From aa51de6d6a00bfa5e8ee81cb463a103b39db9b30 Mon Sep 17 00:00:00 2001
From: "Jonathan M. Wilbur" <jonathan@wilbur.space>
Date: Wed, 10 Jul 2024 22:31:27 +0000
Subject: [PATCH] test: the basicAttConstraints X.509v3 extension

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24847)
---
 test/certs/ext-basicAttConstraints.pem | 11 +++++++++++
 test/recipes/25-test_x509.t            | 10 +++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 test/certs/ext-basicAttConstraints.pem

diff --git a/test/certs/ext-basicAttConstraints.pem b/test/certs/ext-basicAttConstraints.pem
new file mode 100644
index 0000000000..9d3a25bd2e
--- /dev/null
+++ b/test/certs/ext-basicAttConstraints.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBjDCCAXigAwIBAgIDAQIDMAsGCSqGSIb3DQEBBTAAMCIYDzIwMjEwODMxMDIx
+MjQ5WhgPMjAyMTA4MzEwMjEyNDlaMAAwggEgMAsGCSqGSIb3DQEBAQOCAQ8AMIIB
+CgKCAQEAtnjLm1ts1hC4fNNt3UnQD9y73bDXgioTyWYSI3ca/KNfuTydjFTEYAmq
+nuGrBOUfgbmH3PRQ0AmpqljgWTb3d3K8H4UFvDWQTPSS21IMjm8oqd19nE5GxWir
+Gu0oDRzhWLHe1RZ7ZrohCPg/1Ocsy47QZuK2laFB0rEmrRWBmEYbDl3/wxf5XfqI
+qpOynJB02thXrTCcTM7Rz1FqCFt/ZVZB5hKY2S+CTdE9OIVKlr4WHMfuvUYeOj06
+GkwLFJHNv2tU+tovI3mYRxUuY4UupkS3MC+Otey7XKm1P+INjWWoegm6iCAt3Vus
+pVz+6pU2xgl3nrAVMQHB4fReQPH0pQIDAQABoxMwETAPBgNVHSkECDAGAQH/AgED
+MAsGCSqGSIb3DQEBBQMBAA==
+-----END CERTIFICATE-----
diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t
index 2501af434f..7dc8c241eb 100644
--- a/test/recipes/25-test_x509.t
+++ b/test/recipes/25-test_x509.t
@@ -16,7 +16,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;
 
 setup("test_x509");
 
-plan tests => 93;
+plan tests => 95;
 
 # Prevent MSys2 filename munging for arguments that look like file paths but
 # aren't
@@ -286,6 +286,14 @@ cert_contains($user_notice_cert,
               "Explicit Text: Ice ice baby",
               1, 'X509v3 User Notice');
 
+my $battcons_cert = srctop_file(@certs, "ext-basicAttConstraints.pem");
+cert_contains($battcons_cert,
+              "authority:TRUE",
+              1, 'X.509 Basic Attribute Constraints Authority');
+cert_contains($battcons_cert,
+              "pathlen:3",
+              1, 'X.509 Basic Attribute Constraints Path Length');
+
 sub test_errors { # actually tests diagnostics of OSSL_STORE
     my ($expected, $cert, @opts) = @_;
     my $infile = srctop_file(@certs, $cert);