X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=test%2Fverify_extra_test.c;h=d03dc0c71ddf95b7d549febb484764df4491b883;hp=005fae63c01f1266303a0a17ae19c8712b444ffa;hb=HEAD;hpb=bbd86bf5424a611cb6b77a3a17fc522931c4dcb8 diff --git a/test/verify_extra_test.c b/test/verify_extra_test.c index 005fae63c0..38ecd5b863 100644 --- a/test/verify_extra_test.c +++ b/test/verify_extra_test.c @@ -1,107 +1,35 @@ /* - * Written by Matt Caswell for the OpenSSL project. - */ -/* ==================================================================== - * Copyright (c) 1998-2015 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@openssl.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). + * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html */ #include +#include #include #include #include +#include #include #include +#include "testutil.h" -static STACK_OF(X509) *load_certs_from_file(const char *filename) -{ - STACK_OF(X509) *certs; - BIO *bio; - X509 *x; - - bio = BIO_new_file(filename, "r"); +static const char *certs_dir; +static char *root_f = NULL; +static char *roots_f = NULL; +static char *untrusted_f = NULL; +static char *bad_f = NULL; +static char *req_f = NULL; +static char *sroot_cert = NULL; +static char *ca_cert = NULL; +static char *ee_cert = NULL; - if (bio == NULL) { - return NULL; - } - - certs = sk_X509_new_null(); - if (certs == NULL) { - BIO_free(bio); - return NULL; - } +#define load_cert_from_file(file) load_cert_pem(file, NULL) - ERR_set_mark(); - do { - x = PEM_read_bio_X509(bio, NULL, 0, NULL); - if (x != NULL && !sk_X509_push(certs, x)) { - sk_X509_pop_free(certs, X509_free); - BIO_free(bio); - return NULL; - } else if (x == NULL) { - /* - * We probably just ran out of certs, so ignore any errors - * generated - */ - ERR_pop_to_mark(); - } - } while (x != NULL); - - BIO_free(bio); - - return certs; -} - -/* +/*- * Test for CVE-2015-1793 (Alternate Chains Certificate Forgery) * * Chain is as follows: @@ -130,15 +58,12 @@ static STACK_OF(X509) *load_certs_from_file(const char *filename) * CA=FALSE, and will therefore incorrectly verify bad * */ -static int test_alt_chains_cert_forgery(const char *roots_f, - const char *untrusted_f, - const char *bad_f) +static int test_alt_chains_cert_forgery(void) { int ret = 0; int i; X509 *x = NULL; STACK_OF(X509) *untrusted = NULL; - BIO *bio = NULL; X509_STORE_CTX *sctx = NULL; X509_STORE *store = NULL; X509_LOOKUP *lookup = NULL; @@ -150,15 +75,12 @@ static int test_alt_chains_cert_forgery(const char *roots_f, lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); if (lookup == NULL) goto err; - if(!X509_LOOKUP_load_file(lookup, roots_f, X509_FILETYPE_PEM)) + if (!X509_LOOKUP_load_file(lookup, roots_f, X509_FILETYPE_PEM)) goto err; - untrusted = load_certs_from_file(untrusted_f); + untrusted = load_certs_pem(untrusted_f); - if ((bio = BIO_new_file(bad_f, "r")) == NULL) - goto err; - - if((x = PEM_read_bio_X509(bio, NULL, 0, NULL)) == NULL) + if ((x = load_cert_from_file(bad_f)) == NULL) goto err; sctx = X509_STORE_CTX_new(); @@ -170,47 +92,250 @@ static int test_alt_chains_cert_forgery(const char *roots_f, i = X509_verify_cert(sctx); - if(i == 0 && X509_STORE_CTX_get_error(sctx) == X509_V_ERR_INVALID_CA) { + if (i == 0 && X509_STORE_CTX_get_error(sctx) == X509_V_ERR_INVALID_CA) { /* This is the result we were expecting: Test passed */ ret = 1; } err: X509_STORE_CTX_free(sctx); X509_free(x); - BIO_free(bio); - sk_X509_pop_free(untrusted, X509_free); + OSSL_STACK_OF_X509_free(untrusted); X509_STORE_free(store); - if (ret != 1) - ERR_print_errors_fp(stderr); return ret; } -int main(int argc, char **argv) +static int test_distinguishing_id(void) { - CRYPTO_set_mem_debug(1); - CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); + X509 *x = NULL; + int ret = 0; + ASN1_OCTET_STRING *v = NULL, *v2 = NULL; + char *distid = "this is an ID"; + + x = load_cert_from_file(bad_f); + if (x == NULL) + goto err; - ERR_load_crypto_strings(); - OpenSSL_add_all_digests(); + v = ASN1_OCTET_STRING_new(); + if (v == NULL) + goto err; - if (argc != 4) { - fprintf(stderr, "usage: verify_extra_test roots.pem untrusted.pem bad.pem\n"); - return 1; + if (!ASN1_OCTET_STRING_set(v, (unsigned char *)distid, + (int)strlen(distid))) { + ASN1_OCTET_STRING_free(v); + goto err; } - if (!test_alt_chains_cert_forgery(argv[1], argv[2], argv[3])) { - fprintf(stderr, "Test alt chains cert forgery failed\n"); - return 1; + X509_set0_distinguishing_id(x, v); + + v2 = X509_get0_distinguishing_id(x); + if (!TEST_ptr(v2) + || !TEST_int_eq(ASN1_OCTET_STRING_cmp(v, v2), 0)) + goto err; + + ret = 1; + err: + X509_free(x); + return ret; +} + +static int test_req_distinguishing_id(void) +{ + X509_REQ *x = NULL; + BIO *bio = NULL; + int ret = 0; + ASN1_OCTET_STRING *v = NULL, *v2 = NULL; + char *distid = "this is an ID"; + + bio = BIO_new_file(req_f, "r"); + if (bio == NULL) + goto err; + + x = PEM_read_bio_X509_REQ(bio, NULL, 0, NULL); + if (x == NULL) + goto err; + + v = ASN1_OCTET_STRING_new(); + if (v == NULL) + goto err; + + if (!ASN1_OCTET_STRING_set(v, (unsigned char *)distid, + (int)strlen(distid))) { + ASN1_OCTET_STRING_free(v); + goto err; } - EVP_cleanup(); - CRYPTO_cleanup_all_ex_data(); - ERR_remove_thread_state(NULL); - ERR_free_strings(); -#ifdef CRYPTO_MDEBUG - CRYPTO_mem_leaks_fp(stderr); -#endif + X509_REQ_set0_distinguishing_id(x, v); + + v2 = X509_REQ_get0_distinguishing_id(x); + if (!TEST_ptr(v2) + || !TEST_int_eq(ASN1_OCTET_STRING_cmp(v, v2), 0)) + goto err; - printf("PASS\n"); + ret = 1; + err: + X509_REQ_free(x); + BIO_free(bio); + return ret; +} + +static int test_self_signed(const char *filename, int use_trusted, int expected) +{ + X509 *cert = load_cert_from_file(filename); /* may result in NULL */ + STACK_OF(X509) *trusted = sk_X509_new_null(); + X509_STORE_CTX *ctx = X509_STORE_CTX_new(); + int ret; + + ret = TEST_int_eq(X509_self_signed(cert, 1), expected); + + if (cert != NULL) { + if (use_trusted) + ret = ret && TEST_true(sk_X509_push(trusted, cert)); + ret = ret && TEST_true(X509_STORE_CTX_init(ctx, NULL, cert, NULL)); + X509_STORE_CTX_set0_trusted_stack(ctx, trusted); + ret = ret && TEST_int_eq(X509_verify_cert(ctx), expected); + } + + X509_STORE_CTX_free(ctx); + sk_X509_free(trusted); + X509_free(cert); + return ret; +} + +static int test_self_signed_good(void) +{ + return test_self_signed(root_f, 1, 1); +} + +static int test_self_signed_bad(void) +{ + return test_self_signed(bad_f, 1, 0); +} + +static int test_self_signed_error(void) +{ + return test_self_signed("nonexistent file name", 1, -1); +} + +static int test_store_ctx(void) +{ + /* Verifying a cert where we have no trusted certs should fail */ + return test_self_signed(bad_f, 0, 0); +} + +static int do_test_purpose(int purpose, int expected) +{ + X509 *eecert = load_cert_from_file(ee_cert); /* may result in NULL */ + X509 *untrcert = load_cert_from_file(ca_cert); + X509 *trcert = load_cert_from_file(sroot_cert); + STACK_OF(X509) *trusted = sk_X509_new_null(); + STACK_OF(X509) *untrusted = sk_X509_new_null(); + X509_STORE_CTX *ctx = X509_STORE_CTX_new(); + int testresult = 0; + + if (!TEST_ptr(eecert) + || !TEST_ptr(untrcert) + || !TEST_ptr(trcert) + || !TEST_ptr(trusted) + || !TEST_ptr(untrusted) + || !TEST_ptr(ctx)) + goto err; + + + if (!TEST_true(sk_X509_push(trusted, trcert))) + goto err; + trcert = NULL; + if (!TEST_true(sk_X509_push(untrusted, untrcert))) + goto err; + untrcert = NULL; + + if (!TEST_true(X509_STORE_CTX_init(ctx, NULL, eecert, untrusted))) + goto err; + + if (!TEST_true(X509_STORE_CTX_set_purpose(ctx, purpose))) + goto err; + + /* + * X509_STORE_CTX_set0_trusted_stack() is bady named. Despite the set0 name + * we are still responsible for freeing trusted after we have finished with + * it. + */ + X509_STORE_CTX_set0_trusted_stack(ctx, trusted); + + if (!TEST_int_eq(X509_verify_cert(ctx), expected)) + goto err; + + testresult = 1; + err: + OSSL_STACK_OF_X509_free(trusted); + OSSL_STACK_OF_X509_free(untrusted); + X509_STORE_CTX_free(ctx); + X509_free(eecert); + X509_free(untrcert); + X509_free(trcert); + return testresult; +} + +static int test_purpose_ssl_client(void) +{ + return do_test_purpose(X509_PURPOSE_SSL_CLIENT, 0); +} + +static int test_purpose_ssl_server(void) +{ + return do_test_purpose(X509_PURPOSE_SSL_SERVER, 1); +} + +static int test_purpose_any(void) +{ + return do_test_purpose(X509_PURPOSE_ANY, 1); +} + +OPT_TEST_DECLARE_USAGE("certs-dir\n") + +int setup_tests(void) +{ + if (!test_skip_common_options()) { + TEST_error("Error parsing test options\n"); + return 0; + } + + if (!TEST_ptr(certs_dir = test_get_argument(0))) + return 0; + + if (!TEST_ptr(root_f = test_mk_file_path(certs_dir, "rootCA.pem")) + || !TEST_ptr(roots_f = test_mk_file_path(certs_dir, "roots.pem")) + || !TEST_ptr(untrusted_f = test_mk_file_path(certs_dir, "untrusted.pem")) + || !TEST_ptr(bad_f = test_mk_file_path(certs_dir, "bad.pem")) + || !TEST_ptr(req_f = test_mk_file_path(certs_dir, "sm2-csr.pem")) + || !TEST_ptr(sroot_cert = test_mk_file_path(certs_dir, "sroot-cert.pem")) + || !TEST_ptr(ca_cert = test_mk_file_path(certs_dir, "ca-cert.pem")) + || !TEST_ptr(ee_cert = test_mk_file_path(certs_dir, "ee-cert.pem"))) + goto err; + + ADD_TEST(test_alt_chains_cert_forgery); + ADD_TEST(test_store_ctx); + ADD_TEST(test_distinguishing_id); + ADD_TEST(test_req_distinguishing_id); + ADD_TEST(test_self_signed_good); + ADD_TEST(test_self_signed_bad); + ADD_TEST(test_self_signed_error); + ADD_TEST(test_purpose_ssl_client); + ADD_TEST(test_purpose_ssl_server); + ADD_TEST(test_purpose_any); + return 1; + err: + cleanup_tests(); return 0; } + +void cleanup_tests(void) +{ + OPENSSL_free(root_f); + OPENSSL_free(roots_f); + OPENSSL_free(untrusted_f); + OPENSSL_free(bad_f); + OPENSSL_free(req_f); + OPENSSL_free(sroot_cert); + OPENSSL_free(ca_cert); + OPENSSL_free(ee_cert); +}