test/crltest.c

   1 /*
   2  * Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include "internal/nelem.h"
  11 #include <string.h>
  12 #include <openssl/bio.h>
  13 #include <openssl/crypto.h>
  14 #include <openssl/err.h>
  15 #include <openssl/pem.h>
  16 #include <openssl/x509.h>
  17
  18 #include "testutil.h"
  19
  20 DEFINE_STACK_OF(X509)
  21 DEFINE_STACK_OF(X509_CRL)
  22
  23 #define PARAM_TIME 1474934400 /* Sep 27th, 2016 */
  24
  25 static const char *kCRLTestRoot[] = {
  26     "-----BEGIN CERTIFICATE-----\n",
  27     "MIIDbzCCAlegAwIBAgIJAODri7v0dDUFMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV\n",
  28     "BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW\n",
  29     "aWV3MRIwEAYDVQQKDAlCb3JpbmdTU0wwHhcNMTYwOTI2MTUwNjI2WhcNMjYwOTI0\n",
  30     "MTUwNjI2WjBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG\n",
  31     "A1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9yaW5nU1NMMIIBIjANBgkq\n",
  32     "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3B\n",
  33     "S/dUBpbrzd1aeFzNlI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+\n",
  34     "5R/Du0iCb1tCZIPY07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWp\n",
  35     "uRqO6rctN9qUoMlTIAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n\n",
  36     "8H922qmvPNA9idmX9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbL\n",
  37     "P2o9orxGx7aCtnnBZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABo1Aw\n",
  38     "TjAdBgNVHQ4EFgQUWPt3N5cZ/CRvubbrkqfBnAqhq94wHwYDVR0jBBgwFoAUWPt3\n",
  39     "N5cZ/CRvubbrkqfBnAqhq94wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n",
  40     "AQEAORu6M0MOwXy+3VEBwNilfTxyqDfruQsc1jA4PT8Oe8zora1WxE1JB4q2FJOz\n",
  41     "EAuM3H/NXvEnBuN+ITvKZAJUfm4NKX97qmjMJwLKWe1gVv+VQTr63aR7mgWJReQN\n",
  42     "XdMztlVeZs2dppV6uEg3ia1X0G7LARxGpA9ETbMyCpb39XxlYuTClcbA5ftDN99B\n",
  43     "3Xg9KNdd++Ew22O3HWRDvdDpTO/JkzQfzi3sYwUtzMEonENhczJhGf7bQMmvL/w5\n",
  44     "24Wxj4Z7KzzWIHsNqE/RIs6RV3fcW61j/mRgW2XyoWnMVeBzvcJr9NXp4VQYmFPw\n",
  45     "amd8GKMZQvP0ufGnUn7D7uartA==\n",
  46     "-----END CERTIFICATE-----\n",
  47     NULL
  48 };
  49
  50 static const char *kCRLTestLeaf[] = {
  51     "-----BEGIN CERTIFICATE-----\n",
  52     "MIIDkDCCAnigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCVVMx\n",
  53     "EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEjAQ\n",
  54     "BgNVBAoMCUJvcmluZ1NTTDAeFw0xNjA5MjYxNTA4MzFaFw0xNzA5MjYxNTA4MzFa\n",
  55     "MEsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQKDAlC\n",
  56     "b3JpbmdTU0wxEzARBgNVBAMMCmJvcmluZy5zc2wwggEiMA0GCSqGSIb3DQEBAQUA\n",
  57     "A4IBDwAwggEKAoIBAQDc5v1S1M0W+QWM+raWfO0LH8uvqEwuJQgODqMaGnSlWUx9\n",
  58     "8iQcnWfjyPja3lWg9K62hSOFDuSyEkysKHDxijz5R93CfLcfnVXjWQDJe7EJTTDP\n",
  59     "ozEvxN6RjAeYv7CF000euYr3QT5iyBjg76+bon1p0jHZBJeNPP1KqGYgyxp+hzpx\n",
  60     "e0gZmTlGAXd8JQK4v8kpdYwD6PPifFL/jpmQpqOtQmH/6zcLjY4ojmqpEdBqIKIX\n",
  61     "+saA29hMq0+NK3K+wgg31RU+cVWxu3tLOIiesETkeDgArjWRS1Vkzbi4v9SJxtNu\n",
  62     "OZuAxWiynRJw3JwH/OFHYZIvQqz68ZBoj96cepjPAgMBAAGjezB5MAkGA1UdEwQC\n",
  63     "MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl\n",
  64     "MB0GA1UdDgQWBBTGn0OVVh/aoYt0bvEKG+PIERqnDzAfBgNVHSMEGDAWgBRY+3c3\n",
  65     "lxn8JG+5tuuSp8GcCqGr3jANBgkqhkiG9w0BAQsFAAOCAQEAd2nM8gCQN2Dc8QJw\n",
  66     "XSZXyuI3DBGGCHcay/3iXu0JvTC3EiQo8J6Djv7WLI0N5KH8mkm40u89fJAB2lLZ\n",
  67     "ShuHVtcC182bOKnePgwp9CNwQ21p0rDEu/P3X46ZvFgdxx82E9xLa0tBB8PiPDWh\n",
  68     "lV16jbaKTgX5AZqjnsyjR5o9/mbZVupZJXx5Syq+XA8qiJfstSYJs4KyKK9UOjql\n",
  69     "ICkJVKpi2ahDBqX4MOH4SLfzVk8pqSpviS6yaA1RXqjpkxiN45WWaXDldVHMSkhC\n",
  70     "5CNXsXi4b1nAntu89crwSLA3rEwzCWeYj+BX7e1T9rr3oJdwOU/2KQtW1js1yQUG\n",
  71     "tjJMFw==\n",
  72     "-----END CERTIFICATE-----\n",
  73     NULL
  74 };
  75
  76 static const char *kBasicCRL[] = {
  77     "-----BEGIN X509 CRL-----\n",
  78     "MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
  79     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
  80     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV\n",
  81     "HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN\n",
  82     "ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo\n",
  83     "eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os\n",
  84     "dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv\n",
  85     "diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho\n",
  86     "/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==\n",
  87     "-----END X509 CRL-----\n",
  88     NULL
  89 };
  90
  91 static const char *kRevokedCRL[] = {
  92     "-----BEGIN X509 CRL-----\n",
  93     "MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
  94     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
  95     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX\n",
  96     "DTE2MDkyNjE1MTIyNlqgDjAMMAoGA1UdFAQDAgECMA0GCSqGSIb3DQEBCwUAA4IB\n",
  97     "AQCUGaM4DcWzlQKrcZvI8TMeR8BpsvQeo5BoI/XZu2a8h//PyRyMwYeaOM+3zl0d\n",
  98     "sjgCT8b3C1FPgT+P2Lkowv7rJ+FHJRNQkogr+RuqCSPTq65ha4WKlRGWkMFybzVH\n",
  99     "NloxC+aU3lgp/NlX9yUtfqYmJek1CDrOOGPrAEAwj1l/BUeYKNGqfBWYJQtPJu+5\n",
 100     "OaSvIYGpETCZJscUWODmLEb/O3DM438vLvxonwGqXqS0KX37+CHpUlyhnSovxXxp\n",
 101     "Pz4aF+L7OtczxL0GYtD2fR9B7TDMqsNmHXgQrixvvOY7MUdLGbd4RfJL3yA53hyO\n",
 102     "xzfKY2TzxLiOmctG0hXFkH5J\n",
 103     "-----END X509 CRL-----\n",
 104     NULL
 105 };
 106
 107 static const char *kBadIssuerCRL[] = {
 108     "-----BEGIN X509 CRL-----\n",
 109     "MIIBwjCBqwIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
 110     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEWMBQGA1UECgwN\n",
 111     "Tm90IEJvcmluZ1NTTBcNMTYwOTI2MTUxMjQ0WhcNMTYxMDI2MTUxMjQ0WjAVMBMC\n",
 112     "AhAAFw0xNjA5MjYxNTEyMjZaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsF\n",
 113     "AAOCAQEAlBmjOA3Fs5UCq3GbyPEzHkfAabL0HqOQaCP12btmvIf/z8kcjMGHmjjP\n",
 114     "t85dHbI4Ak/G9wtRT4E/j9i5KML+6yfhRyUTUJKIK/kbqgkj06uuYWuFipURlpDB\n",
 115     "cm81RzZaMQvmlN5YKfzZV/clLX6mJiXpNQg6zjhj6wBAMI9ZfwVHmCjRqnwVmCUL\n",
 116     "TybvuTmkryGBqREwmSbHFFjg5ixG/ztwzON/Ly78aJ8Bql6ktCl9+/gh6VJcoZ0q\n",
 117     "L8V8aT8+Ghfi+zrXM8S9BmLQ9n0fQe0wzKrDZh14EK4sb7zmOzFHSxm3eEXyS98g\n",
 118     "Od4cjsc3ymNk88S4jpnLRtIVxZB+SQ==\n",
 119     "-----END X509 CRL-----\n",
 120     NULL
 121 };
 122
 123 /*
 124  * This is kBasicCRL but with a critical issuing distribution point
 125  * extension.
 126  */
 127 static const char *kKnownCriticalCRL[] = {
 128     "-----BEGIN X509 CRL-----\n",
 129     "MIIBujCBowIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
 130     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
 131     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCEwHzAKBgNV\n",
 132     "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wDQYJKoZIhvcNAQELBQADggEBAA+3\n",
 133     "i+5e5Ub8sccfgOBs6WVJFI9c8gvJjrJ8/dYfFIAuCyeocs7DFXn1n13CRZ+URR/Q\n",
 134     "mVWgU28+xeusuSPYFpd9cyYTcVyNUGNTI3lwgcE/yVjPaOmzSZKdPakApRxtpKKQ\n",
 135     "NN/56aQz3bnT/ZSHQNciRB8U6jiD9V30t0w+FDTpGaG+7bzzUH3UVF9xf9Ctp60A\n",
 136     "3mfLe0scas7owSt4AEFuj2SPvcE7yvdOXbu+IEv21cEJUVExJAbhvIweHXh6yRW+\n",
 137     "7VVeiNzdIjkZjyTmAzoXGha4+wbxXyBRbfH+XWcO/H+8nwyG8Gktdu2QB9S9nnIp\n",
 138     "o/1TpfOMSGhMyMoyPrk=\n",
 139     "-----END X509 CRL-----\n",
 140     NULL
 141 };
 142
 143 /*
 144  * kUnknownCriticalCRL is kBasicCRL but with an unknown critical extension.
 145  */
 146 static const char *kUnknownCriticalCRL[] = {
 147     "-----BEGIN X509 CRL-----\n",
 148     "MIIBvDCBpQIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
 149     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
 150     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCMwITAKBgNV\n",
 151     "HRQEAwIBATATBgwqhkiG9xIEAYS3CQABAf8EADANBgkqhkiG9w0BAQsFAAOCAQEA\n",
 152     "GvBP0xqL509InMj/3493YVRV+ldTpBv5uTD6jewzf5XdaxEQ/VjTNe5zKnxbpAib\n",
 153     "Kf7cwX0PMSkZjx7k7kKdDlEucwVvDoqC+O9aJcqVmM6GDyNb9xENxd0XCXja6MZC\n",
 154     "yVgP4AwLauB2vSiEprYJyI1APph3iAEeDm60lTXX/wBM/tupQDDujKh2GPyvBRfJ\n",
 155     "+wEDwGg3ICwvu4gO4zeC5qnFR+bpL9t5tOMAQnVZ0NWv+k7mkd2LbHdD44dxrfXC\n",
 156     "nhtfERx99SDmC/jtUAJrGhtCO8acr7exCeYcduN7KKCm91OeCJKK6OzWst0Og1DB\n",
 157     "kwzzU2rL3G65CrZ7H0SZsQ==\n",
 158     "-----END X509 CRL-----\n",
 159     NULL
 160 };
 161
 162 /*
 163  * kUnknownCriticalCRL2 is kBasicCRL but with a critical issuing distribution
 164  * point extension followed by an unknown critical extension
 165  */
 166 static const char *kUnknownCriticalCRL2[] = {
 167     "-----BEGIN X509 CRL-----\n",
 168     "MIIBzzCBuAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
 169     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
 170     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoDYwNDAKBgNV\n",
 171     "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wEwYMKoZIhvcSBAGEtwkAAQH/BAAw\n",
 172     "DQYJKoZIhvcNAQELBQADggEBACTcpQC8jXL12JN5YzOcQ64ubQIe0XxRAd30p7qB\n",
 173     "BTXGpgqBjrjxRfLms7EBYodEXB2oXMsDq3km0vT1MfYdsDD05S+SQ9CDsq/pUfaC\n",
 174     "E2WNI5p8WircRnroYvbN2vkjlRbMd1+yNITohXYXCJwjEOAWOx3XIM10bwPYBv4R\n",
 175     "rDobuLHoMgL3yHgMHmAkP7YpkBucNqeBV8cCdeAZLuhXFWi6yfr3r/X18yWbC/r2\n",
 176     "2xXdkrSqXLFo7ToyP8YKTgiXpya4x6m53biEYwa2ULlas0igL6DK7wjYZX95Uy7H\n",
 177     "GKljn9weIYiMPV/BzGymwfv2EW0preLwtyJNJPaxbdin6Jc=\n",
 178     "-----END X509 CRL-----\n",
 179     NULL
 180 };
 181
 182 static const char **unknown_critical_crls[] = {
 183     kUnknownCriticalCRL, kUnknownCriticalCRL2
 184 };
 185
 186 static X509 *test_root = NULL;
 187 static X509 *test_leaf = NULL;
 188
 189 /*
 190  * Glue an array of strings together.  Return a BIO and put the string
 191  * into |*out| so we can free it.
 192  */
 193 static BIO *glue2bio(const char **pem, char **out)
 194 {
 195     size_t s = 0;
 196
 197     *out = glue_strings(pem, &s);
 198     return BIO_new_mem_buf(*out, s);
 199 }
 200
 201 /*
 202  * Create a CRL from an array of strings.
 203  */
 204 static X509_CRL *CRL_from_strings(const char **pem)
 205 {
 206     char *p;
 207     BIO *b = glue2bio(pem, &p);
 208     X509_CRL *crl = PEM_read_bio_X509_CRL(b, NULL, NULL, NULL);
 209
 210     OPENSSL_free(p);
 211     BIO_free(b);
 212     return crl;
 213 }
 214
 215 /*
 216  * Create an X509 from an array of strings.
 217  */
 218 static X509 *X509_from_strings(const char **pem)
 219 {
 220     char *p;
 221     BIO *b = glue2bio(pem, &p);
 222     X509 *x = PEM_read_bio_X509(b, NULL, NULL, NULL);
 223
 224     OPENSSL_free(p);
 225     BIO_free(b);
 226     return x;
 227 }
 228
 229 /*
 230  * Verify |leaf| certificate (chained up to |root|).  |crls| if
 231  * not NULL, is a list of CRLs to include in the verification. It is
 232  * also free'd before returning, which is kinda yucky but convenient.
 233  * Returns a value from X509_V_ERR_xxx or X509_V_OK.
 234  */
 235 static int verify(X509 *leaf, X509 *root, STACK_OF(X509_CRL) *crls,
 236                   unsigned long flags)
 237 {
 238     X509_STORE_CTX *ctx = X509_STORE_CTX_new();
 239     X509_STORE *store = X509_STORE_new();
 240     X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
 241     STACK_OF(X509) *roots = sk_X509_new_null();
 242     int status = X509_V_ERR_UNSPECIFIED;
 243
 244     if (!TEST_ptr(ctx)
 245         || !TEST_ptr(store)
 246         || !TEST_ptr(param)
 247         || !TEST_ptr(roots))
 248         goto err;
 249
 250     /* Create a stack; upref the cert because we free it below. */
 251     X509_up_ref(root);
 252     if (!TEST_true(sk_X509_push(roots, root))
 253         || !TEST_true(X509_STORE_CTX_init(ctx, store, leaf, NULL)))
 254         goto err;
 255     X509_STORE_CTX_set0_trusted_stack(ctx, roots);
 256     X509_STORE_CTX_set0_crls(ctx, crls);
 257     X509_VERIFY_PARAM_set_time(param, PARAM_TIME);
 258     if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param), PARAM_TIME))
 259         goto err;
 260     X509_VERIFY_PARAM_set_depth(param, 16);
 261     if (flags)
 262         X509_VERIFY_PARAM_set_flags(param, flags);
 263     X509_STORE_CTX_set0_param(ctx, param);
 264     param = NULL;
 265
 266     ERR_clear_error();
 267     status = X509_verify_cert(ctx) == 1 ? X509_V_OK
 268                                         : X509_STORE_CTX_get_error(ctx);
 269 err:
 270     sk_X509_pop_free(roots, X509_free);
 271     sk_X509_CRL_pop_free(crls, X509_CRL_free);
 272     X509_VERIFY_PARAM_free(param);
 273     X509_STORE_CTX_free(ctx);
 274     X509_STORE_free(store);
 275     return status;
 276 }
 277
 278 /*
 279  * Create a stack of CRL's.  Upref each one because we call pop_free on
 280  * the stack and need to keep the CRL's around until the test exits.
 281  * Yes this crashes on malloc failure; it forces us to debug.
 282  */
 283 static STACK_OF(X509_CRL) *make_CRL_stack(X509_CRL *x1, X509_CRL *x2)
 284 {
 285     STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null();
 286
 287     sk_X509_CRL_push(sk, x1);
 288     X509_CRL_up_ref(x1);
 289     if (x2 != NULL) {
 290         sk_X509_CRL_push(sk, x2);
 291         X509_CRL_up_ref(x2);
 292     }
 293     return sk;
 294 }
 295
 296 static int test_basic_crl(void)
 297 {
 298     X509_CRL *basic_crl = CRL_from_strings(kBasicCRL);
 299     X509_CRL *revoked_crl = CRL_from_strings(kRevokedCRL);
 300     int r;
 301
 302     r = TEST_ptr(basic_crl)
 303         && TEST_ptr(revoked_crl)
 304         && TEST_int_eq(verify(test_leaf, test_root,
 305                               make_CRL_stack(basic_crl, NULL),
 306                               X509_V_FLAG_CRL_CHECK), X509_V_OK)
 307         && TEST_int_eq(verify(test_leaf, test_root,
 308                               make_CRL_stack(basic_crl, revoked_crl),
 309                               X509_V_FLAG_CRL_CHECK), X509_V_ERR_CERT_REVOKED);
 310     X509_CRL_free(basic_crl);
 311     X509_CRL_free(revoked_crl);
 312     return r;
 313 }
 314
 315 static int test_no_crl(void)
 316 {
 317     return TEST_int_eq(verify(test_leaf, test_root, NULL,
 318                               X509_V_FLAG_CRL_CHECK),
 319                        X509_V_ERR_UNABLE_TO_GET_CRL);
 320 }
 321
 322 static int test_bad_issuer_crl(void)
 323 {
 324     X509_CRL *bad_issuer_crl = CRL_from_strings(kBadIssuerCRL);
 325     int r;
 326
 327     r = TEST_ptr(bad_issuer_crl)
 328         && TEST_int_eq(verify(test_leaf, test_root,
 329                               make_CRL_stack(bad_issuer_crl, NULL),
 330                               X509_V_FLAG_CRL_CHECK),
 331                        X509_V_ERR_UNABLE_TO_GET_CRL);
 332     X509_CRL_free(bad_issuer_crl);
 333     return r;
 334 }
 335
 336 static int test_known_critical_crl(void)
 337 {
 338     X509_CRL *known_critical_crl = CRL_from_strings(kKnownCriticalCRL);
 339     int r;
 340
 341     r = TEST_ptr(known_critical_crl)
 342         && TEST_int_eq(verify(test_leaf, test_root,
 343                               make_CRL_stack(known_critical_crl, NULL),
 344                               X509_V_FLAG_CRL_CHECK), X509_V_OK);
 345     X509_CRL_free(known_critical_crl);
 346     return r;
 347 }
 348
 349 static int test_unknown_critical_crl(int n)
 350 {
 351     X509_CRL *unknown_critical_crl = CRL_from_strings(unknown_critical_crls[n]);
 352     int r;
 353
 354     r = TEST_ptr(unknown_critical_crl)
 355         && TEST_int_eq(verify(test_leaf, test_root,
 356                               make_CRL_stack(unknown_critical_crl, NULL),
 357                               X509_V_FLAG_CRL_CHECK),
 358                        X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION);
 359     X509_CRL_free(unknown_critical_crl);
 360     return r;
 361 }
 362
 363 static int test_reuse_crl(void)
 364 {
 365     X509_CRL *reused_crl = CRL_from_strings(kBasicCRL);
 366     char *p;
 367     BIO *b = glue2bio(kRevokedCRL, &p);
 368
 369     reused_crl = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL);
 370
 371     OPENSSL_free(p);
 372     BIO_free(b);
 373     X509_CRL_free(reused_crl);
 374     return 1;
 375 }
 376
 377 int setup_tests(void)
 378 {
 379     if (!TEST_ptr(test_root = X509_from_strings(kCRLTestRoot))
 380         || !TEST_ptr(test_leaf = X509_from_strings(kCRLTestLeaf)))
 381         return 0;
 382
 383     ADD_TEST(test_no_crl);
 384     ADD_TEST(test_basic_crl);
 385     ADD_TEST(test_bad_issuer_crl);
 386     ADD_TEST(test_known_critical_crl);
 387     ADD_ALL_TESTS(test_unknown_critical_crl, OSSL_NELEM(unknown_critical_crls));
 388     ADD_TEST(test_reuse_crl);
 389     return 1;
 390 }
 391
 392 void cleanup_tests(void)
 393 {
 394     X509_free(test_root);
 395     X509_free(test_leaf);
 396 }