openssl/test, branch OpenSSL_1_1_1f

Update copyright year

2020-03-17T13:59:29Z

Reviewed-by: Paul Yang (Merged from https://github.com/openssl/openssl/pull/11344)

sslapitest: don't leak the SSL_CTX pair

2020-03-17T10:00:35Z

We have no need for a new set of SSL_CTXs in test_ccs_change_cipher(), so just keep using the original ones. Also, fix a typo in a comment. [extended tests] Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/11336) (cherry picked from commit b3e6d666e351d45e93d29fe3813245b92a0f5815)

Add test that changes ciphers on CCS

2020-03-13T23:12:18Z

The TLS (pre-1.3) ChangeCipherState message is usually used to indicate the switch from the unencrypted to encrypted part of the handshake. However, it can also be used in cases where there is an existing session (such as during resumption handshakes) or when changing from one cipher to a different one (such as during renegotiation when the cipher list offered by the client has changed). This test serves to exercise such situations, allowing us to detect whether session objects are being modified in cases when they must remain immutable for thread-safety purposes. Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/10943) (cherry picked from commit 3cd14e5e65011660ad8e3603cf871c8366b565fd)

Revert "Create a new embeddedSCTs1 that's signed using SHA256"

2020-03-11T14:56:05Z

This reverts commit b98efebeb2d4265bd6638d5947fe365500121e03. Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/11282)

Revert "Stop accepting certificates signed using SHA1 at security level 1"

2020-03-11T14:56:05Z

This reverts commit 68436f0a8964e911eb4f864bc8b31d7ca4d29585. The OMC did not vote in favour of backporting this to 1.1.1, so this change should be reverted. Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/11282)

Check that ed25519 and ed448 are allowed by the security level

2020-02-16T10:55:42Z

Signature algorithms not using an MD weren't checked that they're allowed by the security level. Reviewed-by: Tomáš Mráz GH: #11062

Generate new Ed488 certificates

2020-02-16T10:52:05Z

Create a whole chain of Ed488 certificates so that we can use it at security level 4 (192 bit). We had an 2048 bit RSA (112 bit, level 2) root sign the Ed488 certificate using SHA256 (128 bit, level 3). Reviewed-by: Matt Caswell GH: #10785 (cherry picked from commit 77c4d3972400adf1bcb76ceea359f5453cc3e8e4)

Fix no-tls1_3

2020-02-12T10:51:54Z

The hostname_cb in sslapitest.c was originally only defined if TLSv1.3 was enabled. A recently added test now uses this unconditionally, so we move the function implementation earlier in the file, and always compile it in. Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/11014) (cherry picked from commit 104a733df65dfd8c3dd110de9bd56f6ebfc8f2f6)

Fix misspelling errors and typos reported by codespell

2020-02-06T15:52:07Z

Fixes #10998 Reviewed-by: Shane Lontis (Merged from https://github.com/openssl/openssl/pull/11000)

Stop accepting certificates signed using SHA1 at security level 1

2020-02-05T21:07:38Z

Reviewed-by: Viktor Dukhovni GH: #10786 (cherry picked from commit b744f915ca8bb37631909728dd2529289bda8438)