diff options
author | Rob Percival <robpercival@google.com> | 2016-02-29 17:33:02 +0000 |
---|---|---|
committer | Rob Percival <robpercival@google.com> | 2016-03-01 20:03:25 +0000 |
commit | 7d054e5ab2aeaead14c0c19b808d62221020b0e1 (patch) | |
tree | 655006eea9d0fe60879b36d09e9046be5a3749de /test | |
parent | 7852414967b87400b08bfdf321732cfbd07286e2 (diff) |
CT policy validation
Specifies a callback that will, in the future, be used by the SSL code to
decide whether to abort a connection on Certificate Transparency grounds.
Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'test')
-rw-r--r-- | test/Makefile.in | 2 | ||||
-rw-r--r-- | test/certs/embeddedSCTs1_issuer.pem | 18 | ||||
-rw-r--r-- | test/certs/embeddedSCTs3_issuer.pem | 35 | ||||
-rw-r--r-- | test/ct_test.c | 169 | ||||
-rw-r--r-- | test/recipes/80-test_ct.t | 5 |
5 files changed, 208 insertions, 21 deletions
diff --git a/test/Makefile.in b/test/Makefile.in index 2fb1f49985..7a5dcc1c3c 100644 --- a/test/Makefile.in +++ b/test/Makefile.in @@ -373,7 +373,7 @@ $(ASYNCTEST)$(EXE_EXT): $(ASYNCTEST).o $(DTLSV1LISTENTEST)$(EXE_EXT): $(DTLSV1LISTENTEST).o @target=$(DTLSV1LISTENTEST) $(BUILD_CMD) -$(CTTEST)$(EXE_EXT): $(CTTEST).o testutil.o +$(CTTEST)$(EXE_EXT): $(CTTEST).o $(DLIBCRYPTO) testutil.o @target=$(CTTEST) testutil=testutil.o; $(BUILD_CMD) $(THREADSTEST)$(EXE_EXT): $(THREADSTEST).o $(DLIBCRYPTO) diff --git a/test/certs/embeddedSCTs1_issuer.pem b/test/certs/embeddedSCTs1_issuer.pem new file mode 100644 index 0000000000..1fa449d5a0 --- /dev/null +++ b/test/certs/embeddedSCTs1_issuer.pem @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC0DCCAjmgAwIBAgIBADANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJHQjEk +MCIGA1UEChMbQ2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5IENBMQ4wDAYDVQQIEwVX +YWxlczEQMA4GA1UEBxMHRXJ3IFdlbjAeFw0xMjA2MDEwMDAwMDBaFw0yMjA2MDEw +MDAwMDBaMFUxCzAJBgNVBAYTAkdCMSQwIgYDVQQKExtDZXJ0aWZpY2F0ZSBUcmFu +c3BhcmVuY3kgQ0ExDjAMBgNVBAgTBVdhbGVzMRAwDgYDVQQHEwdFcncgV2VuMIGf +MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVimhTYhCicRmTbneDIRgcKkATxtB7 +jHbrkVfT0PtLO1FuzsvRyY2RxS90P6tjXVUJnNE6uvMa5UFEJFGnTHgW8iQ8+EjP +KDHM5nugSlojgZ88ujfmJNnDvbKZuDnd/iYx0ss6hPx7srXFL8/BT/9Ab1zURmnL +svfP34b7arnRsQIDAQABo4GvMIGsMB0GA1UdDgQWBBRfnYgNyHPmVNT4DdjmsMEk +tEfDVTB9BgNVHSMEdjB0gBRfnYgNyHPmVNT4DdjmsMEktEfDVaFZpFcwVTELMAkG +A1UEBhMCR0IxJDAiBgNVBAoTG0NlcnRpZmljYXRlIFRyYW5zcGFyZW5jeSBDQTEO +MAwGA1UECBMFV2FsZXMxEDAOBgNVBAcTB0VydyBXZW6CAQAwDAYDVR0TBAUwAwEB +/zANBgkqhkiG9w0BAQUFAAOBgQAGCMxKbWTyIF4UbASydvkrDvqUpdryOvw4BmBt +OZDQoeojPUApV2lGOwRmYef6HReZFSCa6i4Kd1F2QRIn18ADB8dHDmFYT9czQiRy +f1HWkLxHqd81TbD26yWVXeGJPE3VICskovPkQNJ0tU4b03YmnKliibduyqQQkOFP +OwqULg== +-----END CERTIFICATE----- diff --git a/test/certs/embeddedSCTs3_issuer.pem b/test/certs/embeddedSCTs3_issuer.pem new file mode 100644 index 0000000000..f4bc31274b --- /dev/null +++ b/test/certs/embeddedSCTs3_issuer.pem @@ -0,0 +1,35 @@ +-----BEGIN CERTIFICATE----- +MIIGDjCCA/agAwIBAgIQBqdDgNTr/tQ1taP34Wq92DANBgkqhkiG9w0BAQwFADCB +hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV +BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTIwMjEy +MDAwMDAwWhcNMjcwMjExMjM1OTU5WjCBkjELMAkGA1UEBhMCR0IxGzAZBgNVBAgT +EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR +Q09NT0RPIENBIExpbWl0ZWQxODA2BgNVBAMTL0NPTU9ETyBSU0EgRXh0ZW5kZWQg +VmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEAlVbeVLTf1QJJe9FbXKKyHo+cK2JMK40SKPMalaPGEP0p3uGf +CzhAk9HvbpUQ/OGQF3cs7nU+e2PsYZJuTzurgElr3wDqAwB/L3XVKC/sVmePgIOj +vdwDmZOLlJFWW6G4ajo/Br0OksxgnP214J9mMF/b5pTwlWqvyIqvgNnmiDkBfBzA +xSr3e5Wg8narbZtyOTDr0VdVAZ1YEZ18bYSPSeidCfw8/QpKdhQhXBZzQCMZdMO6 +WAqmli7eNuWf0MLw4eDBYuPCGEUZUaoXHugjddTI0JYT/8ck0YwLJ66eetw6YWNg +iJctXQUL5Tvrrs46R3N2qPos3cCHF+msMJn4HwIDAQABo4IBaTCCAWUwHwYDVR0j +BBgwFoAUu69+Aj36pvE8hI6t7jiY7NkyMtQwHQYDVR0OBBYEFDna/8ooFIqodBMI +ueQOqdL6fp1pMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMD4G +A1UdIAQ3MDUwMwYEVR0gADArMCkGCCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5j +b21vZG8uY29tL0NQUzBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNvbW9k +b2NhLmNvbS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggr +BgEFBQcBAQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29t +L0NPTU9ET1JTQUFkZFRydXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2Nz +cC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQEMBQADggIBAERCnUFRK0iIXZebeV4R +AUpSGXtBLMeJPNBy3IX6WK/VJeQT+FhlZ58N/1eLqYVeyqZLsKeyLeCMIs37/3mk +jCuN/gI9JN6pXV/kD0fQ22YlPodHDK4ixVAihNftSlka9pOlk7DgG4HyVsTIEFPk +1Hax0VtpS3ey4E/EhOfUoFDuPPpE/NBXueEoU/1Tzdy5H3pAvTA/2GzS8+cHnx8i +teoiccsq8FZ8/qyo0QYPFBRSTP5kKwxpKrgNUG4+BAe/eiCL+O5lCeHHSQgyPQ0o +fkkdt0rvAucNgBfIXOBhYsvss2B5JdoaZXOcOBCgJjqwyBZ9kzEi7nQLiMBciUEA +KKlHMd99SUWa9eanRRrSjhMQ34Ovmw2tfn6dNVA0BM7pINae253UqNpktNEvWS5e +ojZh1CSggjMziqHRbO9haKPl0latxf1eYusVqHQSTC8xjOnB3xBLAer2VBvNfzu9 +XJ/B288ByvK6YBIhMe2pZLiySVgXbVrXzYxtvp5/4gJYp9vDLVj2dAZqmvZh+fYA +tmnYOosxWd2R5nwnI4fdAw+PKowegwFOAWEMUnNt/AiiuSpm5HZNMaBWm9lTjaK2 +jwLI5jqmBNFI+8NKAnb9L9K8E7bobTQk+p0pisehKxTxlgBzuRPpwLk6R1YCcYAn +pLwltum95OmYdBbxN4SBB7SC +-----END CERTIFICATE----- diff --git a/test/ct_test.c b/test/ct_test.c index ac739ff755..99517a6d9f 100644 --- a/test/ct_test.c +++ b/test/ct_test.c @@ -1,8 +1,7 @@ /* * Tests the Certificate Transparency public and internal APIs. * - * Author: Rob Percival (robpercival@google.com) - * Date: 2016-01-26 + * Author: Rob Percival (robpercival@google.com) * * ==================================================================== * Copyright (c) 2016 The OpenSSL Project. All rights reserved. @@ -72,9 +71,12 @@ typedef struct ct_test_fixture { const char *test_case_name; + /* The CT log store to use during tests */ + CTLOG_STORE* ctlog_store; /* Set the following to test handling of SCTs in X509 certificates */ const char *certificate_file_path; - size_t expected_sct_count; + const char *issuer_file_path; + int expected_sct_count; /* Set the following to test handling of SCTs in TLS format */ const uint8_t *tls_sct; size_t tls_sct_len; @@ -85,6 +87,8 @@ typedef struct ct_test_fixture { * A maximum of |CT_TEST_MAX_FILE_SIZE| bytes will be read of this file. */ const char *sct_text_file_path; + /* Whether to test the validity of the SCT(s) */ + int test_validity; } CT_TEST_FIXTURE; @@ -92,10 +96,25 @@ static CT_TEST_FIXTURE set_up(const char *const test_case_name) { CT_TEST_FIXTURE fixture; int setup_ok = 1; + CTLOG_STORE *ctlog_store = CTLOG_STORE_new(); + + if (ctlog_store == NULL) { + setup_ok = 0; + fprintf(stderr, "Failed to create a new CT log store\n"); + goto end; + } + + if (CTLOG_STORE_load_default_file(ctlog_store) != 1) { + setup_ok = 0; + fprintf(stderr, "Failed to load CT log list\n"); + goto end; + } memset(&fixture, 0, sizeof(fixture)); fixture.test_case_name = test_case_name; + fixture.ctlog_store = ctlog_store; +end: if (!setup_ok) { exit(EXIT_FAILURE); } @@ -104,6 +123,7 @@ static CT_TEST_FIXTURE set_up(const char *const test_case_name) static void tear_down(CT_TEST_FIXTURE fixture) { + CTLOG_STORE_free(fixture.ctlog_store); ERR_print_errors_fp(stderr); } @@ -211,11 +231,13 @@ end: static int execute_cert_test(CT_TEST_FIXTURE fixture) { - int result = 0; - X509 *cert = NULL; + int test_failed = 0; + X509 *cert = NULL, *issuer = NULL; + STACK_OF(SCT) *scts = NULL; SCT *sct = NULL; char expected_sct_text[CT_TEST_MAX_FILE_SIZE]; int sct_text_len = 0; + CT_POLICY_EVAL_CTX *ct_policy_ctx = CT_POLICY_EVAL_CTX_new(); if (fixture.sct_text_file_path != NULL) { sct_text_len = read_text_file( @@ -224,7 +246,7 @@ static int execute_cert_test(CT_TEST_FIXTURE fixture) CT_TEST_MAX_FILE_SIZE - 1); if (sct_text_len < 0) { - result = 1; + test_failed = 1; fprintf(stderr, "Test data file not found: %s\n", fixture.sct_text_file_path); goto end; @@ -233,38 +255,106 @@ static int execute_cert_test(CT_TEST_FIXTURE fixture) expected_sct_text[sct_text_len] = '\0'; } + CT_POLICY_EVAL_CTX_set0_log_store(ct_policy_ctx, fixture.ctlog_store); + if (fixture.certificate_file_path != NULL) { int sct_extension_index; X509_EXTENSION *sct_extension = NULL; cert = load_pem_cert(fixture.certificate_file_path); if (cert == NULL) { - result = 1; + test_failed = 1; fprintf(stderr, "Unable to load certificate: %s\n", fixture.certificate_file_path); goto end; } - sct_extension_index = X509_get_ext_by_NID(cert, NID_ct_precert_scts, -1); + CT_POLICY_EVAL_CTX_set0_cert(ct_policy_ctx, cert); + + if (fixture.issuer_file_path != NULL) { + issuer = load_pem_cert(fixture.issuer_file_path); + + if (issuer == NULL) { + test_failed = 1; + fprintf(stderr, "Unable to load issuer certificate: %s\n", + fixture.issuer_file_path); + goto end; + } + + CT_POLICY_EVAL_CTX_set0_issuer(ct_policy_ctx, issuer); + } + + sct_extension_index = + X509_get_ext_by_NID(cert, NID_ct_precert_scts, -1); sct_extension = X509_get_ext(cert, sct_extension_index); if (fixture.expected_sct_count > 0) { if (sct_extension == NULL) { - result = 1; + test_failed = 1; fprintf(stderr, "SCT extension not found in: %s\n", fixture.certificate_file_path); goto end; } if (fixture.sct_text_file_path) { - result = compare_extension_printout(sct_extension, + test_failed = compare_extension_printout(sct_extension, expected_sct_text); - if (result != 0) + if (test_failed != 0) + goto end; + } + + if (fixture.test_validity) { + int are_scts_validated = 0; + scts = X509V3_EXT_d2i(sct_extension); + SCT_LIST_set_source(scts, SCT_SOURCE_X509V3_EXTENSION); + + are_scts_validated = SCT_LIST_validate(scts, ct_policy_ctx); + if (are_scts_validated < 0) { + fprintf(stderr, "Error verifying SCTs\n"); + test_failed = 1; + } else if (!are_scts_validated) { + int invalid_sct_count = 0; + int valid_sct_count = 0; + int i; + + for (i = 0; i < sk_SCT_num(scts); ++i) { + SCT *sct_i = sk_SCT_value(scts, i); + switch (SCT_get_validation_status(sct_i)) { + case SCT_VALIDATION_STATUS_VALID: + ++valid_sct_count; + break; + case SCT_VALIDATION_STATUS_INVALID: + ++invalid_sct_count; + break; + default: + /* Ignore other validation statuses. */ + break; + } + } + + if (valid_sct_count != fixture.expected_sct_count) { + int unverified_sct_count = sk_SCT_num(scts) - + invalid_sct_count - valid_sct_count; + + fprintf(stderr, + "%d SCTs failed verification\n" + "%d SCTs passed verification (%d expected)\n" + "%d SCTs were unverified\n", + invalid_sct_count, + valid_sct_count, + fixture.expected_sct_count, + unverified_sct_count); + } + test_failed = 1; + } + + if (test_failed != 0) goto end; } } else if (sct_extension != NULL) { - result = 1; - fprintf(stderr, "Expected no SCTs, but found SCT extension in: %s\n", - fixture.certificate_file_path); + test_failed = 1; + fprintf(stderr, + "Expected no SCTs, but found SCT extension in: %s\n", + fixture.certificate_file_path); goto end; } } @@ -274,30 +364,46 @@ static int execute_cert_test(CT_TEST_FIXTURE fixture) unsigned char *tls_sct; size_t tls_sct_len; if (o2i_SCT(&sct, &p, fixture.tls_sct_len) == NULL) { - result = 1; + test_failed = 1; fprintf(stderr, "Failed to decode SCT from TLS format\n"); goto end; } if (fixture.sct_text_file_path) { - result = compare_sct_printout(sct, expected_sct_text); - if (result != 0) + test_failed = compare_sct_printout(sct, expected_sct_text); + if (test_failed != 0) goto end; } tls_sct_len = i2o_SCT(sct, &tls_sct); if (tls_sct_len != fixture.tls_sct_len || memcmp(fixture.tls_sct, tls_sct, tls_sct_len) != 0) { - result = 1; + test_failed = 1; fprintf(stderr, "Failed to encode SCT into TLS format correctly\n"); goto end; } + + if (fixture.test_validity && cert != NULL) { + int is_sct_validated = SCT_validate(sct, ct_policy_ctx); + if (is_sct_validated < 0) { + test_failed = 1; + fprintf(stderr, "Error validating SCT\n"); + goto end; + } else if (!is_sct_validated) { + test_failed = 1; + fprintf(stderr, "SCT failed verification\n"); + goto end; + } + } } end: X509_free(cert); + X509_free(issuer); + SCT_LIST_free(scts); SCT_free(sct); - return result; + CT_POLICY_EVAL_CTX_free(ct_policy_ctx); + return test_failed; } #define SETUP_CT_TEST_FIXTURE() SETUP_TEST_FIXTURE(CT_TEST_FIXTURE, set_up) @@ -307,6 +413,7 @@ static int test_no_scts_in_certificate() { SETUP_CT_TEST_FIXTURE(); fixture.certificate_file_path = "certs/leaf.pem"; + fixture.issuer_file_path = "certs/subinterCA.pem"; fixture.expected_sct_count = 0; EXECUTE_CT_TEST(); } @@ -315,6 +422,7 @@ static int test_one_sct_in_certificate() { SETUP_CT_TEST_FIXTURE(); fixture.certificate_file_path = "certs/embeddedSCTs1.pem"; + fixture.issuer_file_path = "certs/embeddedSCTs1_issuer.pem"; fixture.expected_sct_count = 1; fixture.sct_text_file_path = "certs/embeddedSCTs1.sct"; EXECUTE_CT_TEST(); @@ -324,11 +432,32 @@ static int test_multiple_scts_in_certificate() { SETUP_CT_TEST_FIXTURE(); fixture.certificate_file_path = "certs/embeddedSCTs3.pem"; + fixture.issuer_file_path = "certs/embeddedSCTs3_issuer.pem"; fixture.expected_sct_count = 3; fixture.sct_text_file_path = "certs/embeddedSCTs3.sct"; EXECUTE_CT_TEST(); } +static int test_verify_one_sct() +{ + SETUP_CT_TEST_FIXTURE(); + fixture.certificate_file_path = "certs/embeddedSCTs1.pem"; + fixture.issuer_file_path = "certs/embeddedSCTs1_issuer.pem"; + fixture.expected_sct_count = 1; + fixture.test_validity = 1; + EXECUTE_CT_TEST(); +} + +static int test_verify_multiple_scts() +{ + SETUP_CT_TEST_FIXTURE(); + fixture.certificate_file_path = "certs/embeddedSCTs3.pem"; + fixture.issuer_file_path = "certs/embeddedSCTs3_issuer.pem"; + fixture.expected_sct_count = 3; + fixture.test_validity = 1; + EXECUTE_CT_TEST(); +} + static int test_decode_tls_sct() { SETUP_CT_TEST_FIXTURE(); @@ -384,6 +513,8 @@ int main(int argc, char *argv[]) ADD_TEST(test_no_scts_in_certificate); ADD_TEST(test_one_sct_in_certificate); ADD_TEST(test_multiple_scts_in_certificate); + ADD_TEST(test_verify_one_sct); + ADD_TEST(test_verify_multiple_scts); ADD_TEST(test_decode_tls_sct); ADD_TEST(test_encode_tls_sct); diff --git a/test/recipes/80-test_ct.t b/test/recipes/80-test_ct.t index 616bb17603..54c3e228c2 100644 --- a/test/recipes/80-test_ct.t +++ b/test/recipes/80-test_ct.t @@ -1,6 +1,9 @@ #! /usr/bin/perl +use OpenSSL::Test qw/:DEFAULT srctop_file/; use OpenSSL::Test::Simple; -simple_test("test_ct", "ct_test"); +setup("test_ct"); +$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); +simple_test("test_ct", "ct_test", "ct"); |