luna - wolfssl/tests/api/test_ossl_x509

   1/* test_ossl_x509_ext.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#ifdef NO_INLINE
  25    #include <wolfssl/wolfcrypt/misc.h>
  26#else
  27    #define WOLFSSL_MISC_INCLUDED
  28    #include <wolfcrypt/src/misc.c>
  29#endif
  30
  31#include <wolfssl/ssl.h>
  32#include <wolfssl/openssl/x509v3.h>
  33#include <wolfssl/internal.h>
  34#ifdef OPENSSL_EXTRA
  35    #include <wolfssl/openssl/pem.h>
  36#endif
  37#include <tests/api/api.h>
  38#include <tests/api/test_ossl_x509_ext.h>
  39
  40
  41int test_wolfSSL_X509_get_extension_flags(void)
  42{
  43    EXPECT_DECLS;
  44#if defined(OPENSSL_ALL) && !defined(NO_RSA)
  45    XFILE f = XBADFILE;
  46    X509* x509 = NULL;
  47    unsigned int extFlags;
  48    unsigned int keyUsageFlags;
  49    unsigned int extKeyUsageFlags;
  50
  51    ExpectIntEQ(X509_get_extension_flags(NULL), 0);
  52    ExpectIntEQ(X509_get_key_usage(NULL), 0);
  53    ExpectIntEQ(X509_get_extended_key_usage(NULL), 0);
  54    ExpectNotNull(x509 = wolfSSL_X509_new());
  55    ExpectIntEQ(X509_get_extension_flags(x509), 0);
  56    ExpectIntEQ(X509_get_key_usage(x509), -1);
  57    ExpectIntEQ(X509_get_extended_key_usage(x509), 0);
  58    wolfSSL_X509_free(x509);
  59    x509 = NULL;
  60
  61    /* client-int-cert.pem has the following extension flags. */
  62    extFlags = EXFLAG_KUSAGE | EXFLAG_XKUSAGE;
  63    /* and the following key usage flags. */
  64    keyUsageFlags = KU_DIGITAL_SIGNATURE
  65                  | KU_NON_REPUDIATION
  66                  | KU_KEY_ENCIPHERMENT;
  67    /* and the following extended key usage flags. */
  68    extKeyUsageFlags = XKU_SSL_CLIENT | XKU_SMIME;
  69
  70    ExpectTrue((f = XFOPEN("./certs/intermediate/client-int-cert.pem", "rb")) !=
  71        XBADFILE);
  72    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
  73    if (f != XBADFILE) {
  74        XFCLOSE(f);
  75        f = XBADFILE;
  76    }
  77    ExpectIntEQ(X509_get_extension_flags(x509), extFlags);
  78    ExpectIntEQ(X509_get_key_usage(x509), keyUsageFlags);
  79    ExpectIntEQ(X509_get_extended_key_usage(x509), extKeyUsageFlags);
  80    X509_free(x509);
  81    x509 = NULL;
  82
  83    /* client-cert-ext.pem has the following extension flags. */
  84    extFlags = EXFLAG_KUSAGE;
  85    /* and the following key usage flags. */
  86    keyUsageFlags = KU_DIGITAL_SIGNATURE
  87                  | KU_KEY_CERT_SIGN
  88                  | KU_CRL_SIGN;
  89
  90    ExpectTrue((f = fopen("./certs/client-cert-ext.pem", "rb")) != XBADFILE);
  91    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
  92    if (f != XBADFILE)
  93        XFCLOSE(f);
  94    ExpectIntEQ(X509_get_extension_flags(x509), extFlags);
  95    ExpectIntEQ(X509_get_key_usage(x509), keyUsageFlags);
  96    X509_free(x509);
  97#endif /* OPENSSL_ALL */
  98    return EXPECT_RESULT();
  99}
 100
 101int test_wolfSSL_X509_get_ext(void)
 102{
 103    EXPECT_DECLS;
 104#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
 105    int ret = 0;
 106    XFILE f = XBADFILE;
 107    WOLFSSL_X509* x509 = NULL;
 108    WOLFSSL_X509_EXTENSION* foundExtension;
 109
 110    ExpectTrue((f = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 111    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(f, NULL, NULL, NULL));
 112    if (f != XBADFILE)
 113        XFCLOSE(f);
 114    ExpectIntEQ((ret = wolfSSL_X509_get_ext_count(x509)), 5);
 115
 116    /* wolfSSL_X509_get_ext() valid input */
 117    ExpectNotNull(foundExtension = wolfSSL_X509_get_ext(x509, 0));
 118
 119    /* wolfSSL_X509_get_ext() valid x509, idx out of bounds */
 120    ExpectNull(foundExtension = wolfSSL_X509_get_ext(x509, -1));
 121    ExpectNull(foundExtension = wolfSSL_X509_get_ext(x509, 100));
 122
 123    /* wolfSSL_X509_get_ext() NULL x509, idx out of bounds */
 124    ExpectNull(foundExtension = wolfSSL_X509_get_ext(NULL, -1));
 125    ExpectNull(foundExtension = wolfSSL_X509_get_ext(NULL, 100));
 126
 127    /* wolfSSL_X509_get_ext() NULL x509, valid idx */
 128    ExpectNull(foundExtension = wolfSSL_X509_get_ext(NULL, 0));
 129
 130    ExpectNull(wolfSSL_X509_get0_extensions(NULL));
 131
 132    wolfSSL_X509_free(x509);
 133#endif
 134    return EXPECT_RESULT();
 135}
 136
 137int test_wolfSSL_X509_get_ext_by_NID(void)
 138{
 139    EXPECT_DECLS;
 140#if defined(OPENSSL_ALL) && !defined(NO_RSA)
 141    int rc = 0;
 142    XFILE f = XBADFILE;
 143    WOLFSSL_X509* x509 = NULL;
 144    ASN1_OBJECT* obj = NULL;
 145
 146    ExpectNotNull(x509 = wolfSSL_X509_new());
 147    ExpectIntEQ(wolfSSL_X509_get_ext_by_NID(x509, NID_basic_constraints, -1),
 148        WOLFSSL_FATAL_ERROR);
 149    wolfSSL_X509_free(x509);
 150    x509 = NULL;
 151
 152    ExpectTrue((f = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 153    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(f, NULL, NULL, NULL));
 154    if (f != XBADFILE)
 155        XFCLOSE(f);
 156
 157    ExpectIntGE(rc = wolfSSL_X509_get_ext_by_NID(x509, NID_basic_constraints,
 158        -1), 0);
 159    ExpectIntGE(wolfSSL_X509_get_ext_by_NID(x509, NID_basic_constraints, 20),
 160        -1);
 161
 162    /* Start search from last location (should fail) */
 163    ExpectIntGE(rc = wolfSSL_X509_get_ext_by_NID(x509, NID_basic_constraints,
 164        rc), -1);
 165
 166    ExpectIntGE(rc = wolfSSL_X509_get_ext_by_NID(x509, NID_basic_constraints,
 167        -2), -1);
 168
 169    ExpectIntEQ(rc = wolfSSL_X509_get_ext_by_NID(NULL, NID_basic_constraints,
 170        -1), -1);
 171
 172    ExpectIntEQ(rc = wolfSSL_X509_get_ext_by_NID(x509, NID_undef, -1), -1);
 173
 174    /* NID_ext_key_usage, check also its nid and oid */
 175    ExpectIntGT(rc = wolfSSL_X509_get_ext_by_NID(x509, NID_ext_key_usage, -1),
 176        -1);
 177    ExpectNotNull(obj = wolfSSL_X509_EXTENSION_get_object(wolfSSL_X509_get_ext(
 178        x509, rc)));
 179    ExpectIntEQ(obj->nid, NID_ext_key_usage);
 180    ExpectIntEQ(obj->type, EXT_KEY_USAGE_OID);
 181
 182    wolfSSL_X509_free(x509);
 183#endif
 184    return EXPECT_RESULT();
 185}
 186
 187int test_wolfSSL_X509_get_ext_subj_alt_name(void)
 188{
 189    EXPECT_DECLS;
 190#if defined(OPENSSL_ALL) && !defined(NO_RSA)
 191    int rc = 0;
 192    XFILE f = XBADFILE;
 193    WOLFSSL_X509* x509 = NULL;
 194    WOLFSSL_X509_EXTENSION* ext = NULL;
 195    WOLFSSL_ASN1_STRING* sanString = NULL;
 196    byte* sanDer = NULL;
 197
 198    const byte expectedDer[] = {
 199        0x30, 0x13, 0x82, 0x0b, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e,
 200        0x63, 0x6f, 0x6d, 0x87, 0x04, 0x7f, 0x00, 0x00, 0x01};
 201
 202    ExpectTrue((f = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 203    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
 204    if (f != XBADFILE)
 205        XFCLOSE(f);
 206
 207    ExpectIntNE(rc = X509_get_ext_by_NID(x509, NID_subject_alt_name, -1), -1);
 208    ExpectNotNull(ext = X509_get_ext(x509, rc));
 209    ExpectNotNull(sanString = X509_EXTENSION_get_data(ext));
 210    ExpectIntEQ(ASN1_STRING_length(sanString), sizeof(expectedDer));
 211    ExpectNotNull(sanDer = ASN1_STRING_data(sanString));
 212    ExpectIntEQ(XMEMCMP(sanDer, expectedDer, sizeof(expectedDer)), 0);
 213
 214    X509_free(x509);
 215#endif
 216    return EXPECT_RESULT();
 217}
 218
 219int test_wolfSSL_X509_set_ext(void)
 220{
 221    EXPECT_DECLS;
 222#if defined(OPENSSL_ALL) && !defined(NO_RSA)
 223    WOLFSSL_X509* x509 = NULL;
 224    XFILE f = XBADFILE;
 225    int loc;
 226
 227    ExpectNull(wolfSSL_X509_set_ext(NULL, 0));
 228
 229    ExpectNotNull(x509 = wolfSSL_X509_new());
 230    /* Location too small. */
 231    ExpectNull(wolfSSL_X509_set_ext(x509, -1));
 232    /* Location too big. */
 233    ExpectNull(wolfSSL_X509_set_ext(x509, 1));
 234    /* No DER encoding. */
 235    ExpectNull(wolfSSL_X509_set_ext(x509, 0));
 236    wolfSSL_X509_free(x509);
 237    x509 = NULL;
 238
 239    ExpectTrue((f = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 240    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
 241    if (f != XBADFILE) {
 242        XFCLOSE(f);
 243    }
 244    for (loc = 0; loc < wolfSSL_X509_get_ext_count(x509); loc++) {
 245        ExpectNotNull(wolfSSL_X509_set_ext(x509, loc));
 246    }
 247
 248    wolfSSL_X509_free(x509);
 249#endif
 250    return EXPECT_RESULT();
 251}
 252
 253#if defined(OPENSSL_ALL)
 254static int test_X509_add_basic_constraints(WOLFSSL_X509* x509)
 255{
 256    EXPECT_DECLS;
 257    const byte basicConsObj[] = { 0x06, 0x03, 0x55, 0x1d, 0x13 };
 258    const byte* p;
 259    WOLFSSL_X509_EXTENSION* ext = NULL;
 260    WOLFSSL_ASN1_OBJECT* obj = NULL;
 261    ASN1_INTEGER* pathLen = NULL;
 262
 263    p = basicConsObj;
 264    ExpectNotNull(obj = wolfSSL_d2i_ASN1_OBJECT(NULL, &p,
 265        sizeof(basicConsObj)));
 266    if (obj != NULL) {
 267        obj->type = NID_basic_constraints;
 268    }
 269    ExpectNotNull(pathLen = wolfSSL_ASN1_INTEGER_new());
 270    if (pathLen != NULL) {
 271        pathLen->length = 2;
 272    }
 273    if (obj != NULL) {
 274        obj->ca = 0;
 275    }
 276    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 277    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
 278    if (ext != NULL && ext->obj != NULL) {
 279        ext->obj->ca = 0;
 280        ext->obj->pathlen = pathLen;
 281    }
 282    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 283    ExpectIntEQ(x509->isCa, 0);
 284    ExpectIntEQ(x509->pathLength, 2);
 285    ExpectIntEQ(x509->pathLengthSet, 1);
 286    if (ext != NULL && ext->obj != NULL) {
 287        /* Add second time to without path length. */
 288        ext->obj->ca = 1;
 289        ext->obj->pathlen = NULL;
 290    }
 291    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 292    ExpectIntEQ(x509->isCa, 1);
 293    ExpectIntEQ(x509->pathLength, 2);
 294    ExpectIntEQ(x509->pathLengthSet, 1);
 295    ExpectIntEQ(wolfSSL_X509_get_isSet_pathLength(NULL), 0);
 296    ExpectIntEQ(wolfSSL_X509_get_isSet_pathLength(x509), 1);
 297    ExpectIntEQ(wolfSSL_X509_get_pathLength(NULL), 0);
 298    ExpectIntEQ(wolfSSL_X509_get_pathLength(x509), 2);
 299
 300    wolfSSL_ASN1_INTEGER_free(pathLen);
 301    wolfSSL_ASN1_OBJECT_free(obj);
 302    wolfSSL_X509_EXTENSION_free(ext);
 303
 304    return EXPECT_RESULT();
 305}
 306
 307static int test_X509_add_key_usage(WOLFSSL_X509* x509)
 308{
 309    EXPECT_DECLS;
 310    const byte objData[] = { 0x06, 0x03, 0x55, 0x1d, 0x0f };
 311    const byte data[] = { 0x04, 0x02, 0x01, 0x80 };
 312    const byte emptyData[] = { 0x04, 0x00 };
 313    const char* strData = "digitalSignature,keyCertSign";
 314    const byte* p;
 315    WOLFSSL_X509_EXTENSION* ext = NULL;
 316    WOLFSSL_ASN1_OBJECT* obj = NULL;
 317    WOLFSSL_ASN1_STRING* str = NULL;
 318
 319    p = objData;
 320    ExpectNotNull(obj = wolfSSL_d2i_ASN1_OBJECT(NULL, &p, sizeof(objData)));
 321    if (obj != NULL) {
 322        obj->type = NID_key_usage;
 323    }
 324    p = data;
 325    ExpectNotNull(str = d2i_ASN1_OCTET_STRING(NULL, &p, (long)sizeof(data)));
 326    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 327    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
 328    /* No Data - no change. */
 329    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 330    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 331    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 332    ExpectIntEQ(x509->keyUsage, KEYUSE_DECIPHER_ONLY | KEYUSE_ENCIPHER_ONLY);
 333
 334    /* Add second time with string to interpret. */
 335    wolfSSL_ASN1_STRING_free(str);
 336    str = NULL;
 337    ExpectNotNull(str = wolfSSL_ASN1_STRING_new());
 338    ExpectIntEQ(ASN1_STRING_set(str, strData, (word32)XSTRLEN(strData) + 1),
 339        WOLFSSL_SUCCESS);
 340    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 341    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 342    ExpectIntEQ(x509->keyUsage, KEYUSE_DIGITAL_SIG | KEYUSE_KEY_CERT_SIGN);
 343
 344    /* Empty data. */
 345    wolfSSL_ASN1_STRING_free(str);
 346    str = NULL;
 347    p = emptyData;
 348    ExpectNotNull(str = d2i_ASN1_OCTET_STRING(NULL, &p,
 349        (long)sizeof(emptyData)));
 350    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 351    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_FAILURE);
 352
 353    /* Invalid string to parse. */
 354    wolfSSL_ASN1_STRING_free(str);
 355    str = NULL;
 356    ExpectNotNull(str = wolfSSL_ASN1_STRING_new());
 357    ExpectIntEQ(ASN1_STRING_set(str, "bad", 4), WOLFSSL_SUCCESS);
 358    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 359    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_FAILURE);
 360
 361    wolfSSL_ASN1_STRING_free(str);
 362    wolfSSL_ASN1_OBJECT_free(obj);
 363    wolfSSL_X509_EXTENSION_free(ext);
 364
 365    return EXPECT_RESULT();
 366}
 367
 368static int test_X509_add_ext_key_usage(WOLFSSL_X509* x509)
 369{
 370    EXPECT_DECLS;
 371    const byte objData[] = { 0x06, 0x03, 0x55, 0x1d, 0x25 };
 372    const byte data[] = { 0x04, 0x01, 0x01 };
 373    const byte emptyData[] = { 0x04, 0x00 };
 374    const char* strData = "serverAuth,codeSigning";
 375    const byte* p;
 376    WOLFSSL_X509_EXTENSION* ext = NULL;
 377    WOLFSSL_ASN1_OBJECT* obj = NULL;
 378    WOLFSSL_ASN1_STRING* str = NULL;
 379
 380    p = objData;
 381    ExpectNotNull(obj = wolfSSL_d2i_ASN1_OBJECT(NULL, &p, sizeof(objData)));
 382    if (obj != NULL) {
 383        obj->type = NID_ext_key_usage;
 384    }
 385    p = data;
 386    ExpectNotNull(str = d2i_ASN1_OCTET_STRING(NULL, &p, (long)sizeof(data)));
 387    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 388    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
 389    /* No Data - no change. */
 390    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 391    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 392    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 393    ExpectIntEQ(x509->extKeyUsage, EXTKEYUSE_ANY);
 394
 395    /* Add second time with string to interpret. */
 396    wolfSSL_ASN1_STRING_free(str);
 397    str = NULL;
 398    ExpectNotNull(str = wolfSSL_ASN1_STRING_new());
 399    ExpectIntEQ(ASN1_STRING_set(str, strData, (word32)XSTRLEN(strData) + 1),
 400        WOLFSSL_SUCCESS);
 401    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 402    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 403    ExpectIntEQ(x509->extKeyUsage, EXTKEYUSE_SERVER_AUTH | EXTKEYUSE_CODESIGN);
 404
 405    /* Empty data. */
 406    wolfSSL_ASN1_STRING_free(str);
 407    str = NULL;
 408    p = emptyData;
 409    ExpectNotNull(str = d2i_ASN1_OCTET_STRING(NULL, &p,
 410        (long)sizeof(emptyData)));
 411    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 412    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_FAILURE);
 413
 414    /* Invalid string to parse. */
 415    wolfSSL_ASN1_STRING_free(str);
 416    str = NULL;
 417    ExpectNotNull(str = wolfSSL_ASN1_STRING_new());
 418    ExpectIntEQ(ASN1_STRING_set(str, "bad", 4), WOLFSSL_SUCCESS);
 419    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 420    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_FAILURE);
 421
 422    wolfSSL_ASN1_STRING_free(str);
 423    wolfSSL_ASN1_OBJECT_free(obj);
 424    wolfSSL_X509_EXTENSION_free(ext);
 425
 426    return EXPECT_RESULT();
 427}
 428
 429static int test_x509_add_auth_key_id(WOLFSSL_X509* x509)
 430{
 431    EXPECT_DECLS;
 432    const byte objData[] = { 0x06, 0x03, 0x55, 0x1d, 0x23 };
 433    const byte data[] = {
 434        0x04, 0x81, 0xcc, 0x30, 0x81, 0xc9, 0x80, 0x14,
 435        0x27, 0x8e, 0x67, 0x11, 0x74, 0xc3, 0x26, 0x1d,
 436        0x3f, 0xed, 0x33, 0x63, 0xb3, 0xa4, 0xd8, 0x1d,
 437        0x30, 0xe5, 0xe8, 0xd5, 0xa1, 0x81, 0x9a, 0xa4,
 438        0x81, 0x97, 0x30, 0x81, 0x94, 0x31, 0x0b, 0x30,
 439        0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02,
 440        0x55, 0x53, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03,
 441        0x55, 0x04, 0x08, 0x0c, 0x07, 0x4d, 0x6f, 0x6e,
 442        0x74, 0x61, 0x6e, 0x61, 0x31, 0x10, 0x30, 0x0e,
 443        0x06, 0x03, 0x55, 0x04, 0x07, 0x0c, 0x07, 0x42,
 444        0x6f, 0x7a, 0x65, 0x6d, 0x61, 0x6e, 0x31, 0x11,
 445        0x30, 0x0f, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c,
 446        0x08, 0x53, 0x61, 0x77, 0x74, 0x6f, 0x6f, 0x74,
 447        0x68, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55,
 448        0x04, 0x0b, 0x0c, 0x0a, 0x43, 0x6f, 0x6e, 0x73,
 449        0x75, 0x6c, 0x74, 0x69, 0x6e, 0x67, 0x31, 0x18,
 450        0x30, 0x16, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c,
 451        0x0f, 0x77, 0x77, 0x77, 0x2e, 0x77, 0x6f, 0x6c,
 452        0x66, 0x73, 0x73, 0x6c, 0x2e, 0x63, 0x6f, 0x6d,
 453        0x31, 0x1f, 0x30, 0x1d, 0x06, 0x09, 0x2a, 0x86,
 454        0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16,
 455        0x10, 0x69, 0x6e, 0x66, 0x6f, 0x40, 0x77, 0x6f,
 456        0x6c, 0x66, 0x73, 0x73, 0x6c, 0x2e, 0x63, 0x6f,
 457        0x6d, 0x82, 0x14, 0x33, 0x44, 0x1a, 0xa8, 0x6c,
 458        0x01, 0xec, 0xf6, 0x60, 0xf2, 0x70, 0x51, 0x0a,
 459        0x4c, 0xd1, 0x14, 0xfa, 0xbc, 0xe9, 0x44
 460    };
 461    const byte* p;
 462    WOLFSSL_X509_EXTENSION* ext = NULL;
 463    WOLFSSL_ASN1_OBJECT* obj = NULL;
 464    WOLFSSL_ASN1_STRING* str = NULL;
 465
 466    p = objData;
 467    ExpectNotNull(obj = wolfSSL_d2i_ASN1_OBJECT(NULL, &p, sizeof(objData)));
 468    if (obj != NULL) {
 469        obj->type = NID_authority_key_identifier;
 470    }
 471    p = data;
 472    ExpectNotNull(str = d2i_ASN1_OCTET_STRING(NULL, &p, (long)sizeof(data)));
 473    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 474    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
 475    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 476    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 477
 478    /* Add second time with string to interpret. */
 479    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 480
 481    wolfSSL_ASN1_STRING_free(str);
 482    wolfSSL_ASN1_OBJECT_free(obj);
 483    wolfSSL_X509_EXTENSION_free(ext);
 484
 485    return EXPECT_RESULT();
 486}
 487
 488static int test_x509_add_subj_key_id(WOLFSSL_X509* x509)
 489{
 490    EXPECT_DECLS;
 491    const byte objData[] = { 0x06, 0x03, 0x55, 0x1d, 0x0e };
 492    const byte data[] = {
 493        0x04, 0x16, 0x04, 0x14, 0xb3, 0x11, 0x32, 0xc9,
 494        0x92, 0x98, 0x84, 0xe2, 0xc9, 0xf8, 0xd0, 0x3b,
 495        0x6e, 0x03, 0x42, 0xca, 0x1f, 0x0e, 0x8e, 0x3c
 496    };
 497    const byte* p;
 498    WOLFSSL_X509_EXTENSION* ext = NULL;
 499    WOLFSSL_ASN1_OBJECT* obj = NULL;
 500    WOLFSSL_ASN1_STRING* str = NULL;
 501
 502    p = objData;
 503    ExpectNotNull(obj = wolfSSL_d2i_ASN1_OBJECT(NULL, &p, sizeof(objData)));
 504    if (obj != NULL) {
 505        obj->type = NID_subject_key_identifier;
 506    }
 507    p = data;
 508    ExpectNotNull(str = d2i_ASN1_OCTET_STRING(NULL, &p, (long)sizeof(data)));
 509    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 510    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
 511    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, str), WOLFSSL_SUCCESS);
 512    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 513    /* Add second time with string to interpret. */
 514    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 515
 516    wolfSSL_ASN1_STRING_free(str);
 517    wolfSSL_ASN1_OBJECT_free(obj);
 518    wolfSSL_X509_EXTENSION_free(ext);
 519
 520    return EXPECT_RESULT();
 521}
 522#endif
 523
 524int test_wolfSSL_X509_add_ext(void)
 525{
 526    EXPECT_DECLS;
 527#if defined(OPENSSL_ALL)
 528    WOLFSSL_X509* x509 = NULL;
 529    WOLFSSL_X509_EXTENSION* ext_empty = NULL;
 530    WOLFSSL_X509_EXTENSION* ext = NULL;
 531    WOLFSSL_ASN1_OBJECT* obj = NULL;
 532    WOLFSSL_ASN1_STRING* data = NULL;
 533    const byte* p;
 534    const byte subjAltNameObj[] = { 0x06, 0x03, 0x55, 0x1d, 0x11 };
 535    const byte subjAltName[] = {
 536        0x04, 0x15, 0x30, 0x13, 0x82, 0x0b, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c,
 537        0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x87, 0x04, 0x7f, 0x00, 0x00, 0x01
 538    };
 539
 540    ExpectNotNull(x509 = wolfSSL_X509_new());
 541
 542    /* Create extension: Subject Alternative Name */
 543    ExpectNotNull(ext_empty = wolfSSL_X509_EXTENSION_new());
 544    p = subjAltName;
 545    ExpectNotNull(data = d2i_ASN1_OCTET_STRING(NULL, &p,
 546        (long)sizeof(subjAltName)));
 547    p = subjAltNameObj;
 548    ExpectNotNull(obj = wolfSSL_d2i_ASN1_OBJECT(NULL, &p,
 549        sizeof(subjAltNameObj)));
 550    if (obj != NULL) {
 551        obj->type = NID_subject_alt_name;
 552    }
 553    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 554    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
 555    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_data(ext, data), WOLFSSL_SUCCESS);
 556
 557    /* Failure cases. */
 558    ExpectIntEQ(wolfSSL_X509_add_ext(NULL, NULL, 0),
 559        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 560    ExpectIntEQ(wolfSSL_X509_add_ext(x509, NULL, 0),
 561        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 562    ExpectIntEQ(wolfSSL_X509_add_ext(NULL, ext, 0),
 563        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 564    ExpectIntEQ(wolfSSL_X509_add_ext(NULL, NULL, -1),
 565        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 566    ExpectIntEQ(wolfSSL_X509_add_ext(NULL, ext, -1),
 567        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 568    ExpectIntEQ(wolfSSL_X509_add_ext(x509, NULL, -1),
 569        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 570    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, 0),
 571        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 572    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext_empty, -1),
 573        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 574
 575    /* Add: Subject Alternative Name */
 576    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 577    /* Add second time to ensure no memory leaks. */
 578    ExpectIntEQ(wolfSSL_X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
 579
 580    wolfSSL_X509_EXTENSION_free(ext);
 581    wolfSSL_ASN1_OBJECT_free(obj);
 582    wolfSSL_ASN1_STRING_free(data);
 583    wolfSSL_X509_EXTENSION_free(ext_empty);
 584
 585    EXPECT_TEST(test_X509_add_basic_constraints(x509));
 586    EXPECT_TEST(test_X509_add_key_usage(x509));
 587    EXPECT_TEST(test_X509_add_ext_key_usage(x509));
 588    EXPECT_TEST(test_x509_add_auth_key_id(x509));
 589    EXPECT_TEST(test_x509_add_subj_key_id(x509));
 590
 591    wolfSSL_X509_free(x509);
 592#endif
 593    return EXPECT_RESULT();
 594}
 595
 596int test_wolfSSL_X509_get_ext_count(void)
 597{
 598    EXPECT_DECLS;
 599#if defined(OPENSSL_ALL) && !defined(NO_CERTS) && !defined(NO_FILESYSTEM) && \
 600    !defined(NO_RSA)
 601    int ret = 0;
 602    WOLFSSL_X509* x509 = NULL;
 603    const char ocspRootCaFile[] = "./certs/ocsp/root-ca-cert.pem";
 604    XFILE f = XBADFILE;
 605
 606    /* NULL parameter check */
 607    ExpectIntEQ(X509_get_ext_count(NULL), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 608    ExpectNotNull(x509 = wolfSSL_X509_new());
 609    ExpectIntEQ(X509_get_ext_count(x509), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 610    wolfSSL_X509_free(x509);
 611    x509 = NULL;
 612
 613    ExpectNotNull(x509 = wolfSSL_X509_load_certificate_file(svrCertFile,
 614        SSL_FILETYPE_PEM));
 615    ExpectIntEQ(X509_get_ext_count(x509), 5);
 616    wolfSSL_X509_free(x509);
 617
 618    ExpectNotNull(x509 = wolfSSL_X509_load_certificate_file(ocspRootCaFile,
 619        SSL_FILETYPE_PEM));
 620    ExpectIntEQ(X509_get_ext_count(x509), 5);
 621    wolfSSL_X509_free(x509);
 622
 623    ExpectTrue((f = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 624    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(f, NULL, NULL, NULL));
 625    if (f != XBADFILE)
 626        XFCLOSE(f);
 627
 628    /* wolfSSL_X509_get_ext_count() valid input */
 629    ExpectIntEQ((ret = wolfSSL_X509_get_ext_count(x509)), 5);
 630
 631    wolfSSL_X509_free(x509);
 632#endif
 633    return EXPECT_RESULT();
 634}
 635
 636/* Tests X509v3_get_ext_count, X509v3_get_ext_by_NID, and X509v3_get_ext
 637 * working with a stack retrieved from wolfSSL_X509_get0_extensions().
 638 */
 639int test_wolfSSL_X509_stack_extensions(void)
 640{
 641    EXPECT_DECLS;
 642#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && !defined(NO_FILESYSTEM) && \
 643    !defined(NO_RSA)
 644    WOLFSSL_X509* x509 = NULL;
 645    const WOLFSSL_STACK* ext_stack = NULL;
 646    WOLFSSL_X509_EXTENSION* ext = NULL;
 647    int idx = -1;
 648    int count = 0;
 649    XFILE f = XBADFILE;
 650
 651    /* Load a certificate */
 652    ExpectTrue((f = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 653    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(f, NULL, NULL, NULL));
 654    if (f != XBADFILE)
 655        XFCLOSE(f);
 656
 657    /* Get the stack of extensions */
 658    ExpectNotNull(ext_stack = wolfSSL_X509_get0_extensions(x509));
 659
 660    /* Test X509v3_get_ext_count */
 661    ExpectIntGT((count = X509v3_get_ext_count(ext_stack)), 0);
 662
 663    /* Test X509v3_get_ext_by_NID - find Basic Constraints extension */
 664    ExpectIntGE((idx = X509v3_get_ext_by_NID(ext_stack, NID_basic_constraints,
 665                -1)), 0);
 666
 667    /* Test X509v3_get_ext - get extension by index */
 668    ExpectNotNull(ext = X509v3_get_ext(ext_stack, idx));
 669
 670    /* Verify that the extension is the correct one */
 671    ExpectIntEQ(wolfSSL_OBJ_obj2nid(wolfSSL_X509_EXTENSION_get_object(ext)),
 672               NID_basic_constraints);
 673
 674    /* Test negative cases */
 675    ExpectIntEQ(X509v3_get_ext_by_NID(NULL, NID_basic_constraints, -1),
 676               WOLFSSL_FATAL_ERROR);
 677    ExpectNull(X509v3_get_ext(NULL, 0));
 678    ExpectNull(X509v3_get_ext(ext_stack, -1));
 679    ExpectNull(X509v3_get_ext(ext_stack, count));
 680
 681    wolfSSL_X509_free(x509);
 682#endif
 683    return EXPECT_RESULT();
 684}
 685
 686int test_wolfSSL_X509_EXTENSION_new(void)
 687{
 688    EXPECT_DECLS;
 689#if defined (OPENSSL_ALL)
 690    WOLFSSL_X509_EXTENSION* ext = NULL;
 691
 692    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 693    ExpectNotNull(ext->obj = wolfSSL_ASN1_OBJECT_new());
 694
 695    wolfSSL_X509_EXTENSION_free(NULL);
 696    wolfSSL_X509_EXTENSION_free(ext);
 697#endif
 698    return EXPECT_RESULT();
 699}
 700
 701int test_wolfSSL_X509_EXTENSION_dup(void)
 702{
 703    EXPECT_DECLS;
 704#if defined (OPENSSL_ALL)
 705    WOLFSSL_X509_EXTENSION* ext = NULL;
 706    WOLFSSL_X509_EXTENSION* dup = NULL;
 707
 708    ExpectNull(wolfSSL_X509_EXTENSION_dup(NULL));
 709    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 710    ExpectNotNull(dup = wolfSSL_X509_EXTENSION_dup(ext));
 711
 712    wolfSSL_X509_EXTENSION_free(dup);
 713    wolfSSL_X509_EXTENSION_free(ext);
 714#endif
 715    return EXPECT_RESULT();
 716}
 717
 718int test_wolfSSL_X509_EXTENSION_get_object(void)
 719{
 720    EXPECT_DECLS;
 721#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
 722    WOLFSSL_X509* x509 = NULL;
 723    WOLFSSL_X509_EXTENSION* ext = NULL;
 724    WOLFSSL_X509_EXTENSION* dup = NULL;
 725    WOLFSSL_ASN1_OBJECT* o = NULL;
 726    XFILE file = XBADFILE;
 727
 728    ExpectTrue((file = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 729    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(file, NULL, NULL, NULL));
 730    if (file != XBADFILE)
 731        XFCLOSE(file);
 732
 733    /* wolfSSL_X509_EXTENSION_get_object() testing ext idx 0 */
 734    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, 0));
 735    ExpectNull(wolfSSL_X509_EXTENSION_get_object(NULL));
 736    ExpectNotNull(o = wolfSSL_X509_EXTENSION_get_object(ext));
 737    ExpectIntEQ(o->nid, SUBJ_KEY_OID);
 738    ExpectNotNull(dup = wolfSSL_X509_EXTENSION_dup(ext));
 739    wolfSSL_X509_EXTENSION_free(dup);
 740
 741    /* wolfSSL_X509_EXTENSION_get_object() NULL argument */
 742    ExpectNull(o = wolfSSL_X509_EXTENSION_get_object(NULL));
 743
 744    wolfSSL_X509_free(x509);
 745#endif
 746    return EXPECT_RESULT();
 747}
 748
 749int test_wolfSSL_X509_EXTENSION_get_data(void)
 750{
 751    EXPECT_DECLS;
 752#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
 753    WOLFSSL_X509* x509 = NULL;
 754    WOLFSSL_X509_EXTENSION* ext = NULL;
 755    WOLFSSL_ASN1_STRING* str = NULL;
 756    XFILE file = XBADFILE;
 757#ifndef WOLFSSL_OLD_EXTDATA_FMT
 758    const byte ext_data[] = {
 759        0x04, 0x14, 0xB3, 0x11, 0x32, 0xC9, 0x92, 0x98,
 760        0x84, 0xE2, 0xC9, 0xF8, 0xD0, 0x3B, 0x6E, 0x03,
 761        0x42, 0xCA, 0x1F, 0x0E, 0x8E, 0x3C,
 762    };
 763#endif
 764
 765    ExpectTrue((file = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 766    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(file, NULL, NULL, NULL));
 767    if (file != XBADFILE)
 768        XFCLOSE(file);
 769    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, 0));
 770
 771    ExpectNull(str = wolfSSL_X509_EXTENSION_get_data(NULL));
 772    ExpectNotNull(str = wolfSSL_X509_EXTENSION_get_data(ext));
 773
 774#ifndef WOLFSSL_OLD_EXTDATA_FMT
 775    ExpectIntEQ(str->length, sizeof (ext_data));
 776    ExpectBufEQ(str->data, ext_data, sizeof (ext_data));
 777#endif
 778
 779    wolfSSL_X509_free(x509);
 780#endif
 781    return EXPECT_RESULT();
 782}
 783
 784int test_wolfSSL_X509_EXTENSION_get_critical(void)
 785{
 786    EXPECT_DECLS;
 787#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
 788    WOLFSSL_X509* x509 = NULL;
 789    WOLFSSL_X509_EXTENSION* ext = NULL;
 790    XFILE file = XBADFILE;
 791    int crit = 0;
 792
 793    ExpectTrue((file = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 794    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(file, NULL, NULL, NULL));
 795    if (file != XBADFILE)
 796        XFCLOSE(file);
 797    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, 0));
 798
 799    ExpectIntEQ(crit = wolfSSL_X509_EXTENSION_get_critical(NULL),
 800        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 801    ExpectIntEQ(crit = wolfSSL_X509_EXTENSION_get_critical(ext), 0);
 802
 803    wolfSSL_X509_free(x509);
 804#endif
 805    return EXPECT_RESULT();
 806}
 807
 808int test_wolfSSL_X509_EXTENSION_create_by_OBJ(void)
 809{
 810    EXPECT_DECLS;
 811#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
 812    XFILE file = XBADFILE;
 813    WOLFSSL_X509* x509 = NULL;
 814    WOLFSSL_X509* empty = NULL;
 815    WOLFSSL_X509_EXTENSION* ext = NULL;
 816    WOLFSSL_X509_EXTENSION* ext2 = NULL;
 817    WOLFSSL_X509_EXTENSION* ext3 = NULL;
 818    WOLFSSL_ASN1_OBJECT* o = NULL;
 819    int crit = 0;
 820    WOLFSSL_ASN1_STRING* str = NULL;
 821
 822    ExpectTrue((file = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 823    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(file, NULL, NULL, NULL));
 824    if (file != XBADFILE)
 825        XFCLOSE(file);
 826    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, 0));
 827
 828    ExpectNotNull(o = wolfSSL_X509_EXTENSION_get_object(ext));
 829    ExpectIntEQ(crit = wolfSSL_X509_EXTENSION_get_critical(ext), 0);
 830    ExpectNotNull(str = wolfSSL_X509_EXTENSION_get_data(ext));
 831
 832    ExpectNull(wolfSSL_X509_EXTENSION_create_by_OBJ(NULL, NULL, 0, NULL));
 833    ExpectNull(wolfSSL_X509_EXTENSION_create_by_OBJ(NULL, o, 0, NULL));
 834    ExpectNull(wolfSSL_X509_EXTENSION_create_by_OBJ(NULL, NULL, 0, str));
 835    ExpectNotNull(ext2 = wolfSSL_X509_EXTENSION_create_by_OBJ(NULL, o, crit,
 836        str));
 837    ExpectNotNull(ext3 = wolfSSL_X509_EXTENSION_create_by_OBJ(ext2, o, crit,
 838        str));
 839    if (ext3 == NULL) {
 840        wolfSSL_X509_EXTENSION_free(ext2);
 841    }
 842    wolfSSL_X509_EXTENSION_free(ext3);
 843
 844    ExpectIntEQ(wolfSSL_X509_get_ext_by_OBJ(NULL, NULL, -1),
 845        WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
 846    ExpectIntEQ(wolfSSL_X509_get_ext_by_OBJ(NULL, o, -1),
 847        WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
 848    ExpectNotNull(empty = wolfSSL_X509_new());
 849    ExpectIntEQ(wolfSSL_X509_get_ext_by_OBJ(empty, NULL, -1),
 850        WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
 851    ExpectIntEQ(wolfSSL_X509_get_ext_by_OBJ(empty, o, -1),
 852        WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
 853    wolfSSL_X509_free(empty);
 854    empty = NULL;
 855    ExpectIntEQ(wolfSSL_X509_get_ext_by_OBJ(x509, o, -2), 0);
 856    ExpectIntEQ(wolfSSL_X509_get_ext_by_OBJ(x509, o, 0),
 857        WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
 858
 859    wolfSSL_X509_free(x509);
 860#endif
 861    return EXPECT_RESULT();
 862}
 863
 864int test_wolfSSL_X509V3_set_ctx(void)
 865{
 866    EXPECT_DECLS;
 867#if (defined(OPENSSL_ALL) || defined(OPENSSL_EXTRA)) && \
 868    defined(WOLFSSL_CERT_GEN) && defined(WOLFSSL_CERT_REQ) && \
 869    defined(HAVE_CRL)
 870    WOLFSSL_X509V3_CTX ctx;
 871    WOLFSSL_X509* issuer = NULL;
 872    WOLFSSL_X509* subject = NULL;
 873    WOLFSSL_X509 req;
 874    WOLFSSL_X509_CRL crl;
 875
 876    XMEMSET(&ctx, 0, sizeof(ctx));
 877    ExpectNotNull(issuer = wolfSSL_X509_new());
 878    ExpectNotNull(subject = wolfSSL_X509_new());
 879    XMEMSET(&req, 0, sizeof(req));
 880    XMEMSET(&crl, 0, sizeof(crl));
 881
 882    wolfSSL_X509V3_set_ctx(NULL, NULL, NULL, NULL, NULL, 0);
 883    wolfSSL_X509V3_set_ctx(&ctx, NULL, NULL, NULL, NULL, 0);
 884    wolfSSL_X509_free(ctx.x509);
 885    ctx.x509 = NULL;
 886    wolfSSL_X509V3_set_ctx(&ctx, issuer, NULL, NULL, NULL, 0);
 887    wolfSSL_X509_free(ctx.x509);
 888    ctx.x509 = NULL;
 889    wolfSSL_X509V3_set_ctx(&ctx, NULL, subject, NULL, NULL, 0);
 890    wolfSSL_X509_free(ctx.x509);
 891    ctx.x509 = NULL;
 892    wolfSSL_X509V3_set_ctx(&ctx, NULL, NULL, &req, NULL, 0);
 893    wolfSSL_X509_free(ctx.x509);
 894    ctx.x509 = NULL;
 895    wolfSSL_X509V3_set_ctx(&ctx, NULL, NULL, NULL, &crl, 0);
 896    wolfSSL_X509_free(ctx.x509);
 897    ctx.x509 = NULL;
 898    wolfSSL_X509V3_set_ctx(&ctx, NULL, NULL, NULL, NULL, 1);
 899    /* X509 allocated in context results in 'failure' (but not return). */
 900    wolfSSL_X509V3_set_ctx(&ctx, NULL, NULL, NULL, NULL, 0);
 901    wolfSSL_X509_free(ctx.x509);
 902    ctx.x509 = NULL;
 903
 904    wolfSSL_X509_free(subject);
 905    wolfSSL_X509_free(issuer);
 906#endif
 907    return EXPECT_RESULT();
 908}
 909
 910int test_wolfSSL_X509V3_EXT_get(void)
 911{
 912    EXPECT_DECLS;
 913#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
 914    XFILE f = XBADFILE;
 915    int numOfExt =0;
 916    int extNid = 0;
 917    int i = 0;
 918    WOLFSSL_X509* x509 = NULL;
 919    WOLFSSL_X509_EXTENSION* ext = NULL;
 920    const WOLFSSL_v3_ext_method* method = NULL;
 921    WOLFSSL_ASN1_OBJECT* obj = NULL;
 922
 923    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
 924    /* No object in extension. */
 925    ExpectNull(wolfSSL_X509V3_EXT_get(ext));
 926    ExpectNotNull(obj = wolfSSL_ASN1_OBJECT_new());
 927    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
 928    /* NID is zero. */
 929    ExpectNull(wolfSSL_X509V3_EXT_get(ext));
 930    /* NID is not known. */
 931    if (ext != NULL && ext->obj != NULL) {
 932        ext->obj->nid = 1;
 933    }
 934    ExpectNull(wolfSSL_X509V3_EXT_get(ext));
 935
 936    /* NIDs not in certificate. */
 937    if (ext != NULL && ext->obj != NULL) {
 938        ext->obj->nid = NID_certificate_policies;
 939    }
 940    ExpectNotNull(method = wolfSSL_X509V3_EXT_get(ext));
 941    ExpectIntEQ(method->ext_nid, NID_certificate_policies);
 942    if (ext != NULL && ext->obj != NULL) {
 943        ext->obj->nid = NID_crl_distribution_points;
 944    }
 945    ExpectNotNull(method = wolfSSL_X509V3_EXT_get(ext));
 946    ExpectIntEQ(method->ext_nid, NID_crl_distribution_points);
 947
 948    wolfSSL_ASN1_OBJECT_free(obj);
 949    wolfSSL_X509_EXTENSION_free(ext);
 950    ext = NULL;
 951
 952    ExpectTrue((f = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
 953    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(f, NULL, NULL, NULL));
 954    if (f != XBADFILE)
 955        XFCLOSE(f);
 956
 957    /* wolfSSL_X509V3_EXT_get() return struct and nid test */
 958    ExpectIntEQ((numOfExt = wolfSSL_X509_get_ext_count(x509)), 5);
 959    for (i = 0; i < numOfExt; i++) {
 960        ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, i));
 961        ExpectIntNE((extNid = ext->obj->nid), NID_undef);
 962        ExpectNotNull(method = wolfSSL_X509V3_EXT_get(ext));
 963        ExpectIntEQ(method->ext_nid, extNid);
 964        if (EXPECT_SUCCESS()) {
 965            if (method->ext_nid == NID_subject_key_identifier) {
 966                ExpectNotNull(method->i2s);
 967            }
 968        }
 969    }
 970
 971    /* wolfSSL_X509V3_EXT_get() NULL argument test */
 972    ExpectNull(method = wolfSSL_X509V3_EXT_get(NULL));
 973
 974    wolfSSL_X509_free(x509);
 975#endif
 976    return EXPECT_RESULT();
 977}
 978
 979int test_wolfSSL_X509V3_EXT_nconf(void)
 980{
 981    EXPECT_DECLS;
 982#ifdef OPENSSL_ALL
 983    const char *ext_names[] = {
 984        "subjectKeyIdentifier",
 985        "authorityKeyIdentifier",
 986        "subjectAltName",
 987        "keyUsage",
 988        "extendedKeyUsage",
 989    };
 990    size_t ext_names_count = sizeof(ext_names)/sizeof(*ext_names);
 991    int ext_nids[] = {
 992        NID_subject_key_identifier,
 993        NID_authority_key_identifier,
 994        NID_subject_alt_name,
 995        NID_key_usage,
 996        NID_ext_key_usage,
 997    };
 998    size_t ext_nids_count = sizeof(ext_nids)/sizeof(*ext_nids);
 999    const char *ext_values[] = {
1000        "hash",
1001        "hash",
1002        "DNS:example.com, IP:127.0.0.1",
1003        "digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment,"
1004            "keyAgreement,keyCertSign,cRLSign,encipherOnly,decipherOnly",
1005        "serverAuth,clientAuth,codeSigning,emailProtection,timeStamping,"
1006            "OCSPSigning",
1007    };
1008    size_t i;
1009    X509_EXTENSION* ext = NULL;
1010    X509* x509 = NULL;
1011    unsigned int keyUsageFlags;
1012    unsigned int extKeyUsageFlags;
1013    WOLFSSL_CONF conf;
1014    WOLFSSL_X509V3_CTX ctx;
1015#ifndef NO_WOLFSSL_STUB
1016    WOLFSSL_LHASH lhash;
1017#endif
1018
1019    ExpectNotNull(x509 = X509_new());
1020    ExpectNull(X509V3_EXT_nconf(NULL, NULL, ext_names[0], NULL));
1021    ExpectNull(X509V3_EXT_nconf_nid(NULL, NULL, ext_nids[0], NULL));
1022    ExpectNull(X509V3_EXT_nconf(NULL, NULL, "", ext_values[0]));
1023    ExpectNull(X509V3_EXT_nconf(NULL, NULL, NULL, ext_values[0]));
1024    ExpectNull(X509V3_EXT_nconf_nid(NULL, NULL, 0, ext_values[0]));
1025
1026    /* conf and ctx ignored. */
1027    ExpectNull(X509V3_EXT_nconf_nid(&conf, NULL, 0, ext_values[0]));
1028    ExpectNull(X509V3_EXT_nconf_nid(NULL , &ctx, 0, ext_values[0]));
1029    ExpectNull(X509V3_EXT_nconf_nid(&conf, &ctx, 0, ext_values[0]));
1030
1031    /* keyUsage / extKeyUsage should match string above */
1032    keyUsageFlags = KU_DIGITAL_SIGNATURE
1033                  | KU_NON_REPUDIATION
1034                  | KU_KEY_ENCIPHERMENT
1035                  | KU_DATA_ENCIPHERMENT
1036                  | KU_KEY_AGREEMENT
1037                  | KU_KEY_CERT_SIGN
1038                  | KU_CRL_SIGN
1039                  | KU_ENCIPHER_ONLY
1040                  | KU_DECIPHER_ONLY;
1041    extKeyUsageFlags = XKU_SSL_CLIENT
1042                     | XKU_SSL_SERVER
1043                     | XKU_CODE_SIGN
1044                     | XKU_SMIME
1045                     | XKU_TIMESTAMP
1046                     | XKU_OCSP_SIGN;
1047
1048    for (i = 0; i < ext_names_count; i++) {
1049        ExpectNotNull(ext = X509V3_EXT_nconf(NULL, NULL, ext_names[i],
1050            ext_values[i]));
1051        X509_EXTENSION_free(ext);
1052        ext = NULL;
1053    }
1054
1055    for (i = 0; i < ext_nids_count; i++) {
1056        ExpectNotNull(ext = X509V3_EXT_nconf_nid(NULL, NULL, ext_nids[i],
1057            ext_values[i]));
1058        X509_EXTENSION_free(ext);
1059        ext = NULL;
1060    }
1061
1062    /* Test adding extension to X509 */
1063    for (i = 0; i < ext_nids_count; i++) {
1064        ExpectNotNull(ext = X509V3_EXT_nconf(NULL, NULL, ext_names[i],
1065            ext_values[i]));
1066        ExpectIntEQ(X509_add_ext(x509, ext, -1), WOLFSSL_SUCCESS);
1067
1068        if (ext_nids[i] == NID_key_usage) {
1069            ExpectIntEQ(X509_get_key_usage(x509), keyUsageFlags);
1070        }
1071        else if (ext_nids[i] == NID_ext_key_usage) {
1072            ExpectIntEQ(X509_get_extended_key_usage(x509), extKeyUsageFlags);
1073        }
1074        X509_EXTENSION_free(ext);
1075        ext = NULL;
1076    }
1077    X509_free(x509);
1078
1079#ifndef NO_WOLFSSL_STUB
1080    ExpectIntEQ(wolfSSL_X509V3_EXT_add_nconf(NULL, NULL, NULL, NULL),
1081        WOLFSSL_SUCCESS);
1082    ExpectNull(wolfSSL_X509V3_EXT_conf_nid(NULL, NULL, 0, NULL));
1083    ExpectNull(wolfSSL_X509V3_EXT_conf_nid(&lhash, NULL, 0, NULL));
1084    wolfSSL_X509V3_set_ctx_nodb(NULL);
1085#endif
1086#endif
1087    return EXPECT_RESULT();
1088}
1089
1090int test_wolfSSL_X509V3_EXT_bc(void)
1091{
1092    EXPECT_DECLS;
1093#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
1094    WOLFSSL_X509_EXTENSION* ext = NULL;
1095    WOLFSSL_ASN1_OBJECT* obj = NULL;
1096    WOLFSSL_BASIC_CONSTRAINTS* bc = NULL;
1097    WOLFSSL_ASN1_INTEGER* pathLen = NULL;
1098
1099    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
1100    ExpectNotNull(obj = wolfSSL_ASN1_OBJECT_new());
1101    ExpectNotNull(pathLen = wolfSSL_ASN1_INTEGER_new());
1102    if (pathLen != NULL) {
1103        pathLen->length = 2;
1104    }
1105
1106    if (obj != NULL) {
1107        obj->type = NID_basic_constraints;
1108        obj->nid = NID_basic_constraints;
1109    }
1110    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
1111    ExpectNotNull(wolfSSL_X509V3_EXT_get(ext));
1112    /* No pathlen set. */
1113    ExpectNotNull(bc = (WOLFSSL_BASIC_CONSTRAINTS*)wolfSSL_X509V3_EXT_d2i(ext));
1114    wolfSSL_BASIC_CONSTRAINTS_free(bc);
1115    bc = NULL;
1116
1117    if ((ext != NULL) && (ext->obj != NULL)) {
1118        ext->obj->pathlen = pathLen;
1119        pathLen = NULL;
1120    }
1121    /* pathlen set. */
1122    ExpectNotNull(bc = (WOLFSSL_BASIC_CONSTRAINTS*)wolfSSL_X509V3_EXT_d2i(ext));
1123
1124    wolfSSL_ASN1_INTEGER_free(pathLen);
1125    wolfSSL_BASIC_CONSTRAINTS_free(bc);
1126    wolfSSL_ASN1_OBJECT_free(obj);
1127    wolfSSL_X509_EXTENSION_free(ext);
1128#endif
1129    return EXPECT_RESULT();
1130}
1131
1132int test_wolfSSL_X509V3_EXT_san(void)
1133{
1134    EXPECT_DECLS;
1135#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
1136    WOLFSSL_X509_EXTENSION* ext = NULL;
1137    WOLFSSL_ASN1_OBJECT* obj = NULL;
1138    WOLFSSL_STACK* sk = NULL;
1139
1140    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
1141    ExpectNotNull(obj = wolfSSL_ASN1_OBJECT_new());
1142
1143    if (obj != NULL) {
1144        obj->type = NID_subject_alt_name;
1145        obj->nid = NID_subject_alt_name;
1146    }
1147    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
1148    ExpectNotNull(wolfSSL_X509V3_EXT_get(ext));
1149    /* No extension stack set. */
1150    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1151
1152    ExpectNotNull(sk = wolfSSL_sk_new_null());
1153    if (ext != NULL) {
1154        ext->ext_sk = sk;
1155        sk = NULL;
1156    }
1157    /* Extension stack set. */
1158    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1159
1160    wolfSSL_sk_free(sk);
1161    wolfSSL_ASN1_OBJECT_free(obj);
1162    wolfSSL_X509_EXTENSION_free(ext);
1163#endif
1164    return EXPECT_RESULT();
1165}
1166
1167int test_wolfSSL_X509V3_EXT_aia(void)
1168{
1169    EXPECT_DECLS;
1170#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
1171    WOLFSSL_X509_EXTENSION* ext = NULL;
1172    WOLFSSL_ASN1_OBJECT* obj = NULL;
1173    WOLFSSL_STACK* sk = NULL;
1174    WOLFSSL_STACK* node = NULL;
1175    WOLFSSL_AUTHORITY_INFO_ACCESS* aia = NULL;
1176    WOLFSSL_ASN1_OBJECT* entry = NULL;
1177
1178    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
1179    ExpectNotNull(obj = wolfSSL_ASN1_OBJECT_new());
1180
1181    if (obj != NULL) {
1182        obj->type = NID_info_access;
1183        obj->nid = NID_info_access;
1184    }
1185    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
1186    ExpectNotNull(wolfSSL_X509V3_EXT_get(ext));
1187    /* No extension stack set. */
1188    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1189
1190    ExpectNotNull(sk = wolfSSL_sk_new_null());
1191    if (ext != NULL) {
1192        ext->ext_sk = sk;
1193        sk = NULL;
1194    }
1195    /* Extension stack set but empty. */
1196    ExpectNotNull(aia = (WOLFSSL_AUTHORITY_INFO_ACCESS *)
1197        wolfSSL_X509V3_EXT_d2i(ext));
1198    wolfSSL_AUTHORITY_INFO_ACCESS_free(aia);
1199    aia = NULL;
1200
1201    ExpectNotNull(entry = wolfSSL_ASN1_OBJECT_new());
1202    if (entry != NULL) {
1203        entry->nid = WC_NID_ad_OCSP;
1204        entry->obj = (const unsigned char*)"http://127.0.0.1";
1205        entry->objSz = 16;
1206    }
1207    ExpectNotNull(node = wolfSSL_sk_new_node(NULL));
1208    if ((node != NULL) && (ext != NULL)) {
1209        node->type = STACK_TYPE_OBJ;
1210        node->data.obj = entry;
1211        entry = NULL;
1212        ExpectIntEQ(wolfSSL_sk_push_node(&ext->ext_sk, node), WOLFSSL_SUCCESS);
1213        if (EXPECT_SUCCESS()) {
1214            node = NULL;
1215        }
1216    }
1217    ExpectNotNull(aia = (WOLFSSL_AUTHORITY_INFO_ACCESS *)
1218        wolfSSL_X509V3_EXT_d2i(ext));
1219    wolfSSL_ACCESS_DESCRIPTION_free(NULL);
1220
1221    wolfSSL_AUTHORITY_INFO_ACCESS_pop_free(aia,
1222        wolfSSL_ACCESS_DESCRIPTION_free);
1223    wolfSSL_ASN1_OBJECT_free(entry);
1224    wolfSSL_sk_free(node);
1225    wolfSSL_ASN1_OBJECT_free(obj);
1226    wolfSSL_X509_EXTENSION_free(ext);
1227#endif
1228    return EXPECT_RESULT();
1229}
1230
1231int test_wolfSSL_X509V3_EXT(void)
1232{
1233    EXPECT_DECLS;
1234#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_RSA)
1235    XFILE f = XBADFILE;
1236    int numOfExt = 0, nid = 0, i = 0, expected, actual = 0;
1237    char* str = NULL;
1238    unsigned char* data = NULL;
1239    const WOLFSSL_v3_ext_method* method = NULL;
1240    WOLFSSL_X509* x509 = NULL;
1241    WOLFSSL_X509_EXTENSION* ext = NULL;
1242    WOLFSSL_X509_EXTENSION* ext2 = NULL;
1243    WOLFSSL_ASN1_OBJECT *obj = NULL;
1244    WOLFSSL_ASN1_OBJECT *adObj = NULL;
1245    WOLFSSL_ASN1_STRING* asn1str = NULL;
1246    WOLFSSL_AUTHORITY_KEYID* aKeyId = NULL;
1247    WOLFSSL_AUTHORITY_INFO_ACCESS* aia = NULL;
1248    WOLFSSL_BASIC_CONSTRAINTS* bc = NULL;
1249    WOLFSSL_ACCESS_DESCRIPTION* ad = NULL;
1250    WOLFSSL_GENERAL_NAME* gn = NULL;
1251
1252    /* Check NULL argument */
1253    ExpectNull(wolfSSL_X509V3_EXT_d2i(NULL));
1254
1255    ExpectNotNull(ext = wolfSSL_X509_EXTENSION_new());
1256    ExpectNotNull(obj = wolfSSL_ASN1_OBJECT_new());
1257
1258    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1259    ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj), WOLFSSL_SUCCESS);
1260    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1261    if (ext != NULL && ext->obj != NULL) {
1262        ext->obj->nid = ext->obj->type = NID_ext_key_usage;
1263    }
1264    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1265    if (ext != NULL && ext->obj != NULL) {
1266        ext->obj->nid = ext->obj->type = NID_certificate_policies;
1267    }
1268    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1269    if (ext != NULL && ext->obj != NULL) {
1270        ext->obj->nid = ext->obj->type = NID_crl_distribution_points;
1271    }
1272    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1273    if (ext != NULL && ext->obj != NULL) {
1274        ext->obj->nid = ext->obj->type = NID_subject_alt_name;
1275    }
1276    ExpectNull(wolfSSL_X509V3_EXT_d2i(ext));
1277
1278    wolfSSL_ASN1_OBJECT_free(obj);
1279    obj = NULL;
1280    wolfSSL_X509_EXTENSION_free(ext);
1281    ext = NULL;
1282
1283    /* Using OCSP cert with X509V3 extensions */
1284    ExpectTrue((f = XFOPEN("./certs/ocsp/root-ca-cert.pem", "rb")) != XBADFILE);
1285    ExpectNotNull(x509 = wolfSSL_PEM_read_X509(f, NULL, NULL, NULL));
1286    if (f != XBADFILE)
1287        XFCLOSE(f);
1288
1289    ExpectIntEQ((numOfExt = wolfSSL_X509_get_ext_count(x509)), 5);
1290
1291    /* Basic Constraints */
1292    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, i));
1293    ExpectNotNull(obj = wolfSSL_X509_EXTENSION_get_object(ext));
1294    ExpectIntEQ((nid = wolfSSL_OBJ_obj2nid(obj)), NID_basic_constraints);
1295    ExpectNotNull(bc = (WOLFSSL_BASIC_CONSTRAINTS*)wolfSSL_X509V3_EXT_d2i(ext));
1296
1297    ExpectIntEQ(bc->ca, 1);
1298    ExpectNull(bc->pathlen);
1299    wolfSSL_BASIC_CONSTRAINTS_free(bc);
1300    bc = NULL;
1301    i++;
1302
1303    /* Subject Key Identifier */
1304    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, i));
1305    ExpectNotNull(obj = wolfSSL_X509_EXTENSION_get_object(ext));
1306    ExpectIntEQ((nid = wolfSSL_OBJ_obj2nid(obj)), NID_subject_key_identifier);
1307
1308    ExpectNotNull(asn1str = (WOLFSSL_ASN1_STRING*)wolfSSL_X509V3_EXT_d2i(ext));
1309    ExpectNotNull(ext2 = wolfSSL_X509V3_EXT_i2d(NID_subject_key_identifier, 0,
1310        asn1str));
1311    X509_EXTENSION_free(ext2);
1312    ext2 = NULL;
1313    ExpectNotNull(method = wolfSSL_X509V3_EXT_get(ext));
1314    ExpectNotNull(method->i2s);
1315    ExpectNotNull(str = method->i2s((WOLFSSL_v3_ext_method*)method, asn1str));
1316    wolfSSL_ASN1_STRING_free(asn1str);
1317    asn1str = NULL;
1318    if (str != NULL) {
1319        actual = strcmp(str,
1320            "73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21");
1321    }
1322    ExpectIntEQ(actual, 0);
1323    XFREE(str, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1324    str = NULL;
1325    i++;
1326
1327    /* Authority Key Identifier */
1328    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, i));
1329    ExpectNotNull(obj = wolfSSL_X509_EXTENSION_get_object(ext));
1330    ExpectIntEQ((nid = wolfSSL_OBJ_obj2nid(obj)), NID_authority_key_identifier);
1331
1332    ExpectNotNull(aKeyId = (WOLFSSL_AUTHORITY_KEYID*)wolfSSL_X509V3_EXT_d2i(
1333        ext));
1334    ExpectNotNull(method = wolfSSL_X509V3_EXT_get(ext));
1335    ExpectNotNull(asn1str = aKeyId->keyid);
1336    ExpectNotNull(str = wolfSSL_i2s_ASN1_STRING((WOLFSSL_v3_ext_method*)method,
1337        asn1str));
1338    asn1str = NULL;
1339    if (str != NULL) {
1340        actual = strcmp(str,
1341            "73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21");
1342    }
1343    ExpectIntEQ(actual, 0);
1344    XFREE(str, NULL, DYNAMIC_TYPE_TMP_BUFFER);
1345    str = NULL;
1346    wolfSSL_AUTHORITY_KEYID_free(aKeyId);
1347    aKeyId = NULL;
1348    i++;
1349
1350    /* Key Usage */
1351    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, i));
1352    ExpectNotNull(obj = wolfSSL_X509_EXTENSION_get_object(ext));
1353    ExpectIntEQ((nid = wolfSSL_OBJ_obj2nid(obj)), NID_key_usage);
1354
1355    ExpectNotNull(asn1str = (WOLFSSL_ASN1_STRING*)wolfSSL_X509V3_EXT_d2i(ext));
1356#if defined(WOLFSSL_QT)
1357    ExpectNotNull(data = (unsigned char*)ASN1_STRING_get0_data(asn1str));
1358#else
1359    ExpectNotNull(data = wolfSSL_ASN1_STRING_data(asn1str));
1360#endif
1361    expected = KEYUSE_KEY_CERT_SIGN | KEYUSE_CRL_SIGN;
1362    if (data != NULL) {
1363    #ifdef BIG_ENDIAN_ORDER
1364        actual = data[1];
1365    #else
1366        actual = data[0];
1367    #endif
1368    }
1369    ExpectIntEQ(actual, expected);
1370    wolfSSL_ASN1_STRING_free(asn1str);
1371    asn1str = NULL;
1372    ExpectIntEQ(wolfSSL_X509_get_keyUsage(NULL), 0);
1373    ExpectIntEQ(wolfSSL_X509_get_keyUsage(x509), expected);
1374    i++;
1375
1376    /* Authority Info Access */
1377    ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, i));
1378    ExpectNotNull(obj = wolfSSL_X509_EXTENSION_get_object(ext));
1379    ExpectIntEQ((nid = wolfSSL_OBJ_obj2nid(obj)), NID_info_access);
1380    ExpectNotNull(aia = (WOLFSSL_AUTHORITY_INFO_ACCESS*)wolfSSL_X509V3_EXT_d2i(
1381        ext));
1382#if defined(WOLFSSL_QT)
1383    ExpectIntEQ(OPENSSL_sk_num(aia), 1); /* Only one URI entry for this cert */
1384#else
1385    ExpectIntEQ(wolfSSL_sk_num(aia), 1); /* Only one URI entry for this cert */
1386#endif
1387    /* URI entry is an ACCESS_DESCRIPTION type */
1388#if defined(WOLFSSL_QT)
1389    ExpectNotNull(ad = (WOLFSSL_ACCESS_DESCRIPTION*)wolfSSL_sk_value(aia, 0));
1390#else
1391    ExpectNotNull(ad = (WOLFSSL_ACCESS_DESCRIPTION*)OPENSSL_sk_value(aia, 0));
1392#endif
1393    ExpectNotNull(adObj = ad->method);
1394    /* Make sure nid is OCSP */
1395    ExpectIntEQ(wolfSSL_OBJ_obj2nid(adObj), NID_ad_OCSP);
1396
1397    /* GENERAL_NAME stores URI as an ASN1_STRING */
1398    ExpectNotNull(gn = ad->location);
1399    ExpectIntEQ(gn->type, GEN_URI); /* Type should always be GEN_URI */
1400    ExpectNotNull(asn1str = gn->d.uniformResourceIdentifier);
1401    ExpectIntEQ(wolfSSL_ASN1_STRING_length(asn1str), 22);
1402#if defined(WOLFSSL_QT)
1403    ExpectNotNull(str = (char*)ASN1_STRING_get0_data(asn1str));
1404#else
1405    ExpectNotNull(str = (char*)wolfSSL_ASN1_STRING_data(asn1str));
1406#endif
1407    if (str != NULL) {
1408         actual = strcmp(str, "http://127.0.0.1:22220");
1409    }
1410    ExpectIntEQ(actual, 0);
1411
1412    ExpectIntEQ(wolfSSL_sk_ACCESS_DESCRIPTION_num(NULL), WOLFSSL_FATAL_ERROR);
1413    ExpectIntEQ(wolfSSL_sk_ACCESS_DESCRIPTION_num(aia), 1);
1414    ExpectNull(wolfSSL_sk_ACCESS_DESCRIPTION_value(NULL, 0));
1415    ExpectNull(wolfSSL_sk_ACCESS_DESCRIPTION_value(aia, 1));
1416    ExpectNotNull(wolfSSL_sk_ACCESS_DESCRIPTION_value(aia, 0));
1417    wolfSSL_sk_ACCESS_DESCRIPTION_pop_free(aia, NULL);
1418    aia = NULL;
1419
1420#ifndef NO_WOLFSSL_STUB
1421    ExpectNull(wolfSSL_X509_delete_ext(x509, 0));
1422#endif
1423
1424    wolfSSL_X509_free(x509);
1425#endif
1426    return EXPECT_RESULT();
1427}
1428
1429int test_wolfSSL_X509V3_EXT_print(void)
1430{
1431    EXPECT_DECLS;
1432#if !defined(NO_FILESYSTEM) && defined(OPENSSL_ALL) && !defined(NO_BIO) && \
1433    !defined(NO_RSA)
1434
1435    {
1436        XFILE f = XBADFILE;
1437        WOLFSSL_X509* x509 = NULL;
1438        X509_EXTENSION * ext = NULL;
1439        int loc = 0;
1440        BIO *bio = NULL;
1441
1442        ExpectTrue((f = XFOPEN(svrCertFile, "rb")) != XBADFILE);
1443        ExpectNotNull(x509 = wolfSSL_PEM_read_X509(f, NULL, NULL, NULL));
1444        if (f != XBADFILE)
1445            fclose(f);
1446
1447        ExpectNotNull(bio = wolfSSL_BIO_new(BIO_s_mem()));
1448
1449        ExpectIntGT(loc = wolfSSL_X509_get_ext_by_NID(x509,
1450            NID_basic_constraints, -1), -1);
1451        ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, loc));
1452
1453        /* Failure cases. */
1454        ExpectIntEQ(wolfSSL_X509V3_EXT_print(NULL, NULL, 0, 0),
1455            WOLFSSL_FAILURE);
1456        ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio , NULL, 0, 0),
1457            WOLFSSL_FAILURE);
1458        ExpectIntEQ(wolfSSL_X509V3_EXT_print(NULL, ext , 0, 0),
1459            WOLFSSL_FAILURE);
1460        /* Good case. */
1461        ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0), WOLFSSL_SUCCESS);
1462
1463        ExpectIntGT(loc = wolfSSL_X509_get_ext_by_NID(x509,
1464            NID_subject_key_identifier, -1), -1);
1465        ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, loc));
1466        ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0), WOLFSSL_SUCCESS);
1467
1468        ExpectIntGT(loc = wolfSSL_X509_get_ext_by_NID(x509,
1469            NID_authority_key_identifier, -1), -1);
1470        ExpectNotNull(ext = wolfSSL_X509_get_ext(x509, loc));
1471        ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0), WOLFSSL_SUCCESS);
1472
1473        wolfSSL_BIO_free(bio);
1474        wolfSSL_X509_free(x509);
1475    }
1476
1477    {
1478        X509 *x509 = NULL;
1479        BIO *bio = NULL;
1480        X509_EXTENSION *ext = NULL;
1481        unsigned int i = 0;
1482        unsigned int idx = 0;
1483        /* Some NIDs to test with */
1484        int nids[] = {
1485                /* NID_key_usage, currently X509_get_ext returns this as a bit
1486                 * string, which messes up X509V3_EXT_print */
1487                /* NID_ext_key_usage, */
1488                NID_subject_alt_name,
1489        };
1490        int* n = NULL;
1491
1492        ExpectNotNull(bio = BIO_new_fp(stderr, BIO_NOCLOSE));
1493
1494        ExpectNotNull(x509 = wolfSSL_X509_load_certificate_file(cliCertFileExt,
1495            WOLFSSL_FILETYPE_PEM));
1496
1497        ExpectIntGT(fprintf(stderr, "\nPrinting extension values:\n"), 0);
1498
1499        for (i = 0, n = nids; i<(sizeof(nids)/sizeof(int)); i++, n++) {
1500            /* X509_get_ext_by_NID should return 3 for now. If that changes then
1501             * update the index */
1502            ExpectIntEQ((idx = X509_get_ext_by_NID(x509, *n, -1)), 3);
1503            ExpectNotNull(ext = X509_get_ext(x509, (int)idx));
1504            ExpectIntEQ(X509V3_EXT_print(bio, ext, 0, 0), 1);
1505            ExpectIntGT(fprintf(stderr, "\n"), 0);
1506        }
1507
1508        BIO_free(bio);
1509        X509_free(x509);
1510    }
1511
1512    {
1513        BIO* bio = NULL;
1514        X509_EXTENSION* ext = NULL;
1515        WOLFSSL_ASN1_OBJECT* obj = NULL;
1516
1517        ExpectNotNull(bio = BIO_new_fp(stderr, BIO_NOCLOSE));
1518        ExpectNotNull(ext = X509_EXTENSION_new());
1519
1520        /* No object. */
1521        ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0), WOLFSSL_FAILURE);
1522
1523        ExpectNotNull(obj = wolfSSL_ASN1_OBJECT_new());
1524        ExpectIntEQ(wolfSSL_X509_EXTENSION_set_object(ext, obj),
1525            WOLFSSL_SUCCESS);
1526
1527        /* NID not supported yet - just doesn't write anything. */
1528        if (ext != NULL && ext->obj != NULL) {
1529            ext->obj->nid = AUTH_INFO_OID;
1530            ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0),
1531                WOLFSSL_SUCCESS);
1532            ext->obj->nid = CERT_POLICY_OID;
1533            ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0),
1534                WOLFSSL_SUCCESS);
1535            ext->obj->nid = CRL_DIST_OID;
1536            ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0),
1537                WOLFSSL_SUCCESS);
1538            ext->obj->nid = KEY_USAGE_OID;
1539            ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0),
1540                WOLFSSL_SUCCESS);
1541
1542            ext->obj->nid = EXT_KEY_USAGE_OID;
1543            ExpectIntEQ(wolfSSL_X509V3_EXT_print(bio, ext, 0, 0),
1544                WOLFSSL_SUCCESS);
1545        }
1546
1547        wolfSSL_ASN1_OBJECT_free(obj);
1548        X509_EXTENSION_free(ext);
1549        BIO_free(bio);
1550    }
1551#endif
1552    return EXPECT_RESULT();
1553}
1554
1555/*
1556 * Test retrieving Name Constraints extension via X509_get_ext_d2i.
1557 * Tests basic retrieval of permitted and excluded subtrees, stack operations
1558 * (num, value), GENERAL_NAME type and data extraction, free functions.
1559 */
1560int test_wolfSSL_X509_get_ext_d2i_name_constraints(void)
1561{
1562    EXPECT_DECLS;
1563#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
1564    !defined(NO_RSA) && !defined(IGNORE_NAME_CONSTRAINTS)
1565    XFILE f = XBADFILE;
1566    X509* x509 = NULL;
1567    NAME_CONSTRAINTS* nc = NULL;
1568    GENERAL_SUBTREE* subtree = NULL;
1569    GENERAL_NAME* gn = NULL;
1570    int numPermitted = 0;
1571    int numExcluded = 0;
1572    int critical = -1;
1573
1574    /* Test NULL input handling */
1575    ExpectNull(X509_get_ext_d2i(NULL, NID_name_constraints, NULL, NULL));
1576
1577    /* Test certificate without name constraints
1578     * server-cert.pem does not have name constraints extension */
1579    ExpectTrue((f = XFOPEN("./certs/server-cert.pem", "rb")) != XBADFILE);
1580    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
1581    if (f != XBADFILE) {
1582        XFCLOSE(f);
1583        f = XBADFILE;
1584    }
1585
1586    /* Should return NULL for certificate without name constraints */
1587    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
1588                                             &critical, NULL);
1589    ExpectNull(nc);
1590    X509_free(x509);
1591    x509 = NULL;
1592
1593    /* Test certificate with permitted email name constraint.
1594     * cert-ext-nc.pem has nameConstraints with permitted email */
1595    ExpectTrue((f = XFOPEN("./certs/test/cert-ext-nc.pem", "rb")) != XBADFILE);
1596    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
1597    if (f != XBADFILE) {
1598        XFCLOSE(f);
1599        f = XBADFILE;
1600    }
1601
1602    critical = -1;
1603    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
1604                                             &critical, NULL);
1605    ExpectNotNull(nc);
1606
1607    /* Verify critical flag is set (cert marks it critical) */
1608    ExpectIntEQ(critical, 1);
1609
1610    /* Check permitted subtrees */
1611    if (nc != NULL) {
1612        ExpectNotNull(nc->permittedSubtrees);
1613        if (nc->permittedSubtrees != NULL) {
1614            numPermitted = sk_GENERAL_SUBTREE_num(nc->permittedSubtrees);
1615            ExpectIntGT(numPermitted, 0);
1616
1617            /* Get first permitted subtree */
1618            subtree = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, 0);
1619            ExpectNotNull(subtree);
1620            if (subtree != NULL) {
1621                ExpectNotNull(subtree->base);
1622                if (subtree->base != NULL) {
1623                    /* Check GENERAL_NAME type is GEN_EMAIL */
1624                    gn = subtree->base;
1625                    ExpectIntEQ(gn->type, GEN_EMAIL);
1626
1627                    /* Verify email constraint value */
1628                    ExpectNotNull(gn->d.ia5);
1629                    if (gn->d.ia5 != NULL) {
1630                        ExpectNotNull(gn->d.ia5->data);
1631                        ExpectIntGT(gn->d.ia5->length, 0);
1632                    }
1633                }
1634            }
1635        }
1636
1637        /* Check excluded subtrees, should be NULL or empty */
1638        if (nc->excludedSubtrees != NULL) {
1639            numExcluded = sk_GENERAL_SUBTREE_num(nc->excludedSubtrees);
1640            ExpectIntEQ(numExcluded, 0);
1641        }
1642
1643        /* Test out of bounds access */
1644        if (nc->permittedSubtrees != NULL) {
1645            ExpectNull(sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, 100));
1646        }
1647    }
1648
1649    /* Test NULL stack handling, wolfSSL returns 0 */
1650    ExpectIntEQ(sk_GENERAL_SUBTREE_num(NULL), 0);
1651    ExpectNull(sk_GENERAL_SUBTREE_value(NULL, 0));
1652
1653    NAME_CONSTRAINTS_free(nc);
1654    nc = NULL;
1655    X509_free(x509);
1656    x509 = NULL;
1657
1658    /* Test free functions with NULL */
1659    NAME_CONSTRAINTS_free(NULL);
1660    wolfSSL_GENERAL_SUBTREE_free(NULL);
1661
1662#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_CERTS && !NO_RSA &&
1663        * !IGNORE_NAME_CONSTRAINTS */
1664    return EXPECT_RESULT();
1665}
1666
1667/*
1668 * Test sk_GENERAL_SUBTREE_num and sk_GENERAL_SUBTREE_value functions.
1669 */
1670int test_wolfSSL_sk_GENERAL_SUBTREE(void)
1671{
1672    EXPECT_DECLS;
1673#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
1674    !defined(NO_RSA) && !defined(IGNORE_NAME_CONSTRAINTS)
1675    XFILE f = XBADFILE;
1676    X509* x509 = NULL;
1677    NAME_CONSTRAINTS* nc = NULL;
1678    GENERAL_SUBTREE* subtree = NULL;
1679    int num = 0;
1680    int i;
1681
1682    /* Load certificate with name constraints (cert-ext-nc.pem has 1 email) */
1683    ExpectTrue((f = XFOPEN("./certs/test/cert-ext-nc.pem", "rb")) != XBADFILE);
1684    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
1685    if (f != XBADFILE) {
1686        XFCLOSE(f);
1687        f = XBADFILE;
1688    }
1689
1690    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
1691                                             NULL, NULL);
1692    ExpectNotNull(nc);
1693
1694    if (nc != NULL) {
1695        ExpectNotNull(nc->permittedSubtrees);
1696        if (nc->permittedSubtrees != NULL) {
1697            /* Test sk_GENERAL_SUBTREE_num */
1698            num = sk_GENERAL_SUBTREE_num(nc->permittedSubtrees);
1699            ExpectIntGT(num, 0);
1700
1701            /* Test sk_GENERAL_SUBTREE_value with valid indices */
1702            for (i = 0; i < num && i < 10; i++) {
1703                subtree = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i);
1704                ExpectNotNull(subtree);
1705                if (subtree != NULL) {
1706                    ExpectNotNull(subtree->base);
1707                }
1708            }
1709
1710            /* Test sk_GENERAL_SUBTREE_value at boundaries */
1711            ExpectNotNull(sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, 0));
1712            if (num > 0) {
1713                ExpectNotNull(sk_GENERAL_SUBTREE_value(nc->permittedSubtrees,
1714                                                       num - 1));
1715            }
1716
1717            /* Test invalid indices (out of bounds) */
1718            ExpectNull(sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, num));
1719            ExpectNull(sk_GENERAL_SUBTREE_value(nc->permittedSubtrees,
1720                                                num + 1));
1721            ExpectNull(sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, 10000));
1722        }
1723    }
1724
1725    /* Test NULL stack - wolfSSL returns 0 */
1726    ExpectIntEQ(sk_GENERAL_SUBTREE_num(NULL), 0);
1727    ExpectNull(sk_GENERAL_SUBTREE_value(NULL, 0));
1728
1729    NAME_CONSTRAINTS_free(nc);
1730    X509_free(x509);
1731
1732#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_CERTS && !NO_RSA &&
1733        * !IGNORE_NAME_CONSTRAINTS */
1734    return EXPECT_RESULT();
1735}
1736
1737/*
1738 * Test GENERAL_NAME types in Name Constraints.
1739 * Verify that different GENERAL_NAME types (DNS, EMAIL, DIRNAME) are properly
1740 * extracted from name constraints.
1741 */
1742int test_wolfSSL_NAME_CONSTRAINTS_types(void)
1743{
1744    EXPECT_DECLS;
1745#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
1746    !defined(NO_RSA) && !defined(IGNORE_NAME_CONSTRAINTS)
1747    XFILE f = XBADFILE;
1748    X509* x509 = NULL;
1749    NAME_CONSTRAINTS* nc = NULL;
1750    GENERAL_SUBTREE* subtree = NULL;
1751    GENERAL_NAME* gn = NULL;
1752
1753    /* Test EMAIL type constraint from cert-ext-nc.pem */
1754    ExpectTrue((f = XFOPEN("./certs/test/cert-ext-nc.pem", "rb")) != XBADFILE);
1755    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
1756    if (f != XBADFILE) {
1757        XFCLOSE(f);
1758        f = XBADFILE;
1759    }
1760
1761    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
1762                                             NULL, NULL);
1763    ExpectNotNull(nc);
1764    if (EXPECT_SUCCESS()) {
1765        ExpectNotNull(nc->permittedSubtrees);
1766    }
1767    if (EXPECT_SUCCESS()) {
1768        subtree = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, 0);
1769        ExpectNotNull(subtree);
1770    }
1771    if (EXPECT_SUCCESS()) {
1772        ExpectNotNull(subtree->base);
1773    }
1774    if (EXPECT_SUCCESS()) {
1775        gn = subtree->base;
1776        ExpectIntEQ(gn->type, GEN_EMAIL);
1777        ExpectNotNull(gn->d.ia5);
1778    }
1779    if (EXPECT_SUCCESS()) {
1780        ExpectNotNull(gn->d.ia5->data);
1781        ExpectIntGT(gn->d.ia5->length, 0);
1782    }
1783    if (EXPECT_SUCCESS()) {
1784        /* Constraint should contain "wolfssl.com" */
1785        ExpectNotNull(XSTRSTR((const char*)gn->d.ia5->data, "wolfssl.com"));
1786    }
1787
1788    NAME_CONSTRAINTS_free(nc);
1789    X509_free(x509);
1790
1791#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_CERTS && !NO_RSA &&
1792        * !IGNORE_NAME_CONSTRAINTS */
1793    return EXPECT_RESULT();
1794}
1795
1796/*
1797 * Test URI type in Name Constraints. Verifies that GEN_URI type name
1798 * constraints are properly extracted and stored as IA5STRING.
1799 */
1800int test_wolfSSL_NAME_CONSTRAINTS_uri(void)
1801{
1802    EXPECT_DECLS;
1803#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
1804    !defined(NO_RSA) && !defined(IGNORE_NAME_CONSTRAINTS)
1805    XFILE f = XBADFILE;
1806    X509* x509 = NULL;
1807    NAME_CONSTRAINTS* nc = NULL;
1808    GENERAL_SUBTREE* subtree = NULL;
1809    GENERAL_NAME* gn = NULL;
1810    int i;
1811    int numSubtrees;
1812    int foundUri = 0;
1813
1814    /* Test URI type constraint from cert-ext-nc-combined.pem
1815     * This cert has both URI and DNS constraints */
1816    ExpectTrue((f = XFOPEN("./certs/test/cert-ext-nc-combined.pem", "rb"))
1817                    != XBADFILE);
1818    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
1819    if (f != XBADFILE) {
1820        XFCLOSE(f);
1821        f = XBADFILE;
1822    }
1823
1824    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
1825                                             NULL, NULL);
1826    ExpectNotNull(nc);
1827    if (EXPECT_SUCCESS()) {
1828        ExpectNotNull(nc->permittedSubtrees);
1829    }
1830    /* Find the URI constraint by iterating through subtrees
1831     * (wolfSSL may store them in a different order than in the cert) */
1832    if (EXPECT_SUCCESS()) {
1833        numSubtrees = sk_GENERAL_SUBTREE_num(nc->permittedSubtrees);
1834        for (i = 0; i < numSubtrees; i++) {
1835            subtree = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i);
1836            if (subtree != NULL && subtree->base != NULL &&
1837                subtree->base->type == GEN_URI) {
1838                gn = subtree->base;
1839                foundUri = 1;
1840                break;
1841            }
1842        }
1843        ExpectIntEQ(foundUri, 1);
1844    }
1845    if (EXPECT_SUCCESS() && foundUri) {
1846        ExpectNotNull(gn->d.ia5);
1847    }
1848    if (EXPECT_SUCCESS() && foundUri) {
1849        ExpectNotNull(gn->d.ia5->data);
1850        ExpectIntGT(gn->d.ia5->length, 0);
1851    }
1852    if (EXPECT_SUCCESS() && foundUri) {
1853        /* Constraint should contain "wolfssl.com" */
1854        ExpectNotNull(XSTRSTR((const char*)gn->d.ia5->data, "wolfssl.com"));
1855    }
1856
1857    /* Test URI constraint matching with NAME_CONSTRAINTS_check_name
1858     * Constraint is ".wolfssl.com" (leading dot), matches subdomains only */
1859    if (EXPECT_SUCCESS()) {
1860        /* Full URIs with subdomain hosts - should match */
1861        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1862            "https://www.wolfssl.com/path", 28), 1);
1863        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1864            "http://sub.wolfssl.com", 22), 1);
1865        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1866            "https://a.b.c.wolfssl.com:8080/path?q=1", 39), 1);
1867
1868        /* Exact domain, should not match .wolfssl.com per RFC 5280 */
1869        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1870            "https://wolfssl.com/", 20), 0);
1871
1872        /* Different domains, should not match */
1873        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1874            "https://www.example.com/", 24), 0);
1875        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1876            "https://fakewolfssl.com/", 24), 0);
1877
1878        /* URI with userinfo, should extract host correctly */
1879        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1880            "https://user@www.wolfssl.com/", 29), 1);
1881        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1882            "https://user:pass@www.wolfssl.com/path", 38), 1);
1883
1884        /* IPv6 literal URIs, host extracted without brackets.
1885         * These don't match .wolfssl.com constraint (different host type) */
1886        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1887            "https://[::1]:8080/path", 23), 0);
1888        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1889            "https://[2001:db8::1]/", 22), 0);
1890        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1891            "https://[fe80::1%25eth0]:443/", 29), 0);
1892
1893        /* IPv6 with userinfo */
1894        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1895            "https://user@[::1]:8080/", 24), 0);
1896
1897        /* Malformed IPv6 (missing closing bracket), should fail */
1898        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1899            "https://[::1/path", 17), 0);
1900
1901        /* Invalid URIs, should fail */
1902        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1903            "not-a-uri", 9), 0);
1904        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
1905            "://no-scheme", 12), 0);
1906    }
1907
1908    NAME_CONSTRAINTS_free(nc);
1909    X509_free(x509);
1910
1911#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_CERTS && !NO_RSA &&
1912        * !IGNORE_NAME_CONSTRAINTS */
1913    return EXPECT_RESULT();
1914}
1915
1916/*
1917 * Test IP address type in Name Constraints.
1918 * Verifies that GEN_IPADD type name constraints are properly extracted
1919 * and contain the raw IP bytes in OCTET_STRING format.
1920 * Format: [IP bytes][subnet mask bytes] (8 bytes for IPv4, 32 for IPv6)
1921 */
1922int test_wolfSSL_NAME_CONSTRAINTS_ipaddr(void)
1923{
1924    EXPECT_DECLS;
1925#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
1926    !defined(NO_RSA) && !defined(IGNORE_NAME_CONSTRAINTS)
1927    XFILE f = XBADFILE;
1928    X509* x509 = NULL;
1929    NAME_CONSTRAINTS* nc = NULL;
1930    GENERAL_SUBTREE* subtree = NULL;
1931    GENERAL_NAME* gn = NULL;
1932    int numPermitted = 0;
1933    int critical = -1;
1934
1935    /* Test IP address type constraint from cert-ext-ncip.pem
1936     * This cert has permitted IP: 192.168.1.0/255.255.255.0 */
1937    if ((f = XFOPEN("./certs/test/cert-ext-ncip.pem", "rb")) == XBADFILE) {
1938        return TEST_SKIPPED;
1939    }
1940    x509 = PEM_read_X509(f, NULL, NULL, NULL);
1941    XFCLOSE(f);
1942    f = XBADFILE;
1943
1944    if (x509 == NULL) {
1945        /* Certificate may fail to load due to constraints, skip */
1946        return TEST_SKIPPED;
1947    }
1948
1949    critical = -1;
1950    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
1951                                             &critical, NULL);
1952    ExpectNotNull(nc);
1953
1954    /* Verify critical flag is set */
1955    ExpectIntEQ(critical, 1);
1956
1957    if (EXPECT_SUCCESS()) {
1958        ExpectNotNull(nc->permittedSubtrees);
1959    }
1960    if (EXPECT_SUCCESS()) {
1961        numPermitted = sk_GENERAL_SUBTREE_num(nc->permittedSubtrees);
1962        ExpectIntEQ(numPermitted, 1);
1963        subtree = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, 0);
1964        ExpectNotNull(subtree);
1965    }
1966    if (EXPECT_SUCCESS()) {
1967        ExpectNotNull(subtree->base);
1968    }
1969    if (EXPECT_SUCCESS()) {
1970        gn = subtree->base;
1971        /* Verify GENERAL_NAME type is GEN_IPADD */
1972        ExpectIntEQ(gn->type, GEN_IPADD);
1973        /* Verify IP data is stored in d.ip as OCTET_STRING */
1974        ExpectNotNull(gn->d.ip);
1975    }
1976    if (EXPECT_SUCCESS()) {
1977        ExpectNotNull(gn->d.ip->data);
1978        /* IPv4 constraint: 4 bytes IP + 4 bytes mask = 8 */
1979        ExpectIntEQ(gn->d.ip->length, 8);
1980    }
1981    if (EXPECT_SUCCESS()) {
1982        /* Verify the IP address bytes (192.168.1.0) */
1983        ExpectIntEQ((unsigned char)gn->d.ip->data[0], 192);
1984        ExpectIntEQ((unsigned char)gn->d.ip->data[1], 168);
1985        ExpectIntEQ((unsigned char)gn->d.ip->data[2], 1);
1986        ExpectIntEQ((unsigned char)gn->d.ip->data[3], 0);
1987        /* Verify the subnet mask bytes (255.255.255.0) */
1988        ExpectIntEQ((unsigned char)gn->d.ip->data[4], 255);
1989        ExpectIntEQ((unsigned char)gn->d.ip->data[5], 255);
1990        ExpectIntEQ((unsigned char)gn->d.ip->data[6], 255);
1991        ExpectIntEQ((unsigned char)gn->d.ip->data[7], 0);
1992    }
1993    if (EXPECT_SUCCESS() && nc->excludedSubtrees != NULL) {
1994        /* Excluded subtrees should be empty */
1995        ExpectIntEQ(sk_GENERAL_SUBTREE_num(nc->excludedSubtrees), 0);
1996    }
1997
1998    NAME_CONSTRAINTS_free(nc);
1999    X509_free(x509);
2000
2001#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_CERTS && !NO_RSA &&
2002        * !IGNORE_NAME_CONSTRAINTS */
2003    return EXPECT_RESULT();
2004}
2005
2006/*
2007 * Test wolfSSL_NAME_CONSTRAINTS_check_name() function, checking individual
2008 * names against name constraints.
2009 */
2010int test_wolfSSL_NAME_CONSTRAINTS_check_name(void)
2011{
2012    EXPECT_DECLS;
2013#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
2014    !defined(NO_RSA) && !defined(IGNORE_NAME_CONSTRAINTS)
2015    XFILE f = XBADFILE;
2016    X509* x509 = NULL;
2017    NAME_CONSTRAINTS* nc = NULL;
2018
2019    /* Test email constraint checking with cert-ext-nc.pem
2020     * This cert has permitted email for .wolfssl.com (subdomains only) */
2021    ExpectTrue((f = XFOPEN("./certs/test/cert-ext-nc.pem", "rb")) != XBADFILE);
2022    ExpectNotNull(x509 = PEM_read_X509(f, NULL, NULL, NULL));
2023    if (f != XBADFILE) {
2024        XFCLOSE(f);
2025        f = XBADFILE;
2026    }
2027
2028    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
2029                                             NULL, NULL);
2030    ExpectNotNull(nc);
2031
2032    if (EXPECT_SUCCESS()) {
2033        /* Constraint is ".wolfssl.com" (leading dot). Per RFC 5280, this
2034         * matches emails where domain ends with  ".wolfssl.com" (subdomains
2035         * only), not the exact domain. */
2036
2037        /* Subdomain emails, should match .wolfssl.com */
2038        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2039            "test@sub.wolfssl.com", 20), 1);
2040        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2041            "user@mail.wolfssl.com", 21), 1);
2042        /* Deeper subdomain, should also match */
2043        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2044            "admin@a.b.c.wolfssl.com", 23), 1);
2045
2046        /* Exact domain, should not match .wolfssl.com per RFC */
2047        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2048            "user@wolfssl.com", 16), 0);
2049
2050        /* Different domains, should not match */
2051        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2052            "user@other.com", 14), 0);
2053        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2054            "user@notwolfssl.com", 19), 0);
2055        /* Suffix that doesn't have dot boundary */
2056        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2057            "user@fakewolfssl.com", 20), 0);
2058
2059        /* Test DNS names, no DNS constraint, so all should pass */
2060        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2061            "www.example.com", 15), 1);
2062        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2063            "any.domain.org", 14), 1);
2064
2065        /* Test NULL/invalid arguments */
2066        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(NULL, GEN_EMAIL,
2067            "user@wolfssl.com", 16), 0);
2068        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2069            NULL, 16), 0);
2070        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2071            "user@wolfssl.com", 0), 0);
2072        /* Invalid email format (no @) */
2073        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2074            "invalid-email", 13), 0);
2075        /* @ at start */
2076        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2077            "@wolfssl.com", 12), 0);
2078        /* @ at end */
2079        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2080            "user@", 5), 0);
2081    }
2082
2083    NAME_CONSTRAINTS_free(nc);
2084    X509_free(x509);
2085    x509 = NULL;
2086    nc = NULL;
2087
2088    /* Test IP address constraint checking with cert-ext-ncip.pem
2089     * This cert has permitted IP 192.168.1.0/255.255.255.0 */
2090    if ((f = XFOPEN("./certs/test/cert-ext-ncip.pem", "rb")) == XBADFILE) {
2091        return TEST_SKIPPED;
2092    }
2093    x509 = PEM_read_X509(f, NULL, NULL, NULL);
2094    XFCLOSE(f);
2095    f = XBADFILE;
2096
2097    if (x509 == NULL) {
2098        return TEST_SKIPPED;
2099    }
2100
2101    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
2102                                             NULL, NULL);
2103    ExpectNotNull(nc);
2104
2105    if (EXPECT_SUCCESS()) {
2106        /* Test permitted IPs, within 192.168.1.0/24 subnet */
2107        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_IPADD,
2108            "192.168.1.1", 11), 1);
2109        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_IPADD,
2110            "192.168.1.50", 12), 1);
2111        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_IPADD,
2112            "192.168.1.254", 13), 1);
2113
2114        /* Test non-permitted IPs, outside 192.168.1.0/24 subnet */
2115        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_IPADD,
2116            "192.168.2.1", 11), 0);
2117        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_IPADD,
2118            "10.0.0.1", 8), 0);
2119        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_IPADD,
2120            "8.8.8.8", 7), 0);
2121
2122        /* Test invalid IP format */
2123        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_IPADD,
2124            "invalid", 7), 0);
2125        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_IPADD,
2126            "256.1.1.1", 9), 0);
2127    }
2128
2129    NAME_CONSTRAINTS_free(nc);
2130    X509_free(x509);
2131
2132#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_CERTS && !NO_RSA &&
2133        * !IGNORE_NAME_CONSTRAINTS */
2134    return EXPECT_RESULT();
2135}
2136
2137/*
2138 * Test DNS type name constraint checking with leading dot (subdomain matching).
2139 * Uses cert-ext-nc-combined.pem which has permitted;DNS:.wolfssl.com
2140 */
2141int test_wolfSSL_NAME_CONSTRAINTS_dns(void)
2142{
2143    EXPECT_DECLS;
2144#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
2145    !defined(NO_RSA) && !defined(IGNORE_NAME_CONSTRAINTS)
2146    XFILE f = XBADFILE;
2147    X509* x509 = NULL;
2148    NAME_CONSTRAINTS* nc = NULL;
2149
2150    /* Test DNS constraint checking with cert-ext-nc-combined.pem
2151     * This cert has permitted DNS for .wolfssl.com (subdomains only) */
2152    f = XFOPEN("./certs/test/cert-ext-nc-combined.pem", "rb");
2153    if (f == XBADFILE) {
2154        return TEST_SKIPPED;
2155    }
2156    x509 = PEM_read_X509(f, NULL, NULL, NULL);
2157    XFCLOSE(f);
2158    f = XBADFILE;
2159
2160    if (x509 == NULL) {
2161        return TEST_SKIPPED;
2162    }
2163
2164    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
2165                                             NULL, NULL);
2166    ExpectNotNull(nc);
2167
2168    if (EXPECT_SUCCESS()) {
2169        /* Constraint is ".wolfssl.com" (leading dot). Per RFC 5280, this
2170         * matches DNS names that end with ".wolfssl.com" (subdomains only). */
2171
2172        /* Subdomain DNS names, should match */
2173        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2174            "www.wolfssl.com", 15), 1);
2175        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2176            "mail.wolfssl.com", 16), 1);
2177        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2178            "a.b.c.wolfssl.com", 17), 1);
2179
2180        /* Exact domain, should not match .wolfssl.com per RFC */
2181        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2182            "wolfssl.com", 11), 0);
2183
2184        /* Different domains, should not match */
2185        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2186            "www.example.com", 15), 0);
2187        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2188            "fakewolfssl.com", 15), 0);
2189    }
2190
2191    NAME_CONSTRAINTS_free(nc);
2192    X509_free(x509);
2193
2194#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_CERTS && !NO_RSA &&
2195        * !IGNORE_NAME_CONSTRAINTS */
2196    return EXPECT_RESULT();
2197}
2198
2199/*
2200 * Test excluded name constraints.
2201 * Uses cert-ext-ncmulti.pem which has:
2202 *   permitted;DNS:.example.com, permitted;email:.example.com
2203 *   excluded;DNS:.blocked.example.com, excluded;email:.blocked.example.com
2204 */
2205int test_wolfSSL_NAME_CONSTRAINTS_excluded(void)
2206{
2207    EXPECT_DECLS;
2208#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
2209    !defined(NO_RSA) && !defined(IGNORE_NAME_CONSTRAINTS)
2210    XFILE f = XBADFILE;
2211    X509* x509 = NULL;
2212    NAME_CONSTRAINTS* nc = NULL;
2213
2214    /* Test excluded constraint checking with cert-ext-ncmulti.pem
2215     * This cert permits .example.com but excludes .blocked.example.com */
2216    if ((f = XFOPEN("./certs/test/cert-ext-ncmulti.pem", "rb")) == XBADFILE) {
2217        return TEST_SKIPPED;
2218    }
2219    x509 = PEM_read_X509(f, NULL, NULL, NULL);
2220    XFCLOSE(f);
2221    f = XBADFILE;
2222
2223    if (x509 == NULL) {
2224        return TEST_SKIPPED;
2225    }
2226
2227    nc = (NAME_CONSTRAINTS*)X509_get_ext_d2i(x509, NID_name_constraints,
2228                                             NULL, NULL);
2229    ExpectNotNull(nc);
2230
2231    if (EXPECT_SUCCESS()) {
2232        /* Verify both permitted and excluded subtrees are populated */
2233        ExpectNotNull(nc->permittedSubtrees);
2234        ExpectNotNull(nc->excludedSubtrees);
2235        ExpectIntGT(sk_GENERAL_SUBTREE_num(nc->excludedSubtrees), 0);
2236    }
2237
2238    if (EXPECT_SUCCESS()) {
2239        /* Permitted .example.com subdomains should be allowed */
2240        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2241            "www.example.com", 15), 1);
2242        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2243            "mail.example.com", 16), 1);
2244
2245        /* Excluded .blocked.example.com, subdomains should be blocked */
2246        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2247            "www.blocked.example.com", 23), 0);
2248        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2249            "sub.blocked.example.com", 23), 0);
2250
2251        /* blocked.example.com is permitted because
2252         * .blocked.example.com (with leading dot) only matches subdomains
2253         * per RFC 5280, and it still matches the permitted .example.com
2254         * constraint */
2255        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2256            "blocked.example.com", 19), 1);
2257
2258        /* Domains outside permitted .example.com should not be allowed */
2259        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
2260            "www.wolfssl.com", 15), 0);
2261
2262        /* Permitted email .example.com subdomains should be allowed */
2263        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2264            "user@www.example.com", 20), 1);
2265
2266        /* Excluded email .blocked.example.com, should be blocked */
2267        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_EMAIL,
2268            "user@www.blocked.example.com", 28), 0);
2269    }
2270
2271    NAME_CONSTRAINTS_free(nc);
2272    X509_free(x509);
2273
2274#endif /* OPENSSL_EXTRA && !NO_FILESYSTEM && !NO_CERTS && !NO_RSA &&
2275        * !IGNORE_NAME_CONSTRAINTS */
2276    return EXPECT_RESULT();
2277}
2278