790fc5f4a7e818073ccb19436ca6f3dc9d18dc3f
[openssl.git] / test / crltest.c
1 /*
2  * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the OpenSSL license (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9
10 #include <stdio.h>
11 #include "../e_os.h"
12 #include <string.h>
13 #include <openssl/bio.h>
14 #include <openssl/crypto.h>
15 #include <openssl/err.h>
16 #include <openssl/pem.h>
17 #include <openssl/x509.h>
18
19 #include "testutil.h"
20
21 #define PARAM_TIME 1474934400 /* Sep 27th, 2016 */
22
23 static const char *kCRLTestRoot[] = {
24     "-----BEGIN CERTIFICATE-----\n",
25     "MIIDbzCCAlegAwIBAgIJAODri7v0dDUFMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV\n",
26     "BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW\n",
27     "aWV3MRIwEAYDVQQKDAlCb3JpbmdTU0wwHhcNMTYwOTI2MTUwNjI2WhcNMjYwOTI0\n",
28     "MTUwNjI2WjBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG\n",
29     "A1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9yaW5nU1NMMIIBIjANBgkq\n",
30     "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3B\n",
31     "S/dUBpbrzd1aeFzNlI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+\n",
32     "5R/Du0iCb1tCZIPY07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWp\n",
33     "uRqO6rctN9qUoMlTIAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n\n",
34     "8H922qmvPNA9idmX9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbL\n",
35     "P2o9orxGx7aCtnnBZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABo1Aw\n",
36     "TjAdBgNVHQ4EFgQUWPt3N5cZ/CRvubbrkqfBnAqhq94wHwYDVR0jBBgwFoAUWPt3\n",
37     "N5cZ/CRvubbrkqfBnAqhq94wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n",
38     "AQEAORu6M0MOwXy+3VEBwNilfTxyqDfruQsc1jA4PT8Oe8zora1WxE1JB4q2FJOz\n",
39     "EAuM3H/NXvEnBuN+ITvKZAJUfm4NKX97qmjMJwLKWe1gVv+VQTr63aR7mgWJReQN\n",
40     "XdMztlVeZs2dppV6uEg3ia1X0G7LARxGpA9ETbMyCpb39XxlYuTClcbA5ftDN99B\n",
41     "3Xg9KNdd++Ew22O3HWRDvdDpTO/JkzQfzi3sYwUtzMEonENhczJhGf7bQMmvL/w5\n",
42     "24Wxj4Z7KzzWIHsNqE/RIs6RV3fcW61j/mRgW2XyoWnMVeBzvcJr9NXp4VQYmFPw\n",
43     "amd8GKMZQvP0ufGnUn7D7uartA==\n",
44     "-----END CERTIFICATE-----\n",
45     NULL
46 };
47
48 static const char *kCRLTestLeaf[] = {
49     "-----BEGIN CERTIFICATE-----\n",
50     "MIIDkDCCAnigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCVVMx\n",
51     "EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEjAQ\n",
52     "BgNVBAoMCUJvcmluZ1NTTDAeFw0xNjA5MjYxNTA4MzFaFw0xNzA5MjYxNTA4MzFa\n",
53     "MEsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQKDAlC\n",
54     "b3JpbmdTU0wxEzARBgNVBAMMCmJvcmluZy5zc2wwggEiMA0GCSqGSIb3DQEBAQUA\n",
55     "A4IBDwAwggEKAoIBAQDc5v1S1M0W+QWM+raWfO0LH8uvqEwuJQgODqMaGnSlWUx9\n",
56     "8iQcnWfjyPja3lWg9K62hSOFDuSyEkysKHDxijz5R93CfLcfnVXjWQDJe7EJTTDP\n",
57     "ozEvxN6RjAeYv7CF000euYr3QT5iyBjg76+bon1p0jHZBJeNPP1KqGYgyxp+hzpx\n",
58     "e0gZmTlGAXd8JQK4v8kpdYwD6PPifFL/jpmQpqOtQmH/6zcLjY4ojmqpEdBqIKIX\n",
59     "+saA29hMq0+NK3K+wgg31RU+cVWxu3tLOIiesETkeDgArjWRS1Vkzbi4v9SJxtNu\n",
60     "OZuAxWiynRJw3JwH/OFHYZIvQqz68ZBoj96cepjPAgMBAAGjezB5MAkGA1UdEwQC\n",
61     "MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl\n",
62     "MB0GA1UdDgQWBBTGn0OVVh/aoYt0bvEKG+PIERqnDzAfBgNVHSMEGDAWgBRY+3c3\n",
63     "lxn8JG+5tuuSp8GcCqGr3jANBgkqhkiG9w0BAQsFAAOCAQEAd2nM8gCQN2Dc8QJw\n",
64     "XSZXyuI3DBGGCHcay/3iXu0JvTC3EiQo8J6Djv7WLI0N5KH8mkm40u89fJAB2lLZ\n",
65     "ShuHVtcC182bOKnePgwp9CNwQ21p0rDEu/P3X46ZvFgdxx82E9xLa0tBB8PiPDWh\n",
66     "lV16jbaKTgX5AZqjnsyjR5o9/mbZVupZJXx5Syq+XA8qiJfstSYJs4KyKK9UOjql\n",
67     "ICkJVKpi2ahDBqX4MOH4SLfzVk8pqSpviS6yaA1RXqjpkxiN45WWaXDldVHMSkhC\n",
68     "5CNXsXi4b1nAntu89crwSLA3rEwzCWeYj+BX7e1T9rr3oJdwOU/2KQtW1js1yQUG\n",
69     "tjJMFw==\n",
70     "-----END CERTIFICATE-----\n",
71     NULL
72 };
73
74 static const char *kBasicCRL[] = {
75     "-----BEGIN X509 CRL-----\n",
76     "MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
77     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
78     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV\n",
79     "HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN\n",
80     "ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo\n",
81     "eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os\n",
82     "dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv\n",
83     "diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho\n",
84     "/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==\n",
85     "-----END X509 CRL-----\n",
86     NULL
87 };
88
89 static const char *kRevokedCRL[] = {
90     "-----BEGIN X509 CRL-----\n",
91     "MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
92     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
93     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX\n",
94     "DTE2MDkyNjE1MTIyNlqgDjAMMAoGA1UdFAQDAgECMA0GCSqGSIb3DQEBCwUAA4IB\n",
95     "AQCUGaM4DcWzlQKrcZvI8TMeR8BpsvQeo5BoI/XZu2a8h//PyRyMwYeaOM+3zl0d\n",
96     "sjgCT8b3C1FPgT+P2Lkowv7rJ+FHJRNQkogr+RuqCSPTq65ha4WKlRGWkMFybzVH\n",
97     "NloxC+aU3lgp/NlX9yUtfqYmJek1CDrOOGPrAEAwj1l/BUeYKNGqfBWYJQtPJu+5\n",
98     "OaSvIYGpETCZJscUWODmLEb/O3DM438vLvxonwGqXqS0KX37+CHpUlyhnSovxXxp\n",
99     "Pz4aF+L7OtczxL0GYtD2fR9B7TDMqsNmHXgQrixvvOY7MUdLGbd4RfJL3yA53hyO\n",
100     "xzfKY2TzxLiOmctG0hXFkH5J\n",
101     "-----END X509 CRL-----\n",
102     NULL
103 };
104
105 static const char *kBadIssuerCRL[] = {
106     "-----BEGIN X509 CRL-----\n",
107     "MIIBwjCBqwIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
108     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEWMBQGA1UECgwN\n",
109     "Tm90IEJvcmluZ1NTTBcNMTYwOTI2MTUxMjQ0WhcNMTYxMDI2MTUxMjQ0WjAVMBMC\n",
110     "AhAAFw0xNjA5MjYxNTEyMjZaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsF\n",
111     "AAOCAQEAlBmjOA3Fs5UCq3GbyPEzHkfAabL0HqOQaCP12btmvIf/z8kcjMGHmjjP\n",
112     "t85dHbI4Ak/G9wtRT4E/j9i5KML+6yfhRyUTUJKIK/kbqgkj06uuYWuFipURlpDB\n",
113     "cm81RzZaMQvmlN5YKfzZV/clLX6mJiXpNQg6zjhj6wBAMI9ZfwVHmCjRqnwVmCUL\n",
114     "TybvuTmkryGBqREwmSbHFFjg5ixG/ztwzON/Ly78aJ8Bql6ktCl9+/gh6VJcoZ0q\n",
115     "L8V8aT8+Ghfi+zrXM8S9BmLQ9n0fQe0wzKrDZh14EK4sb7zmOzFHSxm3eEXyS98g\n",
116     "Od4cjsc3ymNk88S4jpnLRtIVxZB+SQ==\n",
117     "-----END X509 CRL-----\n",
118     NULL
119 };
120
121 /*
122  * This is kBasicCRL but with a critical issuing distribution point
123  * extension.
124  */
125 static const char *kKnownCriticalCRL[] = {
126     "-----BEGIN X509 CRL-----\n",
127     "MIIBujCBowIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
128     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
129     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCEwHzAKBgNV\n",
130     "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wDQYJKoZIhvcNAQELBQADggEBAA+3\n",
131     "i+5e5Ub8sccfgOBs6WVJFI9c8gvJjrJ8/dYfFIAuCyeocs7DFXn1n13CRZ+URR/Q\n",
132     "mVWgU28+xeusuSPYFpd9cyYTcVyNUGNTI3lwgcE/yVjPaOmzSZKdPakApRxtpKKQ\n",
133     "NN/56aQz3bnT/ZSHQNciRB8U6jiD9V30t0w+FDTpGaG+7bzzUH3UVF9xf9Ctp60A\n",
134     "3mfLe0scas7owSt4AEFuj2SPvcE7yvdOXbu+IEv21cEJUVExJAbhvIweHXh6yRW+\n",
135     "7VVeiNzdIjkZjyTmAzoXGha4+wbxXyBRbfH+XWcO/H+8nwyG8Gktdu2QB9S9nnIp\n",
136     "o/1TpfOMSGhMyMoyPrk=\n",
137     "-----END X509 CRL-----\n",
138     NULL
139 };
140
141 /*
142  * kUnknownCriticalCRL is kBasicCRL but with an unknown critical extension.
143  */
144 static const char *kUnknownCriticalCRL[] = {
145     "-----BEGIN X509 CRL-----\n",
146     "MIIBvDCBpQIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
147     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
148     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCMwITAKBgNV\n",
149     "HRQEAwIBATATBgwqhkiG9xIEAYS3CQABAf8EADANBgkqhkiG9w0BAQsFAAOCAQEA\n",
150     "GvBP0xqL509InMj/3493YVRV+ldTpBv5uTD6jewzf5XdaxEQ/VjTNe5zKnxbpAib\n",
151     "Kf7cwX0PMSkZjx7k7kKdDlEucwVvDoqC+O9aJcqVmM6GDyNb9xENxd0XCXja6MZC\n",
152     "yVgP4AwLauB2vSiEprYJyI1APph3iAEeDm60lTXX/wBM/tupQDDujKh2GPyvBRfJ\n",
153     "+wEDwGg3ICwvu4gO4zeC5qnFR+bpL9t5tOMAQnVZ0NWv+k7mkd2LbHdD44dxrfXC\n",
154     "nhtfERx99SDmC/jtUAJrGhtCO8acr7exCeYcduN7KKCm91OeCJKK6OzWst0Og1DB\n",
155     "kwzzU2rL3G65CrZ7H0SZsQ==\n",
156     "-----END X509 CRL-----\n",
157     NULL
158 };
159
160 /*
161  * kUnknownCriticalCRL2 is kBasicCRL but with a critical issuing distribution
162  * point extension followed by an unknown critical extension
163  */
164 static const char *kUnknownCriticalCRL2[] = {
165     "-----BEGIN X509 CRL-----\n",
166     "MIIBzzCBuAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
167     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
168     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoDYwNDAKBgNV\n",
169     "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wEwYMKoZIhvcSBAGEtwkAAQH/BAAw\n",
170     "DQYJKoZIhvcNAQELBQADggEBACTcpQC8jXL12JN5YzOcQ64ubQIe0XxRAd30p7qB\n",
171     "BTXGpgqBjrjxRfLms7EBYodEXB2oXMsDq3km0vT1MfYdsDD05S+SQ9CDsq/pUfaC\n",
172     "E2WNI5p8WircRnroYvbN2vkjlRbMd1+yNITohXYXCJwjEOAWOx3XIM10bwPYBv4R\n",
173     "rDobuLHoMgL3yHgMHmAkP7YpkBucNqeBV8cCdeAZLuhXFWi6yfr3r/X18yWbC/r2\n",
174     "2xXdkrSqXLFo7ToyP8YKTgiXpya4x6m53biEYwa2ULlas0igL6DK7wjYZX95Uy7H\n",
175     "GKljn9weIYiMPV/BzGymwfv2EW0preLwtyJNJPaxbdin6Jc=\n",
176     "-----END X509 CRL-----\n",
177     NULL
178 };
179
180
181 /*
182  * Glue an array of strings together.  Return a BIO and put the string
183  * into |*out| so we can free it.
184  */
185 static BIO *glue(const char **pem, char **out)
186 {
187     char *dest;
188     int i;
189     size_t s = 0;
190
191     /* Glue the strings together. */
192     for (i = 0; pem[i] != NULL; ++i)
193         s += strlen(pem[i]);
194     dest = *out = OPENSSL_malloc(s + 1);
195     if (dest == NULL)
196         return NULL;
197     for (i = 0; pem[i] != NULL; ++i)
198         dest += strlen(strcpy(dest, pem[i]));
199     return BIO_new_mem_buf(*out, s);
200 }
201
202 /*
203  * Create a CRL from an array of strings.
204  */
205 static X509_CRL *CRL_from_strings(const char **pem)
206 {
207     char *p;
208     BIO *b = glue(pem, &p);
209     X509_CRL *crl = PEM_read_bio_X509_CRL(b, NULL, NULL, NULL);
210
211     OPENSSL_free(p);
212     BIO_free(b);
213     return crl;
214 }
215
216 /*
217  * Create an X509 from an array of strings.
218  */
219 static X509 *X509_from_strings(const char **pem)
220 {
221     char *p;
222     BIO *b = glue(pem, &p);
223     X509 *x = PEM_read_bio_X509(b, NULL, NULL, NULL);
224
225     OPENSSL_free(p);
226     BIO_free(b);
227     return x;
228 }
229
230 /*
231  * Verify |leaf| certificate (chained up to |root|).  |crls| if
232  * not NULL, is a list of CRLs to include in the verification. It is
233  * also free'd before returning, which is kinda yucky but convenient.
234  * Returns a value from X509_V_ERR_xxx or X509_V_OK.
235  */
236 static int verify(X509 *leaf, X509 *root, STACK_OF(X509_CRL) *crls,
237                   unsigned long flags)
238 {
239     X509_STORE_CTX *ctx = X509_STORE_CTX_new();
240     X509_STORE *store = X509_STORE_new();
241     X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
242     STACK_OF(X509) *roots = sk_X509_new_null();
243     int status = X509_V_ERR_UNSPECIFIED;
244
245     if (!TEST_ptr(ctx))
246         goto err;
247     if (!TEST_ptr(store))
248         goto err;
249     if (!TEST_ptr(param))
250         goto err;
251     if (!TEST_ptr(roots))
252         goto err;
253
254     /* Create a stack; upref the cert because we free it below. */
255     X509_up_ref(root);
256     if (!TEST_true(sk_X509_push(roots, root)))
257         goto err;
258
259     if (!TEST_true(X509_STORE_CTX_init(ctx, store, leaf, NULL)))
260         goto err;
261     X509_STORE_CTX_set0_trusted_stack(ctx, roots);
262     X509_STORE_CTX_set0_crls(ctx, crls);
263     X509_VERIFY_PARAM_set_time(param, PARAM_TIME);
264     if (!TEST_long_eq(X509_VERIFY_PARAM_get_time(param), PARAM_TIME)) {
265         TEST_info("set_time/get_time mismatch.");
266         goto err;
267     }
268     X509_VERIFY_PARAM_set_depth(param, 16);
269     if (flags)
270         X509_VERIFY_PARAM_set_flags(param, flags);
271     X509_STORE_CTX_set0_param(ctx, param);
272
273     ERR_clear_error();
274     status = X509_verify_cert(ctx) == 1 ? X509_V_OK
275                                         : X509_STORE_CTX_get_error(ctx);
276 err:
277     sk_X509_pop_free(roots, X509_free);
278     sk_X509_CRL_pop_free(crls, X509_CRL_free);
279     X509_STORE_CTX_free(ctx);
280     X509_STORE_free(store);
281     return status;
282 }
283
284 /*
285  * Create a stack of CRL's.  Upref each one because we call pop_free on
286  * the stack and need to keep the CRL's around until the test exits.
287  * Yes this crashes on malloc failure; it forces us to debug.
288  */
289 static STACK_OF(X509_CRL) *make_CRL_stack(X509_CRL *x1, X509_CRL *x2)
290 {
291     STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null();
292
293     sk_X509_CRL_push(sk, x1);
294     X509_CRL_up_ref(x1);
295     if (x2 != NULL) {
296         sk_X509_CRL_push(sk, x2);
297         X509_CRL_up_ref(x2);
298     }
299     return sk;
300 }
301
302 static int test_crl()
303 {
304     X509 *root = X509_from_strings(kCRLTestRoot);
305     X509 *leaf = X509_from_strings(kCRLTestLeaf);
306     X509_CRL *basic_crl = CRL_from_strings(kBasicCRL);
307     X509_CRL *revoked_crl = CRL_from_strings(kRevokedCRL);
308     X509_CRL *bad_issuer_crl = CRL_from_strings(kBadIssuerCRL);
309     X509_CRL *known_critical_crl = CRL_from_strings(kKnownCriticalCRL);
310     X509_CRL *unknown_critical_crl = CRL_from_strings(kUnknownCriticalCRL);
311     X509_CRL *unknown_critical_crl2 = CRL_from_strings(kUnknownCriticalCRL2);
312     int status = 0;
313
314     if (!TEST_ptr(root))
315         goto err;
316     if (!TEST_ptr(leaf))
317         goto err;
318     if (!TEST_ptr(basic_crl))
319         goto err;
320     if (!TEST_ptr(revoked_crl))
321         goto err;
322     if (!TEST_ptr(bad_issuer_crl))
323         goto err;
324     if (!TEST_ptr(known_critical_crl))
325         goto err;
326     if (!TEST_ptr(unknown_critical_crl))
327         goto err;
328     if (!TEST_ptr(unknown_critical_crl2))
329         goto err;
330
331     if (verify(leaf, root, make_CRL_stack(basic_crl, NULL),
332                X509_V_FLAG_CRL_CHECK) != X509_V_OK) {
333         TEST_info("Cert with CRL didn't verify.");
334         goto err;
335     }
336
337     if (verify(leaf, root, make_CRL_stack(basic_crl, revoked_crl),
338                X509_V_FLAG_CRL_CHECK) != X509_V_ERR_CERT_REVOKED) {
339         TEST_info("Revoked CRL wasn't checked.");
340         goto err;
341     }
342
343     if (verify(leaf, root, NULL,
344                X509_V_FLAG_CRL_CHECK) != X509_V_ERR_UNABLE_TO_GET_CRL) {
345         TEST_info("CRLs were not required.");
346         goto err;
347     }
348
349     if (verify(leaf, root, make_CRL_stack(bad_issuer_crl, NULL),
350                X509_V_FLAG_CRL_CHECK) != X509_V_ERR_UNABLE_TO_GET_CRL) {
351         TEST_info("Bad CRL issuer was unnoticed.");
352         goto err;
353     }
354
355     if (verify(leaf, root, make_CRL_stack(known_critical_crl, NULL),
356                X509_V_FLAG_CRL_CHECK) != X509_V_OK) {
357         TEST_info("CRL with known critical extension was rejected.");
358         goto err;
359     }
360
361     if (verify(leaf, root, make_CRL_stack(unknown_critical_crl, NULL),
362                X509_V_FLAG_CRL_CHECK) !=
363             X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION) {
364         TEST_info("CRL with unknown critical extension was accepted.");
365         goto err;
366     }
367
368     if (verify(leaf, root, make_CRL_stack(unknown_critical_crl2, NULL),
369                X509_V_FLAG_CRL_CHECK) !=
370             X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION) {
371         TEST_info("CRL with unknown critical extension (2) was accepted.");
372         goto err;
373     }
374
375     status = 1;
376
377 err:
378     X509_free(root);
379     X509_free(leaf);
380     X509_CRL_free(basic_crl);
381     X509_CRL_free(revoked_crl);
382     X509_CRL_free(bad_issuer_crl);
383     X509_CRL_free(known_critical_crl);
384     X509_CRL_free(unknown_critical_crl);
385     X509_CRL_free(unknown_critical_crl2);
386     return status;
387 }
388
389 void register_tests(void)
390 {
391     ADD_TEST(test_crl);
392 }