mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-07-08 23:00:49 +02:00
Sean Parkinson
8e4e76fdcc
1. BasicConstraints pathLenConstraint absent vs. 0 — get_ext_d2i/set_ext/V3_EXT_d2i now distinguish "no constraint" from 0 per RFC 5280 §4.2.1.9, using the existing basicConstPlSet flag. 2. GENERAL_NAME_print GEN_DIRNAME — added missing return-value normalization so the directory name is actually printed (was emitting only DirName:). 3. GENERAL_NAME_print GEN_DNS — use ASN1_STRING_print like the EMAIL/URI cases, avoiding NULL-strData deref and NUL-truncation. 4. X509_print BasicConstraints — print , pathlen:N to match OpenSSL. 5. X509_print Extended Key Usage — print Any Extended Key Usage (was omitted). 6. get_ext_d2i CRL_DIST_OID double-free — null gn immediately after ownership transfers to dp, so an error from the next push doesn't free it twice. 7. X509V3_EXT_print SAN truncation/failure — match XSNPRINTF size cap to the allocation; was truncating at indent==1 and failing at indent>=2. 8. X509V3_EXT_print AUTH_KEY/SUBJ_KEY NULL deref — NULL-check i2s_ASN1_STRING return before passing to %s. 9. X509_add_ext SAN type confusion — reject DIRNAME/RID/X400/EDIPARTY; only the ASN1_STRING*-backed types are read via gn->d.ia5. Was performing a wild-pointer XMEMCPY in add_altname_ex. Also: extracted the SAN and WOLFSSL_CUSTOM_OID arms of X509_add_ext into static helpers (behavior-preserving). Regression tests added for #1–5 and #9; existing GENERAL_NAME_print test hardened (gives GEN_DIRNAME a real directoryName, eliminating an OOB read that the print fix would otherwise expose).
100 lines
5.4 KiB
C
100 lines
5.4 KiB
C
/* test_ossl_x509_ext.h
|
|
*
|
|
* Copyright (C) 2006-2026 wolfSSL Inc.
|
|
*
|
|
* This file is part of wolfSSL.
|
|
*
|
|
* wolfSSL is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* wolfSSL is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
|
*/
|
|
|
|
#ifndef WOLFCRYPT_TEST_OSSL_X509_EXT_H
|
|
#define WOLFCRYPT_TEST_OSSL_X509_EXT_H
|
|
|
|
#include <tests/api/api_decl.h>
|
|
|
|
int test_wolfSSL_X509_get_extension_flags(void);
|
|
int test_wolfSSL_X509_get_ext(void);
|
|
int test_wolfSSL_X509_get_ext_by_NID(void);
|
|
int test_wolfSSL_X509_get_ext_subj_alt_name(void);
|
|
int test_wolfSSL_X509_set_ext(void);
|
|
int test_wolfSSL_X509_add_ext(void);
|
|
int test_wolfSSL_X509_add_ext_dirname_san_rejected(void);
|
|
int test_wolfSSL_X509_get_ext_count(void);
|
|
int test_wolfSSL_X509_stack_extensions(void);
|
|
int test_wolfSSL_X509_EXTENSION_new(void);
|
|
int test_wolfSSL_X509_EXTENSION_dup(void);
|
|
int test_wolfSSL_X509_EXTENSION_get_object(void);
|
|
int test_wolfSSL_X509_EXTENSION_get_data(void);
|
|
int test_wolfSSL_X509_EXTENSION_get_critical(void);
|
|
int test_wolfSSL_X509_EXTENSION_create_by_OBJ(void);
|
|
int test_wolfSSL_X509V3_set_ctx(void);
|
|
int test_wolfSSL_X509V3_EXT_get(void);
|
|
int test_wolfSSL_X509V3_EXT_nconf(void);
|
|
int test_wolfSSL_X509V3_EXT_bc(void);
|
|
int test_wolfSSL_X509_get_ext_d2i_basic_constraints(void);
|
|
int test_wolfSSL_X509V3_EXT_san(void);
|
|
int test_wolfSSL_X509V3_EXT_aia(void);
|
|
int test_wolfSSL_X509V3_EXT(void);
|
|
int test_wolfSSL_X509V3_EXT_print(void);
|
|
int test_wolfSSL_X509_get_ext_d2i_name_constraints(void);
|
|
int test_wolfSSL_sk_GENERAL_SUBTREE(void);
|
|
int test_wolfSSL_NAME_CONSTRAINTS_types(void);
|
|
int test_wolfSSL_NAME_CONSTRAINTS_uri(void);
|
|
int test_wolfSSL_NAME_CONSTRAINTS_ipaddr(void);
|
|
int test_wolfSSL_NAME_CONSTRAINTS_check_name(void);
|
|
int test_wolfSSL_NAME_CONSTRAINTS_dns(void);
|
|
int test_wolfSSL_NAME_CONSTRAINTS_excluded(void);
|
|
|
|
#define TEST_OSSL_X509_EXT_DECLS \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_get_extension_flags), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_get_ext), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_get_ext_by_NID), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_get_ext_subj_alt_name), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_set_ext), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_add_ext), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", \
|
|
test_wolfSSL_X509_add_ext_dirname_san_rejected), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_get_ext_count), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_stack_extensions), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_EXTENSION_new), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_EXTENSION_dup), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_EXTENSION_get_object), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509_EXTENSION_get_data), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", \
|
|
test_wolfSSL_X509_EXTENSION_get_critical), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", \
|
|
test_wolfSSL_X509_EXTENSION_create_by_OBJ), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_set_ctx), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_get), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_nconf), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_bc), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", \
|
|
test_wolfSSL_X509_get_ext_d2i_basic_constraints), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_san), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_aia), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_X509V3_EXT_print), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", \
|
|
test_wolfSSL_X509_get_ext_d2i_name_constraints), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_sk_GENERAL_SUBTREE), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_NAME_CONSTRAINTS_types), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_NAME_CONSTRAINTS_uri), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_NAME_CONSTRAINTS_ipaddr), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_NAME_CONSTRAINTS_check_name),\
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_NAME_CONSTRAINTS_dns), \
|
|
TEST_DECL_GROUP("ossl_x509_ext", test_wolfSSL_NAME_CONSTRAINTS_excluded)
|
|
|
|
#endif /* WOLFCRYPT_TEST_OSSL_X509_EXT_H */
|