3 Running external test suites with OpenSSL
4 =========================================
6 It is possible to integrate external test suites into OpenSSL's "make test".
7 This capability is considered a developer option and does not work on all
12 The BoringSSL test suite
13 ========================
15 In order to run the BoringSSL tests with OpenSSL, first checkout the BoringSSL
16 source code into an appropriate directory. This can be done in two ways:
18 1) Separately from the OpenSSL checkout using:
20 $ git clone https://boringssl.googlesource.com/boringssl boringssl
22 The BoringSSL tests are only confirmed to work at a specific commit in the
23 BoringSSL repository. Later commits may or may not pass the test suite:
26 $ git checkout 490469f850e
28 2) Using the already configured submodule settings in OpenSSL:
30 $ git submodule update --init
32 Configure the OpenSSL source code to enable the external tests:
35 $ ./config enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers \
38 Note that using other config options than those given above may cause the tests
41 Run the OpenSSL tests by providing the path to the BoringSSL test runner in the
42 BORING_RUNNER_DIR environment variable:
44 $ BORING_RUNNER_DIR=/path/to/boringssl/ssl/test/runner make test
46 Note that the test suite may change directory while running so the path provided
47 should be absolute and not relative to the current working directory.
49 To see more detailed output you can run just the BoringSSL tests with the
52 $ VERBOSE=1 BORING_RUNNER_DIR=/path/to/boringssl/ssl/test/runner make \
53 TESTS="test_external_boringssl" test
56 Test failures and suppressions
57 ------------------------------
59 A large number of the BoringSSL tests are known to fail. A test could fail
60 because of many possible reasons. For example:
63 - Different interpretations of standards
64 - Assumptions about the way BoringSSL works that do not apply to OpenSSL
65 - The test uses APIs added to BoringSSL that are not present in OpenSSL
68 In order to provide a "clean" baseline run with all the tests passing a config
69 file has been provided that suppresses the running of tests that are known to
70 fail. These suppressions are held in the file "test/ossl_shim/ossl_config.json"
71 within the OpenSSL source code.
73 The community is encouraged to contribute patches which reduce the number of
74 suppressions that are currently present.
77 Python PYCA/Cryptography test suite
78 ===================================
80 This python test suite runs cryptographic tests with a local OpenSSL build as
83 First checkout the PYCA/Cryptography module into ./pyca-cryptography using:
85 $ git submodule update --init
87 Then configure/build OpenSSL compatible with the python module:
89 $ ./config shared enable-external-tests
92 The tests will run in a python virtual environment which requires virtualenv
95 $ make test VERBOSE=1 TESTS=test_external_pyca
97 Test failures and suppressions
98 ------------------------------
100 Some tests target older (<=1.0.2) versions so will not run. Other tests target
101 other crypto implementations so are not relevant. Currently no tests fail.
107 Much like the PYCA/Cryptography test suite, this builds and runs the krb5
108 tests against the local OpenSSL build.
110 You will need a git checkout of krb5 at the top level:
112 $ git clone https://github.com/krb5/krb5
114 krb5's master has to pass this same CI, but a known-good version is
115 krb5-1.15.1-final if you want to be sure.
118 $ git checkout krb5-1.15.1-final
121 OpenSSL must be built with external tests enabled:
123 $ ./config enable-external-tests
126 krb5's tests will then be run as part of the rest of the suite, or can be
127 explicitly run (with more debugging):
129 $ VERBOSE=1 make TESTS=test_external_krb5 test
131 Test-failures suppressions
132 --------------------------
134 krb5 will automatically adapt its test suite to account for the configuration
135 of your system. Certain tests may require more installed packages to run. No
136 tests are expected to fail.
139 GOST engine test suite
142 Much like the PYCA/Cryptography test suite, this builds and runs the GOST engine
143 tests against the local OpenSSL build.
145 You will need a git checkout of gost-engine at the top level:
147 $ git submodule update --init
149 Then configure/build OpenSSL enabling external tests:
151 $ ./config shared enable-external-tests
154 GOST engine requires CMake for the build process.
156 GOST engine tests will then be run as part of the rest of the suite, or can be
157 explicitly run (with more debugging):
159 $ make test VERBOSE=1 TESTS=test_external_gost_engine
164 To update the commit for any of the above test suites:
166 - Make sure the submodules are cloned locally:
168 $ git submodule update --init --recursive
170 - Enter subdirectory and pull from the repository (use a specific branch/tag if required):
173 $ git pull origin master
175 - Go to root directory, there should be a new git status:
180 # modified: <submodule-dir> (new commits)
183 - Add/commit/push the update
185 git add <submodule-dir>
186 git commit -m "Updated <submodule> to latest commit"