Commit a81ce979 authored by Kyle Nekritz's avatar Kyle Nekritz Committed by Facebook Github Bot

Run OpenSSLCertUtils tests with a polluted OpenSSL error stack.

Summary:
We have had several bugs due to this, running tests with an error in
the stack by default should help catch them.

Reviewed By: xybu

Differential Revision: D12843909

fbshipit-source-id: 82432b338f24b4a566c6290d39e34cf2e55092ca
parent a5ef29a1
......@@ -127,13 +127,20 @@ const std::string kTestCertBundle = folly::stripLeftMargin(R"(
-----END CERTIFICATE-----
)");
class OpenSSLCertUtilsTest : public Test {
class OpenSSLCertUtilsTest : public TestWithParam<bool> {
public:
void SetUp() override {
folly::ssl::init();
if (GetParam()) {
// Run the test with an polluted error stack.
SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
}
}
};
INSTANTIATE_TEST_CASE_P(OpenSSLCertUtilsTest, OpenSSLCertUtilsTest, Bool());
static folly::ssl::X509UniquePtr readCertFromFile(const std::string& filename) {
folly::ssl::BioUniquePtr bio(BIO_new(BIO_s_file()));
if (!bio) {
......@@ -179,7 +186,7 @@ static void validateTestCertWithSAN(X509* x509) {
EXPECT_EQ("*.thirdexample.com", altNames[1]);
}
TEST_F(OpenSSLCertUtilsTest, TestX509CN) {
TEST_P(OpenSSLCertUtilsTest, TestX509CN) {
auto x509 = readCertFromFile(kTestCertWithoutSan);
EXPECT_NE(x509, nullptr);
auto identity = folly::ssl::OpenSSLCertUtils::getCommonName(*x509);
......@@ -188,12 +195,12 @@ TEST_F(OpenSSLCertUtilsTest, TestX509CN) {
EXPECT_EQ(sans.size(), 0);
}
TEST_F(OpenSSLCertUtilsTest, TestX509Sans) {
TEST_P(OpenSSLCertUtilsTest, TestX509Sans) {
auto x509 = readCertFromData(kTestCertWithSan);
validateTestCertWithSAN(x509.get());
}
TEST_F(OpenSSLCertUtilsTest, TestX509IssuerAndSubject) {
TEST_P(OpenSSLCertUtilsTest, TestX509IssuerAndSubject) {
auto x509 = readCertFromData(kTestCertWithSan);
EXPECT_NE(x509, nullptr);
auto issuer = folly::ssl::OpenSSLCertUtils::getIssuer(*x509);
......@@ -204,7 +211,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509IssuerAndSubject) {
EXPECT_EQ(subj.value(), "C = US, O = Asox, CN = 127.0.0.1");
}
TEST_F(OpenSSLCertUtilsTest, TestX509Dates) {
TEST_P(OpenSSLCertUtilsTest, TestX509Dates) {
auto x509 = readCertFromData(kTestCertWithSan);
EXPECT_NE(x509, nullptr);
auto notBefore = folly::ssl::OpenSSLCertUtils::getNotBeforeTime(*x509);
......@@ -213,7 +220,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Dates) {
EXPECT_EQ(notAfter, "Jul 1 23:21:03 2044 GMT");
}
TEST_F(OpenSSLCertUtilsTest, TestX509Summary) {
TEST_P(OpenSSLCertUtilsTest, TestX509Summary) {
auto x509 = readCertFromData(kTestCertWithSan);
EXPECT_NE(x509, nullptr);
auto summary = folly::ssl::OpenSSLCertUtils::toString(*x509);
......@@ -239,7 +246,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Summary) {
" CA Issuers - URI:https://phabricator.fb.com/diffusion/FBCODE/browse/master/ti/test_certs/ca_cert.pem?view=raw\n\n");
}
TEST_F(OpenSSLCertUtilsTest, TestDerEncodeDecode) {
TEST_P(OpenSSLCertUtilsTest, TestDerEncodeDecode) {
auto x509 = readCertFromData(kTestCertWithSan);
auto der = folly::ssl::OpenSSLCertUtils::derEncode(*x509);
......@@ -250,13 +257,13 @@ TEST_F(OpenSSLCertUtilsTest, TestDerEncodeDecode) {
folly::ssl::OpenSSLCertUtils::toString(*decoded));
}
TEST_F(OpenSSLCertUtilsTest, TestDerDecodeJunkData) {
TEST_P(OpenSSLCertUtilsTest, TestDerDecodeJunkData) {
StringPiece junk{"MyFakeCertificate"};
EXPECT_THROW(
folly::ssl::OpenSSLCertUtils::derDecode(junk), std::runtime_error);
}
TEST_F(OpenSSLCertUtilsTest, TestDerDecodeTooShort) {
TEST_P(OpenSSLCertUtilsTest, TestDerDecodeTooShort) {
auto x509 = readCertFromData(kTestCertWithSan);
auto der = folly::ssl::OpenSSLCertUtils::derEncode(*x509);
......@@ -266,7 +273,7 @@ TEST_F(OpenSSLCertUtilsTest, TestDerDecodeTooShort) {
std::runtime_error);
}
TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromBuffer) {
TEST_P(OpenSSLCertUtilsTest, TestReadCertsFromBuffer) {
auto certs = folly::ssl::OpenSSLCertUtils::readCertsFromBuffer(
StringPiece(kTestCertBundle));
validateTestCertBundle(certs);
......@@ -274,7 +281,7 @@ TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromBuffer) {
// readCertsFromBuffer() should manage to read certs from a buffer that contain
// both cert and private key.
TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromMixedBuffer) {
TEST_P(OpenSSLCertUtilsTest, TestReadCertsFromMixedBuffer) {
std::vector<std::string> bufs(
{folly::to<std::string>(kTestCertWithSan, "\n\n", kTestKey, "\n"),
folly::to<std::string>(kTestKey, "\n\n", kTestCertWithSan, "\n")});
......@@ -286,15 +293,7 @@ TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromMixedBuffer) {
}
}
TEST_F(OpenSSLCertUtilsTest, TestReadCertsWithErrorInStack) {
SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
auto certs = folly::ssl::OpenSSLCertUtils::readCertsFromBuffer(
StringPiece(kTestCertBundle));
validateTestCertBundle(certs);
}
TEST_F(OpenSSLCertUtilsTest, TestX509Digest) {
TEST_P(OpenSSLCertUtilsTest, TestX509Digest) {
auto x509 = readCertFromFile(kTestCertWithoutSan);
EXPECT_NE(x509, nullptr);
......@@ -309,7 +308,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Digest) {
"364d3a6a0b10d0635ce59b40c0b7f505ab2cd9fd0a06661cdc61d9cb8c9c9821");
}
TEST_F(OpenSSLCertUtilsTest, TestX509Store) {
TEST_P(OpenSSLCertUtilsTest, TestX509Store) {
auto store = folly::ssl::OpenSSLCertUtils::readStoreFromFile(kTestCa);
EXPECT_NE(store, nullptr);
......@@ -321,7 +320,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Store) {
EXPECT_EQ(rc, 1);
}
TEST_F(OpenSSLCertUtilsTest, TestProcessMalformedCertBuf) {
TEST_P(OpenSSLCertUtilsTest, TestProcessMalformedCertBuf) {
std::string badCert =
"-----BEGIN CERTIFICATE-----\n"
"yo\n"
......@@ -350,3 +349,13 @@ TEST_F(OpenSSLCertUtilsTest, TestProcessMalformedCertBuf) {
folly::StringPiece(bufWithBadCert)),
std::runtime_error);
}
TEST_P(OpenSSLCertUtilsTest, TestReadStoreDuplicate) {
auto dupBundle =
folly::to<std::string>(kTestCertBundle, "\n\n", kTestCertBundle);
auto store = folly::ssl::OpenSSLCertUtils::readStoreFromBuffer(
folly::StringPiece(dupBundle));
EXPECT_NE(store, nullptr);
EXPECT_EQ(ERR_get_error(), 0);
}
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment