Home | History | Annotate | only in /src/crypto/external/bsd/openssl/dist/test
Up to higher level directory
NameDateSize
aborttest.c07-May-2023467
acvp_test.c16-Apr-202551.7K
acvp_test.inc07-May-202382K
aesgcmtest.c07-May-20234.8K
afalgtest.c07-May-20234.6K
algorithmid_test.c07-May-202310.3K
asn1_decode_test.c07-May-20236.3K
asn1_dsa_internal_test.c07-May-20235.7K
asn1_encode_test.c07-May-202329.7K
asn1_internal_test.c07-May-20235.4K
asn1_stable_parse_test.c11-Jun-20241.8K
asn1_string_table_test.c07-May-20231.9K
asn1_time_test.c07-May-202317.7K
asynciotest.c07-May-202312.3K
asynctest.c07-May-202312.8K
bad_dtls_test.c11-Jun-202420.3K
bftest.c07-May-202315.9K
bio_callback_test.c07-May-202313.6K
bio_core_test.c07-May-20233.4K
bio_enc_test.c07-May-20237.4K
bio_memleak_test.c07-May-20237.2K
bio_prefix_text.c07-May-20237.4K
bio_pw_callback_test.c16-Apr-202510K
bio_readbuffer_test.c07-May-20233.8K
bioprinttest.c07-May-202312.5K
bn_internal_test.c07-May-20232.6K
bn_rand_range.h07-May-20232K
bntest.c11-Jun-202497.9K
bntests.pl07-May-20234.5K
build.info16-Apr-202537.5K
ca-and-certs.cnf07-May-20232.2K
casttest.c07-May-20233.2K
CAtsa.cnf07-May-20234.9K
certs/25-Feb-2026
chacha_internal_test.c25-Oct-20238K
cipher_overhead_test.c07-May-20231.7K
cipherbytes_test.c07-May-20234.4K
cipherlist_test.c07-May-20237K
ciphername_test.c07-May-202320.6K
clienthellotest.c07-May-20238.5K
cmactest.c16-Apr-20256.1K
cmp_asn_test.c25-Oct-20234K
cmp_client_test.c31-May-202318.4K
cmp_ctx_test.c11-Jun-202430.7K
cmp_hdr_test.c11-Jun-202414K
cmp_msg_test.c31-May-202318.2K
cmp_protect_test.c25-Oct-202321.4K
cmp_server_test.c07-May-20235.5K
cmp_status_test.c07-May-20233.2K
cmp_vfy_test.c31-May-202323.6K
cms-examples.pl07-May-20238.7K
cmsapitest.c25-Oct-202315.6K
conf_include_test.c16-Apr-20255.7K
confdump.c07-May-20231.4K
constant_time_test.c07-May-202312.3K
context_internal_test.c07-May-20233.6K
crltest.c08-Sep-202415.9K
ct/25-Feb-2026
ct_test.c11-Jun-202415.8K
ctype_internal_test.c07-May-20232.7K
curve448_internal_test.c07-May-202335.9K
d2i-tests/25-Feb-2026
d2i_test.c07-May-20234.1K
dane-cross.in07-May-20236.9K
danetest.c07-May-202311K
danetest.in11-Jun-202494.5K
danetest.pem08-Feb-2018652
data.bin07-Jan-2022128
data2.bin07-May-20233.7K
default-and-fips.cnf07-May-2023264
default-and-legacy.cnf07-May-2023271
default.cnf07-May-2023222
defltfips_test.c07-May-20233K
destest.c31-May-202331.4K
dhtest.c25-Oct-202336K
drbgtest.c16-Apr-202527K
dsa_no_digest_size_test.c07-May-20238.5K
dsatest.c11-Jun-202418K
dtls_mtu_test.c07-May-20237.1K
dtlstest.c31-May-202319.6K
dtlsv1listentest.c07-May-202312.3K
ec_internal_test.c16-Apr-202516.1K
ecdsatest.c11-Jun-202414.6K
ecdsatest.h22-Mar-2020673.6K
ecstresstest.c11-Jun-20244.1K
ectest.c07-May-2023121.8K
endecode_test.c08-Sep-202458K
endecoder_legacy_test.c07-May-202327.8K
enginetest.c16-Apr-202513.1K
errtest.c07-May-202310.5K
evp_byname_test.c08-Sep-2024900
evp_extra_test.c08-Sep-2024184.3K
evp_extra_test2.c11-Jun-202454K
evp_fetch_prov_test.c07-May-202310.4K
evp_kdf_test.c16-Apr-202558.3K
evp_libctx_test.c16-Apr-202530K
evp_pkey_ctx_new_from_name.c07-May-2023279
evp_pkey_dparams_test.c07-May-202313.5K
evp_pkey_provided_test.c11-Jun-202469.4K
evp_test.c11-Jun-2024120.7K
exdatatest.c07-May-20238.1K
exptest.c07-May-20239.3K
ext_internal_test.c07-May-20232.8K
fake_rsaprov.c07-May-202316K
fake_rsaprov.h07-May-2023543
fatalerrtest.c07-May-20232.9K
ffc_internal_test.c25-Oct-202327.5K
filterprov.c07-May-20237.2K
filterprov.h07-May-2023523
fips-alt.cnf07-May-2023376
fips-and-base.cnf07-May-2023255
fips.cnf07-May-2023474
fips_version_test.c07-May-20231.7K
generate_buildtest.pl07-May-2023796
generate_ssl_tests.pl07-May-20234.7K
gmdifftest.c07-May-20231.9K
helpers/25-Feb-2026
hexstr_test.c08-Sep-20243.6K
hmactest.c16-Apr-20258.5K
http_test.c11-Jun-202412.1K
ideatest.c07-May-20233.9K
igetest.c07-May-202316.4K
insta.priv.pem07-May-20231.6K
insta_ca.cert.pem07-May-20231.3K
invalid-x509.cnf11-Jun-2024125
keymgmt_internal_test.c11-Jun-202411.5K
legacy.cnf07-May-2023219
lhash_test.c07-May-20236K
localetest.c07-May-20236.4K
mdc2_internal_test.c07-May-20231.7K
mdc2test.c07-May-20232.6K
memleaktest.c16-Apr-20251.7K
modes_internal_test.c07-May-202329.2K
moduleloadtest.c07-May-20231.3K
namemap_internal_test.c07-May-20234.8K
nocache-and-default.cnf16-Apr-2025301
nodefltctxtest.c31-May-20231.7K
null.cnf31-May-2023213
ocsp-tests/25-Feb-2026
ocspapitest.c07-May-20236.3K
ossl_store_test.c07-May-20235.9K
p_minimal.c11-Jun-2024765
p_test.c16-Apr-202511.6K
packettest.c07-May-202315.2K
param_build_test.c07-May-202320.5K
params_api_test.c07-May-202324.6K
params_conversion_test.c07-May-202311.9K
params_test.c11-Jun-202424.3K
pathed.cnf11-Jun-2024356
pbelutest.c07-May-20231.4K
pbetest.c25-Oct-20234.8K
pem_read_depr_test.c07-May-20234.1K
pemtest.c25-Oct-20234.5K
pkcs12_format_test.c16-Apr-202535.3K
pkcs7-1.pem19-Jul-2009851
pkcs7.pem19-Jul-20093.7K
pkcs7_test.c07-May-20235.7K
pkey_meth_kdf_test.c11-Jun-20246.8K
pkey_meth_test.c07-May-20232.3K
pkits-test.pl07-May-202331.2K
poly1305_internal_test.c07-May-202356.2K
property_test.c16-Apr-202523.5K
prov_config_test.c08-Sep-20243.4K
provfetchtest.c07-May-20238.4K
provider_fallback_test.c08-Sep-20241.5K
provider_internal_test.c08-Sep-20244.1K
provider_internal_test.cnf.in07-May-2023347
provider_pkey_test.c07-May-20238.4K
provider_status_test.c07-May-20237.2K
provider_test.c08-Sep-20247.7K
proxy.cnf07-May-20231.7K
punycode_test.c07-May-20238K
rand_status_test.c07-May-2023673
rand_test.c07-May-20232K
rc2test.c07-May-20232.1K
rc4test.c07-May-20234.1K
rc5test.c07-May-20239.1K
rdrand_sanitytest.c07-May-20233.3K
README-dev.md25-Oct-20235.3K
README-external.md07-May-20233.1K
README.md11-Jun-20246.1K
README.ssltest.md07-May-202310.4K
recipes/Today
recordlentest.c07-May-20235.4K
recursive.cnf11-Jun-2024129
rsa_complex.c07-May-2023909
rsa_mp_test.c07-May-202311.3K
rsa_sp800_56b_test.c07-May-202320.9K
rsa_test.c25-Oct-202320.2K
run_tests.pl07-May-202311.9K
sanitytest.c07-May-20234.4K
secmemtest.c07-May-20235.9K
serverinfo.pem14-Oct-2016740
serverinfo2.pem23-Sep-2018412
servername_test.c07-May-20237.4K
session.pem23-Sep-20181.9K
sha_test.c07-May-20233.7K
shibboleth.pfx08-Feb-20182.5K
shlibloadtest.c07-May-20238.9K
simpledynamic.c07-May-20231.7K
simpledynamic.h07-May-20231.2K
siphash_internal_test.c11-Jun-202417.1K
sm2_internal_test.c11-Jun-202414.6K
sm3_internal_test.c07-May-20232.6K
sm4_internal_test.c07-May-20232.3K
smcont.bin07-May-20237.8K
smcont.txt08-Feb-201883
smcont_zero.txt07-May-20230
smime-certs/25-Feb-2026
smime-eml/25-Feb-2026
sparse_array_test.c07-May-20235.6K
srptest.c07-May-20238.1K
ssl-tests/25-Feb-2026
ssl_cert_table_internal_test.c07-May-20232.1K
ssl_ctx_test.c07-May-20232.3K
ssl_old_test.c11-Jun-202498.8K
ssl_test.c07-May-202319.9K
ssl_test.tmpl08-Feb-20184.3K
ssl_test_ctx_test.c07-May-20239.1K
ssl_test_ctx_test.cnf07-May-20232K
sslapitest.c16-Apr-2025377K
sslbuffertest.c11-Jun-202410.6K
sslcorrupttest.c07-May-20237.3K
stack_test.c07-May-20239.4K
sysdefault.cnf11-Jun-2024440
sysdefaulttest.c07-May-20231.1K
test.cnf11-Jun-20242.3K
test_asn1_parse.cnf11-Jun-2024240
test_test.c07-May-202318.2K
testcrl.pem19-Jul-2009938
testdsa.pem08-Feb-2018672
testdsapub.pem08-Feb-2018654
testec-p112r1.pem07-May-2023221
testec-p256.pem08-Feb-2018227
testecpub-p256.pem08-Feb-2018178
tested25519.pem10-Dec-2020119
tested25519pub.pem10-Dec-2020113
tested448.pem10-Dec-2020156
tested448pub.pem10-Dec-2020146
testp7.pem19-Jul-20092.8K
testreq2.pem19-Jul-2009371
testrsa.pem07-May-2023526
testrsa2048.pem07-May-20231.7K
testrsa2048pub.pem07-May-2023451
testrsa_withattrs.der07-Jan-20221.2K
testrsa_withattrs.pem07-Jan-20221.7K
testrsapss.pem07-May-20231.7K
testrsapssmandatory.pem07-May-20231.7K
testrsapub.pem08-Feb-2018182
testsid.pem07-May-20232.3K
testutil/25-Feb-2026
testutil.h07-May-202326.5K
testx509.pem07-May-2023562
threadstest.c16-Apr-202519.8K
threadstest.h07-May-20231.4K
threadstest_fips.c07-May-20231.1K
time_offset_test.c07-May-20233.2K
tls-provider.c11-Jun-202426K
tls13ccstest.c07-May-202315.2K
tls13encryptiontest.c07-May-202313.8K
tls13secretstest.c07-May-202311.5K
trace_api_test.c07-May-20233.9K
uitest.c07-May-20232.2K
upcallstest.c07-May-20233.6K
user_property_test.c07-May-20233.8K
v3-cert1.pem19-Jul-2009944
v3-cert2.pem19-Jul-2009940
v3_ca_exts.cnf07-May-2023136
v3ext.c11-Jun-202416.1K
v3nametest.c07-May-202319.8K
verify_extra_test.c07-May-20238.7K
versions.c07-May-2023674
wpackettest.c07-May-202317.8K
x509_check_cert_pkey_test.c07-May-20234.9K
x509_dup_cert_test.c07-May-20231.4K
x509_internal_test.c07-May-20233K
x509_time_test.c07-May-202317.7K
x509aux.c07-May-20235.2K

README-dev.md

      1 Guidelines for test developers
      2 ==============================
      3 
      4 How to add recipes
      5 ------------------
      6 
      7 For any test that you want to perform, you write a script located in
      8 `test/recipes/`, named `{nn}-test_{name}.t`,
      9 where `{nn}` is a two digit number and
     10 `{name}` is a unique name of your choice.
     11 
     12 Please note that if a test involves a new testing executable, you will need to
     13 do some additions in test/build.info. Please refer to the section
     14 ["Changes to test/build.info"](README.md#changes-to-testbuildinfo) below.
     15 
     16 Naming conventions
     17 ------------------
     18 
     19 A test executable is named `test/{name}test.c`
     20 
     21 A test recipe is named `test/recipes/{nn}-test_{name}.t`, where `{nn}` is a two
     22 digit number and `{name}` is a unique name of your choice.
     23 
     24 The number `{nn}` is (somewhat loosely) grouped as follows:
     25 
     26     00-04  sanity, internal and essential API tests
     27     05-09  individual symmetric cipher algorithms
     28     10-14  math (bignum)
     29     15-19  individual asymmetric cipher algorithms
     30     20-24  openssl commands (some otherwise not tested)
     31     25-29  certificate forms, generation and verification
     32     30-35  engine and evp
     33     60-79  APIs:
     34        60  X509 subsystem
     35        61  BIO subsystem
     36        65  CMP subsystem
     37        70  PACKET layer
     38     80-89  "larger" protocols (CA, CMS, OCSP, SSL, TSA)
     39     90-98  misc
     40     99     most time consuming tests [such as test_fuzz]
     41 
     42 A recipe that just runs a test executable
     43 -----------------------------------------
     44 
     45 A script that just runs a program looks like this:
     46 
     47     #! /usr/bin/env perl
     48 
     49     use OpenSSL::Test::Simple;
     50 
     51     simple_test("test_{name}", "{name}test", "{name}");
     52 
     53 `{name}` is the unique name you have chosen for your test.
     54 
     55 The second argument to `simple_test` is the test executable, and `simple_test`
     56 expects it to be located in `test/`
     57 
     58 For documentation on `OpenSSL::Test::Simple`,
     59 do `perldoc util/perl/OpenSSL/Test/Simple.pm`.
     60 
     61 A recipe that runs a more complex test
     62 --------------------------------------
     63 
     64 For more complex tests, you will need to read up on Test::More and
     65 OpenSSL::Test.  Test::More is normally preinstalled, do `man Test::More` for
     66 documentation.  For OpenSSL::Test, do `perldoc util/perl/OpenSSL/Test.pm`.
     67 
     68 A script to start from could be this:
     69 
     70     #! /usr/bin/env perl
     71 
     72     use strict;
     73     use warnings;
     74     use OpenSSL::Test;
     75 
     76     setup("test_{name}");
     77 
     78     plan tests => 2;                # The number of tests being performed
     79 
     80     ok(test1, "test1");
     81     ok(test2, "test1");
     82 
     83     sub test1
     84     {
     85         # test feature 1
     86     }
     87 
     88     sub test2
     89     {
     90         # test feature 2
     91     }
     92 
     93 Changes to test/build.info
     94 --------------------------
     95 
     96 Whenever a new test involves a new test executable you need to do the
     97 following (at all times, replace {NAME} and {name} with the name of your
     98 test):
     99 
    100  * add `{name}` to the list of programs under `PROGRAMS_NO_INST`
    101 
    102  * create a three line description of how to build the test, you will have
    103    to modify the include paths and source files if you don't want to use the
    104    basic test framework:
    105 
    106        SOURCE[{name}]={name}.c
    107        INCLUDE[{name}]=.. ../include ../apps/include
    108        DEPEND[{name}]=../libcrypto libtestutil.a
    109 
    110 Generic form of C test executables
    111 ----------------------------------
    112 
    113     #include "testutil.h"
    114 
    115     static int my_test(void)
    116     {
    117         int testresult = 0;                 /* Assume the test will fail    */
    118         int observed;
    119 
    120         observed = function();              /* Call the code under test     */
    121         if (!TEST_int_eq(observed, 2))      /* Check the result is correct  */
    122             goto end;                       /* Exit on failure - optional   */
    123 
    124         testresult = 1;                     /* Mark the test case a success */
    125     end:
    126         cleanup();                          /* Any cleanup you require      */
    127         return testresult;
    128     }
    129 
    130     int setup_tests(void)
    131     {
    132         ADD_TEST(my_test);                  /* Add each test separately     */
    133         return 1;                           /* Indicates success.  Return 0 */
    134                                             /* to produce an error with a   */
    135                                             /* usage message and -1 for     */
    136                                             /* failure to set up with no    */
    137                                             /* usage message.               */
    138     }
    139 
    140 You should use the `TEST_xxx` macros provided by `testutil.h` to test all failure
    141 conditions.  These macros produce an error message in a standard format if the
    142 condition is not met (and nothing if the condition is met).  Additional
    143 information can be presented with the `TEST_info` macro that takes a `printf`
    144 format string and arguments.  `TEST_error` is useful for complicated conditions,
    145 it also takes a `printf` format string and argument.  In all cases the `TEST_xxx`
    146 macros are guaranteed to evaluate their arguments exactly once.  This means
    147 that expressions with side effects are allowed as parameters.  Thus,
    148 
    149     if (!TEST_ptr(ptr = OPENSSL_malloc(..)))
    150 
    151 works fine and can be used in place of:
    152 
    153     ptr = OPENSSL_malloc(..);
    154     if (!TEST_ptr(ptr))
    155 
    156 The former produces a more meaningful message on failure than the latter.
    157 
    158 Note that the test infrastructure automatically sets up all required environment
    159 variables (such as `OPENSSL_MODULES`, `OPENSSL_CONF`, etc.) for the tests.
    160 Individual tests may choose to override the default settings as required.
    161 

README-external.md

      1 Running external test suites with OpenSSL
      2 =========================================
      3 
      4 It is possible to integrate external test suites into OpenSSL's `make test`.
      5 This capability is considered a developer option and does not work on all
      6 platforms.
      7 
      8 Python PYCA/Cryptography test suite
      9 ===================================
     10 
     11 This python test suite runs cryptographic tests with a local OpenSSL build as
     12 the implementation.
     13 
     14 First checkout the `PYCA/Cryptography` module into `./pyca-cryptography` using:
     15 
     16     $ git submodule update --init
     17 
     18 Then configure/build OpenSSL compatible with the python module:
     19 
     20     $ ./config shared enable-external-tests
     21     $ make
     22 
     23 The tests will run in a python virtual environment which requires virtualenv
     24 to be installed.
     25 
     26     $ make test VERBOSE=1 TESTS=test_external_pyca
     27 
     28 Test failures and suppressions
     29 ------------------------------
     30 
     31 Some tests target older (<=1.0.2) versions so will not run. Other tests target
     32 other crypto implementations so are not relevant. Currently no tests fail.
     33 
     34 krb5 test suite
     35 ===============
     36 
     37 Much like the PYCA/Cryptography test suite, this builds and runs the krb5
     38 tests against the local OpenSSL build.
     39 
     40 You will need a git checkout of krb5 at the top level:
     41 
     42     $ git clone https://github.com/krb5/krb5
     43 
     44 krb5's master has to pass this same CI, but a known-good version is
     45 krb5-1.15.1-final if you want to be sure.
     46 
     47     $ cd krb5
     48     $ git checkout krb5-1.15.1-final
     49     $ cd ..
     50 
     51 OpenSSL must be built with external tests enabled:
     52 
     53     $ ./config enable-external-tests
     54     $ make
     55 
     56 krb5's tests will then be run as part of the rest of the suite, or can be
     57 explicitly run (with more debugging):
     58 
     59     $ VERBOSE=1 make TESTS=test_external_krb5 test
     60 
     61 Test-failures suppressions
     62 --------------------------
     63 
     64 krb5 will automatically adapt its test suite to account for the configuration
     65 of your system.  Certain tests may require more installed packages to run.  No
     66 tests are expected to fail.
     67 
     68 GOST engine test suite
     69 ===============
     70 
     71 Much like the PYCA/Cryptography test suite, this builds and runs the GOST engine
     72 tests against the local OpenSSL build.
     73 
     74 You will need a git checkout of gost-engine at the top level:
     75 
     76     $ git submodule update --init
     77 
     78 Then configure/build OpenSSL enabling external tests:
     79 
     80     $ ./config shared enable-external-tests
     81     $ make
     82 
     83 GOST engine requires CMake for the build process.
     84 
     85 GOST engine tests will then be run as part of the rest of the suite, or can be
     86 explicitly run (with more debugging):
     87 
     88     $ make test VERBOSE=1 TESTS=test_external_gost_engine
     89 
     90 Updating test suites
     91 ====================
     92 
     93 To update the commit for any of the above test suites:
     94 
     95 - Make sure the submodules are cloned locally:
     96 
     97     $ git submodule update --init --recursive
     98 
     99 - Enter subdirectory and pull from the repository (use a specific branch/tag if required):
    100 
    101     $ cd `<submodule-dir>`
    102     $ git pull origin master
    103 
    104 - Go to root directory, there should be a new git status:
    105 
    106     $ cd ../
    107     $ git status
    108       ...
    109       #       modified:   `<submodule-dir>` (new commits)
    110       ...
    111 
    112 - Add/commit/push the update
    113 
    114     $ git add `<submodule-dir>`
    115     $ git commit -m `"Updated <submodule> to latest commit"`
    116     $ git push
    117 

README.md

      1 Using OpenSSL Tests
      2 ===================
      3 
      4 After a successful build, and before installing, the libraries should be tested.
      5 Run:
      6 
      7     $ make test                                      # Unix
      8     $ mms test                                       ! OpenVMS
      9     $ nmake test                                     # Windows
     10 
     11 **Warning:** you MUST run the tests from an unprivileged account
     12 (or disable your privileges temporarily if your platform allows it).
     13 
     14 If some tests fail, take a look at the section Test Failures below.
     15 
     16 Test Failures
     17 -------------
     18 
     19 If some tests fail, look at the output.  There may be reasons for the failure
     20 that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue).
     21 You may want increased verbosity, that can be accomplished like this:
     22 
     23 Full verbosity, showing full output of all successful and failed test cases
     24 (`make` macro `VERBOSE` or `V`):
     25 
     26     $ make V=1 test                                  # Unix
     27     $ mms /macro=(V=1) test                          ! OpenVMS
     28     $ nmake V=1 test                                 # Windows
     29 
     30 Verbosity on failed (sub-)tests only
     31 (`VERBOSE_FAILURE` or `VF` or `REPORT_FAILURES`):
     32 
     33     $ make test VF=1
     34 
     35 Verbosity on failed (sub-)tests, in addition progress on succeeded (sub-)tests
     36 (`VERBOSE_FAILURE_PROGRESS` or `VFP` or `REPORT_FAILURES_PROGRESS`):
     37 
     38     $ make test VFP=1
     39 
     40 If you want to run just one or a few specific tests, you can use
     41 the make variable TESTS to specify them, like this:
     42 
     43     $ make TESTS='test_rsa test_dsa' test            # Unix
     44     $ mms/macro="TESTS=test_rsa test_dsa" test       ! OpenVMS
     45     $ nmake TESTS="test_rsa test_dsa" test           # Windows
     46 
     47 And of course, you can combine (Unix examples shown):
     48 
     49     $ make test TESTS='test_rsa test_dsa' VF=1
     50     $ make test TESTS="test_cmp_*" VFP=1
     51 
     52 You can find the list of available tests like this:
     53 
     54     $ make list-tests                                # Unix
     55     $ mms list-tests                                 ! OpenVMS
     56     $ nmake list-tests                               # Windows
     57 
     58 Have a look at the manual for the perl module Test::Harness to
     59 see what other HARNESS_* variables there are.
     60 
     61 To report a bug please open an issue on GitHub, at
     62 <https://github.com/openssl/openssl/issues>.
     63 
     64 For more details on how the `make` variables `TESTS` can be used,
     65 see section Running Selected Tests below.
     66 
     67 Running Selected Tests
     68 ----------------------
     69 
     70 The `make` variable `TESTS` supports a versatile set of space separated tokens
     71 with which you can specify a set of tests to be performed.  With a "current
     72 set of tests" in mind, initially being empty, here are the possible tokens:
     73 
     74      alltests      The current set of tests becomes the whole set of available
     75                    tests (as listed when you do 'make list-tests' or similar).
     76 
     77      xxx           Adds the test 'xxx' to the current set of tests.
     78 
     79     -xxx           Removes 'xxx' from the current set of tests.  If this is the
     80                    first token in the list, the current set of tests is first
     81                    assigned the whole set of available tests, effectively making
     82                    this token equivalent to TESTS="alltests -xxx".
     83 
     84      nn            Adds the test group 'nn' (which is a number) to the current
     85                    set of tests.
     86 
     87     -nn            Removes the test group 'nn' from the current set of tests.
     88                    If this is the first token in the list, the current set of
     89                    tests is first assigned the whole set of available tests,
     90                    effectively making this token equivalent to
     91                    TESTS="alltests -xxx".
     92 
     93 Also, all tokens except for "alltests" may have wildcards, such as *.
     94 (on Unix and Windows, BSD style wildcards are supported, while on VMS,
     95 it's VMS style wildcards)
     96 
     97 ### Examples
     98 
     99 Run all tests except for the fuzz tests:
    100 
    101     $ make TESTS='-test_fuzz*' test
    102 
    103 or, if you want to be explicit:
    104 
    105     $ make TESTS='alltests -test_fuzz*' test
    106 
    107 Run all tests that have a name starting with "test_ssl" but not those
    108 starting with "test_ssl_":
    109 
    110     $ make TESTS='test_ssl* -test_ssl_*' test
    111 
    112 Run only test group 10:
    113 
    114     $ make TESTS='10' test
    115 
    116 Run all tests except the slow group (group 99):
    117 
    118     $ make TESTS='-99' test
    119 
    120 Run all tests in test groups 80 to 99 except for tests in group 90:
    121 
    122     $ make TESTS='[89]? -90' test
    123 
    124 To run specific fuzz tests you can use for instance:
    125 
    126     $ make test TESTS='test_fuzz_cmp test_fuzz_cms'
    127 
    128 To stochastically verify that the algorithm that produces uniformly distributed
    129 random numbers is operating correctly (with a false positive rate of 0.01%):
    130 
    131     $ ./util/wrap.sh test/bntest -stochastic
    132 
    133 Running Tests in Parallel
    134 -------------------------
    135 
    136 By default the test harness will execute the selected tests sequentially.
    137 Depending on the platform characteristics, running more than one test job in
    138 parallel may speed up test execution.
    139 This can be requested by setting the `HARNESS_JOBS` environment variable to a
    140 positive integer value. This specifies the maximum number of test jobs to run in
    141 parallel.
    142 
    143 Depending on the Perl version different strategies could be adopted to select
    144 which test recipes can be run in parallel.  In recent versions of Perl, unless
    145 specified otherwise, any task can be run in parallel. Consult the documentation
    146 for `TAP::Harness` to know more.
    147 
    148 To run up to four tests in parallel at any given time:
    149 
    150     $ make HARNESS_JOBS=4 test
    151 
    152 Randomisation of Test Ordering
    153 ------------------------------
    154 
    155 By default, the test harness will execute tests in the order they were added.
    156 By setting the `OPENSSL_TEST_RAND_ORDER` environment variable to zero, the
    157 test ordering will be randomised.  If a randomly ordered test fails, the
    158 seed value used will be reported.  Setting the `OPENSSL_TEST_RAND_ORDER`
    159 environment variable to this value will rerun the tests in the same
    160 order.  This assures repeatability of randomly ordered test runs.
    161 This repeatability is independent of the operating system, processor or
    162 platform used.
    163 
    164 To randomise the test ordering:
    165 
    166     $ make OPENSSL_TEST_RAND_ORDER=0 test
    167 
    168 To run the tests using the order defined by the random seed `42`:
    169 
    170     $ make OPENSSL_TEST_RAND_ORDER=42 test
    171 

README.ssltest.md

      1 SSL tests
      2 =========
      3 
      4 SSL testcases are configured in the `ssl-tests` directory.
      5 
      6 Each `ssl_*.cnf.in` file contains a number of test configurations. These files
      7 are used to generate testcases in the OpenSSL CONF format.
      8 
      9 The precise test output can be dependent on the library configuration. The test
     10 harness generates the output files on the fly.
     11 
     12 However, for verification, we also include checked-in configuration outputs
     13 corresponding to the default configuration. These testcases live in
     14 `test/ssl-tests/*.cnf` files.
     15 
     16 For more details, see `ssl-tests/01-simple.cnf.in` for an example.
     17 
     18 Configuring the test
     19 --------------------
     20 
     21 First, give your test a name. The names do not have to be unique.
     22 
     23 An example test input looks like this:
     24 
     25     {
     26         name => "test-default",
     27         server => { "CipherString" => "DEFAULT" },
     28         client => { "CipherString" => "DEFAULT" },
     29         test   => { "ExpectedResult" => "Success" },
     30     }
     31 
     32 The test section supports the following options
     33 
     34 ### Test mode
     35 
     36 * Method - the method to test. One of DTLS or TLS.
     37 
     38 * HandshakeMode - which handshake flavour to test:
     39   - Simple - plain handshake (default)
     40   - Resume - test resumption
     41   - RenegotiateServer - test server initiated renegotiation
     42   - RenegotiateClient - test client initiated renegotiation
     43 
     44 When HandshakeMode is Resume or Renegotiate, the original handshake is expected
     45 to succeed. All configured test expectations are verified against the second
     46 handshake.
     47 
     48 * ApplicationData - amount of application data bytes to send (integer, defaults
     49   to 256 bytes). Applies to both client and server. Application data is sent in
     50   64kB chunks (but limited by MaxFragmentSize and available parallelization, see
     51   below).
     52 
     53 * MaxFragmentSize - maximum send fragment size (integer, defaults to 512 in
     54   tests - see `SSL_CTX_set_max_send_fragment` for documentation). Applies to
     55   both client and server. Lowering the fragment size will split handshake and
     56   application data up between more `SSL_write` calls, thus allowing to exercise
     57   different code paths. In particular, if the buffer size (64kB) is at least
     58   four times as large as the maximum fragment, interleaved multi-buffer crypto
     59   implementations may be used on some platforms.
     60 
     61 ### Test expectations
     62 
     63 * ExpectedResult - expected handshake outcome. One of
     64   - Success - handshake success
     65   - ServerFail - serverside handshake failure
     66   - ClientFail - clientside handshake failure
     67   - InternalError - some other error
     68 
     69 * ExpectedClientAlert, ExpectedServerAlert - expected alert. See
     70   `test/helpers/ssl_test_ctx.c` for known values. Note: the expected alert is currently
     71   matched against the _last_ received alert (i.e., a fatal alert or a
     72   `close_notify`). Warning alert expectations are not yet supported. (A warning
     73   alert will not be correctly matched, if followed by a `close_notify` or
     74   another alert.)
     75 
     76 * ExpectedProtocol - expected negotiated protocol. One of
     77   SSLv3, TLSv1, TLSv1.1, TLSv1.2.
     78 
     79 * SessionTicketExpected - whether or not a session ticket is expected
     80   - Ignore - do not check for a session ticket (default)
     81   - Yes - a session ticket is expected
     82   - No - a session ticket is not expected
     83 
     84 * SessionIdExpected - whether or not a session id is expected
     85   - Ignore - do not check for a session id (default)
     86   - Yes - a session id is expected
     87   - No - a session id is not expected
     88 
     89 * ResumptionExpected - whether or not resumption is expected (Resume mode only)
     90   - Yes - resumed handshake
     91   - No - full handshake (default)
     92 
     93 * ExpectedNPNProtocol, ExpectedALPNProtocol - NPN and ALPN expectations.
     94 
     95 * ExpectedTmpKeyType - the expected algorithm or curve of server temp key
     96 
     97 * ExpectedServerCertType, ExpectedClientCertType - the expected algorithm or
     98   curve of server or client certificate
     99 
    100 * ExpectedServerSignHash, ExpectedClientSignHash - the expected
    101   signing hash used by server or client certificate
    102 
    103 * ExpectedServerSignType, ExpectedClientSignType - the expected
    104   signature type used by server or client when signing messages
    105 
    106 * ExpectedClientCANames - for client auth list of CA names the server must
    107   send. If this is "empty" the list is expected to be empty otherwise it
    108   is a file of certificates whose subject names form the list.
    109 
    110 * ExpectedServerCANames - list of CA names the client must send, TLS 1.3 only.
    111   If this is "empty" the list is expected to be empty otherwise it is a file
    112   of certificates whose subject names form the list.
    113 
    114 Configuring the client and server
    115 ---------------------------------
    116 
    117 The client and server configurations can be any valid `SSL_CTX`
    118 configurations. For details, see the manpages for `SSL_CONF_cmd`.
    119 
    120 Give your configurations as a dictionary of CONF commands, e.g.
    121 
    122     server => {
    123         "CipherString" => "DEFAULT",
    124         "MinProtocol" => "TLSv1",
    125     }
    126 
    127 The following sections may optionally be defined:
    128 
    129 * server2 - this section configures a secondary context that is selected via the
    130   ServerName test option. This context is used whenever a ServerNameCallback is
    131   specified. If the server2 section is not present, then the configuration
    132   matches server.
    133 * resume_server - this section configures the client to resume its session
    134   against a different server. This context is used whenever HandshakeMode is
    135   Resume. If the resume_server section is not present, then the configuration
    136   matches server.
    137 * resume_client - this section configures the client to resume its session with
    138   a different configuration. In practice this may occur when, for example,
    139   upgraded clients reuse sessions persisted on disk.  This context is used
    140   whenever HandshakeMode is Resume. If the resume_client section is not present,
    141   then the configuration matches client.
    142 
    143 ### Configuring callbacks and additional options
    144 
    145 Additional handshake settings can be configured in the `extra` section of each
    146 client and server:
    147 
    148     client => {
    149         "CipherString" => "DEFAULT",
    150         extra => {
    151             "ServerName" => "server2",
    152         }
    153     }
    154 
    155 #### Supported client-side options
    156 
    157 * ClientVerifyCallback - the client's custom certificate verify callback.
    158   Used to test callback behaviour. One of
    159   - None - no custom callback (default)
    160   - AcceptAll - accepts all certificates.
    161   - RejectAll - rejects all certificates.
    162 
    163 * ServerName - the server the client should attempt to connect to. One of
    164   - None - do not use SNI (default)
    165   - server1 - the initial context
    166   - server2 - the secondary context
    167   - invalid - an unknown context
    168 
    169 * CTValidation - Certificate Transparency validation strategy. One of
    170   - None - no validation (default)
    171   - Permissive - SSL_CT_VALIDATION_PERMISSIVE
    172   - Strict - SSL_CT_VALIDATION_STRICT
    173 
    174 #### Supported server-side options
    175 
    176 * ServerNameCallback - the SNI switching callback to use
    177   - None - no callback (default)
    178   - IgnoreMismatch - continue the handshake on SNI mismatch
    179   - RejectMismatch - abort the handshake on SNI mismatch
    180 
    181 * BrokenSessionTicket - a special test case where the session ticket callback
    182   does not initialize crypto.
    183   - No (default)
    184   - Yes
    185 
    186 #### Mutually supported options
    187 
    188 * NPNProtocols, ALPNProtocols - NPN and ALPN settings. Server and client
    189   protocols can be specified as a comma-separated list, and a callback with the
    190   recommended behaviour will be installed automatically.
    191 
    192 * SRPUser, SRPPassword - SRP settings. For client, this is the SRP user to
    193   connect as; for server, this is a known SRP user.
    194 
    195 ### Default server and client configurations
    196 
    197 The default server certificate and CA files are added to the configurations
    198 automatically. Server certificate verification is requested by default.
    199 
    200 You can override these options by redefining them:
    201 
    202     client => {
    203         "VerifyCAFile" => "/path/to/custom/file"
    204     }
    205 
    206 or by deleting them
    207 
    208     client => {
    209         "VerifyCAFile" => undef
    210     }
    211 
    212 Adding a test to the test harness
    213 ---------------------------------
    214 
    215 1. Add a new test configuration to `test/ssl-tests`, following the examples of
    216    existing `*.cnf.in` files (for example, `01-simple.cnf.in`).
    217 
    218 2. Generate the generated `*.cnf` test input file. You can do so by running
    219    `generate_ssl_tests.pl`:
    220 
    221     $ ./config
    222     $ cd test
    223     $ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl \
    224       ssl-tests/my.cnf.in default > ssl-tests/my.cnf
    225 
    226 where `my.cnf.in` is your test input file and `default` is the provider to use.
    227 For all the pre-generated test files you should use the default provider.
    228 
    229 For example, to generate the test cases in `ssl-tests/01-simple.cnf.in`, do
    230 
    231     $ TOP=.. perl -I ../util/perl/ generate_ssl_tests.pl \
    232       ssl-tests/01-simple.cnf.in default > ssl-tests/01-simple.cnf
    233 
    234 Alternatively (hackish but simple), you can comment out
    235 
    236     unlink glob $tmp_file;
    237 
    238 in `test/recipes/80-test_ssl_new.t` and run
    239 
    240     $ make TESTS=test_ssl_new test
    241 
    242 This will save the generated output in a `*.tmp` file in the build directory.
    243 
    244 3. Update the number of tests planned in `test/recipes/80-test_ssl_new.t`. If
    245    the test suite has any skip conditions, update those too (see
    246    `test/recipes/80-test_ssl_new.t` for details).
    247 
    248 Running the tests with the test harness
    249 ---------------------------------------
    250 
    251     HARNESS_VERBOSE=yes make TESTS=test_ssl_new test
    252 
    253 Running a test manually
    254 -----------------------
    255 
    256 These steps are only needed during development. End users should run `make test`
    257 or follow the instructions above to run the SSL test suite.
    258 
    259 To run an SSL test manually from the command line, the `TEST_CERTS_DIR`
    260 environment variable to point to the location of the certs. E.g., from the root
    261 OpenSSL directory, do
    262 
    263     $ CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test \
    264       test/ssl-tests/01-simple.cnf default
    265 
    266 or for shared builds
    267 
    268     $ CTLOG_FILE=test/ct/log_list.cnf  TEST_CERTS_DIR=test/certs \
    269       util/wrap.pl test/ssl_test test/ssl-tests/01-simple.cnf default
    270 
    271 In the above examples, `default` is the provider to use.
    272 
    273 Note that the test expectations sometimes depend on the Configure settings. For
    274 example, the negotiated protocol depends on the set of available (enabled)
    275 protocols: a build with `enable-ssl3` has different test expectations than a
    276 build with `no-ssl3`.
    277 
    278 The Perl test harness automatically generates expected outputs, so users who
    279 just run `make test` do not need any extra steps.
    280 
    281 However, when running a test manually, keep in mind that the repository version
    282 of the generated `test/ssl-tests/*.cnf` correspond to expected outputs in with
    283 the default Configure options. To run `ssl_test` manually from the command line
    284 in a build with a different configuration, you may need to generate the right
    285 `*.cnf` file from the `*.cnf.in` input first.
    286