diff --git a/test/build.info b/test/build.info index 56ef747280..f10ff8b8fd 100644 --- a/test/build.info +++ b/test/build.info @@ -63,7 +63,8 @@ IF[{- !$disabled{tests} -}] provfetchtest prov_config_test rand_test \ ca_internals_test bio_tfo_test membio_test bio_dgram_test list_test \ fips_version_test x509_test hpke_test pairwise_fail_test \ - nodefltctxtest evp_xof_test x509_load_cert_file_test bio_meth_test + nodefltctxtest evp_xof_test x509_load_cert_file_test bio_meth_test \ + x509_acert_test IF[{- !$disabled{'rpk'} -}] PROGRAMS{noinst}=rpktest @@ -1206,6 +1207,10 @@ ENDIF INCLUDE[cert_comp_test]=../include ../apps/include .. DEPEND[cert_comp_test]=../libcrypto ../libssl libtestutil.a + SOURCE[x509_acert_test]=x509_acert_test.c + INCLUDE[x509_acert_test]=../include ../apps/include + DEPEND[x509_acert_test]=../libcrypto libtestutil.a + {- use File::Spec::Functions; use File::Basename; diff --git a/test/certs/acert.pem b/test/certs/acert.pem new file mode 100644 index 0000000000..efd2a05dc6 --- /dev/null +++ b/test/certs/acert.pem @@ -0,0 +1,5 @@ +Generated with paccor (https://github.com/nsacyber/paccor) + +-----BEGIN ATTRIBUTE CERTIFICATE----- +MIID4zCCAssCAQEwOaA3MB+kHTAbMRkwFwYDVQQDDBBUUE0gTWFudWZhY3R1cmVyAhRADHoGLYO7i9GfV2Yz2rrlRFDPSqA6MDikNjA0MQswCQYDVQQGEwJVUzEUMBIGA1UECgwLZXhhbXBsZS5jb20xDzANBgNVBAsMBlBDVGVzdDANBgkqhkiG9w0BAQsFAAIBATAiGA8yMDE4MDEwMTA1MDAwMFoYDzIwMjgwMTAxMDUwMDAwWjCB7TALBgVngQUCEzECMAAwHAYFZ4EFAhExEzARMAkCAQECAQMCARYEBAAAAAEwEgYFZ4EFAhkxCTAHBgVngQUIAjCBlQYHZ4EFBQEHAjGBiTCBhqBkMC8wDgYGZ4EFEgMBBAQAAgABDBJYWVogQ29tcHV0aW5nIEluYy4MATGABkFCQzEyMzAxMA4GBmeBBRIDAQQEAAcAAgwNTm90IFNwZWNpZmllZAwDSEQxgAgxMjM0QUJDRIMB/6IeMBwMCHVuYW1lIC1yDBA2LjUuMC0xNS1nZW5lcmljMBQGBWeBBQIXMQswCQIBAQIBAQIBETCCAScwbwYDVR0jBGgwZoAUl46DRCrPD3GZndkBbbNDngf6ZHChOKQ2MDQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtleGFtcGxlLmNvbTEPMA0GA1UECwwGUENUZXN0ghRmuv6Ey2JadCAOFysMNOn9CiH45zBBBgNVHSAEOjA4MDYGAioDMDAwLgYIKwYBBQUHAgIwIgwgVENHIFRydXN0ZWQgUGxhdGZvcm0gRW5kb3JzZW1lbnQwcQYDVR0RBGowaKRmMGQxEzARBgZngQUFAQQMB01vZGVsIEExHjAcBgZngQUFAQEMElhZWiBDb21wdXRpbmcgSW5jLjEZMBcGBmeBBQUBBQwNTm90IFNwZWNpZmllZDESMBAGBmeBBQUBBgwGQUJDMTIzMA0GCSqGSIb3DQEBCwUAA4IBAQBKj3TsMcVSu8zFLPwMX5f8SHelruSr0Oi4QCNLwAylo9Oi3loIaIwCRf95+z4SUJjGhyuBBooWP6Io0uWJ43tI7IFHdZ5vMtRIdemD3te+2iYH7OHMzMucsQ3L63n+XHHxhNrMgBOGI9+7Q4Rnvnm7OFFVqSKt5rX0sZFrR12XVD67CA3VC+khyXy1cV/3v95DwWFSHOG2VkiKjDdO2B4WRrK0Cy2J7ZFo0TYtaLNEONABL5nfa9MIXUAgo4hDwhxNSXfirJPgVt8HQNaoQPepHDiZbmRZc38Q1LAUpTxMYDePH0pQDkmI9Tdk+4/CMYhU0CIq6jzRHrOaUwfgNGp9 +-----END ATTRIBUTE CERTIFICATE----- diff --git a/test/certs/acert_ietf.pem b/test/certs/acert_ietf.pem new file mode 100644 index 0000000000..fdb6e1114e --- /dev/null +++ b/test/certs/acert_ietf.pem @@ -0,0 +1,15 @@ +-----BEGIN ATTRIBUTE CERTIFICATE----- +MIICPTCCASUCAQEwN6AWMBGkDzANMQswCQYDVQQDDAJDQQIBAqEdpBswGTEXMBUG +A1UEAwwOc2VydmVyLmV4YW1wbGWgLTArpCkwJzElMCMGA1UEAwwcQXR0cmlidXRl +IENlcnRpZmljYXRlIElzc3VlcjANBgkqhkiG9w0BAQsFAAIUA7WQWQKiqrVAIUS4 +LE/ZgBtfV8IwIhgPMjAyMTA2MTUxMjM1MDBaGA8yMDMxMDYxMzEyMzUwMFowQTAj +BggrBgEFBQcKBDEXMBWgCYYHVGVzdHZhbDAIDAZncm91cDEwGgYDVQRIMRMwEaEP +gw1hZG1pbmlzdHJhdG9yMCwwHwYDVR0jBBgwFoAUYm7JaGdsZLtTgt0tqoCK2MrI +i10wCQYDVR04BAIFADANBgkqhkiG9w0BAQsFAAOCAQEARYpFEjordN68NXSLmDae +uruxhw+Zsr9Grom4mqYy/2lAuu58os4xA4Cez9OdkfCZmU9baDBVfMWys7GlCJdg +wn5uO5Kk2eiEWsujO/EV4c5eyXSrsUghQZQKfIVsgeut+7WfmDy/+j8ibbxJxJp/ +KMIoDjBAaMDhhxaCYclm8dJRT9DPba/bCNjuPGeTXslDQSXIfzFDgQkRZ0+Z7s9i +enYBmnH4rvW+SX8v5MzfGOu8VtHAKKBEcCbs2qGwYBEUUsCA/LYKSnOwn655wsd9 +k6KifIGOCVS4ZbK9pDyYcH/6/OmD1eSUwDZsd8CrJYDC31gAu7xqhOsBzR9DL3oD +4Q== +-----END ATTRIBUTE CERTIFICATE----- diff --git a/test/recipes/60-test_x509_acert.t b/test/recipes/60-test_x509_acert.t new file mode 100644 index 0000000000..35864e6608 --- /dev/null +++ b/test/recipes/60-test_x509_acert.t @@ -0,0 +1,22 @@ +#! /usr/bin/env perl +# Copyright 2021 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the Apache License 2.0 (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + +use OpenSSL::Test::Utils; +use OpenSSL::Test qw/:DEFAULT srctop_file/; + +setup("test_x509_acert"); + +plan skip_all => "test_x509_acert uses ec which is not supported by this build" + if disabled("ec"); + +plan tests => 1; + +ok(run(test(["x509_acert_test", srctop_file("test", "certs", "acert.pem"), + srctop_file("test", "certs", "acert_ietf.pem")])), + "running x509_acert_test"); + diff --git a/test/x509_acert_test.c b/test/x509_acert_test.c new file mode 100644 index 0000000000..0099d4629e --- /dev/null +++ b/test/x509_acert_test.c @@ -0,0 +1,174 @@ +/* + * Copyright 2021 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include + +#include "testutil.h" + +static int test_print_acert(int idx) +{ + int ret = 0; + const char *acert_file; + X509_ACERT *acert = NULL; + BIO *bp, *bout; + + if (!TEST_ptr(acert_file = test_get_argument(idx))) + return 0; + + if (!TEST_ptr(bp = BIO_new_file(acert_file, "r"))) + return 0; + + if (!TEST_ptr(bout = BIO_new_fp(stderr, BIO_NOCLOSE))) + goto err; + + if (!TEST_ptr(acert = PEM_read_bio_X509_ACERT(bp, NULL, NULL, NULL))) + goto err; + + if (!TEST_int_eq(X509_ACERT_print(bout, acert), 1)) { + goto err; + } + + ret = 1; + +err: + BIO_free(bp); + BIO_free(bout); + X509_ACERT_free(acert); + return ret; +} + +static int test_acert_sign(void) +{ + int ret = 0; + const char *acert_file; + EVP_PKEY *pkey; + BIO *bp = NULL; + X509_ACERT *acert = NULL; + + if (!TEST_ptr(acert_file = test_get_argument(0))) + return 0; + + if (!TEST_ptr(pkey = EVP_RSA_gen(2048))) + return 0; + + if (!TEST_ptr(bp = BIO_new_file(acert_file, "r"))) + goto err; + + if (!TEST_ptr(acert = PEM_read_bio_X509_ACERT(bp, NULL, NULL, NULL))) + goto err; + + if (!TEST_int_gt(X509_ACERT_sign(acert, pkey, EVP_sha256()), 0) || + !TEST_int_eq(X509_ACERT_verify(acert, pkey), 1)) + goto err; + + ret = 1; + +err: + BIO_free(bp); + X509_ACERT_free(acert); + EVP_PKEY_free(pkey); + return ret; +} + +/* IetfAttrSyntax structure with one value */ +static const unsigned char attr_syntax_single[] = { + 0x30, 0x15, 0xa0, 0x09, 0x86, 0x07, 0x54, 0x65, 0x73, 0x74, 0x76, 0x61, + 0x6c, 0x30, 0x08, 0x0c, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x31 +}; + +/* IetfAttrSyntax structure with multiple values of the same type */ +static const unsigned char attr_syntax_multiple[] = { + 0x30, 0x1d, 0x30, 0x1b, 0x0c, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x20, + 0x31, 0x0c, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x20, 0x32, 0x0c, 0x07, + 0x67, 0x72, 0x6f, 0x75, 0x70, 0x20, 0x33 +}; + +/* IetfAttrSyntax structure with multiple values of different types */ +static const unsigned char attr_syntax_diff_type[] = { + 0x30, 0x11, 0x30, 0x0f, 0x04, 0x08, 0x64, 0x65, 0x61, 0x64, 0x63, 0x6f, + 0x64, 0x65, 0x0c, 0x03, 0x61, 0x61, 0x61 +}; + +/* IetfAttrSyntax structure with an invalid/unsupported value type */ +static const unsigned char attr_syntax_invalid_type[] = { + 0x30, 0x05, 0x30, 0x03, 0x02, 0x01, 0x0a +}; + +#define ADD_TEST_DATA(x, valid) {x, sizeof(x), valid} + +struct ietf_type_test_data { + const unsigned char *data; + size_t len; + int valid; +}; + +static const struct ietf_type_test_data ietf_syntax_tests[] = { + ADD_TEST_DATA(attr_syntax_single, 1), + ADD_TEST_DATA(attr_syntax_multiple, 1), + ADD_TEST_DATA(attr_syntax_diff_type, 0), + ADD_TEST_DATA(attr_syntax_invalid_type, 0), +}; + +static int test_object_group_attr(int idx) +{ + int ret = 0; + OSSL_IETF_ATTR_SYNTAX *ias = NULL; + BIO *bout = NULL; + const unsigned char *p; + const struct ietf_type_test_data *test = &ietf_syntax_tests[idx]; + + if (!TEST_ptr(bout = BIO_new_fp(stderr, BIO_NOCLOSE))) + goto done; + + p = test->data; + + ias = d2i_OSSL_IETF_ATTR_SYNTAX(NULL, &p, test->len); + + if ((test->valid && !TEST_ptr(ias)) + || (!test->valid && !TEST_ptr_null(ias))) + goto done; + + if (ias != NULL + && !TEST_int_eq(OSSL_IETF_ATTR_SYNTAX_print(bout, ias, 4), 1)) { + OSSL_IETF_ATTR_SYNTAX_free(ias); + goto done; + } + + ret = 1; + +done: + OSSL_IETF_ATTR_SYNTAX_free(ias); + BIO_free(bout); + return ret; +} + +OPT_TEST_DECLARE_USAGE("[...]\n") +int setup_tests(void) +{ + int cnt; + + if (!test_skip_common_options()) { + TEST_error("Error parsing test options\n"); + return 0; + } + + cnt = test_get_argument_count(); + if (cnt < 1) { + TEST_error("Must specify at least 1 attribute certificate file\n"); + return 0; + } + + ADD_ALL_TESTS(test_print_acert, cnt); + ADD_TEST(test_acert_sign); + ADD_ALL_TESTS(test_object_group_attr, OSSL_NELEM(ietf_syntax_tests)); + + return 1; +}