VirtualBox

source: vbox/trunk/src/libs/openssl-3.1.5/test/pkits-test.pl@ 105770

Last change on this file since 105770 was 104078, checked in by vboxsync, 8 months ago

openssl-3.1.5: Applied and adjusted our OpenSSL changes to 3.1.4. bugref:10638
File size: 31.2 KB
Line 
1#! /usr/bin/env perl
2# Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License"). You may not use
5# this file except in compliance with the License. You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9# Perl utility to run PKITS tests for RFC3280 compliance.
10
11my $ossl_path;
12
13if ( -f "../apps/openssl" ) {
14 $ossl_path = "../util/shlib_wrap.sh ../apps/openssl";
15}
16elsif ( -f "..\\out32dll\\openssl.exe" ) {
17 $ossl_path = "..\\out32dll\\openssl.exe";
18}
19elsif ( -f "..\\out32\\openssl.exe" ) {
20 $ossl_path = "..\\out32\\openssl.exe";
21}
22else {
23 die "Can't find OpenSSL executable";
24}
25
26my $pkitsdir = "pkits/smime";
27my $pkitsta = "pkits/certs/TrustAnchorRootCertificate.crt";
28
29die "Can't find PKITS test data" if !-d $pkitsdir;
30
31my $nist1 = "2.16.840.1.101.3.2.1.48.1";
32my $nist2 = "2.16.840.1.101.3.2.1.48.2";
33my $nist3 = "2.16.840.1.101.3.2.1.48.3";
34my $nist4 = "2.16.840.1.101.3.2.1.48.4";
35my $nist5 = "2.16.840.1.101.3.2.1.48.5";
36my $nist6 = "2.16.840.1.101.3.2.1.48.6";
37
38my $apolicy = "X509v3 Any Policy";
39
40# This table contains the chapter headings of the accompanying PKITS
41# document. They provide useful informational output and their names
42# can be converted into the filename to test.
43
44my @testlists = (
45 [ "4.1", "Signature Verification" ],
46 [ "4.1.1", "Valid Signatures Test1", 0 ],
47 [ "4.1.2", "Invalid CA Signature Test2", 7 ],
48 [ "4.1.3", "Invalid EE Signature Test3", 7 ],
49 [ "4.1.4", "Valid DSA Signatures Test4", 0 ],
50 [ "4.1.5", "Valid DSA Parameter Inheritance Test5", 0 ],
51 [ "4.1.6", "Invalid DSA Signature Test6", 7 ],
52 [ "4.2", "Validity Periods" ],
53 [ "4.2.1", "Invalid CA notBefore Date Test1", 9 ],
54 [ "4.2.2", "Invalid EE notBefore Date Test2", 9 ],
55 [ "4.2.3", "Valid pre2000 UTC notBefore Date Test3", 0 ],
56 [ "4.2.4", "Valid GeneralizedTime notBefore Date Test4", 0 ],
57 [ "4.2.5", "Invalid CA notAfter Date Test5", 10 ],
58 [ "4.2.6", "Invalid EE notAfter Date Test6", 10 ],
59 [ "4.2.7", "Invalid pre2000 UTC EE notAfter Date Test7", 10 ],
60 [ "4.2.8", "Valid GeneralizedTime notAfter Date Test8", 0 ],
61 [ "4.3", "Verifying Name Chaining" ],
62 [ "4.3.1", "Invalid Name Chaining EE Test1", 20 ],
63 [ "4.3.2", "Invalid Name Chaining Order Test2", 20 ],
64 [ "4.3.3", "Valid Name Chaining Whitespace Test3", 0 ],
65 [ "4.3.4", "Valid Name Chaining Whitespace Test4", 0 ],
66 [ "4.3.5", "Valid Name Chaining Capitalization Test5", 0 ],
67 [ "4.3.6", "Valid Name Chaining UIDs Test6", 0 ],
68 [ "4.3.7", "Valid RFC3280 Mandatory Attribute Types Test7", 0 ],
69 [ "4.3.8", "Valid RFC3280 Optional Attribute Types Test8", 0 ],
70 [ "4.3.9", "Valid UTF8String Encoded Names Test9", 0 ],
71 [ "4.3.10", "Valid Rollover from PrintableString to UTF8String Test10", 0 ],
72 [ "4.3.11", "Valid UTF8String Case Insensitive Match Test11", 0 ],
73 [ "4.4", "Basic Certificate Revocation Tests" ],
74 [ "4.4.1", "Missing CRL Test1", 3 ],
75 [ "4.4.2", "Invalid Revoked CA Test2", 23 ],
76 [ "4.4.3", "Invalid Revoked EE Test3", 23 ],
77 [ "4.4.4", "Invalid Bad CRL Signature Test4", 8 ],
78 [ "4.4.5", "Invalid Bad CRL Issuer Name Test5", 3 ],
79 [ "4.4.6", "Invalid Wrong CRL Test6", 3 ],
80 [ "4.4.7", "Valid Two CRLs Test7", 0 ],
81
82 # The test document suggests these should return certificate revoked...
83 # Subsequent discussion has concluded they should not due to unhandle
84 # critical CRL extensions.
85 [ "4.4.8", "Invalid Unknown CRL Entry Extension Test8", 36 ],
86 [ "4.4.9", "Invalid Unknown CRL Extension Test9", 36 ],
87
88 [ "4.4.10", "Invalid Unknown CRL Extension Test10", 36 ],
89 [ "4.4.11", "Invalid Old CRL nextUpdate Test11", 12 ],
90 [ "4.4.12", "Invalid pre2000 CRL nextUpdate Test12", 12 ],
91 [ "4.4.13", "Valid GeneralizedTime CRL nextUpdate Test13", 0 ],
92 [ "4.4.14", "Valid Negative Serial Number Test14", 0 ],
93 [ "4.4.15", "Invalid Negative Serial Number Test15", 23 ],
94 [ "4.4.16", "Valid Long Serial Number Test16", 0 ],
95 [ "4.4.17", "Valid Long Serial Number Test17", 0 ],
96 [ "4.4.18", "Invalid Long Serial Number Test18", 23 ],
97 [ "4.4.19", "Valid Separate Certificate and CRL Keys Test19", 0 ],
98 [ "4.4.20", "Invalid Separate Certificate and CRL Keys Test20", 23 ],
99
100 # CRL path is revoked so get a CRL path validation error
101 [ "4.4.21", "Invalid Separate Certificate and CRL Keys Test21", 54 ],
102 [ "4.5", "Verifying Paths with Self-Issued Certificates" ],
103 [ "4.5.1", "Valid Basic Self-Issued Old With New Test1", 0 ],
104 [ "4.5.2", "Invalid Basic Self-Issued Old With New Test2", 23 ],
105 [ "4.5.3", "Valid Basic Self-Issued New With Old Test3", 0 ],
106 [ "4.5.4", "Valid Basic Self-Issued New With Old Test4", 0 ],
107 [ "4.5.5", "Invalid Basic Self-Issued New With Old Test5", 23 ],
108 [ "4.5.6", "Valid Basic Self-Issued CRL Signing Key Test6", 0 ],
109 [ "4.5.7", "Invalid Basic Self-Issued CRL Signing Key Test7", 23 ],
110 [ "4.5.8", "Invalid Basic Self-Issued CRL Signing Key Test8", 20 ],
111 [ "4.6", "Verifying Basic Constraints" ],
112 [ "4.6.1", "Invalid Missing basicConstraints Test1", 24 ],
113 [ "4.6.2", "Invalid cA False Test2", 24 ],
114 [ "4.6.3", "Invalid cA False Test3", 24 ],
115 [ "4.6.4", "Valid basicConstraints Not Critical Test4", 0 ],
116 [ "4.6.5", "Invalid pathLenConstraint Test5", 25 ],
117 [ "4.6.6", "Invalid pathLenConstraint Test6", 25 ],
118 [ "4.6.7", "Valid pathLenConstraint Test7", 0 ],
119 [ "4.6.8", "Valid pathLenConstraint Test8", 0 ],
120 [ "4.6.9", "Invalid pathLenConstraint Test9", 25 ],
121 [ "4.6.10", "Invalid pathLenConstraint Test10", 25 ],
122 [ "4.6.11", "Invalid pathLenConstraint Test11", 25 ],
123 [ "4.6.12", "Invalid pathLenConstraint Test12", 25 ],
124 [ "4.6.13", "Valid pathLenConstraint Test13", 0 ],
125 [ "4.6.14", "Valid pathLenConstraint Test14", 0 ],
126 [ "4.6.15", "Valid Self-Issued pathLenConstraint Test15", 0 ],
127 [ "4.6.16", "Invalid Self-Issued pathLenConstraint Test16", 25 ],
128 [ "4.6.17", "Valid Self-Issued pathLenConstraint Test17", 0 ],
129 [ "4.7", "Key Usage" ],
130 [ "4.7.1", "Invalid keyUsage Critical keyCertSign False Test1", 20 ],
131 [ "4.7.2", "Invalid keyUsage Not Critical keyCertSign False Test2", 20 ],
132 [ "4.7.3", "Valid keyUsage Not Critical Test3", 0 ],
133 [ "4.7.4", "Invalid keyUsage Critical cRLSign False Test4", 35 ],
134 [ "4.7.5", "Invalid keyUsage Not Critical cRLSign False Test5", 35 ],
135
136 # Certificate policy tests need special handling. They can have several
137 # sub tests and we need to check the outputs are correct.
138
139 [ "4.8", "Certificate Policies" ],
140 [
141 "4.8.1.1",
142 "All Certificates Same Policy Test1",
143 "-policy anyPolicy -explicit_policy",
144 "True", $nist1, $nist1, 0
145 ],
146 [
147 "4.8.1.2",
148 "All Certificates Same Policy Test1",
149 "-policy $nist1 -explicit_policy",
150 "True", $nist1, $nist1, 0
151 ],
152 [
153 "4.8.1.3",
154 "All Certificates Same Policy Test1",
155 "-policy $nist2 -explicit_policy",
156 "True", $nist1, "<empty>", 43
157 ],
158 [
159 "4.8.1.4",
160 "All Certificates Same Policy Test1",
161 "-policy $nist1 -policy $nist2 -explicit_policy",
162 "True", $nist1, $nist1, 0
163 ],
164 [
165 "4.8.2.1",
166 "All Certificates No Policies Test2",
167 "-policy anyPolicy",
168 "False", "<empty>", "<empty>", 0
169 ],
170 [
171 "4.8.2.2",
172 "All Certificates No Policies Test2",
173 "-policy anyPolicy -explicit_policy",
174 "True", "<empty>", "<empty>", 43
175 ],
176 [
177 "4.8.3.1",
178 "Different Policies Test3",
179 "-policy anyPolicy",
180 "False", "<empty>", "<empty>", 0
181 ],
182 [
183 "4.8.3.2",
184 "Different Policies Test3",
185 "-policy anyPolicy -explicit_policy",
186 "True", "<empty>", "<empty>", 43
187 ],
188 [
189 "4.8.3.3",
190 "Different Policies Test3",
191 "-policy $nist1 -policy $nist2 -explicit_policy",
192 "True", "<empty>", "<empty>", 43
193 ],
194
195 [
196 "4.8.4",
197 "Different Policies Test4",
198 "-policy anyPolicy",
199 "True", "<empty>", "<empty>", 43
200 ],
201 [
202 "4.8.5",
203 "Different Policies Test5",
204 "-policy anyPolicy",
205 "True", "<empty>", "<empty>", 43
206 ],
207 [
208 "4.8.6.1",
209 "Overlapping Policies Test6",
210 "-policy anyPolicy",
211 "True", $nist1, $nist1, 0
212 ],
213 [
214 "4.8.6.2",
215 "Overlapping Policies Test6",
216 "-policy $nist1",
217 "True", $nist1, $nist1, 0
218 ],
219 [
220 "4.8.6.3",
221 "Overlapping Policies Test6",
222 "-policy $nist2",
223 "True", $nist1, "<empty>", 43
224 ],
225 [
226 "4.8.7",
227 "Different Policies Test7",
228 "-policy anyPolicy",
229 "True", "<empty>", "<empty>", 43
230 ],
231 [
232 "4.8.8",
233 "Different Policies Test8",
234 "-policy anyPolicy",
235 "True", "<empty>", "<empty>", 43
236 ],
237 [
238 "4.8.9",
239 "Different Policies Test9",
240 "-policy anyPolicy",
241 "True", "<empty>", "<empty>", 43
242 ],
243 [
244 "4.8.10.1",
245 "All Certificates Same Policies Test10",
246 "-policy $nist1",
247 "True", "$nist1:$nist2", "$nist1", 0
248 ],
249 [
250 "4.8.10.2",
251 "All Certificates Same Policies Test10",
252 "-policy $nist2",
253 "True", "$nist1:$nist2", "$nist2", 0
254 ],
255 [
256 "4.8.10.3",
257 "All Certificates Same Policies Test10",
258 "-policy anyPolicy",
259 "True", "$nist1:$nist2", "$nist1:$nist2", 0
260 ],
261 [
262 "4.8.11.1",
263 "All Certificates AnyPolicy Test11",
264 "-policy anyPolicy",
265 "True", "$apolicy", "$apolicy", 0
266 ],
267 [
268 "4.8.11.2",
269 "All Certificates AnyPolicy Test11",
270 "-policy $nist1",
271 "True", "$apolicy", "$nist1", 0
272 ],
273 [
274 "4.8.12",
275 "Different Policies Test12",
276 "-policy anyPolicy",
277 "True", "<empty>", "<empty>", 43
278 ],
279 [
280 "4.8.13.1",
281 "All Certificates Same Policies Test13",
282 "-policy $nist1",
283 "True", "$nist1:$nist2:$nist3", "$nist1", 0
284 ],
285 [
286 "4.8.13.2",
287 "All Certificates Same Policies Test13",
288 "-policy $nist2",
289 "True", "$nist1:$nist2:$nist3", "$nist2", 0
290 ],
291 [
292 "4.8.13.3",
293 "All Certificates Same Policies Test13",
294 "-policy $nist3",
295 "True", "$nist1:$nist2:$nist3", "$nist3", 0
296 ],
297 [
298 "4.8.14.1", "AnyPolicy Test14",
299 "-policy $nist1", "True",
300 "$nist1", "$nist1",
301 0
302 ],
303 [
304 "4.8.14.2", "AnyPolicy Test14",
305 "-policy $nist2", "True",
306 "$nist1", "<empty>",
307 43
308 ],
309 [
310 "4.8.15",
311 "User Notice Qualifier Test15",
312 "-policy anyPolicy",
313 "False", "$nist1", "$nist1", 0
314 ],
315 [
316 "4.8.16",
317 "User Notice Qualifier Test16",
318 "-policy anyPolicy",
319 "False", "$nist1", "$nist1", 0
320 ],
321 [
322 "4.8.17",
323 "User Notice Qualifier Test17",
324 "-policy anyPolicy",
325 "False", "$nist1", "$nist1", 0
326 ],
327 [
328 "4.8.18.1",
329 "User Notice Qualifier Test18",
330 "-policy $nist1",
331 "True", "$nist1:$nist2", "$nist1", 0
332 ],
333 [
334 "4.8.18.2",
335 "User Notice Qualifier Test18",
336 "-policy $nist2",
337 "True", "$nist1:$nist2", "$nist2", 0
338 ],
339 [
340 "4.8.19",
341 "User Notice Qualifier Test19",
342 "-policy anyPolicy",
343 "False", "$nist1", "$nist1", 0
344 ],
345 [
346 "4.8.20",
347 "CPS Pointer Qualifier Test20",
348 "-policy anyPolicy -explicit_policy",
349 "True", "$nist1", "$nist1", 0
350 ],
351 [ "4.9", "Require Explicit Policy" ],
352 [
353 "4.9.1",
354 "Valid RequireExplicitPolicy Test1",
355 "-policy anyPolicy",
356 "False", "<empty>", "<empty>", 0
357 ],
358 [
359 "4.9.2",
360 "Valid RequireExplicitPolicy Test2",
361 "-policy anyPolicy",
362 "False", "<empty>", "<empty>", 0
363 ],
364 [
365 "4.9.3",
366 "Invalid RequireExplicitPolicy Test3",
367 "-policy anyPolicy",
368 "True", "<empty>", "<empty>", 43
369 ],
370 [
371 "4.9.4",
372 "Valid RequireExplicitPolicy Test4",
373 "-policy anyPolicy",
374 "True", "$nist1", "$nist1", 0
375 ],
376 [
377 "4.9.5",
378 "Invalid RequireExplicitPolicy Test5",
379 "-policy anyPolicy",
380 "True", "<empty>", "<empty>", 43
381 ],
382 [
383 "4.9.6",
384 "Valid Self-Issued requireExplicitPolicy Test6",
385 "-policy anyPolicy",
386 "False", "<empty>", "<empty>", 0
387 ],
388 [
389 "4.9.7",
390 "Invalid Self-Issued requireExplicitPolicy Test7",
391 "-policy anyPolicy",
392 "True", "<empty>", "<empty>", 43
393 ],
394 [
395 "4.9.8",
396 "Invalid Self-Issued requireExplicitPolicy Test8",
397 "-policy anyPolicy",
398 "True", "<empty>", "<empty>", 43
399 ],
400 [ "4.10", "Policy Mappings" ],
401 [
402 "4.10.1.1",
403 "Valid Policy Mapping Test1",
404 "-policy $nist1",
405 "True", "$nist1", "$nist1", 0
406 ],
407 [
408 "4.10.1.2",
409 "Valid Policy Mapping Test1",
410 "-policy $nist2",
411 "True", "$nist1", "<empty>", 43
412 ],
413 [
414 "4.10.1.3",
415 "Valid Policy Mapping Test1",
416 "-policy anyPolicy -inhibit_map",
417 "True", "<empty>", "<empty>", 43
418 ],
419 [
420 "4.10.2.1",
421 "Invalid Policy Mapping Test2",
422 "-policy anyPolicy",
423 "True", "<empty>", "<empty>", 43
424 ],
425 [
426 "4.10.2.2",
427 "Invalid Policy Mapping Test2",
428 "-policy anyPolicy -inhibit_map",
429 "True", "<empty>", "<empty>", 43
430 ],
431 [
432 "4.10.3.1",
433 "Valid Policy Mapping Test3",
434 "-policy $nist1",
435 "True", "$nist2", "<empty>", 43
436 ],
437 [
438 "4.10.3.2",
439 "Valid Policy Mapping Test3",
440 "-policy $nist2",
441 "True", "$nist2", "$nist2", 0
442 ],
443 [
444 "4.10.4",
445 "Invalid Policy Mapping Test4",
446 "-policy anyPolicy",
447 "True", "<empty>", "<empty>", 43
448 ],
449 [
450 "4.10.5.1",
451 "Valid Policy Mapping Test5",
452 "-policy $nist1",
453 "True", "$nist1", "$nist1", 0
454 ],
455 [
456 "4.10.5.2",
457 "Valid Policy Mapping Test5",
458 "-policy $nist6",
459 "True", "$nist1", "<empty>", 43
460 ],
461 [
462 "4.10.6.1",
463 "Valid Policy Mapping Test6",
464 "-policy $nist1",
465 "True", "$nist1", "$nist1", 0
466 ],
467 [
468 "4.10.6.2",
469 "Valid Policy Mapping Test6",
470 "-policy $nist6",
471 "True", "$nist1", "<empty>", 43
472 ],
473 [ "4.10.7", "Invalid Mapping From anyPolicy Test7", 42 ],
474 [ "4.10.8", "Invalid Mapping To anyPolicy Test8", 42 ],
475 [
476 "4.10.9",
477 "Valid Policy Mapping Test9",
478 "-policy anyPolicy",
479 "True", "$nist1", "$nist1", 0
480 ],
481 [
482 "4.10.10",
483 "Invalid Policy Mapping Test10",
484 "-policy anyPolicy",
485 "True", "<empty>", "<empty>", 43
486 ],
487 [
488 "4.10.11",
489 "Valid Policy Mapping Test11",
490 "-policy anyPolicy",
491 "True", "$nist1", "$nist1", 0
492 ],
493
494 # TODO: check notice display
495 [
496 "4.10.12.1",
497 "Valid Policy Mapping Test12",
498 "-policy $nist1",
499 "True", "$nist1:$nist2", "$nist1", 0
500 ],
501
502 # TODO: check notice display
503 [
504 "4.10.12.2",
505 "Valid Policy Mapping Test12",
506 "-policy $nist2",
507 "True", "$nist1:$nist2", "$nist2", 0
508 ],
509 [
510 "4.10.13",
511 "Valid Policy Mapping Test13",
512 "-policy anyPolicy",
513 "True", "$nist1", "$nist1", 0
514 ],
515
516 # TODO: check notice display
517 [
518 "4.10.14",
519 "Valid Policy Mapping Test14",
520 "-policy anyPolicy",
521 "True", "$nist1", "$nist1", 0
522 ],
523 [ "4.11", "Inhibit Policy Mapping" ],
524 [
525 "4.11.1",
526 "Invalid inhibitPolicyMapping Test1",
527 "-policy anyPolicy",
528 "True", "<empty>", "<empty>", 43
529 ],
530 [
531 "4.11.2",
532 "Valid inhibitPolicyMapping Test2",
533 "-policy anyPolicy",
534 "True", "$nist1", "$nist1", 0
535 ],
536 [
537 "4.11.3",
538 "Invalid inhibitPolicyMapping Test3",
539 "-policy anyPolicy",
540 "True", "<empty>", "<empty>", 43
541 ],
542 [
543 "4.11.4",
544 "Valid inhibitPolicyMapping Test4",
545 "-policy anyPolicy",
546 "True", "$nist2", "$nist2", 0
547 ],
548 [
549 "4.11.5",
550 "Invalid inhibitPolicyMapping Test5",
551 "-policy anyPolicy",
552 "True", "<empty>", "<empty>", 43
553 ],
554 [
555 "4.11.6",
556 "Invalid inhibitPolicyMapping Test6",
557 "-policy anyPolicy",
558 "True", "<empty>", "<empty>", 43
559 ],
560 [
561 "4.11.7",
562 "Valid Self-Issued inhibitPolicyMapping Test7",
563 "-policy anyPolicy",
564 "True", "$nist1", "$nist1", 0
565 ],
566 [
567 "4.11.8",
568 "Invalid Self-Issued inhibitPolicyMapping Test8",
569 "-policy anyPolicy",
570 "True", "<empty>", "<empty>", 43
571 ],
572 [
573 "4.11.9",
574 "Invalid Self-Issued inhibitPolicyMapping Test9",
575 "-policy anyPolicy",
576 "True", "<empty>", "<empty>", 43
577 ],
578 [
579 "4.11.10",
580 "Invalid Self-Issued inhibitPolicyMapping Test10",
581 "-policy anyPolicy",
582 "True", "<empty>", "<empty>", 43
583 ],
584 [
585 "4.11.11",
586 "Invalid Self-Issued inhibitPolicyMapping Test11",
587 "-policy anyPolicy",
588 "True", "<empty>", "<empty>", 43
589 ],
590 [ "4.12", "Inhibit Any Policy" ],
591 [
592 "4.12.1",
593 "Invalid inhibitAnyPolicy Test1",
594 "-policy anyPolicy",
595 "True", "<empty>", "<empty>", 43
596 ],
597 [
598 "4.12.2",
599 "Valid inhibitAnyPolicy Test2",
600 "-policy anyPolicy",
601 "True", "$nist1", "$nist1", 0
602 ],
603 [
604 "4.12.3.1",
605 "inhibitAnyPolicy Test3",
606 "-policy anyPolicy",
607 "True", "$nist1", "$nist1", 0
608 ],
609 [
610 "4.12.3.2",
611 "inhibitAnyPolicy Test3",
612 "-policy anyPolicy -inhibit_any",
613 "True", "<empty>", "<empty>", 43
614 ],
615 [
616 "4.12.4",
617 "Invalid inhibitAnyPolicy Test4",
618 "-policy anyPolicy",
619 "True", "<empty>", "<empty>", 43
620 ],
621 [
622 "4.12.5",
623 "Invalid inhibitAnyPolicy Test5",
624 "-policy anyPolicy",
625 "True", "<empty>", "<empty>", 43
626 ],
627 [
628 "4.12.6",
629 "Invalid inhibitAnyPolicy Test6",
630 "-policy anyPolicy",
631 "True", "<empty>", "<empty>", 43
632 ],
633 [ "4.12.7", "Valid Self-Issued inhibitAnyPolicy Test7", 0 ],
634 [ "4.12.8", "Invalid Self-Issued inhibitAnyPolicy Test8", 43 ],
635 [ "4.12.9", "Valid Self-Issued inhibitAnyPolicy Test9", 0 ],
636 [ "4.12.10", "Invalid Self-Issued inhibitAnyPolicy Test10", 43 ],
637 [ "4.13", "Name Constraints" ],
638 [ "4.13.1", "Valid DN nameConstraints Test1", 0 ],
639 [ "4.13.2", "Invalid DN nameConstraints Test2", 47 ],
640 [ "4.13.3", "Invalid DN nameConstraints Test3", 47 ],
641 [ "4.13.4", "Valid DN nameConstraints Test4", 0 ],
642 [ "4.13.5", "Valid DN nameConstraints Test5", 0 ],
643 [ "4.13.6", "Valid DN nameConstraints Test6", 0 ],
644 [ "4.13.7", "Invalid DN nameConstraints Test7", 48 ],
645 [ "4.13.8", "Invalid DN nameConstraints Test8", 48 ],
646 [ "4.13.9", "Invalid DN nameConstraints Test9", 48 ],
647 [ "4.13.10", "Invalid DN nameConstraints Test10", 48 ],
648 [ "4.13.11", "Valid DN nameConstraints Test11", 0 ],
649 [ "4.13.12", "Invalid DN nameConstraints Test12", 47 ],
650 [ "4.13.13", "Invalid DN nameConstraints Test13", 47 ],
651 [ "4.13.14", "Valid DN nameConstraints Test14", 0 ],
652 [ "4.13.15", "Invalid DN nameConstraints Test15", 48 ],
653 [ "4.13.16", "Invalid DN nameConstraints Test16", 48 ],
654 [ "4.13.17", "Invalid DN nameConstraints Test17", 48 ],
655 [ "4.13.18", "Valid DN nameConstraints Test18", 0 ],
656 [ "4.13.19", "Valid Self-Issued DN nameConstraints Test19", 0 ],
657 [ "4.13.20", "Invalid Self-Issued DN nameConstraints Test20", 47 ],
658 [ "4.13.21", "Valid RFC822 nameConstraints Test21", 0 ],
659 [ "4.13.22", "Invalid RFC822 nameConstraints Test22", 47 ],
660 [ "4.13.23", "Valid RFC822 nameConstraints Test23", 0 ],
661 [ "4.13.24", "Invalid RFC822 nameConstraints Test24", 47 ],
662 [ "4.13.25", "Valid RFC822 nameConstraints Test25", 0 ],
663 [ "4.13.26", "Invalid RFC822 nameConstraints Test26", 48 ],
664 [ "4.13.27", "Valid DN and RFC822 nameConstraints Test27", 0 ],
665 [ "4.13.28", "Invalid DN and RFC822 nameConstraints Test28", 47 ],
666 [ "4.13.29", "Invalid DN and RFC822 nameConstraints Test29", 47 ],
667 [ "4.13.30", "Valid DNS nameConstraints Test30", 0 ],
668 [ "4.13.31", "Invalid DNS nameConstraints Test31", 47 ],
669 [ "4.13.32", "Valid DNS nameConstraints Test32", 0 ],
670 [ "4.13.33", "Invalid DNS nameConstraints Test33", 48 ],
671 [ "4.13.34", "Valid URI nameConstraints Test34", 0 ],
672 [ "4.13.35", "Invalid URI nameConstraints Test35", 47 ],
673 [ "4.13.36", "Valid URI nameConstraints Test36", 0 ],
674 [ "4.13.37", "Invalid URI nameConstraints Test37", 48 ],
675 [ "4.13.38", "Invalid DNS nameConstraints Test38", 47 ],
676 [ "4.14", "Distribution Points" ],
677 [ "4.14.1", "Valid distributionPoint Test1", 0 ],
678 [ "4.14.2", "Invalid distributionPoint Test2", 23 ],
679 [ "4.14.3", "Invalid distributionPoint Test3", 44 ],
680 [ "4.14.4", "Valid distributionPoint Test4", 0 ],
681 [ "4.14.5", "Valid distributionPoint Test5", 0 ],
682 [ "4.14.6", "Invalid distributionPoint Test6", 23 ],
683 [ "4.14.7", "Valid distributionPoint Test7", 0 ],
684 [ "4.14.8", "Invalid distributionPoint Test8", 44 ],
685 [ "4.14.9", "Invalid distributionPoint Test9", 44 ],
686 [ "4.14.10", "Valid No issuingDistributionPoint Test10", 0 ],
687 [ "4.14.11", "Invalid onlyContainsUserCerts CRL Test11", 44 ],
688 [ "4.14.12", "Invalid onlyContainsCACerts CRL Test12", 44 ],
689 [ "4.14.13", "Valid onlyContainsCACerts CRL Test13", 0 ],
690 [ "4.14.14", "Invalid onlyContainsAttributeCerts Test14", 44 ],
691 [ "4.14.15", "Invalid onlySomeReasons Test15", 23 ],
692 [ "4.14.16", "Invalid onlySomeReasons Test16", 23 ],
693 [ "4.14.17", "Invalid onlySomeReasons Test17", 3 ],
694 [ "4.14.18", "Valid onlySomeReasons Test18", 0 ],
695 [ "4.14.19", "Valid onlySomeReasons Test19", 0 ],
696 [ "4.14.20", "Invalid onlySomeReasons Test20", 23 ],
697 [ "4.14.21", "Invalid onlySomeReasons Test21", 23 ],
698 [ "4.14.22", "Valid IDP with indirectCRL Test22", 0 ],
699 [ "4.14.23", "Invalid IDP with indirectCRL Test23", 23 ],
700 [ "4.14.24", "Valid IDP with indirectCRL Test24", 0 ],
701 [ "4.14.25", "Valid IDP with indirectCRL Test25", 0 ],
702 [ "4.14.26", "Invalid IDP with indirectCRL Test26", 44 ],
703 [ "4.14.27", "Invalid cRLIssuer Test27", 3 ],
704 [ "4.14.28", "Valid cRLIssuer Test28", 0 ],
705 [ "4.14.29", "Valid cRLIssuer Test29", 0 ],
706
707 # Although this test is valid it has a circular dependency. As a result
708 # an attempt is made to recursively checks a CRL path and rejected due to
709 # a CRL path validation error. PKITS notes suggest this test does not
710 # need to be run due to this issue.
711 [ "4.14.30", "Valid cRLIssuer Test30", 54 ],
712 [ "4.14.31", "Invalid cRLIssuer Test31", 23 ],
713 [ "4.14.32", "Invalid cRLIssuer Test32", 23 ],
714 [ "4.14.33", "Valid cRLIssuer Test33", 0 ],
715 [ "4.14.34", "Invalid cRLIssuer Test34", 23 ],
716 [ "4.14.35", "Invalid cRLIssuer Test35", 44 ],
717 [ "4.15", "Delta-CRLs" ],
718 [ "4.15.1", "Invalid deltaCRLIndicator No Base Test1", 3 ],
719 [ "4.15.2", "Valid delta-CRL Test2", 0 ],
720 [ "4.15.3", "Invalid delta-CRL Test3", 23 ],
721 [ "4.15.4", "Invalid delta-CRL Test4", 23 ],
722 [ "4.15.5", "Valid delta-CRL Test5", 0 ],
723 [ "4.15.6", "Invalid delta-CRL Test6", 23 ],
724 [ "4.15.7", "Valid delta-CRL Test7", 0 ],
725 [ "4.15.8", "Valid delta-CRL Test8", 0 ],
726 [ "4.15.9", "Invalid delta-CRL Test9", 23 ],
727 [ "4.15.10", "Invalid delta-CRL Test10", 12 ],
728 [ "4.16", "Private Certificate Extensions" ],
729 [ "4.16.1", "Valid Unknown Not Critical Certificate Extension Test1", 0 ],
730 [ "4.16.2", "Invalid Unknown Critical Certificate Extension Test2", 34 ],
731);
732
733
734my $verbose = 1;
735
736my $numtest = 0;
737my $numfail = 0;
738
739my $ossl = "ossl/apps/openssl";
740
741my $ossl_cmd = "$ossl_path cms -verify -verify_retcode ";
742$ossl_cmd .= "-CAfile pkitsta.pem -crl_check_all -x509_strict ";
743
744# Check for expiry of trust anchor
745system "$ossl_path x509 -inform DER -in $pkitsta -checkend 0";
746if ($? == 256)
747 {
748 print STDERR "WARNING: using older expired data\n";
749 $ossl_cmd .= "-attime 1291940972 ";
750 }
751
752$ossl_cmd .= "-policy_check -extended_crl -use_deltas -out /dev/null 2>&1 ";
753
754system "$ossl_path x509 -inform DER -in $pkitsta -out pkitsta.pem";
755
756die "Can't create trust anchor file" if $?;
757
758print "Running PKITS tests:\n" if $verbose;
759
760foreach (@testlists) {
761 my $argnum = @$_;
762 if ( $argnum == 2 ) {
763 my ( $tnum, $title ) = @$_;
764 print "$tnum $title\n" if $verbose;
765 }
766 elsif ( $argnum == 3 ) {
767 my ( $tnum, $title, $exp_ret ) = @$_;
768 my $filename = $title;
769 $exp_ret += 32 if $exp_ret;
770 $filename =~ tr/ -//d;
771 $filename = "Signed${filename}.eml";
772 if ( !-f "$pkitsdir/$filename" ) {
773 print "\"$filename\" not found\n";
774 }
775 else {
776 my $ret;
777 my $test_fail = 0;
778 my $errmsg = "";
779 my $cmd = $ossl_cmd;
780 $cmd .= "-in $pkitsdir/$filename -policy anyPolicy";
781 my $cmdout = `$cmd`;
782 $ret = $? >> 8;
783 if ( $? & 0xff ) {
784 $errmsg .= "Abnormal OpenSSL termination\n";
785 $test_fail = 1;
786 }
787 if ( $exp_ret != $ret ) {
788 $errmsg .= "Return code:$ret, ";
789 $errmsg .= "expected $exp_ret\n";
790 $test_fail = 1;
791 }
792 if ($test_fail) {
793 print "$tnum $title : Failed!\n";
794 print "Filename: $pkitsdir/$filename\n";
795 print $errmsg;
796 print "Command output:\n$cmdout\n";
797 $numfail++;
798 }
799 $numtest++;
800 }
801 }
802 elsif ( $argnum == 7 ) {
803 my ( $tnum, $title, $exargs, $exp_epol, $exp_aset, $exp_uset, $exp_ret )
804 = @$_;
805 my $filename = $title;
806 $exp_ret += 32 if $exp_ret;
807 $filename =~ tr/ -//d;
808 $filename = "Signed${filename}.eml";
809 if ( !-f "$pkitsdir/$filename" ) {
810 print "\"$filename\" not found\n";
811 }
812 else {
813 my $ret;
814 my $cmdout = "";
815 my $errmsg = "";
816 my $epol = "";
817 my $aset = "";
818 my $uset = "";
819 my $pol = -1;
820 my $test_fail = 0;
821 my $cmd = $ossl_cmd;
822 $cmd .= "-in $pkitsdir/$filename $exargs -policy_print";
823 @oparr = `$cmd`;
824 $ret = $? >> 8;
825
826 if ( $? & 0xff ) {
827 $errmsg .= "Abnormal OpenSSL termination\n";
828 $test_fail = 1;
829 }
830 foreach (@oparr) {
831 my $test_failed = 0;
832 $cmdout .= $_;
833 if (/^Require explicit Policy: (.*)$/) {
834 $epol = $1;
835 }
836 if (/^Authority Policies/) {
837 if (/empty/) {
838 $aset = "<empty>";
839 }
840 else {
841 $pol = 1;
842 }
843 }
844 $test_fail = 1 if (/leak/i);
845 if (/^User Policies/) {
846 if (/empty/) {
847 $uset = "<empty>";
848 }
849 else {
850 $pol = 2;
851 }
852 }
853 if (/\s+Policy: (.*)$/) {
854 if ( $pol == 1 ) {
855 $aset .= ":" if $aset ne "";
856 $aset .= $1;
857 }
858 elsif ( $pol == 2 ) {
859 $uset .= ":" if $uset ne "";
860 $uset .= $1;
861 }
862 }
863 }
864
865 if ( $epol ne $exp_epol ) {
866 $errmsg .= "Explicit policy:$epol, ";
867 $errmsg .= "expected $exp_epol\n";
868 $test_fail = 1;
869 }
870 if ( $aset ne $exp_aset ) {
871 $errmsg .= "Authority policy set :$aset, ";
872 $errmsg .= "expected $exp_aset\n";
873 $test_fail = 1;
874 }
875 if ( $uset ne $exp_uset ) {
876 $errmsg .= "User policy set :$uset, ";
877 $errmsg .= "expected $exp_uset\n";
878 $test_fail = 1;
879 }
880
881 if ( $exp_ret != $ret ) {
882 print "Return code:$ret, expected $exp_ret\n";
883 $test_fail = 1;
884 }
885
886 if ($test_fail) {
887 print "$tnum $title : Failed!\n";
888 print "Filename: $pkitsdir/$filename\n";
889 print "Command output:\n$cmdout\n";
890 $numfail++;
891 }
892 $numtest++;
893 }
894 }
895}
896
897if ($numfail) {
898 print "$numfail tests failed out of $numtest\n";
899}
900else {
901 print "All Tests Successful.\n";
902}
903
904unlink "pkitsta.pem";
905
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette