Commit Graph

831 Commits

Author SHA1 Message Date
FdaSilvaYY
b6453a68bb GH753: More spelling fix
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-27 10:58:16 -05:00
Rob Percival
0cea8832df Public API for Certificate Transparency
Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-26 14:57:29 -05:00
Rob Percival
186d04a543 GH752 ct_test uses testutil, so include that
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-26 14:52:35 -05:00
Richard Levitte
17436ce532 Normalise the include directives in ct_test.c
build.info needed a slight update, one more include directory.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-26 12:28:35 +01:00
Alessandro Ghedini
71a04cfca0 Implement new multi-threading API
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-26 10:00:36 +00:00
Rich Salz
9666ffb333 Update test build/run for unified
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-25 21:48:09 -05:00
FdaSilvaYY
069c3c0908 fix "no-engine" build of test fixture
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-25 15:23:40 -05:00
Rob Percival
5dc312215f Tests for parsing and printing certificates containing SCTs
Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-25 13:59:11 -05:00
Andy Polyakov
50e34aaba3 test/ectest.c: add regression test for RT#4284.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 21:23:05 +01:00
Andy Polyakov
e9fd82f624 test/recipes/80-test_ca.t: remove_tree->rmtree to make it work with Perl 5.10.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-23 21:16:30 +01:00
Richard Levitte
19ab579060 Use $disabled{"dynamic-engine"} internally
We were kinda sorta using a mix of $disabled{"static-engine" and
$disabled{"dynamic-engine"} in Configure.  Let's avoid confusion,
choose one of them and stick to it.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-22 14:38:31 +01:00
Richard Levitte
2dd400bd43 Run the TLSProxy based tests as long as dynamic engines are built.
They depend on this feature because they use the engine ossltest,
which is only available as a dynamic engine.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-20 16:51:31 +01:00
Emilia Kasper
aa474d1fb1 TLS: reject duplicate extensions
Adapted from BoringSSL. Added a test.

The extension parsing code is already attempting to already handle this for
some individual extensions, but it is doing so inconsistently. Duplicate
efforts in individual extension parsing will be cleaned up in a follow-up.

Reviewed-by: Stephen Henson <steve@openssl.org>
2016-02-19 17:24:44 +01:00
Richard Levitte
ce192ebed0 Remove all special make depend flags, as well as OPENSSL_DOING_MAKEDEPEND
All those flags existed because we had all the dependencies versioned
in the repository, and wanted to have it be consistent, no matter what
the local configuration was.  Now that the dependencies are gone from
the versioned Makefile.ins, it makes much more sense to use the exact
same flags as when compiling the object files.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-18 23:43:09 +01:00
Rich Salz
dba3177745 Remove JPAKE
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-17 09:46:10 -05:00
Richard Levitte
d6b55faca3 Fixup secmemtest for the change of CRYPTO_free() and friends
Switching it to use OPENSSL_free() et al when appropriate.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-17 12:27:53 +01:00
Rich Salz
795e123173 Don't call cpuid in test; done as init.
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-14 16:36:41 -05:00
Richard Levitte
18295f0c2d Make sure to use unsigned char for is*() functions
On some platforms, the implementation is such that a signed char
triggers a warning when used with is*() functions.  On others, the
behavior is outright buggy when presented with a char that happens
to get promoted to a negative integer.

The safest thing is to cast the char that's used to an unsigned char.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-14 19:31:55 +01:00
Richard Levitte
0340edcf67 Remove 00-test_checkexes.t, as it has lost its relevance
In the early stages of creating the new test framework,
00-test_checkexes was a temporary check to ensure we had a recipe for
every test program in test/.  By now, this test has fulfilled its
purpose, and we've learned how to make recipes properly.  It's time
for this check to go away.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-13 14:00:22 +01:00
Dr. Stephen Henson
e314c34073 fix warnings on 32 bit builds
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-13 02:29:25 +00:00
Richard Levitte
b44b935e39 Let all TLSProxy based tests display debug text conditionally
If the environment variable HARNESS_ACTIVE isn't defined or
HARNESS_VERBOSE is defined, it's probable that lots of output is
desired.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-12 20:56:46 +01:00
Richard Levitte
b843cdb105 Rethink logging of test recipes
The logging that was performed in OpenSSL::Test was initially set up
as a means not to let messages that test programs write to STDERR get
displayed when a test isn't running in verbose mode.  However, the way
it was implemented, it meant that those messages were never displayed,
and you had to look in a test log.  This also meant that output to
STDERR and output to STDOUT got broken apart, which isn't optimal.

So, we remove the whole test log file implementation, and instead,
we're sending STDERR to the null device unless one of these conditions
apply:

- the test recipe already redirects stderr.  Just let it.
- the environment variable HARNESS_ACTIVE is undefined, meaning the
  recipe is run directly as a perl script instead of being harnessed
  by Test::Harness
- the environment variable HARNESS_VERBOSE is set.

Getting a full log of the tests now becomes as simple as this:

    HARNESS_VERBOSE=yes make test 2>&1 | tee tests.log

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-12 20:56:46 +01:00
Rich Salz
22e3dcb780 Remove TLS heartbeat, disable DTLS heartbeat
To enable heartbeats for DTLS, configure with enable-heartbeats.
Heartbeats for TLS have been completely removed.

This addresses RT 3647

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-11 12:57:26 -05:00
Richard Levitte
5caef3b502 Add inclusion directory crypto/include for BN compilations
Some files in crypto/bn depend on internal/bn_conf.h, and so does
test/bntest.  Therefore, we add another inclusion directory.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-11 14:39:57 +01:00
Richard Levitte
e3e6a72ec8 After auto init, check that the deprecated functions exist before using
The functions that have been deprecated by the auto init changes are
now guarded with deprecation checks, so it's fairly easy to see if
they can be used.

In test/dtlsv1listentest, we simply remove all init and cleanup code,
as they are call automatically when needed.

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-10 23:56:50 +01:00
Rich Salz
f672aee494 Rename INIT funtions, deprecate old ones.
Man, there were a lot of renamings :)

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-10 09:37:03 -05:00
Richard Levitte
0f53f939a1 clean away old VMS cruft
The old building scripts get removed, they are hopelessly gone in bit
rot by now.

Also remove the old symbol hacks.  They were needed needed to shorten
some names to 31 characters, and to resolve other symbol clashes.
Because we now compile with /NAMES=(AS_IS,SHORTENED), this is no
longer required.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-10 14:36:32 +01:00
Andy Polyakov
a98c648e40 x86[_64] assembly pack: add ChaCha20 and Poly1305 modules.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-10 10:31:14 +01:00
Richard Levitte
e8461ee1d1 Simplify the specification of include dirs in the build dir
In build.info files, make the include directory in the build directory
absolute, or Configure will think it should be added to the source
directory top.  Configure will turn it into a relative path if
possible.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-10 05:09:39 +01:00
Quanah Gibson-Mount
5e355e0cff GH645: Fix typo: ctificates -> certificates
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Signed-off-by: Rich Salz <rsalz@openssl.org>
2016-02-09 11:05:22 -05:00
Matt Caswell
8793f012f1 Clean up the tests for auto-init/de-init
Remove the need to explicitly initialise/deinitialise for the tests

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-09 15:11:38 +00:00
Matt Caswell
7b9f8f7f03 Auto init/deinit libcrypto
This builds on the previous commit to auto initialise/deinitialise
libcrypto.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-09 15:11:38 +00:00
Richard Levitte
bc66265da8 Fix 90-test_networking.t
The previous fix wasn't complete, it was missing a 'use OpenSSL::Test::Utils'

Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-09 15:11:01 +01:00
Richard Levitte
920def7401 Update 90-test-networking.t to do the same checks as other TLSProxy tests
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-09 12:18:12 +01:00
Richard Levitte
42e0ccdfe8 unified build scheme: adjust test framework for out of source build tree
To be able to run tests when we've built in a directory other than
the source tree, the testing framework needs a few adjustments.

test/testlib/OpenSSL/Test.pm needs to know where it can find
shlib_wrap.sh, and a number of other tests need to be told a different
place to find engines than what they may be able to figure out on
their own.  Relying to $TOP is not enough, $SRCTOP and $BLDTOP can be
used as an alternative.

As part of this change, top_file and top_dir are removed and
srctop_file, bldtop_file, srctop_dir and bldtop_dir take their place.

Reviewed-by: Ben Laurie <ben@openssl.org>
2016-02-09 11:43:20 +01:00
Viktor Dukhovni
c0a445a9f2 Suppress DANE TLSA reflection when verification fails
As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa()
are expected to return a negative match depth and nothing else when
verification fails.  However, this only happened when verification
failed during chain construction.  Errors in verification of the
constructed chain did not have the intended effect on these functions.

This commit updates the functions to check for verify_result ==
X509_V_OK, and no longer erases any accumulated match information
when chain construction fails.  Sophisticated developers can, with
care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA
info even when verification fail.  They must of course first check
and save the real error, and restore the original error as quickly
as possible.  Hiding by default seems to be the safer interface.

Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find
matching TLSA records.  Previously reported via X509_V_ERR_CERT_UNTRUSTED.

This also changes the "-brief" output from s_client to include
verification results and TLSA match information.

Mentioned session resumption in code example in SSL_CTX_dane_enable(3).
Also mentioned that depths returned are relative to the verified chain
which is now available via SSL_get0_verified_chain(3).

Added a few more test-cases to danetest, that exercise the new
code.

Resolved thread safety issue in use of static buffer in
X509_verify_cert_error_string().

Fixed long-stating issue in apps/s_cb.c which always sets verify_error
to either X509_V_OK or "chain to long", code elsewhere (e.g.
s_time.c), seems to expect the actual error.  [ The new chain
construction code is expected to correctly generate "chain
too long" errors, so at some point we need to drop the
work-arounds, once SSL_set_verify_depth() is also fixed to
propagate the depth to X509_STORE_CTX reliably. ]

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08 14:46:09 -05:00
Richard Levitte
4500a4cd4d Use File::Path::rmtree rather than File::Path::remove_tree
Just like File::Path::make_path, File::Path::remove_tree didn't show
up before File::Path 2.06 / perl v5.10.1, so we prefer the legacy
function here as well.

Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-02-08 17:03:37 +01:00
Richard Levitte
6b9686e694 dtlsv1listentest includes e_os.h, reflect that in include dirs
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-08 12:05:41 +01:00
Kurt Roeckx
026e012b3d Fix memory leak in dtlsv1listentest
Reviewed-by: Rich Salz <rsalz@openssl.org>

MR: #1879
2016-02-06 21:45:24 +01:00
Viktor Dukhovni
d1b105827a Allocate bio_err before turning on memleak checks
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-02-06 15:39:48 -05:00
Richard Levitte
c86ddbe613 Enhance and clear the support of linker flags
Some time ago, we had a ex_libs configuration setting that could be
divided into lflags and ex_libs.  These got divided in two settings,
lflags and ex_libs, and the former was interpreted to be general
linking flags.

Unfortunately, that conclusion wasn't entirely accurate.  Most of
those linking were meant to end up in a very precise position on the
linking command line, just before the spec of libraries the linking
depends on.

Back to the drawing board, we're diving things further, now having
lflags, which are linking flags that aren't depending on command line
position, plib_lflags, which are linking flags that should show up just
before the spec of libraries to depend on, and finally ex_libs, which
is the spec of extra libraries to depend on.

Also, documentation is changed in Configurations/README.  This was
previously forgotten.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-06 17:57:19 +01:00
Billy Brumley
b438f0ed8f GH587: Extend ECDH tests to more curves. Add more ECDH KATs.
squelch sign-compare warning

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-06 10:59:26 -05:00
Richard Levitte
04949088bd Add build.info lines for dtlsv1listentest
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-06 13:11:27 +01:00
Kurt Roeckx
7ee0ccec37 Don't include sys/socket.h
It's not available on all OSs, e_os.h already does the right thing

Reviewed-by: Richard Levitte <levitte@openssl.org>

MR: #1870
2016-02-06 12:28:13 +01:00
Viktor Dukhovni
8143aa6f34 Add missing static declarations in dtlsv1listentest.c
Clang rightly does not like extern symbols that are not declared
in any header file, as typically these are not intended for global
visibility and are exposed in error.  This was indeed the case with
various file-scope objects in dtlsv1listentest.c.

Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-05 23:22:02 -05:00
Matt Caswell
ce0865d8dc Add tests for DTLSv1_listen
Adds a set of tests for the newly rewritten DTLSv1_listen function.
The test pokes various packets at the function and then checks
the return value and the data written out to ensure it is what we
would have expected.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05 20:47:36 +00:00
Dr. Stephen Henson
e51511ce49 enable leak checking for danetest
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-05 16:02:21 +00:00
Dr. Stephen Henson
541e9565bb If memory debugging enabled return error on leaks.
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-05 16:02:21 +00:00
Richard Levitte
c4cbf9b344 Initialise with -1 rather than 1
A small typo crept in.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-05 00:03:53 +01:00
Richard Levitte
b7be6d2290 Add checks for IPv4 and IPv6 in OpenSSL::Test::Utils and use them
This uilds on the same way of checking for availability as we do in
TLSProxy.  We use all IP factories we know of, starting with those who
know both IPv6 and IPv4 and ending with the one that only knows IPv4
and cache their possible success as foundation for checking the
available of each IP domain.

80-test_ssl.t has bigger chances of working on platforms that do not
run both IP domains.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-04 23:45:03 +01:00