From: Jonathan M. Wilbur <jonathan@wilbur.space>
Date: Fri, 13 Dec 2024 06:52:25 +0000 (+0000)
Subject: test: aAissuingDistributionPoint X.509v3 extension
X-Git-Tag: openssl-3.5.0-alpha1~723
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=635ad41cd94d77efeebe6306f97603d07cd4728b;p=thirdparty%2Fopenssl.git

test: aAissuingDistributionPoint X.509v3 extension

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26174)
---

diff --git a/test/certs/ext-aAissuingDistributionPoint.pem b/test/certs/ext-aAissuingDistributionPoint.pem
new file mode 100644
index 00000000000..90839e69f5a
--- /dev/null
+++ b/test/certs/ext-aAissuingDistributionPoint.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBtDCCAaCgAwIBAgIDAQIDMAsGCSqGSIb3DQEBBTAAMCIYDzIwMjEwODMxMDA1
+MjIzWhgPMjAyMTA4MzEwMDUyMjNaMAAwggEgMAsGCSqGSIb3DQEBAQOCAQ8AMIIB
+CgKCAQEAtnjLm1ts1hC4fNNt3UnQD9y73bDXgioTyWYSI3ca/KNfuTydjFTEYAmq
+nuGrBOUfgbmH3PRQ0AmpqljgWTb3d3K8H4UFvDWQTPSS21IMjm8oqd19nE5GxWir
+Gu0oDRzhWLHe1RZ7ZrohCPg/1Ocsy47QZuK2laFB0rEmrRWBmEYbDl3/wxf5XfqI
+qpOynJB02thXrTCcTM7Rz1FqCFt/ZVZB5hKY2S+CTdE9OIVKlr4WHMfuvUYeOj06
+GkwLFJHNv2tU+tovI3mYRxUuY4UupkS3MC+Otey7XKm1P+INjWWoegm6iCAt3Vus
+pVz+6pU2xgl3nrAVMQHB4fReQPH0pQIDAQABozswOTA3BgNVHT8EMDAuoCKgIKQe
+MBwxGjAYBgNVBAMMEVdpbGRib2FyIFNvZnR3YXJlgQIFIIIB/4QB/zALBgkqhkiG
+9w0BAQUDAQA=
+-----END CERTIFICATE-----
diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t
index 7117e3381ee..6be2d162160 100644
--- a/test/recipes/25-test_x509.t
+++ b/test/recipes/25-test_x509.t
@@ -16,7 +16,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;
 
 setup("test_x509");
 
-plan tests => 126;
+plan tests => 132;
 
 # Prevent MSys2 filename munging for arguments that look like file paths but
 # aren't
@@ -400,6 +400,7 @@ cert_contains($attr_map_cert,
 cert_contains($attr_map_cert,
               "commonName:asdf == localityName:03:3E",
               1, 'X.509 Attribute Mappings');
+
 my $aaa_cert = srctop_file(@certs, "ext-allowedAttributeAssignments.pem");
 cert_contains($aaa_cert,
               "Attribute Type: commonName",
@@ -408,6 +409,26 @@ cert_contains($aaa_cert,
               "Holder Domain: email:jonathan.wilbur",
               1, 'X.509 Allowed Attribute Assignments');
 
+my $aa_idp_cert = srctop_file(@certs, "ext-aAissuingDistributionPoint.pem");
+cert_contains($aa_idp_cert,
+              "DirName:CN = Wildboar",
+              1, 'X.509 Attribute Authority Issuing Distribution Point');
+cert_contains($aa_idp_cert,
+              "CA Compromise",
+              1, 'X.509 Attribute Authority Issuing Distribution Point');
+cert_contains($aa_idp_cert,
+              "Indirect CRL: TRUE",
+              1, 'X.509 Attribute Authority Issuing Distribution Point');
+cert_contains($aa_idp_cert,
+              "Contains User Attribute Certificates: TRUE",
+              1, 'X.509 Attribute Authority Issuing Distribution Point');
+cert_contains($aa_idp_cert,
+              "Contains Attribute Authority \\(AA\\) Certificates: TRUE",
+              1, 'X.509 Attribute Authority Issuing Distribution Point');
+cert_contains($aa_idp_cert,
+              "Contains Source Of Authority \\(SOA\\) Public Key Certificates: TRUE",
+              1, 'X.509 Attribute Authority Issuing Distribution Point');
+
 sub test_errors { # actually tests diagnostics of OSSL_STORE
     my ($expected, $cert, @opts) = @_;
     my $infile = srctop_file(@certs, $cert);