2 * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
12 #include "cmp_testlib.h"
13 #include "../crypto/crmf/crmf_local.h" /* for manipulating POPO signature */
14 DEFINE_STACK_OF(OSSL_CRMF_MSG)
16 static const char *server_f;
17 static const char *client_f;
18 static const char *endentity1_f;
19 static const char *endentity2_f;
20 static const char *root_f;
21 static const char *intermediate_f;
22 static const char *ir_protected_f;
23 static const char *ir_unprotected_f;
24 static const char *ir_rmprotection_f;
25 static const char *ip_waiting_f;
26 static const char *instacert_f;
27 static const char *instaca_f;
28 static const char *ir_protected_0_extracerts;
29 static const char *ir_protected_2_extracerts;
31 typedef struct test_fixture {
32 const char *test_case_name;
34 OSSL_CMP_CTX *cmp_ctx;
37 ossl_cmp_allow_unprotected_cb_t allow_unprotected_cb;
39 } CMP_VFY_TEST_FIXTURE;
41 static void tear_down(CMP_VFY_TEST_FIXTURE *fixture)
43 OSSL_CMP_MSG_free(fixture->msg);
44 OSSL_CMP_CTX_free(fixture->cmp_ctx);
45 OPENSSL_free(fixture);
48 static time_t test_time_valid = 0, test_time_after_expiration = 0;
50 static CMP_VFY_TEST_FIXTURE *set_up(const char *const test_case_name)
52 X509_STORE *ts = X509_STORE_new();
53 CMP_VFY_TEST_FIXTURE *fixture;
55 if (!TEST_ptr(fixture = OPENSSL_zalloc(sizeof(*fixture))))
57 fixture->test_case_name = test_case_name;
59 || !TEST_ptr(fixture->cmp_ctx = OSSL_CMP_CTX_new(NULL, NULL))
60 || !OSSL_CMP_CTX_set0_trustedStore(fixture->cmp_ctx, ts)
61 || !OSSL_CMP_CTX_set_log_cb(fixture->cmp_ctx, print_to_bio_out)) {
66 X509_VERIFY_PARAM_set_time(X509_STORE_get0_param(ts), test_time_valid);
67 X509_STORE_set_verify_cb(ts, X509_STORE_CTX_print_verify_cb);
71 static X509 *srvcert = NULL;
72 static X509 *clcert = NULL;
74 static X509 *endentity1 = NULL, *endentity2 = NULL,
75 *intermediate = NULL, *root = NULL;
77 static X509 *insta_cert = NULL, *instaca_cert = NULL;
79 static unsigned char rand_data[OSSL_CMP_TRANSACTIONID_LENGTH];
80 static OSSL_CMP_MSG *ir_unprotected, *ir_rmprotection;
82 static int flip_bit(ASN1_BIT_STRING *bitstr)
85 int bit = ASN1_BIT_STRING_get_bit(bitstr, bit_num);
87 return ASN1_BIT_STRING_set_bit(bitstr, bit_num, !bit);
90 static int execute_verify_popo_test(CMP_VFY_TEST_FIXTURE *fixture)
92 if ((fixture->msg = load_pkimsg(ir_protected_f)) == NULL)
94 if (fixture->expected == 0) {
95 const OSSL_CRMF_MSGS *reqs = fixture->msg->body->value.ir;
96 const OSSL_CRMF_MSG *req = sk_OSSL_CRMF_MSG_value(reqs, 0);
97 if (req == NULL || !flip_bit(req->popo->value.signature->signature))
100 return TEST_int_eq(fixture->expected,
101 ossl_cmp_verify_popo(fixture->cmp_ctx, fixture->msg,
102 fixture->additional_arg));
105 static int test_verify_popo(void)
107 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
108 fixture->expected = 1;
109 EXECUTE_TEST(execute_verify_popo_test, tear_down);
113 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
114 static int test_verify_popo_bad(void)
116 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
117 fixture->expected = 0;
118 EXECUTE_TEST(execute_verify_popo_test, tear_down);
123 static int execute_validate_msg_test(CMP_VFY_TEST_FIXTURE *fixture)
125 return TEST_int_eq(fixture->expected,
126 ossl_cmp_msg_check_update(fixture->cmp_ctx, fixture->msg,
130 static int execute_validate_cert_path_test(CMP_VFY_TEST_FIXTURE *fixture)
132 X509_STORE *ts = OSSL_CMP_CTX_get0_trustedStore(fixture->cmp_ctx);
133 int res = TEST_int_eq(fixture->expected,
134 OSSL_CMP_validate_cert_path(fixture->cmp_ctx,
137 OSSL_CMP_CTX_print_errors(fixture->cmp_ctx);
141 static int test_validate_msg_mac_alg_protection(void)
143 /* secret value belonging to cmp-test/CMP_IP_waitingStatus_PBM.der */
144 const unsigned char sec_1[] = {
145 '9', 'p', 'p', '8', '-', 'b', '3', '5', 'i', '-', 'X', 'd', '3',
146 'Q', '-', 'u', 'd', 'N', 'R'
149 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
151 fixture->expected = 1;
152 if (!TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx, sec_1,
154 || !TEST_ptr(fixture->msg = load_pkimsg(ip_waiting_f))) {
158 EXECUTE_TEST(execute_validate_msg_test, tear_down);
162 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
163 static int test_validate_msg_mac_alg_protection_bad(void)
165 const unsigned char sec_bad[] = {
166 '9', 'p', 'p', '8', '-', 'b', '3', '5', 'i', '-', 'X', 'd', '3',
167 'Q', '-', 'u', 'd', 'N', 'r'
170 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
171 fixture->expected = 0;
173 if (!TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx, sec_bad,
175 || !TEST_ptr(fixture->msg = load_pkimsg(ip_waiting_f))) {
179 EXECUTE_TEST(execute_validate_msg_test, tear_down);
184 static int add_trusted(OSSL_CMP_CTX *ctx, X509 *cert)
186 return X509_STORE_add_cert(OSSL_CMP_CTX_get0_trustedStore(ctx), cert);
189 static int add_untrusted(OSSL_CMP_CTX *ctx, X509 *cert)
191 return X509_add_cert(OSSL_CMP_CTX_get0_untrusted_certs(ctx), cert,
192 X509_ADD_FLAG_UP_REF);
195 static int test_validate_msg_signature_partial_chain(int expired)
199 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
201 ts = OSSL_CMP_CTX_get0_trustedStore(fixture->cmp_ctx);
202 fixture->expected = !expired;
204 || !TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f))
205 || !add_trusted(fixture->cmp_ctx, srvcert)) {
209 X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts);
210 X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_PARTIAL_CHAIN);
212 X509_VERIFY_PARAM_set_time(vpm, test_time_after_expiration);
214 EXECUTE_TEST(execute_validate_msg_test, tear_down);
218 static int test_validate_msg_signature_trusted_ok(void)
220 return test_validate_msg_signature_partial_chain(0);
223 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
224 static int test_validate_msg_signature_trusted_expired(void)
226 return test_validate_msg_signature_partial_chain(1);
230 static int test_validate_msg_signature_srvcert_wrong(void)
232 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
233 fixture->expected = 0;
234 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f))
235 || !TEST_true(OSSL_CMP_CTX_set1_srvCert(fixture->cmp_ctx, clcert))) {
239 EXECUTE_TEST(execute_validate_msg_test, tear_down);
243 static int test_validate_msg_signature_srvcert(int bad_sig)
245 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
246 fixture->expected = !bad_sig;
247 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f))
248 || !TEST_true(OSSL_CMP_CTX_set1_srvCert(fixture->cmp_ctx, srvcert))
249 || (bad_sig && !flip_bit(fixture->msg->protection))) {
253 EXECUTE_TEST(execute_validate_msg_test, tear_down);
257 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
258 static int test_validate_msg_signature_bad(void)
260 return test_validate_msg_signature_srvcert(1);
264 static int test_validate_msg_signature_sender_cert_srvcert(void)
266 return test_validate_msg_signature_srvcert(0);
269 static int test_validate_msg_signature_sender_cert_untrusted(void)
271 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
272 fixture->expected = 1;
273 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_0_extracerts))
274 || !add_trusted(fixture->cmp_ctx, instaca_cert)
275 || !add_untrusted(fixture->cmp_ctx, insta_cert)) {
279 EXECUTE_TEST(execute_validate_msg_test, tear_down);
283 static int test_validate_msg_signature_sender_cert_trusted(void)
285 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
286 fixture->expected = 1;
287 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_0_extracerts))
288 || !add_trusted(fixture->cmp_ctx, instaca_cert)
289 || !add_trusted(fixture->cmp_ctx, insta_cert)) {
293 EXECUTE_TEST(execute_validate_msg_test, tear_down);
297 static int test_validate_msg_signature_sender_cert_extracert(void)
299 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
300 fixture->expected = 1;
301 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_2_extracerts))
302 || !add_trusted(fixture->cmp_ctx, instaca_cert)) {
306 EXECUTE_TEST(execute_validate_msg_test, tear_down);
311 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
312 static int test_validate_msg_signature_sender_cert_absent(void)
314 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
315 fixture->expected = 0;
316 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_0_extracerts))) {
320 EXECUTE_TEST(execute_validate_msg_test, tear_down);
325 static int test_validate_with_sender(const X509_NAME *name, int expected)
327 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
328 fixture->expected = expected;
329 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f))
330 || !TEST_true(OSSL_CMP_CTX_set1_expected_sender(fixture->cmp_ctx, name))
331 || !TEST_true(OSSL_CMP_CTX_set1_srvCert(fixture->cmp_ctx, srvcert))) {
335 EXECUTE_TEST(execute_validate_msg_test, tear_down);
339 static int test_validate_msg_signature_expected_sender(void)
341 return test_validate_with_sender(X509_get_subject_name(srvcert), 1);
344 static int test_validate_msg_signature_unexpected_sender(void)
346 return test_validate_with_sender(X509_get_subject_name(root), 0);
349 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
350 static int test_validate_msg_unprotected_request(void)
352 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
353 fixture->expected = 0;
354 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_unprotected_f))) {
358 EXECUTE_TEST(execute_validate_msg_test, tear_down);
363 static void setup_path(CMP_VFY_TEST_FIXTURE **fixture, X509 *wrong, int expired)
365 (*fixture)->cert = endentity2;
366 (*fixture)->expected = wrong == NULL && !expired;
368 X509_STORE *ts = OSSL_CMP_CTX_get0_trustedStore((*fixture)->cmp_ctx);
369 X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts);
370 X509_VERIFY_PARAM_set_time(vpm, test_time_after_expiration);
372 if (!add_trusted((*fixture)->cmp_ctx, wrong == NULL ? root : wrong)
373 || !add_untrusted((*fixture)->cmp_ctx, endentity1)
374 || !add_untrusted((*fixture)->cmp_ctx, intermediate)) {
375 tear_down((*fixture));
380 static int test_validate_cert_path_ok(void)
382 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
383 setup_path(&fixture, NULL, 0);
384 EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
388 static int test_validate_cert_path_wrong_anchor(void)
390 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
391 setup_path(&fixture, srvcert /* wrong/non-root cert */, 0);
392 EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
396 static int test_validate_cert_path_expired(void)
398 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
399 setup_path(&fixture, NULL, 1);
400 EXECUTE_TEST(execute_validate_cert_path_test, tear_down);
404 static int execute_msg_check_test(CMP_VFY_TEST_FIXTURE *fixture)
406 const OSSL_CMP_PKIHEADER *hdr = OSSL_CMP_MSG_get0_header(fixture->msg);
407 const ASN1_OCTET_STRING *tid = OSSL_CMP_HDR_get0_transactionID(hdr);
409 if (!TEST_int_eq(fixture->expected,
410 ossl_cmp_msg_check_update(fixture->cmp_ctx,
412 fixture->allow_unprotected_cb,
413 fixture->additional_arg)))
416 if (fixture->expected == 0) /* error expected aready during above check */
420 ASN1_OCTET_STRING_cmp(ossl_cmp_hdr_get0_senderNonce(hdr),
421 fixture->cmp_ctx->recipNonce))
423 ASN1_OCTET_STRING_cmp(tid,
424 fixture->cmp_ctx->transactionID));
427 static int allow_unprotected(const OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
428 int invalid_protection, int allow)
433 static void setup_check_update(CMP_VFY_TEST_FIXTURE **fixture, int expected,
434 ossl_cmp_allow_unprotected_cb_t cb, int arg,
435 const unsigned char *trid_data,
436 const unsigned char *nonce_data)
438 OSSL_CMP_CTX *ctx = (*fixture)->cmp_ctx;
439 int nonce_len = OSSL_CMP_SENDERNONCE_LENGTH;
441 (*fixture)->expected = expected;
442 (*fixture)->allow_unprotected_cb = cb;
443 (*fixture)->additional_arg = arg;
444 (*fixture)->msg = OSSL_CMP_MSG_dup(ir_rmprotection);
445 if ((*fixture)->msg == NULL
446 || (nonce_data != NULL
447 && !ossl_cmp_asn1_octet_string_set1_bytes(&ctx->senderNonce,
448 nonce_data, nonce_len))) {
449 tear_down((*fixture));
451 } else if (trid_data != NULL) {
452 ASN1_OCTET_STRING *trid = ASN1_OCTET_STRING_new();
454 || !ASN1_OCTET_STRING_set(trid, trid_data,
455 OSSL_CMP_TRANSACTIONID_LENGTH)
456 || !OSSL_CMP_CTX_set1_transactionID(ctx, trid)) {
457 tear_down((*fixture));
460 ASN1_OCTET_STRING_free(trid);
464 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
465 static int test_msg_check_no_protection_no_cb(void)
467 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
468 setup_check_update(&fixture, 0, NULL, 0, NULL, NULL);
469 EXECUTE_TEST(execute_msg_check_test, tear_down);
473 static int test_msg_check_no_protection_restrictive_cb(void)
475 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
476 setup_check_update(&fixture, 0, allow_unprotected, 0, NULL, NULL);
477 EXECUTE_TEST(execute_msg_check_test, tear_down);
482 static int test_msg_check_no_protection_permissive_cb(void)
484 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
485 setup_check_update(&fixture, 1, allow_unprotected, 1, NULL, NULL);
486 EXECUTE_TEST(execute_msg_check_test, tear_down);
490 static int test_msg_check_transaction_id(void)
492 /* Transaction id belonging to CMP_IR_rmprotection.der */
493 const unsigned char trans_id[OSSL_CMP_TRANSACTIONID_LENGTH] = {
494 0x39, 0xB6, 0x90, 0x28, 0xC4, 0xBC, 0x7A, 0xF6,
495 0xBE, 0xC6, 0x4A, 0x88, 0x97, 0xA6, 0x95, 0x0B
498 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
499 setup_check_update(&fixture, 1, allow_unprotected, 1, trans_id, NULL);
500 EXECUTE_TEST(execute_msg_check_test, tear_down);
504 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
505 static int test_msg_check_transaction_id_bad(void)
507 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
508 setup_check_update(&fixture, 0, allow_unprotected, 1, rand_data, NULL);
509 EXECUTE_TEST(execute_msg_check_test, tear_down);
514 static int test_msg_check_recipient_nonce(void)
516 /* Recipient nonce belonging to CMP_IP_ir_rmprotection.der */
517 const unsigned char rec_nonce[OSSL_CMP_SENDERNONCE_LENGTH] = {
518 0x48, 0xF1, 0x71, 0x1F, 0xE5, 0xAF, 0x1C, 0x8B,
519 0x21, 0x97, 0x5C, 0x84, 0x74, 0x49, 0xBA, 0x32
522 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
523 setup_check_update(&fixture, 1, allow_unprotected, 1, NULL, rec_nonce);
524 EXECUTE_TEST(execute_msg_check_test, tear_down);
528 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
529 static int test_msg_check_recipient_nonce_bad(void)
531 SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
532 setup_check_update(&fixture, 0, allow_unprotected, 1, NULL, rand_data);
533 EXECUTE_TEST(execute_msg_check_test, tear_down);
538 void cleanup_tests(void)
542 X509_free(endentity1);
543 X509_free(endentity2);
544 X509_free(intermediate);
546 X509_free(insta_cert);
547 X509_free(instaca_cert);
548 OSSL_CMP_MSG_free(ir_unprotected);
549 OSSL_CMP_MSG_free(ir_rmprotection);
553 int setup_tests(void)
555 /* Set test time stamps */
556 struct tm ts = { 0 };
558 ts.tm_year = 2018 - 1900; /* 2018 */
559 ts.tm_mon = 1; /* February */
560 ts.tm_mday = 18; /* 18th */
561 test_time_valid = mktime(&ts); /* February 18th 2018 */
562 ts.tm_year += 10; /* February 18th 2028 */
563 test_time_after_expiration = mktime(&ts);
565 if (!test_skip_common_options()) {
566 TEST_error("Error parsing test options\n");
570 RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH);
571 if (!TEST_ptr(server_f = test_get_argument(0))
572 || !TEST_ptr(client_f = test_get_argument(1))
573 || !TEST_ptr(endentity1_f = test_get_argument(2))
574 || !TEST_ptr(endentity2_f = test_get_argument(3))
575 || !TEST_ptr(root_f = test_get_argument(4))
576 || !TEST_ptr(intermediate_f = test_get_argument(5))
577 || !TEST_ptr(ir_protected_f = test_get_argument(6))
578 || !TEST_ptr(ir_unprotected_f = test_get_argument(7))
579 || !TEST_ptr(ip_waiting_f = test_get_argument(8))
580 || !TEST_ptr(ir_rmprotection_f = test_get_argument(9))
581 || !TEST_ptr(instacert_f = test_get_argument(10))
582 || !TEST_ptr(instaca_f = test_get_argument(11))
583 || !TEST_ptr(ir_protected_0_extracerts = test_get_argument(12))
584 || !TEST_ptr(ir_protected_2_extracerts = test_get_argument(13))) {
585 TEST_error("usage: cmp_vfy_test server.crt client.crt "
586 "EndEntity1.crt EndEntity2.crt "
587 "Root_CA.crt Intermediate_CA.crt "
588 "CMP_IR_protected.der CMP_IR_unprotected.der "
589 "IP_waitingStatus_PBM.der IR_rmprotection.der "
590 "insta.cert.pem insta_ca.cert.pem "
591 "IR_protected_0_extraCerts.der "
592 "IR_protected_2_extraCerts.der\n");
596 /* Load certificates for cert chain */
597 if (!TEST_ptr(endentity1 = load_pem_cert(endentity1_f))
598 || !TEST_ptr(endentity2 = load_pem_cert(endentity2_f))
599 || !TEST_ptr(root = load_pem_cert(root_f))
600 || !TEST_ptr(intermediate = load_pem_cert(intermediate_f)))
603 if (!TEST_ptr(insta_cert = load_pem_cert(instacert_f))
604 || !TEST_ptr(instaca_cert = load_pem_cert(instaca_f)))
607 /* Load certificates for message validation */
608 if (!TEST_ptr(srvcert = load_pem_cert(server_f))
609 || !TEST_ptr(clcert = load_pem_cert(client_f)))
611 if (!TEST_int_eq(1, RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH)))
613 if (!TEST_ptr(ir_unprotected = load_pkimsg(ir_unprotected_f))
614 || !TEST_ptr(ir_rmprotection = load_pkimsg(ir_rmprotection_f)))
617 /* Message validation tests */
618 ADD_TEST(test_verify_popo);
619 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
620 ADD_TEST(test_verify_popo_bad);
622 ADD_TEST(test_validate_msg_signature_trusted_ok);
623 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
624 ADD_TEST(test_validate_msg_signature_trusted_expired);
626 ADD_TEST(test_validate_msg_signature_srvcert_wrong);
627 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
628 ADD_TEST(test_validate_msg_signature_bad);
630 ADD_TEST(test_validate_msg_signature_sender_cert_srvcert);
631 ADD_TEST(test_validate_msg_signature_sender_cert_untrusted);
632 ADD_TEST(test_validate_msg_signature_sender_cert_trusted);
633 ADD_TEST(test_validate_msg_signature_sender_cert_extracert);
634 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
635 ADD_TEST(test_validate_msg_signature_sender_cert_absent);
637 ADD_TEST(test_validate_msg_signature_expected_sender);
638 ADD_TEST(test_validate_msg_signature_unexpected_sender);
639 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
640 ADD_TEST(test_validate_msg_unprotected_request);
642 ADD_TEST(test_validate_msg_mac_alg_protection);
643 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
644 ADD_TEST(test_validate_msg_mac_alg_protection_bad);
647 /* Cert path validation tests */
648 ADD_TEST(test_validate_cert_path_ok);
649 ADD_TEST(test_validate_cert_path_expired);
650 ADD_TEST(test_validate_cert_path_wrong_anchor);
652 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
653 ADD_TEST(test_msg_check_no_protection_no_cb);
654 ADD_TEST(test_msg_check_no_protection_restrictive_cb);
656 ADD_TEST(test_msg_check_no_protection_permissive_cb);
657 ADD_TEST(test_msg_check_transaction_id);
658 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
659 ADD_TEST(test_msg_check_transaction_id_bad);
661 ADD_TEST(test_msg_check_recipient_nonce);
662 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
663 ADD_TEST(test_msg_check_recipient_nonce_bad);