From afc70657c2cf84f3de135ef422e38071e0bd970b Mon Sep 17 00:00:00 2001
From: Andres Amaya Garcia <Andres.AmayaGarcia@arm.com>
Date: Thu, 1 Mar 2018 22:15:28 +0000
Subject: [PATCH] Add invalid arg and issuer tests for OCSP Resp vfy

---
 tests/data_files/Makefile                     |   5 +++
 .../data_files/ocsp-resp-issuer-is-signer.der | Bin 0 -> 1392 bytes
 .../data_files/ocsp-resp-no-certs-in-resp.der | Bin 0 -> 437 bytes
 tests/suites/test_suite_x509parse_ocsp.data   |  15 +++++++
 .../suites/test_suite_x509parse_ocsp.function |  37 ++++++++++++++----
 5 files changed, 50 insertions(+), 7 deletions(-)
 create mode 100644 tests/data_files/ocsp-resp-issuer-is-signer.der
 create mode 100644 tests/data_files/ocsp-resp-no-certs-in-resp.der

diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile
index a94a916ead..c7c859fdca 100644
--- a/tests/data_files/Makefile
+++ b/tests/data_files/Makefile
@@ -125,6 +125,11 @@ all_intermediate += ocsp-req-future-produced-at.der
 ocsp-resp-future-produced-at.der: ocsp-req-for-server2-in-database.der test-ca-index.txt test-ca-sha256.crt
 	$(FAKETIME) -f "+9y" $(OPENSSL) ocsp -rsigner test-ca-sha256.crt -index test-ca-index.txt -rkey $(test_ca_key_file_rsa) -CA test-ca-sha256.crt -noverify -reqin $< -respout $@
 all_final += ocsp-resp-future-produced-at.der
+ocsp-resp-issuer-is-signer.der: ocsp-req-for-server2-in-database.der test-ca-index.txt test-ca-sha256.crt
+	$(OPENSSL) ocsp -rsigner test-ca-sha256.crt -index test-ca-index.txt -rkey $(test_ca_key_file_rsa) -CA test-ca-sha256.crt -noverify -reqin $< -respout $@
+all_final += ocsp-resp-issuer-is-signed.der
+ocsp-resp-no-certs-in-resp.der: ocsp-req-for-server2-in-database.der test-ca-index.txt test-ca-sha256.crt
+	$(OPENSSL) ocsp -rsigner test-ca-sha256.crt -index test-ca-index.txt -rkey $(test_ca_key_file_rsa) -CA test-ca-sha256.crt -resp_key_id -resp_no_certs -noverify -reqin $< -respout $@
 
 ################################################################
 #### Meta targets
diff --git a/tests/data_files/ocsp-resp-issuer-is-signer.der b/tests/data_files/ocsp-resp-issuer-is-signer.der
new file mode 100644
index 0000000000000000000000000000000000000000..b0879aff4c41d1e4d7df94904de99f3508eb335a
GIT binary patch
literal 1392
zcmXqLV$I=VWLVI|nrhI*n#jhf&Bn;e%5K2O$kN0b1QhZ!Xk4<;*1+13+klgeIh2J>
zn90w_P|$!M#Np!M2*}S#ED8?xF_bhA2MICr2*89CLQ;!M6r3F;_>Bw<Eewne42_Ho
z%nVJU41x>-46K3Xv1;=%GfA;Bu!wMpW-PndE}y)1-ra2*&*!>*V&Y_H5!n*;Wa;L6
zmx8|Syt-^E|7*KF$N&CkViI6zV8Aq!myJ`a&7<u*FC)+c49rc8j0{UPTQA)Fz|>@Q
zp>#^s^<<TGIj0;K?%5`p5d84`0?RzrEowJEZB*VoBX!aXZHxAueR>IZ#oV5M+p{5l
z`eEm5>1Q*<CKvzC-lS(e)Ah-m?2lS?tP*x<6@@?BF7s_|+2fjha-l%Mf|9#Sug%}R
z-jy?=&Hk*@9<K@ORsIG^#veLiCwPdVD*Q<F-|I@BQzn$NXz|`R3M<V%KIijm$-QgC
zz4WIt-@B2sIIUn^)ak8@-!OC@ulU1tqT^rLh8i`Nq<Lyj?yjADv(|?B-fCkL=EBM0
z%l0=ly-?ogW0ag}A*p+l`{w$|+qIY$=;pi0yJZ&h2wI&y9#FZX^iajJJug-+iezny
zUC_kbZ_vct4aDsRO-%U<n3))vm>3xhkiv?am4TwjHINhMH8eLcH83$WGc`9bj1uQH
z0&z{DT*?e@VpKwQEF(B#`56qF7`d20F?`^@`5*D!52nqvZ@V|msMckv*n+c)A7@^9
z^XhbsL<Gl_rEg{*?Y=K1H`8KfyIl2wUd#Iyu>}?Em*?G_{9<QO;L&r74T4sFdhSpl
za@u845%-~|4nOUlF5}z$^Nm;XfgPF*C3C{9S1e_jQ223g^G*9}OCQ;2^}kn7IDBmW
z>0NIUYPUaYG1}+<J3>u~Ir_?$tG~ZKo~BoD;ECSeKYH&TIffoE(W_M{$~^79QN*FS
zHvLQ6H^bE*E0=8AswecbMf^ijzPg=o#KsU_#aYGX3k}ZaPrCE%<)1aT^)xQlF?lO5
z5dCD4n!@>tC$CRhd_m!f&9hIgetG!Q`Sxl34NOM!W=7;My2`}N$iTR`ajHS%Bm-Gs
z_LJpf5yPHs43a_8$}BMkQ4Lu0)k6Cvlx6cKV8Y@7St88BYQW6M_#ZjufXNJ;C1uth
zm)mmFsPd}O^tfwUcKaH1SH(SkbR<!4$KiLqm*wsV=9q0OQ&_)jt<dV+v&~6ol3L$b
zOL6}d;ku_>9k3?!&Y^yxy#}!?`z9>W>a?A`@z>+I$)d8eLo80Ey$H@KytwSIw9dUx
zbF(vJwBl8Qs`j4>H~q<WP<nyYR__Z%duN_ZzuNq==V_&)-{!u!*Jc(wmgKi?5V{ns
zD(rIc|0bIUmx68W_u5r6P5i=DP;+q`=O!_Bo5D{sUZ++t)M%>duFCt_{Ec_vj^{mc
zb7nU_i7uY$8l?L2o5cKFUe^HAFl#Fb7Qgk)S<#*LKX%C{-`S$G;mEJK8VXL+l@95*
L{QCawjG+erAZH);

literal 0
HcmV?d00001

diff --git a/tests/data_files/ocsp-resp-no-certs-in-resp.der b/tests/data_files/ocsp-resp-no-certs-in-resp.der
new file mode 100644
index 0000000000000000000000000000000000000000..d8e7f30b6799bc010d411da4cf53a33ae93a2827
GIT binary patch
literal 437
zcmXqLV%*5Z$grS^ag{+6<1#i*Z8k<$R(1nMMwTYV=|G{$2DOXCSVXo&Jz2W>-ld>#
zJFhOA%KzGK&+)(iCHRdD3@r?d4GfKp49pBHqYQ!!0t~DTIN4aW`IwocSQ%JExI{CS
zU2K<6UOVsZwvFd=-99mKvST-miAjK=fdSJ@UN%mxHjlRNyo^AHF)%kVGBPl4&fD>)
zWQGQtte0v(-=xc%m`?mNxD>f6XG74@!hnP3#<6?v@biCcEa|CU?)UHb#)3~ToR0gl
znx?I}{6nHbJ9WF8ec{|AmyZ=LkdAwrSFvv6vS=n(t74Z`=NBeyztGdNV9B)3Y4JB?
zfAQ^o8h@=l(x3ZDE5H36_g5bd30{7}pgXJWjJtc=iT^>h+&d4JTv|3QUaZdP_qX1q
z*Yj)+U*;2Z-&s(&!*j-0{pZp_ew*xex~=V;S5yBz@McV!kZaV->kVm(CD+;3equ~u
z_GwKBj4_<JWc5_Vt*=+iJ+FDA!uk8so81RGzMVTNbX+me#l-odoc`I4UiY@QHHD#t
IJe+&n0Ig-am;e9(

literal 0
HcmV?d00001

diff --git a/tests/suites/test_suite_x509parse_ocsp.data b/tests/suites/test_suite_x509parse_ocsp.data
index 489036cfa6..d65f2f28e9 100644
--- a/tests/suites/test_suite_x509parse_ocsp.data
+++ b/tests/suites/test_suite_x509parse_ocsp.data
@@ -246,3 +246,18 @@ x509_ocsp_response_verify:"data_files/ocsp-resp-status-unauthorized.der":"data_f
 
 X509 OCSP Response verification (producedAt is in the future)
 x509_ocsp_response_verify:"data_files/ocsp-resp-future-produced-at.der":"data_files/server2-in-database.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_OCSP_RESPONSE_VERIFY_FAILED:MBEDTLS_X509_BADOCSP_RESPONSE_FUTURE
+
+X509 OCSP Response verification (response not supplied)
+x509_ocsp_response_verify:"":"data_files/server2-in-database.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_BAD_INPUT_DATA:0
+
+X509 OCSP Response verification (empty requested certificate chain)
+x509_ocsp_response_verify:"data_files/ocsp-resp-issuer-is-signer.der":"":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":0:0
+
+X509 OCSP Response verification (issuer not found)
+x509_ocsp_response_verify:"data_files/ocsp-resp-no-certs-in-resp.der":"data_files/server2-in-database.crt":"":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_OCSP_RESPONSE_VERIFY_FAILED:MBEDTLS_X509_BADOCSP_RESPONSE_ISSUER_NOT_TRUSTED | MBEDTLS_X509_BADOCSP_RESPONSE_NOT_TRUSTED
+
+X509 OCSP Response verification (issuer found in response chain with Name ID)
+x509_ocsp_response_verify:"data_files/ocsp-resp-issuer-is-signer.der":"data_files/server2-in-database.crt":"":"data_files/test-ca-sha256.crt":0:0
+
+X509 OCSP Response verification (issuer found in untrusted chain with KeyHash ID)
+x509_ocsp_response_verify:"data_files/ocsp-resp-no-certs-in-resp.der":"data_files/server2-in-database.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":0:0
diff --git a/tests/suites/test_suite_x509parse_ocsp.function b/tests/suites/test_suite_x509parse_ocsp.function
index 67799de397..343909c8ab 100644
--- a/tests/suites/test_suite_x509parse_ocsp.function
+++ b/tests/suites/test_suite_x509parse_ocsp.function
@@ -46,6 +46,10 @@ void x509_ocsp_response_verify( char *resp_file, char *req_crt_file,
     mbedtls_x509_crt req_crt;
     mbedtls_x509_crt chain;
     mbedtls_x509_crt ca;
+    mbedtls_x509_ocsp_response *resp_ptr = NULL;
+    mbedtls_x509_crt *req_crt_ptr = NULL;
+    mbedtls_x509_crt *chain_ptr = NULL;
+    mbedtls_x509_crt *ca_ptr = NULL;
     uint32_t flags = 0;
     int ret;
 
@@ -54,14 +58,33 @@ void x509_ocsp_response_verify( char *resp_file, char *req_crt_file,
     mbedtls_x509_crt_init( &chain );
     mbedtls_x509_crt_init( &ca );
 
-    TEST_ASSERT(
-            mbedtls_x509_ocsp_response_parse_file( &resp, resp_file ) == 0 );
-    TEST_ASSERT( mbedtls_x509_crt_parse_file( &req_crt, req_crt_file ) == 0 );
-    TEST_ASSERT( mbedtls_x509_crt_parse_file( &chain, crt_chain_file ) == 0 );
-    TEST_ASSERT( mbedtls_x509_crt_parse_file( &ca, ca_file ) == 0 );
+    if ( strlen( resp_file ) != 0 )
+    {
+        ret = mbedtls_x509_ocsp_response_parse_file( &resp, resp_file );
+        TEST_ASSERT( ret == 0 );
+        resp_ptr = &resp;
+    }
+    if ( strlen( req_crt_file ) != 0 )
+    {
+        ret = mbedtls_x509_crt_parse_file( &req_crt, req_crt_file );
+        TEST_ASSERT( ret == 0 );
+        req_crt_ptr = &req_crt;
+    }
+    if ( strlen( crt_chain_file ) != 0 )
+    {
+        ret = mbedtls_x509_crt_parse_file( &chain, crt_chain_file );
+        TEST_ASSERT( ret == 0 );
+        chain_ptr = &chain;
+    }
+    if ( strlen( ca_file ) != 0 )
+    {
+        ret = mbedtls_x509_crt_parse_file( &ca, ca_file );
+        TEST_ASSERT( ret == 0 );
+        ca_ptr = &ca;
+    }
 
-    ret = mbedtls_x509_ocsp_response_verify( &resp, &req_crt, &chain, &ca,
-                                             &flags );
+    ret = mbedtls_x509_ocsp_response_verify( resp_ptr, req_crt_ptr, chain_ptr,
+                                             ca_ptr, &flags );
     TEST_ASSERT( ret == ( result ) );
     TEST_ASSERT( flags == (uint32_t)( flags_result ) );