diff options
author | Adam Langley <agl@google.com> | 2015-02-27 11:51:23 -0800 |
---|---|---|
committer | Adam Langley <agl@google.com> | 2015-02-27 11:52:44 -0800 |
commit | 46ba7161f20f8b1e6729384a98e1b9973ed3c908 (patch) | |
tree | 62e8aeff9fac7c19ae82c99bd2980d1ebe83a862 /src/crypto | |
parent | 4c6611d7a1dded159380928705db0a5dfbb2a3e3 (diff) | |
download | external_boringssl-46ba7161f20f8b1e6729384a98e1b9973ed3c908.zip external_boringssl-46ba7161f20f8b1e6729384a98e1b9973ed3c908.tar.gz external_boringssl-46ba7161f20f8b1e6729384a98e1b9973ed3c908.tar.bz2 |
Add functions to parse and generate PKCS#7 files with CRLs.
(This is a cherry-pick of upstream BoringSSL's
50073e8c5e81d8151718e05ec54b7c213372b878.)
Change-Id: Id29ea889055dbecfbba4fc4a9e01af0c49b8073e
Diffstat (limited to 'src/crypto')
-rw-r--r-- | src/crypto/x509/pkcs7.c | 188 | ||||
-rw-r--r-- | src/crypto/x509/pkcs7_test.c | 152 | ||||
-rw-r--r-- | src/crypto/x509/x509_error.c | 3 |
3 files changed, 321 insertions, 22 deletions
diff --git a/src/crypto/x509/pkcs7.c b/src/crypto/x509/pkcs7.c index 75c101b..9a4e490 100644 --- a/src/crypto/x509/pkcs7.c +++ b/src/crypto/x509/pkcs7.c @@ -14,6 +14,8 @@ #include <openssl/x509.h> +#include <assert.h> + #include <openssl/bytestring.h> #include <openssl/err.h> #include <openssl/obj.h> @@ -22,21 +24,26 @@ #include "../bytestring/internal.h" -int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs) { - uint8_t *der_bytes = NULL; +/* pkcs7_parse_header reads the non-certificate/non-CRL prefix of a PKCS#7 + * SignedData blob from |cbs| and sets |*out| to point to the rest of the + * input. If the input is in BER format, then |*der_bytes| will be set to a + * pointer that needs to be freed by the caller once they have finished + * processing |*out| (which will be pointing into |*der_bytes|). + * + * It returns one on success or zero on error. On error, |*der_bytes| is + * NULL. */ +static int pkcs7_parse_header(uint8_t **der_bytes, CBS *out, CBS *cbs) { size_t der_len; - CBS in, content_info, content_type, wrapped_signed_data, signed_data, - certificates; - const size_t initial_certs_len = sk_X509_num(out_certs); + CBS in, content_info, content_type, wrapped_signed_data, signed_data; uint64_t version; - int ret = 0; /* The input may be in BER format. */ - if (!CBS_asn1_ber_to_der(cbs, &der_bytes, &der_len)) { + *der_bytes = NULL; + if (!CBS_asn1_ber_to_der(cbs, der_bytes, &der_len)) { return 0; } - if (der_bytes != NULL) { - CBS_init(&in, der_bytes, der_len); + if (*der_bytes != NULL) { + CBS_init(&in, *der_bytes, der_len); } else { CBS_init(&in, CBS_data(cbs), CBS_len(cbs)); } @@ -48,7 +55,7 @@ int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs) { } if (OBJ_cbs2nid(&content_type) != NID_pkcs7_signed) { - OPENSSL_PUT_ERROR(X509, PKCS7_get_certificates, + OPENSSL_PUT_ERROR(X509, pkcs7_parse_header, X509_R_NOT_PKCS7_SIGNED_DATA); goto err; } @@ -64,11 +71,34 @@ int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs) { } if (version < 1) { - OPENSSL_PUT_ERROR(X509, PKCS7_get_certificates, + OPENSSL_PUT_ERROR(X509, pkcs7_parse_header, X509_R_BAD_PKCS7_VERSION); goto err; } + CBS_init(out, CBS_data(&signed_data), CBS_len(&signed_data)); + return 1; + +err: + if (*der_bytes) { + OPENSSL_free(*der_bytes); + *der_bytes = NULL; + } + + return 0; +} + +int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs) { + CBS signed_data, certificates; + uint8_t *der_bytes = NULL; + int ret = 0; + const size_t initial_certs_len = sk_X509_num(out_certs); + + if (!pkcs7_parse_header(&der_bytes, &signed_data, cbs)) { + return 0; + } + + /* See https://tools.ietf.org/html/rfc2315#section-9.1 */ if (!CBS_get_asn1(&signed_data, &certificates, CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0)) { OPENSSL_PUT_ERROR(X509, PKCS7_get_certificates, @@ -91,12 +121,12 @@ int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs) { goto err; } - if (inp != CBS_data(&cert) + CBS_len(&cert)) { - /* This suggests a disconnect between the two ASN.1 parsers. */ + assert(inp == CBS_data(&cert) + CBS_len(&cert)); + + if (sk_X509_push(out_certs, x509) == 0) { + X509_free(x509); goto err; } - - sk_X509_push(out_certs, x509); } ret = 1; @@ -116,10 +146,83 @@ err: return ret; } -int PKCS7_bundle_certificates(CBB *out, const STACK_OF(X509) *certs) { +int PKCS7_get_CRLs(STACK_OF(X509_CRL) *out_crls, CBS *cbs) { + CBS signed_data, crls; + uint8_t *der_bytes = NULL; + int ret = 0; + const size_t initial_crls_len = sk_X509_CRL_num(out_crls); + + if (!pkcs7_parse_header(&der_bytes, &signed_data, cbs)) { + return 0; + } + + /* See https://tools.ietf.org/html/rfc2315#section-9.1 */ + + /* Even if only CRLs are included, there may be an empty certificates block. + * OpenSSL does this, for example. */ + if (CBS_peek_asn1_tag(&signed_data, + CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0) && + !CBS_get_asn1(&signed_data, NULL /* certificates */, + CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0)) { + goto err; + } + + if (!CBS_get_asn1(&signed_data, &crls, + CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 1)) { + OPENSSL_PUT_ERROR(X509, PKCS7_get_CRLs, + X509_R_NO_CRLS_INCLUDED); + goto err; + } + + while (CBS_len(&crls) > 0) { + CBS crl_data; + X509_CRL *crl; + const uint8_t *inp; + + if (!CBS_get_asn1_element(&crls, &crl_data, CBS_ASN1_SEQUENCE)) { + goto err; + } + + inp = CBS_data(&crl_data); + crl = d2i_X509_CRL(NULL, &inp, CBS_len(&crl_data)); + if (!crl) { + goto err; + } + + assert(inp == CBS_data(&crl_data) + CBS_len(&crl_data)); + + if (sk_X509_CRL_push(out_crls, crl) == 0) { + X509_CRL_free(crl); + goto err; + } + } + + ret = 1; + +err: + if (der_bytes) { + OPENSSL_free(der_bytes); + } + + if (!ret) { + while (sk_X509_CRL_num(out_crls) != initial_crls_len) { + X509_CRL_free(sk_X509_CRL_pop(out_crls)); + } + } + + return ret; +} + +/* pkcs7_bundle writes a PKCS#7, SignedData structure to |out| and then calls + * |cb| with a CBB to which certificate or CRL data can be written, and the + * opaque context pointer, |arg|. The callback can return zero to indicate an + * error. + * + * pkcs7_bundle returns one on success or zero on error. */ +static int pkcs7_bundle(CBB *out, int (*cb)(CBB *out, const void *arg), + const void *arg) { CBB outer_seq, wrapped_seq, seq, version_bytes, digest_algos_set, - content_info, certificates; - size_t i; + content_info; /* See https://tools.ietf.org/html/rfc2315#section-7 */ if (!CBB_add_asn1(out, &outer_seq, CBS_ASN1_SEQUENCE) || @@ -133,7 +236,20 @@ int PKCS7_bundle_certificates(CBB *out, const STACK_OF(X509) *certs) { !CBB_add_asn1(&seq, &digest_algos_set, CBS_ASN1_SET) || !CBB_add_asn1(&seq, &content_info, CBS_ASN1_SEQUENCE) || !OBJ_nid2cbb(&content_info, NID_pkcs7_data) || - !CBB_add_asn1(&seq, &certificates, + !cb(&seq, arg)) { + return 0; + } + + return CBB_flush(out); +} + +static int pkcs7_bundle_certificates_cb(CBB *out, const void *arg) { + const STACK_OF(X509) *certs = arg; + size_t i; + CBB certificates; + + /* See https://tools.ietf.org/html/rfc2315#section-9.1 */ + if (!CBB_add_asn1(out, &certificates, CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0)) { return 0; } @@ -152,3 +268,37 @@ int PKCS7_bundle_certificates(CBB *out, const STACK_OF(X509) *certs) { return CBB_flush(out); } + +int PKCS7_bundle_certificates(CBB *out, const STACK_OF(X509) *certs) { + return pkcs7_bundle(out, pkcs7_bundle_certificates_cb, certs); +} + +static int pkcs7_bundle_crls_cb(CBB *out, const void *arg) { + const STACK_OF(X509_CRL) *crls = arg; + size_t i; + CBB crl_data; + + /* See https://tools.ietf.org/html/rfc2315#section-9.1 */ + if (!CBB_add_asn1(out, &crl_data, + CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 1)) { + return 0; + } + + for (i = 0; i < sk_X509_CRL_num(crls); i++) { + X509_CRL *crl = sk_X509_CRL_value(crls, i); + uint8_t *buf; + int len = i2d_X509_CRL(crl, NULL); + + if (len < 0 || + !CBB_add_space(&crl_data, &buf, len) || + i2d_X509_CRL(crl, &buf) < 0) { + return 0; + } + } + + return CBB_flush(out); +} + +int PKCS7_bundle_CRLs(CBB *out, const STACK_OF(X509_CRL) *crls) { + return pkcs7_bundle(out, pkcs7_bundle_crls_cb, crls); +} diff --git a/src/crypto/x509/pkcs7_test.c b/src/crypto/x509/pkcs7_test.c index 4283022..ff61a2b 100644 --- a/src/crypto/x509/pkcs7_test.c +++ b/src/crypto/x509/pkcs7_test.c @@ -331,7 +331,88 @@ static const uint8_t kPKCS7Windows[] = { 0xcd, 0x5a, 0x2a, 0x82, 0xb2, 0x37, 0x79, 0x31, 0x00, }; -static int test_reparse(const uint8_t *der_bytes, size_t der_len) { +/* kOpenSSLCRL is the Equifax CRL, converted to PKCS#7 form by: + * openssl crl2pkcs7 -inform DER -in secureca.crl */ +static const uint8_t kOpenSSLCRL[] = { + 0x30, 0x82, 0x03, 0x85, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, + 0x01, 0x07, 0x02, 0xa0, 0x82, 0x03, 0x76, 0x30, 0x82, 0x03, 0x72, 0x02, + 0x01, 0x01, 0x31, 0x00, 0x30, 0x0b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, + 0xf7, 0x0d, 0x01, 0x07, 0x01, 0xa0, 0x00, 0xa1, 0x82, 0x03, 0x58, 0x30, + 0x82, 0x03, 0x54, 0x30, 0x82, 0x02, 0xbd, 0x30, 0x0d, 0x06, 0x09, 0x2a, + 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x4e, + 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, + 0x53, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x07, + 0x45, 0x71, 0x75, 0x69, 0x66, 0x61, 0x78, 0x31, 0x2d, 0x30, 0x2b, 0x06, + 0x03, 0x55, 0x04, 0x0b, 0x13, 0x24, 0x45, 0x71, 0x75, 0x69, 0x66, 0x61, + 0x78, 0x20, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x43, 0x65, 0x72, + 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, + 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x32, + 0x32, 0x37, 0x30, 0x31, 0x32, 0x33, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x31, + 0x35, 0x30, 0x33, 0x30, 0x39, 0x30, 0x31, 0x32, 0x33, 0x30, 0x30, 0x5a, + 0x30, 0x82, 0x02, 0x3c, 0x30, 0x14, 0x02, 0x03, 0x0f, 0x58, 0xe4, 0x17, + 0x0d, 0x31, 0x34, 0x30, 0x34, 0x32, 0x37, 0x30, 0x38, 0x31, 0x39, 0x32, + 0x32, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x14, 0x76, 0x19, 0x17, 0x0d, 0x31, + 0x34, 0x30, 0x36, 0x31, 0x38, 0x31, 0x35, 0x30, 0x30, 0x30, 0x33, 0x5a, + 0x30, 0x14, 0x02, 0x03, 0x0f, 0x9a, 0xfb, 0x17, 0x0d, 0x31, 0x34, 0x30, + 0x34, 0x32, 0x39, 0x31, 0x38, 0x30, 0x39, 0x31, 0x37, 0x5a, 0x30, 0x14, + 0x02, 0x03, 0x14, 0x8b, 0xc0, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x37, 0x30, + 0x39, 0x31, 0x39, 0x34, 0x36, 0x33, 0x33, 0x5a, 0x30, 0x14, 0x02, 0x03, + 0x14, 0xe4, 0x9c, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x34, 0x31, 0x36, 0x32, + 0x33, 0x33, 0x39, 0x33, 0x35, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x0f, 0x86, + 0x07, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x35, 0x32, 0x31, 0x31, 0x35, 0x35, + 0x30, 0x35, 0x33, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x12, 0xe2, 0x29, 0x17, + 0x0d, 0x31, 0x34, 0x30, 0x36, 0x31, 0x37, 0x31, 0x38, 0x35, 0x35, 0x31, + 0x35, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x0d, 0x42, 0x66, 0x17, 0x0d, 0x31, + 0x32, 0x30, 0x36, 0x32, 0x37, 0x31, 0x37, 0x31, 0x30, 0x35, 0x33, 0x5a, + 0x30, 0x14, 0x02, 0x03, 0x03, 0x1e, 0x33, 0x17, 0x0d, 0x30, 0x32, 0x30, + 0x35, 0x31, 0x35, 0x31, 0x33, 0x30, 0x36, 0x31, 0x31, 0x5a, 0x30, 0x14, + 0x02, 0x03, 0x12, 0xe2, 0x23, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x36, 0x30, + 0x36, 0x32, 0x30, 0x34, 0x30, 0x32, 0x31, 0x5a, 0x30, 0x14, 0x02, 0x03, + 0x13, 0x9c, 0xab, 0x17, 0x0d, 0x31, 0x30, 0x30, 0x37, 0x32, 0x39, 0x31, + 0x36, 0x34, 0x34, 0x33, 0x39, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x12, 0xc6, + 0x0a, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x36, 0x30, 0x36, 0x32, 0x32, 0x32, + 0x31, 0x33, 0x39, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x03, 0x25, 0x85, 0x17, + 0x0d, 0x30, 0x32, 0x30, 0x35, 0x31, 0x34, 0x31, 0x38, 0x31, 0x31, 0x35, + 0x37, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x14, 0x86, 0xe6, 0x17, 0x0d, 0x31, + 0x34, 0x30, 0x37, 0x32, 0x35, 0x30, 0x32, 0x30, 0x30, 0x33, 0x38, 0x5a, + 0x30, 0x14, 0x02, 0x03, 0x13, 0x9c, 0xa1, 0x17, 0x0d, 0x31, 0x30, 0x30, + 0x37, 0x32, 0x39, 0x31, 0x36, 0x34, 0x37, 0x33, 0x32, 0x5a, 0x30, 0x14, + 0x02, 0x03, 0x15, 0x4d, 0x5c, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x34, 0x33, + 0x30, 0x30, 0x30, 0x30, 0x34, 0x34, 0x32, 0x5a, 0x30, 0x14, 0x02, 0x03, + 0x0f, 0xfa, 0x2d, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x36, 0x31, 0x37, 0x31, + 0x38, 0x35, 0x30, 0x31, 0x31, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x13, 0x75, + 0x55, 0x17, 0x0d, 0x31, 0x35, 0x30, 0x31, 0x31, 0x38, 0x30, 0x32, 0x32, + 0x31, 0x33, 0x33, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x0f, 0x56, 0x96, 0x17, + 0x0d, 0x31, 0x34, 0x30, 0x36, 0x32, 0x34, 0x31, 0x32, 0x33, 0x31, 0x30, + 0x32, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x0b, 0x80, 0x8a, 0x17, 0x0d, 0x31, + 0x32, 0x30, 0x36, 0x32, 0x37, 0x31, 0x37, 0x31, 0x30, 0x32, 0x35, 0x5a, + 0x30, 0x14, 0x02, 0x03, 0x0f, 0x94, 0x16, 0x17, 0x0d, 0x31, 0x30, 0x30, + 0x33, 0x30, 0x31, 0x31, 0x33, 0x34, 0x35, 0x33, 0x31, 0x5a, 0x30, 0x14, + 0x02, 0x03, 0x14, 0x16, 0xb3, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x36, 0x31, + 0x38, 0x31, 0x34, 0x33, 0x32, 0x35, 0x36, 0x5a, 0x30, 0x14, 0x02, 0x03, + 0x0a, 0xe1, 0x85, 0x17, 0x0d, 0x31, 0x32, 0x30, 0x36, 0x32, 0x37, 0x31, + 0x37, 0x31, 0x30, 0x31, 0x37, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x14, 0xcc, + 0x3e, 0x17, 0x0d, 0x31, 0x34, 0x30, 0x37, 0x31, 0x31, 0x31, 0x32, 0x35, + 0x35, 0x33, 0x31, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x10, 0x5b, 0xcb, 0x17, + 0x0d, 0x31, 0x30, 0x30, 0x37, 0x33, 0x30, 0x32, 0x31, 0x33, 0x31, 0x32, + 0x30, 0x5a, 0x30, 0x14, 0x02, 0x03, 0x15, 0x6a, 0x1f, 0x17, 0x0d, 0x31, + 0x34, 0x30, 0x32, 0x32, 0x36, 0x31, 0x32, 0x33, 0x35, 0x31, 0x39, 0x5a, + 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, + 0x05, 0x05, 0x00, 0x03, 0x81, 0x81, 0x00, 0x1d, 0x5c, 0x27, 0x07, 0x11, + 0x03, 0xf2, 0x00, 0xbd, 0xf4, 0x46, 0x3e, 0x71, 0xfd, 0x10, 0x84, 0x83, + 0xd9, 0xd2, 0xd2, 0x19, 0xa0, 0x20, 0xf7, 0x1a, 0x43, 0x3d, 0xac, 0xda, + 0x33, 0xfc, 0xb7, 0x42, 0x60, 0x1a, 0xa4, 0xa8, 0xb2, 0x07, 0x5c, 0x51, + 0x16, 0xc0, 0x42, 0x80, 0x0a, 0x0f, 0xf0, 0x47, 0x5b, 0x4b, 0x78, 0x90, + 0xaf, 0xc7, 0xac, 0x48, 0xf8, 0xca, 0x3c, 0x13, 0x5e, 0xf6, 0xd1, 0x88, + 0xae, 0x55, 0xa3, 0x0c, 0x8a, 0x62, 0x47, 0x29, 0xf8, 0x72, 0xb8, 0x24, + 0x17, 0xaf, 0xb2, 0x06, 0x1e, 0xa7, 0x72, 0x76, 0xab, 0x96, 0x1d, 0xe0, + 0x7c, 0xd4, 0x0c, 0x42, 0x82, 0x3d, 0x4a, 0x8e, 0x15, 0x77, 0x2f, 0x3c, + 0x2a, 0x8c, 0x3a, 0x04, 0x10, 0x55, 0xdc, 0xbb, 0xba, 0xb1, 0x91, 0xee, + 0x7b, 0xe7, 0x23, 0xc5, 0x71, 0x13, 0xae, 0x6b, 0x21, 0x35, 0xd3, 0x64, + 0xf0, 0x00, 0x54, 0x31, 0x00, +}; + +static int test_cert_reparse(const uint8_t *der_bytes, size_t der_len) { CBS pkcs7; CBB cbb; STACK_OF(X509) *certs = sk_X509_new_null(); @@ -395,11 +476,76 @@ static int test_reparse(const uint8_t *der_bytes, size_t der_len) { return 1; } +static int test_crl_reparse(const uint8_t *der_bytes, size_t der_len) { + CBS pkcs7; + CBB cbb; + STACK_OF(X509_CRL) *crls = sk_X509_CRL_new_null(); + STACK_OF(X509_CRL) *crls2 = sk_X509_CRL_new_null(); + uint8_t *result_data, *result2_data; + size_t result_len, result2_len, i; + + CBS_init(&pkcs7, der_bytes, der_len); + if (!PKCS7_get_CRLs(crls, &pkcs7)) { + fprintf(stderr, "PKCS7_get_CRLs failed.\n"); + return 0; + } + + CBB_init(&cbb, der_len); + if (!PKCS7_bundle_CRLs(&cbb, crls) || + !CBB_finish(&cbb, &result_data, &result_len)) { + fprintf(stderr, "PKCS7_bundle_CRLs failed.\n"); + return 0; + } + + CBS_init(&pkcs7, result_data, result_len); + if (!PKCS7_get_CRLs(crls2, &pkcs7)) { + fprintf(stderr, "PKCS7_get_CRLs reparse failed.\n"); + return 0; + } + + if (sk_X509_CRL_num(crls) != sk_X509_CRL_num(crls)) { + fprintf(stderr, "Number of CRLs in results differ.\n"); + return 0; + } + + for (i = 0; i < sk_X509_CRL_num(crls); i++) { + X509_CRL *a = sk_X509_CRL_value(crls, i); + X509_CRL *b = sk_X509_CRL_value(crls2, i); + + if (X509_CRL_cmp(a, b) != 0) { + fprintf(stderr, "CRL %u differs.\n", (unsigned) i); + return 0; + } + } + + CBB_init(&cbb, der_len); + if (!PKCS7_bundle_CRLs(&cbb, crls2) || + !CBB_finish(&cbb, &result2_data, &result2_len)) { + fprintf(stderr, + "PKCS7_bundle_CRLs failed the second time.\n"); + return 0; + } + + if (result_len != result2_len || + memcmp(result_data, result2_data, result_len) != 0) { + fprintf(stderr, "Serialisation is not stable.\n"); + return 0; + } + + OPENSSL_free(result_data); + OPENSSL_free(result2_data); + sk_X509_CRL_pop_free(crls, X509_CRL_free); + sk_X509_CRL_pop_free(crls2, X509_CRL_free); + + return 1; +} + int main(void) { CRYPTO_library_init(); - if (!test_reparse(kPKCS7NSS, sizeof(kPKCS7NSS)) || - !test_reparse(kPKCS7Windows, sizeof(kPKCS7Windows))) { + if (!test_cert_reparse(kPKCS7NSS, sizeof(kPKCS7NSS)) || + !test_cert_reparse(kPKCS7Windows, sizeof(kPKCS7Windows)) || + !test_crl_reparse(kOpenSSLCRL, sizeof(kOpenSSLCRL))) { return 1; } diff --git a/src/crypto/x509/x509_error.c b/src/crypto/x509/x509_error.c index 222a40a..6669a7a 100644 --- a/src/crypto/x509/x509_error.c +++ b/src/crypto/x509/x509_error.c @@ -24,6 +24,7 @@ const ERR_STRING_DATA X509_error_string_data[] = { {ERR_PACK(ERR_LIB_X509, X509_F_ASN1_sign, 0), "ASN1_sign"}, {ERR_PACK(ERR_LIB_X509, X509_F_NETSCAPE_SPKI_b64_decode, 0), "NETSCAPE_SPKI_b64_decode"}, {ERR_PACK(ERR_LIB_X509, X509_F_NETSCAPE_SPKI_b64_encode, 0), "NETSCAPE_SPKI_b64_encode"}, + {ERR_PACK(ERR_LIB_X509, X509_F_PKCS7_get_CRLs, 0), "PKCS7_get_CRLs"}, {ERR_PACK(ERR_LIB_X509, X509_F_PKCS7_get_certificates, 0), "PKCS7_get_certificates"}, {ERR_PACK(ERR_LIB_X509, X509_F_X509_ATTRIBUTE_create_by_NID, 0), "X509_ATTRIBUTE_create_by_NID"}, {ERR_PACK(ERR_LIB_X509, X509_F_X509_ATTRIBUTE_create_by_OBJ, 0), "X509_ATTRIBUTE_create_by_OBJ"}, @@ -80,6 +81,7 @@ const ERR_STRING_DATA X509_error_string_data[] = { {ERR_PACK(ERR_LIB_X509, X509_F_i2d_PrivateKey, 0), "i2d_PrivateKey"}, {ERR_PACK(ERR_LIB_X509, X509_F_i2d_RSA_PUBKEY, 0), "i2d_RSA_PUBKEY"}, {ERR_PACK(ERR_LIB_X509, X509_F_parse_tagging, 0), "parse_tagging"}, + {ERR_PACK(ERR_LIB_X509, X509_F_pkcs7_parse_header, 0), "pkcs7_parse_header"}, {ERR_PACK(ERR_LIB_X509, X509_F_x509_name_encode, 0), "x509_name_encode"}, {ERR_PACK(ERR_LIB_X509, X509_F_x509_name_ex_d2i, 0), "x509_name_ex_d2i"}, {ERR_PACK(ERR_LIB_X509, X509_F_x509_name_ex_new, 0), "x509_name_ex_new"}, @@ -108,6 +110,7 @@ const ERR_STRING_DATA X509_error_string_data[] = { {ERR_PACK(ERR_LIB_X509, 0, X509_R_NOT_PKCS7_SIGNED_DATA), "NOT_PKCS7_SIGNED_DATA"}, {ERR_PACK(ERR_LIB_X509, 0, X509_R_NO_CERTIFICATES_INCLUDED), "NO_CERTIFICATES_INCLUDED"}, {ERR_PACK(ERR_LIB_X509, 0, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY), "NO_CERT_SET_FOR_US_TO_VERIFY"}, + {ERR_PACK(ERR_LIB_X509, 0, X509_R_NO_CRLS_INCLUDED), "NO_CRLS_INCLUDED"}, {ERR_PACK(ERR_LIB_X509, 0, X509_R_NO_CRL_NUMBER), "NO_CRL_NUMBER"}, {ERR_PACK(ERR_LIB_X509, 0, X509_R_PUBLIC_KEY_DECODE_ERROR), "PUBLIC_KEY_DECODE_ERROR"}, {ERR_PACK(ERR_LIB_X509, 0, X509_R_PUBLIC_KEY_ENCODE_ERROR), "PUBLIC_KEY_ENCODE_ERROR"}, |