Commit a81ce979 authored by Kyle Nekritz's avatar Kyle Nekritz Committed by Facebook Github Bot

Run OpenSSLCertUtils tests with a polluted OpenSSL error stack.

Summary:
We have had several bugs due to this, running tests with an error in
the stack by default should help catch them.

Reviewed By: xybu

Differential Revision: D12843909

fbshipit-source-id: 82432b338f24b4a566c6290d39e34cf2e55092ca
parent a5ef29a1
...@@ -127,13 +127,20 @@ const std::string kTestCertBundle = folly::stripLeftMargin(R"( ...@@ -127,13 +127,20 @@ const std::string kTestCertBundle = folly::stripLeftMargin(R"(
-----END CERTIFICATE----- -----END CERTIFICATE-----
)"); )");
class OpenSSLCertUtilsTest : public Test { class OpenSSLCertUtilsTest : public TestWithParam<bool> {
public: public:
void SetUp() override { void SetUp() override {
folly::ssl::init(); folly::ssl::init();
if (GetParam()) {
// Run the test with an polluted error stack.
SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
}
} }
}; };
INSTANTIATE_TEST_CASE_P(OpenSSLCertUtilsTest, OpenSSLCertUtilsTest, Bool());
static folly::ssl::X509UniquePtr readCertFromFile(const std::string& filename) { static folly::ssl::X509UniquePtr readCertFromFile(const std::string& filename) {
folly::ssl::BioUniquePtr bio(BIO_new(BIO_s_file())); folly::ssl::BioUniquePtr bio(BIO_new(BIO_s_file()));
if (!bio) { if (!bio) {
...@@ -179,7 +186,7 @@ static void validateTestCertWithSAN(X509* x509) { ...@@ -179,7 +186,7 @@ static void validateTestCertWithSAN(X509* x509) {
EXPECT_EQ("*.thirdexample.com", altNames[1]); EXPECT_EQ("*.thirdexample.com", altNames[1]);
} }
TEST_F(OpenSSLCertUtilsTest, TestX509CN) { TEST_P(OpenSSLCertUtilsTest, TestX509CN) {
auto x509 = readCertFromFile(kTestCertWithoutSan); auto x509 = readCertFromFile(kTestCertWithoutSan);
EXPECT_NE(x509, nullptr); EXPECT_NE(x509, nullptr);
auto identity = folly::ssl::OpenSSLCertUtils::getCommonName(*x509); auto identity = folly::ssl::OpenSSLCertUtils::getCommonName(*x509);
...@@ -188,12 +195,12 @@ TEST_F(OpenSSLCertUtilsTest, TestX509CN) { ...@@ -188,12 +195,12 @@ TEST_F(OpenSSLCertUtilsTest, TestX509CN) {
EXPECT_EQ(sans.size(), 0); EXPECT_EQ(sans.size(), 0);
} }
TEST_F(OpenSSLCertUtilsTest, TestX509Sans) { TEST_P(OpenSSLCertUtilsTest, TestX509Sans) {
auto x509 = readCertFromData(kTestCertWithSan); auto x509 = readCertFromData(kTestCertWithSan);
validateTestCertWithSAN(x509.get()); validateTestCertWithSAN(x509.get());
} }
TEST_F(OpenSSLCertUtilsTest, TestX509IssuerAndSubject) { TEST_P(OpenSSLCertUtilsTest, TestX509IssuerAndSubject) {
auto x509 = readCertFromData(kTestCertWithSan); auto x509 = readCertFromData(kTestCertWithSan);
EXPECT_NE(x509, nullptr); EXPECT_NE(x509, nullptr);
auto issuer = folly::ssl::OpenSSLCertUtils::getIssuer(*x509); auto issuer = folly::ssl::OpenSSLCertUtils::getIssuer(*x509);
...@@ -204,7 +211,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509IssuerAndSubject) { ...@@ -204,7 +211,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509IssuerAndSubject) {
EXPECT_EQ(subj.value(), "C = US, O = Asox, CN = 127.0.0.1"); EXPECT_EQ(subj.value(), "C = US, O = Asox, CN = 127.0.0.1");
} }
TEST_F(OpenSSLCertUtilsTest, TestX509Dates) { TEST_P(OpenSSLCertUtilsTest, TestX509Dates) {
auto x509 = readCertFromData(kTestCertWithSan); auto x509 = readCertFromData(kTestCertWithSan);
EXPECT_NE(x509, nullptr); EXPECT_NE(x509, nullptr);
auto notBefore = folly::ssl::OpenSSLCertUtils::getNotBeforeTime(*x509); auto notBefore = folly::ssl::OpenSSLCertUtils::getNotBeforeTime(*x509);
...@@ -213,7 +220,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Dates) { ...@@ -213,7 +220,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Dates) {
EXPECT_EQ(notAfter, "Jul 1 23:21:03 2044 GMT"); EXPECT_EQ(notAfter, "Jul 1 23:21:03 2044 GMT");
} }
TEST_F(OpenSSLCertUtilsTest, TestX509Summary) { TEST_P(OpenSSLCertUtilsTest, TestX509Summary) {
auto x509 = readCertFromData(kTestCertWithSan); auto x509 = readCertFromData(kTestCertWithSan);
EXPECT_NE(x509, nullptr); EXPECT_NE(x509, nullptr);
auto summary = folly::ssl::OpenSSLCertUtils::toString(*x509); auto summary = folly::ssl::OpenSSLCertUtils::toString(*x509);
...@@ -239,7 +246,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Summary) { ...@@ -239,7 +246,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Summary) {
" CA Issuers - URI:https://phabricator.fb.com/diffusion/FBCODE/browse/master/ti/test_certs/ca_cert.pem?view=raw\n\n"); " CA Issuers - URI:https://phabricator.fb.com/diffusion/FBCODE/browse/master/ti/test_certs/ca_cert.pem?view=raw\n\n");
} }
TEST_F(OpenSSLCertUtilsTest, TestDerEncodeDecode) { TEST_P(OpenSSLCertUtilsTest, TestDerEncodeDecode) {
auto x509 = readCertFromData(kTestCertWithSan); auto x509 = readCertFromData(kTestCertWithSan);
auto der = folly::ssl::OpenSSLCertUtils::derEncode(*x509); auto der = folly::ssl::OpenSSLCertUtils::derEncode(*x509);
...@@ -250,13 +257,13 @@ TEST_F(OpenSSLCertUtilsTest, TestDerEncodeDecode) { ...@@ -250,13 +257,13 @@ TEST_F(OpenSSLCertUtilsTest, TestDerEncodeDecode) {
folly::ssl::OpenSSLCertUtils::toString(*decoded)); folly::ssl::OpenSSLCertUtils::toString(*decoded));
} }
TEST_F(OpenSSLCertUtilsTest, TestDerDecodeJunkData) { TEST_P(OpenSSLCertUtilsTest, TestDerDecodeJunkData) {
StringPiece junk{"MyFakeCertificate"}; StringPiece junk{"MyFakeCertificate"};
EXPECT_THROW( EXPECT_THROW(
folly::ssl::OpenSSLCertUtils::derDecode(junk), std::runtime_error); folly::ssl::OpenSSLCertUtils::derDecode(junk), std::runtime_error);
} }
TEST_F(OpenSSLCertUtilsTest, TestDerDecodeTooShort) { TEST_P(OpenSSLCertUtilsTest, TestDerDecodeTooShort) {
auto x509 = readCertFromData(kTestCertWithSan); auto x509 = readCertFromData(kTestCertWithSan);
auto der = folly::ssl::OpenSSLCertUtils::derEncode(*x509); auto der = folly::ssl::OpenSSLCertUtils::derEncode(*x509);
...@@ -266,7 +273,7 @@ TEST_F(OpenSSLCertUtilsTest, TestDerDecodeTooShort) { ...@@ -266,7 +273,7 @@ TEST_F(OpenSSLCertUtilsTest, TestDerDecodeTooShort) {
std::runtime_error); std::runtime_error);
} }
TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromBuffer) { TEST_P(OpenSSLCertUtilsTest, TestReadCertsFromBuffer) {
auto certs = folly::ssl::OpenSSLCertUtils::readCertsFromBuffer( auto certs = folly::ssl::OpenSSLCertUtils::readCertsFromBuffer(
StringPiece(kTestCertBundle)); StringPiece(kTestCertBundle));
validateTestCertBundle(certs); validateTestCertBundle(certs);
...@@ -274,7 +281,7 @@ TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromBuffer) { ...@@ -274,7 +281,7 @@ TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromBuffer) {
// readCertsFromBuffer() should manage to read certs from a buffer that contain // readCertsFromBuffer() should manage to read certs from a buffer that contain
// both cert and private key. // both cert and private key.
TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromMixedBuffer) { TEST_P(OpenSSLCertUtilsTest, TestReadCertsFromMixedBuffer) {
std::vector<std::string> bufs( std::vector<std::string> bufs(
{folly::to<std::string>(kTestCertWithSan, "\n\n", kTestKey, "\n"), {folly::to<std::string>(kTestCertWithSan, "\n\n", kTestKey, "\n"),
folly::to<std::string>(kTestKey, "\n\n", kTestCertWithSan, "\n")}); folly::to<std::string>(kTestKey, "\n\n", kTestCertWithSan, "\n")});
...@@ -286,15 +293,7 @@ TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromMixedBuffer) { ...@@ -286,15 +293,7 @@ TEST_F(OpenSSLCertUtilsTest, TestReadCertsFromMixedBuffer) {
} }
} }
TEST_F(OpenSSLCertUtilsTest, TestReadCertsWithErrorInStack) { TEST_P(OpenSSLCertUtilsTest, TestX509Digest) {
SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
auto certs = folly::ssl::OpenSSLCertUtils::readCertsFromBuffer(
StringPiece(kTestCertBundle));
validateTestCertBundle(certs);
}
TEST_F(OpenSSLCertUtilsTest, TestX509Digest) {
auto x509 = readCertFromFile(kTestCertWithoutSan); auto x509 = readCertFromFile(kTestCertWithoutSan);
EXPECT_NE(x509, nullptr); EXPECT_NE(x509, nullptr);
...@@ -309,7 +308,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Digest) { ...@@ -309,7 +308,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Digest) {
"364d3a6a0b10d0635ce59b40c0b7f505ab2cd9fd0a06661cdc61d9cb8c9c9821"); "364d3a6a0b10d0635ce59b40c0b7f505ab2cd9fd0a06661cdc61d9cb8c9c9821");
} }
TEST_F(OpenSSLCertUtilsTest, TestX509Store) { TEST_P(OpenSSLCertUtilsTest, TestX509Store) {
auto store = folly::ssl::OpenSSLCertUtils::readStoreFromFile(kTestCa); auto store = folly::ssl::OpenSSLCertUtils::readStoreFromFile(kTestCa);
EXPECT_NE(store, nullptr); EXPECT_NE(store, nullptr);
...@@ -321,7 +320,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Store) { ...@@ -321,7 +320,7 @@ TEST_F(OpenSSLCertUtilsTest, TestX509Store) {
EXPECT_EQ(rc, 1); EXPECT_EQ(rc, 1);
} }
TEST_F(OpenSSLCertUtilsTest, TestProcessMalformedCertBuf) { TEST_P(OpenSSLCertUtilsTest, TestProcessMalformedCertBuf) {
std::string badCert = std::string badCert =
"-----BEGIN CERTIFICATE-----\n" "-----BEGIN CERTIFICATE-----\n"
"yo\n" "yo\n"
...@@ -350,3 +349,13 @@ TEST_F(OpenSSLCertUtilsTest, TestProcessMalformedCertBuf) { ...@@ -350,3 +349,13 @@ TEST_F(OpenSSLCertUtilsTest, TestProcessMalformedCertBuf) {
folly::StringPiece(bufWithBadCert)), folly::StringPiece(bufWithBadCert)),
std::runtime_error); std::runtime_error);
} }
TEST_P(OpenSSLCertUtilsTest, TestReadStoreDuplicate) {
auto dupBundle =
folly::to<std::string>(kTestCertBundle, "\n\n", kTestCertBundle);
auto store = folly::ssl::OpenSSLCertUtils::readStoreFromBuffer(
folly::StringPiece(dupBundle));
EXPECT_NE(store, nullptr);
EXPECT_EQ(ERR_get_error(), 0);
}
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment