openssl/test, branch OpenSSL_1_0_2o

test/maketests.com: remove irrelevant comment

2018-01-06T18:30:23Z

Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/5017)

Add missing tests to the VMS test scripts

2018-01-06T18:30:23Z

Thanks to Douglas Fyfe @ VSI for making me aware of this Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/5017)

Remove three test programs that snuck in

2017-12-09T23:09:32Z

They are from the 1.1.0 or master branches Fixes #4863 Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/4887)

Standardize syntax around sizeof(foo)

2017-12-08T20:08:43Z

Reviewed-by: Andy Polyakov (Merged from https://github.com/openssl/openssl/pull/4875)

Add a test for CVE-2017-3737

2017-12-06T15:40:23Z

Test reading/writing to an SSL object after a fatal error has been detected. Reviewed-by: Rich Salz

Fix weak digest in TLS 1.2 with SNI.

2017-11-01T12:35:19Z

1ce95f19601bbc6bfd24092c76c8f8105124e857 was incomplete and did not handle the case when SSL_set_SSL_CTX was called from the cert_cb callback rather than the SNI callback. The consequence is any server using OpenSSL 1.0.2 and the cert_cb callback for SNI only ever signs a weak digest, SHA-1, even when connecting to clients which use secure ones. Fix this and add regression tests for both this and the original issue. Fixes #4554. Reviewed-by: Emilia Käsper Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4577)

Limit the output of the enc -ciphers command

2017-03-08T15:16:44Z

to just the ciphers enc can process. This means no AEAD ciphers and no XTS mode. Reviewed-by: Richard Levitte Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/2876) (cherry picked from commit 777f1708a88f85569304caeca197c96ef912b236) (cherry picked from commit b97324dbcb12e8b509d513ded9ba3f71c14547d8)

Restore the test coverage of COMP_rle and SSL_COMP_add_compression_method

2017-02-24T10:22:40Z

Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/2595)

Add -Wundef to --strict-warnings options. Fix some warnings.

2017-02-23T15:07:21Z

Reviewed-by: Andy Polyakov Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/2714)

Fix session ticket and SNI

2017-02-08T11:35:41Z

When session tickets are used, it's possible that SNI might swtich the SSL_CTX on an SSL. Normally, this is not a problem, because the initial_ctx/session_ctx are used for all session ticket/id processes. However, when the SNI callback occurs, it's possible that the callback may update the options in the SSL from the SSL_CTX, and this could cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things can happen: 1. The session ticket TLSEXT may not be written when the ticket expected flag is set. The state machine transistions to writing the ticket, and the client responds with an error as its not expecting a ticket. 2. When creating the session ticket, if the ticket key cb returns 0 the crypto/hmac contexts are not initialized, and the code crashes when trying to encrypt the session ticket. To fix 1, if the ticket TLSEXT is not written out, clear the expected ticket flag. To fix 2, consider a return of 0 from the ticket key cb a recoverable error, and write a 0 length ticket and continue. The client-side code can explicitly handle this case. Fix these two cases, and add unit test code to validate ticket behavior. Reviewed-by: Rich Salz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/1065)