X-Git-Url: https://git.openssl.org/?a=blobdiff_plain;f=test%2Fverify_extra_test.c;h=e8fe79b19a2792655f86b23af559ec19220e2b2d;hb=fda127beb2b3c029741573b0dd931295b3446fd2;hp=cc05bc2ef1f069c7a1b3bc7ffdf489e6adb6583a;hpb=e8aa8b6c8f6d4e2b2bbd5e5721d977b0a6aa3cee;p=openssl.git diff --git a/test/verify_extra_test.c b/test/verify_extra_test.c index cc05bc2ef1..e8fe79b19a 100644 --- a/test/verify_extra_test.c +++ b/test/verify_extra_test.c @@ -1,18 +1,25 @@ /* - * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved. * - * Licensed under the OpenSSL license (the "License"). You may not use + * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ #include +#include #include #include #include #include #include +#include "testutil.h" + +static const char *roots_f; +static const char *untrusted_f; +static const char *bad_f; +static const char *req_f; static STACK_OF(X509) *load_certs_from_file(const char *filename) { @@ -82,9 +89,7 @@ static STACK_OF(X509) *load_certs_from_file(const char *filename) * CA=FALSE, and will therefore incorrectly verify bad * */ -static int test_alt_chains_cert_forgery(const char *roots_f, - const char *untrusted_f, - const char *bad_f) +static int test_alt_chains_cert_forgery(void) { int ret = 0; int i; @@ -102,7 +107,7 @@ static int test_alt_chains_cert_forgery(const char *roots_f, lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); if (lookup == NULL) goto err; - if(!X509_LOOKUP_load_file(lookup, roots_f, X509_FILETYPE_PEM)) + if (!X509_LOOKUP_load_file(lookup, roots_f, X509_FILETYPE_PEM)) goto err; untrusted = load_certs_from_file(untrusted_f); @@ -110,7 +115,7 @@ static int test_alt_chains_cert_forgery(const char *roots_f, if ((bio = BIO_new_file(bad_f, "r")) == NULL) goto err; - if((x = PEM_read_bio_X509(bio, NULL, 0, NULL)) == NULL) + if ((x = PEM_read_bio_X509(bio, NULL, 0, NULL)) == NULL) goto err; sctx = X509_STORE_CTX_new(); @@ -132,31 +137,144 @@ static int test_alt_chains_cert_forgery(const char *roots_f, BIO_free(bio); sk_X509_pop_free(untrusted, X509_free); X509_STORE_free(store); - if (ret != 1) - ERR_print_errors_fp(stderr); return ret; } -int main(int argc, char **argv) +static int test_store_ctx(void) +{ + X509_STORE_CTX *sctx = NULL; + X509 *x = NULL; + BIO *bio = NULL; + int testresult = 0, ret; + + bio = BIO_new_file(bad_f, "r"); + if (bio == NULL) + goto err; + + x = PEM_read_bio_X509(bio, NULL, 0, NULL); + if (x == NULL) + goto err; + + sctx = X509_STORE_CTX_new(); + if (sctx == NULL) + goto err; + + if (!X509_STORE_CTX_init(sctx, NULL, x, NULL)) + goto err; + + /* Verifying a cert where we have no trusted certs should fail */ + ret = X509_verify_cert(sctx); + + if (ret == 0) { + /* This is the result we were expecting: Test passed */ + testresult = 1; + } + + err: + X509_STORE_CTX_free(sctx); + X509_free(x); + BIO_free(bio); + return testresult; +} + +OPT_TEST_DECLARE_USAGE("roots.pem untrusted.pem bad.pem\n") + +static int test_distinguishing_id(void) +{ + X509 *x = NULL; + BIO *bio = NULL; + int ret = 0; + ASN1_OCTET_STRING *v = NULL, *v2 = NULL; + char *distid = "this is an ID"; + + bio = BIO_new_file(bad_f, "r"); + if (bio == NULL) + goto err; + + x = PEM_read_bio_X509(bio, NULL, 0, NULL); + if (x == NULL) + goto err; + + v = ASN1_OCTET_STRING_new(); + if (v == NULL) + goto err; + + if (!ASN1_OCTET_STRING_set(v, (unsigned char *)distid, + (int)strlen(distid))) { + ASN1_OCTET_STRING_free(v); + goto err; + } + + X509_set0_distinguishing_id(x, v); + + v2 = X509_get0_distinguishing_id(x); + if (!TEST_ptr(v2) + || !TEST_int_eq(ASN1_OCTET_STRING_cmp(v, v2), 0)) + goto err; + + ret = 1; + err: + X509_free(x); + BIO_free(bio); + return ret; +} + +static int test_req_distinguishing_id(void) { - CRYPTO_set_mem_debug(1); - CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); + X509_REQ *x = NULL; + BIO *bio = NULL; + int ret = 0; + ASN1_OCTET_STRING *v = NULL, *v2 = NULL; + char *distid = "this is an ID"; + + bio = BIO_new_file(req_f, "r"); + if (bio == NULL) + goto err; + + x = PEM_read_bio_X509_REQ(bio, NULL, 0, NULL); + if (x == NULL) + goto err; - if (argc != 4) { - fprintf(stderr, "usage: verify_extra_test roots.pem untrusted.pem bad.pem\n"); - return 1; + v = ASN1_OCTET_STRING_new(); + if (v == NULL) + goto err; + + if (!ASN1_OCTET_STRING_set(v, (unsigned char *)distid, + (int)strlen(distid))) { + ASN1_OCTET_STRING_free(v); + goto err; } - if (!test_alt_chains_cert_forgery(argv[1], argv[2], argv[3])) { - fprintf(stderr, "Test alt chains cert forgery failed\n"); - return 1; + X509_REQ_set0_distinguishing_id(x, v); + + v2 = X509_REQ_get0_distinguishing_id(x); + if (!TEST_ptr(v2) + || !TEST_int_eq(ASN1_OCTET_STRING_cmp(v, v2), 0)) + goto err; + + ret = 1; + err: + X509_REQ_free(x); + BIO_free(bio); + return ret; +} + +int setup_tests(void) +{ + if (!test_skip_common_options()) { + TEST_error("Error parsing test options\n"); + return 0; } -#ifndef OPENSSL_NO_CRYPTO_MDEBUG - if (CRYPTO_mem_leaks_fp(stderr) <= 0) - return 1; -#endif + if (!TEST_ptr(roots_f = test_get_argument(0)) + || !TEST_ptr(untrusted_f = test_get_argument(1)) + || !TEST_ptr(bad_f = test_get_argument(2)) + || !TEST_ptr(req_f = test_get_argument(3))) + return 0; - printf("PASS\n"); - return 0; + ADD_TEST(test_alt_chains_cert_forgery); + ADD_TEST(test_store_ctx); + ADD_TEST(test_distinguishing_id); + ADD_TEST(test_req_distinguishing_id); + return 1; }