From c8a04447aacf77470e9fc576f769bd58b7ce4408 Mon Sep 17 00:00:00 2001 From: Jou Ho <43765840+jouho@users.noreply.github.com> Date: Mon, 17 Jun 2024 11:51:59 -0700 Subject: [PATCH] Fix: update default cert chain for unit tests (#4582) --- tests/pems/ocsp/OCSP-TEST.md | 17 ++++++++++++++ tests/pems/ocsp/ocsp_response_revoked.der | Bin 2249 -> 2249 bytes tests/testlib/s2n_testlib.h | 10 +++++---- .../unit/s2n_cert_validation_callback_test.c | 6 ++--- tests/unit/s2n_config_test.c | 2 +- tests/unit/s2n_crl_test.c | 4 ++-- tests/unit/s2n_mem_usage_test.c | 2 +- tests/unit/s2n_x509_validator_test.c | 21 +++++------------- ...2n_x509_validator_time_verification_test.c | 4 ++-- 9 files changed, 37 insertions(+), 29 deletions(-) diff --git a/tests/pems/ocsp/OCSP-TEST.md b/tests/pems/ocsp/OCSP-TEST.md index f26a300152d..0dddd53c6a5 100644 --- a/tests/pems/ocsp/OCSP-TEST.md +++ b/tests/pems/ocsp/OCSP-TEST.md @@ -79,6 +79,23 @@ openssl ocsp -CAfile ca_cert.pem \ -cert server_cert.pem -respout ocsp_response_no_next_update.der ``` +### Generating ocsp_response_revoked.der +``` +# Run responder +openssl ocsp -port 8889 -text -CA ca_cert.pem \ + -index certs_revoked.txt \ + -rkey ocsp_key.pem \ + -rsigner ocsp_cert.pem \ + -nrequest 1 -ndays $(( 365 * 100 )) + +# Run requester +openssl ocsp -CAfile ca_cert.pem \ + -url http://127.0.0.1:8889 \ + -issuer ca_cert.pem \ + -cert server_cert.pem \ + -respout ocsp_response_revoked.der +``` + ### Index Files The index files in the previous commands are in the CA Database format, and are the source of truth for certificates being verified or rejected. diff --git a/tests/pems/ocsp/ocsp_response_revoked.der b/tests/pems/ocsp/ocsp_response_revoked.der index 6a9adcd2420d702701504185f0a26b1bb51597f1..d721d02ccc7fe4a3ae42438b751e3db4e5e59f2c 100644 GIT binary patch delta 631 zcmV--0*L*|5y=sdiVHL_HZd|XGc`3ZFp-s7e>5;QF)}hUH8n6WTA&da4>B<_G%z(W zIWjXfH83z*p(8LMFdqg9D+U1t1qUzz0t6BS5Px8fLMQUYn=-AEx}WIvs4xu%2`Yw2 zhW8Bt0Sg5H1A+np0E`R8+yH76`0$1K&?)wezsh;zPP%{oYtF3Fu4s*(8Vz3Rj@SDU zf39`(|I#d%nMU`PCu|PZ#LoLFX$X{5@ zZrFSRP<^Y~jbN?*eH`cEz*&JkR<%g0f0O9nbY63HwoG$UuYQ{RZ|Mpur5YI2)YNez zaP-oKa6N9U7!-`Yn1OjCcf>=UD}>(LTp9O4R<551sjiAt(Ji9u37jr*W3W4g2a4TIwfrz!26j`6pqjvEHrP^b7)JKyFe~T3E z4eIGo6CWvuOT%3TO@g_Me`75JWWbo#?9K(Sv%Z2hhk;C!KquE7?2MEouDBe{-wC(| zjb|X|BSfVE3|3i*5p7xzW0gkMuZrh-nct3Y_?1~_9{h|QfC8~neV%mOPK-zqyB}w7 zHZn3YF)}hTHIbECe=smMGBPqTGBPqXTA&da4>B+~FfcYS zH!?9YGBPzwN2ER$4PZ`qad&b`Bq`BWGto$lm%03stto- ze`T&y*((T!1D-(~8)t0o7!MT+bR?NF=BR0uj{=FRPaZrS@F4{|xq^T-??Qhmf5%_A zBH~2W<_wwhh%x^vxJzxS(sHDpo&M$hmABrzdCAb*Tsrurx+&O?^4wMK)i0|;hr}Lz z3fLjs@8BnjrFud)d2~5*kwhTD?B3Eof6TSV7?}Gk%c=pn*3gPfi_Mu$;ywziXw3c! zHkVO!HS`!nvBg2dsbeqFM6HUsK6U+GSzLEMJRR(4d5;Ip0o2^Y&+d?F9-y;2o}m$7 zruIAWQxk}GsKK&7x;eYjil6%LscrR9fUPVuZN3ex@V);loVo1oQ5jK@ zq%FL3yJ23FR*pa$ONFlzfPZ=-S(7ac&ZU?UMpI5Lc|A>^L85`a{3QTTpECLACkl~; z*GSmd*L%DGI}(4iHqo3{Ir@c?T!j|@SP*zesJsIt`4>m@wIhjlU{1iG^^@49tWS(Lm6J$config->wall_clock; @@ -546,7 +539,6 @@ int main(int argc, char **argv) uint8_t *chain_data = s2n_stuffer_raw_read(&cert_chain_stuffer, chain_len); EXPECT_NOT_NULL(chain_data); - /* The default cert chain includes a SHA1 signature, so the security policy must allow SHA1 cert signatures. */ EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(connection, "default")); s2n_clock_time_nanoseconds old_clock = connection->config->wall_clock; @@ -585,11 +577,12 @@ int main(int argc, char **argv) uint8_t *chain_data = s2n_stuffer_raw_read(&cert_chain_stuffer, chain_len); EXPECT_NOT_NULL(chain_data); - /* The default cert chain includes a SHA1 signature, so the security policy must allow SHA1 cert signatures. */ EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(connection, "default")); /* alter a random byte in the certificate to make it invalid */ - chain_data[500] = (uint8_t) (chain_data[500] << 2); + size_t corrupt_index = 200; + EXPECT_TRUE(chain_len > corrupt_index); + chain_data[corrupt_index] = (uint8_t) (chain_data[corrupt_index] << 2); struct s2n_pkey public_key_out; EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out)); s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN; @@ -629,7 +622,6 @@ int main(int argc, char **argv) uint8_t *chain_data = s2n_stuffer_raw_read(&cert_chain_stuffer, chain_len); EXPECT_NOT_NULL(chain_data); - /* The default cert chain includes a SHA1 signature, so the security policy must allow SHA1 cert signatures. */ EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(connection, "default")); struct s2n_pkey public_key_out; @@ -677,7 +669,6 @@ int main(int argc, char **argv) uint8_t *chain_data = s2n_stuffer_raw_read(&cert_chain_stuffer, chain_len); EXPECT_NOT_NULL(chain_data); - /* The default cert chain includes a SHA1 signature, so the security policy must allow SHA1 cert signatures. */ EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(connection, "default")); struct s2n_pkey public_key_out; @@ -717,7 +708,6 @@ int main(int argc, char **argv) uint8_t *chain_data = s2n_stuffer_raw_read(&cert_chain_stuffer, chain_len); EXPECT_NOT_NULL(chain_data); - /* The default cert chain includes a SHA1 signature, so the security policy must allow SHA1 cert signatures. */ EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(connection, "default")); struct s2n_pkey public_key_out; @@ -765,7 +755,6 @@ int main(int argc, char **argv) uint8_t *chain_data = s2n_stuffer_raw_read(&cert_chain_stuffer, chain_len); EXPECT_NOT_NULL(chain_data); - /* The default cert chain includes a SHA1 signature, so the security policy must allow SHA1 cert signatures. */ EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(connection, "default")); struct s2n_pkey public_key_out; diff --git a/tests/unit/s2n_x509_validator_time_verification_test.c b/tests/unit/s2n_x509_validator_time_verification_test.c index 3abefac35a2..e5bf7317447 100644 --- a/tests/unit/s2n_x509_validator_time_verification_test.c +++ b/tests/unit/s2n_x509_validator_time_verification_test.c @@ -214,7 +214,7 @@ int main(int argc, char *argv[]) DEFER_CLEANUP(struct s2n_connection *client_conn = s2n_connection_new(S2N_CLIENT), s2n_connection_ptr_free); EXPECT_NOT_NULL(client_conn); EXPECT_SUCCESS(s2n_connection_set_config(client_conn, client_config)); - EXPECT_SUCCESS(s2n_set_server_name(client_conn, "s2nTestServer")); + EXPECT_SUCCESS(s2n_set_server_name(client_conn, "localhost")); DEFER_CLEANUP(struct s2n_test_io_pair io_pair = { 0 }, s2n_io_pair_close); EXPECT_SUCCESS(s2n_io_pair_init_non_blocking(&io_pair)); @@ -256,7 +256,7 @@ int main(int argc, char *argv[]) DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_CLIENT), s2n_connection_ptr_free); EXPECT_NOT_NULL(conn); EXPECT_SUCCESS(s2n_connection_set_config(conn, config)); - EXPECT_SUCCESS(s2n_set_server_name(conn, "s2nTestServer")); + EXPECT_SUCCESS(s2n_set_server_name(conn, "localhost")); DEFER_CLEANUP(struct s2n_stuffer cert_chain_stuffer = { 0 }, s2n_stuffer_free); EXPECT_OK(s2n_test_cert_chain_data_from_pem(conn, S2N_DEFAULT_TEST_CERT_CHAIN, &cert_chain_stuffer));