Stop accepting certificates signed using SHA1 at security level 1

[openssl.git] / test / recipes / 25-test_verify.t

diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index 5cc5ce8b2ea4620a3d90799e8d03cdc128f77d60..219e7e1149a63d477b8b67a0fb0ee4d9e4a9fb04 100644 (file)
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -1,7 +1,7 @@
 #! /usr/bin/env perl
-# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
 #
-# Licensed under the OpenSSL license (the "License").  You may not use
+# Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html
@@ -11,7 +11,8 @@ use strict;
 use warnings;
 
 use File::Spec::Functions qw/canonpath/;
-use OpenSSL::Test qw/:DEFAULT srctop_file/;
+use OpenSSL::Test qw/:DEFAULT srctop_file ok_nofips/;
+use OpenSSL::Test::Utils;
 
 setup("test_verify");
 
@@ -26,7 +27,7 @@ sub verify {
     run(app([@args]));
 }
 
-plan tests => 108;
+plan tests => 137;
 
 # Canonical success
 ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
@@ -287,3 +288,100 @@ ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth",
    "accept chain with verify_depth 0");
 ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
    "accept md5 intermediate TA with verify_depth 0");
+
+# Name Constraints tests.
+
+ok(verify("alt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints everything permitted");
+
+ok(verify("alt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
+   "Name Constraints nothing excluded");
+
+ok(verify("alt3-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+   "Name Constraints nested test all permitted");
+
+ok(verify("goodcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints CNs permitted");
+
+ok(!verify("badcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints CNs not permitted");
+
+ok(!verify("badalt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints hostname not permitted");
+
+ok(!verify("badalt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
+   "Name Constraints hostname excluded");
+
+ok(!verify("badalt3-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints email address not permitted");
+
+ok(!verify("badalt4-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints subject email address not permitted");
+
+ok(!verify("badalt5-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints IP address not permitted");
+
+ok(!verify("badalt6-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints CN hostname not permitted");
+
+ok(!verify("badalt7-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
+   "Name Constraints CN BMPSTRING hostname not permitted");
+
+ok(!verify("badalt8-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+   "Name constraints nested DNS name not permitted 1");
+
+ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+   "Name constraints nested DNS name not permitted 2");
+
+ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
+   "Name constraints nested DNS name excluded");
+
+ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
+    "Accept PSS signature using SHA1 at auth level 0");
+
+ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
+    "CA with PSS signature using SHA256");
+
+ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
+    "Reject PSS signature using SHA1 and auth level 1");
+
+ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
+    "PSS signature using SHA256 and auth level 2");
+
+ok(!verify("many-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
+    "Too many names and constraints to check (1)");
+ok(!verify("many-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+    "Too many names and constraints to check (2)");
+ok(!verify("many-names3", "sslserver", ["many-constraints"], ["many-constraints"], ),
+    "Too many names and constraints to check (3)");
+
+ok(verify("some-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
+    "Not too many names and constraints to check (1)");
+ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+    "Not too many names and constraints to check (2)");
+ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
+    "Not too many names and constraints to check (3)");
+ok(verify("root-cert-rsa2", "sslserver", ["root-cert-rsa2"], [], "-check_ss_sig"),
+    "Public Key Algorithm rsa instead of rsaEncryption");
+
+SKIP: {
+    skip "Ed25519 is not supported by this OpenSSL build", 1
+             if disabled("ec");
+
+    # ED25519 certificate from draft-ietf-curdle-pkix-04
+    ok(verify("ee-ed25519", "sslserver", ["root-ed25519"], []),
+       "ED25519 signature");
+
+}
+
+SKIP: {
+    skip "SM2 is not supported by this OpenSSL build", 2
+             if disabled("sm2");
+
+   # Test '-sm2-id' and '-sm2-hex-id'  option
+   ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-sm2-id", "1234567812345678"),
+       "SM2 ID test");
+   ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-sm2-hex-id",
+             "31323334353637383132333435363738"),
+       "SM2 hex ID test");
+}