test/pkits-test.pl

   1 # test/pkits-test.pl
   2 # Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3 # project.
   4 #
   5 # ====================================================================
   6 # Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
   7 #
   8 # Redistribution and use in source and binary forms, with or without
   9 # modification, are permitted provided that the following conditions
  10 # are met:
  11 #
  12 # 1. Redistributions of source code must retain the above copyright
  13 #    notice, this list of conditions and the following disclaimer.
  14 #
  15 # 2. Redistributions in binary form must reproduce the above copyright
  16 #    notice, this list of conditions and the following disclaimer in
  17 #    the documentation and/or other materials provided with the
  18 #    distribution.
  19 #
  20 # 3. All advertising materials mentioning features or use of this
  21 #    software must display the following acknowledgment:
  22 #    "This product includes software developed by the OpenSSL Project
  23 #    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24 #
  25 # 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26 #    endorse or promote products derived from this software without
  27 #    prior written permission. For written permission, please contact
  28 #    licensing@OpenSSL.org.
  29 #
  30 # 5. Products derived from this software may not be called "OpenSSL"
  31 #    nor may "OpenSSL" appear in their names without prior written
  32 #    permission of the OpenSSL Project.
  33 #
  34 # 6. Redistributions of any form whatsoever must retain the following
  35 #    acknowledgment:
  36 #    "This product includes software developed by the OpenSSL Project
  37 #    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38 #
  39 # THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40 # EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42 # PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43 # ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44 # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45 # NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46 # LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48 # STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50 # OF THE POSSIBILITY OF SUCH DAMAGE.
  51 # ====================================================================
  52
  53 # Perl utility to run PKITS tests for RFC3280 compliance.
  54
  55 my $ossl_path;
  56
  57 if ( -f "../apps/openssl" ) {
  58     $ossl_path = "../util/shlib_wrap.sh ../apps/openssl";
  59 }
  60 elsif ( -f "..\\out32dll\\openssl.exe" ) {
  61     $ossl_path = "..\\out32dll\\openssl.exe";
  62 }
  63 elsif ( -f "..\\out32\\openssl.exe" ) {
  64     $ossl_path = "..\\out32\\openssl.exe";
  65 }
  66 else {
  67     die "Can't find OpenSSL executable";
  68 }
  69
  70 my $pkitsdir = "pkits/smime";
  71 my $pkitsta = "pkits/certs/TrustAnchorRootCertificate.crt";
  72
  73 die "Can't find PKITS test data" if !-d $pkitsdir;
  74
  75 my $nist1 = "2.16.840.1.101.3.2.1.48.1";
  76 my $nist2 = "2.16.840.1.101.3.2.1.48.2";
  77 my $nist3 = "2.16.840.1.101.3.2.1.48.3";
  78 my $nist4 = "2.16.840.1.101.3.2.1.48.4";
  79 my $nist5 = "2.16.840.1.101.3.2.1.48.5";
  80 my $nist6 = "2.16.840.1.101.3.2.1.48.6";
  81
  82 my $apolicy = "X509v3 Any Policy";
  83
  84 # This table contains the chapter headings of the accompanying PKITS
  85 # document. They provide useful informational output and their names
  86 # can be converted into the filename to test.
  87
  88 my @testlists = (
  89     [ "4.1", "Signature Verification" ],
  90     [ "4.1.1", "Valid Signatures Test1",                        0 ],
  91     [ "4.1.2", "Invalid CA Signature Test2",                    7 ],
  92     [ "4.1.3", "Invalid EE Signature Test3",                    7 ],
  93     [ "4.1.4", "Valid DSA Signatures Test4",                    0 ],
  94     [ "4.1.5", "Valid DSA Parameter Inheritance Test5",         0 ],
  95     [ "4.1.6", "Invalid DSA Signature Test6",                   7 ],
  96     [ "4.2",   "Validity Periods" ],
  97     [ "4.2.1", "Invalid CA notBefore Date Test1",               9 ],
  98     [ "4.2.2", "Invalid EE notBefore Date Test2",               9 ],
  99     [ "4.2.3", "Valid pre2000 UTC notBefore Date Test3",        0 ],
 100     [ "4.2.4", "Valid GeneralizedTime notBefore Date Test4",    0 ],
 101     [ "4.2.5", "Invalid CA notAfter Date Test5",                10 ],
 102     [ "4.2.6", "Invalid EE notAfter Date Test6",                10 ],
 103     [ "4.2.7", "Invalid pre2000 UTC EE notAfter Date Test7",    10 ],
 104     [ "4.2.8", "Valid GeneralizedTime notAfter Date Test8",     0 ],
 105     [ "4.3",   "Verifying Name Chaining" ],
 106     [ "4.3.1", "Invalid Name Chaining EE Test1",                20 ],
 107     [ "4.3.2", "Invalid Name Chaining Order Test2",             20 ],
 108     [ "4.3.3", "Valid Name Chaining Whitespace Test3",          0 ],
 109     [ "4.3.4", "Valid Name Chaining Whitespace Test4",          0 ],
 110     [ "4.3.5", "Valid Name Chaining Capitalization Test5",      0 ],
 111     [ "4.3.6", "Valid Name Chaining UIDs Test6",                0 ],
 112     [ "4.3.7", "Valid RFC3280 Mandatory Attribute Types Test7", 0 ],
 113     [ "4.3.8", "Valid RFC3280 Optional Attribute Types Test8",  0 ],
 114     [ "4.3.9", "Valid UTF8String Encoded Names Test9",          0 ],
 115     [ "4.3.10", "Valid Rollover from PrintableString to UTF8String Test10", 0 ],
 116     [ "4.3.11", "Valid UTF8String Case Insensitive Match Test11",           0 ],
 117     [ "4.4",    "Basic Certificate Revocation Tests" ],
 118     [ "4.4.1",  "Missing CRL Test1",                                        3 ],
 119     [ "4.4.2", "Invalid Revoked CA Test2",          23 ],
 120     [ "4.4.3", "Invalid Revoked EE Test3",          23 ],
 121     [ "4.4.4", "Invalid Bad CRL Signature Test4",   8 ],
 122     [ "4.4.5", "Invalid Bad CRL Issuer Name Test5", 3 ],
 123     [ "4.4.6", "Invalid Wrong CRL Test6",           3 ],
 124     [ "4.4.7", "Valid Two CRLs Test7",              0 ],
 125
 126     # The test document suggests these should return certificate revoked...
 127     # Subsquent discussion has concluded they should not due to unhandle
 128     # critical CRL extensions.
 129     [ "4.4.8", "Invalid Unknown CRL Entry Extension Test8", 36 ],
 130     [ "4.4.9", "Invalid Unknown CRL Extension Test9",       36 ],
 131
 132     [ "4.4.10", "Invalid Unknown CRL Extension Test10",             36 ],
 133     [ "4.4.11", "Invalid Old CRL nextUpdate Test11",                12 ],
 134     [ "4.4.12", "Invalid pre2000 CRL nextUpdate Test12",            12 ],
 135     [ "4.4.13", "Valid GeneralizedTime CRL nextUpdate Test13",      0 ],
 136     [ "4.4.14", "Valid Negative Serial Number Test14",              0 ],
 137     [ "4.4.15", "Invalid Negative Serial Number Test15",            23 ],
 138     [ "4.4.16", "Valid Long Serial Number Test16",                  0 ],
 139     [ "4.4.17", "Valid Long Serial Number Test17",                  0 ],
 140     [ "4.4.18", "Invalid Long Serial Number Test18",                23 ],
 141     [ "4.4.19", "Valid Separate Certificate and CRL Keys Test19",   0 ],
 142     [ "4.4.20", "Invalid Separate Certificate and CRL Keys Test20", 23 ],
 143
 144     # CRL path is revoked so get a CRL path validation error
 145     [ "4.4.21", "Invalid Separate Certificate and CRL Keys Test21",      54 ],
 146     [ "4.5",    "Verifying Paths with Self-Issued Certificates" ],
 147     [ "4.5.1",  "Valid Basic Self-Issued Old With New Test1",            0 ],
 148     [ "4.5.2",  "Invalid Basic Self-Issued Old With New Test2",          23 ],
 149     [ "4.5.3",  "Valid Basic Self-Issued New With Old Test3",            0 ],
 150     [ "4.5.4",  "Valid Basic Self-Issued New With Old Test4",            0 ],
 151     [ "4.5.5",  "Invalid Basic Self-Issued New With Old Test5",          23 ],
 152     [ "4.5.6",  "Valid Basic Self-Issued CRL Signing Key Test6",         0 ],
 153     [ "4.5.7",  "Invalid Basic Self-Issued CRL Signing Key Test7",       23 ],
 154     [ "4.5.8",  "Invalid Basic Self-Issued CRL Signing Key Test8",       20 ],
 155     [ "4.6",    "Verifying Basic Constraints" ],
 156     [ "4.6.1",  "Invalid Missing basicConstraints Test1",                24 ],
 157     [ "4.6.2",  "Invalid cA False Test2",                                24 ],
 158     [ "4.6.3",  "Invalid cA False Test3",                                24 ],
 159     [ "4.6.4",  "Valid basicConstraints Not Critical Test4",             0 ],
 160     [ "4.6.5",  "Invalid pathLenConstraint Test5",                       25 ],
 161     [ "4.6.6",  "Invalid pathLenConstraint Test6",                       25 ],
 162     [ "4.6.7",  "Valid pathLenConstraint Test7",                         0 ],
 163     [ "4.6.8",  "Valid pathLenConstraint Test8",                         0 ],
 164     [ "4.6.9",  "Invalid pathLenConstraint Test9",                       25 ],
 165     [ "4.6.10", "Invalid pathLenConstraint Test10",                      25 ],
 166     [ "4.6.11", "Invalid pathLenConstraint Test11",                      25 ],
 167     [ "4.6.12", "Invalid pathLenConstraint Test12",                      25 ],
 168     [ "4.6.13", "Valid pathLenConstraint Test13",                        0 ],
 169     [ "4.6.14", "Valid pathLenConstraint Test14",                        0 ],
 170     [ "4.6.15", "Valid Self-Issued pathLenConstraint Test15",            0 ],
 171     [ "4.6.16", "Invalid Self-Issued pathLenConstraint Test16",          25 ],
 172     [ "4.6.17", "Valid Self-Issued pathLenConstraint Test17",            0 ],
 173     [ "4.7",    "Key Usage" ],
 174     [ "4.7.1",  "Invalid keyUsage Critical keyCertSign False Test1",     20 ],
 175     [ "4.7.2",  "Invalid keyUsage Not Critical keyCertSign False Test2", 20 ],
 176     [ "4.7.3",  "Valid keyUsage Not Critical Test3",                     0 ],
 177     [ "4.7.4",  "Invalid keyUsage Critical cRLSign False Test4",         35 ],
 178     [ "4.7.5",  "Invalid keyUsage Not Critical cRLSign False Test5",     35 ],
 179
 180     # Certificate policy tests need special handling. They can have several
 181     # sub tests and we need to check the outputs are correct.
 182
 183     [ "4.8", "Certificate Policies" ],
 184     [
 185         "4.8.1.1",
 186         "All Certificates Same Policy Test1",
 187         "-policy anyPolicy -explicit_policy",
 188         "True", $nist1, $nist1, 0
 189     ],
 190     [
 191         "4.8.1.2",
 192         "All Certificates Same Policy Test1",
 193         "-policy $nist1 -explicit_policy",
 194         "True", $nist1, $nist1, 0
 195     ],
 196     [
 197         "4.8.1.3",
 198         "All Certificates Same Policy Test1",
 199         "-policy $nist2 -explicit_policy",
 200         "True", $nist1, "<empty>", 43
 201     ],
 202     [
 203         "4.8.1.4",
 204         "All Certificates Same Policy Test1",
 205         "-policy $nist1 -policy $nist2 -explicit_policy",
 206         "True", $nist1, $nist1, 0
 207     ],
 208     [
 209         "4.8.2.1",
 210         "All Certificates No Policies Test2",
 211         "-policy anyPolicy",
 212         "False", "<empty>", "<empty>", 0
 213     ],
 214     [
 215         "4.8.2.2",
 216         "All Certificates No Policies Test2",
 217         "-policy anyPolicy -explicit_policy",
 218         "True", "<empty>", "<empty>", 43
 219     ],
 220     [
 221         "4.8.3.1",
 222         "Different Policies Test3",
 223         "-policy anyPolicy",
 224         "False", "<empty>", "<empty>", 0
 225     ],
 226     [
 227         "4.8.3.2",
 228         "Different Policies Test3",
 229         "-policy anyPolicy -explicit_policy",
 230         "True", "<empty>", "<empty>", 43
 231     ],
 232     [
 233         "4.8.3.3",
 234         "Different Policies Test3",
 235         "-policy $nist1 -policy $nist2 -explicit_policy",
 236         "True", "<empty>", "<empty>", 43
 237     ],
 238
 239     [
 240         "4.8.4",
 241         "Different Policies Test4",
 242         "-policy anyPolicy",
 243         "True", "<empty>", "<empty>", 43
 244     ],
 245     [
 246         "4.8.5",
 247         "Different Policies Test5",
 248         "-policy anyPolicy",
 249         "True", "<empty>", "<empty>", 43
 250     ],
 251     [
 252         "4.8.6.1",
 253         "Overlapping Policies Test6",
 254         "-policy anyPolicy",
 255         "True", $nist1, $nist1, 0
 256     ],
 257     [
 258         "4.8.6.2",
 259         "Overlapping Policies Test6",
 260         "-policy $nist1",
 261         "True", $nist1, $nist1, 0
 262     ],
 263     [
 264         "4.8.6.3",
 265         "Overlapping Policies Test6",
 266         "-policy $nist2",
 267         "True", $nist1, "<empty>", 43
 268     ],
 269     [
 270         "4.8.7",
 271         "Different Policies Test7",
 272         "-policy anyPolicy",
 273         "True", "<empty>", "<empty>", 43
 274     ],
 275     [
 276         "4.8.8",
 277         "Different Policies Test8",
 278         "-policy anyPolicy",
 279         "True", "<empty>", "<empty>", 43
 280     ],
 281     [
 282         "4.8.9",
 283         "Different Policies Test9",
 284         "-policy anyPolicy",
 285         "True", "<empty>", "<empty>", 43
 286     ],
 287     [
 288         "4.8.10.1",
 289         "All Certificates Same Policies Test10",
 290         "-policy $nist1",
 291         "True", "$nist1:$nist2", "$nist1", 0
 292     ],
 293     [
 294         "4.8.10.2",
 295         "All Certificates Same Policies Test10",
 296         "-policy $nist2",
 297         "True", "$nist1:$nist2", "$nist2", 0
 298     ],
 299     [
 300         "4.8.10.3",
 301         "All Certificates Same Policies Test10",
 302         "-policy anyPolicy",
 303         "True", "$nist1:$nist2", "$nist1:$nist2", 0
 304     ],
 305     [
 306         "4.8.11.1",
 307         "All Certificates AnyPolicy Test11",
 308         "-policy anyPolicy",
 309         "True", "$apolicy", "$apolicy", 0
 310     ],
 311     [
 312         "4.8.11.2",
 313         "All Certificates AnyPolicy Test11",
 314         "-policy $nist1",
 315         "True", "$apolicy", "$nist1", 0
 316     ],
 317     [
 318         "4.8.12",
 319         "Different Policies Test12",
 320         "-policy anyPolicy",
 321         "True", "<empty>", "<empty>", 43
 322     ],
 323     [
 324         "4.8.13.1",
 325         "All Certificates Same Policies Test13",
 326         "-policy $nist1",
 327         "True", "$nist1:$nist2:$nist3", "$nist1", 0
 328     ],
 329     [
 330         "4.8.13.2",
 331         "All Certificates Same Policies Test13",
 332         "-policy $nist2",
 333         "True", "$nist1:$nist2:$nist3", "$nist2", 0
 334     ],
 335     [
 336         "4.8.13.3",
 337         "All Certificates Same Policies Test13",
 338         "-policy $nist3",
 339         "True", "$nist1:$nist2:$nist3", "$nist3", 0
 340     ],
 341     [
 342         "4.8.14.1",       "AnyPolicy Test14",
 343         "-policy $nist1", "True",
 344         "$nist1",         "$nist1",
 345         0
 346     ],
 347     [
 348         "4.8.14.2",       "AnyPolicy Test14",
 349         "-policy $nist2", "True",
 350         "$nist1",         "<empty>",
 351         43
 352     ],
 353     [
 354         "4.8.15",
 355         "User Notice Qualifier Test15",
 356         "-policy anyPolicy",
 357         "False", "$nist1", "$nist1", 0
 358     ],
 359     [
 360         "4.8.16",
 361         "User Notice Qualifier Test16",
 362         "-policy anyPolicy",
 363         "False", "$nist1", "$nist1", 0
 364     ],
 365     [
 366         "4.8.17",
 367         "User Notice Qualifier Test17",
 368         "-policy anyPolicy",
 369         "False", "$nist1", "$nist1", 0
 370     ],
 371     [
 372         "4.8.18.1",
 373         "User Notice Qualifier Test18",
 374         "-policy $nist1",
 375         "True", "$nist1:$nist2", "$nist1", 0
 376     ],
 377     [
 378         "4.8.18.2",
 379         "User Notice Qualifier Test18",
 380         "-policy $nist2",
 381         "True", "$nist1:$nist2", "$nist2", 0
 382     ],
 383     [
 384         "4.8.19",
 385         "User Notice Qualifier Test19",
 386         "-policy anyPolicy",
 387         "False", "$nist1", "$nist1", 0
 388     ],
 389     [
 390         "4.8.20",
 391         "CPS Pointer Qualifier Test20",
 392         "-policy anyPolicy -explicit_policy",
 393         "True", "$nist1", "$nist1", 0
 394     ],
 395     [ "4.9", "Require Explicit Policy" ],
 396     [
 397         "4.9.1",
 398         "Valid RequireExplicitPolicy Test1",
 399         "-policy anyPolicy",
 400         "False", "<empty>", "<empty>", 0
 401     ],
 402     [
 403         "4.9.2",
 404         "Valid RequireExplicitPolicy Test2",
 405         "-policy anyPolicy",
 406         "False", "<empty>", "<empty>", 0
 407     ],
 408     [
 409         "4.9.3",
 410         "Invalid RequireExplicitPolicy Test3",
 411         "-policy anyPolicy",
 412         "True", "<empty>", "<empty>", 43
 413     ],
 414     [
 415         "4.9.4",
 416         "Valid RequireExplicitPolicy Test4",
 417         "-policy anyPolicy",
 418         "True", "$nist1", "$nist1", 0
 419     ],
 420     [
 421         "4.9.5",
 422         "Invalid RequireExplicitPolicy Test5",
 423         "-policy anyPolicy",
 424         "True", "<empty>", "<empty>", 43
 425     ],
 426     [
 427         "4.9.6",
 428         "Valid Self-Issued requireExplicitPolicy Test6",
 429         "-policy anyPolicy",
 430         "False", "<empty>", "<empty>", 0
 431     ],
 432     [
 433         "4.9.7",
 434         "Invalid Self-Issued requireExplicitPolicy Test7",
 435         "-policy anyPolicy",
 436         "True", "<empty>", "<empty>", 43
 437     ],
 438     [
 439         "4.9.8",
 440         "Invalid Self-Issued requireExplicitPolicy Test8",
 441         "-policy anyPolicy",
 442         "True", "<empty>", "<empty>", 43
 443     ],
 444     [ "4.10", "Policy Mappings" ],
 445     [
 446         "4.10.1.1",
 447         "Valid Policy Mapping Test1",
 448         "-policy $nist1",
 449         "True", "$nist1", "$nist1", 0
 450     ],
 451     [
 452         "4.10.1.2",
 453         "Valid Policy Mapping Test1",
 454         "-policy $nist2",
 455         "True", "$nist1", "<empty>", 43
 456     ],
 457     [
 458         "4.10.1.3",
 459         "Valid Policy Mapping Test1",
 460         "-policy anyPolicy -inhibit_map",
 461         "True", "<empty>", "<empty>", 43
 462     ],
 463     [
 464         "4.10.2.1",
 465         "Invalid Policy Mapping Test2",
 466         "-policy anyPolicy",
 467         "True", "<empty>", "<empty>", 43
 468     ],
 469     [
 470         "4.10.2.2",
 471         "Invalid Policy Mapping Test2",
 472         "-policy anyPolicy -inhibit_map",
 473         "True", "<empty>", "<empty>", 43
 474     ],
 475     [
 476         "4.10.3.1",
 477         "Valid Policy Mapping Test3",
 478         "-policy $nist1",
 479         "True", "$nist2", "<empty>", 43
 480     ],
 481     [
 482         "4.10.3.2",
 483         "Valid Policy Mapping Test3",
 484         "-policy $nist2",
 485         "True", "$nist2", "$nist2", 0
 486     ],
 487     [
 488         "4.10.4",
 489         "Invalid Policy Mapping Test4",
 490         "-policy anyPolicy",
 491         "True", "<empty>", "<empty>", 43
 492     ],
 493     [
 494         "4.10.5.1",
 495         "Valid Policy Mapping Test5",
 496         "-policy $nist1",
 497         "True", "$nist1", "$nist1", 0
 498     ],
 499     [
 500         "4.10.5.2",
 501         "Valid Policy Mapping Test5",
 502         "-policy $nist6",
 503         "True", "$nist1", "<empty>", 43
 504     ],
 505     [
 506         "4.10.6.1",
 507         "Valid Policy Mapping Test6",
 508         "-policy $nist1",
 509         "True", "$nist1", "$nist1", 0
 510     ],
 511     [
 512         "4.10.6.2",
 513         "Valid Policy Mapping Test6",
 514         "-policy $nist6",
 515         "True", "$nist1", "<empty>", 43
 516     ],
 517     [ "4.10.7", "Invalid Mapping From anyPolicy Test7", 42 ],
 518     [ "4.10.8", "Invalid Mapping To anyPolicy Test8",   42 ],
 519     [
 520         "4.10.9",
 521         "Valid Policy Mapping Test9",
 522         "-policy anyPolicy",
 523         "True", "$nist1", "$nist1", 0
 524     ],
 525     [
 526         "4.10.10",
 527         "Invalid Policy Mapping Test10",
 528         "-policy anyPolicy",
 529         "True", "<empty>", "<empty>", 43
 530     ],
 531     [
 532         "4.10.11",
 533         "Valid Policy Mapping Test11",
 534         "-policy anyPolicy",
 535         "True", "$nist1", "$nist1", 0
 536     ],
 537
 538     # TODO: check notice display
 539     [
 540         "4.10.12.1",
 541         "Valid Policy Mapping Test12",
 542         "-policy $nist1",
 543         "True", "$nist1:$nist2", "$nist1", 0
 544     ],
 545
 546     # TODO: check notice display
 547     [
 548         "4.10.12.2",
 549         "Valid Policy Mapping Test12",
 550         "-policy $nist2",
 551         "True", "$nist1:$nist2", "$nist2", 0
 552     ],
 553     [
 554         "4.10.13",
 555         "Valid Policy Mapping Test13",
 556         "-policy anyPolicy",
 557         "True", "$nist1", "$nist1", 0
 558     ],
 559
 560     # TODO: check notice display
 561     [
 562         "4.10.14",
 563         "Valid Policy Mapping Test14",
 564         "-policy anyPolicy",
 565         "True", "$nist1", "$nist1", 0
 566     ],
 567     [ "4.11", "Inhibit Policy Mapping" ],
 568     [
 569         "4.11.1",
 570         "Invalid inhibitPolicyMapping Test1",
 571         "-policy anyPolicy",
 572         "True", "<empty>", "<empty>", 43
 573     ],
 574     [
 575         "4.11.2",
 576         "Valid inhibitPolicyMapping Test2",
 577         "-policy anyPolicy",
 578         "True", "$nist1", "$nist1", 0
 579     ],
 580     [
 581         "4.11.3",
 582         "Invalid inhibitPolicyMapping Test3",
 583         "-policy anyPolicy",
 584         "True", "<empty>", "<empty>", 43
 585     ],
 586     [
 587         "4.11.4",
 588         "Valid inhibitPolicyMapping Test4",
 589         "-policy anyPolicy",
 590         "True", "$nist2", "$nist2", 0
 591     ],
 592     [
 593         "4.11.5",
 594         "Invalid inhibitPolicyMapping Test5",
 595         "-policy anyPolicy",
 596         "True", "<empty>", "<empty>", 43
 597     ],
 598     [
 599         "4.11.6",
 600         "Invalid inhibitPolicyMapping Test6",
 601         "-policy anyPolicy",
 602         "True", "<empty>", "<empty>", 43
 603     ],
 604     [
 605         "4.11.7",
 606         "Valid Self-Issued inhibitPolicyMapping Test7",
 607         "-policy anyPolicy",
 608         "True", "$nist1", "$nist1", 0
 609     ],
 610     [
 611         "4.11.8",
 612         "Invalid Self-Issued inhibitPolicyMapping Test8",
 613         "-policy anyPolicy",
 614         "True", "<empty>", "<empty>", 43
 615     ],
 616     [
 617         "4.11.9",
 618         "Invalid Self-Issued inhibitPolicyMapping Test9",
 619         "-policy anyPolicy",
 620         "True", "<empty>", "<empty>", 43
 621     ],
 622     [
 623         "4.11.10",
 624         "Invalid Self-Issued inhibitPolicyMapping Test10",
 625         "-policy anyPolicy",
 626         "True", "<empty>", "<empty>", 43
 627     ],
 628     [
 629         "4.11.11",
 630         "Invalid Self-Issued inhibitPolicyMapping Test11",
 631         "-policy anyPolicy",
 632         "True", "<empty>", "<empty>", 43
 633     ],
 634     [ "4.12", "Inhibit Any Policy" ],
 635     [
 636         "4.12.1",
 637         "Invalid inhibitAnyPolicy Test1",
 638         "-policy anyPolicy",
 639         "True", "<empty>", "<empty>", 43
 640     ],
 641     [
 642         "4.12.2",
 643         "Valid inhibitAnyPolicy Test2",
 644         "-policy anyPolicy",
 645         "True", "$nist1", "$nist1", 0
 646     ],
 647     [
 648         "4.12.3.1",
 649         "inhibitAnyPolicy Test3",
 650         "-policy anyPolicy",
 651         "True", "$nist1", "$nist1", 0
 652     ],
 653     [
 654         "4.12.3.2",
 655         "inhibitAnyPolicy Test3",
 656         "-policy anyPolicy -inhibit_any",
 657         "True", "<empty>", "<empty>", 43
 658     ],
 659     [
 660         "4.12.4",
 661         "Invalid inhibitAnyPolicy Test4",
 662         "-policy anyPolicy",
 663         "True", "<empty>", "<empty>", 43
 664     ],
 665     [
 666         "4.12.5",
 667         "Invalid inhibitAnyPolicy Test5",
 668         "-policy anyPolicy",
 669         "True", "<empty>", "<empty>", 43
 670     ],
 671     [
 672         "4.12.6",
 673         "Invalid inhibitAnyPolicy Test6",
 674         "-policy anyPolicy",
 675         "True", "<empty>", "<empty>", 43
 676     ],
 677     [ "4.12.7",  "Valid Self-Issued inhibitAnyPolicy Test7",      0 ],
 678     [ "4.12.8",  "Invalid Self-Issued inhibitAnyPolicy Test8",    43 ],
 679     [ "4.12.9",  "Valid Self-Issued inhibitAnyPolicy Test9",      0 ],
 680     [ "4.12.10", "Invalid Self-Issued inhibitAnyPolicy Test10",   43 ],
 681     [ "4.13",    "Name Constraints" ],
 682     [ "4.13.1",  "Valid DN nameConstraints Test1",                0 ],
 683     [ "4.13.2",  "Invalid DN nameConstraints Test2",              47 ],
 684     [ "4.13.3",  "Invalid DN nameConstraints Test3",              47 ],
 685     [ "4.13.4",  "Valid DN nameConstraints Test4",                0 ],
 686     [ "4.13.5",  "Valid DN nameConstraints Test5",                0 ],
 687     [ "4.13.6",  "Valid DN nameConstraints Test6",                0 ],
 688     [ "4.13.7",  "Invalid DN nameConstraints Test7",              48 ],
 689     [ "4.13.8",  "Invalid DN nameConstraints Test8",              48 ],
 690     [ "4.13.9",  "Invalid DN nameConstraints Test9",              48 ],
 691     [ "4.13.10", "Invalid DN nameConstraints Test10",             48 ],
 692     [ "4.13.11", "Valid DN nameConstraints Test11",               0 ],
 693     [ "4.13.12", "Invalid DN nameConstraints Test12",             47 ],
 694     [ "4.13.13", "Invalid DN nameConstraints Test13",             47 ],
 695     [ "4.13.14", "Valid DN nameConstraints Test14",               0 ],
 696     [ "4.13.15", "Invalid DN nameConstraints Test15",             48 ],
 697     [ "4.13.16", "Invalid DN nameConstraints Test16",             48 ],
 698     [ "4.13.17", "Invalid DN nameConstraints Test17",             48 ],
 699     [ "4.13.18", "Valid DN nameConstraints Test18",               0 ],
 700     [ "4.13.19", "Valid Self-Issued DN nameConstraints Test19",   0 ],
 701     [ "4.13.20", "Invalid Self-Issued DN nameConstraints Test20", 47 ],
 702     [ "4.13.21", "Valid RFC822 nameConstraints Test21",           0 ],
 703     [ "4.13.22", "Invalid RFC822 nameConstraints Test22",         47 ],
 704     [ "4.13.23", "Valid RFC822 nameConstraints Test23",           0 ],
 705     [ "4.13.24", "Invalid RFC822 nameConstraints Test24",         47 ],
 706     [ "4.13.25", "Valid RFC822 nameConstraints Test25",           0 ],
 707     [ "4.13.26", "Invalid RFC822 nameConstraints Test26",         48 ],
 708     [ "4.13.27", "Valid DN and RFC822 nameConstraints Test27",    0 ],
 709     [ "4.13.28", "Invalid DN and RFC822 nameConstraints Test28",  47 ],
 710     [ "4.13.29", "Invalid DN and RFC822 nameConstraints Test29",  47 ],
 711     [ "4.13.30", "Valid DNS nameConstraints Test30",              0 ],
 712     [ "4.13.31", "Invalid DNS nameConstraints Test31",            47 ],
 713     [ "4.13.32", "Valid DNS nameConstraints Test32",              0 ],
 714     [ "4.13.33", "Invalid DNS nameConstraints Test33",            48 ],
 715     [ "4.13.34", "Valid URI nameConstraints Test34",              0 ],
 716     [ "4.13.35", "Invalid URI nameConstraints Test35",            47 ],
 717     [ "4.13.36", "Valid URI nameConstraints Test36",              0 ],
 718     [ "4.13.37", "Invalid URI nameConstraints Test37",            48 ],
 719     [ "4.13.38", "Invalid DNS nameConstraints Test38",            47 ],
 720     [ "4.14",    "Distribution Points" ],
 721     [ "4.14.1",  "Valid distributionPoint Test1",                 0 ],
 722     [ "4.14.2",  "Invalid distributionPoint Test2",               23 ],
 723     [ "4.14.3",  "Invalid distributionPoint Test3",               44 ],
 724     [ "4.14.4",  "Valid distributionPoint Test4",                 0 ],
 725     [ "4.14.5",  "Valid distributionPoint Test5",                 0 ],
 726     [ "4.14.6",  "Invalid distributionPoint Test6",               23 ],
 727     [ "4.14.7",  "Valid distributionPoint Test7",                 0 ],
 728     [ "4.14.8",  "Invalid distributionPoint Test8",               44 ],
 729     [ "4.14.9",  "Invalid distributionPoint Test9",               44 ],
 730     [ "4.14.10", "Valid No issuingDistributionPoint Test10",      0 ],
 731     [ "4.14.11", "Invalid onlyContainsUserCerts CRL Test11",      44 ],
 732     [ "4.14.12", "Invalid onlyContainsCACerts CRL Test12",        44 ],
 733     [ "4.14.13", "Valid onlyContainsCACerts CRL Test13",          0 ],
 734     [ "4.14.14", "Invalid onlyContainsAttributeCerts Test14",     44 ],
 735     [ "4.14.15", "Invalid onlySomeReasons Test15",                23 ],
 736     [ "4.14.16", "Invalid onlySomeReasons Test16",                23 ],
 737     [ "4.14.17", "Invalid onlySomeReasons Test17",                3 ],
 738     [ "4.14.18", "Valid onlySomeReasons Test18",                  0 ],
 739     [ "4.14.19", "Valid onlySomeReasons Test19",                  0 ],
 740     [ "4.14.20", "Invalid onlySomeReasons Test20",                23 ],
 741     [ "4.14.21", "Invalid onlySomeReasons Test21",                23 ],
 742     [ "4.14.22", "Valid IDP with indirectCRL Test22",             0 ],
 743     [ "4.14.23", "Invalid IDP with indirectCRL Test23",           23 ],
 744     [ "4.14.24", "Valid IDP with indirectCRL Test24",             0 ],
 745     [ "4.14.25", "Valid IDP with indirectCRL Test25",             0 ],
 746     [ "4.14.26", "Invalid IDP with indirectCRL Test26",           44 ],
 747     [ "4.14.27", "Invalid cRLIssuer Test27",                      3 ],
 748     [ "4.14.28", "Valid cRLIssuer Test28",                        0 ],
 749     [ "4.14.29", "Valid cRLIssuer Test29",                        0 ],
 750
 751     # Although this test is valid it has a circular dependency. As a result
 752     # an attempt is made to reursively checks a CRL path and rejected due to
 753     # a CRL path validation error. PKITS notes suggest this test does not
 754     # need to be run due to this issue.
 755     [ "4.14.30", "Valid cRLIssuer Test30",                                 54 ],
 756     [ "4.14.31", "Invalid cRLIssuer Test31",                               23 ],
 757     [ "4.14.32", "Invalid cRLIssuer Test32",                               23 ],
 758     [ "4.14.33", "Valid cRLIssuer Test33",                                 0 ],
 759     [ "4.14.34", "Invalid cRLIssuer Test34",                               23 ],
 760     [ "4.14.35", "Invalid cRLIssuer Test35",                               44 ],
 761     [ "4.15",    "Delta-CRLs" ],
 762     [ "4.15.1",  "Invalid deltaCRLIndicator No Base Test1",                3 ],
 763     [ "4.15.2",  "Valid delta-CRL Test2",                                  0 ],
 764     [ "4.15.3",  "Invalid delta-CRL Test3",                                23 ],
 765     [ "4.15.4",  "Invalid delta-CRL Test4",                                23 ],
 766     [ "4.15.5",  "Valid delta-CRL Test5",                                  0 ],
 767     [ "4.15.6",  "Invalid delta-CRL Test6",                                23 ],
 768     [ "4.15.7",  "Valid delta-CRL Test7",                                  0 ],
 769     [ "4.15.8",  "Valid delta-CRL Test8",                                  0 ],
 770     [ "4.15.9",  "Invalid delta-CRL Test9",                                23 ],
 771     [ "4.15.10", "Invalid delta-CRL Test10",                               12 ],
 772     [ "4.16",    "Private Certificate Extensions" ],
 773     [ "4.16.1",  "Valid Unknown Not Critical Certificate Extension Test1", 0 ],
 774     [ "4.16.2",  "Invalid Unknown Critical Certificate Extension Test2",   34 ],
 775 );
 776
 777
 778 my $verbose = 1;
 779
 780 my $numtest = 0;
 781 my $numfail = 0;
 782
 783 my $ossl = "ossl/apps/openssl";
 784
 785 my $ossl_cmd = "$ossl_path cms -verify -verify_retcode ";
 786 $ossl_cmd .= "-CAfile pkitsta.pem -crl_check_all -x509_strict ";
 787
 788 # Check for expiry of trust anchor
 789 system "$ossl_path x509 -inform DER -in $pkitsta -checkend 0";
 790 if ($? == 256)
 791         {
 792         print STDERR "WARNING: using older expired data\n";
 793         $ossl_cmd .= "-attime 1291940972 ";
 794         }
 795
 796 $ossl_cmd .= "-policy_check -extended_crl -use_deltas -out /dev/null 2>&1 ";
 797
 798 system "$ossl_path x509 -inform DER -in $pkitsta -out pkitsta.pem";
 799
 800 die "Can't create trust anchor file" if $?;
 801
 802 print "Running PKITS tests:\n" if $verbose;
 803
 804 foreach (@testlists) {
 805     my $argnum = @$_;
 806     if ( $argnum == 2 ) {
 807         my ( $tnum, $title ) = @$_;
 808         print "$tnum $title\n" if $verbose;
 809     }
 810     elsif ( $argnum == 3 ) {
 811         my ( $tnum, $title, $exp_ret ) = @$_;
 812         my $filename = $title;
 813         $exp_ret += 32 if $exp_ret;
 814         $filename =~ tr/ -//d;
 815         $filename = "Signed${filename}.eml";
 816         if ( !-f "$pkitsdir/$filename" ) {
 817             print "\"$filename\" not found\n";
 818         }
 819         else {
 820             my $ret;
 821             my $test_fail = 0;
 822             my $errmsg    = "";
 823             my $cmd       = $ossl_cmd;
 824             $cmd .= "-in $pkitsdir/$filename -policy anyPolicy";
 825             my $cmdout = `$cmd`;
 826             $ret = $? >> 8;
 827             if ( $? & 0xff ) {
 828                 $errmsg .= "Abnormal OpenSSL termination\n";
 829                 $test_fail = 1;
 830             }
 831             if ( $exp_ret != $ret ) {
 832                 $errmsg .= "Return code:$ret, ";
 833                 $errmsg .= "expected $exp_ret\n";
 834                 $test_fail = 1;
 835             }
 836             if ($test_fail) {
 837                 print "$tnum $title : Failed!\n";
 838                 print "Filename: $pkitsdir/$filename\n";
 839                 print $errmsg;
 840                 print "Command output:\n$cmdout\n";
 841                 $numfail++;
 842             }
 843             $numtest++;
 844         }
 845     }
 846     elsif ( $argnum == 7 ) {
 847         my ( $tnum, $title, $exargs, $exp_epol, $exp_aset, $exp_uset, $exp_ret )
 848           = @$_;
 849         my $filename = $title;
 850         $exp_ret += 32 if $exp_ret;
 851         $filename =~ tr/ -//d;
 852         $filename = "Signed${filename}.eml";
 853         if ( !-f "$pkitsdir/$filename" ) {
 854             print "\"$filename\" not found\n";
 855         }
 856         else {
 857             my $ret;
 858             my $cmdout    = "";
 859             my $errmsg    = "";
 860             my $epol      = "";
 861             my $aset      = "";
 862             my $uset      = "";
 863             my $pol       = -1;
 864             my $test_fail = 0;
 865             my $cmd       = $ossl_cmd;
 866             $cmd .= "-in $pkitsdir/$filename $exargs -policy_print";
 867             @oparr = `$cmd`;
 868             $ret   = $? >> 8;
 869
 870             if ( $? & 0xff ) {
 871                 $errmsg .= "Abnormal OpenSSL termination\n";
 872                 $test_fail = 1;
 873             }
 874             foreach (@oparr) {
 875                 my $test_failed = 0;
 876                 $cmdout .= $_;
 877                 if (/^Require explicit Policy: (.*)$/) {
 878                     $epol = $1;
 879                 }
 880                 if (/^Authority Policies/) {
 881                     if (/empty/) {
 882                         $aset = "<empty>";
 883                     }
 884                     else {
 885                         $pol = 1;
 886                     }
 887                 }
 888                 $test_fail = 1 if (/leak/i);
 889                 if (/^User Policies/) {
 890                     if (/empty/) {
 891                         $uset = "<empty>";
 892                     }
 893                     else {
 894                         $pol = 2;
 895                     }
 896                 }
 897                 if (/\s+Policy: (.*)$/) {
 898                     if ( $pol == 1 ) {
 899                         $aset .= ":" if $aset ne "";
 900                         $aset .= $1;
 901                     }
 902                     elsif ( $pol == 2 ) {
 903                         $uset .= ":" if $uset ne "";
 904                         $uset .= $1;
 905                     }
 906                 }
 907             }
 908
 909             if ( $epol ne $exp_epol ) {
 910                 $errmsg .= "Explicit policy:$epol, ";
 911                 $errmsg .= "expected $exp_epol\n";
 912                 $test_fail = 1;
 913             }
 914             if ( $aset ne $exp_aset ) {
 915                 $errmsg .= "Authority policy set :$aset, ";
 916                 $errmsg .= "expected $exp_aset\n";
 917                 $test_fail = 1;
 918             }
 919             if ( $uset ne $exp_uset ) {
 920                 $errmsg .= "User policy set :$uset, ";
 921                 $errmsg .= "expected $exp_uset\n";
 922                 $test_fail = 1;
 923             }
 924
 925             if ( $exp_ret != $ret ) {
 926                 print "Return code:$ret, expected $exp_ret\n";
 927                 $test_fail = 1;
 928             }
 929
 930             if ($test_fail) {
 931                 print "$tnum $title : Failed!\n";
 932                 print "Filename: $pkitsdir/$filename\n";
 933                 print "Command output:\n$cmdout\n";
 934                 $numfail++;
 935             }
 936             $numtest++;
 937         }
 938     }
 939 }
 940
 941 if ($numfail) {
 942     print "$numfail tests failed out of $numtest\n";
 943 }
 944 else {
 945     print "All Tests Successful.\n";
 946 }
 947
 948 unlink "pkitsta.pem";
 949