| 1 | /*
|
|---|
| 2 | * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 3 | *
|
|---|
| 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use
|
|---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
|---|
| 6 | * in the file LICENSE in the source distribution or at
|
|---|
| 7 | * https://www.openssl.org/source/license.html
|
|---|
| 8 | */
|
|---|
| 9 |
|
|---|
| 10 | #include <stdio.h>
|
|---|
| 11 | #include <string.h>
|
|---|
| 12 | #include <openssl/x509.h>
|
|---|
| 13 | #include <openssl/x509v3.h>
|
|---|
| 14 | #include <openssl/pem.h>
|
|---|
| 15 | #include <openssl/err.h>
|
|---|
| 16 | #include "internal/nelem.h"
|
|---|
| 17 |
|
|---|
| 18 | #include "testutil.h"
|
|---|
| 19 |
|
|---|
| 20 | static const char *infile;
|
|---|
| 21 |
|
|---|
| 22 | static int test_pathlen(void)
|
|---|
| 23 | {
|
|---|
| 24 | X509 *x = NULL;
|
|---|
| 25 | BIO *b = NULL;
|
|---|
| 26 | long pathlen;
|
|---|
| 27 | int ret = 0;
|
|---|
| 28 |
|
|---|
| 29 | if (!TEST_ptr(b = BIO_new_file(infile, "r"))
|
|---|
| 30 | || !TEST_ptr(x = PEM_read_bio_X509(b, NULL, NULL, NULL))
|
|---|
| 31 | || !TEST_int_eq(pathlen = X509_get_pathlen(x), 6))
|
|---|
| 32 | goto end;
|
|---|
| 33 |
|
|---|
| 34 | ret = 1;
|
|---|
| 35 |
|
|---|
| 36 | end:
|
|---|
| 37 | BIO_free(b);
|
|---|
| 38 | X509_free(x);
|
|---|
| 39 | return ret;
|
|---|
| 40 | }
|
|---|
| 41 |
|
|---|
| 42 | #ifndef OPENSSL_NO_RFC3779
|
|---|
| 43 | static int test_asid(void)
|
|---|
| 44 | {
|
|---|
| 45 | ASN1_INTEGER *val1 = NULL, *val2 = NULL;
|
|---|
| 46 | ASIdentifiers *asid1 = ASIdentifiers_new(), *asid2 = ASIdentifiers_new(),
|
|---|
| 47 | *asid3 = ASIdentifiers_new(), *asid4 = ASIdentifiers_new();
|
|---|
| 48 | int testresult = 0;
|
|---|
| 49 |
|
|---|
| 50 | if (!TEST_ptr(asid1)
|
|---|
| 51 | || !TEST_ptr(asid2)
|
|---|
| 52 | || !TEST_ptr(asid3))
|
|---|
| 53 | goto err;
|
|---|
| 54 |
|
|---|
| 55 | if (!TEST_ptr(val1 = ASN1_INTEGER_new())
|
|---|
| 56 | || !TEST_true(ASN1_INTEGER_set_int64(val1, 64496)))
|
|---|
| 57 | goto err;
|
|---|
| 58 |
|
|---|
| 59 | if (!TEST_true(X509v3_asid_add_id_or_range(asid1, V3_ASID_ASNUM, val1, NULL)))
|
|---|
| 60 | goto err;
|
|---|
| 61 |
|
|---|
| 62 | val1 = NULL;
|
|---|
| 63 | if (!TEST_ptr(val2 = ASN1_INTEGER_new())
|
|---|
| 64 | || !TEST_true(ASN1_INTEGER_set_int64(val2, 64497)))
|
|---|
| 65 | goto err;
|
|---|
| 66 |
|
|---|
| 67 | if (!TEST_true(X509v3_asid_add_id_or_range(asid2, V3_ASID_ASNUM, val2, NULL)))
|
|---|
| 68 | goto err;
|
|---|
| 69 |
|
|---|
| 70 | val2 = NULL;
|
|---|
| 71 | if (!TEST_ptr(val1 = ASN1_INTEGER_new())
|
|---|
| 72 | || !TEST_true(ASN1_INTEGER_set_int64(val1, 64496))
|
|---|
| 73 | || !TEST_ptr(val2 = ASN1_INTEGER_new())
|
|---|
| 74 | || !TEST_true(ASN1_INTEGER_set_int64(val2, 64497)))
|
|---|
| 75 | goto err;
|
|---|
| 76 |
|
|---|
| 77 | /*
|
|---|
| 78 | * Just tests V3_ASID_ASNUM for now. Could be extended at some point to also
|
|---|
| 79 | * test V3_ASID_RDI if we think it is worth it.
|
|---|
| 80 | */
|
|---|
| 81 | if (!TEST_true(X509v3_asid_add_id_or_range(asid3, V3_ASID_ASNUM, val1, val2)))
|
|---|
| 82 | goto err;
|
|---|
| 83 | val1 = val2 = NULL;
|
|---|
| 84 |
|
|---|
| 85 | /* Actual subsets */
|
|---|
| 86 | if (!TEST_true(X509v3_asid_subset(NULL, NULL))
|
|---|
| 87 | || !TEST_true(X509v3_asid_subset(NULL, asid1))
|
|---|
| 88 | || !TEST_true(X509v3_asid_subset(asid1, asid1))
|
|---|
| 89 | || !TEST_true(X509v3_asid_subset(asid2, asid2))
|
|---|
| 90 | || !TEST_true(X509v3_asid_subset(asid1, asid3))
|
|---|
| 91 | || !TEST_true(X509v3_asid_subset(asid2, asid3))
|
|---|
| 92 | || !TEST_true(X509v3_asid_subset(asid3, asid3))
|
|---|
| 93 | || !TEST_true(X509v3_asid_subset(asid4, asid1))
|
|---|
| 94 | || !TEST_true(X509v3_asid_subset(asid4, asid2))
|
|---|
| 95 | || !TEST_true(X509v3_asid_subset(asid4, asid3)))
|
|---|
| 96 | goto err;
|
|---|
| 97 |
|
|---|
| 98 | /* Not subsets */
|
|---|
| 99 | if (!TEST_false(X509v3_asid_subset(asid1, NULL))
|
|---|
| 100 | || !TEST_false(X509v3_asid_subset(asid1, asid2))
|
|---|
| 101 | || !TEST_false(X509v3_asid_subset(asid2, asid1))
|
|---|
| 102 | || !TEST_false(X509v3_asid_subset(asid3, asid1))
|
|---|
| 103 | || !TEST_false(X509v3_asid_subset(asid3, asid2))
|
|---|
| 104 | || !TEST_false(X509v3_asid_subset(asid1, asid4))
|
|---|
| 105 | || !TEST_false(X509v3_asid_subset(asid2, asid4))
|
|---|
| 106 | || !TEST_false(X509v3_asid_subset(asid3, asid4)))
|
|---|
| 107 | goto err;
|
|---|
| 108 |
|
|---|
| 109 | testresult = 1;
|
|---|
| 110 | err:
|
|---|
| 111 | ASN1_INTEGER_free(val1);
|
|---|
| 112 | ASN1_INTEGER_free(val2);
|
|---|
| 113 | ASIdentifiers_free(asid1);
|
|---|
| 114 | ASIdentifiers_free(asid2);
|
|---|
| 115 | ASIdentifiers_free(asid3);
|
|---|
| 116 | ASIdentifiers_free(asid4);
|
|---|
| 117 | return testresult;
|
|---|
| 118 | }
|
|---|
| 119 |
|
|---|
| 120 | static struct ip_ranges_st {
|
|---|
| 121 | const unsigned int afi;
|
|---|
| 122 | const char *ip1;
|
|---|
| 123 | const char *ip2;
|
|---|
| 124 | int rorp;
|
|---|
| 125 | } ranges[] = {
|
|---|
| 126 | { IANA_AFI_IPV4, "192.168.0.0", "192.168.0.1", IPAddressOrRange_addressPrefix},
|
|---|
| 127 | { IANA_AFI_IPV4, "192.168.0.0", "192.168.0.2", IPAddressOrRange_addressRange},
|
|---|
| 128 | { IANA_AFI_IPV4, "192.168.0.0", "192.168.0.3", IPAddressOrRange_addressPrefix},
|
|---|
| 129 | { IANA_AFI_IPV4, "192.168.0.0", "192.168.0.254", IPAddressOrRange_addressRange},
|
|---|
| 130 | { IANA_AFI_IPV4, "192.168.0.0", "192.168.0.255", IPAddressOrRange_addressPrefix},
|
|---|
| 131 | { IANA_AFI_IPV4, "192.168.0.1", "192.168.0.255", IPAddressOrRange_addressRange},
|
|---|
| 132 | { IANA_AFI_IPV4, "192.168.0.1", "192.168.0.1", IPAddressOrRange_addressPrefix},
|
|---|
| 133 | { IANA_AFI_IPV4, "192.168.0.0", "192.168.255.255", IPAddressOrRange_addressPrefix},
|
|---|
| 134 | { IANA_AFI_IPV4, "192.168.1.0", "192.168.255.255", IPAddressOrRange_addressRange},
|
|---|
| 135 | { IANA_AFI_IPV6, "2001:0db8::0", "2001:0db8::1", IPAddressOrRange_addressPrefix},
|
|---|
| 136 | { IANA_AFI_IPV6, "2001:0db8::0", "2001:0db8::2", IPAddressOrRange_addressRange},
|
|---|
| 137 | { IANA_AFI_IPV6, "2001:0db8::0", "2001:0db8::3", IPAddressOrRange_addressPrefix},
|
|---|
| 138 | { IANA_AFI_IPV6, "2001:0db8::0", "2001:0db8::fffe", IPAddressOrRange_addressRange},
|
|---|
| 139 | { IANA_AFI_IPV6, "2001:0db8::0", "2001:0db8::ffff", IPAddressOrRange_addressPrefix},
|
|---|
| 140 | { IANA_AFI_IPV6, "2001:0db8::1", "2001:0db8::ffff", IPAddressOrRange_addressRange},
|
|---|
| 141 | { IANA_AFI_IPV6, "2001:0db8::1", "2001:0db8::1", IPAddressOrRange_addressPrefix},
|
|---|
| 142 | { IANA_AFI_IPV6, "2001:0db8::0:0", "2001:0db8::ffff:ffff", IPAddressOrRange_addressPrefix},
|
|---|
| 143 | { IANA_AFI_IPV6, "2001:0db8::1:0", "2001:0db8::ffff:ffff", IPAddressOrRange_addressRange}
|
|---|
| 144 | };
|
|---|
| 145 |
|
|---|
| 146 | static int check_addr(IPAddrBlocks *addr, int type)
|
|---|
| 147 | {
|
|---|
| 148 | IPAddressFamily *fam;
|
|---|
| 149 | IPAddressOrRange *aorr;
|
|---|
| 150 |
|
|---|
| 151 | if (!TEST_int_eq(sk_IPAddressFamily_num(addr), 1))
|
|---|
| 152 | return 0;
|
|---|
| 153 |
|
|---|
| 154 | fam = sk_IPAddressFamily_value(addr, 0);
|
|---|
| 155 | if (!TEST_ptr(fam))
|
|---|
| 156 | return 0;
|
|---|
| 157 |
|
|---|
| 158 | if (!TEST_int_eq(fam->ipAddressChoice->type, IPAddressChoice_addressesOrRanges))
|
|---|
| 159 | return 0;
|
|---|
| 160 |
|
|---|
| 161 | if (!TEST_int_eq(sk_IPAddressOrRange_num(fam->ipAddressChoice->u.addressesOrRanges), 1))
|
|---|
| 162 | return 0;
|
|---|
| 163 |
|
|---|
| 164 | aorr = sk_IPAddressOrRange_value(fam->ipAddressChoice->u.addressesOrRanges, 0);
|
|---|
| 165 | if (!TEST_ptr(aorr))
|
|---|
| 166 | return 0;
|
|---|
| 167 |
|
|---|
| 168 | if (!TEST_int_eq(aorr->type, type))
|
|---|
| 169 | return 0;
|
|---|
| 170 |
|
|---|
| 171 | return 1;
|
|---|
| 172 | }
|
|---|
| 173 |
|
|---|
| 174 | static int test_addr_ranges(void)
|
|---|
| 175 | {
|
|---|
| 176 | IPAddrBlocks *addr = NULL;
|
|---|
| 177 | ASN1_OCTET_STRING *ip1 = NULL, *ip2 = NULL;
|
|---|
| 178 | size_t i;
|
|---|
| 179 | int testresult = 0;
|
|---|
| 180 |
|
|---|
| 181 | for (i = 0; i < OSSL_NELEM(ranges); i++) {
|
|---|
| 182 | addr = sk_IPAddressFamily_new_null();
|
|---|
| 183 | if (!TEST_ptr(addr))
|
|---|
| 184 | goto end;
|
|---|
| 185 | /*
|
|---|
| 186 | * Has the side effect of installing the comparison function onto the
|
|---|
| 187 | * stack.
|
|---|
| 188 | */
|
|---|
| 189 | if (!TEST_true(X509v3_addr_canonize(addr)))
|
|---|
| 190 | goto end;
|
|---|
| 191 |
|
|---|
| 192 | ip1 = a2i_IPADDRESS(ranges[i].ip1);
|
|---|
| 193 | if (!TEST_ptr(ip1))
|
|---|
| 194 | goto end;
|
|---|
| 195 | if (!TEST_true(ip1->length == 4 || ip1->length == 16))
|
|---|
| 196 | goto end;
|
|---|
| 197 | ip2 = a2i_IPADDRESS(ranges[i].ip2);
|
|---|
| 198 | if (!TEST_ptr(ip2))
|
|---|
| 199 | goto end;
|
|---|
| 200 | if (!TEST_int_eq(ip2->length, ip1->length))
|
|---|
| 201 | goto end;
|
|---|
| 202 | if (!TEST_true(memcmp(ip1->data, ip2->data, ip1->length) <= 0))
|
|---|
| 203 | goto end;
|
|---|
| 204 |
|
|---|
| 205 | if (!TEST_true(X509v3_addr_add_range(addr, ranges[i].afi, NULL, ip1->data, ip2->data)))
|
|---|
| 206 | goto end;
|
|---|
| 207 |
|
|---|
| 208 | if (!TEST_true(X509v3_addr_is_canonical(addr)))
|
|---|
| 209 | goto end;
|
|---|
| 210 |
|
|---|
| 211 | if (!check_addr(addr, ranges[i].rorp))
|
|---|
| 212 | goto end;
|
|---|
| 213 |
|
|---|
| 214 | sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
|
|---|
| 215 | addr = NULL;
|
|---|
| 216 | ASN1_OCTET_STRING_free(ip1);
|
|---|
| 217 | ASN1_OCTET_STRING_free(ip2);
|
|---|
| 218 | ip1 = ip2 = NULL;
|
|---|
| 219 | }
|
|---|
| 220 |
|
|---|
| 221 | testresult = 1;
|
|---|
| 222 | end:
|
|---|
| 223 | sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
|
|---|
| 224 | ASN1_OCTET_STRING_free(ip1);
|
|---|
| 225 | ASN1_OCTET_STRING_free(ip2);
|
|---|
| 226 | return testresult;
|
|---|
| 227 | }
|
|---|
| 228 |
|
|---|
| 229 | static int test_addr_fam_len(void)
|
|---|
| 230 | {
|
|---|
| 231 | int testresult = 0;
|
|---|
| 232 | IPAddrBlocks *addr = NULL;
|
|---|
| 233 | IPAddressFamily *f1 = NULL;
|
|---|
| 234 | ASN1_OCTET_STRING *ip1 = NULL, *ip2 = NULL;
|
|---|
| 235 | unsigned char key[6];
|
|---|
| 236 | unsigned int keylen;
|
|---|
| 237 | unsigned afi = IANA_AFI_IPV4;
|
|---|
| 238 |
|
|---|
| 239 | /* Create the IPAddrBlocks with a good IPAddressFamily */
|
|---|
| 240 | addr = sk_IPAddressFamily_new_null();
|
|---|
| 241 | if (!TEST_ptr(addr))
|
|---|
| 242 | goto end;
|
|---|
| 243 | ip1 = a2i_IPADDRESS(ranges[0].ip1);
|
|---|
| 244 | if (!TEST_ptr(ip1))
|
|---|
| 245 | goto end;
|
|---|
| 246 | ip2 = a2i_IPADDRESS(ranges[0].ip2);
|
|---|
| 247 | if (!TEST_ptr(ip2))
|
|---|
| 248 | goto end;
|
|---|
| 249 | if (!TEST_true(X509v3_addr_add_range(addr, ranges[0].afi, NULL, ip1->data, ip2->data)))
|
|---|
| 250 | goto end;
|
|---|
| 251 | if (!TEST_true(X509v3_addr_is_canonical(addr)))
|
|---|
| 252 | goto end;
|
|---|
| 253 |
|
|---|
| 254 | /* Create our malformed IPAddressFamily */
|
|---|
| 255 | key[0] = (afi >> 8) & 0xFF;
|
|---|
| 256 | key[1] = afi & 0xFF;
|
|---|
| 257 | key[2] = 0xD;
|
|---|
| 258 | key[3] = 0xE;
|
|---|
| 259 | key[4] = 0xA;
|
|---|
| 260 | key[5] = 0xD;
|
|---|
| 261 | keylen = 6;
|
|---|
| 262 | if ((f1 = IPAddressFamily_new()) == NULL)
|
|---|
| 263 | goto end;
|
|---|
| 264 | if (f1->ipAddressChoice == NULL &&
|
|---|
| 265 | (f1->ipAddressChoice = IPAddressChoice_new()) == NULL)
|
|---|
| 266 | goto end;
|
|---|
| 267 | if (f1->addressFamily == NULL &&
|
|---|
| 268 | (f1->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
|
|---|
| 269 | goto end;
|
|---|
| 270 | if (!ASN1_OCTET_STRING_set(f1->addressFamily, key, keylen))
|
|---|
| 271 | goto end;
|
|---|
| 272 |
|
|---|
| 273 | /* Push and transfer memory ownership to stack */
|
|---|
| 274 | if (!sk_IPAddressFamily_push(addr, f1))
|
|---|
| 275 | goto end;
|
|---|
| 276 | f1 = NULL;
|
|---|
| 277 |
|
|---|
| 278 | /* Shouldn't be able to canonize this as the len is > 3*/
|
|---|
| 279 | if (!TEST_false(X509v3_addr_canonize(addr)))
|
|---|
| 280 | goto end;
|
|---|
| 281 |
|
|---|
| 282 | /* Pop and free the new stack element */
|
|---|
| 283 | IPAddressFamily_free(sk_IPAddressFamily_pop(addr));
|
|---|
| 284 |
|
|---|
| 285 | /* Create a well-formed IPAddressFamily */
|
|---|
| 286 | key[0] = (afi >> 8) & 0xFF;
|
|---|
| 287 | key[1] = afi & 0xFF;
|
|---|
| 288 | key[2] = 0x1;
|
|---|
| 289 | keylen = 3;
|
|---|
| 290 | if ((f1 = IPAddressFamily_new()) == NULL)
|
|---|
| 291 | goto end;
|
|---|
| 292 | if (f1->ipAddressChoice == NULL &&
|
|---|
| 293 | (f1->ipAddressChoice = IPAddressChoice_new()) == NULL)
|
|---|
| 294 | goto end;
|
|---|
| 295 | if (f1->addressFamily == NULL &&
|
|---|
| 296 | (f1->addressFamily = ASN1_OCTET_STRING_new()) == NULL)
|
|---|
| 297 | goto end;
|
|---|
| 298 | if (!ASN1_OCTET_STRING_set(f1->addressFamily, key, keylen))
|
|---|
| 299 | goto end;
|
|---|
| 300 |
|
|---|
| 301 | /* Mark this as inheritance so we skip some of the is_canonize checks */
|
|---|
| 302 | f1->ipAddressChoice->type = IPAddressChoice_inherit;
|
|---|
| 303 |
|
|---|
| 304 | /* Push and transfer memory ownership to stack */
|
|---|
| 305 | if (!sk_IPAddressFamily_push(addr, f1))
|
|---|
| 306 | goto end;
|
|---|
| 307 | f1 = NULL;
|
|---|
| 308 |
|
|---|
| 309 | /* Should be able to canonize now */
|
|---|
| 310 | if (!TEST_true(X509v3_addr_canonize(addr)))
|
|---|
| 311 | goto end;
|
|---|
| 312 |
|
|---|
| 313 | testresult = 1;
|
|---|
| 314 | end:
|
|---|
| 315 | /* Free stack and any memory owned by detached element */
|
|---|
| 316 | IPAddressFamily_free(f1);
|
|---|
| 317 | sk_IPAddressFamily_pop_free(addr, IPAddressFamily_free);
|
|---|
| 318 |
|
|---|
| 319 | ASN1_OCTET_STRING_free(ip1);
|
|---|
| 320 | ASN1_OCTET_STRING_free(ip2);
|
|---|
| 321 | return testresult;
|
|---|
| 322 | }
|
|---|
| 323 |
|
|---|
| 324 | static struct extvalues_st {
|
|---|
| 325 | const char *value;
|
|---|
| 326 | int pass;
|
|---|
| 327 | } extvalues[] = {
|
|---|
| 328 | /* No prefix is ok */
|
|---|
| 329 | { "sbgp-ipAddrBlock = IPv4:192.0.0.1\n", 1 },
|
|---|
| 330 | { "sbgp-ipAddrBlock = IPv4:192.0.0.0/0\n", 1 },
|
|---|
| 331 | { "sbgp-ipAddrBlock = IPv4:192.0.0.0/1\n", 1 },
|
|---|
| 332 | { "sbgp-ipAddrBlock = IPv4:192.0.0.0/32\n", 1 },
|
|---|
| 333 | /* Prefix is too long */
|
|---|
| 334 | { "sbgp-ipAddrBlock = IPv4:192.0.0.0/33\n", 0 },
|
|---|
| 335 | /* Unreasonably large prefix */
|
|---|
| 336 | { "sbgp-ipAddrBlock = IPv4:192.0.0.0/12341234\n", 0 },
|
|---|
| 337 | /* Invalid IP addresses */
|
|---|
| 338 | { "sbgp-ipAddrBlock = IPv4:192.0.0\n", 0 },
|
|---|
| 339 | { "sbgp-ipAddrBlock = IPv4:256.0.0.0\n", 0 },
|
|---|
| 340 | { "sbgp-ipAddrBlock = IPv4:-1.0.0.0\n", 0 },
|
|---|
| 341 | { "sbgp-ipAddrBlock = IPv4:192.0.0.0.0\n", 0 },
|
|---|
| 342 | { "sbgp-ipAddrBlock = IPv3:192.0.0.0\n", 0 },
|
|---|
| 343 |
|
|---|
| 344 | /* IPv6 */
|
|---|
| 345 | /* No prefix is ok */
|
|---|
| 346 | { "sbgp-ipAddrBlock = IPv6:2001:db8::\n", 1 },
|
|---|
| 347 | { "sbgp-ipAddrBlock = IPv6:2001::db8\n", 1 },
|
|---|
| 348 | { "sbgp-ipAddrBlock = IPv6:2001:0db8:0000:0000:0000:0000:0000:0000\n", 1 },
|
|---|
| 349 | { "sbgp-ipAddrBlock = IPv6:2001:db8::/0\n", 1 },
|
|---|
| 350 | { "sbgp-ipAddrBlock = IPv6:2001:db8::/1\n", 1 },
|
|---|
| 351 | { "sbgp-ipAddrBlock = IPv6:2001:db8::/32\n", 1 },
|
|---|
| 352 | { "sbgp-ipAddrBlock = IPv6:2001:0db8:0000:0000:0000:0000:0000:0000/32\n", 1 },
|
|---|
| 353 | { "sbgp-ipAddrBlock = IPv6:2001:db8::/128\n", 1 },
|
|---|
| 354 | /* Prefix is too long */
|
|---|
| 355 | { "sbgp-ipAddrBlock = IPv6:2001:db8::/129\n", 0 },
|
|---|
| 356 | /* Unreasonably large prefix */
|
|---|
| 357 | { "sbgp-ipAddrBlock = IPv6:2001:db8::/12341234\n", 0 },
|
|---|
| 358 | /* Invalid IP addresses */
|
|---|
| 359 | /* Not enough blocks of numbers */
|
|---|
| 360 | { "sbgp-ipAddrBlock = IPv6:2001:0db8:0000:0000:0000:0000:0000\n", 0 },
|
|---|
| 361 | /* Too many blocks of numbers */
|
|---|
| 362 | { "sbgp-ipAddrBlock = IPv6:2001:0db8:0000:0000:0000:0000:0000:0000:0000\n", 0 },
|
|---|
| 363 | /* First value too large */
|
|---|
| 364 | { "sbgp-ipAddrBlock = IPv6:1ffff:0db8:0000:0000:0000:0000:0000:0000\n", 0 },
|
|---|
| 365 | /* First value with invalid characters */
|
|---|
| 366 | { "sbgp-ipAddrBlock = IPv6:fffg:0db8:0000:0000:0000:0000:0000:0000\n", 0 },
|
|---|
| 367 | /* First value is negative */
|
|---|
| 368 | { "sbgp-ipAddrBlock = IPv6:-1:0db8:0000:0000:0000:0000:0000:0000\n", 0 }
|
|---|
| 369 | };
|
|---|
| 370 |
|
|---|
| 371 | static int test_ext_syntax(void)
|
|---|
| 372 | {
|
|---|
| 373 | size_t i;
|
|---|
| 374 | int testresult = 1;
|
|---|
| 375 |
|
|---|
| 376 | for (i = 0; i < OSSL_NELEM(extvalues); i++) {
|
|---|
| 377 | X509V3_CTX ctx;
|
|---|
| 378 | BIO *extbio = BIO_new_mem_buf(extvalues[i].value,
|
|---|
| 379 | strlen(extvalues[i].value));
|
|---|
| 380 | CONF *conf;
|
|---|
| 381 | long eline;
|
|---|
| 382 |
|
|---|
| 383 | if (!TEST_ptr(extbio))
|
|---|
| 384 | return 0 ;
|
|---|
| 385 |
|
|---|
| 386 | conf = NCONF_new_ex(NULL, NULL);
|
|---|
| 387 | if (!TEST_ptr(conf)) {
|
|---|
| 388 | BIO_free(extbio);
|
|---|
| 389 | return 0;
|
|---|
| 390 | }
|
|---|
| 391 | if (!TEST_long_gt(NCONF_load_bio(conf, extbio, &eline), 0)) {
|
|---|
| 392 | testresult = 0;
|
|---|
| 393 | } else {
|
|---|
| 394 | X509V3_set_ctx_test(&ctx);
|
|---|
| 395 | X509V3_set_nconf(&ctx, conf);
|
|---|
| 396 |
|
|---|
| 397 | if (extvalues[i].pass) {
|
|---|
| 398 | if (!TEST_true(X509V3_EXT_add_nconf(conf, &ctx, "default",
|
|---|
| 399 | NULL))) {
|
|---|
| 400 | TEST_info("Value: %s", extvalues[i].value);
|
|---|
| 401 | testresult = 0;
|
|---|
| 402 | }
|
|---|
| 403 | } else {
|
|---|
| 404 | ERR_set_mark();
|
|---|
| 405 | if (!TEST_false(X509V3_EXT_add_nconf(conf, &ctx, "default",
|
|---|
| 406 | NULL))) {
|
|---|
| 407 | testresult = 0;
|
|---|
| 408 | TEST_info("Value: %s", extvalues[i].value);
|
|---|
| 409 | ERR_clear_last_mark();
|
|---|
| 410 | } else {
|
|---|
| 411 | ERR_pop_to_mark();
|
|---|
| 412 | }
|
|---|
| 413 | }
|
|---|
| 414 | }
|
|---|
| 415 | BIO_free(extbio);
|
|---|
| 416 | NCONF_free(conf);
|
|---|
| 417 | }
|
|---|
| 418 |
|
|---|
| 419 | return testresult;
|
|---|
| 420 | }
|
|---|
| 421 |
|
|---|
| 422 | static int test_addr_subset(void)
|
|---|
| 423 | {
|
|---|
| 424 | int i;
|
|---|
| 425 | int ret = 0;
|
|---|
| 426 | IPAddrBlocks *addrEmpty = NULL;
|
|---|
| 427 | IPAddrBlocks *addr[3] = { NULL, NULL };
|
|---|
| 428 | ASN1_OCTET_STRING *ip1[3] = { NULL, NULL };
|
|---|
| 429 | ASN1_OCTET_STRING *ip2[3] = { NULL, NULL };
|
|---|
| 430 | int sz = OSSL_NELEM(addr);
|
|---|
| 431 |
|
|---|
| 432 | for (i = 0; i < sz; ++i) {
|
|---|
| 433 | /* Create the IPAddrBlocks with a good IPAddressFamily */
|
|---|
| 434 | if (!TEST_ptr(addr[i] = sk_IPAddressFamily_new_null())
|
|---|
| 435 | || !TEST_ptr(ip1[i] = a2i_IPADDRESS(ranges[i].ip1))
|
|---|
| 436 | || !TEST_ptr(ip2[i] = a2i_IPADDRESS(ranges[i].ip2))
|
|---|
| 437 | || !TEST_true(X509v3_addr_add_range(addr[i], ranges[i].afi, NULL,
|
|---|
| 438 | ip1[i]->data, ip2[i]->data)))
|
|---|
| 439 | goto end;
|
|---|
| 440 | }
|
|---|
| 441 |
|
|---|
| 442 | ret = TEST_ptr(addrEmpty = sk_IPAddressFamily_new_null())
|
|---|
| 443 | && TEST_true(X509v3_addr_subset(NULL, NULL))
|
|---|
| 444 | && TEST_true(X509v3_addr_subset(NULL, addr[0]))
|
|---|
| 445 | && TEST_true(X509v3_addr_subset(addrEmpty, addr[0]))
|
|---|
| 446 | && TEST_true(X509v3_addr_subset(addr[0], addr[0]))
|
|---|
| 447 | && TEST_true(X509v3_addr_subset(addr[0], addr[1]))
|
|---|
| 448 | && TEST_true(X509v3_addr_subset(addr[0], addr[2]))
|
|---|
| 449 | && TEST_true(X509v3_addr_subset(addr[1], addr[2]))
|
|---|
| 450 | && TEST_false(X509v3_addr_subset(addr[0], NULL))
|
|---|
| 451 | && TEST_false(X509v3_addr_subset(addr[1], addr[0]))
|
|---|
| 452 | && TEST_false(X509v3_addr_subset(addr[2], addr[1]))
|
|---|
| 453 | && TEST_false(X509v3_addr_subset(addr[0], addrEmpty));
|
|---|
| 454 | end:
|
|---|
| 455 | sk_IPAddressFamily_pop_free(addrEmpty, IPAddressFamily_free);
|
|---|
| 456 | for (i = 0; i < sz; ++i) {
|
|---|
| 457 | sk_IPAddressFamily_pop_free(addr[i], IPAddressFamily_free);
|
|---|
| 458 | ASN1_OCTET_STRING_free(ip1[i]);
|
|---|
| 459 | ASN1_OCTET_STRING_free(ip2[i]);
|
|---|
| 460 | }
|
|---|
| 461 | return ret;
|
|---|
| 462 | }
|
|---|
| 463 |
|
|---|
| 464 | #endif /* OPENSSL_NO_RFC3779 */
|
|---|
| 465 |
|
|---|
| 466 | OPT_TEST_DECLARE_USAGE("cert.pem\n")
|
|---|
| 467 |
|
|---|
| 468 | int setup_tests(void)
|
|---|
| 469 | {
|
|---|
| 470 | if (!test_skip_common_options()) {
|
|---|
| 471 | TEST_error("Error parsing test options\n");
|
|---|
| 472 | return 0;
|
|---|
| 473 | }
|
|---|
| 474 |
|
|---|
| 475 | if (!TEST_ptr(infile = test_get_argument(0)))
|
|---|
| 476 | return 0;
|
|---|
| 477 |
|
|---|
| 478 | ADD_TEST(test_pathlen);
|
|---|
| 479 | #ifndef OPENSSL_NO_RFC3779
|
|---|
| 480 | ADD_TEST(test_asid);
|
|---|
| 481 | ADD_TEST(test_addr_ranges);
|
|---|
| 482 | ADD_TEST(test_ext_syntax);
|
|---|
| 483 | ADD_TEST(test_addr_fam_len);
|
|---|
| 484 | ADD_TEST(test_addr_subset);
|
|---|
| 485 | #endif /* OPENSSL_NO_RFC3779 */
|
|---|
| 486 | return 1;
|
|---|
| 487 | }
|
|---|
