tests: added suite for checking PKCS#7 structure import

The initial (problematic) structures have been obtained from oss-fuzz
project.

diff --git a/tests/Makefile.am b/tests/Makefile.am
index b5f58ac5a7478b54196e8f1ff104b623b1d365ad..2e769483d17b11b0c211d249a095ba16d9cb2d67 100644 (file)
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -36,7 +36,9 @@ EXTRA_DIST = suppressions.valgrind eagain-common.h cert-common.h test-chains.h \
        certs-interesting/README.md certs-interesting/cert1.der certs-interesting/cert1.der.err \
        certs-interesting/cert2.der certs-interesting/cert2.der.err certs-interesting/cert3.der \
        certs-interesting/cert3.der.err certs-interesting/cert4.der certs-interesting/cert5.der \
-       certs-interesting/cert6.der
+       certs-interesting/cert6.der \
+       certs-interesting/cert3.der.err certs-interesting/cert4.der pkcs7-interesting/pkcs7-1.der \
+       pkcs7-interesting/pkcs7-1.der.err pkcs7-interesting/pkcs7-2.der pkcs7-interesting/pkcs7-2.der.err
 
 AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
 AM_CPPFLAGS = \
@@ -121,7 +123,7 @@ ctests = mini-record-2 simple gc set_pkcs12_cred cert certuniqueid  \
         set_known_dh_params_anon set_known_dh_params_psk session-tickets-ok \
         session-tickets-missing set_x509_key_file_legacy status-request-ext \
         rng-no-onload dtls1-2-mtu-check crl_apis cert_verify_inv_utf8 \
-        hostname-check-utf8 pkcs8-key-decode-encrypted priority-mix
+        hostname-check-utf8 pkcs8-key-decode-encrypted priority-mix pkcs7
 
 if HAVE_SECCOMP_TESTS
 ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp

diff --git a/tests/pkcs7-interesting/pkcs7-1.der b/tests/pkcs7-interesting/pkcs7-1.der
new file mode 100644 (file)
index 0000000..06f6f9c
Binary files /dev/null and b/tests/pkcs7-interesting/pkcs7-1.der differ

diff --git a/tests/pkcs7-interesting/pkcs7-1.der.err b/tests/pkcs7-interesting/pkcs7-1.der.err
new file mode 100644 (file)
index 0000000..55232a5
--- /dev/null
+++ b/tests/pkcs7-interesting/pkcs7-1.der.err
@@ -0,0 +1 @@
+-73

diff --git a/tests/pkcs7-interesting/pkcs7-2.der b/tests/pkcs7-interesting/pkcs7-2.der
new file mode 100644 (file)
index 0000000..9c38f9f
Binary files /dev/null and b/tests/pkcs7-interesting/pkcs7-2.der differ

diff --git a/tests/pkcs7-interesting/pkcs7-2.der.err b/tests/pkcs7-interesting/pkcs7-2.der.err
new file mode 100644 (file)
index 0000000..55232a5
--- /dev/null
+++ b/tests/pkcs7-interesting/pkcs7-2.der.err
@@ -0,0 +1 @@
+-73

diff --git a/tests/pkcs7.c b/tests/pkcs7.c
new file mode 100644 (file)
index 0000000..a490976
--- /dev/null
+++ b/tests/pkcs7.c
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2006-2012 Free Software Foundation, Inc.
+ * Copyright (C) 2016 Red Hat, Inc.
+ *
+ * Author: Simon Josefsson, Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include <gnutls/pkcs7.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <dirent.h>
+
+#include "utils.h"
+
+/* This program will load certificates from CERT_DIR and try to print
+ * them. If CERT_DIR/certname.err is available, it should contain the
+ * error code that gnutls_x509_crt_import() should return.
+ */
+
+#define CERT_DIR "pkcs7-interesting"
+
+static int getnextfile(DIR **dirp, gnutls_datum_t *der, int *exp_ret)
+{
+       struct dirent *d;
+       char path[256];
+       char cert_dir[256];
+       const char *src;
+       int ret;
+       gnutls_datum_t local;
+
+       src = getenv("srcdir");
+       if (src == NULL)
+               src = ".";
+
+       snprintf(cert_dir, sizeof(cert_dir), "%s/%s", src, CERT_DIR);
+
+       if (*dirp == NULL) {
+               *dirp = opendir(cert_dir);
+               if (*dirp == NULL)
+                       return -1;
+       }
+
+       do {
+               d = readdir(*dirp);
+               if (d != NULL
+#ifdef _DIRENT_HAVE_D_TYPE
+                       && d->d_type == DT_REG
+#endif
+                       ) {
+                       if (strstr(d->d_name, ".der") == 0)
+                               continue;
+                       if (strstr(d->d_name, ".err") != 0)
+                               continue;
+                       snprintf(path, sizeof(path), "%s/%s", cert_dir, d->d_name);
+
+                       success("Loading %s\n", path);
+                       ret = gnutls_load_file(path, der);
+                       if (ret < 0) {
+                               return -1;
+                       }
+
+                       snprintf(path, sizeof(path), "%s/%s.err", cert_dir, d->d_name);
+                       success("Loading errfile %s\n", path);
+                       ret = gnutls_load_file(path, &local);
+                       if (ret < 0) { /* not found assume success */
+                               *exp_ret = 0;
+                       } else {
+                               *exp_ret = atoi((char*)local.data);
+                               success("expecting error code %d\n", *exp_ret);
+                               gnutls_free(local.data);
+                               local.data = NULL;
+                       }
+
+                       return 0;
+               }
+       } while(d != NULL);
+
+       closedir(*dirp);
+       return -1; /* finished */
+}
+
+void doit(void)
+{
+       int ret, exp_ret;
+       gnutls_pkcs7_t cert;
+       gnutls_datum_t der;
+       DIR *dirp = NULL;
+
+       ret = global_init();
+       if (ret < 0)
+               fail("init %d\n", ret);
+
+       while (getnextfile(&dirp, &der, &exp_ret)==0) {
+               ret = gnutls_pkcs7_init(&cert);
+               if (ret < 0)
+                       fail("crt_init %d\n", ret);
+
+               ret = gnutls_pkcs7_import(cert, &der, GNUTLS_X509_FMT_DER);
+               if (ret != exp_ret) {
+                       fail("crt_import %s\n", gnutls_strerror(ret));
+               }
+
+               if (ret == 0) {
+                       /* attempt to fully decode */
+                       gnutls_datum_t out;
+                       ret = gnutls_pkcs7_print(cert, GNUTLS_CRT_PRINT_FULL, &out);
+                       if (ret < 0) {
+                               fail("print: %s\n", gnutls_strerror(ret));
+                       }
+                       gnutls_free(out.data);
+               }
+
+               gnutls_pkcs7_deinit(cert);
+               gnutls_free(der.data);
+               der.data = NULL;
+               der.size = 0;
+               exp_ret = -1;
+       }
+
+       gnutls_global_deinit();
+}