X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=test%2Fcmp_client_test.c;h=d305eb561007b7fd6f1122dcfc45bf659d7d6fe6;hp=35a7c30f927adb94283920ba22e6fc2546778017;hb=HEAD;hpb=4333b89f504e7a8de9c42a0d27f68530b5301848

diff --git a/test/cmp_client_test.c b/test/cmp_client_test.c
index 35a7c30f92..208e0a1767 100644
--- a/test/cmp_client_test.c
+++ b/test/cmp_client_test.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright Nokia 2007-2019
  * Copyright Siemens AG 2015-2019
  *
@@ -11,9 +11,7 @@
 
 #include "helpers/cmp_testlib.h"
 
-#include "apps/cmp_mock_srv.h"
-
-#ifndef NDEBUG /* tests need mock server, which is available only if !NDEBUG */
+#include "cmp_mock_srv.h"
 
 static const char *server_key_f;
 static const char *server_cert_f;
@@ -64,6 +62,7 @@ static CMP_SES_TEST_FIXTURE *set_up(const char *const test_case_name)
     fixture->test_case_name = test_case_name;
     if (!TEST_ptr(fixture->srv_ctx = ossl_cmp_mock_srv_new(libctx, NULL))
             || !OSSL_CMP_SRV_CTX_set_accept_unprotected(fixture->srv_ctx, 1)
+            || !ossl_cmp_mock_srv_set1_refCert(fixture->srv_ctx, client_cert)
             || !ossl_cmp_mock_srv_set1_certOut(fixture->srv_ctx, client_cert)
             || (srv_cmp_ctx =
                 OSSL_CMP_SRV_CTX_get0_cmp_ctx(fixture->srv_ctx)) == NULL
@@ -78,6 +77,7 @@ static CMP_SES_TEST_FIXTURE *set_up(const char *const test_case_name)
             || !OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS, 1)
             || !OSSL_CMP_CTX_set1_oldCert(ctx, client_cert)
             || !OSSL_CMP_CTX_set1_pkey(ctx, client_key)
+            /* client_key is by default used also for newPkey */
             || !OSSL_CMP_CTX_set1_srvCert(ctx, server_cert)
             || !OSSL_CMP_CTX_set1_referenceValue(ctx, ref, sizeof(ref)))
         goto err;
@@ -89,51 +89,85 @@ static CMP_SES_TEST_FIXTURE *set_up(const char *const test_case_name)
     return NULL;
 }
 
-static int execute_exec_RR_ses_test(CMP_SES_TEST_FIXTURE *fixture)
+static int execute_exec_RR_ses_test(CMP_SES_TEST_FIXTURE *fixt)
 {
-    return TEST_int_eq(fixture->expected,
-                       OSSL_CMP_exec_RR_ses(fixture->cmp_ctx) == 1);
+    return TEST_int_eq(OSSL_CMP_CTX_get_status(fixt->cmp_ctx),
+                       OSSL_CMP_PKISTATUS_unspecified)
+        && TEST_int_eq(OSSL_CMP_exec_RR_ses(fixt->cmp_ctx),
+                       fixt->expected == OSSL_CMP_PKISTATUS_accepted)
+        && TEST_int_eq(OSSL_CMP_CTX_get_status(fixt->cmp_ctx), fixt->expected);
 }
 
-static int execute_exec_GENM_ses_test(CMP_SES_TEST_FIXTURE *fixture)
+static int execute_exec_GENM_ses_test_single(CMP_SES_TEST_FIXTURE *fixture)
 {
-    STACK_OF(OSSL_CMP_ITAV) *itavs = NULL;
-    if (!TEST_ptr(itavs = OSSL_CMP_exec_GENM_ses(fixture->cmp_ctx)))
-        return 0;
+    OSSL_CMP_CTX *ctx = fixture->cmp_ctx;
+    ASN1_OBJECT *type = OBJ_txt2obj("1.3.6.1.5.5.7.4.2", 1);
+    OSSL_CMP_ITAV *itav = OSSL_CMP_ITAV_create(type, NULL);
+    STACK_OF(OSSL_CMP_ITAV) *itavs;
+
+    OSSL_CMP_CTX_push0_genm_ITAV(ctx, itav);
+    itavs = OSSL_CMP_exec_GENM_ses(ctx);
+
     sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free);
-    /* TODO: check if the returned value is the expected one (same as sent) */
-    return 1;
+    return TEST_int_eq(OSSL_CMP_CTX_get_status(ctx), fixture->expected)
+        && fixture->expected == OSSL_CMP_PKISTATUS_accepted ?
+        TEST_ptr(itavs) : TEST_ptr_null(itavs);
+}
+
+static int execute_exec_GENM_ses_test(CMP_SES_TEST_FIXTURE *fixture)
+{
+    return execute_exec_GENM_ses_test_single(fixture)
+        && OSSL_CMP_CTX_reinit(fixture->cmp_ctx)
+        && execute_exec_GENM_ses_test_single(fixture);
 }
 
 static int execute_exec_certrequest_ses_test(CMP_SES_TEST_FIXTURE *fixture)
 {
-    X509 *res = OSSL_CMP_exec_certreq(fixture->cmp_ctx,
-                                      fixture->req_type, NULL);
+    OSSL_CMP_CTX *ctx = fixture->cmp_ctx;
+    X509 *res = OSSL_CMP_exec_certreq(ctx, fixture->req_type, NULL);
+    int status = OSSL_CMP_CTX_get_status(ctx);
 
-    if (fixture->expected == 0)
+    OSSL_CMP_CTX_print_errors(ctx);
+    if (!TEST_int_eq(status, fixture->expected)
+        && !(fixture->expected == OSSL_CMP_PKISTATUS_waiting
+             && TEST_int_eq(status, OSSL_CMP_PKISTATUS_trans)))
+        return 0;
+    if (fixture->expected != OSSL_CMP_PKISTATUS_accepted)
         return TEST_ptr_null(res);
 
     if (!TEST_ptr(res) || !TEST_int_eq(X509_cmp(res, client_cert), 0))
         return 0;
-    /* TODO: check that cerfConf has been exchanged unless implicitConfirm */
     if (fixture->caPubs != NULL) {
         STACK_OF(X509) *caPubs = OSSL_CMP_CTX_get1_caPubs(fixture->cmp_ctx);
         int ret = TEST_int_eq(STACK_OF_X509_cmp(fixture->caPubs, caPubs), 0);
 
-        sk_X509_pop_free(caPubs, X509_free);
+        OSSL_STACK_OF_X509_free(caPubs);
         return ret;
     }
     return 1;
 }
 
-static int test_exec_RR_ses(void)
+static int test_exec_RR_ses(int request_error)
 {
     SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
-    fixture->expected = 1;
+    if (request_error)
+        OSSL_CMP_CTX_set1_oldCert(fixture->cmp_ctx, NULL);
+    fixture->expected = request_error ? OSSL_CMP_PKISTATUS_request
+        : OSSL_CMP_PKISTATUS_accepted;
     EXECUTE_TEST(execute_exec_RR_ses_test, tear_down);
     return result;
 }
 
+static int test_exec_RR_ses_ok(void)
+{
+    return test_exec_RR_ses(0);
+}
+
+static int test_exec_RR_ses_request_error(void)
+{
+    return test_exec_RR_ses(1);
+}
+
 static int test_exec_RR_ses_receive_error(void)
 {
     SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
@@ -141,8 +175,8 @@ static int test_exec_RR_ses_receive_error(void)
                                      OSSL_CMP_PKISTATUS_rejection,
                                      OSSL_CMP_CTX_FAILINFO_signerNotTrusted,
                                      "test string");
-    ossl_cmp_mock_srv_set_send_error(fixture->srv_ctx, 1);
-    fixture->expected = 0;
+    ossl_cmp_mock_srv_set_sendError(fixture->srv_ctx, OSSL_CMP_PKIBODY_RR);
+    fixture->expected = OSSL_CMP_PKISTATUS_rejection;
     EXECUTE_TEST(execute_exec_RR_ses_test, tear_down);
     return result;
 }
@@ -150,8 +184,8 @@ static int test_exec_RR_ses_receive_error(void)
 static int test_exec_IR_ses(void)
 {
     SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
-    fixture->req_type = OSSL_CMP_IR;
-    fixture->expected = 1;
+    fixture->req_type = OSSL_CMP_PKIBODY_IR;
+    fixture->expected = OSSL_CMP_PKISTATUS_accepted;
     fixture->caPubs = sk_X509_new_null();
     sk_X509_push(fixture->caPubs, server_cert);
     sk_X509_push(fixture->caPubs, server_cert);
@@ -160,88 +194,177 @@ static int test_exec_IR_ses(void)
     return result;
 }
 
-static const int checkAfter = 1;
-static int test_exec_IR_ses_poll(void)
+static int test_exec_REQ_ses_poll(int req_type, int check_after,
+                                  int poll_count, int total_timeout,
+                                  int expect)
 {
     SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
-    fixture->req_type = OSSL_CMP_IR;
-    fixture->expected = 1;
-    ossl_cmp_mock_srv_set_pollCount(fixture->srv_ctx, 2);
-    ossl_cmp_mock_srv_set_checkAfterTime(fixture->srv_ctx, checkAfter);
-    EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down);
-    /* TODO: check that 2 rounds are done or session takes 2..3 seconds */
+    fixture->req_type = req_type;
+    fixture->expected = expect;
+    ossl_cmp_mock_srv_set_checkAfterTime(fixture->srv_ctx, check_after);
+    ossl_cmp_mock_srv_set_pollCount(fixture->srv_ctx, poll_count);
+    OSSL_CMP_CTX_set_option(fixture->cmp_ctx,
+                            OSSL_CMP_OPT_TOTAL_TIMEOUT, total_timeout);
+
+    if (req_type == OSSL_CMP_PKIBODY_IR) {
+        EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down);
+    } else if (req_type == OSSL_CMP_PKIBODY_GENM) {
+        EXECUTE_TEST(execute_exec_GENM_ses_test, tear_down);
+    }
     return result;
 }
 
-static int test_exec_IR_ses_poll_timeout(void)
+static int checkAfter = 1;
+static int test_exec_IR_ses_poll_ok(void)
 {
-    const int pollCount = 3;
-    const int tout = pollCount * checkAfter;
+    return test_exec_REQ_ses_poll(OSSL_CMP_PKIBODY_IR, checkAfter, 2, 0,
+                                  OSSL_CMP_PKISTATUS_accepted);
+}
 
-    SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
-    fixture->req_type = OSSL_CMP_IR;
-    fixture->expected = 0;
-    ossl_cmp_mock_srv_set_pollCount(fixture->srv_ctx, pollCount + 1);
-    ossl_cmp_mock_srv_set_checkAfterTime(fixture->srv_ctx, checkAfter);
-    OSSL_CMP_CTX_set_option(fixture->cmp_ctx, OSSL_CMP_OPT_TOTAL_TIMEOUT, tout);
-    EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down);
-    return result;
+static int test_exec_IR_ses_poll_no_timeout(void)
+{
+    return test_exec_REQ_ses_poll(OSSL_CMP_PKIBODY_IR, checkAfter,
+                                  2 /* pollCount */, checkAfter + 4,
+                                  OSSL_CMP_PKISTATUS_accepted);
 }
 
+static int test_exec_IR_ses_poll_total_timeout(void)
+{
+    return !test_exec_REQ_ses_poll(OSSL_CMP_PKIBODY_IR, checkAfter + 1,
+                                   3 /* pollCount */, checkAfter + 6,
+                                   OSSL_CMP_PKISTATUS_waiting);
+}
 
-static int test_exec_CR_ses(void)
+static int test_exec_CR_ses(int implicit_confirm, int granted, int reject)
 {
     SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
-    fixture->req_type = OSSL_CMP_CR;
-    fixture->expected = 1;
+    fixture->req_type = OSSL_CMP_PKIBODY_CR;
+    OSSL_CMP_CTX_set_option(fixture->cmp_ctx,
+                            OSSL_CMP_OPT_IMPLICIT_CONFIRM, implicit_confirm);
+    OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(fixture->srv_ctx, granted);
+    ossl_cmp_mock_srv_set_sendError(fixture->srv_ctx,
+                                    reject ? OSSL_CMP_PKIBODY_CERTCONF : -1);
+    fixture->expected = reject ? OSSL_CMP_PKISTATUS_rejection
+        : OSSL_CMP_PKISTATUS_accepted;
     EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down);
     return result;
 }
 
+static int test_exec_CR_ses_explicit_confirm(void)
+{
+    return test_exec_CR_ses(0, 0, 0)
+        && test_exec_CR_ses(0, 0, 1 /* reject */);
+}
+
 static int test_exec_CR_ses_implicit_confirm(void)
 {
-    SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
-    fixture->req_type = OSSL_CMP_CR;
-    fixture->expected = 1;
-    OSSL_CMP_CTX_set_option(fixture->cmp_ctx,
-                            OSSL_CMP_OPT_IMPLICIT_CONFIRM, 1);
-    OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(fixture->srv_ctx, 1);
-    EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down);
-    return result;
+    return test_exec_CR_ses(1, 0, 0)
+        && test_exec_CR_ses(1, 1 /* granted */, 0);
 }
 
-static int test_exec_KUR_ses(void)
+static int test_exec_KUR_ses(int transfer_error, int pubkey, int raverified)
 {
     SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
-    fixture->req_type = OSSL_CMP_KUR;
-    fixture->expected = 1;
+    fixture->req_type = OSSL_CMP_PKIBODY_KUR;
+    /* ctx->oldCert has already been set */
+
+    if (transfer_error)
+        OSSL_CMP_CTX_set_transfer_cb_arg(fixture->cmp_ctx, NULL);
+    if (pubkey) {
+        EVP_PKEY *key = raverified /* wrong key */ ? server_key : client_key;
+
+        EVP_PKEY_up_ref(key);
+        OSSL_CMP_CTX_set0_newPkey(fixture->cmp_ctx, 0 /* not priv */, key);
+        OSSL_CMP_SRV_CTX_set_accept_raverified(fixture->srv_ctx, 1);
+    }
+    if (pubkey || raverified)
+        OSSL_CMP_CTX_set_option(fixture->cmp_ctx, OSSL_CMP_OPT_POPO_METHOD,
+                                OSSL_CRMF_POPO_RAVERIFIED);
+    fixture->expected = transfer_error ? OSSL_CMP_PKISTATUS_trans :
+        raverified ? OSSL_CMP_PKISTATUS_rejection : OSSL_CMP_PKISTATUS_accepted;
     EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down);
     return result;
 }
 
-static int test_exec_P10CR_ses(void)
+static int test_exec_KUR_ses_ok(void)
+{
+    return test_exec_KUR_ses(0, 0, 0);
+}
+
+static int test_exec_KUR_ses_transfer_error(void)
 {
-    X509_REQ *req = NULL;
+    return test_exec_KUR_ses(1, 0, 0);
+}
+
+static int test_exec_KUR_ses_wrong_popo(void)
+{
+#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION /* cf ossl_cmp_verify_popo() */
+    return test_exec_KUR_ses(0, 0, 1);
+#else
+    return 1;
+#endif
+}
+
+static int test_exec_KUR_ses_pub(void)
+{
+    return test_exec_KUR_ses(0, 1, 0);
+}
+
+static int test_exec_KUR_ses_wrong_pub(void)
+{
+    return test_exec_KUR_ses(0, 1, 1);
+}
+
+static int test_certConf_cb(OSSL_CMP_CTX *ctx, X509 *cert, int fail_info,
+                            const char **txt)
+{
+    int *reject = OSSL_CMP_CTX_get_certConf_cb_arg(ctx);
+
+    if (*reject) {
+        *txt = "not to my taste";
+        fail_info = OSSL_CMP_PKIFAILUREINFO_badCertTemplate;
+    }
+    return fail_info;
+}
+
+static int test_exec_P10CR_ses(int reject)
+{
+    OSSL_CMP_CTX *ctx;
+    X509_REQ *csr = NULL;
 
     SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
-    fixture->req_type = OSSL_CMP_P10CR;
-    fixture->expected = 1;
-    if (!TEST_ptr(req = load_csr_der(pkcs10_f))
-            || !TEST_true(OSSL_CMP_CTX_set1_p10CSR(fixture->cmp_ctx, req))) {
+    fixture->req_type = OSSL_CMP_PKIBODY_P10CR;
+    fixture->expected = reject ? OSSL_CMP_PKISTATUS_rejection
+        : OSSL_CMP_PKISTATUS_accepted;
+    ctx = fixture->cmp_ctx;
+    if (!TEST_ptr(csr = load_csr_der(pkcs10_f, libctx))
+        || !TEST_true(OSSL_CMP_CTX_set1_p10CSR(ctx, csr))
+        || !TEST_true(OSSL_CMP_CTX_set_certConf_cb(ctx, test_certConf_cb))
+        || !TEST_true(OSSL_CMP_CTX_set_certConf_cb_arg(ctx, &reject))) {
         tear_down(fixture);
         fixture = NULL;
     }
-    X509_REQ_free(req);
+    X509_REQ_free(csr);
     EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down);
     return result;
 }
 
+static int test_exec_P10CR_ses_ok(void)
+{
+    return test_exec_P10CR_ses(0);
+}
+
+static int test_exec_P10CR_ses_reject(void)
+{
+    return test_exec_P10CR_ses(1);
+}
+
 static int execute_try_certreq_poll_test(CMP_SES_TEST_FIXTURE *fixture)
 {
     OSSL_CMP_CTX *ctx = fixture->cmp_ctx;
     int check_after;
-    const int CHECK_AFTER = 5;
-    const int TYPE = OSSL_CMP_KUR;
+    const int CHECK_AFTER = 0;
+    const int TYPE = OSSL_CMP_PKIBODY_KUR;
 
     ossl_cmp_mock_srv_set_pollCount(fixture->srv_ctx, 3);
     ossl_cmp_mock_srv_set_checkAfterTime(fixture->srv_ctx, CHECK_AFTER);
@@ -269,8 +392,8 @@ static int execute_try_certreq_poll_abort_test(CMP_SES_TEST_FIXTURE *fixture)
 {
     OSSL_CMP_CTX *ctx = fixture->cmp_ctx;
     int check_after;
-    const int CHECK_AFTER = INT_MAX;
-    const int TYPE = OSSL_CMP_CR;
+    const int CHECK_AFTER = 99;
+    const int TYPE = OSSL_CMP_PKIBODY_CR;
 
     ossl_cmp_mock_srv_set_pollCount(fixture->srv_ctx, 3);
     ossl_cmp_mock_srv_set_checkAfterTime(fixture->srv_ctx, CHECK_AFTER);
@@ -278,7 +401,7 @@ static int execute_try_certreq_poll_abort_test(CMP_SES_TEST_FIXTURE *fixture)
         && check_after == CHECK_AFTER
         && TEST_ptr_eq(OSSL_CMP_CTX_get0_newCert(ctx), NULL)
         && TEST_int_eq(fixture->expected,
-                       OSSL_CMP_try_certreq(ctx, -1, NULL, NULL))
+                       OSSL_CMP_try_certreq(ctx, -1 /* abort */, NULL, NULL))
         && TEST_ptr_eq(OSSL_CMP_CTX_get0_newCert(fixture->cmp_ctx), NULL);
 }
 
@@ -290,19 +413,63 @@ static int test_try_certreq_poll_abort(void)
     return result;
 }
 
-static int test_exec_GENM_ses(void)
+static int test_exec_GENM_ses_poll_ok(void)
+{
+    return test_exec_REQ_ses_poll(OSSL_CMP_PKIBODY_GENM, checkAfter, 2, 0,
+                                  OSSL_CMP_PKISTATUS_accepted);
+}
+
+static int test_exec_GENM_ses_poll_no_timeout(void)
+{
+    return test_exec_REQ_ses_poll(OSSL_CMP_PKIBODY_GENM, checkAfter,
+                                  1 /* pollCount */, checkAfter + 1,
+                                  OSSL_CMP_PKISTATUS_accepted);
+}
+
+static int test_exec_GENM_ses_poll_total_timeout(void)
+{
+    return test_exec_REQ_ses_poll(OSSL_CMP_PKIBODY_GENM, checkAfter + 1,
+                                  3 /* pollCount */, checkAfter + 2,
+                                  OSSL_CMP_PKISTATUS_waiting);
+}
+
+static int test_exec_GENM_ses(int transfer_error, int total_timeout, int expect)
 {
     SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up);
+    if (transfer_error)
+        OSSL_CMP_CTX_set_transfer_cb_arg(fixture->cmp_ctx, NULL);
+    /*
+     * cannot use OSSL_CMP_CTX_set_option(... OSSL_CMP_OPT_TOTAL_TIMEOUT)
+     * here because this will correct total_timeout to be >= 0
+     */
+    fixture->cmp_ctx->total_timeout = total_timeout;
+    fixture->expected = expect;
     EXECUTE_TEST(execute_exec_GENM_ses_test, tear_down);
     return result;
 }
 
+static int test_exec_GENM_ses_ok(void)
+{
+    return test_exec_GENM_ses(0, 0, OSSL_CMP_PKISTATUS_accepted);
+}
+
+static int test_exec_GENM_ses_transfer_error(void)
+{
+    return test_exec_GENM_ses(1, 0, OSSL_CMP_PKISTATUS_trans);
+}
+
+static int test_exec_GENM_ses_total_timeout(void)
+{
+    return test_exec_GENM_ses(0, -1, OSSL_CMP_PKISTATUS_trans);
+}
+
 static int execute_exchange_certConf_test(CMP_SES_TEST_FIXTURE *fixture)
 {
     int res =
-        ossl_cmp_exchange_certConf(fixture->cmp_ctx,
+        ossl_cmp_exchange_certConf(fixture->cmp_ctx, OSSL_CMP_CERTREQID,
                                    OSSL_CMP_PKIFAILUREINFO_addInfoNotAvailable,
                                    "abcdefg");
+
     return TEST_int_eq(fixture->expected, res);
 }
 
@@ -343,11 +510,13 @@ void cleanup_tests(void)
     EVP_PKEY_free(server_key);
     X509_free(client_cert);
     EVP_PKEY_free(client_key);
+    OSSL_PROVIDER_unload(default_null_provider);
+    OSSL_PROVIDER_unload(provider);
     OSSL_LIB_CTX_free(libctx);
     return;
 }
 
-# define USAGE "server.key server.crt client.key client.crt client.csr module_name [module_conf_file]\n"
+#define USAGE "server.key server.crt client.key client.crt client.csr module_name [module_conf_file]\n"
 OPT_TEST_DECLARE_USAGE(USAGE)
 
 int setup_tests(void)
@@ -373,34 +542,36 @@ int setup_tests(void)
             || !TEST_ptr(server_cert = load_cert_pem(server_cert_f, libctx))
             || !TEST_ptr(client_key = load_pkey_pem(client_key_f, libctx))
             || !TEST_ptr(client_cert = load_cert_pem(client_cert_f, libctx))
-            || !TEST_int_eq(1, RAND_bytes_ex(libctx, ref, sizeof(ref)))) {
+            || !TEST_int_eq(1, RAND_bytes_ex(libctx, ref, sizeof(ref), 0))) {
         cleanup_tests();
         return 0;
     }
 
-    ADD_TEST(test_exec_RR_ses);
+    ADD_TEST(test_exec_RR_ses_ok);
+    ADD_TEST(test_exec_RR_ses_request_error);
     ADD_TEST(test_exec_RR_ses_receive_error);
-    ADD_TEST(test_exec_CR_ses);
+    ADD_TEST(test_exec_CR_ses_explicit_confirm);
     ADD_TEST(test_exec_CR_ses_implicit_confirm);
     ADD_TEST(test_exec_IR_ses);
-    ADD_TEST(test_exec_IR_ses_poll);
-    ADD_TEST(test_exec_IR_ses_poll_timeout);
-    ADD_TEST(test_exec_KUR_ses);
-    ADD_TEST(test_exec_P10CR_ses);
+    ADD_TEST(test_exec_IR_ses_poll_ok);
+    ADD_TEST(test_exec_IR_ses_poll_no_timeout);
+    ADD_TEST(test_exec_IR_ses_poll_total_timeout);
+    ADD_TEST(test_exec_KUR_ses_ok);
+    ADD_TEST(test_exec_KUR_ses_transfer_error);
+    ADD_TEST(test_exec_KUR_ses_wrong_popo);
+    ADD_TEST(test_exec_KUR_ses_pub);
+    ADD_TEST(test_exec_KUR_ses_wrong_pub);
+    ADD_TEST(test_exec_P10CR_ses_ok);
+    ADD_TEST(test_exec_P10CR_ses_reject);
     ADD_TEST(test_try_certreq_poll);
     ADD_TEST(test_try_certreq_poll_abort);
-    ADD_TEST(test_exec_GENM_ses);
+    ADD_TEST(test_exec_GENM_ses_ok);
+    ADD_TEST(test_exec_GENM_ses_transfer_error);
+    ADD_TEST(test_exec_GENM_ses_total_timeout);
+    ADD_TEST(test_exec_GENM_ses_poll_ok);
+    ADD_TEST(test_exec_GENM_ses_poll_no_timeout);
+    ADD_TEST(test_exec_GENM_ses_poll_total_timeout);
     ADD_TEST(test_exchange_certConf);
     ADD_TEST(test_exchange_error);
     return 1;
 }
-
-#else /* !defined (NDEBUG) */
-
-int setup_tests(void)
-{
-    TEST_note("CMP session tests are disabled in this build (NDEBUG).");
-    return 1;
-}
-
-#endif