x509_acert: Add simple API tests
Add a some simple API tests for reading, printing, signing and verifying attribute certificates. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15857)
This commit is contained in:
Damian Hobson-Garcia
Matt Caswell
parent
0e8020a45b
commit
f90d97caab
@ -63,7 +63,8 @@ IF[{- !$disabled{tests} -}]
|
||||
provfetchtest prov_config_test rand_test \
|
||||
ca_internals_test bio_tfo_test membio_test bio_dgram_test list_test \
|
||||
fips_version_test x509_test hpke_test pairwise_fail_test \
|
||||
nodefltctxtest evp_xof_test x509_load_cert_file_test bio_meth_test
|
||||
nodefltctxtest evp_xof_test x509_load_cert_file_test bio_meth_test \
|
||||
x509_acert_test
|
||||
|
||||
IF[{- !$disabled{'rpk'} -}]
|
||||
PROGRAMS{noinst}=rpktest
|
||||
@ -1206,6 +1207,10 @@ ENDIF
|
||||
INCLUDE[cert_comp_test]=../include ../apps/include ..
|
||||
DEPEND[cert_comp_test]=../libcrypto ../libssl libtestutil.a
|
||||
|
||||
SOURCE[x509_acert_test]=x509_acert_test.c
|
||||
INCLUDE[x509_acert_test]=../include ../apps/include
|
||||
DEPEND[x509_acert_test]=../libcrypto libtestutil.a
|
||||
|
||||
{-
|
||||
use File::Spec::Functions;
|
||||
use File::Basename;
|
||||
|
||||
5
test/certs/acert.pem
Normal file
5
test/certs/acert.pem
Normal file
@ -0,0 +1,5 @@
|
||||
Generated with paccor (https://github.com/nsacyber/paccor)
|
||||
|
||||
-----BEGIN ATTRIBUTE CERTIFICATE-----
|
||||
MIID4zCCAssCAQEwOaA3MB+kHTAbMRkwFwYDVQQDDBBUUE0gTWFudWZhY3R1cmVyAhRADHoGLYO7i9GfV2Yz2rrlRFDPSqA6MDikNjA0MQswCQYDVQQGEwJVUzEUMBIGA1UECgwLZXhhbXBsZS5jb20xDzANBgNVBAsMBlBDVGVzdDANBgkqhkiG9w0BAQsFAAIBATAiGA8yMDE4MDEwMTA1MDAwMFoYDzIwMjgwMTAxMDUwMDAwWjCB7TALBgVngQUCEzECMAAwHAYFZ4EFAhExEzARMAkCAQECAQMCARYEBAAAAAEwEgYFZ4EFAhkxCTAHBgVngQUIAjCBlQYHZ4EFBQEHAjGBiTCBhqBkMC8wDgYGZ4EFEgMBBAQAAgABDBJYWVogQ29tcHV0aW5nIEluYy4MATGABkFCQzEyMzAxMA4GBmeBBRIDAQQEAAcAAgwNTm90IFNwZWNpZmllZAwDSEQxgAgxMjM0QUJDRIMB/6IeMBwMCHVuYW1lIC1yDBA2LjUuMC0xNS1nZW5lcmljMBQGBWeBBQIXMQswCQIBAQIBAQIBETCCAScwbwYDVR0jBGgwZoAUl46DRCrPD3GZndkBbbNDngf6ZHChOKQ2MDQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtleGFtcGxlLmNvbTEPMA0GA1UECwwGUENUZXN0ghRmuv6Ey2JadCAOFysMNOn9CiH45zBBBgNVHSAEOjA4MDYGAioDMDAwLgYIKwYBBQUHAgIwIgwgVENHIFRydXN0ZWQgUGxhdGZvcm0gRW5kb3JzZW1lbnQwcQYDVR0RBGowaKRmMGQxEzARBgZngQUFAQQMB01vZGVsIEExHjAcBgZngQUFAQEMElhZWiBDb21wdXRpbmcgSW5jLjEZMBcGBmeBBQUBBQwNTm90IFNwZWNpZmllZDESMBAGBmeBBQUBBgwGQUJDMTIzMA0GCSqGSIb3DQEBCwUAA4IBAQBKj3TsMcVSu8zFLPwMX5f8SHelruSr0Oi4QCNLwAylo9Oi3loIaIwCRf95+z4SUJjGhyuBBooWP6Io0uWJ43tI7IFHdZ5vMtRIdemD3te+2iYH7OHMzMucsQ3L63n+XHHxhNrMgBOGI9+7Q4Rnvnm7OFFVqSKt5rX0sZFrR12XVD67CA3VC+khyXy1cV/3v95DwWFSHOG2VkiKjDdO2B4WRrK0Cy2J7ZFo0TYtaLNEONABL5nfa9MIXUAgo4hDwhxNSXfirJPgVt8HQNaoQPepHDiZbmRZc38Q1LAUpTxMYDePH0pQDkmI9Tdk+4/CMYhU0CIq6jzRHrOaUwfgNGp9
|
||||
-----END ATTRIBUTE CERTIFICATE-----
|
||||
15
test/certs/acert_ietf.pem
Normal file
15
test/certs/acert_ietf.pem
Normal file
@ -0,0 +1,15 @@
|
||||
-----BEGIN ATTRIBUTE CERTIFICATE-----
|
||||
MIICPTCCASUCAQEwN6AWMBGkDzANMQswCQYDVQQDDAJDQQIBAqEdpBswGTEXMBUG
|
||||
A1UEAwwOc2VydmVyLmV4YW1wbGWgLTArpCkwJzElMCMGA1UEAwwcQXR0cmlidXRl
|
||||
IENlcnRpZmljYXRlIElzc3VlcjANBgkqhkiG9w0BAQsFAAIUA7WQWQKiqrVAIUS4
|
||||
LE/ZgBtfV8IwIhgPMjAyMTA2MTUxMjM1MDBaGA8yMDMxMDYxMzEyMzUwMFowQTAj
|
||||
BggrBgEFBQcKBDEXMBWgCYYHVGVzdHZhbDAIDAZncm91cDEwGgYDVQRIMRMwEaEP
|
||||
gw1hZG1pbmlzdHJhdG9yMCwwHwYDVR0jBBgwFoAUYm7JaGdsZLtTgt0tqoCK2MrI
|
||||
i10wCQYDVR04BAIFADANBgkqhkiG9w0BAQsFAAOCAQEARYpFEjordN68NXSLmDae
|
||||
uruxhw+Zsr9Grom4mqYy/2lAuu58os4xA4Cez9OdkfCZmU9baDBVfMWys7GlCJdg
|
||||
wn5uO5Kk2eiEWsujO/EV4c5eyXSrsUghQZQKfIVsgeut+7WfmDy/+j8ibbxJxJp/
|
||||
KMIoDjBAaMDhhxaCYclm8dJRT9DPba/bCNjuPGeTXslDQSXIfzFDgQkRZ0+Z7s9i
|
||||
enYBmnH4rvW+SX8v5MzfGOu8VtHAKKBEcCbs2qGwYBEUUsCA/LYKSnOwn655wsd9
|
||||
k6KifIGOCVS4ZbK9pDyYcH/6/OmD1eSUwDZsd8CrJYDC31gAu7xqhOsBzR9DL3oD
|
||||
4Q==
|
||||
-----END ATTRIBUTE CERTIFICATE-----
|
||||
22
test/recipes/60-test_x509_acert.t
Normal file
22
test/recipes/60-test_x509_acert.t
Normal file
@ -0,0 +1,22 @@
|
||||
#! /usr/bin/env perl
|
||||
# Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
# in the file LICENSE in the source distribution or at
|
||||
# https://www.openssl.org/source/license.html
|
||||
|
||||
use OpenSSL::Test::Utils;
|
||||
use OpenSSL::Test qw/:DEFAULT srctop_file/;
|
||||
|
||||
setup("test_x509_acert");
|
||||
|
||||
plan skip_all => "test_x509_acert uses ec which is not supported by this build"
|
||||
if disabled("ec");
|
||||
|
||||
plan tests => 1;
|
||||
|
||||
ok(run(test(["x509_acert_test", srctop_file("test", "certs", "acert.pem"),
|
||||
srctop_file("test", "certs", "acert_ietf.pem")])),
|
||||
"running x509_acert_test");
|
||||
|
||||
174
test/x509_acert_test.c
Normal file
174
test/x509_acert_test.c
Normal file
@ -0,0 +1,174 @@
|
||||
/*
|
||||
* Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/rsa.h>
|
||||
#include <openssl/x509_acert.h>
|
||||
|
||||
#include "testutil.h"
|
||||
|
||||
static int test_print_acert(int idx)
|
||||
{
|
||||
int ret = 0;
|
||||
const char *acert_file;
|
||||
X509_ACERT *acert = NULL;
|
||||
BIO *bp, *bout;
|
||||
|
||||
if (!TEST_ptr(acert_file = test_get_argument(idx)))
|
||||
return 0;
|
||||
|
||||
if (!TEST_ptr(bp = BIO_new_file(acert_file, "r")))
|
||||
return 0;
|
||||
|
||||
if (!TEST_ptr(bout = BIO_new_fp(stderr, BIO_NOCLOSE)))
|
||||
goto err;
|
||||
|
||||
if (!TEST_ptr(acert = PEM_read_bio_X509_ACERT(bp, NULL, NULL, NULL)))
|
||||
goto err;
|
||||
|
||||
if (!TEST_int_eq(X509_ACERT_print(bout, acert), 1)) {
|
||||
goto err;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
BIO_free(bp);
|
||||
BIO_free(bout);
|
||||
X509_ACERT_free(acert);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int test_acert_sign(void)
|
||||
{
|
||||
int ret = 0;
|
||||
const char *acert_file;
|
||||
EVP_PKEY *pkey;
|
||||
BIO *bp = NULL;
|
||||
X509_ACERT *acert = NULL;
|
||||
|
||||
if (!TEST_ptr(acert_file = test_get_argument(0)))
|
||||
return 0;
|
||||
|
||||
if (!TEST_ptr(pkey = EVP_RSA_gen(2048)))
|
||||
return 0;
|
||||
|
||||
if (!TEST_ptr(bp = BIO_new_file(acert_file, "r")))
|
||||
goto err;
|
||||
|
||||
if (!TEST_ptr(acert = PEM_read_bio_X509_ACERT(bp, NULL, NULL, NULL)))
|
||||
goto err;
|
||||
|
||||
if (!TEST_int_gt(X509_ACERT_sign(acert, pkey, EVP_sha256()), 0) ||
|
||||
!TEST_int_eq(X509_ACERT_verify(acert, pkey), 1))
|
||||
goto err;
|
||||
|
||||
ret = 1;
|
||||
|
||||
err:
|
||||
BIO_free(bp);
|
||||
X509_ACERT_free(acert);
|
||||
EVP_PKEY_free(pkey);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* IetfAttrSyntax structure with one value */
|
||||
static const unsigned char attr_syntax_single[] = {
|
||||
0x30, 0x15, 0xa0, 0x09, 0x86, 0x07, 0x54, 0x65, 0x73, 0x74, 0x76, 0x61,
|
||||
0x6c, 0x30, 0x08, 0x0c, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x31
|
||||
};
|
||||
|
||||
/* IetfAttrSyntax structure with multiple values of the same type */
|
||||
static const unsigned char attr_syntax_multiple[] = {
|
||||
0x30, 0x1d, 0x30, 0x1b, 0x0c, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x20,
|
||||
0x31, 0x0c, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x20, 0x32, 0x0c, 0x07,
|
||||
0x67, 0x72, 0x6f, 0x75, 0x70, 0x20, 0x33
|
||||
};
|
||||
|
||||
/* IetfAttrSyntax structure with multiple values of different types */
|
||||
static const unsigned char attr_syntax_diff_type[] = {
|
||||
0x30, 0x11, 0x30, 0x0f, 0x04, 0x08, 0x64, 0x65, 0x61, 0x64, 0x63, 0x6f,
|
||||
0x64, 0x65, 0x0c, 0x03, 0x61, 0x61, 0x61
|
||||
};
|
||||
|
||||
/* IetfAttrSyntax structure with an invalid/unsupported value type */
|
||||
static const unsigned char attr_syntax_invalid_type[] = {
|
||||
0x30, 0x05, 0x30, 0x03, 0x02, 0x01, 0x0a
|
||||
};
|
||||
|
||||
#define ADD_TEST_DATA(x, valid) {x, sizeof(x), valid}
|
||||
|
||||
struct ietf_type_test_data {
|
||||
const unsigned char *data;
|
||||
size_t len;
|
||||
int valid;
|
||||
};
|
||||
|
||||
static const struct ietf_type_test_data ietf_syntax_tests[] = {
|
||||
ADD_TEST_DATA(attr_syntax_single, 1),
|
||||
ADD_TEST_DATA(attr_syntax_multiple, 1),
|
||||
ADD_TEST_DATA(attr_syntax_diff_type, 0),
|
||||
ADD_TEST_DATA(attr_syntax_invalid_type, 0),
|
||||
};
|
||||
|
||||
static int test_object_group_attr(int idx)
|
||||
{
|
||||
int ret = 0;
|
||||
OSSL_IETF_ATTR_SYNTAX *ias = NULL;
|
||||
BIO *bout = NULL;
|
||||
const unsigned char *p;
|
||||
const struct ietf_type_test_data *test = &ietf_syntax_tests[idx];
|
||||
|
||||
if (!TEST_ptr(bout = BIO_new_fp(stderr, BIO_NOCLOSE)))
|
||||
goto done;
|
||||
|
||||
p = test->data;
|
||||
|
||||
ias = d2i_OSSL_IETF_ATTR_SYNTAX(NULL, &p, test->len);
|
||||
|
||||
if ((test->valid && !TEST_ptr(ias))
|
||||
|| (!test->valid && !TEST_ptr_null(ias)))
|
||||
goto done;
|
||||
|
||||
if (ias != NULL
|
||||
&& !TEST_int_eq(OSSL_IETF_ATTR_SYNTAX_print(bout, ias, 4), 1)) {
|
||||
OSSL_IETF_ATTR_SYNTAX_free(ias);
|
||||
goto done;
|
||||
}
|
||||
|
||||
ret = 1;
|
||||
|
||||
done:
|
||||
OSSL_IETF_ATTR_SYNTAX_free(ias);
|
||||
BIO_free(bout);
|
||||
return ret;
|
||||
}
|
||||
|
||||
OPT_TEST_DECLARE_USAGE("[<attribute certs (PEM)>...]\n")
|
||||
int setup_tests(void)
|
||||
{
|
||||
int cnt;
|
||||
|
||||
if (!test_skip_common_options()) {
|
||||
TEST_error("Error parsing test options\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
cnt = test_get_argument_count();
|
||||
if (cnt < 1) {
|
||||
TEST_error("Must specify at least 1 attribute certificate file\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
ADD_ALL_TESTS(test_print_acert, cnt);
|
||||
ADD_TEST(test_acert_sign);
|
||||
ADD_ALL_TESTS(test_object_group_attr, OSSL_NELEM(ietf_syntax_tests));
|
||||
|
||||
return 1;
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user