verify_extra_test.c (1.1.1.6) | verify_extra_test.c (1.1.1.1) |
---|---|
1/* | 1/* |
2 * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. | 2 * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. |
3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10#include <stdio.h> 11#include <openssl/crypto.h> 12#include <openssl/bio.h> 13#include <openssl/x509.h> | 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10#include <stdio.h> 11#include <openssl/crypto.h> 12#include <openssl/bio.h> 13#include <openssl/x509.h> |
14#include <openssl/x509v3.h> | |
15#include <openssl/pem.h> 16#include <openssl/err.h> | 14#include <openssl/pem.h> 15#include <openssl/err.h> |
17#include "testutil.h" | |
18 | 16 |
19static const char *certs_dir; 20static char *roots_f = NULL; 21static char *untrusted_f = NULL; 22static char *bad_f = NULL; 23static char *good_f = NULL; 24static char *sroot_cert = NULL; 25static char *ca_cert = NULL; 26static char *ee_cert = NULL; 27 28static X509 *load_cert_pem(const char *file) 29{ 30 X509 *cert = NULL; 31 BIO *bio = NULL; 32 33 if (!TEST_ptr(bio = BIO_new(BIO_s_file()))) 34 return NULL; 35 if (TEST_int_gt(BIO_read_filename(bio, file), 0)) 36 (void)TEST_ptr(cert = PEM_read_bio_X509(bio, NULL, NULL, NULL)); 37 38 BIO_free(bio); 39 return cert; 40} 41 | |
42static STACK_OF(X509) *load_certs_from_file(const char *filename) 43{ 44 STACK_OF(X509) *certs; 45 BIO *bio; 46 X509 *x; 47 48 bio = BIO_new_file(filename, "r"); 49 --- 23 unchanged lines hidden (view full) --- 73 } 74 } while (x != NULL); 75 76 BIO_free(bio); 77 78 return certs; 79} 80 | 17static STACK_OF(X509) *load_certs_from_file(const char *filename) 18{ 19 STACK_OF(X509) *certs; 20 BIO *bio; 21 X509 *x; 22 23 bio = BIO_new_file(filename, "r"); 24 --- 23 unchanged lines hidden (view full) --- 48 } 49 } while (x != NULL); 50 51 BIO_free(bio); 52 53 return certs; 54} 55 |
81/*- | 56/* |
82 * Test for CVE-2015-1793 (Alternate Chains Certificate Forgery) 83 * 84 * Chain is as follows: 85 * 86 * rootCA (self-signed) 87 * | 88 * interCA 89 * | --- 12 unchanged lines hidden (view full) --- 102 * (roots.pem) 103 * leaf and subinterCA are in the untrusted list (untrusted.pem) 104 * bad is the certificate being verified (bad.pem) 105 * 106 * Versions vulnerable to CVE-2015-1793 will fail to detect that leaf has 107 * CA=FALSE, and will therefore incorrectly verify bad 108 * 109 */ | 57 * Test for CVE-2015-1793 (Alternate Chains Certificate Forgery) 58 * 59 * Chain is as follows: 60 * 61 * rootCA (self-signed) 62 * | 63 * interCA 64 * | --- 12 unchanged lines hidden (view full) --- 77 * (roots.pem) 78 * leaf and subinterCA are in the untrusted list (untrusted.pem) 79 * bad is the certificate being verified (bad.pem) 80 * 81 * Versions vulnerable to CVE-2015-1793 will fail to detect that leaf has 82 * CA=FALSE, and will therefore incorrectly verify bad 83 * 84 */ |
110static int test_alt_chains_cert_forgery(void) | 85static int test_alt_chains_cert_forgery(const char *roots_f, 86 const char *untrusted_f, 87 const char *bad_f) |
111{ 112 int ret = 0; 113 int i; 114 X509 *x = NULL; 115 STACK_OF(X509) *untrusted = NULL; 116 BIO *bio = NULL; 117 X509_STORE_CTX *sctx = NULL; 118 X509_STORE *store = NULL; 119 X509_LOOKUP *lookup = NULL; 120 121 store = X509_STORE_new(); 122 if (store == NULL) 123 goto err; 124 125 lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); 126 if (lookup == NULL) 127 goto err; | 88{ 89 int ret = 0; 90 int i; 91 X509 *x = NULL; 92 STACK_OF(X509) *untrusted = NULL; 93 BIO *bio = NULL; 94 X509_STORE_CTX *sctx = NULL; 95 X509_STORE *store = NULL; 96 X509_LOOKUP *lookup = NULL; 97 98 store = X509_STORE_new(); 99 if (store == NULL) 100 goto err; 101 102 lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); 103 if (lookup == NULL) 104 goto err; |
128 if (!X509_LOOKUP_load_file(lookup, roots_f, X509_FILETYPE_PEM)) | 105 if(!X509_LOOKUP_load_file(lookup, roots_f, X509_FILETYPE_PEM)) |
129 goto err; 130 131 untrusted = load_certs_from_file(untrusted_f); 132 133 if ((bio = BIO_new_file(bad_f, "r")) == NULL) 134 goto err; 135 | 106 goto err; 107 108 untrusted = load_certs_from_file(untrusted_f); 109 110 if ((bio = BIO_new_file(bad_f, "r")) == NULL) 111 goto err; 112 |
136 if ((x = PEM_read_bio_X509(bio, NULL, 0, NULL)) == NULL) | 113 if((x = PEM_read_bio_X509(bio, NULL, 0, NULL)) == NULL) |
137 goto err; 138 139 sctx = X509_STORE_CTX_new(); 140 if (sctx == NULL) 141 goto err; 142 143 if (!X509_STORE_CTX_init(sctx, store, x, untrusted)) 144 goto err; 145 146 i = X509_verify_cert(sctx); 147 | 114 goto err; 115 116 sctx = X509_STORE_CTX_new(); 117 if (sctx == NULL) 118 goto err; 119 120 if (!X509_STORE_CTX_init(sctx, store, x, untrusted)) 121 goto err; 122 123 i = X509_verify_cert(sctx); 124 |
148 if (i != 0 || X509_STORE_CTX_get_error(sctx) != X509_V_ERR_INVALID_CA) 149 goto err; 150 151 /* repeat with X509_V_FLAG_X509_STRICT */ 152 X509_STORE_CTX_cleanup(sctx); 153 X509_STORE_set_flags(store, X509_V_FLAG_X509_STRICT); 154 155 if (!X509_STORE_CTX_init(sctx, store, x, untrusted)) 156 goto err; 157 158 i = X509_verify_cert(sctx); 159 160 if (i == 0 && X509_STORE_CTX_get_error(sctx) == X509_V_ERR_INVALID_CA) | 125 if (i == 0 && X509_STORE_CTX_get_error(sctx) == X509_V_ERR_INVALID_CA) { |
161 /* This is the result we were expecting: Test passed */ 162 ret = 1; | 126 /* This is the result we were expecting: Test passed */ 127 ret = 1; |
163 | 128 } |
164 err: 165 X509_STORE_CTX_free(sctx); 166 X509_free(x); 167 BIO_free(bio); 168 sk_X509_pop_free(untrusted, X509_free); 169 X509_STORE_free(store); | 129 err: 130 X509_STORE_CTX_free(sctx); 131 X509_free(x); 132 BIO_free(bio); 133 sk_X509_pop_free(untrusted, X509_free); 134 X509_STORE_free(store); |
135 if (ret != 1) 136 ERR_print_errors_fp(stderr); |
|
170 return ret; 171} 172 | 137 return ret; 138} 139 |
173static int test_store_ctx(void) | 140int main(int argc, char **argv) |
174{ | 141{ |
175 X509_STORE_CTX *sctx = NULL; 176 X509 *x = NULL; 177 BIO *bio = NULL; 178 int testresult = 0, ret; | 142 CRYPTO_set_mem_debug(1); 143 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); |
179 | 144 |
180 bio = BIO_new_file(bad_f, "r"); 181 if (bio == NULL) 182 goto err; 183 184 x = PEM_read_bio_X509(bio, NULL, 0, NULL); 185 if (x == NULL) 186 goto err; 187 188 sctx = X509_STORE_CTX_new(); 189 if (sctx == NULL) 190 goto err; 191 192 if (!X509_STORE_CTX_init(sctx, NULL, x, NULL)) 193 goto err; 194 195 /* Verifying a cert where we have no trusted certs should fail */ 196 ret = X509_verify_cert(sctx); 197 198 if (ret == 0) { 199 /* This is the result we were expecting: Test passed */ 200 testresult = 1; | 145 if (argc != 4) { 146 fprintf(stderr, "usage: verify_extra_test roots.pem untrusted.pem bad.pem\n"); 147 return 1; |
201 } 202 | 148 } 149 |
203 err: 204 X509_STORE_CTX_free(sctx); 205 X509_free(x); 206 BIO_free(bio); 207 return testresult; 208} 209 210static int test_self_signed(const char *filename, int expected) 211{ 212 X509 *cert = load_cert_pem(filename); 213 STACK_OF(X509) *trusted = sk_X509_new_null(); 214 X509_STORE_CTX *ctx = X509_STORE_CTX_new(); 215 int ret; 216 217 ret = TEST_ptr(cert) 218 && TEST_true(sk_X509_push(trusted, cert)) 219 && TEST_true(X509_STORE_CTX_init(ctx, NULL, cert, NULL)); 220 X509_STORE_CTX_set0_trusted_stack(ctx, trusted); 221 ret = ret && TEST_int_eq(X509_verify_cert(ctx), expected); 222 223 X509_STORE_CTX_free(ctx); 224 sk_X509_free(trusted); 225 X509_free(cert); 226 return ret; 227} 228 229static int test_self_signed_good(void) 230{ 231 return test_self_signed(good_f, 1); 232} 233 234static int test_self_signed_bad(void) 235{ 236 return test_self_signed(bad_f, 0); 237} 238 239static int do_test_purpose(int purpose, int expected) 240{ 241 X509 *eecert = load_cert_pem(ee_cert); /* may result in NULL */ 242 X509 *untrcert = load_cert_pem(ca_cert); 243 X509 *trcert = load_cert_pem(sroot_cert); 244 STACK_OF(X509) *trusted = sk_X509_new_null(); 245 STACK_OF(X509) *untrusted = sk_X509_new_null(); 246 X509_STORE_CTX *ctx = X509_STORE_CTX_new(); 247 int testresult = 0; 248 249 if (!TEST_ptr(eecert) 250 || !TEST_ptr(untrcert) 251 || !TEST_ptr(trcert) 252 || !TEST_ptr(trusted) 253 || !TEST_ptr(untrusted) 254 || !TEST_ptr(ctx)) 255 goto err; 256 257 258 if (!TEST_true(sk_X509_push(trusted, trcert))) 259 goto err; 260 trcert = NULL; 261 if (!TEST_true(sk_X509_push(untrusted, untrcert))) 262 goto err; 263 untrcert = NULL; 264 265 if (!TEST_true(X509_STORE_CTX_init(ctx, NULL, eecert, untrusted))) 266 goto err; 267 268 if (!TEST_true(X509_STORE_CTX_set_purpose(ctx, purpose))) 269 goto err; 270 271 /* 272 * X509_STORE_CTX_set0_trusted_stack() is bady named. Despite the set0 name 273 * we are still responsible for freeing trusted after we have finished with 274 * it. 275 */ 276 X509_STORE_CTX_set0_trusted_stack(ctx, trusted); 277 278 if (!TEST_int_eq(X509_verify_cert(ctx), expected)) 279 goto err; 280 281 testresult = 1; 282 err: 283 sk_X509_pop_free(trusted, X509_free); 284 sk_X509_pop_free(untrusted, X509_free); 285 X509_STORE_CTX_free(ctx); 286 X509_free(eecert); 287 X509_free(untrcert); 288 X509_free(trcert); 289 return testresult; 290} 291 292static int test_purpose_ssl_client(void) 293{ 294 return do_test_purpose(X509_PURPOSE_SSL_CLIENT, 0); 295} 296 297static int test_purpose_ssl_server(void) 298{ 299 return do_test_purpose(X509_PURPOSE_SSL_SERVER, 1); 300} 301 302static int test_purpose_any(void) 303{ 304 return do_test_purpose(X509_PURPOSE_ANY, 1); 305} 306 307int setup_tests(void) 308{ 309 if (!TEST_ptr(certs_dir = test_get_argument(0))) { 310 TEST_error("usage: verify_extra_test certs-dir\n"); 311 return 0; | 150 if (!test_alt_chains_cert_forgery(argv[1], argv[2], argv[3])) { 151 fprintf(stderr, "Test alt chains cert forgery failed\n"); 152 return 1; |
312 } 313 | 153 } 154 |
314 if (!TEST_ptr(roots_f = test_mk_file_path(certs_dir, "roots.pem")) 315 || !TEST_ptr(untrusted_f = test_mk_file_path(certs_dir, "untrusted.pem")) 316 || !TEST_ptr(bad_f = test_mk_file_path(certs_dir, "bad.pem")) 317 || !TEST_ptr(good_f = test_mk_file_path(certs_dir, "rootCA.pem")) 318 || !TEST_ptr(sroot_cert = test_mk_file_path(certs_dir, "sroot-cert.pem")) 319 || !TEST_ptr(ca_cert = test_mk_file_path(certs_dir, "ca-cert.pem")) 320 || !TEST_ptr(ee_cert = test_mk_file_path(certs_dir, "ee-cert.pem"))) 321 goto err; | 155#ifndef OPENSSL_NO_CRYPTO_MDEBUG 156 if (CRYPTO_mem_leaks_fp(stderr) <= 0) 157 return 1; 158#endif |
322 | 159 |
323 ADD_TEST(test_alt_chains_cert_forgery); 324 ADD_TEST(test_store_ctx); 325 ADD_TEST(test_self_signed_good); 326 ADD_TEST(test_self_signed_bad); 327 ADD_TEST(test_purpose_ssl_client); 328 ADD_TEST(test_purpose_ssl_server); 329 ADD_TEST(test_purpose_any); 330 return 1; 331 err: 332 cleanup_tests(); | 160 printf("PASS\n"); |
333 return 0; 334} | 161 return 0; 162} |
335 336void cleanup_tests(void) 337{ 338 OPENSSL_free(roots_f); 339 OPENSSL_free(untrusted_f); 340 OPENSSL_free(bad_f); 341 OPENSSL_free(good_f); 342 OPENSSL_free(sroot_cert); 343 OPENSSL_free(ca_cert); 344 OPENSSL_free(ee_cert); 345} | |