summaryrefslogtreecommitdiff
path: root/tests/suite
Commit message (Collapse)AuthorAgeFilesLines
* tls-sig: check RSA-PSS signature key compatibility also in TLS 1.2Daiki Ueno2019-01-091-4/+2
| | | | | | | | | This extends commit 51d21634 to cover the optional TLS 1.2 cases, which RFC 8446 4.2.3 suggests: "Implementations that advertise support for RSASSA-PSS (which is mandatory in TLS 1.3) MUST be prepared to accept a signature using that scheme even when TLS 1.2 is negotiated". Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tlsfuzzer: update to the latest upstream for the TLS 1.2 CV testsDaiki Ueno2019-01-092-0/+0
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* testrandom.sh: Fix endless looptmp-testrandom.shTim Rühsen2018-12-201-3/+3
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* tlsfuzzer: update to the latest upstream to eanble CCS teststmp-ccs-tls13Daiki Ueno2018-12-104-0/+6
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* serv: add --maxearlydata optionDaiki Ueno2018-11-181-0/+18
| | | | | | Also exercise this in testcompat-tls13-openssl.sh. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'tmp-0rtt' into 'master'Daiki Ueno2018-11-121-0/+54
|\ | | | | | | | | | | | | add support for 0-RTT Closes #127 See merge request gnutls/gnutls!775
| * testcompat-tls13-openssl: exercise early data transmissionDaiki Ueno2018-11-121-0/+54
| | | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | tls13: use system's openssl for interop testingNikos Mavrogiannopoulos2018-11-102-6/+8
|/ | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* testcompat-openssl: do not test DSS or small curves with 1.1.1tmp-fix-ci-runsNikos Mavrogiannopoulos2018-11-071-25/+39
| | | | | | | DSA uses 1024-bit parameters, and these together with curves of less than 256 bits are not accepted by debian's openssl. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tlsfuzzer: updated to latest upstream and enabled new teststmp-update-tlsfuzzerNikos Mavrogiannopoulos2018-10-165-4/+72
| | | | | | Resolves: #591 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Fix check for GNU C compiler in eina_cpu.ctmp-fix-eina-cpu-on-solarisTim Rühsen2018-10-091-2/+2
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* tlsfuzzer: disable SSL3.0 in export-ciphers-rejected testDmitry Eremin-Solenikov2018-09-271-1/+21
| | | | | | | | These tests will fail with SSL3.0-enabled gnutls-serv unless --ssl3 option was passed. We will run these tests anyway from gnutls-nocert-ssl3.json, so disable them here. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tlsfuzzer: support running from separate build dirDmitry Eremin-Solenikov2018-09-272-10/+9
| | | | | | | Adapt tls-fuzzer-common.sh script to be able to run tests in case srcdir != builddir. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tlsfuzzer: add missing scriptDmitry Eremin-Solenikov2018-09-271-0/+29
| | | | | | | Makefile.am refers tls-fuzzer-nocert-ssl3.sh script, which is missing in the source tree. Add it back. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tlsfuzzer: move common code to separate fileDmitry Eremin-Solenikov2018-09-277-185/+72
| | | | | | Move common code to tls-fuzzer-common.sh to ease further adjustments. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tlsfuzzer: use random port for tls-fuzzer-nocert testDmitry Eremin-Solenikov2018-09-272-73/+136
| | | | | | | Like the rest of tls-fuzzer tests, pass "-p PORT" to subtests, allowing usage of random port for server. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tlsfuzzer: use random port for tls-fuzzer-cert testDmitry Eremin-Solenikov2018-09-272-13/+17
| | | | | | | Like the rest of tls-fuzzer tests, pass "-p PORT" to subtests, allowing usage of random port for server. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tlsfuzzer: remove duplicate tests and sort them alphabeticallyDaiki Ueno2018-09-141-28/+20
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tlsfuzzer: modify to use the final code pointsNikos Mavrogiannopoulos2018-08-201-0/+2
| | | | | | Relates #542 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tlsfuzzer: update to the latest versionDaiki Ueno2018-08-083-3/+7
| | | | | | | | Also enable test-tls13-ffdhe-sanity.py, test-tls13-session-resumption.py, and test-tls13-unrecognised-groups.py. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* algorithms: add support for FFDHE6144Daiki Ueno2018-08-082-6/+3
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tests: tls-fuzzer: enable tests relying on header fragmentationDaiki Ueno2018-08-062-19/+10
| | | | | | | Those tests were previously disabled because splitting of handshake messages in a very short (< 4 bytes) fragments is not implemented. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tlsfuzzer: update to the latest versionDaiki Ueno2018-08-063-1/+3
| | | | | | Also enable test-tls13-0rtt-garbage.py. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tls1.3: server returns early on handshake when no cert is provided by clientNikos Mavrogiannopoulos2018-08-033-8/+9
| | | | | | | | | | | | Under TLS1.3 the server knows the negotiated keys early, if no client certificate is sent. In that case, the server is not only able to transmit the session ticket immediately after its finished message, but is also able to transmit data, similarly to false start. Resolves #481 Resolves #457 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: run tls-fuzzer PSK testsuiteNikos Mavrogiannopoulos2018-07-273-1/+88
| | | | | | Resolves #508 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* send_client_hello: don't override version after HRR is receivedNikos Mavrogiannopoulos2018-07-251-5/+35
| | | | | | | | | | | | | When a Hello Retry Request is received, do not set our (transient) version to TLS1.2 on the second client hello. That's because both peers have already negotiated TLS1.3. This addresses issue with peers which may send a changecipherspec message at this stage, which is now allowed when our version is set to be TLS1.2. Introduced test suite using openssl and resumption using HRR which reproduces the issue. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: tls-fuzzer: separated SSL3.0 from TLS1.x testsNikos Mavrogiannopoulos2018-07-133-10/+37
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: tls-fuzzer-alpn: operate on random portNikos Mavrogiannopoulos2018-07-073-7/+5
| | | | | | This allows parallel run of the test with other tlsfuzzer tests. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* configure: added option --enable-tls13-supportNikos Mavrogiannopoulos2018-07-074-4/+6
| | | | | | | | | | The new option enables TLS1.3 draft-28 support unconditionally. Updated the test suite to run when TLS1.3 is enabled by default, and added a CI run with TLS1.3 enabled. Resolves #424 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: mini-record-timing: avoid warning for too large stack usageNikos Mavrogiannopoulos2018-07-041-1/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tlsfuzzer: updated to include RSA and RSA-PSS related testsNikos Mavrogiannopoulos2018-07-023-4/+28
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* testcompat-tls13-openssl: fix openssl interactionsNikos Mavrogiannopoulos2018-06-271-9/+51
| | | | | | | | | | | | | * Do not require certificate validation on tests where no certificate is sent * Rekey test performs data transfer after re-key This introduces a dependency on the expect package for testing, and updates openssl to address an issue in post-handshake auth interop testing. Resolves #488 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: eliminated compiler warningsNikos Mavrogiannopoulos2018-06-272-5/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* avoid overflow when substracting timespecs if rdtsc is not availableRolf Eike Beer2018-06-261-2/+2
| | | | | | | This may still overflow on platforms where unsigned long is 32 bit (e.g. 32 bit Un*x, any Windows) when the delta is more than 4 seconds. Signed-off-by: Rolf Eike Beer <eike@sf-mail.de>
* .gitlab-ci.yml: updated x86 CI builds with better datefudge detectionNikos Mavrogiannopoulos2018-06-243-17/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tlsfuzzer: update to the latest versiontmp-tlsfuzzer-tls13-hrrDaiki Ueno2018-06-152-0/+0
| | | | | | Also enable test-tls13-hrr.py. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tlsfuzzer-tls13: use a random port for testingNikos Mavrogiannopoulos2018-06-122-13/+20
| | | | | | That eliminates the need for locking and allows parallel runs. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tlsfuzzer: update to the latest versionDaiki Ueno2018-06-126-1/+96
| | | | | | Also enable the TLS 1.3 tests. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* priorities: hmac-sha256 ciphersuites were removed from defaultsNikos Mavrogiannopoulos2018-06-121-2/+2
| | | | | | | | | | | | These ciphersuites are deprecated since the introduction of AEAD ciphersuites, and are only necessary for compatibility with older servers. Since older servers already support hmac-sha1 there is no reason to keep these ciphersuites enabled by default, as they increase our attack surface. Relates #456 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* cbc-record-check.sh: introducedNikos Mavrogiannopoulos2018-06-123-321/+295
| | | | | | | That enhances the existing CBC check and adds sha384, uses PSK to reduce handshake time, and other updates. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: exercise TLS 1.3 session resumptionDaiki Ueno2018-05-261-0/+38
| | | | | | | | | | This requires a few changes to the resume.c test: because NewSessionTicket is a post-handshake message, gnutls_session_get_data2() needs to be called after sending the first application data. Also, when GNUTLS_E_AGAIN, gnutls_record_recv() needs to retry. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Fix testdane by removing www.kumari.netTim Rühsen2018-05-241-2/+2
| | | | | | | danetool --check www.kumari.net: Verification: Verification failed. The certificate differs. Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* tests: fix serv location in testcompat-main-opensslNikos Mavrogiannopoulos2018-05-161-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests/suite: add missing file to distAndreas Metzler2018-05-151-1/+2
| | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* Allow running of test against installed gnutls-servAndreas Metzler2018-05-151-1/+2
| | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* tests: mini-record-timing: updated to work under newer gnutls [ci skip]Nikos Mavrogiannopoulos2018-05-101-13/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: testcompat-openssl: disable DSS ciphersuites under SSL3.0Nikos Mavrogiannopoulos2018-05-091-59/+64
| | | | | | | | Previously if openssl wouldn't support DSS, we would only disable DSS under TLS1.0 or later, not under SSL 3.0. This fixes interoperability with Fedora28 openssl. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added interop tests with openssl under TLS1.3Nikos Mavrogiannopoulos2018-05-043-7/+413
| | | | | | | | | | | | | This adds interoperability tests for: * PSK with elliptic curve DHE * RSA,RSA-PSS,secp256r1,ed25519 server certificate * RSA,RSA-PSS,secp256r1,ed25519 client certificate * X25519,SECP256R1 key share exchange * key share with HRR Relates #328 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: moved invalid-cert reproducer into fuzz/ reproducersNikos Mavrogiannopoulos2018-03-193-43/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: testpkcs11.sh was moved to the main testsNikos Mavrogiannopoulos2018-03-1915-1837/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status