[openssl-commits] [openssl] master update
Rich Salz
rsalz at openssl.org
Wed Aug 16 18:34:54 UTC 2017
The branch master has been updated
via 121738d1cbfffa704eef4073510f13b419e6f08d (commit)
from e0584e96c1b37edeec0222e28b9c37f97c6bbc02 (commit)
- Log -----------------------------------------------------------------
commit 121738d1cbfffa704eef4073510f13b419e6f08d
Author: David von Oheimb <David.von.Oheimb at siemens.com>
Date: Wed Aug 16 14:00:05 2017 -0400
Fix OCSP_basic_verify() cert chain construction in case bs->certs is NULL
Now the certs arg is not any more neglected when building the signer cert chain.
Added case to test/recipes/80-test_ocsp.t proving fix for 3-level CA hierarchy.
See also http://rt.openssl.org/Ticket/Display.html?id=4620
Reviewed-by: Matt Caswell <matt at openssl.org>
Reviewed-by: Rich Salz <rsalz at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4124)
-----------------------------------------------------------------------
Summary of changes:
crypto/ocsp/ocsp_vfy.c | 2 +
.../{ND3_Issuer_Root.pem => ND1_Cross_Root.pem} | 0
.../{ND2_Cert_ICA.pem => ND1_Issuer_ICA-Cross.pem} | 29 +++++
test/recipes/80-test_ocsp.t | 118 +++++++++++----------
4 files changed, 93 insertions(+), 56 deletions(-)
copy test/ocsp-tests/{ND3_Issuer_Root.pem => ND1_Cross_Root.pem} (100%)
copy test/ocsp-tests/{ND2_Cert_ICA.pem => ND1_Issuer_ICA-Cross.pem} (50%)
diff --git a/crypto/ocsp/ocsp_vfy.c b/crypto/ocsp/ocsp_vfy.c
index e2cfa6d..809f7f4 100644
--- a/crypto/ocsp/ocsp_vfy.c
+++ b/crypto/ocsp/ocsp_vfy.c
@@ -73,6 +73,8 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
goto f_err;
}
}
+ } else if (certs != NULL) {
+ untrusted = certs;
} else {
untrusted = bs->certs;
}
diff --git a/test/ocsp-tests/ND3_Issuer_Root.pem b/test/ocsp-tests/ND1_Cross_Root.pem
similarity index 100%
copy from test/ocsp-tests/ND3_Issuer_Root.pem
copy to test/ocsp-tests/ND1_Cross_Root.pem
diff --git a/test/ocsp-tests/ND2_Cert_ICA.pem b/test/ocsp-tests/ND1_Issuer_ICA-Cross.pem
similarity index 50%
copy from test/ocsp-tests/ND2_Cert_ICA.pem
copy to test/ocsp-tests/ND1_Issuer_ICA-Cross.pem
index 3260db3..08f04f6 100644
--- a/test/ocsp-tests/ND2_Cert_ICA.pem
+++ b/test/ocsp-tests/ND1_Issuer_ICA-Cross.pem
@@ -27,3 +27,32 @@ hC+Me1UvzymINzR4DzOq/7fylqSbRIC1vmxWVKukgZ4lGChUOn8sY89ZIIwYazgs
tN3t40DeDDYlV5rA0WCeXgNol64aO+pF11GZSe5EWVYLXrGPaOqKnsrSyaADfnAl
9DLJTlCDh6I0SD1PNXf82Ijq9n0ezkO21cJqfjhmY03n7jLvDyToKmf6
-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIE8TCCA9mgAwIBAgIQbyXcFa/fXqMIVgw7ek/H+DANBgkqhkiG9w0BAQUFADBv
+MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
+ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
+eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
+gYExCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
+BgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMScwJQYD
+VQQDEx5DT01PRE8gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDQQIuLcuORG/dRwRtUBJjTqb/B5opdO4f7u4jO
+DeMvPwaW8KIpUJmu2zuhV7B0UXHN7UKRTUH+qcjYaoZ3RLtZZpdQXrTULHBEz9o3
+lUJpPDDEcbNS8CFNodi6OXwcnqMknfKDFpiqFnxDmxVbt640kf7UYiYYRpo/68H5
+8ZBX66x6DYvbcjBqZtXgRqNw3GjZ/wRIiXfeten7Z21B6bw5vTLZYgLxsag9bjec
+4i/i06Imi8a4VUOI4SM+pdIkOWpHqwDUobOpJf4NP6cdutNRwQuk2qw471VQJAVl
+RpM0Ty2NrcbUIRnSjsoFYXEHc0flihkSvQRNzk6cpUisuyb3AgMBAAGjggF0MIIB
+cDAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTvA73gJMtUGjAdBgNVHQ4EFgQUC1jl
+i8ZMFTekQKkwqSG+RzZaVv8wDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
+Af8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9MDswOaA3oDWGM2h0dHA6Ly9j
+cmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LmNybDCBswYI
+KwYBBQUHAQEEgaYwgaMwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0
+LmNvbS9BZGRUcnVzdEV4dGVybmFsQ0FSb290LnA3YzA5BggrBgEFBQcwAoYtaHR0
+cDovL2NydC51c2VydHJ1c3QuY29tL0FkZFRydXN0VVROU0dDQ0EuY3J0MCUGCCsG
+AQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBBQUA
+A4IBAQAHYJOZqs7Q00fQNzPeP2S35S6jJQzVMx0Njav2fkZ7WQaS44LE5/X289kF
+z0k0LTdf9CXH8PtrI3fx8UDXTLtJRTHdAChntylMdagfeTHJNjcPyjVPjPF+3vxG
+q79om3AjMC63xVx7ivsYE3lLkkKM3CyrbCK3KFOzGkrOG/soDrc6pNoN90AyT99v
+uwFQ/IfTdtn8+7aEA8rJNhj33Wzbu7qBHKat/ij5z7micV0ZBepKRtxzQe+JlEKx
+Q4hvNRevHmCDrHqMEHufyfaDbZ76iO4+3e6esL/garnQnweyCROa9aTlyFt5p0c1
+M2jlVZ6qW8swC53HD79oRIGXi1FK
+-----END CERTIFICATE-----
diff --git a/test/recipes/80-test_ocsp.t b/test/recipes/80-test_ocsp.t
index 103a7ae..9f178de 100644
--- a/test/recipes/80-test_ocsp.t
+++ b/test/recipes/80-test_ocsp.t
@@ -29,6 +29,10 @@ sub test_ocsp {
my $title = shift;
my $inputfile = shift;
my $CAfile = shift;
+ my $untrusted = shift;
+ if ($untrusted eq "") {
+ $untrusted = $CAfile;
+ }
my $expected_exit = shift;
run(app(["openssl", "base64", "-d",
@@ -38,7 +42,7 @@ sub test_ocsp {
sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat",
"-partial_chain", @check_time,
"-CAfile", catfile($ocspdir, $CAfile),
- "-verify_other", catfile($ocspdir, $CAfile),
+ "-verify_other", catfile($ocspdir, $untrusted),
"-no-CApath"])),
$title); });
unlink "ocsp-resp-fff.dat";
@@ -47,144 +51,146 @@ sub test_ocsp {
plan tests => 10;
subtest "=== VALID OCSP RESPONSES ===" => sub {
- plan tests => 6;
+ plan tests => 7;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
- "ND1.ors", "ND1_Issuer_ICA.pem", 0);
+ "ND1.ors", "ND1_Issuer_ICA.pem", "", 0);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
- "ND2.ors", "ND2_Issuer_Root.pem", 0);
+ "ND2.ors", "ND2_Issuer_Root.pem", "", 0);
test_ocsp("NON-DELEGATED; Root CA -> EE",
- "ND3.ors", "ND3_Issuer_Root.pem", 0);
+ "ND3.ors", "ND3_Issuer_Root.pem", "", 0);
+ test_ocsp("NON-DELEGATED; 3-level CA hierarchy",
+ "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0);
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "D1.ors", "D1_Issuer_ICA.pem", 0);
+ "D1.ors", "D1_Issuer_ICA.pem", "", 0);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "D2.ors", "D2_Issuer_Root.pem", 0);
+ "D2.ors", "D2_Issuer_Root.pem", "", 0);
test_ocsp("DELEGATED; Root CA -> EE",
- "D3.ors", "D3_Issuer_Root.pem", 0);
+ "D3.ors", "D3_Issuer_Root.pem", "", 0);
};
subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
- "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
+ "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
- "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
+ "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
- "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
+ "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
+ "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
+ "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> EE",
- "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
+ "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1);
};
subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
- "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
+ "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
- "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
+ "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
- "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
+ "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
+ "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
+ "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> EE",
- "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
+ "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1);
};
subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
- "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
+ "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
- "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
+ "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
- "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
+ "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
+ "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
+ "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> EE",
- "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
+ "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1);
};
subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
- "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
+ "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
- "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
+ "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
- "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
+ "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
+ "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
+ "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> EE",
- "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
+ "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1);
};
subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
plan tests => 3;
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
+ "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
+ "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> EE",
- "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
+ "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
};
subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
plan tests => 3;
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
+ "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
+ "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> EE",
- "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
+ "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
};
subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
- "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
+ "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
- "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
+ "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
- "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
+ "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
+ "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
+ "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> EE",
- "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
+ "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1);
};
subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
- "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
+ "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
- "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
+ "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
- "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
+ "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
+ "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
+ "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1);
test_ocsp("DELEGATED; Root CA -> EE",
- "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
+ "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1);
};
subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
@@ -192,15 +198,15 @@ subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
# Expect success, because we're explicitly trusting the issuer certificate.
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
- "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
+ "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
- "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
+ "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0);
test_ocsp("NON-DELEGATED; Root CA -> EE",
- "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
+ "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0);
test_ocsp("DELEGATED; Intermediate CA -> EE",
- "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
+ "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
- "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
+ "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0);
test_ocsp("DELEGATED; Root CA -> EE",
- "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);
+ "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0);
};
More information about the openssl-commits
mailing list