More X509_verify_cert() tests via verify(1).

Still need tests for trusted-first and tests that probe construction
of alternate chains.

Reviewed-by: Richard Levitte <levitte@openssl.org>

diff --git a/test/certs/root-noserver.pem b/test/certs/root-noserver.pem
new file mode 100644 (file)
index 0000000..0c7fb8d
--- /dev/null
+++ b/test/certs/root-noserver.pem
@@ -0,0 +1,19 @@
+-----BEGIN TRUSTED CERTIFICATE-----
+MIIC8TCCAdmgAwIBAgIBATANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTE2MDExNDIyMjkwNVoYDzIxMTYwMTE1MjIyOTA1WjASMRAwDgYDVQQD
+DAdSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv5oV1s3N
+us7SINg7omu5AxueEgK97mh5PU3hgZpliSFaESmL2qLGeP609oXs/68XDXVW4utU
+LCOjLh0np+5Xy3i3GRDXgBZ72QDe23WqqQqqaBlQVVm1WxG+amRtZJEWdSIsiFBt
+k+8dBElHh2WQDhDOWqHGHQarQgJPxGB97MRhMSlbTwK1T5KAWOlqi5mJW5L6vNrQ
+7Tra/YceH70fU0fJYOXhBxM92NwD1bbVd9GPYFSqrdrVj19bvo63XsxZduex5QHr
+RkWqT5w5mgAHaEgCqWrS/64q9TR9UEwrB8kiZZg3k9/im+zBwEULTZu0r8oMEkpj
+bTlXLmt8EMBqxwIDAQABo1AwTjAdBgNVHQ4EFgQUcH8uroNoWZgEIyrN6z4XzSTd
+AUkwHwYDVR0jBBgwFoAUcH8uroNoWZgEIyrN6z4XzSTdAUkwDAYDVR0TBAUwAwEB
+/zANBgkqhkiG9w0BAQsFAAOCAQEAuiLq2lhcOJHrwUP0txbHk2vy6rmGTPxqmcCo
+CUQFZ3KrvUQM+rtRqqQ0+LzU4wSTFogBz9KSMfT03gPegY3b/7L2TOaMmUFRzTdd
+c9PNT0lP8V3pNQrxp0IjKir791QkGe2Ux45iMKf/SXpeTWASp4zeMiD6/LXFzzaK
+BfNS5IrIWRDev41lFasDzudK5/kmVaMvDOFyW51KkKkqb64VS4UA81JIEzClvz+3
+Vp3k1AXup5+XnTvhqu2nRhrLpJR5w8OXQpcn6qjKlVc2BXtb3xwci1/ibHlZy3CZ
+n70e2NYihU5yYKccReP+fjLgVFsuhsDs/0hRML1u9bLp9nUbYDAMoAoGCCsGAQUF
+BwMB
+-----END TRUSTED CERTIFICATE-----

diff --git a/test/certs/rootcert.pem b/test/certs/rootcert.pem
new file mode 100644 (file)
index 0000000..2b90ddb
--- /dev/null
+++ b/test/certs/rootcert.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC8TCCAdmgAwIBAgIBATANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTE2MDExNDIyMjkwNVoYDzIxMTYwMTE1MjIyOTA1WjASMRAwDgYDVQQD
+DAdSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv5oV1s3N
+us7SINg7omu5AxueEgK97mh5PU3hgZpliSFaESmL2qLGeP609oXs/68XDXVW4utU
+LCOjLh0np+5Xy3i3GRDXgBZ72QDe23WqqQqqaBlQVVm1WxG+amRtZJEWdSIsiFBt
+k+8dBElHh2WQDhDOWqHGHQarQgJPxGB97MRhMSlbTwK1T5KAWOlqi5mJW5L6vNrQ
+7Tra/YceH70fU0fJYOXhBxM92NwD1bbVd9GPYFSqrdrVj19bvo63XsxZduex5QHr
+RkWqT5w5mgAHaEgCqWrS/64q9TR9UEwrB8kiZZg3k9/im+zBwEULTZu0r8oMEkpj
+bTlXLmt8EMBqxwIDAQABo1AwTjAdBgNVHQ4EFgQUcH8uroNoWZgEIyrN6z4XzSTd
+AUkwHwYDVR0jBBgwFoAUcH8uroNoWZgEIyrN6z4XzSTdAUkwDAYDVR0TBAUwAwEB
+/zANBgkqhkiG9w0BAQsFAAOCAQEAuiLq2lhcOJHrwUP0txbHk2vy6rmGTPxqmcCo
+CUQFZ3KrvUQM+rtRqqQ0+LzU4wSTFogBz9KSMfT03gPegY3b/7L2TOaMmUFRzTdd
+c9PNT0lP8V3pNQrxp0IjKir791QkGe2Ux45iMKf/SXpeTWASp4zeMiD6/LXFzzaK
+BfNS5IrIWRDev41lFasDzudK5/kmVaMvDOFyW51KkKkqb64VS4UA81JIEzClvz+3
+Vp3k1AXup5+XnTvhqu2nRhrLpJR5w8OXQpcn6qjKlVc2BXtb3xwci1/ibHlZy3CZ
+n70e2NYihU5yYKccReP+fjLgVFsuhsDs/0hRML1u9bLp9nUbYA==
+-----END CERTIFICATE-----

diff --git a/test/certs/rootkey.pem b/test/certs/rootkey.pem
new file mode 100644 (file)
index 0000000..d85c96f
--- /dev/null
+++ b/test/certs/rootkey.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC/mhXWzc26ztIg
+2Duia7kDG54SAr3uaHk9TeGBmmWJIVoRKYvaosZ4/rT2hez/rxcNdVbi61QsI6Mu
+HSen7lfLeLcZENeAFnvZAN7bdaqpCqpoGVBVWbVbEb5qZG1kkRZ1IiyIUG2T7x0E
+SUeHZZAOEM5aocYdBqtCAk/EYH3sxGExKVtPArVPkoBY6WqLmYlbkvq82tDtOtr9
+hx4fvR9TR8lg5eEHEz3Y3APVttV30Y9gVKqt2tWPX1u+jrdezFl257HlAetGRapP
+nDmaAAdoSAKpatL/rir1NH1QTCsHySJlmDeT3+Kb7MHARQtNm7SvygwSSmNtOVcu
+a3wQwGrHAgMBAAECggEBAL4rWle8JuCuHGNbGz1nO9d41tg7fnYdnZAaN6OiMfr8
+bl+wY84aV3GKJOS2InfYOcIy340UU5QHvxOq/kwwRVV/uAOZ8rqAFmZY9djOnhdv
+rZjq3xAHnPgJ0XvZt7XkR2z1AUw+v7Pf1WYGsYcSZ/t99MKB5Je0odA/aRqZRwLy
+YflbsnAJtxdJ6fsiVCSJcU76V8sxfiCimw6ppLMEp3zCjveQ5Lv0eVoL2zNYeh+l
+GiSwqTqaR+WJekkDiXRd9KYI19drf7OkTII1DtOd6bgvKX3zv2lNiere4J4k7cAP
+rW6fBFgtSq2oklTpWUlXRH7XQAgDtDvldXdlKaj96dkCgYEA8KPSu5ywg8pjCofE
+nLtJTfVyD2g9tgNLj9dI3kuSniZU51kOtk5rZZwL0S8piGczL908aV9DIWdXWsND
+5hlXquKUTSjxPYEzZvaN+tvf9e0AcY/D/UaK0mKPjEbh7vg6pS77aZZz2EL2inOs
+dam8famOOC9RUkxH5JWa3UV4UhsCgYEAy9T0wPQctjuvDkZQTqKEKsHrmrgY2PXT
+Re8DDGI8hxjYb8l+NoFQ7eiwTHir/DULupxQoBBUQtS+idQzUu02tzLMnGcjHNwh
+Tu+vZ4xlVnXxfgIRjDKkfQjiAC5SLzoNO9Jn8g4eS/1mEPXhQ0TXIsFonZDypp/n
+RMp21DkvdMUCgYAIMgwjR5rbYjEtUqJnlBlTBmD0FWDEqigQpgxdRcWgjT2nA2l0
+3AbcVwwv+6M2eg1MPASqsgvfP13CQZQ2afaKY10Zo6NTrOrLPupm+MYP4hp5w6Ox
+JI3lzGWHKYLYWKvmpEr7tZwMaXtsC7R77WP2A6hMUZA7dU2dg1ra3lrSsQKBgQDA
+sPIsUtmtwOBtqzUSEXrGfQqA+larDEGNVDVaiKfVwzwg+aeyWS+rqRS5Rj64L2GG
+KW3i020EvN/fplZap9vY9lIN7UZ5avSmDdqRFl1ajiccy1HRarKrbTFRoHibItMN
+4YvYfVZQ2h2aHQe2Myb6OULv6e4qbPIRyyDo4aKmTQKBgQCadq2JfICFIP9Q1aQn
+93oD7Z4WcYs+KsLYO+/uJxWMrn0/gv90cGrSfstJqDOHnRq4WKUcgK9ErxaE4LkW
+sD0mBhRM3SMxnRJZRO+6roRdehtjHkvzKu75KjcsuwefoMs2sFa4CLQ1YU2vO3Tx
+dgzpnKS2bH/i5yLwhelRfddZ6Q==
+-----END PRIVATE KEY-----

diff --git a/test/certs/server-trusted.pem b/test/certs/server-trusted.pem
new file mode 100644 (file)
index 0000000..7508cff
--- /dev/null
+++ b/test/certs/server-trusted.pem
@@ -0,0 +1,20 @@
+-----BEGIN TRUSTED CERTIFICATE-----
+MIIDJTCCAg2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTE2MDExNDIyMjk0NloYDzIxMTYwMTE1MjIyOTQ2WjAZMRcwFQYDVQQD
+DA5zZXJ2ZXIuZXhhbXBsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANVdYGrf/GHuSKqMEUhDpW22Ul2qmEmxYZI1sfw6BCUMbXn/tNXJ6VwcO+Crs7h9
+o95tveDd11q/FEcRQl6mgtBhwX/dE0bmCYUHDvLU/Bpk0gqtIKsga5bwrczEGVNV
+3AEdpLPvirRJU12KBRzx3OFEv8XX4ncZV1yXC3XuiENxD8pswbSyUKd3RmxYDxG/
+8XYkWq45QrdRZynh0FUwbxfkkeqt+CjCQ2+iZKn7nZiSYkg+6w1PgkqK/z9y7pa1
+rqHBmLrvfZB1bf9aUp6r9cB+0IdD24UHBw99OHr90dPuZR3T6jlqhzfuStPgDW71
+cKzCvfFu85KVXqnwoWWVk40CAwEAAaN9MHswHQYDVR0OBBYEFMDnhL/oWSczELBS
+T1FSLwbWwHrNMB8GA1UdIwQYMBaAFHB/Lq6DaFmYBCMqzes+F80k3QFJMAkGA1Ud
+EwQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwGQYDVR0RBBIwEIIOc2VydmVyLmV4
+YW1wbGUwDQYJKoZIhvcNAQELBQADggEBAHvTBEN1ig8RrsT716Ginv4gGNX0LzGI
+RrZ1jO7lm5emuaPNYJpGw0iX5Zdo91qGNXPZaZ75X3S55pQTActq3OPEBOll2pyk
+iyjz+Zp/v5cfRZLlBbFW5gv2R94eibYr4U3fSn4B0yPcl4xH/l/HzJhGDsSDW8qK
+8VIJvmvsPwmL0JMCv+FR59F+NFYZdND/KCXet59WUpF9ICmFCoBEX3EyJXEPwhbi
+X2sdPzJbCjx0HLli8e0HUKNttLQxCsBTRGo6iISLLamwN47mGDa9miBADwGSiz2q
+YeeuLO02zToHhnQ6KbPXOrQAqcL1kngO4g+j/ru+4AZThFkdkGnltvkwDDAKBggr
+BgEFBQcDAQ==
+-----END TRUSTED CERTIFICATE-----

diff --git a/test/certs/servercert.pem b/test/certs/servercert.pem
new file mode 100644 (file)
index 0000000..cc17d3f
--- /dev/null
+++ b/test/certs/servercert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJTCCAg2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTE2MDExNDIyMjk0NloYDzIxMTYwMTE1MjIyOTQ2WjAZMRcwFQYDVQQD
+DA5zZXJ2ZXIuZXhhbXBsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANVdYGrf/GHuSKqMEUhDpW22Ul2qmEmxYZI1sfw6BCUMbXn/tNXJ6VwcO+Crs7h9
+o95tveDd11q/FEcRQl6mgtBhwX/dE0bmCYUHDvLU/Bpk0gqtIKsga5bwrczEGVNV
+3AEdpLPvirRJU12KBRzx3OFEv8XX4ncZV1yXC3XuiENxD8pswbSyUKd3RmxYDxG/
+8XYkWq45QrdRZynh0FUwbxfkkeqt+CjCQ2+iZKn7nZiSYkg+6w1PgkqK/z9y7pa1
+rqHBmLrvfZB1bf9aUp6r9cB+0IdD24UHBw99OHr90dPuZR3T6jlqhzfuStPgDW71
+cKzCvfFu85KVXqnwoWWVk40CAwEAAaN9MHswHQYDVR0OBBYEFMDnhL/oWSczELBS
+T1FSLwbWwHrNMB8GA1UdIwQYMBaAFHB/Lq6DaFmYBCMqzes+F80k3QFJMAkGA1Ud
+EwQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwGQYDVR0RBBIwEIIOc2VydmVyLmV4
+YW1wbGUwDQYJKoZIhvcNAQELBQADggEBAHvTBEN1ig8RrsT716Ginv4gGNX0LzGI
+RrZ1jO7lm5emuaPNYJpGw0iX5Zdo91qGNXPZaZ75X3S55pQTActq3OPEBOll2pyk
+iyjz+Zp/v5cfRZLlBbFW5gv2R94eibYr4U3fSn4B0yPcl4xH/l/HzJhGDsSDW8qK
+8VIJvmvsPwmL0JMCv+FR59F+NFYZdND/KCXet59WUpF9ICmFCoBEX3EyJXEPwhbi
+X2sdPzJbCjx0HLli8e0HUKNttLQxCsBTRGo6iISLLamwN47mGDa9miBADwGSiz2q
+YeeuLO02zToHhnQ6KbPXOrQAqcL1kngO4g+j/ru+4AZThFkdkGnltvk=
+-----END CERTIFICATE-----

diff --git a/test/certs/serverkey.pem b/test/certs/serverkey.pem
new file mode 100644 (file)
index 0000000..0d7e404
--- /dev/null
+++ b/test/certs/serverkey.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDVXWBq3/xh7kiq
+jBFIQ6VttlJdqphJsWGSNbH8OgQlDG15/7TVyelcHDvgq7O4faPebb3g3ddavxRH
+EUJepoLQYcF/3RNG5gmFBw7y1PwaZNIKrSCrIGuW8K3MxBlTVdwBHaSz74q0SVNd
+igUc8dzhRL/F1+J3GVdclwt17ohDcQ/KbMG0slCnd0ZsWA8Rv/F2JFquOUK3UWcp
+4dBVMG8X5JHqrfgowkNvomSp+52YkmJIPusNT4JKiv8/cu6Wta6hwZi6732QdW3/
+WlKeq/XAftCHQ9uFBwcPfTh6/dHT7mUd0+o5aoc37krT4A1u9XCswr3xbvOSlV6p
+8KFllZONAgMBAAECggEADLTt7A+A2Vg2jamf0dztejY0e42QWjstI2b9PZc67fXq
+gyx+WYkX07t+uWegYWliG/oPJ9guXiIpE/5sJHToL37S5kmFP2CtynVcJ4wVo4DD
+nY0n9+kLX0bgIuS+2V6wpoRcbbbjXM9NHrH8kfe5ftT4UtEDlLI2qLX6IcDd7p4u
+OYjILChR8GSGTw96yIy2Ws/1Uq9PMw64JoT4RcK5QqnkcPMDFRH1SeLOL+zXP2c4
+nEl9yOy3HauZKxwl/Ry/XK1s3DdjopIAU29ut+hAuMiTb06kzZnumL9NoplKoZtU
+otw/gVcCKhT+Ep+p6i8InLF0XEME8A0qUR0niWebgQKBgQD6vkxR49B8ZZQrzjw4
+XKs1lI9cP7cgPiuWlDHMNjYou3WbOaGrMeScvbB1Ldh9A8pjAhxlw8AaV/xs4qcA
+trmVmSISVMVyc1wSGlJXWi2nUzTNs9OE3vj22SyStihf8UUZtWwX2b5Y4JrYhA/V
++ThGGqHR03oLNLShNLtJc2c7YQKBgQDZ1nkibEyrepexw/fnwkw61IJKq9wRIh1G
+PREakhbe9wU5ie0knuf9razt7awzQiwFmlixmWqsM7UEtLuXNnNPciwdrKhhbvrd
+vD/rkbIEHEPllIhFlDtOzn3hRBWTzWmXFjpou/2LvHTSbVis4IYVZymTp2jb1ZLs
+7VbiG9JTrQKBgQDc6n75g1szzpdehQT/r33U5j/syeJBUSU8NPMu9fB/sLHsgjlT
+SNEf2+y1QSBE/Or6kmiMrIv7advn30W+Vj9qc5HWTsPrk4HiHTjA553jl2alebN5
+lK4LZspjtIQcC8mS3goPdXPEgJdM/gWpwzr2YQ6DfOxBJT2j7n64NyoT4QKBgH7/
+yx+GhCx1DHtXBPDZFhg2TL+78lEK0oZgk9gp06up2CHzh44SFq6O0oLkTcCUk5Ww
+poTkLIy4mJBlzfgahp+KsK2cO46SZS9g0ONFzcMXt33hWpE2Gl2XhUwPpYTF/QlY
+rDTjZK5S8Mi9dzVSsNlJi7PJphiEK2R1+nFYRwcBAoGBANWoIG85jpXAOnq/Kcgx
+Rl3YivR0Ke6r1tFlP58rT7X3EkiboXyQl5vLIFCAwUte6RGrLl1dy3Qyh80B9ySL
+Jx6vj42CK7vgv6A96TuVYhnXTnEI6ZvwAQ2VGaw4BizhjALs/kdSE/og9aSCs3ws
+KQypwAFz0tbHxaNag/bSAN0J
+-----END PRIVATE KEY-----

diff --git a/test/certs/wrongcert.pem b/test/certs/wrongcert.pem
new file mode 100644 (file)
index 0000000..b8b3cfd
--- /dev/null
+++ b/test/certs/wrongcert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIC/TCCAeWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1Xcm9u
+ZyBSb290IENBMCAXDTE2MDExNDIyMjkwMVoYDzIxMTYwMTE1MjIyOTAxWjAYMRYw
+FAYDVQQDDA1Xcm9uZyBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA1qOM0wmfvpzDnuZbMaZd5VtYPVYFoYMhlSmUQWCH/I17zxzzWi2SCRvc
+JXx+mZcK1l7KXYabewH1fxHzBGJYI/huxqEF3G7e0cqa60XAhyEKfop0VrKMpqDh
+sNRxqC3PWaQQzijlD2XEY5h3u97qn/m4mAMO1RvKUtv0l0Go9G3VZVp0HSPxW2VM
+0xDyOhlPSYzQ0solQgvb3Nir6dyxzOFz4kCJiVwOQQ4YFvRps72NcBV7q6OWpXHE
+URIGlVlc7p/8ysGNMgj/G3mtPjVtb+AKFDESO+l9ZGi5JU1LJJf23A2BVUgP4eL1
+huZGrTsVNdIYMds1yHyoDfHABLI+TQIDAQABo1AwTjAdBgNVHQ4EFgQU0sgStYvh
+Wvrkc0aam05HE5YMZFgwHwYDVR0jBBgwFoAU0sgStYvhWvrkc0aam05HE5YMZFgw
+DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAT4DDpFvHBIzhKR1/LJx6
+1gsXYCAp1fre5luek/kGTRrInWg6OLZ7B2wLtGcfNlfpRCvLHCh1ORgctNaYwBgE
+xOGWHTsbFDfq15cOcATXgDqRch8dLv/5XKm8rXDwmi6mUfbwUDF5qko4f3hpBWvA
+EBRJSqPvaRxfiJs3SXGnCbiIcYEz0nAwgqfJl7QFXnD22Fu0FGczwzW/7kh0EeIW
+tMsyrIvMR+s6AYzwYrRnUjXBNHjRxuiy5KmyvTMoFm5R6PsD2YfUN1xFkdRy48vb
+8fVYApmiXoNWMBgVSija261L81OY4yZZw3BK8nAGrko5VmXjbfYIScpiMlZkXLHN
+Ww==
+-----END CERTIFICATE-----

diff --git a/test/certs/wrongkey.pem b/test/certs/wrongkey.pem
new file mode 100644 (file)
index 0000000..72ab17b
--- /dev/null
+++ b/test/certs/wrongkey.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDWo4zTCZ++nMOe
+5lsxpl3lW1g9VgWhgyGVKZRBYIf8jXvPHPNaLZIJG9wlfH6ZlwrWXspdhpt7AfV/
+EfMEYlgj+G7GoQXcbt7RyprrRcCHIQp+inRWsoymoOGw1HGoLc9ZpBDOKOUPZcRj
+mHe73uqf+biYAw7VG8pS2/SXQaj0bdVlWnQdI/FbZUzTEPI6GU9JjNDSyiVCC9vc
+2Kvp3LHM4XPiQImJXA5BDhgW9GmzvY1wFXuro5alccRREgaVWVzun/zKwY0yCP8b
+ea0+NW1v4AoUMRI76X1kaLklTUskl/bcDYFVSA/h4vWG5katOxU10hgx2zXIfKgN
+8cAEsj5NAgMBAAECggEBAJBlHKMI0W/RVIT8oZMIQhi/V+CDk2wxpJENlNBamYFc
+yVLvPgOHrrv0Aykw1JaNF1xaDrfWi5i4G6jtsVhctMEWK6fywdemur3WGFx442nE
+36N7j4KXwamDh/GHKiMjFmBO0INw3ZB7PSBnfP1lnOAchoO1YvAZLwaJNMXhBUHR
+uoGrL2nv2F6EDe1whuNd6ifNPT8aX+8kOP0ooe6+rEvoe8Q6N+ktMLcl/b6y7nqt
+Tkl1CzuCnC/KJwY6LRRl6NUttw1c78IauqeNRuLYuaUKMXRjWkKTzPY7sHAdQbey
+szC6Rowso6i26n7a0yJFnML8NDZPJAsJqj7NA1rfn4ECgYEA8K51eqVe9C0uNdcG
+jxbzZZggPXM2SjGLwSz7DazN67kGkLY54B4BO1s428ZfpgsI364Cyg7vocDegAr2
+t9/+N+i/fF7c9yKICxefNcO/Q1i4hozTimQHEWpCDKgystBrWl+CopRrq/QMndGh
+oFfeLzIwQ3m69lFgTBwyTRCDsi0CgYEA5EzEI3uGVfP639x06/7h2kLeBYUlvIaA
+84O4t7oAvsIRHBsTvi5OKR2YB9ONkDLmdSEZaGg7KUgzPDBoJ2PDmGP6jEiW//bD
+9ftXb6UPUuHMyQu92wzJW6qrNSZu13NqkQ0XTBYBYlYGTvESljJhbWTDLpUd7dlV
+i4xxAkxJ8KECgYAD4MvDziZZiODVvUE9zQDfAjSCyPh2+ZVm53KkJcSrp6+TZVxJ
+YDJk4nNoFyozYroh4Ivq9ZKm6JStO3/+Nn3CKN3tAxpMYSIQC7FlDGJok2VlxZ8i
++7mhbjTiP1ORzgnsyt0wAXQ6sRQC9v3Dt6a82/IrJCr/DRCgKVQmKb31gQKBgQC5
+IctYHr5UC1KgoGysR3es/9Z9UXjFhakiT+nGC265QjSPvyFmcrRtQRNdHV/J1Izv
+5NRuxz9afbMWlwaPEqa1eDXf9qmEjf5hBd3kqkxf4L2pNv1Rme/bhu3pXu45ht2f
+HKeMyrd6n9njwDhbViWNiU2CA+hOTZTCYjPuMiEvoQKBgQCY4styVO7gKdNc3j9c
+iPAjnMjBBqLzEJdS4de2BFdKM4xhX4OWbNsO+GcMlq4k1Tt6dMKdcLmjnHWsdsqp
+UFGEMMZDd/ez6kOAGInYajr7rmRjxAolZwK7mc1OQcDiNgjb5Qs0E5zM4TEg5r56
+sU+ewyfUH6y1dTTJhjIldEfUtw==
+-----END PRIVATE KEY-----

diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index 923bda0c4f94361a73843db89628f21a3344007b..10598786835c79fe7c413fb1c24ead9f90a0424f 100644 (file)
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -8,10 +8,85 @@ use OpenSSL::Test qw/:DEFAULT top_dir top_file/;
 
 setup("test_verify");
 
-plan skip_all => "no rehash.time was found."
-    unless (-f top_file("rehash.time"));
+# Note for now, at most one trusted and one untrusted PEM file can be
+# specified.  The verify(1) option parser does not accumulate content
+# from multiple trusted or untrusted files.
+#
+sub verify {
+    my ($cert, $vname, $trusted, $untrusted, @opts) = @_;
+    my @args = qw(openssl verify -verify_name);
+    my @path = qw(test certs);
+    push(@args, "$vname", @opts);
+    for (@$trusted) { push(@args, "-trusted", top_dir(@path, "$_.pem")) }
+    for (@$untrusted) { push(@args, "-untrusted", top_dir(@path, "$_.pem")) }
+    push(@args, top_dir(@path, "$cert.pem"));
+    run(app([@args]));
+}
 
-plan tests => 1;
+plan tests => 29;
 
-ok(run(app(["openssl", "verify", "-CApath", top_dir("certs", "demo"),
-           glob(top_file("certs", "demo", "*.pem"))])), "verifying demo certs");
+# Canonical success
+ok(verify("ee-cert", "ssl_server", ["root-cert"], ["ca-cert"]),
+   "verify valid chain");
+
+# Root CA variants
+ok(verify("ee-cert", "ssl_server", [qw(root-nonca)], [qw(ca-cert)]),
+   "Trusted certs not subject to CA:true checks");
+ok(!verify("ee-cert", "ssl_server", [qw(root-cert2)], [qw(ca-cert)]),
+   "fail wrong root key");
+ok(!verify("ee-cert", "ssl_server", [qw(root-name2)], [qw(ca-cert)]),
+   "fail wrong root DN");
+ok(verify("ee-cert", "ssl_server", [qw(root+serverAuth)], [qw(ca-cert)]),
+   "accept right EKU");
+ok(!verify("ee-cert", "ssl_server", [qw(root-serverAuth)], [qw(ca-cert)]),
+   "fail rejected EKU");
+ok(!verify("ee-cert", "ssl_server", [qw(root+clientAuth)], [qw(ca-cert)]),
+   "fail wrong EKU");
+
+# CA variants
+ok(!verify("ee-cert", "ssl_server", [qw(root-cert)], [qw(ca-nonca)]),
+   "fail non-CA");
+ok(!verify("ee-cert", "ssl_server", [qw(root-cert)], [qw(ca-cert2)]),
+   "fail wrong CA key");
+ok(!verify("ee-cert", "ssl_server", [qw(root-cert)], [qw(ca-name2)]),
+   "fail wrong CA DN");
+ok(!verify("ee-cert", "ssl_server", [qw(root-cert)], [qw(ca-root2)]),
+   "fail wrong CA issuer");
+ok(!verify("ee-cert", "ssl_server", [], [qw(ca-cert)], "-partial_chain"),
+   "fail untrusted partial");
+ok(!verify("ee-cert", "ssl_server", [], [qw(ca+serverAuth)], "-partial_chain"),
+   "fail untrusted EKU partial");
+ok(verify("ee-cert", "ssl_server", [qw(ca+serverAuth)], [], "-partial_chain"),
+   "accept trusted EKU partial");
+ok(!verify("ee-cert", "ssl_server", [qw(ca-serverAuth)], [], "-partial_chain"),
+   "fail rejected EKU partial");
+ok(!verify("ee-cert", "ssl_server", [qw(ca+clientAuth)], [], "-partial_chain"),
+   "fail wrong EKU partial");
+
+# EE variants
+ok(verify("ee-client", "ssl_client", [qw(root-cert)], [qw(ca-cert)]),
+   "accept client cert");
+ok(!verify("ee-client", "ssl_server", [qw(root-cert)], [qw(ca-cert)]),
+   "fail wrong leaf purpose");
+ok(!verify("ee-cert", "ssl_client", [qw(root-cert)], [qw(ca-cert)]),
+   "fail wrong leaf purpose");
+ok(!verify("ee-cert2", "ssl_server", [qw(root-cert)], [qw(ca-cert)]),
+   "fail wrong CA key");
+ok(!verify("ee-name2", "ssl_server", [qw(root-cert)], [qw(ca-cert)]),
+   "fail wrong CA name");
+ok(!verify("ee-expired", "ssl_server", [qw(root-cert)], [qw(ca-cert)]),
+   "fail expired leaf");
+ok(verify("ee-cert", "ssl_server", [qw(ee-cert)], [], "-partial_chain"),
+   "accept last-resort direct leaf match");
+ok(verify("ee-client", "ssl_client", [qw(ee-client)], [], "-partial_chain"),
+   "accept last-resort direct leaf match");
+ok(!verify("ee-cert", "ssl_server", [qw(ee-client)], [], "-partial_chain"),
+   "fail last-resort direct leaf non-match");
+ok(verify("ee-cert", "ssl_server", [qw(ee+serverAuth)], [], "-partial_chain"),
+   "accept direct match with trusted EKU");
+ok(!verify("ee-cert", "ssl_server", [qw(ee-serverAuth)], [], "-partial_chain"),
+   "reject direct match with rejected EKU");
+ok(verify("ee-client", "ssl_client", [qw(ee+clientAuth)], [], "-partial_chain"),
+   "accept direct match with trusted EKU");
+ok(!verify("ee-client", "ssl_client", [qw(ee-clientAuth)], [], "-partial_chain"),
+   "reject direct match with rejected EKU");