diff options
Diffstat (limited to 'test/recipes')
| -rw-r--r-- | test/recipes/70-test_tls13ticket.t | 26 | ||||
| -rw-r--r-- | test/recipes/80-test_cms.t | 47 | ||||
| -rw-r--r-- | test/recipes/80-test_cmsapi.t | 3 | ||||
| -rw-r--r-- | test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der | bin | 0 -> 193 bytes |
4 files changed, 74 insertions, 2 deletions
diff --git a/test/recipes/70-test_tls13ticket.t b/test/recipes/70-test_tls13ticket.t new file mode 100644 index 000000000000..d05bb357d2a7 --- /dev/null +++ b/test/recipes/70-test_tls13ticket.t @@ -0,0 +1,26 @@ +#! /usr/bin/env perl +# Copyright 2026 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the Apache License 2.0 (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + +use OpenSSL::Test::Simple; +use OpenSSL::Test qw/:DEFAULT srctop_file/; +use OpenSSL::Test::Utils qw(disabled); + +setup("test_tls13ticket"); + +plan skip_all => "needs TLSv1.3 enabled" + if disabled("tls1_3"); + +plan skip_all => "needs EC enabled" + if disabled("ec"); + + +plan tests => 1; + +ok(run(test(["tls13ticket_test", srctop_file("apps", "server.pem"), + srctop_file("apps", "server.pem")])), + "running tls13ticket_test"); diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t index b6ee61464409..2f850c6e0ee8 100644 --- a/test/recipes/80-test_cms.t +++ b/test/recipes/80-test_cms.t @@ -51,7 +51,7 @@ my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib) $no_rc2 = 1 if disabled("legacy"); -plan tests => 23; +plan tests => 26; ok(run(test(["pkcs7_test"])), "test pkcs7"); @@ -1011,6 +1011,23 @@ subtest "CMS binary input tests\n" => sub { "verify binary input with -binary missing -crlfeol"); }; +# Regression test for PKCS7_verify() ownership handling when +# digestAlgorithms is an empty SET. +# The malformed structure must fail cleanly without crashing or +# triggering use-after-free behaviour. +with({ exit_checker => sub { return shift == 4; } }, + sub { + ok(run(app([ + 'openssl', 'smime', + '-verify', + '-noverify', + '-in', + srctop_file('test', 'smime-eml', + 'pkcs7-empty-digest-set.eml'), + ])), + "Check empty digestAlgorithms SET is handled safely"); + }); + # Test case for missing MD algorithm (must not segfault) with({ exit_checker => sub { return shift == 4; } }, @@ -1054,6 +1071,16 @@ ok(!run(app(['openssl', 'cms', '-verify', ])), "issue#19643"); +# Check that users get error when using incorrect envelope type for AEAD algorithms +ok(!run(app(['openssl', 'cms', '-decrypt', + '-inform', 'PEM', '-stream', + '-secretkey', '000102030405060708090A0B0C0D0E0F', + '-secretkeyid', 'C0FEE0', + '-in', srctop_file("test/cms-msg", + "enveloped-content-type-for-aes-gcm.pem") + ])), + "Error AES-GCM in enveloped content type"); + # Check that kari encryption with originator does not segfault with({ exit_checker => sub { return shift == 3; } }, sub { @@ -1196,3 +1223,21 @@ subtest "encrypt to three recipients with RSA-OAEP, key only decrypt" => sub { "decrypt with key only"); is(compare($pt, $ptpt), 0, "compare original message with decrypted ciphertext"); }; + +# Regression test for NULL dereference in PWRI decrypt path +# when optional keyDerivationAlgorithm is omitted. +subtest "PWRI missing keyDerivationAlgorithm regression" => sub { + plan tests => 1; + + with({ exit_checker => sub { return shift == 4; } }, sub { + ok(run(app([ + "openssl", "cms", @prov, + "-decrypt", + "-inform", "DER", + "-in", + srctop_file('test', 'cms-msg', 'missing-kdf.der'), + "-out", "pwri-out.txt", + "-pwri_password", "secret"])), + "missing keyDerivationAlgorithm is rejected"); + }); +}; diff --git a/test/recipes/80-test_cmsapi.t b/test/recipes/80-test_cmsapi.t index 8d9371e005c0..3d1dae846464 100644 --- a/test/recipes/80-test_cmsapi.t +++ b/test/recipes/80-test_cmsapi.t @@ -19,5 +19,6 @@ plan tests => 1; ok(run(test(["cmsapitest", srctop_file("test", "certs", "servercert.pem"), srctop_file("test", "certs", "serverkey.pem"), srctop_file("test", "recipes", "80-test_cmsapi_data", "encryptedData.der"), - srctop_file("test", "recipes", "80-test_cmsapi_data", "encDataWithTooLongIV.pem")])), + srctop_file("test", "recipes", "80-test_cmsapi_data", "encDataWithTooLongIV.pem"), + srctop_file("test", "recipes", "80-test_cmsapi_data", "cms_pwri_kek_oob.der")])), "running cmsapitest"); diff --git a/test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der b/test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der Binary files differnew file mode 100644 index 000000000000..c3ef3abd10e6 --- /dev/null +++ b/test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der |