summaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* Fix test for DH cipher directiveRob Crittenden2016-02-291-0/+2
| | | | | | | Since we don't support ADH ciphers can just ignore DH-* Note that OpenSSL defines the DH- ciphers but does not implement them so the DH string support is there only for compatibility.
* tests: Centralize the openssl ciphers flags when comparingRob Crittenden2016-02-291-56/+64
| | | | | | | I used to have a separate set of options when comparing the NSS and OpenSSL ciphers. These differed between tests, sometimes being just a difference in order. This just made the tests hard to understand.
* Basic test case for DHE cipher negotiationRob Crittenden2016-02-293-0/+16
|
* Remove -DH from test strings, duplicate test, fix testRob Crittenden2016-02-291-29/+29
| | | | | | | The AESGCM test was duplicated. Remove one. Two different tests were in test_AES_no_ECDH. I broke one out separately.
* Add basic reverse proxy test case (over Internet)Rob Crittenden2016-01-193-0/+19
| | | | | | | | Fetches https://www.google.com and just looks for a 200 response. This adds implicit requirement that the test machine has Internet access so I might have to remove this eventually, but it at least exercises that code in a positive test case.
* Add test for colons in FakeBasicAuth user certificateRob Crittenden2016-01-152-1/+13
| | | | | | Update gencert to do a better job parsing arguments so I can pass in a --test flag to generate a special test-only user certificate to test colons in the DN.
* Add cipher test for ECDH+aRSARob Crittenden2016-01-151-0/+3
|
* Fix typo in valgrind in start script, create separate logsRob Crittenden2015-10-021-1/+1
| | | | | Use the %p option to generate separate logs for each process with valgrind.
* Add a test for reverse proxy SNIRob Crittenden2015-10-025-3/+31
|
* Fix compatibility with RHEL 6.x (Apache 2.2.x and NSS 3.15.1)Rob Crittenden2015-10-021-2/+3
|
* Add -DH as another exclusion in the SSLv3 cipher testRob Crittenden2015-10-021-1/+1
| | | | make check was failing in Fedora rawhide
* Enable the core dump directoryRob Crittenden2015-10-021-0/+2
|
* Always enable the glibc memory checking routinesRob Crittenden2015-10-021-1/+3
|
* Add test suite for SNIRob Crittenden2015-10-0210-125/+432
| | | | | | | | | | | | | | | | | | | | | | | | | python for OpenSSL is in quite a sad state with several competing mid-level implementations which provide different feature sets. The httplib client provides access to the negotiated cipher and protocol but not SNI (and it has lousy hostname checking). The urllib3 client provides SNI and is generally better but doesn't give any details on the connection. So I'm using both. The original one is used for basic server testing and the urllib3 one is used just for SNI testing. Also: - Indent the test configuration to make it more readable - Add separate config file for SNI testing - Add a CGI configuration and script to test CGI variables - Change client cipher test to use AES256-SHA instead of RC4 - Add a commented-out valgrind option in start for future debuggers - Change the VirtualServers to *:port and use ServerName - Add per-VH document roots so SNI can be more easily tested
* NSS added support for some SHA384 ciphers, add themRob Crittenden2015-10-021-3/+7
| | | | | | | I don't want to assume these ciphers are available in every distro so I'm bending over backwards a bit to check for availablility and get the defines right for the python cipher tests.
* Implement EECDH, kECDH, AECDH, ECDSA and aECDSA cipher macrosRob Crittenden2015-10-021-0/+18
| | | | Also add test for AESGCM
* The OpenSSL DEFAULT cipher macro shouldn't enable NULL ciphersRob Crittenden2015-10-021-0/+8
|
* Fix logical AND support in OpenSSL cipher compatibilityRob Crittenden2015-07-224-85/+182
| | | | | | | | | | | | | | | | | | | | | | | | | The + operator didn't perform properly at all. It is supposed to be used either for logical AND to combine two cipher suites or to move ciphers to the end of the list. Given that NSS doesn't support cipher ordering + is a no-op in this case. Also add in a slew of missing aliases: kRSA, aRSA, EDH, ECDH, kECDHe, kECDHr, kEECDH, aECDH, aNULL, AESGCM, AES128, AES256, CAMELLIA, CAMELLIA128, CAMELLIA256. Fix the definition of TLSv1.2. Define some ciphers as unimplemented in NSS. Renumber the mask/protocol/strength values to ensure uniqueness. Replace the existing cipher test to one that compares the output of the NSS-generated cipher string with the openssl generated string. There are a lot of restrictions on the openssl string since so much isn't either implemented or needed for mod_nss. Add a new openssl-compatible cipher request test to the server tests.
* Fix test failure due to line number change in test_cipher.pyRob Crittenden2015-02-271-1/+1
| | | | | | | I'm not going to commit a million of these 1-liners but I think the code is stable enough that it won't be a big deal. If it happens again I'll see about adding a fuzzer to assert_equal() to avoid line number differences.
* Add compatibility for mod_ssl-style cipher definitionsRob Crittenden2014-12-026-4/+214
| | | | | | | | - Add Camelia ciphers - Remove Fortezza ciphers - Add TLSv1.2-specific ciphers Resolves BZ: #862938
* Add support for sqlite NSS databasesRob Crittenden2014-10-284-10/+12
| | | | | | | | | | | | We do a chdir() to the NSS database location so that libnssckbi.so is available when the database is opened. Strip off a sql: prefix if one is available. This allows the new sqlite format to work. Add an additional test pass configuring NSS using the sqlite format. This requires a bit of a hack to pass in the value to python but it will work for now. Resolves: #1057650
* gencert is not executable in the tree so call bash directlyRob Crittenden2014-10-221-1/+1
|
* Add a new VirtualHost for testing TLS v1.2Rob Crittenden2014-10-177-15/+202
| | | | | | Protocol is a per-server or Virtual Host setting so I added a new VH to do TLSv1.2 testing. It isn't as configurable as I'd like because the port is hardcoded but it'll do for now.
* Add some basic functional tests.Rob Crittenden2014-02-268-0/+1744
This tests in an in-tree Apache instance using the local libmodnss.so shared library, so no pre-installation is necessary. The tests use python-nose and a hacked python-requests library. It is hacked so I can obtain the negotiated cipher and protocol as well as pass a few other things into it. Tests right now are limited to GET requests. A new user certificate for 'beta' was added to gencert to do pass/fail access control testing. The basic process of the tests are: - run setup.sh which sets up a new instance with createinstance.sh and does some variable substitution. - nosetests -v I picture multiple test "suites" of different configurations. Right now there is only one. A template file is provided for each suite. Tested only on Fedora 20 right now.
generated by cgit (git 2.34.1) at 2025-07-01 14:55:22 +0000