System test OpenSSL integration

Author: ctz

revoke-test/tests/api/openssl.rs

@@ -0,0 +1,162 @@
+use core::ffi::{c_int, c_long, c_void};
+use core::{mem, ptr};
+use std::ffi::CString;
+
+use base64::{Engine, prelude::BASE64_STANDARD};
+use openssl_sys::{
+    OPENSSL_STACK, OPENSSL_sk_free, OPENSSL_sk_new_null, OPENSSL_sk_push, SSL, SSL_CTX,
+    SSL_CTX_free, SSL_CTX_new, SSL_free, SSL_get_ex_data_X509_STORE_CTX_idx, SSL_new,
+    TLS_client_method, X509_STORE_CTX, X509_STORE_CTX_free, X509_STORE_CTX_get_error,
+    X509_STORE_CTX_new, X509_V_ERR_CERT_REVOKED, d2i_X509, stack_st_X509,
+};
+use rustls_pki_types::CertificateDer;
+use upki_ffi::{upki_config_new, upki_result};
+use upkiopenssl::{upki_openssl_set_config, upki_openssl_verify_callback};
+
+use super::{TEST_CONFIG_PATH, TestResult};
+use revoke_test::CertificateDetail;
+
+pub(super) fn openssl(detail: &CertificateDetail) -> TestResult {
+    let mut chain = Chain::new();
+
+    for cert in [&detail.end_entity_cert]
+        .into_iter()
+        .chain(detail.intermediates.iter())
+        .map(|c| {
+            CertificateDer::from(
+                BASE64_STANDARD
+                    .decode(c)
+                    .expect("cannot decode cert"),
+            )
+        })
+    {
+        chain.push(&cert);
+    }
+
+    let mut config = ptr::null_mut();
+    assert!(matches!(
+        unsafe {
+            upki_config_new(
+                CString::new(TEST_CONFIG_PATH)
+                    .unwrap()
+                    .as_ptr(),
+                &mut config,
+            )
+        },
+        upki_result::UPKI_OK
+    ));
+
+    let ssl_ctx = SslCtx::new();
+    unsafe { upki_openssl_set_config(ssl_ctx.0, config) };
+
+    let ssl = ssl_ctx.new_ssl();
+
+    let mut store_ctx = StoreCtx::new();
+    store_ctx.attach_ssl(ssl.0);
+    store_ctx.set_error_depth(0);
+    store_ctx.set_verified_chain(chain);
+
+    let rc = unsafe { upki_openssl_verify_callback(1, store_ctx.0) };
+
+    drop(ssl); // extend lifetime over store_ctx
+
+    match rc {
+        1 => TestResult::IncorrectlyNotRevoked,
+        0 if store_ctx.error() == X509_V_ERR_CERT_REVOKED => TestResult::CorrectlyRevoked,
+        _ => panic!(
+            "upki_openssl_verify_callback failed with rc={rc:?} store_ctx.error={:?}",
+            store_ctx.error()
+        ),
+    }
+}
+
+struct SslCtx(*mut SSL_CTX);
+
+impl SslCtx {
+    fn new() -> Self {
+        Self(unsafe { SSL_CTX_new(TLS_client_method()) })
+    }
+
+    fn new_ssl(&self) -> Ssl {
+        Ssl(unsafe { SSL_new(self.0) })
+    }
+}
+
+impl Drop for SslCtx {
+    fn drop(&mut self) {
+        unsafe { SSL_CTX_free(self.0) };
+    }
+}
+
+struct Ssl(*mut SSL);
+
+impl Drop for Ssl {
+    fn drop(&mut self) {
+        unsafe { SSL_free(self.0) };
+    }
+}
+
+struct StoreCtx(*mut X509_STORE_CTX);
+
+impl StoreCtx {
+    fn new() -> Self {
+        Self(unsafe { X509_STORE_CTX_new() })
+    }
+
+    fn error(&self) -> c_int {
+        unsafe { X509_STORE_CTX_get_error(self.0) }
+    }
+
+    fn set_error_depth(&mut self, depth: i32) {
+        unsafe { X509_STORE_CTX_set_error_depth(self.0, depth) };
+    }
+
+    fn set_verified_chain(&mut self, mut chain: Chain) {
+        unsafe { X509_STORE_CTX_set0_verified_chain(self.0, chain.steal()) };
+    }
+
+    fn attach_ssl(&mut self, ssl: *mut SSL) {
+        unsafe {
+            X509_STORE_CTX_set_ex_data(self.0, SSL_get_ex_data_X509_STORE_CTX_idx(), ssl.cast())
+        };
+    }
+}
+
+impl Drop for StoreCtx {
+    fn drop(&mut self) {
+        unsafe { X509_STORE_CTX_free(self.0) }
+    }
+}
+
+struct Chain(*mut stack_st_X509);
+
+impl Chain {
+    fn new() -> Self {
+        Self(unsafe { OPENSSL_sk_new_null() as *mut stack_st_X509 })
+    }
+
+    fn push(&mut self, der_bytes: &[u8]) {
+        unsafe {
+            let mut ptr = der_bytes.as_ptr();
+            let x509 = d2i_X509(ptr::null_mut(), &mut ptr, der_bytes.len() as c_long);
+            assert!(!x509.is_null());
+            OPENSSL_sk_push(self.0 as *mut OPENSSL_STACK, x509 as *mut c_void);
+        }
+    }
+
+    fn steal(&mut self) -> *mut stack_st_X509 {
+        mem::replace(&mut self.0, ptr::null_mut())
+    }
+}
+
+impl Drop for Chain {
+    fn drop(&mut self) {
+        unsafe { OPENSSL_sk_free(self.0 as *mut OPENSSL_STACK) }
+    }
+}
+
+unsafe extern "C" {
+    fn X509_STORE_CTX_set_error_depth(ctx: *mut X509_STORE_CTX, depth: c_int);
+    fn X509_STORE_CTX_set0_verified_chain(ctx: *mut X509_STORE_CTX, chain: *mut stack_st_X509);
+    fn X509_STORE_CTX_set_ex_data(ctx: *mut X509_STORE_CTX, idx: c_int, ptr: *mut c_void);
+}

revoke-test/tests/system_tests.rs

@@ -19,6 +19,8 @@ use rustls_upki::{Policy, ServerVerifier};
 
 #[path = "api/ffi.rs"]
 mod ffi;
+#[path = "api/openssl.rs"]
+mod openssl;
 
 #[ignore]
 #[test]
@@ -50,6 +52,7 @@ fn real_world_system_tests() {
 
     let high_level_cli = test_each_site(tests.sites.iter(), high_level_cli, "cli");
     let ffi = test_each_site(tests.sites.iter(), ffi::ffi, "ffi");
+    let openssl = test_each_site(tests.sites.iter(), openssl::openssl, "openssl");
 
     let verifier = ServerVerifier::new(
         Policy::default(),
@@ -63,12 +66,13 @@ fn real_world_system_tests() {
 
     let rustls_results = test_each_site(tests.sites.iter(), verifier, "rustls");
 
-    for (((site, high), rustls), ffi) in tests
+    for ((((site, high), rustls), ffi), openssl) in tests
         .sites
         .iter()
         .zip(high_level_cli.iter())
         .zip(rustls_results.iter())
         .zip(ffi.iter())
+        .zip(openssl.iter())
     {
         assert!(
             high == rustls || *high == rustls.expired_as_revoked(),
@@ -78,6 +82,10 @@ fn real_world_system_tests() {
             high == ffi,
             "site {site:?} revocation result disagrees between high-level API ({high:?}) and FFI API ({ffi:?})"
         );
+        assert!(
+            high == openssl,
+            "site {site:?} revocation result disagrees between high-level API ({high:?}) and OpenSSL API ({openssl:?})"
+        );
     }
 }
 

upki-openssl/Cargo.toml

@@ -8,7 +8,7 @@ repository.workspace = true
 
 [lib]
 name = "upkiopenssl"
-crate-type = ["cdylib"]
+crate-type = ["cdylib", "lib"]
 
 [dependencies]
 openssl-sys = { workspace = true }