Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refactor s2n_x509_validator_validate_cert_chain to support an async callback #3500

Merged
merged 14 commits into from
Sep 28, 2022
Merged

Refactor s2n_x509_validator_validate_cert_chain to support an async callback #3500

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
665a692
Refactor s2n_x509_validator_validate_cert_chain to support async call…
goatgoose Sep 15, 2022
c9870a6
don't check for pkey_type on error in x509_validator tests
goatgoose Sep 16, 2022
bb86ad4
check for S2N_PKEY_TYPE_UNKNOWN on error
goatgoose Sep 20, 2022
567385d
prepend s2n_x509_validator
goatgoose Sep 20, 2022
a9c024e
refactor validate_cert_chain into functions per state
goatgoose Sep 21, 2022
5f7443e
fixes
goatgoose Sep 21, 2022
8043a37
check for INIT state in s2n_x509_validator_read_cert_chain
goatgoose Sep 21, 2022
5d07513
fixes
goatgoose Sep 21, 2022
2b5f26e
add comment for processing leaf certificate extensions
goatgoose Sep 21, 2022
876a33b
CERT_CHAIN_PROCESSED -> READY_TO_VERIFY
goatgoose Sep 21, 2022
fd87c6c
EXPECT_TRUE -> EXPECT_EQUAL
goatgoose Sep 21, 2022
b9aa377
Merge branch 'main' into refactor-x509-validate-async
goatgoose Sep 27, 2022
5347cfa
Merge branch 'main' into refactor-x509-validate-async
goatgoose Sep 27, 2022
49c3345
Merge branch 'main' into refactor-x509-validate-async
goatgoose Sep 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 34 additions & 40 deletions tests/unit/s2n_x509_validator_test.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);
Expand All @@ -217,7 +217,7 @@ int main(int argc, char **argv) {
EXPECT_SUCCESS(s2n_x509_validator_set_max_chain_depth(&validator, 2));
struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));

s2n_stuffer_free(&chain_stuffer);
Expand Down Expand Up @@ -266,7 +266,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);
EXPECT_EQUAL(0, verify_data.callback_invoked);
Expand Down Expand Up @@ -304,7 +304,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));

s2n_stuffer_free(&chain_stuffer);
Expand Down Expand Up @@ -341,7 +341,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));

s2n_stuffer_free(&chain_stuffer);
Expand Down Expand Up @@ -387,7 +387,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));

s2n_stuffer_free(&chain_stuffer);
Expand Down Expand Up @@ -427,13 +427,12 @@ int main(int argc, char **argv) {
EXPECT_SUCCESS(s2n_x509_validator_set_max_chain_depth(&validator, 2));
struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out),
S2N_ERR_CERT_MAX_CHAIN_DEPTH_EXCEEDED);

s2n_stuffer_free(&chain_stuffer);
EXPECT_EQUAL(0, verify_data.callback_invoked);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);
s2n_connection_free(connection);
lrstewart marked this conversation as resolved.
Show resolved Hide resolved
s2n_pkey_free(&public_key_out);

Expand Down Expand Up @@ -470,7 +469,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_EXPIRED);

Expand Down Expand Up @@ -511,7 +510,7 @@ int main(int argc, char **argv) {
chain_data[500] = (uint8_t) (chain_data[500] << 2);
struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);

Expand Down Expand Up @@ -549,7 +548,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);

Expand Down Expand Up @@ -593,7 +592,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);
s2n_stuffer_free(&chain_stuffer);
Expand Down Expand Up @@ -629,7 +628,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));

s2n_stuffer_free(&chain_stuffer);
Expand Down Expand Up @@ -674,7 +673,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));

s2n_stuffer_free(&chain_stuffer);
Expand Down Expand Up @@ -713,14 +712,13 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);
s2n_stuffer_free(&chain_stuffer);

EXPECT_EQUAL(1, verify_data.found_name);
EXPECT_EQUAL(1, verify_data.callback_invoked);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);

s2n_connection_free(connection);
s2n_pkey_free(&public_key_out);
Expand Down Expand Up @@ -755,14 +753,13 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);
s2n_stuffer_free(&chain_stuffer);

EXPECT_EQUAL(0, verify_data.found_name);
EXPECT_EQUAL(1, verify_data.callback_invoked);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);

s2n_connection_free(connection);
s2n_pkey_free(&public_key_out);
Expand Down Expand Up @@ -797,14 +794,13 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);
s2n_stuffer_free(&chain_stuffer);

EXPECT_EQUAL(1, verify_data.found_name);
EXPECT_EQUAL(1, verify_data.callback_invoked);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);

s2n_connection_free(connection);
s2n_pkey_free(&public_key_out);
Expand Down Expand Up @@ -836,7 +832,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -879,7 +875,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -933,7 +929,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));

s2n_stuffer_free(&chain_stuffer);
Expand Down Expand Up @@ -977,7 +973,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -1024,7 +1020,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -1072,7 +1068,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -1120,7 +1116,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -1167,7 +1163,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -1215,7 +1211,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -1261,7 +1257,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);

Expand Down Expand Up @@ -1303,7 +1299,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);
Expand Down Expand Up @@ -1337,7 +1333,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);
Expand Down Expand Up @@ -1371,12 +1367,11 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);

s2n_stuffer_free(&chain_stuffer);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);
s2n_connection_free(connection);
s2n_pkey_free(&public_key_out);

Expand Down Expand Up @@ -1405,12 +1400,11 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);

s2n_stuffer_free(&chain_stuffer);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);
s2n_connection_free(connection);
s2n_pkey_free(&public_key_out);

Expand Down Expand Up @@ -1441,7 +1435,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));
s2n_stuffer_free(&chain_stuffer);
EXPECT_EQUAL(S2N_PKEY_TYPE_RSA, pkey_type);
Expand All @@ -1465,7 +1459,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;

/* Expect to return S2N_CERT_ERR_UNTRUSTED */
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
Expand Down Expand Up @@ -1509,7 +1503,7 @@ int main(int argc, char **argv) {

struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
validator.skip_cert_validation = 1;
EXPECT_OK(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len, &pkey_type, &public_key_out));

Expand Down Expand Up @@ -1551,7 +1545,7 @@ int main(int argc, char **argv) {
uint8_t *chain_data = s2n_stuffer_raw_read(&chain_stuffer, (uint32_t) chain_len);
struct s2n_pkey public_key_out;
EXPECT_SUCCESS(s2n_pkey_zero_init(&public_key_out));
s2n_pkey_type pkey_type;
s2n_pkey_type pkey_type = S2N_PKEY_TYPE_UNKNOWN;
EXPECT_ERROR_WITH_ERRNO(s2n_x509_validator_validate_cert_chain(&validator, connection, chain_data, chain_len,
&pkey_type, &public_key_out), S2N_ERR_CERT_UNTRUSTED);

Expand Down
Loading