Home | History | Annotate | Line # | Download | only in test 
      1 /*
      2  * Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved.
      3  *
      4  * Licensed under the Apache License 2.0 (the "License").  You may not use
      5  * this file except in compliance with the License.  You can obtain a copy
      6  * in the file LICENSE in the source distribution or at
      7  * https://www.openssl.org/source/license.html
      8  */
      9 
     10 #include "internal/nelem.h"
     11 #include <string.h>
     12 #include <time.h>
     13 #include <openssl/bio.h>
     14 #include <openssl/crypto.h>
     15 #include <openssl/err.h>
     16 #include <openssl/pem.h>
     17 #include <openssl/x509.h>
     18 
     19 #include "testutil.h"
     20 
     21 /*
     22  * We cannot use old certificates for new tests because the private key
     23  * associated with them is no longer available. Therefore, we add kCRLTestLeaf,
     24  * kCRLTestLeaf2 and PARAM_TIME2, as well as pass the verification time to the
     25  * verify function as a parameter. Certificates and CRL from
     26  * https://github.com/openssl/openssl/issues/27506 are used.
     27  */
     28 
     29 #define PARAM_TIME 1474934400 /* Sep 27th, 2016 */
     30 #define PARAM_TIME2 1753284700 /* July 23th, 2025 */
     31 
     32 static const char *kCRLTestRoot[] = {
     33     "-----BEGIN CERTIFICATE-----\n",
     34     "MIIDbzCCAlegAwIBAgIJAODri7v0dDUFMA0GCSqGSIb3DQEBCwUAME4xCzAJBgNV\n",
     35     "BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW\n",
     36     "aWV3MRIwEAYDVQQKDAlCb3JpbmdTU0wwHhcNMTYwOTI2MTUwNjI2WhcNMjYwOTI0\n",
     37     "MTUwNjI2WjBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQG\n",
     38     "A1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9yaW5nU1NMMIIBIjANBgkq\n",
     39     "hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo16WiLWZuaymsD8n5SKPmxV1y6jjgr3B\n",
     40     "S/dUBpbrzd1aeFzNlI8l2jfAnzUyp+I21RQ+nh/MhqjGElkTtK9xMn1Y+S9GMRh+\n",
     41     "5R/Du0iCb1tCZIPY07Tgrb0KMNWe0v2QKVVruuYSgxIWodBfxlKO64Z8AJ5IbnWp\n",
     42     "uRqO6rctN9qUoMlTIAB6dL4G0tDJ/PGFWOJYwOMEIX54bly2wgyYJVBKiRRt4f7n\n",
     43     "8H922qmvPNA9idmX9G1VAtgV6x97XXi7ULORIQvn9lVQF6nTYDBJhyuPB+mLThbL\n",
     44     "P2o9orxGx7aCtnnBZUIxUvHNOI0FaSaZH7Fi0xsZ/GkG2HZe7ImPJwIDAQABo1Aw\n",
     45     "TjAdBgNVHQ4EFgQUWPt3N5cZ/CRvubbrkqfBnAqhq94wHwYDVR0jBBgwFoAUWPt3\n",
     46     "N5cZ/CRvubbrkqfBnAqhq94wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\n",
     47     "AQEAORu6M0MOwXy+3VEBwNilfTxyqDfruQsc1jA4PT8Oe8zora1WxE1JB4q2FJOz\n",
     48     "EAuM3H/NXvEnBuN+ITvKZAJUfm4NKX97qmjMJwLKWe1gVv+VQTr63aR7mgWJReQN\n",
     49     "XdMztlVeZs2dppV6uEg3ia1X0G7LARxGpA9ETbMyCpb39XxlYuTClcbA5ftDN99B\n",
     50     "3Xg9KNdd++Ew22O3HWRDvdDpTO/JkzQfzi3sYwUtzMEonENhczJhGf7bQMmvL/w5\n",
     51     "24Wxj4Z7KzzWIHsNqE/RIs6RV3fcW61j/mRgW2XyoWnMVeBzvcJr9NXp4VQYmFPw\n",
     52     "amd8GKMZQvP0ufGnUn7D7uartA==\n",
     53     "-----END CERTIFICATE-----\n",
     54     NULL
     55 };
     56 
     57 static const char *kCRLTestLeaf[] = {
     58     "-----BEGIN CERTIFICATE-----\n",
     59     "MIIDkDCCAnigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwTjELMAkGA1UEBhMCVVMx\n",
     60     "EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEjAQ\n",
     61     "BgNVBAoMCUJvcmluZ1NTTDAeFw0xNjA5MjYxNTA4MzFaFw0xNzA5MjYxNTA4MzFa\n",
     62     "MEsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQKDAlC\n",
     63     "b3JpbmdTU0wxEzARBgNVBAMMCmJvcmluZy5zc2wwggEiMA0GCSqGSIb3DQEBAQUA\n",
     64     "A4IBDwAwggEKAoIBAQDc5v1S1M0W+QWM+raWfO0LH8uvqEwuJQgODqMaGnSlWUx9\n",
     65     "8iQcnWfjyPja3lWg9K62hSOFDuSyEkysKHDxijz5R93CfLcfnVXjWQDJe7EJTTDP\n",
     66     "ozEvxN6RjAeYv7CF000euYr3QT5iyBjg76+bon1p0jHZBJeNPP1KqGYgyxp+hzpx\n",
     67     "e0gZmTlGAXd8JQK4v8kpdYwD6PPifFL/jpmQpqOtQmH/6zcLjY4ojmqpEdBqIKIX\n",
     68     "+saA29hMq0+NK3K+wgg31RU+cVWxu3tLOIiesETkeDgArjWRS1Vkzbi4v9SJxtNu\n",
     69     "OZuAxWiynRJw3JwH/OFHYZIvQqz68ZBoj96cepjPAgMBAAGjezB5MAkGA1UdEwQC\n",
     70     "MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl\n",
     71     "MB0GA1UdDgQWBBTGn0OVVh/aoYt0bvEKG+PIERqnDzAfBgNVHSMEGDAWgBRY+3c3\n",
     72     "lxn8JG+5tuuSp8GcCqGr3jANBgkqhkiG9w0BAQsFAAOCAQEAd2nM8gCQN2Dc8QJw\n",
     73     "XSZXyuI3DBGGCHcay/3iXu0JvTC3EiQo8J6Djv7WLI0N5KH8mkm40u89fJAB2lLZ\n",
     74     "ShuHVtcC182bOKnePgwp9CNwQ21p0rDEu/P3X46ZvFgdxx82E9xLa0tBB8PiPDWh\n",
     75     "lV16jbaKTgX5AZqjnsyjR5o9/mbZVupZJXx5Syq+XA8qiJfstSYJs4KyKK9UOjql\n",
     76     "ICkJVKpi2ahDBqX4MOH4SLfzVk8pqSpviS6yaA1RXqjpkxiN45WWaXDldVHMSkhC\n",
     77     "5CNXsXi4b1nAntu89crwSLA3rEwzCWeYj+BX7e1T9rr3oJdwOU/2KQtW1js1yQUG\n",
     78     "tjJMFw==\n",
     79     "-----END CERTIFICATE-----\n",
     80     NULL
     81 };
     82 
     83 static const char *kCRLTestRoot2[] = {
     84     "-----BEGIN CERTIFICATE-----\n",
     85     "MIID4zCCAsugAwIBAgIUGTcyNat9hTOo8nnGdzF7MTzL9WAwDQYJKoZIhvcNAQEL\n",
     86     "BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM\n",
     87     "DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk15IENvbXBhbnkxEzARBgNVBAMMCk15\n",
     88     "IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJvb3QgQ0EwHhcNMjUwMzAzMDcxNDA0WhcN\n",
     89     "MzUwMzAxMDcxNDA0WjB5MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p\n",
     90     "YTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKTXkgQ29tcGFueTET\n",
     91     "MBEGA1UEAwwKTXkgUm9vdCBDQTETMBEGA1UECwwKTXkgUm9vdCBDQTCCASIwDQYJ\n",
     92     "KoZIhvcNAQEBBQADggEPADCCAQoCggEBAN6jjwkmV+pse430MQfyaWv+JtAd2r6K\n",
     93     "qzEquBcoofzuf/yvdEhQPjK3bcotgfEcFq3QMo1MJ7vqRHEIu0hJ+5ZnEQtIRcrg\n",
     94     "Vm7/EoVCBpDc9BDtW40TDp69z9kaKyyKYy6rxmSKgJydGBeGGMwBxgTK/o0xAriC\n",
     95     "C3lLXHT8G8YMamKUpToPL5iCRX+GJPnnizB2ODvpQGMWkbp9+1xEc4dD7Db2wfUb\n",
     96     "gatDYUoGndQKWD49UhURavQZeLpDxlz93YutRRkZTWc4IB7WebiEb39BDjSP3QYm\n",
     97     "2h+rZYyjp3Gxy8pBNTPzE9Dk4yjiqS7o3WGvi/S6zKTLDvWl9t6pMOMCAwEAAaNj\n",
     98     "MGEwHQYDVR0OBBYEFNdhiR+Tlot2VBbp5XfcfLdlG4AkMA4GA1UdDwEB/wQEAwIB\n",
     99     "hjAfBgNVHSMEGDAWgBTXYYkfk5aLdlQW6eV33Hy3ZRuAJDAPBgNVHRMBAf8EBTAD\n",
    100     "AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCvwutY0WMcKoqulifnYfhxGLtXSSvD2GET\n",
    101     "uNRv+S1KI5JKcAdfvnbNDpUwlujMDIpe3ewmv9i6kcitpHwZXdVAw6KWagJ0kDSt\n",
    102     "jbArJxuuuFmSFDS7kj8x7FZok5quAWDSSg+ubV2tCVxmDuTs1WXJXD3l9g+3J9GU\n",
    103     "kyeFMKqwRp8w22vm9ilgXrzeesAmmAg/pEb56ljTPeaONQxVe7KJhv2q8J17sML8\n",
    104     "BE7TdVx7UFQbO/t9XqdT5O9eF8JUx4Vn4QSr+jdjJ/ns4T3/IC9dJq9k7tjD48iA\n",
    105     "TNc+7x+uj8P39VA96HpjujVakj8/qn5SQMPJgDds+MSXrX+6JBWm\n",
    106     "-----END CERTIFICATE-----\n",
    107     NULL
    108 };
    109 
    110 static const char *kCRLTestLeaf2[] = {
    111     "-----BEGIN CERTIFICATE-----\n",
    112     "MIIECjCCAvKgAwIBAgIUPxuMqMtuN1j3XZVRVrNmaTCIP04wDQYJKoZIhvcNAQEL\n",
    113     "BQAweTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM\n",
    114     "DVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk15IENvbXBhbnkxEzARBgNVBAMMCk15\n",
    115     "IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJvb3QgQ0EwHhcNMjUwNDE3MTAxNjQ5WhcN\n",
    116     "MjYwNDE3MTAxNjQ5WjBoMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHQmVpamluZzEQ\n",
    117     "MA4GA1UEBwwHQmVpamluZzEYMBYGA1UECgwPTXkgT3JnYW5pemF0aW9uMRswGQYD\n",
    118     "VQQDDBJNeSBJbnRlcm1lZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n",
    119     "ggEKAoIBAQDIxRxZQokflDaLYoD21HT2U4EshqtKpSf9zPS5unBMCfnQkU4IJjBF\n",
    120     "3qQmfgz5ZOpZv3x0w48fDjiysk0eOVCFAo+uixEjMeuln6Wj3taetch2Sk0YNm5J\n",
    121     "SJCNF2olHZXn5R8ngEmho2j1wbwNnpcccZyRNzUSjR9oAgObkP3O7fyQKJRxwNU0\n",
    122     "sN7mfoyEOczKtUaYbqi2gPx6OOqNLjXlLmfZ8PJagKCN/oYkGU5PoRNXp65Znhu6\n",
    123     "s8FuSmvTodu8Qhs9Uizo+SycaBXn5Fbqt32S+9vPfhH9FfELDfQIaBp+iQAxcKPX\n",
    124     "tUglXEjiEVrbNf722PuWIWN9EIBolULVAgMBAAGjgZowgZcwEgYDVR0TAQH/BAgw\n",
    125     "BgEB/wIBATAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vbG9jYWxob3N0OjgwMDAv\n",
    126     "Y2FfY3JsLmRlcjAdBgNVHQ4EFgQUh40vFgoopz5GUggPEEk2+bKgbwQwHwYDVR0j\n",
    127     "BBgwFoAU12GJH5OWi3ZUFunld9x8t2UbgCQwDgYDVR0PAQH/BAQDAgGGMA0GCSqG\n",
    128     "SIb3DQEBCwUAA4IBAQDANfJuTgo0vRaMPYqOeW8R4jLHdVazdGLeQQ/85vXr/Gl1\n",
    129     "aL40tLp4yZbThxuxTzPzfY1OGkG69YQ/8Vo0gCEi5KjBMYPKmZISKy1MwROQ1Jfp\n",
    130     "HkmyZk1TfuzG/4fN/bun2gjpDYcihf4xA4NhSVzQyvqm1N6VkTgK+bEWTOGzqw66\n",
    131     "6IYPN6oVDmLbwU1EvV3rggB7HUJCJP4qW9DbAQRAijUurPUGoU2vEbrSyYkfQXCf\n",
    132     "p4ouOTMl6O7bJ110SKzxbCfWqom+iAwHlU2tOPVmOp1CLDCClMRNHIFMDGAoBomH\n",
    133     "s01wD+IcIi9OkQEbqVb/XDKes8fqzQgTtSM9C9Ot\n",
    134     "-----END CERTIFICATE-----\n",
    135     NULL
    136 };
    137 
    138 static const char *kBasicCRL[] = {
    139     "-----BEGIN X509 CRL-----\n",
    140     "MIIBpzCBkAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
    141     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
    142     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV\n",
    143     "HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN\n",
    144     "ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo\n",
    145     "eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os\n",
    146     "dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv\n",
    147     "diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho\n",
    148     "/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==\n",
    149     "-----END X509 CRL-----\n",
    150     NULL
    151 };
    152 
    153 static const char *kRevokedCRL[] = {
    154     "-----BEGIN X509 CRL-----\n",
    155     "MIIBvjCBpwIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
    156     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
    157     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEyNDRaFw0xNjEwMjYxNTEyNDRaMBUwEwICEAAX\n",
    158     "DTE2MDkyNjE1MTIyNlqgDjAMMAoGA1UdFAQDAgECMA0GCSqGSIb3DQEBCwUAA4IB\n",
    159     "AQCUGaM4DcWzlQKrcZvI8TMeR8BpsvQeo5BoI/XZu2a8h//PyRyMwYeaOM+3zl0d\n",
    160     "sjgCT8b3C1FPgT+P2Lkowv7rJ+FHJRNQkogr+RuqCSPTq65ha4WKlRGWkMFybzVH\n",
    161     "NloxC+aU3lgp/NlX9yUtfqYmJek1CDrOOGPrAEAwj1l/BUeYKNGqfBWYJQtPJu+5\n",
    162     "OaSvIYGpETCZJscUWODmLEb/O3DM438vLvxonwGqXqS0KX37+CHpUlyhnSovxXxp\n",
    163     "Pz4aF+L7OtczxL0GYtD2fR9B7TDMqsNmHXgQrixvvOY7MUdLGbd4RfJL3yA53hyO\n",
    164     "xzfKY2TzxLiOmctG0hXFkH5J\n",
    165     "-----END X509 CRL-----\n",
    166     NULL
    167 };
    168 
    169 static const char *kInvalidCRL[] = {
    170     "-----BEGIN X509 CRL-----\n",
    171     "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n",
    172     "-----END X509 CRL-----\n",
    173     NULL
    174 };
    175 
    176 static const char *kBadIssuerCRL[] = {
    177     "-----BEGIN X509 CRL-----\n",
    178     "MIIBwjCBqwIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
    179     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEWMBQGA1UECgwN\n",
    180     "Tm90IEJvcmluZ1NTTBcNMTYwOTI2MTUxMjQ0WhcNMTYxMDI2MTUxMjQ0WjAVMBMC\n",
    181     "AhAAFw0xNjA5MjYxNTEyMjZaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsF\n",
    182     "AAOCAQEAlBmjOA3Fs5UCq3GbyPEzHkfAabL0HqOQaCP12btmvIf/z8kcjMGHmjjP\n",
    183     "t85dHbI4Ak/G9wtRT4E/j9i5KML+6yfhRyUTUJKIK/kbqgkj06uuYWuFipURlpDB\n",
    184     "cm81RzZaMQvmlN5YKfzZV/clLX6mJiXpNQg6zjhj6wBAMI9ZfwVHmCjRqnwVmCUL\n",
    185     "TybvuTmkryGBqREwmSbHFFjg5ixG/ztwzON/Ly78aJ8Bql6ktCl9+/gh6VJcoZ0q\n",
    186     "L8V8aT8+Ghfi+zrXM8S9BmLQ9n0fQe0wzKrDZh14EK4sb7zmOzFHSxm3eEXyS98g\n",
    187     "Od4cjsc3ymNk88S4jpnLRtIVxZB+SQ==\n",
    188     "-----END X509 CRL-----\n",
    189     NULL
    190 };
    191 
    192 static const char *kEmptyIdpCRL[] = {
    193     "-----BEGIN X509 CRL-----\n",
    194     "MIICOTCCASECAQEwDQYJKoZIhvcNAQELBQAweTELMAkGA1UEBhMCVVMxEzARBgNV\n",
    195     "BAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoM\n",
    196     "Ck15IENvbXBhbnkxEzARBgNVBAMMCk15IFJvb3QgQ0ExEzARBgNVBAsMCk15IFJv\n",
    197     "b3QgQ0EXDTI1MDEwMTAwMDAwMFoXDTI1MTIwMTAwMDAwMFowJzAlAhQcgAIu+B8k\n",
    198     "Be6WphLcth/grHAeXhcNMjUwNDE3MTAxNjUxWqBLMEkwGAYDVR0UBBECDxnP/97a\n",
    199     "dO3y9qRGDM7hQDAfBgNVHSMEGDAWgBTXYYkfk5aLdlQW6eV33Hy3ZRuAJDAMBgNV\n",
    200     "HRwBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQAf+mtlDi9IftsYwTcxYYKxE203\n",
    201     "+prttFB00om29jjtkGYRxcs3vZQRTvera21YFn3mrS/lxvhBq6GMx0I61AQ48Pr4\n",
    202     "63bDvZgf+/P6T2+MLgLds23o3TOfy2SBSdnFEcN0bFUgF5U0bFpQqlQWx+FYhrAf\n",
    203     "ZX3RAhURiKKfGKGeVOVKS0u+x666FoDQ7pbhbHM3+jnuzdtv8RQMkj1AZMw0FMl8\n",
    204     "m2dFQhZqT9WdJqZAc8ldc6V3a0rUeOV8BUPACf1k4B0CKhn4draIqltZkWgl3cmU\n",
    205     "SX2V/a51lS12orfNYSEx+vtJ9gpx4LDxyOnai18vueVyljrXuQSrcYuxS2Cd\n",
    206     "-----END X509 CRL-----\n",
    207     NULL
    208 };
    209 
    210 /*
    211  * This is kBasicCRL but with a critical issuing distribution point
    212  * extension.
    213  */
    214 static const char *kKnownCriticalCRL[] = {
    215     "-----BEGIN X509 CRL-----\n",
    216     "MIIBujCBowIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
    217     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
    218     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCEwHzAKBgNV\n",
    219     "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wDQYJKoZIhvcNAQELBQADggEBAA+3\n",
    220     "i+5e5Ub8sccfgOBs6WVJFI9c8gvJjrJ8/dYfFIAuCyeocs7DFXn1n13CRZ+URR/Q\n",
    221     "mVWgU28+xeusuSPYFpd9cyYTcVyNUGNTI3lwgcE/yVjPaOmzSZKdPakApRxtpKKQ\n",
    222     "NN/56aQz3bnT/ZSHQNciRB8U6jiD9V30t0w+FDTpGaG+7bzzUH3UVF9xf9Ctp60A\n",
    223     "3mfLe0scas7owSt4AEFuj2SPvcE7yvdOXbu+IEv21cEJUVExJAbhvIweHXh6yRW+\n",
    224     "7VVeiNzdIjkZjyTmAzoXGha4+wbxXyBRbfH+XWcO/H+8nwyG8Gktdu2QB9S9nnIp\n",
    225     "o/1TpfOMSGhMyMoyPrk=\n",
    226     "-----END X509 CRL-----\n",
    227     NULL
    228 };
    229 
    230 /*
    231  * kUnknownCriticalCRL is kBasicCRL but with an unknown critical extension.
    232  */
    233 static const char *kUnknownCriticalCRL[] = {
    234     "-----BEGIN X509 CRL-----\n",
    235     "MIIBvDCBpQIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
    236     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
    237     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoCMwITAKBgNV\n",
    238     "HRQEAwIBATATBgwqhkiG9xIEAYS3CQABAf8EADANBgkqhkiG9w0BAQsFAAOCAQEA\n",
    239     "GvBP0xqL509InMj/3493YVRV+ldTpBv5uTD6jewzf5XdaxEQ/VjTNe5zKnxbpAib\n",
    240     "Kf7cwX0PMSkZjx7k7kKdDlEucwVvDoqC+O9aJcqVmM6GDyNb9xENxd0XCXja6MZC\n",
    241     "yVgP4AwLauB2vSiEprYJyI1APph3iAEeDm60lTXX/wBM/tupQDDujKh2GPyvBRfJ\n",
    242     "+wEDwGg3ICwvu4gO4zeC5qnFR+bpL9t5tOMAQnVZ0NWv+k7mkd2LbHdD44dxrfXC\n",
    243     "nhtfERx99SDmC/jtUAJrGhtCO8acr7exCeYcduN7KKCm91OeCJKK6OzWst0Og1DB\n",
    244     "kwzzU2rL3G65CrZ7H0SZsQ==\n",
    245     "-----END X509 CRL-----\n",
    246     NULL
    247 };
    248 
    249 /*
    250  * kUnknownCriticalCRL2 is kBasicCRL but with a critical issuing distribution
    251  * point extension followed by an unknown critical extension
    252  */
    253 static const char *kUnknownCriticalCRL2[] = {
    254     "-----BEGIN X509 CRL-----\n",
    255     "MIIBzzCBuAIBATANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE\n",
    256     "CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ\n",
    257     "Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoDYwNDAKBgNV\n",
    258     "HRQEAwIBATARBgNVHRwBAf8EBzAFoQMBAf8wEwYMKoZIhvcSBAGEtwkAAQH/BAAw\n",
    259     "DQYJKoZIhvcNAQELBQADggEBACTcpQC8jXL12JN5YzOcQ64ubQIe0XxRAd30p7qB\n",
    260     "BTXGpgqBjrjxRfLms7EBYodEXB2oXMsDq3km0vT1MfYdsDD05S+SQ9CDsq/pUfaC\n",
    261     "E2WNI5p8WircRnroYvbN2vkjlRbMd1+yNITohXYXCJwjEOAWOx3XIM10bwPYBv4R\n",
    262     "rDobuLHoMgL3yHgMHmAkP7YpkBucNqeBV8cCdeAZLuhXFWi6yfr3r/X18yWbC/r2\n",
    263     "2xXdkrSqXLFo7ToyP8YKTgiXpya4x6m53biEYwa2ULlas0igL6DK7wjYZX95Uy7H\n",
    264     "GKljn9weIYiMPV/BzGymwfv2EW0preLwtyJNJPaxbdin6Jc=\n",
    265     "-----END X509 CRL-----\n",
    266     NULL
    267 };
    268 
    269 static const char **unknown_critical_crls[] = {
    270     kUnknownCriticalCRL, kUnknownCriticalCRL2
    271 };
    272 
    273 static X509 *test_root = NULL;
    274 static X509 *test_leaf = NULL;
    275 static X509 *test_root2 = NULL;
    276 static X509 *test_leaf2 = NULL;
    277 
    278 /*
    279  * Glue an array of strings together.  Return a BIO and put the string
    280  * into |*out| so we can free it.
    281  */
    282 static BIO *glue2bio(const char **pem, char **out)
    283 {
    284     size_t s = 0;
    285 
    286     *out = glue_strings(pem, &s);
    287     return BIO_new_mem_buf(*out, s);
    288 }
    289 
    290 /*
    291  * Create a CRL from an array of strings.
    292  */
    293 static X509_CRL *CRL_from_strings(const char **pem)
    294 {
    295     X509_CRL *crl;
    296     char *p;
    297     BIO *b = glue2bio(pem, &p);
    298 
    299     if (b == NULL) {
    300         OPENSSL_free(p);
    301         return NULL;
    302     }
    303 
    304     crl = PEM_read_bio_X509_CRL(b, NULL, NULL, NULL);
    305 
    306     OPENSSL_free(p);
    307     BIO_free(b);
    308     return crl;
    309 }
    310 
    311 /*
    312  * Create an X509 from an array of strings.
    313  */
    314 static X509 *X509_from_strings(const char **pem)
    315 {
    316     X509 *x;
    317     char *p;
    318     BIO *b = glue2bio(pem, &p);
    319 
    320     if (b == NULL) {
    321         OPENSSL_free(p);
    322         return NULL;
    323     }
    324 
    325     x = PEM_read_bio_X509(b, NULL, NULL, NULL);
    326 
    327     OPENSSL_free(p);
    328     BIO_free(b);
    329     return x;
    330 }
    331 
    332 /*
    333  * Verify |leaf| certificate (chained up to |root|).  |crls| if
    334  * not NULL, is a list of CRLs to include in the verification. It is
    335  * also free'd before returning, which is kinda yucky but convenient.
    336  * Returns a value from X509_V_ERR_xxx or X509_V_OK.
    337  */
    338 static int verify(X509 *leaf, X509 *root, STACK_OF(X509_CRL) *crls,
    339     unsigned long flags, time_t verification_time)
    340 {
    341     X509_STORE_CTX *ctx = X509_STORE_CTX_new();
    342     X509_STORE *store = X509_STORE_new();
    343     X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
    344     STACK_OF(X509) *roots = sk_X509_new_null();
    345     int status = X509_V_ERR_UNSPECIFIED;
    346 
    347     if (!TEST_ptr(ctx)
    348         || !TEST_ptr(store)
    349         || !TEST_ptr(param)
    350         || !TEST_ptr(roots))
    351         goto err;
    352 
    353     /* Create a stack; upref the cert because we free it below. */
    354     if (!TEST_true(X509_up_ref(root)))
    355         goto err;
    356     if (!TEST_true(sk_X509_push(roots, root))) {
    357         X509_free(root);
    358         goto err;
    359     }
    360     if (!TEST_true(X509_STORE_CTX_init(ctx, store, leaf, NULL)))
    361         goto err;
    362     X509_STORE_CTX_set0_trusted_stack(ctx, roots);
    363     X509_STORE_CTX_set0_crls(ctx, crls);
    364     X509_VERIFY_PARAM_set_time(param, verification_time);
    365     if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param), (long)verification_time))
    366         goto err;
    367     X509_VERIFY_PARAM_set_depth(param, 16);
    368     if (flags)
    369         X509_VERIFY_PARAM_set_flags(param, flags);
    370     X509_STORE_CTX_set0_param(ctx, param);
    371     param = NULL;
    372 
    373     ERR_clear_error();
    374     status = X509_verify_cert(ctx) == 1 ? X509_V_OK
    375                                         : X509_STORE_CTX_get_error(ctx);
    376 err:
    377     OSSL_STACK_OF_X509_free(roots);
    378     sk_X509_CRL_pop_free(crls, X509_CRL_free);
    379     X509_VERIFY_PARAM_free(param);
    380     X509_STORE_CTX_free(ctx);
    381     X509_STORE_free(store);
    382     return status;
    383 }
    384 
    385 /*
    386  * Create a stack of CRL's.  Upref each one because we call pop_free on
    387  * the stack and need to keep the CRL's around until the test exits.
    388  * Yes this crashes on malloc failure; it forces us to debug.
    389  */
    390 static STACK_OF(X509_CRL) *make_CRL_stack(X509_CRL *x1, X509_CRL *x2)
    391 {
    392     STACK_OF(X509_CRL) *sk = sk_X509_CRL_new_null();
    393 
    394     if (x1 != NULL) {
    395         if (!X509_CRL_up_ref(x1))
    396             goto err;
    397         if (!sk_X509_CRL_push(sk, x1)) {
    398             X509_CRL_free(x1);
    399             goto err;
    400         }
    401     }
    402 
    403     if (x2 != NULL) {
    404         if (!X509_CRL_up_ref(x2))
    405             goto err;
    406         if (!sk_X509_CRL_push(sk, x2)) {
    407             X509_CRL_free(x2);
    408             goto err;
    409         }
    410     }
    411 
    412     return sk;
    413 
    414 err:
    415     sk_X509_CRL_pop_free(sk, X509_CRL_free);
    416     return NULL;
    417 }
    418 
    419 static int test_basic_crl(void)
    420 {
    421     X509_CRL *basic_crl = CRL_from_strings(kBasicCRL);
    422     X509_CRL *revoked_crl = CRL_from_strings(kRevokedCRL);
    423     int r;
    424 
    425     r = TEST_ptr(basic_crl)
    426         && TEST_ptr(revoked_crl)
    427         && TEST_int_eq(verify(test_leaf, test_root,
    428                            make_CRL_stack(basic_crl, NULL),
    429                            X509_V_FLAG_CRL_CHECK, PARAM_TIME),
    430             X509_V_OK)
    431         && TEST_int_eq(verify(test_leaf, test_root,
    432                            make_CRL_stack(basic_crl, revoked_crl),
    433                            X509_V_FLAG_CRL_CHECK, PARAM_TIME),
    434             X509_V_ERR_CERT_REVOKED);
    435     X509_CRL_free(basic_crl);
    436     X509_CRL_free(revoked_crl);
    437     return r;
    438 }
    439 
    440 static int test_no_crl(void)
    441 {
    442     return TEST_int_eq(verify(test_leaf, test_root, NULL,
    443                            X509_V_FLAG_CRL_CHECK, PARAM_TIME),
    444         X509_V_ERR_UNABLE_TO_GET_CRL);
    445 }
    446 
    447 static int test_bad_issuer_crl(void)
    448 {
    449     X509_CRL *bad_issuer_crl = CRL_from_strings(kBadIssuerCRL);
    450     int r;
    451 
    452     r = TEST_ptr(bad_issuer_crl)
    453         && TEST_int_eq(verify(test_leaf, test_root,
    454                            make_CRL_stack(bad_issuer_crl, NULL),
    455                            X509_V_FLAG_CRL_CHECK, PARAM_TIME),
    456             X509_V_ERR_UNABLE_TO_GET_CRL);
    457     X509_CRL_free(bad_issuer_crl);
    458     return r;
    459 }
    460 
    461 static int test_crl_empty_idp(void)
    462 {
    463     X509_CRL *empty_idp_crl = CRL_from_strings(kEmptyIdpCRL);
    464     int r;
    465 
    466     r = TEST_ptr(empty_idp_crl)
    467         && TEST_int_eq(verify(test_leaf2, test_root2,
    468                            make_CRL_stack(empty_idp_crl, NULL),
    469                            X509_V_FLAG_CRL_CHECK, PARAM_TIME2),
    470             X509_V_ERR_UNABLE_TO_GET_CRL);
    471     X509_CRL_free(empty_idp_crl);
    472     return r;
    473 }
    474 
    475 static int test_known_critical_crl(void)
    476 {
    477     X509_CRL *known_critical_crl = CRL_from_strings(kKnownCriticalCRL);
    478     int r;
    479 
    480     r = TEST_ptr(known_critical_crl)
    481         && TEST_int_eq(verify(test_leaf, test_root,
    482                            make_CRL_stack(known_critical_crl, NULL),
    483                            X509_V_FLAG_CRL_CHECK, PARAM_TIME),
    484             X509_V_OK);
    485     X509_CRL_free(known_critical_crl);
    486     return r;
    487 }
    488 
    489 static int test_unknown_critical_crl(int n)
    490 {
    491     X509_CRL *unknown_critical_crl = CRL_from_strings(unknown_critical_crls[n]);
    492     int r;
    493 
    494     r = TEST_ptr(unknown_critical_crl)
    495         && TEST_int_eq(verify(test_leaf, test_root,
    496                            make_CRL_stack(unknown_critical_crl, NULL),
    497                            X509_V_FLAG_CRL_CHECK, PARAM_TIME),
    498             X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION);
    499     X509_CRL_free(unknown_critical_crl);
    500     return r;
    501 }
    502 
    503 static int test_reuse_crl(int idx)
    504 {
    505     X509_CRL *result, *reused_crl = CRL_from_strings(kBasicCRL);
    506     X509_CRL *addref_crl = NULL;
    507     char *p = NULL;
    508     BIO *b = NULL;
    509     int r = 0;
    510 
    511     if (!TEST_ptr(reused_crl))
    512         goto err;
    513 
    514     if (idx & 1) {
    515         if (!TEST_true(X509_CRL_up_ref(reused_crl)))
    516             goto err;
    517         addref_crl = reused_crl;
    518     }
    519 
    520     idx >>= 1;
    521     b = glue2bio(idx == 2 ? kRevokedCRL : kInvalidCRL + idx, &p);
    522 
    523     if (!TEST_ptr(b))
    524         goto err;
    525 
    526     result = PEM_read_bio_X509_CRL(b, &reused_crl, NULL, NULL);
    527 
    528     switch (idx) {
    529     case 0: /* valid PEM + invalid DER */
    530         if (!TEST_ptr_null(result)
    531             || !TEST_ptr_null(reused_crl))
    532             goto err;
    533         break;
    534     case 1: /* invalid PEM */
    535         if (!TEST_ptr_null(result)
    536             || !TEST_ptr(reused_crl))
    537             goto err;
    538         break;
    539     case 2:
    540         if (!TEST_ptr(result)
    541             || !TEST_ptr(reused_crl)
    542             || !TEST_ptr_eq(result, reused_crl))
    543             goto err;
    544         break;
    545     }
    546 
    547     r = 1;
    548 
    549 err:
    550     OPENSSL_free(p);
    551     BIO_free(b);
    552     X509_CRL_free(reused_crl);
    553     X509_CRL_free(addref_crl);
    554     return r;
    555 }
    556 
    557 /*
    558  * Test to make sure X509_verify_cert sets the issuer, reasons, and
    559  * CRL score of the CRLs it gets from X509_STORE_CTX->get_crl
    560  */
    561 
    562 static int get_crl_fn(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x)
    563 {
    564     *crl = CRL_from_strings(kBasicCRL);
    565     return 1;
    566 }
    567 
    568 static int test_get_crl_fn_score(void)
    569 {
    570     X509_STORE_CTX *ctx = X509_STORE_CTX_new();
    571     X509_STORE *store = X509_STORE_new();
    572     X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
    573     STACK_OF(X509) *roots = sk_X509_new_null();
    574 
    575     int status = X509_V_ERR_UNSPECIFIED;
    576 
    577     if (!TEST_ptr(ctx)
    578         || !TEST_ptr(store)
    579         || !TEST_ptr(param)
    580         || !TEST_ptr(roots))
    581         goto err;
    582 
    583     /* Create a stack; upref the cert because we free it below. */
    584     if (!TEST_true(X509_up_ref(test_root)))
    585         goto err;
    586     if (!TEST_true(sk_X509_push(roots, test_root))) {
    587         X509_free(test_root);
    588         goto err;
    589     }
    590     if (!TEST_true(X509_STORE_CTX_init(ctx, store, test_leaf, NULL)))
    591         goto err;
    592 
    593     X509_STORE_CTX_set0_trusted_stack(ctx, roots);
    594     X509_STORE_CTX_set_get_crl(ctx, &get_crl_fn);
    595     X509_VERIFY_PARAM_set_time(param, PARAM_TIME);
    596     if (!TEST_long_eq((long)X509_VERIFY_PARAM_get_time(param),
    597             (long)PARAM_TIME))
    598         goto err;
    599     X509_VERIFY_PARAM_set_depth(param, 16);
    600     X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
    601     X509_STORE_CTX_set0_param(ctx, param);
    602     param = NULL;
    603 
    604     ERR_clear_error();
    605     status = X509_verify_cert(ctx) == 1 ? X509_V_OK
    606                                         : X509_STORE_CTX_get_error(ctx);
    607 
    608     TEST_int_eq(status, X509_V_OK);
    609 
    610 err:
    611     OSSL_STACK_OF_X509_free(roots);
    612     X509_VERIFY_PARAM_free(param);
    613     X509_STORE_CTX_free(ctx);
    614     X509_STORE_free(store);
    615     return status == X509_V_OK;
    616 }
    617 
    618 int setup_tests(void)
    619 {
    620     if (!TEST_ptr(test_root = X509_from_strings(kCRLTestRoot))
    621         || !TEST_ptr(test_leaf = X509_from_strings(kCRLTestLeaf))
    622         || !TEST_ptr(test_root2 = X509_from_strings(kCRLTestRoot2))
    623         || !TEST_ptr(test_leaf2 = X509_from_strings(kCRLTestLeaf2)))
    624         return 0;
    625 
    626     ADD_TEST(test_no_crl);
    627     ADD_TEST(test_basic_crl);
    628     ADD_TEST(test_bad_issuer_crl);
    629     ADD_TEST(test_crl_empty_idp);
    630     ADD_TEST(test_known_critical_crl);
    631     ADD_TEST(test_get_crl_fn_score);
    632     ADD_ALL_TESTS(test_unknown_critical_crl, OSSL_NELEM(unknown_critical_crls));
    633     ADD_ALL_TESTS(test_reuse_crl, 6);
    634     return 1;
    635 }
    636 
    637 void cleanup_tests(void)
    638 {
    639     X509_free(test_root);
    640     X509_free(test_leaf);
    641     X509_free(test_root2);
    642     X509_free(test_leaf2);
    643 }
    644