Manuel Pégourié-Gonnard
3bdcda79e5
Add test for expired cert in longer chain
...
That's two lines that were not covered in verify_child()
2018-03-05 12:53:23 +01:00
Gilles Peskine
7fb29b17c7
Merge branch 'development' into development-restricted
2017-11-28 18:46:09 +01:00
Gilles Peskine
ea8d697fa2
Merge remote-tracking branch 'upstream-public/pr/1089' into development
...
Resolve trivial conflict due to additions in the same place in
tests/data_files/Makefile; minor comment/whitespace presentation
improvements.
2017-11-28 17:32:32 +01:00
Gilles Peskine
2507267cd4
Merge branch 'development' into development-restricted
2017-11-24 16:05:49 +01:00
Gilles Peskine
e7707228b4
Merge remote-tracking branch 'upstream-public/pr/1062' into development
2017-11-24 15:35:50 +01:00
Gilles Peskine
28a0c72795
RSA: Fix buffer overflow in PSS signature verification
...
Fix buffer overflow in RSA-PSS signature verification when the hash is
too large for the key size. Found by Seth Terashima, Qualcomm.
Added a non-regression test and a positive test with the smallest
permitted key size for a SHA-512 hash.
2017-10-17 19:01:38 +02:00
Hanno Becker
08a36dde80
Unify naming schemes for RSA keys
2017-09-29 20:05:23 +01:00
Hanno Becker
cc56628117
Don't use all_final as a target in tests/data_files/Makefile
...
The `neat` target in that Makefile assumes all_final to be a concatenation of
file names.
2017-09-26 16:21:19 +01:00
Hanno Becker
81535d0011
Minor style and typo corrections
2017-09-14 07:51:54 +01:00
Hanno Becker
476986547b
Omit version from X.509 v1 certificates
...
The version field in an X.509 certificate is optional and defaults to v1, so it
may be omitted in this case.
2017-09-14 07:51:54 +01:00
Hanno Becker
418a62242b
Extend tests/data_files/Makefile to include CRT's for CRT write test
2017-09-14 07:51:28 +01:00
Hanno Becker
5a4f172522
Add suffix for 1024-bit RSA key files
...
Previously, 2048-bit and 4096-bit RSA key files had their bitsize indicated in their filename, while the original
1024-bit keys hadn't. This commit unifies the naming scheme by always indicating the bitsize in the filename.
2017-09-07 15:40:30 +01:00
Hanno Becker
c8063c58f0
Correct Makefile in tests/data_files
...
The documentation of the target `all_final` was no longer accurate, and numerous non-file targets were missing in the
.PHONY section.
2017-09-07 15:30:12 +01:00
Hanno Becker
8fdfc98676
Update keyfiles
...
This commit replaces the previous keyfiles with those generated by the commands added in the previous commit.
2017-09-05 10:08:37 +01:00
Hanno Becker
d16f6126c7
Add RSA key generation commands to test Makefile
...
This commit adds the commands used to generate the various RSA keys to tests/Makefile so that they can be easily
regenerated or modified, e.g. if larger key sizes or other encryption algorithms need to be tested in the future.
2017-09-05 10:08:37 +01:00
Hanno Becker
37c6b6b339
Add tests for encrypted 2048 and 4096-bit RSA keys
2017-08-26 09:22:14 +01:00
Hanno Becker
e908c3de67
Improve Readme for long test certificate chains
2017-07-26 13:49:38 +01:00
Janos Follath
745bcf454f
Fix typos
2017-07-21 14:04:31 +01:00
Manuel Pégourié-Gonnard
5be13d8fd1
Make test script more portable
...
seq isn't POSIX and isn't present by default on BSDs
2017-07-06 14:31:54 +02:00
Manuel Pégourié-Gonnard
1beb048316
Add test for limit on intermediate certificates
...
Inspired by test code provided by Nicholas Wilson in PR #351 .
The test will fail if someone sets MAX_INTERMEDIATE_CA to a value larger than
18 (default is 8), which is hopefully unlikely and can easily be fixed by
running long.sh again with a larger value if it ever happens.
Current behaviour is suboptimal as flags are not set, but currently the goal
is only to document/test existing behaviour.
2017-07-06 11:57:31 +02:00
Gilles Peskine
fd14bca6dc
Document test data makefile
2017-06-06 18:44:14 +02:00
Gilles Peskine
bc70a1836b
Test that SHA-1 defaults off
...
Added tests to validate that certificates signed using SHA-1 are
rejected by default, but accepted if SHA-1 is explicitly enabled.
2017-06-06 18:44:14 +02:00
Gilles Peskine
f040a17604
Added SHA256 test certificates
...
With SHA-1 deprecation, we need a few certificates using algorithms in
the default support list. Most tests still use SHA-1 though.
The generation process for the new certificates is recorded in the makefile.
2017-06-06 18:44:13 +02:00
Simon Butcher
fc794ff2b7
Merge branch 'iotssl-1071-ca-flags'
...
Fixes a regression introduced by an earlier commit that modified
x509_crt_verify_top() to ensure that valid certificates that are after past or
future valid in the chain are processed. However the change introduced a change
in behaviour that caused the verification flags MBEDTLS_X509_BADCERT_EXPIRED and
MBEDTLS_BADCERT_FUTURE to always be set whenever there is a failure in the
verification regardless of the cause.
The fix maintains both behaviours:
* Ensure that valid certificates after future and past are verified
* Ensure that the correct verification flags are set.
2017-02-27 19:06:05 +00:00
Andres AG
9f430c15d8
Add tests for out flags from x509_crt_verify_top()
...
The tests load certificate chains from files. The CA chains contain a
past or future certificate and an invalid certificate. The test then
checks that the flags set are MBEDTLS_X509_BADCERT_EXPIRED or
MBEDTLS_X509_BADCERT_FUTURE.
2017-01-20 13:52:01 +00:00
Andres AG
a39db394db
Add test for infinite loop in CRL parse
2017-01-19 17:10:51 +00:00
Simon Butcher
4b852db299
Merge branch 'iotssl-629-der-trailing-bytes'
...
Fixes bug in mbedtls_x509_crt_parse that caused trailing extra data in the
buffer following DER certificates to be included in the raw representation.
2016-03-12 23:28:26 +00:00
Simon Butcher
f59e66ba24
Remove redundant test certificates and clarify ChangeLog
2016-03-09 19:32:10 +00:00
Janos Follath
df4bca2029
X509: Future CA among trusted: add more tests
2016-03-09 19:32:10 +00:00
Janos Follath
12c868c5d6
X509: Future CA among trusted: add unit tests
2016-03-09 19:32:10 +00:00
Janos Follath
0b2423403c
x509: trailing bytes in DER: add integration tests
2016-02-17 10:11:21 +00:00
Manuel Pégourié-Gonnard
8b4331aa56
Add test case for root with max_pathlen=0
...
This was already working but not tested so far
(Test case from previous commit still failing.)
Test certificates generated with:
programs/pkey/gen_key type=ec ec_curve=secp256r1 filename=cert91.key
programs/pkey/gen_key type=ec ec_curve=secp256r1 filename=cert92.key
programs/x509/cert_write serial=91 output_file=cert91.crt is_ca=1 \
issuer_key=cert91.key issuer_name="CN=Root 9,O=mbed TLS,C=UK" \
selfsign=1 max_pathlen=0
programs/x509/cert_write serial=92 output_file=cert92.crt \
issuer_key=cert91.key issuer_name="CN=Root 9,O=mbed TLS,C=UK" \
subject_key=cert92.key subject_name="CN=EE 92,O=mbed TLS,C=UK"
mv cert9?.crt tests/data_files/dir4
rm cert9?.key
2015-11-19 11:10:33 +01:00
Manuel Pégourié-Gonnard
a3aa43da5f
Add test case for first intermediate max_pathlen=0
...
!!! This test case is currently failing !!!
(See fix in next-next commit.)
Test certificates generated with the following script:
programs/pkey/gen_key type=ec ec_curve=secp256r1 filename=cert81.key
programs/pkey/gen_key type=ec ec_curve=secp256r1 filename=cert82.key
programs/pkey/gen_key type=ec ec_curve=secp256r1 filename=cert83.key
programs/x509/cert_write serial=81 output_file=cert81.crt is_ca=1 \
issuer_key=cert81.key issuer_name="CN=Root 8,O=mbed TLS,C=UK" \
selfsign=1
programs/x509/cert_write serial=82 output_file=cert82.crt is_ca=1 \
issuer_key=cert81.key issuer_name="CN=Root 8,O=mbed TLS,C=UK" \
subject_key=cert82.key subject_name="CN=Int 82,O=mbed TLS,C=UK" \
max_pathlen=0
programs/x509/cert_write serial=83 output_file=cert83.crt \
issuer_key=cert82.key issuer_name="CN=Int 82,O=mbed TLS,C=UK" \
subject_key=cert83.key subject_name="CN=EE 83,O=mbed TLS,C=UK"
mv cert8?.crt tests/data_files/dir4
rm cert8?.key
2015-11-19 10:56:30 +01:00
Manuel Pégourié-Gonnard
0a543a8bc5
Merge pull request #320 from Inikup/fix-issue-318
...
Fix boolean values according to DER specs
2015-11-02 05:52:42 +09:00
Jonathan Leroy
00ee6eee54
Test certificate "Server1 SHA1, key_usage" reissued.
2015-10-14 13:15:22 +02:00
Janos Follath
ef4f2588f3
Additional corner cases for testing pathlen constrains. Just in case.
2015-10-11 16:17:27 +02:00
Janos Follath
822b2c33b9
Added test case for pathlen constrains in intermediate certificates
2015-10-11 10:39:15 +02:00
Manuel Pégourié-Gonnard
560fea3767
Add tests for verify callback
...
As we're about to change the chain construction logic, we want to make sure
the callback will still be called exactly when it should, and not on the
(upcoming) ignored certs in the chain.
2015-09-01 17:24:42 +02:00
Manuel Pégourié-Gonnard
052d10c9d5
Accept a trailing space at end of PEM lines
...
With certs being copy-pasted from webmails and all, this will probably become
more and more common.
closes #226
2015-07-31 11:11:26 +02:00
Manuel Pégourié-Gonnard
9a702255f4
Add parsing/printing for new X.509 keyUsage flags
2015-06-23 13:09:10 +02:00
Manuel Pégourié-Gonnard
6ea831dcf4
Add tests for mbedtls_set_hs_ca_chain()
2015-06-22 17:30:18 +02:00
Manuel Pégourié-Gonnard
7a010aabde
Add tests for dhm_min_bitlen
2015-06-17 14:27:38 +02:00
Manuel Pégourié-Gonnard
5119df2022
Add test case for dh params with privateValueLength
2015-04-15 13:50:29 +02:00
Manuel Pégourié-Gonnard
e6c8366b46
Fix bug in pk_parse_key()
2015-04-15 11:21:24 +02:00
Paul Bakker
6152b0267c
Fixed typos
2015-04-14 15:00:09 +02:00
Manuel Pégourié-Gonnard
39ead3ef2f
Add test certificate for bitstring in DN
2015-03-27 13:11:33 +01:00
Manuel Pégourié-Gonnard
57a5d60abb
Add tests for concatenated CRLs
2014-11-19 16:08:34 +01:00
Manuel Pégourié-Gonnard
4be3449dbc
Add Readme about X.509 test files
2014-11-19 14:03:59 +01:00
Manuel Pégourié-Gonnard
9c911da68f
Add tests for X.509 name encoding mismatch
2014-10-17 12:42:31 +02:00
Manuel Pégourié-Gonnard
64938c63f0
Accept spaces at end of line/buffer in base64
2014-10-15 23:53:33 +02:00
