mirror of
https://github.com/openssl/openssl.git
synced 2024-12-09 05:51:54 +08:00
5fd72d96a5
It replaces apps/server.pem that used a sha1 signature with a copy of test/certs/servercert.pem that is uses sha256. This caused the dtlstest to start failing. It's testing connection sbetween a dtls client and server. In particular it was checking that if we drop a record that the handshake recovers and still completes successfully. The test iterates a number of times. The first time through it drops the first record. The second time it drops the second one, and so on. In order to do this it has a hard-coded value for the expected number of records it should see in a handshake. That's ok because we completely control both sides of the handshake and know what records we expect to see. Small changes in message size would be tolerated because that is unlikely to have an impact on the number of records. Larger changes in message size however could increase or decrease the number of records and hence cause the test to fail. This particular test uses a mem bio which doesn't have all the CTRLs that the dgram BIO has. When we are using a dgram BIO we query that BIO to determine the MTU size. The smaller the MTU the more fragmented handshakes become. Since the mem BIO doesn't report an MTU we use a rather small default value and get quite a lot of records in our handshake. This has the tendency to increase the likelihood of the number of records changing in the test if the message size changes. It so happens that the new server certificate is smaller than the old one. AFAICT this is probably because the DNs for the Subject and Issuer are significantly shorter than previously. The result is that the number of records used to transmit the Certificate message is one less than it was before. This actually has a knock on impact for subsequent messages and how we fragment them resulting in one less ServerKeyExchange record too (the actual size of the ServerKeyExchange message hasn't changed, but where in that message it gets fragmented has). In total the number of records used in the handshake has decreased by 2 with the new server.pem file. Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #10784 |
||
|---|---|---|
| .. | ||
| demoSRP | ||
| include | ||
| lib | ||
| asn1pars.c | ||
| build.info | ||
| ca-cert.srl | ||
| ca-key.pem | ||
| ca-req.pem | ||
| ca.c | ||
| CA.pl.in | ||
| cert.pem | ||
| ciphers.c | ||
| client.pem | ||
| cms.c | ||
| crl2p7.c | ||
| crl.c | ||
| ct_log_list.cnf | ||
| dgst.c | ||
| dh1024.pem | ||
| dh2048.pem | ||
| dh4096.pem | ||
| dhparam.c | ||
| dsa512.pem | ||
| dsa1024.pem | ||
| dsa-ca.pem | ||
| dsa-pca.pem | ||
| dsa.c | ||
| dsap.pem | ||
| dsaparam.c | ||
| ec.c | ||
| ecparam.c | ||
| enc.c | ||
| engine.c | ||
| errstr.c | ||
| fipsinstall.c | ||
| gendsa.c | ||
| genpkey.c | ||
| genrsa.c | ||
| info.c | ||
| kdf.c | ||
| list.c | ||
| mac.c | ||
| nseq.c | ||
| ocsp.c | ||
| openssl-vms.cnf | ||
| openssl.c | ||
| openssl.cnf | ||
| passwd.c | ||
| pca-cert.srl | ||
| pca-key.pem | ||
| pca-req.pem | ||
| pkcs7.c | ||
| pkcs8.c | ||
| pkcs12.c | ||
| pkey.c | ||
| pkeyparam.c | ||
| pkeyutl.c | ||
| prime.c | ||
| privkey.pem | ||
| progs.c | ||
| progs.h | ||
| progs.pl | ||
| provider.c | ||
| rand.c | ||
| rehash.c | ||
| req.c | ||
| req.pem | ||
| rsa8192.pem | ||
| rsa.c | ||
| rsautl.c | ||
| s512-key.pem | ||
| s512-req.pem | ||
| s1024key.pem | ||
| s1024req.pem | ||
| s_client.c | ||
| s_server.c | ||
| s_time.c | ||
| server2.pem | ||
| server.pem | ||
| server.srl | ||
| sess_id.c | ||
| smime.c | ||
| speed.c | ||
| spkac.c | ||
| srp.c | ||
| storeutl.c | ||
| testCA.pem | ||
| testdsa.h | ||
| testrsa.h | ||
| timeouts.h | ||
| ts.c | ||
| tsget.in | ||
| verify.c | ||
| version.c | ||
| vms_decc_init.c | ||
| x509.c | ||