ag/cpython-source-deps
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Import OpenSSL1.1.1k

Browse Source
This commit is contained in:
Steve Dower
2021-03-29 21:47:40 +01:00
parent ae8aba4cbc
commit b439f09b29
104 changed files with 1075 additions and 379 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
test/recipes/25-test_verify.t
View File

@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -27,7 +27,7 @@ sub verify {
run(app([@args]));
}
plan tests => 145;
plan tests => 146;
# Canonical success
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
@@ -377,6 +377,9 @@ ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_l
ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
"PSS signature using SHA256 and auth level 2");
ok(verify("ee-pss-cert", "sslserver", ["root-cert"], ["ca-pss-cert"], ),
"CA PSS signature");
ok(!verify("many-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
"Too many names and constraints to check (1)");
ok(!verify("many-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),

38
test/recipes/70-test_renegotiation.t
View File

@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -38,7 +38,7 @@ my $proxy = TLSProxy::Proxy->new(
$proxy->clientflags("-no_tls1_3");
$proxy->reneg(1);
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 3;
plan tests => 4;
ok(TLSProxy::Message->success(), "Basic renegotiation");
#Test 2: Client does not send the Reneg SCSV. Reneg should fail
@@ -77,6 +77,20 @@ SKIP: {
"Check ClientHello version is the same");
}
SKIP: {
skip "TLSv1.2 disabled", 1
if disabled("tls1_2");
#Test 4: Test for CVE-2021-3449. client_sig_algs instead of sig_algs in
# resumption ClientHello
$proxy->clear();
$proxy->filter(\&sigalgs_filter);
$proxy->clientflags("-tls1_2");
$proxy->reneg(1);
$proxy->start();
ok(TLSProxy::Message->fail(), "client_sig_algs instead of sig_algs");
}
sub reneg_filter
{
my $proxy = shift;
@@ -96,3 +110,23 @@ sub reneg_filter
}
}
}
sub sigalgs_filter
{
my $proxy = shift;
my $cnt = 0;
# We're only interested in the second ClientHello message
foreach my $message (@{$proxy->message_list}) {
if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) {
next if ($cnt++ == 0);
my $sigs = pack "C10", 0x00, 0x08,
# rsa_pkcs_sha{256,384,512,1}
0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02, 0x01;
$message->set_extension(TLSProxy::Message::EXT_SIG_ALGS_CERT, $sigs);
$message->delete_extension(TLSProxy::Message::EXT_SIG_ALGS);
$message->repack();
}
}
}

5
test/recipes/70-test_verify_extra.t
View File

@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -16,4 +16,5 @@ plan tests => 1;
ok(run(test(["verify_extra_test",
srctop_file("test", "certs", "roots.pem"),
srctop_file("test", "certs", "untrusted.pem"),
srctop_file("test", "certs", "bad.pem")])));
srctop_file("test", "certs", "bad.pem"),
srctop_file("test", "certs", "rootCA.pem")])));

15
test/recipes/80-test_x509aux.t
View File

@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -14,14 +14,17 @@ use OpenSSL::Test::Utils;
setup("test_x509aux");
my @path = qw(test certs);
plan skip_all => "test_dane uses ec which is not supported by this OpenSSL build"
if disabled("ec");
plan tests => 1; # The number of tests being performed
ok(run(test(["x509aux",
srctop_file("test", "certs", "roots.pem"),
srctop_file("test", "certs", "root+anyEKU.pem"),
srctop_file("test", "certs", "root-anyEKU.pem"),
srctop_file("test", "certs", "root-cert.pem")]
)), "x509aux tests");
srctop_file(@path, "roots.pem"),
srctop_file(@path, "root+anyEKU.pem"),
srctop_file(@path, "root-anyEKU.pem"),
srctop_file(@path, "root-cert.pem"),
srctop_file(@path, "invalid-cert.pem"),
])), "x509aux tests");