isaacpittman-hitachi / rpms / openssl

Forked from rpms/openssl 2 years ago
Clone

Blame SOURCES/0064-CVE-2022-1343.diff

22d461
diff --git a/crypto/ocsp/ocsp_vfy.c b/crypto/ocsp/ocsp_vfy.c
22d461
index 7a4a45d537..3c5f48ec0a 100644
22d461
--- a/crypto/ocsp/ocsp_vfy.c
22d461
+++ b/crypto/ocsp/ocsp_vfy.c
22d461
@@ -59,9 +59,10 @@ static int ocsp_verify_signer(X509 *signer, int response,
22d461
 
22d461
     ret = X509_verify_cert(ctx);
22d461
     if (ret <= 0) {
22d461
-        ret = X509_STORE_CTX_get_error(ctx);
22d461
+        int err = X509_STORE_CTX_get_error(ctx);
22d461
+
22d461
         ERR_raise_data(ERR_LIB_OCSP, OCSP_R_CERTIFICATE_VERIFY_ERROR,
22d461
-                       "Verify error: %s", X509_verify_cert_error_string(ret));
22d461
+                       "Verify error: %s", X509_verify_cert_error_string(err));
22d461
         goto end;
22d461
     }
22d461
     if (chain != NULL)
22d461
diff --git a/test/recipes/80-test_ocsp.t b/test/recipes/80-test_ocsp.t
22d461
index d42030cb89..34fdfcbccc 100644
22d461
--- a/test/recipes/80-test_ocsp.t
22d461
+++ b/test/recipes/80-test_ocsp.t
22d461
@@ -35,6 +35,7 @@ sub test_ocsp {
22d461
         $untrusted = $CAfile;
22d461
     }
22d461
     my $expected_exit = shift;
22d461
+    my $nochecks = shift;
22d461
     my $outputfile = basename($inputfile, '.ors') . '.dat';
22d461
 
22d461
     run(app(["openssl", "base64", "-d",
22d461
@@ -45,7 +46,8 @@ sub test_ocsp {
22d461
                            "-partial_chain", @check_time,
22d461
                            "-CAfile", catfile($ocspdir, $CAfile),
22d461
                            "-verify_other", catfile($ocspdir, $untrusted),
22d461
-                           "-no-CApath", "-no-CAstore"])),
22d461
+                           "-no-CApath", "-no-CAstore",
22d461
+                           $nochecks ? "-no_cert_checks" : ()])),
22d461
                   $title); });
22d461
 }
22d461
 
22d461
@@ -55,143 +57,149 @@ subtest "=== VALID OCSP RESPONSES ===" => sub {
22d461
     plan tests => 7;
22d461
 
22d461
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
22d461
-              "ND1.ors", "ND1_Issuer_ICA.pem", "", 0);
22d461
+              "ND1.ors", "ND1_Issuer_ICA.pem", "", 0, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
22d461
-              "ND2.ors", "ND2_Issuer_Root.pem", "", 0);
22d461
+              "ND2.ors", "ND2_Issuer_Root.pem", "", 0, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> EE",
22d461
-              "ND3.ors", "ND3_Issuer_Root.pem", "", 0);
22d461
+              "ND3.ors", "ND3_Issuer_Root.pem", "", 0, 0);
22d461
     test_ocsp("NON-DELEGATED; 3-level CA hierarchy",
22d461
-              "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0);
22d461
+              "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0, 0);
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "D1.ors", "D1_Issuer_ICA.pem", "", 0);
22d461
+              "D1.ors", "D1_Issuer_ICA.pem", "", 0, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "D2.ors", "D2_Issuer_Root.pem", "", 0);
22d461
+              "D2.ors", "D2_Issuer_Root.pem", "", 0, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "D3.ors", "D3_Issuer_Root.pem", "", 0);
22d461
+              "D3.ors", "D3_Issuer_Root.pem", "", 0, 0);
22d461
 };
22d461
 
22d461
 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
22d461
     plan tests => 6;
22d461
 
22d461
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
22d461
-              "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
22d461
+              "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
22d461
-              "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
22d461
+              "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> EE",
22d461
-              "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
22d461
+              "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1);
22d461
+              "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1);
22d461
+              "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1);
22d461
+              "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
22d461
 };
22d461
 
22d461
 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
22d461
     plan tests => 6;
22d461
 
22d461
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
22d461
-              "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
22d461
+              "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
22d461
-              "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
22d461
+              "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> EE",
22d461
-              "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
22d461
+              "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1);
22d461
+              "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1);
22d461
+              "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1);
22d461
+              "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
22d461
 };
22d461
 
22d461
 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
22d461
     plan tests => 6;
22d461
 
22d461
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
22d461
-              "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
22d461
+              "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
22d461
-              "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
22d461
+              "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> EE",
22d461
-              "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
22d461
+              "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
22d461
+              "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1);
22d461
+              "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1);
22d461
+              "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
22d461
 };
22d461
 
22d461
 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
22d461
     plan tests => 6;
22d461
 
22d461
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
22d461
-              "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
22d461
+              "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
22d461
-              "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
22d461
+              "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> EE",
22d461
-              "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
22d461
+              "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
22d461
+              "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1);
22d461
+              "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1);
22d461
+              "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
22d461
 };
22d461
 
22d461
 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
22d461
     plan tests => 3;
22d461
 
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
22d461
+              "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
22d461
+              "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
22d461
+              "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
22d461
 };
22d461
 
22d461
 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
22d461
-    plan tests => 3;
22d461
+    plan tests => 6;
22d461
 
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
22d461
+              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 0);
22d461
+    test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
+              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 0);
22d461
+    test_ocsp("DELEGATED; Root CA -> EE",
22d461
+              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 0);
22d461
+    test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
+              "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1, 1);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
22d461
+              "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1, 1);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
22d461
+              "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1, 1);
22d461
 };
22d461
 
22d461
 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
22d461
     plan tests => 6;
22d461
 
22d461
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
22d461
-              "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1);
22d461
+              "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
22d461
-              "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1);
22d461
+              "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> EE",
22d461
-              "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1);
22d461
+              "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1);
22d461
+              "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1);
22d461
+              "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1);
22d461
+              "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1, 0);
22d461
 };
22d461
 
22d461
 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
22d461
     plan tests => 6;
22d461
 
22d461
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
22d461
-              "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1);
22d461
+              "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
22d461
-              "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1);
22d461
+              "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> EE",
22d461
-              "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1);
22d461
+              "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1);
22d461
+              "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1);
22d461
+              "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1);
22d461
+              "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1, 0);
22d461
 };
22d461
 
22d461
 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
22d461
@@ -199,17 +207,17 @@ subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
22d461
 
22d461
     # Expect success, because we're explicitly trusting the issuer certificate.
22d461
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
22d461
-              "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0);
22d461
+              "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
22d461
-              "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0);
22d461
+              "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0, 0);
22d461
     test_ocsp("NON-DELEGATED; Root CA -> EE",
22d461
-              "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0);
22d461
+              "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0, 0);
22d461
     test_ocsp("DELEGATED; Intermediate CA -> EE",
22d461
-              "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0);
22d461
+              "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
22d461
-              "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0);
22d461
+              "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0, 0);
22d461
     test_ocsp("DELEGATED; Root CA -> EE",
22d461
-              "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0);
22d461
+              "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0, 0);
22d461
 };
22d461
 
22d461
 subtest "=== OCSP API TESTS===" => sub {