Move slow tests to OSSL_TEST_ALL=1 only

Update GitHub Actions workflows to set OSSL_TEST_ALL=1.

Exclude a few slow tests that are not critical for local development,
unless OSSL_TEST_ALL=1 is set. The bindings code paths are still reached
by other tests with smaller inputs, and failures in those would likely
indicate an issue in OpenSSL rather than in the bindings.

Newly excluded tests include generating large DSA keys and measuring
CRYPTO_memcmp() timing. These tests currently take nearly half of the
total runtime.

Author: rhenium

.github/workflows/test.yml

@@ -66,7 +66,7 @@ jobs:
         run:  bundle exec rake debug
 
       - name: rake test
-        run:  bundle exec rake test TESTOPTS="-v --no-show-detail-immediately"
+        run:  bundle exec rake test TESTOPTS="-v --no-show-detail-immediately" OSSL_TEST_ALL=1
         timeout-minutes: 5
 
   test-openssls:
@@ -167,7 +167,7 @@ jobs:
         run:  bundle exec rake debug
 
       - name: rake test
-        run:  bundle exec rake test TESTOPTS="-v --no-show-detail-immediately"
+        run:  bundle exec rake test TESTOPTS="-v --no-show-detail-immediately" OSSL_TEST_ALL=1
         timeout-minutes: 5
 
       # Run only the passing tests on the FIPS module as a temporary workaround.
@@ -177,6 +177,6 @@ jobs:
           sed -e "s|OPENSSL_DIR|$HOME/openssl|" tool/openssl_fips.cnf.tmpl > tmp/openssl_fips.cnf
           export OPENSSL_CONF=$(pwd)/tmp/openssl_fips.cnf
           bundle exec rake debug
-          bundle exec rake test_fips TESTOPTS="-v --no-show-detail-immediately"
+          bundle exec rake test_fips TESTOPTS="-v --no-show-detail-immediately" OSSL_TEST_ALL=1
         timeout-minutes: 5
         if: ${{ startsWith(matrix.openssl, 'openssl-3') || matrix.openssl == 'openssl-master' }}

test/openssl/test_ossl.rb

@@ -63,7 +63,7 @@ def test_memcmp_timing
     end
     assert_operator(a_b_time, :<, a_c_time * 10, "fixed_length_secure_compare timing test failed")
     assert_operator(a_c_time, :<, a_b_time * 10, "fixed_length_secure_compare timing test failed")
-  end
+  end if ENV["OSSL_TEST_ALL"] == "1"
 
   def test_error_data
     # X509V3_EXT_nconf_nid() called from OpenSSL::X509::ExtensionFactory#create_ext is a function

test/openssl/test_pkey_dh.rb

@@ -16,7 +16,7 @@ def test_new_generate
     # This test is slow
     dh = OpenSSL::PKey::DH.new(NEW_KEYLEN)
     assert_key(dh)
-  end if ENV["OSSL_TEST_ALL"]
+  end if ENV["OSSL_TEST_ALL"] == "1"
 
   def test_new_break
     unless openssl? && OpenSSL.fips_mode

test/openssl/test_pkey_dsa.rb

@@ -47,11 +47,11 @@ def test_generate
     assert_equal 1024, key1024.p.num_bits
     assert_equal 160, key1024.q.num_bits
 
-    key2048 = OpenSSL::PKey::DSA.generate(2048)
-    assert_equal 2048, key2048.p.num_bits
-    assert_equal 256, key2048.q.num_bits
-
     if ENV["OSSL_TEST_ALL"] == "1" # slow
+      key2048 = OpenSSL::PKey::DSA.generate(2048)
+      assert_equal 2048, key2048.p.num_bits
+      assert_equal 256, key2048.q.num_bits
+
       key3072 = OpenSSL::PKey::DSA.generate(3072)
       assert_equal 3072, key3072.p.num_bits
       assert_equal 256, key3072.q.num_bits

test/openssl/test_ssl_session.rb

@@ -222,7 +222,7 @@ def test_server_session_cache
 
   # Skipping tests that use session_remove_cb by default because it may cause
   # deadlock.
-  TEST_SESSION_REMOVE_CB = ENV["OSSL_TEST_ALL"] == "1"
+  TEST_SESSION_REMOVE_CB = ENV["OSSL_TEST_UNSAFE"] == "1"
 
   def test_ctx_client_session_cb_tls12
     start_server do |port|