1 /*
2 * Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include "internal/nelem.h"
11 #include <string.h>
12 #include <time.h>
13 #include <openssl/bio.h>
14 #include <openssl/crypto.h>
15 #include <openssl/err.h>
16 #include <openssl/pem.h>
17 #include <openssl/x509.h>
18
19 #include "testutil.h"
20
21 /*
22 * We cannot use old certificates for new tests because the private key
23 * associated with them is no longer available. Therefore, we add kCRLTestLeaf,
24 * kCRLTestLeaf2 and PARAM_TIME2, as well as pass the verification time to the
25 * verify function as a parameter. Certificates and CRL from
26 * https://github.com/openssl/openssl/issues/27506 are used.
27 */
28
29 static const char *kRoot[] = {
30 "-----BEGIN CERTIFICATE-----\n",
31 "MIIEFjCCAv6gAwIBAgIUQR1kHB+/IzJcfAT/HHVPp+wPmxwwDQYJKoZIhvcNAQEL\n",
32 "BQAwgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQH\n",
33 "DA1TYW4gRnJhbmNpc2NvMRUwEwYDVQQKDAxFeGFtcGxlIENvcnAxHjAcBgNVBAsM\n",
34 "FUNlcnRpZmljYXRlIEF1dGhvcml0eTEdMBsGA1UEAwwURXhhbXBsZSBDb3JwIFJv\n",
35 "b3QgQ0EwHhcNMjYwMzEwMTEzMDUzWhcNMzYwMzA3MTEzMDUzWjCBkDELMAkGA1UE\n",
36 "BhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lz\n",
37 "Y28xFTATBgNVBAoMDEV4YW1wbGUgQ29ycDEeMBwGA1UECwwVQ2VydGlmaWNhdGUg\n",
38 "QXV0aG9yaXR5MR0wGwYDVQQDDBRFeGFtcGxlIENvcnAgUm9vdCBDQTCCASIwDQYJ\n",
39 "KoZIhvcNAQEBBQADggEPADCCAQoCggEBALm21ITU+2o6ZHWukCyBw9H270fSABYT\n",
40 "rl8lhPCcTXynW9tBeHAaV50WMiOxBl+thfv1fGS3t8BbyjEjP3I5LAkBS9dTUI7F\n",
41 "PSQnngBgKvKrpsnsiJXVhNOISm6GfT/EXj1NWKLXR3MXGIGfiVud5ln9CQxzaq3e\n",
42 "TzW8X8zsdv6WGaeRIBm48QYe8TkK/TDmvoYZ7fD9lPMk3AUoNasZfuPeGpzh1cBR\n",
43 "bfvOYEHJQ31+GFzrJFldqoaq/k0If/khwVgjOdmF+R25OCF0jsrMjmZ42Qr2cNrd\n",
44 "VYEIjQL2R1grCVCGaIagzQuyN0Qvvl5BXsHKI51TpDQlq9SFkCOvRckCAwEAAaNm\n",
45 "MGQwHQYDVR0OBBYEFP4UDhMbCWfLSg1L2k/z75C1Q9szMB8GA1UdIwQYMBaAFP4U\n",
46 "DhMbCWfLSg1L2k/z75C1Q9szMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/\n",
47 "BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQBcYi8b4tetG18ElSqF/CJkjm93xS6k\n",
48 "tk4jia0k+79FSAvy/TlcarBAe3PwlLA7GcLYDUmmM7GCiEMf91+c6dOmKkIdbw1B\n",
49 "FILQBnghZ9s+xl0+n1P0775dDWc0msXhXci/wcRK3HFqxEOXQUkDYZwrq1gXBESr\n",
50 "6yjpYe2RFKQUdnW+yrMlY1QyGNhelV7//BbSG8fD1esU7VaBE0wF/b8Ly2ykK5QE\n",
51 "d6XUwqTT6sIlcyxVGUgEMVj7kSZUQJ2LS/ze/r+a1FeC2I0UljD78UB+I40FafZe\n",
52 "pLLvkABIXRqtOiZ5YkdEK3Z4xI0yqSZC3og4jHsoCrfWbXasRieYR7dT\n",
53 "-----END CERTIFICATE-----\n",
54 NULL
55 };
56
57 #define PARAM_TIME 1474934400 /* Sep 27th, 2016 */
58 #define PARAM_TIME2 1753284700 /* July 23th, 2025 */
59
60 static const char *kCRLTestRoot[] = {
61 "-----BEGIN CERTIFICATE-----\n",
62 "MIIDbzCCAlegAwIBAgIJAODri7v0dDUFMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV\n",
63 "BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW\n",
64 "aWV3MRIwEAYDVQQKDAlCb3JpbmdTU0wwHhcNMTYwOTI2MTUwNjI2WhcNMjYwOTI0\n",
65 "MTUwNjI2WjBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG\n",
66 "A1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9yaW5nU1NMMIIBIjANBgkq\n",
67 "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3B\n",
68 "S/dUBpbrzd1aeFzNlI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+\n",
69 "5R/Du0iCb1tCZIPY07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWp\n",
70 "uRqO6rctN9qUoMlTIAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n\n",
71 "8H922qmvPNA9idmX9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbL\n",
72 "P2o9orxGx7aCtnnBZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABo1Aw\n",
73 "TjAdBgNVHQ4EFgQUWPt3N5cZ/CRvubbrkqfBnAqhq94wHwYDVR0jBBgwFoAUWPt3\n",
74 "N5cZ/CRvubbrkqfBnAqhq94wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n",
75 "AQEAORu6M0MOwXy+3VEBwNilfTxyqDfruQsc1jA4PT8Oe8zora1WxE1JB4q2FJOz\n",
76 "EAuM3H/NXvEnBuN+ITvKZAJUfm4NKX97qmjMJwLKWe1gVv+VQTr63aR7mgWJReQN\n",
77 "XdMztlVeZs2dppV6uEg3ia1X0G7LARxGpA9ETbMyCpb39XxlYuTClcbA5ftDN99B\n",
78 "3Xg9KNdd++Ew22O3HWRDvdDpTO/JkzQfzi3sYwUtzMEonENhczJhGf7bQMmvL/w5\n",
79 "24Wxj4Z7KzzWIHsNqE/RIs6RV3fcW61j/mRgW2XyoWnMVeBzvcJr9NXp4VQYmFPw\n",
80 "amd8GKMZQvP0ufGnUn7D7uartA==\n",
81 "-----END CERTIFICATE-----\n",
82 NULL
83 };
84
85 static const char *kCRLTestLeaf[] = {
86 "-----BEGIN CERTIFICATE-----\n",
87 "MIIDkDCCAnigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCVVMx\n",
88 "EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEjAQ\n",
89 "BgNVBAoMCUJvcmluZ1NTTDAeFw0xNjA5MjYxNTA4MzFaFw0xNzA5MjYxNTA4MzFa\n",
90 "MEsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQKDAlC\n",
91 "b3JpbmdTU0wxEzARBgNVBAMMCmJvcmluZy5zc2wwggEiMA0GCSqGSIb3DQEBAQUA\n",
92 "A4IBDwAwggEKAoIBAQDc5v1S1M0W+QWM+raWfO0LH8uvqEwuJQgODqMaGnSlWUx9\n",
93 "8iQcnWfjyPja3lWg9K62hSOFDuSyEkysKHDxijz5R93CfLcfnVXjWQDJe7EJTTDP\n",
94 "ozEvxN6RjAeYv7CF000euYr3QT5iyBjg76+bon1p0jHZBJeNPP1KqGYgyxp+hzpx\n",
95 "e0gZmTlGAXd8JQK4v8kpdYwD6PPifFL/jpmQpqOtQmH/6zcLjY4ojmqpEdBqIKIX\n",
96 "+saA29hMq0+NK3K+wgg31RU+cVWxu3tLOIiesETkeDgArjWRS1Vkzbi4v9SJxtNu\n",
97 "OZuAxWiynRJw3JwH/OFHYZIvQqz68ZBoj96cepjPAgMBAAGjezB5MAkGA1UdEwQC\n",
98 "MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl\n",
99 "MB0GA1UdDgQWBBTGn0OVVh/aoYt0bvEKG+PIERqnDzAfBgNVHSMEGDAWgBRY+3c3\n",
100 "lxn8JG+5tuuSp8GcCqGr3jANBgkqhkiG9w0BAQsFAAOCAQEAd2nM8gCQN2Dc8QJw\n",
101 "XSZXyuI3DBGGCHcay/3iXu0JvTC3EiQo8J6Djv7WLI0N5KH8mkm40u89fJAB2lLZ\n",
102 "ShuHVtcC182bOKnePgwp9CNwQ21p0rDEu/P3X46ZvFgdxx82E9xLa0tBB8PiPDWh\n",
103 "lV16jbaKTgX5AZqjnsyjR5o9/mbZVupZJXx5Syq+XA8qiJfstSYJs4KyKK9UOjql\n",
104 "ICkJVKpi2ahDBqX4MOH4SLfzVk8pqSpviS6yaA1RXqjpkxiN45WWaXDldVHMSkhC\n",
105 "5CNXsXi4b1nAntu89crwSLA3rEwzCWeYj+BX7e1T9rr3oJdwOU/2KQtW1js1yQUG\n",
106 "tjJMFw==\n",
107 "-----END CERTIFICATE-----\n",
108 NULL
109 };
110
111 static const char *kCRLTestRoot2[] = {
112 "-----BEGIN CERTIFICATE-----\n",
113 "MIID4zCCAsugAwIBAgIUGTcyNat9hTOo8nnGdzF7MTzL9WAwDQYJKoZIhvcNAQEL\n",
114 "BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM\n",
115 "DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk15IENvbXBhbnkxEzARBgNVBAMMCk15\n",
116 "IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJvb3QgQ0EwHhcNMjUwMzAzMDcxNDA0WhcN\n",
117 "MzUwMzAxMDcxNDA0WjB5MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p\n",
118 "YTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKTXkgQ29tcGFueTET\n",
119 "MBEGA1UEAwwKTXkgUm9vdCBDQTETMBEGA1UECwwKTXkgUm9vdCBDQTCCASIwDQYJ\n",
120 "KoZIhvcNAQEBBQADggEPADCCAQoCggEBAN6jjwkmV+pse430MQfyaWv+JtAd2r6K\n",
121 "qzEquBcoofzuf/yvdEhQPjK3bcotgfEcFq3QMo1MJ7vqRHEIu0hJ+5ZnEQtIRcrg\n",
122 "Vm7/EoVCBpDc9BDtW40TDp69z9kaKyyKYy6rxmSKgJydGBeGGMwBxgTK/o0xAriC\n",
123 "C3lLXHT8G8YMamKUpToPL5iCRX+GJPnnizB2ODvpQGMWkbp9+1xEc4dD7Db2wfUb\n",
124 "gatDYUoGndQKWD49UhURavQZeLpDxlz93YutRRkZTWc4IB7WebiEb39BDjSP3QYm\n",
125 "2h+rZYyjp3Gxy8pBNTPzE9Dk4yjiqS7o3WGvi/S6zKTLDvWl9t6pMOMCAwEAAaNj\n",
126 "MGEwHQYDVR0OBBYEFNdhiR+Tlot2VBbp5XfcfLdlG4AkMA4GA1UdDwEB/wQEAwIB\n",
127 "hjAfBgNVHSMEGDAWgBTXYYkfk5aLdlQW6eV33Hy3ZRuAJDAPBgNVHRMBAf8EBTAD\n",
128 "AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCvwutY0WMcKoqulifnYfhxGLtXSSvD2GET\n",
129 "uNRv+S1KI5JKcAdfvnbNDpUwlujMDIpe3ewmv9i6kcitpHwZXdVAw6KWagJ0kDSt\n",
130 "jbArJxuuuFmSFDS7kj8x7FZok5quAWDSSg+ubV2tCVxmDuTs1WXJXD3l9g+3J9GU\n",
131 "kyeFMKqwRp8w22vm9ilgXrzeesAmmAg/pEb56ljTPeaONQxVe7KJhv2q8J17sML8\n",
132 "BE7TdVx7UFQbO/t9XqdT5O9eF8JUx4Vn4QSr+jdjJ/ns4T3/IC9dJq9k7tjD48iA\n",
133 "TNc+7x+uj8P39VA96HpjujVakj8/qn5SQMPJgDds+MSXrX+6JBWm\n",
134 "-----END CERTIFICATE-----\n",
135 NULL
136 };
137
138 static const char *kCRLTestLeaf2[] = {
139 "-----BEGIN CERTIFICATE-----\n",
140 "MIIECjCCAvKgAwIBAgIUPxuMqMtuN1j3XZVRVrNmaTCIP04wDQYJKoZIhvcNAQEL\n",
141 "BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM\n",
142 "DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk15IENvbXBhbnkxEzARBgNVBAMMCk15\n",
143 "IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJvb3QgQ0EwHhcNMjUwNDE3MTAxNjQ5WhcN\n",
144 "MjYwNDE3MTAxNjQ5WjBoMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHQmVpamluZzEQ\n",
145 "MA4GA1UEBwwHQmVpamluZzEYMBYGA1UECgwPTXkgT3JnYW5pemF0aW9uMRswGQYD\n",
146 "VQQDDBJNeSBJbnRlcm1lZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n",
147 "ggEKAoIBAQDIxRxZQokflDaLYoD21HT2U4EshqtKpSf9zPS5unBMCfnQkU4IJjBF\n",
148 "3qQmfgz5ZOpZv3x0w48fDjiysk0eOVCFAo+uixEjMeuln6Wj3taetch2Sk0YNm5J\n",
149 "SJCNF2olHZXn5R8ngEmho2j1wbwNnpcccZyRNzUSjR9oAgObkP3O7fyQKJRxwNU0\n",
150 "sN7mfoyEOczKtUaYbqi2gPx6OOqNLjXlLmfZ8PJagKCN/oYkGU5PoRNXp65Znhu6\n",
151 "s8FuSmvTodu8Qhs9Uizo+SycaBXn5Fbqt32S+9vPfhH9FfELDfQIaBp+iQAxcKPX\n",
152 "tUglXEjiEVrbNf722PuWIWN9EIBolULVAgMBAAGjgZowgZcwEgYDVR0TAQH/BAgw\n",
153 "BgEB/wIBATAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vbG9jYWxob3N0OjgwMDAv\n",
154 "Y2FfY3JsLmRlcjAdBgNVHQ4EFgQUh40vFgoopz5GUggPEEk2+bKgbwQwHwYDVR0j\n",
155 "BBgwFoAU12GJH5OWi3ZUFunld9x8t2UbgCQwDgYDVR0PAQH/BAQDAgGGMA0GCSqG\n",
156 "SIb3DQEBCwUAA4IBAQDANfJuTgo0vRaMPYqOeW8R4jLHdVazdGLeQQ/85vXr/Gl1\n",
157 "aL40tLp4yZbThxuxTzPzfY1OGkG69YQ/8Vo0gCEi5KjBMYPKmZISKy1MwROQ1Jfp\n",
158 "HkmyZk1TfuzG/4fN/bun2gjpDYcihf4xA4NhSVzQyvqm1N6VkTgK+bEWTOGzqw66\n",
159 "6IYPN6oVDmLbwU1EvV3rggB7HUJCJP4qW9DbAQRAijUurPUGoU2vEbrSyYkfQXCf\n",
160 "p4ouOTMl6O7bJ110SKzxbCfWqom+iAwHlU2tOPVmOp1CLDCClMRNHIFMDGAoBomH\n",
161 "s01wD+IcIi9OkQEbqVb/XDKes8fqzQgTtSM9C9Ot\n",
162 "-----END CERTIFICATE-----\n",
163 NULL
164 };
165
166 static const char *kBasicCRL[] = {
167 "-----BEGIN X509 CRL-----\n",
168 "MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
169 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
170 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV\n",
171 "HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN\n",
172 "ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo\n",
173 "eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os\n",
174 "dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv\n",
175 "diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho\n",
176 "/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==\n",
177 "-----END X509 CRL-----\n",
178 NULL
179 };
180
181 static const char *kRevokedCRL[] = {
182 "-----BEGIN X509 CRL-----\n",
183 "MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
184 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
185 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX\n",
186 "DTE2MDkyNjE1MTIyNlqgDjAMMAoGA1UdFAQDAgECMA0GCSqGSIb3DQEBCwUAA4IB\n",
187 "AQCUGaM4DcWzlQKrcZvI8TMeR8BpsvQeo5BoI/XZu2a8h//PyRyMwYeaOM+3zl0d\n",
188 "sjgCT8b3C1FPgT+P2Lkowv7rJ+FHJRNQkogr+RuqCSPTq65ha4WKlRGWkMFybzVH\n",
189 "NloxC+aU3lgp/NlX9yUtfqYmJek1CDrOOGPrAEAwj1l/BUeYKNGqfBWYJQtPJu+5\n",
190 "OaSvIYGpETCZJscUWODmLEb/O3DM438vLvxonwGqXqS0KX37+CHpUlyhnSovxXxp\n",
191 "Pz4aF+L7OtczxL0GYtD2fR9B7TDMqsNmHXgQrixvvOY7MUdLGbd4RfJL3yA53hyO\n",
192 "xzfKY2TzxLiOmctG0hXFkH5J\n",
193 "-----END X509 CRL-----\n",
194 NULL
195 };
196
197 static const char *kInvalidCRL[] = {
198 "-----BEGIN X509 CRL-----\n",
199 "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n",
200 "-----END X509 CRL-----\n",
201 NULL
202 };
203
204 static const char *kBadIssuerCRL[] = {
205 "-----BEGIN X509 CRL-----\n",
206 "MIIBwjCBqwIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
207 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEWMBQGA1UECgwN\n",
208 "Tm90IEJvcmluZ1NTTBcNMTYwOTI2MTUxMjQ0WhcNMTYxMDI2MTUxMjQ0WjAVMBMC\n",
209 "AhAAFw0xNjA5MjYxNTEyMjZaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsF\n",
210 "AAOCAQEAlBmjOA3Fs5UCq3GbyPEzHkfAabL0HqOQaCP12btmvIf/z8kcjMGHmjjP\n",
211 "t85dHbI4Ak/G9wtRT4E/j9i5KML+6yfhRyUTUJKIK/kbqgkj06uuYWuFipURlpDB\n",
212 "cm81RzZaMQvmlN5YKfzZV/clLX6mJiXpNQg6zjhj6wBAMI9ZfwVHmCjRqnwVmCUL\n",
213 "TybvuTmkryGBqREwmSbHFFjg5ixG/ztwzON/Ly78aJ8Bql6ktCl9+/gh6VJcoZ0q\n",
214 "L8V8aT8+Ghfi+zrXM8S9BmLQ9n0fQe0wzKrDZh14EK4sb7zmOzFHSxm3eEXyS98g\n",
215 "Od4cjsc3ymNk88S4jpnLRtIVxZB+SQ==\n",
216 "-----END X509 CRL-----\n",
217 NULL
218 };
219
220 static const char *kEmptyIdpCRL[] = {
221 "-----BEGIN X509 CRL-----\n",
222 "MIICOTCCASECAQEwDQYJKoZIhvcNAQELBQAweTELMAkGA1UEBhMCVVMxEzARBgNV\n",
223 "BAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoM\n",
224 "Ck15IENvbXBhbnkxEzARBgNVBAMMCk15IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJv\n",
225 "b3QgQ0EXDTI1MDEwMTAwMDAwMFoXDTI1MTIwMTAwMDAwMFowJzAlAhQcgAIu+B8k\n",
226 "Be6WphLcth/grHAeXhcNMjUwNDE3MTAxNjUxWqBLMEkwGAYDVR0UBBECDxnP/97a\n",
227 "dO3y9qRGDM7hQDAfBgNVHSMEGDAWgBTXYYkfk5aLdlQW6eV33Hy3ZRuAJDAMBgNV\n",
228 "HRwBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQAf+mtlDi9IftsYwTcxYYKxE203\n",
229 "+prttFB00om29jjtkGYRxcs3vZQRTvera21YFn3mrS/lxvhBq6GMx0I61AQ48Pr4\n",
230 "63bDvZgf+/P6T2+MLgLds23o3TOfy2SBSdnFEcN0bFUgF5U0bFpQqlQWx+FYhrAf\n",
231 "ZX3RAhURiKKfGKGeVOVKS0u+x666FoDQ7pbhbHM3+jnuzdtv8RQMkj1AZMw0FMl8\n",
232 "m2dFQhZqT9WdJqZAc8ldc6V3a0rUeOV8BUPACf1k4B0CKhn4draIqltZkWgl3cmU\n",
233 "SX2V/a51lS12orfNYSEx+vtJ9gpx4LDxyOnai18vueVyljrXuQSrcYuxS2Cd\n",
234 "-----END X509 CRL-----\n",
235 NULL
236 };
237
238 /*
239 * This is kBasicCRL but with a critical issuing distribution point
240 * extension.
241 */
242 static const char *kKnownCriticalCRL[] = {
243 "-----BEGIN X509 CRL-----\n",
244 "MIIBujCBowIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
245 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
246 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCEwHzAKBgNV\n",
247 "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wDQYJKoZIhvcNAQELBQADggEBAA+3\n",
248 "i+5e5Ub8sccfgOBs6WVJFI9c8gvJjrJ8/dYfFIAuCyeocs7DFXn1n13CRZ+URR/Q\n",
249 "mVWgU28+xeusuSPYFpd9cyYTcVyNUGNTI3lwgcE/yVjPaOmzSZKdPakApRxtpKKQ\n",
250 "NN/56aQz3bnT/ZSHQNciRB8U6jiD9V30t0w+FDTpGaG+7bzzUH3UVF9xf9Ctp60A\n",
251 "3mfLe0scas7owSt4AEFuj2SPvcE7yvdOXbu+IEv21cEJUVExJAbhvIweHXh6yRW+\n",
252 "7VVeiNzdIjkZjyTmAzoXGha4+wbxXyBRbfH+XWcO/H+8nwyG8Gktdu2QB9S9nnIp\n",
253 "o/1TpfOMSGhMyMoyPrk=\n",
254 "-----END X509 CRL-----\n",
255 NULL
256 };
257
258 /*
259 * kUnknownCriticalCRL is kBasicCRL but with an unknown critical extension.
260 */
261 static const char *kUnknownCriticalCRL[] = {
262 "-----BEGIN X509 CRL-----\n",
263 "MIIBvDCBpQIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
264 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
265 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCMwITAKBgNV\n",
266 "HRQEAwIBATATBgwqhkiG9xIEAYS3CQABAf8EADANBgkqhkiG9w0BAQsFAAOCAQEA\n",
267 "GvBP0xqL509InMj/3493YVRV+ldTpBv5uTD6jewzf5XdaxEQ/VjTNe5zKnxbpAib\n",
268 "Kf7cwX0PMSkZjx7k7kKdDlEucwVvDoqC+O9aJcqVmM6GDyNb9xENxd0XCXja6MZC\n",
269 "yVgP4AwLauB2vSiEprYJyI1APph3iAEeDm60lTXX/wBM/tupQDDujKh2GPyvBRfJ\n",
270 "+wEDwGg3ICwvu4gO4zeC5qnFR+bpL9t5tOMAQnVZ0NWv+k7mkd2LbHdD44dxrfXC\n",
271 "nhtfERx99SDmC/jtUAJrGhtCO8acr7exCeYcduN7KKCm91OeCJKK6OzWst0Og1DB\n",
272 "kwzzU2rL3G65CrZ7H0SZsQ==\n",
273 "-----END X509 CRL-----\n",
274 NULL
275 };
276
277 /*
278 * kUnknownCriticalCRL2 is kBasicCRL but with a critical issuing distribution
279 * point extension followed by an unknown critical extension
280 */
281 static const char *kUnknownCriticalCRL2[] = {
282 "-----BEGIN X509 CRL-----\n",
283 "MIIBzzCBuAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
284 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
285 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoDYwNDAKBgNV\n",
286 "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wEwYMKoZIhvcSBAGEtwkAAQH/BAAw\n",
287 "DQYJKoZIhvcNAQELBQADggEBACTcpQC8jXL12JN5YzOcQ64ubQIe0XxRAd30p7qB\n",
288 "BTXGpgqBjrjxRfLms7EBYodEXB2oXMsDq3km0vT1MfYdsDD05S+SQ9CDsq/pUfaC\n",
289 "E2WNI5p8WircRnroYvbN2vkjlRbMd1+yNITohXYXCJwjEOAWOx3XIM10bwPYBv4R\n",
290 "rDobuLHoMgL3yHgMHmAkP7YpkBucNqeBV8cCdeAZLuhXFWi6yfr3r/X18yWbC/r2\n",
291 "2xXdkrSqXLFo7ToyP8YKTgiXpya4x6m53biEYwa2ULlas0igL6DK7wjYZX95Uy7H\n",
292 "GKljn9weIYiMPV/BzGymwfv2EW0preLwtyJNJPaxbdin6Jc=\n",
293 "-----END X509 CRL-----\n",
294 NULL
295 };
296
297 static const char **unknown_critical_crls[] = {
298 kUnknownCriticalCRL, kUnknownCriticalCRL2
299 };
300
301 static X509 *test_root = NULL;
302 static X509 *test_leaf = NULL;
303 static X509 *test_root2 = NULL;
304 static X509 *test_leaf2 = NULL;
305
306 /*
307 * Glue an array of strings together. Return a BIO and put the string
308 * into |*out| so we can free it.
309 */
glue2bio(const char ** pem,char ** out)310 static BIO *glue2bio(const char **pem, char **out)
311 {
312 size_t s = 0;
313
314 *out = glue_strings(pem, &s);
315 return BIO_new_mem_buf(*out, s);
316 }
317
318 /*
319 * Create a CRL from an array of strings.
320 */
CRL_from_strings(const char ** pem)321 static X509_CRL *CRL_from_strings(const char **pem)
322 {
323 X509_CRL *crl;
324 char *p;
325 BIO *b = glue2bio(pem, &p);
326
327 if (b == NULL) {
328 OPENSSL_free(p);
329 return NULL;
330 }
331
332 crl = PEM_read_bio_X509_CRL(b, NULL, NULL, NULL);
333
334 OPENSSL_free(p);
335 BIO_free(b);
336 return crl;
337 }
338
339 /*
340 * Create an X509 from an array of strings.
341 */
X509_from_strings(const char ** pem)342 static X509 *X509_from_strings(const char **pem)
343 {
344 X509 *x;
345 char *p;
346 BIO *b = glue2bio(pem, &p);
347
348 if (b == NULL) {
349 OPENSSL_free(p);
350 return NULL;
351 }
352
353 x = PEM_read_bio_X509(b, NULL, NULL, NULL);
354
355 OPENSSL_free(p);
356 BIO_free(b);
357 return x;
358 }
359
360 /*
361 * A well-formed CRL issued by kRoot (sha256WithRSAEncryption, inner and
362 * outer signatureAlgorithm identical), used as the positive test case in
363 * test_crl_sigalg_mismatch.
364 */
365 static const char *kCrlRootCA[] = {
366 "-----BEGIN X509 CRL-----\n",
367 "MIIB2jCBwwIBATANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UEBhMCVVMxEzARBgNV\n",
368 "BAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xFTATBgNVBAoM\n",
369 "DEV4YW1wbGUgQ29ycDEeMBwGA1UECwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MR0w\n",
370 "GwYDVQQDDBRFeGFtcGxlIENvcnAgUm9vdCBDQRcNMjYwMTAxMDAwMDAwWhcNMjcw\n",
371 "MTAxMDAwMDAwWjANBgkqhkiG9w0BAQsFAAOCAQEAjLDGYBswRZpuaRh9qVXrP4i0\n",
372 "wttPikYZkkUk07/KU1zN6pS21Dqx1sEofrkqwRnKXq/hsoCz3sd7QFIv30v2iZwM\n",
373 "ioaksAjcGnaLqe8vuKVtIyiOpDSJR89l84BZr2I9+6osTYnPgroMHQ/7OUt+PKdE\n",
374 "1VAkA137tLMRw2qGPELdCyHA7LXr0gI6jeyLPLtb1blQrMzznp3y/trNWa+DKq6h\n",
375 "SflQrixmLeXTMBD/DDUd8Kj9HHmejbJNAsgaNHv9mtIhUVEspRM0020b3AeJyfTP\n",
376 "3oN/y4fgQ8q5v9i8lDbe8moCo+W0rS4ksWvB6SuYYj/NkUE4EtoIreSVtcz8JA==\n",
377 "-----END X509 CRL-----\n",
378 NULL
379 };
380
381 /*
382 * kCrlMismatchedSigAlg is issued by kRoot with a deliberately inconsistent
383 * pair of signatureAlgorithm fields: the inner (signed) copy inside
384 * TBSCertList claims ecdsaWithSHA256, while the outer wrapper carries
385 * sha256WithRSAEncryption -- and the actual signature is a valid RSA-SHA256
386 * signature over that TBSCertList. Without the inner/outer comparison,
387 * X509_CRL_verify() would accept this CRL because the RSA signature checks
388 * out. RFC 5280 section 5.1.1.2 requires the two fields to be identical.
389 */
390 static const char *kCrlMismatchedSigAlg[] = {
391 "-----BEGIN X509 CRL-----\n",
392 "MIIB1zCBwAIBATAKBggqhkjOPQQDAjCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgM\n",
393 "CkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xFTATBgNVBAoMDEV4\n",
394 "YW1wbGUgQ29ycDEeMBwGA1UECwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MR0wGwYD\n",
395 "VQQDDBRFeGFtcGxlIENvcnAgUm9vdCBDQRcNMjYwMTAxMDAwMDAwWhcNMjcwMTAx\n",
396 "MDAwMDAwWjANBgkqhkiG9w0BAQsFAAOCAQEAcle5SUuN1XIx5amjddTqDPyEm9pP\n",
397 "sNeBwR+TQi19pWHtQ5anr6PBIAxHC5uxhVpZDScZu0TlodWigo+1bfAJRyrIm/6+\n",
398 "AbmAyNC4txpNsOHgCFGW7q9T8OutaOhUw+jC6i3bxUQZ64L1sXuy2nZMzU19+Aro\n",
399 "TxSWYkIJg65SKwM/8ggyd5G7TXkv7w19+W/7Y9JV0c+kPueUZSgEGUG/GJF/Nrrc\n",
400 "TRfvqz7Qs9H9+hUiQl5K7tF9gj6aU3p1s1IZKR2x0lv4wDRUUgIjrvRzfQSGjhgf\n",
401 "6rBILI3EIxPN/PoZ3mHLYkhH5IyNj9R2GlMle52isNdW8BiNlePLx0/Jzg==\n",
402 "-----END X509 CRL-----\n",
403 NULL
404 };
405
406 /*
407 * Verify |leaf| certificate (chained up to |root|). |crls| if
408 * not NULL, is a list of CRLs to include in the verification. It is
409 * also free'd before returning, which is kinda yucky but convenient.
410 * Returns a value from X509_V_ERR_xxx or X509_V_OK.
411 */
verify(X509 * leaf,X509 * root,STACK_OF (X509_CRL)* crls,unsigned long flags,time_t verification_time)412 static int verify(X509 *leaf, X509 *root, STACK_OF(X509_CRL) *crls,
413 unsigned long flags, time_t verification_time)
414 {
415 X509_STORE_CTX *ctx = X509_STORE_CTX_new();
416 X509_STORE *store = X509_STORE_new();
417 X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
418 STACK_OF(X509) *roots = sk_X509_new_null();
419 int status = X509_V_ERR_UNSPECIFIED;
420
421 if (!TEST_ptr(ctx)
422 || !TEST_ptr(store)
423 || !TEST_ptr(param)
424 || !TEST_ptr(roots))
425 goto err;
426
427 /* Create a stack; upref the cert because we free it below. */
428 if (!TEST_true(X509_up_ref(root)))
429 goto err;
430 if (!TEST_true(sk_X509_push(roots, root))) {
431 X509_free(root);
432 goto err;
433 }
434 if (!TEST_true(X509_STORE_CTX_init(ctx, store, leaf, NULL)))
435 goto err;
436 X509_STORE_CTX_set0_trusted_stack(ctx, roots);
437 X509_STORE_CTX_set0_crls(ctx, crls);
438 X509_VERIFY_PARAM_set_time(param, verification_time);
439 if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param), (long)verification_time))
440 goto err;
441 X509_VERIFY_PARAM_set_depth(param, 16);
442 if (flags)
443 X509_VERIFY_PARAM_set_flags(param, flags);
444 X509_STORE_CTX_set0_param(ctx, param);
445 param = NULL;
446
447 ERR_clear_error();
448 status = X509_verify_cert(ctx) == 1 ? X509_V_OK
449 : X509_STORE_CTX_get_error(ctx);
450 err:
451 OSSL_STACK_OF_X509_free(roots);
452 sk_X509_CRL_pop_free(crls, X509_CRL_free);
453 X509_VERIFY_PARAM_free(param);
454 X509_STORE_CTX_free(ctx);
455 X509_STORE_free(store);
456 return status;
457 }
458
459 /*
460 * Create a stack of CRL's. Upref each one because we call pop_free on
461 * the stack and need to keep the CRL's around until the test exits.
462 * Yes this crashes on malloc failure; it forces us to debug.
463 */
STACK_OF(X509_CRL)464 static STACK_OF(X509_CRL) *make_CRL_stack(X509_CRL *x1, X509_CRL *x2)
465 {
466 STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null();
467
468 if (x1 != NULL) {
469 if (!X509_CRL_up_ref(x1))
470 goto err;
471 if (!sk_X509_CRL_push(sk, x1)) {
472 X509_CRL_free(x1);
473 goto err;
474 }
475 }
476
477 if (x2 != NULL) {
478 if (!X509_CRL_up_ref(x2))
479 goto err;
480 if (!sk_X509_CRL_push(sk, x2)) {
481 X509_CRL_free(x2);
482 goto err;
483 }
484 }
485
486 return sk;
487
488 err:
489 sk_X509_CRL_pop_free(sk, X509_CRL_free);
490 return NULL;
491 }
492
test_basic_crl(void)493 static int test_basic_crl(void)
494 {
495 X509_CRL *basic_crl = CRL_from_strings(kBasicCRL);
496 X509_CRL *revoked_crl = CRL_from_strings(kRevokedCRL);
497 int r;
498
499 r = TEST_ptr(basic_crl)
500 && TEST_ptr(revoked_crl)
501 && TEST_int_eq(verify(test_leaf, test_root,
502 make_CRL_stack(basic_crl, NULL),
503 X509_V_FLAG_CRL_CHECK, PARAM_TIME),
504 X509_V_OK)
505 && TEST_int_eq(verify(test_leaf, test_root,
506 make_CRL_stack(basic_crl, revoked_crl),
507 X509_V_FLAG_CRL_CHECK, PARAM_TIME),
508 X509_V_ERR_CERT_REVOKED);
509 X509_CRL_free(basic_crl);
510 X509_CRL_free(revoked_crl);
511 return r;
512 }
513
test_no_crl(void)514 static int test_no_crl(void)
515 {
516 return TEST_int_eq(verify(test_leaf, test_root, NULL,
517 X509_V_FLAG_CRL_CHECK, PARAM_TIME),
518 X509_V_ERR_UNABLE_TO_GET_CRL);
519 }
520
test_bad_issuer_crl(void)521 static int test_bad_issuer_crl(void)
522 {
523 X509_CRL *bad_issuer_crl = CRL_from_strings(kBadIssuerCRL);
524 int r;
525
526 r = TEST_ptr(bad_issuer_crl)
527 && TEST_int_eq(verify(test_leaf, test_root,
528 make_CRL_stack(bad_issuer_crl, NULL),
529 X509_V_FLAG_CRL_CHECK, PARAM_TIME),
530 X509_V_ERR_UNABLE_TO_GET_CRL);
531 X509_CRL_free(bad_issuer_crl);
532 return r;
533 }
534
test_crl_empty_idp(void)535 static int test_crl_empty_idp(void)
536 {
537 X509_CRL *empty_idp_crl = CRL_from_strings(kEmptyIdpCRL);
538 int r;
539
540 r = TEST_ptr(empty_idp_crl)
541 && TEST_int_eq(verify(test_leaf2, test_root2,
542 make_CRL_stack(empty_idp_crl, NULL),
543 X509_V_FLAG_CRL_CHECK, PARAM_TIME2),
544 X509_V_ERR_UNABLE_TO_GET_CRL);
545 X509_CRL_free(empty_idp_crl);
546 return r;
547 }
548
test_known_critical_crl(void)549 static int test_known_critical_crl(void)
550 {
551 X509_CRL *known_critical_crl = CRL_from_strings(kKnownCriticalCRL);
552 int r;
553
554 r = TEST_ptr(known_critical_crl)
555 && TEST_int_eq(verify(test_leaf, test_root,
556 make_CRL_stack(known_critical_crl, NULL),
557 X509_V_FLAG_CRL_CHECK, PARAM_TIME),
558 X509_V_OK);
559 X509_CRL_free(known_critical_crl);
560 return r;
561 }
562
test_unknown_critical_crl(int n)563 static int test_unknown_critical_crl(int n)
564 {
565 X509_CRL *unknown_critical_crl = CRL_from_strings(unknown_critical_crls[n]);
566 int r;
567
568 r = TEST_ptr(unknown_critical_crl)
569 && TEST_int_eq(verify(test_leaf, test_root,
570 make_CRL_stack(unknown_critical_crl, NULL),
571 X509_V_FLAG_CRL_CHECK, PARAM_TIME),
572 X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION);
573 X509_CRL_free(unknown_critical_crl);
574 return r;
575 }
576
test_reuse_crl(int idx)577 static int test_reuse_crl(int idx)
578 {
579 X509_CRL *result, *reused_crl = CRL_from_strings(kBasicCRL);
580 X509_CRL *addref_crl = NULL;
581 char *p = NULL;
582 BIO *b = NULL;
583 int r = 0;
584
585 if (!TEST_ptr(reused_crl))
586 goto err;
587
588 if (idx & 1) {
589 if (!TEST_true(X509_CRL_up_ref(reused_crl)))
590 goto err;
591 addref_crl = reused_crl;
592 }
593
594 idx >>= 1;
595 b = glue2bio(idx == 2 ? kRevokedCRL : kInvalidCRL + idx, &p);
596
597 if (!TEST_ptr(b))
598 goto err;
599
600 result = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL);
601
602 switch (idx) {
603 case 0: /* valid PEM + invalid DER */
604 if (!TEST_ptr_null(result)
605 || !TEST_ptr_null(reused_crl))
606 goto err;
607 break;
608 case 1: /* invalid PEM */
609 if (!TEST_ptr_null(result)
610 || !TEST_ptr(reused_crl))
611 goto err;
612 break;
613 case 2:
614 if (!TEST_ptr(result)
615 || !TEST_ptr(reused_crl)
616 || !TEST_ptr_eq(result, reused_crl))
617 goto err;
618 break;
619 }
620
621 r = 1;
622
623 err:
624 OPENSSL_free(p);
625 BIO_free(b);
626 X509_CRL_free(reused_crl);
627 X509_CRL_free(addref_crl);
628 return r;
629 }
630
631 /*
632 * Test to make sure X509_verify_cert sets the issuer, reasons, and
633 * CRL score of the CRLs it gets from X509_STORE_CTX->get_crl
634 */
635
get_crl_fn(X509_STORE_CTX * ctx,X509_CRL ** crl,X509 * x)636 static int get_crl_fn(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x)
637 {
638 *crl = CRL_from_strings(kBasicCRL);
639 return 1;
640 }
641
test_get_crl_fn_score(void)642 static int test_get_crl_fn_score(void)
643 {
644 X509_STORE_CTX *ctx = X509_STORE_CTX_new();
645 X509_STORE *store = X509_STORE_new();
646 X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
647 STACK_OF(X509) *roots = sk_X509_new_null();
648
649 int status = X509_V_ERR_UNSPECIFIED;
650
651 if (!TEST_ptr(ctx)
652 || !TEST_ptr(store)
653 || !TEST_ptr(param)
654 || !TEST_ptr(roots))
655 goto err;
656
657 /* Create a stack; upref the cert because we free it below. */
658 if (!TEST_true(X509_up_ref(test_root)))
659 goto err;
660 if (!TEST_true(sk_X509_push(roots, test_root))) {
661 X509_free(test_root);
662 goto err;
663 }
664 if (!TEST_true(X509_STORE_CTX_init(ctx, store, test_leaf, NULL)))
665 goto err;
666
667 X509_STORE_CTX_set0_trusted_stack(ctx, roots);
668 X509_STORE_CTX_set_get_crl(ctx, &get_crl_fn);
669 X509_VERIFY_PARAM_set_time(param, PARAM_TIME);
670 if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param),
671 (long)PARAM_TIME))
672 goto err;
673 X509_VERIFY_PARAM_set_depth(param, 16);
674 X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
675 X509_STORE_CTX_set0_param(ctx, param);
676 param = NULL;
677
678 ERR_clear_error();
679 status = X509_verify_cert(ctx) == 1 ? X509_V_OK
680 : X509_STORE_CTX_get_error(ctx);
681
682 TEST_int_eq(status, X509_V_OK);
683
684 err:
685 OSSL_STACK_OF_X509_free(roots);
686 X509_VERIFY_PARAM_free(param);
687 X509_STORE_CTX_free(ctx);
688 X509_STORE_free(store);
689 return status == X509_V_OK;
690 }
691
692 /*
693 * Check that X509_CRL_verify() rejects a CRL where the outer
694 * signatureAlgorithm does not match the inner copy inside TBSCertList.
695 * RFC 5280 section 5.1.1.2 requires the two to be identical; X509_verify()
696 * and X509_ACERT_verify() enforce this, and so must X509_CRL_verify().
697 *
698 * Both CRLs are issued by kRoot (RSA-2048). kCrlMismatchedSigAlg carries a
699 * valid RSA-SHA256 signature over a TBSCertList whose inner signatureAlgorithm
700 * claims ecdsaWithSHA256, while the outer wrapper carries the correct
701 * sha256WithRSAEncryption. Without the inner/outer comparison the signature
702 * would verify and the CRL would be accepted.
703 */
test_crl_sigalg_mismatch(void)704 static int test_crl_sigalg_mismatch(void)
705 {
706 X509 *root = X509_from_strings(kRoot);
707 X509_CRL *good = CRL_from_strings(kCrlRootCA);
708 X509_CRL *bad = CRL_from_strings(kCrlMismatchedSigAlg);
709 EVP_PKEY *pkey = NULL;
710 int ret = 0;
711
712 if (!TEST_ptr(root) || !TEST_ptr(good) || !TEST_ptr(bad))
713 goto end;
714
715 pkey = X509_get0_pubkey(root);
716 if (!TEST_ptr(pkey))
717 goto end;
718
719 /* Well-formed CRL: inner and outer algorithms match; verify succeeds. */
720 if (!TEST_int_eq(X509_CRL_verify(good, pkey), 1))
721 goto end;
722
723 /*
724 * Mismatched CRL: inner signatureAlgorithm is ecdsaWithSHA256, outer is
725 * sha256WithRSAEncryption, RSA signature is valid. X509_ALGOR_cmp()
726 * must catch the mismatch before the signature is checked.
727 */
728 if (!TEST_int_eq(X509_CRL_verify(bad, pkey), 0))
729 goto end;
730
731 ret = 1;
732 end:
733 X509_CRL_free(good);
734 X509_CRL_free(bad);
735 X509_free(root);
736 return ret;
737 }
738
setup_tests(void)739 int setup_tests(void)
740 {
741 if (!TEST_ptr(test_root = X509_from_strings(kCRLTestRoot))
742 || !TEST_ptr(test_leaf = X509_from_strings(kCRLTestLeaf))
743 || !TEST_ptr(test_root2 = X509_from_strings(kCRLTestRoot2))
744 || !TEST_ptr(test_leaf2 = X509_from_strings(kCRLTestLeaf2)))
745 return 0;
746
747 ADD_TEST(test_no_crl);
748 ADD_TEST(test_basic_crl);
749 ADD_TEST(test_bad_issuer_crl);
750 ADD_TEST(test_crl_empty_idp);
751 ADD_TEST(test_known_critical_crl);
752 ADD_TEST(test_get_crl_fn_score);
753 ADD_ALL_TESTS(test_unknown_critical_crl, OSSL_NELEM(unknown_critical_crls));
754 ADD_ALL_TESTS(test_reuse_crl, 6);
755 ADD_TEST(test_crl_sigalg_mismatch);
756
757 return 1;
758 }
759
cleanup_tests(void)760 void cleanup_tests(void)
761 {
762 X509_free(test_root);
763 X509_free(test_leaf);
764 X509_free(test_root2);
765 X509_free(test_leaf2);
766 }
767