aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/test
AgeCommit message (Collapse)Author
2017-03-08dtls: Only test this for TLS for nowIngela Anderton Andin
We want to avoid failing test cases but still be able to merge DTLS progress for 19.3
2017-03-07dtls: Avoid mixup of protocol to testIngela Anderton Andin
2017-03-06dtls: Correct dialyzer spec and postpone inclusion of testIngela Anderton Andin
The new_options_in_accept test is not working yet, however DTLS is still work in progress and we want to make a progress merge to avoid merge conflicts with other progress of the ssl application.
2017-03-06dtls: Enable some DTLS tests in ssl_to_openssl_SUITEIngela Anderton Andin
We need to figure out a good way of knowing if the OpenSSL-"DTLS server" is up. Some of the code in this commit is attempting this, but it is not really working yet, and hence only tests where OpenSSL is client are enabled.
2017-03-06dtls: Enable DTLS test in ssl_certificate_verify_SUITEIngela Anderton Andin
2017-03-06dtls: Hibernation and retransmit timersIngela Anderton Andin
Change retransmissions timers to use gen_statem state timeouts. We do not need a retransmission timer in the state connection as data traffic in DTLS over UDP is not retransmitted. If the last flight before transitioning into connection is lost, it will be resent when the peer resends its last flight. This will also make hibernation testing more straight forward. We need more adjustments later to handle a reliable DTLS transport such as SCTP.
2017-03-06dtls: DTLS specific handling of socket and ciphersIngela Anderton Andin
DTLS does not support stream ciphers and needs diffrent handling of the "#ssl_socket{}" handle .
2017-02-20Add dummy end_per_suite/1Siri Hansen
common_test requires that if init_per_suite/1 exists, then end_per_suite/1 must also exist. If end_per_suite/1 does not exist, then it will be marked in the log as failed with reason 'undef'. Some test suites are corrected to avoid this.
2017-02-13ssl: Test case robustnessIngela Anderton Andin
2017-02-08ssl: Avoid SSL/TLS hello format confusionIngela Anderton Andin
Valid SSL 3.0 or TLS hellos might accidentally match SSL 2.0 format (and sometimes the other way around before inspecting data) so we need to match SSL 3.0 and TLS first and only match SSL 2.0 hellos when flag to support it is set.
2017-01-25Merge branch 'ingela/ssl/crl-validity' into maintIngela Anderton Andin
* ingela/ssl/crl-validity: ssl: Make crls valid for a week instead of 24 hours
2017-01-19ssl: Move PEM cache to a dedicated processIngela Anderton Andin
The PEM cache handling has proven to be too disruptive of the manager process.
2017-01-17ssl: Handle really big handshake packagesIngela Anderton Andin
If a handshake message is really big it could happen that the ssl process would hang due to failing of requesting more data from the socket. This has been fixed. Also added option to limit max handshake size. It has a default value that should be big enough to handle normal usage and small enough to mitigate DoS attacks.
2017-01-12ssl: Make crls valid for a week instead of 24 hoursIngela Anderton Andin
With the 24 option we might be unlucky and get failing tests just because cert expired before the test is run.
2016-12-07Update copyright-yearErlang/OTP
2016-12-06Merge branch 'ingela/dtls/statem/OTP-12982' into maintIngela Anderton Andin
* ingela/dtls/statem/OTP-12982: ssl: Implement DTLS state machine
2016-12-05Merge branch 'ingela/ECC-tests' into maintIngela Anderton Andin
* ingela/ECC-tests: ssl: Make sure common-test priv_dir is used for test case generated files
2016-12-05ssl: Implement DTLS state machineIngela Anderton Andin
Beta DTLS, not production ready. Only very basically tested, and not everything in the SPEC is implemented and some things are hard coded that should not be, so this implementation can not be consider secure. Refactor "TLS connection state" and socket handling, to facilitate DTLS implementation. Create dtls "listner" (multiplexor) process that spawns DTLS connection process handlers. Handle DTLS fragmentation. Framework for handling retransmissions. Replay Detection is not implemented yet. Alerts currently always handled as in TLS.
2016-11-10ssl: Use SHA2 for signing ECC certs if possibleIngela Anderton Andin
ECC certs should preferably use SHA2, this is what we want to be testing. Also assembling of all available test suites must consider TLS version.
2016-11-09Merge branch 'ingela/ssl/tune-timeouts-packet_SUITE' into maintIngela Anderton Andin
* ingela/ssl/tune-timeouts-packet_SUITE: ssl: Change to more modest timeouts
2016-11-09ssl: Remove faulty workaroundIngela Anderton Andin
We where never really satisfied with this workaround it was a bit far fetched, so we are pleased to be able to remove it.
2016-11-07ssl: Make sure common-test priv_dir is used for test case generated filesIngela Anderton Andin
2016-11-02Add ECC curve selection order config in TLS serverFred Hebert
As per RFC 4492 Sec 5.1, the preferred order of selection of named curves is based on client preferences. Currently, the SSL application only picks entries according to the absolute order of entries as tracked in a hardcoded list in code. This patch changes things so that the client-specified order is preferred. It also allows a mode where the server can be configured to override the client's preferred order with its own, although the chosen ECC must still be within both lists. The configuration is done through the following options: - `eccs`, shared by clients and servers alike, allows the specification of the supported named curves, in their preferred order, and may eventually support more values for explicit primes and so on. - `honor_ecc_order`, a server-only option, is similar to `honor_cipher_order` and will, by default let the server pick the client-preferred ECC, and otherwise pick the server-preferred one. The default value for `eccs` is the same as before, although the server-chosen ECC now defaults to the client rather than previous choice. A function `ssl:eccs()` has been added that returns the highest supported ECCs for the library.
2016-10-21ssl: Change to more modest timeoutsIngela Anderton Andin
This should be fine as timeout problem was due to test case bug that treated a stream as if it was packet oriented.
2016-10-14ssl: Tune timeout for old solaris machineIngela Anderton Andin
2016-10-11Merge branch 'ingela/ssl/crl_SUITE' into maintIngela Anderton Andin
* ingela/ssl/crl_SUITE: ssl: Make sure test has correct input
2016-10-04ssl: Correct tests tcp stream handlingIngela Anderton Andin
Data collection function active_once_raw/4 did not handle streamed data correctly (it assumed the stream was "packet oriented"), which could result in that the test case perceived that it did not receive all data even though it did.
2016-09-30ssl: Correct anonymous suite handlingIngela Anderton Andin
Test suite did not take TLS-version in to account. Also some anonymous suites where included incorrectly in some TLS versions.
2016-09-21ssl: Make sure test has correct inputIngela Anderton Andin
2016-09-14Merge branch 'ingela/ssl/packet-tests' into maintIngela Anderton Andin
* ingela/ssl/packet-tests: ssl: Add timetrap scale calls ssl: Add nodelay to packet=0|raw tests
2016-09-13ssl: Add timetrap scale callsIngela Anderton Andin
2016-09-12Merge branch 'ferd/bypass-pem-cache/PR-1143/OTP-13883' into maintIngela Anderton Andin
* ferd/bypass-pem-cache/PR-1143/OTP-13883: ssl: Add documentation of bypass_pem_cache application environment configuration ssl: Add new benchmarks to skip file for normal testing Adding PEM cache bypass benchmark entries Fixing CRL searching in cache bypass Add option to bypass SSL PEM cache
2016-09-07ssl: Make sure tests get a clean startIngela Anderton Andin
2016-09-07ssl: Tune timeoutIngela Anderton Andin
2016-09-07ssl: Consistent timeout handlingIngela Anderton Andin
init_per_testcase timeout for renegotiation tests would be overridden by local timeout in test case help function.
2016-09-06Merge branch 'ingela/ssl/dtls-progress/connection-states-as-maps' into maintIngela Anderton Andin
* ingela/ssl/dtls-progress/connection-states-as-maps: dtls: fix encoding of client hello cookie dtls: Prepare start of DTLS connection manager with SSL app ssl: Refactor to use maps for the connection states ssl, dtls: Refactor sni handling dtls: Add close/5 dtls: Add renegotiate/2 dtls: Add protocol event handling ssl: Refactor code so that tls and dtls can share more code ssl, dtls: Disable V2 compatibility clause from ssl_handshake:update_handshake_history ssl: Make sure common code for TLS and DTLS uses the TLS Version ssl: remove unused RecordCB argument from master_secret dtls: Add reinit_handshake_data/1 to dtls dtls: replace tls_record with RecordCB in connection_info Fix version numbers and dependencies
2016-09-05ssl: Refactor to use maps for the connection statesIngela Anderton Andin
2016-09-05ssl: Make sure to have correct defaultIngela Anderton Andin
2016-09-05ssl: Add nodelay to packet=0|raw testsIngela Anderton Andin
2016-09-02ssl: Test ssl v2 clients rejection depending on configurationIngela Anderton Andin
Even though v2 is never supported v2 hellos can be. No support for v2 client hellos gives "handshake failiure" alert. Support for v2 hello but no higher SSL/TLS version offered gives "protocol version" alert.
2016-09-02ssl: Add new benchmarks to skip file for normal testingIngela Anderton Andin
2016-09-02ssl: Add check in test framework for crypto supportIngela Anderton Andin
Avoid to run tests of algorithms not supported by crypto.
2016-08-31Adding PEM cache bypass benchmark entriesFred Hebert
The benchmarks run through the local node only, as an attempt to show more potential contention on certificate usage.
2016-08-31Merge branch 'raimo/gen_statem-callback_mode/OTP-13752' into maintRaimo Niskanen
* raimo/gen_statem-callback_mode/OTP-13752: ssl: Upgrade suite testing skipped if stdlib upgrade is required Fix version numbers and dependencies Conflicts: lib/ssl/src/ssl.appup.src lib/ssl/vsn.mk
2016-08-31Merge branch 'ingela/ssl/cuddle' into maintIngela Anderton Andin
* ingela/ssl/cuddle: ssl: Test and test suites shall be independent of each other
2016-08-30ssl: Timeout tuningIngela Anderton Andin
Skip some test on really slow solaris machines
2016-08-25ssl: Upgrade suite testing skipped if stdlib upgrade is requiredIngela Anderton Andin
2016-08-18ssl: Check precondition for ssl_npn_hello_SUITEIngela Anderton Andin
2016-07-08ssl: Test and test suites shall be independent of each otherIngela Anderton Andin
Make sure ssl application has a fresh start, so that test do not fail due to that other tests did not clean up properly.
2016-07-08ssl: Simplify and refactor testsIngela Anderton Andin
Tests in ECC_SUITE did not always use the certs implied by the name. Variable naming also confused the intent. ssl_certificate_verify_SUITE did not clean up properly and tests could fail due to cache problems.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 16:52:09 +0000