summaryrefslogtreecommitdiff
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* Avoid &> redirection bashism in testsuiteAndreas Metzler2022-01-212-8/+8
| | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* tests: privkey-keygen: fix memory leakDaiki Ueno2022-01-181-0/+1
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* tests: suppress GCC -fanalyzer warningsDaiki Ueno2022-01-162-1/+4
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* tests: use more aliases in tests for better alias testing coverageAlexander Sosedkin2022-01-152-7/+7
| | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* src: replace autoopts/libopts with minimal config parserDaiki Ueno2022-01-1528-1/+522
| | | | | | | This replaces configuration file parsing code previously provided by <autoopts/options.h>, with a minimal compatible implementation. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'wip/dueno/build-fixes2' into 'master'Daiki Ueno2022-01-121-1/+6
|\ | | | | | | | | Minor build fixes before the 3.7.3 release See merge request gnutls/gnutls!1511
| * tests: simple: check if the digest algorithm is compiled inDaiki Ueno2022-01-121-1/+6
| | | | | | | | | | | | | | When the library is built with --disable-gost, gnutls_digest_get_id returns GNUTLS_DIG_UNKNOWN for GOST algorithms. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'curve-keygen-allowlist-test' into 'master'Daiki Ueno2022-01-123-27/+291
|\ \ | |/ |/| | | | | Extend system-override-curves-allowlist test with key generation See merge request gnutls/gnutls!1500
| * tests: extend system-override-curves-allowlist with key generationAlexander Sosedkin2021-12-203-5/+243
| | | | | | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
| * tests: tweak system-override-curves-allowlist insignificantlyAlexander Sosedkin2021-12-201-26/+52
| | | | | | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* | Merge branch 'wip/dueno/pkcs12' into 'master'Daiki Ueno2022-01-122-3/+46
|\ \ | | | | | | | | | | | | certtool: --to-p12: use modern algorithms by default See merge request gnutls/gnutls!1499
| * | tests: check algorithms for generating PKCS#12 fileDaiki Ueno2022-01-112-3/+46
| | | | | | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | | cipher-api-test: mention why it is written using forkDaiki Ueno2022-01-081-0/+5
| | | | | | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | | fips: plumb service indicator to symmetric key crypto operationsDaiki Ueno2022-01-082-0/+75
| | | | | | | | | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org> Co-authored-by: Pedro Monreal <pmonrealgonzalez@suse.de>
* | | fips: plumb service indicator to public key crypto operationsDaiki Ueno2022-01-083-7/+323
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This installs service indicator state transitions in certain public key operations in gnutls_crypto_pk_st, namely: * fallible operations - encrypt - sign - generate_keys - derive * infallible operations - decrypt, decrypt2 - verify other operations, such as generate_params, are not considered as crypto operation. Note that fallible operations above mean that those return value could indicate error, while infallible operations do not have distinction between errors and failures: decrypt/verify failures are treated as a successful completion of the operation. Signed-off-by: Daiki Ueno <ueno@gnu.org> Co-authored-by: Pedro Monreal <pmonrealgonzalez@suse.de>
* | p11tool: add --mark-always-authenticate optionAlon Bar-Lev2022-01-031-0/+36
|/ | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* ktls: flagsFrantisek Krenzelok2021-12-161-3/+3
| | | | | | ktls enum flags API Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* KTLS: APIFrantisek Krenzelok2021-12-151-37/+60
| | | | | | | ktls is enabled by default, we can check if inicialization was succesfull with gnutls_transport_is_ktls_enabled Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* tests: fix out of tree builds with ASANAlexander Sosedkin2021-12-102-2/+2
| | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* tests: add protocol-set-allowlistAlexander Sosedkin2021-12-103-1/+584
| | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* tests: add tcp_connect to utilsAlexander Sosedkin2021-12-093-2/+25
| | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* x509 CT: Add testsAnder Juaristi2021-12-042-1/+312
| | | | Signed-off-by: Ander Juaristi <a@juaristi.eus>
* Merge branch 'wip/dueno/config-allowlisting' into 'master'Daiki Ueno2021-11-296-0/+489
|\ | | | | | | | | | | | | priority: support allowlisting in configuration file Closes #1172 See merge request gnutls/gnutls!1427
| * priority: support allowlisting in configuration fileDaiki Ueno2021-11-296-0/+489
| | | | | | | | | | | | | | | | | | | | | | | | This adds a new mode of interpreting the [overrides] section. If "override-mode" is set to "allowlisting" in the [global] section, all the algorithms (hashes, signature algorithms, curves, and versions) are initially marked as insecure/disabled. Then the user can enable them by specifying allowlisting keywords such as "secure-hash" in the [overrides] section. Signed-off-by: Daiki Ueno <ueno@gnu.org> Co-authored-by: Alexander Sosedkin <asosedkin@redhat.com>
* | build: update to use the latest valgrind-tests module from GnulibDaiki Ueno2021-11-273-4/+11
|/ | | | | | | | | | | | This adjust the existing valgrind invocations in the test suite with: https://www.gnu.org/software/gnulib/manual/html_node/Valgrind-options.html - make --suppressions option to per directory, using AM_VALGRINDFLAGS - use LOG_VALGRIND for LOG_COMPILER - quote '$(LOG_VALGRIND)' in TESTS_ENVIRONMENT - move gl_VALGRIND_TESTS_DEFAULT_NO call before gl_INIT Signed-off-by: Daiki Ueno <ueno@gnu.org>
* locks: use once execution for on-demand initialization of globalsDaiki Ueno2021-11-171-0/+3
| | | | | | | | | | This makes sure that the global variables are initialized only once. Most of those variables are initialized at ELF constructor, though a couple of occasions they are initialized on-demand: the global keylog file pointer and TPM2 TCTI context. To properly protect the initialization this patch uses gl_once provided by Gnulib. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'wip/dueno/tpm2' into 'master'Daiki Ueno2021-11-142-0/+225
|\ | | | | | | | | | | | | Port openconnect TPM2 code Closes #594 See merge request gnutls/gnutls!1460
| * Port openconnect TPM2 codeNikos Mavrogiannopoulos2021-11-132-0/+225
| | | | | | | | | | | | | | | | | | | | This introduces transparent loading of TPM2 keys which are in PEM form by gnutls_privkey_import_x509_raw() and higher level functions which wrap it. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> Co-authored-by: David Woodhouse <dwmw2@infradead.org> Co-authored-by: Daiki Ueno <ueno@gnu.org>
* | tests: set $abs_top_builddir in more placesAlexander Sosedkin2021-11-104-0/+4
|/ | | | | | | | | `$abs_top_builddir` has been used all across tests' subdirectories (through tests/scripts/common.sh) but has only been defined for tests/suite/ ones. Defining it in other Makefiles where `top_builddir` is being passed. Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* tests: add system-override-hash-influences-prfAlexander Sosedkin2021-10-212-1/+90
| | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* ktls: basic implementation of SW modeHedgehog50402021-10-192-0/+286
| | | | | | | | | | | | | | | | | ktls enables us to offload encryption/decryption to the kernel prerequisites: - configured with `--enable-ktls` - tls module `modprobe tls` check with 'lsmod | grep tls' - per connection: gnutls_transport_set_int{2} must be set When prerequisities are met then ktls is used by default. If GnuTLS encounters a error during KTLS initialization, it will not use ktls and fallback to userspace. Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* Merge branch 'x25519-and-x448' into 'master'Daiki Ueno2021-09-233-1/+112
|\ | | | | | | | | certtool: generate, parse, and manipulate X25519 and X448 pubkeys, privkeys, and certificates See merge request gnutls/gnutls!1428
| * tests: add test for generating x25519 and x448 certificatesDaniel Kahn Gillmor2021-09-172-1/+102
| | | | | | | | | | | | | | | | | | | | These certs should work just fine for the purposes of cryptographic e-mail (S/MIME). These usage flags are also used in the end-entity certificates found in https://datatracker.ietf.org/doc/draft-ietf-lamps-samples/ Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| * tests: update details about sample X25519 certificateDaniel Kahn Gillmor2021-09-171-0/+10
| | | | | | | | Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* | wrap_nettle_hash_exists: add missing hash algorithmsDaiki Ueno2021-09-201-2/+14
|/ | | | | | | | | | | This adds SHAKE-128, SHAKE-256, and RIPEMD-160 to the supported algorithms by nettle. While SHAKEs are not a hash algorithm but an XOF, it would be consistent to report they are implemented. The simple test is expanded to exercise the code path (gnutls_digest_get_id → wrap_nettle_hash_exists). Signed-off-by: Daiki Ueno <ueno@gnu.org>
* tests: use PYTHONPATH instead of creating symlinks in srcdirDaiki Ueno2021-09-071-4/+4
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* tls-fuzzer: update submodules to the latestDaiki Ueno2021-09-073-0/+0
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* testcompat-openssl-tls13-cli.sh: disable early data testingDaiki Ueno2021-09-071-33/+33
| | | | | | | This test is causing intermittent failure quite often in the CI. Let's temporarily disable it until the cause is properly investigated. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* testcompat-openssl-tls13-cli.sh: use different tmpdirs for sub-testsDaiki Ueno2021-09-071-2/+2
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* tests: rework port lockingDaiki Ueno2021-09-072-29/+27
| | | | | | | | This makes the locking logic per port, not per entire make process. It also makes use of absolute paths for locking directory, so that tlsfuzzer tests can use it. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'fix-tls13-post-hanshake-with-cert' into 'master'Daiki Ueno2021-09-011-4/+5
|\ | | | | | | | | tests/tls13/post-handshake-with-cert: avoid a race condition See merge request gnutls/gnutls!1464
| * tests/tls13/post-handshake-with-cert: avoid a race conditionAlexander Sosedkin2021-08-301-4/+5
| | | | | | | | | | | | | | | | A server tries to close connection and kill the client after reauth. Client, in turn, attempts to send data in some cases. This patch makes the server wait for the client to terminate first. Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* | tests: remove unused `terminate` from 2 testsAlexander Sosedkin2021-08-302-18/+0
| | | | | | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* | tests: add a safeguard to terminate()Alexander Sosedkin2021-08-3053-35/+74
| | | | | | | | | | | | Add a safeguard to `terminate()` so that we don't kill whole pgroups. Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* | tests: don't kill whole pgroupsAlexander Sosedkin2021-08-2716-60/+60
|/ | | | | | | `terminate()` executed from the child process results in a `kill(0, SIGTERM)`, bringing the whole pgroup down. `exit(1)` should be called instead. Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* x509: pin/password callback support for openssl encrypted private keysCraig Gallek2021-08-151-0/+71
| | | | | | | | | This attempts to use the registered pin callback when the password for an encrypted openssl private key is not supplied. This matches the functionality for PKCS8 sealed keys above and is similar to what openssl does in this situation. Signed-off-by: Craig Gallek <cgallek@gmail.com>
* Merge branch 'wip/dueno/asan-poisoning' into 'master'Daiki Ueno2021-08-101-13/+15
|\ | | | | | | | | | | | | mem: instrument with ASan memory poisoning as well as valgrind Closes #1260 See merge request gnutls/gnutls!1458
| * mem: instrument with ASan memory poisoning as well as valgrindDaiki Ueno2021-08-091-13/+15
| | | | | | | | | | | | | | This makes it possible to catch undefined memory access in the more lightweight CI runs. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | pk: add flags to force RSA-PSS salt length to match digest lengthDaiki Ueno2021-08-071-41/+98
|/ | | | | | | | | This adds a couple of flags to RSA-PSS signing and verification, to enforce that the salt length matches the digest length. That is not only recommended in RFC 4055, but also mandated in RFC 8446 in the TLS 1.3 context. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* tests: tls13/key_share: rewrite as single processDaiki Ueno2021-08-041-159/+57
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
View Lorry Controller Status