1 /* 2 * Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright Nokia 2007-2019 4 * Copyright Siemens AG 2015-2019 5 * 6 * Licensed under the Apache License 2.0 (the "License"). You may not use 7 * this file except in compliance with the License. You can obtain a copy 8 * in the file LICENSE in the source distribution or at 9 * https://www.openssl.org/source/license.html 10 */ 11 12 #include "helpers/cmp_testlib.h" 13 14 #include "cmp_mock_srv.h" 15 16 #ifndef NDEBUG /* tests need mock server, which is available only if !NDEBUG */ 17 18 static const char *server_key_f; 19 static const char *server_cert_f; 20 static const char *client_key_f; 21 static const char *client_cert_f; 22 static const char *pkcs10_f; 23 24 typedef struct test_fixture { 25 const char *test_case_name; 26 OSSL_CMP_CTX *cmp_ctx; 27 OSSL_CMP_SRV_CTX *srv_ctx; 28 int req_type; 29 int expected; 30 STACK_OF(X509) *caPubs; 31 } CMP_SES_TEST_FIXTURE; 32 33 static OSSL_LIB_CTX *libctx = NULL; 34 static OSSL_PROVIDER *default_null_provider = NULL, *provider = NULL; 35 36 static EVP_PKEY *server_key = NULL; 37 static X509 *server_cert = NULL; 38 static EVP_PKEY *client_key = NULL; 39 static X509 *client_cert = NULL; 40 static unsigned char ref[CMP_TEST_REFVALUE_LENGTH]; 41 42 /* 43 * For these unit tests, the client abandons message protection, and for 44 * error messages the mock server does so as well. 45 * Message protection and verification is tested in cmp_lib_test.c 46 */ 47 48 static void tear_down(CMP_SES_TEST_FIXTURE *fixture) 49 { 50 OSSL_CMP_CTX_free(fixture->cmp_ctx); 51 ossl_cmp_mock_srv_free(fixture->srv_ctx); 52 sk_X509_free(fixture->caPubs); 53 OPENSSL_free(fixture); 54 } 55 56 static CMP_SES_TEST_FIXTURE *set_up(const char *const test_case_name) 57 { 58 CMP_SES_TEST_FIXTURE *fixture; 59 OSSL_CMP_CTX *srv_cmp_ctx = NULL; 60 OSSL_CMP_CTX *ctx = NULL; /* for client */ 61 62 if (!TEST_ptr(fixture = OPENSSL_zalloc(sizeof(*fixture)))) 63 return NULL; 64 fixture->test_case_name = test_case_name; 65 if (!TEST_ptr(fixture->srv_ctx = ossl_cmp_mock_srv_new(libctx, NULL)) 66 || !OSSL_CMP_SRV_CTX_set_accept_unprotected(fixture->srv_ctx, 1) 67 || !ossl_cmp_mock_srv_set1_certOut(fixture->srv_ctx, client_cert) 68 || (srv_cmp_ctx = 69 OSSL_CMP_SRV_CTX_get0_cmp_ctx(fixture->srv_ctx)) == NULL 70 || !OSSL_CMP_CTX_set1_cert(srv_cmp_ctx, server_cert) 71 || !OSSL_CMP_CTX_set1_pkey(srv_cmp_ctx, server_key)) 72 goto err; 73 if (!TEST_ptr(fixture->cmp_ctx = ctx = OSSL_CMP_CTX_new(libctx, NULL)) 74 || !OSSL_CMP_CTX_set_log_cb(fixture->cmp_ctx, print_to_bio_out) 75 || !OSSL_CMP_CTX_set_transfer_cb(ctx, OSSL_CMP_CTX_server_perform) 76 || !OSSL_CMP_CTX_set_transfer_cb_arg(ctx, fixture->srv_ctx) 77 || !OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_SEND, 1) 78 || !OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS, 1) 79 || !OSSL_CMP_CTX_set1_oldCert(ctx, client_cert) 80 || !OSSL_CMP_CTX_set1_pkey(ctx, client_key) 81 || !OSSL_CMP_CTX_set1_srvCert(ctx, server_cert) 82 || !OSSL_CMP_CTX_set1_referenceValue(ctx, ref, sizeof(ref))) 83 goto err; 84 fixture->req_type = -1; 85 return fixture; 86 87 err: 88 tear_down(fixture); 89 return NULL; 90 } 91 92 static int execute_exec_RR_ses_test(CMP_SES_TEST_FIXTURE *fixt) 93 { 94 return TEST_int_eq(OSSL_CMP_CTX_get_status(fixt->cmp_ctx), 95 OSSL_CMP_PKISTATUS_unspecified) 96 && TEST_int_eq(OSSL_CMP_exec_RR_ses(fixt->cmp_ctx), 97 fixt->expected == OSSL_CMP_PKISTATUS_accepted) 98 && TEST_int_eq(OSSL_CMP_CTX_get_status(fixt->cmp_ctx), fixt->expected); 99 } 100 101 static int execute_exec_GENM_ses_test_single(CMP_SES_TEST_FIXTURE *fixture) 102 { 103 OSSL_CMP_CTX *ctx = fixture->cmp_ctx; 104 ASN1_OBJECT *type = OBJ_txt2obj("1.3.6.1.5.5.7.4.2", 1); 105 OSSL_CMP_ITAV *itav = OSSL_CMP_ITAV_create(type, NULL); 106 STACK_OF(OSSL_CMP_ITAV) *itavs; 107 108 OSSL_CMP_CTX_push0_genm_ITAV(ctx, itav); 109 itavs = OSSL_CMP_exec_GENM_ses(ctx); 110 111 sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free); 112 return TEST_int_eq(OSSL_CMP_CTX_get_status(ctx), fixture->expected) 113 && fixture->expected == OSSL_CMP_PKISTATUS_accepted ? 114 TEST_ptr(itavs) : TEST_ptr_null(itavs); 115 } 116 117 static int execute_exec_GENM_ses_test(CMP_SES_TEST_FIXTURE *fixture) 118 { 119 return execute_exec_GENM_ses_test_single(fixture) 120 && OSSL_CMP_CTX_reinit(fixture->cmp_ctx) 121 && execute_exec_GENM_ses_test_single(fixture); 122 } 123 124 static int execute_exec_certrequest_ses_test(CMP_SES_TEST_FIXTURE *fixture) 125 { 126 OSSL_CMP_CTX *ctx = fixture->cmp_ctx; 127 X509 *res = OSSL_CMP_exec_certreq(ctx, fixture->req_type, NULL); 128 int status = OSSL_CMP_CTX_get_status(ctx); 129 130 if (!TEST_int_eq(status, fixture->expected) 131 && !(fixture->expected == OSSL_CMP_PKISTATUS_waiting 132 && TEST_int_eq(status, OSSL_CMP_PKISTATUS_trans))) 133 return 0; 134 if (fixture->expected != OSSL_CMP_PKISTATUS_accepted) 135 return TEST_ptr_null(res); 136 137 if (!TEST_ptr(res) || !TEST_int_eq(X509_cmp(res, client_cert), 0)) 138 return 0; 139 if (fixture->caPubs != NULL) { 140 STACK_OF(X509) *caPubs = OSSL_CMP_CTX_get1_caPubs(fixture->cmp_ctx); 141 int ret = TEST_int_eq(STACK_OF_X509_cmp(fixture->caPubs, caPubs), 0); 142 143 sk_X509_pop_free(caPubs, X509_free); 144 return ret; 145 } 146 return 1; 147 } 148 149 static int test_exec_RR_ses(int request_error) 150 { 151 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 152 if (request_error) 153 OSSL_CMP_CTX_set1_oldCert(fixture->cmp_ctx, NULL); 154 fixture->expected = request_error ? OSSL_CMP_PKISTATUS_request 155 : OSSL_CMP_PKISTATUS_accepted; 156 EXECUTE_TEST(execute_exec_RR_ses_test, tear_down); 157 return result; 158 } 159 160 static int test_exec_RR_ses_ok(void) 161 { 162 return test_exec_RR_ses(0); 163 } 164 165 static int test_exec_RR_ses_request_error(void) 166 { 167 return test_exec_RR_ses(1); 168 } 169 170 static int test_exec_RR_ses_receive_error(void) 171 { 172 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 173 ossl_cmp_mock_srv_set_statusInfo(fixture->srv_ctx, 174 OSSL_CMP_PKISTATUS_rejection, 175 OSSL_CMP_CTX_FAILINFO_signerNotTrusted, 176 "test string"); 177 ossl_cmp_mock_srv_set_send_error(fixture->srv_ctx, 1); 178 fixture->expected = OSSL_CMP_PKISTATUS_rejection; 179 EXECUTE_TEST(execute_exec_RR_ses_test, tear_down); 180 return result; 181 } 182 183 static int test_exec_IR_ses(void) 184 { 185 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 186 fixture->req_type = OSSL_CMP_IR; 187 fixture->expected = OSSL_CMP_PKISTATUS_accepted; 188 fixture->caPubs = sk_X509_new_null(); 189 sk_X509_push(fixture->caPubs, server_cert); 190 sk_X509_push(fixture->caPubs, server_cert); 191 ossl_cmp_mock_srv_set1_caPubsOut(fixture->srv_ctx, fixture->caPubs); 192 EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down); 193 return result; 194 } 195 196 static int test_exec_IR_ses_poll(int check_after, int poll_count, 197 int total_timeout, int expect) 198 { 199 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 200 fixture->req_type = OSSL_CMP_IR; 201 fixture->expected = expect; 202 ossl_cmp_mock_srv_set_checkAfterTime(fixture->srv_ctx, check_after); 203 ossl_cmp_mock_srv_set_pollCount(fixture->srv_ctx, poll_count); 204 OSSL_CMP_CTX_set_option(fixture->cmp_ctx, 205 OSSL_CMP_OPT_TOTAL_TIMEOUT, total_timeout); 206 EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down); 207 return result; 208 } 209 210 static int checkAfter = 1; 211 static int test_exec_IR_ses_poll_ok(void) 212 { 213 return test_exec_IR_ses_poll(checkAfter, 2, 0, OSSL_CMP_PKISTATUS_accepted); 214 } 215 216 static int test_exec_IR_ses_poll_no_timeout(void) 217 { 218 return test_exec_IR_ses_poll(checkAfter, 1 /* pollCount */, checkAfter + 1, 219 OSSL_CMP_PKISTATUS_accepted); 220 } 221 222 static int test_exec_IR_ses_poll_total_timeout(void) 223 { 224 return test_exec_IR_ses_poll(checkAfter + 1, 2 /* pollCount */, checkAfter, 225 OSSL_CMP_PKISTATUS_waiting); 226 } 227 228 static int test_exec_CR_ses(int implicit_confirm, int granted) 229 { 230 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 231 fixture->req_type = OSSL_CMP_CR; 232 fixture->expected = OSSL_CMP_PKISTATUS_accepted; 233 OSSL_CMP_CTX_set_option(fixture->cmp_ctx, 234 OSSL_CMP_OPT_IMPLICIT_CONFIRM, implicit_confirm); 235 OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(fixture->srv_ctx, granted); 236 EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down); 237 return result; 238 } 239 240 static int test_exec_CR_ses_explicit_confirm(void) 241 { 242 return test_exec_CR_ses(0, 0); 243 } 244 245 static int test_exec_CR_ses_implicit_confirm(void) 246 { 247 return test_exec_CR_ses(1, 0) 248 && test_exec_CR_ses(1, 1); 249 } 250 251 static int test_exec_KUR_ses(int transfer_error) 252 { 253 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 254 fixture->req_type = OSSL_CMP_KUR; 255 if (transfer_error) 256 OSSL_CMP_CTX_set_transfer_cb_arg(fixture->cmp_ctx, NULL); 257 fixture->expected = transfer_error ? OSSL_CMP_PKISTATUS_trans 258 : OSSL_CMP_PKISTATUS_accepted; 259 EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down); 260 return result; 261 } 262 263 static int test_exec_KUR_ses_ok(void) 264 { 265 return test_exec_KUR_ses(0); 266 } 267 268 static int test_exec_KUR_ses_transfer_error(void) 269 { 270 return test_exec_KUR_ses(1); 271 } 272 273 static int test_exec_P10CR_ses(void) 274 { 275 X509_REQ *req = NULL; 276 277 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 278 fixture->req_type = OSSL_CMP_P10CR; 279 fixture->expected = OSSL_CMP_PKISTATUS_accepted; 280 if (!TEST_ptr(req = load_csr_der(pkcs10_f, libctx)) 281 || !TEST_true(OSSL_CMP_CTX_set1_p10CSR(fixture->cmp_ctx, req))) { 282 tear_down(fixture); 283 fixture = NULL; 284 } 285 X509_REQ_free(req); 286 EXECUTE_TEST(execute_exec_certrequest_ses_test, tear_down); 287 return result; 288 } 289 290 static int execute_try_certreq_poll_test(CMP_SES_TEST_FIXTURE *fixture) 291 { 292 OSSL_CMP_CTX *ctx = fixture->cmp_ctx; 293 int check_after; 294 const int CHECK_AFTER = 5; 295 const int TYPE = OSSL_CMP_KUR; 296 297 ossl_cmp_mock_srv_set_pollCount(fixture->srv_ctx, 3); 298 ossl_cmp_mock_srv_set_checkAfterTime(fixture->srv_ctx, CHECK_AFTER); 299 return TEST_int_eq(-1, OSSL_CMP_try_certreq(ctx, TYPE, NULL, &check_after)) 300 && check_after == CHECK_AFTER 301 && TEST_ptr_eq(OSSL_CMP_CTX_get0_newCert(ctx), NULL) 302 && TEST_int_eq(-1, OSSL_CMP_try_certreq(ctx, TYPE, NULL, &check_after)) 303 && check_after == CHECK_AFTER 304 && TEST_ptr_eq(OSSL_CMP_CTX_get0_newCert(ctx), NULL) 305 && TEST_int_eq(fixture->expected, 306 OSSL_CMP_try_certreq(ctx, TYPE, NULL, NULL)) 307 && TEST_int_eq(0, 308 X509_cmp(OSSL_CMP_CTX_get0_newCert(ctx), client_cert)); 309 } 310 311 static int test_try_certreq_poll(void) 312 { 313 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 314 fixture->expected = 1; 315 EXECUTE_TEST(execute_try_certreq_poll_test, tear_down); 316 return result; 317 } 318 319 static int execute_try_certreq_poll_abort_test(CMP_SES_TEST_FIXTURE *fixture) 320 { 321 OSSL_CMP_CTX *ctx = fixture->cmp_ctx; 322 int check_after; 323 const int CHECK_AFTER = INT_MAX; 324 const int TYPE = OSSL_CMP_CR; 325 326 ossl_cmp_mock_srv_set_pollCount(fixture->srv_ctx, 3); 327 ossl_cmp_mock_srv_set_checkAfterTime(fixture->srv_ctx, CHECK_AFTER); 328 return TEST_int_eq(-1, OSSL_CMP_try_certreq(ctx, TYPE, NULL, &check_after)) 329 && check_after == CHECK_AFTER 330 && TEST_ptr_eq(OSSL_CMP_CTX_get0_newCert(ctx), NULL) 331 && TEST_int_eq(fixture->expected, 332 OSSL_CMP_try_certreq(ctx, -1, NULL, NULL)) 333 && TEST_ptr_eq(OSSL_CMP_CTX_get0_newCert(fixture->cmp_ctx), NULL); 334 } 335 336 static int test_try_certreq_poll_abort(void) 337 { 338 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 339 fixture->expected = 1; 340 EXECUTE_TEST(execute_try_certreq_poll_abort_test, tear_down); 341 return result; 342 } 343 344 static int test_exec_GENM_ses(int transfer_error, int total_timeout, int expect) 345 { 346 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 347 if (transfer_error) 348 OSSL_CMP_CTX_set_transfer_cb_arg(fixture->cmp_ctx, NULL); 349 /* 350 * cannot use OSSL_CMP_CTX_set_option(... OSSL_CMP_OPT_TOTAL_TIMEOUT) 351 * here because this will correct total_timeout to be >= 0 352 */ 353 fixture->cmp_ctx->total_timeout = total_timeout; 354 fixture->expected = expect; 355 EXECUTE_TEST(execute_exec_GENM_ses_test, tear_down); 356 return result; 357 } 358 359 static int test_exec_GENM_ses_ok(void) 360 { 361 return test_exec_GENM_ses(0, 0, OSSL_CMP_PKISTATUS_accepted); 362 } 363 364 static int test_exec_GENM_ses_transfer_error(void) 365 { 366 return test_exec_GENM_ses(1, 0, OSSL_CMP_PKISTATUS_trans); 367 } 368 369 static int test_exec_GENM_ses_total_timeout(void) 370 { 371 return test_exec_GENM_ses(0, -1, OSSL_CMP_PKISTATUS_trans); 372 } 373 374 static int execute_exchange_certConf_test(CMP_SES_TEST_FIXTURE *fixture) 375 { 376 int res = 377 ossl_cmp_exchange_certConf(fixture->cmp_ctx, 378 OSSL_CMP_PKIFAILUREINFO_addInfoNotAvailable, 379 "abcdefg"); 380 return TEST_int_eq(fixture->expected, res); 381 } 382 383 static int execute_exchange_error_test(CMP_SES_TEST_FIXTURE *fixture) 384 { 385 int res = 386 ossl_cmp_exchange_error(fixture->cmp_ctx, 387 OSSL_CMP_PKISTATUS_rejection, 388 1 << OSSL_CMP_PKIFAILUREINFO_unsupportedVersion, 389 "foo_status", 999, "foo_details"); 390 391 return TEST_int_eq(fixture->expected, res); 392 } 393 394 static int test_exchange_certConf(void) 395 { 396 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 397 fixture->expected = 0; /* client should not send certConf immediately */ 398 if (!ossl_cmp_ctx_set0_newCert(fixture->cmp_ctx, X509_dup(client_cert))) { 399 tear_down(fixture); 400 fixture = NULL; 401 } 402 EXECUTE_TEST(execute_exchange_certConf_test, tear_down); 403 return result; 404 } 405 406 static int test_exchange_error(void) 407 { 408 SETUP_TEST_FIXTURE(CMP_SES_TEST_FIXTURE, set_up); 409 fixture->expected = 1; /* client may send error any time */ 410 EXECUTE_TEST(execute_exchange_error_test, tear_down); 411 return result; 412 } 413 414 void cleanup_tests(void) 415 { 416 X509_free(server_cert); 417 EVP_PKEY_free(server_key); 418 X509_free(client_cert); 419 EVP_PKEY_free(client_key); 420 OSSL_LIB_CTX_free(libctx); 421 return; 422 } 423 424 # define USAGE "server.key server.crt client.key client.crt client.csr module_name [module_conf_file]\n" 425 OPT_TEST_DECLARE_USAGE(USAGE) 426 427 int setup_tests(void) 428 { 429 if (!test_skip_common_options()) { 430 TEST_error("Error parsing test options\n"); 431 return 0; 432 } 433 434 if (!TEST_ptr(server_key_f = test_get_argument(0)) 435 || !TEST_ptr(server_cert_f = test_get_argument(1)) 436 || !TEST_ptr(client_key_f = test_get_argument(2)) 437 || !TEST_ptr(client_cert_f = test_get_argument(3)) 438 || !TEST_ptr(pkcs10_f = test_get_argument(4))) { 439 TEST_error("usage: cmp_client_test %s", USAGE); 440 return 0; 441 } 442 443 if (!test_arg_libctx(&libctx, &default_null_provider, &provider, 5, USAGE)) 444 return 0; 445 446 if (!TEST_ptr(server_key = load_pkey_pem(server_key_f, libctx)) 447 || !TEST_ptr(server_cert = load_cert_pem(server_cert_f, libctx)) 448 || !TEST_ptr(client_key = load_pkey_pem(client_key_f, libctx)) 449 || !TEST_ptr(client_cert = load_cert_pem(client_cert_f, libctx)) 450 || !TEST_int_eq(1, RAND_bytes_ex(libctx, ref, sizeof(ref), 0))) { 451 cleanup_tests(); 452 return 0; 453 } 454 455 ADD_TEST(test_exec_RR_ses_ok); 456 ADD_TEST(test_exec_RR_ses_request_error); 457 ADD_TEST(test_exec_RR_ses_receive_error); 458 ADD_TEST(test_exec_CR_ses_explicit_confirm); 459 ADD_TEST(test_exec_CR_ses_implicit_confirm); 460 ADD_TEST(test_exec_IR_ses); 461 ADD_TEST(test_exec_IR_ses_poll_ok); 462 ADD_TEST(test_exec_IR_ses_poll_no_timeout); 463 ADD_TEST(test_exec_IR_ses_poll_total_timeout); 464 ADD_TEST(test_exec_KUR_ses_ok); 465 ADD_TEST(test_exec_KUR_ses_transfer_error); 466 ADD_TEST(test_exec_P10CR_ses); 467 ADD_TEST(test_try_certreq_poll); 468 ADD_TEST(test_try_certreq_poll_abort); 469 ADD_TEST(test_exec_GENM_ses_ok); 470 ADD_TEST(test_exec_GENM_ses_transfer_error); 471 ADD_TEST(test_exec_GENM_ses_total_timeout); 472 ADD_TEST(test_exchange_certConf); 473 ADD_TEST(test_exchange_error); 474 return 1; 475 } 476 477 #else /* !defined (NDEBUG) */ 478 479 int setup_tests(void) 480 { 481 TEST_note("CMP session tests are disabled in this build (NDEBUG)."); 482 return 1; 483 } 484 485 #endif 486