VirtualBox

Changeset 105945 in vbox


Ignore:
Timestamp:
Sep 4, 2024 11:32:47 AM (8 months ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
164679
Message:

openssl-3.1.7: Applied and adjusted our OpenSSL changes to 3.1.7. bugref:10757

Location:
trunk/src/libs/openssl-3.1.7
Files:
105 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/libs/openssl-3.1.7

    • Property svn:mergeinfo

      •  

        old new  
        2525/vendor/openssl/3.0.3:151497-151729
        2626/vendor/openssl/3.0.7:154371
         27/vendor/openssl/3.1.7:164675-164677

  • trunk/src/libs/openssl-3.1.7/Config.kmk

    r104078 r105945  
    4242
    4343# Can't use relative paths when dealing with sub-makefiles.
    44 VBOX_PATH_OPENSSL           := $(PATH_ROOT)/src/libs/openssl-3.1.5
     44VBOX_PATH_OPENSSL           := $(PATH_ROOT)/src/libs/openssl-3.1.7
    4545VBOX_PATH_CRYPTO            := $(VBOX_PATH_OPENSSL)/crypto
    4646VBOX_PATH_CRYPTO_GENASM     := $(VBOX_PATH_CRYPTO)/genasm-$(VBOX_CRYPTO_ASM_SCHEME)

  • trunk/src/libs/openssl-3.1.7/NOTES-NONSTOP.md

    r104078 r105945  
    5757components.
    5858
    59 A resolution to this situation is under investigation.
     59It is possible to configure the build with `no-atexit` to avoid the SIGSEGV.
     60Preferably, you can explicitly call `OPENSSL_cleanup()` from your application.
     61It is not mandatory as it just deallocates various global data structures
     62OpenSSL allocated.
    6063
    6164About Prefix and OpenSSLDir

  • trunk/src/libs/openssl-3.1.7/crypto/aes/asm/aesp8-ppc.pl

    r104078 r105945  
    11#! /usr/bin/env perl
    2 # Copyright 2014-2020 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2014-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    100100.long   0x0d0e0f0c, 0x0d0e0f0c, 0x0d0e0f0c, 0x0d0e0f0c  ?rev
    101101.long   0,0,0,0                                         ?asis
     102.long   0x0f102132, 0x43546576, 0x8798a9ba, 0xcbdcedfe
    102103Lconsts:
    103104        mflr    r0
    104105        bcl     20,31,\$+4
    105106        mflr    $ptr     #vvvvv "distance between . and rcon
    106         addi    $ptr,$ptr,-0x48
     107        addi    $ptr,$ptr,-0x58
    107108        mtlr    r0
    108109        blr
    … …  
    24062407my ($x00,$x10,$x20,$x30,$x40,$x50,$x60,$x70)=map("r$_",(0,3,26..31));
    24072408    $x00=0 if ($flavour =~ /osx/);
    2408 my ($in0,  $in1,  $in2,  $in3,  $in4,  $in5 )=map("v$_",(0..5));
     2409my ($in0,  $in1,  $in2,  $in3,  $in4,  $in5)=map("v$_",(0..5));
    24092410my ($out0, $out1, $out2, $out3, $out4, $out5)=map("v$_",(7,12..16));
    24102411my ($twk0, $twk1, $twk2, $twk3, $twk4, $twk5)=map("v$_",(17..22));
    … …  
    24612462        mtspr           256,r0
    24622463
     2464        # Reverse eighty7 to 0x010101..87
     2465        xxlor           2, 32+$eighty7, 32+$eighty7
     2466        vsldoi          $eighty7,$tmp,$eighty7,1        # 0x010101..87
     2467        xxlor           1, 32+$eighty7, 32+$eighty7
     2468
     2469        # Load XOR contents. 0xf102132435465768798a9bacbdcedfe
     2470        mr              $x70, r6
     2471        bl              Lconsts
     2472        lxvw4x          0, $x40, r6             # load XOR contents
     2473        mr              r6, $x70
     2474        li              $x70,0x70
     2475
    24632476        subi            $rounds,$rounds,3       # -4 in total
    24642477
    … …  
    25032516        lvx             v25,$x10,$key_          # pre-load round[2]
    25042517
     2518        # Switch to use the following codes with 0x010101..87 to generate tweak.
     2519        #     eighty7 = 0x010101..87
     2520        # vsrab         tmp, tweak, seven       # next tweak value, right shift 7 bits
     2521        # vand          tmp, tmp, eighty7       # last byte with carry
     2522        # vaddubm       tweak, tweak, tweak     # left shift 1 bit (x2)
     2523        # xxlor         vsx, 0, 0
     2524        # vpermxor      tweak, tweak, tmp, vsx
     2525
    25052526         vperm          $in0,$inout,$inptail,$inpperm
    25062527         subi           $inp,$inp,31            # undo "caller"
    … …  
    25082529        vsrab           $tmp,$tweak,$seven      # next tweak value
    25092530        vaddubm         $tweak,$tweak,$tweak
    2510         vsldoi          $tmp,$tmp,$tmp,15
    25112531        vand            $tmp,$tmp,$eighty7
    25122532         vxor           $out0,$in0,$twk0
    2513         vxor            $tweak,$tweak,$tmp
     2533        xxlor           32+$in1, 0, 0
     2534        vpermxor        $tweak, $tweak, $tmp, $in1
    25142535
    25152536         lvx_u          $in1,$x10,$inp
    … …  
    25172538        vsrab           $tmp,$tweak,$seven      # next tweak value
    25182539        vaddubm         $tweak,$tweak,$tweak
    2519         vsldoi          $tmp,$tmp,$tmp,15
    25202540         le?vperm       $in1,$in1,$in1,$leperm
    25212541        vand            $tmp,$tmp,$eighty7
    25222542         vxor           $out1,$in1,$twk1
    2523         vxor            $tweak,$tweak,$tmp
     2543        xxlor           32+$in2, 0, 0
     2544        vpermxor        $tweak, $tweak, $tmp, $in2
    25242545
    25252546         lvx_u          $in2,$x20,$inp
    … …  
    25282549        vsrab           $tmp,$tweak,$seven      # next tweak value
    25292550        vaddubm         $tweak,$tweak,$tweak
    2530         vsldoi          $tmp,$tmp,$tmp,15
    25312551         le?vperm       $in2,$in2,$in2,$leperm
    25322552        vand            $tmp,$tmp,$eighty7
    25332553         vxor           $out2,$in2,$twk2
    2534         vxor            $tweak,$tweak,$tmp
     2554        xxlor           32+$in3, 0, 0
     2555        vpermxor        $tweak, $tweak, $tmp, $in3
    25352556
    25362557         lvx_u          $in3,$x30,$inp
    … …  
    25392560        vsrab           $tmp,$tweak,$seven      # next tweak value
    25402561        vaddubm         $tweak,$tweak,$tweak
    2541         vsldoi          $tmp,$tmp,$tmp,15
    25422562         le?vperm       $in3,$in3,$in3,$leperm
    25432563        vand            $tmp,$tmp,$eighty7
    25442564         vxor           $out3,$in3,$twk3
    2545         vxor            $tweak,$tweak,$tmp
     2565        xxlor           32+$in4, 0, 0
     2566        vpermxor        $tweak, $tweak, $tmp, $in4
    25462567
    25472568         lvx_u          $in4,$x40,$inp
    … …  
    25502571        vsrab           $tmp,$tweak,$seven      # next tweak value
    25512572        vaddubm         $tweak,$tweak,$tweak
    2552         vsldoi          $tmp,$tmp,$tmp,15
    25532573         le?vperm       $in4,$in4,$in4,$leperm
    25542574        vand            $tmp,$tmp,$eighty7
    25552575         vxor           $out4,$in4,$twk4
    2556         vxor            $tweak,$tweak,$tmp
     2576        xxlor           32+$in5, 0, 0
     2577        vpermxor        $tweak, $tweak, $tmp, $in5
    25572578
    25582579         lvx_u          $in5,$x50,$inp
    … …  
    25612582        vsrab           $tmp,$tweak,$seven      # next tweak value
    25622583        vaddubm         $tweak,$tweak,$tweak
    2563         vsldoi          $tmp,$tmp,$tmp,15
    25642584         le?vperm       $in5,$in5,$in5,$leperm
    25652585        vand            $tmp,$tmp,$eighty7
    25662586         vxor           $out5,$in5,$twk5
    2567         vxor            $tweak,$tweak,$tmp
     2587        xxlor           32+$in0, 0, 0
     2588        vpermxor        $tweak, $tweak, $tmp, $in0
    25682589
    25692590        vxor            v31,v31,$rndkey0
    … …  
    25912612        bdnz            Loop_xts_enc6x
    25922613
     2614        xxlor           32+$eighty7, 1, 1               # 0x010101..87
     2615
    25932616        subic           $len,$len,96            # $len-=96
    25942617         vxor           $in0,$twk0,v31          # xor with last round key
    … …  
    26002623        vcipher         $out2,$out2,v24
    26012624        vcipher         $out3,$out3,v24
    2602          vsldoi         $tmp,$tmp,$tmp,15
    26032625        vcipher         $out4,$out4,v24
    26042626        vcipher         $out5,$out5,v24
    … …  
    26082630        vcipher         $out0,$out0,v25
    26092631        vcipher         $out1,$out1,v25
    2610          vxor           $tweak,$tweak,$tmp
     2632         xxlor          32+$in1, 0, 0
     2633         vpermxor       $tweak, $tweak, $tmp, $in1
    26112634        vcipher         $out2,$out2,v25
    26122635        vcipher         $out3,$out3,v25
    … …  
    26192642        and             r0,r0,$len
    26202643         vaddubm        $tweak,$tweak,$tweak
    2621          vsldoi         $tmp,$tmp,$tmp,15
    26222644        vcipher         $out0,$out0,v26
    26232645        vcipher         $out1,$out1,v26
    … …  
    26252647        vcipher         $out2,$out2,v26
    26262648        vcipher         $out3,$out3,v26
    2627          vxor           $tweak,$tweak,$tmp
     2649         xxlor          32+$in2, 0, 0
     2650         vpermxor       $tweak, $tweak, $tmp, $in2
    26282651        vcipher         $out4,$out4,v26
    26292652        vcipher         $out5,$out5,v26
    … …  
    26392662        vcipher         $out0,$out0,v27
    26402663        vcipher         $out1,$out1,v27
    2641          vsldoi         $tmp,$tmp,$tmp,15
    26422664        vcipher         $out2,$out2,v27
    26432665        vcipher         $out3,$out3,v27
    … …  
    26472669
    26482670        addi            $key_,$sp,$FRAME+15     # rewind $key_
    2649          vxor           $tweak,$tweak,$tmp
     2671         xxlor          32+$in3, 0, 0
     2672         vpermxor       $tweak, $tweak, $tmp, $in3
    26502673        vcipher         $out0,$out0,v28
    26512674        vcipher         $out1,$out1,v28
    … …  
    26562679        vcipher         $out3,$out3,v28
    26572680         vaddubm        $tweak,$tweak,$tweak
    2658          vsldoi         $tmp,$tmp,$tmp,15
    26592681        vcipher         $out4,$out4,v28
    26602682        vcipher         $out5,$out5,v28
    … …  
    26642686        vcipher         $out0,$out0,v29
    26652687        vcipher         $out1,$out1,v29
    2666          vxor           $tweak,$tweak,$tmp
     2688         xxlor          32+$in4, 0, 0
     2689         vpermxor       $tweak, $tweak, $tmp, $in4
    26672690        vcipher         $out2,$out2,v29
    26682691        vcipher         $out3,$out3,v29
    … …  
    26742697        lvx             v25,$x10,$key_          # re-pre-load round[2]
    26752698         vaddubm        $tweak,$tweak,$tweak
    2676          vsldoi         $tmp,$tmp,$tmp,15
    26772699
    26782700        vcipher         $out0,$out0,v30
    … …  
    26812703        vcipher         $out2,$out2,v30
    26822704        vcipher         $out3,$out3,v30
    2683          vxor           $tweak,$tweak,$tmp
     2705         xxlor          32+$in5, 0, 0
     2706         vpermxor       $tweak, $tweak, $tmp, $in5
    26842707        vcipher         $out4,$out4,v30
    26852708        vcipher         $out5,$out5,v30
    … …  
    26912714         lvx_u          $in0,$x00,$inp          # load next input block
    26922715         vaddubm        $tweak,$tweak,$tweak
    2693          vsldoi         $tmp,$tmp,$tmp,15
    26942716        vcipherlast     $out1,$out1,$in1
    26952717         lvx_u          $in1,$x10,$inp
    … …  
    27042726         le?vperm       $in2,$in2,$in2,$leperm
    27052727         lvx_u          $in4,$x40,$inp
    2706          vxor           $tweak,$tweak,$tmp
     2728         xxlor          10, 32+$in0, 32+$in0
     2729         xxlor          32+$in0, 0, 0
     2730         vpermxor       $tweak, $tweak, $tmp, $in0
     2731         xxlor          32+$in0, 10, 10
    27072732        vcipherlast     $tmp,$out5,$in5         # last block might be needed
    27082733                                                # in stealing mode
    … …  
    27362761        mtctr           $rounds
    27372762        beq             Loop_xts_enc6x          # did $len-=96 borrow?
     2763
     2764        xxlor           32+$eighty7, 2, 2               # 0x870101..01
    27382765
    27392766        addic.          $len,$len,0x60
    … …  
    31133140        mtspr           256,r0
    31143141
     3142        # Reverse eighty7 to 0x010101..87
     3143        xxlor           2, 32+$eighty7, 32+$eighty7
     3144        vsldoi          $eighty7,$tmp,$eighty7,1        # 0x010101..87
     3145        xxlor           1, 32+$eighty7, 32+$eighty7
     3146
     3147        # Load XOR contents. 0xf102132435465768798a9bacbdcedfe
     3148        mr              $x70, r6
     3149        bl              Lconsts
     3150        lxvw4x          0, $x40, r6             # load XOR contents
     3151        mr              r6, $x70
     3152        li              $x70,0x70
     3153
    31153154        subi            $rounds,$rounds,3       # -4 in total
    31163155
    … …  
    31603199        vsrab           $tmp,$tweak,$seven      # next tweak value
    31613200        vaddubm         $tweak,$tweak,$tweak
    3162         vsldoi          $tmp,$tmp,$tmp,15
    31633201        vand            $tmp,$tmp,$eighty7
    31643202         vxor           $out0,$in0,$twk0
    3165         vxor            $tweak,$tweak,$tmp
     3203        xxlor           32+$in1, 0, 0
     3204        vpermxor        $tweak, $tweak, $tmp, $in1
    31663205
    31673206         lvx_u          $in1,$x10,$inp
    … …  
    31693208        vsrab           $tmp,$tweak,$seven      # next tweak value
    31703209        vaddubm         $tweak,$tweak,$tweak
    3171         vsldoi          $tmp,$tmp,$tmp,15
    31723210         le?vperm       $in1,$in1,$in1,$leperm
    31733211        vand            $tmp,$tmp,$eighty7
    31743212         vxor           $out1,$in1,$twk1
    3175         vxor            $tweak,$tweak,$tmp
     3213        xxlor           32+$in2, 0, 0
     3214        vpermxor        $tweak, $tweak, $tmp, $in2
    31763215
    31773216         lvx_u          $in2,$x20,$inp
    … …  
    31803219        vsrab           $tmp,$tweak,$seven      # next tweak value
    31813220        vaddubm         $tweak,$tweak,$tweak
    3182         vsldoi          $tmp,$tmp,$tmp,15
    31833221         le?vperm       $in2,$in2,$in2,$leperm
    31843222        vand            $tmp,$tmp,$eighty7
    31853223         vxor           $out2,$in2,$twk2
    3186         vxor            $tweak,$tweak,$tmp
     3224        xxlor           32+$in3, 0, 0
     3225        vpermxor        $tweak, $tweak, $tmp, $in3
    31873226
    31883227         lvx_u          $in3,$x30,$inp
    … …  
    31913230        vsrab           $tmp,$tweak,$seven      # next tweak value
    31923231        vaddubm         $tweak,$tweak,$tweak
    3193         vsldoi          $tmp,$tmp,$tmp,15
    31943232         le?vperm       $in3,$in3,$in3,$leperm
    31953233        vand            $tmp,$tmp,$eighty7
    31963234         vxor           $out3,$in3,$twk3
    3197         vxor            $tweak,$tweak,$tmp
     3235        xxlor           32+$in4, 0, 0
     3236        vpermxor        $tweak, $tweak, $tmp, $in4
    31983237
    31993238         lvx_u          $in4,$x40,$inp
    … …  
    32023241        vsrab           $tmp,$tweak,$seven      # next tweak value
    32033242        vaddubm         $tweak,$tweak,$tweak
    3204         vsldoi          $tmp,$tmp,$tmp,15
    32053243         le?vperm       $in4,$in4,$in4,$leperm
    32063244        vand            $tmp,$tmp,$eighty7
    32073245         vxor           $out4,$in4,$twk4
    3208         vxor            $tweak,$tweak,$tmp
     3246        xxlor           32+$in5, 0, 0
     3247        vpermxor        $tweak, $tweak, $tmp, $in5
    32093248
    32103249         lvx_u          $in5,$x50,$inp
    … …  
    32133252        vsrab           $tmp,$tweak,$seven      # next tweak value
    32143253        vaddubm         $tweak,$tweak,$tweak
    3215         vsldoi          $tmp,$tmp,$tmp,15
    32163254         le?vperm       $in5,$in5,$in5,$leperm
    32173255        vand            $tmp,$tmp,$eighty7
    32183256         vxor           $out5,$in5,$twk5
    3219         vxor            $tweak,$tweak,$tmp
     3257        xxlor           32+$in0, 0, 0
     3258        vpermxor        $tweak, $tweak, $tmp, $in0
    32203259
    32213260        vxor            v31,v31,$rndkey0
    … …  
    32433282        bdnz            Loop_xts_dec6x
    32443283
     3284        xxlor           32+$eighty7, 1, 1
     3285
    32453286        subic           $len,$len,96            # $len-=96
    32463287         vxor           $in0,$twk0,v31          # xor with last round key
    … …  
    32523293        vncipher        $out2,$out2,v24
    32533294        vncipher        $out3,$out3,v24
    3254          vsldoi         $tmp,$tmp,$tmp,15
    32553295        vncipher        $out4,$out4,v24
    32563296        vncipher        $out5,$out5,v24
    … …  
    32603300        vncipher        $out0,$out0,v25
    32613301        vncipher        $out1,$out1,v25
    3262          vxor           $tweak,$tweak,$tmp
     3302         xxlor          32+$in1, 0, 0
     3303         vpermxor       $tweak, $tweak, $tmp, $in1
    32633304        vncipher        $out2,$out2,v25
    32643305        vncipher        $out3,$out3,v25
    … …  
    32713312        and             r0,r0,$len
    32723313         vaddubm        $tweak,$tweak,$tweak
    3273          vsldoi         $tmp,$tmp,$tmp,15
    32743314        vncipher        $out0,$out0,v26
    32753315        vncipher        $out1,$out1,v26
    … …  
    32773317        vncipher        $out2,$out2,v26
    32783318        vncipher        $out3,$out3,v26
    3279          vxor           $tweak,$tweak,$tmp
     3319         xxlor          32+$in2, 0, 0
     3320         vpermxor       $tweak, $tweak, $tmp, $in2
    32803321        vncipher        $out4,$out4,v26
    32813322        vncipher        $out5,$out5,v26
    … …  
    32913332        vncipher        $out0,$out0,v27
    32923333        vncipher        $out1,$out1,v27
    3293          vsldoi         $tmp,$tmp,$tmp,15
    32943334        vncipher        $out2,$out2,v27
    32953335        vncipher        $out3,$out3,v27
    … …  
    32993339
    33003340        addi            $key_,$sp,$FRAME+15     # rewind $key_
    3301          vxor           $tweak,$tweak,$tmp
     3341         xxlor          32+$in3, 0, 0
     3342         vpermxor       $tweak, $tweak, $tmp, $in3
    33023343        vncipher        $out0,$out0,v28
    33033344        vncipher        $out1,$out1,v28
    … …  
    33083349        vncipher        $out3,$out3,v28
    33093350         vaddubm        $tweak,$tweak,$tweak
    3310          vsldoi         $tmp,$tmp,$tmp,15
    33113351        vncipher        $out4,$out4,v28
    33123352        vncipher        $out5,$out5,v28
    … …  
    33163356        vncipher        $out0,$out0,v29
    33173357        vncipher        $out1,$out1,v29
    3318          vxor           $tweak,$tweak,$tmp
     3358         xxlor          32+$in4, 0, 0
     3359         vpermxor       $tweak, $tweak, $tmp, $in4
    33193360        vncipher        $out2,$out2,v29
    33203361        vncipher        $out3,$out3,v29
    … …  
    33263367        lvx             v25,$x10,$key_          # re-pre-load round[2]
    33273368         vaddubm        $tweak,$tweak,$tweak
    3328          vsldoi         $tmp,$tmp,$tmp,15
    33293369
    33303370        vncipher        $out0,$out0,v30
    … …  
    33333373        vncipher        $out2,$out2,v30
    33343374        vncipher        $out3,$out3,v30
    3335          vxor           $tweak,$tweak,$tmp
     3375         xxlor          32+$in5, 0, 0
     3376         vpermxor       $tweak, $tweak, $tmp, $in5
    33363377        vncipher        $out4,$out4,v30
    33373378        vncipher        $out5,$out5,v30
    … …  
    33433384         lvx_u          $in0,$x00,$inp          # load next input block
    33443385         vaddubm        $tweak,$tweak,$tweak
    3345          vsldoi         $tmp,$tmp,$tmp,15
    33463386        vncipherlast    $out1,$out1,$in1
    33473387         lvx_u          $in1,$x10,$inp
    … …  
    33563396         le?vperm       $in2,$in2,$in2,$leperm
    33573397         lvx_u          $in4,$x40,$inp
    3358          vxor           $tweak,$tweak,$tmp
     3398         xxlor          10, 32+$in0, 32+$in0
     3399         xxlor          32+$in0, 0, 0
     3400         vpermxor       $tweak, $tweak, $tmp, $in0
     3401         xxlor          32+$in0, 10, 10
    33593402        vncipherlast    $out5,$out5,$in5
    33603403         le?vperm       $in3,$in3,$in3,$leperm
    … …  
    33873430        beq             Loop_xts_dec6x          # did $len-=96 borrow?
    33883431
     3432        xxlor           32+$eighty7, 2, 2
     3433
    33893434        addic.          $len,$len,0x60
    33903435        beq             Lxts_dec6x_zero

  • trunk/src/libs/openssl-3.1.7/crypto/aes/build.info

    r104078 r105945  
    3939  $AESDEF_parisc20_64=$AESDEF_parisc11
    4040
     41  IF[{- $target{sys_id} ne "MACOSX" -}]
    4142  $AESASM_ppc32=aes_core.c aes_cbc.c aes-ppc.s vpaes-ppc.s aesp8-ppc.s
     43  ELSE
     44    $AESASM_ppc32=aes_core.c aes_cbc.c aes-ppc.s vpaes-ppc.s
     45  ENDIF
    4246  $AESDEF_ppc32=AES_ASM VPAES_ASM
    4347  $AESASM_ppc64=$AESASM_ppc32
    … …  
    8488# added again.
    8589IF[{- !$disabled{module} && !$disabled{shared} -}]
    86   DEFINE[../providers/liblegacy.a]=$AESDEF
     90  DEFINE[../../providers/liblegacy.a]=$AESDEF
    8791ENDIF
    8892

  • trunk/src/libs/openssl-3.1.7/crypto/asn1/a_d2i_fp.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    149149                }
    150150                len += i;
     151                if ((size_t)i < want)
     152                    continue;
     153
    151154            }
    152155        }

  • trunk/src/libs/openssl-3.1.7/crypto/asn1/a_mbstr.c

    r104078 r105945  
    11/*
    2  * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    140140        free_out = 0;
    141141        dest = *out;
    142         OPENSSL_free(dest->data);
    143         dest->data = NULL;
    144         dest->length = 0;
     142        ASN1_STRING_set0(dest, NULL, 0);
    145143        dest->type = str_type;
    146144    } else {
    … …  
    156154    if (inform == outform) {
    157155        if (!ASN1_STRING_set(dest, in, len)) {
     156            if (free_out) {
     157                ASN1_STRING_free(dest);
     158                *out = NULL;
     159            }
    158160            ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
    159161            return -1;
    … …  
    186188    }
    187189    if ((p = OPENSSL_malloc(outlen + 1)) == NULL) {
    188         if (free_out)
     190        if (free_out) {
    189191            ASN1_STRING_free(dest);
     192            *out = NULL;
     193        }
    190194        ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
    191195        return -1;

  • trunk/src/libs/openssl-3.1.7/crypto/asn1/a_strex.c

    r104078 r105945  
    11/*
    2  * Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    1111#include <string.h>
    1212#include "internal/cryptlib.h"
     13#include "internal/sizes.h"
    1314#include "crypto/asn1.h"
    1415#include <openssl/crypto.h>
    … …  
    346347    if (lflags & ASN1_STRFLGS_SHOW_TYPE) {
    347348        const char *tagname;
     349
    348350        tagname = ASN1_tag2str(type);
    349         outlen += strlen(tagname);
     351        /* We can directly cast here as tagname will never be too large. */
     352        outlen += (int)strlen(tagname);
    350353        if (!io_ch(arg, tagname, outlen) || !io_ch(arg, ":", 1))
    351354            return -1;
    … …  
    373376    if (type == -1) {
    374377        len = do_dump(lflags, io_ch, arg, str);
    375         if (len < 0)
     378        if (len < 0 || len > INT_MAX - outlen)
    376379            return -1;
    377380        outlen += len;
    … …  
    392395
    393396    len = do_buf(str->data, str->length, type, flags, &quotes, io_ch, NULL);
    394     if (len < 0)
     397    if (len < 0 || len > INT_MAX - 2 - outlen)
    395398        return -1;
    396399    outlen += len;

  • trunk/src/libs/openssl-3.1.7/crypto/asn1/a_verify.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    204204    if (inl <= 0) {
    205205        ERR_raise(ERR_LIB_ASN1, ERR_R_INTERNAL_ERROR);
     206        ret = -1;
    206207        goto err;
    207208    }
    208209    if (buf_in == NULL) {
    209210        ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
     211        ret = -1;
    210212        goto err;
    211213    }

  • trunk/src/libs/openssl-3.1.7/crypto/asn1/tasn_fre.c

    r104078 r105945  
    11/*
    2  * Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    8686    case ASN1_ITYPE_NDEF_SEQUENCE:
    8787    case ASN1_ITYPE_SEQUENCE:
    88         if (ossl_asn1_do_lock(pval, -1, it) != 0) /* if error or ref-counter > 0 */
    89             return;
     88        if (ossl_asn1_do_lock(pval, -1, it) != 0) {
     89            /* if error or ref-counter > 0 */
     90            OPENSSL_assert(embed == 0);
     91            *pval = NULL;
     92            return;
     93        }
    9094        if (asn1_cb) {
    9195            i = asn1_cb(ASN1_OP_FREE_PRE, pval, it, NULL);

  • trunk/src/libs/openssl-3.1.7/crypto/bio/bf_readbuff.c

    r104078 r105945  
    11/*
    2  * Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    223223    int i, j;
    224224
    225     if (size == 0)
     225    if (buf == NULL || size == 0)
    226226        return 0;
    227227    --size; /* the passed in size includes the terminator - so remove it here */
    228228    ctx = (BIO_F_BUFFER_CTX *)b->ptr;
     229
     230    if (ctx == NULL || b->next_bio == NULL)
     231        return 0;
    229232    BIO_clear_retry_flags(b);
    230233

  • trunk/src/libs/openssl-3.1.7/crypto/bio/bio_addr.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    779779        if (!RUN_ONCE(&bio_lookup_init, do_bio_lookup_init)) {
    780780            ERR_raise(ERR_LIB_BIO, ERR_R_MALLOC_FAILURE);
    781             ret = 0;
    782             goto err;
    783         }
    784 
    785         if (!CRYPTO_THREAD_write_lock(bio_lookup_lock)) {
    786             ret = 0;
    787             goto err;
    788         }
     781            return 0;
     782        }
     783
     784        if (!CRYPTO_THREAD_write_lock(bio_lookup_lock))
     785            return 0;
     786       
    789787        he_fallback_address = INADDR_ANY;
    790788        if (host == NULL) {

  • trunk/src/libs/openssl-3.1.7/crypto/bio/bio_lib.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    870870
    871871#ifndef OPENSSL_NO_SOCK
    872     if (BIO_get_fd(bio, &fd) > 0 && fd < FD_SETSIZE)
    873         return BIO_socket_wait(fd, BIO_should_read(bio), max_time);
     872    if (BIO_get_fd(bio, &fd) > 0) {
     873        int ret = BIO_socket_wait(fd, BIO_should_read(bio), max_time);
     874
     875        if (ret != -1)
     876            return ret;
     877    }
    874878#endif
    875879    /* fall back to polling since no sockets are available */

  • trunk/src/libs/openssl-3.1.7/crypto/bio/bio_sock.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    397397    time_t now;
    398398
     399#ifdef _WIN32
     400    if ((SOCKET)fd == INVALID_SOCKET)
     401#else
    399402    if (fd < 0 || fd >= FD_SETSIZE)
     403#endif
    400404        return -1;
    401405    if (max_time == 0)

  • trunk/src/libs/openssl-3.1.7/crypto/bn/bn_lib.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    619619    BN_ULONG t1, t2, *ap, *bp;
    620620
     621    ap = a->d;
     622    bp = b->d;
     623
     624    if (BN_get_flags(a, BN_FLG_CONSTTIME)
     625            && a->top == b->top) {
     626        int res = 0;
     627
     628        for (i = 0; i < b->top; i++) {
     629            res = constant_time_select_int(constant_time_lt_bn(ap[i], bp[i]),
     630                                           -1, res);
     631            res = constant_time_select_int(constant_time_lt_bn(bp[i], ap[i]),
     632                                           1, res);
     633        }
     634        return res;
     635    }
     636
    621637    bn_check_top(a);
    622638    bn_check_top(b);
    … …  
    625641    if (i != 0)
    626642        return i;
    627     ap = a->d;
    628     bp = b->d;
     643
    629644    for (i = a->top - 1; i >= 0; i--) {
    630645        t1 = ap[i];
    … …  
    738753}
    739754
    740 int BN_mask_bits(BIGNUM *a, int n)
     755int ossl_bn_mask_bits_fixed_top(BIGNUM *a, int n)
    741756{
    742757    int b, w;
    743758
    744     bn_check_top(a);
    745759    if (n < 0)
    746760        return 0;
    … …  
    756770        a->d[w] &= ~(BN_MASK2 << b);
    757771    }
    758     bn_correct_top(a);
     772    a->flags |= BN_FLG_FIXED_TOP;
    759773    return 1;
     774}
     775
     776int BN_mask_bits(BIGNUM *a, int n)
     777{
     778    int ret;
     779
     780    bn_check_top(a);
     781    ret = ossl_bn_mask_bits_fixed_top(a, n);
     782    if (ret)
     783        bn_correct_top(a);
     784    return ret;
    760785}
    761786
    … …  
    933958}
    934959
     960int ossl_bn_is_word_fixed_top(const BIGNUM *a, BN_ULONG w)
     961{
     962    int res, i;
     963    const BN_ULONG *ap = a->d;
     964
     965    if (a->neg || a->top == 0)
     966        return 0;
     967
     968    res = constant_time_select_int(constant_time_eq_bn(ap[0], w), 1, 0);
     969
     970    for (i = 1; i < a->top; i++)
     971        res = constant_time_select_int(constant_time_is_zero_bn(ap[i]),
     972                                       res, 0);
     973    return res;
     974}
     975
    935976int BN_is_odd(const BIGNUM *a)
    936977{

  • trunk/src/libs/openssl-3.1.7/crypto/bn/bn_rand.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    187187        do {
    188188            /* range = 11..._2  or  range = 101..._2 */
    189             if (!bnrand(flag, r, n, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY, 0,
    190                         ctx))
     189            if (!bnrand(flag, r, n, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY,
     190                        strength, ctx))
    191191                return 0;
    192192
    … …  
    241241#endif
    242242
     243int ossl_bn_priv_rand_range_fixed_top(BIGNUM *r, const BIGNUM *range,
     244                                      unsigned int strength, BN_CTX *ctx)
     245{
     246    int n;
     247    int count = 100;
     248
     249    if (r == NULL) {
     250        ERR_raise(ERR_LIB_BN, ERR_R_PASSED_NULL_PARAMETER);
     251        return 0;
     252    }
     253
     254    if (range->neg || BN_is_zero(range)) {
     255        ERR_raise(ERR_LIB_BN, BN_R_INVALID_RANGE);
     256        return 0;
     257    }
     258
     259    n = BN_num_bits(range);     /* n > 0 */
     260
     261    /* BN_is_bit_set(range, n - 1) always holds */
     262
     263    if (n == 1) {
     264        BN_zero(r);
     265    } else {
     266        BN_set_flags(r, BN_FLG_CONSTTIME);
     267        do {
     268            if (!bnrand(PRIVATE, r, n + 1, BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY,
     269                        strength, ctx))
     270                return 0;
     271
     272            if (!--count) {
     273                ERR_raise(ERR_LIB_BN, BN_R_TOO_MANY_ITERATIONS);
     274                return 0;
     275            }
     276            ossl_bn_mask_bits_fixed_top(r, n);
     277        }
     278        while (BN_ucmp(r, range) >= 0);
     279#ifdef BN_DEBUG
     280        /* With BN_DEBUG on a fixed top number cannot be returned */
     281        bn_correct_top(r);
     282#endif
     283    }
     284
     285    return 1;
     286}
     287
    243288/*
    244  * BN_generate_dsa_nonce generates a random number 0 <= out < range. Unlike
    245  * BN_rand_range, it also includes the contents of |priv| and |message| in
    246  * the generation so that an RNG failure isn't fatal as long as |priv|
     289 * ossl_bn_gen_dsa_nonce_fixed_top generates a random number 0 <= out < range.
     290 * Unlike BN_rand_range, it also includes the contents of |priv| and |message|
     291 * in the generation so that an RNG failure isn't fatal as long as |priv|
    247292 * remains secret. This is intended for use in DSA and ECDSA where an RNG
    248293 * weakness leads directly to private key exposure unless this function is
    249294 * used.
    250295 */
    251 int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
    252                           const BIGNUM *priv, const unsigned char *message,
    253                           size_t message_len, BN_CTX *ctx)
     296int ossl_bn_gen_dsa_nonce_fixed_top(BIGNUM *out, const BIGNUM *range,
     297                                    const BIGNUM *priv,
     298                                    const unsigned char *message,
     299                                    size_t message_len, BN_CTX *ctx)
    254300{
    255301    EVP_MD_CTX *mdctx = EVP_MD_CTX_new();
    … …  
    261307    unsigned char digest[SHA512_DIGEST_LENGTH];
    262308    unsigned done, todo;
    263     /* We generate |range|+8 bytes of random output. */
    264     const unsigned num_k_bytes = BN_num_bytes(range) + 8;
     309    /* We generate |range|+1 bytes of random output. */
     310    const unsigned num_k_bytes = BN_num_bytes(range) + 1;
    265311    unsigned char private_bytes[96];
    266312    unsigned char *k_bytes = NULL;
     313    const int max_n = 64;           /* Pr(failure to generate) < 2^max_n */
     314    int n;
    267315    int ret = 0;
    268316    EVP_MD *md = NULL;
    … …  
    270318
    271319    if (mdctx == NULL)
    272         goto err;
     320        goto end;
    273321
    274322    k_bytes = OPENSSL_malloc(num_k_bytes);
    275323    if (k_bytes == NULL)
    276         goto err;
     324        goto end;
     325    /* Ensure top byte is set to avoid non-constant time in bin2bn */
     326    k_bytes[0] = 0xff;
    277327
    278328    /* We copy |priv| into a local buffer to avoid exposing its length. */
    … …  
    284334         */
    285335        ERR_raise(ERR_LIB_BN, BN_R_PRIVATE_KEY_TOO_LARGE);
    286         goto err;
     336        goto end;
    287337    }
    288338
    … …  
    290340    if (md == NULL) {
    291341        ERR_raise(ERR_LIB_BN, BN_R_NO_SUITABLE_DIGEST);
    292         goto err;
    293     }
    294     for (done = 0; done < num_k_bytes;) {
    295         if (RAND_priv_bytes_ex(libctx, random_bytes, sizeof(random_bytes), 0) <= 0)
    296             goto err;
    297 
    298         if (!EVP_DigestInit_ex(mdctx, md, NULL)
    299                 || !EVP_DigestUpdate(mdctx, &done, sizeof(done))
    300                 || !EVP_DigestUpdate(mdctx, private_bytes,
    301                                      sizeof(private_bytes))
    302                 || !EVP_DigestUpdate(mdctx, message, message_len)
    303                 || !EVP_DigestUpdate(mdctx, random_bytes, sizeof(random_bytes))
    304                 || !EVP_DigestFinal_ex(mdctx, digest, NULL))
    305             goto err;
    306 
    307         todo = num_k_bytes - done;
    308         if (todo > SHA512_DIGEST_LENGTH)
    309             todo = SHA512_DIGEST_LENGTH;
    310         memcpy(k_bytes + done, digest, todo);
    311         done += todo;
    312     }
    313 
    314     if (!BN_bin2bn(k_bytes, num_k_bytes, out))
    315         goto err;
    316     if (BN_mod(out, out, range, ctx) != 1)
    317         goto err;
    318     ret = 1;
    319 
    320  err:
     342        goto end;
     343    }
     344    for (n = 0; n < max_n; n++) {
     345        unsigned char i = 0;
     346
     347        for (done = 1; done < num_k_bytes;) {
     348            if (RAND_priv_bytes_ex(libctx, random_bytes, sizeof(random_bytes),
     349                                   0) <= 0)
     350                goto end;
     351
     352            if (!EVP_DigestInit_ex(mdctx, md, NULL)
     353                    || !EVP_DigestUpdate(mdctx, &i, sizeof(i))
     354                    || !EVP_DigestUpdate(mdctx, private_bytes,
     355                                         sizeof(private_bytes))
     356                    || !EVP_DigestUpdate(mdctx, message, message_len)
     357                    || !EVP_DigestUpdate(mdctx, random_bytes,
     358                                         sizeof(random_bytes))
     359                    || !EVP_DigestFinal_ex(mdctx, digest, NULL))
     360                goto end;
     361
     362            todo = num_k_bytes - done;
     363            if (todo > SHA512_DIGEST_LENGTH)
     364                todo = SHA512_DIGEST_LENGTH;
     365            memcpy(k_bytes + done, digest, todo);
     366            done += todo;
     367            ++i;
     368        }
     369
     370        if (!BN_bin2bn(k_bytes, num_k_bytes, out))
     371            goto end;
     372
     373        /* Clear out the top bits and rejection filter into range */
     374        BN_set_flags(out, BN_FLG_CONSTTIME);
     375        ossl_bn_mask_bits_fixed_top(out, BN_num_bits(range));
     376
     377        if (BN_ucmp(out, range) < 0) {
     378            ret = 1;
     379#ifdef BN_DEBUG
     380            /* With BN_DEBUG on a fixed top number cannot be returned */
     381            bn_correct_top(out);
     382#endif
     383            goto end;
     384        }
     385    }
     386    /* Failed to generate anything */
     387    ERR_raise(ERR_LIB_BN, ERR_R_INTERNAL_ERROR);
     388
     389 end:
    321390    EVP_MD_CTX_free(mdctx);
    322391    EVP_MD_free(md);
    … …  
    327396    return ret;
    328397}
     398
     399int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
     400                          const BIGNUM *priv, const unsigned char *message,
     401                          size_t message_len, BN_CTX *ctx)
     402{
     403    int ret;
     404
     405    ret = ossl_bn_gen_dsa_nonce_fixed_top(out, range, priv, message,
     406                                          message_len, ctx);
     407    /*
     408     * This call makes the BN_generate_dsa_nonce non-const-time, thus we
     409     * do not use it internally. But fixed_top BNs currently cannot be returned
     410     * from public API calls.
     411     */
     412    bn_correct_top(out);
     413    return ret;
     414}

  • trunk/src/libs/openssl-3.1.7/crypto/bn/bn_shift.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    157157    }
    158158
     159    bn_check_top(r);
     160    bn_check_top(a);
     161
    159162    ret = bn_rshift_fixed_top(r, a, n);
    160163
    … …  
    178181    BN_ULONG l, m, mask;
    179182
    180     bn_check_top(r);
    181     bn_check_top(a);
    182 
    183183    assert(n >= 0);
    184184

  • trunk/src/libs/openssl-3.1.7/crypto/conf/conf_def.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    333333        v = NULL;
    334334        /* check for line continuation */
    335         if (bufnum >= 1) {
     335        if (!again && bufnum >= 1) {
    336336            /*
    337337             * If we have bytes and the last char '\\' and second last char

  • trunk/src/libs/openssl-3.1.7/crypto/conf/conf_lib.c

    r104078 r105945  
    11/*
    2  * Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    465465void OPENSSL_INIT_free(OPENSSL_INIT_SETTINGS *settings)
    466466{
     467    if (settings == NULL)
     468        return;
     469
    467470    free(settings->filename);
    468471    free(settings->appname);

  • trunk/src/libs/openssl-3.1.7/crypto/conf/conf_sap.c

    r104078 r105945  
    11/*
    2  * Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2002-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    3939    settings.flags = DEFAULT_CONF_MFLAGS;
    4040    OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, &settings);
     41
     42    free(settings.appname);
    4143}
    4244#endif

  • trunk/src/libs/openssl-3.1.7/crypto/context.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    440440void OSSL_LIB_CTX_free(OSSL_LIB_CTX *ctx)
    441441{
    442     if (ossl_lib_ctx_is_default(ctx))
     442    if (ctx == NULL || ossl_lib_ctx_is_default(ctx))
    443443        return;
    444444

  • trunk/src/libs/openssl-3.1.7/crypto/dsa/dsa_check.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    2020#include "crypto/dsa.h"
    2121
     22static int dsa_precheck_params(const DSA *dsa, int *ret)
     23{
     24    if (dsa->params.p == NULL || dsa->params.q == NULL) {
     25        ERR_raise(ERR_LIB_DSA, DSA_R_BAD_FFC_PARAMETERS);
     26        *ret = FFC_CHECK_INVALID_PQ;
     27        return 0;
     28    }
     29
     30    if (BN_num_bits(dsa->params.p) > OPENSSL_DSA_MAX_MODULUS_BITS) {
     31        ERR_raise(ERR_LIB_DSA, DSA_R_MODULUS_TOO_LARGE);
     32        *ret = FFC_CHECK_INVALID_PQ;
     33        return 0;
     34    }
     35
     36    if (BN_num_bits(dsa->params.q) >= BN_num_bits(dsa->params.p)) {
     37        ERR_raise(ERR_LIB_DSA, DSA_R_BAD_Q_VALUE);
     38        *ret = FFC_CHECK_INVALID_PQ;
     39        return 0;
     40    }
     41
     42    return 1;
     43}
     44
    2245int ossl_dsa_check_params(const DSA *dsa, int checktype, int *ret)
    2346{
     47    if (!dsa_precheck_params(dsa, ret))
     48        return 0;
     49
    2450    if (checktype == OSSL_KEYMGMT_VALIDATE_QUICK_CHECK)
    2551        return ossl_ffc_params_simple_validate(dsa->libctx, &dsa->params,
    … …  
    4066int ossl_dsa_check_pub_key(const DSA *dsa, const BIGNUM *pub_key, int *ret)
    4167{
     68    if (!dsa_precheck_params(dsa, ret))
     69        return 0;
     70
    4271    return ossl_ffc_validate_public_key(&dsa->params, pub_key, ret)
    4372           && *ret == 0;
    … …  
    5180int ossl_dsa_check_pub_key_partial(const DSA *dsa, const BIGNUM *pub_key, int *ret)
    5281{
     82    if (!dsa_precheck_params(dsa, ret))
     83        return 0;
     84
    5385    return ossl_ffc_validate_public_key_partial(&dsa->params, pub_key, ret)
    5486           && *ret == 0;
    … …  
    5991    *ret = 0;
    6092
    61     return (dsa->params.q != NULL
    62             && ossl_ffc_validate_private_key(dsa->params.q, priv_key, ret));
     93    if (!dsa_precheck_params(dsa, ret))
     94        return 0;
     95
     96    return ossl_ffc_validate_private_key(dsa->params.q, priv_key, ret);
    6397}
    6498
    … …  
    73107    BIGNUM *pub_key = NULL;
    74108
    75     if (dsa->params.p == NULL
    76         || dsa->params.g == NULL
     109    if (!dsa_precheck_params(dsa, &ret))
     110        return 0;
     111
     112    if (dsa->params.g == NULL
    77113        || dsa->priv_key == NULL
    78114        || dsa->pub_key == NULL)

  • trunk/src/libs/openssl-3.1.7/crypto/dsa/dsa_ossl.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    263263             * This protects the private key from a weak PRNG.
    264264             */
    265             if (!BN_generate_dsa_nonce(k, dsa->params.q, dsa->priv_key, dgst,
    266                                        dlen, ctx))
     265            if (!ossl_bn_gen_dsa_nonce_fixed_top(k, dsa->params.q,
     266                                                 dsa->priv_key, dgst,
     267                                                 dlen, ctx))
    267268                goto err;
    268         } else if (!BN_priv_rand_range_ex(k, dsa->params.q, 0, ctx))
    269             goto err;
    270     } while (BN_is_zero(k));
     269        } else if (!ossl_bn_priv_rand_range_fixed_top(k, dsa->params.q, 0, ctx))
     270            goto err;
     271    } while (ossl_bn_is_word_fixed_top(k, 0));
    271272
    272273    BN_set_flags(k, BN_FLG_CONSTTIME);

  • trunk/src/libs/openssl-3.1.7/crypto/dsa/dsa_sign.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    157157    DSA_SIG *s;
    158158
     159    if (sig == NULL) {
     160        *siglen = DSA_size(dsa);
     161        return 1;
     162    }
     163
    159164    /* legacy case uses the method table */
    160165    if (dsa->libctx == NULL || dsa->meth != DSA_get_default_method())
    … …  
    166171        return 0;
    167172    }
    168     *siglen = i2d_DSA_SIG(s, sig != NULL ? &sig : NULL);
     173    *siglen = i2d_DSA_SIG(s, &sig);
    169174    DSA_SIG_free(s);
    170175    return 1;

  • trunk/src/libs/openssl-3.1.7/crypto/ec/build.info

    r104078 r105945  
    7878# has, and doesn't need it added again.
    7979IF[{- !$disabled{module} && !$disabled{shared} -}]
    80   DEFINE[../providers/liblegacy.a]=$ECDEF
     80  DEFINE[../../providers/liblegacy.a]=$ECDEF
    8181ENDIF
    8282

  • trunk/src/libs/openssl-3.1.7/crypto/ec/curve448/arch_64/f_impl64.c

    r104078 r105945  
    11/*
    2  * Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 * Copyright 2014 Cryptography Research, Inc.
    44 *
    … …  
    4646        }
    4747        for (; j < 4; j++) {
    48             accum2 += widemul(a[j], b[i - j + 8]);
    49             accum1 += widemul(aa[j], bbb[i - j + 4]);
    50             accum0 += widemul(a[j + 4], bb[i - j + 4]);
     48            accum2 += widemul(a[j], b[i + 8 - j]);
     49            accum1 += widemul(aa[j], bbb[i + 4 - j]);
     50            accum0 += widemul(a[j + 4], bb[i + 4 - j]);
    5151        }
    5252

  • trunk/src/libs/openssl-3.1.7/crypto/ec/ecdsa_ossl.c

    r104078 r105945  
    11/*
    2  * Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2002-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    7171    ECDSA_SIG *s;
    7272
     73    if (sig == NULL && (kinv == NULL || r == NULL)) {
     74        *siglen = ECDSA_size(eckey);
     75        return 1;
     76    }
     77
    7378    s = ECDSA_do_sign_ex(dgst, dlen, kinv, r, eckey);
    7479    if (s == NULL) {
    … …  
    126131        goto err;
    127132    }
    128     order = EC_GROUP_get0_order(group);
     133
     134    if ((order = EC_GROUP_get0_order(group)) == NULL) {
     135        ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
     136        goto err;
     137    }
    129138
    130139    /* Preallocate space */
    … …  
    141150        do {
    142151            if (dgst != NULL) {
    143                 if (!BN_generate_dsa_nonce(k, order, priv_key,
    144                                            dgst, dlen, ctx)) {
     152                if (!ossl_bn_gen_dsa_nonce_fixed_top(k, order, priv_key,
     153                                                     dgst, dlen, ctx)) {
    145154                    ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED);
    146155                    goto err;
    147156                }
    148157            } else {
    149                 if (!BN_priv_rand_range_ex(k, order, 0, ctx)) {
     158                if (!ossl_bn_priv_rand_range_fixed_top(k, order, 0, ctx)) {
    150159                    ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED);
    151160                    goto err;
    152161                }
    153162            }
    154         } while (BN_is_zero(k));
     163        } while (ossl_bn_is_word_fixed_top(k, 0));
    155164
    156165        /* compute r the x-coordinate of generator * k */
    … …  
    251260    }
    252261
    253     order = EC_GROUP_get0_order(group);
     262    if ((order = EC_GROUP_get0_order(group)) == NULL) {
     263        ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
     264        goto err;
     265    }
     266
    254267    i = BN_num_bits(order);
    255268    /*

  • trunk/src/libs/openssl-3.1.7/crypto/encode_decode/encoder_lib.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    5757                       "at least one of the default or base providers "
    5858                       "available. Did you forget to load them?");
     59        return 0;
     60    }
     61
     62    if (ctx->cleanup == NULL || ctx->construct == NULL) {
     63        ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_INIT_FAIL);
    5964        return 0;
    6065    }

  • trunk/src/libs/openssl-3.1.7/crypto/engine/eng_pkey.c

    r104078 r105945  
    11/*
    2  * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    8181        return NULL;
    8282    }
    83     /* We enforce check for legacy key */
    84     switch (EVP_PKEY_get_id(pkey)) {
    85     case EVP_PKEY_RSA:
    86         {
    87         RSA *rsa = EVP_PKEY_get1_RSA(pkey);
    88         EVP_PKEY_set1_RSA(pkey, rsa);
    89         RSA_free(rsa);
    90         }
    91         break;
    92 #  ifndef OPENSSL_NO_EC
    93     case EVP_PKEY_SM2:
    94     case EVP_PKEY_EC:
    95         {
    96         EC_KEY *ec = EVP_PKEY_get1_EC_KEY(pkey);
    97         EVP_PKEY_set1_EC_KEY(pkey, ec);
    98         EC_KEY_free(ec);
    99         }
    100         break;
    101 #  endif
    102 #  ifndef OPENSSL_NO_DSA
    103     case EVP_PKEY_DSA:
    104         {
    105         DSA *dsa = EVP_PKEY_get1_DSA(pkey);
    106         EVP_PKEY_set1_DSA(pkey, dsa);
    107         DSA_free(dsa);
    108         }
    109         break;
    110 #endif
    111 #  ifndef OPENSSL_NO_DH
    112     case EVP_PKEY_DH:
    113         {
    114         DH *dh = EVP_PKEY_get1_DH(pkey);
    115         EVP_PKEY_set1_DH(pkey, dh);
    116         DH_free(dh);
    117         }
    118         break;
    119 #endif
    120     default:
    121         /*Do nothing */
    122         break;
    123     }
    124 
    12583    return pkey;
    12684}

  • trunk/src/libs/openssl-3.1.7/crypto/engine/eng_table.c

    r104078 r105945  
    11/*
    2  * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    216216        return NULL;
    217217    }
     218
     219    if (!CRYPTO_THREAD_write_lock(global_engine_lock))
     220        return NULL;
     221
    218222    ERR_set_mark();
    219     if (!CRYPTO_THREAD_write_lock(global_engine_lock))
    220         goto end;
    221223    /*
    222224     * Check again inside the lock otherwise we could race against cleanup

  • trunk/src/libs/openssl-3.1.7/crypto/err/openssl.ec

    r104078 r105945  
    7777R SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE   1113
    7878R SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE        1114
    79 R TLS1_AD_UNKNOWN_PSK_IDENTITY                  1115
     79R SSL_R_TLSV1_ALERT_UNKNOWN_PSK_IDENTITY        1115
    8080R SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED       1116
    81 R TLS1_AD_NO_APPLICATION_PROTOCOL               1120
     81R SSL_R_TLSV1_ALERT_NO_APPLICATION_PROTOCOL     1120

  • trunk/src/libs/openssl-3.1.7/crypto/ess/ess_lib.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    294294
    295295    if (require_signing_cert && ss == NULL && ssv2 == NULL) {
    296         ERR_raise(ERR_LIB_CMS, ESS_R_MISSING_SIGNING_CERTIFICATE_ATTRIBUTE);
     296        ERR_raise(ERR_LIB_ESS, ESS_R_MISSING_SIGNING_CERTIFICATE_ATTRIBUTE);
    297297        return -1;
    298298    }

  • trunk/src/libs/openssl-3.1.7/crypto/evp/ctrl_params_translate.c

    r104078 r105945  
    11/*
    2  * Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    27782778        int ret;
    27792779
    2780         tmpl.action_type = action_type;
     2780        ctx.action_type = tmpl.action_type = action_type;
    27812781        tmpl.keytype1 = tmpl.keytype2 = keytype;
    27822782        tmpl.optype = optype;
    … …  
    27872787            if (translation->fixup_args != NULL)
    27882788                fixup = translation->fixup_args;
    2789             ctx.action_type = translation->action_type;
    27902789            ctx.ctrl_cmd = translation->ctrl_num;
    27912790        }

  • trunk/src/libs/openssl-3.1.7/crypto/evp/digest.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    423423    /* Code below to be removed when legacy support is dropped. */
    424424 legacy:
    425     return ctx->update(ctx, data, count);
     425    return ctx->update != NULL ? ctx->update(ctx, data, count) : 0;
    426426}
    427427

  • trunk/src/libs/openssl-3.1.7/crypto/evp/keymgmt_lib.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    244244     * A comparison and sk_P_CACHE_ELEM_find() are avoided to not cause
    245245     * problems when we've only a read lock.
     246     * A keymgmt is a match if the |keymgmt| pointers are identical or if the
     247     * provider and the name ID match
    246248     */
    247249    for (i = 0; i < end; i++) {
    248250        p = sk_OP_CACHE_ELEM_value(pk->operation_cache, i);
    249         if (keymgmt == p->keymgmt && (p->selection & selection) == selection)
     251        if ((p->selection & selection) == selection
     252                && (keymgmt == p->keymgmt
     253                    || (keymgmt->name_id == p->keymgmt->name_id
     254                        && keymgmt->prov == p->keymgmt->prov)))
    250255            return p;
    251256    }

  • trunk/src/libs/openssl-3.1.7/crypto/evp/names.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    7979    OSSL_NAMEMAP *namemap;
    8080    int id;
     81    int do_retry = 1;
    8182
    8283    if (!OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS, NULL))
    … …  
    9596
    9697    namemap = ossl_namemap_stored(libctx);
     98 retry:
    9799    id = ossl_namemap_name2num(namemap, name);
    98     if (id == 0)
    99         return NULL;
     100    if (id == 0) {
     101        EVP_CIPHER *fetched_cipher;
     102
     103        /* Try to fetch it because the name might not be known yet. */
     104        if (!do_retry)
     105            return NULL;
     106        do_retry = 0;
     107        ERR_set_mark();
     108        fetched_cipher = EVP_CIPHER_fetch(libctx, name, NULL);
     109        EVP_CIPHER_free(fetched_cipher);
     110        ERR_pop_to_mark();
     111        goto retry;
     112    }
    100113
    101114    if (!ossl_namemap_doall_names(namemap, id, cipher_from_name, &cp))
    … …  
    125138    OSSL_NAMEMAP *namemap;
    126139    int id;
     140    int do_retry = 1;
    127141
    128142    if (!OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_DIGESTS, NULL))
    … …  
    141155
    142156    namemap = ossl_namemap_stored(libctx);
     157 retry:
    143158    id = ossl_namemap_name2num(namemap, name);
    144     if (id == 0)
    145         return NULL;
     159    if (id == 0) {
     160        EVP_MD *fetched_md;
     161
     162        /* Try to fetch it because the name might not be known yet. */
     163        if (!do_retry)
     164            return NULL;
     165        do_retry = 0;
     166        ERR_set_mark();
     167        fetched_md = EVP_MD_fetch(libctx, name, NULL);
     168        EVP_MD_free(fetched_md);
     169        ERR_pop_to_mark();
     170        goto retry;
     171    }
    146172
    147173    if (!ossl_namemap_doall_names(namemap, id, digest_from_name, &dp))

  • trunk/src/libs/openssl-3.1.7/crypto/evp/p_lib.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    19031903             * that export doesn't need to be redone.  In that case, we take
    19041904             * token copies of the cached pointers, to have token success
    1905              * values to return.
     1905             * values to return. It is possible (e.g. in a no-cached-fetch
     1906             * build), for op->keymgmt to be a different pointer to tmp_keymgmt
     1907             * even though the name/provider must be the same. In other words
     1908             * the keymgmt instance may be different but still equivalent, i.e.
     1909             * same algorithm/provider instance - but we make the simplifying
     1910             * assumption that the keydata can be used with either keymgmt
     1911             * instance. Not doing so introduces significant complexity and
     1912             * probably requires refactoring - since we would have to ripple
     1913             * the change in keymgmt instance up the call chain.
    19061914             */
    19071915            if (op != NULL && op->keymgmt != NULL) {

  • trunk/src/libs/openssl-3.1.7/crypto/evp/pmeth_lib.c

    r104078 r105945  
    11/*
    2  * Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    10291029}
    10301030
     1031static int evp_pkey_ctx_add1_octet_string(EVP_PKEY_CTX *ctx, int fallback,
     1032                                          const char *param, int op, int ctrl,
     1033                                          const unsigned char *data,
     1034                                          int datalen)
     1035{
     1036    OSSL_PARAM os_params[2];
     1037    const OSSL_PARAM *gettables;
     1038    unsigned char *info = NULL;
     1039    size_t info_len = 0;
     1040    size_t info_alloc = 0;
     1041    int ret = 0;
     1042
     1043    if (ctx == NULL || (ctx->operation & op) == 0) {
     1044        ERR_raise(ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED);
     1045        /* Uses the same return values as EVP_PKEY_CTX_ctrl */
     1046        return -2;
     1047    }
     1048
     1049    /* Code below to be removed when legacy support is dropped. */
     1050    if (fallback)
     1051        return EVP_PKEY_CTX_ctrl(ctx, -1, op, ctrl, datalen, (void *)(data));
     1052    /* end of legacy support */
     1053
     1054    if (datalen < 0) {
     1055        ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_LENGTH);
     1056        return 0;
     1057    } else if (datalen == 0) {
     1058        return 1;
     1059    }
     1060
     1061    /* Check for older provider that doesn't support getting this parameter */
     1062    gettables = EVP_PKEY_CTX_gettable_params(ctx);
     1063    if (gettables == NULL || OSSL_PARAM_locate_const(gettables, param) == NULL)
     1064        return evp_pkey_ctx_set1_octet_string(ctx, fallback, param, op, ctrl,
     1065                                              data, datalen);
     1066
     1067    /* Get the original value length */
     1068    os_params[0] = OSSL_PARAM_construct_octet_string(param, NULL, 0);
     1069    os_params[1] = OSSL_PARAM_construct_end();
     1070
     1071    if (!EVP_PKEY_CTX_get_params(ctx, os_params))
     1072        return 0;
     1073
     1074    /* This should not happen but check to be sure. */
     1075    if (os_params[0].return_size == OSSL_PARAM_UNMODIFIED)
     1076        return 0;
     1077
     1078    info_alloc = os_params[0].return_size + datalen;
     1079    if (info_alloc == 0)
     1080        return 0;
     1081    info = OPENSSL_zalloc(info_alloc);
     1082    if (info == NULL)
     1083        return 0;
     1084    info_len = os_params[0].return_size;
     1085
     1086    os_params[0] = OSSL_PARAM_construct_octet_string(param, info, info_alloc);
     1087
     1088    /* if we have data, then go get it */
     1089    if (info_len > 0) {
     1090        if (!EVP_PKEY_CTX_get_params(ctx, os_params))
     1091            goto error;
     1092    }
     1093
     1094    /* Copy the input data */
     1095    memcpy(&info[info_len], data, datalen);
     1096    ret = EVP_PKEY_CTX_set_params(ctx, os_params);
     1097
     1098 error:
     1099    OPENSSL_clear_free(info, info_alloc);
     1100    return ret;
     1101}
     1102
    10311103int EVP_PKEY_CTX_set1_tls1_prf_secret(EVP_PKEY_CTX *ctx,
    10321104                                      const unsigned char *sec, int seclen)
    … …  
    10791151                                      const unsigned char *info, int infolen)
    10801152{
    1081     return evp_pkey_ctx_set1_octet_string(ctx, ctx->op.kex.algctx == NULL,
     1153    return evp_pkey_ctx_add1_octet_string(ctx, ctx->op.kex.algctx == NULL,
    10821154                                          OSSL_KDF_PARAM_INFO,
    10831155                                          EVP_PKEY_OP_DERIVE,

  • trunk/src/libs/openssl-3.1.7/crypto/evp/signature.c

    r104078 r105945  
    11/*
    2  * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    404404
    405405    if (ctx == NULL) {
    406         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
    407         return -2;
     406        ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
     407        return -1;
    408408    }
    409409
    … …  
    635635
    636636    if (ctx == NULL) {
    637         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
    638         return -2;
     637        ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
     638        return -1;
    639639    }
    640640
    … …  
    647647        goto legacy;
    648648
     649    if (ctx->op.sig.signature->sign == NULL) {
     650        ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     651        return -2;
     652    }
     653
    649654    ret = ctx->op.sig.signature->sign(ctx->op.sig.algctx, sig, siglen,
    650655                                      (sig == NULL) ? 0 : *siglen, tbs, tbslen);
    … …  
    679684
    680685    if (ctx == NULL) {
    681         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
    682         return -2;
     686        ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
     687        return -1;
    683688    }
    684689
    … …  
    690695    if (ctx->op.sig.algctx == NULL)
    691696        goto legacy;
     697
     698    if (ctx->op.sig.signature->verify == NULL) {
     699        ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     700        return -2;
     701    }
    692702
    693703    ret = ctx->op.sig.signature->verify(ctx->op.sig.algctx, sig, siglen,
    … …  
    722732
    723733    if (ctx == NULL) {
    724         ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
    725         return -2;
     734        ERR_raise(ERR_LIB_EVP, ERR_R_PASSED_NULL_PARAMETER);
     735        return -1;
    726736    }
    727737
    … …  
    733743    if (ctx->op.sig.algctx == NULL)
    734744        goto legacy;
     745
     746    if (ctx->op.sig.signature->verify_recover == NULL) {
     747        ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     748        return -2;
     749    }
    735750
    736751    ret = ctx->op.sig.signature->verify_recover(ctx->op.sig.algctx, rout,

  • trunk/src/libs/openssl-3.1.7/crypto/init.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    9898DEFINE_RUN_ONCE_STATIC(ossl_init_register_atexit)
    9999{
    100 #ifdef OPENSSL_INIT_DEBUG
     100#ifndef OPENSSL_NO_ATEXIT
     101# ifdef OPENSSL_INIT_DEBUG
    101102    fprintf(stderr, "OPENSSL_INIT: ossl_init_register_atexit()\n");
    102 #endif
    103 #ifndef OPENSSL_SYS_UEFI
    104 # if defined(_WIN32) && !defined(__BORLANDC__)
     103# endif
     104# ifndef OPENSSL_SYS_UEFI
     105#  if defined(_WIN32) && !defined(__BORLANDC__)
    105106    /* We use _onexit() in preference because it gets called on DLL unload */
    106107    if (_onexit(win32atexit) == NULL)
    107108        return 0;
    108 # else
     109#  else
    109110    if (atexit(OPENSSL_cleanup) != 0)
    110111        return 0;
     112#  endif
    111113# endif
    112114#endif

  • trunk/src/libs/openssl-3.1.7/crypto/o_str.c

    r104078 r105945  
    11/*
    2  * Copyright 2003-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2003-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    230230    size_t len = has_sep ? buflen * 3 : 1 + buflen * 2;
    231231
     232    if (len == 0)
     233        ++len;
    232234    if (strlength != NULL)
    233235        *strlength = len;
    … …  
    235237        return 1;
    236238
    237     if (str_n < (unsigned long)len) {
     239    if (str_n < len) {
    238240        ERR_raise(ERR_LIB_CRYPTO, CRYPTO_R_TOO_SMALL_BUFFER);
    239241        return 0;
    … …  
    247249            *q++ = sep;
    248250    }
    249     if (has_sep)
     251    if (has_sep && buflen > 0)
    250252        --q;
    251253    *q = CH_ZERO;
    252254
    253255#ifdef CHARSET_EBCDIC
    254     ebcdic2ascii(str, str, q - str - 1);
     256    ebcdic2ascii(str, str, q - str);
    255257#endif
    256258    return 1;

  • trunk/src/libs/openssl-3.1.7/crypto/objects/obj_dat.c

    r104078 r105945  
    274274{
    275275    ASN1_OBJECT *o = NULL;
    276     ADDED_OBJ *ao[4] = { NULL, NULL, NULL, NULL }, *aop;
     276    ADDED_OBJ *ao[4] = { NULL, NULL, NULL, NULL }, *aop[4];
    277277    int i;
    278278
    … …  
    307307            ao[i]->type = i;
    308308            ao[i]->obj = o;
    309             aop = lh_ADDED_OBJ_insert(added, ao[i]);
    310             /* memory leak, but should not normally matter */
    311             OPENSSL_free(aop);
     309            aop[i] = lh_ADDED_OBJ_retrieve(added, ao[i]);
     310            if (aop[i] != NULL)
     311                aop[i]->type = -1;
     312            (void)lh_ADDED_OBJ_insert(added, ao[i]);
     313            if (lh_ADDED_OBJ_error(added)) {
     314                if (aop[i] != NULL)
     315                    aop[i]->type = i;
     316                while (i-- > ADDED_DATA) {
     317                    lh_ADDED_OBJ_delete(added, ao[i]);
     318                    if (aop[i] != NULL)
     319                        aop[i]->type = i;
     320                }
     321                ERR_raise(ERR_LIB_OBJ, ERR_R_CRYPTO_LIB);
     322                goto err;
     323            }
    312324        }
    313325    }

  • trunk/src/libs/openssl-3.1.7/crypto/pkcs12/p12_crt.c

    r104078 r105945  
    11/*
    2  * Copyright 1999-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    214214        goto err;
    215215    if (nid_key != -1) {
     216        /* This call does not take ownership of p8 */
    216217        bag = PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(nid_key, pass, -1, NULL, 0,
    217218                                                     iter, p8, ctx, propq);
     219    } else {
     220        bag = PKCS12_SAFEBAG_create0_p8inf(p8);
     221        if (bag != NULL)
     222           p8 = NULL; /* bag takes ownership of p8 */
     223    }
     224    /* This does not need to be in the error path */
     225    if (p8 != NULL)
    218226        PKCS8_PRIV_KEY_INFO_free(p8);
    219     } else
    220         bag = PKCS12_SAFEBAG_create0_p8inf(p8);
    221 
    222     if (!bag)
    223         goto err;
    224 
    225     if (!pkcs12_add_bag(pbags, bag))
     227
     228    if (bag == NULL || !pkcs12_add_bag(pbags, bag))
    226229        goto err;
    227230

  • trunk/src/libs/openssl-3.1.7/crypto/pkcs7/pk7_doit.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    12401240{
    12411241    X509_ATTRIBUTE *attr = NULL;
     1242    int i, n;
    12421243
    12431244    if (*sk == NULL) {
    12441245        if ((*sk = sk_X509_ATTRIBUTE_new_null()) == NULL)
    12451246            return 0;
    1246  new_attrib:
    1247         if ((attr = X509_ATTRIBUTE_create(nid, atrtype, value)) == NULL)
    1248             return 0;
    1249         if (!sk_X509_ATTRIBUTE_push(*sk, attr)) {
    1250             X509_ATTRIBUTE_free(attr);
    1251             return 0;
    1252         }
    1253     } else {
    1254         int i;
    1255 
    1256         for (i = 0; i < sk_X509_ATTRIBUTE_num(*sk); i++) {
    1257             attr = sk_X509_ATTRIBUTE_value(*sk, i);
    1258             if (OBJ_obj2nid(X509_ATTRIBUTE_get0_object(attr)) == nid) {
    1259                 X509_ATTRIBUTE_free(attr);
    1260                 attr = X509_ATTRIBUTE_create(nid, atrtype, value);
    1261                 if (attr == NULL)
    1262                     return 0;
    1263                 if (!sk_X509_ATTRIBUTE_set(*sk, i, attr)) {
    1264                     X509_ATTRIBUTE_free(attr);
    1265                     return 0;
    1266                 }
    1267                 goto end;
    1268             }
    1269         }
    1270         goto new_attrib;
    1271     }
     1247    }
     1248    n = sk_X509_ATTRIBUTE_num(*sk);
     1249    for (i = 0; i < n; i++) {
     1250        attr = sk_X509_ATTRIBUTE_value(*sk, i);
     1251        if (OBJ_obj2nid(X509_ATTRIBUTE_get0_object(attr)) == nid)
     1252            goto end;
     1253    }
     1254    if (!sk_X509_ATTRIBUTE_push(*sk, NULL))
     1255        return 0;
     1256
    12721257 end:
     1258    attr = X509_ATTRIBUTE_create(nid, atrtype, value);
     1259    if (attr == NULL) {
     1260        if (i == n)
     1261            sk_X509_ATTRIBUTE_pop(*sk);
     1262        return 0;
     1263    }
     1264    X509_ATTRIBUTE_free(sk_X509_ATTRIBUTE_value(*sk, i));
     1265    (void) sk_X509_ATTRIBUTE_set(*sk, i, attr);
    12731266    return 1;
    12741267}

  • trunk/src/libs/openssl-3.1.7/crypto/property/property.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 * Copyright (c) 2019, Oracle and/or its affiliates.  All rights reserved.
    44 *
    … …  
    9797DEFINE_SPARSE_ARRAY_OF(ALGORITHM);
    9898
     99DEFINE_STACK_OF(ALGORITHM)
     100
    99101typedef struct ossl_global_properties_st {
    100102    OSSL_PROPERTY_LIST *list;
    … …  
    462464}
    463465
    464 struct alg_do_each_data_st {
    465     void (*fn)(int id, void *method, void *fnarg);
    466     void *fnarg;
    467 };
    468 
    469 static void alg_do_each(ossl_uintmax_t idx, ALGORITHM *alg, void *arg)
    470 {
    471     struct alg_do_each_data_st *data = arg;
    472     int i, end = sk_IMPLEMENTATION_num(alg->impls);
    473 
    474     for (i = 0; i < end; i++) {
    475         IMPLEMENTATION *impl = sk_IMPLEMENTATION_value(alg->impls, i);
    476 
    477         alg_do_one(alg, impl, data->fn, data->fnarg);
    478     }
     466static void alg_copy(ossl_uintmax_t idx, ALGORITHM *alg, void *arg)
     467{
     468    STACK_OF(ALGORITHM) *newalg = arg;
     469
     470    (void)sk_ALGORITHM_push(newalg, alg);
    479471}
    480472
    … …  
    483475                              void *fnarg)
    484476{
    485     struct alg_do_each_data_st data;
    486 
    487     data.fn = fn;
    488     data.fnarg = fnarg;
    489     if (store != NULL)
    490         ossl_sa_ALGORITHM_doall_arg(store->algs, alg_do_each, &data);
     477    int i, j;
     478    int numalgs, numimps;
     479    STACK_OF(ALGORITHM) *tmpalgs;
     480    ALGORITHM *alg;
     481
     482    if (store != NULL) {
     483
     484        if (!ossl_property_read_lock(store))
     485            return;
     486       
     487        tmpalgs = sk_ALGORITHM_new_reserve(NULL,
     488                                           ossl_sa_ALGORITHM_num(store->algs));
     489        if (tmpalgs == NULL) {
     490            ossl_property_unlock(store);
     491            return;
     492        }
     493
     494        ossl_sa_ALGORITHM_doall_arg(store->algs, alg_copy, tmpalgs);
     495        ossl_property_unlock(store);
     496        numalgs = sk_ALGORITHM_num(tmpalgs);
     497        for (i = 0; i < numalgs; i++) {
     498            alg = sk_ALGORITHM_value(tmpalgs, i);
     499            numimps = sk_IMPLEMENTATION_num(alg->impls);
     500            for (j = 0; j < numimps; j++)
     501                alg_do_one(alg, sk_IMPLEMENTATION_value(alg->impls, j), fn, fnarg);
     502        }
     503        sk_ALGORITHM_free(tmpalgs);
     504    }
    491505}
    492506
    … …  
    644658{
    645659    IMPL_CACHE_FLUSH *state = (IMPL_CACHE_FLUSH *)v;
     660    unsigned long orig_down_load = lh_QUERY_get_down_load(alg->cache);
    646661
    647662    state->cache = alg->cache;
     663    lh_QUERY_set_down_load(alg->cache, 0);
    648664    lh_QUERY_doall_IMPL_CACHE_FLUSH(state->cache, &impl_cache_flush_cache,
    649665                                    state);
     666    lh_QUERY_set_down_load(alg->cache, orig_down_load);
    650667}
    651668

  • trunk/src/libs/openssl-3.1.7/crypto/property/property_parse.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 * Copyright (c) 2019, Oracle and/or its affiliates.  All rights reserved.
    44 *
    … …  
    1515#include "internal/propertyerr.h"
    1616#include "internal/property.h"
     17#include "internal/numbers.h"
    1718#include "crypto/ctype.h"
    1819#include "internal/nelem.h"

  • trunk/src/libs/openssl-3.1.7/crypto/provider_core.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    560560
    561561    /* provider_new() generates an error, so no need here */
    562     if ((prov = provider_new(name, template.init, template.parameters)) == NULL)
     562    prov = provider_new(name, template.init, template.parameters);
     563
     564    if (prov == NULL)
    563565        return NULL;
     566
     567    if (!ossl_provider_set_module_path(prov, template.path)) {
     568        ossl_provider_free(prov);
     569        return NULL;
     570    }
    564571
    565572    prov->libctx = libctx;

  • trunk/src/libs/openssl-3.1.7/crypto/rand/randfile.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    1717#endif
    1818
     19#include "internal/e_os.h"
    1920#include "internal/cryptlib.h"
    2021
    … …  
    213214         */
    214215        int fd = open(file, O_WRONLY | O_CREAT | O_BINARY, 0600);
    215         if (fd != -1)
     216
     217        if (fd != -1) {
    216218            out = fdopen(fd, "wb");
     219            if (out == NULL) {
     220                close(fd);
     221                ERR_raise_data(ERR_LIB_RAND, RAND_R_CANNOT_OPEN_FILE,
     222                               "Filename=%s", file);
     223                return -1;
     224            }
     225        }
    217226    }
    218227#endif

  • trunk/src/libs/openssl-3.1.7/crypto/rsa/rsa_oaep.c

    r104078 r105945  
    11/*
    2  * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    187187    mdlen = EVP_MD_get_size(md);
    188188
    189     if (tlen <= 0 || flen <= 0)
     189    if (tlen <= 0 || flen <= 0 || mdlen <= 0)
    190190        return -1;
    191191    /*

  • trunk/src/libs/openssl-3.1.7/crypto/sha/build.info

    r104078 r105945  
    8989# the static libcrypto.a has, and doesn't need it added again.
    9090IF[{- !$disabled{module} && !$disabled{shared} -}]
    91   DEFINE[../providers/liblegacy.a]=$SHA1DEF $KECCAK1600DEF
     91  DEFINE[../../providers/liblegacy.a]=$SHA1DEF $KECCAK1600DEF
    9292ENDIF
    9393

  • trunk/src/libs/openssl-3.1.7/crypto/sm2/sm2_crypt.c

    r104078 r105945  
    11/*
    2  * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 * Copyright 2017 Ribose Inc. All Rights Reserved.
    44 * Ported from Ribose contributions from Botan.
    … …  
    6666
    6767    return field_size;
     68}
     69
     70static int is_all_zeros(const unsigned char *msg, size_t msglen)
     71{
     72    unsigned char re = 0;
     73    size_t i;
     74
     75    for (i = 0; i < msglen; i++) {
     76        re |= msg[i];
     77    }
     78
     79    return re == 0 ? 1 : 0;
    6880}
    6981
    … …  
    180192    memset(ciphertext_buf, 0, *ciphertext_len);
    181193
     194    msg_mask = OPENSSL_zalloc(msg_len);
     195    if (msg_mask == NULL) {
     196       ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
     197       goto done;
     198    }
     199
     200again:
    182201    if (!BN_priv_rand_range_ex(k, order, 0, ctx)) {
    183202        ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);
    … …  
    199218    }
    200219
    201     msg_mask = OPENSSL_zalloc(msg_len);
    202     if (msg_mask == NULL) {
    203        ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
    204        goto done;
    205    }
    206 
    207220    /* X9.63 with no salt happens to match the KDF used in SM2 */
    208221    if (!ossl_ecdh_kdf_X9_63(msg_mask, msg_len, x2y2, 2 * field_size, NULL, 0,
    … …  
    210223        ERR_raise(ERR_LIB_SM2, ERR_R_EVP_LIB);
    211224        goto done;
     225    }
     226
     227    if (is_all_zeros(msg_mask, msg_len)) {
     228        memset(x2y2, 0, 2 * field_size);
     229        goto again;
    212230    }
    213231
    … …  
    365383    }
    366384
     385    if (is_all_zeros(msg_mask, msg_len)) {
     386        ERR_raise(ERR_LIB_SM2, SM2_R_INVALID_ENCODING);
     387        goto done;
     388    }
     389
    367390    for (i = 0; i != msg_len; ++i)
    368391        ptext_buf[i] = C2[i] ^ msg_mask[i];

  • trunk/src/libs/openssl-3.1.7/crypto/sm2/sm2_sign.c

    r104078 r105945  
    11/*
    2  * Copyright 2017-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 * Copyright 2017 Ribose Inc. All Rights Reserved.
    44 * Ported from Ribose contributions from Botan.
    … …  
    2929    int rc = 0;
    3030    const EC_GROUP *group = EC_KEY_get0_group(key);
     31    const EC_POINT *pubkey = EC_KEY_get0_public_key(key);
    3132    BN_CTX *ctx = NULL;
    3233    EVP_MD_CTX *hash = NULL;
    … …  
    4344    uint8_t e_byte = 0;
    4445
     46    /* SM2 Signatures require a public key, check for it */
     47    if (pubkey == NULL) {
     48        ERR_raise(ERR_LIB_SM2, ERR_R_PASSED_NULL_PARAMETER);
     49        goto done;
     50    }
     51
    4552    hash = EVP_MD_CTX_new();
    4653    ctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(key));
    … …  
    118125            || !EVP_DigestUpdate(hash, buf, p_bytes)
    119126            || !EC_POINT_get_affine_coordinates(group,
    120                                                 EC_KEY_get0_public_key(key),
     127                                                pubkey,
    121128                                                xA, yA, ctx)
    122129            || BN_bn2binpad(xA, buf, p_bytes) < 0
    … …  
    442449    int ret = -1;
    443450
     451    if (sig == NULL) {
     452        ERR_raise(ERR_LIB_SM2, ERR_R_PASSED_NULL_PARAMETER);
     453        goto done;
     454    }
     455
    444456    e = BN_bin2bn(dgst, dgstlen, NULL);
    445457    if (e == NULL) {
    … …  
    454466    }
    455467
    456     sigleni = i2d_ECDSA_SIG(s, sig != NULL ? &sig : NULL);
     468    sigleni = i2d_ECDSA_SIG(s, &sig);
    457469    if (sigleni < 0) {
    458470       ERR_raise(ERR_LIB_SM2, ERR_R_INTERNAL_ERROR);

  • trunk/src/libs/openssl-3.1.7/crypto/sm4/build.info

    r104078 r105945  
    2626# added again.
    2727IF[{- !$disabled{module} && !$disabled{shared} -}]
    28   DEFINE[../providers/liblegacy.a]=$SM4DEF
     28  DEFINE[../../providers/liblegacy.a]=$SM4DEF
    2929ENDIF
    3030

  • trunk/src/libs/openssl-3.1.7/crypto/x509/v3_addr.c

    r104078 r105945  
    398398{
    399399    int bytelen = (prefixlen + 7) / 8, bitlen = prefixlen % 8;
    400     IPAddressOrRange *aor = IPAddressOrRange_new();
     400    IPAddressOrRange *aor;
    401401
    402402    if (prefixlen < 0 || prefixlen > (afilen * 8))
    403403        return 0;
    404     if (aor == NULL)
     404    if ((aor = IPAddressOrRange_new()) == NULL)
    405405        return 0;
    406406    aor->type = IPAddressOrRange_addressPrefix;

  • trunk/src/libs/openssl-3.1.7/crypto/x509/v3_utl.c

    r104078 r105945  
    11/*
    2  * Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    917917
    918918            gen = sk_GENERAL_NAME_value(gens, i);
    919             if ((gen->type == GEN_OTHERNAME) && (check_type == GEN_EMAIL)) {
    920                 if (OBJ_obj2nid(gen->d.otherName->type_id) ==
    921                     NID_id_on_SmtpUTF8Mailbox) {
    922                     san_present = 1;
    923 
    924                     /*
    925                      * If it is not a UTF8String then that is unexpected and we
    926                      * treat it as no match
     919            switch (gen->type) {
     920            default:
     921                continue;
     922            case GEN_OTHERNAME:
     923                switch (OBJ_obj2nid(gen->d.otherName->type_id)) {
     924                default:
     925                    continue;
     926                case NID_id_on_SmtpUTF8Mailbox:
     927                    /*-
     928                     * https://datatracker.ietf.org/doc/html/rfc8398#section-3
     929                     *
     930                     *   Due to name constraint compatibility reasons described
     931                     *   in Section 6, SmtpUTF8Mailbox subjectAltName MUST NOT
     932                     *   be used unless the local-part of the email address
     933                     *   contains non-ASCII characters. When the local-part is
     934                     *   ASCII, rfc822Name subjectAltName MUST be used instead
     935                     *   of SmtpUTF8Mailbox. This is compatible with legacy
     936                     *   software that supports only rfc822Name (and not
     937                     *   SmtpUTF8Mailbox). [...]
     938                     *
     939                     *   SmtpUTF8Mailbox is encoded as UTF8String.
     940                     *
     941                     * If it is not a UTF8String then that is unexpected, and
     942                     * we ignore the invalid SAN (neither set san_present nor
     943                     * consider it a candidate for equality).  This does mean
     944                     * that the subject CN may be considered, as would be the
     945                     * case when the malformed SmtpUtf8Mailbox SAN is instead
     946                     * simply absent.
     947                     *
     948                     * When CN-ID matching is not desirable, applications can
     949                     * choose to turn it off, doing so is at this time a best
     950                     * practice.
    927951                     */
    928                     if (gen->d.otherName->value->type == V_ASN1_UTF8STRING) {
    929                         cstr = gen->d.otherName->value->value.utf8string;
    930 
    931                         /* Positive on success, negative on error! */
    932                         if ((rv = do_check_string(cstr, 0, equal, flags,
    933                                                 chk, chklen, peername)) != 0)
    934                             break;
    935                     }
    936                 } else
     952                    if (check_type != GEN_EMAIL
     953                        || gen->d.otherName->value->type != V_ASN1_UTF8STRING)
     954                        continue;
     955                    alt_type = 0;
     956                    cstr = gen->d.otherName->value->value.utf8string;
     957                    break;
     958                }
     959                break;
     960            case GEN_EMAIL:
     961                if (check_type != GEN_EMAIL)
    937962                    continue;
    938             } else {
    939                 if ((gen->type != check_type) && (gen->type != GEN_OTHERNAME))
     963                cstr = gen->d.rfc822Name;
     964                break;
     965            case GEN_DNS:
     966                if (check_type != GEN_DNS)
    940967                    continue;
     968                cstr = gen->d.dNSName;
     969                break;
     970            case GEN_IPADD:
     971                if (check_type != GEN_IPADD)
     972                    continue;
     973                cstr = gen->d.iPAddress;
     974                break;
    941975            }
    942976            san_present = 1;
    943             if (check_type == GEN_EMAIL)
    944                 cstr = gen->d.rfc822Name;
    945             else if (check_type == GEN_DNS)
    946                 cstr = gen->d.dNSName;
    947             else
    948                 cstr = gen->d.iPAddress;
    949977            /* Positive on success, negative on error! */
    950978            if ((rv = do_check_string(cstr, alt_type, equal, flags,

  • trunk/src/libs/openssl-3.1.7/crypto/x509/x_name.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    477477        ltmp = ASN1_item_ex_i2d(&v, in,
    478478                                ASN1_ITEM_rptr(X509_NAME_ENTRIES), -1, -1);
    479         if (ltmp < 0)
    480             return ltmp;
     479        if (ltmp < 0 || len > INT_MAX - ltmp)
     480            return -1;
    481481        len += ltmp;
    482482    }

  • trunk/src/libs/openssl-3.1.7/test/bad_dtls_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    505505            || !TEST_true(SSL_set_session(con, sess)))
    506506        goto end;
    507     SSL_SESSION_free(sess);
    508507
    509508    rbio = BIO_new(BIO_s_mem());
    … …  
    593592
    594593 end:
     594    SSL_SESSION_free(sess);
    595595    BIO_free(rbio);
    596596    BIO_free(wbio);

  • trunk/src/libs/openssl-3.1.7/test/build.info

    r104078 r105945  
    4141          evp_pkey_provided_test evp_test evp_extra_test evp_extra_test2 \
    4242          evp_fetch_prov_test evp_libctx_test ossl_store_test \
    43           v3nametest v3ext punycode_test \
     43          v3nametest v3ext punycode_test evp_byname_test \
    4444          crltest danetest bad_dtls_test lhash_test sparse_array_test \
    4545          conf_include_test params_api_test params_conversion_test \
    … …  
    306306  DEPEND[punycode_test]=../libcrypto.a libtestutil.a
    307307
     308  SOURCE[evp_byname_test]=evp_byname_test.c
     309  INCLUDE[evp_byname_test]=../include ../apps/include
     310  DEPEND[evp_byname_test]=../libcrypto libtestutil.a
     311
    308312  SOURCE[stack_test]=stack_test.c
    309313  INCLUDE[stack_test]=../include ../apps/include
    … …  
    875879  IF[{- $disabled{module} || !$target{dso_scheme} -}]
    876880    DEFINE[provider_test]=NO_PROVIDER_MODULE
     881    DEFINE[prov_config_test]=NO_PROVIDER_MODULE
    877882    DEFINE[provider_internal_test]=NO_PROVIDER_MODULE
    878883  ENDIF

  • trunk/src/libs/openssl-3.1.7/test/cmp_hdr_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2007-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 * Copyright Nokia 2007-2019
    44 * Copyright Siemens AG 2015-2019
    … …  
    7272static int execute_HDR_get0_senderNonce_test(CMP_HDR_TEST_FIXTURE *fixture)
    7373{
     74    int res = 0;
    7475    X509_NAME *sender = X509_NAME_new();
    7576    ASN1_OCTET_STRING *sn;
    7677
    7778    if (!TEST_ptr(sender))
    78         return 0;
     79        goto err;
    7980
    8081    X509_NAME_ADD(sender, "CN", "A common sender name");
    8182    if (!TEST_int_eq(OSSL_CMP_CTX_set1_subjectName(fixture->cmp_ctx, sender),
    8283                     1))
    83         return 0;
     84        goto err;
    8485    if (!TEST_int_eq(ossl_cmp_hdr_init(fixture->cmp_ctx, fixture->hdr),
    8586                     1))
    86         return 0;
     87        goto err;
    8788    sn = ossl_cmp_hdr_get0_senderNonce(fixture->hdr);
    8889    if (!TEST_int_eq(ASN1_OCTET_STRING_cmp(fixture->cmp_ctx->senderNonce, sn),
    8990                     0))
    90         return 0;
     91        goto err;
     92
     93    res = 1;
     94err:
    9195    X509_NAME_free(sender);
    92     return 1;
     96
     97    return res;
    9398}
    9499
    … …  
    103108static int execute_HDR_set1_sender_test(CMP_HDR_TEST_FIXTURE *fixture)
    104109{
     110    int res = 0;
    105111    X509_NAME *x509name = X509_NAME_new();
    106112
    107113    if (!TEST_ptr(x509name))
    108         return 0;
     114        goto err;
    109115
    110116    X509_NAME_ADD(x509name, "CN", "A common sender name");
    111117    if (!TEST_int_eq(ossl_cmp_hdr_set1_sender(fixture->hdr, x509name), 1))
    112         return 0;
     118        goto err;
     119
    113120    if (!TEST_int_eq(fixture->hdr->sender->type, GEN_DIRNAME))
    114         return 0;
     121        goto err;
    115122
    116123    if (!TEST_int_eq(X509_NAME_cmp(fixture->hdr->sender->d.directoryName,
    117124                                   x509name), 0))
    118         return 0;
    119 
     125        goto err;
     126
     127    res = 1;
     128err:
    120129    X509_NAME_free(x509name);
    121     return 1;
     130
     131    return res;
    122132}
    123133
    … …  
    132142static int execute_HDR_set1_recipient_test(CMP_HDR_TEST_FIXTURE *fixture)
    133143{
     144    int res = 0;
    134145    X509_NAME *x509name = X509_NAME_new();
    135146
    136147    if (!TEST_ptr(x509name))
    137         return 0;
     148        goto err;
    138149
    139150    X509_NAME_ADD(x509name, "CN", "A common recipient name");
    140151    if (!TEST_int_eq(ossl_cmp_hdr_set1_recipient(fixture->hdr, x509name), 1))
    141         return 0;
     152        goto err;
    142153
    143154    if (!TEST_int_eq(fixture->hdr->recipient->type, GEN_DIRNAME))
    144         return 0;
     155        goto err;
    145156
    146157    if (!TEST_int_eq(X509_NAME_cmp(fixture->hdr->recipient->d.directoryName,
    147158                                   x509name), 0))
    148         return 0;
    149 
     159        goto err;
     160
     161    res = 1;
     162err:
    150163    X509_NAME_free(x509name);
    151     return 1;
     164
     165    return res;
    152166}
    153167
    … …  
    204218
    205219    if (!TEST_ptr(senderKID))
    206         return 0;
     220        goto err;
    207221
    208222    if (!TEST_int_eq(ASN1_OCTET_STRING_set(senderKID, rand_data,
    … …  
    266280
    267281    if (!TEST_ptr(text))
    268         return 0;
     282        goto err;
    269283
    270284    if (!ASN1_STRING_set(text, "A free text", -1))
    … …  
    281295 err:
    282296    ASN1_UTF8STRING_free(text);
     297
    283298    return res;
    284299}

  • trunk/src/libs/openssl-3.1.7/test/crltest.c

    r104078 r105945  
    11/*
    2  * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    102102};
    103103
     104static const char *kInvalidCRL[] = {
     105    "-----BEGIN X509 CRL-----\n",
     106    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n",
     107    "-----END X509 CRL-----\n",
     108    NULL
     109};
     110
    104111static const char *kBadIssuerCRL[] = {
    105112    "-----BEGIN X509 CRL-----\n",
    … …  
    372379}
    373380
    374 static int test_reuse_crl(void)
    375 {
    376     X509_CRL *reused_crl = CRL_from_strings(kBasicCRL);
    377     char *p;
    378     BIO *b = glue2bio(kRevokedCRL, &p);
    379 
    380     if (b == NULL) {
    381         OPENSSL_free(p);
    382         X509_CRL_free(reused_crl);
    383         return 0;
     381static int test_reuse_crl(int idx)
     382{
     383    X509_CRL *result, *reused_crl = CRL_from_strings(kBasicCRL);
     384    X509_CRL *addref_crl = NULL;
     385    char *p = NULL;
     386    BIO *b = NULL;
     387    int r = 0;
     388
     389    if (!TEST_ptr(reused_crl))
     390        goto err;
     391
     392    if (idx & 1) {
     393        if (!TEST_true(X509_CRL_up_ref(reused_crl)))
     394            goto err;
     395        addref_crl = reused_crl;
    384396    }
    385397
    386     reused_crl = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL);
    387 
     398    idx >>= 1;
     399    b = glue2bio(idx == 2 ? kRevokedCRL : kInvalidCRL + idx, &p);
     400
     401    if (!TEST_ptr(b))
     402        goto err;
     403
     404    result = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL);
     405
     406    switch (idx) {
     407    case 0: /* valid PEM + invalid DER */
     408        if (!TEST_ptr_null(result)
     409                || !TEST_ptr_null(reused_crl))
     410            goto err;
     411        break;
     412    case 1: /* invalid PEM */
     413        if (!TEST_ptr_null(result)
     414                || !TEST_ptr(reused_crl))
     415            goto err;
     416        break;
     417    case 2:
     418        if (!TEST_ptr(result)
     419                || !TEST_ptr(reused_crl)
     420                || !TEST_ptr_eq(result, reused_crl))
     421            goto err;
     422        break;
     423    }
     424
     425    r = 1;
     426
     427 err:
    388428    OPENSSL_free(p);
    389429    BIO_free(b);
    390430    X509_CRL_free(reused_crl);
    391     return 1;
     431    X509_CRL_free(addref_crl);
     432    return r;
    392433}
    393434
    … …  
    403444    ADD_TEST(test_known_critical_crl);
    404445    ADD_ALL_TESTS(test_unknown_critical_crl, OSSL_NELEM(unknown_critical_crls));
    405     ADD_TEST(test_reuse_crl);
     446    ADD_ALL_TESTS(test_reuse_crl, 6);
    406447    return 1;
    407448}

  • trunk/src/libs/openssl-3.1.7/test/ct_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    451451    fixture->sct_list = sk_SCT_new_null();
    452452    if (fixture->sct_list == NULL)
    453             return 0;
     453    {
     454        tear_down(fixture);
     455        return 0;
     456    }
    454457
    455458    if (!TEST_ptr(sct = SCT_new_from_base64(SCT_VERSION_V1, log_id,
    456459                                            CT_LOG_ENTRY_TYPE_X509, timestamp,
    457460                                            extensions, signature)))
    458 
     461    {
     462        tear_down(fixture);
    459463        return 0;
     464    }
    460465
    461466    sk_SCT_push(fixture->sct_list, sct);

  • trunk/src/libs/openssl-3.1.7/test/dsatest.c

    r104078 r105945  
    11/*
    2  * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    333333    BIGNUM *badq = NULL, *badpriv = NULL;
    334334    const unsigned char msg[] = { 0x00 };
     335    unsigned int signature_len0;
    335336    unsigned int signature_len;
    336337    unsigned char signature[64];
    … …  
    376377
    377378    /* Test passing signature as NULL */
    378     if (!TEST_true(DSA_sign(0, msg, sizeof(msg), NULL, &signature_len, dsa)))
    379         goto err;
    380 
    381     if (!TEST_true(DSA_sign(0, msg, sizeof(msg), signature, &signature_len, dsa)))
     379    if (!TEST_true(DSA_sign(0, msg, sizeof(msg), NULL, &signature_len0, dsa))
     380        || !TEST_int_gt(signature_len0, 0))
     381        goto err;
     382
     383    if (!TEST_true(DSA_sign(0, msg, sizeof(msg), signature, &signature_len, dsa))
     384        || !TEST_int_gt(signature_len, 0)
     385        || !TEST_int_le(signature_len, signature_len0))
    382386        goto err;
    383387

  • trunk/src/libs/openssl-3.1.7/test/ecdsatest.c

    r104078 r105945  
    11/*
    2  * Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2002-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
    44 *
    … …  
    351351{
    352352    int ret;
     353    unsigned int siglen0;
    353354    unsigned int siglen;
    354355    unsigned char dgst[128] = { 0 };
    355356    EC_KEY *eckey = NULL;
     357    unsigned char *sig = NULL;
     358    BIGNUM *kinv = NULL, *rp = NULL;
    356359
    357360    ret = TEST_ptr(eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1))
    358361          && TEST_int_eq(EC_KEY_generate_key(eckey), 1)
    359           && TEST_int_eq(ECDSA_sign(0, dgst, sizeof(dgst), NULL, &siglen, eckey), 1)
    360           && TEST_int_gt(siglen, 0);
     362          && TEST_int_eq(ECDSA_sign(0, dgst, sizeof(dgst), NULL, &siglen0,
     363                                    eckey), 1)
     364          && TEST_int_gt(siglen0, 0)
     365          && TEST_ptr(sig = OPENSSL_malloc(siglen0))
     366          && TEST_int_eq(ECDSA_sign(0, dgst, sizeof(dgst), sig, &siglen,
     367                                    eckey), 1)
     368          && TEST_int_gt(siglen, 0)
     369          && TEST_int_le(siglen, siglen0)
     370          && TEST_int_eq(ECDSA_verify(0, dgst, sizeof(dgst), sig, siglen,
     371                                      eckey), 1)
     372          && TEST_int_eq(ECDSA_sign_setup(eckey, NULL, &kinv, &rp), 1)
     373          && TEST_int_eq(ECDSA_sign_ex(0, dgst, sizeof(dgst), NULL, &siglen,
     374                                       kinv, rp, eckey), 1)
     375          && TEST_int_gt(siglen, 0)
     376          && TEST_int_le(siglen, siglen0)
     377          && TEST_int_eq(ECDSA_sign_ex(0, dgst, sizeof(dgst), sig, &siglen0,
     378                                       kinv, rp, eckey), 1)
     379          && TEST_int_eq(siglen, siglen0)
     380          && TEST_int_eq(ECDSA_verify(0, dgst, sizeof(dgst), sig, siglen,
     381                                      eckey), 1);
    361382    EC_KEY_free(eckey);
     383    OPENSSL_free(sig);
     384    BN_free(kinv);
     385    BN_free(rp);
    362386    return ret;
    363387}

  • trunk/src/libs/openssl-3.1.7/test/ecstresstest.c

    r104078 r105945  
    11/*
    2  * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License");
    … …  
    8080                                              group))
    8181            || !TEST_ptr(result = walk_curve(group, point, num_repeats)))
    82         return 0;
     82        goto err;
    8383
    8484    if (print_mode) {

  • trunk/src/libs/openssl-3.1.7/test/endecode_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    10331033IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitTri2G, "EC")
    10341034# endif
     1035# ifndef OPENSSL_NO_SM2
     1036KEYS(SM2);
     1037IMPLEMENT_TEST_SUITE(SM2, "SM2", 0)
     1038# endif
    10351039KEYS(ED25519);
    10361040IMPLEMENT_TEST_SUITE(ED25519, "ED25519", 1)
    … …  
    13381342
    13391343    /* FIPS(3.0.0): provider imports explicit params but they won't work #17998 */
    1340     is_fips_3_0_0 = fips_provider_version_eq(testctx, 3, 0, 0);
    1341     if (is_fips_3_0_0 < 0)
    1342         return 0;
     1344    is_fips_3_0_0 = is_fips && fips_provider_version_eq(testctx, 3, 0, 0);
    13431345
    13441346#ifdef STATIC_LEGACY
    … …  
    13981400    MAKE_DOMAIN_KEYS(ECExplicitTri2G, "EC", ec_explicit_tri_params_explicit);
    13991401# endif
     1402# ifndef OPENSSL_NO_SM2
     1403    MAKE_KEYS(SM2, "SM2", NULL);
     1404# endif
    14001405    MAKE_KEYS(ED25519, "ED25519", NULL);
    14011406    MAKE_KEYS(ED448, "ED448", NULL);
    … …  
    14441449        ADD_TEST_SUITE_LEGACY(ECExplicitTri2G);
    14451450# endif
     1451# ifndef OPENSSL_NO_SM2
     1452        if (!is_fips_3_0_0) {
     1453            /* 3.0.0 FIPS provider imports explicit EC params and then fails. */
     1454            ADD_TEST_SUITE(SM2);
     1455        }
     1456# endif
    14461457        ADD_TEST_SUITE(ED25519);
    14471458        ADD_TEST_SUITE(ED448);
    … …  
    15011512    FREE_DOMAIN_KEYS(ECExplicitTri2G);
    15021513# endif
     1514# ifndef OPENSSL_NO_SM2
     1515    FREE_KEYS(SM2);
     1516# endif
    15031517    FREE_KEYS(ED25519);
    15041518    FREE_KEYS(ED448);

  • trunk/src/libs/openssl-3.1.7/test/evp_extra_test.c

    r104078 r105945  
    11011101    eckey = NULL;
    11021102
    1103     while (dup_pk == NULL) {
     1103    for (;;) {
    11041104        ret = 0;
    11051105        ctx = EVP_MD_CTX_new();
    … …  
    11171117        ctx = NULL;
    11181118
     1119        if (dup_pk != NULL)
     1120            break;
     1121
    11191122        if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pkey)))
    11201123            goto err;
    … …  
    11261129            goto err;
    11271130    }
     1131    ret = 1;
    11281132
    11291133 err:
    … …  
    25552559        0x68, 0x81, 0xa5, 0x3e, 0x5b, 0x9c, 0x7b, 0x6f, 0x2e, 0xec, 0xc8, 0x47,
    25562560        0x7c, 0xfa, 0x47, 0x35, 0x66, 0x82, 0x15, 0x30
     2561    };
     2562    size_t expectedlen = sizeof(expected);
     2563
     2564    if (!TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(testctx, "HKDF", testpropq)))
     2565        goto done;
     2566
     2567    outlen = sizeof(out);
     2568    memset(out, 0, outlen);
     2569
     2570    if (!TEST_int_gt(EVP_PKEY_derive_init(pctx), 0)
     2571            || !TEST_int_gt(EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()), 0)
     2572            || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt,
     2573                                                        sizeof(salt) - 1), 0)
     2574            || !TEST_int_gt(EVP_PKEY_CTX_set1_hkdf_key(pctx, key,
     2575                                                       sizeof(key) - 1), 0)
     2576            || !TEST_int_gt(EVP_PKEY_CTX_add1_hkdf_info(pctx, info,
     2577                                                        sizeof(info) - 1), 0)
     2578            || !TEST_int_gt(EVP_PKEY_derive(pctx, out, &outlen), 0)
     2579            || !TEST_mem_eq(out, outlen, expected, expectedlen))
     2580        goto done;
     2581
     2582    ret = 1;
     2583
     2584 done:
     2585    EVP_PKEY_CTX_free(pctx);
     2586
     2587    return ret;
     2588}
     2589
     2590static int test_empty_salt_info_HKDF(void)
     2591{
     2592    EVP_PKEY_CTX *pctx;
     2593    unsigned char out[20];
     2594    size_t outlen;
     2595    int ret = 0;
     2596    unsigned char salt[] = "";
     2597    unsigned char key[] = "012345678901234567890123456789";
     2598    unsigned char info[] = "";
     2599    const unsigned char expected[] = {
     2600        0x67, 0x12, 0xf9, 0x27, 0x8a, 0x8a, 0x3a, 0x8f, 0x7d, 0x2c, 0xa3, 0x6a,
     2601        0xaa, 0xe9, 0xb3, 0xb9, 0x52, 0x5f, 0xe0, 0x06,
    25572602    };
    25582603    size_t expectedlen = sizeof(expected);
    … …  
    46764721static int test_custom_md_meth(void)
    46774722{
     4723    ASN1_OBJECT *o = NULL;
    46784724    EVP_MD_CTX *mdctx = NULL;
    46794725    EVP_MD *tmp = NULL;
    … …  
    47214767        goto err;
    47224768
     4769    if (!TEST_int_eq(OBJ_create("1.3.6.1.4.1.16604.998866.1",
     4770                                "custom-md", "custom-md"), NID_undef)
     4771            || !TEST_int_eq(ERR_GET_LIB(ERR_peek_error()), ERR_LIB_OBJ)
     4772            || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), OBJ_R_OID_EXISTS))
     4773        goto err;
     4774
     4775    o = ASN1_OBJECT_create(nid, (unsigned char *)
     4776                                "\53\6\1\4\1\201\201\134\274\373\122\1", 12,
     4777                                "custom-md", "custom-md");
     4778    if (!TEST_int_eq(OBJ_add_object(o), nid))
     4779        goto err;
     4780
    47234781    testresult = 1;
    47244782 err:
     4783    ASN1_OBJECT_free(o);
    47254784    EVP_MD_CTX_free(mdctx);
    47264785    EVP_MD_meth_free(tmp);
    … …  
    53075366#endif
    53085367
     5368static int test_invalid_ctx_for_digest(void)
     5369{
     5370    int ret;
     5371    EVP_MD_CTX *mdctx;
     5372
     5373    mdctx = EVP_MD_CTX_new();
     5374    if (!TEST_ptr(mdctx))
     5375        return 0;
     5376
     5377    if (!TEST_int_eq(EVP_DigestUpdate(mdctx, "test", sizeof("test") - 1), 0))
     5378        ret = 0;
     5379    else
     5380        ret = 1;
     5381
     5382    EVP_MD_CTX_free(mdctx);
     5383
     5384    return ret;
     5385}
     5386
    53095387int setup_tests(void)
    53105388{
    … …  
    53845462    ADD_TEST(test_HKDF);
    53855463    ADD_TEST(test_emptyikm_HKDF);
     5464    ADD_TEST(test_empty_salt_info_HKDF);
    53865465#ifndef OPENSSL_NO_EC
    53875466    ADD_TEST(test_X509_PUBKEY_inplace);
    … …  
    54715550#endif
    54725551
     5552    ADD_TEST(test_invalid_ctx_for_digest);
     5553
    54735554    return 1;
    54745555}

  • trunk/src/libs/openssl-3.1.7/test/evp_kdf_test.c

    r104078 r105945  
    18591859}
    18601860
     1861/* Test that changing the KBKDF algorithm from KMAC to HMAC works correctly */
     1862static int test_kbkdf_mac_change(void)
     1863{
     1864    int ret = 0;
     1865    EVP_KDF_CTX *kctx = NULL;
     1866    OSSL_PARAM params[9], *p = params;
     1867    /* Test data taken from the evptest corpus */
     1868    int l = 0, sep = 0, r = 8;
     1869    static /* const */ unsigned char key[] = {
     1870        0x3e, 0xdc, 0x6b, 0x5b, 0x8f, 0x7a, 0xad, 0xbd,
     1871        0x71, 0x37, 0x32, 0xb4, 0x82, 0xb8, 0xf9, 0x79,
     1872        0x28, 0x6e, 0x1e, 0xa3, 0xb8, 0xf8, 0xf9, 0x9c,
     1873        0x30, 0xc8, 0x84, 0xcf, 0xe3, 0x34, 0x9b, 0x83
     1874    };
     1875    static /* const */ unsigned char info[] = {
     1876        0x98, 0xe9, 0x98, 0x8b, 0xb4, 0xcc, 0x8b, 0x34,
     1877        0xd7, 0x92, 0x2e, 0x1c, 0x68, 0xad, 0x69, 0x2b,
     1878        0xa2, 0xa1, 0xd9, 0xae, 0x15, 0x14, 0x95, 0x71,
     1879        0x67, 0x5f, 0x17, 0xa7, 0x7a, 0xd4, 0x9e, 0x80,
     1880        0xc8, 0xd2, 0xa8, 0x5e, 0x83, 0x1a, 0x26, 0x44,
     1881        0x5b, 0x1f, 0x0f, 0xf4, 0x4d, 0x70, 0x84, 0xa1,
     1882        0x72, 0x06, 0xb4, 0x89, 0x6c, 0x81, 0x12, 0xda,
     1883        0xad, 0x18, 0x60, 0x5a
     1884    };
     1885    static const unsigned char output[] = {
     1886        0x6c, 0x03, 0x76, 0x52, 0x99, 0x06, 0x74, 0xa0,
     1887        0x78, 0x44, 0x73, 0x2d, 0x0a, 0xd9, 0x85, 0xf9
     1888    };
     1889    unsigned char out[sizeof(output)];
     1890
     1891    params[0] = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
     1892                                                 OSSL_MAC_NAME_KMAC128, 0);
     1893    params[1] = OSSL_PARAM_construct_end();
     1894    if (!TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_KBKDF))
     1895            || !TEST_true(EVP_KDF_CTX_set_params(kctx, params)))
     1896        goto err;
     1897
     1898    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, "COUNTER", 0);
     1899    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, "HMAC", 0);
     1900    *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST, "SHA256", 0);
     1901    *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_L, &l);
     1902    *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR, &sep);
     1903    *p++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_KBKDF_R, &r);
     1904    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
     1905                                             key, sizeof(key));
     1906    *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
     1907                                             info, sizeof(info));
     1908    *p = OSSL_PARAM_construct_end();
     1909    if (!TEST_true(EVP_KDF_derive(kctx, out, sizeof(out), params))
     1910            || !TEST_mem_eq(out, sizeof(out), output, sizeof(output)))
     1911        goto err;
     1912
     1913    ret = 1;
     1914err:
     1915    EVP_KDF_CTX_free(kctx);
     1916    return ret;
     1917}
     1918
    18611919int setup_tests(void)
    18621920{
    … …  
    19201978#endif
    19211979    ADD_TEST(test_kdf_krb5kdf);
     1980    ADD_TEST(test_kbkdf_mac_change);
    19221981    return 1;
    19231982}

  • trunk/src/libs/openssl-3.1.7/test/evp_pkey_provided_test.c

    r104078 r105945  
    390390        goto err;
    391391
    392     while (dup_pk == NULL) {
     392    for (;;) {
    393393        ret = 0;
    394394        if (!TEST_int_eq(EVP_PKEY_get_bits(pk), 32)
    … …  
    418418              && test_print_key_using_encoder("RSA", pk);
    419419
    420         if (!ret || !TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
     420        if (!ret || dup_pk != NULL)
     421            break;
     422
     423        if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
    421424            goto err;
    422425        ret = ret && TEST_int_eq(EVP_PKEY_eq(pk, dup_pk), 1);
    … …  
    603606        goto err;
    604607
    605     while (dup_pk == NULL) {
     608    for (;;) {
    606609        ret = 0;
    607610        if (!TEST_int_eq(EVP_PKEY_get_bits(pk), 2048)
    … …  
    683686              && test_print_key_using_encoder("DH", pk);
    684687
    685         if (!ret || !TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
     688        if (!ret || dup_pk != NULL)
     689            break;
     690
     691        if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
    686692            goto err;
    687693        ret = ret && TEST_int_eq(EVP_PKEY_eq(pk, dup_pk), 1);
    … …  
    784790        goto err;
    785791
    786     while (dup_pk == NULL) {
     792    for (;;) {
    787793        ret = 0;
    788794        if (!TEST_int_eq(EVP_PKEY_get_bits(pk), 2048)
    … …  
    858864              && test_print_key_using_encoder("DH", pk);
    859865
    860         if (!ret || !TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
     866        if (!ret || dup_pk != NULL)
     867            break;
     868
     869        if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
    861870            goto err;
    862871        ret = ret && TEST_int_eq(EVP_PKEY_eq(pk, dup_pk), 1);
    … …  
    10911100        goto err;
    10921101
    1093     while (dup_pk == NULL) {
     1102    for (;;) {
    10941103        ret = 0;
    10951104        if (!TEST_int_eq(EVP_PKEY_get_bits(pk), bits)
    … …  
    11461155                  && test_print_key_using_encoder(alg, pk);
    11471156
    1148         if (!ret || !TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
     1157        if (!ret || dup_pk != NULL)
     1158            break;
     1159
     1160        if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
    11491161            goto err;
    11501162        ret = ret && TEST_int_eq(EVP_PKEY_eq(pk, dup_pk), 1);
    … …  
    12631275        goto err;
    12641276
    1265     while (dup_pk == NULL) {
     1277    for (;;) {
    12661278        ret = 0;
    12671279        if (!TEST_int_eq(EVP_PKEY_get_bits(pk), 256)
    … …  
    13011313            || !TEST_BN_eq(group_b, b))
    13021314            goto err;
     1315
     1316        EC_GROUP_free(group);
     1317        group = NULL;
     1318        BN_free(group_p);
     1319        group_p = NULL;
     1320        BN_free(group_a);
     1321        group_a = NULL;
     1322        BN_free(group_b);
     1323        group_b = NULL;
    13031324
    13041325        if (!EVP_PKEY_get_utf8_string_param(pk, OSSL_PKEY_PARAM_GROUP_NAME,
    … …  
    13301351              && test_print_key_using_encoder(alg, pk);
    13311352
    1332         if (!ret || !TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
     1353        if (!ret || dup_pk != NULL)
     1354            break;
     1355
     1356        if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
    13331357            goto err;
    13341358        ret = ret && TEST_int_eq(EVP_PKEY_eq(pk, dup_pk), 1);
    … …  
    15761600        goto err;
    15771601
    1578     while (dup_pk == NULL) {
     1602    for (;;) {
    15791603        ret = 0;
    15801604        if (!TEST_int_eq(EVP_PKEY_get_bits(pk), 2048)
    … …  
    16251649            || !TEST_int_eq(pcounter, pcounter_out))
    16261650            goto err;
    1627         BN_free(p);
    1628         p = NULL;
    1629         BN_free(q);
    1630         q = NULL;
    1631         BN_free(g);
    1632         g = NULL;
     1651        BN_free(p_out);
     1652        p_out = NULL;
     1653        BN_free(q_out);
     1654        q_out = NULL;
     1655        BN_free(g_out);
     1656        g_out = NULL;
    16331657        BN_free(j_out);
    16341658        j_out = NULL;
    … …  
    16581682              && test_print_key_using_encoder("DSA", pk);
    16591683
    1660         if (!ret || !TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
     1684        if (!ret || dup_pk != NULL)
     1685            break;
     1686
     1687        if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
    16611688            goto err;
    16621689        ret = ret && TEST_int_eq(EVP_PKEY_eq(pk, dup_pk), 1);

  • trunk/src/libs/openssl-3.1.7/test/evp_test.c

    r104078 r105945  
    27912791        return 0;
    27922792    p = strchr(name, ':');
    2793     if (p != NULL)
     2793    if (p == NULL)
     2794        p = "";
     2795    else
    27942796        *p++ = '\0';
    27952797
    … …  
    28022804
    28032805    rv = OSSL_PARAM_allocate_from_text(kdata->p, defs, name, p,
    2804                                        p != NULL ? strlen(p) : 0, NULL);
     2806                                       strlen(p), NULL);
    28052807    *++kdata->p = OSSL_PARAM_construct_end();
    28062808    if (!rv) {
    … …  
    28092811        return 0;
    28102812    }
    2811     if (p != NULL && strcmp(name, "digest") == 0) {
     2813    if (strcmp(name, "digest") == 0) {
    28122814        if (is_digest_disabled(p)) {
    28132815            TEST_info("skipping, '%s' is disabled", p);
    … …  
    28162818        goto end;
    28172819    }
    2818     if (p != NULL
    2819         && (strcmp(name, "cipher") == 0
    2820             || strcmp(name, "cekalg") == 0)
     2820
     2821    if ((strcmp(name, "cipher") == 0
     2822        || strcmp(name, "cekalg") == 0)
    28212823        && is_cipher_disabled(p)) {
    28222824        TEST_info("skipping, '%s' is disabled", p);
    … …  
    28242826        goto end;
    28252827    }
    2826     if (p != NULL
    2827         && (strcmp(name, "mac") == 0)
     2828    if ((strcmp(name, "mac") == 0)
    28282829        && is_mac_disabled(p)) {
    28292830        TEST_info("skipping, '%s' is disabled", p);

  • trunk/src/libs/openssl-3.1.7/test/helpers/handshake.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    348348
    349349    len = strlen(protos);
     350
     351    if (len == 0) {
     352        *out = NULL;
     353        *outlen = 0;
     354        return 1;
     355    }
    350356
    351357    /* Should never have reuse. */

  • trunk/src/libs/openssl-3.1.7/test/helpers/ssltestlib.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    88 */
    99
     10/*
     11 * We need access to the deprecated low level ENGINE APIs for legacy purposes
     12 * when the deprecated calls are not hidden
     13 */
     14#ifndef OPENSSL_NO_DEPRECATED_3_0
     15# define OPENSSL_SUPPRESS_DEPRECATED
     16#endif
     17
    1018#include <string.h>
    1119
     20#include <openssl/engine.h>
    1221#include "internal/nelem.h"
    1322#include "ssltestlib.h"
    … …  
    11831192    SSL_free(clientssl);
    11841193}
     1194
     1195ENGINE *load_dasync(void)
     1196{
     1197#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE)
     1198    ENGINE *e;
     1199
     1200    if (!TEST_ptr(e = ENGINE_by_id("dasync")))
     1201        return NULL;
     1202
     1203    if (!TEST_true(ENGINE_init(e))) {
     1204        ENGINE_free(e);
     1205        return NULL;
     1206    }
     1207
     1208    if (!TEST_true(ENGINE_register_ciphers(e))) {
     1209        ENGINE_free(e);
     1210        return NULL;
     1211    }
     1212
     1213    return e;
     1214#else
     1215    return NULL;
     1216#endif
     1217}

  • trunk/src/libs/openssl-3.1.7/test/helpers/ssltestlib.h

    r104078 r105945  
    11/*
    2  * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    6060DEFINE_STACK_OF(MEMPACKET)
    6161
     62ENGINE *load_dasync(void);
    6263#endif /* OSSL_TEST_SSLTESTLIB_H */

  • trunk/src/libs/openssl-3.1.7/test/hexstr_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License");
    … …  
    121121    return TEST_true(OPENSSL_hexstr2buf_ex(buf, sizeof(buf), &len, test->in, ':'))
    122122           && TEST_mem_eq(buf, len, test->expected, test->expected_len)
     123           && TEST_false(OPENSSL_buf2hexstr_ex(out, 3 * len - 1, NULL, buf, len,
     124                                               ':'))
    123125           && TEST_true(OPENSSL_buf2hexstr_ex(out, sizeof(out), NULL, buf, len,
    124                         ':'))
    125            && TEST_str_eq(out, test->in);
     126                                              ':'))
     127           && TEST_str_eq(out, test->in)
     128           && TEST_true(OPENSSL_buf2hexstr_ex(out, sizeof(out), NULL, buf, 0,
     129                                              ':'))
     130           && TEST_size_t_eq(strlen(out), 0);
    126131}
    127132

  • trunk/src/libs/openssl-3.1.7/test/keymgmt_internal_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    225225        goto err;
    226226
    227     while (dup_pk == NULL) {
     227    for (;;) {
    228228        ret = 0;
    229229        km = km3;
    … …  
    256256
    257257        ret = (ret == OSSL_NELEM(expected));
    258         if (!ret || !TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
     258
     259        if (!ret || dup_pk != NULL)
     260            break;
     261
     262        if (!TEST_ptr(dup_pk = EVP_PKEY_dup(pk)))
    259263            goto err;
    260264

  • trunk/src/libs/openssl-3.1.7/test/pkey_meth_kdf_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    1717#include "testutil.h"
    1818
    19 static int test_kdf_tls1_prf(void)
     19static int test_kdf_tls1_prf(int index)
    2020{
    2121    int ret = 0;
    … …  
    4141        goto err;
    4242    }
    43     if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx,
    44                                         (unsigned char *)"seed", 4) <= 0) {
    45         TEST_error("EVP_PKEY_CTX_add1_tls1_prf_seed");
    46         goto err;
     43    if (index == 0) {
     44        if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx,
     45                                            (unsigned char *)"seed", 4) <= 0) {
     46            TEST_error("EVP_PKEY_CTX_add1_tls1_prf_seed");
     47            goto err;
     48        }
     49    } else {
     50        if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx,
     51                                            (unsigned char *)"se", 2) <= 0) {
     52            TEST_error("EVP_PKEY_CTX_add1_tls1_prf_seed");
     53            goto err;
     54        }
     55        if (EVP_PKEY_CTX_add1_tls1_prf_seed(pctx,
     56                                            (unsigned char *)"ed", 2) <= 0) {
     57            TEST_error("EVP_PKEY_CTX_add1_tls1_prf_seed");
     58            goto err;
     59        }
    4760    }
    4861    if (EVP_PKEY_derive(pctx, out, &outlen) <= 0) {
    … …  
    6679}
    6780
    68 static int test_kdf_hkdf(void)
     81static int test_kdf_hkdf(int index)
    6982{
    7083    int ret = 0;
    … …  
    95108        goto err;
    96109    }
    97     if (EVP_PKEY_CTX_add1_hkdf_info(pctx, (const unsigned char *)"label", 5)
    98             <= 0) {
    99         TEST_error("EVP_PKEY_CTX_set1_hkdf_info");
    100         goto err;
     110    if (index == 0) {
     111        if (EVP_PKEY_CTX_add1_hkdf_info(pctx, (const unsigned char *)"label", 5)
     112            <= 0) {
     113            TEST_error("EVP_PKEY_CTX_add1_hkdf_info");
     114            goto err;
     115        }
     116    } else {
     117        if (EVP_PKEY_CTX_add1_hkdf_info(pctx, (const unsigned char *)"lab", 3)
     118            <= 0) {
     119            TEST_error("EVP_PKEY_CTX_add1_hkdf_info");
     120            goto err;
     121        }
     122        if (EVP_PKEY_CTX_add1_hkdf_info(pctx, (const unsigned char *)"el", 2)
     123            <= 0) {
     124            TEST_error("EVP_PKEY_CTX_add1_hkdf_info");
     125            goto err;
     126        }
    101127    }
    102128    if (EVP_PKEY_derive(pctx, out, &outlen) <= 0) {
    … …  
    196222int setup_tests(void)
    197223{
    198     ADD_TEST(test_kdf_tls1_prf);
    199     ADD_TEST(test_kdf_hkdf);
     224    int tests = 1;
     225
     226    if (fips_provider_version_ge(NULL, 3, 3, 1))
     227        tests = 2;
     228
     229    ADD_ALL_TESTS(test_kdf_tls1_prf, tests);
     230    ADD_ALL_TESTS(test_kdf_hkdf, tests);
    200231#ifndef OPENSSL_NO_SCRYPT
    201232    ADD_TEST(test_kdf_scrypt);

  • trunk/src/libs/openssl-3.1.7/test/prov_config_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    88 */
    99
     10#include <sys/stat.h>
    1011#include <openssl/evp.h>
    1112#include <openssl/conf.h>
    … …  
    1415static char *configfile = NULL;
    1516static char *recurseconfigfile = NULL;
     17static char *pathedconfig = NULL;
    1618
    1719/*
    … …  
    2527    EVP_MD *sha256 = NULL;
    2628
    27     if (!TEST_ptr(configfile))
    28         return 0;
    2929    if (!TEST_ptr(ctx))
    3030        return 0;
    3131
    3232    if (!TEST_true(OSSL_LIB_CTX_load_config(ctx, configfile)))
    33         return 0;
     33        goto err;
    3434    if (!TEST_true(OSSL_LIB_CTX_load_config(ctx, configfile)))
    35         return 0;
     35        goto err;
    3636
    3737    /* Check we can actually fetch something */
    … …  
    5353    unsigned long err;
    5454
    55     if (!TEST_ptr(recurseconfigfile))
    56         goto err;
    57 
    5855    if (!TEST_ptr(ctx))
    5956        goto err;
    … …  
    6663    if (ERR_GET_REASON(err) == CONF_R_RECURSIVE_SECTION_REFERENCE)
    6764        testresult = 1;
     65 err:
     66    OSSL_LIB_CTX_free(ctx);
     67    return testresult;
     68}
     69
     70#define P_TEST_PATH "/../test/p_test.so"
     71static int test_path_config(void)
     72{
     73    OSSL_LIB_CTX *ctx = NULL;
     74    OSSL_PROVIDER *prov;
     75    int testresult = 0;
     76    struct stat sbuf;
     77    char *module_path = getenv("OPENSSL_MODULES");
     78    char *full_path = NULL;
     79    int rc;
     80
     81    if (!TEST_ptr(module_path))
     82        return 0;
     83
     84    full_path = OPENSSL_zalloc(strlen(module_path) + strlen(P_TEST_PATH) + 1);
     85    if (!TEST_ptr(full_path))
     86        return 0;
     87
     88    strcpy(full_path, module_path);
     89    full_path = strcat(full_path, P_TEST_PATH);
     90    TEST_info("full path is %s", full_path);
     91    rc = stat(full_path, &sbuf);
     92    OPENSSL_free(full_path);
     93    if (rc == -1)
     94        return TEST_skip("Skipping modulepath test as provider not present");
     95
     96    if (!TEST_ptr(pathedconfig))
     97        return 0;
     98
     99    ctx = OSSL_LIB_CTX_new();
     100    if (!TEST_ptr(ctx))
     101        return 0;
     102
     103    if (!TEST_true(OSSL_LIB_CTX_load_config(ctx, pathedconfig)))
     104        goto err;
     105
     106    /* attempt to manually load the test provider */
     107    if (!TEST_ptr(prov = OSSL_PROVIDER_load(ctx, "test")))
     108        goto err;
     109
     110    OSSL_PROVIDER_unload(prov);
     111
     112    testresult = 1;
    68113 err:
    69114    OSSL_LIB_CTX_free(ctx);
    … …  
    86131        return 0;
    87132
     133    if (!TEST_ptr(pathedconfig = test_get_argument(2)))
     134        return 0;
     135
    88136    ADD_TEST(test_recursive_config);
    89137    ADD_TEST(test_double_config);
     138    ADD_TEST(test_path_config);
    90139    return 1;
    91140}

  • trunk/src/libs/openssl-3.1.7/test/provider_fallback_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    4040
    4141    ok = TEST_ptr(ctx = OSSL_LIB_CTX_new())
    42         && TEST_ptr(prov = OSSL_PROVIDER_load(ctx, "default"))
    43         && test_provider(ctx)
    44         && TEST_true(OSSL_PROVIDER_unload(prov));
     42        && TEST_ptr(prov = OSSL_PROVIDER_load(ctx, "default"));
     43
     44    if (ok) {
     45        ok = test_provider(ctx);
     46        if (ok)
     47            ok = TEST_true(OSSL_PROVIDER_unload(prov));
     48        else
     49            OSSL_PROVIDER_unload(prov);
     50    }
    4551
    4652    OSSL_LIB_CTX_free(ctx);

  • trunk/src/libs/openssl-3.1.7/test/provider_internal_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    2323static int test_provider(OSSL_PROVIDER *prov, const char *expected_greeting)
    2424{
    25     const char *greeting = NULL;
     25    const char *greeting = "no greeting received";
    2626    int ret = 0;
    2727

  • trunk/src/libs/openssl-3.1.7/test/provider_status_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    1515#include <openssl/self_test.h>
    1616#include <openssl/evp.h>
     17#include <openssl/rsa.h>
    1718#include "testutil.h"
    1819
    … …  
    148149    OSSL_PARAM params[2];
    149150    EVP_MD *fetch = NULL;
     151    EVP_PKEY_CTX *pctx = NULL;
     152    EVP_PKEY *pkey = NULL;
    150153
    151154    if (!TEST_ptr(prov = OSSL_PROVIDER_load(libctx, provider_name)))
    … …  
    164167    EVP_MD_free(fetch);
    165168    fetch = NULL;
     169    /* Use RNG before triggering on-demand self tests */
     170    if (!TEST_ptr((pctx = EVP_PKEY_CTX_new_from_name(libctx, "RSA", NULL)))
     171        || !TEST_int_gt(EVP_PKEY_keygen_init(pctx), 0)
     172        || !TEST_int_gt(EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, 2048), 0)
     173        || !TEST_int_gt(EVP_PKEY_keygen(pctx, &pkey), 0))
     174        goto err;
     175    EVP_PKEY_free(pkey);
     176    EVP_PKEY_CTX_free(pctx);
     177    pkey = NULL;
     178    pctx = NULL;
    166179
    167180    /* Test that the provider self test is ok */

  • trunk/src/libs/openssl-3.1.7/test/provider_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    198198    if (!TEST_true(OSSL_PROVIDER_add_builtin(libctx, name,
    199199                                             PROVIDER_INIT_FUNCTION_NAME))) {
     200        OSSL_PROVIDER_unload(legacy);
    200201        OSSL_LIB_CTX_free(libctx);
    201202        return 0;

  • trunk/src/libs/openssl-3.1.7/test/recipes/03-test_fipsinstall.t

    r104078 r105945  
    11#! /usr/bin/env perl
    2 # Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    207207            '-provider_name', 'fips', '-mac_name', 'HMAC',
    208208            '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
    209             '-section_name', 'fips_sect', '-corrupt_desc', 'SHA1'])),
     209            '-section_name', 'fips_sect', '-corrupt_desc', 'SHA2'])),
    210210   "fipsinstall fails when the digest result is corrupted");
    211211

  • trunk/src/libs/openssl-3.1.7/test/recipes/04-test_conf.t

    r104078 r105945  
    11#! /usr/bin/env perl
    2 # Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    1919    'dollarid_on.cnf'  => 'dollarid_on.txt',
    2020    'dollarid_off.cnf' => 'dollarid_off.txt',
     21    'oversized_line.cnf' => 'oversized_line.txt',
    2122);
    2223

  • trunk/src/libs/openssl-3.1.7/test/recipes/25-test_eai_data.t

    r104078 r105945  
    11#! /usr/bin/env perl
    2 # Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    2222#./util/wrap.pl apps/openssl verify -nameopt utf8 -no_check_time -CAfile test/recipes/25-test_eai_data/ascii_chain.pem test/recipes/25-test_eai_data/utf8_leaf.pem
    2323
    24 plan tests => 12;
     24plan tests => 16;
    2525
    2626require_ok(srctop_file('test','recipes','tconversion.pl'));
    … …  
    2929my $ascii_pem = srctop_file($folder, "ascii_leaf.pem");
    3030my $utf8_pem  = srctop_file($folder, "utf8_leaf.pem");
     31my $kdc_pem   = srctop_file($folder, "kdc-cert.pem");
    3132
    3233my $ascii_chain_pem = srctop_file($folder, "ascii_chain.pem");
    3334my $utf8_chain_pem  = srctop_file($folder, "utf8_chain.pem");
     35my $kdc_chain_pem  = srctop_file($folder, "kdc-root-cert.pem");
    3436
    3537my $out;
    … …  
    5759ok(run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-CAfile", $ascii_chain_pem, $ascii_pem])));
    5860ok(run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-CAfile", $utf8_chain_pem, $utf8_pem])));
     61ok(run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-CAfile", $kdc_chain_pem, $kdc_pem])));
    5962
    6063ok(!run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-CAfile", $ascii_chain_pem, $utf8_pem])));
    6164ok(!run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-CAfile", $utf8_chain_pem,  $ascii_pem])));
     65
     66# Check an otherName does not get misparsed as an DNS name, (should trigger ASAN errors if violated).
     67ok(run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-verify_hostname", 'mx1.example.com', "-CAfile", $kdc_chain_pem,  $kdc_pem])));
     68# Check an otherName does not get misparsed as an email address, (should trigger ASAN errors if violated).
     69ok(run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-verify_email", '[email protected]', "-CAfile", $kdc_chain_pem,  $kdc_pem])));
     70# We expect SmtpUTF8Mailbox to be a UTF8 String, not an IA5String.
     71ok(!run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-verify_email", '[email protected]', "-CAfile", $kdc_chain_pem,  $kdc_pem])));
    6272
    6373#Check that we get the expected failure return code

  • trunk/src/libs/openssl-3.1.7/test/recipes/25-test_req.t

    r104078 r105945  
    1616setup("test_req");
    1717
    18 plan tests => 49;
     18plan tests => 50;
    1919
    2020require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));
    … …  
    5454ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
    5555ok(run(app([@addext_args, "-addext", "SXNetID=1:one, 2:two, 3:three"])));
     56ok(run(app([@addext_args, "-addext", "subjectAltName=dirName:dirname_sec"])));
    5657
    5758# If a CSR is provided with neither of -key or -CA/-CAkey, this should fail.

  • trunk/src/libs/openssl-3.1.7/test/recipes/30-test_evp_data/evppkey_dsa.txt

    r104078 r105945  
    11#
    2 # Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    271271# Test sign with a 2048 bit key with N == 160 is not allowed in fips mode
    272272Availablein = fips
     273FIPSversion = <3.4.0
    273274DigestSign = SHA256
    274275Key = DSA-2048-160
    … …  
    325326# Test sign with a 1024 bit key is not allowed in fips mode
    326327Availablein = fips
     328FIPSversion = <3.4.0
    327329DigestSign = SHA256
    328330Securitycheck = 1
    … …  
    341343# Test sign with a 3072 bit key with N == 224 is not allowed in fips mode
    342344Availablein = fips
     345FIPSversion = <3.4.0
    343346DigestSign = SHA256
    344347Securitycheck = 1
    … …  
    349352# Test sign with a 4096 bit key is not allowed in fips mode
    350353Availablein = fips
     354FIPSversion = <3.4.0
    351355DigestSign = SHA256
    352356Securitycheck = 1

  • trunk/src/libs/openssl-3.1.7/test/recipes/30-test_evp_data/evppkey_ecdsa.txt

    r104078 r105945  
    11#
    2 # Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    217217# Test that SHA1 is not allowed in fips mode for signing
    218218Availablein = fips
     219FIPSversion = <3.4.0
    219220Sign = P-256
    220221Securitycheck = 1

  • trunk/src/libs/openssl-3.1.7/test/recipes/30-test_evp_data/evppkey_rsa_common.txt

    r104078 r105945  
    11#
    2 # Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    13451345# Signing with SHA1 is not allowed in fips mode
    13461346Availablein = fips
     1347FIPSversion = <3.4.0
    13471348DigestSign = SHA1
    13481349Securitycheck = 1

  • trunk/src/libs/openssl-3.1.7/test/recipes/30-test_prov_config.t

    r104078 r105945  
    11#! /usr/bin/env perl
    2 # Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    2424
    2525ok(run(test(["prov_config_test", srctop_file("test", "default.cnf"),
    26                                  srctop_file("test", "recursive.cnf")])),
     26                                 srctop_file("test", "recursive.cnf"),
     27                                 srctop_file("test", "pathed.cnf")])),
    2728    "running prov_config_test default.cnf");
    2829
    … …  
    3132
    3233    ok(run(test(["prov_config_test", srctop_file("test", "fips.cnf"),
    33                                      srctop_file("test", "recursive.cnf")])),
     34                                     srctop_file("test", "recursive.cnf"),
     35                                     srctop_file("test", "pathed.cnf")])),
    3436       "running prov_config_test fips.cnf");
    3537}

  • trunk/src/libs/openssl-3.1.7/test/recipes/80-test_pkcs12.t

    r104078 r105945  
    5555$ENV{OPENSSL_WIN32_UTF8}=1;
    5656
    57 plan tests => 17;
     57plan tests => 20;
    5858
    5959# Test different PKCS#12 formats
    … …  
    163163           "test bad pkcs12 file 1 (nomacver)");
    164164
     165        ok(run(app(["openssl", "pkcs12", "-in", $bad1, "-password", "pass:",
     166                    "-info"])),
     167           "test bad pkcs12 file 1 (info)");
     168
    165169        ok(run(app(["openssl", "pkcs12", "-in", $bad2, "-password", "pass:"])),
    166170           "test bad pkcs12 file 2");
    167171
     172        ok(run(app(["openssl", "pkcs12", "-in", $bad2, "-password", "pass:",
     173                    "-info"])),
     174           "test bad pkcs12 file 2 (info)");
     175
    168176        ok(run(app(["openssl", "pkcs12", "-in", $bad3, "-password", "pass:"])),
    169177           "test bad pkcs12 file 3");
     178
     179        ok(run(app(["openssl", "pkcs12", "-in", $bad3, "-password", "pass:",
     180                    "-info"])),
     181           "test bad pkcs12 file 3 (info)");
    170182     });
    171183

  • trunk/src/libs/openssl-3.1.7/test/recipes/90-test_shlibload.t

    r104078 r105945  
    11#! /usr/bin/env perl
    2 # Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    2424plan skip_all => "Test only supported in a dso build" if disabled("dso");
    2525plan skip_all => "Test is disabled in an address sanitizer build" unless disabled("asan");
     26plan skip_all => "Test is disabled in no-atexit build" if disabled("atexit");
    2627
    2728plan tests => 10;

  • trunk/src/libs/openssl-3.1.7/test/recipes/90-test_sslapi.t

    r104078 r105945  
    11#! /usr/bin/env perl
    2 # Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    88
    99use OpenSSL::Test::Utils;
    10 use OpenSSL::Test qw/:DEFAULT srctop_file srctop_dir bldtop_dir bldtop_file/;
     10use OpenSSL::Test qw/:DEFAULT srctop_file srctop_dir bldtop_dir bldtop_file result_dir result_file/;
    1111use File::Temp qw(tempfile);
    1212
    … …  
    1414setup("test_sslapi");
    1515}
    16 
    17 use lib srctop_dir('Configurations');
    18 use lib bldtop_dir('.');
    1916
    2017my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
    … …  
    2623# A modified copy of "fipsmodule.cnf"
    2724my $fipsmodcfgnew_filename = "fipsmodule_mod.cnf";
    28 my $fipsmodcfgnew = bldtop_file("test", $fipsmodcfgnew_filename);
     25my $fipsmodcfgnew = result_file($fipsmodcfgnew_filename);
    2926
    3027# A modified copy of "fips-and-base.cnf"
    31 my $provconfnew = bldtop_file("test", "temp.cnf");
     28my $provconfnew = result_file("fips-and-base-temp.cnf");
    3229
    3330plan skip_all => "No TLS/SSL protocols are supported by this OpenSSL build"
    … …  
    5249        if $no_fips;
    5350
     51    # NOTE that because by default we setup fips provider in pedantic mode,
     52    # with >= 3.1.0 this just runs test_no_ems() to check that the connection
     53    # fails if ems is not used and the fips check is enabled.
    5454    ok(run(test(["sslapitest", srctop_dir("test", "certs"),
    5555                 srctop_file("test", "recipes", "90-test_sslapi_data",
    … …  
    6060                             "90-test_sslapi_data",
    6161                             "dhparams.pem")])),
    62                  "running sslapitest");
     62                 "running sslapitest with default fips config");
    6363
    6464    run(test(["fips_version_test", "-config", $provconf, ">=3.1.0"]),
    … …  
    7171    # value in $repl and output to a new file $outfile.
    7272    sub replace_line_file_internal {
    73    
     73
    7474        my ($infile, $srch, $repl, $outfile) = @_;
    7575        my $msg;
    … …  
    8686        return 1;
    8787    }
    88    
     88
    8989    # Read in the text input file $infile
    9090    # and replace a single Key = Value line with a new value in $value.
    … …  
    103103        return replace_line_file_internal($infile, $srch, $rep, $outfile);
    104104    }
    105    
     105
    106106    # Read in the text $input file
    107107    # and search for the $key and replace with $newkey
    … …  
    115115    }
    116116
    117     # In order to enable the tls1-prf-ems-check=1 in a fips config file
     117    # The default fipsmodule.cnf in tests is set with -pedantic.
     118    # In order to enable the tls1-prf-ems-check=0 in a fips config file
    118119    # copy the existing fipsmodule.cnf and modify it.
    119120    # Then copy fips-and-base.cfg to make a file that includes the changed file
    120     # NOTE that this just runs test_no_ems() to check that the connection
    121     # fails if ems is not used and the fips check is enabled.
     121    $ENV{OPENSSL_CONF_INCLUDE} = result_dir();
    122122    ok(replace_kv_file($fipsmodcfg,
    123                        'tls1-prf-ems-check', '1',
     123                       'tls1-prf-ems-check', '0',
    124124                       $fipsmodcfgnew)
    125125       && replace_line_file($provconf,
    … …  
    135135                                "90-test_sslapi_data",
    136136                                "dhparams.pem")])),
    137        "running sslapitest");
    138 
    139     unlink $fipsmodcfgnew;
    140     unlink $provconfnew;
     137       "running sslapitest with modified fips config");
    141138}
    142139

  • trunk/src/libs/openssl-3.1.7/test/sm2_internal_test.c

    r104078 r105945  
    11/*
    2  * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    306306                         const char *k_hex,
    307307                         const char *r_hex,
    308                          const char *s_hex)
     308                         const char *s_hex,
     309                         int omit_pubkey)
    309310{
    310311    const size_t msg_len = strlen(message);
    … …  
    328329        goto done;
    329330
    330     pt = EC_POINT_new(group);
    331     if (!TEST_ptr(pt)
    332             || !TEST_true(EC_POINT_mul(group, pt, priv, NULL, NULL, NULL))
    333             || !TEST_true(EC_KEY_set_public_key(key, pt)))
    334         goto done;
     331    if (omit_pubkey == 0) {
     332        pt = EC_POINT_new(group);
     333        if (!TEST_ptr(pt)
     334                || !TEST_true(EC_POINT_mul(group, pt, priv, NULL, NULL, NULL))
     335                || !TEST_true(EC_KEY_set_public_key(key, pt)))
     336            goto done;
     337    }
    335338
    336339    start_fake_rand(k_hex);
    … …  
    393396                        "007c47811054c6f99613a578eb8453706ccb96384fe7df5c171671e760bfa8be3a",
    394397                        "40F1EC59F793D9F49E09DCEF49130D4194F79FB1EED2CAA55BACDB49C4E755D1",
    395                         "6FC6DAC32C5D5CF10C77DFB20F7C2EB667A457872FB09EC56327A67EC7DEEBE7")))
     398                        "6FC6DAC32C5D5CF10C77DFB20F7C2EB667A457872FB09EC56327A67EC7DEEBE7", 0)))
     399        goto done;
     400
     401    /* Make sure we fail if we omit the public portion of the key */
     402    if (!TEST_false(test_sm2_sign(
     403                     test_group,
     404                     /* the default ID specified in GM/T 0009-2012 (Sec. 10).*/
     405                     SM2_DEFAULT_USERID,
     406                     /* privkey */
     407                     "3945208F7B2144B13F36E38AC6D39F95889393692860B51A42FB81EF4DF7C5B8",
     408                     /* plaintext message */
     409                     "message digest",
     410                     /* ephemeral nonce k */
     411                     "59276E27D506861A16680F3AD9C02DCCEF3CC1FA3CDBE4CE6D54B80DEAC1BC21",
     412                     /* expected signature, */
     413                     /* signature R, 0x20 bytes */
     414                     "F5A03B0648D2C4630EEAC513E1BB81A15944DA3827D5B74143AC7EACEEE720B3",
     415                     /* signature S, 0x20 bytes */
     416                     "B1B6AA29DF212FD8763182BC0D421CA1BB9038FD1F7F42D4840B69C485BBC1AA", 1)))
    396417        goto done;
    397418

  • trunk/src/libs/openssl-3.1.7/test/ssl-tests/08-npn.cnf

    r104078 r105945  
    11# Generated with generate_ssl_tests.pl
    22
    3 num_tests = 20
     3num_tests = 22
    44
    55test-0 = 0-npn-simple
    … …  
    99test-4 = 4-npn-no-server-support
    1010test-5 = 5-npn-no-client-support
    11 test-6 = 6-npn-with-sni-no-context-switch
    12 test-7 = 7-npn-with-sni-context-switch
    13 test-8 = 8-npn-selected-sni-server-supports-npn
    14 test-9 = 9-npn-selected-sni-server-does-not-support-npn
    15 test-10 = 10-alpn-preferred-over-npn
    16 test-11 = 11-sni-npn-preferred-over-alpn
    17 test-12 = 12-npn-simple-resumption
    18 test-13 = 13-npn-server-switch-resumption
    19 test-14 = 14-npn-client-switch-resumption
    20 test-15 = 15-npn-client-first-pref-on-mismatch-resumption
    21 test-16 = 16-npn-no-server-support-resumption
    22 test-17 = 17-npn-no-client-support-resumption
    23 test-18 = 18-alpn-preferred-over-npn-resumption
    24 test-19 = 19-npn-used-if-alpn-not-supported-resumption
     11test-6 = 6-npn-empty-client-list
     12test-7 = 7-npn-empty-server-list
     13test-8 = 8-npn-with-sni-no-context-switch
     14test-9 = 9-npn-with-sni-context-switch
     15test-10 = 10-npn-selected-sni-server-supports-npn
     16test-11 = 11-npn-selected-sni-server-does-not-support-npn
     17test-12 = 12-alpn-preferred-over-npn
     18test-13 = 13-sni-npn-preferred-over-alpn
     19test-14 = 14-npn-simple-resumption
     20test-15 = 15-npn-server-switch-resumption
     21test-16 = 16-npn-client-switch-resumption
     22test-17 = 17-npn-client-first-pref-on-mismatch-resumption
     23test-18 = 18-npn-no-server-support-resumption
     24test-19 = 19-npn-no-client-support-resumption
     25test-20 = 20-alpn-preferred-over-npn-resumption
     26test-21 = 21-npn-used-if-alpn-not-supported-resumption
    2527# ===========================================================
    2628
    … …  
    207209# ===========================================================
    208210
    209 [6-npn-with-sni-no-context-switch]
    210 ssl_conf = 6-npn-with-sni-no-context-switch-ssl
    211 
    212 [6-npn-with-sni-no-context-switch-ssl]
    213 server = 6-npn-with-sni-no-context-switch-server
    214 client = 6-npn-with-sni-no-context-switch-client
    215 server2 = 6-npn-with-sni-no-context-switch-server2
    216 
    217 [6-npn-with-sni-no-context-switch-server]
    218 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    219 CipherString = DEFAULT
    220 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    221 
    222 [6-npn-with-sni-no-context-switch-server2]
    223 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    224 CipherString = DEFAULT
    225 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    226 
    227 [6-npn-with-sni-no-context-switch-client]
     211[6-npn-empty-client-list]
     212ssl_conf = 6-npn-empty-client-list-ssl
     213
     214[6-npn-empty-client-list-ssl]
     215server = 6-npn-empty-client-list-server
     216client = 6-npn-empty-client-list-client
     217
     218[6-npn-empty-client-list-server]
     219Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     220CipherString = DEFAULT
     221PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     222
     223[6-npn-empty-client-list-client]
    228224CipherString = DEFAULT
    229225MaxProtocol = TLSv1.2
    … …  
    232228
    233229[test-6]
     230ExpectedClientAlert = HandshakeFailure
     231ExpectedResult = ClientFail
     232server = 6-npn-empty-client-list-server-extra
     233client = 6-npn-empty-client-list-client-extra
     234
     235[6-npn-empty-client-list-server-extra]
     236NPNProtocols = foo
     237
     238[6-npn-empty-client-list-client-extra]
     239NPNProtocols =
     240
     241
     242# ===========================================================
     243
     244[7-npn-empty-server-list]
     245ssl_conf = 7-npn-empty-server-list-ssl
     246
     247[7-npn-empty-server-list-ssl]
     248server = 7-npn-empty-server-list-server
     249client = 7-npn-empty-server-list-client
     250
     251[7-npn-empty-server-list-server]
     252Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     253CipherString = DEFAULT
     254PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     255
     256[7-npn-empty-server-list-client]
     257CipherString = DEFAULT
     258MaxProtocol = TLSv1.2
     259VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     260VerifyMode = Peer
     261
     262[test-7]
     263ExpectedNPNProtocol = foo
     264server = 7-npn-empty-server-list-server-extra
     265client = 7-npn-empty-server-list-client-extra
     266
     267[7-npn-empty-server-list-server-extra]
     268NPNProtocols =
     269
     270[7-npn-empty-server-list-client-extra]
     271NPNProtocols = foo
     272
     273
     274# ===========================================================
     275
     276[8-npn-with-sni-no-context-switch]
     277ssl_conf = 8-npn-with-sni-no-context-switch-ssl
     278
     279[8-npn-with-sni-no-context-switch-ssl]
     280server = 8-npn-with-sni-no-context-switch-server
     281client = 8-npn-with-sni-no-context-switch-client
     282server2 = 8-npn-with-sni-no-context-switch-server2
     283
     284[8-npn-with-sni-no-context-switch-server]
     285Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     286CipherString = DEFAULT
     287PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     288
     289[8-npn-with-sni-no-context-switch-server2]
     290Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     291CipherString = DEFAULT
     292PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     293
     294[8-npn-with-sni-no-context-switch-client]
     295CipherString = DEFAULT
     296MaxProtocol = TLSv1.2
     297VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     298VerifyMode = Peer
     299
     300[test-8]
    234301ExpectedNPNProtocol = foo
    235302ExpectedServerName = server1
    236 server = 6-npn-with-sni-no-context-switch-server-extra
    237 server2 = 6-npn-with-sni-no-context-switch-server2-extra
    238 client = 6-npn-with-sni-no-context-switch-client-extra
    239 
    240 [6-npn-with-sni-no-context-switch-server-extra]
     303server = 8-npn-with-sni-no-context-switch-server-extra
     304server2 = 8-npn-with-sni-no-context-switch-server2-extra
     305client = 8-npn-with-sni-no-context-switch-client-extra
     306
     307[8-npn-with-sni-no-context-switch-server-extra]
    241308NPNProtocols = foo
    242309ServerNameCallback = IgnoreMismatch
    243310
    244 [6-npn-with-sni-no-context-switch-server2-extra]
    245 NPNProtocols = bar
    246 
    247 [6-npn-with-sni-no-context-switch-client-extra]
     311[8-npn-with-sni-no-context-switch-server2-extra]
     312NPNProtocols = bar
     313
     314[8-npn-with-sni-no-context-switch-client-extra]
    248315NPNProtocols = foo,bar
    249316ServerName = server1
    … …  
    252319# ===========================================================
    253320
    254 [7-npn-with-sni-context-switch]
    255 ssl_conf = 7-npn-with-sni-context-switch-ssl
    256 
    257 [7-npn-with-sni-context-switch-ssl]
    258 server = 7-npn-with-sni-context-switch-server
    259 client = 7-npn-with-sni-context-switch-client
    260 server2 = 7-npn-with-sni-context-switch-server2
    261 
    262 [7-npn-with-sni-context-switch-server]
    263 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    264 CipherString = DEFAULT
    265 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    266 
    267 [7-npn-with-sni-context-switch-server2]
    268 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    269 CipherString = DEFAULT
    270 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    271 
    272 [7-npn-with-sni-context-switch-client]
    273 CipherString = DEFAULT
    274 MaxProtocol = TLSv1.2
    275 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    276 VerifyMode = Peer
    277 
    278 [test-7]
     321[9-npn-with-sni-context-switch]
     322ssl_conf = 9-npn-with-sni-context-switch-ssl
     323
     324[9-npn-with-sni-context-switch-ssl]
     325server = 9-npn-with-sni-context-switch-server
     326client = 9-npn-with-sni-context-switch-client
     327server2 = 9-npn-with-sni-context-switch-server2
     328
     329[9-npn-with-sni-context-switch-server]
     330Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     331CipherString = DEFAULT
     332PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     333
     334[9-npn-with-sni-context-switch-server2]
     335Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     336CipherString = DEFAULT
     337PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     338
     339[9-npn-with-sni-context-switch-client]
     340CipherString = DEFAULT
     341MaxProtocol = TLSv1.2
     342VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     343VerifyMode = Peer
     344
     345[test-9]
    279346ExpectedNPNProtocol = bar
    280347ExpectedServerName = server2
    281 server = 7-npn-with-sni-context-switch-server-extra
    282 server2 = 7-npn-with-sni-context-switch-server2-extra
    283 client = 7-npn-with-sni-context-switch-client-extra
    284 
    285 [7-npn-with-sni-context-switch-server-extra]
     348server = 9-npn-with-sni-context-switch-server-extra
     349server2 = 9-npn-with-sni-context-switch-server2-extra
     350client = 9-npn-with-sni-context-switch-client-extra
     351
     352[9-npn-with-sni-context-switch-server-extra]
    286353NPNProtocols = foo
    287354ServerNameCallback = IgnoreMismatch
    288355
    289 [7-npn-with-sni-context-switch-server2-extra]
    290 NPNProtocols = bar
    291 
    292 [7-npn-with-sni-context-switch-client-extra]
     356[9-npn-with-sni-context-switch-server2-extra]
     357NPNProtocols = bar
     358
     359[9-npn-with-sni-context-switch-client-extra]
    293360NPNProtocols = foo,bar
    294361ServerName = server2
    … …  
    297364# ===========================================================
    298365
    299 [8-npn-selected-sni-server-supports-npn]
    300 ssl_conf = 8-npn-selected-sni-server-supports-npn-ssl
    301 
    302 [8-npn-selected-sni-server-supports-npn-ssl]
    303 server = 8-npn-selected-sni-server-supports-npn-server
    304 client = 8-npn-selected-sni-server-supports-npn-client
    305 server2 = 8-npn-selected-sni-server-supports-npn-server2
    306 
    307 [8-npn-selected-sni-server-supports-npn-server]
    308 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    309 CipherString = DEFAULT
    310 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    311 
    312 [8-npn-selected-sni-server-supports-npn-server2]
    313 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    314 CipherString = DEFAULT
    315 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    316 
    317 [8-npn-selected-sni-server-supports-npn-client]
    318 CipherString = DEFAULT
    319 MaxProtocol = TLSv1.2
    320 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    321 VerifyMode = Peer
    322 
    323 [test-8]
     366[10-npn-selected-sni-server-supports-npn]
     367ssl_conf = 10-npn-selected-sni-server-supports-npn-ssl
     368
     369[10-npn-selected-sni-server-supports-npn-ssl]
     370server = 10-npn-selected-sni-server-supports-npn-server
     371client = 10-npn-selected-sni-server-supports-npn-client
     372server2 = 10-npn-selected-sni-server-supports-npn-server2
     373
     374[10-npn-selected-sni-server-supports-npn-server]
     375Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     376CipherString = DEFAULT
     377PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     378
     379[10-npn-selected-sni-server-supports-npn-server2]
     380Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     381CipherString = DEFAULT
     382PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     383
     384[10-npn-selected-sni-server-supports-npn-client]
     385CipherString = DEFAULT
     386MaxProtocol = TLSv1.2
     387VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     388VerifyMode = Peer
     389
     390[test-10]
    324391ExpectedNPNProtocol = bar
    325392ExpectedServerName = server2
    326 server = 8-npn-selected-sni-server-supports-npn-server-extra
    327 server2 = 8-npn-selected-sni-server-supports-npn-server2-extra
    328 client = 8-npn-selected-sni-server-supports-npn-client-extra
    329 
    330 [8-npn-selected-sni-server-supports-npn-server-extra]
     393server = 10-npn-selected-sni-server-supports-npn-server-extra
     394server2 = 10-npn-selected-sni-server-supports-npn-server2-extra
     395client = 10-npn-selected-sni-server-supports-npn-client-extra
     396
     397[10-npn-selected-sni-server-supports-npn-server-extra]
    331398ServerNameCallback = IgnoreMismatch
    332399
    333 [8-npn-selected-sni-server-supports-npn-server2-extra]
    334 NPNProtocols = bar
    335 
    336 [8-npn-selected-sni-server-supports-npn-client-extra]
     400[10-npn-selected-sni-server-supports-npn-server2-extra]
     401NPNProtocols = bar
     402
     403[10-npn-selected-sni-server-supports-npn-client-extra]
    337404NPNProtocols = foo,bar
    338405ServerName = server2
    … …  
    341408# ===========================================================
    342409
    343 [9-npn-selected-sni-server-does-not-support-npn]
    344 ssl_conf = 9-npn-selected-sni-server-does-not-support-npn-ssl
    345 
    346 [9-npn-selected-sni-server-does-not-support-npn-ssl]
    347 server = 9-npn-selected-sni-server-does-not-support-npn-server
    348 client = 9-npn-selected-sni-server-does-not-support-npn-client
    349 server2 = 9-npn-selected-sni-server-does-not-support-npn-server2
    350 
    351 [9-npn-selected-sni-server-does-not-support-npn-server]
    352 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    353 CipherString = DEFAULT
    354 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    355 
    356 [9-npn-selected-sni-server-does-not-support-npn-server2]
    357 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    358 CipherString = DEFAULT
    359 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    360 
    361 [9-npn-selected-sni-server-does-not-support-npn-client]
    362 CipherString = DEFAULT
    363 MaxProtocol = TLSv1.2
    364 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    365 VerifyMode = Peer
    366 
    367 [test-9]
     410[11-npn-selected-sni-server-does-not-support-npn]
     411ssl_conf = 11-npn-selected-sni-server-does-not-support-npn-ssl
     412
     413[11-npn-selected-sni-server-does-not-support-npn-ssl]
     414server = 11-npn-selected-sni-server-does-not-support-npn-server
     415client = 11-npn-selected-sni-server-does-not-support-npn-client
     416server2 = 11-npn-selected-sni-server-does-not-support-npn-server2
     417
     418[11-npn-selected-sni-server-does-not-support-npn-server]
     419Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     420CipherString = DEFAULT
     421PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     422
     423[11-npn-selected-sni-server-does-not-support-npn-server2]
     424Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     425CipherString = DEFAULT
     426PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     427
     428[11-npn-selected-sni-server-does-not-support-npn-client]
     429CipherString = DEFAULT
     430MaxProtocol = TLSv1.2
     431VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     432VerifyMode = Peer
     433
     434[test-11]
    368435ExpectedServerName = server2
    369 server = 9-npn-selected-sni-server-does-not-support-npn-server-extra
    370 client = 9-npn-selected-sni-server-does-not-support-npn-client-extra
    371 
    372 [9-npn-selected-sni-server-does-not-support-npn-server-extra]
     436server = 11-npn-selected-sni-server-does-not-support-npn-server-extra
     437client = 11-npn-selected-sni-server-does-not-support-npn-client-extra
     438
     439[11-npn-selected-sni-server-does-not-support-npn-server-extra]
    373440NPNProtocols = bar
    374441ServerNameCallback = IgnoreMismatch
    375442
    376 [9-npn-selected-sni-server-does-not-support-npn-client-extra]
     443[11-npn-selected-sni-server-does-not-support-npn-client-extra]
    377444NPNProtocols = foo,bar
    378445ServerName = server2
    … …  
    381448# ===========================================================
    382449
    383 [10-alpn-preferred-over-npn]
    384 ssl_conf = 10-alpn-preferred-over-npn-ssl
    385 
    386 [10-alpn-preferred-over-npn-ssl]
    387 server = 10-alpn-preferred-over-npn-server
    388 client = 10-alpn-preferred-over-npn-client
    389 
    390 [10-alpn-preferred-over-npn-server]
    391 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    392 CipherString = DEFAULT
    393 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    394 
    395 [10-alpn-preferred-over-npn-client]
    396 CipherString = DEFAULT
    397 MaxProtocol = TLSv1.2
    398 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    399 VerifyMode = Peer
    400 
    401 [test-10]
     450[12-alpn-preferred-over-npn]
     451ssl_conf = 12-alpn-preferred-over-npn-ssl
     452
     453[12-alpn-preferred-over-npn-ssl]
     454server = 12-alpn-preferred-over-npn-server
     455client = 12-alpn-preferred-over-npn-client
     456
     457[12-alpn-preferred-over-npn-server]
     458Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     459CipherString = DEFAULT
     460PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     461
     462[12-alpn-preferred-over-npn-client]
     463CipherString = DEFAULT
     464MaxProtocol = TLSv1.2
     465VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     466VerifyMode = Peer
     467
     468[test-12]
    402469ExpectedALPNProtocol = foo
    403 server = 10-alpn-preferred-over-npn-server-extra
    404 client = 10-alpn-preferred-over-npn-client-extra
    405 
    406 [10-alpn-preferred-over-npn-server-extra]
     470server = 12-alpn-preferred-over-npn-server-extra
     471client = 12-alpn-preferred-over-npn-client-extra
     472
     473[12-alpn-preferred-over-npn-server-extra]
    407474ALPNProtocols = foo
    408475NPNProtocols = bar
    409476
    410 [10-alpn-preferred-over-npn-client-extra]
     477[12-alpn-preferred-over-npn-client-extra]
    411478ALPNProtocols = foo
    412479NPNProtocols = bar
    … …  
    415482# ===========================================================
    416483
    417 [11-sni-npn-preferred-over-alpn]
    418 ssl_conf = 11-sni-npn-preferred-over-alpn-ssl
    419 
    420 [11-sni-npn-preferred-over-alpn-ssl]
    421 server = 11-sni-npn-preferred-over-alpn-server
    422 client = 11-sni-npn-preferred-over-alpn-client
    423 server2 = 11-sni-npn-preferred-over-alpn-server2
    424 
    425 [11-sni-npn-preferred-over-alpn-server]
    426 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    427 CipherString = DEFAULT
    428 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    429 
    430 [11-sni-npn-preferred-over-alpn-server2]
    431 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    432 CipherString = DEFAULT
    433 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    434 
    435 [11-sni-npn-preferred-over-alpn-client]
    436 CipherString = DEFAULT
    437 MaxProtocol = TLSv1.2
    438 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    439 VerifyMode = Peer
    440 
    441 [test-11]
     484[13-sni-npn-preferred-over-alpn]
     485ssl_conf = 13-sni-npn-preferred-over-alpn-ssl
     486
     487[13-sni-npn-preferred-over-alpn-ssl]
     488server = 13-sni-npn-preferred-over-alpn-server
     489client = 13-sni-npn-preferred-over-alpn-client
     490server2 = 13-sni-npn-preferred-over-alpn-server2
     491
     492[13-sni-npn-preferred-over-alpn-server]
     493Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     494CipherString = DEFAULT
     495PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     496
     497[13-sni-npn-preferred-over-alpn-server2]
     498Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     499CipherString = DEFAULT
     500PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     501
     502[13-sni-npn-preferred-over-alpn-client]
     503CipherString = DEFAULT
     504MaxProtocol = TLSv1.2
     505VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     506VerifyMode = Peer
     507
     508[test-13]
    442509ExpectedNPNProtocol = bar
    443510ExpectedServerName = server2
    444 server = 11-sni-npn-preferred-over-alpn-server-extra
    445 server2 = 11-sni-npn-preferred-over-alpn-server2-extra
    446 client = 11-sni-npn-preferred-over-alpn-client-extra
    447 
    448 [11-sni-npn-preferred-over-alpn-server-extra]
     511server = 13-sni-npn-preferred-over-alpn-server-extra
     512server2 = 13-sni-npn-preferred-over-alpn-server2-extra
     513client = 13-sni-npn-preferred-over-alpn-client-extra
     514
     515[13-sni-npn-preferred-over-alpn-server-extra]
    449516ALPNProtocols = foo
    450517ServerNameCallback = IgnoreMismatch
    451518
    452 [11-sni-npn-preferred-over-alpn-server2-extra]
    453 NPNProtocols = bar
    454 
    455 [11-sni-npn-preferred-over-alpn-client-extra]
     519[13-sni-npn-preferred-over-alpn-server2-extra]
     520NPNProtocols = bar
     521
     522[13-sni-npn-preferred-over-alpn-client-extra]
    456523ALPNProtocols = foo
    457524NPNProtocols = bar
    … …  
    461528# ===========================================================
    462529
    463 [12-npn-simple-resumption]
    464 ssl_conf = 12-npn-simple-resumption-ssl
    465 
    466 [12-npn-simple-resumption-ssl]
    467 server = 12-npn-simple-resumption-server
    468 client = 12-npn-simple-resumption-client
    469 resume-server = 12-npn-simple-resumption-server
    470 resume-client = 12-npn-simple-resumption-client
    471 
    472 [12-npn-simple-resumption-server]
    473 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    474 CipherString = DEFAULT
    475 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    476 
    477 [12-npn-simple-resumption-client]
    478 CipherString = DEFAULT
    479 MaxProtocol = TLSv1.2
    480 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    481 VerifyMode = Peer
    482 
    483 [test-12]
     530[14-npn-simple-resumption]
     531ssl_conf = 14-npn-simple-resumption-ssl
     532
     533[14-npn-simple-resumption-ssl]
     534server = 14-npn-simple-resumption-server
     535client = 14-npn-simple-resumption-client
     536resume-server = 14-npn-simple-resumption-server
     537resume-client = 14-npn-simple-resumption-client
     538
     539[14-npn-simple-resumption-server]
     540Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     541CipherString = DEFAULT
     542PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     543
     544[14-npn-simple-resumption-client]
     545CipherString = DEFAULT
     546MaxProtocol = TLSv1.2
     547VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     548VerifyMode = Peer
     549
     550[test-14]
    484551ExpectedNPNProtocol = foo
    485552HandshakeMode = Resume
    486553ResumptionExpected = Yes
    487 server = 12-npn-simple-resumption-server-extra
    488 resume-server = 12-npn-simple-resumption-server-extra
    489 client = 12-npn-simple-resumption-client-extra
    490 resume-client = 12-npn-simple-resumption-client-extra
    491 
    492 [12-npn-simple-resumption-server-extra]
    493 NPNProtocols = foo
    494 
    495 [12-npn-simple-resumption-client-extra]
    496 NPNProtocols = foo
    497 
    498 
    499 # ===========================================================
    500 
    501 [13-npn-server-switch-resumption]
    502 ssl_conf = 13-npn-server-switch-resumption-ssl
    503 
    504 [13-npn-server-switch-resumption-ssl]
    505 server = 13-npn-server-switch-resumption-server
    506 client = 13-npn-server-switch-resumption-client
    507 resume-server = 13-npn-server-switch-resumption-resume-server
    508 resume-client = 13-npn-server-switch-resumption-client
    509 
    510 [13-npn-server-switch-resumption-server]
    511 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    512 CipherString = DEFAULT
    513 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    514 
    515 [13-npn-server-switch-resumption-resume-server]
    516 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    517 CipherString = DEFAULT
    518 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    519 
    520 [13-npn-server-switch-resumption-client]
    521 CipherString = DEFAULT
    522 MaxProtocol = TLSv1.2
    523 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    524 VerifyMode = Peer
    525 
    526 [test-13]
     554server = 14-npn-simple-resumption-server-extra
     555resume-server = 14-npn-simple-resumption-server-extra
     556client = 14-npn-simple-resumption-client-extra
     557resume-client = 14-npn-simple-resumption-client-extra
     558
     559[14-npn-simple-resumption-server-extra]
     560NPNProtocols = foo
     561
     562[14-npn-simple-resumption-client-extra]
     563NPNProtocols = foo
     564
     565
     566# ===========================================================
     567
     568[15-npn-server-switch-resumption]
     569ssl_conf = 15-npn-server-switch-resumption-ssl
     570
     571[15-npn-server-switch-resumption-ssl]
     572server = 15-npn-server-switch-resumption-server
     573client = 15-npn-server-switch-resumption-client
     574resume-server = 15-npn-server-switch-resumption-resume-server
     575resume-client = 15-npn-server-switch-resumption-client
     576
     577[15-npn-server-switch-resumption-server]
     578Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     579CipherString = DEFAULT
     580PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     581
     582[15-npn-server-switch-resumption-resume-server]
     583Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     584CipherString = DEFAULT
     585PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     586
     587[15-npn-server-switch-resumption-client]
     588CipherString = DEFAULT
     589MaxProtocol = TLSv1.2
     590VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     591VerifyMode = Peer
     592
     593[test-15]
    527594ExpectedNPNProtocol = baz
    528595HandshakeMode = Resume
    529596ResumptionExpected = Yes
    530 server = 13-npn-server-switch-resumption-server-extra
    531 resume-server = 13-npn-server-switch-resumption-resume-server-extra
    532 client = 13-npn-server-switch-resumption-client-extra
    533 resume-client = 13-npn-server-switch-resumption-client-extra
    534 
    535 [13-npn-server-switch-resumption-server-extra]
     597server = 15-npn-server-switch-resumption-server-extra
     598resume-server = 15-npn-server-switch-resumption-resume-server-extra
     599client = 15-npn-server-switch-resumption-client-extra
     600resume-client = 15-npn-server-switch-resumption-client-extra
     601
     602[15-npn-server-switch-resumption-server-extra]
    536603NPNProtocols = bar,foo
    537604
    538 [13-npn-server-switch-resumption-resume-server-extra]
     605[15-npn-server-switch-resumption-resume-server-extra]
    539606NPNProtocols = baz,foo
    540607
    541 [13-npn-server-switch-resumption-client-extra]
     608[15-npn-server-switch-resumption-client-extra]
    542609NPNProtocols = foo,bar,baz
    543610
    … …  
    545612# ===========================================================
    546613
    547 [14-npn-client-switch-resumption]
    548 ssl_conf = 14-npn-client-switch-resumption-ssl
    549 
    550 [14-npn-client-switch-resumption-ssl]
    551 server = 14-npn-client-switch-resumption-server
    552 client = 14-npn-client-switch-resumption-client
    553 resume-server = 14-npn-client-switch-resumption-server
    554 resume-client = 14-npn-client-switch-resumption-resume-client
    555 
    556 [14-npn-client-switch-resumption-server]
    557 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    558 CipherString = DEFAULT
    559 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    560 
    561 [14-npn-client-switch-resumption-client]
    562 CipherString = DEFAULT
    563 MaxProtocol = TLSv1.2
    564 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    565 VerifyMode = Peer
    566 
    567 [14-npn-client-switch-resumption-resume-client]
    568 CipherString = DEFAULT
    569 MaxProtocol = TLSv1.2
    570 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    571 VerifyMode = Peer
    572 
    573 [test-14]
     614[16-npn-client-switch-resumption]
     615ssl_conf = 16-npn-client-switch-resumption-ssl
     616
     617[16-npn-client-switch-resumption-ssl]
     618server = 16-npn-client-switch-resumption-server
     619client = 16-npn-client-switch-resumption-client
     620resume-server = 16-npn-client-switch-resumption-server
     621resume-client = 16-npn-client-switch-resumption-resume-client
     622
     623[16-npn-client-switch-resumption-server]
     624Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     625CipherString = DEFAULT
     626PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     627
     628[16-npn-client-switch-resumption-client]
     629CipherString = DEFAULT
     630MaxProtocol = TLSv1.2
     631VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     632VerifyMode = Peer
     633
     634[16-npn-client-switch-resumption-resume-client]
     635CipherString = DEFAULT
     636MaxProtocol = TLSv1.2
     637VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     638VerifyMode = Peer
     639
     640[test-16]
    574641ExpectedNPNProtocol = bar
    575642HandshakeMode = Resume
    576643ResumptionExpected = Yes
    577 server = 14-npn-client-switch-resumption-server-extra
    578 resume-server = 14-npn-client-switch-resumption-server-extra
    579 client = 14-npn-client-switch-resumption-client-extra
    580 resume-client = 14-npn-client-switch-resumption-resume-client-extra
    581 
    582 [14-npn-client-switch-resumption-server-extra]
     644server = 16-npn-client-switch-resumption-server-extra
     645resume-server = 16-npn-client-switch-resumption-server-extra
     646client = 16-npn-client-switch-resumption-client-extra
     647resume-client = 16-npn-client-switch-resumption-resume-client-extra
     648
     649[16-npn-client-switch-resumption-server-extra]
    583650NPNProtocols = foo,bar,baz
    584651
    585 [14-npn-client-switch-resumption-client-extra]
     652[16-npn-client-switch-resumption-client-extra]
    586653NPNProtocols = foo,baz
    587654
    588 [14-npn-client-switch-resumption-resume-client-extra]
     655[16-npn-client-switch-resumption-resume-client-extra]
    589656NPNProtocols = bar,baz
    590657
    … …  
    592659# ===========================================================
    593660
    594 [15-npn-client-first-pref-on-mismatch-resumption]
    595 ssl_conf = 15-npn-client-first-pref-on-mismatch-resumption-ssl
    596 
    597 [15-npn-client-first-pref-on-mismatch-resumption-ssl]
    598 server = 15-npn-client-first-pref-on-mismatch-resumption-server
    599 client = 15-npn-client-first-pref-on-mismatch-resumption-client
    600 resume-server = 15-npn-client-first-pref-on-mismatch-resumption-resume-server
    601 resume-client = 15-npn-client-first-pref-on-mismatch-resumption-client
    602 
    603 [15-npn-client-first-pref-on-mismatch-resumption-server]
    604 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    605 CipherString = DEFAULT
    606 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    607 
    608 [15-npn-client-first-pref-on-mismatch-resumption-resume-server]
    609 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    610 CipherString = DEFAULT
    611 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    612 
    613 [15-npn-client-first-pref-on-mismatch-resumption-client]
    614 CipherString = DEFAULT
    615 MaxProtocol = TLSv1.2
    616 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    617 VerifyMode = Peer
    618 
    619 [test-15]
     661[17-npn-client-first-pref-on-mismatch-resumption]
     662ssl_conf = 17-npn-client-first-pref-on-mismatch-resumption-ssl
     663
     664[17-npn-client-first-pref-on-mismatch-resumption-ssl]
     665server = 17-npn-client-first-pref-on-mismatch-resumption-server
     666client = 17-npn-client-first-pref-on-mismatch-resumption-client
     667resume-server = 17-npn-client-first-pref-on-mismatch-resumption-resume-server
     668resume-client = 17-npn-client-first-pref-on-mismatch-resumption-client
     669
     670[17-npn-client-first-pref-on-mismatch-resumption-server]
     671Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     672CipherString = DEFAULT
     673PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     674
     675[17-npn-client-first-pref-on-mismatch-resumption-resume-server]
     676Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     677CipherString = DEFAULT
     678PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     679
     680[17-npn-client-first-pref-on-mismatch-resumption-client]
     681CipherString = DEFAULT
     682MaxProtocol = TLSv1.2
     683VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     684VerifyMode = Peer
     685
     686[test-17]
    620687ExpectedNPNProtocol = foo
    621688HandshakeMode = Resume
    622689ResumptionExpected = Yes
    623 server = 15-npn-client-first-pref-on-mismatch-resumption-server-extra
    624 resume-server = 15-npn-client-first-pref-on-mismatch-resumption-resume-server-extra
    625 client = 15-npn-client-first-pref-on-mismatch-resumption-client-extra
    626 resume-client = 15-npn-client-first-pref-on-mismatch-resumption-client-extra
    627 
    628 [15-npn-client-first-pref-on-mismatch-resumption-server-extra]
    629 NPNProtocols = bar
    630 
    631 [15-npn-client-first-pref-on-mismatch-resumption-resume-server-extra]
     690server = 17-npn-client-first-pref-on-mismatch-resumption-server-extra
     691resume-server = 17-npn-client-first-pref-on-mismatch-resumption-resume-server-extra
     692client = 17-npn-client-first-pref-on-mismatch-resumption-client-extra
     693resume-client = 17-npn-client-first-pref-on-mismatch-resumption-client-extra
     694
     695[17-npn-client-first-pref-on-mismatch-resumption-server-extra]
     696NPNProtocols = bar
     697
     698[17-npn-client-first-pref-on-mismatch-resumption-resume-server-extra]
    632699NPNProtocols = baz
    633700
    634 [15-npn-client-first-pref-on-mismatch-resumption-client-extra]
     701[17-npn-client-first-pref-on-mismatch-resumption-client-extra]
    635702NPNProtocols = foo,bar
    636703
    … …  
    638705# ===========================================================
    639706
    640 [16-npn-no-server-support-resumption]
    641 ssl_conf = 16-npn-no-server-support-resumption-ssl
    642 
    643 [16-npn-no-server-support-resumption-ssl]
    644 server = 16-npn-no-server-support-resumption-server
    645 client = 16-npn-no-server-support-resumption-client
    646 resume-server = 16-npn-no-server-support-resumption-resume-server
    647 resume-client = 16-npn-no-server-support-resumption-client
    648 
    649 [16-npn-no-server-support-resumption-server]
    650 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    651 CipherString = DEFAULT
    652 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    653 
    654 [16-npn-no-server-support-resumption-resume-server]
    655 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    656 CipherString = DEFAULT
    657 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    658 
    659 [16-npn-no-server-support-resumption-client]
    660 CipherString = DEFAULT
    661 MaxProtocol = TLSv1.2
    662 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    663 VerifyMode = Peer
    664 
    665 [test-16]
     707[18-npn-no-server-support-resumption]
     708ssl_conf = 18-npn-no-server-support-resumption-ssl
     709
     710[18-npn-no-server-support-resumption-ssl]
     711server = 18-npn-no-server-support-resumption-server
     712client = 18-npn-no-server-support-resumption-client
     713resume-server = 18-npn-no-server-support-resumption-resume-server
     714resume-client = 18-npn-no-server-support-resumption-client
     715
     716[18-npn-no-server-support-resumption-server]
     717Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     718CipherString = DEFAULT
     719PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     720
     721[18-npn-no-server-support-resumption-resume-server]
     722Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     723CipherString = DEFAULT
     724PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     725
     726[18-npn-no-server-support-resumption-client]
     727CipherString = DEFAULT
     728MaxProtocol = TLSv1.2
     729VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     730VerifyMode = Peer
     731
     732[test-18]
    666733HandshakeMode = Resume
    667734ResumptionExpected = Yes
    668 server = 16-npn-no-server-support-resumption-server-extra
    669 client = 16-npn-no-server-support-resumption-client-extra
    670 resume-client = 16-npn-no-server-support-resumption-client-extra
    671 
    672 [16-npn-no-server-support-resumption-server-extra]
    673 NPNProtocols = foo
    674 
    675 [16-npn-no-server-support-resumption-client-extra]
    676 NPNProtocols = foo
    677 
    678 
    679 # ===========================================================
    680 
    681 [17-npn-no-client-support-resumption]
    682 ssl_conf = 17-npn-no-client-support-resumption-ssl
    683 
    684 [17-npn-no-client-support-resumption-ssl]
    685 server = 17-npn-no-client-support-resumption-server
    686 client = 17-npn-no-client-support-resumption-client
    687 resume-server = 17-npn-no-client-support-resumption-server
    688 resume-client = 17-npn-no-client-support-resumption-resume-client
    689 
    690 [17-npn-no-client-support-resumption-server]
    691 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    692 CipherString = DEFAULT
    693 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    694 
    695 [17-npn-no-client-support-resumption-client]
    696 CipherString = DEFAULT
    697 MaxProtocol = TLSv1.2
    698 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    699 VerifyMode = Peer
    700 
    701 [17-npn-no-client-support-resumption-resume-client]
    702 CipherString = DEFAULT
    703 MaxProtocol = TLSv1.2
    704 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    705 VerifyMode = Peer
    706 
    707 [test-17]
     735server = 18-npn-no-server-support-resumption-server-extra
     736client = 18-npn-no-server-support-resumption-client-extra
     737resume-client = 18-npn-no-server-support-resumption-client-extra
     738
     739[18-npn-no-server-support-resumption-server-extra]
     740NPNProtocols = foo
     741
     742[18-npn-no-server-support-resumption-client-extra]
     743NPNProtocols = foo
     744
     745
     746# ===========================================================
     747
     748[19-npn-no-client-support-resumption]
     749ssl_conf = 19-npn-no-client-support-resumption-ssl
     750
     751[19-npn-no-client-support-resumption-ssl]
     752server = 19-npn-no-client-support-resumption-server
     753client = 19-npn-no-client-support-resumption-client
     754resume-server = 19-npn-no-client-support-resumption-server
     755resume-client = 19-npn-no-client-support-resumption-resume-client
     756
     757[19-npn-no-client-support-resumption-server]
     758Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     759CipherString = DEFAULT
     760PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     761
     762[19-npn-no-client-support-resumption-client]
     763CipherString = DEFAULT
     764MaxProtocol = TLSv1.2
     765VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     766VerifyMode = Peer
     767
     768[19-npn-no-client-support-resumption-resume-client]
     769CipherString = DEFAULT
     770MaxProtocol = TLSv1.2
     771VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     772VerifyMode = Peer
     773
     774[test-19]
    708775HandshakeMode = Resume
    709776ResumptionExpected = Yes
    710 server = 17-npn-no-client-support-resumption-server-extra
    711 resume-server = 17-npn-no-client-support-resumption-server-extra
    712 client = 17-npn-no-client-support-resumption-client-extra
    713 
    714 [17-npn-no-client-support-resumption-server-extra]
    715 NPNProtocols = foo
    716 
    717 [17-npn-no-client-support-resumption-client-extra]
    718 NPNProtocols = foo
    719 
    720 
    721 # ===========================================================
    722 
    723 [18-alpn-preferred-over-npn-resumption]
    724 ssl_conf = 18-alpn-preferred-over-npn-resumption-ssl
    725 
    726 [18-alpn-preferred-over-npn-resumption-ssl]
    727 server = 18-alpn-preferred-over-npn-resumption-server
    728 client = 18-alpn-preferred-over-npn-resumption-client
    729 resume-server = 18-alpn-preferred-over-npn-resumption-resume-server
    730 resume-client = 18-alpn-preferred-over-npn-resumption-client
    731 
    732 [18-alpn-preferred-over-npn-resumption-server]
    733 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    734 CipherString = DEFAULT
    735 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    736 
    737 [18-alpn-preferred-over-npn-resumption-resume-server]
    738 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    739 CipherString = DEFAULT
    740 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    741 
    742 [18-alpn-preferred-over-npn-resumption-client]
    743 CipherString = DEFAULT
    744 MaxProtocol = TLSv1.2
    745 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    746 VerifyMode = Peer
    747 
    748 [test-18]
     777server = 19-npn-no-client-support-resumption-server-extra
     778resume-server = 19-npn-no-client-support-resumption-server-extra
     779client = 19-npn-no-client-support-resumption-client-extra
     780
     781[19-npn-no-client-support-resumption-server-extra]
     782NPNProtocols = foo
     783
     784[19-npn-no-client-support-resumption-client-extra]
     785NPNProtocols = foo
     786
     787
     788# ===========================================================
     789
     790[20-alpn-preferred-over-npn-resumption]
     791ssl_conf = 20-alpn-preferred-over-npn-resumption-ssl
     792
     793[20-alpn-preferred-over-npn-resumption-ssl]
     794server = 20-alpn-preferred-over-npn-resumption-server
     795client = 20-alpn-preferred-over-npn-resumption-client
     796resume-server = 20-alpn-preferred-over-npn-resumption-resume-server
     797resume-client = 20-alpn-preferred-over-npn-resumption-client
     798
     799[20-alpn-preferred-over-npn-resumption-server]
     800Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     801CipherString = DEFAULT
     802PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     803
     804[20-alpn-preferred-over-npn-resumption-resume-server]
     805Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     806CipherString = DEFAULT
     807PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     808
     809[20-alpn-preferred-over-npn-resumption-client]
     810CipherString = DEFAULT
     811MaxProtocol = TLSv1.2
     812VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     813VerifyMode = Peer
     814
     815[test-20]
    749816ExpectedALPNProtocol = foo
    750817HandshakeMode = Resume
    751818ResumptionExpected = Yes
    752 server = 18-alpn-preferred-over-npn-resumption-server-extra
    753 resume-server = 18-alpn-preferred-over-npn-resumption-resume-server-extra
    754 client = 18-alpn-preferred-over-npn-resumption-client-extra
    755 resume-client = 18-alpn-preferred-over-npn-resumption-client-extra
    756 
    757 [18-alpn-preferred-over-npn-resumption-server-extra]
    758 NPNProtocols = bar
    759 
    760 [18-alpn-preferred-over-npn-resumption-resume-server-extra]
     819server = 20-alpn-preferred-over-npn-resumption-server-extra
     820resume-server = 20-alpn-preferred-over-npn-resumption-resume-server-extra
     821client = 20-alpn-preferred-over-npn-resumption-client-extra
     822resume-client = 20-alpn-preferred-over-npn-resumption-client-extra
     823
     824[20-alpn-preferred-over-npn-resumption-server-extra]
     825NPNProtocols = bar
     826
     827[20-alpn-preferred-over-npn-resumption-resume-server-extra]
    761828ALPNProtocols = foo
    762829NPNProtocols = baz
    763830
    764 [18-alpn-preferred-over-npn-resumption-client-extra]
     831[20-alpn-preferred-over-npn-resumption-client-extra]
    765832ALPNProtocols = foo
    766833NPNProtocols = bar,baz
    … …  
    769836# ===========================================================
    770837
    771 [19-npn-used-if-alpn-not-supported-resumption]
    772 ssl_conf = 19-npn-used-if-alpn-not-supported-resumption-ssl
    773 
    774 [19-npn-used-if-alpn-not-supported-resumption-ssl]
    775 server = 19-npn-used-if-alpn-not-supported-resumption-server
    776 client = 19-npn-used-if-alpn-not-supported-resumption-client
    777 resume-server = 19-npn-used-if-alpn-not-supported-resumption-resume-server
    778 resume-client = 19-npn-used-if-alpn-not-supported-resumption-client
    779 
    780 [19-npn-used-if-alpn-not-supported-resumption-server]
    781 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    782 CipherString = DEFAULT
    783 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    784 
    785 [19-npn-used-if-alpn-not-supported-resumption-resume-server]
    786 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    787 CipherString = DEFAULT
    788 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    789 
    790 [19-npn-used-if-alpn-not-supported-resumption-client]
    791 CipherString = DEFAULT
    792 MaxProtocol = TLSv1.2
    793 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    794 VerifyMode = Peer
    795 
    796 [test-19]
     838[21-npn-used-if-alpn-not-supported-resumption]
     839ssl_conf = 21-npn-used-if-alpn-not-supported-resumption-ssl
     840
     841[21-npn-used-if-alpn-not-supported-resumption-ssl]
     842server = 21-npn-used-if-alpn-not-supported-resumption-server
     843client = 21-npn-used-if-alpn-not-supported-resumption-client
     844resume-server = 21-npn-used-if-alpn-not-supported-resumption-resume-server
     845resume-client = 21-npn-used-if-alpn-not-supported-resumption-client
     846
     847[21-npn-used-if-alpn-not-supported-resumption-server]
     848Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     849CipherString = DEFAULT
     850PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     851
     852[21-npn-used-if-alpn-not-supported-resumption-resume-server]
     853Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     854CipherString = DEFAULT
     855PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     856
     857[21-npn-used-if-alpn-not-supported-resumption-client]
     858CipherString = DEFAULT
     859MaxProtocol = TLSv1.2
     860VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     861VerifyMode = Peer
     862
     863[test-21]
    797864ExpectedNPNProtocol = baz
    798865HandshakeMode = Resume
    799866ResumptionExpected = Yes
    800 server = 19-npn-used-if-alpn-not-supported-resumption-server-extra
    801 resume-server = 19-npn-used-if-alpn-not-supported-resumption-resume-server-extra
    802 client = 19-npn-used-if-alpn-not-supported-resumption-client-extra
    803 resume-client = 19-npn-used-if-alpn-not-supported-resumption-client-extra
    804 
    805 [19-npn-used-if-alpn-not-supported-resumption-server-extra]
     867server = 21-npn-used-if-alpn-not-supported-resumption-server-extra
     868resume-server = 21-npn-used-if-alpn-not-supported-resumption-resume-server-extra
     869client = 21-npn-used-if-alpn-not-supported-resumption-client-extra
     870resume-client = 21-npn-used-if-alpn-not-supported-resumption-client-extra
     871
     872[21-npn-used-if-alpn-not-supported-resumption-server-extra]
    806873ALPNProtocols = foo
    807874NPNProtocols = bar
    808875
    809 [19-npn-used-if-alpn-not-supported-resumption-resume-server-extra]
     876[21-npn-used-if-alpn-not-supported-resumption-resume-server-extra]
    810877NPNProtocols = baz
    811878
    812 [19-npn-used-if-alpn-not-supported-resumption-client-extra]
     879[21-npn-used-if-alpn-not-supported-resumption-client-extra]
    813880ALPNProtocols = foo
    814881NPNProtocols = bar,baz

  • trunk/src/libs/openssl-3.1.7/test/ssl-tests/08-npn.cnf.in

    r104078 r105945  
    11# -*- mode: perl; -*-
    2 # Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    112112    },
    113113    {
     114        name => "npn-empty-client-list",
     115        server => {
     116            extra => {
     117                "NPNProtocols" => "foo",
     118            },
     119        },
     120        client => {
     121            extra => {
     122                "NPNProtocols" => "",
     123            },
     124            "MaxProtocol" => "TLSv1.2"
     125        },
     126        test => {
     127            "ExpectedResult" => "ClientFail",
     128            "ExpectedClientAlert" => "HandshakeFailure"
     129        },
     130    },
     131    {
     132        name => "npn-empty-server-list",
     133        server => {
     134            extra => {
     135                "NPNProtocols" => "",
     136            },
     137        },
     138        client => {
     139            extra => {
     140                "NPNProtocols" => "foo",
     141            },
     142            "MaxProtocol" => "TLSv1.2"
     143        },
     144        test => {
     145            "ExpectedNPNProtocol" => "foo"
     146        },
     147    },
     148    {
    114149        name => "npn-with-sni-no-context-switch",
    115150        server => {

  • trunk/src/libs/openssl-3.1.7/test/ssl-tests/09-alpn.cnf

    r104078 r105945  
    11# Generated with generate_ssl_tests.pl
    22
    3 num_tests = 16
     3num_tests = 18
    44
    55test-0 = 0-alpn-simple
    … …  
    1919test-14 = 14-alpn-no-server-support-resumption
    2020test-15 = 15-alpn-no-client-support-resumption
     21test-16 = 16-alpn-empty-client-list
     22test-17 = 17-alpn-empty-server-list
    2123# ===========================================================
    2224
    … …  
    618620
    619621
     622# ===========================================================
     623
     624[16-alpn-empty-client-list]
     625ssl_conf = 16-alpn-empty-client-list-ssl
     626
     627[16-alpn-empty-client-list-ssl]
     628server = 16-alpn-empty-client-list-server
     629client = 16-alpn-empty-client-list-client
     630
     631[16-alpn-empty-client-list-server]
     632Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     633CipherString = DEFAULT
     634PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     635
     636[16-alpn-empty-client-list-client]
     637CipherString = DEFAULT
     638VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     639VerifyMode = Peer
     640
     641[test-16]
     642server = 16-alpn-empty-client-list-server-extra
     643client = 16-alpn-empty-client-list-client-extra
     644
     645[16-alpn-empty-client-list-server-extra]
     646ALPNProtocols = foo
     647
     648[16-alpn-empty-client-list-client-extra]
     649ALPNProtocols =
     650
     651
     652# ===========================================================
     653
     654[17-alpn-empty-server-list]
     655ssl_conf = 17-alpn-empty-server-list-ssl
     656
     657[17-alpn-empty-server-list-ssl]
     658server = 17-alpn-empty-server-list-server
     659client = 17-alpn-empty-server-list-client
     660
     661[17-alpn-empty-server-list-server]
     662Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     663CipherString = DEFAULT
     664PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     665
     666[17-alpn-empty-server-list-client]
     667CipherString = DEFAULT
     668VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     669VerifyMode = Peer
     670
     671[test-17]
     672ExpectedResult = ServerFail
     673ExpectedServerAlert = NoApplicationProtocol
     674server = 17-alpn-empty-server-list-server-extra
     675client = 17-alpn-empty-server-list-client-extra
     676
     677[17-alpn-empty-server-list-server-extra]
     678ALPNProtocols =
     679
     680[17-alpn-empty-server-list-client-extra]
     681ALPNProtocols = foo
     682
     683

  • trunk/src/libs/openssl-3.1.7/test/ssl-tests/09-alpn.cnf.in

    r104078 r105945  
    11# -*- mode: perl; -*-
    2 # Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    323323        },
    324324    },
     325    {
     326        name => "alpn-empty-client-list",
     327        server => {
     328            extra => {
     329                "ALPNProtocols" => "foo",
     330            },
     331        },
     332        client => {
     333            extra => {
     334                "ALPNProtocols" => "",
     335            },
     336        },
     337        test => {
     338            "ExpectedALPNProtocol" => undef,
     339        },
     340    },
     341    {
     342        name => "alpn-empty-server-list",
     343        server => {
     344            extra => {
     345                "ALPNProtocols" => "",
     346            },
     347        },
     348        client => {
     349            extra => {
     350                "ALPNProtocols" => "foo",
     351            },
     352        },
     353        test => {
     354            "ExpectedResult" => "ServerFail",
     355            "ExpectedServerAlert" => "NoApplicationProtocol",
     356        },
     357    },
    325358);

  • trunk/src/libs/openssl-3.1.7/test/ssl-tests/14-curves.cnf.in

    r104078 r105945  
    1313our $fips_mode;
    1414
    15 my @curves = ("prime256v1", "secp384r1", "secp521r1", "X25519",
    16               "X448");
     15my @curves = ("prime256v1", "secp384r1", "secp521r1");
     16
     17my @curves_no_fips = ("X25519", "X448");
     18
     19push @curves, @curves_no_fips if !$fips_mode;
    1720
    1821#Curves *only* suitable for use in TLSv1.3

  • trunk/src/libs/openssl-3.1.7/test/ssl-tests/20-cert-select.cnf

    r104078 r105945  
    2020test-15 = 15-Ed25519 CipherString and Signature Algorithm Selection
    2121test-16 = 16-Ed448 CipherString and Signature Algorithm Selection
    22 test-17 = 17-Ed25519 CipherString and Curves Selection
    23 test-18 = 18-Ed448 CipherString and Curves Selection
    24 test-19 = 19-TLS 1.2 Ed25519 Client Auth
    25 test-20 = 20-TLS 1.2 Ed448 Client Auth
    26 test-21 = 21-ECDSA Signature Algorithm Selection SHA1
    27 test-22 = 22-ECDSA with brainpool
     22test-17 = 17-TLS 1.2 Ed25519 Client Auth
     23test-18 = 18-TLS 1.2 Ed448 Client Auth
     24test-19 = 19-ECDSA Signature Algorithm Selection SHA1
     25test-20 = 20-ECDSA with brainpool
     26test-21 = 21-Ed25519 CipherString and Curves Selection
     27test-22 = 22-Ed448 CipherString and Curves Selection
    2828test-23 = 23-RSA-PSS Certificate CipherString Selection
    2929test-24 = 24-RSA-PSS Certificate Legacy Signature Algorithm Selection
    … …  
    603603# ===========================================================
    604604
    605 [17-Ed25519 CipherString and Curves Selection]
    606 ssl_conf = 17-Ed25519 CipherString and Curves Selection-ssl
    607 
    608 [17-Ed25519 CipherString and Curves Selection-ssl]
    609 server = 17-Ed25519 CipherString and Curves Selection-server
    610 client = 17-Ed25519 CipherString and Curves Selection-client
    611 
    612 [17-Ed25519 CipherString and Curves Selection-server]
    613 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    614 CipherString = DEFAULT
    615 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
    616 ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
    617 Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
    618 Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
    619 Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
    620 Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
    621 MaxProtocol = TLSv1.2
    622 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    623 
    624 [17-Ed25519 CipherString and Curves Selection-client]
    625 CipherString = aECDSA
    626 Curves = X25519
    627 MaxProtocol = TLSv1.2
    628 SignatureAlgorithms = ECDSA+SHA256:ed25519
    629 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
    630 VerifyMode = Peer
    631 
    632 [test-17]
    633 ExpectedResult = Success
    634 ExpectedServerCertType = Ed25519
    635 ExpectedServerSignType = Ed25519
    636 
    637 
    638 # ===========================================================
    639 
    640 [18-Ed448 CipherString and Curves Selection]
    641 ssl_conf = 18-Ed448 CipherString and Curves Selection-ssl
    642 
    643 [18-Ed448 CipherString and Curves Selection-ssl]
    644 server = 18-Ed448 CipherString and Curves Selection-server
    645 client = 18-Ed448 CipherString and Curves Selection-client
    646 
    647 [18-Ed448 CipherString and Curves Selection-server]
    648 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    649 CipherString = DEFAULT
    650 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
    651 ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
    652 Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
    653 Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
    654 Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
    655 Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
    656 MaxProtocol = TLSv1.2
    657 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    658 
    659 [18-Ed448 CipherString and Curves Selection-client]
    660 CipherString = aECDSA
    661 Curves = X448
    662 MaxProtocol = TLSv1.2
    663 SignatureAlgorithms = ECDSA+SHA256:ed448
    664 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
    665 VerifyMode = Peer
    666 
    667 [test-18]
    668 ExpectedResult = Success
    669 ExpectedServerCertType = Ed448
    670 ExpectedServerSignType = Ed448
    671 
    672 
    673 # ===========================================================
    674 
    675 [19-TLS 1.2 Ed25519 Client Auth]
    676 ssl_conf = 19-TLS 1.2 Ed25519 Client Auth-ssl
    677 
    678 [19-TLS 1.2 Ed25519 Client Auth-ssl]
    679 server = 19-TLS 1.2 Ed25519 Client Auth-server
    680 client = 19-TLS 1.2 Ed25519 Client Auth-client
    681 
    682 [19-TLS 1.2 Ed25519 Client Auth-server]
     605[17-TLS 1.2 Ed25519 Client Auth]
     606ssl_conf = 17-TLS 1.2 Ed25519 Client Auth-ssl
     607
     608[17-TLS 1.2 Ed25519 Client Auth-ssl]
     609server = 17-TLS 1.2 Ed25519 Client Auth-server
     610client = 17-TLS 1.2 Ed25519 Client Auth-client
     611
     612[17-TLS 1.2 Ed25519 Client Auth-server]
    683613Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    684614CipherString = DEFAULT
    … …  
    687617VerifyMode = Require
    688618
    689 [19-TLS 1.2 Ed25519 Client Auth-client]
     619[17-TLS 1.2 Ed25519 Client Auth-client]
    690620CipherString = DEFAULT
    691621Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
    … …  
    696626VerifyMode = Peer
    697627
    698 [test-19]
     628[test-17]
    699629ExpectedClientCertType = Ed25519
    700630ExpectedClientSignType = Ed25519
    … …  
    704634# ===========================================================
    705635
    706 [20-TLS 1.2 Ed448 Client Auth]
    707 ssl_conf = 20-TLS 1.2 Ed448 Client Auth-ssl
    708 
    709 [20-TLS 1.2 Ed448 Client Auth-ssl]
    710 server = 20-TLS 1.2 Ed448 Client Auth-server
    711 client = 20-TLS 1.2 Ed448 Client Auth-client
    712 
    713 [20-TLS 1.2 Ed448 Client Auth-server]
     636[18-TLS 1.2 Ed448 Client Auth]
     637ssl_conf = 18-TLS 1.2 Ed448 Client Auth-ssl
     638
     639[18-TLS 1.2 Ed448 Client Auth-ssl]
     640server = 18-TLS 1.2 Ed448 Client Auth-server
     641client = 18-TLS 1.2 Ed448 Client Auth-client
     642
     643[18-TLS 1.2 Ed448 Client Auth-server]
    714644Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    715645CipherString = DEFAULT
    … …  
    718648VerifyMode = Require
    719649
    720 [20-TLS 1.2 Ed448 Client Auth-client]
     650[18-TLS 1.2 Ed448 Client Auth-client]
    721651CipherString = DEFAULT
    722652Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
    … …  
    727657VerifyMode = Peer
    728658
    729 [test-20]
     659[test-18]
    730660ExpectedClientCertType = Ed448
    731661ExpectedClientSignType = Ed448
    … …  
    735665# ===========================================================
    736666
    737 [21-ECDSA Signature Algorithm Selection SHA1]
    738 ssl_conf = 21-ECDSA Signature Algorithm Selection SHA1-ssl
    739 
    740 [21-ECDSA Signature Algorithm Selection SHA1-ssl]
    741 server = 21-ECDSA Signature Algorithm Selection SHA1-server
    742 client = 21-ECDSA Signature Algorithm Selection SHA1-client
    743 
    744 [21-ECDSA Signature Algorithm Selection SHA1-server]
     667[19-ECDSA Signature Algorithm Selection SHA1]
     668ssl_conf = 19-ECDSA Signature Algorithm Selection SHA1-ssl
     669
     670[19-ECDSA Signature Algorithm Selection SHA1-ssl]
     671server = 19-ECDSA Signature Algorithm Selection SHA1-server
     672client = 19-ECDSA Signature Algorithm Selection SHA1-client
     673
     674[19-ECDSA Signature Algorithm Selection SHA1-server]
    745675Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
    746676CipherString = DEFAULT:@SECLEVEL=0
    … …  
    754684PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
    755685
    756 [21-ECDSA Signature Algorithm Selection SHA1-client]
     686[19-ECDSA Signature Algorithm Selection SHA1-client]
    757687CipherString = DEFAULT:@SECLEVEL=0
    758688SignatureAlgorithms = ECDSA+SHA1
    … …  
    760690VerifyMode = Peer
    761691
    762 [test-21]
     692[test-19]
    763693ExpectedResult = Success
    764694ExpectedServerCertType = P-256
    … …  
    769699# ===========================================================
    770700
    771 [22-ECDSA with brainpool]
    772 ssl_conf = 22-ECDSA with brainpool-ssl
    773 
    774 [22-ECDSA with brainpool-ssl]
    775 server = 22-ECDSA with brainpool-server
    776 client = 22-ECDSA with brainpool-client
    777 
    778 [22-ECDSA with brainpool-server]
     701[20-ECDSA with brainpool]
     702ssl_conf = 20-ECDSA with brainpool-ssl
     703
     704[20-ECDSA with brainpool-ssl]
     705server = 20-ECDSA with brainpool-server
     706client = 20-ECDSA with brainpool-client
     707
     708[20-ECDSA with brainpool-server]
    779709Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem
    780710CipherString = DEFAULT
    … …  
    782712PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem
    783713
    784 [22-ECDSA with brainpool-client]
     714[20-ECDSA with brainpool-client]
    785715CipherString = aECDSA
    786716Groups = brainpoolP256r1
    … …  
    790720VerifyMode = Peer
    791721
    792 [test-22]
     722[test-20]
    793723ExpectedResult = Success
    794724ExpectedServerCANames = empty
    795725ExpectedServerCertType = brainpoolP256r1
    796726ExpectedServerSignType = EC
     727
     728
     729# ===========================================================
     730
     731[21-Ed25519 CipherString and Curves Selection]
     732ssl_conf = 21-Ed25519 CipherString and Curves Selection-ssl
     733
     734[21-Ed25519 CipherString and Curves Selection-ssl]
     735server = 21-Ed25519 CipherString and Curves Selection-server
     736client = 21-Ed25519 CipherString and Curves Selection-client
     737
     738[21-Ed25519 CipherString and Curves Selection-server]
     739Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     740CipherString = DEFAULT
     741ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
     742ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
     743Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
     744Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
     745Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
     746Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
     747MaxProtocol = TLSv1.2
     748PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     749
     750[21-Ed25519 CipherString and Curves Selection-client]
     751CipherString = aECDSA
     752Curves = X25519
     753MaxProtocol = TLSv1.2
     754SignatureAlgorithms = ECDSA+SHA256:ed25519
     755VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
     756VerifyMode = Peer
     757
     758[test-21]
     759ExpectedResult = Success
     760ExpectedServerCertType = Ed25519
     761ExpectedServerSignType = Ed25519
     762
     763
     764# ===========================================================
     765
     766[22-Ed448 CipherString and Curves Selection]
     767ssl_conf = 22-Ed448 CipherString and Curves Selection-ssl
     768
     769[22-Ed448 CipherString and Curves Selection-ssl]
     770server = 22-Ed448 CipherString and Curves Selection-server
     771client = 22-Ed448 CipherString and Curves Selection-client
     772
     773[22-Ed448 CipherString and Curves Selection-server]
     774Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
     775CipherString = DEFAULT
     776ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
     777ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
     778Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
     779Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
     780Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
     781Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
     782MaxProtocol = TLSv1.2
     783PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
     784
     785[22-Ed448 CipherString and Curves Selection-client]
     786CipherString = aECDSA
     787Curves = X448
     788MaxProtocol = TLSv1.2
     789SignatureAlgorithms = ECDSA+SHA256:ed448
     790VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
     791VerifyMode = Peer
     792
     793[test-22]
     794ExpectedResult = Success
     795ExpectedServerCertType = Ed448
     796ExpectedServerSignType = Ed448
    797797
    798798

  • trunk/src/libs/openssl-3.1.7/test/ssl-tests/20-cert-select.cnf.in

    r104078 r105945  
    330330    },
    331331    {
    332         name => "Ed25519 CipherString and Curves Selection",
    333         server => $server,
    334         client => {
    335             "CipherString" => "aECDSA",
    336             "MaxProtocol" => "TLSv1.2",
    337             "SignatureAlgorithms" => "ECDSA+SHA256:ed25519",
    338             # Excluding P-256 from the supported curves list means server
    339             # certificate should be Ed25519 and not P-256
    340             "Curves" => "X25519"
    341         },
    342         test   => {
    343             "ExpectedServerCertType" =>, "Ed25519",
    344             "ExpectedServerSignType" =>, "Ed25519",
    345             "ExpectedResult" => "Success"
    346         },
    347     },
    348     {
    349         name => "Ed448 CipherString and Curves Selection",
    350         server => $server,
    351         client => {
    352             "CipherString" => "aECDSA",
    353             "MaxProtocol" => "TLSv1.2",
    354             "SignatureAlgorithms" => "ECDSA+SHA256:ed448",
    355             "VerifyCAFile" => test_pem("root-ed448-cert.pem"),
    356             # Excluding P-256 from the supported curves list means server
    357             # certificate should be Ed25519 and not P-256
    358             "Curves" => "X448"
    359         },
    360         test   => {
    361             "ExpectedServerCertType" =>, "Ed448",
    362             "ExpectedServerSignType" =>, "Ed448",
    363             "ExpectedResult" => "Success"
    364         },
    365     },
    366     {
    367332        name => "TLS 1.2 Ed25519 Client Auth",
    368333        server => {
    … …  
    444409            # Note: certificate_authorities not sent for TLS < 1.3
    445410            "ExpectedServerCANames" =>, "empty",
     411            "ExpectedResult" => "Success"
     412        },
     413    },
     414    {
     415        name => "Ed25519 CipherString and Curves Selection",
     416        server => $server,
     417        client => {
     418            "CipherString" => "aECDSA",
     419            "MaxProtocol" => "TLSv1.2",
     420            "SignatureAlgorithms" => "ECDSA+SHA256:ed25519",
     421            # Excluding P-256 from the supported curves list means server
     422            # certificate should be Ed25519 and not P-256
     423            "Curves" => "X25519"
     424        },
     425        test   => {
     426            "ExpectedServerCertType" =>, "Ed25519",
     427            "ExpectedServerSignType" =>, "Ed25519",
     428            "ExpectedResult" => "Success"
     429        },
     430    },
     431    {
     432        name => "Ed448 CipherString and Curves Selection",
     433        server => $server,
     434        client => {
     435            "CipherString" => "aECDSA",
     436            "MaxProtocol" => "TLSv1.2",
     437            "SignatureAlgorithms" => "ECDSA+SHA256:ed448",
     438            "VerifyCAFile" => test_pem("root-ed448-cert.pem"),
     439            # Excluding P-256 from the supported curves list means server
     440            # certificate should be Ed25519 and not P-256
     441            "Curves" => "X448"
     442        },
     443        test   => {
     444            "ExpectedServerCertType" =>, "Ed448",
     445            "ExpectedServerSignType" =>, "Ed448",
    446446            "ExpectedResult" => "Success"
    447447        },

  • trunk/src/libs/openssl-3.1.7/test/ssl-tests/28-seclevel.cnf.in

    r104078 r105945  
    11# -*- mode: perl; -*-
    2 # Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
     2# Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33#
    44# Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    5757                    "VerifyCAFile" => test_pem("root-ed448-cert.pem") },
    5858        test   => { "ExpectedResult" => "ServerFail" },
    59     },
     59    }
     60);
     61
     62our @tests_ec_non_fips = (
    6063    {
    6164        name => "SECLEVEL 3 with P-384 key, X25519 ECDHE",
    … …  
    8285);
    8386
     87push @tests_ec, @tests_ec_non_fips unless $fips_mode;
    8488push @tests, @tests_ec unless disabled("ec");
    8589push @tests, @tests_tls1_2 unless disabled("tls1_2") || disabled("ec");

  • trunk/src/libs/openssl-3.1.7/test/sslapitest.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    24102410}
    24112411
    2412 
    24132412#ifndef OSSL_NO_USABLE_TLS1_3
    24142413static SSL_SESSION *sesscache[6];
    … …  
    34983497}
    34993498
     3499static int check_early_data_timeout(time_t timer)
     3500{
     3501    int res = 0;
     3502
     3503    /*
     3504     * Early data is time sensitive. We have an approx 8 second allowance
     3505     * between writing the early data and reading it. If we exceed that time
     3506     * then this test will fail. This can sometimes (rarely) occur in normal CI
     3507     * operation. We can try and detect this and just ignore the result of this
     3508     * test if it has taken too long. We assume anything over 7 seconds is too
     3509     * long
     3510     */
     3511    timer = time(NULL) - timer;
     3512    if (timer >= 7)
     3513        res = TEST_skip("Test took too long, ignoring result");
     3514
     3515    return res;
     3516}
     3517
    35003518static int test_early_data_read_write(int idx)
    35013519{
    … …  
    35073525    size_t readbytes, written, eoedlen, rawread, rawwritten;
    35083526    BIO *rbio;
     3527    time_t timer;
    35093528
    35103529    if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
    … …  
    35143533
    35153534    /* Write and read some early data */
     3535    timer = time(NULL);
    35163536    if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
    35173537                                        &written))
    3518             || !TEST_size_t_eq(written, strlen(MSG1))
    3519             || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
    3520                                                 sizeof(buf), &readbytes),
    3521                             SSL_READ_EARLY_DATA_SUCCESS)
    3522             || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
     3538            || !TEST_size_t_eq(written, strlen(MSG1)))
     3539        goto end;
     3540
     3541    if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
     3542                                         &readbytes),
     3543                     SSL_READ_EARLY_DATA_SUCCESS)) {
     3544        testresult = check_early_data_timeout(timer);
     3545        goto end;
     3546    }
     3547
     3548    if (!TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
    35233549            || !TEST_int_eq(SSL_get_early_data_status(serverssl),
    35243550                            SSL_EARLY_DATA_ACCEPTED))
    … …  
    37373763    size_t readbytes, written;
    37383764    unsigned char buf[20];
     3765    time_t timer;
    37393766
    37403767    allow_ed_cb_called = 0;
    … …  
    37913818
    37923819    /* Write and read some early data */
     3820    timer = time(NULL);
    37933821    if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
    37943822                                        &written))
    … …  
    38113839        if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
    38123840                                             &readbytes),
    3813                          SSL_READ_EARLY_DATA_SUCCESS)
    3814                 || !TEST_mem_eq(MSG1, strlen(MSG1), buf, readbytes)
     3841                         SSL_READ_EARLY_DATA_SUCCESS)) {
     3842            testresult = check_early_data_timeout(timer);
     3843            goto end;
     3844        }
     3845        if (!TEST_mem_eq(MSG1, strlen(MSG1), buf, readbytes)
    38153846                   /*
    38163847                    * Server will have sent its flight so client can now send
    … …  
    39153946            goto end;
    39163947#else
    3917         if (!TEST_true(SSL_set1_groups_list(serverssl, "P-256")))
     3948        if (!TEST_true(SSL_set1_groups_list(serverssl, "P-384")))
    39183949            goto end;
    39193950#endif
    … …  
    43294360            goto end;
    43304361    } else {
     4362        time_t timer = time(NULL);
     4363
    43314364        if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
    43324365                                            &written)))
    … …  
    43344367
    43354368        if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
    4336                                              &readbytes), readearlyres)
    4337                 || (readearlyres == SSL_READ_EARLY_DATA_SUCCESS
     4369                                             &readbytes), readearlyres)) {
     4370            testresult = check_early_data_timeout(timer);
     4371            goto end;
     4372        }
     4373
     4374        if ((readearlyres == SSL_READ_EARLY_DATA_SUCCESS
    43384375                    && !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
    43394376                || !TEST_int_eq(SSL_get_early_data_status(serverssl), edstatus)
    … …  
    43734410    size_t readbytes, written;
    43744411    const SSL_CIPHER *cipher;
     4412    time_t timer;
    43754413    const char *cipher_str[] = {
    43764414        TLS1_3_RFC_AES_128_GCM_SHA256,
    … …  
    44244462
    44254463    SSL_set_connect_state(clientssl);
     4464    timer = time(NULL);
    44264465    if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
    44274466                                        &written)))
    … …  
    44304469    if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
    44314470                                         &readbytes),
    4432                                          SSL_READ_EARLY_DATA_SUCCESS)
    4433             || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
     4471                                         SSL_READ_EARLY_DATA_SUCCESS)) {
     4472        testresult = check_early_data_timeout(timer);
     4473        goto end;
     4474    }
     4475
     4476    if (!TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
    44344477            || !TEST_int_eq(SSL_get_early_data_status(serverssl),
    44354478                                                      SSL_EARLY_DATA_ACCEPTED)
    … …  
    48724915            break;
    48734916        case 4:
     4917            if (is_fips)
     4918                return TEST_skip("X25519 might not be supported by fips provider.");
    48744919            kexch_alg = NID_X25519;
    48754920            kexch_name0 = "x25519";
    48764921            break;
    48774922        case 5:
     4923            if (is_fips)
     4924                return TEST_skip("X448 might not be supported by fips provider.");
    48784925            kexch_alg = NID_X448;
    48794926            kexch_name0 = "x448";
    … …  
    50905137        expectednid = kexch_alg;
    50915138
     5139    if (is_fips && (kexch_alg == NID_X25519 || kexch_alg == NID_X448))
     5140        return TEST_skip("X25519 and X448 might not be available in fips provider.");
     5141
    50925142    if (!istls13)
    50935143        max_version = TLS1_2_VERSION;
    … …  
    55115561        goto end;
    55125562#else
    5513     if (!TEST_true(SSL_set1_groups_list(serverssl, "P-256")))
     5563    if (!TEST_true(SSL_set1_groups_list(serverssl, "P-384")))
    55145564        goto end;
    55155565#endif
    … …  
    74757525        size_t written, readbytes;
    74767526        unsigned char buf[80];
     7527        time_t timer;
    74777528
    74787529        /* early_data tests */
    … …  
    74897540
    74907541        /* Write and read some early data and then complete the connection */
     7542        timer = time(NULL);
    74917543        if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
    74927544                                            &written))
    7493                 || !TEST_size_t_eq(written, strlen(MSG1))
    7494                 || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
    7495                                                     sizeof(buf), &readbytes),
    7496                                 SSL_READ_EARLY_DATA_SUCCESS)
    7497                 || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
     7545                || !TEST_size_t_eq(written, strlen(MSG1)))
     7546            goto end;
     7547
     7548        if (!TEST_int_eq(SSL_read_early_data(serverssl, buf,
     7549                                             sizeof(buf), &readbytes),
     7550                         SSL_READ_EARLY_DATA_SUCCESS)) {
     7551            testresult = check_early_data_timeout(timer);
     7552            goto end;
     7553        }
     7554
     7555        if (!TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
    74987556                || !TEST_int_eq(SSL_get_early_data_status(serverssl),
    74997557                                SSL_EARLY_DATA_ACCEPTED)
    … …  
    89639021
    89649022/*
     9023 * Test that a session cache overflow works as expected
     9024 * Test 0: TLSv1.3, timeout on new session later than old session
     9025 * Test 1: TLSv1.2, timeout on new session later than old session
     9026 * Test 2: TLSv1.3, timeout on new session earlier than old session
     9027 * Test 3: TLSv1.2, timeout on new session earlier than old session
     9028 */
     9029#if !defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
     9030static int test_session_cache_overflow(int idx)
     9031{
     9032    SSL_CTX *sctx = NULL, *cctx = NULL;
     9033    SSL *serverssl = NULL, *clientssl = NULL;
     9034    int testresult = 0;
     9035    SSL_SESSION *sess = NULL;
     9036
     9037#ifdef OSSL_NO_USABLE_TLS1_3
     9038    /* If no TLSv1.3 available then do nothing in this case */
     9039    if (idx % 2 == 0)
     9040        return TEST_skip("No TLSv1.3 available");
     9041#endif
     9042#ifdef OPENSSL_NO_TLS1_2
     9043    /* If no TLSv1.2 available then do nothing in this case */
     9044    if (idx % 2 == 1)
     9045        return TEST_skip("No TLSv1.2 available");
     9046#endif
     9047
     9048    if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
     9049                                       TLS_client_method(), TLS1_VERSION,
     9050                                       (idx % 2 == 0) ? TLS1_3_VERSION
     9051                                                      : TLS1_2_VERSION,
     9052                                       &sctx, &cctx, cert, privkey))
     9053            || !TEST_true(SSL_CTX_set_options(sctx, SSL_OP_NO_TICKET)))
     9054        goto end;
     9055
     9056    SSL_CTX_sess_set_get_cb(sctx, get_session_cb);
     9057    get_sess_val = NULL;
     9058
     9059    SSL_CTX_sess_set_cache_size(sctx, 1);
     9060
     9061    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
     9062                                      NULL, NULL)))
     9063        goto end;
     9064
     9065    if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
     9066        goto end;
     9067
     9068    if (idx > 1) {
     9069        sess = SSL_get_session(serverssl);
     9070        if (!TEST_ptr(sess))
     9071            goto end;
     9072
     9073        /*
     9074         * Cause this session to have a longer timeout than the next session to
     9075         * be added.
     9076         */
     9077        if (!TEST_true(SSL_SESSION_set_timeout(sess, LONG_MAX / 2))) {
     9078            sess = NULL;
     9079            goto end;
     9080        }
     9081        sess = NULL;
     9082    }
     9083
     9084    SSL_shutdown(serverssl);
     9085    SSL_shutdown(clientssl);
     9086    SSL_free(serverssl);
     9087    SSL_free(clientssl);
     9088    serverssl = clientssl = NULL;
     9089
     9090    /*
     9091     * Session cache size is 1 and we already populated the cache with a session
     9092     * so the next connection should cause an overflow.
     9093     */
     9094
     9095    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
     9096                                      NULL, NULL)))
     9097        goto end;
     9098
     9099    if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
     9100        goto end;
     9101
     9102    /*
     9103     * The session we just negotiated may have been already removed from the
     9104     * internal cache - but we will return it anyway from our external cache.
     9105     */
     9106    get_sess_val = SSL_get_session(serverssl);
     9107    if (!TEST_ptr(get_sess_val))
     9108        goto end;
     9109    sess = SSL_get1_session(clientssl);
     9110    if (!TEST_ptr(sess))
     9111        goto end;
     9112
     9113    SSL_shutdown(serverssl);
     9114    SSL_shutdown(clientssl);
     9115    SSL_free(serverssl);
     9116    SSL_free(clientssl);
     9117    serverssl = clientssl = NULL;
     9118
     9119    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
     9120                                      NULL, NULL)))
     9121        goto end;
     9122
     9123    if (!TEST_true(SSL_set_session(clientssl, sess)))
     9124        goto end;
     9125
     9126    if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
     9127        goto end;
     9128
     9129    testresult = 1;
     9130
     9131 end:
     9132    SSL_free(serverssl);
     9133    SSL_free(clientssl);
     9134    SSL_CTX_free(sctx);
     9135    SSL_CTX_free(cctx);
     9136    SSL_SESSION_free(sess);
     9137
     9138    return testresult;
     9139}
     9140#endif /* !defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2) */
     9141
     9142/*
    89659143 * Test 0: Client sets servername and server acknowledges it (TLSv1.2)
    89669144 * Test 1: Client sets servername and server does not acknowledge it (TLSv1.2)
    … …  
    92779455    /* Check that we are not impacted by a provider without any groups */
    92789456    OSSL_PROVIDER *legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
    9279     const char *group_name = idx == 0 ? "xorgroup" : "xorkemgroup";
     9457    const char *group_name = idx == 0 ? "xorkemgroup" : "xorgroup";
    92809458
    92819459    if (!TEST_ptr(tlsprov))
    92829460        goto end;
    9283 
    9284     if (legacyprov == NULL) {
    9285         /*
    9286          * In this case we assume we've been built with "no-legacy" and skip
    9287          * this test (there is no OPENSSL_NO_LEGACY)
    9288          */
    9289         testresult = 1;
    9290         goto end;
    9291     }
    92929461
    92939462    if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
    … …  
    93009469        goto end;
    93019470
    9302     if (!TEST_true(SSL_set1_groups_list(serverssl, group_name))
     9471    /* ensure GROUPLIST_INCREMENT (=40) logic triggers: */
     9472    if (!TEST_true(SSL_set1_groups_list(serverssl, "xorgroup:xorkemgroup:dummy1:dummy2:dummy3:dummy4:dummy5:dummy6:dummy7:dummy8:dummy9:dummy10:dummy11:dummy12:dummy13:dummy14:dummy15:dummy16:dummy17:dummy18:dummy19:dummy20:dummy21:dummy22:dummy23:dummy24:dummy25:dummy26:dummy27:dummy28:dummy29:dummy30:dummy31:dummy32:dummy33:dummy34:dummy35:dummy36:dummy37:dummy38:dummy39:dummy40:dummy41:dummy42:dummy43"))
     9473    /* removing a single algorithm from the list makes the test pass */
    93039474            || !TEST_true(SSL_set1_groups_list(clientssl, group_name)))
    93049475        goto end;
    … …  
    1032310494
    1032410495#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE)
    10325 
    10326 static ENGINE *load_dasync(void)
    10327 {
    10328     ENGINE *e;
    10329 
    10330     if (!TEST_ptr(e = ENGINE_by_id("dasync")))
    10331         return NULL;
    10332 
    10333     if (!TEST_true(ENGINE_init(e))) {
    10334         ENGINE_free(e);
    10335         return NULL;
    10336     }
    10337 
    10338     if (!TEST_true(ENGINE_register_ciphers(e))) {
    10339         ENGINE_free(e);
    10340         return NULL;
    10341     }
    10342 
    10343     return e;
    10344 }
    10345 
    1034610496/*
    1034710497 * Test TLSv1.2 with a pipeline capable cipher. TLSv1.3 and DTLS do not
    … …  
    1063510785    BIO_free(tmp);
    1063610786    set_always_retry_err_val(-1);
     10787    return testresult;
     10788}
     10789
     10790struct resume_servername_cb_data {
     10791    int i;
     10792    SSL_CTX *cctx;
     10793    SSL_CTX *sctx;
     10794    SSL_SESSION *sess;
     10795    int recurse;
     10796};
     10797
     10798/*
     10799 * Servername callback. We use it here to run another complete handshake using
     10800 * the same session - and mark the session as not_resuamble at the end
     10801 */
     10802static int resume_servername_cb(SSL *s, int *ad, void *arg)
     10803{
     10804    struct resume_servername_cb_data *cbdata = arg;
     10805    SSL *serverssl = NULL, *clientssl = NULL;
     10806    int ret = SSL_TLSEXT_ERR_ALERT_FATAL;
     10807
     10808    if (cbdata->recurse)
     10809        return SSL_TLSEXT_ERR_ALERT_FATAL;
     10810
     10811    if ((cbdata->i % 3) != 1)
     10812        return SSL_TLSEXT_ERR_OK;
     10813
     10814    cbdata->recurse = 1;
     10815
     10816    if (!TEST_true(create_ssl_objects(cbdata->sctx, cbdata->cctx, &serverssl,
     10817                                      &clientssl, NULL, NULL))
     10818            || !TEST_true(SSL_set_session(clientssl, cbdata->sess)))
     10819        goto end;
     10820
     10821    ERR_set_mark();
     10822    /*
     10823     * We expect this to fail - because the servername cb will fail. This will
     10824     * mark the session as not_resumable.
     10825     */
     10826    if (!TEST_false(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) {
     10827        ERR_clear_last_mark();
     10828        goto end;
     10829    }
     10830    ERR_pop_to_mark();
     10831
     10832    ret = SSL_TLSEXT_ERR_OK;
     10833 end:
     10834    SSL_free(serverssl);
     10835    SSL_free(clientssl);
     10836    cbdata->recurse = 0;
     10837    return ret;
     10838}
     10839
     10840/*
     10841 * Test multiple resumptions and cache size handling
     10842 * Test 0: TLSv1.3 (max_early_data set)
     10843 * Test 1: TLSv1.3 (SSL_OP_NO_TICKET set)
     10844 * Test 2: TLSv1.3 (max_early_data and SSL_OP_NO_TICKET set)
     10845 * Test 3: TLSv1.3 (SSL_OP_NO_TICKET, simultaneous resumes)
     10846 * Test 4: TLSv1.2
     10847 */
     10848static int test_multi_resume(int idx)
     10849{
     10850    SSL_CTX *sctx = NULL, *cctx = NULL;
     10851    SSL *serverssl = NULL, *clientssl = NULL;
     10852    SSL_SESSION *sess = NULL;
     10853    int max_version = TLS1_3_VERSION;
     10854    int i, testresult = 0;
     10855    struct resume_servername_cb_data cbdata;
     10856
     10857#if defined(OPENSSL_NO_TLS1_2)
     10858    if (idx == 4)
     10859        return TEST_skip("TLSv1.2 is disabled in this build");
     10860#else
     10861    if (idx == 4)
     10862        max_version = TLS1_2_VERSION;
     10863#endif
     10864#if defined(OSSL_NO_USABLE_TLS1_3)
     10865    if (idx != 4)
     10866        return TEST_skip("No usable TLSv1.3 in this build");
     10867#endif
     10868
     10869    if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
     10870                                       TLS_client_method(), TLS1_VERSION,
     10871                                       max_version, &sctx, &cctx, cert,
     10872                                       privkey)))
     10873        goto end;
     10874
     10875    /*
     10876     * TLSv1.3 only uses a session cache if either max_early_data > 0 (used for
     10877     * replay protection), or if SSL_OP_NO_TICKET is in use
     10878     */
     10879    if (idx == 0 || idx == 2)  {
     10880        if (!TEST_true(SSL_CTX_set_max_early_data(sctx, 1024)))
     10881            goto end;
     10882    }
     10883    if (idx == 1 || idx == 2 || idx == 3)
     10884        SSL_CTX_set_options(sctx, SSL_OP_NO_TICKET);
     10885
     10886    SSL_CTX_sess_set_cache_size(sctx, 5);
     10887
     10888    if (idx == 3) {
     10889        SSL_CTX_set_tlsext_servername_callback(sctx, resume_servername_cb);
     10890        SSL_CTX_set_tlsext_servername_arg(sctx, &cbdata);
     10891        cbdata.cctx = cctx;
     10892        cbdata.sctx = sctx;
     10893        cbdata.recurse = 0;
     10894    }
     10895
     10896    for (i = 0; i < 30; i++) {
     10897        if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
     10898                                                NULL, NULL))
     10899                || !TEST_true(SSL_set_session(clientssl, sess)))
     10900            goto end;
     10901
     10902        /*
     10903         * Check simultaneous resumes. We pause the connection part way through
     10904         * the handshake by (mis)using the servername_cb. The pause occurs after
     10905         * session resumption has already occurred, but before any session
     10906         * tickets have been issued. While paused we run another complete
     10907         * handshake resuming the same session.
     10908         */
     10909        if (idx == 3) {
     10910            cbdata.i = i;
     10911            cbdata.sess = sess;
     10912        }
     10913
     10914        /*
     10915         * Recreate a bug where dynamically changing the max_early_data value
     10916         * can cause sessions in the session cache which cannot be deleted.
     10917         */
     10918        if ((idx == 0 || idx == 2) && (i % 3) == 2)
     10919            SSL_set_max_early_data(serverssl, 0);
     10920
     10921        if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
     10922            goto end;
     10923
     10924        if (sess == NULL || (idx == 0 && (i % 3) == 2)) {
     10925            if (!TEST_false(SSL_session_reused(clientssl)))
     10926                goto end;
     10927        } else {
     10928            if (!TEST_true(SSL_session_reused(clientssl)))
     10929                goto end;
     10930        }
     10931        SSL_SESSION_free(sess);
     10932
     10933        /* Do a full handshake, followed by two resumptions */
     10934        if ((i % 3) == 2) {
     10935            sess = NULL;
     10936        } else {
     10937            if (!TEST_ptr((sess = SSL_get1_session(clientssl))))
     10938                goto end;
     10939        }
     10940
     10941        SSL_shutdown(clientssl);
     10942        SSL_shutdown(serverssl);
     10943        SSL_free(serverssl);
     10944        SSL_free(clientssl);
     10945        serverssl = clientssl = NULL;
     10946    }
     10947
     10948    /* We should never exceed the session cache size limit */
     10949    if (!TEST_long_le(SSL_CTX_sess_number(sctx), 5))
     10950        goto end;
     10951
     10952    testresult = 1;
     10953 end:
     10954    SSL_free(serverssl);
     10955    SSL_free(clientssl);
     10956    SSL_CTX_free(sctx);
     10957    SSL_CTX_free(cctx);
     10958    SSL_SESSION_free(sess);
     10959    return testresult;
     10960}
     10961
     10962static struct next_proto_st {
     10963    int serverlen;
     10964    unsigned char server[40];
     10965    int clientlen;
     10966    unsigned char client[40];
     10967    int expected_ret;
     10968    size_t selectedlen;
     10969    unsigned char selected[40];
     10970} next_proto_tests[] = {
     10971    {
     10972        4, { 3, 'a', 'b', 'c' },
     10973        4, { 3, 'a', 'b', 'c' },
     10974        OPENSSL_NPN_NEGOTIATED,
     10975        3, { 'a', 'b', 'c' }
     10976    },
     10977    {
     10978        7, { 3, 'a', 'b', 'c', 2, 'a', 'b' },
     10979        4, { 3, 'a', 'b', 'c' },
     10980        OPENSSL_NPN_NEGOTIATED,
     10981        3, { 'a', 'b', 'c' }
     10982    },
     10983    {
     10984        7, { 2, 'a', 'b', 3, 'a', 'b', 'c', },
     10985        4, { 3, 'a', 'b', 'c' },
     10986        OPENSSL_NPN_NEGOTIATED,
     10987        3, { 'a', 'b', 'c' }
     10988    },
     10989    {
     10990        4, { 3, 'a', 'b', 'c' },
     10991        7, { 3, 'a', 'b', 'c', 2, 'a', 'b', },
     10992        OPENSSL_NPN_NEGOTIATED,
     10993        3, { 'a', 'b', 'c' }
     10994    },
     10995    {
     10996        4, { 3, 'a', 'b', 'c' },
     10997        7, { 2, 'a', 'b', 3, 'a', 'b', 'c'},
     10998        OPENSSL_NPN_NEGOTIATED,
     10999        3, { 'a', 'b', 'c' }
     11000    },
     11001    {
     11002        7, { 2, 'b', 'c', 3, 'a', 'b', 'c' },
     11003        7, { 2, 'a', 'b', 3, 'a', 'b', 'c'},
     11004        OPENSSL_NPN_NEGOTIATED,
     11005        3, { 'a', 'b', 'c' }
     11006    },
     11007    {
     11008        10, { 2, 'b', 'c', 3, 'a', 'b', 'c', 2, 'a', 'b' },
     11009        7, { 2, 'a', 'b', 3, 'a', 'b', 'c'},
     11010        OPENSSL_NPN_NEGOTIATED,
     11011        3, { 'a', 'b', 'c' }
     11012    },
     11013    {
     11014        4, { 3, 'b', 'c', 'd' },
     11015        4, { 3, 'a', 'b', 'c' },
     11016        OPENSSL_NPN_NO_OVERLAP,
     11017        3, { 'a', 'b', 'c' }
     11018    },
     11019    {
     11020        0, { 0 },
     11021        4, { 3, 'a', 'b', 'c' },
     11022        OPENSSL_NPN_NO_OVERLAP,
     11023        3, { 'a', 'b', 'c' }
     11024    },
     11025    {
     11026        -1, { 0 },
     11027        4, { 3, 'a', 'b', 'c' },
     11028        OPENSSL_NPN_NO_OVERLAP,
     11029        3, { 'a', 'b', 'c' }
     11030    },
     11031    {
     11032        4, { 3, 'a', 'b', 'c' },
     11033        0, { 0 },
     11034        OPENSSL_NPN_NO_OVERLAP,
     11035        0, { 0 }
     11036    },
     11037    {
     11038        4, { 3, 'a', 'b', 'c' },
     11039        -1, { 0 },
     11040        OPENSSL_NPN_NO_OVERLAP,
     11041        0, { 0 }
     11042    },
     11043    {
     11044        3, { 3, 'a', 'b', 'c' },
     11045        4, { 3, 'a', 'b', 'c' },
     11046        OPENSSL_NPN_NO_OVERLAP,
     11047        3, { 'a', 'b', 'c' }
     11048    },
     11049    {
     11050        4, { 3, 'a', 'b', 'c' },
     11051        3, { 3, 'a', 'b', 'c' },
     11052        OPENSSL_NPN_NO_OVERLAP,
     11053        0, { 0 }
     11054    }
     11055};
     11056
     11057static int test_select_next_proto(int idx)
     11058{
     11059    struct next_proto_st *np = &next_proto_tests[idx];
     11060    int ret = 0;
     11061    unsigned char *out, *client, *server;
     11062    unsigned char outlen;
     11063    unsigned int clientlen, serverlen;
     11064
     11065    if (np->clientlen == -1) {
     11066        client = NULL;
     11067        clientlen = 0;
     11068    } else {
     11069        client = np->client;
     11070        clientlen = (unsigned int)np->clientlen;
     11071    }
     11072    if (np->serverlen == -1) {
     11073        server = NULL;
     11074        serverlen = 0;
     11075    } else {
     11076        server = np->server;
     11077        serverlen = (unsigned int)np->serverlen;
     11078    }
     11079
     11080    if (!TEST_int_eq(SSL_select_next_proto(&out, &outlen, server, serverlen,
     11081                                           client, clientlen),
     11082                     np->expected_ret))
     11083        goto err;
     11084
     11085    if (np->selectedlen == 0) {
     11086        if (!TEST_ptr_null(out) || !TEST_uchar_eq(outlen, 0))
     11087            goto err;
     11088    } else {
     11089        if (!TEST_mem_eq(out, outlen, np->selected, np->selectedlen))
     11090            goto err;
     11091    }
     11092
     11093    ret = 1;
     11094 err:
     11095    return ret;
     11096}
     11097
     11098static const unsigned char fooprot[] = {3, 'f', 'o', 'o' };
     11099static const unsigned char barprot[] = {3, 'b', 'a', 'r' };
     11100
     11101#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_NEXTPROTONEG)
     11102static int npn_advert_cb(SSL *ssl, const unsigned char **out,
     11103                         unsigned int *outlen, void *arg)
     11104{
     11105    int *idx = (int *)arg;
     11106
     11107    switch (*idx) {
     11108    default:
     11109    case 0:
     11110        *out = fooprot;
     11111        *outlen = sizeof(fooprot);
     11112        return SSL_TLSEXT_ERR_OK;
     11113
     11114    case 1:
     11115        *outlen = 0;
     11116        return SSL_TLSEXT_ERR_OK;
     11117
     11118    case 2:
     11119        return SSL_TLSEXT_ERR_NOACK;
     11120    }
     11121}
     11122
     11123static int npn_select_cb(SSL *s, unsigned char **out, unsigned char *outlen,
     11124                         const unsigned char *in, unsigned int inlen, void *arg)
     11125{
     11126    int *idx = (int *)arg;
     11127
     11128    switch (*idx) {
     11129    case 0:
     11130    case 1:
     11131        *out = (unsigned char *)(fooprot + 1);
     11132        *outlen = *fooprot;
     11133        return SSL_TLSEXT_ERR_OK;
     11134
     11135    case 3:
     11136        *out = (unsigned char *)(barprot + 1);
     11137        *outlen = *barprot;
     11138        return SSL_TLSEXT_ERR_OK;
     11139
     11140    case 4:
     11141        *outlen = 0;
     11142        return SSL_TLSEXT_ERR_OK;
     11143
     11144    default:
     11145    case 2:
     11146        return SSL_TLSEXT_ERR_ALERT_FATAL;
     11147    }
     11148}
     11149
     11150/*
     11151 * Test the NPN callbacks
     11152 * Test 0: advert = foo, select = foo
     11153 * Test 1: advert = <empty>, select = foo
     11154 * Test 2: no advert
     11155 * Test 3: advert = foo, select = bar
     11156 * Test 4: advert = foo, select = <empty> (should fail)
     11157 */
     11158static int test_npn(int idx)
     11159{
     11160    SSL_CTX *sctx = NULL, *cctx = NULL;
     11161    SSL *serverssl = NULL, *clientssl = NULL;
     11162    int testresult = 0;
     11163
     11164    if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
     11165                                       TLS_client_method(), 0, TLS1_2_VERSION,
     11166                                       &sctx, &cctx, cert, privkey)))
     11167        goto end;
     11168
     11169    SSL_CTX_set_next_protos_advertised_cb(sctx, npn_advert_cb, &idx);
     11170    SSL_CTX_set_next_proto_select_cb(cctx, npn_select_cb, &idx);
     11171
     11172    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
     11173                                      NULL)))
     11174        goto end;
     11175
     11176    if (idx == 4) {
     11177        /* We don't allow empty selection of NPN, so this should fail */
     11178        if (!TEST_false(create_ssl_connection(serverssl, clientssl,
     11179                                              SSL_ERROR_NONE)))
     11180            goto end;
     11181    } else {
     11182        const unsigned char *prot;
     11183        unsigned int protlen;
     11184
     11185        if (!TEST_true(create_ssl_connection(serverssl, clientssl,
     11186                                             SSL_ERROR_NONE)))
     11187            goto end;
     11188
     11189        SSL_get0_next_proto_negotiated(serverssl, &prot, &protlen);
     11190        switch (idx) {
     11191        case 0:
     11192        case 1:
     11193            if (!TEST_mem_eq(prot, protlen, fooprot + 1, *fooprot))
     11194                goto end;
     11195            break;
     11196        case 2:
     11197            if (!TEST_uint_eq(protlen, 0))
     11198                goto end;
     11199            break;
     11200        case 3:
     11201            if (!TEST_mem_eq(prot, protlen, barprot + 1, *barprot))
     11202                goto end;
     11203            break;
     11204        default:
     11205            TEST_error("Should not get here");
     11206            goto end;
     11207        }
     11208    }
     11209
     11210    testresult = 1;
     11211 end:
     11212    SSL_free(serverssl);
     11213    SSL_free(clientssl);
     11214    SSL_CTX_free(sctx);
     11215    SSL_CTX_free(cctx);
     11216
     11217    return testresult;
     11218}
     11219#endif /* !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_NEXTPROTONEG) */
     11220
     11221static int alpn_select_cb2(SSL *ssl, const unsigned char **out,
     11222                           unsigned char *outlen, const unsigned char *in,
     11223                           unsigned int inlen, void *arg)
     11224{
     11225    int *idx = (int *)arg;
     11226
     11227    switch (*idx) {
     11228    case 0:
     11229        *out = (unsigned char *)(fooprot + 1);
     11230        *outlen = *fooprot;
     11231        return SSL_TLSEXT_ERR_OK;
     11232
     11233    case 2:
     11234        *out = (unsigned char *)(barprot + 1);
     11235        *outlen = *barprot;
     11236        return SSL_TLSEXT_ERR_OK;
     11237
     11238    case 3:
     11239        *outlen = 0;
     11240        return SSL_TLSEXT_ERR_OK;
     11241
     11242    default:
     11243    case 1:
     11244        return SSL_TLSEXT_ERR_ALERT_FATAL;
     11245    }
     11246    return 0;
     11247}
     11248
     11249/*
     11250 * Test the ALPN callbacks
     11251 * Test 0: client = foo, select = foo
     11252 * Test 1: client = <empty>, select = none
     11253 * Test 2: client = foo, select = bar (should fail)
     11254 * Test 3: client = foo, select = <empty> (should fail)
     11255 */
     11256static int test_alpn(int idx)
     11257{
     11258    SSL_CTX *sctx = NULL, *cctx = NULL;
     11259    SSL *serverssl = NULL, *clientssl = NULL;
     11260    int testresult = 0;
     11261    const unsigned char *prots = fooprot;
     11262    unsigned int protslen = sizeof(fooprot);
     11263
     11264    if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
     11265                                       TLS_client_method(), 0, 0,
     11266                                       &sctx, &cctx, cert, privkey)))
     11267        goto end;
     11268
     11269    SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb2, &idx);
     11270
     11271    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
     11272                                      NULL)))
     11273        goto end;
     11274
     11275    if (idx == 1) {
     11276        prots = NULL;
     11277        protslen = 0;
     11278    }
     11279
     11280    /* SSL_set_alpn_protos returns 0 for success! */
     11281    if (!TEST_false(SSL_set_alpn_protos(clientssl, prots, protslen)))
     11282        goto end;
     11283
     11284    if (idx == 2 || idx == 3) {
     11285        /* We don't allow empty selection of NPN, so this should fail */
     11286        if (!TEST_false(create_ssl_connection(serverssl, clientssl,
     11287                                              SSL_ERROR_NONE)))
     11288            goto end;
     11289    } else {
     11290        const unsigned char *prot;
     11291        unsigned int protlen;
     11292
     11293        if (!TEST_true(create_ssl_connection(serverssl, clientssl,
     11294                                             SSL_ERROR_NONE)))
     11295            goto end;
     11296
     11297        SSL_get0_alpn_selected(clientssl, &prot, &protlen);
     11298        switch (idx) {
     11299        case 0:
     11300            if (!TEST_mem_eq(prot, protlen, fooprot + 1, *fooprot))
     11301                goto end;
     11302            break;
     11303        case 1:
     11304            if (!TEST_uint_eq(protlen, 0))
     11305                goto end;
     11306            break;
     11307        default:
     11308            TEST_error("Should not get here");
     11309            goto end;
     11310        }
     11311    }
     11312
     11313    testresult = 1;
     11314 end:
     11315    SSL_free(serverssl);
     11316    SSL_free(clientssl);
     11317    SSL_CTX_free(sctx);
     11318    SSL_CTX_free(cctx);
     11319
    1063711320    return testresult;
    1063811321}
    … …  
    1092311606    ADD_TEST(test_set_verify_cert_store_ssl);
    1092411607    ADD_ALL_TESTS(test_session_timeout, 1);
     11608#if !defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
     11609    ADD_ALL_TESTS(test_session_cache_overflow, 4);
     11610#endif
    1092511611    ADD_TEST(test_load_dhfile);
    1092611612#ifndef OSSL_NO_USABLE_TLS1_3
    … …  
    1093511621#endif
    1093611622    ADD_ALL_TESTS(test_handshake_retry, 16);
     11623    ADD_ALL_TESTS(test_multi_resume, 5);
     11624    ADD_ALL_TESTS(test_select_next_proto, OSSL_NELEM(next_proto_tests));
     11625#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_NEXTPROTONEG)
     11626    ADD_ALL_TESTS(test_npn, 5);
     11627#endif
     11628    ADD_ALL_TESTS(test_alpn, 4);
    1093711629    return 1;
    1093811630

  • trunk/src/libs/openssl-3.1.7/test/sslbuffertest.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License");
    … …  
    99 */
    1010
     11/*
     12 * We need access to the deprecated low level Engine APIs for legacy purposes
     13 * when the deprecated calls are not hidden
     14 */
     15#ifndef OPENSSL_NO_DEPRECATED_3_0
     16# define OPENSSL_SUPPRESS_DEPRECATED
     17#endif
     18
    1119#include <string.h>
    1220#include <openssl/ssl.h>
    1321#include <openssl/bio.h>
    1422#include <openssl/err.h>
     23#include <openssl/engine.h>
    1524
    1625#include "internal/packet.h"
    … …  
    151160}
    152161
     162/*
     163 * Test that attempting to free the buffers at points where they cannot be freed
     164 * works as expected
     165 * Test 0: Attempt to free buffers after a full record has been processed, but
     166 *         the application has only performed a partial read
     167 * Test 1: Attempt to free buffers after only a partial record header has been
     168 *         received
     169 * Test 2: Attempt to free buffers after a full record header but no record body
     170 * Test 3: Attempt to free buffers after a full record hedaer and partial record
     171 *         body
     172 * Test 4-7: We repeat tests 0-3 but including data from a second pipelined
     173 *           record
     174 */
     175static int test_free_buffers(int test)
     176{
     177    int result = 0;
     178    SSL *serverssl = NULL, *clientssl = NULL;
     179    const char testdata[] = "Test data";
     180    char buf[120];
     181    size_t written, readbytes;
     182    int i, pipeline = test > 3;
     183    ENGINE *e = NULL;
     184
     185    if (pipeline) {
     186        e = load_dasync();
     187        if (e == NULL)
     188            goto end;
     189        test -= 4;
     190    }
     191
     192    if (!TEST_true(create_ssl_objects(serverctx, clientctx, &serverssl,
     193                                      &clientssl, NULL, NULL)))
     194        goto end;
     195
     196    if (pipeline) {
     197        if (!TEST_true(SSL_set_cipher_list(serverssl, "AES128-SHA"))
     198                || !TEST_true(SSL_set_max_proto_version(serverssl,
     199                                                        TLS1_2_VERSION))
     200                || !TEST_true(SSL_set_max_pipelines(serverssl, 2)))
     201            goto end;
     202    }
     203
     204    if (!TEST_true(create_ssl_connection(serverssl, clientssl,
     205                                         SSL_ERROR_NONE)))
     206        goto end;
     207
     208    /*
     209     * For the non-pipeline case we write one record. For pipelining we write
     210     * two records.
     211     */
     212    for (i = 0; i <= pipeline; i++) {
     213        if (!TEST_true(SSL_write_ex(clientssl, testdata, strlen(testdata),
     214                                    &written)))
     215            goto end;
     216    }
     217
     218    if (test == 0) {
     219        size_t readlen = 1;
     220
     221        /*
     222         * Deliberately only read the first byte - so the remaining bytes are
     223         * still buffered. In the pipelining case we read as far as the first
     224         * byte from the second record.
     225         */
     226        if (pipeline)
     227            readlen += strlen(testdata);
     228
     229        if (!TEST_true(SSL_read_ex(serverssl, buf, readlen, &readbytes))
     230                || !TEST_size_t_eq(readlen, readbytes))
     231            goto end;
     232    } else {
     233        BIO *tmp;
     234        size_t partial_len;
     235
     236        /* Remove all the data that is pending for read by the server */
     237        tmp = SSL_get_rbio(serverssl);
     238        if (!TEST_true(BIO_read_ex(tmp, buf, sizeof(buf), &readbytes))
     239                || !TEST_size_t_lt(readbytes, sizeof(buf))
     240                || !TEST_size_t_gt(readbytes, SSL3_RT_HEADER_LENGTH))
     241            goto end;
     242
     243        switch(test) {
     244        case 1:
     245            partial_len = SSL3_RT_HEADER_LENGTH - 1;
     246            break;
     247        case 2:
     248            partial_len = SSL3_RT_HEADER_LENGTH;
     249            break;
     250        case 3:
     251            partial_len = readbytes - 1;
     252            break;
     253        default:
     254            TEST_error("Invalid test index");
     255            goto end;
     256        }
     257
     258        if (pipeline) {
     259            /* We happen to know the first record is 57 bytes long */
     260            const size_t first_rec_len = 57;
     261
     262            if (test != 3)
     263                partial_len += first_rec_len;
     264
     265            /*
     266             * Sanity check. If we got the record len right then this should
     267             * never fail.
     268             */
     269            if (!TEST_int_eq(buf[first_rec_len], SSL3_RT_APPLICATION_DATA))
     270                goto end;
     271        }
     272
     273        /*
     274         * Put back just the partial record (plus the whole initial record in
     275         * the pipelining case)
     276         */
     277        if (!TEST_true(BIO_write_ex(tmp, buf, partial_len, &written)))
     278            goto end;
     279
     280        if (pipeline) {
     281            /*
     282             * Attempt a read. This should pass but only return data from the
     283             * first record. Only a partial record is available for the second
     284             * record.
     285             */
     286            if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf),
     287                                        &readbytes))
     288                    || !TEST_size_t_eq(readbytes, strlen(testdata)))
     289                goto end;
     290        } else {
     291            /*
     292            * Attempt a read. This should fail because only a partial record is
     293            * available.
     294            */
     295            if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf),
     296                                        &readbytes)))
     297                goto end;
     298        }
     299    }
     300
     301    /*
     302     * Attempting to free the buffers at this point should fail because they are
     303     * still in use
     304     */
     305    if (!TEST_false(SSL_free_buffers(serverssl)))
     306        goto end;
     307
     308    result = 1;
     309 end:
     310    SSL_free(clientssl);
     311    SSL_free(serverssl);
     312#ifndef OPENSSL_NO_DYNAMIC_ENGINE
     313    if (e != NULL) {
     314        ENGINE_unregister_ciphers(e);
     315        ENGINE_finish(e);
     316        ENGINE_free(e);
     317    }
     318#endif
     319    return result;
     320}
     321
    153322OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
    154323
    … …  
    174343
    175344    ADD_ALL_TESTS(test_func, 9);
     345#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE)
     346    ADD_ALL_TESTS(test_free_buffers, 8);
     347#else
     348    ADD_ALL_TESTS(test_free_buffers, 4);
     349#endif
    176350    return 1;
    177351}

  • trunk/src/libs/openssl-3.1.7/test/test.cnf

    r104078 r105945  
    7373emailAddress                    = email field
    7474emailAddress_value              = [email protected]
     75
     76[ dirname_sec ]
     77C  = UK
     78O  = My Organization
     79OU = My Unit
     80CN = My Name

  • trunk/src/libs/openssl-3.1.7/test/tls-provider.c

    r104078 r105945  
    11/*
    2  * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    186186
    187187    /* Register our 2 groups */
     188    OPENSSL_assert(xor_group.group_id >= 65024
     189                   && xor_group.group_id < 65279 - NUM_DUMMY_GROUPS);
    188190    ret = cb(xor_group_params, arg);
    189191    ret &= cb(xor_kemgroup_params, arg);
    … …  
    197199    for (i = 0; i < NUM_DUMMY_GROUPS; i++) {
    198200        OSSL_PARAM dummygroup[OSSL_NELEM(xor_group_params)];
     201        unsigned int dummygroup_id;
    199202
    200203        memcpy(dummygroup, xor_group_params, sizeof(xor_group_params));
    … …  
    211214        dummygroup[0].data = dummy_group_names[i];
    212215        dummygroup[0].data_size = strlen(dummy_group_names[i]) + 1;
     216        /* assign unique group IDs also to dummy groups for registration */
     217        dummygroup_id = 65279 - NUM_DUMMY_GROUPS + i;
     218        dummygroup[3].data = (unsigned char*)&dummygroup_id;
    213219        ret &= cb(dummygroup, arg);
    214220    }
    … …  
    818824    /*
    819825     * Ensure group_id is within the IANA Reserved for private use range
    820      * (65024-65279)
     826     * (65024-65279).
     827     * Carve out NUM_DUMMY_GROUPS ids for properly registering those.
    821828     */
    822     group_id %= 65279 - 65024;
     829    group_id %= 65279 - NUM_DUMMY_GROUPS - 65024;
    823830    group_id += 65024;
    824831

  • trunk/src/libs/openssl-3.1.7/test/v3ext.c

    r104078 r105945  
    11/*
    2  * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
     2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    33 *
    44 * Licensed under the Apache License 2.0 (the "License").  You may not use
    … …  
    270270    if (!ASN1_OCTET_STRING_set(f1->addressFamily, key, keylen))
    271271        goto end;
     272
     273    /* Push and transfer memory ownership to stack */
    272274    if (!sk_IPAddressFamily_push(addr, f1))
    273275        goto end;
     276    f1 = NULL;
    274277
    275278    /* Shouldn't be able to canonize this as the len is > 3*/
    … …  
    277280        goto end;
    278281
    279     /* Create a well formed IPAddressFamily */
    280     f1 = sk_IPAddressFamily_pop(addr);
    281     IPAddressFamily_free(f1);
    282 
     282    /* Pop and free the new stack element */
     283    IPAddressFamily_free(sk_IPAddressFamily_pop(addr));
     284
     285    /* Create a well-formed IPAddressFamily */
    283286    key[0] = (afi >> 8) & 0xFF;
    284287    key[1] = afi & 0xFF;
    … …  
    298301    /* Mark this as inheritance so we skip some of the is_canonize checks */
    299302    f1->ipAddressChoice->type = IPAddressChoice_inherit;
     303
     304    /* Push and transfer memory ownership to stack */
    300305    if (!sk_IPAddressFamily_push(addr, f1))
    301306        goto end;
     307    f1 = NULL;
    302308
    303309    /* Should be able to canonize now */
    … …  
    307313    testresult = 1;
    308314  end:
     315    /* Free stack and any memory owned by detached element */
     316    IPAddressFamily_free(f1);
    309317    sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
     318
    310319    ASN1_OCTET_STRING_free(ip1);
    311320    ASN1_OCTET_STRING_free(ip2);
Note: See TracChangeset for help on using the changeset viewer.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette