11 #if defined( __MVS__ ) || defined( __VMCMS__ )
13 #pragma convlit( suspend )
15 #if defined( __ILEC400__ )
27 static BOOLEAN handleCertImportError(
const int errorCode,
const int lineNo )
29 printf(
"cryptImportCert() failed with error code %d, line %d.\n",
43 const int certNo,
const int errorCode )
52 puts(
"Couldn't get error locus for certificate check failure." );
60 puts(
"Warning: Validity check failed because the certificate has "
69 puts(
"Warning: Validity check failed due to RegTP CA certificate "
70 "incorrectly\n marked as non-CA certificate." );
80 puts(
"Warning: Validity check failed due to CA certificate with "
81 "incorrect\n key usage field (this will be ignored "
82 "since the certificate\n is used to test for other "
83 "error handling conditions)." );
90 static int certImport(
const int certNo,
const BOOLEAN isECC,
98 printf(
"Testing %scertificate #%d import...\n",
99 isECC ?
"ECC " : isBase64 ?
"base64 " :
"", certNo );
103 if( ( filePtr = fopen( buffer,
"rb" ) ) == NULL )
105 puts(
"Couldn't find certificate file for import test." );
115 ( certNo == 9 || certNo == 10 ) )
123 puts(
"Warning: Certificate import failed because the certificate "
124 "uses a very short\n (insecure) key.\n" );
130 puts(
"Warning: Certificate import failed for RegTP/Deutsche "
131 "Telekom CA\n certificate with negative public-key "
140 puts(
"Warning: Certificate import failed because the certificate "
141 "uses an\n algorithm that isn't enabled in this build "
147 printf(
"cryptImportCert() for certificate #%d failed with error "
148 "code %d, line %d.\n", certNo, status, __LINE__ );
157 printf(
"Couldn't get certificate self-signed status, status %d, "
158 "line %d.\n", status, __LINE__ );
163 printf(
"Certificate is self-signed, checking signature... " );
167 if( !handleCertError( cryptCert, certNo, status ) )
170 status, __LINE__ ) );
174 puts(
"signature verified." );
177 puts(
"Certificate is signed, signature key unknown." );
185 puts(
"Certificate import succeeded.\n" );
191 static void importTestData(
void )
195 for( i = 1; i <= 110000; i++ )
203 printf(
"%06d\r", i );
207 if( ( filePtr = fopen( buffer,
"rb" ) ) == NULL )
223 for( i = 1; i <= 30; i++ )
237 puts(
"ECC algorithm support appears to be disabled, skipping "
238 "processing of ECDSA\ncertificates.\n" );
242 for( i = 1; i <= 10; i++ )
250 static int certReqImport(
const int certNo )
255 int count, complianceValue,
status;
257 printf(
"Testing certificate request #%d import...\n", certNo );
259 if( ( filePtr = fopen( buffer,
"rb" ) ) == NULL )
261 puts(
"Couldn't find certificate file for import test." );
287 puts(
"The certificate request import failed, probably because "
288 "you're using an\nolder version of unzip that corrupts "
289 "certain types of files when it\nextracts them. To fix this, "
290 "you need to re-extract test/*.der without\nusing the -a "
291 "option to convert text files.\n" );
297 puts(
"Warning: Certificate request import failed because the "
298 "request uses a very short\n (insecure) key." );
302 return( handleCertImportError( status, __LINE__ ) );
304 puts(
" (Skipping signature check because CRMF data is unsigned)." );
307 printf(
"Checking signature... " );
310 return(
attrErrorExit( cryptCert,
"cryptCheckCert()", status,
312 puts(
"signature verified." );
321 puts(
"Certificate request import succeeded.\n" );
329 for( i = 1; i <= 5; i++ )
331 if( !certReqImport( i ) )
337 #define LARGE_CRL_SIZE 32767
339 static int crlImport(
const int crlNo,
BYTE *buffer )
346 if( ( filePtr = fopen( buffer,
"rb" ) ) == NULL )
348 printf(
"Couldn't find CRL file for CRL #%d import test.\n", crlNo );
353 printf(
"CRL #%d has size %d bytes.\n", crlNo, count );
360 return( handleCertImportError( status, __LINE__ ) );
375 puts(
"Testing CRL import..." );
381 puts(
"Out of memory." );
384 for( i = 1; i <= 3; i++ )
386 if( !crlImport( i, bufPtr ) )
392 puts(
"CRL import succeeded.\n" );
427 int complianceValue,
status;
429 printf(
"Warning: The certificate chain didn't verify because one or "
430 "more\n certificates in it have expired. Trying again "
431 "in oblivious\n mode... " );
444 const int certNo,
const int errorCode )
454 puts(
"\nCertificate chain contains only a single standalone "
455 "certificate, skipping\nsignature check..." );
463 errorCode, __LINE__ ) );
471 puts(
"Couldn't get error locus for certificate check failure." );
484 printf(
"\nWarning: The certificate chain didn't verify "
485 "because it didn't end in a\n trusted root "
486 "certificate. Checking again using an "
487 "implicitly\n trusted root... " );
491 printf(
"\nWarning: The certificate chain didn't verify "
492 "because the root certificate's\n key isn't "
493 "enabled for this usage. Checking again using "
494 "an\n implicitly trusted root... " );
499 printf(
"\nAttempt to make chain root implicitly trusted "
500 "failed, status = %d, line %d.\n", status, __LINE__ );
513 status = checkExpiredCertChain( cryptCertChain );
518 puts(
"\nCertificate chain contains only a single standalone "
519 "certificate, skipping\nsignature check..." );
525 puts(
"\nCertificate chain is incomplete (one or more certificates "
526 "needed to\ncomplete the chain are missing), skipping "
527 "signature check..." );
539 puts(
"signatures verified." );
540 puts(
"Checking again with an intermediate certificate marked as "
563 status = checkExpiredCertChain( cryptCertChain );
578 return(
attrErrorExit( cryptCertChain,
"cryptCheckCert()", status,
582 puts(
"signatures verified." );
586 static int certChainImport(
const int certNo,
const BOOLEAN isBase64 )
593 printf(
"Testing %scert chain #%d import...\n",
594 isBase64 ?
"base64 " :
"", certNo );
597 if( ( filePtr = fopen( buffer,
"rb" ) ) == NULL )
599 puts(
"Couldn't find certificate chain file for import test." );
606 puts(
"The certificate buffer size is too small for the certificate "
607 "chain. To fix\nthis, increase the BUFFER_SIZE value in "
608 "test/testcert.c and recompile the code." );
611 printf(
"Certificate chain has size %d bytes.\n", count );
622 printf(
"Import of certificate with invalid e=3 key failed, "
623 "line %d.\n", __LINE__ );
624 puts(
" (This is the correct result for this test).\n" );
627 return( handleCertImportError( status, __LINE__ ) );
631 printf(
"Import of certificate with invalid e=3 key succeeded when "
632 "it should have\n failed, line %d.\n", __LINE__ );
638 return(
attrErrorExit( cryptCertChain,
"cryptGetAttribute()",
639 status, __LINE__ ) );
646 printf(
"Imported object isn't a certificate, line %d.\n",
655 printf(
"Imported object isn't a certificate chain, line %d.\n",
660 printf(
"Checking signatures... " );
664 if( !handleCertChainError( cryptCertChain, certNo, status ) )
668 puts(
"signatures verified." );
676 puts(
"Certificate chain import succeeded.\n" );
684 for( i = 1; i <= 5; i++ )
686 if( !certChainImport( i,
FALSE ) )
701 puts(
"Couldn't find OCSP OK response file for import test." );
704 puts(
"Testing OCSP OK response import..." );
707 printf(
"OCSP OK response has size %d bytes.\n", count );
715 return( handleCertImportError( status, __LINE__ ) );
716 printf(
"Checking signature... " );
724 return(
attrErrorExit( cryptCert,
"cryptCheckCert()", status,
726 puts(
"signatures verified." );
736 puts(
"Testing OCSP revoked response import..." );
739 puts(
"Couldn't find OCSP revoked response file for import test." );
744 printf(
"OCSP revoked response has size %d bytes.\n", count );
748 return( handleCertImportError( status, __LINE__ ) );
756 puts(
"OCSP import succeeded.\n" );
768 puts(
"Skipping import of base64-encoded data on EBCDIC system.\n" );
772 for( i = 1; i <= 2; i++ )
788 puts(
"Skipping import of base64-encoded data on EBCDIC system.\n" );
792 for( i = 1; i <= 1; i++ )
793 if( !certChainImport( i,
TRUE ) )
798 static int miscImport(
const char *
fileName,
const char *description )
805 if( ( filePtr = fopen( fileName,
"rb" ) ) == NULL )
807 printf(
"Couldn't find file for %s key import test.\n",
822 printf(
"cryptImportCert() for %s key failed with error code %d, "
823 "line %d.\n", description, status, __LINE__ );
837 puts(
"Testing base64-encoded SSH/PGP key import..." );
838 for( i = 1; i <= 2; i++ )
841 if( !miscImport( buffer,
"SSH" ) )
844 for( i = 1; i <= 3; i++ )
847 if( !miscImport( buffer,
"PGP" ) )
850 puts(
"Import succeeded.\n" );
865 puts(
"Testing handling of incorrectly chained certs..." );
893 printf(
"Sig.check of incorrectly chained certificate returned %d, "
894 "should have been %d, line %d.\n", status,
903 puts(
"Handling of incorrectly chained certs succeeded.\n" );
925 printf(
"Testing certificate handling at various compliance levels "
926 "(current = %d)...\n", value );
929 puts(
"Couldn't certificate for import test." );
941 puts(
"(Couldn't set compliance level to "
942 "CRYPT_COMPLIANCELEVEL_PKIX_PARTIAL, probably\n because "
943 "cryptlib has been configured to not use this level, "
944 "skipping this\n test...)" );
957 printf(
"cryptImportCert() of broken certificate succeeded when "
958 "it should have failed, line %d.\n", __LINE__ );
971 return( handleCertImportError( status, __LINE__ ) );
987 return( handleCertImportError( status, __LINE__ ) );
992 printf(
"cryptCheckCert() of broken certificate succeeded when it "
993 "should have failed, line %d.\n", __LINE__ );
1004 printf(
"cryptCheckCert() of broken certificate failed when it "
1005 "should have succeeded, line %d.\n", __LINE__ );
1012 puts(
"Certificate handling at different compliance levels succeeded.\n" );
1297 char pathName[ 64 ];
1298 int pathNo, requirePolicy,
status;
1303 pathNo = atoi( pathName );
1308 " without explicit policy" :
"" );
1313 printf(
"Certificate import for test path %s failed, status %d, "
1314 "line %d.\n", pathName, status, __LINE__ );
1323 assert( requirePolicy !=
FALSE );
1337 puts(
" didn't verify even though it should be valid." );
1339 status, __LINE__ ) );
1346 puts(
" verified even though it should have failed." );
1350 puts(
" succeeded." );
1361 puts(
"Testing path processing..." );
1372 printf(
"Couldn't create trusted root certificate for path "
1373 "processing, line %d.\n", __LINE__ );
1383 printf(
"Couldn't set compliance level to "
1384 "CRYPT_COMPLIANCELEVEL_PKIX_FULL, line %d.\nThis may be "
1385 "because cryptlib has been configured not to run at this "
1386 "level.\n", __LINE__ );
1392 for( i = 0; pathTestInfo[ i ].fileMajor != 0; i++ )
1394 if( !testPath( &pathTestInfo[ i ] ) )
1401 if( pathTestInfo[ i ].fileMajor )
1404 puts(
"Path processing succeeded." );
1423 int i, complianceValue,
status;
1425 puts(
"Testing invalid PKCS #1 padding handling..." );
1434 for( i = 1; i <= 11; i++ )
1440 printf(
"Couldn't import certificate for PKCS #1 padding check, "
1441 "status %d, line %d.\n", status, __LINE__ );
1447 printf(
"Certificate with bad PKSC #1 padding verified, should "
1448 "have failed, line %d.\n", __LINE__ );
1456 puts(
"Padding handling succeeded (all certs rejected).\n" );
1472 filePtr = fopen( fileName,
"rb" );
1473 assert( filePtr != NULL );
1475 length = ftell( filePtr );
1479 bufPtr = malloc( length );
1480 assert( bufPtr != NULL );
1482 count = fread( bufPtr, 1, length, filePtr );
1483 assert( count == length );
1487 if( bufPtr != buffer )
1501 if( caFileNameOpt == NULL )