crltest.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396
  1. /*
  2. * Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include "internal/nelem.h"
  10. #include <string.h>
  11. #include <openssl/bio.h>
  12. #include <openssl/crypto.h>
  13. #include <openssl/err.h>
  14. #include <openssl/pem.h>
  15. #include <openssl/x509.h>
  16. #include "testutil.h"
  17. DEFINE_STACK_OF(X509)
  18. DEFINE_STACK_OF(X509_CRL)
  19. #define PARAM_TIME 1474934400 /* Sep 27th, 2016 */
  20. static const char *kCRLTestRoot[] = {
  21. "-----BEGIN CERTIFICATE-----\n",
  22. "MIIDbzCCAlegAwIBAgIJAODri7v0dDUFMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV\n",
  23. "BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW\n",
  24. "aWV3MRIwEAYDVQQKDAlCb3JpbmdTU0wwHhcNMTYwOTI2MTUwNjI2WhcNMjYwOTI0\n",
  25. "MTUwNjI2WjBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG\n",
  26. "A1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9yaW5nU1NMMIIBIjANBgkq\n",
  27. "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3B\n",
  28. "S/dUBpbrzd1aeFzNlI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+\n",
  29. "5R/Du0iCb1tCZIPY07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWp\n",
  30. "uRqO6rctN9qUoMlTIAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n\n",
  31. "8H922qmvPNA9idmX9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbL\n",
  32. "P2o9orxGx7aCtnnBZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABo1Aw\n",
  33. "TjAdBgNVHQ4EFgQUWPt3N5cZ/CRvubbrkqfBnAqhq94wHwYDVR0jBBgwFoAUWPt3\n",
  34. "N5cZ/CRvubbrkqfBnAqhq94wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n",
  35. "AQEAORu6M0MOwXy+3VEBwNilfTxyqDfruQsc1jA4PT8Oe8zora1WxE1JB4q2FJOz\n",
  36. "EAuM3H/NXvEnBuN+ITvKZAJUfm4NKX97qmjMJwLKWe1gVv+VQTr63aR7mgWJReQN\n",
  37. "XdMztlVeZs2dppV6uEg3ia1X0G7LARxGpA9ETbMyCpb39XxlYuTClcbA5ftDN99B\n",
  38. "3Xg9KNdd++Ew22O3HWRDvdDpTO/JkzQfzi3sYwUtzMEonENhczJhGf7bQMmvL/w5\n",
  39. "24Wxj4Z7KzzWIHsNqE/RIs6RV3fcW61j/mRgW2XyoWnMVeBzvcJr9NXp4VQYmFPw\n",
  40. "amd8GKMZQvP0ufGnUn7D7uartA==\n",
  41. "-----END CERTIFICATE-----\n",
  42. NULL
  43. };
  44. static const char *kCRLTestLeaf[] = {
  45. "-----BEGIN CERTIFICATE-----\n",
  46. "MIIDkDCCAnigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCVVMx\n",
  47. "EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEjAQ\n",
  48. "BgNVBAoMCUJvcmluZ1NTTDAeFw0xNjA5MjYxNTA4MzFaFw0xNzA5MjYxNTA4MzFa\n",
  49. "MEsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQKDAlC\n",
  50. "b3JpbmdTU0wxEzARBgNVBAMMCmJvcmluZy5zc2wwggEiMA0GCSqGSIb3DQEBAQUA\n",
  51. "A4IBDwAwggEKAoIBAQDc5v1S1M0W+QWM+raWfO0LH8uvqEwuJQgODqMaGnSlWUx9\n",
  52. "8iQcnWfjyPja3lWg9K62hSOFDuSyEkysKHDxijz5R93CfLcfnVXjWQDJe7EJTTDP\n",
  53. "ozEvxN6RjAeYv7CF000euYr3QT5iyBjg76+bon1p0jHZBJeNPP1KqGYgyxp+hzpx\n",
  54. "e0gZmTlGAXd8JQK4v8kpdYwD6PPifFL/jpmQpqOtQmH/6zcLjY4ojmqpEdBqIKIX\n",
  55. "+saA29hMq0+NK3K+wgg31RU+cVWxu3tLOIiesETkeDgArjWRS1Vkzbi4v9SJxtNu\n",
  56. "OZuAxWiynRJw3JwH/OFHYZIvQqz68ZBoj96cepjPAgMBAAGjezB5MAkGA1UdEwQC\n",
  57. "MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl\n",
  58. "MB0GA1UdDgQWBBTGn0OVVh/aoYt0bvEKG+PIERqnDzAfBgNVHSMEGDAWgBRY+3c3\n",
  59. "lxn8JG+5tuuSp8GcCqGr3jANBgkqhkiG9w0BAQsFAAOCAQEAd2nM8gCQN2Dc8QJw\n",
  60. "XSZXyuI3DBGGCHcay/3iXu0JvTC3EiQo8J6Djv7WLI0N5KH8mkm40u89fJAB2lLZ\n",
  61. "ShuHVtcC182bOKnePgwp9CNwQ21p0rDEu/P3X46ZvFgdxx82E9xLa0tBB8PiPDWh\n",
  62. "lV16jbaKTgX5AZqjnsyjR5o9/mbZVupZJXx5Syq+XA8qiJfstSYJs4KyKK9UOjql\n",
  63. "ICkJVKpi2ahDBqX4MOH4SLfzVk8pqSpviS6yaA1RXqjpkxiN45WWaXDldVHMSkhC\n",
  64. "5CNXsXi4b1nAntu89crwSLA3rEwzCWeYj+BX7e1T9rr3oJdwOU/2KQtW1js1yQUG\n",
  65. "tjJMFw==\n",
  66. "-----END CERTIFICATE-----\n",
  67. NULL
  68. };
  69. static const char *kBasicCRL[] = {
  70. "-----BEGIN X509 CRL-----\n",
  71. "MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
  72. "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
  73. "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV\n",
  74. "HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN\n",
  75. "ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo\n",
  76. "eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os\n",
  77. "dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv\n",
  78. "diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho\n",
  79. "/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==\n",
  80. "-----END X509 CRL-----\n",
  81. NULL
  82. };
  83. static const char *kRevokedCRL[] = {
  84. "-----BEGIN X509 CRL-----\n",
  85. "MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
  86. "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
  87. "Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX\n",
  88. "DTE2MDkyNjE1MTIyNlqgDjAMMAoGA1UdFAQDAgECMA0GCSqGSIb3DQEBCwUAA4IB\n",
  89. "AQCUGaM4DcWzlQKrcZvI8TMeR8BpsvQeo5BoI/XZu2a8h//PyRyMwYeaOM+3zl0d\n",
  90. "sjgCT8b3C1FPgT+P2Lkowv7rJ+FHJRNQkogr+RuqCSPTq65ha4WKlRGWkMFybzVH\n",
  91. "NloxC+aU3lgp/NlX9yUtfqYmJek1CDrOOGPrAEAwj1l/BUeYKNGqfBWYJQtPJu+5\n",
  92. "OaSvIYGpETCZJscUWODmLEb/O3DM438vLvxonwGqXqS0KX37+CHpUlyhnSovxXxp\n",
  93. "Pz4aF+L7OtczxL0GYtD2fR9B7TDMqsNmHXgQrixvvOY7MUdLGbd4RfJL3yA53hyO\n",
  94. "xzfKY2TzxLiOmctG0hXFkH5J\n",
  95. "-----END X509 CRL-----\n",
  96. NULL
  97. };
  98. static const char *kBadIssuerCRL[] = {
  99. "-----BEGIN X509 CRL-----\n",
  100. "MIIBwjCBqwIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
  101. "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEWMBQGA1UECgwN\n",
  102. "Tm90IEJvcmluZ1NTTBcNMTYwOTI2MTUxMjQ0WhcNMTYxMDI2MTUxMjQ0WjAVMBMC\n",
  103. "AhAAFw0xNjA5MjYxNTEyMjZaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsF\n",
  104. "AAOCAQEAlBmjOA3Fs5UCq3GbyPEzHkfAabL0HqOQaCP12btmvIf/z8kcjMGHmjjP\n",
  105. "t85dHbI4Ak/G9wtRT4E/j9i5KML+6yfhRyUTUJKIK/kbqgkj06uuYWuFipURlpDB\n",
  106. "cm81RzZaMQvmlN5YKfzZV/clLX6mJiXpNQg6zjhj6wBAMI9ZfwVHmCjRqnwVmCUL\n",
  107. "TybvuTmkryGBqREwmSbHFFjg5ixG/ztwzON/Ly78aJ8Bql6ktCl9+/gh6VJcoZ0q\n",
  108. "L8V8aT8+Ghfi+zrXM8S9BmLQ9n0fQe0wzKrDZh14EK4sb7zmOzFHSxm3eEXyS98g\n",
  109. "Od4cjsc3ymNk88S4jpnLRtIVxZB+SQ==\n",
  110. "-----END X509 CRL-----\n",
  111. NULL
  112. };
  113. /*
  114. * This is kBasicCRL but with a critical issuing distribution point
  115. * extension.
  116. */
  117. static const char *kKnownCriticalCRL[] = {
  118. "-----BEGIN X509 CRL-----\n",
  119. "MIIBujCBowIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
  120. "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
  121. "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCEwHzAKBgNV\n",
  122. "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wDQYJKoZIhvcNAQELBQADggEBAA+3\n",
  123. "i+5e5Ub8sccfgOBs6WVJFI9c8gvJjrJ8/dYfFIAuCyeocs7DFXn1n13CRZ+URR/Q\n",
  124. "mVWgU28+xeusuSPYFpd9cyYTcVyNUGNTI3lwgcE/yVjPaOmzSZKdPakApRxtpKKQ\n",
  125. "NN/56aQz3bnT/ZSHQNciRB8U6jiD9V30t0w+FDTpGaG+7bzzUH3UVF9xf9Ctp60A\n",
  126. "3mfLe0scas7owSt4AEFuj2SPvcE7yvdOXbu+IEv21cEJUVExJAbhvIweHXh6yRW+\n",
  127. "7VVeiNzdIjkZjyTmAzoXGha4+wbxXyBRbfH+XWcO/H+8nwyG8Gktdu2QB9S9nnIp\n",
  128. "o/1TpfOMSGhMyMoyPrk=\n",
  129. "-----END X509 CRL-----\n",
  130. NULL
  131. };
  132. /*
  133. * kUnknownCriticalCRL is kBasicCRL but with an unknown critical extension.
  134. */
  135. static const char *kUnknownCriticalCRL[] = {
  136. "-----BEGIN X509 CRL-----\n",
  137. "MIIBvDCBpQIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
  138. "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
  139. "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCMwITAKBgNV\n",
  140. "HRQEAwIBATATBgwqhkiG9xIEAYS3CQABAf8EADANBgkqhkiG9w0BAQsFAAOCAQEA\n",
  141. "GvBP0xqL509InMj/3493YVRV+ldTpBv5uTD6jewzf5XdaxEQ/VjTNe5zKnxbpAib\n",
  142. "Kf7cwX0PMSkZjx7k7kKdDlEucwVvDoqC+O9aJcqVmM6GDyNb9xENxd0XCXja6MZC\n",
  143. "yVgP4AwLauB2vSiEprYJyI1APph3iAEeDm60lTXX/wBM/tupQDDujKh2GPyvBRfJ\n",
  144. "+wEDwGg3ICwvu4gO4zeC5qnFR+bpL9t5tOMAQnVZ0NWv+k7mkd2LbHdD44dxrfXC\n",
  145. "nhtfERx99SDmC/jtUAJrGhtCO8acr7exCeYcduN7KKCm91OeCJKK6OzWst0Og1DB\n",
  146. "kwzzU2rL3G65CrZ7H0SZsQ==\n",
  147. "-----END X509 CRL-----\n",
  148. NULL
  149. };
  150. /*
  151. * kUnknownCriticalCRL2 is kBasicCRL but with a critical issuing distribution
  152. * point extension followed by an unknown critical extension
  153. */
  154. static const char *kUnknownCriticalCRL2[] = {
  155. "-----BEGIN X509 CRL-----\n",
  156. "MIIBzzCBuAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
  157. "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
  158. "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoDYwNDAKBgNV\n",
  159. "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wEwYMKoZIhvcSBAGEtwkAAQH/BAAw\n",
  160. "DQYJKoZIhvcNAQELBQADggEBACTcpQC8jXL12JN5YzOcQ64ubQIe0XxRAd30p7qB\n",
  161. "BTXGpgqBjrjxRfLms7EBYodEXB2oXMsDq3km0vT1MfYdsDD05S+SQ9CDsq/pUfaC\n",
  162. "E2WNI5p8WircRnroYvbN2vkjlRbMd1+yNITohXYXCJwjEOAWOx3XIM10bwPYBv4R\n",
  163. "rDobuLHoMgL3yHgMHmAkP7YpkBucNqeBV8cCdeAZLuhXFWi6yfr3r/X18yWbC/r2\n",
  164. "2xXdkrSqXLFo7ToyP8YKTgiXpya4x6m53biEYwa2ULlas0igL6DK7wjYZX95Uy7H\n",
  165. "GKljn9weIYiMPV/BzGymwfv2EW0preLwtyJNJPaxbdin6Jc=\n",
  166. "-----END X509 CRL-----\n",
  167. NULL
  168. };
  169. static const char **unknown_critical_crls[] = {
  170. kUnknownCriticalCRL, kUnknownCriticalCRL2
  171. };
  172. static X509 *test_root = NULL;
  173. static X509 *test_leaf = NULL;
  174. /*
  175. * Glue an array of strings together. Return a BIO and put the string
  176. * into |*out| so we can free it.
  177. */
  178. static BIO *glue2bio(const char **pem, char **out)
  179. {
  180. size_t s = 0;
  181. *out = glue_strings(pem, &s);
  182. return BIO_new_mem_buf(*out, s);
  183. }
  184. /*
  185. * Create a CRL from an array of strings.
  186. */
  187. static X509_CRL *CRL_from_strings(const char **pem)
  188. {
  189. char *p;
  190. BIO *b = glue2bio(pem, &p);
  191. X509_CRL *crl = PEM_read_bio_X509_CRL(b, NULL, NULL, NULL);
  192. OPENSSL_free(p);
  193. BIO_free(b);
  194. return crl;
  195. }
  196. /*
  197. * Create an X509 from an array of strings.
  198. */
  199. static X509 *X509_from_strings(const char **pem)
  200. {
  201. char *p;
  202. BIO *b = glue2bio(pem, &p);
  203. X509 *x = PEM_read_bio_X509(b, NULL, NULL, NULL);
  204. OPENSSL_free(p);
  205. BIO_free(b);
  206. return x;
  207. }
  208. /*
  209. * Verify |leaf| certificate (chained up to |root|). |crls| if
  210. * not NULL, is a list of CRLs to include in the verification. It is
  211. * also free'd before returning, which is kinda yucky but convenient.
  212. * Returns a value from X509_V_ERR_xxx or X509_V_OK.
  213. */
  214. static int verify(X509 *leaf, X509 *root, STACK_OF(X509_CRL) *crls,
  215. unsigned long flags)
  216. {
  217. X509_STORE_CTX *ctx = X509_STORE_CTX_new();
  218. X509_STORE *store = X509_STORE_new();
  219. X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
  220. STACK_OF(X509) *roots = sk_X509_new_null();
  221. int status = X509_V_ERR_UNSPECIFIED;
  222. if (!TEST_ptr(ctx)
  223. || !TEST_ptr(store)
  224. || !TEST_ptr(param)
  225. || !TEST_ptr(roots))
  226. goto err;
  227. /* Create a stack; upref the cert because we free it below. */
  228. X509_up_ref(root);
  229. if (!TEST_true(sk_X509_push(roots, root))
  230. || !TEST_true(X509_STORE_CTX_init(ctx, store, leaf, NULL)))
  231. goto err;
  232. X509_STORE_CTX_set0_trusted_stack(ctx, roots);
  233. X509_STORE_CTX_set0_crls(ctx, crls);
  234. X509_VERIFY_PARAM_set_time(param, PARAM_TIME);
  235. if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param), PARAM_TIME))
  236. goto err;
  237. X509_VERIFY_PARAM_set_depth(param, 16);
  238. if (flags)
  239. X509_VERIFY_PARAM_set_flags(param, flags);
  240. X509_STORE_CTX_set0_param(ctx, param);
  241. param = NULL;
  242. ERR_clear_error();
  243. status = X509_verify_cert(ctx) == 1 ? X509_V_OK
  244. : X509_STORE_CTX_get_error(ctx);
  245. err:
  246. sk_X509_pop_free(roots, X509_free);
  247. sk_X509_CRL_pop_free(crls, X509_CRL_free);
  248. X509_VERIFY_PARAM_free(param);
  249. X509_STORE_CTX_free(ctx);
  250. X509_STORE_free(store);
  251. return status;
  252. }
  253. /*
  254. * Create a stack of CRL's. Upref each one because we call pop_free on
  255. * the stack and need to keep the CRL's around until the test exits.
  256. * Yes this crashes on malloc failure; it forces us to debug.
  257. */
  258. static STACK_OF(X509_CRL) *make_CRL_stack(X509_CRL *x1, X509_CRL *x2)
  259. {
  260. STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null();
  261. sk_X509_CRL_push(sk, x1);
  262. X509_CRL_up_ref(x1);
  263. if (x2 != NULL) {
  264. sk_X509_CRL_push(sk, x2);
  265. X509_CRL_up_ref(x2);
  266. }
  267. return sk;
  268. }
  269. static int test_basic_crl(void)
  270. {
  271. X509_CRL *basic_crl = CRL_from_strings(kBasicCRL);
  272. X509_CRL *revoked_crl = CRL_from_strings(kRevokedCRL);
  273. int r;
  274. r = TEST_ptr(basic_crl)
  275. && TEST_ptr(revoked_crl)
  276. && TEST_int_eq(verify(test_leaf, test_root,
  277. make_CRL_stack(basic_crl, NULL),
  278. X509_V_FLAG_CRL_CHECK), X509_V_OK)
  279. && TEST_int_eq(verify(test_leaf, test_root,
  280. make_CRL_stack(basic_crl, revoked_crl),
  281. X509_V_FLAG_CRL_CHECK), X509_V_ERR_CERT_REVOKED);
  282. X509_CRL_free(basic_crl);
  283. X509_CRL_free(revoked_crl);
  284. return r;
  285. }
  286. static int test_no_crl(void)
  287. {
  288. return TEST_int_eq(verify(test_leaf, test_root, NULL,
  289. X509_V_FLAG_CRL_CHECK),
  290. X509_V_ERR_UNABLE_TO_GET_CRL);
  291. }
  292. static int test_bad_issuer_crl(void)
  293. {
  294. X509_CRL *bad_issuer_crl = CRL_from_strings(kBadIssuerCRL);
  295. int r;
  296. r = TEST_ptr(bad_issuer_crl)
  297. && TEST_int_eq(verify(test_leaf, test_root,
  298. make_CRL_stack(bad_issuer_crl, NULL),
  299. X509_V_FLAG_CRL_CHECK),
  300. X509_V_ERR_UNABLE_TO_GET_CRL);
  301. X509_CRL_free(bad_issuer_crl);
  302. return r;
  303. }
  304. static int test_known_critical_crl(void)
  305. {
  306. X509_CRL *known_critical_crl = CRL_from_strings(kKnownCriticalCRL);
  307. int r;
  308. r = TEST_ptr(known_critical_crl)
  309. && TEST_int_eq(verify(test_leaf, test_root,
  310. make_CRL_stack(known_critical_crl, NULL),
  311. X509_V_FLAG_CRL_CHECK), X509_V_OK);
  312. X509_CRL_free(known_critical_crl);
  313. return r;
  314. }
  315. static int test_unknown_critical_crl(int n)
  316. {
  317. X509_CRL *unknown_critical_crl = CRL_from_strings(unknown_critical_crls[n]);
  318. int r;
  319. r = TEST_ptr(unknown_critical_crl)
  320. && TEST_int_eq(verify(test_leaf, test_root,
  321. make_CRL_stack(unknown_critical_crl, NULL),
  322. X509_V_FLAG_CRL_CHECK),
  323. X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION);
  324. X509_CRL_free(unknown_critical_crl);
  325. return r;
  326. }
  327. static int test_reuse_crl(void)
  328. {
  329. X509_CRL *reused_crl = CRL_from_strings(kBasicCRL);
  330. char *p;
  331. BIO *b = glue2bio(kRevokedCRL, &p);
  332. reused_crl = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL);
  333. OPENSSL_free(p);
  334. BIO_free(b);
  335. X509_CRL_free(reused_crl);
  336. return 1;
  337. }
  338. int setup_tests(void)
  339. {
  340. if (!TEST_ptr(test_root = X509_from_strings(kCRLTestRoot))
  341. || !TEST_ptr(test_leaf = X509_from_strings(kCRLTestLeaf)))
  342. return 0;
  343. ADD_TEST(test_no_crl);
  344. ADD_TEST(test_basic_crl);
  345. ADD_TEST(test_bad_issuer_crl);
  346. ADD_TEST(test_known_critical_crl);
  347. ADD_ALL_TESTS(test_unknown_critical_crl, OSSL_NELEM(unknown_critical_crls));
  348. ADD_TEST(test_reuse_crl);
  349. return 1;
  350. }
  351. void cleanup_tests(void)
  352. {
  353. X509_free(test_root);
  354. X509_free(test_leaf);
  355. }