c
INCLUDE[mdc2test]=../include ../apps/include
DEPEND[mdc2test]=../libcrypto libtestutil.a
@@ -184,8 +171,7 @@ IF[{- !$disabled{tests} -}]
INCLUDE[evp_pkey_provided_test]=../include ../apps/include
DEPEND[evp_pkey_provided_test]=../libcrypto libtestutil.a
IF[{- !$disabled{"deprecated"}
|| (defined $config{"api"} && $config{"api"} < 30000) -}]
IF[{- !$disabled{'deprecated-3.0'} -}]
PROGRAMS{noinst}=igetest bftest casttest
SOURCE[igetest]=igetest.c
@@ -334,10 +320,22 @@ IF[{- !$disabled{tests} -}]
INCLUDE[sslapitest]=../include ../apps/include ..
DEPEND[sslapitest]=../libcrypto ../libssl libtestutil.a
SOURCE[sslprovidertest]=sslprovidertest.c ssltestlib.c
INCLUDE[sslprovidertest]=../include ../apps/include ..
DEPEND[sslprovidertest]=../libcrypto ../libssl libtestutil.a
SOURCE[ocspapitest]=ocspapitest.c
INCLUDE[ocspapitest]=../include ../apps/include
DEPEND[ocspapitest]=../libcrypto libtestutil.a
IF[{- !$disabled{sock} -}]
PROGRAMS{noinst}=http_test
ENDIF
SOURCE[http_test]=http_test.c
INCLUDE[http_test]=../include ../apps/include
DEPEND[http_test]=../libcrypto libtestutil.a
SOURCE[dtlstest]=dtlstest.c ssltestlib.c
INCLUDE[dtlstest]=../include ../apps/include
DEPEND[dtlstest]=../libcrypto ../libssl libtestutil.a
@@ -502,8 +500,8 @@ IF[{- !$disabled{tests} -}]
PROGRAMS{noinst}=asn1_internal_test modes_internal_test x509_internal_test \
tls13encryptiontest wpackettest ctype_internal_test \
rdrand_sanitytest property_test ideatest \
rsa_sp800_56b_test bn_internal_test \
rc2test rc4test rc5test \
rsa_sp800_56b_test bn_internal_test ecdsatest \
rc2test rc4test rc5test hmactest \
asn1_dsa_internal_test
IF[{- !$disabled{poly1305} -}]
@@ -545,6 +543,10 @@ IF[{- !$disabled{tests} -}]
INCLUDE[x509_internal_test]=.. ../include ../apps/include
DEPEND[x509_internal_test]=../libcrypto.a libtestutil.a
SOURCE[ecdsatest]=ecdsatest.c
INCLUDE[ecdsatest]=../include ../apps/include
DEPEND[ecdsatest]=../libcrypto.a libtestutil.a
SOURCE[tls13encryptiontest]=tls13encryptiontest.c
INCLUDE[tls13encryptiontest]=.. ../include ../apps/include
DEPEND[tls13encryptiontest]=../libcrypto ../libssl.a libtestutil.a
@@ -569,6 +571,10 @@ IF[{- !$disabled{tests} -}]
INCLUDE[sparse_array_test]=../crypto/include ../include ../apps/include
DEPEND[sparse_array_test]=../libcrypto.a libtestutil.a
SOURCE[hmactest]=hmactest.c
INCLUDE[hmactest]=../include ../apps/include
DEPEND[hmactest]=../libcrypto.a libtestutil.a
SOURCE[siphash_internal_test]=siphash_internal_test.c
INCLUDE[siphash_internal_test]=.. ../include ../apps/include ../crypto/include
DEPEND[siphash_internal_test]=../libcrypto.a libtestutil.a
@@ -581,6 +587,10 @@ IF[{- !$disabled{tests} -}]
INCLUDE[sm4_internal_test]=.. ../include ../apps/include ../crypto/include
DEPEND[sm4_internal_test]=../libcrypto.a libtestutil.a
SOURCE[destest]=destest.c
INCLUDE[destest]=../include ../apps/include
DEPEND[destest]=../libcrypto.a libtestutil.a
SOURCE[rc2test]=rc2test.c
INCLUDE[rc2test]=../include ../apps/include
DEPEND[rc2test]=../libcrypto.a libtestutil.a
test/certs/ct-server-key-public.pem
+4
View File
@@ -0,0 +1,4 @@
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmXg8sUUzwBYaWrRb+V0IopzQ6o3U
yEJ04r5ZrRXGdpYM8K+hB0pXrGRLI0eeWz+3skXrS0IO83AhA3GpRL6s6w==
-----END PUBLIC KEY-----
test/certs/ct-server-key.pem
+5
View File
@@ -0,0 +1,5 @@
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIFLw4uhuCruGKjrS9MoNeXFbypqZe+Sgh+EL1gnRn1d4oAoGCCqGSM49
AwEHoUQDQgAEmXg8sUUzwBYaWrRb+V0IopzQ6o3UyEJ04r5ZrRXGdpYM8K+hB0pX
rGRLI0eeWz+3skXrS0IO83AhA3GpRL6s6w==
-----END EC PRIVATE KEY-----
test/certs/embeddedSCTs1-key.pem
+25 -13
View File
@@ -1,15 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQC+75jnwmh3rjhfdTJaDB0ym+3xj6r015a/BH634c4VyVui+A7k
WL19uG+KSyUhkaeb1wDDjpwDibRc1NyaEgqyHgy0HNDnKAWkEM2cW9tdSSdyba8X
EPYBhzd+olsaHjnu0LiBGdwVTcaPfajjDK8VijPmyVCfSgWwFAn/Xdh+tQIDAQAB
AoGAK/daG0vt6Fkqy/hdrtSJSKUVRoGRmS2nnba4Qzlwzh1+x2kdbMFuaOu2a37g
PvmeQclheKZ3EG1+Jb4yShwLcBCV6pkRJhOKuhvqGnjngr6uBH4gMCjpZVj7GDMf
flYHhdJCs3Cz/TY0wKN3o1Fldil2DHR/AEOc1nImeSp5/EUCQQDjKS3W957kYtTU
X5BeRjvg03Ug8tJq6IFuhTFvUJ+XQ5bAc0DmxAbQVKqRS7Wje59zTknVvS+MFdeQ
pz4dGuV7AkEA1y0X2yarIls+0A/S1uwkvwRTIkfS+QwFJ1zVya8sApRdKAcidIzA
b70hkKLilU9+LrXg5iZdFp8l752qJiw9jwJAXjItN/7mfH4fExGto+or2kbVQxxt
9LcFNPc2UJp2ExuL37HrL8YJrUnukOF8KJaSwBWuuFsC5GwKP4maUCdfEQJAUwBR
83c3DEmmMRvpeH4erpA8gTyzZN3+HvDwhpvLnjMcvBQEdnDUykVqbSBnxrCjO+Fs
n1qtDczWFVf8Cj2GgQJAQ14Awx32Cn9sF+3M+sEVtlAf6CqiEbkYeYdSCbsplMmZ
1UoaxiwXY3z+B7epsRnnPR3KaceAlAxw2/zQJMFNOQ==
MIIEpQIBAAKCAQEAuIjpA4/iCpDA2mjywI5zG6IBX6bNcRQYDsB7Cv0VonNXtJBw
XxMENP4jVpvEmWpJ5iMBknGHV+XWBkngYapczIsY4LGn6aMU6ySABBVQpNOQSRfT
48xGGPR9mzOBG/yplmpFOVq1j+b65lskvAXKYaLFpFn3oY/pBSdcCNBP8LypVXAJ
b3IqEXsBL/ErgHG9bgIRP8VxBAaryCz77kLzAXkfHL2LfSGIfNONyEKB3xI94S4L
eouOSoWL1VkEfJs87vG4G5xoXw3KOHyiueQUUlMnu8p+Bx0xPVKPEsLje3R9k0rG
a5ca7dXAn9UypKKp25x4NXpnjGX5txVEYfNvqQIDAQABAoIBAE0zqhh9Z5n3+Vbm
tTht4CZdXqm/xQ9b0rzJNjDgtN5j1vuJuhlsgUQSVoJzZIqydvw7BPtZV8AkPagf
3Cm/9lb0kpHegVsziRrfCFes+zIZ+LE7sMAKxADIuIvnvkoRKHnvN8rI8lCj16/r
zbCD06mJSZp6sSj8ZgZr8wsU63zRGt1TeGM67uVW4agphfzuKGlXstPLsSMwknpF
nxFS2TYbitxa9oH76oCpEk5fywYsYgUP4TdzOzfVAgMzNSu0FobvWl0CECB+G3RQ
XQ5VWbYkFoj5XbE5kYz6sYHMQWL1NQpglUp+tAQ1T8Nca0CvbSpD77doRGm7UqYw
ziVQKokCgYEA6BtHwzyD1PHdAYtOcy7djrpnIMaiisSxEtMhctoxg8Vr2ePEvMpZ
S1ka8A1Pa9GzjaUk+VWKWsTf+VkmMHGtpB1sv8S7HjujlEmeQe7p8EltjstvLDmi
BhAA7ixvZpXXjQV4GCVdUVu0na6gFGGueZb2FHEXB8j1amVwleJj2lcCgYEAy4f3
2wXqJfz15+YdJPpG9BbH9d/plKJm5ID3p2ojAGo5qvVuIJMNJA4elcfHDwzCWVmn
MtR/WwtxYVVmy1BAnmk6HPSYc3CStvv1800vqN3fyJWtZ1P+8WBVZWZzIQdjdiaU
JSRevPnjQGc+SAZQQIk1yVclbz5790yuXsdIxf8CgYEApqlABC5lsvfga4Vt1UMn
j57FAkHe4KmPRCcZ83A88ZNGd/QWhkD9kR7wOsIz7wVqWiDkxavoZnjLIi4jP9HA
jwEZ3zER8wl70bRy0IEOtZzj8A6fSzAu6Q+Au4RokU6yse3lZ+EcepjQvhBvnXLu
ZxxAojj6AnsHzVf9WYJvlI0CgYEAoATIw/TEgRV/KNHs/BOiEWqP0Co5dVix2Nnk
3EVAO6VIrbbE3OuAm2ZWeaBWSujXLHSmVfpoHubCP6prZVI1W9aTkAxmh+xsDV3P
o3h+DiBTP1seuGx7tr7spQqFXeR3OH9gXktYCO/W0d3aQ7pjAjpehWv0zJ+ty2MI
fQ/lkXUCgYEAgbP+P5UmY7Fqm/mi6TprEJ/eYktji4Ne11GDKGFQCfjF5RdKhdw1
5+elGhZes+cpzu5Ak6zBDu4bviT+tRTWJu5lVLEzlHHv4nAU7Ks5Aj67ApH21AnP
RtlATdhWOt5Dkdq1WSpDfz5bvWgvyBx9D66dSmQdbKKe2dH327eQll4=
-----END RSA PRIVATE KEY-----
test/certs/embeddedSCTs1.pem
+18 -17
View File
@@ -1,20 +1,21 @@
-----BEGIN CERTIFICATE-----
MIIDWTCCAsKgAwIBAgIBBzANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJHQjEk
MIIDeDCCAuGgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBVMQswCQYDVQQGEwJHQjEk
MCIGA1UEChMbQ2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5IENBMQ4wDAYDVQQIEwVX
YWxlczEQMA4GA1UEBxMHRXJ3IFdlbjAeFw0xMjA2MDEwMDAwMDBaFw0yMjA2MDEw
MDAwMDBaMFIxCzAJBgNVBAYTAkdCMSEwHwYDVQQKExhDZXJ0aWZpY2F0ZSBUcmFu
c3BhcmVuY3kxDjAMBgNVBAgTBVdhbGVzMRAwDgYDVQQHEwdFcncgV2VuMIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+75jnwmh3rjhfdTJaDB0ym+3xj6r015a/
BH634c4VyVui+A7kWL19uG+KSyUhkaeb1wDDjpwDibRc1NyaEgqyHgy0HNDnKAWk
EM2cW9tdSSdyba8XEPYBhzd+olsaHjnu0LiBGdwVTcaPfajjDK8VijPmyVCfSgWw
FAn/Xdh+tQIDAQABo4IBOjCCATYwHQYDVR0OBBYEFCAxVBryXAX/2GWLaEN5T16Q
Nve0MH0GA1UdIwR2MHSAFF+diA3Ic+ZU1PgN2OawwSS0R8NVoVmkVzBVMQswCQYD
VQQGEwJHQjEkMCIGA1UEChMbQ2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5IENBMQ4w
DAYDVQQIEwVXYWxlczEQMA4GA1UEBxMHRXJ3IFdlboIBADAJBgNVHRMEAjAAMIGK
BgorBgEEAdZ5AgQCBHwEegB4AHYA3xwuwRUAlFJHqWFoMl3cXHlZ6PfG04j8AC4L
vT9012QAAAE92yffkwAABAMARzBFAiBIL2dRrzXbplQ2vh/WZA89v5pBQpSVkkUw
KI+j5eI+BgIhAOTtwNs6xXKx4vXoq2poBlOYfc9BAn3+/6EFUZ2J7b8IMA0GCSqG
SIb3DQEBBQUAA4GBAIoMS+8JnUeSea+goo5on5HhxEIb4tJpoupspOghXd7dyhUE
oR58h8S3foDw6XkDUmjyfKIOFmgErlVvMWmB+Wo5Srer/T4lWsAERRP+dlcMZ5Wr
5HAxM9MD+J86+mu8/FFzGd/ZW5NCQSEfY0A1w9B4MHpoxgdaLiDInza4kQyg
YWxlczEQMA4GA1UEBxMHRXJ3IFdlbjAgFw0yMDAxMjUxMTUwMTNaGA8yMTIwMDEy
NjExNTAxM1owGTEXMBUGA1UEAwwOc2VydmVyLmV4YW1wbGUwggEiMA0GCSqGSIb3
DQEBAQUAA4IBDwAwggEKAoIBAQC4iOkDj+IKkMDaaPLAjnMbogFfps1xFBgOwHsK
/RWic1e0kHBfEwQ0/iNWm8SZaknmIwGScYdX5dYGSeBhqlzMixjgsafpoxTrJIAE
FVCk05BJF9PjzEYY9H2bM4Eb/KmWakU5WrWP5vrmWyS8BcphosWkWfehj+kFJ1wI
0E/wvKlVcAlvcioRewEv8SuAcb1uAhE/xXEEBqvILPvuQvMBeR8cvYt9IYh8043I
QoHfEj3hLgt6i45KhYvVWQR8mzzu8bgbnGhfDco4fKK55BRSUye7yn4HHTE9Uo8S
wuN7dH2TSsZrlxrt1cCf1TKkoqnbnHg1emeMZfm3FURh82+pAgMBAAGjggEMMIIB
CDAdBgNVHQ4EFgQUtMa8XD5ylrF9AqCdnPEhXa63H2owHwYDVR0jBBgwFoAUX52I
Dchz5lTU+A3Y5rDBJLRHw1UwCQYDVR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcD
ATCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN8cLsEVAJRSR6lhaDJd3Fx5Wej3xtOI
/AAuC70/dNdkAAABb15m6AAAAAQDAEcwRQIgfDPo8RArm/vcSEZ608Q1u+XQ55QB
u67SZEuZxLpbUM0CIQDRsgcTud4PDy8Cgg+lHeAS7UxgSKBbWAznYOuorwNewzAZ
BgNVHREEEjAQgg5zZXJ2ZXIuZXhhbXBsZTANBgkqhkiG9w0BAQsFAAOBgQCWFKKR
RNkDRzB25NK07OLkbzebhnpKtbP4i3blRx1HAvTSamf/3uuHI7kfiPJorJymJpT1
IuJvSVKyMu1qONWBimiBfiyGL7+le1izHEJIP5lVTbddfzSIBIvrlHHcWIOL3H+W
YT6yTEIzJuO07Xp61qnB1CE2TrinUWlyC46Zkw==
-----END CERTIFICATE-----
test/certs/embeddedSCTs1.sct
+6 -6
View File
@@ -2,11 +2,11 @@ Signed Certificate Timestamp:
Version : v1 (0x0)
Log ID : DF:1C:2E:C1:15:00:94:52:47:A9:61:68:32:5D:DC:5C:
79:59:E8:F7:C6:D3:88:FC:00:2E:0B:BD:3F:74:D7:64
Timestamp : Apr 5 17:04:16.275 2013 GMT
Timestamp : Jan 1 00:00:00.000 2020 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:45:02:20:48:2F:67:51:AF:35:DB:A6:54:36:BE:1F:
D6:64:0F:3D:BF:9A:41:42:94:95:92:45:30:28:8F:A3:
E5:E2:3E:06:02:21:00:E4:ED:C0:DB:3A:C5:72:B1:E2:
F5:E8:AB:6A:68:06:53:98:7D:CF:41:02:7D:FE:FF:A1:
05:51:9D:89:ED:BF:08
30:45:02:20:7C:33:E8:F1:10:2B:9B:FB:DC:48:46:7A:
D3:C4:35:BB:E5:D0:E7:94:01:BB:AE:D2:64:4B:99:C4:
BA:5B:50:CD:02:21:00:D1:B2:07:13:B9:DE:0F:0F:2F:
02:82:0F:A5:1D:E0:12:ED:4C:60:48:A0:5B:58:0C:E7:
60:EB:A8:AF:03:5E:C3
test/certs/embeddedSCTs1.tlssct
BIN
View File
Binary file not shown.
test/certs/embeddedSCTs1_issuer-key.pem
+15
View File
@@ -0,0 +1,15 @@
-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDVimhTYhCicRmTbneDIRgcKkATxtB7jHbrkVfT0PtLO1FuzsvR
yY2RxS90P6tjXVUJnNE6uvMa5UFEJFGnTHgW8iQ8+EjPKDHM5nugSlojgZ88ujfm
JNnDvbKZuDnd/iYx0ss6hPx7srXFL8/BT/9Ab1zURmnLsvfP34b7arnRsQIDAQAB
AoGAJLR6xEJp+5IXRFlLn7WTkFvO0ddtxJ7bXhiIkTctyruyfqp7LF9Jv1G2m3PK
QPUtBc73w/GYkfnwIwdfJbOmPHL7XyEGHZYmEXgIgEtw6LXvAv0G5JpUnNwsSBfL
GfSQqI5Z5ytyzlJXkMcTGA2kTgNAYc73h4EnU+pwUnDPdAECQQD2aj+4LtYk1XPq
r3gjgI6MoGvgYJfPmAtZhxxVbhXQKciFUCAcBiwlQdHIdLWE9j65ctmZRWidKifr
4O4nz+TBAkEA3djNW/rTQq5fKZy+mCF1WYnIU/3yhJaptzRqLm7AHqe7+hdrGXJw
+mCtU8T3L/Ms8bH1yFBZhmkp1PbR8gl48QJAQo70YyWThiN5yfxXcQ96cZWrTdIJ
b3NcLXSHPLQdhDqlBQ1dfvRT3ERpC8IqfZ2d162kBPhwh3MpkVcSPQK0gQJAC/dY
xGBYKt2a9nSk9zG+0bCT5Kvq++ngh6hFHfINXNnxUsEWns3EeEzkrIMQTj7QqszN
lBt5aL2dawZRNrv6EQJBAOo4STF9KEwQG0HLC/ryh1FeB0OBA5yIepXze+eJVKei
T0cCECOQJKfWHEzYJYDJhyEFF/sYp9TXwKSDjOifrsU=
-----END RSA PRIVATE KEY-----
test/certs/embeddedSCTs3.sct
+1 -1
View File
@@ -33,4 +33,4 @@ Signed Certificate Timestamp:
55:83:D2:9D:E5:A1:8D:B6:3D:A6:73:89:42:32:9C:91:
0F:3B:6A:74:02:21:00:86:EE:10:F9:10:E6:7B:17:65:
D9:2D:37:53:4A:3B:F0:AE:03:E4:21:76:37:EF:AF:B4:
44:2E:2B:F5:5C:C6:91
44:2E:2B:F5:5C:C6:91
test/certs/mkcert.sh
+52
View File
@@ -288,4 +288,56 @@ gennocn() {
cert "$cert" "" -signkey "${key}.pem" -set_serial 1 -days -1 "$@"
}
genct() {
local OPTIND=1
local purpose=serverAuth
while getopts p: o
do
case $o in
p) purpose="$OPTARG";;
*) echo "Usage: $0 genct [-p EKU] cn keyname certname cakeyname cacertname ctlogkey" >&2
return 1;;
esac
done
shift $((OPTIND - 1))
local cn=$1; shift
local key=$1; shift
local cert=$1; shift
local cakey=$1; shift
local ca=$1; shift
local logkey=$1; shift
exts=$(printf "%s\n%s\n%s\n%s\n%s\n%s\n[alts]\n%s\n" \
"subjectKeyIdentifier = hash" \
"authorityKeyIdentifier = keyid, issuer" \
"basicConstraints = CA:false" \
"extendedKeyUsage = $purpose" \
"1.3.6.1.4.1.11129.2.4.3 = critical,ASN1:NULL"\
"subjectAltName = @alts" "DNS=${cn}")
csr=$(req "$key" "CN = $cn") || return 1
echo "$csr" |
cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
-set_serial 2 -days "${DAYS}" "$@"
cat ${cert}.pem ${ca}.pem > ${cert}-chain.pem
go run github.com/google/certificate-transparency-go/ctutil/sctgen \
--log_private_key ${logkey}.pem \
--timestamp="2020-01-01T00:00:00Z" \
--cert_chain ${cert}-chain.pem \
--tls_out ${cert}.tlssct
rm ${cert}-chain.pem
filesize=$(wc -c <${cert}.tlssct)
exts=$(printf "%s\n%s\n%s\n%s\n%s%04X%04X%s\n%s\n[alts]\n%s\n" \
"subjectKeyIdentifier = hash" \
"authorityKeyIdentifier = keyid, issuer" \
"basicConstraints = CA:false" \
"extendedKeyUsage = $purpose" \
"1.3.6.1.4.1.11129.2.4.2 = ASN1:FORMAT:HEX,OCT:" $((filesize+2)) $filesize `xxd -p ${cert}.tlssct | tr -d '\n'` \
"subjectAltName = @alts" "DNS=${cn}")
echo "$csr" |
cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
-set_serial 2 -days "${DAYS}" "$@"
}
"$@"
test/certs/setup.sh
+3
View File
@@ -375,3 +375,6 @@ openssl req -new -nodes -subj "/CN=localhost" \
-pkeyopt rsa_pss_keygen_md:sha256 -pkeyopt rsa_pss_keygen_saltlen:32 | \
./mkcert.sh geneenocsr "Server RSA-PSS restricted cert" \
server-pss-restrict-cert rootkey rootcert
# CT entry
./mkcert.sh genct server.example embeddedSCTs1-key embeddedSCTs1 embeddedSCTs1_issuer-key embeddedSCTs1_issuer ct-server-key
test/clienthellotest.c
+5
View File
@@ -250,6 +250,11 @@ OPT_TEST_DECLARE_USAGE("sessionfile\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(sessionfile = test_get_argument(0)))
return 0;
test/cmp_ctx_test.c
+5 -4
View File
@@ -301,15 +301,15 @@ static int test_cmp_ctx_log_cb(void)
return result;
}
static BIO *test_http_cb(OSSL_CMP_CTX *ctx, BIO *hbio, unsigned long detail)
static BIO *test_http_cb(BIO *bio, void *arg, int use_ssl, int detail)
{
return NULL;
}
static int test_transfer_cb(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *req,
OSSL_CMP_MSG **res)
static OSSL_CMP_MSG *test_transfer_cb(OSSL_CMP_CTX *ctx,
const OSSL_CMP_MSG *req)
{
return 0;
return NULL;
}
static int test_certConf_cb(OSSL_CMP_CTX *ctx, X509 *cert, int fail_info,
@@ -537,6 +537,7 @@ static X509_STORE *X509_STORE_new_1(void)
STACK_OF(TYPE)*, NULL, IS_0, \
sk_##TYPE##_new_null(), sk_##TYPE##_free)
typedef OSSL_HTTP_bio_cb_t OSSL_cmp_http_cb_t;
#define DEFINE_SET_CB_TEST(FIELD) \
static OSSL_cmp_##FIELD##_t OSSL_CMP_CTX_get_##FIELD(const CMP_CTX *ctx) \
{ \
test/cmp_msg_test.c
+5
View File
@@ -538,6 +538,11 @@ void cleanup_tests(void)
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(server_cert_f = test_get_argument(0))
|| !TEST_ptr(pkcs10_f = test_get_argument(1))) {
TEST_error("usage: cmp_msg_test server.crt pkcs10.der\n");
test/cmp_protect_test.c
+10
View File
@@ -294,6 +294,8 @@ static int test_MSG_add_extraCerts(void)
return result;
}
#ifndef OPENSSL_NO_EC
/* The cert chain tests use EC certs so we skip them in no-ec builds */
static int execute_cmp_build_cert_chain_test(CMP_PROTECT_TEST_FIXTURE *fixture)
{
STACK_OF(X509) *result = NULL;
@@ -372,6 +374,7 @@ static int test_cmp_build_cert_chain_no_certs(void)
EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
return result;
}
#endif /* OPENSSL_NO_EC */
static int execute_X509_STORE_test(CMP_PROTECT_TEST_FIXTURE *fixture)
{
@@ -455,6 +458,11 @@ int setup_tests(void)
char *root_f;
char *intermediate_f;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH);
if (!TEST_ptr(server_f = test_get_argument(0))
|| !TEST_ptr(ir_protected_f = test_get_argument(1))
@@ -505,10 +513,12 @@ int setup_tests(void)
ADD_TEST(test_MSG_add_extraCerts);
#ifndef OPENSSL_NO_EC
ADD_TEST(test_cmp_build_cert_chain);
ADD_TEST(test_cmp_build_cert_chain_missing_root);
ADD_TEST(test_cmp_build_cert_chain_missing_intermediate);
ADD_TEST(test_cmp_build_cert_chain_no_certs);
#endif
ADD_TEST(test_X509_STORE);
ADD_TEST(test_X509_STORE_only_self_signed);
test/cmsapitest.c
+5
View File
@@ -65,6 +65,11 @@ int setup_tests(void)
char *certin = NULL, *privkeyin = NULL;
BIO *certbio = NULL, *privkeybio = NULL;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(certin = test_get_argument(0))
|| !TEST_ptr(privkeyin = test_get_argument(1)))
return 0;
test/ct_test.c
+5 -1
View File
@@ -63,7 +63,7 @@ static CT_TEST_FIXTURE *set_up(const char *const test_case_name)
if (!TEST_ptr(fixture = OPENSSL_zalloc(sizeof(*fixture))))
goto end;
fixture->test_case_name = test_case_name;
fixture->epoch_time_in_ms = 1473269626000ULL; /* Sep 7 17:33:46 2016 GMT */
fixture->epoch_time_in_ms = 1580335307000ULL; /* Wed 29 Jan 2020 10:01:47 PM UTC */
if (!TEST_ptr(fixture->ctlog_store = CTLOG_STORE_new())
|| !TEST_int_eq(
CTLOG_STORE_load_default_file(fixture->ctlog_store), 1))
@@ -160,6 +160,10 @@ static int compare_extension_printout(X509_EXTENSION *extension,
X509V3_EXT_DEFAULT, 0)))
goto end;
/* Append \n because it's easier to create files that end with one. */
if (!TEST_true(BIO_write(text_buffer, "\n", 1)))
goto end;
/* Append \0 because we're about to use the buffer contents as a string. */
if (!TEST_true(BIO_write(text_buffer, "\0", 1)))
goto end;
test/d2i_test.c
+5
View File
@@ -127,6 +127,11 @@ int setup_tests(void)
{"compare", ASN1_COMPARE}
};
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(test_type_name = test_get_argument(0))
|| !TEST_ptr(expected_error_string = test_get_argument(1))
|| !TEST_ptr(test_file = test_get_argument(2)))
test/danetest.c
+5
View File
@@ -413,6 +413,11 @@ OPT_TEST_DECLARE_USAGE("basedomain CAfile tlsafile\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(basedomain = test_get_argument(0))
|| !TEST_ptr(CAfile = test_get_argument(1))
|| !TEST_ptr(tlsafile = test_get_argument(2)))
test/destest.c
+6
View File
@@ -7,6 +7,12 @@
* https://www.openssl.org/source/license.html
*/
/*
* DES low level APIs are deprecated for public use, but still ok for internal
* use.
*/
#include "internal/deprecated.h"
#include <openssl/e_os2.h>
#include <string.h>
test/dhtest.c
+33
View File
@@ -676,6 +676,38 @@ static int rfc7919_test(void)
DH_free(b);
return ret;
}
static int prime_groups[] = {
NID_ffdhe2048,
NID_ffdhe3072,
NID_ffdhe4096,
NID_ffdhe6144,
NID_ffdhe8192,
NID_modp_2048,
NID_modp_3072,
NID_modp_4096,
NID_modp_6144,
};
static int dh_test_prime_groups(int index)
{
int ok = 0;
DH *dh = NULL;
const BIGNUM *p, *q, *g;
if (!TEST_ptr(dh = DH_new_by_nid(prime_groups[index])))
goto err;
DH_get0_pqg(dh, &p, &q, &g);
if (!TEST_ptr(p) || !TEST_ptr(q) || !TEST_ptr(g))
goto err;
if (!TEST_int_eq(DH_get_nid(dh), prime_groups[index]))
goto err;
ok = 1;
err:
DH_free(dh);
return ok;
}
#endif
@@ -687,6 +719,7 @@ int setup_tests(void)
ADD_TEST(dh_test);
ADD_TEST(rfc5114_test);
ADD_TEST(rfc7919_test);
ADD_ALL_TESTS(dh_test_prime_groups, OSSL_NELEM(prime_groups));
#endif
return 1;
}
test/drbgtest.c
+16 -15
View File
@@ -127,8 +127,6 @@ static DRBG_SELFTEST_DATA drbg_test[] = {
make_drbg_test_data_hash(NID_sha512, sha512, 0),
};
static int app_data_index;
/*
* Test context data, attached as EXDATA to the RAND_DRBG
*/
@@ -145,7 +143,7 @@ static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout,
int entropy, size_t min_len, size_t max_len,
int prediction_resistance)
{
TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_callback_data(drbg);
t->entropycnt++;
*pout = (unsigned char *)t->entropy;
@@ -155,7 +153,7 @@ static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout,
static size_t kat_nonce(RAND_DRBG *drbg, unsigned char **pout,
int entropy, size_t min_len, size_t max_len)
{
TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_callback_data(drbg);
t->noncecnt++;
*pout = (unsigned char *)t->nonce;
@@ -213,6 +211,7 @@ static int single_kat(DRBG_SELFTEST_DATA *td)
return 0;
if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
kat_nonce, NULL))
|| !TEST_true(RAND_DRBG_set_callback_data(drbg, &t))
|| !TEST_true(disable_crngt(drbg))) {
failures++;
goto err;
@@ -222,7 +221,6 @@ static int single_kat(DRBG_SELFTEST_DATA *td)
t.entropylen = td->entropylen;
t.nonce = td->nonce;
t.noncelen = td->noncelen;
RAND_DRBG_set_ex_data(drbg, app_data_index, &t);
if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
|| !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
@@ -246,9 +244,9 @@ static int single_kat(DRBG_SELFTEST_DATA *td)
*/
if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
|| !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
kat_nonce, NULL)))
kat_nonce, NULL))
|| !TEST_true(RAND_DRBG_set_callback_data(drbg, &t)))
failures++;
RAND_DRBG_set_ex_data(drbg, app_data_index, &t);
t.entropy = td->entropy_pr;
t.entropylen = td->entropylen_pr;
t.nonce = td->nonce_pr;
@@ -296,7 +294,7 @@ static int init(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td, TEST_CTX *t)
|| !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
kat_nonce, NULL)))
return 0;
RAND_DRBG_set_ex_data(drbg, app_data_index, t);
RAND_DRBG_set_callback_data(drbg, t);
t->entropy = td->entropy;
t->entropylen = td->entropylen;
t->nonce = td->nonce;
@@ -551,7 +549,7 @@ static HOOK_CTX master_ctx, public_ctx, private_ctx;
static HOOK_CTX *get_hook_ctx(RAND_DRBG *drbg)
{
return (HOOK_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
return (HOOK_CTX *)RAND_DRBG_get_callback_data(drbg);
}
/* Intercepts and counts calls to the get_entropy() callback */
@@ -579,17 +577,22 @@ static void hook_drbg(RAND_DRBG *drbg, HOOK_CTX *ctx)
memset(ctx, 0, sizeof(*ctx));
ctx->drbg = drbg;
ctx->get_entropy = drbg->get_entropy;
/*
* We can't use the public API here, since it prohibits modifying
* the callbacks or the callback data of chained DRBGs.
*/
drbg->get_entropy = get_entropy_hook;
RAND_DRBG_set_ex_data(drbg, app_data_index, ctx);
drbg->callback_data = ctx;
}
/* Installs the hook for the get_entropy() callback of the given drbg */
static void unhook_drbg(RAND_DRBG *drbg)
{
HOOK_CTX *ctx = get_hook_ctx(drbg);
HOOK_CTX *ctx = drbg->callback_data;
drbg->get_entropy = ctx->get_entropy;
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_RAND_DRBG, drbg, &drbg->ex_data);
if (ctx != NULL)
drbg->get_entropy = ctx->get_entropy;
}
/* Resets the given hook context */
@@ -1382,8 +1385,6 @@ err:
int setup_tests(void)
{
app_data_index = RAND_DRBG_get_ex_new_index(0L, NULL, NULL, NULL, NULL);
ADD_ALL_TESTS(test_kats, OSSL_NELEM(drbg_test));
ADD_ALL_TESTS(test_error_checks, OSSL_NELEM(drbg_test));
ADD_TEST(test_rand_drbg_reseed);
test/dtlstest.c
+6 -1
View File
@@ -122,7 +122,7 @@ static int test_dtls_unprocessed(int testidx)
#define CLI_TO_SRV_EPOCH_0_RECS 3
#define CLI_TO_SRV_EPOCH_1_RECS 1
#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
# define SRV_TO_CLI_EPOCH_0_RECS 12
# define SRV_TO_CLI_EPOCH_0_RECS 10
#else
/*
* In this case we have no ServerKeyExchange message, because we don't have
@@ -332,6 +332,11 @@ OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(privkey = test_get_argument(1)))
return 0;
test/ec_internal_test.c
+5
View File
@@ -7,6 +7,11 @@
* https://www.openssl.org/source/license.html
*/
/*
* Low level APIs are deprecated for public use, but still ok for internal use.
*/
#include "internal/deprecated.h"
#include "internal/nelem.h"
#include "testutil.h"
#include <openssl/ec.h>
test/ecdsatest.c
+89 -16
View File
@@ -8,6 +8,11 @@
* https://www.openssl.org/source/license.html
*/
/*
* Low level APIs are deprecated for public use, but still ok for internal use.
*/
#include "internal/deprecated.h"
#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_EC is defined */
#include "testutil.h"
@@ -201,7 +206,30 @@ static int x9_62_tests(int n)
* - reject that signature after modifying the signature
* - accept that signature after un-modifying the signature
*/
static int test_builtin(int n)
static int set_sm2_id(EVP_MD_CTX *mctx, EVP_PKEY *pkey)
{
/* With the SM2 key type, the SM2 ID is mandatory */
static const char sm2_id[] = { 1, 2, 3, 4, 'l', 'e', 't', 't', 'e', 'r' };
EVP_PKEY_CTX *pctx;
if (!TEST_ptr(pctx = EVP_PKEY_CTX_new(pkey, NULL))
|| !TEST_int_gt(EVP_PKEY_CTX_set1_id(pctx, sm2_id, sizeof(sm2_id)), 0))
return 0;
EVP_MD_CTX_set_pkey_ctx(mctx, pctx);
return 1;
}
static int clean_sm2_id(EVP_MD_CTX *mctx)
{
EVP_PKEY_CTX *pctx;
if (!TEST_ptr(pctx = EVP_MD_CTX_pkey_ctx(mctx)))
return 0;
EVP_PKEY_CTX_free(pctx);
return 1;
}
static int test_builtin(int n, int as)
{
EC_KEY *eckey_neg = NULL, *eckey = NULL;
unsigned char dirt, offset, tbs[128];
@@ -220,7 +248,8 @@ static int test_builtin(int n)
return 1;
}
TEST_info("testing ECDSA for curve %s", OBJ_nid2sn(nid));
TEST_info("testing ECDSA for curve %s as %s key type", OBJ_nid2sn(nid),
as == EVP_PKEY_EC ? "EC" : "SM2");
if (!TEST_ptr(mctx = EVP_MD_CTX_new())
/* get some random message data */
@@ -239,37 +268,62 @@ static int test_builtin(int n)
temp = ECDSA_size(eckey);
/*
* |as| indicates how we want to treat the key, i.e. what sort of
* computation we want to do with it. The two choices are the key
* types EVP_PKEY_EC and EVP_PKEY_SM2. It's perfectly possible to
* switch back and forth between those two key types, regardless of
* curve, even though the default is to have EVP_PKEY_SM2 for the
* SM2 curve and EVP_PKEY_EC for all other curves.
*/
if (!TEST_true(EVP_PKEY_set_alias_type(pkey, as))
|| !TEST_true(EVP_PKEY_set_alias_type(pkey_neg, as)))
goto err;
if (!TEST_int_ge(temp, 0)
|| !TEST_ptr(sig = OPENSSL_malloc(sig_len = (size_t)temp))
/* create a signature */
|| (as == EVP_PKEY_SM2 && !set_sm2_id(mctx, pkey))
|| !TEST_true(EVP_DigestSignInit(mctx, NULL, NULL, NULL, pkey))
|| !TEST_true(EVP_DigestSign(mctx, sig, &sig_len, tbs, sizeof(tbs)))
|| !TEST_int_le(sig_len, ECDSA_size(eckey))
/* negative test, verify with wrong key, 0 return */
|| (as == EVP_PKEY_SM2 && !clean_sm2_id(mctx))
|| !TEST_true(EVP_MD_CTX_reset(mctx))
/* negative test, verify with wrong key, 0 return */
|| (as == EVP_PKEY_SM2 && !set_sm2_id(mctx, pkey_neg))
|| !TEST_true(EVP_DigestVerifyInit(mctx, NULL, NULL, NULL, pkey_neg))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 0)
/* negative test, verify with wrong signature length, -1 return */
|| (as == EVP_PKEY_SM2 && !clean_sm2_id(mctx))
|| !TEST_true(EVP_MD_CTX_reset(mctx))
/* negative test, verify with wrong signature length, -1 return */
|| (as == EVP_PKEY_SM2 && !set_sm2_id(mctx, pkey))
|| !TEST_true(EVP_DigestVerifyInit(mctx, NULL, NULL, NULL, pkey))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len - 1, tbs, sizeof(tbs)), -1)
/* positive test, verify with correct key, 1 return */
|| (as == EVP_PKEY_SM2 && !clean_sm2_id(mctx))
|| !TEST_true(EVP_MD_CTX_reset(mctx))
/* positive test, verify with correct key, 1 return */
|| (as == EVP_PKEY_SM2 && !set_sm2_id(mctx, pkey))
|| !TEST_true(EVP_DigestVerifyInit(mctx, NULL, NULL, NULL, pkey))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1)
|| (as == EVP_PKEY_SM2 && !clean_sm2_id(mctx))
|| !TEST_true(EVP_MD_CTX_reset(mctx)))
goto err;
/* muck with the message, test it fails with 0 return */
tbs[0] ^= 1;
if (!TEST_true(EVP_MD_CTX_reset(mctx))
if ((as == EVP_PKEY_SM2 && !set_sm2_id(mctx, pkey))
|| !TEST_true(EVP_DigestVerifyInit(mctx, NULL, NULL, NULL, pkey))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 0))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 0)
|| (as == EVP_PKEY_SM2 && !clean_sm2_id(mctx))
|| !TEST_true(EVP_MD_CTX_reset(mctx)))
goto err;
/* un-muck and test it verifies */
tbs[0] ^= 1;
if (!TEST_true(EVP_MD_CTX_reset(mctx))
if ((as == EVP_PKEY_SM2 && !set_sm2_id(mctx, pkey))
|| !TEST_true(EVP_DigestVerifyInit(mctx, NULL, NULL, NULL, pkey))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1)
|| (as == EVP_PKEY_SM2 && !clean_sm2_id(mctx))
|| !TEST_true(EVP_MD_CTX_reset(mctx)))
goto err;
/*-
@@ -301,15 +355,19 @@ static int test_builtin(int n)
offset = tbs[0] % sig_len;
dirt = tbs[1] ? tbs[1] : 1;
sig[offset] ^= dirt;
if (!TEST_true(EVP_MD_CTX_reset(mctx))
if ((as == EVP_PKEY_SM2 && !set_sm2_id(mctx, pkey))
|| !TEST_true(EVP_DigestVerifyInit(mctx, NULL, NULL, NULL, pkey))
|| !TEST_int_ne(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1))
|| !TEST_int_ne(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1)
|| (as == EVP_PKEY_SM2 && !clean_sm2_id(mctx))
|| !TEST_true(EVP_MD_CTX_reset(mctx)))
goto err;
/* un-muck and test it verifies */
sig[offset] ^= dirt;
if (!TEST_true(EVP_MD_CTX_reset(mctx))
if ((as == EVP_PKEY_SM2 && !set_sm2_id(mctx, pkey))
|| !TEST_true(EVP_DigestVerifyInit(mctx, NULL, NULL, NULL, pkey))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1))
|| !TEST_int_eq(EVP_DigestVerify(mctx, sig, sig_len, tbs, sizeof(tbs)), 1)
|| (as == EVP_PKEY_SM2 && !clean_sm2_id(mctx))
|| !TEST_true(EVP_MD_CTX_reset(mctx)))
goto err;
ret = 1;
@@ -320,7 +378,19 @@ static int test_builtin(int n)
OPENSSL_free(sig);
return ret;
}
#endif
static int test_builtin_as_ec(int n)
{
return test_builtin(n, EVP_PKEY_EC);
}
# ifndef OPENSSL_NO_SM2
static int test_builtin_as_sm2(int n)
{
return test_builtin(n, EVP_PKEY_SM2);
}
# endif
#endif /* OPENSSL_NO_EC */
int setup_tests(void)
{
@@ -332,7 +402,10 @@ int setup_tests(void)
if (!TEST_ptr(curves = OPENSSL_malloc(sizeof(*curves) * crv_len))
|| !TEST_true(EC_get_builtin_curves(curves, crv_len)))
return 0;
ADD_ALL_TESTS(test_builtin, crv_len);
ADD_ALL_TESTS(test_builtin_as_ec, crv_len);
# ifndef OPENSSL_NO_SM2
ADD_ALL_TESTS(test_builtin_as_sm2, crv_len);
# endif
ADD_ALL_TESTS(x9_62_tests, OSSL_NELEM(ecdsa_cavs_kats));
#endif
return 1;
test/evp_extra_test.c
+34 -26
View File
@@ -25,6 +25,7 @@
#include <openssl/dh.h>
#include "testutil.h"
#include "internal/nelem.h"
#include "internal/sizes.h"
#include "crypto/evp.h"
/*
@@ -1239,13 +1240,13 @@ static int test_EVP_PKEY_CTX_get_set_params(void)
EVP_PKEY_CTX *ctx = NULL;
EVP_SIGNATURE *dsaimpl = NULL;
const OSSL_PARAM *params;
OSSL_PARAM ourparams[2], *param = ourparams;
OSSL_PARAM ourparams[2], *param = ourparams, *param_md;
DSA *dsa = NULL;
BIGNUM *p = NULL, *q = NULL, *g = NULL, *pub = NULL, *priv = NULL;
EVP_PKEY *pkey = NULL;
int ret = 0;
const EVP_MD *md;
size_t mdsize = SHA512_DIGEST_LENGTH;
char mdname[OSSL_MAX_NAME_SIZE];
char ssl3ms[48];
/*
@@ -1288,39 +1289,36 @@ static int test_EVP_PKEY_CTX_get_set_params(void)
*/
params = EVP_PKEY_CTX_settable_params(ctx);
if (!TEST_ptr(params)
|| !TEST_int_eq(strcmp(params[0].key,
OSSL_SIGNATURE_PARAM_DIGEST_SIZE), 0)
|| !TEST_int_eq(strcmp(params[1].key, OSSL_SIGNATURE_PARAM_DIGEST),
0)
/* The final key should be NULL */
|| !TEST_ptr_null(params[2].key))
|| !TEST_ptr(OSSL_PARAM_locate_const(params,
OSSL_SIGNATURE_PARAM_DIGEST)))
goto err;
/* Gettable params are the same as the settable ones */
params = EVP_PKEY_CTX_gettable_params(ctx);
if (!TEST_ptr(params)
|| !TEST_int_eq(strcmp(params[0].key,
OSSL_SIGNATURE_PARAM_DIGEST_SIZE), 0)
|| !TEST_int_eq(strcmp(params[1].key, OSSL_SIGNATURE_PARAM_DIGEST),
0)
/* The final key should be NULL */
|| !TEST_ptr_null(params[2].key))
|| !TEST_ptr(OSSL_PARAM_locate_const(params,
OSSL_SIGNATURE_PARAM_ALGORITHM_ID))
|| !TEST_ptr(OSSL_PARAM_locate_const(params,
OSSL_SIGNATURE_PARAM_DIGEST)))
goto err;
/*
* Test getting and setting params via EVP_PKEY_CTX_set_params() and
* EVP_PKEY_CTX_get_params()
*/
*param++ = OSSL_PARAM_construct_size_t(OSSL_SIGNATURE_PARAM_DIGEST_SIZE,
&mdsize);
strcpy(mdname, "SHA512");
param_md = param;
*param++ = OSSL_PARAM_construct_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST,
mdname, 0);
*param++ = OSSL_PARAM_construct_end();
if (!TEST_true(EVP_PKEY_CTX_set_params(ctx, ourparams)))
goto err;
mdsize = 0;
mdname[0] = '\0';
*param_md = OSSL_PARAM_construct_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST,
mdname, sizeof(mdname));
if (!TEST_true(EVP_PKEY_CTX_get_params(ctx, ourparams))
|| !TEST_size_t_eq(mdsize, SHA512_DIGEST_LENGTH))
|| !TEST_str_eq(mdname, "SHA512"))
goto err;
/*
@@ -1447,16 +1445,25 @@ static int test_decrypt_null_chunks(void)
#ifndef OPENSSL_NO_DH
static int test_EVP_PKEY_set1_DH(void)
{
DH *x942dh, *pkcs3dh;
EVP_PKEY *pkey1, *pkey2;
DH *x942dh = NULL, *noqdh = NULL;
EVP_PKEY *pkey1 = NULL, *pkey2 = NULL;
int ret = 0;
BIGNUM *p, *g = NULL;
if (!TEST_ptr(p = BN_new())
|| !TEST_ptr(g = BN_new())
|| !BN_set_word(p, 9999)
|| !BN_set_word(g, 2)
|| !TEST_ptr(noqdh = DH_new())
|| !DH_set0_pqg(noqdh, p, NULL, g))
goto err;
p = g = NULL;
x942dh = DH_get_2048_256();
pkcs3dh = DH_new_by_nid(NID_ffdhe2048);
pkey1 = EVP_PKEY_new();
pkey2 = EVP_PKEY_new();
if (!TEST_ptr(x942dh)
|| !TEST_ptr(pkcs3dh)
|| !TEST_ptr(noqdh)
|| !TEST_ptr(pkey1)
|| !TEST_ptr(pkey2))
goto err;
@@ -1465,17 +1472,18 @@ static int test_EVP_PKEY_set1_DH(void)
|| !TEST_int_eq(EVP_PKEY_id(pkey1), EVP_PKEY_DHX))
goto err;
if(!TEST_true(EVP_PKEY_set1_DH(pkey2, pkcs3dh))
if(!TEST_true(EVP_PKEY_set1_DH(pkey2, noqdh))
|| !TEST_int_eq(EVP_PKEY_id(pkey2), EVP_PKEY_DH))
goto err;
ret = 1;
err:
BN_free(p);
BN_free(g);
EVP_PKEY_free(pkey1);
EVP_PKEY_free(pkey2);
DH_free(x942dh);
DH_free(pkcs3dh);
DH_free(noqdh);
return ret;
}
test/evp_pkey_provided_test.c
+11 -1
View File
@@ -92,7 +92,7 @@ err:
static int test_fromdata_rsa(void)
{
int ret = 0;
EVP_PKEY_CTX *ctx = NULL;
EVP_PKEY_CTX *ctx = NULL, *key_ctx = NULL;
EVP_PKEY *pk = NULL;
/*
* 32-bit RSA key, extracted from this command,
@@ -132,11 +132,21 @@ static int test_fromdata_rsa(void)
|| !TEST_int_eq(EVP_PKEY_size(pk), 4))
goto err;
if (!TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pk, "")))
goto err;
if (!TEST_true(EVP_PKEY_check(key_ctx))
|| !TEST_true(EVP_PKEY_public_check(key_ctx))
|| !TEST_true(EVP_PKEY_private_check(key_ctx))
|| !TEST_true(EVP_PKEY_pairwise_check(key_ctx)))
goto err;
ret = test_print_key_using_pem(pk)
| test_print_key_using_serializer(pk);
err:
EVP_PKEY_free(pk);
EVP_PKEY_CTX_free(key_ctx);
EVP_PKEY_CTX_free(ctx);
return ret;
test/evp_test.c
+7 -12
View File
@@ -3145,17 +3145,6 @@ top:
if (!TEST_ptr(key = OPENSSL_malloc(sizeof(*key))))
return 0;
key->name = take_value(pp);
/* Hack to detect SM2 keys */
if(pkey != NULL && strstr(key->name, "SM2") != NULL) {
#ifdef OPENSSL_NO_SM2
EVP_PKEY_free(pkey);
pkey = NULL;
#else
EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2);
#endif
}
key->key = pkey;
key->next = *klist;
*klist = key;
@@ -3258,8 +3247,14 @@ OPT_TEST_DECLARE_USAGE("file...\n")
int setup_tests(void)
{
size_t n = test_get_argument_count();
size_t n;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
n = test_get_argument_count();
if (n == 0)
return 0;
test/fatalerrtest.c
+5
View File
@@ -86,6 +86,11 @@ OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(privkey = test_get_argument(1)))
return 0;
test/gosttest.c
+5
View File
@@ -82,6 +82,11 @@ OPT_TEST_DECLARE_USAGE("certfile1 privkeyfile1 certfile2 privkeyfile2\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert1 = test_get_argument(0))
|| !TEST_ptr(privkey1 = test_get_argument(1))
|| !TEST_ptr(cert2 = test_get_argument(2))
test/handshake_helper.c
+8 -6
View File
@@ -317,8 +317,9 @@ static int verify_accept_cb(X509_STORE_CTX *ctx, void *arg) {
return 1;
}
static int broken_session_ticket_cb(SSL *s, unsigned char *key_name, unsigned char *iv,
EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc)
static int broken_session_ticket_cb(SSL *s, unsigned char *key_name,
unsigned char *iv, EVP_CIPHER_CTX *ctx,
EVP_MAC_CTX *hctx, int enc)
{
return 0;
}
@@ -326,7 +327,7 @@ static int broken_session_ticket_cb(SSL *s, unsigned char *key_name, unsigned ch
static int do_not_call_session_ticket_cb(SSL *s, unsigned char *key_name,
unsigned char *iv,
EVP_CIPHER_CTX *ctx,
HMAC_CTX *hctx, int enc)
EVP_MAC_CTX *hctx, int enc)
{
HANDSHAKE_EX_DATA *ex_data =
(HANDSHAKE_EX_DATA*)(SSL_get_ex_data(s, ex_data_idx));
@@ -585,11 +586,12 @@ static int configure_handshake_ctx(SSL_CTX *server_ctx, SSL_CTX *server2_ctx,
* session (assigned via SNI), and should never be invoked
*/
if (server2_ctx != NULL)
SSL_CTX_set_tlsext_ticket_key_cb(server2_ctx,
do_not_call_session_ticket_cb);
SSL_CTX_set_tlsext_ticket_key_evp_cb(server2_ctx,
do_not_call_session_ticket_cb);
if (extra->server.broken_session_ticket) {
SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, broken_session_ticket_cb);
SSL_CTX_set_tlsext_ticket_key_evp_cb(server_ctx,
broken_session_ticket_cb);
}
#ifndef OPENSSL_NO_NEXTPROTONEG
if (extra->server.npn_protocols != NULL) {
test/hmactest.c
+6
View File
@@ -7,6 +7,12 @@
* https://www.openssl.org/source/license.html
*/
/*
* HMAC low level APIs are deprecated for public use, but still ok for internal
* use.
*/
#include "internal/deprecated.h"
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
test/http_test.c
+181
View File
@@ -0,0 +1,181 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
* Copyright Siemens AG 2020
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/http.h>
#include <openssl/pem.h>
#include <openssl/x509v3.h>
#include <string.h>
#include "testutil.h"
static const ASN1_ITEM *x509_it = NULL;
static X509 *x509 = NULL;
#define SERVER "mock.server"
#define PORT "81"
#define RPATH "path/any.crt"
static const char *rpath;
static X509 *load_pem_cert(const char *file)
{
X509 *cert = NULL;
BIO *bio = NULL;
if (!TEST_ptr(bio = BIO_new(BIO_s_file())))
return NULL;
if (TEST_int_gt(BIO_read_filename(bio, file), 0))
(void)TEST_ptr(cert = PEM_read_bio_X509(bio, NULL, NULL, NULL));
BIO_free(bio);
return cert;
}
/*
* pretty trivial HTTP mock server:
* for POST, copy request headers+body from mem BIO 'in' as response to 'out'
* for GET, first redirect the request then respond with 'rsp' of ASN1 type 'it'
*/
static int mock_http_server(BIO *in, BIO *out,
ASN1_VALUE *rsp, const ASN1_ITEM *it)
{
const char *req;
long count = BIO_get_mem_data(in, (unsigned char **)&req);
const char *hdr = (char *)req;
int is_get = count >= 4 && strncmp(hdr, "GET ", 4) == 0;
int len;
/* first line should contain "<GET or POST> <rpath> HTTP/1.x" */
if (is_get)
hdr += 4;
else if (TEST_true(count >= 5 && strncmp(hdr, "POST ", 5) == 0))
hdr += 5;
else
return 0;
while (*rpath == '/')
rpath++;
while (*hdr == '/')
hdr++;
len = strlen(rpath);
if (!TEST_strn_eq(hdr, rpath, len) || !TEST_char_eq(hdr++[len], ' '))
return 0;
hdr += len;
len = strlen("HTTP/1.");
if (!TEST_strn_eq(hdr, "HTTP/1.", len))
return 0;
hdr += len;
/* check for HTTP version 1.0 .. 1.1 */
if (!TEST_char_le('0', *hdr) || !TEST_char_le(*hdr++, '1'))
return 0;
if (!TEST_char_eq(*hdr++, '\r') || !TEST_char_eq(*hdr++, '\n'))
return 0;
count -= (hdr - req);
if (count <= 0 || out == NULL)
return 0;
if (is_get && strcmp(rpath, RPATH) == 0) {
rpath = "path/new.crt";
return BIO_printf(out, "HTTP/1.1 301 Moved Permanently\r\n"
"Location: /%s\r\n\r\n", rpath) > 0; /* same server */
}
if (BIO_printf(out, "HTTP/1.1 200 OK\r\n") <= 0)
return 0;
if (is_get) { /* construct new header and body */
if ((len = ASN1_item_i2d(rsp, NULL, it)) <= 0)
return 0;
if (BIO_printf(out, "Content-Type: application/x-x509-ca-cert\r\n"
"Content-Length: %d\r\n\r\n", len) <= 0)
return 0;
return ASN1_item_i2d_bio(it, out, rsp);
} else {
return BIO_write(out, hdr, count) == count; /* echo header and body */
}
}
static long http_bio_cb_ex(BIO *bio, int oper, const char *argp, size_t len,
int cmd, long argl, int ret, size_t *processed)
{
if (oper == (BIO_CB_CTRL | BIO_CB_RETURN) && cmd == BIO_CTRL_FLUSH)
ret = mock_http_server(bio, (BIO *)BIO_get_callback_arg(bio),
(ASN1_VALUE *)x509, x509_it);
return ret;
}
static int test_http_x509(int do_get)
{
X509 *rcert = NULL;
BIO *wbio = BIO_new(BIO_s_mem());
BIO *rbio = BIO_new(BIO_s_mem());
STACK_OF(CONF_VALUE) *headers = NULL;
int res = 0;
if (wbio == NULL || rbio == NULL)
goto err;
BIO_set_callback_ex(wbio, http_bio_cb_ex);
BIO_set_callback_arg(wbio, (char *)rbio);
rpath = RPATH;
rcert = (X509 *)
(do_get ?
OSSL_HTTP_get_asn1("http://"SERVER":"PORT"/"RPATH,
NULL /* proxy */, NULL /* proxy_port */,
wbio, rbio, NULL /* bio_update_fn */, NULL,
headers, 0 /* maxline */,
0 /* max_resp_len */, 0 /* timeout */,
"application/x-x509-ca-cert", x509_it)
:
OSSL_HTTP_post_asn1(SERVER, PORT, RPATH, 0 /* use_ssl */,
NULL /* proxy */, NULL /* proxy_port */,
wbio, rbio, NULL /* bio_update_fn */, NULL,
headers, "application/x-x509-ca-cert",
(ASN1_VALUE *)x509, x509_it, 0 /* maxline */,
0 /* max_resp_len */, 0 /* timeout */,
"application/x-x509-ca-cert", x509_it)
);
res = TEST_ptr(rcert) && TEST_int_eq(X509_cmp(x509, rcert), 0);
err:
X509_free(rcert);
BIO_free(wbio);
BIO_free(rbio);
sk_CONF_VALUE_pop_free(headers, X509V3_conf_free);
return res;
}
static int test_http_get_x509(void)
{
return test_http_x509(1);
}
static int test_http_post_x509(void)
{
return test_http_x509(0);
}
void cleanup_tests(void)
{
X509_free(x509);
}
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
x509_it = ASN1_ITEM_rptr(X509);
if (!TEST_ptr((x509 = load_pem_cert(test_get_argument(0)))))
return 1;
ADD_TEST(test_http_get_x509);
ADD_TEST(test_http_post_x509);
return 1;
}
test/keymgmt_internal_test.c
+6 -4
View File
@@ -145,7 +145,7 @@ static int test_pass_rsa(FIXTURE *fixture)
BIGNUM *bn1 = NULL, *bn2 = NULL, *bn3 = NULL;
EVP_PKEY *pk = NULL;
EVP_KEYMGMT *km1 = NULL, *km2 = NULL;
void *provdata = NULL;
void *provkey = NULL;
/*
* 32-bit RSA key, extracted from this command,
* executed with OpenSSL 1.0.2:
@@ -207,11 +207,13 @@ static int test_pass_rsa(FIXTURE *fixture)
|| !TEST_ptr_ne(km1, km2))
goto err;
if (!TEST_ptr(evp_keymgmt_export_to_provider(pk, km1, 0))
|| !TEST_ptr(provdata = evp_keymgmt_export_to_provider(pk, km2, 0)))
if (!TEST_ptr(evp_keymgmt_util_export_to_provider(pk, km1))
|| !TEST_ptr(provkey = evp_keymgmt_util_export_to_provider(pk, km2)))
goto err;
if (!TEST_true(evp_keymgmt_exportkey(km2, provdata, &export_cb, keydata)))
if (!TEST_true(evp_keymgmt_export(km2, provkey,
OSSL_KEYMGMT_SELECT_KEYPAIR,
&export_cb, keydata)))
goto err;
/*
test/ocspapitest.c
+5
View File
@@ -215,6 +215,11 @@ OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(certstr = test_get_argument(0))
|| !TEST_ptr(privkeystr = test_get_argument(1)))
return 0;
test/params_conversion_test.c
+7 -1
View File
@@ -328,8 +328,14 @@ OPT_TEST_DECLARE_USAGE("file...\n")
int setup_tests(void)
{
size_t n = test_get_argument_count();
size_t n;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
n = test_get_argument_count();
if (n == 0)
return 0;
test/recipes/05-test_bf.t
+1 -2
View File
@@ -16,7 +16,6 @@ use OpenSSL::Test::Utils;
setup("test_bf");
plan skip_all => "Low-level Blowfish APIs are disabled in this build"
if disabled("deprecated")
&& (!defined config("api") || config("api") >= 30000);
if disabled('deprecated-3.0');
simple_test("test_bf", "bftest", "bf");
test/recipes/05-test_cast.t
+1 -2
View File
@@ -17,7 +17,6 @@ use OpenSSL::Test::Utils;
setup("test_cast");
plan skip_all => "Low-level CAST APIs are disabled in this build"
if disabled("deprecated")
&& (!defined config("api") || config("api") >= 30000);
if disabled('deprecated-3.0');
simple_test("test_cast", "casttest", "cast");
test/recipes/20-test_passwd.t
+5 -3
View File
@@ -76,11 +76,12 @@ my @sha_tests =
expected => '$6$rounds=1000$roundstoolow$kUMsbe306n21p9R.FRkW3IGn.S9NPN0x50YhH1xhLsPuWGsUSklZt58jaTfF4ZEQpyUNGc0dqbpBYYBaHHrsX.' }
);
plan tests => (disabled("des") ? 9 : 11) + scalar @sha_tests;
plan tests => (disabled("des") || disabled('deprecated-3.0') ? 9 : 11) + scalar @sha_tests;
ok(compare1stline_re([qw{openssl passwd password}], '^.{13}\R$'),
'crypt password with random salt') if !disabled("des");
'crypt password with random salt')
if !disabled("des") && !disabled('deprecated-3.0');
ok(compare1stline_re([qw{openssl passwd -1 password}], '^\$1\$.{8}\$.{22}\R$'),
'BSD style MD5 password with random salt');
ok(compare1stline_re([qw{openssl passwd -apr1 password}], '^\$apr1\$.{8}\$.{22}\R$'),
@@ -91,7 +92,8 @@ ok(compare1stline_re([qw{openssl passwd -6 password}], '^\$6\$.{16}\$.{86}\R$'),
'Apache SHA512 password with random salt');
ok(compare1stline([qw{openssl passwd -salt xx password}], 'xxj31ZMTZzkVA'),
'crypt password with salt xx') if !disabled("des");
'crypt password with salt xx')
if !disabled("des") && !disabled('deprecated-3.0');
ok(compare1stline([qw{openssl passwd -salt xxxxxxxx -1 password}], '$1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.'),
'BSD style MD5 password with salt xxxxxxxx');
ok(compare1stline([qw{openssl passwd -salt xxxxxxxx -apr1 password}], '$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0'),
test/recipes/25-test_verify.t
+4 -4
View File
@@ -336,14 +336,14 @@ ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cer
ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name constraints nested DNS name excluded");
ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
"Certificate PSS signature using SHA1");
ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
"Accept PSS signature using SHA1 at auth level 0");
ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
"CA with PSS signature using SHA256");
ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
"Reject PSS signature using SHA1 and auth level 2");
ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
"Reject PSS signature using SHA1 and auth level 1");
ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
"PSS signature using SHA256 and auth level 2");
test/recipes/30-test_evp.t
+4 -4
View File
@@ -67,11 +67,11 @@ push @defltfiles, @chachafiles unless disabled("chacha");
my @bffiles = qw( evpciph_bf.txt );
push @defltfiles, @bffiles unless disabled("bf");
my @bffiles = qw( evpmd_md2.txt );
push @defltfiles, @bffiles unless disabled("md2");
my @md2files = qw( evpmd_md2.txt );
push @defltfiles, @md2files unless disabled("md2");
my @bffiles = qw( evpmd_mdc2.txt );
push @defltfiles, @bffiles unless disabled("mdc2");
my @mdc2files = qw( evpmd_mdc2.txt );
push @defltfiles, @mdc2files unless disabled("mdc2");
plan tests =>
($no_fips ? 0 : 1) # FIPS install test
test/recipes/70-test_sslsigalgs.t
+39 -18
View File
@@ -53,7 +53,7 @@ use constant {
#Test 1: Default sig algs should succeed
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 22;
plan tests => 24;
ok(TLSProxy::Message->success, "Default sigalgs");
my $testtype;
@@ -132,19 +132,40 @@ SKIP: {
}
SKIP: {
skip "EC or TLSv1.2 disabled", 8 if disabled("tls1_2") || disabled("ec");
skip "EC or TLSv1.2 disabled", 10 if disabled("tls1_2") || disabled("ec");
$proxy->filter(\&sigalgs_filter);
#Test 10: Sending no sig algs extension in TLSv1.2 should succeed
#Test 10: Sending no sig algs extension in TLSv1.2 should succeed at
# security level 1
$proxy->clear();
$testtype = NO_SIG_ALGS_EXT;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->clientflags("-no_tls1_3 -cipher DEFAULT\@SECLEVEL=1");
$proxy->ciphers("ECDHE-RSA-AES128-SHA\@SECLEVEL=1");
$proxy->start();
ok(TLSProxy::Message->success, "No TLSv1.2 sigalgs");
ok(TLSProxy::Message->success, "No TLSv1.2 sigalgs seclevel 1");
#Test 11: Sending an empty sig algs extension in TLSv1.2 should fail
#Test 11: Sending no sig algs extension in TLSv1.2 should fail at security
# level 2 since it will try to use SHA1. Testing client at level 1,
# server level 2.
$proxy->clear();
$testtype = NO_SIG_ALGS_EXT;
$proxy->clientflags("-tls1_2 -cipher DEFAULT\@SECLEVEL=1");
$proxy->ciphers("DEFAULT\@SECLEVEL=2");
$proxy->start();
ok(TLSProxy::Message->fail, "No TLSv1.2 sigalgs server seclevel 2");
#Test 12: Sending no sig algs extension in TLSv1.2 should fail at security
# level 2 since it will try to use SHA1. Testing client at level 2,
# server level 1.
$proxy->clear();
$testtype = NO_SIG_ALGS_EXT;
$proxy->clientflags("-tls1_2 -cipher DEFAULT\@SECLEVEL=2");
$proxy->ciphers("DEFAULT\@SECLEVEL=1");
$proxy->start();
ok(TLSProxy::Message->fail, "No TLSv1.2 sigalgs client seclevel 2");
#Test 13: Sending an empty sig algs extension in TLSv1.2 should fail
$proxy->clear();
$testtype = EMPTY_SIG_ALGS_EXT;
$proxy->clientflags("-no_tls1_3");
@@ -152,7 +173,7 @@ SKIP: {
$proxy->start();
ok(TLSProxy::Message->fail, "Empty TLSv1.2 sigalgs");
#Test 12: Sending a list with no recognised sig algs in TLSv1.2 should fail
#Test 14: Sending a list with no recognised sig algs in TLSv1.2 should fail
$proxy->clear();
$testtype = NO_KNOWN_SIG_ALGS;
$proxy->clientflags("-no_tls1_3");
@@ -160,7 +181,7 @@ SKIP: {
$proxy->start();
ok(TLSProxy::Message->fail, "No known TLSv1.3 sigalgs");
#Test 13: Sending a sig algs list without pss for an RSA cert in TLSv1.2
#Test 15: Sending a sig algs list without pss for an RSA cert in TLSv1.2
# should succeed
$proxy->clear();
$testtype = NO_PSS_SIG_ALGS;
@@ -169,7 +190,7 @@ SKIP: {
$proxy->start();
ok(TLSProxy::Message->success, "No PSS TLSv1.2 sigalgs");
#Test 14: Sending only TLSv1.3 PSS sig algs in TLSv1.2 should succeed
#Test 16: Sending only TLSv1.3 PSS sig algs in TLSv1.2 should succeed
$proxy->clear();
$testtype = PSS_ONLY_SIG_ALGS;
$proxy->serverflags("-no_tls1_3");
@@ -177,7 +198,7 @@ SKIP: {
$proxy->start();
ok(TLSProxy::Message->success, "PSS only sigalgs in TLSv1.2");
#Test 15: Responding with a sig alg we did not send in TLSv1.2 should fail
#Test 17: Responding with a sig alg we did not send in TLSv1.2 should fail
# We send rsa_pkcs1_sha256 and respond with rsa_pss_rsae_sha256
# TODO(TLS1.3): Add a similar test to the TLSv1.3 section above
# when we have an API capable of configuring the TLSv1.3 sig algs
@@ -188,7 +209,7 @@ SKIP: {
$proxy->start();
ok(TLSProxy::Message->fail, "Sigalg we did not send in TLSv1.2");
#Test 16: Sending a valid sig algs list but not including a sig type that
#Test 18: Sending a valid sig algs list but not including a sig type that
# matches the certificate should fail in TLSv1.2
$proxy->clear();
$proxy->clientflags("-no_tls1_3 -sigalgs ECDSA+SHA256");
@@ -198,7 +219,7 @@ SKIP: {
ok(TLSProxy::Message->fail, "No matching TLSv1.2 sigalgs");
$proxy->filter(\&sigalgs_filter);
#Test 17: No sig algs extension, ECDSA cert, TLSv1.2 should succeed
#Test 19: No sig algs extension, ECDSA cert, TLSv1.2 should succeed
$proxy->clear();
$testtype = NO_SIG_ALGS_EXT;
$proxy->clientflags("-no_tls1_3");
@@ -214,7 +235,7 @@ SKIP: {
my ($dsa_status, $sha1_status, $sha224_status);
SKIP: {
skip "TLSv1.3 disabled", 2 if disabled("tls1_3") || disabled("dsa");
#Test 18: signature_algorithms with 1.3-only ClientHello
#Test 20: signature_algorithms with 1.3-only ClientHello
$testtype = PURE_SIGALGS;
$dsa_status = $sha1_status = $sha224_status = 0;
$proxy->clear();
@@ -224,7 +245,7 @@ SKIP: {
ok($dsa_status && $sha1_status && $sha224_status,
"DSA/SHA2 sigalg sent for 1.3-only ClientHello");
#Test 19: signature_algorithms with backwards compatible ClientHello
#Test 21: signature_algorithms with backwards compatible ClientHello
SKIP: {
skip "TLSv1.2 disabled", 1 if disabled("tls1_2");
$testtype = COMPAT_SIGALGS;
@@ -239,21 +260,21 @@ SKIP: {
SKIP: {
skip "TLSv1.3 disabled", 3 if disabled("tls1_3");
#Test 20: Insert signature_algorithms_cert that match normal sigalgs
#Test 22: Insert signature_algorithms_cert that match normal sigalgs
$testtype = SIGALGS_CERT_ALL;
$proxy->clear();
$proxy->filter(\&modify_sigalgs_cert_filter);
$proxy->start();
ok(TLSProxy::Message->success, "sigalgs_cert in TLSv1.3");
#Test 21: Insert signature_algorithms_cert that forces PKCS#1 cert
#Test 23: Insert signature_algorithms_cert that forces PKCS#1 cert
$testtype = SIGALGS_CERT_PKCS;
$proxy->clear();
$proxy->filter(\&modify_sigalgs_cert_filter);
$proxy->start();
ok(TLSProxy::Message->success, "sigalgs_cert in TLSv1.3 with PKCS#1 cert");
#Test 22: Insert signature_algorithms_cert that fails
#Test 24: Insert signature_algorithms_cert that fails
$testtype = SIGALGS_CERT_INVALID;
$proxy->clear();
$proxy->filter(\&modify_sigalgs_cert_filter);
test/recipes/80-test_http.t
+21
View File
@@ -0,0 +1,21 @@
#! /usr/bin/env perl
# Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use OpenSSL::Test qw/:DEFAULT srctop_file/;
use OpenSSL::Test::Utils;
setup("test_http");
plan tests => 1;
SKIP: {
skip "sockets disabled", 1 if disabled("sock");
ok(run(test(["http_test",
srctop_file("test", "certs", "ca-cert.pem")])));
}
test/recipes/90-test_ige.t
+1 -2
View File
@@ -17,7 +17,6 @@ use OpenSSL::Test::Utils;
setup("test_ige");
plan skip_all => "AES_ige support is disabled in this build"
if disabled("deprecated")
&& (!defined config("api") || config("api") >= 30000);
if disabled('deprecated-3.0');
simple_test("test_ige", "igetest");
test/recipes/90-test_sslprovider.t
+21
View File
@@ -0,0 +1,21 @@
#! /usr/bin/env perl
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use OpenSSL::Test::Utils;
use OpenSSL::Test qw/:DEFAULT srctop_dir/;
setup("test_sslprovider");
plan skip_all => "No TLS/SSL protocols are supported by this OpenSSL build"
if alldisabled(grep { $_ ne "ssl3" } available_protocols("tls"));
plan tests => 1;
ok(run(test(["sslprovidertest", srctop_dir("test", "certs")])),
"running sslprovidertest");
test/recipes/95-test_external_krb5.t
+3 -1
View File
@@ -10,6 +10,7 @@
use OpenSSL::Test;
use OpenSSL::Test::Utils;
use OpenSSL::Test qw/:DEFAULT data_file srctop_file bldtop_dir/;
use Cwd qw(abs_path);
setup("test_external_krb5");
@@ -20,6 +21,7 @@ plan skip_all => "krb5 not available"
plan tests => 1;
$ENV{OPENSSL_CONF} = srctop_file("test", "default-and-legacy.cnf");
$ENV{OPENSSL_MODULES} = abs_path($ENV{OPENSSL_MODULES});
$ENV{OPENSSL_CONF} = abs_path(srctop_file("test", "default-and-legacy.cnf"));
ok(run(cmd([data_file("krb5.sh")])), "running krb5 tests");
test/recordlentest.c
+5
View File
@@ -185,6 +185,11 @@ OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(privkey = test_get_argument(1)))
return 0;
test/secmemtest.c
+2 -2
View File
@@ -92,7 +92,7 @@ static int test_sec_mem(void)
* elements was 1<<31, as |int i| was set to that, which is a
* negative number. However, it requires minimum input values:
*
* CRYPTO_secure_malloc_init((size_t)1<<34, (size_t)1<<4);
* CRYPTO_secure_malloc_init((size_t)1<<34, 1<<4);
*
* Which really only works on 64-bit systems, since it took 16 GB
* secure memory arena to trigger the problem. It naturally takes
@@ -113,7 +113,7 @@ static int test_sec_mem(void)
*/
if (sizeof(size_t) > 4) {
TEST_info("Possible infinite loop: 1<<31 limit");
if (TEST_true(CRYPTO_secure_malloc_init((size_t)1<<34, (size_t)1<<4) != 0))
if (TEST_true(CRYPTO_secure_malloc_init((size_t)1<<34, 1<<4) != 0))
TEST_true(CRYPTO_secure_malloc_done());
}
# endif
test/servername_test.c
+5
View File
@@ -239,6 +239,11 @@ static int test_servername(int test)
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(privkey = test_get_argument(1)))
return 0;
test/sm2_internal_test.c
+5
View File
@@ -7,6 +7,11 @@
* https://www.openssl.org/source/license.html
*/
/*
* Low level APIs are deprecated for public use, but still ok for internal use.
*/
#include "internal/deprecated.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
test/ssl_test.c
+5
View File
@@ -506,6 +506,11 @@ int setup_tests(void)
{
long num_tests;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(conf = NCONF_new(NULL))
/* argv[1] should point to the test conf file */
|| !TEST_int_gt(NCONF_load(conf, test_get_argument(0), NULL), 0)
test/ssl_test_ctx_test.c
+5
View File
@@ -244,6 +244,11 @@ OPT_TEST_DECLARE_USAGE("conf_file\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(conf = NCONF_new(NULL)))
return 0;
/* argument should point to test/ssl_test_ctx_test.conf */
test/sslapitest.c
+234 -23
View File
@@ -7,6 +7,14 @@
* https://www.openssl.org/source/license.html
*/
/*
* We need access to the deprecated low level HMAC APIs for legacy purposes
* when the deprecated calls are not hidden
*/
#ifndef OPENSSL_NO_DEPRECATED_3_0
# define OPENSSL_SUPPRESS_DEPRECATED
#endif
#include <stdio.h>
#include <string.h>
@@ -19,6 +27,7 @@
#include <openssl/txt_db.h>
#include <openssl/aes.h>
#include <openssl/rand.h>
#include <openssl/core_names.h>
#include "ssltestlib.h"
#include "testutil.h"
@@ -101,6 +110,17 @@ static unsigned char serverinfov2[] = {
0xff /* Dummy extension data */
};
static int hostname_cb(SSL *s, int *al, void *arg)
{
const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
if (hostname != NULL && (strcmp(hostname, "goodhost") == 0
|| strcmp(hostname, "altgoodhost") == 0))
return SSL_TLSEXT_ERR_OK;
return SSL_TLSEXT_ERR_NOACK;
}
static void client_keylog_callback(const SSL *ssl, const char *line)
{
int line_length = strlen(line);
@@ -3187,16 +3207,6 @@ static int test_early_data_not_sent(int idx)
return testresult;
}
static int hostname_cb(SSL *s, int *al, void *arg)
{
const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
if (hostname != NULL && strcmp(hostname, "goodhost") == 0)
return SSL_TLSEXT_ERR_OK;
return SSL_TLSEXT_ERR_NOACK;
}
static const char *servalpn;
static int alpn_select_cb(SSL *ssl, const unsigned char **out,
@@ -3289,16 +3299,16 @@ static int test_early_data_psk(int idx)
case 3:
/*
* Set inconsistent SNI (server detected). In this case the connection
* will succeed but reject early_data.
* Set inconsistent SNI (server side). In this case the connection
* will succeed and accept early_data. In TLSv1.3 on the server side SNI
* is associated with each handshake - not the session. Therefore it
* should not matter that we used a different server name last time.
*/
SSL_SESSION_free(serverpsk);
serverpsk = SSL_SESSION_dup(clientpsk);
if (!TEST_ptr(serverpsk)
|| !TEST_true(SSL_SESSION_set1_hostname(serverpsk, "badhost")))
goto end;
edstatus = SSL_EARLY_DATA_REJECTED;
readearlyres = SSL_READ_EARLY_DATA_FINISH;
/* Fall through */
case 4:
/* Set consistent SNI */
@@ -6077,6 +6087,7 @@ static SSL_TICKET_RETURN dec_tick_cb(SSL *s, SSL_SESSION *ss,
}
#ifndef OPENSSL_NO_DEPRECATED_3_0
static int tick_key_cb(SSL *s, unsigned char key_name[16],
unsigned char iv[EVP_MAX_IV_LENGTH], EVP_CIPHER_CTX *ctx,
HMAC_CTX *hctx, int enc)
@@ -6094,6 +6105,32 @@ static int tick_key_cb(SSL *s, unsigned char key_name[16],
return tick_key_renew ? 2 : 1;
}
#endif
static int tick_key_evp_cb(SSL *s, unsigned char key_name[16],
unsigned char iv[EVP_MAX_IV_LENGTH],
EVP_CIPHER_CTX *ctx, EVP_MAC_CTX *hctx, int enc)
{
const unsigned char tick_aes_key[16] = "0123456789abcdef";
unsigned char tick_hmac_key[16] = "0123456789abcdef";
OSSL_PARAM params[3];
tick_key_cb_called = 1;
memset(iv, 0, AES_BLOCK_SIZE);
memset(key_name, 0, 16);
params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
"SHA256", 0);
params[1] = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
tick_hmac_key,
sizeof(tick_hmac_key));
params[2] = OSSL_PARAM_construct_end();
if (!EVP_CipherInit_ex(ctx, EVP_aes_128_cbc(), NULL, tick_aes_key, iv, enc)
|| !EVP_MAC_CTX_set_params(hctx, params)
|| !EVP_MAC_init(hctx))
return -1;
return tick_key_renew ? 2 : 1;
}
/*
* Test the various ticket callbacks
@@ -6105,10 +6142,14 @@ static int tick_key_cb(SSL *s, unsigned char key_name[16],
* Test 5: TLSv1.3, no ticket key callback, ticket, no renewal
* Test 6: TLSv1.2, no ticket key callback, ticket, renewal
* Test 7: TLSv1.3, no ticket key callback, ticket, renewal
* Test 8: TLSv1.2, ticket key callback, ticket, no renewal
* Test 9: TLSv1.3, ticket key callback, ticket, no renewal
* Test 10: TLSv1.2, ticket key callback, ticket, renewal
* Test 11: TLSv1.3, ticket key callback, ticket, renewal
* Test 8: TLSv1.2, old ticket key callback, ticket, no renewal
* Test 9: TLSv1.3, old ticket key callback, ticket, no renewal
* Test 10: TLSv1.2, old ticket key callback, ticket, renewal
* Test 11: TLSv1.3, old ticket key callback, ticket, renewal
* Test 12: TLSv1.2, ticket key callback, ticket, no renewal
* Test 13: TLSv1.3, ticket key callback, ticket, no renewal
* Test 14: TLSv1.2, ticket key callback, ticket, renewal
* Test 15: TLSv1.3, ticket key callback, ticket, renewal
*/
static int test_ticket_callbacks(int tst)
{
@@ -6125,11 +6166,15 @@ static int test_ticket_callbacks(int tst)
if (tst % 2 == 1)
return 1;
#endif
#ifdef OPENSSL_NO_DEPRECATED_3_0
if (tst >= 8 && tst <= 11)
return 1;
#endif
gen_tick_called = dec_tick_called = tick_key_cb_called = 0;
/* Which tests the ticket key callback should request renewal for */
if (tst == 10 || tst == 11)
if (tst == 10 || tst == 11 || tst == 14 || tst == 15)
tick_key_renew = 1;
else
tick_key_renew = 0;
@@ -6179,9 +6224,15 @@ static int test_ticket_callbacks(int tst)
NULL)))
goto end;
if (tst >= 8
&& !TEST_true(SSL_CTX_set_tlsext_ticket_key_cb(sctx, tick_key_cb)))
goto end;
if (tst >= 12) {
if (!TEST_true(SSL_CTX_set_tlsext_ticket_key_evp_cb(sctx, tick_key_evp_cb)))
goto end;
#ifndef OPENSSL_NO_DEPRECATED_3_0
} else if (tst >= 8) {
if (!TEST_true(SSL_CTX_set_tlsext_ticket_key_cb(sctx, tick_key_cb)))
goto end;
#endif
}
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
@@ -6918,10 +6969,169 @@ end:
}
#endif /* OPENSSL_NO_TLS1_2 */
/*
* Test 0: Client sets servername and server acknowledges it (TLSv1.2)
* Test 1: Client sets servername and server does not acknowledge it (TLSv1.2)
* Test 2: Client sets inconsistent servername on resumption (TLSv1.2)
* Test 3: Client does not set servername on initial handshake (TLSv1.2)
* Test 4: Client does not set servername on resumption handshake (TLSv1.2)
* Test 5: Client sets servername and server acknowledges it (TLSv1.3)
* Test 6: Client sets servername and server does not acknowledge it (TLSv1.3)
* Test 7: Client sets inconsistent servername on resumption (TLSv1.3)
* Test 8: Client does not set servername on initial handshake(TLSv1.3)
* Test 9: Client does not set servername on resumption handshake (TLSv1.3)
*/
static int test_servername(int tst)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
int testresult = 0;
SSL_SESSION *sess = NULL;
const char *sexpectedhost = NULL, *cexpectedhost = NULL;
#ifdef OPENSSL_NO_TLS1_2
if (tst <= 4)
return 1;
#endif
#ifdef OPENSSL_NO_TLS1_3
if (tst >= 5)
return 1;
#endif
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(),
TLS1_VERSION,
(tst <= 4) ? TLS1_2_VERSION
: TLS1_3_VERSION,
&sctx, &cctx, cert, privkey))
|| !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL)))
goto end;
if (tst != 1 && tst != 6) {
if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx,
hostname_cb)))
goto end;
}
if (tst != 3 && tst != 8) {
if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost")))
goto end;
sexpectedhost = cexpectedhost = "goodhost";
}
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
goto end;
if (!TEST_str_eq(SSL_get_servername(clientssl, TLSEXT_NAMETYPE_host_name),
cexpectedhost)
|| !TEST_str_eq(SSL_get_servername(serverssl,
TLSEXT_NAMETYPE_host_name),
sexpectedhost))
goto end;
/* Now repeat with a resumption handshake */
if (!TEST_int_eq(SSL_shutdown(clientssl), 0)
|| !TEST_ptr_ne(sess = SSL_get1_session(clientssl), NULL)
|| !TEST_true(SSL_SESSION_is_resumable(sess))
|| !TEST_int_eq(SSL_shutdown(serverssl), 0))
goto end;
SSL_free(clientssl);
SSL_free(serverssl);
clientssl = serverssl = NULL;
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
NULL)))
goto end;
if (!TEST_true(SSL_set_session(clientssl, sess)))
goto end;
sexpectedhost = cexpectedhost = "goodhost";
if (tst == 2 || tst == 7) {
/* Set an inconsistent hostname */
if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "altgoodhost")))
goto end;
/*
* In TLSv1.2 we expect the hostname from the original handshake, in
* TLSv1.3 we expect the hostname from this handshake
*/
if (tst == 7)
sexpectedhost = cexpectedhost = "altgoodhost";
if (!TEST_str_eq(SSL_get_servername(clientssl,
TLSEXT_NAMETYPE_host_name),
"altgoodhost"))
goto end;
} else if (tst == 4 || tst == 9) {
/*
* A TLSv1.3 session does not associate a session with a servername,
* but a TLSv1.2 session does.
*/
if (tst == 9)
sexpectedhost = cexpectedhost = NULL;
if (!TEST_str_eq(SSL_get_servername(clientssl,
TLSEXT_NAMETYPE_host_name),
cexpectedhost))
goto end;
} else {
if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost")))
goto end;
/*
* In a TLSv1.2 resumption where the hostname was not acknowledged
* we expect the hostname on the server to be empty. On the client we
* return what was requested in this case.
*
* Similarly if the client didn't set a hostname on an original TLSv1.2
* session but is now, the server hostname will be empty, but the client
* is as we set it.
*/
if (tst == 1 || tst == 3)
sexpectedhost = NULL;
if (!TEST_str_eq(SSL_get_servername(clientssl,
TLSEXT_NAMETYPE_host_name),
"goodhost"))
goto end;
}
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
goto end;
if (!TEST_true(SSL_session_reused(clientssl))
|| !TEST_true(SSL_session_reused(serverssl))
|| !TEST_str_eq(SSL_get_servername(clientssl,
TLSEXT_NAMETYPE_host_name),
cexpectedhost)
|| !TEST_str_eq(SSL_get_servername(serverssl,
TLSEXT_NAMETYPE_host_name),
sexpectedhost))
goto end;
testresult = 1;
end:
SSL_SESSION_free(sess);
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(certsdir = test_get_argument(0))
|| !TEST_ptr(srpvfile = test_get_argument(1))
|| !TEST_ptr(tmpfilename = test_get_argument(2)))
@@ -7060,7 +7270,7 @@ int setup_tests(void)
ADD_ALL_TESTS(test_info_callback, 6);
ADD_ALL_TESTS(test_ssl_pending, 2);
ADD_ALL_TESTS(test_ssl_get_shared_ciphers, OSSL_NELEM(shared_ciphers_data));
ADD_ALL_TESTS(test_ticket_callbacks, 12);
ADD_ALL_TESTS(test_ticket_callbacks, 16);
ADD_ALL_TESTS(test_shutdown, 7);
ADD_ALL_TESTS(test_cert_cb, 6);
ADD_ALL_TESTS(test_client_cert_cb, 2);
@@ -7068,6 +7278,7 @@ int setup_tests(void)
#ifndef OPENSSL_NO_TLS1_2
ADD_ALL_TESTS(test_multiblock_write, OSSL_NELEM(multiblock_cipherlist_data));
#endif
ADD_ALL_TESTS(test_servername, 10);
return 1;
}
test/sslbuffertest.c
+5
View File
@@ -156,6 +156,11 @@ int setup_tests(void)
{
char *cert, *pkey;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(pkey = test_get_argument(1)))
return 0;
test/sslcorrupttest.c
+5
View File
@@ -250,6 +250,11 @@ int setup_tests(void)
{
int n;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(privkey = test_get_argument(1)))
return 0;
test/sslprovidertest.c
+128
View File
@@ -0,0 +1,128 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <openssl/provider.h>
#include "ssltestlib.h"
#include "testutil.h"
static char *cert = NULL;
static char *privkey = NULL;
/* TODO(3.0): Re-enable this code. See comment in setup_tests() */
#if 0
OSSL_PROVIDER *defctxlegacy = NULL;
#endif
static int test_different_libctx(void)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
int testresult = 0;
OPENSSL_CTX *libctx = OPENSSL_CTX_new();
/* TODO(3.0): Re-enable this code. See comment in setup_tests() */
#if 0
/* Verify that the default provider in the default libctx is not available */
if (!TEST_false(OSSL_PROVIDER_available(NULL, "default")))
goto end;
#endif
cctx = SSL_CTX_new_with_libctx(libctx, NULL, TLS_client_method());
if (!TEST_ptr(cctx))
goto end;
sctx = SSL_CTX_new_with_libctx(libctx, NULL, TLS_server_method());
if (!TEST_ptr(sctx))
goto end;
if (!TEST_true(create_ssl_ctx_pair(NULL,
NULL,
TLS1_VERSION,
0,
&sctx, NULL, cert, privkey)))
goto end;
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL)))
goto end;
/* This time we expect success */
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
goto end;
/* TODO(3.0): Re-enable this code. See comment in setup_tests() */
#if 0
/*
* Verify that the default provider in the default libctx is still not
* available
*/
if (!TEST_false(OSSL_PROVIDER_available(NULL, "default")))
goto end;
#endif
testresult = 1;
end:
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
OPENSSL_CTX_free(libctx);
return testresult;
}
int setup_tests(void)
{
char *certsdir = NULL;
/*
* TODO(3.0): Re-enable this code when key generation is provider aware. At
* the moment the below causes the tests to fail because libssl attempts to
* generate a key for the key_share, which ultimately invokes RAND_bytes().
* However, because key generation is not yet provider aware it just uses
* the default library context - and hence fails.
*/
#if 0
/*
* For tests in this file we want to ensure the default ctx does not have
* the default provider loaded into the default ctx. So we load "legacy" to
* prevent default from being auto-loaded. This tests that there is no
* "leakage", i.e. when using SSL_CTX_new_with_libctx() we expect only the
* specific libctx to be used - nothing should fall back to the default
* libctx
*/
defctxlegacy = OSSL_PROVIDER_load(NULL, "legacy");
#endif
if (!TEST_ptr(certsdir = test_get_argument(0)))
return 0;
cert = test_mk_file_path(certsdir, "servercert.pem");
if (cert == NULL)
return 0;
privkey = test_mk_file_path(certsdir, "serverkey.pem");
if (privkey == NULL) {
OPENSSL_free(cert);
return 0;
}
ADD_TEST(test_different_libctx);
return 1;
}
void cleanup_tests(void)
{
/* TODO(3.0): Re-enable this code. See comment in setup_tests() */
#if 0
OSSL_PROVIDER_unload(defctxlegacy);
#endif
}
test/ssltestlib.c
+10 -2
View File
@@ -724,10 +724,18 @@ int create_ssl_ctx_pair(const SSL_METHOD *sm, const SSL_METHOD *cm,
SSL_CTX *serverctx = NULL;
SSL_CTX *clientctx = NULL;
if (!TEST_ptr(serverctx = SSL_CTX_new(sm))
|| (cctx != NULL && !TEST_ptr(clientctx = SSL_CTX_new(cm))))
if (*sctx != NULL)
serverctx = *sctx;
else if (!TEST_ptr(serverctx = SSL_CTX_new(sm)))
goto err;
if (cctx != NULL) {
if (*cctx != NULL)
clientctx = *cctx;
else if (!TEST_ptr(clientctx = SSL_CTX_new(cm)))
goto err;
}
if ((min_proto_version > 0
&& !TEST_true(SSL_CTX_set_min_proto_version(serverctx,
min_proto_version)))
test/testutil.h
+6
View File
@@ -193,6 +193,12 @@ char *test_get_argument(size_t n);
/* Return the number of additional non optional command line arguments */
size_t test_get_argument_count(void);
/*
* Skip over common test options. Should be called before calling
* test_get_argument()
*/
int test_skip_common_options(void);
/*
* Internal helpers. Test programs shouldn't use these directly, but should
* rather link to one of the helper main() methods.
test/testutil/options.c
+15
View File
@@ -15,6 +15,21 @@
static int used[100] = { 0 };
int test_skip_common_options(void)
{
OPTION_CHOICE_DEFAULT o;
while ((o = (OPTION_CHOICE_DEFAULT)opt_next()) != OPT_EOF) {
switch (o) {
case OPT_TEST_CASES:
break;
default:
case OPT_ERR:
return 0;
}
}
return 1;
}
size_t test_get_argument_count(void)
{
test/tls13ccstest.c
+5
View File
@@ -492,6 +492,11 @@ OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(privkey = test_get_argument(1)))
return 0;
test/v3ext.c
+5
View File
@@ -41,6 +41,11 @@ OPT_TEST_DECLARE_USAGE("cert.pem\n")
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(infile = test_get_argument(0)))
return 0;
test/verify_extra_test.c
+5
View File
@@ -263,6 +263,11 @@ static int test_req_sm2_id(void)
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(roots_f = test_get_argument(0))
|| !TEST_ptr(untrusted_f = test_get_argument(1))
|| !TEST_ptr(bad_f = test_get_argument(2))
test/x509_check_cert_pkey_test.c
+5
View File
@@ -122,6 +122,11 @@ const OPTIONS *test_get_options(void)
int setup_tests(void)
{
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
if (!TEST_ptr(c = test_get_argument(0))
|| !TEST_ptr(k = test_get_argument(1))
|| !TEST_ptr(t = test_get_argument(2))
test/x509_dup_cert_test.c
+7 -1
View File
@@ -37,8 +37,14 @@ OPT_TEST_DECLARE_USAGE("cert.pem...\n")
int setup_tests(void)
{
size_t n = test_get_argument_count();
size_t n;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
n = test_get_argument_count();
if (!TEST_int_gt(n, 0))
return 0;
test/x509aux.c
+8 -1
View File
@@ -165,7 +165,14 @@ OPT_TEST_DECLARE_USAGE("certfile...\n")
int setup_tests(void)
{
size_t n = test_get_argument_count();
size_t n;
if (!test_skip_common_options()) {
TEST_error("Error parsing test options\n");
return 0;
}
n = test_get_argument_count();
if (n == 0)
return 0;