From a9c5e686cb240b1301b7b49cc8d75291e8d095fb Mon Sep 17 00:00:00 2001 From: Wangchong Zhou Date: Thu, 27 Feb 2020 05:46:50 +0800 Subject: [PATCH] src/openssl.c: enable check for revocation if CRL is added to store --- regress/180-store-verify-crl.lua | 138 +++++++++++++++++++++++++++++++ src/openssl.c | 7 ++ 2 files changed, 145 insertions(+) create mode 100644 regress/180-store-verify-crl.lua diff --git a/regress/180-store-verify-crl.lua b/regress/180-store-verify-crl.lua new file mode 100644 index 0000000..b33240b --- /dev/null +++ b/regress/180-store-verify-crl.lua @@ -0,0 +1,138 @@ +local regress = require "regress" + +local x509 = require "openssl.x509" +local store = require "openssl.x509.store" +local chain = require "openssl.x509.chain" +local crl = require "openssl.x509.crl" + +-- the cert to be verified +local c = x509.new([[-----BEGIN CERTIFICATE----- +MIIFZTCCA02gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwWzELMAkGA1UEBhMCVVMx +CzAJBgNVBAgMAkNBMQ0wCwYDVQQKDARrb25nMQwwCgYDVQQLDANGVFQxIjAgBgNV +BAMMGXd3dy5pbnRlcm1lZGlhdGUua29uZy5jb20wHhcNMjAwMjI1MTkxNzQ1WhcN +MjEwMjI0MTkxNzQ1WjBiMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExCzAJBgNV +BAcMAlNGMQ0wCwYDVQQKDARrb25nMQwwCgYDVQQLDANGVFQxHDAaBgNVBAMME3d3 +dy5zaGFzaGkua29uZy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB +AQDnJZyax9cmO6M6Iv2wm8FQlpko1+NyOPO2Hz20gYVfKElD66sfqrjL/DJVSxig +XREnJYoXjym+udBWiIQsRDvYVjYuyKU5Nl4jAZcei/IhpGrZpiFNQ4KX3Ed61ZBI +hzNiNuscvQZi9MTnmNbIIMJ/cbkOtqLmTnsZalEh35F62H1A4VPbAMU3UZDD1Hjc +wqKMCvkySg1HnH48571SGMqBvH33xZn5lL/814x75imRxM56LcnLSe8iR02nFJu2 +EAWiR7w+i+WWAQZ4IsyIGMJbw6q0YVDKoiw7iKaetQc3Lq0txyWa4cX+VFczrJqD +VmSboh5cwifydauIcpFQE7aTAgMBAAGjggEqMIIBJjAJBgNVHRMEAjAAMBEGCWCG +SAGG+EIBAQQEAwIFoDAzBglghkgBhvhCAQ0EJhYkT3BlblNTTCBHZW5lcmF0ZWQg +Q2xpZW50IENlcnRpZmljYXRlMB0GA1UdDgQWBBRCTdv48WUjZIJZ5AYplljLA3im +AjAfBgNVHSMEGDAWgBQILuNz6qJ5qT3NyVsxUxkzFwT0ajAOBgNVHQ8BAf8EBAMC +BeAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMDEGCCsGAQUFBwEBBCUw +IzAhBggrBgEFBQcwAYYVaHR0cDovLzEyNy4wLjAuMToyNTYwMC8GA1UdHwQoMCYw +JKAioCCGHmh0dHA6Ly8xMjcuMC4wLjE6ODA4MC9rb25nLmNybDANBgkqhkiG9w0B +AQsFAAOCAgEAUyZlN2K6WdSQZ+C7dv6nVBfEnsXfr0j24pLoqqjwszXj5fv4YhTO +5mikWbdxyx+wTcRqidEPabm+aF02kn78I5eOhdfxo1WSak7tsUkeFA0v63rABkXl +AsBh39HYwnHVGz8X9pmj7njRr+d/D3MX9f5GTWzrqJuv+H7ig9TszIDNSFBC6HaQ +QUL6TLLwuYqb5QNk3OQQ6INeL1FTD+Gx7h1N+DLwEhM+ftPe1dsNZYs/kVsUC7dA +Vn+OMGAtXyEnISR4VGWUGwOKlTEIWVRDPvFfgUKh83TQUMZw3x6pbvA3uB0RzVKd +Y+gHtYb2wOqeXU9WEzCY8g4cqQSU3evK+hMoUPvki4XuYht5K24DzkDxbXmDNOlv +hs1te7jRv6t6zLYe9R3eq/UPEUk7YPo2MFZ7xmnrSmCLg2DbRCBjgV6ssAfXtz+/ +nKiO8DgxWqEp/dibtR58iGLakkFBkxeOsWU9L1aq3ixVYoFNL6qdMiXhfy95gvSf +BgshBXpyMM4HLaZ0u4QdhzJVP0wE8X2VrEd6LhX1v2Ka/kpLITYoJP2sfCAn2uNK +9AQtuWs+oneXl0mGwsEXATirf9sBPjQ1iVr//EYs/fg0B+wCtS1afD+32fM+sy+q +0PfOiXBDPWEdIGZxx+SYBUhE1fmEx/TgeZQIG9rLNHZdVoRwgQspLMI= +-----END CERTIFICATE----- +]]) + +local s = store.new() +local ch = chain.new() + +-- intermediate +ch:add(x509.new([[-----BEGIN CERTIFICATE----- +MIIFnTCCA4WgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwYDELMAkGA1UEBhMCVVMx +CzAJBgNVBAgMAkNBMQswCQYDVQQHDAJTRjENMAsGA1UECgwEa29uZzEMMAoGA1UE +CwwDRlRUMRowGAYDVQQDDBF3d3cucm9vdC5rb25nLmNvbTAeFw0yMDAyMjQxODU1 +MTRaFw0zMDAyMjExODU1MTRaMFsxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEN +MAsGA1UECgwEa29uZzEMMAoGA1UECwwDRlRUMSIwIAYDVQQDDBl3d3cuaW50ZXJt +ZWRpYXRlLmtvbmcuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +z/gq5K3Y9iKPRTm/tp8tbqCCh4UGpXElclJNF56Vt4/bUur3m5N++TcApMta4+pY +HfhDDszc8OaBc5C6cmbnwW5WEUBOP8GnBu4Tz/2j9neuwaywajrObXP1LuSacVq/ +agud+CQCTqlnJPx4f6q2c4jimQv9apjyLzuzLJ61FZMKmggD0lwAiZacUQ2KDKSE +e3ZmdXxNjFk3vHOHZcZQvJNFcVcQZRDvlgqkSDcDbDvgncJnxXPLgIM7keJe1xOM +oHoi3wt6oQS4bAWDN8EGcu6RPkxhfYCGXxGXSL2858nxVdI94FRW+RN6Y/RqsNbc +g12ZCa+xAZnR7O64pSKqzCwhJcV0tAA48J5o4mbAYEbSfb6MJbD0pSbxjQALjfaA +5Ezc+lkKu5Gzk7Xfvh5qGxsyWw4xLjLClMRGwcJq27HV3eQ1Kwq+JhtFNZBCzGZK +F/rEzAb1IZxuNO0DNIEuNZgpJzOREDxgvM2n3cviaYpVtwQmKJcIGPrZ5PsZUuFC +ShTPPxz0yMMUjCW8Ovla/2yMQ7B7JVmCwXPqxpaOZ/W8kIsr0qyeWxge8BUVQpVx +kqI0zpSaGMWrkqaZDUMxUY0wJTYBcfm/ttES5XTv+/zZtYWt/Kad70k6jBsRS4h0 +hJdwC7rDg2ELFoF+nDQA/aTo/e8G46iSACUKjEGiML8CAwEAAaNmMGQwHQYDVR0O +BBYEFAgu43PqonmpPc3JWzFTGTMXBPRqMB8GA1UdIwQYMBaAFHK4L2s3N0aajjVZ +6EWlyJW6FjVhMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0G +CSqGSIb3DQEBCwUAA4ICAQDPZ0/GGFTBShlfGXJ6LplU6nSBsv4cFvDgBPnTqe/6 +7W2BkT6OTEN1cA0muBArN4ZGF5kAXI5Rq+mUtKjelGtRfXRGbz1u6ezqqD+SM0x2 +ZEUjyrzDgOoc0++ThIOcmrEFwgcH1tmzC5xiXReSU+9cDrVinDkx5qrcrBNhrm+Q +jU5HnD9M9x4YKfYZ97YgmmD8P8JUdgFkBfKXn9ec0TsnBO88r7f3uOC/AEjSpT3g +K/EfzPQXRr3UO62dCLH7CJlc80P7y0haRXXMiPVs/fcHglRgb/lFwLw/BFuAdyNs +vIqxopwC5TCv8lqo5V4olc599/3VnD6QHj1TuYUFPq+dxSmWDSEwKKRYO2j9xOHw +KOeOOhQnCKhXq+1pVuT3cHfL8D3aOhA+ouBxf2opdFVo2YpvhqHCIX7uLfOvSt0f +8sAMSU+Vaxbg2z9vNwsuaPSeGm1Nx9IJn7ggoaR71gqK4eihHgEaBD6RrDDDgtSg +bIoxHH/rJNzDPeGpOard3jezYkxLpA/M1TvzBy2aly6+6Xlu/t+oERWeF2Av32Si +xH7FPTzd6SsL462A5uX04psUmgeQ9OGHpSDKS/JLralFoB+amVDl0S4slHBNhTg9 +u21gtUdre8KBMsRni3uvaW++DjGpXiSqBvAejO8zq1x+VppCap9OWRcwkklpSzuK +dA== +-----END CERTIFICATE----- +]])) + +-- CA +s:add(x509.new([[-----BEGIN CERTIFICATE----- +MIIFsTCCA5mgAwIBAgIUGwM+/eUddS57Nb6ve6PGVyvrnvswDQYJKoZIhvcNAQEL +BQAwYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQswCQYDVQQHDAJTRjENMAsG +A1UECgwEa29uZzEMMAoGA1UECwwDRlRUMRowGAYDVQQDDBF3d3cucm9vdC5rb25n +LmNvbTAeFw0yMDAyMjQxODU1MTRaFw0zMDAyMjExODU1MTRaMGAxCzAJBgNVBAYT +AlVTMQswCQYDVQQIDAJDQTELMAkGA1UEBwwCU0YxDTALBgNVBAoMBGtvbmcxDDAK +BgNVBAsMA0ZUVDEaMBgGA1UEAwwRd3d3LnJvb3Qua29uZy5jb20wggIiMA0GCSqG +SIb3DQEBAQUAA4ICDwAwggIKAoICAQDmZLUv5+fzzw8WZAo+0fg+ZuD50JY+BugO +WW/vfvNr55K4pzYhVB2KdLeLswHtAx//BSs1wvtASkWBG0rB8xIICNersKAtaykY +DTGwbzzWq6xF2qhCGeN/9rwdlQw1y8m07J/AGIPsTuW0uX4WxJsS+Z1AIZBQnQGI +mKW1k0lVCyWLjCqFF7wtSfLpEC6e43YBov0Fb6DZHBAulVkt0bAlKOq+VrFec9EL +B0xZQdWGI8Q0XlJ7Ub8Vn1ISvBLnPaM+gNVmDm1QHe0NqMVEaI4zYzMkP768Mkld +OVBOh8LOMtA1Lp19Lz9j06nUX7JQIo9e6SA3tHF3iVo7vOUZmBUNJmQtGSI+nVPy +0LUGMXyUlpFWFzQr9KFeOf7huezQYPhlzybpfv5N8HllxjFNhl/dp33GuJ8DQCSt +qGUn6azRXQQ2lSX0P/JsfKZc1EM3tRmqS1pAj1w23gIwocsuQvbgdc4LYNk0BPhx +MUvWj6vWYZjXiSgLTUAkDrqTFKDIMaOKbf8jFUJyAXtUxuhZkuxm5J7dbji+UWjY +UzN4sArGwk2pj4MElXXvRHIvcrVwtwWIZ/MqMsc5J+sOZhu1uuKmcx6rmiJRqUnM +IO8hUBLFY1HMGB7VokdqfQPsY65y++d307Gz/3onidlyGG8Uz4qCOc1B2dVM68K3 +LrXFGN5dxwIDAQABo2MwYTAdBgNVHQ4EFgQUcrgvazc3RpqONVnoRaXIlboWNWEw +HwYDVR0jBBgwFoAUcrgvazc3RpqONVnoRaXIlboWNWEwDwYDVR0TAQH/BAUwAwEB +/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBAFzE9SZa1UpvmVzj +ZYlPRCt+B2OfsZ57kfZXMw4jBs+Bid1CLP3Hq2+Xr9TwYDRjaP8fm5nMoXOeFjhg +qIF+lmIJf85hdVvz1ratB9Jvj9bpGx6vUS6x8tg5yji3D9RxKBrmXE4RmmKyV+7T +mg3BJtwAwa944nULoebqg031ovcnSMwHle9pvfQ4k4HkQL1gGFUd84t45A3oVnqx +a+DVre/KaR92E/NlaAb9Re9mNG+euh2s8RKxRpuAeDlzuQTi1Ck9IE0Iwamfn/6B +3fZyQ41VEZuW/jqXMcTrDYwmnI8bWygUFyQjKdZDGbU2pbKqGLPdCRgQOEO06RLd +DasUk+71GHNe7n8wj781LOdqjGpXXwvfBxZgge4TwsrnxMvtfk6wJh9qHYbE+ElS +SmB2ggtwgPyq3nK97VdhzCVWUR5m3uKO7P82E6JBW5N38DPUFoNXnH30J2EuB4rx +4NhG+uqTft3YQwyUxZNkOMnJ5KRLm7uFdgayLDSO1xc1Sxa0EegzJH75jGq8WdAq +CCpSk7i3ZFcGtAJyrbTofL1UTPvZtUuMBpIlhe+LGXKKATVDXH4R7KmRranjbggo +D8EAGv74WfAVyV0PZsJlfQDkqOmfoA2kf4FwHGaR1fj8zN80hLU0Ne59MC4j02Xd +fHkHWlcFxuEgWRqCXKtlBK9M9C39 +-----END CERTIFICATE----- +]])) + +local crrr = crl.new([[-----BEGIN X509 CRL----- +MIIC7TCB1gIBATANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJVUzELMAkGA1UE +CAwCQ0ExDTALBgNVBAoMBGtvbmcxDDAKBgNVBAsMA0ZUVDEiMCAGA1UEAwwZd3d3 +LmludGVybWVkaWF0ZS5rb25nLmNvbRcNMjAwMjI2MTgyNzQ5WhcNMjAwMzI3MTgy +NzQ5WjAVMBMCAhABFw0yMDAyMjYxODE2NDFaoDAwLjAfBgNVHSMEGDAWgBQILuNz +6qJ5qT3NyVsxUxkzFwT0ajALBgNVHRQEBAICEAEwDQYJKoZIhvcNAQELBQADggIB +AMawanOynHVLn45dFoAhANLU5LWbPZIEMHjeH4QxglLocbcYF80Iv5kV/YiZkmm9 +6gvEEienoeWQqmtrF0TzOk90N3CywPHICwlDreTXCuLxHlJyiLTGgggtAr0oEQ05 +XqIOaTlzaU7spE213qSNdyMdKrRFidouVARtVYmfRaJ4XWwmp/HhDqL1QtcpwWXw ++5ogmrfuS7q614nUpm8Ae6AfUZ6nVSoidImFvQVALpTkbFSmRH8xhyFFo0zK/7t/ +anJPvboqSND680J7bGJZZI3T60B+uQIxaYIOONwx3HtoFHs/HMjcQc2J80NKpiFR +FGc981T2caVGfDOke/NLRurzfpKmamNVLdYVkePivM+aB7HFnjZLN82EEIXJTC89 +BlIkuW5d4N++eGXU4KibmtyVMualLp3vcinde8ZDxkW8f033ed5nuttlccD0mpo1 +BimgELq5cNMsSHGjdYKCMnBF8nS+Pof/eMM2oNtuciHaWyY9xlmRdt5hxO4f+L7n +pjHc6QRYWMl2aMJ4BCjOns6bNDMqcmmSPy7XJuxWS3M11ILZQHDrFq1uIeWyH3ZA +Fl+0XJFdLpNGCaE0bas5L1y1Di3lHINSapbFJeG4TddHw+bfTkrGarndPR1MbJIq +epS2sIgEJDLNwEXo002Lw1kQ/DlZrjQmoznzXZEf1MDj +-----END X509 CRL-----]]) +s:add(crrr) + +-- should fail +regress.check(not s:verify(c, ch)) diff --git a/src/openssl.c b/src/openssl.c index 9a9de0f..8543d45 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -8726,6 +8726,13 @@ static int xs_add(lua_State *L) { X509_CRL_free(crl_dup); return auxL_error(L, auxL_EOPENSSL, "x509.store:add"); } + + /* enable check revocation of chain leaf certificate if CRL is added to store*/ + if (!X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK)) { + X509_CRL_free(crl_dup); + return auxL_error(L, auxL_EOPENSSL, "x509.store:add"); + } + } else { const char *path = luaL_checkstring(L, i); struct stat st;