From 57a2d16e60f7eb0ebfdedd82cb5e4e5fc198faf1 Mon Sep 17 00:00:00 2001 From: Daniel McCarney Date: Wed, 1 Nov 2023 16:38:48 -0400 Subject: [PATCH] tests: add LE chain test to verification_real_world In particular this testcase ensures that we can validate a chain from EE->intermediate->trust anchor for a chain where one or more certificates (in this case, the intermediate) are missing an authority information access (AIA) extension that specifies an OCSP access method and URI. --- .../letsencrypt_org_valid_1.crt | Bin 0 -> 1137 bytes .../letsencrypt_org_valid_2.crt | Bin 0 -> 1306 bytes .../letsencrypt_org_valid_3.crt | Bin 0 -> 1380 bytes src/tests/verification_real_world/mod.rs | 15 +++++++++++++++ 4 files changed, 15 insertions(+) create mode 100644 src/tests/verification_real_world/letsencrypt_org_valid_1.crt create mode 100644 src/tests/verification_real_world/letsencrypt_org_valid_2.crt create mode 100644 src/tests/verification_real_world/letsencrypt_org_valid_3.crt diff --git a/src/tests/verification_real_world/letsencrypt_org_valid_1.crt b/src/tests/verification_real_world/letsencrypt_org_valid_1.crt new file mode 100644 index 0000000000000000000000000000000000000000..4dbed56cf492480e6f2b59bbf47b584aa0cc1362 GIT binary patch literal 1137 zcmXqLV#zgVVh&xv%*4pVB*c7eugSqP6;12juR9zibm#jFHUnNZPOUbNw(q=*jNGgY z21bV52Apinp)72|OrgPsVg@204wo>mPil#Jv4U$}a#3YL2}}{QFjJ7Rft)z6k+FfL zk)@G=iGh(x6o_kRWMl#68b=w37z!B(fQ(@l=FCY2nxL0olx`4dAk4-NwECPa6C)c3 zn8D1*&g{g%a@q3XvX`uX&d$qS{r`=-(9{2OLN0eQUTip^$ND;9*$#oc3}iuk zRThw^IJDUqSy|bcfmTCVOa?q4Xmh0I0t=4;mjMSGTY4i8BNL-R6C)EF7ck&h z7_U__u`sbTer9R>!0?WtlwrHwZr2`Pt-==vy$*s}I|X5FywLvW)GPz1)~AnFehR(3anrFMWw zb6Wp!zk6t>AA{8T4dUCP<~q%qFx^sFSie0i{6M_0?*_2 z3b$Fw@A?#e?P~sRt@rkyO+oYQgR$~O8y!o^@{fcny;EQL&$jPkR8bp;>nhWA%?r1g KS&JYE{~5g;AP{~YV&CO&dbQi&B|cl zZ^&)H$;KSY!Y0fV8f>U(pbp}22`hN!m82HsrIsiJrzV#cWtLPb1f>?ICKe@UD7Y8p zmlha`8VG}wG7Ix~1_!w-1m)+KC`1?<$cghB85md^m>7UT6p(9bU}i>{#klr@pXRpDI%e!;XU(K zEV7jR+GOLj(l76;^&6z(8 z#AA0A<^OIxy7p3Agsu4T=bXDgYJYFLbMRJS>=n1iXV$77?AVi#UYfS~qr~?`G0%ek zTXk%6U;1BI;?)e!a{IZ#KhHBh{kp6`Tx5OnlK(R|Po8@xcsbiYk5<`*nd?+bcMG2h zV*dIzaAEgtQ6^?a2FArrj2yraVKLwX2B<7QBjbM-7GNT1Gmr)GRarnG&7sZ4$jZvj z%mimK8VG@;g+aGrR#$eo~%5Jf`OcY%mS$e637aZkrgU|Y*%2BHjp&nU}H;f0^%a4a^@zWr&>?>x!W!N-s;l2=W2SzrWwg=OMT_0*&3%7h3Gae zcy;*g4~6~lXSNqGY|pd)7B}VI6NUN9-gj?ee!gg{n9amW8&X z%-(q}=2Oav1N$lu`1j?y@Wf5pt@piK;Nc5d7tPy|3U8BlD*g~sn=(0kfov+vK`y0r z0=&-C7fQ(2J$TS&zBOv&UW5JZdD>e475$`H4}X=I{vmG7;iWsWKIrYSHs1Np``(#9 zPu90^x7i;EbvFB!@z6{>t8eDT|4SW~n`}RDA=%Q@vNZ40uCf!8nO?5+&JjPy!*p|R z$I5B||t$-I`!kiAsP`9|pUq9dAo-;c!loml7AVsQOaYrMq5%H7Z7 z3cA@JwoN{~v;R(Fp{myU`)^ePf-<@%-FbR#>*HIs7us`L6b;ukef_<2^@&b#+lM|+ zE%?6e)!sX;QRMa2+qMeJ>mn~d`VsLndWXl^e=+`In*ZcNmDisT+|c`~X7U7a{l9A# zak{(Ne|WiJ`+p7J45Mr5adMf9C-3+=w_Bh4Qjqhqe53GGU!%tR7QwBtb+KuhuXfyh uGIi_Otzkk=XOH+DQ?+mj$bEB;AyneuOV5-mey66-*%E!Ac*W`+?uP)U>;Po| literal 0 HcmV?d00001 diff --git a/src/tests/verification_real_world/letsencrypt_org_valid_3.crt b/src/tests/verification_real_world/letsencrypt_org_valid_3.crt new file mode 100644 index 0000000000000000000000000000000000000000..79a33ba5908c84a1d790715853f435daee569995 GIT binary patch literal 1380 zcmZ8hX;4#F7|qM_2mwM&*eu$Fr2?YKjgd_dWM4Hxumr^pF+@P)OL%!<8I(e(5iA&| zqJoT;#TJS}2W4?ki&C*_of<7=P#~xk;1SKNl#73 zL{gR@JrxmQN>sv%N0kbU6)a3(BsVrTIO`YaHLTUzetqh8$~a7QeHi@9kthc*3o8$h*(; z>xh^i%o)0PNl$;_a4P!xVRc4&)b8Cn=BEM-gTGL*US4Q~u_wbYZ zDfms zEcV=m+^FFg`e)|yQi5C6h`@Q4@$l*LPTIw&l7Qk`QLOI#A(OH>amFlrRJNnMV5B%{ zeU3EqneWkEITQV7PjOatYiT1?-9y?Do5l8p`h{N}<4wvnp5)_`qh2R0Je6k_sc7@c z$}5C7k)*zYK~l@=-oWYeQ08%pW#7;rSLsX-j;pQoLHYH1)08YE+^gfa^NC-io&FN- zE$)T`-TV{%2UpEI-(FU?y*6eOGpxFzwQfT!qV_#=0Ij2wvJ?OGkIl9=BWOys9MT2< z+^7}N3KISAn@@(fGWG`_!!F*zCXX;7vKI90$nb12>9`I+QbfDTxBUA9$%kud-Bfow zt`-vQYYGX0)xD$__FZky>-VdD!|Eee7Y$^d%IswB`EKKK&5ZY}6x}U%3yQ0Lp?}mm zsK-(3vU4P7$!=0!)VO8h;ny2(4!Xo5`YS2(ykI__0O6oo6%+*-45z1 zV7;~Lu{7wita7e}-xX3sR^FX4skGXKWb0;KI((AmYpRjY%j7gc^X2g$wKYGxLp>+v zx>+8)H+>?{;f&IjORWv6(Bs!${@~;~*<1Z|tiOQM!Vwzk@OJYaWjIrz+O_~17) zu&>n3$uxN&6dyyk^POI#>IOpo5|%eTxf&W;U9@xeoh90|Om%Bnkj3Kk?3fy-J53w& detY&nbKg{?>MOX?eQGZsGWX76zZsnL`3L9%8WsQm literal 0 HcmV?d00001 diff --git a/src/tests/verification_real_world/mod.rs b/src/tests/verification_real_world/mod.rs index 80314d76..6af3fc74 100644 --- a/src/tests/verification_real_world/mod.rs +++ b/src/tests/verification_real_world/mod.rs @@ -77,6 +77,14 @@ const VALID_UNRELATED_CHAIN: &[&[u8]] = &[ include_bytes!("agilebits_com_valid_4.crt"), ]; +const LETSENCRYPT_ORG: &str = "letsencrypt.org"; + +const VALID_LETSENCRYPT_ORG_CHAIN: &[&[u8]] = &[ + include_bytes!("letsencrypt_org_valid_1.crt"), + include_bytes!("letsencrypt_org_valid_2.crt"), + include_bytes!("letsencrypt_org_valid_3.crt"), +]; + macro_rules! real_world_test_cases { { $( $name:ident => $test_case:expr ),+ , } => { real_world_test_cases!(@ $($name => $test_case),+,); @@ -202,6 +210,13 @@ real_world_test_cases! { expected_result: Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)), other_error: no_error!(), }, + letsencrypt => TestCase { + reference_id: LETSENCRYPT_ORG, + chain: VALID_LETSENCRYPT_ORG_CHAIN, + stapled_ocsp: None, + expected_result: Ok(()), + other_error: no_error!(), + }, // OCSP stapling works. //