Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-03-08 13:10:50 +09:00
parent b412d79e8b
commit be29e7bcc6
274 changed files with 2778 additions and 763 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/CAss.cnf
-4
View File
@@ -1,7 +1,3 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
####################################################################
[ req ]
test/CAssdh.cnf
-22
View File
@@ -1,22 +0,0 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
# hacked by iang to do DH certs - CA
####################################################################
[ req ]
distinguished_name = req_distinguished_name
encrypt_rsa_key = no
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = CU
countryName_value = CU
organizationName = Organization Name (eg, company)
organizationName_value = La Junta de la Revolucion
commonName = Common Name (eg, YOUR name)
commonName_value = Junta
test/CAssdsa.cnf
-21
View File
@@ -1,21 +0,0 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
# hacked by iang to do DSA certs - CA
####################################################################
[ req ]
distinguished_name = req_distinguished_name
encrypt_rsa_key = no
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = ES
countryName_value = ES
organizationName = Organization Name (eg, company)
organizationName_value = Hermanos Locos
commonName = Common Name (eg, YOUR name)
commonName_value = Hermanos Locos CA
test/CAssrsa.cnf
-22
View File
@@ -1,22 +0,0 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
# create RSA certs - CA
####################################################################
[ req ]
distinguished_name = req_distinguished_name
encrypt_key = no
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = ES
countryName_value = ES
organizationName = Organization Name (eg, company)
organizationName_value = Hermanos Locos
commonName = Common Name (eg, YOUR name)
commonName_value = Hermanos Locos CA
test/P1ss.cnf
-4
View File
@@ -1,7 +1,3 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
####################################################################
[ req ]
test/P2ss.cnf
-4
View File
@@ -1,7 +1,3 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
####################################################################
[ req ]
test/README.ssltest.md
+16 -16
View File
@@ -2,7 +2,7 @@
SSL testcases are configured in the `ssl-tests` directory.
Each `ssl_*.conf.in` file contains a number of test configurations. These files
Each `ssl_*.cnf.in` file contains a number of test configurations. These files
are used to generate testcases in the OpenSSL CONF format.
The precise test output can be dependent on the library configuration. The test
@@ -10,9 +10,9 @@ harness generates the output files on the fly.
However, for verification, we also include checked-in configuration outputs
corresponding to the default configuration. These testcases live in
`test/ssl-tests/*.conf` files.
`test/ssl-tests/*.cnf` files.
For more details, see `ssl-tests/01-simple.conf.in` for an example.
For more details, see `ssl-tests/01-simple.cnf.in` for an example.
## Configuring the test
@@ -219,24 +219,24 @@ client => {
## Adding a test to the test harness
1. Add a new test configuration to `test/ssl-tests`, following the examples of
existing `*.conf.in` files (for example, `01-simple.conf.in`).
existing `*.cnf.in` files (for example, `01-simple.cnf.in`).
2. Generate the generated `*.conf` test input file. You can do so by running
2. Generate the generated `*.cnf` test input file. You can do so by running
`generate_ssl_tests.pl`:
```
$ ./config
$ cd test
$ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl ssl-tests/my.conf.in \
> ssl-tests/my.conf
$ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl ssl-tests/my.cnf.in \
> ssl-tests/my.cnf
```
where `my.conf.in` is your test input file.
where `my.cnf.in` is your test input file.
For example, to generate the test cases in `ssl-tests/01-simple.conf.in`, do
For example, to generate the test cases in `ssl-tests/01-simple.cnf.in`, do
```
$ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl ssl-tests/01-simple.conf.in > ssl-tests/01-simple.conf
$ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl ssl-tests/01-simple.cnf.in > ssl-tests/01-simple.cnf
```
Alternatively (hackish but simple), you can comment out
@@ -273,15 +273,15 @@ environment variable to point to the location of the certs. E.g., from the root
OpenSSL directory, do
```
$ CTLOG_FILE=test/ct/log_list.conf TEST_CERTS_DIR=test/certs test/ssl_test \
test/ssl-tests/01-simple.conf
$ CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test \
test/ssl-tests/01-simple.cnf
```
or for shared builds
```
$ CTLOG_FILE=test/ct/log_list.conf TEST_CERTS_DIR=test/certs \
util/wrap.pl test/ssl_test test/ssl-tests/01-simple.conf
$ CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs \
util/wrap.pl test/ssl_test test/ssl-tests/01-simple.cnf
```
Note that the test expectations sometimes depend on the Configure settings. For
@@ -293,7 +293,7 @@ The Perl test harness automatically generates expected outputs, so users who
just run `make test` do not need any extra steps.
However, when running a test manually, keep in mind that the repository version
of the generated `test/ssl-tests/*.conf` correspond to expected outputs in with
of the generated `test/ssl-tests/*.cnf` correspond to expected outputs in with
the default Configure options. To run `ssl_test` manually from the command line
in a build with a different configuration, you may need to generate the right
`*.conf` file from the `*.conf.in` input first.
`*.cnf` file from the `*.cnf.in` input first.
test/Sssdsa.cnf
-25
View File
@@ -1,25 +0,0 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
# hacked by iang to do DSA certs - Server
####################################################################
[ req ]
distinguished_name = req_distinguished_name
encrypt_rsa_key = no
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = ES
countryName_value = ES
organizationName = Organization Name (eg, company)
organizationName_value = Tortilleras S.A.
0.commonName = Common Name (eg, YOUR name)
0.commonName_value = Torti
1.commonName = Common Name (eg, YOUR name)
1.commonName_value = Gordita
test/Sssrsa.cnf
-24
View File
@@ -1,24 +0,0 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
# create RSA certs - Server
####################################################################
[ req ]
distinguished_name = req_distinguished_name
encrypt_key = no
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = ES
countryName_value = ES
organizationName = Organization Name (eg, company)
organizationName_value = Tortilleras S.A.
0.commonName = Common Name (eg, YOUR name)
0.commonName_value = Torti
1.commonName = Common Name (eg, YOUR name)
1.commonName_value = Gordita
test/Uss.cnf
-4
View File
@@ -1,7 +1,3 @@
#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
CN2 = Brother 2
test/build.info
+6 -5
View File
@@ -35,6 +35,7 @@ IF[{- !$disabled{tests} -}]
ectest ecstresstest gmdifftest pbelutest \
destest mdc2test \
enginetest exptest \
ssltest_old exptest rsa_test \
evp_pkey_provided_test evp_test evp_extra_test evp_fetch_prov_test \
v3nametest v3ext \
crltest danetest bad_dtls_test lhash_test sparse_array_test \
@@ -152,7 +153,7 @@ IF[{- !$disabled{tests} -}]
SOURCE[evp_pkey_provided_test]=evp_pkey_provided_test.c
INCLUDE[evp_pkey_provided_test]=../include ../apps/include
DEPEND[evp_pkey_provided_test]=../libcrypto libtestutil.a
DEPEND[evp_pkey_provided_test]=../libcrypto.a libtestutil.a
IF[{- !$disabled{'deprecated-3.0'} -}]
PROGRAMS{noinst}=igetest bftest casttest
@@ -486,8 +487,8 @@ IF[{- !$disabled{tests} -}]
IF[1]
PROGRAMS{noinst}=asn1_internal_test modes_internal_test x509_internal_test \
tls13encryptiontest wpackettest ctype_internal_test \
rdrand_sanitytest property_test ideatest rsa_mp_test \
rsa_sp800_56b_test bn_internal_test ecdsatest rsa_test \
rdrand_sanitytest property_test ideatest \
rsa_sp800_56b_test bn_internal_test ecdsatest \
rc2test rc4test rc5test hmactest ffc_internal_test \
asn1_dsa_internal_test dsatest dsa_no_digest_size_test \
dhtest ssltest_old
@@ -717,8 +718,8 @@ IF[{- !$disabled{tests} -}]
DEFINE[provider_test]=NO_PROVIDER_MODULE
DEFINE[provider_internal_test]=NO_PROVIDER_MODULE
ENDIF
DEPEND[]=provider_internal_test.conf
GENERATE[provider_internal_test.conf]=provider_internal_test.conf.in
DEPEND[]=provider_internal_test.cnf
GENERATE[provider_internal_test.cnf]=provider_internal_test.cnf.in
PROGRAMS{noinst}=params_test
SOURCE[params_test]=params_test.c
test/ct/log_list.conf → test/ct/log_list.cnf
View File
test/default-and-fips.cnf
+1 -1
View File
@@ -1,6 +1,6 @@
openssl_conf = openssl_init
.include fipsinstall.conf
.include fipsinstall.cnf
[openssl_init]
providers = provider_sect
test/dhtest.c
+71
View File
@@ -700,6 +700,7 @@ static int dh_test_prime_groups(int index)
int ok = 0;
DH *dh = NULL;
const BIGNUM *p, *q, *g;
long len;
if (!TEST_ptr(dh = DH_new_by_nid(prime_groups[index])))
goto err;
@@ -709,11 +710,80 @@ static int dh_test_prime_groups(int index)
if (!TEST_int_eq(DH_get_nid(dh), prime_groups[index]))
goto err;
len = DH_get_length(dh);
if (!TEST_true(len > 0)
|| !TEST_true(len <= BN_num_bits(q)))
goto err;
ok = 1;
err:
DH_free(dh);
return ok;
}
static int dh_get_nid(void)
{
int ok = 0;
const BIGNUM *p, *q, *g;
BIGNUM *pcpy = NULL, *gcpy = NULL, *qcpy = NULL;
DH *dh1 = DH_new_by_nid(NID_ffdhe2048);
DH *dh2 = DH_new();
if (!TEST_ptr(dh1)
|| !TEST_ptr(dh2))
goto err;
/* Set new DH parameters manually using a existing named group's p & g */
DH_get0_pqg(dh1, &p, &q, &g);
if (!TEST_ptr(p)
|| !TEST_ptr(q)
|| !TEST_ptr(g)
|| !TEST_ptr(pcpy = BN_dup(p))
|| !TEST_ptr(gcpy = BN_dup(g)))
goto err;
if (!TEST_true(DH_set0_pqg(dh2, pcpy, NULL, gcpy)))
goto err;
pcpy = gcpy = NULL;
/* Test q is set if p and g are provided */
if (!TEST_ptr(DH_get0_q(dh2)))
goto err;
/* Test that setting p & g manually returns that it is a named group */
if (!TEST_int_eq(DH_get_nid(dh2), NID_ffdhe2048))
goto err;
/* Test that after changing g it is no longer a named group */
if (!TEST_ptr(gcpy = BN_dup(BN_value_one())))
goto err;
if (!TEST_true(DH_set0_pqg(dh2, NULL, NULL, gcpy)))
goto err;
gcpy = NULL;
if (!TEST_int_eq(DH_get_nid(dh2), NID_undef))
goto err;
/* Test that setting an incorrect q results in this not being a named group */
if (!TEST_ptr(pcpy = BN_dup(p))
|| !TEST_ptr(qcpy = BN_dup(q))
|| !TEST_ptr(gcpy = BN_dup(g))
|| !TEST_int_eq(BN_add_word(qcpy, 2), 1)
|| !TEST_true(DH_set0_pqg(dh2, pcpy, qcpy, gcpy)))
goto err;
pcpy = qcpy = gcpy = NULL;
if (!TEST_int_eq(DH_get_nid(dh2), NID_undef))
goto err;
ok = 1;
err:
BN_free(pcpy);
BN_free(qcpy);
BN_free(gcpy);
DH_free(dh2);
DH_free(dh1);
return ok;
}
#endif
@@ -726,6 +796,7 @@ int setup_tests(void)
ADD_TEST(rfc5114_test);
ADD_TEST(rfc7919_test);
ADD_ALL_TESTS(dh_test_prime_groups, OSSL_NELEM(prime_groups));
ADD_TEST(dh_get_nid);
#endif
return 1;
}
test/evp_pkey_provided_test.c
+88 -13
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -15,6 +15,7 @@
#include <openssl/core_names.h>
#include "crypto/ecx.h"
#include "internal/nelem.h"
#include "internal/param_build.h"
#include "crypto/evp.h" /* For the internal API */
#include "testutil.h"
@@ -155,7 +156,7 @@ static int test_print_key_type_using_serializer(const char *alg, int type,
const char *pq;
OSSL_SERIALIZER_CTX *ctx = NULL;
BIO *membio = BIO_new(BIO_s_mem());
int ret = 1;
int ret = 0;
switch (type) {
case PRIV_TEXT:
@@ -187,10 +188,8 @@ static int test_print_key_type_using_serializer(const char *alg, int type,
goto err;
}
if (!TEST_ptr(membio)) {
ret = 0;
if (!TEST_ptr(membio))
goto err;
}
/* Make a context, it's valid for several prints */
TEST_note("Setting up a OSSL_SERIALIZER context with passphrase");
@@ -203,7 +202,7 @@ static int test_print_key_type_using_serializer(const char *alg, int type,
TEST_note("Testing with no encryption");
if (!TEST_true(OSSL_SERIALIZER_to_bio(ctx, membio))
|| !TEST_true(compare_with_file(alg, type, membio)))
ret = 0;
goto err;
if (type == PRIV_PEM) {
/* Set a passphrase to be used later */
@@ -216,22 +215,22 @@ static int test_print_key_type_using_serializer(const char *alg, int type,
TEST_note("Displaying PEM encrypted with AES-256-CBC");
if (!TEST_true(OSSL_SERIALIZER_CTX_set_cipher(ctx, "AES-256-CBC", NULL))
|| !TEST_true(OSSL_SERIALIZER_to_bio(ctx, bio_out)))
ret = 0;
goto err;
/* Use an invalid cipher name, which should generate no output */
TEST_note("NOT Displaying PEM encrypted with (invalid) FOO");
if (!TEST_false(OSSL_SERIALIZER_CTX_set_cipher(ctx, "FOO", NULL))
|| !TEST_false(OSSL_SERIALIZER_to_bio(ctx, bio_out)))
ret = 0;
goto err;
/* Clear the cipher. This should give us an unencrypted PEM again */
TEST_note("Testing with encryption cleared (no encryption)");
if (!TEST_true(OSSL_SERIALIZER_CTX_set_cipher(ctx, NULL, NULL))
|| !TEST_true(OSSL_SERIALIZER_to_bio(ctx, membio))
|| !TEST_true(compare_with_file(alg, type, membio)))
ret = 0;
goto err;
}
ret = 1;
err:
BIO_free(membio);
OSSL_SERIALIZER_CTX_free(ctx);
@@ -332,7 +331,7 @@ static int test_fromdata_rsa(void)
static int test_fromdata_dh(void)
{
int ret = 0;
EVP_PKEY_CTX *ctx = NULL;
EVP_PKEY_CTX *ctx = NULL, *key_ctx = NULL;
EVP_PKEY *pk = NULL;
/*
* 32-bit DH key, extracted from this command,
@@ -368,9 +367,19 @@ static int test_fromdata_dh(void)
ret = test_print_key_using_pem("DH", pk)
&& test_print_key_using_serializer("DH", pk);
if (!TEST_ptr(key_ctx = EVP_PKEY_CTX_new_from_pkey(NULL, pk, "")))
goto err;
if (!TEST_false(EVP_PKEY_check(key_ctx))
|| !TEST_true(EVP_PKEY_public_check(key_ctx))
|| !TEST_false(EVP_PKEY_private_check(key_ctx)) /* Need a q */
|| !TEST_true(EVP_PKEY_pairwise_check(key_ctx)))
goto err;
err:
EVP_PKEY_free(pk);
EVP_PKEY_CTX_free(ctx);
EVP_PKEY_CTX_free(key_ctx);
return ret;
}
@@ -479,14 +488,79 @@ static int test_fromdata_ecx(int tst)
ret = test_print_key_using_pem(alg, pk)
&& test_print_key_using_serializer(alg, pk);
err:
err:
EVP_PKEY_free(pk);
EVP_PKEY_CTX_free(ctx);
return ret;
}
#endif
static int test_fromdata_ec(void)
{
int ret = 0;
EVP_PKEY_CTX *ctx = NULL;
EVP_PKEY *pk = NULL;
OSSL_PARAM_BLD bld;
BIGNUM *ec_priv_bn = NULL;
OSSL_PARAM *fromdata_params = NULL;
const char *alg = "EC";
static const unsigned char ec_pub_keydata[] = {
0x04,
0x1b, 0x93, 0x67, 0x55, 0x1c, 0x55, 0x9f, 0x63,
0xd1, 0x22, 0xa4, 0xd8, 0xd1, 0x0a, 0x60, 0x6d,
0x02, 0xa5, 0x77, 0x57, 0xc8, 0xa3, 0x47, 0x73,
0x3a, 0x6a, 0x08, 0x28, 0x39, 0xbd, 0xc9, 0xd2,
0x80, 0xec, 0xe9, 0xa7, 0x08, 0x29, 0x71, 0x2f,
0xc9, 0x56, 0x82, 0xee, 0x9a, 0x85, 0x0f, 0x6d,
0x7f, 0x59, 0x5f, 0x8c, 0xd1, 0x96, 0x0b, 0xdf,
0x29, 0x3e, 0x49, 0x07, 0x88, 0x3f, 0x9a, 0x29
};
static const unsigned char ec_priv_keydata[] = {
0x33, 0xd0, 0x43, 0x83, 0xa9, 0x89, 0x56, 0x03,
0xd2, 0xd7, 0xfe, 0x6b, 0x01, 0x6f, 0xe4, 0x59,
0xcc, 0x0d, 0x9a, 0x24, 0x6c, 0x86, 0x1b, 0x2e,
0xdc, 0x4b, 0x4d, 0x35, 0x43, 0xe1, 0x1b, 0xad
};
ossl_param_bld_init(&bld);
if (!TEST_ptr(ec_priv_bn = BN_bin2bn(ec_priv_keydata,
sizeof(ec_priv_keydata), NULL)))
goto err;
if (ossl_param_bld_push_utf8_string(&bld, OSSL_PKEY_PARAM_EC_NAME,
"prime256v1", 0) <= 0)
goto err;
if (ossl_param_bld_push_octet_string(&bld, OSSL_PKEY_PARAM_PUB_KEY,
ec_pub_keydata,
sizeof(ec_pub_keydata)) <= 0)
goto err;
if (ossl_param_bld_push_BN(&bld, OSSL_PKEY_PARAM_PRIV_KEY, ec_priv_bn) <= 0)
goto err;
if (!TEST_ptr(fromdata_params = ossl_param_bld_to_param(&bld)))
goto err;
ctx = EVP_PKEY_CTX_new_from_name(NULL, alg, NULL);
if (!TEST_ptr(ctx))
goto err;
if (!TEST_true(EVP_PKEY_key_fromdata_init(ctx))
|| !TEST_true(EVP_PKEY_fromdata(ctx, &pk, fromdata_params))
|| !TEST_int_eq(EVP_PKEY_bits(pk), 256)
|| !TEST_int_eq(EVP_PKEY_security_bits(pk), 128)
|| !TEST_int_eq(EVP_PKEY_size(pk), 2 + 35 * 2))
goto err;
ret = test_print_key_using_pem(alg, pk)
&& test_print_key_using_serializer(alg, pk);
err:
BN_free(ec_priv_bn);
ossl_param_bld_free(fromdata_params);
EVP_PKEY_free(pk);
EVP_PKEY_CTX_free(ctx);
return ret;
}
#endif /* OPENSSL_NO_EC */
int setup_tests(void)
{
@@ -504,6 +578,7 @@ int setup_tests(void)
#endif
#ifndef OPENSSL_NO_EC
ADD_ALL_TESTS(test_fromdata_ecx, 2);
ADD_TEST(test_fromdata_ec);
#endif
return 1;
}
test/fips.cnf
+1 -1
View File
@@ -1,6 +1,6 @@
openssl_conf = openssl_init
.include fipsinstall.conf
.include fipsinstall.cnf
[openssl_init]
providers = provider_sect
test/provider_internal_test.conf.in → test/provider_internal_test.cnf.in
View File
test/recipes/02-test_internal_provider.t
+1 -1
View File
@@ -14,6 +14,6 @@ use OpenSSL::Test::Utils;
setup("test_internal_provider");
$ENV{OPENSSL_MODULES} = bldtop_dir("test");
$ENV{OPENSSL_CONF} = bldtop_file("test", "provider_internal_test.conf");
$ENV{OPENSSL_CONF} = bldtop_file("test", "provider_internal_test.cnf");
simple_test("test_internal_provider", "provider_internal_test");
test/recipes/03-test_fipsinstall.t
+13 -13
View File
@@ -30,7 +30,7 @@ my $infile = bldtop_file('providers', platform->dso('fips'));
$ENV{OPENSSL_MODULES} = bldtop_dir("providers");
# fail if no module name
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module',
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module',
'-provider_name', 'fips',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
'-section_name', 'fips_install'])),
@@ -44,57 +44,57 @@ ok(!run(app(['openssl', 'fipsinstall', '-in', 'dummy.tmp', '-module', $infile,
"fipsinstall verify fail");
# output a fips.conf file containing mac data
ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
# output a fips.cnf file containing mac data
ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
'-section_name', 'fips_install'])),
"fipsinstall");
# verify the fips.conf file
ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile,
# verify the fips.cnf file
ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
'-section_name', 'fips_install', '-verify'])),
"fipsinstall verify");
# fail to verify the fips.conf file if a different key is used
ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile,
# fail to verify the fips.cnf file if a different key is used
ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:01',
'-section_name', 'fips_install', '-verify'])),
"fipsinstall verify fail bad key");
# fail to verify the fips.conf file if a different mac digest is used
ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile,
# fail to verify the fips.cnf file if a different mac digest is used
ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA512', '-macopt', 'hexkey:00',
'-section_name', 'fips_install', '-verify'])),
"fipsinstall verify fail incorrect digest");
# corrupt the module hmac
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
'-section_name', 'fips_install', '-corrupt_desc', 'HMAC'])),
"fipsinstall fails when the module integrity is corrupted");
# corrupt the first digest
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
'-section_name', 'fips_install', '-corrupt_desc', 'SHA1'])),
"fipsinstall fails when the digest result is corrupted");
# corrupt another digest
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
'-section_name', 'fips_install', '-corrupt_desc', 'SHA3'])),
"fipsinstall fails when the digest result is corrupted");
# corrupt DRBG
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
'-section_name', 'fips_install', '-corrupt_desc', 'CTR'])),
test/recipes/04-test_conf.t
+2 -2
View File
@@ -16,8 +16,8 @@ use File::Compare qw(compare_text);
setup('test_conf');
my %input_result = (
'dollarid_on.conf' => 'dollarid_on.txt',
'dollarid_off.conf' => 'dollarid_off.txt',
'dollarid_on.cnf' => 'dollarid_on.txt',
'dollarid_off.cnf' => 'dollarid_off.txt',
);
plan skip_all => 'This is unsupported for cross compiled configurations'
test/recipes/04-test_conf_data/dollarid_off.conf → test/recipes/04-test_conf_data/dollarid_off.cnf
View File
test/recipes/04-test_conf_data/dollarid_on.conf → test/recipes/04-test_conf_data/dollarid_on.cnf
View File
test/recipes/25-test_req.t
+29 -1
View File
@@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;
setup("test_req");
plan tests => 15;
plan tests => 16;
require_ok(srctop_file('test','recipes','tconversion.pl'));
@@ -42,6 +42,34 @@ ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
subtest "generating alt certificate requests with RSA" => sub {
plan tests => 3;
SKIP: {
skip "RSA is not supported by this OpenSSL build", 2
if disabled("rsa");
ok(run(app(["openssl", "req",
"-config", srctop_file("test", "test.cnf"),
"-section", "altreq",
"-new", "-out", "testreq-rsa.pem", "-utf8",
"-key", srctop_file("test", "testrsa.pem")])),
"Generating request");
ok(run(app(["openssl", "req",
"-config", srctop_file("test", "test.cnf"),
"-verify", "-in", "testreq-rsa.pem", "-noout"])),
"Verifying signature on request");
ok(run(app(["openssl", "req",
"-config", srctop_file("test", "test.cnf"),
"-section", "altreq",
"-verify", "-in", "testreq-rsa.pem", "-noout"])),
"Verifying signature on request");
}
};
subtest "generating certificate requests with RSA" => sub {
plan tests => 2;
test/recipes/30-test_evp.t
+1 -1
View File
@@ -84,7 +84,7 @@ unless ($no_fips) {
$ENV{OPENSSL_CONF_INCLUDE} = bldtop_dir("providers");
ok(run(app(['openssl', 'fipsinstall',
'-out', bldtop_file('providers', 'fipsinstall.conf'),
'-out', bldtop_file('providers', 'fipsinstall.cnf'),
'-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
test/recipes/30-test_evp_fetch_prov.t
+1 -1
View File
@@ -48,7 +48,7 @@ my @testdata = (
unless ($no_fips) {
push @setups, {
cmd => app(['openssl', 'fipsinstall',
'-out', bldtop_file('providers', 'fipsinstall.conf'),
'-out', bldtop_file('providers', 'fipsinstall.cnf'),
'-module', bldtop_file('providers', platform->dso('fips')),
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
test/recipes/30-test_evp_pkey_provided.t
+1 -2
View File
@@ -1,6 +1,5 @@
#! /usr/bin/env perl
# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
# Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
# Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
test/recipes/30-test_evp_pkey_provided/EC.priv.der
BIN
View File
Binary file not shown.
test/recipes/30-test_evp_pkey_provided/EC.priv.pem
+5
View File
@@ -0,0 +1,5 @@
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgM9BDg6mJVgPS1/5r
AW/kWcwNmiRshhsu3EtNNUPhG62hRANCAAQbk2dVHFWfY9EipNjRCmBtAqV3V8ij
R3M6aggoOb3J0oDs6acIKXEvyVaC7pqFD21/WV+M0ZYL3yk+SQeIP5op
-----END PRIVATE KEY-----
test/recipes/30-test_evp_pkey_provided/EC.priv.txt
+13
View File
@@ -0,0 +1,13 @@
Private-Key: (256 bit)
priv:
33:d0:43:83:a9:89:56:03:d2:d7:fe:6b:01:6f:e4:
59:cc:0d:9a:24:6c:86:1b:2e:dc:4b:4d:35:43:e1:
1b:ad
pub:
04:1b:93:67:55:1c:55:9f:63:d1:22:a4:d8:d1:0a:
60:6d:02:a5:77:57:c8:a3:47:73:3a:6a:08:28:39:
bd:c9:d2:80:ec:e9:a7:08:29:71:2f:c9:56:82:ee:
9a:85:0f:6d:7f:59:5f:8c:d1:96:0b:df:29:3e:49:
07:88:3f:9a:29
ASN1 OID: prime256v1
NIST CURVE: P-256
test/recipes/30-test_evp_pkey_provided/EC.pub.der
BIN
View File
Binary file not shown.
test/recipes/30-test_evp_pkey_provided/EC.pub.pem
+4
View File
@@ -0,0 +1,4 @@
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEG5NnVRxVn2PRIqTY0QpgbQKld1fI
o0dzOmoIKDm9ydKA7OmnCClxL8lWgu6ahQ9tf1lfjNGWC98pPkkHiD+aKQ==
-----END PUBLIC KEY-----
test/recipes/30-test_evp_pkey_provided/EC.pub.txt
+9
View File
@@ -0,0 +1,9 @@
Public-Key: (256 bit)
pub:
04:1b:93:67:55:1c:55:9f:63:d1:22:a4:d8:d1:0a:
60:6d:02:a5:77:57:c8:a3:47:73:3a:6a:08:28:39:
bd:c9:d2:80:ec:e9:a7:08:29:71:2f:c9:56:82:ee:
9a:85:0f:6d:7f:59:5f:8c:d1:96:0b:df:29:3e:49:
07:88:3f:9a:29
ASN1 OID: prime256v1
NIST CURVE: P-256
test/recipes/70-test_comp.t
+1 -1
View File
@@ -28,7 +28,7 @@ plan skip_all => "$test_name needs TLSv1.3 or TLSv1.2 enabled"
if disabled("tls1_3") && disabled("tls1_2");
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
use constant {
MULTIPLE_COMPRESSIONS => 0,
test/recipes/70-test_sslmessages.t
+1 -1
View File
@@ -30,7 +30,7 @@ plan skip_all => "$test_name needs TLS enabled"
|| (!disabled("tls1_3") && disabled("tls1_2"));
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
my $proxy = TLSProxy::Proxy->new(
undef,
test/recipes/70-test_sslversions.t
+1 -1
View File
@@ -49,7 +49,7 @@ my $proxy = TLSProxy::Proxy->new(
);
#We're just testing various negative and unusual scenarios here. ssltest with
#02-protocol-version.conf should check all the various combinations of normal
#02-protocol-version.cnf should check all the various combinations of normal
#version neg
#Test 1: An empty supported_versions extension should not succeed
test/recipes/70-test_tls13kexmodes.t
+1 -1
View File
@@ -32,7 +32,7 @@ plan skip_all => "$test_name needs EC enabled"
if disabled("ec");
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
@handmessages = (
test/recipes/70-test_tls13messages.t
+1 -1
View File
@@ -32,7 +32,7 @@ plan skip_all => "$test_name needs EC enabled"
if disabled("ec");
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
@handmessages = (
test/recipes/70-test_tls13psk.t
+1 -1
View File
@@ -28,7 +28,7 @@ plan skip_all => "$test_name needs TLSv1.3 enabled"
if disabled("tls1_3");
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
my $proxy = TLSProxy::Proxy->new(
undef,
test/recipes/80-test_ct.t
+1 -1
View File
@@ -11,7 +11,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file srctop_dir/;
use OpenSSL::Test::Simple;
setup("test_ct");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
$ENV{CT_DIR} = srctop_dir("test", "ct");
$ENV{CERTS_DIR} = srctop_dir("test", "certs");
simple_test("test_ct", "ct_test", "ct", "ec");
test/recipes/80-test_ssl_new.t
+40 -40
View File
@@ -19,9 +19,9 @@ use OpenSSL::Test::Utils qw/disabled alldisabled available_protocols/;
setup("test_ssl_new");
$ENV{TEST_CERTS_DIR} = srctop_dir("test", "certs");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
my @conf_srcs = glob(srctop_file("test", "ssl-tests", "*.conf.in"));
my @conf_srcs = glob(srctop_file("test", "ssl-tests", "*.cnf.in"));
map { s/;.*// } @conf_srcs if $^O eq "VMS";
my @conf_files = map { basename($_, ".in") } @conf_srcs;
map { s/\^// } @conf_files if $^O eq "VMS";
@@ -54,56 +54,56 @@ my $no_ocsp = disabled("ocsp");
# Add your test here if the test conf.in generates test cases and/or
# expectations dynamically based on the OpenSSL compile-time config.
my %conf_dependent_tests = (
"02-protocol-version.conf" => !$is_default_tls,
"04-client_auth.conf" => !$is_default_tls || !$is_default_dtls
"02-protocol-version.cnf" => !$is_default_tls,
"04-client_auth.cnf" => !$is_default_tls || !$is_default_dtls
|| !disabled("sctp"),
"05-sni.conf" => disabled("tls1_1"),
"07-dtls-protocol-version.conf" => !$is_default_dtls || !disabled("sctp"),
"10-resumption.conf" => !$is_default_tls || $no_ec,
"11-dtls_resumption.conf" => !$is_default_dtls || !disabled("sctp"),
"16-dtls-certstatus.conf" => !$is_default_dtls || !disabled("sctp"),
"17-renegotiate.conf" => disabled("tls1_2"),
"18-dtls-renegotiate.conf" => disabled("dtls1_2") || !disabled("sctp"),
"19-mac-then-encrypt.conf" => !$is_default_tls,
"20-cert-select.conf" => !$is_default_tls || $no_dh || $no_dsa,
"22-compression.conf" => !$is_default_tls,
"25-cipher.conf" => disabled("poly1305") || disabled("chacha"),
"27-ticket-appdata.conf" => !$is_default_tls,
"28-seclevel.conf" => disabled("tls1_2") || $no_ec,
"30-extended-master-secret.conf" => disabled("tls1_2"),
"05-sni.cnf" => disabled("tls1_1"),
"07-dtls-protocol-version.cnf" => !$is_default_dtls || !disabled("sctp"),
"10-resumption.cnf" => !$is_default_tls || $no_ec,
"11-dtls_resumption.cnf" => !$is_default_dtls || !disabled("sctp"),
"16-dtls-certstatus.cnf" => !$is_default_dtls || !disabled("sctp"),
"17-renegotiate.cnf" => disabled("tls1_2"),
"18-dtls-renegotiate.cnf" => disabled("dtls1_2") || !disabled("sctp"),
"19-mac-then-encrypt.cnf" => !$is_default_tls,
"20-cert-select.cnf" => !$is_default_tls || $no_dh || $no_dsa,
"22-compression.cnf" => !$is_default_tls,
"25-cipher.cnf" => disabled("poly1305") || disabled("chacha"),
"27-ticket-appdata.cnf" => !$is_default_tls,
"28-seclevel.cnf" => disabled("tls1_2") || $no_ec,
"30-extended-master-secret.cnf" => disabled("tls1_2"),
);
# Add your test here if it should be skipped for some compile-time
# configurations. Default is $no_tls but some tests have different skip
# conditions.
my %skip = (
"06-sni-ticket.conf" => $no_tls_below1_3,
"07-dtls-protocol-version.conf" => $no_dtls,
"08-npn.conf" => (disabled("tls1") && disabled("tls1_1")
"06-sni-ticket.cnf" => $no_tls_below1_3,
"07-dtls-protocol-version.cnf" => $no_dtls,
"08-npn.cnf" => (disabled("tls1") && disabled("tls1_1")
&& disabled("tls1_2")) || $no_npn,
"10-resumption.conf" => disabled("tls1_1") || disabled("tls1_2"),
"11-dtls_resumption.conf" => disabled("dtls1") || disabled("dtls1_2"),
"12-ct.conf" => $no_tls || $no_ct || $no_ec,
"10-resumption.cnf" => disabled("tls1_1") || disabled("tls1_2"),
"11-dtls_resumption.cnf" => disabled("dtls1") || disabled("dtls1_2"),
"12-ct.cnf" => $no_tls || $no_ct || $no_ec,
# We could run some of these tests without TLS 1.2 if we had a per-test
# disable instruction but that's a bizarre configuration not worth
# special-casing for.
# TODO(TLS 1.3): We should review this once we have TLS 1.3.
"13-fragmentation.conf" => disabled("tls1_2"),
"14-curves.conf" => disabled("tls1_2") || $no_ec || $no_ec2m,
"15-certstatus.conf" => $no_tls || $no_ocsp,
"16-dtls-certstatus.conf" => $no_dtls || $no_ocsp,
"17-renegotiate.conf" => $no_tls_below1_3,
"18-dtls-renegotiate.conf" => $no_dtls,
"19-mac-then-encrypt.conf" => $no_pre_tls1_3,
"20-cert-select.conf" => disabled("tls1_2") || $no_ec,
"21-key-update.conf" => disabled("tls1_3"),
"22-compression.conf" => disabled("zlib") || $no_tls,
"23-srp.conf" => (disabled("tls1") && disabled ("tls1_1")
"13-fragmentation.cnf" => disabled("tls1_2"),
"14-curves.cnf" => disabled("tls1_2") || $no_ec || $no_ec2m,
"15-certstatus.cnf" => $no_tls || $no_ocsp,
"16-dtls-certstatus.cnf" => $no_dtls || $no_ocsp,
"17-renegotiate.cnf" => $no_tls_below1_3,
"18-dtls-renegotiate.cnf" => $no_dtls,
"19-mac-then-encrypt.cnf" => $no_pre_tls1_3,
"20-cert-select.cnf" => disabled("tls1_2") || $no_ec,
"21-key-update.cnf" => disabled("tls1_3"),
"22-compression.cnf" => disabled("zlib") || $no_tls,
"23-srp.cnf" => (disabled("tls1") && disabled ("tls1_1")
&& disabled("tls1_2")) || disabled("srp"),
"24-padding.conf" => disabled("tls1_3"),
"25-cipher.conf" => disabled("ec") || disabled("tls1_2"),
"26-tls13_client_auth.conf" => disabled("tls1_3"),
"29-dtls-sctp-label-bug.conf" => disabled("sctp") || disabled("sock"),
"24-padding.cnf" => disabled("tls1_3"),
"25-cipher.cnf" => disabled("ec") || disabled("tls1_2"),
"26-tls13_client_auth.cnf" => disabled("tls1_3"),
"29-dtls-sctp-label-bug.cnf" => disabled("sctp") || disabled("sock"),
);
foreach my $conf (@conf_files) {
@@ -133,7 +133,7 @@ sub test_conf {
"Getting output from generate_ssl_tests.pl.");
SKIP: {
# Test 2. Compare against existing output in test/ssl_tests.conf.
# Test 2. Compare against existing output in test/ssl_tests.cnf.
skip "Skipping generated source test for $conf", 1
if !$check_source;
test/recipes/80-test_ssl_old.t
+1 -1
View File
@@ -18,7 +18,7 @@ use OpenSSL::Test::Utils;
setup("test_ssl");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.cnf");
my ($no_rsa, $no_dsa, $no_dh, $no_ec, $no_psk,
$no_ssl3, $no_tls1, $no_tls1_1, $no_tls1_2, $no_tls1_3,
test/recipes/80-test_ssl_test_ctx.t
+2 -2
View File
@@ -15,5 +15,5 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;
setup("test_ssl_test_ctx");
plan tests => 1;
ok(run(test(["ssl_test_ctx_test", srctop_file("test", "ssl_test_ctx_test.conf")])),
"running ssl_test_ctx_test ssl_test_ctx_test.conf");
ok(run(test(["ssl_test_ctx_test", srctop_file("test", "ssl_test_ctx_test.cnf")])),
"running ssl_test_ctx_test ssl_test_ctx_test.cnf");
test/recipes/90-test_gost.t
+1 -1
View File
@@ -31,7 +31,7 @@ plan skip_all => "No test GOST engine found"
plan tests => 1;
$ENV{OPENSSL_CONF} = srctop_file("test", "recipes", "90-test_gost_data",
"gost.conf");
"gost.cnf");
ok(run(test(["gosttest",
srctop_file("test", "recipes", "90-test_gost_data",
test/recipes/90-test_gost_data/gost.conf → test/recipes/90-test_gost_data/gost.cnf
View File
test/recipes/90-test_includes_data/vms-includes.cnf
+1 -1
View File
@@ -2,4 +2,4 @@
# Example configuration file using includes.
#
.include [.conf-includes]
.include [.cnf-includes]
test/ssl-tests/01-simple.conf → test/ssl-tests/01-simple.cnf
View File
test/ssl-tests/01-simple.conf.in → test/ssl-tests/01-simple.cnf.in
View File
test/ssl-tests/02-protocol-version.conf → test/ssl-tests/02-protocol-version.cnf
View File
test/ssl-tests/02-protocol-version.conf.in → test/ssl-tests/02-protocol-version.cnf.in
View File
test/ssl-tests/03-custom_verify.conf → test/ssl-tests/03-custom_verify.cnf
View File
test/ssl-tests/03-custom_verify.conf.in → test/ssl-tests/03-custom_verify.cnf.in
View File
test/ssl-tests/04-client_auth.conf → test/ssl-tests/04-client_auth.cnf
View File
test/ssl-tests/04-client_auth.conf.in → test/ssl-tests/04-client_auth.cnf.in
View File
test/ssl-tests/05-sni.conf → test/ssl-tests/05-sni.cnf
View File
test/ssl-tests/05-sni.conf.in → test/ssl-tests/05-sni.cnf.in
View File
test/ssl-tests/06-sni-ticket.conf → test/ssl-tests/06-sni-ticket.cnf
View File
test/ssl-tests/06-sni-ticket.conf.in → test/ssl-tests/06-sni-ticket.cnf.in
View File
test/ssl-tests/07-dtls-protocol-version.conf → test/ssl-tests/07-dtls-protocol-version.cnf
View File
test/ssl-tests/07-dtls-protocol-version.conf.in → test/ssl-tests/07-dtls-protocol-version.cnf.in
View File
test/ssl-tests/08-npn.conf → test/ssl-tests/08-npn.cnf
View File
test/ssl-tests/08-npn.conf.in → test/ssl-tests/08-npn.cnf.in
View File
test/ssl-tests/09-alpn.conf → test/ssl-tests/09-alpn.cnf
View File
test/ssl-tests/09-alpn.conf.in → test/ssl-tests/09-alpn.cnf.in
View File
test/ssl-tests/10-resumption.conf → test/ssl-tests/10-resumption.cnf
View File
test/ssl-tests/10-resumption.conf.in → test/ssl-tests/10-resumption.cnf.in
View File
test/ssl-tests/11-dtls_resumption.conf → test/ssl-tests/11-dtls_resumption.cnf
View File
test/ssl-tests/11-dtls_resumption.conf.in → test/ssl-tests/11-dtls_resumption.cnf.in
View File
test/ssl-tests/12-ct.conf → test/ssl-tests/12-ct.cnf
View File
test/ssl-tests/12-ct.conf.in → test/ssl-tests/12-ct.cnf.in
View File
test/ssl-tests/13-fragmentation.conf → test/ssl-tests/13-fragmentation.cnf
View File
test/ssl-tests/13-fragmentation.conf.in → test/ssl-tests/13-fragmentation.cnf.in
View File
test/ssl-tests/14-curves.conf → test/ssl-tests/14-curves.cnf
View File
test/ssl-tests/14-curves.conf.in → test/ssl-tests/14-curves.cnf.in
View File
test/ssl-tests/15-certstatus.conf → test/ssl-tests/15-certstatus.cnf
View File
test/ssl-tests/15-certstatus.conf.in → test/ssl-tests/15-certstatus.cnf.in
View File
test/ssl-tests/16-dtls-certstatus.conf → test/ssl-tests/16-dtls-certstatus.cnf
View File
test/ssl-tests/16-dtls-certstatus.conf.in → test/ssl-tests/16-dtls-certstatus.cnf.in
View File
test/ssl-tests/17-renegotiate.conf → test/ssl-tests/17-renegotiate.cnf
View File
test/ssl-tests/17-renegotiate.conf.in → test/ssl-tests/17-renegotiate.cnf.in
View File
test/ssl-tests/18-dtls-renegotiate.conf → test/ssl-tests/18-dtls-renegotiate.cnf
View File
test/ssl-tests/18-dtls-renegotiate.conf.in → test/ssl-tests/18-dtls-renegotiate.cnf.in
View File
test/ssl-tests/19-mac-then-encrypt.conf → test/ssl-tests/19-mac-then-encrypt.cnf
View File
test/ssl-tests/19-mac-then-encrypt.conf.in → test/ssl-tests/19-mac-then-encrypt.cnf.in
View File
test/ssl-tests/20-cert-select.conf → test/ssl-tests/20-cert-select.cnf
View File
test/ssl-tests/20-cert-select.conf.in → test/ssl-tests/20-cert-select.cnf.in
View File
test/ssl-tests/21-key-update.conf → test/ssl-tests/21-key-update.cnf
View File
test/ssl-tests/21-key-update.conf.in → test/ssl-tests/21-key-update.cnf.in
View File
test/ssl-tests/22-compression.conf → test/ssl-tests/22-compression.cnf
View File
test/ssl-tests/22-compression.conf.in → test/ssl-tests/22-compression.cnf.in
View File
test/ssl-tests/23-srp.conf → test/ssl-tests/23-srp.cnf
View File
test/ssl-tests/23-srp.conf.in → test/ssl-tests/23-srp.cnf.in
View File
test/ssl-tests/24-padding.conf → test/ssl-tests/24-padding.cnf
View File
test/ssl-tests/24-padding.conf.in → test/ssl-tests/24-padding.cnf.in
View File
test/ssl-tests/25-cipher.conf → test/ssl-tests/25-cipher.cnf
View File
test/ssl-tests/25-cipher.conf.in → test/ssl-tests/25-cipher.cnf.in
View File
test/ssl-tests/26-tls13_client_auth.conf → test/ssl-tests/26-tls13_client_auth.cnf
View File
test/ssl-tests/26-tls13_client_auth.conf.in → test/ssl-tests/26-tls13_client_auth.cnf.in
+1 -1
View File
@@ -8,7 +8,7 @@
## Test TLSv1.3 certificate authentication
## Similar to 04-client_auth.conf.in output, but specific for
## Similar to 04-client_auth.cnf.in output, but specific for
## TLSv1.3 and post-handshake authentication
use strict;
test/ssl-tests/27-ticket-appdata.conf → test/ssl-tests/27-ticket-appdata.cnf
View File
test/ssl-tests/27-ticket-appdata.conf.in → test/ssl-tests/27-ticket-appdata.cnf.in
View File
test/ssl-tests/28-seclevel.cnf
+150
View File
@@ -0,0 +1,150 @@
# Generated with generate_ssl_tests.pl
num_tests = 6
test-0 = 0-SECLEVEL 3 with default key
test-1 = 1-SECLEVEL 4 with ED448 key
test-2 = 2-SECLEVEL 5 server with ED448 key
test-3 = 3-SECLEVEL 5 client with ED448 key
test-4 = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE
test-5 = 5-SECLEVEL 3 with ED448 key, TLSv1.2
# ===========================================================
[0-SECLEVEL 3 with default key]
ssl_conf = 0-SECLEVEL 3 with default key-ssl
[0-SECLEVEL 3 with default key-ssl]
server = 0-SECLEVEL 3 with default key-server
client = 0-SECLEVEL 3 with default key-client
[0-SECLEVEL 3 with default key-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT:@SECLEVEL=3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-SECLEVEL 3 with default key-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = ServerFail
# ===========================================================
[1-SECLEVEL 4 with ED448 key]
ssl_conf = 1-SECLEVEL 4 with ED448 key-ssl
[1-SECLEVEL 4 with ED448 key-ssl]
server = 1-SECLEVEL 4 with ED448 key-server
client = 1-SECLEVEL 4 with ED448 key-client
[1-SECLEVEL 4 with ED448 key-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
CipherString = DEFAULT:@SECLEVEL=4
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
[1-SECLEVEL 4 with ED448 key-client]
CipherString = DEFAULT:@SECLEVEL=4
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
# ===========================================================
[2-SECLEVEL 5 server with ED448 key]
ssl_conf = 2-SECLEVEL 5 server with ED448 key-ssl
[2-SECLEVEL 5 server with ED448 key-ssl]
server = 2-SECLEVEL 5 server with ED448 key-server
client = 2-SECLEVEL 5 server with ED448 key-client
[2-SECLEVEL 5 server with ED448 key-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
CipherString = DEFAULT:@SECLEVEL=5
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
[2-SECLEVEL 5 server with ED448 key-client]
CipherString = DEFAULT:@SECLEVEL=4
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = ServerFail
# ===========================================================
[3-SECLEVEL 5 client with ED448 key]
ssl_conf = 3-SECLEVEL 5 client with ED448 key-ssl
[3-SECLEVEL 5 client with ED448 key-ssl]
server = 3-SECLEVEL 5 client with ED448 key-server
client = 3-SECLEVEL 5 client with ED448 key-client
[3-SECLEVEL 5 client with ED448 key-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
CipherString = DEFAULT:@SECLEVEL=4
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
[3-SECLEVEL 5 client with ED448 key-client]
CipherString = DEFAULT:@SECLEVEL=5
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
VerifyMode = Peer
[test-3]
ExpectedResult = ServerFail
# ===========================================================
[4-SECLEVEL 3 with P-384 key, X25519 ECDHE]
ssl_conf = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl
[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl]
server = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-server
client = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-client
[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-server]
Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
CipherString = DEFAULT:@SECLEVEL=3
Groups = X25519
PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-client]
CipherString = ECDHE:@SECLEVEL=3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
VerifyMode = Peer
[test-4]
ExpectedResult = Success
# ===========================================================
[5-SECLEVEL 3 with ED448 key, TLSv1.2]
ssl_conf = 5-SECLEVEL 3 with ED448 key, TLSv1.2-ssl
[5-SECLEVEL 3 with ED448 key, TLSv1.2-ssl]
server = 5-SECLEVEL 3 with ED448 key, TLSv1.2-server
client = 5-SECLEVEL 3 with ED448 key, TLSv1.2-client
[5-SECLEVEL 3 with ED448 key, TLSv1.2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
CipherString = DEFAULT:@SECLEVEL=3
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
[5-SECLEVEL 3 with ED448 key, TLSv1.2-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
VerifyMode = Peer
[test-5]
ExpectedResult = Success

Some files were not shown because too many files have changed in this diff Show More