root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity
openssl/test/ct_test.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

537 lines
16 KiB
C
Raw Normal View History

Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
/*
Copyright year updates Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2025-03-12 21:35:59 +08:00
* Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
*
Following the license change, modify the boilerplates in test/ Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7767)
2018-12-06 20:05:25 +08:00
* Licensed under the Apache License 2.0 (the "License"). You may not use
Copyright consolidation 02/10 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-18 02:20:24 +08:00
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
*/
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
Public API for Certificate Transparency Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-26 02:11:16 +08:00
#include <openssl/ct.h>
Normalise the include directives in ct_test.c build.info needed a slight update, one more include directory. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-26 15:57:06 +08:00
#include <openssl/err.h>
Minor update to includes and documentation for ct_test.c Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08 01:58:49 +08:00
#include <openssl/pem.h>
Normalise the include directives in ct_test.c build.info needed a slight update, one more include directory. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-26 15:57:06 +08:00
#include <openssl/x509.h>
#include <openssl/x509v3.h>
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
#include "testutil.h"
Reduce the use of e_os.h in test programs This includes unnecessary use of the top as inclusion directory Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5132)
2018-01-22 18:00:59 +08:00
#include <openssl/crypto.h>
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Remove OPENSSL_NO_UNIT_TEST guard from ct_test.c Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08 01:58:14 +08:00
#ifndef OPENSSL_NO_CT
In OpenSSL builds, declare STACK for datatypes ... ... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669)
2019-12-20 06:30:24 +08:00
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
/* Used when declaring buffers to read text files into */
Fix preprocessor indentation. Rework main() to be in the style of the other conditional tests. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3711)
2017-06-19 09:35:25 +08:00
# define CT_TEST_MAX_FILE_SIZE 8096
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Make ct_dir and certs_dir static in test/ct_test.c Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-10 00:24:34 +08:00
static char *certs_dir = NULL;
static char *ct_dir = NULL;
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
typedef struct ct_test_fixture {
const char *test_case_name;
Check that SCT timestamps are not in the future Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-09-08 23:02:46 +08:00
/* The current time in milliseconds */
uint64_t epoch_time_in_ms;
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
/* The CT log store to use during tests */
CTLOG_STORE* ctlog_store;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
/* Set the following to test handling of SCTs in X509 certificates */
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
const char *certs_dir;
char *certificate_file;
char *issuer_file;
Check that SCT timestamps are not in the future Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-09-08 23:02:46 +08:00
/* Expected number of SCTs */
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
int expected_sct_count;
Check that SCT timestamps are not in the future Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-09-08 23:02:46 +08:00
/* Expected number of valid SCTS */
int expected_valid_sct_count;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
/* Set the following to test handling of SCTs in TLS format */
Test SCT lists This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:38:14 +08:00
const unsigned char *tls_sct_list;
size_t tls_sct_list_len;
STACK_OF(SCT) *sct_list;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
/*
* A file to load the expected SCT text from.
* This text will be compared to the actual text output during the test.
* A maximum of |CT_TEST_MAX_FILE_SIZE| bytes will be read of this file.
*/
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
const char *sct_dir;
const char *sct_text_file;
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
/* Whether to test the validity of the SCT(s) */
int test_validity;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
} CT_TEST_FIXTURE;
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
static CT_TEST_FIXTURE *set_up(const char *const test_case_name)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
CT_TEST_FIXTURE *fixture = NULL;
Fix warnings exposed by clang-3.8 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-08 22:19:00 +08:00
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (!TEST_ptr(fixture = OPENSSL_zalloc(sizeof(*fixture))))
goto end;
fixture->test_case_name = test_case_name;
Create a new embeddedSCTs1 that's signed using SHA256 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> GH: #10786
2020-01-23 07:24:35 +08:00
fixture->epoch_time_in_ms = 1580335307000ULL; /* Wed 29 Jan 2020 10:01:47 PM UTC */
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (!TEST_ptr(fixture->ctlog_store = CTLOG_STORE_new())
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
|| !TEST_int_eq(
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
CTLOG_STORE_load_default_file(fixture->ctlog_store), 1))
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
goto end;
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
return fixture;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
end:
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture != NULL)
CTLOG_STORE_free(fixture->ctlog_store);
OPENSSL_free(fixture);
TEST_error("Failed to setup");
return NULL;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
static void tear_down(CT_TEST_FIXTURE *fixture)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture != NULL) {
CTLOG_STORE_free(fixture->ctlog_store);
SCT_LIST_free(fixture->sct_list);
}
OPENSSL_free(fixture);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
static X509 *load_pem_cert(const char *dir, const char *file)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
X509 *cert = NULL;
Extend tests of SSL_check_chain() Actually supply a chain and then test: 1) A successful check of both the ee and chain certs 2) A failure to check the ee cert 3) A failure to check a chain cert Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9442)
2019-07-24 00:10:05 +08:00
char *file_path = test_mk_file_path(dir, file);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
if (file_path != NULL) {
BIO *cert_io = BIO_new_file(file_path, "r");
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
if (cert_io != NULL)
cert = PEM_read_bio_X509(cert_io, NULL, NULL, NULL);
BIO_free(cert_io);
}
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
OPENSSL_free(file_path);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
return cert;
}
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
static int read_text_file(const char *dir, const char *file,
char *buffer, int buffer_length)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
int len = -1;
Extend tests of SSL_check_chain() Actually supply a chain and then test: 1) A successful check of both the ee and chain certs 2) A failure to check the ee cert 3) A failure to check a chain cert Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9442)
2019-07-24 00:10:05 +08:00
char *file_path = test_mk_file_path(dir, file);
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
if (file_path != NULL) {
BIO *file_io = BIO_new_file(file_path, "r");
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (file_io != NULL)
len = BIO_read(file_io, buffer, buffer_length);
BIO_free(file_io);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
OPENSSL_free(file_path);
return len;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Test SCT lists This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:38:14 +08:00
static int compare_sct_list_printout(STACK_OF(SCT) *sct,
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
const char *expected_output)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
BIO *text_buffer = NULL;
char *actual_output = NULL;
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
int result = 0;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (!TEST_ptr(text_buffer = BIO_new(BIO_s_mem())))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
Test SCT lists This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:38:14 +08:00
SCT_LIST_print(sct, text_buffer, 0, "\n", NULL);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
/* Append \0 because we're about to use the buffer contents as a string. */
if (!TEST_true(BIO_write(text_buffer, "\0", 1)))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
BIO_get_mem_data(text_buffer, &actual_output);
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (!TEST_str_eq(actual_output, expected_output))
goto end;
result = 1;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
end:
BIO_free(text_buffer);
return result;
}
static int compare_extension_printout(X509_EXTENSION *extension,
const char *expected_output)
{
BIO *text_buffer = NULL;
char *actual_output = NULL;
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
int result = 0;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (!TEST_ptr(text_buffer = BIO_new(BIO_s_mem()))
|| !TEST_true(X509V3_EXT_print(text_buffer, extension,
X509V3_EXT_DEFAULT, 0)))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
Create a new embeddedSCTs1 that's signed using SHA256 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> GH: #10786
2020-01-23 07:24:35 +08:00
/* Append \n because it's easier to create files that end with one. */
if (!TEST_true(BIO_write(text_buffer, "\n", 1)))
goto end;
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
/* Append \0 because we're about to use the buffer contents as a string. */
if (!TEST_true(BIO_write(text_buffer, "\0", 1)))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
BIO_get_mem_data(text_buffer, &actual_output);
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (!TEST_str_eq(actual_output, expected_output))
goto end;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
result = 1;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
end:
BIO_free(text_buffer);
return result;
}
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
static int assert_validity(CT_TEST_FIXTURE *fixture, STACK_OF(SCT) *scts,
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
CT_POLICY_EVAL_CTX *policy_ctx)
{
Tests should check validation status directly Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:56:02 +08:00
int invalid_sct_count = 0;
int valid_sct_count = 0;
int i;
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (!TEST_int_ge(SCT_LIST_validate(scts, policy_ctx), 0))
Tests should check validation status directly Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:56:02 +08:00
return 0;
for (i = 0; i < sk_SCT_num(scts); ++i) {
SCT *sct_i = sk_SCT_value(scts, i);
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
Tests should check validation status directly Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:56:02 +08:00
switch (SCT_get_validation_status(sct_i)) {
case SCT_VALIDATION_STATUS_VALID:
++valid_sct_count;
break;
case SCT_VALIDATION_STATUS_INVALID:
++invalid_sct_count;
break;
Add -Wswitch-enum Change code so when switching on an enumeration, have case's for all enumeration values. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-08-31 01:31:18 +08:00
case SCT_VALIDATION_STATUS_NOT_SET:
case SCT_VALIDATION_STATUS_UNKNOWN_LOG:
case SCT_VALIDATION_STATUS_UNVERIFIED:
case SCT_VALIDATION_STATUS_UNKNOWN_VERSION:
Tests should check validation status directly Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:56:02 +08:00
/* Ignore other validation statuses. */
break;
}
}
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (!TEST_int_eq(valid_sct_count, fixture->expected_valid_sct_count)) {
Tests should check validation status directly Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:56:02 +08:00
int unverified_sct_count = sk_SCT_num(scts) -
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
invalid_sct_count - valid_sct_count;
TEST_info("%d SCTs failed, %d SCTs unverified",
invalid_sct_count, unverified_sct_count);
Tests should check validation status directly Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:56:02 +08:00
return 0;
}
return 1;
}
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
static int execute_cert_test(CT_TEST_FIXTURE *fixture)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
testutil: return 1 on success Require that test methods return 1 on success (not 0). This is more customary for OpenSSL. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-05 20:29:06 +08:00
int success = 0;
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
X509 *cert = NULL, *issuer = NULL;
STACK_OF(SCT) *scts = NULL;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
SCT *sct = NULL;
char expected_sct_text[CT_TEST_MAX_FILE_SIZE];
int sct_text_len = 0;
Test SCT lists This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:38:14 +08:00
unsigned char *tls_sct_list = NULL;
size_t tls_sct_list_len = 0;
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
CT_POLICY_EVAL_CTX *ct_policy_ctx = CT_POLICY_EVAL_CTX_new();
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->sct_text_file != NULL) {
sct_text_len = read_text_file(fixture->sct_dir, fixture->sct_text_file,
Fix ct_test to not assume it's in the source directory ct_test assumed it's run in the source directory and failed when built elsewhere. It still defaults to that, but can be told another story with the environment variables CT_DIR and CERTS_DIR. Test recipe updated to match. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09 21:10:05 +08:00
expected_sct_text,
CT_TEST_MAX_FILE_SIZE - 1);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (!TEST_int_ge(sct_text_len, 0))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
expected_sct_text[sct_text_len] = '\0';
}
Improves CTLOG_STORE setters Changes them to have clearer ownership semantics, as suggested in https://github.com/openssl/openssl/pull/1372#discussion_r73232196. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1408)
2016-08-05 21:17:31 +08:00
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
ct_policy_ctx, fixture->ctlog_store);
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
CT_POLICY_EVAL_CTX_set_time(ct_policy_ctx, fixture->epoch_time_in_ms);
Check that SCT timestamps are not in the future Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-09-08 23:02:46 +08:00
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->certificate_file != NULL) {
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
int sct_extension_index;
Update the test to assert that the SCT is from an X.509 extension Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3149)
2017-04-08 21:33:17 +08:00
int i;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
X509_EXTENSION *sct_extension = NULL;
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (!TEST_ptr(cert = load_pem_cert(fixture->certs_dir,
fixture->certificate_file)))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
Improves CTLOG_STORE setters Changes them to have clearer ownership semantics, as suggested in https://github.com/openssl/openssl/pull/1372#discussion_r73232196. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1408)
2016-08-05 21:17:31 +08:00
CT_POLICY_EVAL_CTX_set1_cert(ct_policy_ctx, cert);
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->issuer_file != NULL) {
if (!TEST_ptr(issuer = load_pem_cert(fixture->certs_dir,
fixture->issuer_file)))
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
goto end;
Improves CTLOG_STORE setters Changes them to have clearer ownership semantics, as suggested in https://github.com/openssl/openssl/pull/1372#discussion_r73232196. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1408)
2016-08-05 21:17:31 +08:00
CT_POLICY_EVAL_CTX_set1_issuer(ct_policy_ctx, issuer);
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
}
sct_extension_index =
X509_get_ext_by_NID(cert, NID_ct_precert_scts, -1);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
sct_extension = X509_get_ext(cert, sct_extension_index);
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->expected_sct_count > 0) {
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (!TEST_ptr(sct_extension))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->sct_text_file
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
&& !compare_extension_printout(sct_extension,
expected_sct_text))
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
goto end;
Update the test to assert that the SCT is from an X.509 extension Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3149)
2017-04-08 21:33:17 +08:00
scts = X509V3_EXT_d2i(sct_extension);
for (i = 0; i < sk_SCT_num(scts); ++i) {
SCT *sct_i = sk_SCT_value(scts, i);
Removes SCT_LIST_set_source and SCT_LIST_set0_logs Both of these functions can easily be implemented by callers instead. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09 03:09:06 +08:00
test/ct_test.c: remove dependency on -lm. fabs(3m) is customarily inlined, but it's not, one has to link with -lm. Since fabs(3m) is the only reference, it makes more sense to avoid it. Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-02-25 23:24:34 +08:00
if (!TEST_int_eq(SCT_get_source(sct_i),
SCT_SOURCE_X509V3_EXTENSION)) {
Update the test to assert that the SCT is from an X.509 extension Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3149)
2017-04-08 21:33:17 +08:00
goto end;
Extensive application of __owur to CT functions that return a boolean Also improves some documentation of those functions. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-05 03:51:43 +08:00
}
Update the test to assert that the SCT is from an X.509 extension Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3149)
2017-04-08 21:33:17 +08:00
}
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->test_validity) {
Tests should check validation status directly Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:56:02 +08:00
if (!assert_validity(fixture, scts, ct_policy_ctx))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
}
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
} else if (!TEST_ptr_null(sct_extension)) {
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
}
}
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->tls_sct_list != NULL) {
const unsigned char *p = fixture->tls_sct_list;
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (!TEST_ptr(o2i_SCT_LIST(&scts, &p, fixture->tls_sct_list_len)))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->test_validity && cert != NULL) {
Tests should check validation status directly Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:56:02 +08:00
if (!assert_validity(fixture, scts, ct_policy_ctx))
Suppress CT callback as appropriate Suppress CT callbacks with aNULL or PSK ciphersuites that involve no certificates. Ditto when the certificate chain is validated via DANE-TA(2) or DANE-EE(3) TLSA records. Also skip SCT processing when the chain is fails verification. Move and consolidate CT callbacks from libcrypto to libssl. We also simplify the interface to SSL_{,CTX_}_enable_ct() which can specify either a permissive mode that just collects information or a strict mode that requires at least one valid SCT or else asks to abort the connection. Simplified SCT processing and options in s_client(1) which now has just a simple pair of "-noct" vs. "-ct" options, the latter enables the permissive callback so that we can complete the handshake and report all relevant information. When printing SCTs, print the validation status if set and not valid. Signed-off-by: Rob Percival <robpercival@google.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-04-08 02:17:37 +08:00
goto end;
}
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (fixture->sct_text_file
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
&& !compare_sct_list_printout(scts, expected_sct_text)) {
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
}
Test SCT lists This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:38:14 +08:00
tls_sct_list_len = i2o_SCT_LIST(scts, &tls_sct_list);
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
if (!TEST_mem_eq(fixture->tls_sct_list, fixture->tls_sct_list_len,
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
tls_sct_list, tls_sct_list_len))
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
goto end;
}
testutil: return 1 on success Require that test methods return 1 on success (not 0). This is more customary for OpenSSL. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-05 20:29:06 +08:00
success = 1;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
end:
X509_free(cert);
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
X509_free(issuer);
SCT_LIST_free(scts);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
SCT_free(sct);
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
CT_POLICY_EVAL_CTX_free(ct_policy_ctx);
Test SCT lists This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:38:14 +08:00
OPENSSL_free(tls_sct_list);
testutil: return 1 on success Require that test methods return 1 on success (not 0). This is more customary for OpenSSL. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-05 20:29:06 +08:00
return success;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
# define SETUP_CT_TEST_FIXTURE() SETUP_TEST_FIXTURE(CT_TEST_FIXTURE, set_up)
Fix preprocessor indentation. Rework main() to be in the style of the other conditional tests. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3711)
2017-06-19 09:35:25 +08:00
# define EXECUTE_CT_TEST() EXECUTE_TEST(execute_cert_test, tear_down)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_no_scts_in_certificate(void)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
SETUP_CT_TEST_FIXTURE();
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->certs_dir = certs_dir;
fixture->certificate_file = "leaf.pem";
fixture->issuer_file = "subinterCA.pem";
fixture->expected_sct_count = 0;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
EXECUTE_CT_TEST();
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
return result;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_one_sct_in_certificate(void)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
SETUP_CT_TEST_FIXTURE();
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->certs_dir = certs_dir;
fixture->certificate_file = "embeddedSCTs1.pem";
fixture->issuer_file = "embeddedSCTs1_issuer.pem";
fixture->expected_sct_count = 1;
fixture->sct_dir = certs_dir;
fixture->sct_text_file = "embeddedSCTs1.sct";
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
EXECUTE_CT_TEST();
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
return result;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_multiple_scts_in_certificate(void)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
SETUP_CT_TEST_FIXTURE();
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->certs_dir = certs_dir;
fixture->certificate_file = "embeddedSCTs3.pem";
fixture->issuer_file = "embeddedSCTs3_issuer.pem";
fixture->expected_sct_count = 3;
fixture->sct_dir = certs_dir;
fixture->sct_text_file = "embeddedSCTs3.sct";
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
EXECUTE_CT_TEST();
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
return result;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_verify_one_sct(void)
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
{
SETUP_CT_TEST_FIXTURE();
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->certs_dir = certs_dir;
fixture->certificate_file = "embeddedSCTs1.pem";
fixture->issuer_file = "embeddedSCTs1_issuer.pem";
fixture->expected_sct_count = fixture->expected_valid_sct_count = 1;
fixture->test_validity = 1;
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
EXECUTE_CT_TEST();
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
return result;
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
}
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_verify_multiple_scts(void)
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
{
SETUP_CT_TEST_FIXTURE();
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->certs_dir = certs_dir;
fixture->certificate_file = "embeddedSCTs3.pem";
fixture->issuer_file = "embeddedSCTs3_issuer.pem";
fixture->expected_sct_count = fixture->expected_valid_sct_count = 3;
fixture->test_validity = 1;
Check that SCT timestamps are not in the future Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-09-08 23:02:46 +08:00
EXECUTE_CT_TEST();
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
return result;
Check that SCT timestamps are not in the future Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-09-08 23:02:46 +08:00
}
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_verify_fails_for_future_sct(void)
Check that SCT timestamps are not in the future Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-09-08 23:02:46 +08:00
{
SETUP_CT_TEST_FIXTURE();
fix truncation of integers on 32bit AIX Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8417)
2019-03-06 10:57:09 +08:00
fixture->epoch_time_in_ms = 1365094800000ULL; /* Apr 4 17:00:00 2013 GMT */
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->certs_dir = certs_dir;
fixture->certificate_file = "embeddedSCTs1.pem";
fixture->issuer_file = "embeddedSCTs1_issuer.pem";
fixture->expected_sct_count = 1;
fixture->expected_valid_sct_count = 0;
fixture->test_validity = 1;
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
EXECUTE_CT_TEST();
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
return result;
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
}
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_decode_tls_sct(void)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
Test SCT lists This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:38:14 +08:00
const unsigned char tls_sct_list[] = "\x00\x78" /* length of list */
"\x00\x76"
"\x00" /* version */
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
/* log ID */
"\xDF\x1C\x2E\xC1\x15\x00\x94\x52\x47\xA9\x61\x68\x32\x5D\xDC\x5C\x79"
"\x59\xE8\xF7\xC6\xD3\x88\xFC\x00\x2E\x0B\xBD\x3F\x74\xD7\x64"
"\x00\x00\x01\x3D\xDB\x27\xDF\x93" /* timestamp */
"\x00\x00" /* extensions length */
"" /* extensions */
"\x04\x03" /* hash and signature algorithms */
"\x00\x47" /* signature length */
Make SCT literals into const variables in ct_test.c Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09 10:46:15 +08:00
/* signature */
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
"\x30\x45\x02\x20\x48\x2F\x67\x51\xAF\x35\xDB\xA6\x54\x36\xBE\x1F\xD6"
"\x64\x0F\x3D\xBF\x9A\x41\x42\x94\x95\x92\x45\x30\x28\x8F\xA3\xE5\xE2"
"\x3E\x06\x02\x21\x00\xE4\xED\xC0\xDB\x3A\xC5\x72\xB1\xE2\xF5\xE8\xAB"
"\x6A\x68\x06\x53\x98\x7D\xCF\x41\x02\x7D\xFE\xFF\xA1\x05\x51\x9D\x89"
Make SCT literals into const variables in ct_test.c Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09 10:46:15 +08:00
"\xED\xBF\x08";
SETUP_CT_TEST_FIXTURE();
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->tls_sct_list = tls_sct_list;
fixture->tls_sct_list_len = 0x7a;
fixture->sct_dir = ct_dir;
fixture->sct_text_file = "tls1.sct";
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
EXECUTE_CT_TEST();
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
return result;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_encode_tls_sct(void)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
Construct SCT from base64 in ct_test This gives better code coverage and is more representative of how a user would likely construct an SCT (using the base64 returned by a CT log). Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1548)
2016-09-08 00:47:56 +08:00
const char log_id[] = "3xwuwRUAlFJHqWFoMl3cXHlZ6PfG04j8AC4LvT9012Q=";
const uint64_t timestamp = 1;
const char extensions[] = "";
Use valid signature in test_decode_tls_sct() Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1548)
2016-10-19 22:39:13 +08:00
const char signature[] = "BAMARzBAMiBIL2dRrzXbplQ2vh/WZA89v5pBQpSVkkUwKI+j5"
"eI+BgIhAOTtwNs6xXKx4vXoq2poBlOYfc9BAn3+/6EFUZ2J7b8I";
Make sure things get deleted when test setup fails in ct_test.c Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1548)
2016-10-19 22:40:46 +08:00
SCT *sct = NULL;
Make SCT literals into const variables in ct_test.c Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09 10:46:15 +08:00
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
SETUP_CT_TEST_FIXTURE();
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->sct_list = sk_SCT_new_null();
test/ct_test.c: Add the missing check after calling sk_SCT_new_null As the potential failure of the allocation, the sk_SCT_new_null() could return NULL pointer if fails. And then sk_SCT_push() uses the 'fixture->sct_list' and returns -1 if fails. But the return value of the sk_SCT_push() is not checked. I think it is better to check it just after the allocation. CLA: trivial Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17571)
2022-01-24 11:18:38 +08:00
if (fixture->sct_list == NULL)
Invoke tear_down when exiting test_encode_tls_sct() prematurely Fixes #24121 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24222)
2024-04-22 07:48:33 +08:00
{
tear_down(fixture);
return 0;
}
test/ct_test.c: Add the missing check after calling sk_SCT_new_null As the potential failure of the allocation, the sk_SCT_new_null() could return NULL pointer if fails. And then sk_SCT_push() uses the 'fixture->sct_list' and returns -1 if fails. But the return value of the sk_SCT_push() is not checked. I think it is better to check it just after the allocation. CLA: trivial Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17571)
2022-01-24 11:18:38 +08:00
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if (!TEST_ptr(sct = SCT_new_from_base64(SCT_VERSION_V1, log_id,
CT_LOG_ENTRY_TYPE_X509, timestamp,
extensions, signature)))
Invoke tear_down when exiting test_encode_tls_sct() prematurely Fixes #24121 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24222)
2024-04-22 07:48:33 +08:00
{
tear_down(fixture);
Simplify tests part 2 1) Remove some unnecessary fixtures 2) Add EXECUTE_TEST_NO_TEARDOWN shorthand when a fixture exists but has no teardown. 3) Fix return values in ct_test.c (introduced by an earlier refactoring, oops) Note that for parameterized tests, the index (test vector) usually holds all the customization, and there should be no need for a separate test fixture. The CTS test is an exception: it demonstrates how to combine customization with parameterization. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-11-04 23:06:12 +08:00
return 0;
Invoke tear_down when exiting test_encode_tls_sct() prematurely Fixes #24121 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24222)
2024-04-22 07:48:33 +08:00
}
Test SCT lists This encompasses what was previously tested. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-08 00:38:14 +08:00
Check returns of various sk_*_push functions Check returns of sk_POLICY_MAPPING_push, sk_GENERAL_NAME_push, sk_ACCESS_DESCRIPTION_push, sk_X509_push, sk_X509_NAME_push, sk_OPENSSL_CSTRING_push, sk_SCT_push, sk_DIST_POINT_push, sk_OSSL_CMP_CRLSTATUS_push, sk_ASN1_UTF8STRING_push and sk_ASN1_OBJECT_push and handle appropriately. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26240)
2024-12-21 22:15:11 +08:00
if (!sk_SCT_push(fixture->sct_list, sct)) {
tear_down(fixture);
return 0;
}
Test fixtures changed to pointers. Change the fixture types to pointers to structures that are heap allocated in the tests that use SETUP_TEST_FIXTURE. This will permit error returns from the setup function and allow for future running tests in parallel. Also removed a call of `exit(2)` which allows the remaining tests to run if one fails to initialise. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4071)
2017-08-02 11:48:29 +08:00
fixture->sct_dir = ct_dir;
fixture->sct_text_file = "tls1.sct";
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
EXECUTE_CT_TEST();
Change SETUP_TEST_FIXTURE so that the fixture structure is passed by reference not by value. This allows an error return from the setup function. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4083)
2017-08-04 08:49:38 +08:00
return result;
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
}
Add test for CT_POLICY_EVAL_CTX default time Checks that the epoch_time_in_ms field of CT_POLICY_EVAL_CTX is initialized to approximately the current time (as returned by time()) by default. This prevents the addition of this field, and its verification during SCT validation, from breaking existing code that calls SCT_validate directly. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-11-15 18:42:57 +08:00
/*
* Tests that the CT_POLICY_EVAL_CTX default time is approximately now.
* Allow +-10 minutes, as it may compensate for clock skew.
*/
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_default_ct_policy_eval_ctx_time_is_now(void)
Add test for CT_POLICY_EVAL_CTX default time Checks that the epoch_time_in_ms field of CT_POLICY_EVAL_CTX is initialized to approximately the current time (as returned by time()) by default. This prevents the addition of this field, and its verification during SCT validation, from breaking existing code that calls SCT_validate directly. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-11-15 18:42:57 +08:00
{
int success = 0;
CT_POLICY_EVAL_CTX *ct_policy_ctx = CT_POLICY_EVAL_CTX_new();
Add an explicit cast to time_t Caused a compilation failure in some environments Fixes #7204 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7205)
2018-09-12 23:49:19 +08:00
const time_t default_time =
(time_t)(CT_POLICY_EVAL_CTX_get_time(ct_policy_ctx) / 1000);
Add test for CT_POLICY_EVAL_CTX default time Checks that the epoch_time_in_ms field of CT_POLICY_EVAL_CTX is initialized to approximately the current time (as returned by time()) by default. This prevents the addition of this field, and its verification during SCT validation, from breaking existing code that calls SCT_validate directly. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-11-15 18:42:57 +08:00
const time_t time_tolerance = 600; /* 10 minutes */
test/ct_test.c: remove dependency on -lm. fabs(3m) is customarily inlined, but it's not, one has to link with -lm. Since fabs(3m) is the only reference, it makes more sense to avoid it. Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-02-25 23:24:34 +08:00
if (!TEST_time_t_le(abs((int)difftime(time(NULL), default_time)),
time_tolerance))
Add test for CT_POLICY_EVAL_CTX default time Checks that the epoch_time_in_ms field of CT_POLICY_EVAL_CTX is initialized to approximately the current time (as returned by time()) by default. This prevents the addition of this field, and its verification during SCT validation, from breaking existing code that calls SCT_validate directly. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-11-15 18:42:57 +08:00
goto end;
success = 1;
end:
CT_POLICY_EVAL_CTX_free(ct_policy_ctx);
return success;
}
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
static int test_ctlog_from_base64(void)
{
Fix compiler warnings Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3839)
2017-07-05 11:40:23 +08:00
CTLOG *ctlogp = NULL;
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
const char notb64[] = "\01\02\03\04";
const char pad[] = "====";
const char name[] = "name";
/* We expect these to both fail! */
Fix compiler warnings Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3839)
2017-07-05 11:40:23 +08:00
if (!TEST_true(!CTLOG_new_from_base64(&ctlogp, notb64, name))
|| !TEST_true(!CTLOG_new_from_base64(&ctlogp, pad, name)))
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
return 0;
return 1;
}
Fix preprocessor indentation. Rework main() to be in the style of the other conditional tests. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3711)
2017-06-19 09:35:25 +08:00
#endif
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
Update the test framework so that the need for test_main is removed. Everything that needed test_main now works using the same infrastructure as tests that used register_tests. This meant: * renaming register_tests to setup_tests and giving it a success/failure return. * renaming the init_test function to setup_test_framework. * renaming the finish_test function to pulldown_test_framework. * adding a user provided global_init function that runs before the test frame work is initialised. It returns a failure indication that stops the stest. * adding helper functions that permit tests to access their command line args. * spliting the BIO initialisation and finalisation out from the test setup and teardown. * hiding some of the now test internal functions. * fix the comments in testutil.h Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3953)
2017-07-18 09:48:27 +08:00
int setup_tests(void)
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
{
Fix preprocessor indentation. Rework main() to be in the style of the other conditional tests. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3711)
2017-06-19 09:35:25 +08:00
#ifndef OPENSSL_NO_CT
Convert more tests ct_test,evp_extra_test,wpackettest,packettest Add strncmp TEST wrappers And make some style/consistency fixes to ct_test Silence travis; gcc bug? Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3234)
2017-04-19 04:33:15 +08:00
if ((ct_dir = getenv("CT_DIR")) == NULL)
ct_dir = "ct";
if ((certs_dir = getenv("CERTS_DIR")) == NULL)
certs_dir = "certs";
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
ADD_TEST(test_no_scts_in_certificate);
ADD_TEST(test_one_sct_in_certificate);
ADD_TEST(test_multiple_scts_in_certificate);
CT policy validation Specifies a callback that will, in the future, be used by the SSL code to decide whether to abort a connection on Certificate Transparency grounds. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-01 01:33:02 +08:00
ADD_TEST(test_verify_one_sct);
ADD_TEST(test_verify_multiple_scts);
Check that SCT timestamps are not in the future Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-09-08 23:02:46 +08:00
ADD_TEST(test_verify_fails_for_future_sct);
Tests for parsing and printing certificates containing SCTs Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-23 00:51:44 +08:00
ADD_TEST(test_decode_tls_sct);
ADD_TEST(test_encode_tls_sct);
Add test for CT_POLICY_EVAL_CTX default time Checks that the epoch_time_in_ms field of CT_POLICY_EVAL_CTX is initialized to approximately the current time (as returned by time()) by default. This prevents the addition of this field, and its verification during SCT validation, from breaking existing code that calls SCT_validate directly. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1554)
2016-11-15 18:42:57 +08:00
ADD_TEST(test_default_ct_policy_eval_ctx_time_is_now);
Fix memory leaks in CTLOG_new_from_base64 Move the call to ct_base64_decode(), which allocates, until after the check for NULL output parameter. Also place a cap on the number of padding characters used to decrement the output length -- any more than two '='s is not permitted in a well-formed base64 text. Prior to this change, ct_base64_decode() would return a length of -1 along with allocated storage for an input of "====". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3379)
2017-06-10 01:31:11 +08:00
ADD_TEST(test_ctlog_from_base64);
Fix no-ct in test/ct_test.c Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1890)
2016-11-10 08:33:54 +08:00
#else
printf("No CT support\n");
Add main() test methods to reduce test boilerplate. Simple tests only need to implement register_tests(). Tests that need a custom main() should implement test_main(). This will be wrapped in a main() that performs common setup/teardown (currently crypto-mdebug). Note that for normal development, enable-asan is usually sufficient for detecting leaks, and more versatile. enable-crypto-mdebug is stricter as it will also insist that all static variables be freed. This is useful for debugging library init/deinit; however, it also means that test_main() must free everything it allocates. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07 23:53:15 +08:00
#endif
Update the test framework so that the need for test_main is removed. Everything that needed test_main now works using the same infrastructure as tests that used register_tests. This meant: * renaming register_tests to setup_tests and giving it a success/failure return. * renaming the init_test function to setup_test_framework. * renaming the finish_test function to pulldown_test_framework. * adding a user provided global_init function that runs before the test frame work is initialised. It returns a failure indication that stops the stest. * adding helper functions that permit tests to access their command line args. * spliting the BIO initialisation and finalisation out from the test setup and teardown. * hiding some of the now test internal functions. * fix the comments in testutil.h Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3953)
2017-07-18 09:48:27 +08:00
return 1;
Fix preprocessor indentation. Rework main() to be in the style of the other conditional tests. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3711)
2017-06-19 09:35:25 +08:00
}