Commit 7f2be2f9 authored by Andy Polyakov's avatar Andy Polyakov
Browse files

recipes/25-test_verify.t: reformat. 



Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4411)
parent 329a004f

test/recipes/25-test_verify.t

+87 −51
Original line number Diff line number Diff line
@@ -20,8 +20,12 @@ sub verify { 
    my @args = qw(openssl verify -auth_level 1 -purpose);

    my @path = qw(test certs);

    push(@args, "$purpose", @opts);

    for (@$trusted) { push(@args, "-trusted", srctop_file(@path, "$_.pem")) }

    for (@$untrusted) { push(@args, "-untrusted", srctop_file(@path, "$_.pem")) }

    for (@$trusted) {

        push(@args, "-trusted", srctop_file(@path, "$_.pem"))

    }

    for (@$untrusted) {

        push(@args, "-untrusted", srctop_file(@path, "$_.pem"))

    }

    push(@args, srctop_file(@path, "$cert.pem"));

    run(app([@args]));

}
@@ -161,13 +165,16 @@ ok(verify("ee-cert", "sslserver", [qw(root-cert ca+anyEKU)], [qw(ca-cert)]), 
   "accept wildcard trust");

ok(verify("ee-cert", "sslserver", [qw(root-cert sca-cert)], [qw(ca-cert)]),

   "accept server purpose");

ok(verify("ee-cert", "sslserver", [qw(root-cert sca+serverAuth)], [qw(ca-cert)]),

ok(verify("ee-cert", "sslserver", [qw(root-cert sca+serverAuth)],

          [qw(ca-cert)]),

   "accept server trust and purpose");

ok(verify("ee-cert", "sslserver", [qw(root-cert sca+anyEKU)], [qw(ca-cert)]),

   "accept wildcard trust and server purpose");

ok(verify("ee-cert", "sslserver", [qw(root-cert sca-clientAuth)], [qw(ca-cert)]),

ok(verify("ee-cert", "sslserver", [qw(root-cert sca-clientAuth)],

          [qw(ca-cert)]),

   "accept client mistrust and server purpose");

ok(verify("ee-cert", "sslserver", [qw(root-cert cca+serverAuth)], [qw(ca-cert)]),

ok(verify("ee-cert", "sslserver", [qw(root-cert cca+serverAuth)],

          [qw(ca-cert)]),

   "accept server trust and client purpose");

ok(verify("ee-cert", "sslserver", [qw(root-cert cca+anyEKU)], [qw(ca-cert)]),

   "accept wildcard trust and client purpose");
@@ -175,19 +182,26 @@ ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-cert)], [qw(ca-cert)]), 
   "fail client purpose");

ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-anyEKU)], [qw(ca-cert)]),

   "fail wildcard mistrust");

ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-serverAuth)], [qw(ca-cert)]),

ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-serverAuth)],

           [qw(ca-cert)]),

   "fail server mistrust");

ok(!verify("ee-cert", "sslserver", [qw(root-cert ca+clientAuth)], [qw(ca-cert)]),

ok(!verify("ee-cert", "sslserver", [qw(root-cert ca+clientAuth)],

           [qw(ca-cert)]),

   "fail client trust");

ok(!verify("ee-cert", "sslserver", [qw(root-cert sca+clientAuth)], [qw(ca-cert)]),

ok(!verify("ee-cert", "sslserver", [qw(root-cert sca+clientAuth)],

           [qw(ca-cert)]),

   "fail client trust and server purpose");

ok(!verify("ee-cert", "sslserver", [qw(root-cert cca+clientAuth)], [qw(ca-cert)]),

ok(!verify("ee-cert", "sslserver", [qw(root-cert cca+clientAuth)],

           [qw(ca-cert)]),

   "fail client trust and client purpose");

ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-serverAuth)], [qw(ca-cert)]),

ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-serverAuth)],

           [qw(ca-cert)]),

   "fail server mistrust and client purpose");

ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-clientAuth)], [qw(ca-cert)]),

ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-clientAuth)],

           [qw(ca-cert)]),

   "fail client mistrust and client purpose");

ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-serverAuth)], [qw(ca-cert)]),

ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-serverAuth)],

           [qw(ca-cert)]),

   "fail server mistrust and server purpose");

ok(!verify("ee-cert", "sslserver", [qw(root-cert sca-anyEKU)], [qw(ca-cert)]),

   "fail wildcard mistrust and server purpose");
@@ -228,49 +242,58 @@ ok(!verify("pc1-cert", "sslclient", [qw(root-cert)], [qw(ee-client ca-cert)]), 
ok(verify("pc1-cert", "sslclient", [qw(root-cert)], [qw(ee-client ca-cert)],

          "-allow_proxy_certs"),

   "accept proxy cert 1");

ok(verify("pc2-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],

          "-allow_proxy_certs"),

ok(verify("pc2-cert", "sslclient", [qw(root-cert)],

          [qw(pc1-cert ee-client ca-cert)], "-allow_proxy_certs"),

   "accept proxy cert 2");

ok(!verify("bad-pc3-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],

          "-allow_proxy_certs"),

ok(!verify("bad-pc3-cert", "sslclient", [qw(root-cert)],

           [qw(pc1-cert ee-client ca-cert)], "-allow_proxy_certs"),

   "fail proxy cert with incorrect subject");

ok(!verify("bad-pc4-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],

          "-allow_proxy_certs"),

ok(!verify("bad-pc4-cert", "sslclient", [qw(root-cert)],

           [qw(pc1-cert ee-client ca-cert)], "-allow_proxy_certs"),

   "fail proxy cert with incorrect pathlen");

ok(verify("pc5-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],

          "-allow_proxy_certs"),

ok(verify("pc5-cert", "sslclient", [qw(root-cert)],

          [qw(pc1-cert ee-client ca-cert)], "-allow_proxy_certs"),

   "accept proxy cert missing proxy policy");

ok(!verify("pc6-cert", "sslclient", [qw(root-cert)], [qw(pc1-cert ee-client ca-cert)],

          "-allow_proxy_certs"),

ok(!verify("pc6-cert", "sslclient", [qw(root-cert)],

           [qw(pc1-cert ee-client ca-cert)], "-allow_proxy_certs"),

   "failed proxy cert where last CN was added as a multivalue RDN component");



# Security level tests

ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),

ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"],

          "-auth_level", "2"),

   "accept RSA 2048 chain at auth level 2");

ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "3"),

ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"],

           "-auth_level", "3"),

   "reject RSA 2048 root at auth level 3");

ok(verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"], "-auth_level", "0"),

ok(verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"],

          "-auth_level", "0"),

   "accept RSA 768 root at auth level 0");

ok(!verify("ee-cert", "sslserver", ["root-cert-768"], ["ca-cert-768i"]),

   "reject RSA 768 root at auth level 1");

ok(verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"], "-auth_level", "0"),

ok(verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"],

          "-auth_level", "0"),

   "accept RSA 768 intermediate at auth level 0");

ok(!verify("ee-cert-768i", "sslserver", ["root-cert"], ["ca-cert-768"]),

   "reject RSA 768 intermediate at auth level 1");

ok(verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),

ok(verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"],

          "-auth_level", "0"),

   "accept RSA 768 leaf at auth level 0");

ok(!verify("ee-cert-768", "sslserver", ["root-cert"], ["ca-cert"]),

   "reject RSA 768 leaf at auth level 1");

#

ok(verify("ee-cert", "sslserver", ["root-cert-md5"], ["ca-cert"], "-auth_level", "2"),

ok(verify("ee-cert", "sslserver", ["root-cert-md5"], ["ca-cert"],

          "-auth_level", "2"),

   "accept md5 self-signed TA at auth level 2");

ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-auth_level", "2"),

ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [],

          "-auth_level", "2"),

   "accept md5 intermediate TA at auth level 2");

ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"], "-auth_level", "0"),

ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"],

          "-auth_level", "0"),

   "accept md5 intermediate at auth level 0");

ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert-md5"]),

   "reject md5 intermediate at auth level 1");

ok(verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "0"),

ok(verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"],

          "-auth_level", "0"),

   "accept md5 leaf at auth level 0");

ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]),

   "reject md5 leaf at auth level 1");
@@ -279,13 +302,17 @@ ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]), 
# between the trust-anchor and the leaf, so, for example, with a root->ca->leaf

# chain, depth = 1 is sufficient, but depth == 0 is not.

#

ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "2"),

ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"],

          "-verify_depth", "2"),

   "accept chain with verify_depth 2");

ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "1"),

ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"],

          "-verify_depth", "1"),

   "accept chain with verify_depth 1");

ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"], "-verify_depth", "0"),

ok(!verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"],

           "-verify_depth", "0"),

   "accept chain with verify_depth 0");

ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [], "-verify_depth", "0"),

ok(verify("ee-cert", "sslserver", ["ca-cert-md5-any"], [],

          "-verify_depth", "0"),

   "accept md5 intermediate TA with verify_depth 0");



# Name Constraints tests.
@@ -320,25 +347,34 @@ ok(!verify("badalt6-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ), 
ok(!verify("badalt7-cert", "sslserver", ["root-cert"], ["ncca1-cert"], ),

   "Name Constraints CN BMPSTRING hostname not permitted");



ok(!verify("badalt8-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),

ok(!verify("badalt8-cert", "sslserver", ["root-cert"],

           ["ncca1-cert", "ncca3-cert"], ),

   "Name constaints nested DNS name not permitted 1");



ok(!verify("badalt9-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),

ok(!verify("badalt9-cert", "sslserver", ["root-cert"],

           ["ncca1-cert", "ncca3-cert"], ),

   "Name constaints nested DNS name not permitted 2");



ok(!verify("badalt10-cert", "sslserver", ["root-cert"], ["ncca1-cert", "ncca3-cert"], ),

ok(!verify("badalt10-cert", "sslserver", ["root-cert"],

           ["ncca1-cert", "ncca3-cert"], ),

   "Name constaints nested DNS name excluded");



ok(!verify("many-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),

ok(!verify("many-names1", "sslserver", ["many-constraints"],

           ["many-constraints"], ),

   "Too many names and constraints to check (1)");

ok(!verify("many-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),

ok(!verify("many-names2", "sslserver", ["many-constraints"],

           ["many-constraints"], ),

   "Too many names and constraints to check (2)");

ok(!verify("many-names3", "sslserver", ["many-constraints"], ["many-constraints"], ),

ok(!verify("many-names3", "sslserver", ["many-constraints"],

           ["many-constraints"], ),

   "Too many names and constraints to check (3)");



ok(verify("some-names1", "sslserver", ["many-constraints"], ["many-constraints"], ),

ok(verify("some-names1", "sslserver", ["many-constraints"],

          ["many-constraints"], ),

   "Not too many names and constraints to check (1)");

ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),

ok(verify("some-names2", "sslserver", ["many-constraints"],

          ["many-constraints"], ),

   "Not too many names and constraints to check (2)");

ok(verify("some-names2", "sslserver", ["many-constraints"], ["many-constraints"], ),

ok(verify("some-names2", "sslserver", ["many-constraints"],

          ["many-constraints"], ),

   "Not too many names and constraints to check (3)");