[openssl] master update

beldmit at gmail.com beldmit at gmail.com
Wed Jan 5 10:26:06 UTC 2022


The branch master has been updated
       via  e66c41725f03dae2b295df048312fe6d28729e98 (commit)
       via  db87f89b7393eea395b82050c7fc4e1869ef112e (commit)
       via  cccbb4fa60ca890a0ce6757fcba5669208fffa46 (commit)
      from  0da3b39af3d961486758262ca71d2135d7013048 (commit)


- Log -----------------------------------------------------------------
commit e66c41725f03dae2b295df048312fe6d28729e98
Author: Dmitry Belyavskiy <beldmit at gmail.com>
Date:   Thu Dec 23 11:19:07 2021 +0100

    Run TLSfuzzer tests for CI
    
    Reviewed-by: Paul Dale <pauli at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/17340)

commit db87f89b7393eea395b82050c7fc4e1869ef112e
Author: Dmitry Belyavskiy <beldmit at gmail.com>
Date:   Wed Dec 22 18:13:40 2021 +0100

    TLS Fuzzer: initial test infrastructure
    
    Reviewed-by: Paul Dale <pauli at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/17340)

commit cccbb4fa60ca890a0ce6757fcba5669208fffa46
Author: Dmitry Belyavskiy <beldmit at gmail.com>
Date:   Wed Dec 22 18:11:21 2021 +0100

    TLSfuzzer: submodules
    
    Reviewed-by: Paul Dale <pauli at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/17340)

-----------------------------------------------------------------------

Summary of changes:
 .github/workflows/ci.yml                           |  2 +
 .gitmodules                                        |  9 +++
 python-ecdsa                                       |  1 +
 test/recipes/95-test_external_tlsfuzzer.t          | 28 +++++++++
 .../95-test_external_tlsfuzzer_data/cert.json.in   | 38 +++++++++++
 .../tls-fuzzer-cert.sh                             |  9 +++
 .../95-test_external_tlsfuzzer_data/tlsfuzzer.sh   | 73 ++++++++++++++++++++++
 tlsfuzzer                                          |  1 +
 tlslite-ng                                         |  1 +
 9 files changed, 162 insertions(+)
 create mode 160000 python-ecdsa
 create mode 100644 test/recipes/95-test_external_tlsfuzzer.t
 create mode 100644 test/recipes/95-test_external_tlsfuzzer_data/cert.json.in
 create mode 100644 test/recipes/95-test_external_tlsfuzzer_data/tls-fuzzer-cert.sh
 create mode 100644 test/recipes/95-test_external_tlsfuzzer_data/tlsfuzzer.sh
 create mode 160000 tlsfuzzer
 create mode 160000 tlslite-ng

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b52b8c15f4..103f4c774f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -273,6 +273,8 @@ jobs:
       run: make test TESTS="test_external_gost_engine"
     - name: test external krb5
       run: make test TESTS="test_external_krb5"
+    - name: test external_tlsfuzzer
+      run: make test TESTS="test_external_tlsfuzzer"
 
   external-test-pyca:
     runs-on: ubuntu-latest
diff --git a/.gitmodules b/.gitmodules
index 35f803a99c..1d4c6c9da7 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -13,3 +13,12 @@
 [submodule "wycheproof"]
 	path = wycheproof
 	url = https://github.com/google/wycheproof
+[submodule "tlsfuzzer"]
+	path = tlsfuzzer
+	url = https://github.com/tlsfuzzer/tlsfuzzer
+[submodule "python-ecdsa"]
+	path = python-ecdsa
+	url = https://github.com/tlsfuzzer/python-ecdsa
+[submodule "tlslite-ng"]
+	path = tlslite-ng
+	url = https://github.com/tlsfuzzer/tlslite-ng
diff --git a/python-ecdsa b/python-ecdsa
new file mode 160000
index 0000000000..4de8d5bf89
--- /dev/null
+++ b/python-ecdsa
@@ -0,0 +1 @@
+Subproject commit 4de8d5bf89089d1140eb99aa5d7eb2dc8e6337b6
diff --git a/test/recipes/95-test_external_tlsfuzzer.t b/test/recipes/95-test_external_tlsfuzzer.t
new file mode 100644
index 0000000000..e506f8007a
--- /dev/null
+++ b/test/recipes/95-test_external_tlsfuzzer.t
@@ -0,0 +1,28 @@
+#! /usr/bin/env perl
+# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+
+use OpenSSL::Test;
+use OpenSSL::Test::Utils;
+use OpenSSL::Test qw/:DEFAULT data_file data_dir bldtop_dir srctop_dir cmdstr/;
+use Cwd qw(abs_path);
+
+setup("test_external_tlsfuzzer");
+
+plan skip_all => "No external tests in this configuration"
+    if disabled("external-tests");
+plan skip_all => "TLSFuzzer tests not available on Windows or VMS"
+    if $^O =~ /^(VMS|MSWin32)$/;
+plan skip_all => "TLSFuzzer tests not supported in out of tree builds"
+    if bldtop_dir() ne srctop_dir();
+
+$ENV{TESTDATADIR} = abs_path(data_dir());
+plan tests => 1;
+
+ok(run(cmd(["sh", data_file("tls-fuzzer-cert.sh")])),
+   "running TLSFuzzer tests");
diff --git a/test/recipes/95-test_external_tlsfuzzer_data/cert.json.in b/test/recipes/95-test_external_tlsfuzzer_data/cert.json.in
new file mode 100644
index 0000000000..1bc20799d9
--- /dev/null
+++ b/test/recipes/95-test_external_tlsfuzzer_data/cert.json.in
@@ -0,0 +1,38 @@
+[
+    {"server_command": ["@SERVER@", "s_server", "-www",
+                 "-key", "tests/serverX509Key.pem",
+                 "-cert", "tests/serverX509Cert.pem",
+                 "-verify", "1", "-CAfile", "tests/clientX509Cert.pem"],
+     "comment": "Use ANY certificate just to ensure that server tries to authorise a client",
+     "environment": {"PYTHONPATH" : "."},
+     "server_hostname": "localhost",
+     "server_port": @PORT@,
+     "tests" : [
+	 {"name" : "test-tls13-certificate-verify.py",
+          "arguments" : ["-k", "tests/clientX509Key.pem",
+                         "-c", "tests/clientX509Cert.pem",
+			 "-s", "ecdsa_secp256r1_sha256 ecdsa_secp384r1_sha384 ecdsa_secp521r1_sha512 ed25519 ed448 8+26 8+27 8+28 rsa_pss_pss_sha256 rsa_pss_pss_sha384 rsa_pss_pss_sha512 rsa_pss_rsae_sha256 rsa_pss_rsae_sha384 rsa_pss_rsae_sha512 rsa_pkcs1_sha256 rsa_pkcs1_sha384 rsa_pkcs1_sha512 ecdsa_sha224 rsa_pkcs1_sha224",
+	                 "-p", "@PORT@"]},
+	 {"name" : "test-tls13-ecdsa-in-certificate-verify.py",
+          "arguments" : ["-k", "tests/serverECKey.pem",
+                         "-c", "tests/serverECCert.pem",
+			 "-s", "ecdsa_secp256r1_sha256 ecdsa_secp384r1_sha384 ecdsa_secp521r1_sha512 ed25519 ed448 8+26 8+27 8+28 rsa_pss_pss_sha256 rsa_pss_pss_sha384 rsa_pss_pss_sha512 rsa_pss_rsae_sha256 rsa_pss_rsae_sha384 rsa_pss_rsae_sha512 rsa_pkcs1_sha256 rsa_pkcs1_sha384 rsa_pkcs1_sha512 ecdsa_sha224 rsa_pkcs1_sha224",
+	                 "-p", "@PORT@"]}
+     ]
+    },
+    {"server_command": ["@SERVER@", "s_server", "-www",
+                 "-key", "tests/serverX509Key.pem",
+                 "-cert", "tests/serverX509Cert.pem"],
+     "environment": {"PYTHONPATH" : "."},
+     "server_hostname": "localhost",
+     "server_port": @PORT@,
+     "tests" : [
+	 {"name" : "test-tls13-conversation.py",
+          "arguments" : ["-p", "@PORT@"]},
+	 {"name" : "test-conversation.py",
+          "arguments" : ["-p", "@PORT@",
+		  "-d"]}
+     ]
+    }
+
+]
diff --git a/test/recipes/95-test_external_tlsfuzzer_data/tls-fuzzer-cert.sh b/test/recipes/95-test_external_tlsfuzzer_data/tls-fuzzer-cert.sh
new file mode 100644
index 0000000000..60bb8cffa1
--- /dev/null
+++ b/test/recipes/95-test_external_tlsfuzzer_data/tls-fuzzer-cert.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+tls_fuzzer_prepare() {
+
+sed -e "s|@SERVER@|$SERV|g" -e "s/@PORT@/$PORT/g" -e "s/@PRIORITY@/$PRIORITY/g" ${TESTDATADIR}/cert.json.in >${TMPFILE}
+}
+
+. "${TESTDATADIR}/tlsfuzzer.sh"
+
diff --git a/test/recipes/95-test_external_tlsfuzzer_data/tlsfuzzer.sh b/test/recipes/95-test_external_tlsfuzzer_data/tlsfuzzer.sh
new file mode 100644
index 0000000000..a9f781de33
--- /dev/null
+++ b/test/recipes/95-test_external_tlsfuzzer_data/tlsfuzzer.sh
@@ -0,0 +1,73 @@
+#!/bin/bash
+#
+# Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+#
+# OpenSSL external testing using the TLSFuzzer test suite
+#
+set -e
+
+PWD="$(pwd)"
+
+SRCTOP="$(cd $SRCTOP; pwd)"
+BLDTOP="$(cd $BLDTOP; pwd)"
+
+if [ "$SRCTOP" != "$BLDTOP" ] ; then
+    echo "Out of tree builds not supported with TLSFuzzer test!"
+    exit 1
+fi
+
+O_EXE="$BLDTOP/apps"
+O_BINC="$BLDTOP/include"
+O_SINC="$SRCTOP/include"
+O_LIB="$BLDTOP"
+
+export PATH="$O_EXE:$PATH"
+export LD_LIBRARY_PATH="$O_LIB:$LD_LIBRARY_PATH"
+export OPENSSL_ROOT_DIR="$O_LIB"
+
+# Check/Set openssl version
+OPENSSL_VERSION=`openssl version | cut -f 2 -d ' '`
+
+CLI="${O_EXE}/openssl"
+SERV="${O_EXE}/openssl"
+
+TMPFILE="${PWD}/tls-fuzzer.$$.tmp"
+PSKFILE="${PWD}/tls-fuzzer.psk.$$.tmp"
+
+PYTHON=`which python`
+PORT=4433
+
+echo "------------------------------------------------------------------"
+echo "Testing OpenSSL using TLSFuzzer:"
+echo "   CWD:                $PWD"
+echo "   SRCTOP:             $SRCTOP"
+echo "   BLDTOP:             $BLDTOP"
+echo "   OPENSSL_ROOT_DIR:   $OPENSSL_ROOT_DIR"
+echo "   Python:             $PYTHON"
+echo "   TESTDATADIR:        $TESTDATADIR"
+echo "------------------------------------------------------------------"
+
+cd "${SRCTOP}/tlsfuzzer"
+
+test -L ecdsa || ln -s ../python-ecdsa/src/ecdsa ecdsa
+test -L tlslite || ln -s ../tlslite-ng/tlslite tlslite 2>/dev/null
+
+retval=0
+
+tls_fuzzer_prepare
+
+PYTHONPATH=. "${PYTHON}" tests/scripts_retention.py ${TMPFILE} ${SERV} 821
+retval=$?
+
+rm -f ${TMPFILE}
+[ -f "${PSKFILE}" ] && rm -f ${PSKFILE}
+
+cd $PWD
+
+exit $retval
diff --git a/tlsfuzzer b/tlsfuzzer
new file mode 160000
index 0000000000..dbd56c1490
--- /dev/null
+++ b/tlsfuzzer
@@ -0,0 +1 @@
+Subproject commit dbd56c149072e656ca8d6a43a59588f3e7513da2
diff --git a/tlslite-ng b/tlslite-ng
new file mode 160000
index 0000000000..771e9f59d6
--- /dev/null
+++ b/tlslite-ng
@@ -0,0 +1 @@
+Subproject commit 771e9f59d639dbb0e2fa8e646c8e588405d3903e


More information about the openssl-commits mailing list