mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-30 14:01:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

cleanup where purpose is not needed in 25-test_verify.t

Browse Source 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14413)
This commit is contained in:
Dr. David von Oheimb 2021-03-02 13:20:38 +01:00 committed by Tomas Mraz
parent eca4826a29
commit 97b59744f2
1 changed files with 67 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

134
test/recipes/25-test_verify.t
View File

@ -18,9 +18,10 @@ setup("test_verify");
sub verify {
my ($cert, $purpose, $trusted, $untrusted, @opts) = @_;
my @args = qw(openssl verify -auth_level 1 -purpose);
my @path = qw(test certs);
push(@args, "$purpose", @opts);
my @args = qw(openssl verify -auth_level 1);
push(@args, "-purpose", $purpose) if $purpose ne "";
push(@args, @opts);
for (@$trusted) { push(@args, "-trusted", srctop_file(@path, "$_.pem")) }
for (@$untrusted) { push(@args, "-untrusted", srctop_file(@path, "$_.pem")) }
push(@args, srctop_file(@path, "$cert.pem"));
@ -47,11 +48,11 @@ ok(!verify("ee-cert", "sslserver", [qw(root-name2)], [qw(ca-cert)]),
# Critical extensions
ok(verify("ee-cert-noncrit-unknown-ext", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
ok(verify("ee-cert-noncrit-unknown-ext", "", ["root-cert"], ["ca-cert"]),
"accept non-critical unknown extension");
ok(!verify("ee-cert-crit-unknown-ext", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
ok(!verify("ee-cert-crit-unknown-ext", "", ["root-cert"], ["ca-cert"]),
"reject critical unknown extension");
ok(verify("ee-cert-ocsp-nocheck", "sslserver", [qw(root-cert)], [qw(ca-cert)]),
ok(verify("ee-cert-ocsp-nocheck", "", ["root-cert"], ["ca-cert"]),
"accept critical OCSP No Check");
# Explicit trust/purpose combinations
@ -263,47 +264,47 @@ ok(!verify("pc6-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-c
"failed proxy cert where last CN was added as a multivalue RDN component");
# Security level tests
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
"accept RSA 2048 chain at auth level 2");
ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
"reject RSA 2048 root at auth level 3");
ok(verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),
ok(verify("ee-cert", "", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),
"accept RSA 768 root at auth level 0");
ok(!verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"]),
ok(!verify("ee-cert", "", ["root-cert-768"], ["ca-cert-768i"]),
"reject RSA 768 root at auth level 1");
ok(verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),
ok(verify("ee-cert-768i", "", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),
"accept RSA 768 intermediate at auth level 0");
ok(!verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"]),
ok(!verify("ee-cert-768i", "", ["root-cert"], ["ca-cert-768"]),
"reject RSA 768 intermediate at auth level 1");
ok(verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
ok(verify("ee-cert-768", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
"accept RSA 768 leaf at auth level 0");
ok(!verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"]),
ok(!verify("ee-cert-768", "", ["root-cert"], ["ca-cert"]),
"reject RSA 768 leaf at auth level 1");
#
ok(verify("ee-cert", "sslserver", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),
ok(verify("ee-cert", "", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),
"accept md5 self-signed TA at auth level 2");
ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-auth_level", "2"),
ok(verify("ee-cert", "", ["ca-cert-md5-any"], [], "-auth_level", "2"),
"accept md5 intermediate TA at auth level 2");
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),
ok(verify("ee-cert", "", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),
"accept md5 intermediate at auth level 0");
ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"]),
ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert-md5"]),
"reject md5 intermediate at auth level 1");
ok(verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
ok(verify("ee-cert-md5", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
"accept md5 leaf at auth level 0");
ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]),
ok(!verify("ee-cert-md5", "", ["root-cert"], ["ca-cert"]),
"reject md5 leaf at auth level 1");
# Explicit vs named curve tests
SKIP: {
skip "EC is not supported by this OpenSSL build", 3
if disabled("ec");
ok(!verify("ee-cert-ec-explicit", "sslserver", ["root-cert"],
ok(!verify("ee-cert-ec-explicit", "", ["root-cert"],
["ca-cert-ec-named"]),
"reject explicit curve leaf with named curve intermediate");
ok(!verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"],
ok(!verify("ee-cert-ec-named-explicit", "", ["root-cert"],
["ca-cert-ec-explicit"]),
"reject named curve leaf with explicit curve intermediate");
ok(verify("ee-cert-ec-named-named", "sslserver", ["root-cert"],
ok(verify("ee-cert-ec-named-named", "", ["root-cert"],
["ca-cert-ec-named"]),
"accept named curve leaf with named curve intermediate");
}
@ -312,129 +313,128 @@ SKIP: {
# between the trust-anchor and the leaf, so, for example, with a root->ca->leaf
# chain, depth = 1 is sufficient, but depth == 0 is not.
#
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),
ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),
"accept chain with verify_depth 2");
ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),
ok(verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),
"accept chain with verify_depth 1");
ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),
"accept chain with verify_depth 0");
ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
ok(!verify("ee-cert", "", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),
"reject chain with verify_depth 0");
ok(verify("ee-cert", "", ["ca-cert-md5-any"], [], "-verify_depth", "0"),
"accept md5 intermediate TA with verify_depth 0");
# Name Constraints tests.
ok(verify("alt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(verify("alt1-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints everything permitted");
ok(verify("alt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
ok(verify("alt2-cert", "", ["root-cert"], ["ncca2-cert"], ),
"Name Constraints nothing excluded");
ok(verify("alt3-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
ok(verify("alt3-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name Constraints nested test all permitted");
ok(verify("goodcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(verify("goodcn1-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints CNs permitted");
ok(!verify("badcn1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(!verify("badcn1-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints CNs not permitted");
ok(!verify("badalt1-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(!verify("badalt1-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints hostname not permitted");
ok(!verify("badalt2-cert", "sslserver", ["root-cert"], ["ncca2-cert"], ),
ok(!verify("badalt2-cert", "", ["root-cert"], ["ncca2-cert"], ),
"Name Constraints hostname excluded");
ok(!verify("badalt3-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(!verify("badalt3-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints email address not permitted");
ok(!verify("badalt4-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(!verify("badalt4-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints subject email address not permitted");
ok(!verify("badalt5-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(!verify("badalt5-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints IP address not permitted");
ok(!verify("badalt6-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(!verify("badalt6-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints CN hostname not permitted");
ok(!verify("badalt7-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),
ok(!verify("badalt7-cert", "", ["root-cert"], ["ncca1-cert"], ),
"Name Constraints CN BMPSTRING hostname not permitted");
ok(!verify("badalt8-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
ok(!verify("badalt8-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name constraints nested DNS name not permitted 1");
ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
ok(!verify("badalt9-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name constraints nested DNS name not permitted 2");
ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
ok(!verify("badalt10-cert", "", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),
"Name constraints nested DNS name excluded");
ok(verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
ok(verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "0"),
"Accept PSS signature using SHA1 at auth level 0");
ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], ),
"CA with PSS signature using SHA256");
ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
ok(!verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "1"),
"Reject PSS signature using SHA1 and auth level 1");
ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
"PSS signature using SHA256 and auth level 2");
ok(verify("ee-pss-cert", "sslserver", ["root-cert"], ["ca-pss-cert"], ),
ok(verify("ee-pss-cert", "", ["root-cert"], ["ca-pss-cert"], ),
"CA PSS signature");
ok(!verify("ee-pss-wrong1.5-cert", "sslserver", ["root-cert"], ["ca-pss-cert"], ),
ok(!verify("ee-pss-wrong1.5-cert", "", ["root-cert"], ["ca-pss-cert"], ),
"CA producing regular PKCS#1 v1.5 signature with PSA-PSS key");
ok(!verify("many-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
ok(!verify("many-names1", "", ["many-constraints"], ["many-constraints"], ),
"Too many names and constraints to check (1)");
ok(!verify("many-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
ok(!verify("many-names2", "", ["many-constraints"], ["many-constraints"], ),
"Too many names and constraints to check (2)");
ok(!verify("many-names3", "sslserver", ["many-constraints"], ["many-constraints"], ),
ok(!verify("many-names3", "", ["many-constraints"], ["many-constraints"], ),
"Too many names and constraints to check (3)");
ok(verify("some-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),
ok(verify("some-names1", "", ["many-constraints"], ["many-constraints"], ),
"Not too many names and constraints to check (1)");
ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
ok(verify("some-names2", "", ["many-constraints"], ["many-constraints"], ),
"Not too many names and constraints to check (2)");
ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),
ok(verify("some-names2", "", ["many-constraints"], ["many-constraints"], ),
"Not too many names and constraints to check (3)");
ok(verify("root-cert-rsa2", "sslserver", ["root-cert-rsa2"], [], "-check_ss_sig"),
ok(verify("root-cert-rsa2", "", ["root-cert-rsa2"], [], "-check_ss_sig"),
"Public Key Algorithm rsa instead of rsaEncryption");
ok(verify("ee-self-signed", "sslserver", ["ee-self-signed"], []),
"accept trusted self-signed EE cert excluding key usage keyCertSign");
ok(verify("ee-self-signed", "", ["ee-self-signed"], []),
"accept trusted self-signed EE cert excluding key usage keyCertSign");
SKIP: {
skip "Ed25519 is not supported by this OpenSSL build", 6
if disabled("ec");
# ED25519 certificate from draft-ietf-curdle-pkix-04
ok(verify("ee-ed25519", "sslserver", ["root-ed25519"], []),
ok(verify("ee-ed25519", "", ["root-ed25519"], []),
"accept X25519 EE cert issued by trusted Ed25519 self-signed CA cert");
ok(!verify("ee-ed25519", "sslserver", ["root-ed25519"], [], "-x509_strict"),
ok(!verify("ee-ed25519", "", ["root-ed25519"], [], "-x509_strict"),
"reject X25519 EE cert in strict mode since AKID is missing");
ok(!verify("root-ed25519", "sslserver", ["ee-ed25519"], []),
ok(!verify("root-ed25519", "", ["ee-ed25519"], []),
"fail Ed25519 CA and EE certs swapped");
ok(verify("root-ed25519", "sslserver", ["root-ed25519"], []),
ok(verify("root-ed25519", "", ["root-ed25519"], []),
"accept trusted Ed25519 self-signed CA cert");
ok(!verify("ee-ed25519", "sslserver", ["ee-ed25519"], []),
ok(!verify("ee-ed25519", "", ["ee-ed25519"], []),
"fail trusted Ed25519-signed self-issued X25519 cert");
ok(verify("ee-ed25519", "sslserver", ["ee-ed25519"], [], "-partial_chain"),
ok(verify("ee-ed25519", "", ["ee-ed25519"], [], "-partial_chain"),
"accept last-resort direct leaf match Ed25519-signed self-issued cert");
}
SKIP: {
skip "SM2 is not supported by this OpenSSL build", 2
if disabled("sm2");
skip "SM2 is not supported by this OpenSSL build", 2 if disabled("sm2");
ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-vfyopt", "distid:1234567812345678"),
ok_nofips(verify("sm2", "", ["sm2-ca-cert"], [], "-vfyopt", "distid:1234567812345678"),
"SM2 ID test");
ok_nofips(verify("sm2", "any", ["sm2-ca-cert"], [], "-vfyopt", "hexdistid:31323334353637383132333435363738"),
ok_nofips(verify("sm2", "", ["sm2-ca-cert"], [], "-vfyopt", "hexdistid:31323334353637383132333435363738"),
"SM2 hex ID test");
}