1 /* 2 * Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include "internal/nelem.h" 11 #include <string.h> 12 #include <time.h> 13 #include <openssl/bio.h> 14 #include <openssl/crypto.h> 15 #include <openssl/err.h> 16 #include <openssl/pem.h> 17 #include <openssl/x509.h> 18 19 #include "testutil.h" 20 21 /* 22 * We cannot use old certificates for new tests because the private key 23 * associated with them is no longer available. Therefore, we add kCRLTestLeaf, 24 * kCRLTestLeaf2 and PARAM_TIME2, as well as pass the verification time to the 25 * verify function as a parameter. Certificates and CRL from 26 * https://github.com/openssl/openssl/issues/27506 are used. 27 */ 28 29 static const char *kRoot[] = { 30 "-----BEGIN CERTIFICATE-----\n", 31 "MIIEFjCCAv6gAwIBAgIUQR1kHB+/IzJcfAT/HHVPp+wPmxwwDQYJKoZIhvcNAQEL\n", 32 "BQAwgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQH\n", 33 "DA1TYW4gRnJhbmNpc2NvMRUwEwYDVQQKDAxFeGFtcGxlIENvcnAxHjAcBgNVBAsM\n", 34 "FUNlcnRpZmljYXRlIEF1dGhvcml0eTEdMBsGA1UEAwwURXhhbXBsZSBDb3JwIFJv\n", 35 "b3QgQ0EwHhcNMjYwMzEwMTEzMDUzWhcNMzYwMzA3MTEzMDUzWjCBkDELMAkGA1UE\n", 36 "BhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lz\n", 37 "Y28xFTATBgNVBAoMDEV4YW1wbGUgQ29ycDEeMBwGA1UECwwVQ2VydGlmaWNhdGUg\n", 38 "QXV0aG9yaXR5MR0wGwYDVQQDDBRFeGFtcGxlIENvcnAgUm9vdCBDQTCCASIwDQYJ\n", 39 "KoZIhvcNAQEBBQADggEPADCCAQoCggEBALm21ITU+2o6ZHWukCyBw9H270fSABYT\n", 40 "rl8lhPCcTXynW9tBeHAaV50WMiOxBl+thfv1fGS3t8BbyjEjP3I5LAkBS9dTUI7F\n", 41 "PSQnngBgKvKrpsnsiJXVhNOISm6GfT/EXj1NWKLXR3MXGIGfiVud5ln9CQxzaq3e\n", 42 "TzW8X8zsdv6WGaeRIBm48QYe8TkK/TDmvoYZ7fD9lPMk3AUoNasZfuPeGpzh1cBR\n", 43 "bfvOYEHJQ31+GFzrJFldqoaq/k0If/khwVgjOdmF+R25OCF0jsrMjmZ42Qr2cNrd\n", 44 "VYEIjQL2R1grCVCGaIagzQuyN0Qvvl5BXsHKI51TpDQlq9SFkCOvRckCAwEAAaNm\n", 45 "MGQwHQYDVR0OBBYEFP4UDhMbCWfLSg1L2k/z75C1Q9szMB8GA1UdIwQYMBaAFP4U\n", 46 "DhMbCWfLSg1L2k/z75C1Q9szMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/\n", 47 "BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQBcYi8b4tetG18ElSqF/CJkjm93xS6k\n", 48 "tk4jia0k+79FSAvy/TlcarBAe3PwlLA7GcLYDUmmM7GCiEMf91+c6dOmKkIdbw1B\n", 49 "FILQBnghZ9s+xl0+n1P0775dDWc0msXhXci/wcRK3HFqxEOXQUkDYZwrq1gXBESr\n", 50 "6yjpYe2RFKQUdnW+yrMlY1QyGNhelV7//BbSG8fD1esU7VaBE0wF/b8Ly2ykK5QE\n", 51 "d6XUwqTT6sIlcyxVGUgEMVj7kSZUQJ2LS/ze/r+a1FeC2I0UljD78UB+I40FafZe\n", 52 "pLLvkABIXRqtOiZ5YkdEK3Z4xI0yqSZC3og4jHsoCrfWbXasRieYR7dT\n", 53 "-----END CERTIFICATE-----\n", 54 NULL 55 }; 56 57 #define PARAM_TIME 1474934400 /* Sep 27th, 2016 */ 58 #define PARAM_TIME2 1753284700 /* July 23th, 2025 */ 59 60 static const char *kCRLTestRoot[] = { 61 "-----BEGIN CERTIFICATE-----\n", 62 "MIIDbzCCAlegAwIBAgIJAODri7v0dDUFMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV\n", 63 "BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW\n", 64 "aWV3MRIwEAYDVQQKDAlCb3JpbmdTU0wwHhcNMTYwOTI2MTUwNjI2WhcNMjYwOTI0\n", 65 "MTUwNjI2WjBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG\n", 66 "A1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9yaW5nU1NMMIIBIjANBgkq\n", 67 "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3B\n", 68 "S/dUBpbrzd1aeFzNlI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+\n", 69 "5R/Du0iCb1tCZIPY07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWp\n", 70 "uRqO6rctN9qUoMlTIAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n\n", 71 "8H922qmvPNA9idmX9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbL\n", 72 "P2o9orxGx7aCtnnBZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABo1Aw\n", 73 "TjAdBgNVHQ4EFgQUWPt3N5cZ/CRvubbrkqfBnAqhq94wHwYDVR0jBBgwFoAUWPt3\n", 74 "N5cZ/CRvubbrkqfBnAqhq94wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n", 75 "AQEAORu6M0MOwXy+3VEBwNilfTxyqDfruQsc1jA4PT8Oe8zora1WxE1JB4q2FJOz\n", 76 "EAuM3H/NXvEnBuN+ITvKZAJUfm4NKX97qmjMJwLKWe1gVv+VQTr63aR7mgWJReQN\n", 77 "XdMztlVeZs2dppV6uEg3ia1X0G7LARxGpA9ETbMyCpb39XxlYuTClcbA5ftDN99B\n", 78 "3Xg9KNdd++Ew22O3HWRDvdDpTO/JkzQfzi3sYwUtzMEonENhczJhGf7bQMmvL/w5\n", 79 "24Wxj4Z7KzzWIHsNqE/RIs6RV3fcW61j/mRgW2XyoWnMVeBzvcJr9NXp4VQYmFPw\n", 80 "amd8GKMZQvP0ufGnUn7D7uartA==\n", 81 "-----END CERTIFICATE-----\n", 82 NULL 83 }; 84 85 static const char *kCRLTestLeaf[] = { 86 "-----BEGIN CERTIFICATE-----\n", 87 "MIIDkDCCAnigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCVVMx\n", 88 "EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEjAQ\n", 89 "BgNVBAoMCUJvcmluZ1NTTDAeFw0xNjA5MjYxNTA4MzFaFw0xNzA5MjYxNTA4MzFa\n", 90 "MEsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQKDAlC\n", 91 "b3JpbmdTU0wxEzARBgNVBAMMCmJvcmluZy5zc2wwggEiMA0GCSqGSIb3DQEBAQUA\n", 92 "A4IBDwAwggEKAoIBAQDc5v1S1M0W+QWM+raWfO0LH8uvqEwuJQgODqMaGnSlWUx9\n", 93 "8iQcnWfjyPja3lWg9K62hSOFDuSyEkysKHDxijz5R93CfLcfnVXjWQDJe7EJTTDP\n", 94 "ozEvxN6RjAeYv7CF000euYr3QT5iyBjg76+bon1p0jHZBJeNPP1KqGYgyxp+hzpx\n", 95 "e0gZmTlGAXd8JQK4v8kpdYwD6PPifFL/jpmQpqOtQmH/6zcLjY4ojmqpEdBqIKIX\n", 96 "+saA29hMq0+NK3K+wgg31RU+cVWxu3tLOIiesETkeDgArjWRS1Vkzbi4v9SJxtNu\n", 97 "OZuAxWiynRJw3JwH/OFHYZIvQqz68ZBoj96cepjPAgMBAAGjezB5MAkGA1UdEwQC\n", 98 "MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl\n", 99 "MB0GA1UdDgQWBBTGn0OVVh/aoYt0bvEKG+PIERqnDzAfBgNVHSMEGDAWgBRY+3c3\n", 100 "lxn8JG+5tuuSp8GcCqGr3jANBgkqhkiG9w0BAQsFAAOCAQEAd2nM8gCQN2Dc8QJw\n", 101 "XSZXyuI3DBGGCHcay/3iXu0JvTC3EiQo8J6Djv7WLI0N5KH8mkm40u89fJAB2lLZ\n", 102 "ShuHVtcC182bOKnePgwp9CNwQ21p0rDEu/P3X46ZvFgdxx82E9xLa0tBB8PiPDWh\n", 103 "lV16jbaKTgX5AZqjnsyjR5o9/mbZVupZJXx5Syq+XA8qiJfstSYJs4KyKK9UOjql\n", 104 "ICkJVKpi2ahDBqX4MOH4SLfzVk8pqSpviS6yaA1RXqjpkxiN45WWaXDldVHMSkhC\n", 105 "5CNXsXi4b1nAntu89crwSLA3rEwzCWeYj+BX7e1T9rr3oJdwOU/2KQtW1js1yQUG\n", 106 "tjJMFw==\n", 107 "-----END CERTIFICATE-----\n", 108 NULL 109 }; 110 111 static const char *kCRLTestRoot2[] = { 112 "-----BEGIN CERTIFICATE-----\n", 113 "MIID4zCCAsugAwIBAgIUGTcyNat9hTOo8nnGdzF7MTzL9WAwDQYJKoZIhvcNAQEL\n", 114 "BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM\n", 115 "DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk15IENvbXBhbnkxEzARBgNVBAMMCk15\n", 116 "IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJvb3QgQ0EwHhcNMjUwMzAzMDcxNDA0WhcN\n", 117 "MzUwMzAxMDcxNDA0WjB5MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p\n", 118 "YTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKTXkgQ29tcGFueTET\n", 119 "MBEGA1UEAwwKTXkgUm9vdCBDQTETMBEGA1UECwwKTXkgUm9vdCBDQTCCASIwDQYJ\n", 120 "KoZIhvcNAQEBBQADggEPADCCAQoCggEBAN6jjwkmV+pse430MQfyaWv+JtAd2r6K\n", 121 "qzEquBcoofzuf/yvdEhQPjK3bcotgfEcFq3QMo1MJ7vqRHEIu0hJ+5ZnEQtIRcrg\n", 122 "Vm7/EoVCBpDc9BDtW40TDp69z9kaKyyKYy6rxmSKgJydGBeGGMwBxgTK/o0xAriC\n", 123 "C3lLXHT8G8YMamKUpToPL5iCRX+GJPnnizB2ODvpQGMWkbp9+1xEc4dD7Db2wfUb\n", 124 "gatDYUoGndQKWD49UhURavQZeLpDxlz93YutRRkZTWc4IB7WebiEb39BDjSP3QYm\n", 125 "2h+rZYyjp3Gxy8pBNTPzE9Dk4yjiqS7o3WGvi/S6zKTLDvWl9t6pMOMCAwEAAaNj\n", 126 "MGEwHQYDVR0OBBYEFNdhiR+Tlot2VBbp5XfcfLdlG4AkMA4GA1UdDwEB/wQEAwIB\n", 127 "hjAfBgNVHSMEGDAWgBTXYYkfk5aLdlQW6eV33Hy3ZRuAJDAPBgNVHRMBAf8EBTAD\n", 128 "AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCvwutY0WMcKoqulifnYfhxGLtXSSvD2GET\n", 129 "uNRv+S1KI5JKcAdfvnbNDpUwlujMDIpe3ewmv9i6kcitpHwZXdVAw6KWagJ0kDSt\n", 130 "jbArJxuuuFmSFDS7kj8x7FZok5quAWDSSg+ubV2tCVxmDuTs1WXJXD3l9g+3J9GU\n", 131 "kyeFMKqwRp8w22vm9ilgXrzeesAmmAg/pEb56ljTPeaONQxVe7KJhv2q8J17sML8\n", 132 "BE7TdVx7UFQbO/t9XqdT5O9eF8JUx4Vn4QSr+jdjJ/ns4T3/IC9dJq9k7tjD48iA\n", 133 "TNc+7x+uj8P39VA96HpjujVakj8/qn5SQMPJgDds+MSXrX+6JBWm\n", 134 "-----END CERTIFICATE-----\n", 135 NULL 136 }; 137 138 static const char *kCRLTestLeaf2[] = { 139 "-----BEGIN CERTIFICATE-----\n", 140 "MIIECjCCAvKgAwIBAgIUPxuMqMtuN1j3XZVRVrNmaTCIP04wDQYJKoZIhvcNAQEL\n", 141 "BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM\n", 142 "DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk15IENvbXBhbnkxEzARBgNVBAMMCk15\n", 143 "IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJvb3QgQ0EwHhcNMjUwNDE3MTAxNjQ5WhcN\n", 144 "MjYwNDE3MTAxNjQ5WjBoMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHQmVpamluZzEQ\n", 145 "MA4GA1UEBwwHQmVpamluZzEYMBYGA1UECgwPTXkgT3JnYW5pemF0aW9uMRswGQYD\n", 146 "VQQDDBJNeSBJbnRlcm1lZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n", 147 "ggEKAoIBAQDIxRxZQokflDaLYoD21HT2U4EshqtKpSf9zPS5unBMCfnQkU4IJjBF\n", 148 "3qQmfgz5ZOpZv3x0w48fDjiysk0eOVCFAo+uixEjMeuln6Wj3taetch2Sk0YNm5J\n", 149 "SJCNF2olHZXn5R8ngEmho2j1wbwNnpcccZyRNzUSjR9oAgObkP3O7fyQKJRxwNU0\n", 150 "sN7mfoyEOczKtUaYbqi2gPx6OOqNLjXlLmfZ8PJagKCN/oYkGU5PoRNXp65Znhu6\n", 151 "s8FuSmvTodu8Qhs9Uizo+SycaBXn5Fbqt32S+9vPfhH9FfELDfQIaBp+iQAxcKPX\n", 152 "tUglXEjiEVrbNf722PuWIWN9EIBolULVAgMBAAGjgZowgZcwEgYDVR0TAQH/BAgw\n", 153 "BgEB/wIBATAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vbG9jYWxob3N0OjgwMDAv\n", 154 "Y2FfY3JsLmRlcjAdBgNVHQ4EFgQUh40vFgoopz5GUggPEEk2+bKgbwQwHwYDVR0j\n", 155 "BBgwFoAU12GJH5OWi3ZUFunld9x8t2UbgCQwDgYDVR0PAQH/BAQDAgGGMA0GCSqG\n", 156 "SIb3DQEBCwUAA4IBAQDANfJuTgo0vRaMPYqOeW8R4jLHdVazdGLeQQ/85vXr/Gl1\n", 157 "aL40tLp4yZbThxuxTzPzfY1OGkG69YQ/8Vo0gCEi5KjBMYPKmZISKy1MwROQ1Jfp\n", 158 "HkmyZk1TfuzG/4fN/bun2gjpDYcihf4xA4NhSVzQyvqm1N6VkTgK+bEWTOGzqw66\n", 159 "6IYPN6oVDmLbwU1EvV3rggB7HUJCJP4qW9DbAQRAijUurPUGoU2vEbrSyYkfQXCf\n", 160 "p4ouOTMl6O7bJ110SKzxbCfWqom+iAwHlU2tOPVmOp1CLDCClMRNHIFMDGAoBomH\n", 161 "s01wD+IcIi9OkQEbqVb/XDKes8fqzQgTtSM9C9Ot\n", 162 "-----END CERTIFICATE-----\n", 163 NULL 164 }; 165 166 static const char *kBasicCRL[] = { 167 "-----BEGIN X509 CRL-----\n", 168 "MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n", 169 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n", 170 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV\n", 171 "HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN\n", 172 "ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo\n", 173 "eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os\n", 174 "dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv\n", 175 "diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho\n", 176 "/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==\n", 177 "-----END X509 CRL-----\n", 178 NULL 179 }; 180 181 static const char *kRevokedCRL[] = { 182 "-----BEGIN X509 CRL-----\n", 183 "MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n", 184 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n", 185 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX\n", 186 "DTE2MDkyNjE1MTIyNlqgDjAMMAoGA1UdFAQDAgECMA0GCSqGSIb3DQEBCwUAA4IB\n", 187 "AQCUGaM4DcWzlQKrcZvI8TMeR8BpsvQeo5BoI/XZu2a8h//PyRyMwYeaOM+3zl0d\n", 188 "sjgCT8b3C1FPgT+P2Lkowv7rJ+FHJRNQkogr+RuqCSPTq65ha4WKlRGWkMFybzVH\n", 189 "NloxC+aU3lgp/NlX9yUtfqYmJek1CDrOOGPrAEAwj1l/BUeYKNGqfBWYJQtPJu+5\n", 190 "OaSvIYGpETCZJscUWODmLEb/O3DM438vLvxonwGqXqS0KX37+CHpUlyhnSovxXxp\n", 191 "Pz4aF+L7OtczxL0GYtD2fR9B7TDMqsNmHXgQrixvvOY7MUdLGbd4RfJL3yA53hyO\n", 192 "xzfKY2TzxLiOmctG0hXFkH5J\n", 193 "-----END X509 CRL-----\n", 194 NULL 195 }; 196 197 static const char *kInvalidCRL[] = { 198 "-----BEGIN X509 CRL-----\n", 199 "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n", 200 "-----END X509 CRL-----\n", 201 NULL 202 }; 203 204 static const char *kBadIssuerCRL[] = { 205 "-----BEGIN X509 CRL-----\n", 206 "MIIBwjCBqwIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzETMBEGA1UE\n", 207 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEWMBQGA1UECgwN\n", 208 "Tm90IEJvcmluZ1NTTBcNMTYwOTI2MTUxMjQ0WhcNMTYxMDI2MTUxMjQ0WjAVMBMC\n", 209 "AhAAFw0xNjA5MjYxNTEyMjZaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsF\n", 210 "AAOCAQEAlBmjOA3Fs5UCq3GbyPEzHkfAabL0HqOQaCP12btmvIf/z8kcjMGHmjjP\n", 211 "t85dHbI4Ak/G9wtRT4E/j9i5KML+6yfhRyUTUJKIK/kbqgkj06uuYWuFipURlpDB\n", 212 "cm81RzZaMQvmlN5YKfzZV/clLX6mJiXpNQg6zjhj6wBAMI9ZfwVHmCjRqnwVmCUL\n", 213 "TybvuTmkryGBqREwmSbHFFjg5ixG/ztwzON/Ly78aJ8Bql6ktCl9+/gh6VJcoZ0q\n", 214 "L8V8aT8+Ghfi+zrXM8S9BmLQ9n0fQe0wzKrDZh14EK4sb7zmOzFHSxm3eEXyS98g\n", 215 "Od4cjsc3ymNk88S4jpnLRtIVxZB+SQ==\n", 216 "-----END X509 CRL-----\n", 217 NULL 218 }; 219 220 static const char *kEmptyIdpCRL[] = { 221 "-----BEGIN X509 CRL-----\n", 222 "MIICOTCCASECAQEwDQYJKoZIhvcNAQELBQAweTELMAkGA1UEBhMCVVMxEzARBgNV\n", 223 "BAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoM\n", 224 "Ck15IENvbXBhbnkxEzARBgNVBAMMCk15IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJv\n", 225 "b3QgQ0EXDTI1MDEwMTAwMDAwMFoXDTI1MTIwMTAwMDAwMFowJzAlAhQcgAIu+B8k\n", 226 "Be6WphLcth/grHAeXhcNMjUwNDE3MTAxNjUxWqBLMEkwGAYDVR0UBBECDxnP/97a\n", 227 "dO3y9qRGDM7hQDAfBgNVHSMEGDAWgBTXYYkfk5aLdlQW6eV33Hy3ZRuAJDAMBgNV\n", 228 "HRwBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQAf+mtlDi9IftsYwTcxYYKxE203\n", 229 "+prttFB00om29jjtkGYRxcs3vZQRTvera21YFn3mrS/lxvhBq6GMx0I61AQ48Pr4\n", 230 "63bDvZgf+/P6T2+MLgLds23o3TOfy2SBSdnFEcN0bFUgF5U0bFpQqlQWx+FYhrAf\n", 231 "ZX3RAhURiKKfGKGeVOVKS0u+x666FoDQ7pbhbHM3+jnuzdtv8RQMkj1AZMw0FMl8\n", 232 "m2dFQhZqT9WdJqZAc8ldc6V3a0rUeOV8BUPACf1k4B0CKhn4draIqltZkWgl3cmU\n", 233 "SX2V/a51lS12orfNYSEx+vtJ9gpx4LDxyOnai18vueVyljrXuQSrcYuxS2Cd\n", 234 "-----END X509 CRL-----\n", 235 NULL 236 }; 237 238 /* 239 * This is kBasicCRL but with a critical issuing distribution point 240 * extension. 241 */ 242 static const char *kKnownCriticalCRL[] = { 243 "-----BEGIN X509 CRL-----\n", 244 "MIIBujCBowIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n", 245 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n", 246 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCEwHzAKBgNV\n", 247 "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wDQYJKoZIhvcNAQELBQADggEBAA+3\n", 248 "i+5e5Ub8sccfgOBs6WVJFI9c8gvJjrJ8/dYfFIAuCyeocs7DFXn1n13CRZ+URR/Q\n", 249 "mVWgU28+xeusuSPYFpd9cyYTcVyNUGNTI3lwgcE/yVjPaOmzSZKdPakApRxtpKKQ\n", 250 "NN/56aQz3bnT/ZSHQNciRB8U6jiD9V30t0w+FDTpGaG+7bzzUH3UVF9xf9Ctp60A\n", 251 "3mfLe0scas7owSt4AEFuj2SPvcE7yvdOXbu+IEv21cEJUVExJAbhvIweHXh6yRW+\n", 252 "7VVeiNzdIjkZjyTmAzoXGha4+wbxXyBRbfH+XWcO/H+8nwyG8Gktdu2QB9S9nnIp\n", 253 "o/1TpfOMSGhMyMoyPrk=\n", 254 "-----END X509 CRL-----\n", 255 NULL 256 }; 257 258 /* 259 * kUnknownCriticalCRL is kBasicCRL but with an unknown critical extension. 260 */ 261 static const char *kUnknownCriticalCRL[] = { 262 "-----BEGIN X509 CRL-----\n", 263 "MIIBvDCBpQIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n", 264 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n", 265 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCMwITAKBgNV\n", 266 "HRQEAwIBATATBgwqhkiG9xIEAYS3CQABAf8EADANBgkqhkiG9w0BAQsFAAOCAQEA\n", 267 "GvBP0xqL509InMj/3493YVRV+ldTpBv5uTD6jewzf5XdaxEQ/VjTNe5zKnxbpAib\n", 268 "Kf7cwX0PMSkZjx7k7kKdDlEucwVvDoqC+O9aJcqVmM6GDyNb9xENxd0XCXja6MZC\n", 269 "yVgP4AwLauB2vSiEprYJyI1APph3iAEeDm60lTXX/wBM/tupQDDujKh2GPyvBRfJ\n", 270 "+wEDwGg3ICwvu4gO4zeC5qnFR+bpL9t5tOMAQnVZ0NWv+k7mkd2LbHdD44dxrfXC\n", 271 "nhtfERx99SDmC/jtUAJrGhtCO8acr7exCeYcduN7KKCm91OeCJKK6OzWst0Og1DB\n", 272 "kwzzU2rL3G65CrZ7H0SZsQ==\n", 273 "-----END X509 CRL-----\n", 274 NULL 275 }; 276 277 /* 278 * kUnknownCriticalCRL2 is kBasicCRL but with a critical issuing distribution 279 * point extension followed by an unknown critical extension 280 */ 281 static const char *kUnknownCriticalCRL2[] = { 282 "-----BEGIN X509 CRL-----\n", 283 "MIIBzzCBuAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n", 284 "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n", 285 "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoDYwNDAKBgNV\n", 286 "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wEwYMKoZIhvcSBAGEtwkAAQH/BAAw\n", 287 "DQYJKoZIhvcNAQELBQADggEBACTcpQC8jXL12JN5YzOcQ64ubQIe0XxRAd30p7qB\n", 288 "BTXGpgqBjrjxRfLms7EBYodEXB2oXMsDq3km0vT1MfYdsDD05S+SQ9CDsq/pUfaC\n", 289 "E2WNI5p8WircRnroYvbN2vkjlRbMd1+yNITohXYXCJwjEOAWOx3XIM10bwPYBv4R\n", 290 "rDobuLHoMgL3yHgMHmAkP7YpkBucNqeBV8cCdeAZLuhXFWi6yfr3r/X18yWbC/r2\n", 291 "2xXdkrSqXLFo7ToyP8YKTgiXpya4x6m53biEYwa2ULlas0igL6DK7wjYZX95Uy7H\n", 292 "GKljn9weIYiMPV/BzGymwfv2EW0preLwtyJNJPaxbdin6Jc=\n", 293 "-----END X509 CRL-----\n", 294 NULL 295 }; 296 297 static const char **unknown_critical_crls[] = { 298 kUnknownCriticalCRL, kUnknownCriticalCRL2 299 }; 300 301 static X509 *test_root = NULL; 302 static X509 *test_leaf = NULL; 303 static X509 *test_root2 = NULL; 304 static X509 *test_leaf2 = NULL; 305 306 /* 307 * Glue an array of strings together. Return a BIO and put the string 308 * into |*out| so we can free it. 309 */ 310 static BIO *glue2bio(const char **pem, char **out) 311 { 312 size_t s = 0; 313 314 *out = glue_strings(pem, &s); 315 return BIO_new_mem_buf(*out, s); 316 } 317 318 /* 319 * Create a CRL from an array of strings. 320 */ 321 static X509_CRL *CRL_from_strings(const char **pem) 322 { 323 X509_CRL *crl; 324 char *p; 325 BIO *b = glue2bio(pem, &p); 326 327 if (b == NULL) { 328 OPENSSL_free(p); 329 return NULL; 330 } 331 332 crl = PEM_read_bio_X509_CRL(b, NULL, NULL, NULL); 333 334 OPENSSL_free(p); 335 BIO_free(b); 336 return crl; 337 } 338 339 /* 340 * Create an X509 from an array of strings. 341 */ 342 static X509 *X509_from_strings(const char **pem) 343 { 344 X509 *x; 345 char *p; 346 BIO *b = glue2bio(pem, &p); 347 348 if (b == NULL) { 349 OPENSSL_free(p); 350 return NULL; 351 } 352 353 x = PEM_read_bio_X509(b, NULL, NULL, NULL); 354 355 OPENSSL_free(p); 356 BIO_free(b); 357 return x; 358 } 359 360 /* 361 * A well-formed CRL issued by kRoot (sha256WithRSAEncryption, inner and 362 * outer signatureAlgorithm identical), used as the positive test case in 363 * test_crl_sigalg_mismatch. 364 */ 365 static const char *kCrlRootCA[] = { 366 "-----BEGIN X509 CRL-----\n", 367 "MIIB2jCBwwIBATANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UEBhMCVVMxEzARBgNV\n", 368 "BAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xFTATBgNVBAoM\n", 369 "DEV4YW1wbGUgQ29ycDEeMBwGA1UECwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MR0w\n", 370 "GwYDVQQDDBRFeGFtcGxlIENvcnAgUm9vdCBDQRcNMjYwMTAxMDAwMDAwWhcNMjcw\n", 371 "MTAxMDAwMDAwWjANBgkqhkiG9w0BAQsFAAOCAQEAjLDGYBswRZpuaRh9qVXrP4i0\n", 372 "wttPikYZkkUk07/KU1zN6pS21Dqx1sEofrkqwRnKXq/hsoCz3sd7QFIv30v2iZwM\n", 373 "ioaksAjcGnaLqe8vuKVtIyiOpDSJR89l84BZr2I9+6osTYnPgroMHQ/7OUt+PKdE\n", 374 "1VAkA137tLMRw2qGPELdCyHA7LXr0gI6jeyLPLtb1blQrMzznp3y/trNWa+DKq6h\n", 375 "SflQrixmLeXTMBD/DDUd8Kj9HHmejbJNAsgaNHv9mtIhUVEspRM0020b3AeJyfTP\n", 376 "3oN/y4fgQ8q5v9i8lDbe8moCo+W0rS4ksWvB6SuYYj/NkUE4EtoIreSVtcz8JA==\n", 377 "-----END X509 CRL-----\n", 378 NULL 379 }; 380 381 /* 382 * kCrlMismatchedSigAlg is issued by kRoot with a deliberately inconsistent 383 * pair of signatureAlgorithm fields: the inner (signed) copy inside 384 * TBSCertList claims ecdsaWithSHA256, while the outer wrapper carries 385 * sha256WithRSAEncryption -- and the actual signature is a valid RSA-SHA256 386 * signature over that TBSCertList. Without the inner/outer comparison, 387 * X509_CRL_verify() would accept this CRL because the RSA signature checks 388 * out. RFC 5280 section 5.1.1.2 requires the two fields to be identical. 389 */ 390 static const char *kCrlMismatchedSigAlg[] = { 391 "-----BEGIN X509 CRL-----\n", 392 "MIIB1zCBwAIBATAKBggqhkjOPQQDAjCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgM\n", 393 "CkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xFTATBgNVBAoMDEV4\n", 394 "YW1wbGUgQ29ycDEeMBwGA1UECwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MR0wGwYD\n", 395 "VQQDDBRFeGFtcGxlIENvcnAgUm9vdCBDQRcNMjYwMTAxMDAwMDAwWhcNMjcwMTAx\n", 396 "MDAwMDAwWjANBgkqhkiG9w0BAQsFAAOCAQEAcle5SUuN1XIx5amjddTqDPyEm9pP\n", 397 "sNeBwR+TQi19pWHtQ5anr6PBIAxHC5uxhVpZDScZu0TlodWigo+1bfAJRyrIm/6+\n", 398 "AbmAyNC4txpNsOHgCFGW7q9T8OutaOhUw+jC6i3bxUQZ64L1sXuy2nZMzU19+Aro\n", 399 "TxSWYkIJg65SKwM/8ggyd5G7TXkv7w19+W/7Y9JV0c+kPueUZSgEGUG/GJF/Nrrc\n", 400 "TRfvqz7Qs9H9+hUiQl5K7tF9gj6aU3p1s1IZKR2x0lv4wDRUUgIjrvRzfQSGjhgf\n", 401 "6rBILI3EIxPN/PoZ3mHLYkhH5IyNj9R2GlMle52isNdW8BiNlePLx0/Jzg==\n", 402 "-----END X509 CRL-----\n", 403 NULL 404 }; 405 406 /* 407 * Verify |leaf| certificate (chained up to |root|). |crls| if 408 * not NULL, is a list of CRLs to include in the verification. It is 409 * also free'd before returning, which is kinda yucky but convenient. 410 * Returns a value from X509_V_ERR_xxx or X509_V_OK. 411 */ 412 static int verify(X509 *leaf, X509 *root, STACK_OF(X509_CRL) *crls, 413 unsigned long flags, time_t verification_time) 414 { 415 X509_STORE_CTX *ctx = X509_STORE_CTX_new(); 416 X509_STORE *store = X509_STORE_new(); 417 X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new(); 418 STACK_OF(X509) *roots = sk_X509_new_null(); 419 int status = X509_V_ERR_UNSPECIFIED; 420 421 if (!TEST_ptr(ctx) 422 || !TEST_ptr(store) 423 || !TEST_ptr(param) 424 || !TEST_ptr(roots)) 425 goto err; 426 427 /* Create a stack; upref the cert because we free it below. */ 428 if (!TEST_true(X509_up_ref(root))) 429 goto err; 430 if (!TEST_true(sk_X509_push(roots, root))) { 431 X509_free(root); 432 goto err; 433 } 434 if (!TEST_true(X509_STORE_CTX_init(ctx, store, leaf, NULL))) 435 goto err; 436 X509_STORE_CTX_set0_trusted_stack(ctx, roots); 437 X509_STORE_CTX_set0_crls(ctx, crls); 438 X509_VERIFY_PARAM_set_time(param, verification_time); 439 if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param), (long)verification_time)) 440 goto err; 441 X509_VERIFY_PARAM_set_depth(param, 16); 442 if (flags) 443 X509_VERIFY_PARAM_set_flags(param, flags); 444 X509_STORE_CTX_set0_param(ctx, param); 445 param = NULL; 446 447 ERR_clear_error(); 448 status = X509_verify_cert(ctx) == 1 ? X509_V_OK 449 : X509_STORE_CTX_get_error(ctx); 450 err: 451 OSSL_STACK_OF_X509_free(roots); 452 sk_X509_CRL_pop_free(crls, X509_CRL_free); 453 X509_VERIFY_PARAM_free(param); 454 X509_STORE_CTX_free(ctx); 455 X509_STORE_free(store); 456 return status; 457 } 458 459 /* 460 * Create a stack of CRL's. Upref each one because we call pop_free on 461 * the stack and need to keep the CRL's around until the test exits. 462 * Yes this crashes on malloc failure; it forces us to debug. 463 */ 464 static STACK_OF(X509_CRL) *make_CRL_stack(X509_CRL *x1, X509_CRL *x2) 465 { 466 STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null(); 467 468 if (x1 != NULL) { 469 if (!X509_CRL_up_ref(x1)) 470 goto err; 471 if (!sk_X509_CRL_push(sk, x1)) { 472 X509_CRL_free(x1); 473 goto err; 474 } 475 } 476 477 if (x2 != NULL) { 478 if (!X509_CRL_up_ref(x2)) 479 goto err; 480 if (!sk_X509_CRL_push(sk, x2)) { 481 X509_CRL_free(x2); 482 goto err; 483 } 484 } 485 486 return sk; 487 488 err: 489 sk_X509_CRL_pop_free(sk, X509_CRL_free); 490 return NULL; 491 } 492 493 static int test_basic_crl(void) 494 { 495 X509_CRL *basic_crl = CRL_from_strings(kBasicCRL); 496 X509_CRL *revoked_crl = CRL_from_strings(kRevokedCRL); 497 int r; 498 499 r = TEST_ptr(basic_crl) 500 && TEST_ptr(revoked_crl) 501 && TEST_int_eq(verify(test_leaf, test_root, 502 make_CRL_stack(basic_crl, NULL), 503 X509_V_FLAG_CRL_CHECK, PARAM_TIME), 504 X509_V_OK) 505 && TEST_int_eq(verify(test_leaf, test_root, 506 make_CRL_stack(basic_crl, revoked_crl), 507 X509_V_FLAG_CRL_CHECK, PARAM_TIME), 508 X509_V_ERR_CERT_REVOKED); 509 X509_CRL_free(basic_crl); 510 X509_CRL_free(revoked_crl); 511 return r; 512 } 513 514 static int test_no_crl(void) 515 { 516 return TEST_int_eq(verify(test_leaf, test_root, NULL, 517 X509_V_FLAG_CRL_CHECK, PARAM_TIME), 518 X509_V_ERR_UNABLE_TO_GET_CRL); 519 } 520 521 static int test_bad_issuer_crl(void) 522 { 523 X509_CRL *bad_issuer_crl = CRL_from_strings(kBadIssuerCRL); 524 int r; 525 526 r = TEST_ptr(bad_issuer_crl) 527 && TEST_int_eq(verify(test_leaf, test_root, 528 make_CRL_stack(bad_issuer_crl, NULL), 529 X509_V_FLAG_CRL_CHECK, PARAM_TIME), 530 X509_V_ERR_UNABLE_TO_GET_CRL); 531 X509_CRL_free(bad_issuer_crl); 532 return r; 533 } 534 535 static int test_crl_empty_idp(void) 536 { 537 X509_CRL *empty_idp_crl = CRL_from_strings(kEmptyIdpCRL); 538 int r; 539 540 r = TEST_ptr(empty_idp_crl) 541 && TEST_int_eq(verify(test_leaf2, test_root2, 542 make_CRL_stack(empty_idp_crl, NULL), 543 X509_V_FLAG_CRL_CHECK, PARAM_TIME2), 544 X509_V_ERR_UNABLE_TO_GET_CRL); 545 X509_CRL_free(empty_idp_crl); 546 return r; 547 } 548 549 static int test_known_critical_crl(void) 550 { 551 X509_CRL *known_critical_crl = CRL_from_strings(kKnownCriticalCRL); 552 int r; 553 554 r = TEST_ptr(known_critical_crl) 555 && TEST_int_eq(verify(test_leaf, test_root, 556 make_CRL_stack(known_critical_crl, NULL), 557 X509_V_FLAG_CRL_CHECK, PARAM_TIME), 558 X509_V_OK); 559 X509_CRL_free(known_critical_crl); 560 return r; 561 } 562 563 static int test_unknown_critical_crl(int n) 564 { 565 X509_CRL *unknown_critical_crl = CRL_from_strings(unknown_critical_crls[n]); 566 int r; 567 568 r = TEST_ptr(unknown_critical_crl) 569 && TEST_int_eq(verify(test_leaf, test_root, 570 make_CRL_stack(unknown_critical_crl, NULL), 571 X509_V_FLAG_CRL_CHECK, PARAM_TIME), 572 X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION); 573 X509_CRL_free(unknown_critical_crl); 574 return r; 575 } 576 577 static int test_reuse_crl(int idx) 578 { 579 X509_CRL *result, *reused_crl = CRL_from_strings(kBasicCRL); 580 X509_CRL *addref_crl = NULL; 581 char *p = NULL; 582 BIO *b = NULL; 583 int r = 0; 584 585 if (!TEST_ptr(reused_crl)) 586 goto err; 587 588 if (idx & 1) { 589 if (!TEST_true(X509_CRL_up_ref(reused_crl))) 590 goto err; 591 addref_crl = reused_crl; 592 } 593 594 idx >>= 1; 595 b = glue2bio(idx == 2 ? kRevokedCRL : kInvalidCRL + idx, &p); 596 597 if (!TEST_ptr(b)) 598 goto err; 599 600 result = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL); 601 602 switch (idx) { 603 case 0: /* valid PEM + invalid DER */ 604 if (!TEST_ptr_null(result) 605 || !TEST_ptr_null(reused_crl)) 606 goto err; 607 break; 608 case 1: /* invalid PEM */ 609 if (!TEST_ptr_null(result) 610 || !TEST_ptr(reused_crl)) 611 goto err; 612 break; 613 case 2: 614 if (!TEST_ptr(result) 615 || !TEST_ptr(reused_crl) 616 || !TEST_ptr_eq(result, reused_crl)) 617 goto err; 618 break; 619 } 620 621 r = 1; 622 623 err: 624 OPENSSL_free(p); 625 BIO_free(b); 626 X509_CRL_free(reused_crl); 627 X509_CRL_free(addref_crl); 628 return r; 629 } 630 631 /* 632 * Test to make sure X509_verify_cert sets the issuer, reasons, and 633 * CRL score of the CRLs it gets from X509_STORE_CTX->get_crl 634 */ 635 636 static int get_crl_fn(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x) 637 { 638 *crl = CRL_from_strings(kBasicCRL); 639 return 1; 640 } 641 642 static int test_get_crl_fn_score(void) 643 { 644 X509_STORE_CTX *ctx = X509_STORE_CTX_new(); 645 X509_STORE *store = X509_STORE_new(); 646 X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new(); 647 STACK_OF(X509) *roots = sk_X509_new_null(); 648 649 int status = X509_V_ERR_UNSPECIFIED; 650 651 if (!TEST_ptr(ctx) 652 || !TEST_ptr(store) 653 || !TEST_ptr(param) 654 || !TEST_ptr(roots)) 655 goto err; 656 657 /* Create a stack; upref the cert because we free it below. */ 658 if (!TEST_true(X509_up_ref(test_root))) 659 goto err; 660 if (!TEST_true(sk_X509_push(roots, test_root))) { 661 X509_free(test_root); 662 goto err; 663 } 664 if (!TEST_true(X509_STORE_CTX_init(ctx, store, test_leaf, NULL))) 665 goto err; 666 667 X509_STORE_CTX_set0_trusted_stack(ctx, roots); 668 X509_STORE_CTX_set_get_crl(ctx, &get_crl_fn); 669 X509_VERIFY_PARAM_set_time(param, PARAM_TIME); 670 if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param), 671 (long)PARAM_TIME)) 672 goto err; 673 X509_VERIFY_PARAM_set_depth(param, 16); 674 X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK); 675 X509_STORE_CTX_set0_param(ctx, param); 676 param = NULL; 677 678 ERR_clear_error(); 679 status = X509_verify_cert(ctx) == 1 ? X509_V_OK 680 : X509_STORE_CTX_get_error(ctx); 681 682 TEST_int_eq(status, X509_V_OK); 683 684 err: 685 OSSL_STACK_OF_X509_free(roots); 686 X509_VERIFY_PARAM_free(param); 687 X509_STORE_CTX_free(ctx); 688 X509_STORE_free(store); 689 return status == X509_V_OK; 690 } 691 692 /* 693 * Check that X509_CRL_verify() rejects a CRL where the outer 694 * signatureAlgorithm does not match the inner copy inside TBSCertList. 695 * RFC 5280 section 5.1.1.2 requires the two to be identical; X509_verify() 696 * and X509_ACERT_verify() enforce this, and so must X509_CRL_verify(). 697 * 698 * Both CRLs are issued by kRoot (RSA-2048). kCrlMismatchedSigAlg carries a 699 * valid RSA-SHA256 signature over a TBSCertList whose inner signatureAlgorithm 700 * claims ecdsaWithSHA256, while the outer wrapper carries the correct 701 * sha256WithRSAEncryption. Without the inner/outer comparison the signature 702 * would verify and the CRL would be accepted. 703 */ 704 static int test_crl_sigalg_mismatch(void) 705 { 706 X509 *root = X509_from_strings(kRoot); 707 X509_CRL *good = CRL_from_strings(kCrlRootCA); 708 X509_CRL *bad = CRL_from_strings(kCrlMismatchedSigAlg); 709 EVP_PKEY *pkey = NULL; 710 int ret = 0; 711 712 if (!TEST_ptr(root) || !TEST_ptr(good) || !TEST_ptr(bad)) 713 goto end; 714 715 pkey = X509_get0_pubkey(root); 716 if (!TEST_ptr(pkey)) 717 goto end; 718 719 /* Well-formed CRL: inner and outer algorithms match; verify succeeds. */ 720 if (!TEST_int_eq(X509_CRL_verify(good, pkey), 1)) 721 goto end; 722 723 /* 724 * Mismatched CRL: inner signatureAlgorithm is ecdsaWithSHA256, outer is 725 * sha256WithRSAEncryption, RSA signature is valid. X509_ALGOR_cmp() 726 * must catch the mismatch before the signature is checked. 727 */ 728 if (!TEST_int_eq(X509_CRL_verify(bad, pkey), 0)) 729 goto end; 730 731 ret = 1; 732 end: 733 X509_CRL_free(good); 734 X509_CRL_free(bad); 735 X509_free(root); 736 return ret; 737 } 738 739 int setup_tests(void) 740 { 741 if (!TEST_ptr(test_root = X509_from_strings(kCRLTestRoot)) 742 || !TEST_ptr(test_leaf = X509_from_strings(kCRLTestLeaf)) 743 || !TEST_ptr(test_root2 = X509_from_strings(kCRLTestRoot2)) 744 || !TEST_ptr(test_leaf2 = X509_from_strings(kCRLTestLeaf2))) 745 return 0; 746 747 ADD_TEST(test_no_crl); 748 ADD_TEST(test_basic_crl); 749 ADD_TEST(test_bad_issuer_crl); 750 ADD_TEST(test_crl_empty_idp); 751 ADD_TEST(test_known_critical_crl); 752 ADD_TEST(test_get_crl_fn_score); 753 ADD_ALL_TESTS(test_unknown_critical_crl, OSSL_NELEM(unknown_critical_crls)); 754 ADD_ALL_TESTS(test_reuse_crl, 6); 755 ADD_TEST(test_crl_sigalg_mismatch); 756 757 return 1; 758 } 759 760 void cleanup_tests(void) 761 { 762 X509_free(test_root); 763 X509_free(test_leaf); 764 X509_free(test_root2); 765 X509_free(test_leaf2); 766 } 767