- 10 11月, 2016 9 次提交
-
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Andy Polyakov 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Richard Levitte 提交于
Skip the test if the value after ":" is a disabled algorithm, rather than failing it Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Richard Levitte 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
Send a TLS1.4 ClientHello with supported_versions and get TLS1.3 Send a TLS1.3 ClientHello without supported_versions and get TLS1.2 Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
If supported_versions is present it takes precedence. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 09 11月, 2016 5 次提交
-
-
由 Emilia Kasper 提交于
Simple tests only need to implement register_tests(). Tests that need a custom main() should implement test_main(). This will be wrapped in a main() that performs common setup/teardown (currently crypto-mdebug). Note that for normal development, enable-asan is usually sufficient for detecting leaks, and more versatile. enable-crypto-mdebug is stricter as it will also insist that all static variables be freed. This is useful for debugging library init/deinit; however, it also means that test_main() must free everything it allocates. Reviewed-by: NRichard Levitte <levitte@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 EasySec 提交于
Reviewed-by: NKurt Roeckx <kurt@openssl.org> Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
Normally WPACKETs will use a BUF_MEM which can grow as required. Sometimes though that may be overkill for what is needed - a static buffer may be sufficient. This adds that capability. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 08 11月, 2016 2 次提交
-
-
由 David Benjamin 提交于
MD5/SHA1 and MDC-2 have special-case logic beyond the generic DigestInfo wrapping. Test that each of these works, including hash and length mismatches (both input and signature). Also add VerifyRecover tests. It appears 5824cc29 added support for VerifyRecover, but forgot to add the test data. Reviewed-by: NKurt Roeckx <kurt@roeckx.be> Reviewed-by: NRich Salz <rsalz@openssl.org> GH: #1474
-
由 David Benjamin 提交于
RFC 3447, section 8.2.2, steps 3 and 4 states that verifiers must encode the DigestInfo struct and then compare the result against the public key operation result. This implies that one and only one encoding is legal. OpenSSL instead parses with crypto/asn1, then checks that the encoding round-trips, and allows some variations for the parameter. Sufficient laxness in this area can allow signature forgeries, as described in https://www.imperialviolet.org/2014/09/26/pkcs1.html Although there aren't known attacks against OpenSSL's current scheme, this change makes OpenSSL implement the algorithm as specified. This avoids the uncertainty and, more importantly, helps grow a healthy ecosystem. Laxness beyond the spec, particularly in implementations which enjoy wide use, risks harm to the ecosystem for all. A signature producer which only tests against OpenSSL may not notice bugs and accidentally become widely deployed. Thus implementations have a responsibility to honor the specification as tightly as is practical. In some cases, the damage is permanent and the spec deviation and security risk becomes a tax all implementors must forever pay, but not here. Both BoringSSL and Go successfully implemented and deployed RSASSA-PKCS1-v1_5 as specified since their respective beginnings, so this change should be compatible enough to pin down in future OpenSSL releases. See also https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00 As a bonus, by not having to deal with sign/verify differences, this version is also somewhat clearer. It also more consistently enforces digest lengths in the verify_recover codepath. The NID_md5_sha1 codepath wasn't quite doing this right. Reviewed-by: NKurt Roeckx <kurt@roeckx.be> Reviewed-by: NRich Salz <rsalz@openssl.org> GH: #1474
-
- 07 11月, 2016 3 次提交
-
-
由 Emilia Kasper 提交于
1) Remove some unnecessary fixtures 2) Add EXECUTE_TEST_NO_TEARDOWN shorthand when a fixture exists but has no teardown. 3) Fix return values in ct_test.c (introduced by an earlier refactoring, oops) Note that for parameterized tests, the index (test vector) usually holds all the customization, and there should be no need for a separate test fixture. The CTS test is an exception: it demonstrates how to combine customization with parameterization. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Prior to TLS1.3 we check that the received record version number is correct. In TLS1.3 we need to ignore the record version number. This adds a test to make sure we do it correctly. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
We may get failures if we run it in TLS1.3, and it makes no sense anyway so force TLS1.2 Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 05 11月, 2016 1 次提交
-
-
由 Richard Levitte 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1856)
-
- 04 11月, 2016 20 次提交
-
-
由 Richard Levitte 提交于
The sources for internal tests were sometimes badly formed, assuming perl variables such as $target{cpuid_asm_src} contains only one file name. This change correctly massages all file names in such a variable. Reviewed-by: NRich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1850)
-
由 Emilia Kasper 提交于
The test fixtures are (meant to be) useful for sharing common setup. Don't bother when we don't have any setup/teardown. This only addresses simple tests. Parameterized tests (ADD_ALL_TESTS) will be made more user-friendly in a follow-up. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Emilia Kasper 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
As per permission from Google (Emilia). Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
The updated shim has the ability to skip tests using unimplemented flags. This should reduce the number of test failures. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Move from two ifs to a single one with an && Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
It was only a sanity check anyway, so isn't needed Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
It is no longer used (replaced with bssl:UniquePtr) Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
That way we can remove flags that we don't support Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
We will rely on the -allow-unimplemented feature instead. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
They were there for BoringSSL only features which are not relevant to us. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
It was just a sanity check and isn't needed Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
git clone has the directory name last Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
This Makefile was temporary. Building ossl_shim has now been integrated into to the build system. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-