1/*
2 * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License").  You may not use
5 * this file except in compliance with the License.  You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10#include "internal/nelem.h"
11#include <string.h>
12#include <openssl/bio.h>
13#include <openssl/crypto.h>
14#include <openssl/err.h>
15#include <openssl/pem.h>
16#include <openssl/x509.h>
17
18#include "testutil.h"
19
20#define PARAM_TIME 1474934400 /* Sep 27th, 2016 */
21
22static const char *kCRLTestRoot[] = {
23    "-----BEGIN CERTIFICATE-----\n",
24    "MIIDbzCCAlegAwIBAgIJAODri7v0dDUFMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV\n",
25    "BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW\n",
26    "aWV3MRIwEAYDVQQKDAlCb3JpbmdTU0wwHhcNMTYwOTI2MTUwNjI2WhcNMjYwOTI0\n",
27    "MTUwNjI2WjBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG\n",
28    "A1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9yaW5nU1NMMIIBIjANBgkq\n",
29    "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3B\n",
30    "S/dUBpbrzd1aeFzNlI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+\n",
31    "5R/Du0iCb1tCZIPY07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWp\n",
32    "uRqO6rctN9qUoMlTIAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n\n",
33    "8H922qmvPNA9idmX9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbL\n",
34    "P2o9orxGx7aCtnnBZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABo1Aw\n",
35    "TjAdBgNVHQ4EFgQUWPt3N5cZ/CRvubbrkqfBnAqhq94wHwYDVR0jBBgwFoAUWPt3\n",
36    "N5cZ/CRvubbrkqfBnAqhq94wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n",
37    "AQEAORu6M0MOwXy+3VEBwNilfTxyqDfruQsc1jA4PT8Oe8zora1WxE1JB4q2FJOz\n",
38    "EAuM3H/NXvEnBuN+ITvKZAJUfm4NKX97qmjMJwLKWe1gVv+VQTr63aR7mgWJReQN\n",
39    "XdMztlVeZs2dppV6uEg3ia1X0G7LARxGpA9ETbMyCpb39XxlYuTClcbA5ftDN99B\n",
40    "3Xg9KNdd++Ew22O3HWRDvdDpTO/JkzQfzi3sYwUtzMEonENhczJhGf7bQMmvL/w5\n",
41    "24Wxj4Z7KzzWIHsNqE/RIs6RV3fcW61j/mRgW2XyoWnMVeBzvcJr9NXp4VQYmFPw\n",
42    "amd8GKMZQvP0ufGnUn7D7uartA==\n",
43    "-----END CERTIFICATE-----\n",
44    NULL
45};
46
47static const char *kCRLTestLeaf[] = {
48    "-----BEGIN CERTIFICATE-----\n",
49    "MIIDkDCCAnigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCVVMx\n",
50    "EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEjAQ\n",
51    "BgNVBAoMCUJvcmluZ1NTTDAeFw0xNjA5MjYxNTA4MzFaFw0xNzA5MjYxNTA4MzFa\n",
52    "MEsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQKDAlC\n",
53    "b3JpbmdTU0wxEzARBgNVBAMMCmJvcmluZy5zc2wwggEiMA0GCSqGSIb3DQEBAQUA\n",
54    "A4IBDwAwggEKAoIBAQDc5v1S1M0W+QWM+raWfO0LH8uvqEwuJQgODqMaGnSlWUx9\n",
55    "8iQcnWfjyPja3lWg9K62hSOFDuSyEkysKHDxijz5R93CfLcfnVXjWQDJe7EJTTDP\n",
56    "ozEvxN6RjAeYv7CF000euYr3QT5iyBjg76+bon1p0jHZBJeNPP1KqGYgyxp+hzpx\n",
57    "e0gZmTlGAXd8JQK4v8kpdYwD6PPifFL/jpmQpqOtQmH/6zcLjY4ojmqpEdBqIKIX\n",
58    "+saA29hMq0+NK3K+wgg31RU+cVWxu3tLOIiesETkeDgArjWRS1Vkzbi4v9SJxtNu\n",
59    "OZuAxWiynRJw3JwH/OFHYZIvQqz68ZBoj96cepjPAgMBAAGjezB5MAkGA1UdEwQC\n",
60    "MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl\n",
61    "MB0GA1UdDgQWBBTGn0OVVh/aoYt0bvEKG+PIERqnDzAfBgNVHSMEGDAWgBRY+3c3\n",
62    "lxn8JG+5tuuSp8GcCqGr3jANBgkqhkiG9w0BAQsFAAOCAQEAd2nM8gCQN2Dc8QJw\n",
63    "XSZXyuI3DBGGCHcay/3iXu0JvTC3EiQo8J6Djv7WLI0N5KH8mkm40u89fJAB2lLZ\n",
64    "ShuHVtcC182bOKnePgwp9CNwQ21p0rDEu/P3X46ZvFgdxx82E9xLa0tBB8PiPDWh\n",
65    "lV16jbaKTgX5AZqjnsyjR5o9/mbZVupZJXx5Syq+XA8qiJfstSYJs4KyKK9UOjql\n",
66    "ICkJVKpi2ahDBqX4MOH4SLfzVk8pqSpviS6yaA1RXqjpkxiN45WWaXDldVHMSkhC\n",
67    "5CNXsXi4b1nAntu89crwSLA3rEwzCWeYj+BX7e1T9rr3oJdwOU/2KQtW1js1yQUG\n",
68    "tjJMFw==\n",
69    "-----END CERTIFICATE-----\n",
70    NULL
71};
72
73static const char *kBasicCRL[] = {
74    "-----BEGIN X509 CRL-----\n",
75    "MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
76    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
77    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV\n",
78    "HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN\n",
79    "ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo\n",
80    "eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os\n",
81    "dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv\n",
82    "diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho\n",
83    "/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==\n",
84    "-----END X509 CRL-----\n",
85    NULL
86};
87
88static const char *kRevokedCRL[] = {
89    "-----BEGIN X509 CRL-----\n",
90    "MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
91    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
92    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX\n",
93    "DTE2MDkyNjE1MTIyNlqgDjAMMAoGA1UdFAQDAgECMA0GCSqGSIb3DQEBCwUAA4IB\n",
94    "AQCUGaM4DcWzlQKrcZvI8TMeR8BpsvQeo5BoI/XZu2a8h//PyRyMwYeaOM+3zl0d\n",
95    "sjgCT8b3C1FPgT+P2Lkowv7rJ+FHJRNQkogr+RuqCSPTq65ha4WKlRGWkMFybzVH\n",
96    "NloxC+aU3lgp/NlX9yUtfqYmJek1CDrOOGPrAEAwj1l/BUeYKNGqfBWYJQtPJu+5\n",
97    "OaSvIYGpETCZJscUWODmLEb/O3DM438vLvxonwGqXqS0KX37+CHpUlyhnSovxXxp\n",
98    "Pz4aF+L7OtczxL0GYtD2fR9B7TDMqsNmHXgQrixvvOY7MUdLGbd4RfJL3yA53hyO\n",
99    "xzfKY2TzxLiOmctG0hXFkH5J\n",
100    "-----END X509 CRL-----\n",
101    NULL
102};
103
104static const char *kBadIssuerCRL[] = {
105    "-----BEGIN X509 CRL-----\n",
106    "MIIBwjCBqwIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
107    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEWMBQGA1UECgwN\n",
108    "Tm90IEJvcmluZ1NTTBcNMTYwOTI2MTUxMjQ0WhcNMTYxMDI2MTUxMjQ0WjAVMBMC\n",
109    "AhAAFw0xNjA5MjYxNTEyMjZaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsF\n",
110    "AAOCAQEAlBmjOA3Fs5UCq3GbyPEzHkfAabL0HqOQaCP12btmvIf/z8kcjMGHmjjP\n",
111    "t85dHbI4Ak/G9wtRT4E/j9i5KML+6yfhRyUTUJKIK/kbqgkj06uuYWuFipURlpDB\n",
112    "cm81RzZaMQvmlN5YKfzZV/clLX6mJiXpNQg6zjhj6wBAMI9ZfwVHmCjRqnwVmCUL\n",
113    "TybvuTmkryGBqREwmSbHFFjg5ixG/ztwzON/Ly78aJ8Bql6ktCl9+/gh6VJcoZ0q\n",
114    "L8V8aT8+Ghfi+zrXM8S9BmLQ9n0fQe0wzKrDZh14EK4sb7zmOzFHSxm3eEXyS98g\n",
115    "Od4cjsc3ymNk88S4jpnLRtIVxZB+SQ==\n",
116    "-----END X509 CRL-----\n",
117    NULL
118};
119
120/*
121 * This is kBasicCRL but with a critical issuing distribution point
122 * extension.
123 */
124static const char *kKnownCriticalCRL[] = {
125    "-----BEGIN X509 CRL-----\n",
126    "MIIBujCBowIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
127    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
128    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCEwHzAKBgNV\n",
129    "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wDQYJKoZIhvcNAQELBQADggEBAA+3\n",
130    "i+5e5Ub8sccfgOBs6WVJFI9c8gvJjrJ8/dYfFIAuCyeocs7DFXn1n13CRZ+URR/Q\n",
131    "mVWgU28+xeusuSPYFpd9cyYTcVyNUGNTI3lwgcE/yVjPaOmzSZKdPakApRxtpKKQ\n",
132    "NN/56aQz3bnT/ZSHQNciRB8U6jiD9V30t0w+FDTpGaG+7bzzUH3UVF9xf9Ctp60A\n",
133    "3mfLe0scas7owSt4AEFuj2SPvcE7yvdOXbu+IEv21cEJUVExJAbhvIweHXh6yRW+\n",
134    "7VVeiNzdIjkZjyTmAzoXGha4+wbxXyBRbfH+XWcO/H+8nwyG8Gktdu2QB9S9nnIp\n",
135    "o/1TpfOMSGhMyMoyPrk=\n",
136    "-----END X509 CRL-----\n",
137    NULL
138};
139
140/*
141 * kUnknownCriticalCRL is kBasicCRL but with an unknown critical extension.
142 */
143static const char *kUnknownCriticalCRL[] = {
144    "-----BEGIN X509 CRL-----\n",
145    "MIIBvDCBpQIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
146    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
147    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCMwITAKBgNV\n",
148    "HRQEAwIBATATBgwqhkiG9xIEAYS3CQABAf8EADANBgkqhkiG9w0BAQsFAAOCAQEA\n",
149    "GvBP0xqL509InMj/3493YVRV+ldTpBv5uTD6jewzf5XdaxEQ/VjTNe5zKnxbpAib\n",
150    "Kf7cwX0PMSkZjx7k7kKdDlEucwVvDoqC+O9aJcqVmM6GDyNb9xENxd0XCXja6MZC\n",
151    "yVgP4AwLauB2vSiEprYJyI1APph3iAEeDm60lTXX/wBM/tupQDDujKh2GPyvBRfJ\n",
152    "+wEDwGg3ICwvu4gO4zeC5qnFR+bpL9t5tOMAQnVZ0NWv+k7mkd2LbHdD44dxrfXC\n",
153    "nhtfERx99SDmC/jtUAJrGhtCO8acr7exCeYcduN7KKCm91OeCJKK6OzWst0Og1DB\n",
154    "kwzzU2rL3G65CrZ7H0SZsQ==\n",
155    "-----END X509 CRL-----\n",
156    NULL
157};
158
159/*
160 * kUnknownCriticalCRL2 is kBasicCRL but with a critical issuing distribution
161 * point extension followed by an unknown critical extension
162 */
163static const char *kUnknownCriticalCRL2[] = {
164    "-----BEGIN X509 CRL-----\n",
165    "MIIBzzCBuAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
166    "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
167    "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoDYwNDAKBgNV\n",
168    "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wEwYMKoZIhvcSBAGEtwkAAQH/BAAw\n",
169    "DQYJKoZIhvcNAQELBQADggEBACTcpQC8jXL12JN5YzOcQ64ubQIe0XxRAd30p7qB\n",
170    "BTXGpgqBjrjxRfLms7EBYodEXB2oXMsDq3km0vT1MfYdsDD05S+SQ9CDsq/pUfaC\n",
171    "E2WNI5p8WircRnroYvbN2vkjlRbMd1+yNITohXYXCJwjEOAWOx3XIM10bwPYBv4R\n",
172    "rDobuLHoMgL3yHgMHmAkP7YpkBucNqeBV8cCdeAZLuhXFWi6yfr3r/X18yWbC/r2\n",
173    "2xXdkrSqXLFo7ToyP8YKTgiXpya4x6m53biEYwa2ULlas0igL6DK7wjYZX95Uy7H\n",
174    "GKljn9weIYiMPV/BzGymwfv2EW0preLwtyJNJPaxbdin6Jc=\n",
175    "-----END X509 CRL-----\n",
176    NULL
177};
178
179static const char **unknown_critical_crls[] = {
180    kUnknownCriticalCRL, kUnknownCriticalCRL2
181};
182
183static X509 *test_root = NULL;
184static X509 *test_leaf = NULL;
185
186/*
187 * Glue an array of strings together.  Return a BIO and put the string
188 * into |*out| so we can free it.
189 */
190static BIO *glue2bio(const char **pem, char **out)
191{
192    size_t s = 0;
193
194    *out = glue_strings(pem, &s);
195    return BIO_new_mem_buf(*out, s);
196}
197
198/*
199 * Create a CRL from an array of strings.
200 */
201static X509_CRL *CRL_from_strings(const char **pem)
202{
203    X509_CRL *crl;
204    char *p;
205    BIO *b = glue2bio(pem, &p);
206
207    if (b == NULL) {
208        OPENSSL_free(p);
209        return NULL;
210    }
211
212    crl = PEM_read_bio_X509_CRL(b, NULL, NULL, NULL);
213
214    OPENSSL_free(p);
215    BIO_free(b);
216    return crl;
217}
218
219/*
220 * Create an X509 from an array of strings.
221 */
222static X509 *X509_from_strings(const char **pem)
223{
224    X509 *x;
225    char *p;
226    BIO *b = glue2bio(pem, &p);
227
228    if (b == NULL) {
229        OPENSSL_free(p);
230        return NULL;
231    }
232
233    x = PEM_read_bio_X509(b, NULL, NULL, NULL);
234
235    OPENSSL_free(p);
236    BIO_free(b);
237    return x;
238}
239
240/*
241 * Verify |leaf| certificate (chained up to |root|).  |crls| if
242 * not NULL, is a list of CRLs to include in the verification. It is
243 * also free'd before returning, which is kinda yucky but convenient.
244 * Returns a value from X509_V_ERR_xxx or X509_V_OK.
245 */
246static int verify(X509 *leaf, X509 *root, STACK_OF(X509_CRL) *crls,
247                  unsigned long flags)
248{
249    X509_STORE_CTX *ctx = X509_STORE_CTX_new();
250    X509_STORE *store = X509_STORE_new();
251    X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
252    STACK_OF(X509) *roots = sk_X509_new_null();
253    int status = X509_V_ERR_UNSPECIFIED;
254
255    if (!TEST_ptr(ctx)
256        || !TEST_ptr(store)
257        || !TEST_ptr(param)
258        || !TEST_ptr(roots))
259        goto err;
260
261    /* Create a stack; upref the cert because we free it below. */
262    X509_up_ref(root);
263    if (!TEST_true(sk_X509_push(roots, root))
264        || !TEST_true(X509_STORE_CTX_init(ctx, store, leaf, NULL)))
265        goto err;
266    X509_STORE_CTX_set0_trusted_stack(ctx, roots);
267    X509_STORE_CTX_set0_crls(ctx, crls);
268    X509_VERIFY_PARAM_set_time(param, PARAM_TIME);
269    if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param), PARAM_TIME))
270        goto err;
271    X509_VERIFY_PARAM_set_depth(param, 16);
272    if (flags)
273        X509_VERIFY_PARAM_set_flags(param, flags);
274    X509_STORE_CTX_set0_param(ctx, param);
275    param = NULL;
276
277    ERR_clear_error();
278    status = X509_verify_cert(ctx) == 1 ? X509_V_OK
279                                        : X509_STORE_CTX_get_error(ctx);
280err:
281    sk_X509_pop_free(roots, X509_free);
282    sk_X509_CRL_pop_free(crls, X509_CRL_free);
283    X509_VERIFY_PARAM_free(param);
284    X509_STORE_CTX_free(ctx);
285    X509_STORE_free(store);
286    return status;
287}
288
289/*
290 * Create a stack of CRL's.  Upref each one because we call pop_free on
291 * the stack and need to keep the CRL's around until the test exits.
292 * Yes this crashes on malloc failure; it forces us to debug.
293 */
294static STACK_OF(X509_CRL) *make_CRL_stack(X509_CRL *x1, X509_CRL *x2)
295{
296    STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null();
297
298    sk_X509_CRL_push(sk, x1);
299    X509_CRL_up_ref(x1);
300    if (x2 != NULL) {
301        sk_X509_CRL_push(sk, x2);
302        X509_CRL_up_ref(x2);
303    }
304    return sk;
305}
306
307static int test_basic_crl(void)
308{
309    X509_CRL *basic_crl = CRL_from_strings(kBasicCRL);
310    X509_CRL *revoked_crl = CRL_from_strings(kRevokedCRL);
311    int r;
312
313    r = TEST_ptr(basic_crl)
314        && TEST_ptr(revoked_crl)
315        && TEST_int_eq(verify(test_leaf, test_root,
316                              make_CRL_stack(basic_crl, NULL),
317                              X509_V_FLAG_CRL_CHECK), X509_V_OK)
318        && TEST_int_eq(verify(test_leaf, test_root,
319                              make_CRL_stack(basic_crl, revoked_crl),
320                              X509_V_FLAG_CRL_CHECK), X509_V_ERR_CERT_REVOKED);
321    X509_CRL_free(basic_crl);
322    X509_CRL_free(revoked_crl);
323    return r;
324}
325
326static int test_no_crl(void)
327{
328    return TEST_int_eq(verify(test_leaf, test_root, NULL,
329                              X509_V_FLAG_CRL_CHECK),
330                       X509_V_ERR_UNABLE_TO_GET_CRL);
331}
332
333static int test_bad_issuer_crl(void)
334{
335    X509_CRL *bad_issuer_crl = CRL_from_strings(kBadIssuerCRL);
336    int r;
337
338    r = TEST_ptr(bad_issuer_crl)
339        && TEST_int_eq(verify(test_leaf, test_root,
340                              make_CRL_stack(bad_issuer_crl, NULL),
341                              X509_V_FLAG_CRL_CHECK),
342                       X509_V_ERR_UNABLE_TO_GET_CRL);
343    X509_CRL_free(bad_issuer_crl);
344    return r;
345}
346
347static int test_known_critical_crl(void)
348{
349    X509_CRL *known_critical_crl = CRL_from_strings(kKnownCriticalCRL);
350    int r;
351
352    r = TEST_ptr(known_critical_crl)
353        && TEST_int_eq(verify(test_leaf, test_root,
354                              make_CRL_stack(known_critical_crl, NULL),
355                              X509_V_FLAG_CRL_CHECK), X509_V_OK);
356    X509_CRL_free(known_critical_crl);
357    return r;
358}
359
360static int test_unknown_critical_crl(int n)
361{
362    X509_CRL *unknown_critical_crl = CRL_from_strings(unknown_critical_crls[n]);
363    int r;
364
365    r = TEST_ptr(unknown_critical_crl)
366        && TEST_int_eq(verify(test_leaf, test_root,
367                              make_CRL_stack(unknown_critical_crl, NULL),
368                              X509_V_FLAG_CRL_CHECK),
369                       X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION);
370    X509_CRL_free(unknown_critical_crl);
371    return r;
372}
373
374static int test_reuse_crl(void)
375{
376    X509_CRL *reused_crl = CRL_from_strings(kBasicCRL);
377    char *p;
378    BIO *b = glue2bio(kRevokedCRL, &p);
379
380    if (b == NULL) {
381        OPENSSL_free(p);
382        X509_CRL_free(reused_crl);
383        return 0;
384    }
385
386    reused_crl = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL);
387
388    OPENSSL_free(p);
389    BIO_free(b);
390    X509_CRL_free(reused_crl);
391    return 1;
392}
393
394int setup_tests(void)
395{
396    if (!TEST_ptr(test_root = X509_from_strings(kCRLTestRoot))
397        || !TEST_ptr(test_leaf = X509_from_strings(kCRLTestLeaf)))
398        return 0;
399
400    ADD_TEST(test_no_crl);
401    ADD_TEST(test_basic_crl);
402    ADD_TEST(test_bad_issuer_crl);
403    ADD_TEST(test_known_critical_crl);
404    ADD_ALL_TESTS(test_unknown_critical_crl, OSSL_NELEM(unknown_critical_crls));
405    ADD_TEST(test_reuse_crl);
406    return 1;
407}
408
409void cleanup_tests(void)
410{
411    X509_free(test_root);
412    X509_free(test_leaf);
413}
414