1 /*
2 * Copyright 2007-2026 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright Nokia 2007-2019
4 * Copyright Siemens AG 2015-2019
5 *
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12 #include "helpers/cmp_testlib.h"
13
14 static const char *ir_protected_f;
15 static const char *genm_prot_Ed_f;
16 static const char *ir_unprotected_f;
17 static const char *ip_PBM_f;
18
19 typedef struct test_fixture {
20 const char *test_case_name;
21 OSSL_CMP_CTX *cmp_ctx;
22 /* for protection tests */
23 OSSL_CMP_MSG *msg;
24 OSSL_CMP_PKISI *si; /* for error and response messages */
25 EVP_PKEY *pubkey;
26 unsigned char *mem;
27 int memlen;
28 X509 *cert;
29 STACK_OF(X509) *certs;
30 STACK_OF(X509) *chain;
31 int with_ss;
32 int callback_arg;
33 int expected;
34 } CMP_PROTECT_TEST_FIXTURE;
35
36 static OSSL_LIB_CTX *libctx = NULL;
37 static OSSL_PROVIDER *default_null_provider = NULL, *provider = NULL;
38
tear_down(CMP_PROTECT_TEST_FIXTURE * fixture)39 static void tear_down(CMP_PROTECT_TEST_FIXTURE *fixture)
40 {
41 if (fixture != NULL) {
42 OSSL_CMP_CTX_free(fixture->cmp_ctx);
43 OSSL_CMP_MSG_free(fixture->msg);
44 OSSL_CMP_PKISI_free(fixture->si);
45
46 OPENSSL_free(fixture->mem);
47 sk_X509_free(fixture->certs);
48 sk_X509_free(fixture->chain);
49
50 OPENSSL_free(fixture);
51 }
52 }
53
set_up(const char * const test_case_name)54 static CMP_PROTECT_TEST_FIXTURE *set_up(const char *const test_case_name)
55 {
56 CMP_PROTECT_TEST_FIXTURE *fixture;
57
58 if (!TEST_ptr(fixture = OPENSSL_zalloc(sizeof(*fixture))))
59 return NULL;
60 fixture->test_case_name = test_case_name;
61 if (!TEST_ptr(fixture->cmp_ctx = OSSL_CMP_CTX_new(libctx, NULL))) {
62 tear_down(fixture);
63 return NULL;
64 }
65 return fixture;
66 }
67
68 static EVP_PKEY *prot_RSA_key = NULL;
69 #ifndef OPENSSL_NO_ECX
70 static EVP_PKEY *prot_Ed_key = NULL;
71 static OSSL_CMP_MSG *genm_protected_Ed;
72 #endif
73 static EVP_PKEY *server_key = NULL;
74 static X509 *server_cert = NULL;
75 static unsigned char rand_data[OSSL_CMP_TRANSACTIONID_LENGTH];
76 static OSSL_CMP_MSG *ir_unprotected, *ir_protected;
77 static X509 *endentity1 = NULL, *endentity2 = NULL,
78 *root = NULL, *intermediate = NULL;
79
execute_calc_protection_fails_test(CMP_PROTECT_TEST_FIXTURE * fixture)80 static int execute_calc_protection_fails_test(CMP_PROTECT_TEST_FIXTURE *fixture)
81 {
82 ASN1_BIT_STRING *protection = ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
83 int res = TEST_ptr_null(protection);
84
85 ASN1_BIT_STRING_free(protection);
86 return res;
87 }
88
execute_calc_protection_pbmac_test(CMP_PROTECT_TEST_FIXTURE * fixture)89 static int execute_calc_protection_pbmac_test(CMP_PROTECT_TEST_FIXTURE *fixture)
90 {
91 ASN1_BIT_STRING *protection = ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
92 int res = TEST_ptr(protection)
93 && TEST_true(ASN1_STRING_cmp(protection,
94 fixture->msg->protection)
95 == 0);
96
97 ASN1_BIT_STRING_free(protection);
98 return res;
99 }
100
101 /*
102 * This function works similarly to parts of verify_signature in cmp_vfy.c,
103 * but without the need for an OSSL_CMP_CTX or an X509 certificate.
104 */
verify_signature(OSSL_CMP_MSG * msg,ASN1_BIT_STRING * protection,EVP_PKEY * pkey,EVP_MD * digest)105 static int verify_signature(OSSL_CMP_MSG *msg,
106 ASN1_BIT_STRING *protection,
107 EVP_PKEY *pkey, EVP_MD *digest)
108 {
109 OSSL_CMP_PROTECTEDPART prot_part;
110
111 prot_part.header = OSSL_CMP_MSG_get0_header(msg);
112 prot_part.body = msg->body;
113 return ASN1_item_verify_ex(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART),
114 msg->header->protectionAlg, protection,
115 &prot_part, NULL, pkey, libctx, NULL)
116 > 0;
117 }
118
119 /* Calls OSSL_CMP_calc_protection and compares and verifies signature */
execute_calc_protection_signature_test(CMP_PROTECT_TEST_FIXTURE * fixture)120 static int execute_calc_protection_signature_test(CMP_PROTECT_TEST_FIXTURE *
121 fixture)
122 {
123 ASN1_BIT_STRING *protection = ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
124 int ret = (TEST_ptr(protection)
125 && TEST_true(verify_signature(fixture->msg, protection,
126 fixture->pubkey,
127 fixture->cmp_ctx->digest)));
128
129 ASN1_BIT_STRING_free(protection);
130 return ret;
131 }
132
test_cmp_calc_protection_no_key_no_secret(void)133 static int test_cmp_calc_protection_no_key_no_secret(void)
134 {
135 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
136 if (!TEST_ptr(fixture->msg = load_pkimsg(ir_unprotected_f, libctx))
137 || !TEST_ptr(fixture->msg->header->protectionAlg = X509_ALGOR_new() /* no specific alg needed here */)) {
138 tear_down(fixture);
139 fixture = NULL;
140 }
141
142 EXECUTE_TEST(execute_calc_protection_fails_test, tear_down);
143 return result;
144 }
145
test_cmp_calc_protection_pkey(void)146 static int test_cmp_calc_protection_pkey(void)
147 {
148 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
149 fixture->pubkey = prot_RSA_key;
150 if (!TEST_true(OSSL_CMP_CTX_set1_pkey(fixture->cmp_ctx, prot_RSA_key))
151 || !TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f, libctx))) {
152 tear_down(fixture);
153 fixture = NULL;
154 }
155 EXECUTE_TEST(execute_calc_protection_signature_test, tear_down);
156 return result;
157 }
158
159 #ifndef OPENSSL_NO_ECX
test_cmp_calc_protection_pkey_Ed(void)160 static int test_cmp_calc_protection_pkey_Ed(void)
161 {
162 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
163 fixture->pubkey = prot_Ed_key;
164 if (!TEST_true(OSSL_CMP_CTX_set1_pkey(fixture->cmp_ctx, prot_Ed_key))
165 || !TEST_ptr(fixture->msg = load_pkimsg(genm_prot_Ed_f, libctx))) {
166 tear_down(fixture);
167 fixture = NULL;
168 }
169 EXECUTE_TEST(execute_calc_protection_signature_test, tear_down);
170 return result;
171 }
172 #endif
173
test_cmp_calc_protection_pbmac(void)174 static int test_cmp_calc_protection_pbmac(void)
175 {
176 unsigned char sec_insta[] = { 'i', 'n', 's', 't', 'a' };
177
178 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
179 if (!TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
180 sec_insta, sizeof(sec_insta)))
181 || !TEST_ptr(fixture->msg = load_pkimsg(ip_PBM_f, libctx))) {
182 tear_down(fixture);
183 fixture = NULL;
184 }
185 EXECUTE_TEST(execute_calc_protection_pbmac_test, tear_down);
186 return result;
187 }
188
189 /*
190 * Regression test for the ossl_cmp_calc_protection() protectionAlg
191 * type-confusion DoS: a PKIMessage whose protectionAlg has the
192 * id-PasswordBasedMAC OID but carries a BOOLEAN parameter instead of the
193 * expected PBMParameter SEQUENCE. X509_ALGOR_get0() then returns the boolean's
194 * union member (0xff) via ppval; the unpatched code took the non-NULL ppval as
195 * a valid ASN1_STRING * and dereferenced 0xff, crashing with a near-NULL
196 * access. The fixed code must reject the malformed parameter and return NULL.
197 */
test_cmp_calc_protection_pbmac_bad_alg_param(void)198 static int test_cmp_calc_protection_pbmac_bad_alg_param(void)
199 {
200 unsigned char sec_insta[] = { 'i', 'n', 's', 't', 'a' };
201 X509_ALGOR *alg = NULL;
202
203 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
204 if (!TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
205 sec_insta, sizeof(sec_insta)))
206 || !TEST_ptr(fixture->msg = load_pkimsg(ip_PBM_f, libctx))
207 || !TEST_ptr(alg = X509_ALGOR_new())
208 || !TEST_true(X509_ALGOR_set0(alg, OBJ_nid2obj(NID_id_PasswordBasedMAC),
209 V_ASN1_BOOLEAN, (void *)1))) {
210 X509_ALGOR_free(alg);
211 tear_down(fixture);
212 fixture = NULL;
213 } else {
214 X509_ALGOR_free(fixture->msg->header->protectionAlg);
215 fixture->msg->header->protectionAlg = alg;
216 }
217 EXECUTE_TEST(execute_calc_protection_fails_test, tear_down);
218 return result;
219 }
execute_MSG_protect_test(CMP_PROTECT_TEST_FIXTURE * fixture)220 static int execute_MSG_protect_test(CMP_PROTECT_TEST_FIXTURE *fixture)
221 {
222 return TEST_int_eq(fixture->expected,
223 ossl_cmp_msg_protect(fixture->cmp_ctx, fixture->msg));
224 }
225
226 #define SET_OPT_UNPROTECTED_SEND(ctx, val) \
227 OSSL_CMP_CTX_set_option((ctx), OSSL_CMP_OPT_UNPROTECTED_SEND, (val))
test_MSG_protect_unprotected_request(void)228 static int test_MSG_protect_unprotected_request(void)
229 {
230 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
231
232 fixture->expected = 1;
233 if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
234 || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 1))) {
235 tear_down(fixture);
236 fixture = NULL;
237 }
238 EXECUTE_TEST(execute_MSG_protect_test, tear_down);
239 return result;
240 }
241
test_MSG_protect_with_msg_sig_alg_protection_plus_rsa_key(void)242 static int test_MSG_protect_with_msg_sig_alg_protection_plus_rsa_key(void)
243 {
244 const size_t size = sizeof(rand_data) / 2;
245
246 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
247 fixture->expected = 1;
248
249 if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
250 || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))
251 /*
252 * Use half of the 16 bytes of random input
253 * for each reference and secret value
254 */
255 || !TEST_true(OSSL_CMP_CTX_set1_referenceValue(fixture->cmp_ctx,
256 rand_data, size))
257 || !TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
258 rand_data + size,
259 size))) {
260 tear_down(fixture);
261 fixture = NULL;
262 }
263 EXECUTE_TEST(execute_MSG_protect_test, tear_down);
264 return result;
265 }
266
test_MSG_protect_with_certificate_and_key(void)267 static int test_MSG_protect_with_certificate_and_key(void)
268 {
269 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
270 fixture->expected = 1;
271
272 if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
273 || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))
274 || !TEST_true(OSSL_CMP_CTX_set1_pkey(fixture->cmp_ctx, server_key))
275 || !TEST_true(OSSL_CMP_CTX_set1_cert(fixture->cmp_ctx,
276 server_cert))) {
277 tear_down(fixture);
278 fixture = NULL;
279 }
280 EXECUTE_TEST(execute_MSG_protect_test, tear_down);
281 return result;
282 }
283
test_MSG_protect_certificate_based_without_cert(void)284 static int test_MSG_protect_certificate_based_without_cert(void)
285 {
286 OSSL_CMP_CTX *ctx;
287
288 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
289 ctx = fixture->cmp_ctx;
290 fixture->expected = 0;
291 if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
292 || !TEST_true(SET_OPT_UNPROTECTED_SEND(ctx, 0))
293 || !TEST_true(EVP_PKEY_up_ref(server_key))
294 || !TEST_true(OSSL_CMP_CTX_set0_newPkey(ctx, 1, server_key))) {
295 tear_down(fixture);
296 fixture = NULL;
297 }
298 EXECUTE_TEST(execute_MSG_protect_test, tear_down);
299 return result;
300 }
301
test_MSG_protect_no_key_no_secret(void)302 static int test_MSG_protect_no_key_no_secret(void)
303 {
304 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
305 fixture->expected = 0;
306 if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
307 || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))) {
308 tear_down(fixture);
309 fixture = NULL;
310 }
311 EXECUTE_TEST(execute_MSG_protect_test, tear_down);
312 return result;
313 }
314
test_MSG_protect_pbmac_no_sender(int with_ref)315 static int test_MSG_protect_pbmac_no_sender(int with_ref)
316 {
317 static unsigned char secret[] = { 47, 11, 8, 15 };
318 static unsigned char ref[] = { 0xca, 0xfe, 0xba, 0xbe };
319
320 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
321 fixture->expected = with_ref;
322 if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
323 || !SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0)
324 || !ossl_cmp_hdr_set1_sender(fixture->msg->header, NULL)
325 || !OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
326 secret, sizeof(secret))
327 || (!OSSL_CMP_CTX_set1_referenceValue(fixture->cmp_ctx,
328 with_ref ? ref : NULL,
329 sizeof(ref)))) {
330 tear_down(fixture);
331 fixture = NULL;
332 }
333 EXECUTE_TEST(execute_MSG_protect_test, tear_down);
334 return result;
335 }
336
test_MSG_protect_pbmac_no_sender_with_ref(void)337 static int test_MSG_protect_pbmac_no_sender_with_ref(void)
338 {
339 return test_MSG_protect_pbmac_no_sender(1);
340 }
341
test_MSG_protect_pbmac_no_sender_no_ref(void)342 static int test_MSG_protect_pbmac_no_sender_no_ref(void)
343 {
344 return test_MSG_protect_pbmac_no_sender(0);
345 }
346
execute_MSG_add_extraCerts_test(CMP_PROTECT_TEST_FIXTURE * fixture)347 static int execute_MSG_add_extraCerts_test(CMP_PROTECT_TEST_FIXTURE *fixture)
348 {
349 return TEST_true(ossl_cmp_msg_add_extraCerts(fixture->cmp_ctx,
350 fixture->msg));
351 }
352
test_MSG_add_extraCerts(void)353 static int test_MSG_add_extraCerts(void)
354 {
355 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
356 if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_protected))) {
357 tear_down(fixture);
358 fixture = NULL;
359 }
360 EXECUTE_TEST(execute_MSG_add_extraCerts_test, tear_down);
361 return result;
362 }
363
364 #ifndef OPENSSL_NO_EC
365 /* The cert chain tests use EC certs so we skip them in no-ec builds */
execute_cmp_build_cert_chain_test(CMP_PROTECT_TEST_FIXTURE * fixture)366 static int execute_cmp_build_cert_chain_test(CMP_PROTECT_TEST_FIXTURE *fixture)
367 {
368 int ret = 0;
369 OSSL_CMP_CTX *ctx = fixture->cmp_ctx;
370 X509_STORE *store;
371 STACK_OF(X509) *chain = X509_build_chain(fixture->cert, fixture->certs, NULL,
372 fixture->with_ss, ctx->libctx, ctx->propq);
373
374 if (TEST_ptr(chain)) {
375 /* Check whether chain built is equal to the expected one */
376 ret = TEST_int_eq(0, STACK_OF_X509_cmp(chain, fixture->chain));
377 OSSL_STACK_OF_X509_free(chain);
378 }
379 if (!ret)
380 return 0;
381
382 if (TEST_ptr(store = X509_STORE_new())
383 && TEST_true(X509_STORE_add_cert(store, root))) {
384 X509_VERIFY_PARAM_set_flags(X509_STORE_get0_param(store),
385 X509_V_FLAG_NO_CHECK_TIME);
386 chain = X509_build_chain(fixture->cert, fixture->certs, store,
387 fixture->with_ss, ctx->libctx, ctx->propq);
388 ret = TEST_int_eq(fixture->expected, chain != NULL);
389 if (ret && chain != NULL) {
390 /* Check whether chain built is equal to the expected one */
391 ret = TEST_int_eq(0, STACK_OF_X509_cmp(chain, fixture->chain));
392 OSSL_STACK_OF_X509_free(chain);
393 }
394 }
395 X509_STORE_free(store);
396 return ret;
397 }
398
test_cmp_build_cert_chain(void)399 static int test_cmp_build_cert_chain(void)
400 {
401 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
402 fixture->expected = 1;
403 fixture->with_ss = 0;
404 fixture->cert = endentity2;
405 if (!TEST_ptr(fixture->certs = sk_X509_new_null())
406 || !TEST_ptr(fixture->chain = sk_X509_new_null())
407 || !TEST_true(sk_X509_push(fixture->certs, endentity1))
408 || !TEST_true(sk_X509_push(fixture->certs, root))
409 || !TEST_true(sk_X509_push(fixture->certs, intermediate))
410 || !TEST_true(sk_X509_push(fixture->chain, endentity2))
411 || !TEST_true(sk_X509_push(fixture->chain, intermediate))) {
412 tear_down(fixture);
413 fixture = NULL;
414 }
415 if (fixture != NULL) {
416 result = execute_cmp_build_cert_chain_test(fixture);
417 fixture->with_ss = 1;
418 if (result && TEST_true(sk_X509_push(fixture->chain, root)))
419 result = execute_cmp_build_cert_chain_test(fixture);
420 }
421 tear_down(fixture);
422 return result;
423 }
424
test_cmp_build_cert_chain_missing_intermediate(void)425 static int test_cmp_build_cert_chain_missing_intermediate(void)
426 {
427 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
428 fixture->expected = 0;
429 fixture->with_ss = 0;
430 fixture->cert = endentity2;
431 if (!TEST_ptr(fixture->certs = sk_X509_new_null())
432 || !TEST_ptr(fixture->chain = sk_X509_new_null())
433 || !TEST_true(sk_X509_push(fixture->certs, endentity1))
434 || !TEST_true(sk_X509_push(fixture->certs, root))
435 || !TEST_true(sk_X509_push(fixture->chain, endentity2))) {
436 tear_down(fixture);
437 fixture = NULL;
438 }
439 EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
440 return result;
441 }
442
test_cmp_build_cert_chain_no_root(void)443 static int test_cmp_build_cert_chain_no_root(void)
444 {
445 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
446 fixture->expected = 1;
447 fixture->with_ss = 0;
448 fixture->cert = endentity2;
449 if (!TEST_ptr(fixture->certs = sk_X509_new_null())
450 || !TEST_ptr(fixture->chain = sk_X509_new_null())
451 || !TEST_true(sk_X509_push(fixture->certs, endentity1))
452 || !TEST_true(sk_X509_push(fixture->certs, intermediate))
453 || !TEST_true(sk_X509_push(fixture->chain, endentity2))
454 || !TEST_true(sk_X509_push(fixture->chain, intermediate))) {
455 tear_down(fixture);
456 fixture = NULL;
457 }
458 EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
459 return result;
460 }
461
test_cmp_build_cert_chain_only_root(void)462 static int test_cmp_build_cert_chain_only_root(void)
463 {
464 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
465 fixture->expected = 1;
466 fixture->with_ss = 0; /* still chain must include the only cert (root) */
467 fixture->cert = root;
468 if (!TEST_ptr(fixture->certs = sk_X509_new_null())
469 || !TEST_ptr(fixture->chain = sk_X509_new_null())
470 || !TEST_true(sk_X509_push(fixture->certs, root))
471 || !TEST_true(sk_X509_push(fixture->chain, root))) {
472 tear_down(fixture);
473 fixture = NULL;
474 }
475 EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
476 return result;
477 }
478
test_cmp_build_cert_chain_no_certs(void)479 static int test_cmp_build_cert_chain_no_certs(void)
480 {
481 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
482 fixture->expected = 0;
483 fixture->with_ss = 0;
484 fixture->cert = endentity2;
485 if (!TEST_ptr(fixture->certs = sk_X509_new_null())
486 || !TEST_ptr(fixture->chain = sk_X509_new_null())
487 || !TEST_true(sk_X509_push(fixture->chain, endentity2))) {
488 tear_down(fixture);
489 fixture = NULL;
490 }
491 EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
492 return result;
493 }
494 #endif /* OPENSSL_NO_EC */
495
execute_X509_STORE_test(CMP_PROTECT_TEST_FIXTURE * fixture)496 static int execute_X509_STORE_test(CMP_PROTECT_TEST_FIXTURE *fixture)
497 {
498 X509_STORE *store = X509_STORE_new();
499 STACK_OF(X509) *sk = NULL;
500 int res = 0;
501
502 if (!TEST_true(ossl_cmp_X509_STORE_add1_certs(store,
503 fixture->certs,
504 fixture->callback_arg)))
505 goto err;
506 sk = X509_STORE_get1_all_certs(store);
507 if (!TEST_int_eq(0, STACK_OF_X509_cmp(sk, fixture->chain)))
508 goto err;
509 res = 1;
510 err:
511 X509_STORE_free(store);
512 OSSL_STACK_OF_X509_free(sk);
513 return res;
514 }
515
test_X509_STORE(void)516 static int test_X509_STORE(void)
517 {
518 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
519 fixture->callback_arg = 0; /* self-issued allowed */
520 if (!TEST_ptr(fixture->certs = sk_X509_new_null())
521 || !sk_X509_push(fixture->certs, endentity1)
522 || !sk_X509_push(fixture->certs, endentity2)
523 || !sk_X509_push(fixture->certs, root)
524 || !sk_X509_push(fixture->certs, intermediate)
525 || !TEST_ptr(fixture->chain = sk_X509_dup(fixture->certs))) {
526 tear_down(fixture);
527 fixture = NULL;
528 }
529 EXECUTE_TEST(execute_X509_STORE_test, tear_down);
530 return result;
531 }
532
test_X509_STORE_only_self_issued(void)533 static int test_X509_STORE_only_self_issued(void)
534 {
535 SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
536 fixture->certs = sk_X509_new_null();
537 fixture->chain = sk_X509_new_null();
538 fixture->callback_arg = 1; /* only self-issued */
539 if (!TEST_true(sk_X509_push(fixture->certs, endentity1))
540 || !TEST_true(sk_X509_push(fixture->certs, endentity2))
541 || !TEST_true(sk_X509_push(fixture->certs, root))
542 || !TEST_true(sk_X509_push(fixture->certs, intermediate))
543 || !TEST_true(sk_X509_push(fixture->chain, root))) {
544 tear_down(fixture);
545 fixture = NULL;
546 }
547 EXECUTE_TEST(execute_X509_STORE_test, tear_down);
548 return result;
549 }
550
cleanup_tests(void)551 void cleanup_tests(void)
552 {
553 EVP_PKEY_free(prot_RSA_key);
554 #ifndef OPENSSL_NO_ECX
555 EVP_PKEY_free(prot_Ed_key);
556 OSSL_CMP_MSG_free(genm_protected_Ed);
557 #endif
558 EVP_PKEY_free(server_key);
559 X509_free(server_cert);
560 X509_free(endentity1);
561 X509_free(endentity2);
562 X509_free(root);
563 X509_free(intermediate);
564 OSSL_CMP_MSG_free(ir_protected);
565 OSSL_CMP_MSG_free(ir_unprotected);
566 OSSL_PROVIDER_unload(default_null_provider);
567 OSSL_PROVIDER_unload(provider);
568 OSSL_LIB_CTX_free(libctx);
569 }
570
571 #define USAGE "prot_RSA.pem IR_protected.der prot_Ed.pem " \
572 "GENM_protected_Ed.der IR_unprotected.der IP_PBM.der " \
573 "server.crt server.pem EndEntity1.crt EndEntity2.crt Root_CA.crt " \
574 "Intermediate_CA.crt module_name [module_conf_file]\n"
OPT_TEST_DECLARE_USAGE(USAGE)575 OPT_TEST_DECLARE_USAGE(USAGE)
576
577 int setup_tests(void)
578 {
579 char *prot_RSA_f;
580 char *prot_Ed_f;
581 char *server_key_f;
582 char *server_cert_f;
583 char *endentity1_f;
584 char *endentity2_f;
585 char *root_f;
586 char *intermediate_f;
587
588 if (!test_skip_common_options()) {
589 TEST_error("Error parsing test options\n");
590 return 0;
591 }
592
593 RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH);
594 if (!TEST_ptr(prot_RSA_f = test_get_argument(0))
595 || !TEST_ptr(ir_protected_f = test_get_argument(1))
596 || !TEST_ptr(prot_Ed_f = test_get_argument(2))
597 || !TEST_ptr(genm_prot_Ed_f = test_get_argument(3))
598 || !TEST_ptr(ir_unprotected_f = test_get_argument(4))
599 || !TEST_ptr(ip_PBM_f = test_get_argument(5))
600 || !TEST_ptr(server_cert_f = test_get_argument(6))
601 || !TEST_ptr(server_key_f = test_get_argument(7))
602 || !TEST_ptr(endentity1_f = test_get_argument(8))
603 || !TEST_ptr(endentity2_f = test_get_argument(9))
604 || !TEST_ptr(root_f = test_get_argument(10))
605 || !TEST_ptr(intermediate_f = test_get_argument(11))) {
606 TEST_error("usage: cmp_protect_test %s", USAGE);
607 return 0;
608 }
609
610 if (!test_arg_libctx(&libctx, &default_null_provider, &provider, 12, USAGE))
611 return 0;
612
613 if (!TEST_ptr(server_key = load_pkey_pem(server_key_f, libctx))
614 || !TEST_ptr(server_cert = load_cert_pem(server_cert_f, libctx)))
615 return 0;
616
617 if (!TEST_ptr(prot_RSA_key = load_pkey_pem(prot_RSA_f, libctx)))
618 return 0;
619 #ifndef OPENSSL_NO_ECX
620 if (!TEST_ptr(prot_Ed_key = load_pkey_pem(prot_Ed_f, libctx)))
621 return 0;
622 #endif
623 if (!TEST_ptr(ir_protected = load_pkimsg(ir_protected_f, libctx))
624 #ifndef OPENSSL_NO_ECX
625 || !TEST_ptr(genm_protected_Ed = load_pkimsg(genm_prot_Ed_f, libctx))
626 #endif
627 || !TEST_ptr(ir_unprotected = load_pkimsg(ir_unprotected_f, libctx)))
628 return 0;
629 if (!TEST_ptr(endentity1 = load_cert_pem(endentity1_f, libctx))
630 || !TEST_ptr(endentity2 = load_cert_pem(endentity2_f, libctx))
631 || !TEST_ptr(root = load_cert_pem(root_f, libctx))
632 || !TEST_ptr(intermediate = load_cert_pem(intermediate_f, libctx)))
633 return 0;
634 if (!TEST_int_eq(1, RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH)))
635 return 0;
636
637 /* Message protection tests */
638 ADD_TEST(test_cmp_calc_protection_no_key_no_secret);
639 ADD_TEST(test_cmp_calc_protection_pkey);
640 #ifndef OPENSSL_NO_ECX
641 ADD_TEST(test_cmp_calc_protection_pkey_Ed);
642 #endif
643 ADD_TEST(test_cmp_calc_protection_pbmac);
644 ADD_TEST(test_cmp_calc_protection_pbmac_bad_alg_param);
645
646 ADD_TEST(test_MSG_protect_with_msg_sig_alg_protection_plus_rsa_key);
647 ADD_TEST(test_MSG_protect_with_certificate_and_key);
648 ADD_TEST(test_MSG_protect_certificate_based_without_cert);
649 ADD_TEST(test_MSG_protect_unprotected_request);
650 ADD_TEST(test_MSG_protect_no_key_no_secret);
651 ADD_TEST(test_MSG_protect_pbmac_no_sender_with_ref);
652 ADD_TEST(test_MSG_protect_pbmac_no_sender_no_ref);
653 ADD_TEST(test_MSG_add_extraCerts);
654
655 #ifndef OPENSSL_NO_EC
656 ADD_TEST(test_cmp_build_cert_chain);
657 ADD_TEST(test_cmp_build_cert_chain_only_root);
658 ADD_TEST(test_cmp_build_cert_chain_no_root);
659 ADD_TEST(test_cmp_build_cert_chain_missing_intermediate);
660 ADD_TEST(test_cmp_build_cert_chain_no_certs);
661 #endif
662
663 ADD_TEST(test_X509_STORE);
664 ADD_TEST(test_X509_STORE_only_self_issued);
665
666 return 1;
667 }
668