cleanup where purpose is not needed in 25-test_verify.t

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14413)

diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index 4b0cb4072983dab0c49ea908886ce5bb505057f7..03a5e1fbdd2469631440cb9d74ea824a703f4d31 100644 (file)
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -18,9 +18,10 @@ setup("test_verify");
 
 sub verify {
     my ($cert, $purpose, $trusted, $untrusted, @opts) = @_;
-    my @args = qw(openssl verify -auth_level 1 -purpose);
     my @path = qw(test certs);
-    push(@args, "$purpose", @opts);
+    my @args = qw(openssl verify -auth_level 1);
+    push(@args, "-purpose", $purpose) if $purpose ne "";
+    push(@args, @opts);
     for (@$trusted) { push(@args, "-trusted", srctop_file(@path, "$_.pem")) }
     for (@$untrusted) { push(@args, "-untrusted", srctop_file(@path, "$_.pem")) }
     push(@args, srctop_file(@path, "$cert.pem"));
@@ -47,11 +48,11 @@ ok(!verify("ee-cert", "sslserver", [qw(root-name2)], [qw(ca-cert)]),
 
 # Critical extensions
 
-ok(verify("ee-cert-noncrit-unknown-ext", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
+ok(verify("ee-cert-noncrit-unknown-ext", "", ["root-cert"], ["ca-cert"]),
    "accept non-critical unknown extension");
-ok(!verify("ee-cert-crit-unknown-ext", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
+ok(!verify("ee-cert-crit-unknown-ext", "", ["root-cert"], ["ca-cert"]),
    "reject critical unknown extension");
-ok(verify("ee-cert-ocsp-nocheck", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
+ok(verify("ee-cert-ocsp-nocheck", "", ["root-cert"], ["ca-cert"]),
    "accept critical OCSP No Check");
 
 # Explicit trust/purpose combinations
@@ -263,47 +264,47 @@ ok(!verify("pc6-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-c
    "failed proxy cert where last CN was added as a multivalue RDN component");
 
 # Security level tests
-ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
    "accept RSA 2048 chain at auth level 2");
-ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
+ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
    "reject RSA 2048 root at auth level 3");
-ok(verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),
+ok(verify("ee-cert", "", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),
    "accept RSA 768 root at auth level 0");
-ok(!verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"]),
+ok(!verify("ee-cert", "", ["root-cert-768"], ["ca-cert-768i"]),
    "reject RSA 768 root at auth level 1");
-ok(verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),
+ok(verify("ee-cert-768i", "", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),
    "accept RSA 768 intermediate at auth level 0");
-ok(!verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"]),
+ok(!verify("ee-cert-768i", "", ["root-cert"], ["ca-cert-768"]),
    "reject RSA 768 intermediate at auth level 1");
-ok(verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
+ok(verify("ee-cert-768", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
    "accept RSA 768 leaf at auth level 0");
-ok(!verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"]),
+ok(!verify("ee-cert-768", "", ["root-cert"], ["ca-cert"]),
    "reject RSA 768 leaf at auth level 1");
 #
-ok(verify("ee-cert", "sslserver", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),
+ok(verify("ee-cert", "", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),
    "accept md5 self-signed TA at auth level 2");
-ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-auth_level", "2"),
+ok(verify("ee-cert", "", ["ca-cert-md5-any"], [], "-auth_level", "2"),
    "accept md5 intermediate TA at auth level 2");
-ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),
+ok(verify("ee-cert", "", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),
    "accept md5 intermediate at auth level 0");
-ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"]),
+ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert-md5"]),
    "reject md5 intermediate at auth level 1");
-ok(verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
+ok(verify("ee-cert-md5", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
    "accept md5 leaf at auth level 0");
-ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]),
+ok(!verify("ee-cert-md5", "", ["root-cert"], ["ca-cert"]),
    "reject md5 leaf at auth level 1");
 
 # Explicit vs named curve tests
 SKIP: {
     skip "EC is not supported by this OpenSSL build", 3
         if disabled("ec");
-    ok(!verify("ee-cert-ec-explicit", "sslserver", ["root-cert"],
+    ok(!verify("ee-cert-ec-explicit", "", ["root-cert"],
                ["ca-cert-ec-named"]),
         "reject explicit curve leaf with named curve intermediate");
-    ok(!verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"],
+    ok(!verify("ee-cert-ec-named-explicit", "", ["root-cert"],
                ["ca-cert-ec-explicit"]),
         "reject named curve leaf with explicit curve intermediate");
-    ok(verify("ee-cert-ec-named-named", "sslserver", ["root-cert"],
+    ok(verify("ee-cert-ec-named-named", "", ["root-cert"],
               ["ca-cert-ec-named"]),
         "accept named curve leaf with named curve intermediate");
 }
@@ -312,129 +313,128 @@ SKIP: {
 # between the trust-anchor and the leaf, so, for example, with a root->ca->leaf
 # chain, depth = 1 is sufficient, but depth == 0 is not.
 #
-ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),
+ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),
    "accept chain with verify_depth 2");
-ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),
+ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),
    "accept chain with verify_depth 1");
-ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),
-   "accept chain with verify_depth 0");
-ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
+ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),
+   "reject chain with verify_depth 0");
+ok(verify("ee-cert", "", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
    "accept md5 intermediate TA with verify_depth 0");
 
 # Name Constraints tests.
 
-ok(verify("alt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(verify("alt1-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints everything permitted");
 
-ok(verify("alt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
+ok(verify("alt2-cert", "", ["root-cert"], ["ncca2-cert"], ),
    "Name Constraints nothing excluded");
 
-ok(verify("alt3-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+ok(verify("alt3-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
    "Name Constraints nested test all permitted");
 
-ok(verify("goodcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(verify("goodcn1-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints CNs permitted");
 
-ok(!verify("badcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badcn1-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints CNs not permitted");
 
-ok(!verify("badalt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt1-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints hostname not permitted");
 
-ok(!verify("badalt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
+ok(!verify("badalt2-cert", "", ["root-cert"], ["ncca2-cert"], ),
    "Name Constraints hostname excluded");
 
-ok(!verify("badalt3-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt3-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints email address not permitted");
 
-ok(!verify("badalt4-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt4-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints subject email address not permitted");
 
-ok(!verify("badalt5-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt5-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints IP address not permitted");
 
-ok(!verify("badalt6-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt6-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints CN hostname not permitted");
 
-ok(!verify("badalt7-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+ok(!verify("badalt7-cert", "", ["root-cert"], ["ncca1-cert"], ),
    "Name Constraints CN BMPSTRING hostname not permitted");
 
-ok(!verify("badalt8-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+ok(!verify("badalt8-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
    "Name constraints nested DNS name not permitted 1");
 
-ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+ok(!verify("badalt9-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
    "Name constraints nested DNS name not permitted 2");
 
-ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+ok(!verify("badalt10-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
    "Name constraints nested DNS name excluded");
 
-ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
+ok(verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
     "Accept PSS signature using SHA1 at auth level 0");
 
-ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
+ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], ),
     "CA with PSS signature using SHA256");
 
-ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
+ok(!verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
     "Reject PSS signature using SHA1 and auth level 1");
 
-ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
     "PSS signature using SHA256 and auth level 2");
 
-ok(verify("ee-pss-cert", "sslserver", ["root-cert"], ["ca-pss-cert"], ),
+ok(verify("ee-pss-cert", "", ["root-cert"], ["ca-pss-cert"], ),
     "CA PSS signature");
-ok(!verify("ee-pss-wrong1.5-cert", "sslserver", ["root-cert"], ["ca-pss-cert"], ),
+ok(!verify("ee-pss-wrong1.5-cert", "", ["root-cert"], ["ca-pss-cert"], ),
     "CA producing regular PKCS#1 v1.5 signature with PSA-PSS key");
 
-ok(!verify("many-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(!verify("many-names1", "", ["many-constraints"], ["many-constraints"], ),
     "Too many names and constraints to check (1)");
-ok(!verify("many-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(!verify("many-names2", "", ["many-constraints"], ["many-constraints"], ),
     "Too many names and constraints to check (2)");
-ok(!verify("many-names3", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(!verify("many-names3", "", ["many-constraints"], ["many-constraints"], ),
     "Too many names and constraints to check (3)");
 
-ok(verify("some-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(verify("some-names1", "", ["many-constraints"], ["many-constraints"], ),
     "Not too many names and constraints to check (1)");
-ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(verify("some-names2", "", ["many-constraints"], ["many-constraints"], ),
     "Not too many names and constraints to check (2)");
-ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+ok(verify("some-names2", "", ["many-constraints"], ["many-constraints"], ),
     "Not too many names and constraints to check (3)");
-ok(verify("root-cert-rsa2", "sslserver", ["root-cert-rsa2"], [], "-check_ss_sig"),
+ok(verify("root-cert-rsa2", "", ["root-cert-rsa2"], [], "-check_ss_sig"),
     "Public Key Algorithm rsa instead of rsaEncryption");
 
-    ok(verify("ee-self-signed", "sslserver", ["ee-self-signed"], []),
-       "accept trusted self-signed EE cert excluding key usage keyCertSign");
+ok(verify("ee-self-signed", "", ["ee-self-signed"], []),
+   "accept trusted self-signed EE cert excluding key usage keyCertSign");
 
 SKIP: {
     skip "Ed25519 is not supported by this OpenSSL build", 6
              if disabled("ec");
 
     # ED25519 certificate from draft-ietf-curdle-pkix-04
-    ok(verify("ee-ed25519", "sslserver", ["root-ed25519"], []),
+    ok(verify("ee-ed25519", "", ["root-ed25519"], []),
        "accept X25519 EE cert issued by trusted Ed25519 self-signed CA cert");
 
-    ok(!verify("ee-ed25519", "sslserver", ["root-ed25519"], [], "-x509_strict"),
+    ok(!verify("ee-ed25519", "", ["root-ed25519"], [], "-x509_strict"),
        "reject X25519 EE cert in strict mode since AKID is missing");
 
-    ok(!verify("root-ed25519", "sslserver", ["ee-ed25519"], []),
+    ok(!verify("root-ed25519", "", ["ee-ed25519"], []),
        "fail Ed25519 CA and EE certs swapped");
 
-    ok(verify("root-ed25519", "sslserver", ["root-ed25519"], []),
+    ok(verify("root-ed25519", "", ["root-ed25519"], []),
        "accept trusted Ed25519 self-signed CA cert");
 
-    ok(!verify("ee-ed25519", "sslserver", ["ee-ed25519"], []),
+    ok(!verify("ee-ed25519", "", ["ee-ed25519"], []),
        "fail trusted Ed25519-signed self-issued X25519 cert");
 
-    ok(verify("ee-ed25519", "sslserver", ["ee-ed25519"], [], "-partial_chain"),
+    ok(verify("ee-ed25519", "", ["ee-ed25519"], [], "-partial_chain"),
        "accept last-resort direct leaf match Ed25519-signed self-issued cert");
 
 }
 
 SKIP: {
-    skip "SM2 is not supported by this OpenSSL build", 2
-             if disabled("sm2");
+    skip "SM2 is not supported by this OpenSSL build", 2 if disabled("sm2");
 
-   ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-vfyopt", "distid:1234567812345678"),
+   ok_nofips(verify("sm2", "", ["sm2-ca-cert"], [], "-vfyopt", "distid:1234567812345678"),
        "SM2 ID test");
-   ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-vfyopt", "hexdistid:31323334353637383132333435363738"),
+   ok_nofips(verify("sm2", "", ["sm2-ca-cert"], [], "-vfyopt", "hexdistid:31323334353637383132333435363738"),
        "SM2 hex ID test");
 }