Skip to content

Prevent unverified CRL from replacing a verified one in AddCRL() #11477

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
padelsbach wants to merge 1 commit into
base: master
Choose a base branch
from
+280 −0
Open

Prevent unverified CRL from replacing a verified one in AddCRL() #11477

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/crl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -848,6 +848,12 @@ static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl, CRL_Entry* crle,

for (curr = crl->crlList; curr != NULL; curr = curr->next) {
if (XMEMCMP(curr->issuerHash, crle->issuerHash, CRL_DIGEST_SIZE) == 0) {
if ((curr->verified > 0) && (crle->verified == 0)) {
WOLFSSL_MSG("Unverified CRL cannot replace a verified entry");
wc_UnLockRwLock(&crl->crlLock);
return DUPE_ENTRY_E;
}

ret = CompareCRLnumber(crle, curr);
/* Error out if the CRL we're attempting to add isn't more
* authoritative than the existing entry */
Expand Down
272 changes: 272 additions & 0 deletions tests/api/test_certman.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@
#include <tests/api/api.h>
#include <tests/api/test_certman.h>
#include <tests/utils.h>
#include <testsuite/utils.h>

int test_wolfSSL_CertManagerAPI(void)
{
Expand Down Expand Up @@ -2950,6 +2951,277 @@ int test_wolfSSL_CRL_critical_idp(void)
return EXPECT_RESULT();
}

/* A CRL read from a distribution point, or from anywhere else that does not
* check its signature, is stored unverified. Such an entry must not be able
* to push out the CRL whose signature the certificate manager has already
* checked. */
int test_wolfSSL_CRL_unverified_no_evict(void)
{
EXPECT_DECLS;
#if defined(HAVE_CRL) && !defined(NO_CERTS) && !defined(NO_RSA) && \
!defined(NO_SHA256) && defined(OPENSSL_EXTRA) && \
defined(WOLFSSL_PEM_TO_DER) && !defined(NO_FILESYSTEM) && \
!defined(NO_WOLFSSL_DIR) && !defined(NO_TLS) && \
!defined(NO_WOLFSSL_CLIENT)
/* Trusted CA "crl-test-ca-a", self-signed, keyCertSign + cRLSign. */
static const unsigned char caCertA[] = {
0x30, 0x82, 0x03, 0x21, 0x30, 0x82, 0x02, 0x09, 0xa0, 0x03, 0x02,
0x01, 0x02, 0x02, 0x14, 0x7e, 0xad, 0x8c, 0x50, 0xec, 0xd2, 0x0e,
0xe3, 0xcf, 0x15, 0x6f, 0x48, 0x89, 0x19, 0xba, 0xe5, 0x46, 0x13,
0xec, 0xc6, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x18, 0x31, 0x16, 0x30,
0x14, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0d, 0x63, 0x72, 0x6c,
0x2d, 0x74, 0x65, 0x73, 0x74, 0x2d, 0x63, 0x61, 0x2d, 0x61, 0x30,
0x1e, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30,
0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x34, 0x36, 0x30, 0x31,
0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x18,
0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0d,
0x63, 0x72, 0x6c, 0x2d, 0x74, 0x65, 0x73, 0x74, 0x2d, 0x63, 0x61,
0x2d, 0x61, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a,
0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03,
0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01,
0x01, 0x00, 0xc0, 0x6b, 0x66, 0x66, 0x08, 0x4a, 0x0a, 0xec, 0x0c,
0x04, 0xcb, 0x7b, 0x7b, 0x81, 0xef, 0xdb, 0x0c, 0xab, 0x23, 0x24,
0xa6, 0xdb, 0x72, 0xb2, 0xad, 0xa9, 0x59, 0x0e, 0x40, 0x87, 0x6e,
0x9a, 0x0f, 0xa3, 0xf6, 0x3d, 0x56, 0x7a, 0x30, 0x3a, 0x01, 0xe3,
0x95, 0x3f, 0x36, 0x83, 0x0d, 0xb7, 0x35, 0xde, 0xcf, 0xcb, 0x34,
0x5b, 0x3d, 0x69, 0xbc, 0xde, 0x56, 0x0c, 0x2e, 0x76, 0x18, 0xc0,
0xee, 0xfb, 0x74, 0x2d, 0x4b, 0xd7, 0x7d, 0x6b, 0xd7, 0x14, 0x02,
0xda, 0xe6, 0x73, 0x65, 0x6f, 0xfb, 0x4a, 0x3a, 0xa1, 0x76, 0xb5,
0x22, 0xcf, 0x44, 0x4c, 0x51, 0x70, 0x9e, 0x3c, 0x43, 0xcb, 0xaf,
0xb5, 0x7a, 0x0f, 0xa2, 0x29, 0x5f, 0xaf, 0x56, 0x9c, 0x5b, 0xa3,
0x80, 0x27, 0x7d, 0x31, 0x68, 0x13, 0x5b, 0x80, 0x4a, 0x67, 0x87,
0xd6, 0xa3, 0x3f, 0x3d, 0x58, 0x58, 0x1c, 0x90, 0xa2, 0xa3, 0x8b,
0x80, 0xf9, 0xdc, 0x63, 0x98, 0x69, 0x1f, 0x5b, 0xb3, 0xb5, 0x05,
0x69, 0xe0, 0x0e, 0x7d, 0xbc, 0xb4, 0x40, 0x57, 0xb2, 0x4f, 0x5f,
0x1d, 0x2d, 0x46, 0xc1, 0x95, 0xd7, 0x5d, 0x21, 0xd9, 0x35, 0xa7,
0xed, 0xa7, 0x07, 0x54, 0x7d, 0xf7, 0x8f, 0x56, 0x0d, 0x59, 0x09,
0xc1, 0x25, 0x43, 0xa8, 0x49, 0x49, 0xa8, 0x54, 0x71, 0xe6, 0xb0,
0x46, 0x9e, 0x20, 0x77, 0x37, 0x8d, 0x2d, 0x5d, 0x0a, 0x9d, 0x39,
0x82, 0x47, 0x68, 0x17, 0x7a, 0x87, 0xd9, 0x57, 0xb4, 0xa1, 0x2b,
0xbd, 0xb7, 0x3b, 0xa8, 0x32, 0x73, 0xa1, 0x6b, 0xc4, 0xbe, 0x6e,
0xee, 0xc3, 0xc0, 0xde, 0x2c, 0x09, 0xd0, 0x40, 0xff, 0x0b, 0x87,
0xd8, 0x9e, 0x9d, 0x72, 0xc9, 0x3a, 0x91, 0x1d, 0x3c, 0xcc, 0x31,
0x8b, 0x50, 0x5c, 0x10, 0xbf, 0xa1, 0x97, 0xc0, 0x65, 0x9c, 0xae,
0xd0, 0xd9, 0x20, 0x2b, 0xc3, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3,
0x63, 0x30, 0x61, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04,
0x18, 0x30, 0x16, 0x80, 0x14, 0x16, 0x20, 0x5d, 0x43, 0x64, 0x9c,
0xed, 0xc6, 0x95, 0x92, 0xa4, 0xc6, 0x28, 0xdc, 0x1a, 0x06, 0x7f,
0x01, 0x84, 0x0e, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
0x01, 0xff, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x0e,
0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03,
0x02, 0x01, 0x06, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04,
0x16, 0x04, 0x14, 0x16, 0x20, 0x5d, 0x43, 0x64, 0x9c, 0xed, 0xc6,
0x95, 0x92, 0xa4, 0xc6, 0x28, 0xdc, 0x1a, 0x06, 0x7f, 0x01, 0x84,
0x0e, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0xb9,
0xed, 0xac, 0x74, 0x75, 0x54, 0xf8, 0x51, 0xca, 0xdb, 0x48, 0xfd,
0x68, 0xff, 0x97, 0x6e, 0x49, 0x6e, 0x4c, 0xd0, 0x7a, 0xaa, 0x7a,
0xb2, 0x6c, 0x5a, 0x5c, 0xf9, 0x2b, 0x41, 0xfc, 0xcf, 0x30, 0xe5,
0xc5, 0x81, 0x6e, 0x27, 0xd7, 0x37, 0x59, 0xc1, 0x89, 0x10, 0x12,
0x4f, 0x48, 0x8f, 0x2b, 0xf6, 0xf6, 0x39, 0x00, 0x7e, 0x9e, 0x8e,
0x10, 0xcf, 0xff, 0x79, 0x63, 0x4d, 0x94, 0x81, 0x25, 0xff, 0x88,
0x42, 0x30, 0x3b, 0xfd, 0x9d, 0x98, 0x7e, 0x06, 0x75, 0xb3, 0x28,
0x36, 0xc2, 0xda, 0x4e, 0xbc, 0xb6, 0x63, 0xf4, 0x69, 0x12, 0x80,
0x75, 0xc3, 0x36, 0xfe, 0xcd, 0xa1, 0x4b, 0xfb, 0x37, 0xa5, 0xf8,
0xdb, 0x4f, 0x53, 0xdd, 0xeb, 0x31, 0x08, 0xaf, 0xc5, 0x3b, 0x4f,
0x11, 0x9e, 0x0c, 0xd4, 0xe9, 0xd6, 0xb9, 0x9b, 0xac, 0x29, 0x0e,
0xa9, 0x9e, 0xd4, 0x2d, 0xfe, 0x5b, 0x68, 0x7a, 0x23, 0x5e, 0x83,
0x72, 0x7f, 0xdc, 0x5e, 0xc5, 0x08, 0x2d, 0x61, 0x07, 0xf5, 0xa8,
0x08, 0x1d, 0x92, 0x15, 0x6f, 0x15, 0xb7, 0xce, 0xf2, 0x57, 0x68,
0xcd, 0x04, 0x35, 0x30, 0x69, 0x85, 0x48, 0x84, 0x48, 0x44, 0x6e,
0xb8, 0x3e, 0x3c, 0xd3, 0xa5, 0x05, 0x0d, 0x45, 0x1a, 0xd7, 0xac,
0xcc, 0xb1, 0x02, 0x21, 0xe3, 0x00, 0x1f, 0x7f, 0xc8, 0x1f, 0x60,
0xee, 0x95, 0xb3, 0xd8, 0x7e, 0x3c, 0x82, 0x98, 0xa5, 0xae, 0x86,
0x49, 0x55, 0x09, 0xbd, 0xa1, 0xc3, 0x98, 0xd1, 0xb2, 0x8b, 0xc1,
0xb3, 0xba, 0xcb, 0x41, 0x4d, 0xb1, 0xe7, 0x94, 0x0e, 0xbc, 0x22,
0xe3, 0x36, 0x21, 0x6b, 0xe3, 0x08, 0xdc, 0x82, 0x62, 0x4d, 0x4c,
0xd5, 0xbc, 0xfe, 0x95, 0x37, 0xd2, 0x97, 0x5d, 0xe6, 0xc4, 0x6f,
0xc6, 0xd3, 0x39, 0x8d, 0xec, 0xb1, 0xf1, 0x7d, 0x96, 0xed, 0x7c,
0x8d, 0xea
};

/* Leaf issued by CA A, serial 0x2a, not revoked below. */
static const unsigned char leafCertA[] = {
0x30, 0x82, 0x03, 0x0b, 0x30, 0x82, 0x01, 0xf3, 0xa0, 0x03, 0x02,
0x01, 0x02, 0x02, 0x01, 0x2a, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x18,
0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0d,
0x63, 0x72, 0x6c, 0x2d, 0x74, 0x65, 0x73, 0x74, 0x2d, 0x63, 0x61,
0x2d, 0x61, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x31, 0x30,
0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x34,
0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30,
0x5a, 0x30, 0x18, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04,
0x03, 0x0c, 0x0d, 0x63, 0x72, 0x6c, 0x2d, 0x74, 0x65, 0x73, 0x74,
0x2d, 0x6c, 0x65, 0x61, 0x66, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d,
0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a,
0x02, 0x82, 0x01, 0x01, 0x00, 0xd5, 0xb1, 0x3f, 0x7e, 0xe3, 0xc9,
0x6a, 0xe5, 0xed, 0xc2, 0x24, 0xdd, 0x3f, 0x31, 0x19, 0xd4, 0xc7,
0xea, 0xad, 0x58, 0x5f, 0xd6, 0x51, 0xec, 0x27, 0x28, 0x8a, 0xee,
0x54, 0x03, 0x2c, 0x58, 0x36, 0x2e, 0xc7, 0x06, 0x17, 0x66, 0xf2,
0x80, 0x3a, 0x6c, 0x9e, 0x1b, 0xf8, 0x40, 0x9d, 0x21, 0x61, 0xf4,
0x44, 0x16, 0x29, 0xc5, 0x5d, 0x0e, 0xf8, 0x67, 0x41, 0x12, 0x29,
0x8c, 0x9f, 0x7f, 0x85, 0x24, 0x51, 0x90, 0x7e, 0x9a, 0xc7, 0x4c,
0x45, 0x6c, 0x8c, 0x0c, 0xbe, 0x3f, 0xdb, 0x3d, 0xd6, 0x4d, 0x24,
0x74, 0xd4, 0x90, 0xb5, 0xfe, 0xcf, 0x24, 0xdf, 0xfa, 0xf5, 0x2e,
0x1e, 0xbe, 0x48, 0xe3, 0xe6, 0xc2, 0x22, 0x59, 0xe9, 0x18, 0x72,
0xd1, 0xe5, 0x0a, 0xce, 0xcb, 0xa7, 0x3c, 0xde, 0x1a, 0xc7, 0xdd,
0x95, 0xcf, 0x97, 0xf6, 0xe0, 0x37, 0xbc, 0x24, 0xf0, 0xdf, 0x1b,
0x3f, 0x21, 0x49, 0xc6, 0x7c, 0x1a, 0x68, 0x58, 0x82, 0x5c, 0xe2,
0xc6, 0x2d, 0x9e, 0x3c, 0x44, 0x19, 0x24, 0x90, 0x96, 0xa5, 0x01,
0x7e, 0xc3, 0xac, 0x70, 0x8b, 0x8f, 0x71, 0xe2, 0x73, 0x1c, 0x46,
0xa6, 0x50, 0x93, 0x4a, 0xa2, 0x6d, 0x41, 0xab, 0x83, 0xb0, 0x91,
0x7a, 0x38, 0x78, 0x8d, 0x51, 0x8c, 0xd0, 0x3e, 0xb6, 0xa6, 0xaf,
0x02, 0x10, 0xfb, 0x1f, 0x6e, 0x50, 0x60, 0x75, 0xef, 0x84, 0xc8,
0x6d, 0x69, 0xa2, 0x38, 0x61, 0xc8, 0xb6, 0x2f, 0xc6, 0x55, 0x1b,
0x19, 0x86, 0xd3, 0x44, 0xbb, 0x55, 0x76, 0xfb, 0xac, 0x5f, 0x34,
0x2b, 0x2d, 0x84, 0x22, 0x6c, 0x6d, 0x5f, 0x57, 0xcc, 0x4f, 0x67,
0x12, 0x09, 0x44, 0xaf, 0xe4, 0x26, 0x5d, 0xb1, 0x14, 0xdb, 0xbc,
0xa9, 0xbb, 0x4b, 0xcf, 0x65, 0xe4, 0xc0, 0x1f, 0x1d, 0xc4, 0xfe,
0xe8, 0xe0, 0xa3, 0x4a, 0x3e, 0xd0, 0xe2, 0xe7, 0x02, 0x03, 0x01,
0x00, 0x01, 0xa3, 0x60, 0x30, 0x5e, 0x30, 0x0c, 0x06, 0x03, 0x55,
0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x0e,
0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03,
0x02, 0x07, 0x80, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04,
0x16, 0x04, 0x14, 0x85, 0x8d, 0x21, 0x83, 0xd0, 0xf2, 0x31, 0x12,
0x35, 0x96, 0x85, 0xcf, 0x0e, 0xa3, 0xf8, 0x25, 0xfa, 0x52, 0x35,
0xa1, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
0x16, 0x80, 0x14, 0x16, 0x20, 0x5d, 0x43, 0x64, 0x9c, 0xed, 0xc6,
0x95, 0x92, 0xa4, 0xc6, 0x28, 0xdc, 0x1a, 0x06, 0x7f, 0x01, 0x84,
0x0e, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x29,
0xbf, 0x18, 0xcd, 0xc7, 0xef, 0x17, 0x13, 0xf0, 0x87, 0x9c, 0x50,
0xbc, 0x60, 0x54, 0x2e, 0xdb, 0x42, 0xd3, 0xc5, 0x2c, 0x3a, 0xb1,
0x4f, 0xd9, 0xc0, 0x23, 0x69, 0xab, 0x06, 0xda, 0x2b, 0x0c, 0x55,
0xc7, 0x78, 0x0c, 0xae, 0x34, 0xb9, 0x82, 0x17, 0x0c, 0x13, 0x8a,
0x87, 0xde, 0x82, 0x7e, 0x3a, 0x6a, 0x60, 0x38, 0xd7, 0xc4, 0x2c,
0x96, 0x2c, 0x64, 0xfe, 0x72, 0x9c, 0x91, 0x85, 0x1d, 0x7f, 0xd5,
0xb5, 0xa8, 0x53, 0xc1, 0x75, 0x99, 0x2d, 0xae, 0x7c, 0xa7, 0xb6,
0x1a, 0x7e, 0x74, 0x46, 0xff, 0x77, 0xcc, 0xec, 0x12, 0x3d, 0x9a,
0x6f, 0x7d, 0x6e, 0x6d, 0x9b, 0x0f, 0x27, 0x96, 0x25, 0x31, 0x9d,
0xc4, 0x92, 0x03, 0x13, 0x04, 0xd7, 0x4f, 0xb1, 0x24, 0x31, 0x13,
0x42, 0x58, 0x95, 0xef, 0x01, 0x65, 0x7c, 0x57, 0x90, 0x71, 0xf6,
0xc8, 0x7b, 0x74, 0xdd, 0x4d, 0x42, 0x0d, 0x99, 0x5c, 0x09, 0x55,
0x2a, 0xbf, 0x24, 0xbe, 0x9b, 0x74, 0xd8, 0x7c, 0x37, 0xc1, 0xd0,
0x0f, 0xc0, 0x2a, 0x4d, 0x93, 0x5b, 0x3d, 0x1e, 0x9d, 0xd9, 0x2f,
0x2d, 0x6a, 0xeb, 0x43, 0x2c, 0x75, 0xc7, 0xbd, 0xd0, 0xf7, 0xe4,
0x0d, 0xc1, 0xe0, 0xea, 0x93, 0x81, 0x54, 0xf2, 0xe1, 0xd6, 0x70,
0x0c, 0x16, 0xf1, 0x75, 0x92, 0xdf, 0xd5, 0x63, 0x0f, 0x0f, 0x04,
0x07, 0x14, 0xbb, 0x3e, 0xbb, 0x21, 0xa5, 0xbb, 0xb1, 0xe5, 0x8d,
0xe2, 0xcc, 0x66, 0xd1, 0x52, 0xb0, 0xbc, 0x77, 0x04, 0x21, 0x9e,
0x19, 0xda, 0xb9, 0x94, 0x27, 0x35, 0x88, 0xb5, 0x0d, 0x52, 0x46,
0x0b, 0x17, 0xf1, 0x06, 0x3c, 0xb3, 0xd3, 0xd9, 0x28, 0x97, 0x04,
0x14, 0xba, 0x12, 0x28, 0xd4, 0x66, 0x36, 0x76, 0x9e, 0x77, 0x90,
0x19, 0xc0, 0x8b, 0x57, 0x83, 0x00, 0xf5, 0xb7, 0xb6, 0xc5, 0x2d,
0x83, 0x59
};

/* CRL number 1 from CA A, revoking nothing, correctly signed. */
static const unsigned char crlGood[] = {
0x30, 0x82, 0x01, 0x91, 0x30, 0x7b, 0x02, 0x01, 0x01, 0x30, 0x0d,
0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
0x05, 0x00, 0x30, 0x18, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55,
0x04, 0x03, 0x0c, 0x0d, 0x63, 0x72, 0x6c, 0x2d, 0x74, 0x65, 0x73,
0x74, 0x2d, 0x63, 0x61, 0x2d, 0x61, 0x17, 0x0d, 0x32, 0x36, 0x30,
0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17,
0x0d, 0x34, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30,
0x30, 0x30, 0x5a, 0xa0, 0x2f, 0x30, 0x2d, 0x30, 0x1f, 0x06, 0x03,
0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x16, 0x20,
0x5d, 0x43, 0x64, 0x9c, 0xed, 0xc6, 0x95, 0x92, 0xa4, 0xc6, 0x28,
0xdc, 0x1a, 0x06, 0x7f, 0x01, 0x84, 0x0e, 0x30, 0x0a, 0x06, 0x03,
0x55, 0x1d, 0x14, 0x04, 0x03, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06,
0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05,
0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x92, 0x93, 0x4b, 0x3a, 0x31,
0x0b, 0x72, 0x28, 0x6c, 0x25, 0xb3, 0x36, 0xc4, 0x69, 0xcb, 0x9f,
0xee, 0x3c, 0x2a, 0x31, 0xd0, 0xed, 0x1f, 0xed, 0xb8, 0x77, 0x0e,
0x57, 0x78, 0xde, 0x75, 0xb9, 0xb8, 0x87, 0x7e, 0x8e, 0x75, 0xd6,
0xd7, 0xe2, 0x7a, 0xc2, 0x5b, 0x5f, 0x69, 0x1d, 0x74, 0x42, 0xcd,
0x35, 0x72, 0x08, 0xef, 0xd8, 0x25, 0x1d, 0x11, 0x70, 0x41, 0xa8,
0xfe, 0xaf, 0xcc, 0xbf, 0x98, 0xfe, 0x4c, 0xed, 0xf8, 0xe1, 0x6e,
0x70, 0x50, 0x48, 0x15, 0x82, 0x04, 0xda, 0x14, 0x63, 0xd4, 0x16,
0x83, 0x1b, 0xb0, 0xb7, 0x62, 0x53, 0x3c, 0xca, 0xda, 0xab, 0x73,
0x03, 0x0c, 0x7e, 0xd2, 0x34, 0xd3, 0x1e, 0x0e, 0x7a, 0xc8, 0xa9,
0x40, 0xa2, 0xd3, 0x1d, 0x1a, 0x6e, 0x8a, 0x65, 0xe8, 0x16, 0x14,
0x72, 0x4e, 0xfc, 0xd3, 0x31, 0xa4, 0xe9, 0x0c, 0x4d, 0x27, 0x7e,
0xb1, 0xde, 0x31, 0xcb, 0x87, 0xf3, 0xd8, 0xa0, 0x78, 0x50, 0x5f,
0x91, 0xac, 0x09, 0x35, 0x6b, 0xe0, 0xf7, 0x22, 0xde, 0xba, 0x52,
0x84, 0x16, 0xc4, 0xbe, 0x2d, 0xb4, 0x09, 0x94, 0x86, 0x55, 0x8c,
0x36, 0xf4, 0xbe, 0xc9, 0x99, 0x0a, 0x5e, 0x34, 0xae, 0xd3, 0x78,
0x1c, 0x2a, 0xc9, 0xcb, 0xd5, 0x8e, 0x79, 0x88, 0x7c, 0xc0, 0xfe,
0xd4, 0x95, 0xb9, 0xcc, 0xe2, 0x4a, 0x63, 0x8f, 0x21, 0x09, 0xa6,
0xd5, 0xa2, 0xcd, 0xe9, 0x7f, 0x1e, 0xa9, 0xa4, 0xeb, 0xfd, 0x33,
0x95, 0x36, 0x24, 0x51, 0x4d, 0xc2, 0x31, 0x11, 0x8e, 0x15, 0x6a,
0x27, 0x8c, 0xf9, 0x8a, 0x61, 0xfb, 0xf9, 0x95, 0xaf, 0x1e, 0x8f,
0xa2, 0x2d, 0xa9, 0xae, 0x7b, 0x6c, 0xc0, 0xe1, 0x90, 0xd7, 0xdf,
0x9f, 0x39, 0xd7, 0x07, 0x33, 0xa0, 0xd4, 0x7a, 0xc0, 0xa5, 0x8f,
0x8f, 0x6d, 0x9e, 0x72, 0xc4, 0xea, 0x4d, 0xba, 0x3f
};

/* CRL number 2, also naming CA A as issuer, with an AKID no CA
* in the store matches and a corrupted signature. */
static const char crlBogusPem[] =
"-----BEGIN X509 CRL-----\n"
"MIIBqDCBkQIBATANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1jcmwtdGVzdC1j\n"
"YS1hFw0yNjAxMDEwMDAwMDBaFw00NjAxMDEwMDAwMDBaMBQwEgIBKhcNMjYwMTAx\n"
"MDAwMDAwWqAvMC0wHwYDVR0jBBgwFoAUq6urq6urq6urq6urq6urq6urq6swCgYD\n"
"VR0UBAMCAQIwDQYJKoZIhvcNAQELBQADggEBAJtS0Cryy1LKrfHLgv3Cpf4r7kh1\n"
"Oj+1TGmrDq+C//nzuzbJqXFdkqZ1dH/+s5I57rsMMFdy8t2+1nMvT8RFn6cu3rP7\n"
"9EehFJugBURpAevcwnrEl4Ts1XhFoLVSe6Cbx8BXzuSixEx1CPgLNg5Ab6E68+so\n"
"GfSKQuTWCTHjLZiUj3VUMRBv4OruqBFZ2bC1CZ2MAgsQPEXA4teGHvsrangAdoA1\n"
"a7ghS2jBOgihsn+XyzYgK1b9ITYlSh7Ys0SDkGn3MJDhYB91wFsgr3yF5MgR3s88\n"
"0LuVjJtXPDC2px+otou+4DlmT+SibAjz5TbHgxba/bZZD/2N4Rtfnv1Np3s=\n"
"-----END X509 CRL-----\n";
const int bogusSz = (int)sizeof(crlBogusPem) - 1;
char tmpDir[16];
char bogusFile[64];
WOLFSSL_CTX* ctx = NULL;
WOLFSSL_CERT_MANAGER* cm = NULL;
WOLFSSL_X509_STORE* store = NULL;
XFILE f = XBADFILE;

XMEMSET(tmpDir, 0, sizeof(tmpDir));
XMEMSET(bogusFile, 0, sizeof(bogusFile));

/* Own directory per run, so unit.test runs sharing a working directory
* do not write over each other's fixture. */
ExpectNotNull(create_tmp_dir(tmpDir, (int)sizeof(tmpDir) - 1));
ExpectIntGT(XSNPRINTF(bogusFile, sizeof(bogusFile), "%s/crl.pem", tmpDir),
0);

ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));
ExpectNotNull(cm = wolfSSL_CTX_GetCertManager(ctx));
ExpectNotNull(store = wolfSSL_CTX_get_cert_store(ctx));
ExpectIntEQ(wolfSSL_CertManagerLoadCABuffer(cm, caCertA, sizeof(caCertA),
WOLFSSL_FILETYPE_ASN1), WOLFSSL_SUCCESS);

/* The CA is in place, so this entry is verified as it is loaded. */
ExpectIntEQ(wolfSSL_CertManagerLoadCRLBuffer(cm, crlGood, sizeof(crlGood),
WOLFSSL_FILETYPE_ASN1), WOLFSSL_SUCCESS);
ExpectIntEQ(wolfSSL_CertManagerCheckCRL(cm, leafCertA,
(int)sizeof(leafCertA)), WOLFSSL_SUCCESS);

ExpectTrue((f = XFOPEN(bogusFile, "wb")) != XBADFILE);
ExpectIntEQ((int)XFWRITE(crlBogusPem, 1, (size_t)bogusSz, f), bogusSz);
if (f != XBADFILE)
XFCLOSE(f);

/* Reading a store location does not check signatures, so the newer CRL
* number alone must not be enough to take the entry's place. */
ExpectIntNE(wolfSSL_X509_STORE_load_locations(store, bogusFile, NULL),
WOLFSSL_SUCCESS);
ExpectIntEQ(wolfSSL_CertManagerCheckCRL(cm, leafCertA,
(int)sizeof(leafCertA)), WOLFSSL_SUCCESS);

if (bogusFile[0] != '\0')
(void)rem_file(bogusFile);
if (tmpDir[0] != '\0')
(void)rem_dir(tmpDir);
wolfSSL_CTX_free(ctx);
#endif
return EXPECT_RESULT();
}

int test_wolfSSL_cert_critical_policy_constraints(void)
{
EXPECT_DECLS;
Expand Down
2 changes: 2 additions & 0 deletions tests/api/test_certman.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ int test_wolfSSL_CRL_unknown_ext_cb_rescues_critical_entry_ext(void);
int test_wolfSSL_CRL_unknown_ext_cb_rescues_critical_crl_ext(void);
int test_wolfSSL_CRL_unknown_ext_cb_positive_return_fails_load(void);
int test_wolfSSL_CRL_unknown_ext_cb_noctx(void);
int test_wolfSSL_CRL_unverified_no_evict(void);
int test_wolfSSL_cert_critical_policy_constraints(void);
int test_wolfSSL_CertManagerCheckOCSPResponse(void);
int test_various_pathlen_chains(void);
Expand Down Expand Up @@ -97,6 +98,7 @@ int test_wolfSSL_CertManagerNameConstraint_skid_disambiguates(void);
test_wolfSSL_CRL_unknown_ext_cb_positive_return_fails_load), \
TEST_DECL_GROUP("certman", \
test_wolfSSL_CRL_unknown_ext_cb_noctx), \
TEST_DECL_GROUP("certman", test_wolfSSL_CRL_unverified_no_evict), \
TEST_DECL_GROUP("certman", test_wolfSSL_cert_critical_policy_constraints), \
TEST_DECL_GROUP("certman", test_wolfSSL_CertManagerCheckOCSPResponse), \
TEST_DECL_GROUP("certman", test_various_pathlen_chains), \
Expand Down
Loading