From: Matt Caswell <matt@openssl.org>
Date: Tue, 7 Mar 2023 17:07:57 +0000 (+0000)
Subject: Add a Certificate Policies Test
X-Git-Tag: openssl-3.2.0-alpha1~1091
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=591feddc61f113827883ad8bae05109ee01ccd41;p=thirdparty%2Fopenssl.git

Add a Certificate Policies Test

Test that a valid certificate policy is accepted and that an invalid
certificate policy is rejected. Specifically we are checking that a
leaf certificate with an invalid policy is detected.

Related-to: CVE-2023-0465

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20585)
---

diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
index b60ed5a77d3..58f9de410fc 100644
--- a/test/recipes/25-test_verify.t
+++ b/test/recipes/25-test_verify.t
@@ -29,7 +29,7 @@ sub verify {
     run(app([@args]));
 }
 
-plan tests => 183;
+plan tests => 185;
 
 # Canonical success
 ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
@@ -558,3 +558,14 @@ SKIP: {
     ok(run(app([ qw(openssl verify -trusted), $rsapluscert_file, $cert_file ])),
        'Mixed key + cert file test');
 }
+
+# Certificate Policies
+ok(verify("ee-cert-policies", "", ["root-cert"], ["ca-pol-cert"],
+          "-policy_check", "-policy", "1.3.6.1.4.1.16604.998855.1",
+          "-explicit_policy"),
+   "Certificate policy");
+
+ok(!verify("ee-cert-policies-bad", "", ["root-cert"], ["ca-pol-cert"],
+           "-policy_check", "-policy", "1.3.6.1.4.1.16604.998855.1",
+           "-explicit_policy"),
+   "Bad certificate policy");