test/cmp_protect_test.c

   1 /*
   2  * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright Nokia 2007-2019
   4  * Copyright Siemens AG 2015-2019
   5  *
   6  * Licensed under the Apache License 2.0 (the "License").  You may not use
   7  * this file except in compliance with the License.  You can obtain a copy
   8  * in the file LICENSE in the source distribution or at
   9  * https://www.openssl.org/source/license.html
  10  */
  11
  12 #include "cmp_testlib.h"
  13
  14 DEFINE_STACK_OF(X509)
  15
  16 static const char *ir_protected_f;
  17 static const char *ir_unprotected_f;
  18 static const char *ip_PBM_f;
  19
  20 typedef struct test_fixture {
  21     const char *test_case_name;
  22     OSSL_CMP_CTX *cmp_ctx;
  23     /* for protection tests */
  24     OSSL_CMP_MSG *msg;
  25     OSSL_CMP_PKISI *si; /* for error and response messages */
  26     EVP_PKEY *pubkey;
  27     unsigned char *mem;
  28     int memlen;
  29     X509 *cert;
  30     STACK_OF(X509) *certs;
  31     STACK_OF(X509) *chain;
  32     int callback_arg;
  33     int expected;
  34 } CMP_PROTECT_TEST_FIXTURE;
  35
  36 static void tear_down(CMP_PROTECT_TEST_FIXTURE *fixture)
  37 {
  38     OSSL_CMP_CTX_free(fixture->cmp_ctx);
  39     OSSL_CMP_MSG_free(fixture->msg);
  40     OSSL_CMP_PKISI_free(fixture->si);
  41
  42     OPENSSL_free(fixture->mem);
  43     sk_X509_free(fixture->certs);
  44     sk_X509_free(fixture->chain);
  45
  46     OPENSSL_free(fixture);
  47 }
  48
  49 static CMP_PROTECT_TEST_FIXTURE *set_up(const char *const test_case_name)
  50 {
  51     CMP_PROTECT_TEST_FIXTURE *fixture;
  52
  53     if (!TEST_ptr(fixture = OPENSSL_zalloc(sizeof(*fixture))))
  54         return NULL;
  55     fixture->test_case_name = test_case_name;
  56     if (!TEST_ptr(fixture->cmp_ctx = OSSL_CMP_CTX_new(NULL, NULL))) {
  57         tear_down(fixture);
  58         return NULL;
  59     }
  60     return fixture;
  61 }
  62
  63 static EVP_PKEY *loadedprivkey = NULL;
  64 static EVP_PKEY *loadedpubkey = NULL;
  65 static EVP_PKEY *loadedkey = NULL;
  66 static X509 *cert = NULL;
  67 static unsigned char rand_data[OSSL_CMP_TRANSACTIONID_LENGTH];
  68 static OSSL_CMP_MSG *ir_unprotected, *ir_protected;
  69 static X509 *endentity1 = NULL, *endentity2 = NULL,
  70     *root = NULL, *intermediate = NULL;
  71
  72 static int execute_calc_protection_fails_test(CMP_PROTECT_TEST_FIXTURE *fixture)
  73 {
  74     ASN1_BIT_STRING *protection =
  75         ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
  76     int res = TEST_ptr_null(protection);
  77
  78     ASN1_BIT_STRING_free(protection);
  79     return res;
  80 }
  81
  82 static int execute_calc_protection_pbmac_test(CMP_PROTECT_TEST_FIXTURE *fixture)
  83 {
  84     ASN1_BIT_STRING *protection =
  85         ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
  86     int res = TEST_ptr(protection)
  87             && TEST_true(ASN1_STRING_cmp(protection,
  88                                          fixture->msg->protection) == 0);
  89
  90     ASN1_BIT_STRING_free(protection);
  91     return res;
  92 }
  93
  94 /*
  95  * This function works similarly to parts of CMP_verify_signature in cmp_vfy.c,
  96  * but without the need for a OSSL_CMP_CTX or a X509 certificate
  97  */
  98 static int verify_signature(OSSL_CMP_MSG *msg,
  99                             ASN1_BIT_STRING *protection,
 100                             EVP_PKEY *pkey, EVP_MD *digest)
 101 {
 102     OSSL_CMP_PROTECTEDPART prot_part;
 103     unsigned char *prot_part_der = NULL;
 104     int len;
 105     EVP_MD_CTX *ctx = NULL;
 106     int res;
 107
 108     prot_part.header = OSSL_CMP_MSG_get0_header(msg);
 109     prot_part.body = msg->body;
 110     len = i2d_OSSL_CMP_PROTECTEDPART(&prot_part, &prot_part_der);
 111     res =
 112         TEST_int_ge(len, 0)
 113         && TEST_ptr(ctx = EVP_MD_CTX_new())
 114         && TEST_true(EVP_DigestVerifyInit(ctx, NULL, digest, NULL, pkey))
 115         && TEST_int_eq(EVP_DigestVerify(ctx, protection->data,
 116                                         protection->length,
 117                                         prot_part_der, len), 1);
 118     /* cleanup */
 119     EVP_MD_CTX_free(ctx);
 120     OPENSSL_free(prot_part_der);
 121     return res;
 122 }
 123
 124 /* Calls OSSL_CMP_calc_protection and compares and verifies signature */
 125 static int execute_calc_protection_signature_test(CMP_PROTECT_TEST_FIXTURE *
 126                                                   fixture)
 127 {
 128     ASN1_BIT_STRING *protection =
 129         ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
 130     int ret = (TEST_ptr(protection)
 131                    && TEST_true(ASN1_STRING_cmp(protection,
 132                                                 fixture->msg->protection) == 0)
 133                    && TEST_true(verify_signature(fixture->msg, protection,
 134                                                  fixture->pubkey,
 135                                                  fixture->cmp_ctx->digest)));
 136
 137     ASN1_BIT_STRING_free(protection);
 138     return ret;
 139 }
 140
 141 static int test_cmp_calc_protection_no_key_no_secret(void)
 142 {
 143     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 144     if (!TEST_ptr(fixture->msg = load_pkimsg(ir_unprotected_f))
 145             || !TEST_ptr(fixture->msg->header->protectionAlg =
 146                          X509_ALGOR_new() /* no specific alg needed here */)) {
 147         tear_down(fixture);
 148         fixture = NULL;
 149     }
 150
 151     EXECUTE_TEST(execute_calc_protection_fails_test, tear_down);
 152     return result;
 153 }
 154
 155 static int test_cmp_calc_protection_pkey(void)
 156 {
 157     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 158     fixture->pubkey = loadedpubkey;
 159     if (!TEST_true(OSSL_CMP_CTX_set1_pkey(fixture->cmp_ctx, loadedprivkey))
 160             || !TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f))) {
 161         tear_down(fixture);
 162         fixture = NULL;
 163     }
 164     EXECUTE_TEST(execute_calc_protection_signature_test, tear_down);
 165     return result;
 166 }
 167
 168 static int test_cmp_calc_protection_pbmac(void)
 169 {
 170     unsigned char sec_insta[] = { 'i', 'n', 's', 't', 'a' };
 171
 172     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 173     if (!TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
 174                                                  sec_insta, sizeof(sec_insta)))
 175             || !TEST_ptr(fixture->msg = load_pkimsg(ip_PBM_f))) {
 176         tear_down(fixture);
 177         fixture = NULL;
 178     }
 179     EXECUTE_TEST(execute_calc_protection_pbmac_test, tear_down);
 180     return result;
 181 }
 182 static int execute_MSG_protect_test(CMP_PROTECT_TEST_FIXTURE *fixture)
 183 {
 184     return TEST_int_eq(fixture->expected,
 185                        ossl_cmp_msg_protect(fixture->cmp_ctx, fixture->msg));
 186 }
 187
 188 #define SET_OPT_UNPROTECTED_SEND(ctx, val) \
 189     OSSL_CMP_CTX_set_option((ctx), OSSL_CMP_OPT_UNPROTECTED_SEND, (val))
 190 static int test_MSG_protect_unprotected_request(void)
 191 {
 192     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 193
 194     fixture->expected = 1;
 195     if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
 196             || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 1))) {
 197         tear_down(fixture);
 198         fixture = NULL;
 199     }
 200     EXECUTE_TEST(execute_MSG_protect_test, tear_down);
 201     return result;
 202 }
 203
 204 static int test_MSG_protect_with_msg_sig_alg_protection_plus_rsa_key(void)
 205 {
 206     const size_t size = sizeof(rand_data) / 2;
 207
 208     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 209     fixture->expected = 1;
 210
 211     if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
 212             || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))
 213             /*
 214              * Use half of the 16 bytes of random input
 215              * for each reference and secret value
 216              */
 217             || !TEST_true(OSSL_CMP_CTX_set1_referenceValue(fixture->cmp_ctx,
 218                                                            rand_data, size))
 219             || !TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
 220                                                         rand_data + size,
 221                                                         size))) {
 222         tear_down(fixture);
 223         fixture = NULL;
 224     }
 225     EXECUTE_TEST(execute_MSG_protect_test, tear_down);
 226     return result;
 227 }
 228
 229 static int test_MSG_protect_with_certificate_and_key(void)
 230 {
 231     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 232     fixture->expected = 1;
 233
 234     if (!TEST_ptr(fixture->msg =
 235                   OSSL_CMP_MSG_dup(ir_unprotected))
 236             || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))
 237             || !TEST_true(OSSL_CMP_CTX_set1_pkey(fixture->cmp_ctx, loadedkey))
 238             || !TEST_true(OSSL_CMP_CTX_set1_cert(fixture->cmp_ctx, cert))) {
 239         tear_down(fixture);
 240         fixture = NULL;
 241     }
 242     EXECUTE_TEST(execute_MSG_protect_test, tear_down);
 243     return result;
 244 }
 245
 246 static int test_MSG_protect_certificate_based_without_cert(void)
 247 {
 248     OSSL_CMP_CTX *ctx;
 249
 250     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 251     ctx = fixture->cmp_ctx;
 252     fixture->expected = 0;
 253     if (!TEST_ptr(fixture->msg =
 254                   OSSL_CMP_MSG_dup(ir_unprotected))
 255             || !TEST_true(SET_OPT_UNPROTECTED_SEND(ctx, 0))
 256             || !TEST_true(OSSL_CMP_CTX_set0_newPkey(ctx, 1, loadedkey))) {
 257         tear_down(fixture);
 258         fixture = NULL;
 259     }
 260     EVP_PKEY_up_ref(loadedkey);
 261     EXECUTE_TEST(execute_MSG_protect_test, tear_down);
 262     return result;
 263 }
 264
 265 static int test_MSG_protect_no_key_no_secret(void)
 266 {
 267     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 268     fixture->expected = 0;
 269     if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
 270             || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))) {
 271         tear_down(fixture);
 272         fixture = NULL;
 273     }
 274     EXECUTE_TEST(execute_MSG_protect_test, tear_down);
 275     return result;
 276 }
 277
 278 static int test_MSG_protect_pbmac_no_sender(int with_ref)
 279 {
 280     static unsigned char secret[] = { 47, 11, 8, 15 };
 281     static unsigned char ref[] = { 0xca, 0xfe, 0xba, 0xbe };
 282
 283     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 284     fixture->expected = with_ref;
 285     if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
 286             || !SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0)
 287             || !ossl_cmp_hdr_set1_sender(fixture->msg->header, NULL)
 288             || !OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
 289                                               secret, sizeof(secret))
 290             || (!OSSL_CMP_CTX_set1_referenceValue(fixture->cmp_ctx,
 291                                                   with_ref ? ref : NULL,
 292                                                   sizeof(ref)))) {
 293         tear_down(fixture);
 294         fixture = NULL;
 295     }
 296     EXECUTE_TEST(execute_MSG_protect_test, tear_down);
 297     return result;
 298 }
 299
 300 static int test_MSG_protect_pbmac_no_sender_with_ref(void)
 301 {
 302     return test_MSG_protect_pbmac_no_sender(1);
 303 }
 304
 305 static int test_MSG_protect_pbmac_no_sender_no_ref(void)
 306 {
 307     return test_MSG_protect_pbmac_no_sender(0);
 308 }
 309
 310 static int execute_MSG_add_extraCerts_test(CMP_PROTECT_TEST_FIXTURE *fixture)
 311 {
 312     return TEST_true(ossl_cmp_msg_add_extraCerts(fixture->cmp_ctx,
 313                                                  fixture->msg));
 314 }
 315
 316 static int test_MSG_add_extraCerts(void)
 317 {
 318     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 319     if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_protected))) {
 320         tear_down(fixture);
 321         fixture = NULL;
 322     }
 323     EXECUTE_TEST(execute_MSG_add_extraCerts_test, tear_down);
 324     return result;
 325 }
 326
 327 #ifndef OPENSSL_NO_EC
 328 /* The cert chain tests use EC certs so we skip them in no-ec builds */
 329 static int execute_cmp_build_cert_chain_test(CMP_PROTECT_TEST_FIXTURE *fixture)
 330 {
 331     int ret = 0;
 332     OSSL_CMP_CTX *ctx = fixture->cmp_ctx;
 333     STACK_OF(X509) *chain =
 334         ossl_cmp_build_cert_chain(ctx->libctx, ctx->propq,
 335                                   fixture->certs, fixture->cert);
 336
 337     if (TEST_ptr(chain)) {
 338         /* Check whether chain built is equal to the expected one */
 339         ret = TEST_int_eq(0, STACK_OF_X509_cmp(chain, fixture->chain));
 340         sk_X509_pop_free(chain, X509_free);
 341     }
 342     return ret;
 343 }
 344
 345 static int test_cmp_build_cert_chain(void)
 346 {
 347     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 348     fixture->cert = endentity2;
 349     if (!TEST_ptr(fixture->certs = sk_X509_new_null())
 350             || !TEST_ptr(fixture->chain = sk_X509_new_null())
 351             || !TEST_true(sk_X509_push(fixture->certs, endentity1))
 352             || !TEST_true(sk_X509_push(fixture->certs, root))
 353             || !TEST_true(sk_X509_push(fixture->certs, intermediate))
 354             || !TEST_true(sk_X509_push(fixture->chain, endentity2))
 355             || !TEST_true(sk_X509_push(fixture->chain, intermediate))) {
 356         tear_down(fixture);
 357         fixture = NULL;
 358     }
 359     EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
 360     return result;
 361 }
 362
 363 static int test_cmp_build_cert_chain_missing_intermediate(void)
 364 {
 365     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 366     fixture->cert = endentity2;
 367     if (!TEST_ptr(fixture->certs = sk_X509_new_null())
 368             || !TEST_ptr(fixture->chain = sk_X509_new_null())
 369             || !TEST_true(sk_X509_push(fixture->certs, endentity1))
 370             || !TEST_true(sk_X509_push(fixture->certs, root))
 371             || !TEST_true(sk_X509_push(fixture->chain, endentity2))) {
 372         tear_down(fixture);
 373         fixture = NULL;
 374     }
 375     EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
 376     return result;
 377 }
 378
 379 static int test_cmp_build_cert_chain_missing_root(void)
 380 {
 381     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 382     fixture->cert = endentity2;
 383     if (!TEST_ptr(fixture->certs = sk_X509_new_null())
 384             || !TEST_ptr(fixture->chain = sk_X509_new_null())
 385             || !TEST_true(sk_X509_push(fixture->certs, endentity1))
 386             || !TEST_true(sk_X509_push(fixture->certs, intermediate))
 387             || !TEST_true(sk_X509_push(fixture->chain, endentity2))
 388             || !TEST_true(sk_X509_push(fixture->chain, intermediate))) {
 389         tear_down(fixture);
 390         fixture = NULL;
 391     }
 392     EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
 393     return result;
 394 }
 395
 396 static int test_cmp_build_cert_chain_no_certs(void)
 397 {
 398     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 399     fixture->cert = endentity2;
 400     if (!TEST_ptr(fixture->certs = sk_X509_new_null())
 401             || !TEST_ptr(fixture->chain = sk_X509_new_null())
 402             || !TEST_true(sk_X509_push(fixture->chain, endentity2))) {
 403         tear_down(fixture);
 404         fixture = NULL;
 405     }
 406     EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
 407     return result;
 408 }
 409 #endif /* OPENSSL_NO_EC */
 410
 411 static int execute_X509_STORE_test(CMP_PROTECT_TEST_FIXTURE *fixture)
 412 {
 413     X509_STORE *store = X509_STORE_new();
 414     STACK_OF(X509) *sk = NULL;
 415     int res = 0;
 416
 417     if (!TEST_true(ossl_cmp_X509_STORE_add1_certs(store,
 418                                                   fixture->certs,
 419                                                   fixture->callback_arg)))
 420         goto err;
 421     sk = X509_STORE_get1_all_certs(store);
 422     if (!TEST_int_eq(0, STACK_OF_X509_cmp(sk, fixture->chain)))
 423         goto err;
 424     res = 1;
 425  err:
 426     X509_STORE_free(store);
 427     sk_X509_pop_free(sk, X509_free);
 428     return res;
 429
 430 }
 431
 432 static int test_X509_STORE(void)
 433 {
 434     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 435     fixture->callback_arg = 0; /* self-issued allowed */
 436     if (!TEST_ptr(fixture->certs = sk_X509_new_null())
 437             || !sk_X509_push(fixture->certs, endentity1)
 438             || !sk_X509_push(fixture->certs, endentity2)
 439             || !sk_X509_push(fixture->certs, root)
 440             || !sk_X509_push(fixture->certs, intermediate)
 441             || !TEST_ptr(fixture->chain = sk_X509_dup(fixture->certs))) {
 442         tear_down(fixture);
 443         fixture = NULL;
 444     }
 445     EXECUTE_TEST(execute_X509_STORE_test, tear_down);
 446     return result;
 447 }
 448
 449 static int test_X509_STORE_only_self_issued(void)
 450 {
 451     SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
 452     fixture->certs = sk_X509_new_null();
 453     fixture->chain = sk_X509_new_null();
 454     fixture->callback_arg = 1; /* only self-issued */
 455     if (!TEST_true(sk_X509_push(fixture->certs, endentity1))
 456             || !TEST_true(sk_X509_push(fixture->certs, endentity2))
 457             || !TEST_true(sk_X509_push(fixture->certs, root))
 458             || !TEST_true(sk_X509_push(fixture->certs, intermediate))
 459             || !TEST_true(sk_X509_push(fixture->chain, root))) {
 460         tear_down(fixture);
 461         fixture = NULL;
 462     }
 463     EXECUTE_TEST(execute_X509_STORE_test, tear_down);
 464     return result;
 465 }
 466
 467
 468 void cleanup_tests(void)
 469 {
 470     EVP_PKEY_free(loadedprivkey);
 471     EVP_PKEY_free(loadedpubkey);
 472     EVP_PKEY_free(loadedkey);
 473     X509_free(cert);
 474     X509_free(endentity1);
 475     X509_free(endentity2);
 476     X509_free(root);
 477     X509_free(intermediate);
 478     OSSL_CMP_MSG_free(ir_protected);
 479     OSSL_CMP_MSG_free(ir_unprotected);
 480
 481 }
 482
 483 int setup_tests(void)
 484 {
 485     char *server_f;
 486     char *server_key_f;
 487     char *server_cert_f;
 488     char *endentity1_f;
 489     char *endentity2_f;
 490     char *root_f;
 491     char *intermediate_f;
 492
 493     if (!test_skip_common_options()) {
 494         TEST_error("Error parsing test options\n");
 495         return 0;
 496     }
 497
 498     RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH);
 499     if (!TEST_ptr(server_f = test_get_argument(0))
 500             || !TEST_ptr(ir_protected_f = test_get_argument(1))
 501             || !TEST_ptr(ir_unprotected_f = test_get_argument(2))
 502             || !TEST_ptr(ip_PBM_f = test_get_argument(3))
 503             || !TEST_ptr(server_cert_f = test_get_argument(4))
 504             || !TEST_ptr(server_key_f = test_get_argument(5))
 505             || !TEST_ptr(endentity1_f = test_get_argument(6))
 506             || !TEST_ptr(endentity2_f = test_get_argument(7))
 507             || !TEST_ptr(root_f = test_get_argument(8))
 508             || !TEST_ptr(intermediate_f = test_get_argument(9))) {
 509         TEST_error("usage: cmp_protect_test server.pem "
 510                    "IR_protected.der IR_unprotected.der IP_PBM.der "
 511                    "server.crt server.pem"
 512                    "EndEntity1.crt EndEntity2.crt "
 513                    "Root_CA.crt Intermediate_CA.crt\n");
 514         return 0;
 515     }
 516     if (!TEST_ptr(loadedkey = load_pem_key(server_key_f))
 517             || !TEST_ptr(cert = load_pem_cert(server_cert_f, NULL)))
 518         return 0;
 519
 520     if (!TEST_ptr(loadedprivkey = load_pem_key(server_f)))
 521         return 0;
 522     if (TEST_true(EVP_PKEY_up_ref(loadedprivkey)))
 523         loadedpubkey = loadedprivkey;
 524     if (!TEST_ptr(ir_protected = load_pkimsg(ir_protected_f))
 525             || !TEST_ptr(ir_unprotected = load_pkimsg(ir_unprotected_f)))
 526         return 0;
 527     if (!TEST_ptr(endentity1 = load_pem_cert(endentity1_f, NULL))
 528             || !TEST_ptr(endentity2 = load_pem_cert(endentity2_f, NULL))
 529             || !TEST_ptr(root = load_pem_cert(root_f, NULL))
 530             || !TEST_ptr(intermediate = load_pem_cert(intermediate_f, NULL)))
 531         return 0;
 532     if (!TEST_int_eq(1, RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH)))
 533         return 0;
 534
 535     /* Message protection tests */
 536     ADD_TEST(test_cmp_calc_protection_no_key_no_secret);
 537     ADD_TEST(test_cmp_calc_protection_pkey);
 538     ADD_TEST(test_cmp_calc_protection_pbmac);
 539
 540     ADD_TEST(test_MSG_protect_with_msg_sig_alg_protection_plus_rsa_key);
 541     ADD_TEST(test_MSG_protect_with_certificate_and_key);
 542     ADD_TEST(test_MSG_protect_certificate_based_without_cert);
 543     ADD_TEST(test_MSG_protect_unprotected_request);
 544     ADD_TEST(test_MSG_protect_no_key_no_secret);
 545     ADD_TEST(test_MSG_protect_pbmac_no_sender_with_ref);
 546     ADD_TEST(test_MSG_protect_pbmac_no_sender_no_ref);
 547     ADD_TEST(test_MSG_add_extraCerts);
 548
 549 #ifndef OPENSSL_NO_EC
 550     ADD_TEST(test_cmp_build_cert_chain);
 551     ADD_TEST(test_cmp_build_cert_chain_missing_root);
 552     ADD_TEST(test_cmp_build_cert_chain_missing_intermediate);
 553     ADD_TEST(test_cmp_build_cert_chain_no_certs);
 554 #endif
 555
 556     ADD_TEST(test_X509_STORE);
 557     ADD_TEST(test_X509_STORE_only_self_issued);
 558
 559     return 1;
 560 }