- 16 11月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
The previous commits put in place the logic to exchange key_share data. We now need to do something with that information. In <= TLSv1.2 the equivalent of the key_share extension is the ServerKeyExchange and ClientKeyExchange messages. With key_share those two messages are no longer necessary. The commit removes the SKE and CKE messages from the TLSv1.3 state machine. TLSv1.3 is completely different to TLSv1.2 in the messages that it sends and the transitions that are allowed. Therefore, rather than extend the existing <=TLS1.2 state transition functions, we create a whole new set for TLSv1.3. Intially these are still based on the TLSv1.2 ones, but over time they will be amended. The new TLSv1.3 transitions remove SKE and CKE completely. There's also some cleanup for some stuff which is not relevant to TLSv1.3 and is easy to remove, e.g. the DTLS support (we're not doing DTLSv1.3 yet) and NPN. I also disable EXTMS for TLSv1.3. Using it was causing some added complexity, so rather than fix it I removed it, since eventually it will not be needed anyway. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 10 11月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 02 11月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
Also we disable TLS1.3 by default (use enable-tls1_3 to re-enable). This is because this is a WIP and will not be interoperable with any other TLS1.3 implementation. Finally, we fix some tests that started failing when TLS1.3 was disabled by default. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 28 9月, 2016 2 次提交
-
-
由 Matt Caswell 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 19 9月, 2016 1 次提交
-
-
由 Richard Levitte 提交于
Some compilers complain about unused variables, and some tests do not run well without OCSP. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 30 8月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
The previous commit revealed a long standing problem where CertStatus processing was broken in DTLS. This would have been revealed by better testing - so add some! Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 24 8月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
The new curves test did not take into account no-ec2m Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 23 8月, 2016 1 次提交
-
-
由 Kurt Roeckx 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org> GH: #1472
-
- 19 8月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
Reviewed-by: NStephen Henson <steve@openssl.org>
-
- 18 8月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
Make maximum fragment length configurable and add various fragmentation tests, in addition to the existing multi-buffer tests. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 11 8月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
In practice, CT isn't really functional without EC anyway, as most logs use EC keys. So, skip loading the log list with no-ec, and skip CT tests completely in that conf. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 10 8月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
This commit only ports existing tests, and adds some coverage for resumption. We don't appear to have any handshake tests that cover SCT validation success, and this commit doesn't change that. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 08 8月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
OPENSSL_NO_NEXTPROTONEG only disables NPN, not ALPN Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 02 8月, 2016 3 次提交
-
-
由 Richard Levitte 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Richard Levitte 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
Fix the 80-test_ssl_test_ctx and 80-test_ssl_new tests when used with the no-nextprotoneg option Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 25 7月, 2016 2 次提交
-
-
由 Matt Caswell 提交于
Misc fixes impacting no-tls1_2. Also fixes no-dtls1_2. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
Also fixes some other options like no-dgram and no-sock. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 20 7月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
Systematically test every server-side version downgrade or upgrade. Client version upgrade or downgrade could be tested analogously but will be done in a later change. Reviewed-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
- 19 7月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 18 7月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
If configuring for anything other than the default TLS protocols then test failures were occuring. Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 13 6月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 10 6月, 2016 1 次提交
-
-
由 Todd Short 提交于
When session tickets are used, it's possible that SNI might swtich the SSL_CTX on an SSL. Normally, this is not a problem, because the initial_ctx/session_ctx are used for all session ticket/id processes. However, when the SNI callback occurs, it's possible that the callback may update the options in the SSL from the SSL_CTX, and this could cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things can happen: 1. The session ticket TLSEXT may not be written when the ticket expected flag is set. The state machine transistions to writing the ticket, and the client responds with an error as its not expecting a ticket. 2. When creating the session ticket, if the ticket key cb returns 0 the crypto/hmac contexts are not initialized, and the code crashes when trying to encrypt the session ticket. To fix 1, if the ticket TLSEXT is not written out, clear the expected ticket flag. To fix 2, consider a return of 0 from the ticket key cb a recoverable error, and write a 0 length ticket and continue. The client-side code can explicitly handle this case. Fix these two cases, and add unit test code to validate ticket behavior. Reviewed-by: NEmilia Käsper <emilia@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1098)
-
- 03 6月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 30 5月, 2016 1 次提交
-
-
由 Richard Levitte 提交于
Trying to use normal perl conditions to conditionally 'use' a perl module didn't quite work. Using the 'if' module to do so does work. Reviewed-by: NAndy Polyakov <appro@openssl.org>
-
- 29 5月, 2016 1 次提交
-
-
由 Andy Polyakov 提交于
As it turns out default glob's behaviour for quoted argument varies from version to version, making it impossible to Configure or run tests in some cases. The reason for quoting globs was to accommodate source path with spaces in its name, which was treated by default glob as multiple paths. File::Glob::glob on the other hand doesn't consider spaces as delimiters and therefore works with unquoted patterns. [Unfortunaltely File::Glob::glob, being too csh-ly, doesn't work on VMS, hence the "pinning" is conditional.] Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 27 5月, 2016 1 次提交
-
-
由 Richard Levitte 提交于
RT#4486 Reviewed-by: NMatt Caswell <matt@openssl.org>
-
- 13 5月, 2016 2 次提交
-
-
由 Richard Levitte 提交于
In some cases, perl's glob() thinks it needs to return file names with generation numbers, such as when a file name pattern includes two periods. Constructing other file names by simple appending to file names with generation numbers isn't a good idea, so for the VMS case, just peal the generation numbers if they are there. Fortunately, this is easy, as the returned generation number delimiter will always be a semi-colon. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Emilia Kasper 提交于
The old proxy tests test the implementation of an application proxy policy callback defined in the test itself, which is not particularly useful. It is, however, useful to test cert verify overrides in general. Therefore, replace these tests with tests for cert verify callback behaviour. Also glob the ssl test inputs on the .in files to catch missing generated files. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 22 4月, 2016 1 次提交
-
-
由 Rich Salz 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 10 4月, 2016 1 次提交
-
-
由 Richard Levitte 提交于
The simple reason is that the pre-generated files are mainly for Unix. The VMS variants look slightly different, so comparing will always fail. Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 07 4月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 05 4月, 2016 1 次提交
-
-
由 Emilia Kasper 提交于
Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: NRichard Levitte <levitte@openssl.org>
-