It is sometimes useful (especially in automated tests) to supply
multiple trusted or untrusted certificates via separate files rather
than have to prepare a single file containing them all.
To that end, change verify(1) to accept these options zero or more
times. Also automatically set -no-CAfile and -no-CApath when
-trusted is specified.
Improve verify(1) documentation, which could still use some work.
Reviewed-by: Richard Levitte <levitte@openssl.org>
The GOST engine is now out of date and is removed by this commit. An up
to date GOST engine is now being maintained in an external repository.
See:
https://wiki.openssl.org/index.php/Binaries
Reviewed-by: Richard Levitte <levitte@openssl.org>
Some users want to disable SSL 3.0/TLS 1.0/TLS 1.1, and enable just
TLS 1.2. In the future they might want to disable TLS 1.2 and
enable just TLS 1.3, ...
This commit makes it possible to disable any or all of the TLS or
DTLS protocols. It also considerably simplifies the SSL/TLS tests,
by auto-generating the min/max version tests based on the set of
supported protocols (425 explicitly written out tests got replaced
by two loops that generate all 425 tests if all protocols are
enabled, fewer otherwise).
Reviewed-by: Richard Levitte <levitte@openssl.org>
On some platforms, the shell will determine what attributes a file
will have, so while the program might think it's safely outputting
binary data, it's not always true.
For the sake of the tests, it's therefore safer to use -out than to
use redirection.
Reviewed-by: Rich Salz <rsalz@openssl.org>
This used to work but somewhere along the line it broke and was failing to
detect duplicate ordinals - which was the whole point of the test!
Reviewed-by: Rich Salz <rsalz@openssl.org>
VMS being a record oriented operating system, it's uncertain how the
'pipe' passes binary data from one process to another. Experience
shows that we get in trouble, and it's probably due to the pipe in
itself being opened in text mode (variable length records).
It's safer to pass data via an intermediary file instead.
Reviewed-by: Rich Salz <rsalz@openssl.org>
VMS uses a variant of openssl.cnf named openssl-vms.cnf.
There's a Perl on VMS mystery where a open pipe will not SIGPIPE when
the child process exits, which means that a loop sending "y\n" to it
will never stop. Adding a counter helps fix this (set to 10, we know
that none of the CA.pl commands will require more).
Reviewed-by: Rich Salz <rsalz@openssl.org>
Since danetest is to test DANE rather than specific algorithms, it's
acceptable to require EC when testing it.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Only two macros CRYPTO_MDEBUG and CRYPTO_MDEBUG_ABORT to control this.
If CRYPTO_MDEBUG is not set, #ifdef out the whole debug machinery.
(Thanks to Jakob Bohm for the suggestion!)
Make the "change wrapper functions" be the only paradigm.
Wrote documentation!
Format the 'set func' functions so their paramlists are legible.
Format some multi-line comments.
Remove ability to get/set the "memory debug" functions at runtme.
Remove MemCheck_* and CRYPTO_malloc_debug_init macros.
Add CRYPTO_mem_debug(int flag) function.
Add test/memleaktest.
Rename CRYPTO_malloc_init to OPENSSL_malloc_init; remove needless calls.
Reviewed-by: Richard Levitte <levitte@openssl.org>
If the client sends a status_request extension in the ClientHello
and the server responds with a status_request extension in the
ServerHello then normally the server will also later send a
CertificateStatus message. However this message is *optional* even
if the extensions were sent. This adds a test to ensure that if
the extensions are sent then we can still omit the message.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
On Linux when creating the .so file we were exporting all symbols. We should
only be exporting public symbols. This commit fixes the issue. It is only
applicable to linux currently although the same technique may work for other
platforms (e.g. Solaris should work the same way).
This also adds symbol version information to our exported symbols.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Occaisionally we have had problems where there are duplicated ordinals in
libeay.num or ssleay.num. This adds a test for this issue.
Reviewed-by: Richard Levitte <levitte@openssl.org>
The windows test uses the pseudo file "nul" to indicate no file for the
-CApath option. This does not work on all versions of Windows. Instead use
the new -no-CApath option.
Reviewed-by: Andy Polyakov <appro@openssl.org>
The openssl rehash command is not available on some platforms including
Windows. This change skips the associated tests if rehash is not available.
Reviewed-by: Richard Levitte <levitte@openssl.org>
It depended on 'openssl no-wp', which always exited with code 0, so
this test would never be performed, and this, I never discovered that
the program it's supposed to run was misspellt. Furthermore, the
feature to check is 'whirlpool', not 'wp'.
All corrected.
Reviewed-by: Stephen Henson <steve@openssl.org>
Obvious typo, and it took configuring with 'zlib' to discover it,
otherwise there was a previous skip that bypassed this section
entirely.
Reviewed-by: Tim Hudson <tjh@openssl.org>
If test/recipes/40-test_rehash.t is executed as root, the last test
will fail, since the created directory will remain writable no matter
what. Make sure it complains loudly about being run as root.
Reviewed-by: Rich Salz <rsalz@openssl.org>
test_ecdh and test_ecdsa are made to depend on no-ec being false.
test_hmac is made not to depend on algorithm at all.
Based on a contribution by Alessandro Ghedini <alessandro@ghedini.me>
Reviewed-by: Rich Salz <rsalz@openssl.org>
The verify_extra_test was recently changed to take its parameters as
arguments instead of having them hardcoded.
Reviewed-by: Rich Salz <rsalz@openssl.org>
This recipe counted too much on being called with test/ as its current
working directory. That's a mistake on, for example, Windows.
Reviewed-by: Rich Salz <rsalz@openssl.org>
