aboutsummaryrefslogtreecommitdiff
path: root/tests
AgeCommit message (Collapse)Author
2020-05-15Do not write extra 0 byte for --gen-key with auth-token/tls-crypt-v2Arne Schwabe
Change crypto_pem_encode to not put a nul-terminated terminated string into the buffer. This was useful for printf but should not be written into the file. Instead do not assume that the buffer is null terminated and print only the number of bytes in the buffer. Also fix a similar case in printing static key where the 0 byte was never added to the buffer Patch V2: make pem_encode behave more like other similar functions in OpenVPN and do not null terminate. Patch V3: also make the mbed TLS variant of pem_decode behave like other similar functions in OpeNVPN and accept a not null-terminated buffer. Patch V4: The newly introduced unit test test_tls_crypt_v2_write_client_key_file_metadata was added after the V3 version of the patch and now misses the strlen with memcmp replacment that were added to test_tls_crypt_v2_write_client_key_file. Also add the modifictions to this function. Unconditionally allocate buffer in mbed TLS path as requested by Steffan. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Steffan Karger <steffan.karger@foxcrypto.com> Message-Id: <20200507132534.6380-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19852.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-05-07convert *_inline attributes to boolAntonio Quartulli
Carrying around the INLINE_TAG is not really efficient, because it requires a strcmp() to be performed every time we want to understand if the data is stored inline or not. Convert all the *_inline attributes to bool to make the logic easier and checks more efficient. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200507135909.21227-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19854.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-05-07t_net.sh: assign MAC address directly during interface creationAntonio Quartulli
Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200428131700.9123-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19832.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-04-27Uncrustify the tests/unit_tests/ part of our tree.Gert Doering
Apply uncrustify 0.70.1 (FreeBSD port) with our rules to that part of the tree, which followed a more compact coding style so far. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20200426095402.65047-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19823.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-04-26Add tls-crypt-v2 test writing metadataArne Schwabe
Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20200420104435.7082-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19798.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-04-19t_net.sh: use dummy interface instead of tunAntonio Quartulli
The tun interface has proved to be a bit fragile for basic netlink tests as it may introduce delays in switching state, depending on the system the test is ran on. For this reason, switch to dummy interface type and at the same type set its oper-state to up right after creation to avoid hitting the no-carrier state later. No-carrier has been problematic in pasts tests as it sometimes persists long enough to create a discrepancy between the various tests snapshots thus causing a test failure. Setting a static MAC addressis also re-enabled to avoid it being different and thus causing a test failure when comparing snapshots. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200416134925.8848-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19751.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-03-27Normalise ncp-ciphers option and restrict it to 127 bytesArne Schwabe
In scenarios of mbed TLS vs OpenSSL we already normalise the ciphers that are send via the wire protocol via OCC to not have a mismatch warning between server and client. This is done by translate_cipher_name_from_openvpn. The same applies also to the ncp-ciphers list. Specifying non normalised names in ncp-ciphers will cause negotation not to succeed if ciphers are not in the same form. Therefore we will normalise the ciphers in options_postmutate. The alternative and a lot less user friendly alternative would be to bail if on of the ciphers in ncp-ciphers is not in its normalised form. Also restrict the ncp-ciphers list to 127. This is somewhat arbitrary but should prevent too large IV_CIPHER messages and problems sending those. The server will accept also large IV_CIPHER values from clients. Patch V2: Correct comment about normalising ciphers Patch V3: Correct #ifdef statement Patch V5: Fix tests with OpenSSL 1.0.2 and libraries missing Chacha Patch V6: Fix unit tests for mbed tls, which recognises ChaCha20-Poly1305 only when used with all uppercase, fix missing space in message Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20200312113654.16184-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19546.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-03-09Move NCP related function into a seperate file and add unit testsArne Schwabe
This allows unit test the NCP functions. The ssl.c file has too many dependencies to make unit testing of it viable. Patch V2: Removing the include "ssl_ncp.h" from options.c for V2 of implement dynamic NCP forces a new version of this patch to add the #include in this patch. Merge VS studio file changes for ssl_ncp.[ch] into this patch Patch V3: Regenerate for changes in earlier patches, apply Lev's changes to Visual Studio project file Patch V4: Regenerate to also have the changes of earlier patches. Patch V5: Fix unit tests for crypto library missing chacha20-poly1305 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Lev Stipakov <lstipakov@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200221100746.7065-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19499.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-02-20Add gc_arena to struct argv to save allocationsHeiko Hund
With the private gc_arena we do not have to allocate the strings found during parsing again, since we know the arena they are allocated in is valid as long as the argv vector is. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200206132103.15977-4-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19376.html
2020-02-20argv: do fewer memory re-allocationsHeiko Hund
Prevent the re-allocations of memory when the internal argv grows beyond 2 and 4 arguments by initially allocating argv to hold up to 7 (+ trailing NULL) pointers. While at it rename argv_reset to argv_free to actually express what's going on. Redo the argv_reset functionality so that it can be used to actually reset the argv without re-allocation. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200206132103.15977-3-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19378.html
2020-02-20re-implement argv_printf_*()Heiko Hund
The previous implementation had the problem that it was not fully compatible with printf() and could only detect % format directives following a space character (0x20). It modifies the format string and inserts marks to separate groups before passing it to the regular printf in libc. The marks are later used to separate the output string into individual command line arguments. The choice of 0x1D as the argument delimiter is based on the assumption that no "regular" string passed to argv_printf_*() will ever have to contain that byte (and the fact that it actually is the ASCII "group separator" control character, which fits its purpose). This commit has been updated by David Sommerseth based on Arne Schwabe and his own feedback on the mailing list. Signed-off-by: Heiko Hund <heiko.hund@sophos.com> Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20200206132103.15977-2-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg19380.html
2019-11-10get rid of 'broadcast' argument when configuring the tun deviceAntonio Quartulli
The broadcast argument is actually useless as every platform will figure it out and configure it on its own. We even realized that on linux, if you configure it wrong, nothing wrong will happen. At this point, let's make the code cleaner and let's get rid of this useless argument at all. This patch just removed any occurrence of 'broadcast'. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20191110124407.8734-1-a@unstable.cc> URL: https://www.mail-archive.com/search?l=mid&q=20191110124407.8734-1-a@unstable.cc Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-10-01Implement unit tests for auth-gen-tokenArne Schwabe
The unit test is breaking the 80 char limit in some places but the remaining lines it breaks the limit I feel forcing the 80 char limit will impair readibility Patch V2: adapt unit tests to other V2 patches Patch V4: Resolve rebase conflicts Patch V5: Add \ lost in rebase that broke compilation Patch V7: Fix unit test failure, try to stay below 80 Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20190917123321.15993-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18821.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-09-24tests/t_lpback.sh: Switch sed(1) to POSIX-compatible regex.Kyle Evans
A test run with FreeBSD PR 229925 'Disallow escaping ordinary characters in regex(3)' reveals one sed expression that uses the GNU-extension "\s". Given that this is the only occurrence and it's a trivial fix, update it to be POSIX-compatible. Signed-off-by: Matthias Andree <matthias.andree@gmx.de> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190906174458.14975-2-matthias.andree@gmx.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18806.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-09-19t_net.sh: execute sleep after checking exit code of previous commandAntonio Quartulli
Ensure to check the exit code of the mktun command *before* running sleep, otherwise '$?' will resolve to the exit code of sleep itself, thus nullifying the check. Reported-by: Steffan Karger <steffan@karger.me> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190919202257.19405-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18845.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-09-19t_net.sh: wait for NO-CARRIER bit to settle before starting testAntonio Quartulli
Interfaces of type tun are marked as NO-CARRIER when no process is attached to them. However, this bit gets set with some delay after creation. For this reason, it is better to wait for the bit to settle before starting any test, otherwise any timing influence on the test may lead to inconsistencies due to the NO-CARRIER bit randomly being or not in the snapshot output taken by t_net.sh. This patch add a 'sleep 1' command right after creation of the interface, to give the NO-CARRIER bit a chance to settle. This issue has been witnessed on a buildbot that is apparently slowler than average to run the unit tests. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190919072820.9913-1-a@unstable.cc> URL: https://www.mail-archive.com/search?l=mid&q=20190919072820.9913-1-a@unstable.cc Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-07-05Implement --genkey type keyfile syntax and migrate tls-crypt-v2Arne Schwabe
This unifies our key generation and also migrates the generation of the tls-crypt-v2 keys. Since tls-crypt-v2 is not included in any released version, we remove the the old syntax without compatibility. PATCH V4: Introduce warning/error when using --secret with --genkey Update non code usages to use new --genkey syntax Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20190613134834.5709-1-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18524.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-24Remove cmocka submodule, rely on system-wide installation instead.Gert Doering
We used to ship git submodule instructions to build a local copy of cmocka in vendor/cmocka/ and use that (if cmake is installed) to build unit tests. With the network test driver this turns out to be a LD_LIBRARY_PATH vs. SUDO complication which is really outweighing the benefit of a local build today - so, use the system-wide installation if available (querying pgk-config). Do not build unit-tests otherwise. v2: (inspired by patch from David Sommerseth) introduce "configure --disable-unit-test" switch simplify configure.ac logic use CMOCKA_LIBS and CMOCKA_INCLUDE (set by PKG_CHECK) v3: repair conflict with commit 7473f326366fbceb CMOCKA_INCLUDE is not correct, must be CMOCKA_CFLAGS (see config.status) Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20190623183210.6005-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18570.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-20t_net.sh: fixes for the networking test scriptAntonio Quartulli
1) Building the networking unit-test when SITNL is not enabled does not make much sense right now. Make compilation dependent on having SITNL configured. 2) Remove some no-op mock_msg function calls. 3) Remove obsolete comment and declarations Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20190618163435.26431-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18556.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-16t_net.sh: properly perform sudo check and print test stepsAntonio Quartulli
The current script is performing a test on the "kill" command, but this is not useful to the t_net.sh script as it never really executes it. Rather test that "sudo <unit-test-binary>" really works. <unit-test-binary> has to be added to the sudoers file if this test has to be performend unattanded. The path is: ./unit_tests/openvpn/networking_testdriver On top of that, print a simple OK for every test that is succesful. Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190615230213.14888-2-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18548.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-16t_net.sh: make bash dep explicit and run only if SITNL is compiledAntonio Quartulli
The t_net script currently has #!/bin/sh but it implicitly assume to be using bash. This is fine on most distros, but some do not have sh pointing to bash by default, thus breaking the script. Explicitly use bash to avoid failures. On the other hand, run this unit-test only if SITNL was enabled at compile time. This test was designed with SITNL in mind and it is not yet ready for other backends. Running only when SITNL is enabled implies running on Linux only therefore we are guaranteed that bash will always work. While at it, also add a comment as of why the t_client.rc file is sourced. Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20190615230213.14888-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18547.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-06-06unit tests: implement test for sitnlAntonio Quartulli
This patch introduces a new unit test that is not executed by the cmocka framework, but rather used by a new t_net.sh bash script. The idea behind this test is to ensure that invoking sitnl functions or running iproute commands leads to the same networking (interface and routing table) state. To achieve this, the t_net.sh script first runs a binary implemented invoking sitnl functions and then takes a "screenshot" of the state. Subsequently a series of iproute commands, expected to mimic exactly the same behaviour as the sitnl functions invoked before, are executed. The final state is then compared with the screenshot previously taken. If no mismatching is found, the test is passed. The current unit_test, however, does not cover all the sitnl functionalities and it is expected to be extended in the future. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20181219050118.6568-7-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18027.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-05-10tests: remove dependency on base64Steffan Karger
Triggered by the report from Ilya, that if base64 is missing, the tests would still report success: Testing tls-crypt-v2 key generation (max length metadata)..../t_lpback.sh: base64: not found OK PASS: t_lpback.sh The easiest way to fix that, is to remove the dependency on base64 (which is it's current form wouldn't work on OSX anyway, because their base64 doesn't understand "-w0"). Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <E1hON0G-0007yB-3H@sfs-ml-4.v29.lw.sourceforge.com> URL: https://www.mail-archive.com/search?l=mid&q=E1hON0G-0007yB-3H@sfs-ml-4.v29.lw.sourceforge.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-05-03build: Package missing mock_msg.hDavid Sommerseth
The mock_msg.h file was not enlisted in the _SOURCES lists in Makefile.am for the unit tests. This caused the mock_msg.h file to not be present in the .tar.gz file created by 'make dist'. This was not noticed earlier as we haven't really tried much to run git clone of the cmocka project manually in vendor/ from an unpacked tarball. With this fix the cmocka unit tests can also run from tarballs, with manually extracting/fetching the cmocka source code in vendor/cmocka. Signed-off-by: David Sommerseth <davids@openvpn.net> ----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<---- How to test: - Create a tarball: make distcheck (or just 'dist') - Extract openvpn-2.5_git.tar.gz in a clean directory - cd openvpn-2.5_git/vendor - git clone https://git.cryptomilk.org/projects/cmocka.git - ./configure - make check - Observe that the cmocka unit tests ran as expected Depending on the CMake version, you might want to check out cmocka git commit b2732b52202ae48f; which is the one we use in the git submodule. Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20190417203015.1903-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18380.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-02-06Fix various spelling mistakesJonathan Tooker
New patch, omitted changes to copyrights/licenses & changelog. Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20190123201717.15048-1-jonathan@reliablehosting.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18177.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-01-22test_tls_crypt.c: fix global-buffer-overflow found by AddressSanitizerLev Stipakov
When writing data to buffer we incorrectly specify source length - sizeof for pointer returns 8, but actual buffer length is 1. Fix by replacing empty global string to local string literal and specifying the correct length. Signed-off-by: Lev Stipakov <lev@openvpn.net> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1548164060-13144-1-git-send-email-lstipakov@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18140.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-01-16Extend tls-crypt-v2 unit testsSteffan Karger
This commit adds two tests for tls-crypt-v2 to verify the client and server key generation. These are introduced primarily as a regression test for the off-by-one bug fixed by Arne in tls_crypt_v2_read_keyfile() recently (no commit hash availble, patch has not been applied yet). Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <E1gjn4T-0003e9-LN@sfs-ml-1.v29.lw.sourceforge.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18095.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-10-26tls-crypt-v2: add script hook to verify metadataSteffan Karger
To allow rejecting incoming connections very early in the handshake, add a --tls-crypt-v2-verify option that allows administators to run an external command to verify the metadata from the client key. See doc/tls-crypt-v2.txt for more details. Because of the extra dependencies, this requires adding a mock parse_line() to the tls-crypt unit tests. Also, this turns tls_wrap_free into a static inline function, so that we don't need to compile in ssl.c (and all of it's dependencies) with the unit tests. Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <1540208715-14044-6-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17789.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2018-10-26tls-crypt-v2: implement tls-crypt-v2 handshakeSteffan Karger
This makes clients send-and-use, and servers receive-unwrap-and-use tls-crypt-v2 client keys, which completes the on-the-wire work. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <1540208715-14044-5-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17787.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2018-10-26tls-crypt-v2: add unwrap_client_keySteffan Karger
Add helper functions to unwrap tls-crypt-v2 client keys. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <1540208715-14044-3-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17791.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2018-10-26tls-crypt-v2: generate tls-crypt-v2 keysSteffan Karger
As a first step towards a full tls-crypt-v2 implementation, add functionality to generate tls-crypt-v2 client and server keys. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <1540208715-14044-2-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17792.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2018-10-11Fix mbedtls unit testsSteffan Karger
Commit 674b166 ("Fix build warnings related to get_random()") broke the unit tests for mbedtls, because <mbedtls/cipher.h> was now included via platform.c -> crypto.h -> crypto_backend.h, but the crypto cflags were not included for that unit tests. Since we got rid of --disable-crypto, we can now fix this by simply always including the CRYPTO_CFLAGS in the TEST_CFLAGS (and the CRYPTO_LIBS in the TEST_LDFLAGS). This should not only fix this occurrence, but also prevent similar problems in the future. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1539153883-15789-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17687.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-07-24crypto: always reload tls-auth/crypt key contextsAntonio Quartulli
In preparation to having tls-auth/crypt keys per connection block, it is important to ensure that such material is always reloaded upon SIGUSR1, no matter if `persist-key` was specified or not. This is required because when moving from one remote to the other the key may change and thus the key context needs to be refreshed. To ensure that the `persist-key` logic will still work as expected, the tls-auth/crypt key is pre-loaded so that the keyfile is not required at runtime. Trac: #720 Cc: Steffan Karger <steffan@karger.me> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20180708024517.27108-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17237.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-07-22Add crypto_pem_{encode,decode}()Steffan Karger
Needed for tls-crypt-v2, but isolated enough to be reviewed as a separate patch. The encode API allocates memory, because it fits our typical gc-oriented code pattern and the caller does not have to do multiple calls or calculations to determine the required destination buffer size. The decode API does not allocate memory, because the required destination buffer is always smaller than the input buffer (so is easy to manage by the caller) and does not force the caller to use the heap. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20180722100645.5813-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17284.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-07-05Move file-related functions from misc.c to platform.cSteffan Karger
To avoid having to include misc.c - which is a dependency mess - in the tls-crypt unit tests, move file-handing related functions to platform.c (which is where other file-related functions already reside). Note that platform_create_temp_file() needs random. To avoid including misc.c in other tests that use platform.c, add a mock get_random(). (Almost every test includes platform.c, because buffer.c depends on it. That smells like it needs cleanup too, but not in this patch set.) Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180704175404.22371-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17208.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-06-23Add %d, %u and %lu tests to test_argv unit tests.Gert Doering
Some basic integer tests to verify signed, unsigned and long unsigned (1L) printing. Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20180623191538.29317-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17131.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-01Update copyright to include 2018 plus company name changeDavid Sommerseth
The autumn of 2017, OpenVPN Technologies, Inc changed name to just OpenVPN Inc. Otherwise, extend the copyright to cover 2018 as well. With the exception of the company name change, all changes have been performed by the dev-tools/update-copyright.sh script. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180131140314.11103-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16418.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-01-09buffer_list_aggregate_separator(): don't exceed max_lenSteffan Karger
buffer_list_aggregate_separator() would merge buffer_list entries until it had exceeded the provided max_len, instead of stopping *before* exceeding the max value. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <1514541191-19471-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16104.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-01-09buffer_list_aggregate_separator(): update list size after aggregatingSteffan Karger
After aggregating a buffer_list, the size should be adjusted accordingly. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <1514541144-19407-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16103.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-01-09Fix memory leak in buffer unit testsSteffan Karger
buffer_list_push_data does not take ownership of the memory, so just feed it stack data to plug the leak. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <1512724338-22197-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16055.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-12-04Remove option to disable crypto engineAntonio Quartulli
With this patch we remove the possibility to disable the crypto engine (ENABLE_CRYPTO define) at configuration time. [--disable-crypto has been removed from .travis.yml too] Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20171203124952.15220-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15979.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-12-04Remove ENABLE_CRYPTOAntonio Quartulli
The crypto engine cannot be disabled anymore, therefore get rid of all the related ifdefs in the code. This change makes the code simpler and reduces our the number of config combinations we have to test after a new change is applied. Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <20171204010110.22091-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16004.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-11-05buffer_list_aggregate_separator(): add unit testsSteffan Karger
Before refactoring this function, add tests to verify the new implementation. While writing the tests, it became clear that this function is not behaving very well. We'll fix that in follow-up commits. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20171104224551.3079-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15748.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-08-16tls-crypt: introduce tls_crypt_kt()Steffan Karger
Reduces code duplication (and prepares for tls-crypt-v2, which needs the same functionality at more places). Because tls_crypt_kt() is a static function we now need to include tls_crypt.c from the tests, rather than tls_crypt.h. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <1502531632-16833-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15229.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-06-27Move adjust_power_of_2() to integer.hSteffan Karger
misc.c is a mess of incoherent functions, and is therefore included by virtually all our source files. That makes testing harder than it should be. As a first step of cleaning up misc.c, move adjust_power_of_2() to integer.h, which is a more suitable place for a function like this. This allows us to remove the duplicate implementation from test_argv.c. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Antonio Quartulli <antonio@openvpn.net> Message-Id: <20170621211043.6490-1-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14940.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-16copyright: Update GPLv2 license textsDavid Sommerseth
The COPYRIGHT.GPL file was slightly out-of-sync with the last GPLv2 license from Free Software Foundation, Inc. The changes are primarily a new address, which required touching almost all the project files. Except of that, it is just minor adjustments to formatting, removal of form-feed characters and referencing "GNU Lesser General Public License" instead of "GNU Library General Public License". Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170329093648.10156-1-davids@openvpn.net> URL: https://www.mail-archive.com/search?l=mid&q=20170329093648.10156-1-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-12Skip tls-crypt unit tests if required crypto mode not supportedSteffan Karger
Instead of failing the test with an unclear error, print that the a required crypto primitive is not supported and skip the test. This is for example the case when using the system-supplied openssl on SLES11, which does not support AES-256-CTR. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1494859483-16466-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14657.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-05-11Drop packets instead of assert out if packet id rolls over (CVE-2017-7479)Steffan Karger
Previously, if a mode was selected where packet ids are not allowed to roll over, but renegotiation does not succeed for some reason (e.g. no password entered in time, certificate expired or a malicious peer that refuses the renegotiaion on purpose) we would continue to use the old keys. Until the packet ID would roll over and we would ASSERT() out. Given that this can be triggered on purpose by an authenticated peer, this is a fix for an authenticated remote DoS vulnerability. An attack is rather inefficient though; a peer would need to get us to send 2^32 packets (min-size packet is IP+UDP+OPCODE+PID+TAG (no payload), results in (20+8+1+4+16)*2^32 bytes, or approx. 196 GB). This is a fix for finding 5.2 from the OSTIF / Quarkslab audit. CVE: 2017-7479 Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494358209-4568-3-git-send-email-steffan.karger@fox-it.com> URL: http://www.mail-archive.com/search?l=mid&q=1494358209-4568-3-git-send-email-steffan.karger@fox-it.com Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-05-05Don't run packet_id unit tests for --disable-crypto buildsSteffan Karger
Because there is no packet_id in those builds... This fixes 'make check' for --disable-crypto builds, caught by travis. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494014848-20099-1-git-send-email-steffan.karger@fox-it.com> URL: http://www.mail-archive.com/search?l=mid&q=1494014848-20099-1-git-send-email-steffan.karger@fox-it.com Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-05-05cleanup: merge packet_id_alloc_outgoing() into packet_id_write()Steffan Karger
The functions packet_id_alloc_outgoing() and packet_id_write() were always called in tandem. Instead of forcing the caller to allocate a packet_id_net to do so, merge the two functions. This simplifies the API and reduces the chance on mistakes in the future. This patch adds unit tests to verify the behaviour of packet_id_write(). Verifying that we assert out correctly required the change to mock_msg.c. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494006291-3522-1-git-send-email-steffan.karger@fox-it.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14541.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
generated by cgit v1.1 at 2024-10-07 14:18:21 +0000