openssl/test/testssl, branch OpenSSL_1_0_2t

Fix no-ssl3-method in 1.0.2

2018-06-19T10:12:59Z

Fixes #5322 Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/6510)

Fix weak digest in TLS 1.2 with SNI.

2017-11-01T12:35:19Z

1ce95f19601bbc6bfd24092c76c8f8105124e857 was incomplete and did not handle the case when SSL_set_SSL_CTX was called from the cert_cb callback rather than the SNI callback. The consequence is any server using OpenSSL 1.0.2 and the cert_cb callback for SNI only ever signs a weak digest, SHA-1, even when connecting to clients which use secure ones. Fix this and add regression tests for both this and the original issue. Fixes #4554. Reviewed-by: Emilia Käsper Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4577)

Fix session ticket and SNI

2017-02-08T11:35:41Z

When session tickets are used, it's possible that SNI might swtich the SSL_CTX on an SSL. Normally, this is not a problem, because the initial_ctx/session_ctx are used for all session ticket/id processes. However, when the SNI callback occurs, it's possible that the callback may update the options in the SSL from the SSL_CTX, and this could cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things can happen: 1. The session ticket TLSEXT may not be written when the ticket expected flag is set. The state machine transistions to writing the ticket, and the client responds with an error as its not expecting a ticket. 2. When creating the session ticket, if the ticket key cb returns 0 the crypto/hmac contexts are not initialized, and the code crashes when trying to encrypt the session ticket. To fix 1, if the ticket TLSEXT is not written out, clear the expected ticket flag. To fix 2, consider a return of 0 from the ticket key cb a recoverable error, and write a 0 length ticket and continue. The client-side code can explicitly handle this case. Fix these two cases, and add unit test code to validate ticket behavior. Reviewed-by: Rich Salz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/1065)

Fix ALPN

2016-04-04T17:45:09Z

* Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * document ALPN functions * unit tests Backport of commit 817cd0d52f0462039d1fe60462150be7f59d2002 Reviewed-by: Emilia Käsper Reviewed-by: Dr. Stephen Henson

Check for errors with SRP

2015-06-29T18:21:15Z

Reviewed-by: Matt Caswell (cherry picked from commit 5fced2395ddfb603a50fd1bd87411e603a59dc6f)

RT3907-fix

2015-06-23T00:50:20Z

Typo in local variable name; introduced by previous fix. Reviewed-by: Richard Levitte (cherry picked from commit cc3f3fc2b1c94d65824ab8d69595b6d89b17cf8d)

RT3907: avoid "local" in testssl script

2015-06-22T19:50:02Z

Reviewed-by: Richard Levitte (cherry picked from commit 75ba5c58c6b3b3326a6c3198100830afa120e7c3)

Fix ssltest to use 1024-bit DHE parameters

2015-05-26T10:42:40Z

Also add more ciphersuite test coverage, and a negative test for 512-bit DHE. Reviewed-by: Rich Salz (cherry picked from commit 1ee85aab75d7c9f20058f781bfe9222323df08eb)

Add DTLS tests to make test

2015-03-20T12:09:24Z

Updated test/testssl script to include the new DTLS capability in ssltest. Reviewed-by: Emilia Käsper (cherry picked from commit 3c381e54233be3d0dcbce7cc853c4767d979fe90)

Test SRP authentication ciphersuites.

2014-08-08T23:09:01Z

Reviewed-by: Matt Caswell (cherry picked from commit 193c1c07165b0042abd217274a084b49459d4443)