From accc4eada6ad79ceb971c72166b4f534a76a0238 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 06:31:10 +0800 Subject: [PATCH 01/12] test(ssl): add bounded Apple TLS PEM parser Co-authored-by: TRAE CLI --- Makefile | 4 + scripts/unittest.sh | 3 + ssl/appletls_pem.c | 442 ++++++++++++++++++ ssl/appletls_pem.h | 39 ++ unittest/appletls_pem_test.c | 154 ++++++ unittest/fixtures/appletls/ca-dir/README.txt | 1 + unittest/fixtures/appletls/ca-dir/root.crt | 20 + unittest/fixtures/appletls/client-chain.pem | 20 + unittest/fixtures/appletls/client.crt | 20 + unittest/fixtures/appletls/client.key | 27 ++ unittest/fixtures/appletls/ec-pkcs8.key | 5 + unittest/fixtures/appletls/ec-sec1.key | 5 + unittest/fixtures/appletls/encrypted-key.pem | 30 ++ unittest/fixtures/appletls/generate.sh | 93 ++++ unittest/fixtures/appletls/intermediate.crt | 20 + .../fixtures/appletls/malformed-base64.pem | 3 + .../fixtures/appletls/malformed-pkcs8.pem | 3 + unittest/fixtures/appletls/multi-ca.pem | 40 ++ unittest/fixtures/appletls/root.crt | 20 + unittest/fixtures/appletls/server-chain.pem | 40 ++ unittest/fixtures/appletls/server-pkcs1.key | 27 ++ unittest/fixtures/appletls/server-pkcs8.key | 28 ++ unittest/fixtures/appletls/server.crt | 20 + unittest/fixtures/appletls/wrong-root.crt | 20 + unittest/fixtures/appletls/wrong-server.key | 27 ++ 25 files changed, 1111 insertions(+) create mode 100644 ssl/appletls_pem.c create mode 100644 ssl/appletls_pem.h create mode 100644 unittest/appletls_pem_test.c create mode 100644 unittest/fixtures/appletls/ca-dir/README.txt create mode 100644 unittest/fixtures/appletls/ca-dir/root.crt create mode 100644 unittest/fixtures/appletls/client-chain.pem create mode 100644 unittest/fixtures/appletls/client.crt create mode 100644 unittest/fixtures/appletls/client.key create mode 100644 unittest/fixtures/appletls/ec-pkcs8.key create mode 100644 unittest/fixtures/appletls/ec-sec1.key create mode 100644 unittest/fixtures/appletls/encrypted-key.pem create mode 100755 unittest/fixtures/appletls/generate.sh create mode 100644 unittest/fixtures/appletls/intermediate.crt create mode 100644 unittest/fixtures/appletls/malformed-base64.pem create mode 100644 unittest/fixtures/appletls/malformed-pkcs8.pem create mode 100644 unittest/fixtures/appletls/multi-ca.pem create mode 100644 unittest/fixtures/appletls/root.crt create mode 100644 unittest/fixtures/appletls/server-chain.pem create mode 100644 unittest/fixtures/appletls/server-pkcs1.key create mode 100644 unittest/fixtures/appletls/server-pkcs8.key create mode 100644 unittest/fixtures/appletls/server.crt create mode 100644 unittest/fixtures/appletls/wrong-root.crt create mode 100644 unittest/fixtures/appletls/wrong-server.key diff --git a/Makefile b/Makefile index 2b7f50464..fdac758c8 100644 --- a/Makefile +++ b/Makefile @@ -423,6 +423,10 @@ ifeq ($(WITH_REDIS), yes) $(CXX) -g -Wall -O0 -std=c++11 -I. -Ibase -Issl -Ievent -Icpputil -Iredis -Ievpp -o bin/redis_subscriber_test unittest/redis_subscriber_test.cpp unittest/redis_test_server.cpp -Llib -lhv -pthread endif endif + +appletls_pem_test: prepare + $(CC) -g -Wall -Wextra -O0 -std=c99 -I. -Ibase -Issl \ + -o bin/appletls_pem_test unittest/appletls_pem_test.c ssl/appletls_pem.c ifeq ($(WITH_LUA), yes) $(CXX) -g -Wall -O0 -std=c++11 -DWITH_LUA $(LUA_CFLAGS) -I. -Ibase -Issl -Ievent -Icpputil -Ievpp -Ilua -o bin/lua_binding_test unittest/lua_binding_test.cpp -Llib -lhv -pthread $(LUA_LIBS) $(CXX) -g -Wall -O0 -std=c++11 -DWITH_LUA $(LUA_CFLAGS) -I. -Ibase -Issl -Ievent -Icpputil -Ievpp -Ilua -o bin/lua_io_test unittest/lua_io_test.cpp -Llib -lhv -pthread $(LUA_LIBS) diff --git a/scripts/unittest.sh b/scripts/unittest.sh index 5a4d05668..e14d751d5 100755 --- a/scripts/unittest.sh +++ b/scripts/unittest.sh @@ -28,6 +28,9 @@ bin/hurl_test # bin/hthread_test # bin/hmutex_test bin/socketpair_test +if [ -x bin/appletls_pem_test ]; then + bin/appletls_pem_test || exit $? +fi # bin/threadpool_test # bin/objectpool_test bin/sizeof_test diff --git a/ssl/appletls_pem.c b/ssl/appletls_pem.c new file mode 100644 index 000000000..5db0b88f6 --- /dev/null +++ b/ssl/appletls_pem.c @@ -0,0 +1,442 @@ +#include "appletls_pem.h" + +#include +#include +#include +#include +#include +#include + +typedef struct { + const unsigned char* ptr; + const unsigned char* end; +} der_cursor_t; + +static const unsigned char rsa_encryption_oid[] = { + 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 +}; + +static int read_file(const char* path, unsigned char** data, size_t* len) { + FILE* fp = NULL; + long file_len; + unsigned char* buffer = NULL; + + if (path == NULL || data == NULL || len == NULL) return APPLETLS_PEM_ERROR_FORMAT; + *data = NULL; + *len = 0; + + fp = fopen(path, "rb"); + if (fp == NULL) return APPLETLS_PEM_ERROR_IO; + if (fseek(fp, 0, SEEK_END) != 0) goto io_error; + file_len = ftell(fp); + if (file_len < 0) goto io_error; + if ((unsigned long)file_len > APPLETLS_PEM_MAX_FILE_SIZE) { + fclose(fp); + return APPLETLS_PEM_ERROR_LIMIT; + } + if (file_len == 0 || fseek(fp, 0, SEEK_SET) != 0) goto io_error; + + buffer = (unsigned char*)malloc((size_t)file_len + 1u); + if (buffer == NULL) { + fclose(fp); + return APPLETLS_PEM_ERROR_NOMEM; + } + if (fread(buffer, 1, (size_t)file_len, fp) != (size_t)file_len) { + free(buffer); + goto io_error; + } + buffer[file_len] = '\0'; + fclose(fp); + *data = buffer; + *len = (size_t)file_len; + return APPLETLS_PEM_OK; + +io_error: + fclose(fp); + return APPLETLS_PEM_ERROR_IO; +} + +static int is_space_only(const unsigned char* begin, const unsigned char* end) { + while (begin < end) { + if (!isspace(*begin)) return 0; + ++begin; + } + return 1; +} + +static int base64_value(unsigned char ch) { + if (ch >= 'A' && ch <= 'Z') return ch - 'A'; + if (ch >= 'a' && ch <= 'z') return ch - 'a' + 26; + if (ch >= '0' && ch <= '9') return ch - '0' + 52; + if (ch == '+') return 62; + if (ch == '/') return 63; + return -1; +} + +static int decode_base64(const unsigned char* begin, const unsigned char* end, appletls_der_t* der) { + unsigned char quartet[4]; + size_t quartet_len = 0; + size_t useful = 0; + size_t out_len = 0; + int padded = 0; + unsigned char* out; + const unsigned char* ptr; + + for (ptr = begin; ptr < end; ++ptr) { + if (isspace(*ptr)) continue; + if (*ptr != '=' && base64_value(*ptr) < 0) return APPLETLS_PEM_ERROR_FORMAT; + ++useful; + } + if (useful == 0 || useful % 4 != 0) return APPLETLS_PEM_ERROR_FORMAT; + if (useful / 4 > (APPLETLS_PEM_MAX_BLOCK_SIZE + 2u) / 3u) return APPLETLS_PEM_ERROR_LIMIT; + + out = (unsigned char*)malloc((useful / 4) * 3); + if (out == NULL) return APPLETLS_PEM_ERROR_NOMEM; + + for (ptr = begin; ptr < end; ++ptr) { + int a, b, c, d; + if (isspace(*ptr)) continue; + if (padded) { + free(out); + return APPLETLS_PEM_ERROR_FORMAT; + } + quartet[quartet_len++] = *ptr; + if (quartet_len != 4) continue; + + a = base64_value(quartet[0]); + b = base64_value(quartet[1]); + c = quartet[2] == '=' ? -2 : base64_value(quartet[2]); + d = quartet[3] == '=' ? -2 : base64_value(quartet[3]); + if (a < 0 || b < 0 || c < -2 || d < -2 || (c == -2 && d != -2)) { + free(out); + return APPLETLS_PEM_ERROR_FORMAT; + } + out[out_len++] = (unsigned char)((a << 2) | (b >> 4)); + if (c == -2) { + if ((b & 0x0f) != 0) goto invalid_padding; + padded = 1; + } else { + out[out_len++] = (unsigned char)((b << 4) | (c >> 2)); + if (d == -2) { + if ((c & 0x03) != 0) goto invalid_padding; + padded = 1; + } else { + out[out_len++] = (unsigned char)((c << 6) | d); + } + } + quartet_len = 0; + } + if (quartet_len != 0 || out_len == 0 || out_len > APPLETLS_PEM_MAX_BLOCK_SIZE) { + free(out); + return out_len > APPLETLS_PEM_MAX_BLOCK_SIZE ? APPLETLS_PEM_ERROR_LIMIT : APPLETLS_PEM_ERROR_FORMAT; + } + der->data = out; + der->len = out_len; + return APPLETLS_PEM_OK; + +invalid_padding: + free(out); + return APPLETLS_PEM_ERROR_FORMAT; +} + +static int der_read_length(der_cursor_t* cursor, size_t* len) { + unsigned char first; + size_t value = 0; + size_t bytes; + size_t i; + + if (cursor->ptr >= cursor->end) return APPLETLS_PEM_ERROR_FORMAT; + first = *cursor->ptr++; + if ((first & 0x80) == 0) { + *len = first; + return (size_t)(cursor->end - cursor->ptr) >= *len ? APPLETLS_PEM_OK : APPLETLS_PEM_ERROR_FORMAT; + } + bytes = first & 0x7f; + if (bytes == 0 || bytes > sizeof(size_t) || (size_t)(cursor->end - cursor->ptr) < bytes) { + return APPLETLS_PEM_ERROR_FORMAT; + } + if (*cursor->ptr == 0) return APPLETLS_PEM_ERROR_FORMAT; + for (i = 0; i < bytes; ++i) { + if (value > (SIZE_MAX >> 8)) return APPLETLS_PEM_ERROR_LIMIT; + value = (value << 8) | *cursor->ptr++; + } + if (value < 128 || (size_t)(cursor->end - cursor->ptr) < value) return APPLETLS_PEM_ERROR_FORMAT; + *len = value; + return APPLETLS_PEM_OK; +} + +static int der_read_tlv(der_cursor_t* cursor, unsigned char expected_tag, der_cursor_t* value) { + size_t len; + int ret; + if (cursor->ptr >= cursor->end || *cursor->ptr++ != expected_tag) return APPLETLS_PEM_ERROR_FORMAT; + ret = der_read_length(cursor, &len); + if (ret != APPLETLS_PEM_OK) return ret; + value->ptr = cursor->ptr; + value->end = cursor->ptr + len; + cursor->ptr += len; + return APPLETLS_PEM_OK; +} + +static int der_integer_is_minimal(const der_cursor_t* integer) { + size_t len = (size_t)(integer->end - integer->ptr); + if (len == 0 || (integer->ptr[0] & 0x80) != 0) return 0; + if (len > 1 && integer->ptr[0] == 0 && (integer->ptr[1] & 0x80) == 0) return 0; + return 1; +} + +static int validate_pkcs1_rsa(const unsigned char* data, size_t len) { + der_cursor_t outer = {data, data + len}; + der_cursor_t sequence; + der_cursor_t integer; + size_t i; + int ret = der_read_tlv(&outer, 0x30, &sequence); + if (ret != APPLETLS_PEM_OK || outer.ptr != outer.end) return APPLETLS_PEM_ERROR_FORMAT; + ret = der_read_tlv(&sequence, 0x02, &integer); + if (ret != APPLETLS_PEM_OK || !der_integer_is_minimal(&integer) || + integer.end - integer.ptr != 1 || integer.ptr[0] != 0) { + return APPLETLS_PEM_ERROR_FORMAT; + } + for (i = 0; i < 8; ++i) { + ret = der_read_tlv(&sequence, 0x02, &integer); + if (ret != APPLETLS_PEM_OK || !der_integer_is_minimal(&integer)) return APPLETLS_PEM_ERROR_FORMAT; + } + return sequence.ptr == sequence.end ? APPLETLS_PEM_OK : APPLETLS_PEM_ERROR_FORMAT; +} + +static int copy_der(const unsigned char* data, size_t len, appletls_der_t* out) { + unsigned char* copy; + if (len == 0 || len > APPLETLS_PEM_MAX_BLOCK_SIZE) return APPLETLS_PEM_ERROR_LIMIT; + copy = (unsigned char*)malloc(len); + if (copy == NULL) return APPLETLS_PEM_ERROR_NOMEM; + memcpy(copy, data, len); + out->data = copy; + out->len = len; + return APPLETLS_PEM_OK; +} + +static int unwrap_pkcs8_rsa(const unsigned char* data, size_t len, appletls_der_t* pkcs1_key) { + der_cursor_t outer = {data, data + len}; + der_cursor_t sequence; + der_cursor_t version; + der_cursor_t algorithm; + der_cursor_t oid; + der_cursor_t null_value; + der_cursor_t private_key; + int ret = der_read_tlv(&outer, 0x30, &sequence); + if (ret != APPLETLS_PEM_OK || outer.ptr != outer.end) return APPLETLS_PEM_ERROR_FORMAT; + ret = der_read_tlv(&sequence, 0x02, &version); + if (ret != APPLETLS_PEM_OK || version.end - version.ptr != 1 || version.ptr[0] != 0) return APPLETLS_PEM_ERROR_FORMAT; + ret = der_read_tlv(&sequence, 0x30, &algorithm); + if (ret != APPLETLS_PEM_OK) return ret; + ret = der_read_tlv(&algorithm, 0x06, &oid); + if (ret != APPLETLS_PEM_OK) return ret; + if ((size_t)(oid.end - oid.ptr) != sizeof(rsa_encryption_oid) || + memcmp(oid.ptr, rsa_encryption_oid, sizeof(rsa_encryption_oid)) != 0) { + return APPLETLS_PEM_ERROR_UNSUPPORTED; + } + if (algorithm.ptr != algorithm.end) { + ret = der_read_tlv(&algorithm, 0x05, &null_value); + if (ret != APPLETLS_PEM_OK || null_value.ptr != null_value.end || algorithm.ptr != algorithm.end) { + return APPLETLS_PEM_ERROR_FORMAT; + } + } + ret = der_read_tlv(&sequence, 0x04, &private_key); + if (ret != APPLETLS_PEM_OK || sequence.ptr != sequence.end) return APPLETLS_PEM_ERROR_FORMAT; + ret = validate_pkcs1_rsa(private_key.ptr, (size_t)(private_key.end - private_key.ptr)); + if (ret != APPLETLS_PEM_OK) return ret; + return copy_der(private_key.ptr, (size_t)(private_key.end - private_key.ptr), pkcs1_key); +} + +static const unsigned char* find_bytes(const unsigned char* begin, const unsigned char* end, const char* needle) { + size_t needle_len = strlen(needle); + const unsigned char* ptr; + if ((size_t)(end - begin) < needle_len) return NULL; + for (ptr = begin; ptr + needle_len <= end; ++ptr) { + if (memcmp(ptr, needle, needle_len) == 0) return ptr; + } + return NULL; +} + +static int append_der(appletls_der_list_t* list, size_t max_count, appletls_der_t* der) { + appletls_der_t* items; + size_t new_count; + if (list->count >= max_count || list->count >= APPLETLS_PEM_MAX_CERTIFICATES) return APPLETLS_PEM_ERROR_LIMIT; + new_count = list->count + 1; + if (new_count > SIZE_MAX / sizeof(*items)) return APPLETLS_PEM_ERROR_LIMIT; + items = (appletls_der_t*)realloc(list->items, new_count * sizeof(*items)); + if (items == NULL) return APPLETLS_PEM_ERROR_NOMEM; + list->items = items; + list->items[list->count] = *der; + list->count = new_count; + der->data = NULL; + der->len = 0; + return APPLETLS_PEM_OK; +} + +static int validate_der_object(const unsigned char* data, size_t len) { + der_cursor_t outer = {data, data + len}; + der_cursor_t sequence; + int ret = der_read_tlv(&outer, 0x30, &sequence); + if (ret != APPLETLS_PEM_OK || outer.ptr != outer.end || sequence.ptr == sequence.end) return APPLETLS_PEM_ERROR_FORMAT; + return APPLETLS_PEM_OK; +} + +int appletls_pem_load_certificates(const char* path, int allow_der, size_t max_certificates, appletls_der_list_t* certificates) { + static const char begin_marker[] = "-----BEGIN CERTIFICATE-----"; + static const char end_marker[] = "-----END CERTIFICATE-----"; + unsigned char* file = NULL; + size_t file_len = 0; + const unsigned char* ptr; + const unsigned char* end; + int ret; + + if (certificates == NULL || max_certificates == 0) return APPLETLS_PEM_ERROR_FORMAT; + certificates->items = NULL; + certificates->count = 0; + ret = read_file(path, &file, &file_len); + if (ret != APPLETLS_PEM_OK) return ret; + ptr = file; + end = file + file_len; + + if (find_bytes(ptr, end, begin_marker) == NULL) { + appletls_der_t der = {0}; + if (!allow_der) { + ret = APPLETLS_PEM_ERROR_FORMAT; + goto done; + } + ret = validate_der_object(file, file_len); + if (ret == APPLETLS_PEM_OK) ret = copy_der(file, file_len, &der); + if (ret == APPLETLS_PEM_OK) ret = append_der(certificates, max_certificates, &der); + appletls_der_free(&der); + goto done; + } + + while (ptr < end) { + const unsigned char* block_begin; + const unsigned char* block_end; + appletls_der_t der = {0}; + block_begin = find_bytes(ptr, end, begin_marker); + if (block_begin == NULL) { + ret = is_space_only(ptr, end) ? APPLETLS_PEM_OK : APPLETLS_PEM_ERROR_FORMAT; + break; + } + if (!is_space_only(ptr, block_begin)) { + ret = APPLETLS_PEM_ERROR_FORMAT; + break; + } + block_begin += strlen(begin_marker); + block_end = find_bytes(block_begin, end, end_marker); + if (block_end == NULL) { + ret = APPLETLS_PEM_ERROR_FORMAT; + break; + } + ret = decode_base64(block_begin, block_end, &der); + if (ret == APPLETLS_PEM_OK) ret = validate_der_object(der.data, der.len); + if (ret == APPLETLS_PEM_OK) ret = append_der(certificates, max_certificates, &der); + appletls_der_free(&der); + if (ret != APPLETLS_PEM_OK) break; + ptr = block_end + strlen(end_marker); + } + if (ret == APPLETLS_PEM_OK && certificates->count == 0) ret = APPLETLS_PEM_ERROR_FORMAT; + +done: + free(file); + if (ret != APPLETLS_PEM_OK) appletls_der_list_free(certificates); + return ret; +} + +int appletls_pem_load_rsa_private_key(const char* path, appletls_der_t* pkcs1_key) { + static const char rsa_begin[] = "-----BEGIN RSA PRIVATE KEY-----"; + static const char rsa_end[] = "-----END RSA PRIVATE KEY-----"; + static const char pkcs8_begin[] = "-----BEGIN PRIVATE KEY-----"; + static const char pkcs8_end[] = "-----END PRIVATE KEY-----"; + static const char encrypted_begin[] = "-----BEGIN ENCRYPTED PRIVATE KEY-----"; + static const char ec_begin[] = "-----BEGIN EC PRIVATE KEY-----"; + unsigned char* file = NULL; + size_t file_len = 0; + const unsigned char* begin; + const unsigned char* end; + const unsigned char* body_end; + const char* end_marker; + int pkcs8 = 0; + int ret; + appletls_der_t decoded = {0}; + + if (pkcs1_key == NULL) return APPLETLS_PEM_ERROR_FORMAT; + pkcs1_key->data = NULL; + pkcs1_key->len = 0; + ret = read_file(path, &file, &file_len); + if (ret != APPLETLS_PEM_OK) return ret; + end = file + file_len; + if (find_bytes(file, end, encrypted_begin) || find_bytes(file, end, ec_begin) || + find_bytes(file, end, "Proc-Type: 4,ENCRYPTED")) { + ret = APPLETLS_PEM_ERROR_UNSUPPORTED; + goto done; + } + begin = find_bytes(file, end, rsa_begin); + end_marker = rsa_end; + if (begin == NULL) { + begin = find_bytes(file, end, pkcs8_begin); + end_marker = pkcs8_end; + pkcs8 = 1; + } + if (begin == NULL || !is_space_only(file, begin)) { + ret = APPLETLS_PEM_ERROR_FORMAT; + goto done; + } + begin += strlen(pkcs8 ? pkcs8_begin : rsa_begin); + body_end = find_bytes(begin, end, end_marker); + if (body_end == NULL) { + ret = APPLETLS_PEM_ERROR_FORMAT; + goto done; + } + if (!is_space_only(body_end + strlen(end_marker), end)) { + ret = APPLETLS_PEM_ERROR_FORMAT; + goto done; + } + ret = decode_base64(begin, body_end, &decoded); + if (ret != APPLETLS_PEM_OK) goto done; + if (pkcs8) { + ret = unwrap_pkcs8_rsa(decoded.data, decoded.len, pkcs1_key); + } else { + ret = validate_pkcs1_rsa(decoded.data, decoded.len); + if (ret == APPLETLS_PEM_OK) { + *pkcs1_key = decoded; + decoded.data = NULL; + decoded.len = 0; + } + } + +done: + appletls_der_free(&decoded); + free(file); + return ret; +} + +void appletls_der_free(appletls_der_t* der) { + if (der == NULL) return; + free(der->data); + der->data = NULL; + der->len = 0; +} + +void appletls_der_list_free(appletls_der_list_t* list) { + size_t i; + if (list == NULL) return; + for (i = 0; i < list->count; ++i) appletls_der_free(&list->items[i]); + free(list->items); + list->items = NULL; + list->count = 0; +} + +const char* appletls_pem_error_string(int error) { + switch (error) { + case APPLETLS_PEM_OK: return "success"; + case APPLETLS_PEM_ERROR_IO: return "file I/O failed"; + case APPLETLS_PEM_ERROR_FORMAT: return "invalid PEM or DER format"; + case APPLETLS_PEM_ERROR_UNSUPPORTED: return "unsupported key format"; + case APPLETLS_PEM_ERROR_LIMIT: return "input limit exceeded"; + case APPLETLS_PEM_ERROR_NOMEM: return "out of memory"; + default: return "unknown parser error"; + } +} diff --git a/ssl/appletls_pem.h b/ssl/appletls_pem.h new file mode 100644 index 000000000..b3af70fbd --- /dev/null +++ b/ssl/appletls_pem.h @@ -0,0 +1,39 @@ +#ifndef HV_APPLETLS_PEM_H_ +#define HV_APPLETLS_PEM_H_ + +#include + +#define APPLETLS_PEM_MAX_FILE_SIZE (16u * 1024u * 1024u) +#define APPLETLS_PEM_MAX_BLOCK_SIZE (4u * 1024u * 1024u) +#define APPLETLS_PEM_MAX_CERTIFICATES 1024u + +typedef struct { + unsigned char* data; + size_t len; +} appletls_der_t; + +typedef struct { + appletls_der_t* items; + size_t count; +} appletls_der_list_t; + +typedef enum { + APPLETLS_PEM_OK = 0, + APPLETLS_PEM_ERROR_IO = -1, + APPLETLS_PEM_ERROR_FORMAT = -2, + APPLETLS_PEM_ERROR_UNSUPPORTED = -3, + APPLETLS_PEM_ERROR_LIMIT = -4, + APPLETLS_PEM_ERROR_NOMEM = -5 +} appletls_pem_error_t; + +int appletls_pem_load_certificates(const char* path, + int allow_der, + size_t max_certificates, + appletls_der_list_t* certificates); +int appletls_pem_load_rsa_private_key(const char* path, + appletls_der_t* pkcs1_key); +void appletls_der_free(appletls_der_t* der); +void appletls_der_list_free(appletls_der_list_t* list); +const char* appletls_pem_error_string(int error); + +#endif diff --git a/unittest/appletls_pem_test.c b/unittest/appletls_pem_test.c new file mode 100644 index 000000000..181f08888 --- /dev/null +++ b/unittest/appletls_pem_test.c @@ -0,0 +1,154 @@ +#include +#include +#include +#include +#include + +#include "appletls_pem.h" + +#define FIXTURE(name) "unittest/fixtures/appletls/" name + +static void assert_file_equal(const appletls_der_t* lhs, const appletls_der_t* rhs) { + assert(lhs->len == rhs->len); + assert(memcmp(lhs->data, rhs->data, lhs->len) == 0); +} + +static char* write_temp(const void* data, size_t len) { + char* path = strdup("/private/tmp/libhv-appletls-pem-XXXXXX"); + assert(path != NULL); + int fd = mkstemp(path); + assert(fd >= 0); + const unsigned char* ptr = (const unsigned char*)data; + while (len != 0) { + ssize_t nwrite = write(fd, ptr, len); + assert(nwrite > 0); + ptr += nwrite; + len -= (size_t)nwrite; + } + assert(close(fd) == 0); + return path; +} + +static void remove_temp(char* path) { + assert(unlink(path) == 0); + free(path); +} + +static void test_load_pkcs1_rsa(void) { + appletls_der_t key = {0}; + assert(appletls_pem_load_rsa_private_key(FIXTURE("server-pkcs1.key"), &key) == APPLETLS_PEM_OK); + assert(key.data != NULL && key.len > 256); + assert(key.data[0] == 0x30); + appletls_der_free(&key); + assert(key.data == NULL && key.len == 0); +} + +static void test_unwrap_pkcs8_rsa(void) { + appletls_der_t pkcs1 = {0}; + appletls_der_t pkcs8 = {0}; + assert(appletls_pem_load_rsa_private_key(FIXTURE("server-pkcs1.key"), &pkcs1) == APPLETLS_PEM_OK); + assert(appletls_pem_load_rsa_private_key(FIXTURE("server-pkcs8.key"), &pkcs8) == APPLETLS_PEM_OK); + assert_file_equal(&pkcs1, &pkcs8); + appletls_der_free(&pkcs1); + appletls_der_free(&pkcs8); +} + +static void test_load_certificate_chain_in_order(void) { + appletls_der_list_t chain = {0}; + appletls_der_list_t leaf = {0}; + appletls_der_list_t intermediate = {0}; + assert(appletls_pem_load_certificates(FIXTURE("server-chain.pem"), 0, 64, &chain) == APPLETLS_PEM_OK); + assert(appletls_pem_load_certificates(FIXTURE("server.crt"), 0, 1, &leaf) == APPLETLS_PEM_OK); + assert(appletls_pem_load_certificates(FIXTURE("intermediate.crt"), 0, 1, &intermediate) == APPLETLS_PEM_OK); + assert(chain.count == 2 && leaf.count == 1 && intermediate.count == 1); + assert_file_equal(&chain.items[0], &leaf.items[0]); + assert_file_equal(&chain.items[1], &intermediate.items[0]); + appletls_der_list_free(&chain); + appletls_der_list_free(&leaf); + appletls_der_list_free(&intermediate); +} + +static void test_reject_ec_and_encrypted_keys(void) { + appletls_der_t key = {0}; + assert(appletls_pem_load_rsa_private_key(FIXTURE("ec-sec1.key"), &key) == APPLETLS_PEM_ERROR_UNSUPPORTED); + assert(appletls_pem_load_rsa_private_key(FIXTURE("ec-pkcs8.key"), &key) == APPLETLS_PEM_ERROR_UNSUPPORTED); + assert(appletls_pem_load_rsa_private_key(FIXTURE("encrypted-key.pem"), &key) == APPLETLS_PEM_ERROR_UNSUPPORTED); +} + +static void test_reject_invalid_base64(void) { + appletls_der_list_t certs = {0}; + assert(appletls_pem_load_certificates(FIXTURE("malformed-base64.pem"), 0, 1, &certs) == APPLETLS_PEM_ERROR_FORMAT); +} + +static void test_reject_invalid_der_lengths(void) { + static const unsigned char indefinite[] = {0x30, 0x80, 0x00, 0x00}; + static const unsigned char nonminimal[] = {0x30, 0x81, 0x01, 0x00}; + static const unsigned char truncated[] = {0x30, 0x04, 0x02, 0x01}; + static const unsigned char trailing[] = {0x30, 0x00, 0x00}; + const unsigned char* cases[] = {indefinite, nonminimal, truncated, trailing}; + const size_t sizes[] = {sizeof(indefinite), sizeof(nonminimal), sizeof(truncated), sizeof(trailing)}; + size_t i; + for (i = 0; i < sizeof(cases) / sizeof(cases[0]); ++i) { + char* path = write_temp(cases[i], sizes[i]); + appletls_der_list_t certs = {0}; + assert(appletls_pem_load_certificates(path, 1, 1, &certs) == APPLETLS_PEM_ERROR_FORMAT); + remove_temp(path); + } +} + +static void test_reject_non_rsa_pkcs8_oid(void) { + appletls_der_t key = {0}; + assert(appletls_pem_load_rsa_private_key(FIXTURE("ec-pkcs8.key"), &key) == APPLETLS_PEM_ERROR_UNSUPPORTED); + assert(appletls_pem_load_rsa_private_key(FIXTURE("malformed-pkcs8.pem"), &key) == APPLETLS_PEM_ERROR_FORMAT); +} + +static void test_reject_multiple_private_keys(void) { + FILE* source = fopen(FIXTURE("server-pkcs1.key"), "rb"); + assert(source != NULL); + assert(fseek(source, 0, SEEK_END) == 0); + long length = ftell(source); + assert(length > 0 && fseek(source, 0, SEEK_SET) == 0); + char* key = (char*)malloc((size_t)length); + char* twice = (char*)malloc((size_t)length * 2); + assert(key != NULL && twice != NULL); + assert(fread(key, 1, (size_t)length, source) == (size_t)length); + fclose(source); + memcpy(twice, key, (size_t)length); + memcpy(twice + length, key, (size_t)length); + char* path = write_temp(twice, (size_t)length * 2); + appletls_der_t parsed = {0}; + assert(appletls_pem_load_rsa_private_key(path, &parsed) == APPLETLS_PEM_ERROR_FORMAT); + remove_temp(path); + free(twice); + free(key); +} + +static void test_enforce_file_block_and_count_limits(void) { + appletls_der_list_t certs = {0}; + char* path; + int fd; + assert(appletls_pem_load_certificates(FIXTURE("server-chain.pem"), 0, 1, &certs) == APPLETLS_PEM_ERROR_LIMIT); + + path = strdup("/private/tmp/libhv-appletls-large-XXXXXX"); + assert(path != NULL); + fd = mkstemp(path); + assert(fd >= 0); + assert(ftruncate(fd, (off_t)APPLETLS_PEM_MAX_FILE_SIZE + 1) == 0); + assert(close(fd) == 0); + assert(appletls_pem_load_certificates(path, 1, 1, &certs) == APPLETLS_PEM_ERROR_LIMIT); + remove_temp(path); +} + +int main(void) { + test_load_pkcs1_rsa(); + test_unwrap_pkcs8_rsa(); + test_load_certificate_chain_in_order(); + test_reject_ec_and_encrypted_keys(); + test_reject_invalid_base64(); + test_reject_invalid_der_lengths(); + test_reject_non_rsa_pkcs8_oid(); + test_reject_multiple_private_keys(); + test_enforce_file_block_and_count_limits(); + puts("appletls_pem_test: PASS"); + return 0; +} diff --git a/unittest/fixtures/appletls/ca-dir/README.txt b/unittest/fixtures/appletls/ca-dir/README.txt new file mode 100644 index 000000000..2716bf650 --- /dev/null +++ b/unittest/fixtures/appletls/ca-dir/README.txt @@ -0,0 +1 @@ +not a certificate diff --git a/unittest/fixtures/appletls/ca-dir/root.crt b/unittest/fixtures/appletls/ca-dir/root.crt new file mode 100644 index 000000000..34c0fc273 --- /dev/null +++ b/unittest/fixtures/appletls/ca-dir/root.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDOTCCAiGgAwIBAgIUdsy7efSOuc3Tckn3MvtOPCjyz8wwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz +MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs +ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2 +AsbGXP0ZwKn6k/pZbBI9AbzG8UTj9M/lV6lugynolHAXweKFTPMkeF85ZbFKArPV +4CPCXRanlNH37gaeaT9imXcSyLdvTtpIwF/FpFtMbPKNeOLu7ci+SlB+20BWAUsq +flmogmmq5eGKaPA9eEQILDuPbjzAvowcz413JkKrUFle4KriRb1dN3eAKm7QnCMx +hDLjSCcxjj6S2lGLi1cuvs9FS73jyx9TaCMv095jhLeSoF8Jfz/67HxIW/DFVl9d +6KVpJdToHxZyqfaJ3iRQXsbMq0Wh8fJP9ac8LORFOD7/Seo5VekgTBZOhE5SwfPC +7lYG94SDeLXpVU6gntIVAgMBAAGjYzBhMB0GA1UdDgQWBBSMG/0lKegkP3ay7vUy +TpK/gmdOsTAfBgNVHSMEGDAWgBSMG/0lKegkP3ay7vUyTpK/gmdOsTAPBgNVHRMB +Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAmIPm +3TWnQ3sF+yYgsnQhWdBkC0bAVXsCtdpgwCXujIfjsklVa7i93iXC4ypH92C7+jzw +NWIYbbG2Kv2NYc5H7TYUMO57nURC7hPh4pRse0yW+EdfpHnb6tM65mWwoE8ECuBD +3TdHiD97NXlODQhdhnxGsg8qVJ8h7Tcll8BARzfumVxL+78iQiJOTR0haRdIip+1 ++++2AIv82MkMSh18JISg4ym8DQjMYnY0I/SasQCWkF/V2dsjzwjX5qRU4mBN71Ub +rgUI+8m0yDCYgf5fyKbkBkoVjvqorVed/SXhyMzGl4peFCC5u2ijTRwoFs3lPMCo +FTAq4PmJPf0CVhgrog== +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client-chain.pem b/unittest/fixtures/appletls/client-chain.pem new file mode 100644 index 000000000..87df1f423 --- /dev/null +++ b/unittest/fixtures/appletls/client-chain.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDTTCCAjWgAwIBAgIUa1xt7fbLCcces2WETU+Dj6XY6uMwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz +MDE5MjcwMVoYDzIxMjYwOTA2MTkyNzAxWjAlMSMwIQYDVQQDDBpsaWJodi1hcHBs +ZXRscy10ZXN0LWNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AKfycz1z9vLhyKSzZkq4mX0nV/Deiwmn7xZkQhfCpVRaRPtr5kie4hRnibVVZEVc +qlsdLBS2nUT8RdYI1NyPYdYwKkr4LjdEHIv+ih3cfKjVV7zKZRkObX55RqaRxNXB +AOXejXLCSxpeY+DEB/atPw8C1OjrNBj6Ew8B/ijLF5pG7tn386IcAqIaFpZqXv9k +6q5OtXCgruScm/iciAxLSH7qgzcQcBBzD+inGBwxVMvHJATNHoLsji32efY+Ixj6 +1hBm9q8iCALTSUr53p8jC6DFWZxe7Mqgi7TpBms2vbxgl+rx9HoI6xWC97UyfBO4 +Ye+Fv/HygLhjSrd//F3WCssCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8B +Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFHzMup588/DN +SB+VFmgLFFmu3zBtMB8GA1UdIwQYMBaAFIwb/SUp6CQ/drLu9TJOkr+CZ06xMA0G +CSqGSIb3DQEBCwUAA4IBAQAujf++SCVGpobUF8H5Wj+Od1Nd6M9BKBjjGiJ5k3CN +N2txnC1YaDjAFUXBlGTsaRUrBZko/L+0q/o0DffS9X7b6SvJb7TBa/PjQf5LjeP2 +Cs/TBuVnZgB20cNlZQz7xVYp5hKDumyy9wVGU07H0WfiqUrp8JTeTsiKse8tHYul +cExtsZasQ5OIr6FXwZdwtx1r9awISfAIfVV6vh/nRbDKyBpCOyZuNQ36eco0iWNK +nBvDfdO2vfRT0+qNYp1W2oCri+IallzT10+Gld5p4k6N2leUT24VA4MGGkZAOBH5 +ExUc9uYQytcG9hRwpvRgR4f7ExU7BBwV9YuskVKJxxZ1 +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client.crt b/unittest/fixtures/appletls/client.crt new file mode 100644 index 000000000..87df1f423 --- /dev/null +++ b/unittest/fixtures/appletls/client.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDTTCCAjWgAwIBAgIUa1xt7fbLCcces2WETU+Dj6XY6uMwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz +MDE5MjcwMVoYDzIxMjYwOTA2MTkyNzAxWjAlMSMwIQYDVQQDDBpsaWJodi1hcHBs +ZXRscy10ZXN0LWNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AKfycz1z9vLhyKSzZkq4mX0nV/Deiwmn7xZkQhfCpVRaRPtr5kie4hRnibVVZEVc +qlsdLBS2nUT8RdYI1NyPYdYwKkr4LjdEHIv+ih3cfKjVV7zKZRkObX55RqaRxNXB +AOXejXLCSxpeY+DEB/atPw8C1OjrNBj6Ew8B/ijLF5pG7tn386IcAqIaFpZqXv9k +6q5OtXCgruScm/iciAxLSH7qgzcQcBBzD+inGBwxVMvHJATNHoLsji32efY+Ixj6 +1hBm9q8iCALTSUr53p8jC6DFWZxe7Mqgi7TpBms2vbxgl+rx9HoI6xWC97UyfBO4 +Ye+Fv/HygLhjSrd//F3WCssCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8B +Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFHzMup588/DN +SB+VFmgLFFmu3zBtMB8GA1UdIwQYMBaAFIwb/SUp6CQ/drLu9TJOkr+CZ06xMA0G +CSqGSIb3DQEBCwUAA4IBAQAujf++SCVGpobUF8H5Wj+Od1Nd6M9BKBjjGiJ5k3CN +N2txnC1YaDjAFUXBlGTsaRUrBZko/L+0q/o0DffS9X7b6SvJb7TBa/PjQf5LjeP2 +Cs/TBuVnZgB20cNlZQz7xVYp5hKDumyy9wVGU07H0WfiqUrp8JTeTsiKse8tHYul +cExtsZasQ5OIr6FXwZdwtx1r9awISfAIfVV6vh/nRbDKyBpCOyZuNQ36eco0iWNK +nBvDfdO2vfRT0+qNYp1W2oCri+IallzT10+Gld5p4k6N2leUT24VA4MGGkZAOBH5 +ExUc9uYQytcG9hRwpvRgR4f7ExU7BBwV9YuskVKJxxZ1 +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client.key b/unittest/fixtures/appletls/client.key new file mode 100644 index 000000000..581ba790e --- /dev/null +++ b/unittest/fixtures/appletls/client.key @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEAp/JzPXP28uHIpLNmSriZfSdX8N6LCafvFmRCF8KlVFpE+2vm +SJ7iFGeJtVVkRVyqWx0sFLadRPxF1gjU3I9h1jAqSvguN0Qci/6KHdx8qNVXvMpl +GQ5tfnlGppHE1cEA5d6NcsJLGl5j4MQH9q0/DwLU6Os0GPoTDwH+KMsXmkbu2ffz +ohwCohoWlmpe/2Tqrk61cKCu5Jyb+JyIDEtIfuqDNxBwEHMP6KcYHDFUy8ckBM0e +guyOLfZ59j4jGPrWEGb2ryIIAtNJSvnenyMLoMVZnF7syqCLtOkGaza9vGCX6vH0 +egjrFYL3tTJ8E7hh74W/8fKAuGNKt3/8XdYKywIDAQABAoIBAAvDoUGOEfT0I93a +7dtmEDpYEIJAKcpvXQFbMdYAPccphj4mUhHcL0dGnrrOVHZssJzZRPEz1Chfk3S+ +rEpsML+UIszwPYHZijZe33CKtUtjm6sPHQMi+OssYOqMuMD7Aq5svHPBcF6p0KKP +Q2TgFdQIsBPwsHbfbYkA7BC8ySvL7HnNJffMLIJtb/90HF8YP6I6Lmm5hd8Vyrri +IBhIJjiR8QbpQBwrZRSmEJoJg/wPVMjWZl07yFasU+5/311vyaHxMVn2KJp7jt9O +wiFQo3tJoiDLG+Q5tz5I5XDroaIFis/E3jyDxHzeuSERwJcekVkEtU7pHjZmgiru +cp0sZEECgYEA0ows+jM46hBtS566X8eYeApG8BHYl8haPQKFhgTYEkWKPtWEjD7f +iEqW8avOI2KsYpuN2+CWKjGMlzhlzBh164LU13Tjy9xgoE0gL+LbvyFKF7N3cwQV +bZVcb88aNpTnUEmnUMbMVIp60t8LF4n+W3cGxfENK3UjwyleR9D68HMCgYEAzDP5 +1IA9pEiNDqd0JuSP65/9B0C/CqjOgDvvSSAyPFr5keJsWBplb2AsjtN1Eul6Lbwy +cQ0jcebjYhnB2vs2hmBa15j/Q1OlXkFFyX+srEUNNZSXp+l5c3s4NktzwFB9GYgt +h5d3H3eYWmIAVrvjVwTV6kMCfc/1qh+umAT+HkkCgYBaUGa6rF4tiP5ZAa1QiH2O +gFoNgJo4AWkz4nEEG+/TZqD2cwB4aD/aZqR45gl2hE0Nv0wKlTvUvYxhEYAZHCT4 +8RX7ldhhChcoq+yync1FHzJ5GDKU05uddgRAscW8xAK1HeL3c08StJQbADHx1u+U +rGnrXosXqRe+D3CxvaLmoQKBgFviE0sz/QicAKSUYqZReBTs41zNHGk+ddSro0sD +KrePs/aZrGikT/oii0olCevdlLVZllTaNZW975inwFu5Z9plJtsWI932mFVmB3HY +eij11TDD0M2kN5rn2e5MWyQw02mWpe36EIbfOHWK3V4pouz35w1G46sa1Q6cvOH4 +dSPJAoGBAMhGs9k7+yDq3kGHbraIIq3LVvwk9wF34CInIRf5EpnjbpWkqwSI4Amf +2PvXVhAw+oqHNalFbPK0usM4VdWIRjw4s5aGnrYep9QiGRdiLq/Hobcf3u5kDgNf +9/8OKmEKFFisfrbM4EOSVqNMxH2OicWNSvBW0Q2QuBs/mLLnU2FH +-----END RSA PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/ec-pkcs8.key b/unittest/fixtures/appletls/ec-pkcs8.key new file mode 100644 index 000000000..e3edacde3 --- /dev/null +++ b/unittest/fixtures/appletls/ec-pkcs8.key @@ -0,0 +1,5 @@ +-----BEGIN PRIVATE KEY----- +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg7PiKZ5Zhg+sGzzH1 +U2FvX+7gimH6hMsvSkv2hnHimsGhRANCAARlxNONLD8pbXyFy/AAtgOo2QGxlpQY +3pYQY4NCIXpaN/QAPf5PDJqBIWdtNsrG5w1GDm3XkoXMT6AHOnpulVv8 +-----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/ec-sec1.key b/unittest/fixtures/appletls/ec-sec1.key new file mode 100644 index 000000000..c66c81c2f --- /dev/null +++ b/unittest/fixtures/appletls/ec-sec1.key @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIOz4imeWYYPrBs8x9VNhb1/u4Iph+oTLL0pL9oZx4prBoAoGCCqGSM49 +AwEHoUQDQgAEZcTTjSw/KW18hcvwALYDqNkBsZaUGN6WEGODQiF6Wjf0AD3+Twya +gSFnbTbKxucNRg5t15KFzE+gBzp6bpVb/A== +-----END EC PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/encrypted-key.pem b/unittest/fixtures/appletls/encrypted-key.pem new file mode 100644 index 000000000..707297e2d --- /dev/null +++ b/unittest/fixtures/appletls/encrypted-key.pem @@ -0,0 +1,30 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQ3Vziw7buZE36o2dd +aoZxOQICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEPBOjTWPWiXRAO/u +npu1uRAEggTQ3RW4DR+2eq7srsj3VOMl4q1EvwVyuPa8At2uSoI2KUgsxZ0/Njje +SnHpG+WomXefG1ABwAqdyTwpSUiYVf0u5zPhAjYzRzPDFOOMSxNAGZ9N4dPXOyTq +bSghOgnuAvjuZOP5kJ2SIpgDNWZe6K5ehy4OBgNOnLXqGhzqdf3cWh8gyzjuddge +1YWkITvxT3kRxMooIeCvt2CzgfRWTG1Al0bafOrtWDHOrAEh/1Yjvab8I8eYbkCY +k/L+bpLWJE8zRgyLCCQZSHdaisBZPLn7MkfbuPfCJxmXVQwYEKvLj2GW95OpufVX +qn6qX6JJFO9wKOG0xK/IXO0VDqP4EsnqmLmYByKJf18kq/fjC8OoK4hY4oQbkmVE +qvf9145EqYQYIWcLyYwULu2M1sCPtjCs5D8k7k8ZeuSrqaDEn+mAuC14To22IxEN +K3U8Mr3K3Sd+21D3YnC1/aRaZZPO77V0LbRFbB3uazNlCBWuenCB3ranmbcGcku9 +uklZR6PafA8/clu68+Y/4xYTPA01xUCA6O7BH/gXKLoAS+O/HBcIkMaUjnhhVBIp +IGORKfrH0KgEy1H/o/VQn7H6ddGAXdsL4Ogt+yWertx5+5yImVe+txPfANOpcdpE +Q+n9cWwfN8Eak5hW9/i+09JvkKbb083XTxFvwzulgrZXsp0gGzDO990SscnIfsHv +tEG4QYI3x9Wzsd1PeN3epChRClUTUBuGTm9eh3ZkcFsbI2xAv4y70cSBarTte/ou +Fqbd9yxtPfwAJc1RFWgkzrhrLgvqfukE2Ok5V/1/p1WqCrQvBs5rFEA5rfcZDGrz +A6CHTtmqu0HNTcLJf75U/gsGnRmP2x8RMW8GNnMW4/wTLIeZFfH60M6UblY2xMVv +WXYwc+CrduTcW6VvLKD6ecIgbvjLmZmaOW3k5P7obYJRLPmt/0+Acbl28L5UcR1M +7yP0M0tXllUR5O2R+Mt5JXND776gZr4R37yCkI0I6VpjVups+5OBJyg/hkF1GSOn +WjnOxdyb7U5F8zkYT2rqWCjvpwUAzdE3CACzcCEvCTGLHpfUyV0Ja7E9FGHWRVRr +yo58f6BXNhM9pIGipAyI0OS7FU6c05IhsY2ylkepvLb9m8qp1bDqRRIg6Js/33Ws +XpSmXbCKuJrSA7d3nw2sojF9iV8jy4Qg01o0xfuXL30+rZbnZqeo5GBbc8Ov67WA +RW46jnEc/vvVclSTTnvobcf6k3MhrQkte6dResdxPNqsc8avbe42XNaVxETSo0vH +mQxRywcLITclB72qmxDsYQMwYQaLz108al9fs3yoQnxsYbZQqq9NvuYK9iZu+Uez +RPLEsQN70JObdkpEIkzIa7jXmTFXX/4NdurQQWbyhJG+N94FZk9zYBhl6MESRvBf +Xxd6tjcFk1djRMDJqIX0VB17bKA7RjOKj35FdnxRgF+YY70kpvnIAAoiNYIW32t+ +JgnBaKPt9YyDkC95BZFBNuzZzoEsbJzd7Ep/68J75Qh8PPZLiokaU/F2jSHJ4lQf +1fOm2oadN7TnhW1Nv8/id9Qz0i1bpLzTto98OsKx1bwkada3flhQwwJ5Wrmx/0k9 +r8Xc4Ef5wM6CsGqdfR8LAy9V8RAVq7OwuoCsW8KzRsL1beryC71PCNQ= +-----END ENCRYPTED PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/generate.sh b/unittest/fixtures/appletls/generate.sh new file mode 100755 index 000000000..48469ebd5 --- /dev/null +++ b/unittest/fixtures/appletls/generate.sh @@ -0,0 +1,93 @@ +#!/bin/sh +set -eu + +fixture_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) +tmp_dir=$(mktemp -d) +trap 'rm -rf "$tmp_dir"' EXIT INT TERM + +make_key() { + openssl genrsa -traditional -out "$1" 2048 +} + +make_key "$tmp_dir/root.key" +openssl req -new -x509 -sha256 -days 36500 \ + -key "$tmp_dir/root.key" -out "$fixture_dir/root.crt" \ + -subj /CN=libhv-appletls-test-root \ + -addext basicConstraints=critical,CA:true \ + -addext keyUsage=critical,keyCertSign,cRLSign + +make_key "$tmp_dir/intermediate.key" +openssl req -new -sha256 -key "$tmp_dir/intermediate.key" \ + -out "$tmp_dir/intermediate.csr" -subj /CN=libhv-appletls-test-intermediate +printf '%s\n' \ + 'basicConstraints=critical,CA:true,pathlen:0' \ + 'keyUsage=critical,keyCertSign,cRLSign' \ + 'subjectKeyIdentifier=hash' \ + 'authorityKeyIdentifier=keyid,issuer' > "$tmp_dir/intermediate.ext" +openssl x509 -req -sha256 -days 36500 \ + -in "$tmp_dir/intermediate.csr" -CA "$fixture_dir/root.crt" \ + -CAkey "$tmp_dir/root.key" -CAserial "$tmp_dir/root.srl" -CAcreateserial \ + -out "$fixture_dir/intermediate.crt" -extfile "$tmp_dir/intermediate.ext" + +make_key "$fixture_dir/server-pkcs1.key" +openssl pkcs8 -topk8 -nocrypt -in "$fixture_dir/server-pkcs1.key" \ + -out "$fixture_dir/server-pkcs8.key" +openssl req -new -sha256 -key "$fixture_dir/server-pkcs1.key" \ + -out "$tmp_dir/server.csr" -subj /CN=localhost +printf '%s\n' \ + 'basicConstraints=critical,CA:false' \ + 'keyUsage=critical,digitalSignature,keyEncipherment' \ + 'extendedKeyUsage=serverAuth' \ + 'subjectAltName=DNS:localhost' > "$tmp_dir/server.ext" +openssl x509 -req -sha256 -days 36500 \ + -in "$tmp_dir/server.csr" -CA "$fixture_dir/intermediate.crt" \ + -CAkey "$tmp_dir/intermediate.key" -CAserial "$tmp_dir/intermediate.srl" -CAcreateserial \ + -out "$fixture_dir/server.crt" -extfile "$tmp_dir/server.ext" + +make_key "$fixture_dir/client.key" +openssl req -new -sha256 -key "$fixture_dir/client.key" \ + -out "$tmp_dir/client.csr" -subj /CN=libhv-appletls-test-client +printf '%s\n' \ + 'basicConstraints=critical,CA:false' \ + 'keyUsage=critical,digitalSignature,keyEncipherment' \ + 'extendedKeyUsage=clientAuth' > "$tmp_dir/client.ext" +openssl x509 -req -sha256 -days 36500 \ + -in "$tmp_dir/client.csr" -CA "$fixture_dir/root.crt" \ + -CAkey "$tmp_dir/root.key" -CAserial "$tmp_dir/root.srl" \ + -out "$fixture_dir/client.crt" -extfile "$tmp_dir/client.ext" + +make_key "$tmp_dir/wrong-root.key" +openssl req -new -x509 -sha256 -days 36500 \ + -key "$tmp_dir/wrong-root.key" -out "$fixture_dir/wrong-root.crt" \ + -subj /CN=libhv-appletls-wrong-root \ + -addext basicConstraints=critical,CA:true \ + -addext keyUsage=critical,keyCertSign,cRLSign +make_key "$fixture_dir/wrong-server.key" + +openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \ + -out "$fixture_dir/ec-pkcs8.key" +openssl pkey -in "$fixture_dir/ec-pkcs8.key" -traditional \ + -out "$fixture_dir/ec-sec1.key" +openssl pkcs8 -topk8 -v2 aes-256-cbc -passout pass:test-only \ + -in "$fixture_dir/server-pkcs1.key" -out "$fixture_dir/encrypted-key.pem" + +cat "$fixture_dir/server.crt" "$fixture_dir/intermediate.crt" \ + > "$fixture_dir/server-chain.pem" +cat "$fixture_dir/client.crt" > "$fixture_dir/client-chain.pem" +cat "$fixture_dir/root.crt" "$fixture_dir/wrong-root.crt" \ + > "$fixture_dir/multi-ca.pem" + +mkdir -p "$fixture_dir/ca-dir" +cp "$fixture_dir/root.crt" "$fixture_dir/ca-dir/root.crt" +printf '%s\n' 'not a certificate' > "$fixture_dir/ca-dir/README.txt" + +printf '%s\n' \ + '-----BEGIN CERTIFICATE-----' \ + 'not-base64!' \ + '-----END CERTIFICATE-----' > "$fixture_dir/malformed-base64.pem" +printf '%s\n' \ + '-----BEGIN PRIVATE KEY-----' \ + 'MAMCAQE=' \ + '-----END PRIVATE KEY-----' > "$fixture_dir/malformed-pkcs8.pem" + +echo "Apple TLS fixtures regenerated in $fixture_dir" diff --git a/unittest/fixtures/appletls/intermediate.crt b/unittest/fixtures/appletls/intermediate.crt new file mode 100644 index 000000000..4d2b2dd18 --- /dev/null +++ b/unittest/fixtures/appletls/intermediate.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDRDCCAiygAwIBAgIUa1xt7fbLCcces2WETU+Dj6XY6uIwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz +MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjArMSkwJwYDVQQDDCBsaWJodi1hcHBs +ZXRscy10ZXN0LWludGVybWVkaWF0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC +AQoCggEBALqhdB4aYuvfa/oKpswqsJ1Qfw1Kcl02ek21AzW9oCt2P4W+aQQXP5wK +GagRqrVQpb0WW7yF2PGU9asr3RpqhNWZidRARMuT/d87TPkd526pQbHC6TtnHF15 +HNvyZsm/mJ32szSKndDEc4JMc+X/VL3Pg6s60UHDCOqAz9sOUNF25cwAd/cpj+oT +7Hqucg9qvqITLd6VykKk8kJ36jyvE/ltuGToJ/ieA3KSqMW0Dpv9sqwGyUM792WC +8gpgeeC3Uj92nPCxqKDKkLatgoz7IK+xB7FtUZCPxtmhRhRHFLxW+FwgAN7HcY/c +PacBQIg5uMzrgJsyHFoxlGIQr1zLA4cCAwEAAaNmMGQwEgYDVR0TAQH/BAgwBgEB +/wIBADAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFH22Q3yuCTWaUPJB7lBIqGn1 +SBcCMB8GA1UdIwQYMBaAFIwb/SUp6CQ/drLu9TJOkr+CZ06xMA0GCSqGSIb3DQEB +CwUAA4IBAQCD1uOpUFCftbc0cb+cSgRbSIWj8zCh+Cbf7VWggDSZr1opxzxBeZw0 +axtdT9TIWZl3LmpCQKkHTOlzDvjiokh9o52T5ztgZ+T4e9zjKs93Qm8sjMHXTVUs +tYR8d480gsw0JstvGxe3O2EMrDNteKb6yDBhNlho57dyMCmzsSqvceA9OiTYRhdG +BiDxJVSlhBR0YWiwq0NdD2KR7zVpaSOHimVwpq9ilHxGXv0bri6BYkI3pNnhn8Kz +WDIqyfZwdfPgO6rRt5q9TccRtVoBOecWsHNunNoYhdNW4i5cxNXWN0v5HAKBfDkL +LitHx/SgxkG+bU5Q9sgBHhXwP/l+LI7t +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/malformed-base64.pem b/unittest/fixtures/appletls/malformed-base64.pem new file mode 100644 index 000000000..3a7cb2100 --- /dev/null +++ b/unittest/fixtures/appletls/malformed-base64.pem @@ -0,0 +1,3 @@ +-----BEGIN CERTIFICATE----- +not-base64! +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/malformed-pkcs8.pem b/unittest/fixtures/appletls/malformed-pkcs8.pem new file mode 100644 index 000000000..bb29ed3cb --- /dev/null +++ b/unittest/fixtures/appletls/malformed-pkcs8.pem @@ -0,0 +1,3 @@ +-----BEGIN PRIVATE KEY----- +MAMCAQE= +-----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/multi-ca.pem b/unittest/fixtures/appletls/multi-ca.pem new file mode 100644 index 000000000..5428834e8 --- /dev/null +++ b/unittest/fixtures/appletls/multi-ca.pem @@ -0,0 +1,40 @@ +-----BEGIN CERTIFICATE----- +MIIDOTCCAiGgAwIBAgIUdsy7efSOuc3Tckn3MvtOPCjyz8wwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz +MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs +ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2 +AsbGXP0ZwKn6k/pZbBI9AbzG8UTj9M/lV6lugynolHAXweKFTPMkeF85ZbFKArPV +4CPCXRanlNH37gaeaT9imXcSyLdvTtpIwF/FpFtMbPKNeOLu7ci+SlB+20BWAUsq +flmogmmq5eGKaPA9eEQILDuPbjzAvowcz413JkKrUFle4KriRb1dN3eAKm7QnCMx +hDLjSCcxjj6S2lGLi1cuvs9FS73jyx9TaCMv095jhLeSoF8Jfz/67HxIW/DFVl9d +6KVpJdToHxZyqfaJ3iRQXsbMq0Wh8fJP9ac8LORFOD7/Seo5VekgTBZOhE5SwfPC +7lYG94SDeLXpVU6gntIVAgMBAAGjYzBhMB0GA1UdDgQWBBSMG/0lKegkP3ay7vUy +TpK/gmdOsTAfBgNVHSMEGDAWgBSMG/0lKegkP3ay7vUyTpK/gmdOsTAPBgNVHRMB +Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAmIPm +3TWnQ3sF+yYgsnQhWdBkC0bAVXsCtdpgwCXujIfjsklVa7i93iXC4ypH92C7+jzw +NWIYbbG2Kv2NYc5H7TYUMO57nURC7hPh4pRse0yW+EdfpHnb6tM65mWwoE8ECuBD +3TdHiD97NXlODQhdhnxGsg8qVJ8h7Tcll8BARzfumVxL+78iQiJOTR0haRdIip+1 ++++2AIv82MkMSh18JISg4ym8DQjMYnY0I/SasQCWkF/V2dsjzwjX5qRU4mBN71Ub +rgUI+8m0yDCYgf5fyKbkBkoVjvqorVed/SXhyMzGl4peFCC5u2ijTRwoFs3lPMCo +FTAq4PmJPf0CVhgrog== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDOzCCAiOgAwIBAgIUVAOKBiVPejb5caic5l+eJveEnAUwDQYJKoZIhvcNAQEL +BQAwJDEiMCAGA1UEAwwZbGliaHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAgFw0yNjA5 +MzAxOTI3MDFaGA8yMTI2MDkwNjE5MjcwMVowJDEiMCAGA1UEAwwZbGliaHYtYXBw +bGV0bHMtd3Jvbmctcm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AN9WxNrZ0pUrLVu2WriBgLDbVQLfIUlYHlQ6o1PVt6bbPoQoeVNfXCX1dV0DeJ3p +wDgnbDGRvpZmyl3vDGHsvnO7ICgAWz2W9YiM9WXOdb+a6FJ19hRlfrVY69MwP6qF +xNOcpxxHOL++N+YRwRgRArIx7/I4yWEWF5Qgf92HxxO4VOFdvSvgFXRHizDIImTH +EMNtUqW1Gl6a7ktDaPpiaX9fe/If0rlpO071A3FOhtuc3iJfF9nGu2bwdHreST9H +WSus8ObaPI3to+DnpGcU8kZKiq3pZHy/NWQPT1iKyj9IvE+VfaTuym4TgVBiY/ev +5u3Ij7joMAHm/tvhBgDWCqkCAwEAAaNjMGEwHQYDVR0OBBYEFC+6qgDhXcZ2pM9X +tPuj+F24AfvcMB8GA1UdIwQYMBaAFC+6qgDhXcZ2pM9XtPuj+F24AfvcMA8GA1Ud +EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQA5 +3k2v79uWtYcLq1jvrPz2Uf6tsJdAkFngyqEW1wVg/ONAwMszrUI+K6AC3AazJO0B +D0nM5ocDK3rkXeJzkZYhdQa1H67f+1+714iyov2tK4cJaKVsBr3kz5eQhwexkuJr +15rkb/EM+z49PEl2uVsji4ivWhEmgD8Yu1G7mjZMCGPxz+4MBXSKw7xLjbloYAq7 +HjNsTK+C1no6EmU0mXwiqBhASFAD5OqCLzTzDPEvtYuRoG7GSb27IyG+gtOokhSn +uxuNjRbS1iE1QeNDsXryG0tuWqvHR+CQB7bTsedsqiRXRpEPbs/lfnKci20sI8iC +8aFaMoGLa/bzDHlj/ShT +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/root.crt b/unittest/fixtures/appletls/root.crt new file mode 100644 index 000000000..34c0fc273 --- /dev/null +++ b/unittest/fixtures/appletls/root.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDOTCCAiGgAwIBAgIUdsy7efSOuc3Tckn3MvtOPCjyz8wwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz +MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs +ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2 +AsbGXP0ZwKn6k/pZbBI9AbzG8UTj9M/lV6lugynolHAXweKFTPMkeF85ZbFKArPV +4CPCXRanlNH37gaeaT9imXcSyLdvTtpIwF/FpFtMbPKNeOLu7ci+SlB+20BWAUsq +flmogmmq5eGKaPA9eEQILDuPbjzAvowcz413JkKrUFle4KriRb1dN3eAKm7QnCMx +hDLjSCcxjj6S2lGLi1cuvs9FS73jyx9TaCMv095jhLeSoF8Jfz/67HxIW/DFVl9d +6KVpJdToHxZyqfaJ3iRQXsbMq0Wh8fJP9ac8LORFOD7/Seo5VekgTBZOhE5SwfPC +7lYG94SDeLXpVU6gntIVAgMBAAGjYzBhMB0GA1UdDgQWBBSMG/0lKegkP3ay7vUy +TpK/gmdOsTAfBgNVHSMEGDAWgBSMG/0lKegkP3ay7vUyTpK/gmdOsTAPBgNVHRMB +Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAmIPm +3TWnQ3sF+yYgsnQhWdBkC0bAVXsCtdpgwCXujIfjsklVa7i93iXC4ypH92C7+jzw +NWIYbbG2Kv2NYc5H7TYUMO57nURC7hPh4pRse0yW+EdfpHnb6tM65mWwoE8ECuBD +3TdHiD97NXlODQhdhnxGsg8qVJ8h7Tcll8BARzfumVxL+78iQiJOTR0haRdIip+1 ++++2AIv82MkMSh18JISg4ym8DQjMYnY0I/SasQCWkF/V2dsjzwjX5qRU4mBN71Ub +rgUI+8m0yDCYgf5fyKbkBkoVjvqorVed/SXhyMzGl4peFCC5u2ijTRwoFs3lPMCo +FTAq4PmJPf0CVhgrog== +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/server-chain.pem b/unittest/fixtures/appletls/server-chain.pem new file mode 100644 index 000000000..dfb5fd72b --- /dev/null +++ b/unittest/fixtures/appletls/server-chain.pem @@ -0,0 +1,40 @@ +-----BEGIN CERTIFICATE----- +MIIDXDCCAkSgAwIBAgIUesmG0zycKPRO5//Ww3V2wBsRbrIwDQYJKoZIhvcNAQEL +BQAwKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUw +IBcNMjYwOTMwMTkyNzAwWhgPMjEyNjA5MDYxOTI3MDBaMBQxEjAQBgNVBAMMCWxv +Y2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJuAfYq+tA/ +IjaWxGh2n45kxdriLcQGcuwCtq705+vZS1axBDg65F/pRHZ/r24qyd8YCrMUW5jk +AXBlg0ZwONy0HUnAknTIwoDyM78VWnQ6HAl2LIFQzX5s3BJ9j+na3vpjb4uW2LCd ++3JPDKYQ4dSlqNge+9nQAMmuE5OYrc4+TvEMwlyBPGgqQpbOa2r+GbP9s5Re88BO +UeaABymfwjTpyBSWAgjXXIT/emQKe/nFbYqPOsbVzKsQk3XhuLDdZ6j5i23HKtNj +vMAngYCwf+6VJK1/sCceO3EN9BFZcMc1AWNuU3INFNUMxOjD4p+oYygBz/f0qOgZ +1G8P0b+A7/8CAwEAAaOBjDCBiTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF +oDATBgNVHSUEDDAKBggrBgEFBQcDATAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYD +VR0OBBYEFL7nojwnBsrbpNrsV5D8puq+E0+sMB8GA1UdIwQYMBaAFH22Q3yuCTWa +UPJB7lBIqGn1SBcCMA0GCSqGSIb3DQEBCwUAA4IBAQBS0HokPSmrhhNU9OpF9N4n +suxW7gT2Q9hSjG7Quct21NuiXLlPLkC4dqNyKwFfTZPm8fYacVzEb6k+3zcIlOQI +vf0U1+tRfNd6RdZkf6+2W5iWaTXQYieZ82TPvkv1TWhFeskXd93Fw9ir+3pCCF2M +c5GNfSZz3iNOOGFbPvvJfGHppqO5ggx6e3hOoArmLc/mvTNkptlIxpU/DseWgo14 +PdXgkuBjjhJexBapTDkk12jzwCNjFUvPdfy85mR7tH8hH98S9HChrZSXd3JT4p+F +g5hv5XzVWUBPyirrVb5wZMI10Z2OA1d80OSUBUUg4j40V4wg/ViTrU1weRjPufGC +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDRDCCAiygAwIBAgIUa1xt7fbLCcces2WETU+Dj6XY6uIwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz +MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjArMSkwJwYDVQQDDCBsaWJodi1hcHBs +ZXRscy10ZXN0LWludGVybWVkaWF0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC +AQoCggEBALqhdB4aYuvfa/oKpswqsJ1Qfw1Kcl02ek21AzW9oCt2P4W+aQQXP5wK +GagRqrVQpb0WW7yF2PGU9asr3RpqhNWZidRARMuT/d87TPkd526pQbHC6TtnHF15 +HNvyZsm/mJ32szSKndDEc4JMc+X/VL3Pg6s60UHDCOqAz9sOUNF25cwAd/cpj+oT +7Hqucg9qvqITLd6VykKk8kJ36jyvE/ltuGToJ/ieA3KSqMW0Dpv9sqwGyUM792WC +8gpgeeC3Uj92nPCxqKDKkLatgoz7IK+xB7FtUZCPxtmhRhRHFLxW+FwgAN7HcY/c +PacBQIg5uMzrgJsyHFoxlGIQr1zLA4cCAwEAAaNmMGQwEgYDVR0TAQH/BAgwBgEB +/wIBADAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFH22Q3yuCTWaUPJB7lBIqGn1 +SBcCMB8GA1UdIwQYMBaAFIwb/SUp6CQ/drLu9TJOkr+CZ06xMA0GCSqGSIb3DQEB +CwUAA4IBAQCD1uOpUFCftbc0cb+cSgRbSIWj8zCh+Cbf7VWggDSZr1opxzxBeZw0 +axtdT9TIWZl3LmpCQKkHTOlzDvjiokh9o52T5ztgZ+T4e9zjKs93Qm8sjMHXTVUs +tYR8d480gsw0JstvGxe3O2EMrDNteKb6yDBhNlho57dyMCmzsSqvceA9OiTYRhdG +BiDxJVSlhBR0YWiwq0NdD2KR7zVpaSOHimVwpq9ilHxGXv0bri6BYkI3pNnhn8Kz +WDIqyfZwdfPgO6rRt5q9TccRtVoBOecWsHNunNoYhdNW4i5cxNXWN0v5HAKBfDkL +LitHx/SgxkG+bU5Q9sgBHhXwP/l+LI7t +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/server-pkcs1.key b/unittest/fixtures/appletls/server-pkcs1.key new file mode 100644 index 000000000..34aa7f729 --- /dev/null +++ b/unittest/fixtures/appletls/server-pkcs1.key @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEAwm4B9ir60D8iNpbEaHafjmTF2uItxAZy7AK2rvTn69lLVrEE +ODrkX+lEdn+vbirJ3xgKsxRbmOQBcGWDRnA43LQdScCSdMjCgPIzvxVadDocCXYs +gVDNfmzcEn2P6dre+mNvi5bYsJ37ck8MphDh1KWo2B772dAAya4Tk5itzj5O8QzC +XIE8aCpCls5rav4Zs/2zlF7zwE5R5oAHKZ/CNOnIFJYCCNdchP96ZAp7+cVtio86 +xtXMqxCTdeG4sN1nqPmLbccq02O8wCeBgLB/7pUkrX+wJx47cQ30EVlwxzUBY25T +cg0U1QzE6MPin6hjKAHP9/So6BnUbw/Rv4Dv/wIDAQABAoIBAAaZFRf1fW1ztwWD +OEcTP3bllJFI+6SbU2sO7IQja3tldFkMyMfft8BJejlLO/jRGuinODW7iyA1HJdj +2oCZblSPCC9oiY/NAEy/62Ggp+Ep16m6iOgahd60cwNtn2SgONDmbvKdu9zCf7Xx +WMyJ5iABPymWY5WQqXYuohtwIvXMuD0OdOydcycgrrGj1iyG687yOMYlTW8IKtmH +W434H8M2HND34fb5z8gKub7R69BTbXklF9DGFLNIseq+7U7D3IISBvenLGMdQXv3 +G8arHmpC7Um6UjTvBU2TJpJGSkovIwkzBftKsNA0qDrphk0L3+uidXPjxGHwj60q +Er5RwwECgYEA/X2cDCS4+OQnGHYQCe9VnjOO/UzYfyEd+c8I3i/eJK3DOO37MHRQ +p06IIKIqSkV91VtrJO2GQ/VPdLjxJrdFhctowDIeh1J7FgQTGVJK4UWQSx3HPR2U +Amkj1a+x1C7ANYqnv+ACTBTUVHxWWLsNTMxKUivLqJULjhpebs1yUpcCgYEAxFq6 +JyFohUp6NOkzWhMDm/o2klLMB3YGsEyfF8lyrqPxJVt5VHli7+9FaxNpGYDMc76A +D6X8BrYN37kovJmwXmuMEfI0JRT6igwgaG/nzBWGvlIRUfjStqkDbPODLDITgTfZ +FobqFNlf/HHARtWfHrPYhG8DNutZmXhnumHiQtkCgYAxhU9t4+Kq5M9qbO4XMsVU +IZhmjZOhylNz0OlXlpxcKAICZiNzRNXYyXO4hFWkqsy5WKGm1iwrrIm4MMUTniwb +xjARk/j40LkxBNzCTpxIQ/G7avbYTqXyjp2siiVAYV21WAALcPSh7lPIqX2o2enw +PdyrDtk7dtqKCUa3eLVDwwKBgQCjWXsN/KwQX0JFbE/tOm5BP6pQlpLoDhdIaaXc +yxkeEoMV+gB49zcItnyAtLg1oEH2dF/jJMoC50epfEdYh18DXeM8NsuMoeRAHhCD +8bzbunjLMkj4cdESZo7T/817Yfl6AXUXWYu5ZpGE2TkFdMgYabPRkO0Srj5u/40D +sFTkGQKBgG0ErBfZ/fLlaFKuUg/15QmLtbthq4pBodYTlEwCls561x2c9lin/b4Q +DnCiXeh/kAefAKnFGvXNJUiAVgC0p25HfviYC+zQn3zhGdYX0oypWvfhzo/gBF5/ +Hejz474qi/GemqOzhnlpcsYfLhmYVYJvIiPxNUN+xt0ousHYc9iy +-----END RSA PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/server-pkcs8.key b/unittest/fixtures/appletls/server-pkcs8.key new file mode 100644 index 000000000..551759bcd --- /dev/null +++ b/unittest/fixtures/appletls/server-pkcs8.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDCbgH2KvrQPyI2 +lsRodp+OZMXa4i3EBnLsArau9Ofr2UtWsQQ4OuRf6UR2f69uKsnfGAqzFFuY5AFw +ZYNGcDjctB1JwJJ0yMKA8jO/FVp0OhwJdiyBUM1+bNwSfY/p2t76Y2+Lltiwnfty +TwymEOHUpajYHvvZ0ADJrhOTmK3OPk7xDMJcgTxoKkKWzmtq/hmz/bOUXvPATlHm +gAcpn8I06cgUlgII11yE/3pkCnv5xW2KjzrG1cyrEJN14biw3Weo+YttxyrTY7zA +J4GAsH/ulSStf7AnHjtxDfQRWXDHNQFjblNyDRTVDMTow+KfqGMoAc/39KjoGdRv +D9G/gO//AgMBAAECggEABpkVF/V9bXO3BYM4RxM/duWUkUj7pJtTaw7shCNre2V0 +WQzIx9+3wEl6OUs7+NEa6Kc4NbuLIDUcl2PagJluVI8IL2iJj80ATL/rYaCn4SnX +qbqI6BqF3rRzA22fZKA40OZu8p273MJ/tfFYzInmIAE/KZZjlZCpdi6iG3Ai9cy4 +PQ507J1zJyCusaPWLIbrzvI4xiVNbwgq2YdbjfgfwzYc0Pfh9vnPyAq5vtHr0FNt +eSUX0MYUs0ix6r7tTsPcghIG96csYx1Be/cbxqseakLtSbpSNO8FTZMmkkZKSi8j +CTMF+0qw0DSoOumGTQvf66J1c+PEYfCPrSoSvlHDAQKBgQD9fZwMJLj45CcYdhAJ +71WeM479TNh/IR35zwjeL94krcM47fswdFCnToggoipKRX3VW2sk7YZD9U90uPEm +t0WFy2jAMh6HUnsWBBMZUkrhRZBLHcc9HZQCaSPVr7HULsA1iqe/4AJMFNRUfFZY +uw1MzEpSK8uolQuOGl5uzXJSlwKBgQDEWronIWiFSno06TNaEwOb+jaSUswHdgaw +TJ8XyXKuo/ElW3lUeWLv70VrE2kZgMxzvoAPpfwGtg3fuSi8mbBea4wR8jQlFPqK +DCBob+fMFYa+UhFR+NK2qQNs84MsMhOBN9kWhuoU2V/8ccBG1Z8es9iEbwM261mZ +eGe6YeJC2QKBgDGFT23j4qrkz2ps7hcyxVQhmGaNk6HKU3PQ6VeWnFwoAgJmI3NE +1djJc7iEVaSqzLlYoabWLCusibgwxROeLBvGMBGT+PjQuTEE3MJOnEhD8btq9thO +pfKOnayKJUBhXbVYAAtw9KHuU8ipfajZ6fA93KsO2Tt22ooJRrd4tUPDAoGBAKNZ +ew38rBBfQkVsT+06bkE/qlCWkugOF0hppdzLGR4SgxX6AHj3Nwi2fIC0uDWgQfZ0 +X+MkygLnR6l8R1iHXwNd4zw2y4yh5EAeEIPxvNu6eMsySPhx0RJmjtP/zXth+XoB +dRdZi7lmkYTZOQV0yBhps9GQ7RKuPm7/jQOwVOQZAoGAbQSsF9n98uVoUq5SD/Xl +CYu1u2GrikGh1hOUTAKWznrXHZz2WKf9vhAOcKJd6H+QB58AqcUa9c0lSIBWALSn +bkd++JgL7NCffOEZ1hfSjKla9+HOj+AEXn8d6PPjviqL8Z6ao7OGeWlyxh8uGZhV +gm8iI/E1Q37G3Si6wdhz2LI= +-----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/server.crt b/unittest/fixtures/appletls/server.crt new file mode 100644 index 000000000..cb20449f2 --- /dev/null +++ b/unittest/fixtures/appletls/server.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDXDCCAkSgAwIBAgIUesmG0zycKPRO5//Ww3V2wBsRbrIwDQYJKoZIhvcNAQEL +BQAwKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUw +IBcNMjYwOTMwMTkyNzAwWhgPMjEyNjA5MDYxOTI3MDBaMBQxEjAQBgNVBAMMCWxv +Y2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJuAfYq+tA/ +IjaWxGh2n45kxdriLcQGcuwCtq705+vZS1axBDg65F/pRHZ/r24qyd8YCrMUW5jk +AXBlg0ZwONy0HUnAknTIwoDyM78VWnQ6HAl2LIFQzX5s3BJ9j+na3vpjb4uW2LCd ++3JPDKYQ4dSlqNge+9nQAMmuE5OYrc4+TvEMwlyBPGgqQpbOa2r+GbP9s5Re88BO +UeaABymfwjTpyBSWAgjXXIT/emQKe/nFbYqPOsbVzKsQk3XhuLDdZ6j5i23HKtNj +vMAngYCwf+6VJK1/sCceO3EN9BFZcMc1AWNuU3INFNUMxOjD4p+oYygBz/f0qOgZ +1G8P0b+A7/8CAwEAAaOBjDCBiTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF +oDATBgNVHSUEDDAKBggrBgEFBQcDATAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYD +VR0OBBYEFL7nojwnBsrbpNrsV5D8puq+E0+sMB8GA1UdIwQYMBaAFH22Q3yuCTWa +UPJB7lBIqGn1SBcCMA0GCSqGSIb3DQEBCwUAA4IBAQBS0HokPSmrhhNU9OpF9N4n +suxW7gT2Q9hSjG7Quct21NuiXLlPLkC4dqNyKwFfTZPm8fYacVzEb6k+3zcIlOQI +vf0U1+tRfNd6RdZkf6+2W5iWaTXQYieZ82TPvkv1TWhFeskXd93Fw9ir+3pCCF2M +c5GNfSZz3iNOOGFbPvvJfGHppqO5ggx6e3hOoArmLc/mvTNkptlIxpU/DseWgo14 +PdXgkuBjjhJexBapTDkk12jzwCNjFUvPdfy85mR7tH8hH98S9HChrZSXd3JT4p+F +g5hv5XzVWUBPyirrVb5wZMI10Z2OA1d80OSUBUUg4j40V4wg/ViTrU1weRjPufGC +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/wrong-root.crt b/unittest/fixtures/appletls/wrong-root.crt new file mode 100644 index 000000000..9fb837e59 --- /dev/null +++ b/unittest/fixtures/appletls/wrong-root.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDOzCCAiOgAwIBAgIUVAOKBiVPejb5caic5l+eJveEnAUwDQYJKoZIhvcNAQEL +BQAwJDEiMCAGA1UEAwwZbGliaHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAgFw0yNjA5 +MzAxOTI3MDFaGA8yMTI2MDkwNjE5MjcwMVowJDEiMCAGA1UEAwwZbGliaHYtYXBw +bGV0bHMtd3Jvbmctcm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AN9WxNrZ0pUrLVu2WriBgLDbVQLfIUlYHlQ6o1PVt6bbPoQoeVNfXCX1dV0DeJ3p +wDgnbDGRvpZmyl3vDGHsvnO7ICgAWz2W9YiM9WXOdb+a6FJ19hRlfrVY69MwP6qF +xNOcpxxHOL++N+YRwRgRArIx7/I4yWEWF5Qgf92HxxO4VOFdvSvgFXRHizDIImTH +EMNtUqW1Gl6a7ktDaPpiaX9fe/If0rlpO071A3FOhtuc3iJfF9nGu2bwdHreST9H +WSus8ObaPI3to+DnpGcU8kZKiq3pZHy/NWQPT1iKyj9IvE+VfaTuym4TgVBiY/ev +5u3Ij7joMAHm/tvhBgDWCqkCAwEAAaNjMGEwHQYDVR0OBBYEFC+6qgDhXcZ2pM9X +tPuj+F24AfvcMB8GA1UdIwQYMBaAFC+6qgDhXcZ2pM9XtPuj+F24AfvcMA8GA1Ud +EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQA5 +3k2v79uWtYcLq1jvrPz2Uf6tsJdAkFngyqEW1wVg/ONAwMszrUI+K6AC3AazJO0B +D0nM5ocDK3rkXeJzkZYhdQa1H67f+1+714iyov2tK4cJaKVsBr3kz5eQhwexkuJr +15rkb/EM+z49PEl2uVsji4ivWhEmgD8Yu1G7mjZMCGPxz+4MBXSKw7xLjbloYAq7 +HjNsTK+C1no6EmU0mXwiqBhASFAD5OqCLzTzDPEvtYuRoG7GSb27IyG+gtOokhSn +uxuNjRbS1iE1QeNDsXryG0tuWqvHR+CQB7bTsedsqiRXRpEPbs/lfnKci20sI8iC +8aFaMoGLa/bzDHlj/ShT +-----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/wrong-server.key b/unittest/fixtures/appletls/wrong-server.key new file mode 100644 index 000000000..b1e4b2fdf --- /dev/null +++ b/unittest/fixtures/appletls/wrong-server.key @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEA111jNkaM5Y5rKkKg30Xk2Qo4cd5i5xCp+feeVdHtIQU+LTNp +FsCH7QcoEAlHmcnIOiDtxqgY78JaSjOK3dmeJPReyyeGkM2HsXG5c9iCFugSOtaZ ++LP5Gqc1BNS2RWXOtbY3XO2kJhQzVkr00Wr0GPIoJPM5lwKqgNvBhSfO+KF2vzWN +BBL50tn0NG5ys4i1KV33bkL0wW8gUXWLEQsPZOEwsoycSoDcyyVYudppsngIESB1 +6mTJOSFhHJvyXQU7zXL/bfcnDMeYV8XF0P7z/dU9Ll0NjgtA0V2axxcU2vIAuzkO +boe5/xuwAYZyt5L66VP2KAUrRT4l4qDj4zPMlQIDAQABAoIBAAaGGm+GNxXsGMR0 +tL1Wt244sEmIwEu6FkAPd3EnlQyTRVUmscgB6IwuU5Eaytu2gFV8cl96b5jxtPz6 +7zm1siPx8B4s0hd4VmQyavj+pcAuYwD7x7nAL+tWBdXh4Kyc/yRDgw1SWI7bvUtf +pWdjm0XXLg6ifIvdxY72OThAorUm1rv1q3GPW4sDhRMeZO0jQ1fJg1MJ0oKgxwO8 +zh3RqhfkRgELnJyFIcXnQ/UXqj47VM5/OniHMP3kriG6TPyIODpu7eZ5Mrbeosm2 +oV+GOykFUJcm8fDtaCk3LRy7gcoyOJ4cOiJj3su88hq49RXzdS+Doq7hBcM1PPZm +IiHD44kCgYEA+CFZqhY8L09CMFfpDkZ0Ze13rqpgDbEH9wKyjQcyLQklHEk/TfIl +IEXFW4U/m+DdevYAZEoOtmTXY4uSDQn6qqohFx42j3LKegHD/B/KMtNMKALEsHiq +UPap5Cg+jFX+t+NCsXy5EAHO3O9mOrNnrRZiZE0RaCbu2w9J3jz8jtkCgYEA3jIA ++Or2mLDpN+6DhEXakv3DhH6/6xmmfXp/0+NBL0U3uZa1xLSG5a8eLXOU3HfP3hO9 +AaKzbnhjpgVL9KBq5Fsq69aGkn/Me9AJlAdU9/AXdmdTv+ieua3ZGWBizFJFawmQ +ZU+u2oaJjGqLyedoT/zPsdVQ+btOuOZZDI+tzh0CgYEAj+roEtsqtVYHUfrrVjhP +Mv91N33ikI5pzD9oSJwv4ic3uxxQ92jHV9ygB+FVb5gRXkxpFcJOnkQHGdnOMHnl +Ri+/WaVQiAtQnUuA3S+jG6+qsFpKswCJ6MPo7kjZXpRSVV4fRMrOnBYwYb0JUmrU +a3RcRUjeG8bZK33GnnxJEKECgYB7UlmDzjUrrhTi/Dh2c6bKqpmXshmmzMfBIPpN +ifYl3E7/bIxaLrAoTrd7Folqi/0NDvt6KulXyO3VuV7c2SQ6tfbuilSKfu/pUB/g +zujz64e6KcMr4lomSD0UfpCXQppQvDAuarlrg/xXuNL5LryQmIpV80VMNg+NRBvs +gto+aQKBgQDhMLdz+UvhV1Z+MPI9XKQtyXaa4UQ+p9tWnzYUxuvODiTcWshNeP+9 +OQQi0qaV+7xAiIcvVpg1wiELk70q7YqjPwsy5VfMeKEuZ5K28sbZjXq4O7pJ4vNF +TZ+F4Ak7h1EAtFT7A0WIT3pCz2mblp9UXKSO0Ih9L4PbYPPX/km1Qg== +-----END RSA PRIVATE KEY----- From e519ed5f39f0052468e81b942b344dc9ee65cb4c Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 07:27:45 +0800 Subject: [PATCH 02/12] feat(ssl): load RSA identities in Apple TLS Co-authored-by: TRAE CLI --- Makefile | 5 + scripts/unittest.sh | 3 + ssl/appletls.c | 234 ++++++++++++++++-- unittest/appletls_test.c | 97 ++++++++ .../fixtures/appletls/empty-ca-dir/README.txt | 1 + unittest/fixtures/appletls/generate.sh | 2 + 6 files changed, 324 insertions(+), 18 deletions(-) create mode 100644 unittest/appletls_test.c create mode 100644 unittest/fixtures/appletls/empty-ca-dir/README.txt diff --git a/Makefile b/Makefile index fdac758c8..46af3ea9e 100644 --- a/Makefile +++ b/Makefile @@ -427,6 +427,11 @@ endif appletls_pem_test: prepare $(CC) -g -Wall -Wextra -O0 -std=c99 -I. -Ibase -Issl \ -o bin/appletls_pem_test unittest/appletls_pem_test.c ssl/appletls_pem.c + +appletls_test: prepare libhv + $(CC) -g -Wall -Wextra -O0 -std=c99 -I. -Ibase -Issl -Ievent \ + -o bin/appletls_test unittest/appletls_test.c \ + -Llib -lhv -framework CoreFoundation -framework Security ifeq ($(WITH_LUA), yes) $(CXX) -g -Wall -O0 -std=c++11 -DWITH_LUA $(LUA_CFLAGS) -I. -Ibase -Issl -Ievent -Icpputil -Ievpp -Ilua -o bin/lua_binding_test unittest/lua_binding_test.cpp -Llib -lhv -pthread $(LUA_LIBS) $(CXX) -g -Wall -O0 -std=c++11 -DWITH_LUA $(LUA_CFLAGS) -I. -Ibase -Issl -Ievent -Icpputil -Ievpp -Ilua -o bin/lua_io_test unittest/lua_io_test.cpp -Llib -lhv -pthread $(LUA_LIBS) diff --git a/scripts/unittest.sh b/scripts/unittest.sh index e14d751d5..03fec5957 100755 --- a/scripts/unittest.sh +++ b/scripts/unittest.sh @@ -31,6 +31,9 @@ bin/socketpair_test if [ -x bin/appletls_pem_test ]; then bin/appletls_pem_test || exit $? fi +if [ -x bin/appletls_test ]; then + bin/appletls_test || exit $? +fi # bin/threadpool_test # bin/objectpool_test bin/sizeof_test diff --git a/ssl/appletls.c b/ssl/appletls.c index a74fee1df..bb92828fe 100644 --- a/ssl/appletls.c +++ b/ssl/appletls.c @@ -11,6 +11,7 @@ #include #include +#include "appletls_pem.h" #include "hsocket.h" /* The Security framework has changed greatly between iOS and different macOS @@ -762,25 +763,228 @@ const char* hssl_backend() { } typedef struct appletls_ctx { - SecIdentityRef cert; - hssl_ctx_opt_t* param; + SecIdentityRef identity; + CFArrayRef certificate_chain; + CFArrayRef trust_anchors; + short verify_peer; + short configured_endpoint; } appletls_ctx_t; +static CFDataRef appletls_cfdata(const appletls_der_t* der) { + return CFDataCreate(NULL, der->data, (CFIndex)der->len); +} + +static int appletls_create_identity(appletls_ctx_t* ctx, const char* cert_file, const char* key_file) { + appletls_der_list_t certificates = {0}; + appletls_der_t key_data = {0}; + CFMutableArrayRef chain = NULL; + SecCertificateRef leaf = NULL; + SecKeyRef private_key = NULL; + SecIdentityRef identity = NULL; + CFDataRef data = NULL; + CFDictionaryRef attributes = NULL; + CFErrorRef error = NULL; + int ret = APPLETLS_PEM_ERROR_FORMAT; + size_t i; + + ret = appletls_pem_load_certificates(cert_file, 0, 64, &certificates); + if (ret != APPLETLS_PEM_OK) { + fprintf(stderr, "Apple TLS certificate file failed: %s\n", appletls_pem_error_string(ret)); + goto cleanup; + } + ret = appletls_pem_load_rsa_private_key(key_file, &key_data); + if (ret != APPLETLS_PEM_OK) { + fprintf(stderr, "Apple TLS RSA private key failed: %s\n", appletls_pem_error_string(ret)); + goto cleanup; + } + +#if defined(__has_builtin) +#if __has_builtin(__builtin_available) + if (!__builtin_available(macOS 10.12, iOS 11.2, *)) { + fprintf(stderr, "Apple TLS local identities require macOS 10.12 or iOS 11.2\n"); + ret = APPLETLS_PEM_ERROR_UNSUPPORTED; + goto cleanup; + } +#endif +#endif + + data = appletls_cfdata(&certificates.items[0]); + if (data == NULL) goto cleanup; + leaf = SecCertificateCreateWithData(NULL, data); + CFRelease(data); + data = NULL; + if (leaf == NULL) { + fprintf(stderr, "Apple TLS leaf certificate is invalid\n"); + goto cleanup; + } + + data = appletls_cfdata(&key_data); + if (data == NULL) goto cleanup; + { + const void* keys[] = {kSecAttrKeyType, kSecAttrKeyClass}; + const void* values[] = {kSecAttrKeyTypeRSA, kSecAttrKeyClassPrivate}; + attributes = CFDictionaryCreate(NULL, keys, values, 2, + &kCFTypeDictionaryKeyCallBacks, + &kCFTypeDictionaryValueCallBacks); + } + if (attributes == NULL) goto cleanup; + private_key = SecKeyCreateWithData(data, attributes, &error); + CFRelease(data); + data = NULL; + if (private_key == NULL) { + fprintf(stderr, "Apple TLS could not create the RSA private key\n"); + goto cleanup; + } + identity = SecIdentityCreate(NULL, leaf, private_key); + if (identity == NULL) { + fprintf(stderr, "Apple TLS certificate and private key do not match\n"); + goto cleanup; + } + + chain = CFArrayCreateMutable(NULL, (CFIndex)certificates.count, &kCFTypeArrayCallBacks); + if (chain == NULL) goto cleanup; + CFArrayAppendValue(chain, identity); + for (i = 1; i < certificates.count; ++i) { + SecCertificateRef certificate; + data = appletls_cfdata(&certificates.items[i]); + if (data == NULL) goto cleanup; + certificate = SecCertificateCreateWithData(NULL, data); + CFRelease(data); + data = NULL; + if (certificate == NULL) { + fprintf(stderr, "Apple TLS certificate chain contains an invalid certificate\n"); + goto cleanup; + } + CFArrayAppendValue(chain, certificate); + CFRelease(certificate); + } + + ctx->identity = identity; + ctx->certificate_chain = chain; + identity = NULL; + chain = NULL; + ret = APPLETLS_PEM_OK; + +cleanup: + if (error) CFRelease(error); + if (attributes) CFRelease(attributes); + if (data) CFRelease(data); + if (identity) CFRelease(identity); + if (private_key) CFRelease(private_key); + if (leaf) CFRelease(leaf); + if (chain) CFRelease(chain); + appletls_der_free(&key_data); + appletls_der_list_free(&certificates); + return ret == APPLETLS_PEM_OK ? HSSL_OK : HSSL_ERROR; +} + +static int appletls_append_anchor_file(CFMutableArrayRef anchors, const char* path, + size_t* anchor_count, int strict) { + appletls_der_list_t certificates = {0}; + int ret; + size_t i; + + if (*anchor_count >= APPLETLS_PEM_MAX_CERTIFICATES) return HSSL_ERROR; + ret = appletls_pem_load_certificates(path, 1, + APPLETLS_PEM_MAX_CERTIFICATES - *anchor_count, &certificates); + if (ret != APPLETLS_PEM_OK) { + if (strict) { + fprintf(stderr, "Apple TLS CA file failed: %s\n", appletls_pem_error_string(ret)); + } + return strict ? HSSL_ERROR : HSSL_OK; + } + for (i = 0; i < certificates.count; ++i) { + CFDataRef data = appletls_cfdata(&certificates.items[i]); + SecCertificateRef certificate = data ? SecCertificateCreateWithData(NULL, data) : NULL; + if (data) CFRelease(data); + if (certificate == NULL) { + if (strict) fprintf(stderr, "Apple TLS CA file contains an invalid certificate\n"); + appletls_der_list_free(&certificates); + return strict ? HSSL_ERROR : HSSL_OK; + } + CFArrayAppendValue(anchors, certificate); + CFRelease(certificate); + ++*anchor_count; + } + appletls_der_list_free(&certificates); + return HSSL_OK; +} + +static int appletls_load_anchors(appletls_ctx_t* ctx, const char* ca_file, const char* ca_path) { + CFMutableArrayRef anchors = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks); + size_t anchor_count = 0; + if (anchors == NULL) return HSSL_ERROR; + + if (ca_file && *ca_file && appletls_append_anchor_file(anchors, ca_file, &anchor_count, 1) != HSSL_OK) { + CFRelease(anchors); + return HSSL_ERROR; + } + if (ca_path && *ca_path) { + DIR* dir = opendir(ca_path); + struct dirent* entry; + if (dir == NULL) { + fprintf(stderr, "Apple TLS CA directory could not be opened\n"); + CFRelease(anchors); + return HSSL_ERROR; + } + while ((entry = readdir(dir)) != NULL) { + struct stat st; + char path[PATH_MAX]; + int length; + if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) continue; + length = snprintf(path, sizeof(path), "%s/%s", ca_path, entry->d_name); + if (length < 0 || (size_t)length >= sizeof(path)) continue; + if (lstat(path, &st) != 0 || !S_ISREG(st.st_mode)) continue; + if (appletls_append_anchor_file(anchors, path, &anchor_count, 0) != HSSL_OK) { + closedir(dir); + CFRelease(anchors); + return HSSL_ERROR; + } + } + closedir(dir); + } + if (anchor_count == 0) { + fprintf(stderr, "Apple TLS custom CA source contains no valid certificates\n"); + CFRelease(anchors); + return HSSL_ERROR; + } + ctx->trust_anchors = anchors; + return HSSL_OK; +} + hssl_ctx_t hssl_ctx_new(hssl_ctx_opt_t* param) { - appletls_ctx_t* ctx = (appletls_ctx_t*)malloc(sizeof(appletls_ctx_t)); + const char* crt_file = param && param->crt_file && *param->crt_file ? param->crt_file : NULL; + const char* key_file = param && param->key_file && *param->key_file ? param->key_file : NULL; + const char* ca_file = param && param->ca_file && *param->ca_file ? param->ca_file : NULL; + const char* ca_path = param && param->ca_path && *param->ca_path ? param->ca_path : NULL; + appletls_ctx_t* ctx = (appletls_ctx_t*)calloc(1, sizeof(appletls_ctx_t)); if (ctx == NULL) return NULL; - ctx->cert = NULL; - ctx->param = param; + ctx->verify_peer = param ? param->verify_peer : 0; + ctx->configured_endpoint = param ? param->endpoint : HSSL_CLIENT; + + if ((crt_file == NULL) != (key_file == NULL)) { + fprintf(stderr, "Apple TLS requires both crt_file and key_file\n"); + goto error; + } + if (crt_file && appletls_create_identity(ctx, crt_file, key_file) != HSSL_OK) goto error; + if (param && param->endpoint == HSSL_SERVER && ctx->identity == NULL) { + fprintf(stderr, "Apple TLS server requires an RSA certificate and private key\n"); + goto error; + } + if ((ca_file || ca_path) && appletls_load_anchors(ctx, ca_file, ca_path) != HSSL_OK) goto error; return ctx; + +error: + hssl_ctx_free(ctx); + return NULL; } void hssl_ctx_free(hssl_ctx_t ssl_ctx) { if (ssl_ctx == NULL) return; appletls_ctx_t* ctx = (appletls_ctx_t*)ssl_ctx; - if (ctx->cert) { - CFRelease(ctx->cert); - ctx->cert = NULL; - } + if (ctx->certificate_chain) CFRelease(ctx->certificate_chain); + if (ctx->trust_anchors) CFRelease(ctx->trust_anchors); + if (ctx->identity) CFRelease(ctx->identity); free(ctx); } @@ -897,7 +1101,7 @@ static int hssl_init(hssl_t ssl, int endpoint) { } bool verify_peer = false; - if (appletls->ctx->param && appletls->ctx->param->verify_peer) { + if (appletls->ctx->verify_peer) { verify_peer = true; } #if defined(__MAC_10_8) @@ -910,14 +1114,8 @@ static int hssl_init(hssl_t ssl, int endpoint) { return HSSL_ERROR; } - if (appletls->ctx->cert) { - CFArrayRef certs = CFArrayCreate(NULL, (const void**)&appletls->ctx->cert, 1, NULL); - if (!certs) { - fprintf(stderr, "CFArrayCreate failed!\n"); - return HSSL_ERROR; - } - ret = SSLSetCertificate(appletls->session, certs); - CFRelease(certs); + if (appletls->ctx->certificate_chain) { + ret = SSLSetCertificate(appletls->session, appletls->ctx->certificate_chain); if (ret != noErr) { fprintf(stderr, "SSLSetCertificate failed!\n"); return HSSL_ERROR; diff --git a/unittest/appletls_test.c b/unittest/appletls_test.c new file mode 100644 index 000000000..23d83cb8b --- /dev/null +++ b/unittest/appletls_test.c @@ -0,0 +1,97 @@ +#include +#include +#include + +#include "hssl.h" + +#define FIXTURE(name) "unittest/fixtures/appletls/" name + +static hssl_ctx_opt_t server_options(const char* key_file) { + hssl_ctx_opt_t options; + memset(&options, 0, sizeof(options)); + options.endpoint = HSSL_SERVER; + options.crt_file = FIXTURE("server-chain.pem"); + options.key_file = key_file; + return options; +} + +static void test_server_context_accepts_matching_pkcs1_identity(void) { + hssl_ctx_opt_t options = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_t ctx = hssl_ctx_new(&options); + assert(ctx != NULL); + hssl_ctx_free(ctx); +} + +static void test_server_context_accepts_matching_pkcs8_identity(void) { + hssl_ctx_opt_t options = server_options(FIXTURE("server-pkcs8.key")); + hssl_ctx_t ctx = hssl_ctx_new(&options); + assert(ctx != NULL); + hssl_ctx_free(ctx); +} + +static void test_server_context_rejects_missing_identity(void) { + hssl_ctx_opt_t options; + memset(&options, 0, sizeof(options)); + options.endpoint = HSSL_SERVER; + assert(hssl_ctx_new(&options) == NULL); +} + +static void test_context_rejects_partial_identity(void) { + hssl_ctx_opt_t options = server_options(NULL); + assert(hssl_ctx_new(&options) == NULL); + options = server_options(FIXTURE("server-pkcs1.key")); + options.crt_file = NULL; + assert(hssl_ctx_new(&options) == NULL); +} + +static void test_context_rejects_mismatched_identity(void) { + hssl_ctx_opt_t options = server_options(FIXTURE("wrong-server.key")); + assert(hssl_ctx_new(&options) == NULL); +} + +static void test_context_loads_ca_file(void) { + hssl_ctx_opt_t options; + memset(&options, 0, sizeof(options)); + options.endpoint = HSSL_CLIENT; + options.verify_peer = 1; + options.ca_file = FIXTURE("multi-ca.pem"); + hssl_ctx_t ctx = hssl_ctx_new(&options); + assert(ctx != NULL); + hssl_ctx_free(ctx); +} + +static void test_context_loads_ca_directory_and_skips_noise(void) { + hssl_ctx_opt_t options; + memset(&options, 0, sizeof(options)); + options.endpoint = HSSL_CLIENT; + options.verify_peer = 1; + options.ca_path = FIXTURE("ca-dir"); + hssl_ctx_t ctx = hssl_ctx_new(&options); + assert(ctx != NULL); + hssl_ctx_free(ctx); +} + +static void test_context_rejects_empty_ca_source(void) { + hssl_ctx_opt_t options; + memset(&options, 0, sizeof(options)); + options.endpoint = HSSL_CLIENT; + options.verify_peer = 1; + options.ca_file = FIXTURE("malformed-base64.pem"); + assert(hssl_ctx_new(&options) == NULL); + options.ca_file = NULL; + options.ca_path = FIXTURE("empty-ca-dir"); + assert(hssl_ctx_new(&options) == NULL); +} + +int main(void) { + test_server_context_accepts_matching_pkcs1_identity(); + test_server_context_accepts_matching_pkcs8_identity(); + test_server_context_rejects_missing_identity(); + test_context_rejects_partial_identity(); + test_context_rejects_mismatched_identity(); + test_context_loads_ca_file(); + test_context_loads_ca_directory_and_skips_noise(); + test_context_rejects_empty_ca_source(); + puts("appletls_test: PASS"); + return 0; +} diff --git a/unittest/fixtures/appletls/empty-ca-dir/README.txt b/unittest/fixtures/appletls/empty-ca-dir/README.txt new file mode 100644 index 000000000..2716bf650 --- /dev/null +++ b/unittest/fixtures/appletls/empty-ca-dir/README.txt @@ -0,0 +1 @@ +not a certificate diff --git a/unittest/fixtures/appletls/generate.sh b/unittest/fixtures/appletls/generate.sh index 48469ebd5..960450c37 100755 --- a/unittest/fixtures/appletls/generate.sh +++ b/unittest/fixtures/appletls/generate.sh @@ -80,6 +80,8 @@ cat "$fixture_dir/root.crt" "$fixture_dir/wrong-root.crt" \ mkdir -p "$fixture_dir/ca-dir" cp "$fixture_dir/root.crt" "$fixture_dir/ca-dir/root.crt" printf '%s\n' 'not a certificate' > "$fixture_dir/ca-dir/README.txt" +mkdir -p "$fixture_dir/empty-ca-dir" +printf '%s\n' 'not a certificate' > "$fixture_dir/empty-ca-dir/README.txt" printf '%s\n' \ '-----BEGIN CERTIFICATE-----' \ From d613b4cc3b1ecc0eaf9756d256006e098a3b4d56 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 12:14:51 +0800 Subject: [PATCH 03/12] feat(ssl): verify peers in Apple TLS Co-authored-by: TRAE CLI --- Makefile | 7 +- ssl/appletls.c | 342 +++++++++++-------- ssl/appletls_pem.c | 2 +- unittest/appletls_test.c | 185 ++++++++++ unittest/fixtures/appletls/ca-dir/root.crt | 36 +- unittest/fixtures/appletls/client-chain.pem | 34 +- unittest/fixtures/appletls/client.crt | 34 +- unittest/fixtures/appletls/client.key | 50 +-- unittest/fixtures/appletls/ec-pkcs8.key | 6 +- unittest/fixtures/appletls/ec-sec1.key | 6 +- unittest/fixtures/appletls/encrypted-key.pem | 56 +-- unittest/fixtures/appletls/generate.sh | 6 +- unittest/fixtures/appletls/intermediate.crt | 36 +- unittest/fixtures/appletls/multi-ca.pem | 70 ++-- unittest/fixtures/appletls/root.crt | 36 +- unittest/fixtures/appletls/server-chain.pem | 70 ++-- unittest/fixtures/appletls/server-pkcs1.key | 50 +-- unittest/fixtures/appletls/server-pkcs8.key | 52 +-- unittest/fixtures/appletls/server.crt | 34 +- unittest/fixtures/appletls/wrong-root.crt | 34 +- unittest/fixtures/appletls/wrong-server.key | 50 +-- 21 files changed, 725 insertions(+), 471 deletions(-) diff --git a/Makefile b/Makefile index 46af3ea9e..9fef643f6 100644 --- a/Makefile +++ b/Makefile @@ -377,7 +377,12 @@ hrpc_calc_server: prepare hrpc_calc_protoc -unittest: prepare libhv +APPLE_TLS_UNITTESTS = +ifeq ($(shell uname -s),Darwin) +APPLE_TLS_UNITTESTS += appletls_test +endif + +unittest: prepare libhv appletls_pem_test $(APPLE_TLS_UNITTESTS) $(CC) -g -Wall -O0 -std=c99 -I. -Ibase -o bin/rbtree_test unittest/rbtree_test.c base/rbtree.c $(CC) -g -Wall -O0 -std=c99 -I. -Ibase -o bin/hbase_test unittest/hbase_test.c base/hbase.c $(CC) -g -Wall -O0 -std=c99 -I. -Ibase -o bin/mkdir_p unittest/mkdir_test.c base/hbase.c diff --git a/ssl/appletls.c b/ssl/appletls.c index bb92828fe..85946ca67 100644 --- a/ssl/appletls.c +++ b/ssl/appletls.c @@ -3,6 +3,15 @@ #ifdef WITH_APPLETLS /* Disclaimer: excerpted from curl */ +/* + * Secure Transport is deprecated, but Network.framework cannot adopt the + * connected socket owned by libhv's event loop. Keep this compatibility + * warning local to the Apple TLS backend instead of weakening global flags. + */ +#if defined(__clang__) +#pragma clang diagnostic push +#pragma clang diagnostic ignored "-Wdeprecated-declarations" +#endif #include /* For some reason, when building for iOS, the omnibus header above does @@ -86,18 +95,6 @@ static const SSLProtocol kTLSProtocol12 = (SSLProtocol)8; static const SSLProtocol kTLSProtocol13 = (SSLProtocol)10; #endif -static inline const char* SSLProtocolToString(SSLProtocol proto) { - switch(proto) { - case kSSLProtocol2: return "SSLv2"; - case kSSLProtocol3: return "SSLv3"; - case kTLSProtocol1: return "TLSv1"; - case kTLSProtocol11: return "TLSv1.1"; - case kTLSProtocol12: return "TLSv1.2"; - case kTLSProtocol13: return "TLSv1.3"; - default: return "Unknown"; - } -} - struct st_cipher { const char *name; /* Cipher suite IANA name. It starts with "TLS_" prefix */ const char *alias_name; /* Alias name is the same as OpenSSL cipher name */ @@ -726,25 +723,6 @@ const static struct st_cipher ciphertable[] = { #define NUM_OF_CIPHERS sizeof(ciphertable)/sizeof(ciphertable[0]) -static const char* SSLCipherSuiteToString(SSLCipherSuite cipher) -{ - /* The first ciphers in the ciphertable are continuos. Here we do small - optimization and instead of loop directly get SSL name by cipher number. - */ - if(cipher <= SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA) { - return ciphertable[cipher].name; - } - /* Iterate through the rest of the ciphers */ - for(size_t i = SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA + 1; - i < NUM_OF_CIPHERS; - ++i) { - if(ciphertable[i].num == cipher) { - return ciphertable[i].name; - } - } - return ciphertable[SSL_NULL_WITH_NULL_NULL].name; -} - static bool is_cipher_suite_strong(SSLCipherSuite suite_num) { for(size_t i = 0; i < NUM_OF_CIPHERS; ++i) { @@ -798,48 +776,51 @@ static int appletls_create_identity(appletls_ctx_t* ctx, const char* cert_file, goto cleanup; } -#if defined(__has_builtin) -#if __has_builtin(__builtin_available) - if (!__builtin_available(macOS 10.12, iOS 11.2, *)) { +#if (TARGET_OS_MAC && MAC_OS_X_VERSION_MAX_ALLOWED >= 101200) || \ + ((TARGET_OS_EMBEDDED || TARGET_OS_IPHONE) && __IPHONE_OS_VERSION_MAX_ALLOWED >= 110200) + if (__builtin_available(macOS 10.12, iOS 11.2, *)) { + data = appletls_cfdata(&certificates.items[0]); + if (data == NULL) goto cleanup; + leaf = SecCertificateCreateWithData(NULL, data); + CFRelease(data); + data = NULL; + if (leaf == NULL) { + fprintf(stderr, "Apple TLS leaf certificate is invalid\n"); + goto cleanup; + } + + data = appletls_cfdata(&key_data); + if (data == NULL) goto cleanup; + { + const void* keys[] = {kSecAttrKeyType, kSecAttrKeyClass}; + const void* values[] = {kSecAttrKeyTypeRSA, kSecAttrKeyClassPrivate}; + attributes = CFDictionaryCreate(NULL, keys, values, 2, + &kCFTypeDictionaryKeyCallBacks, + &kCFTypeDictionaryValueCallBacks); + } + if (attributes == NULL) goto cleanup; + private_key = SecKeyCreateWithData(data, attributes, &error); + CFRelease(data); + data = NULL; + if (private_key == NULL) { + fprintf(stderr, "Apple TLS could not create the RSA private key\n"); + goto cleanup; + } + identity = SecIdentityCreate(NULL, leaf, private_key); + if (identity == NULL) { + fprintf(stderr, "Apple TLS certificate and private key do not match\n"); + goto cleanup; + } + } else { fprintf(stderr, "Apple TLS local identities require macOS 10.12 or iOS 11.2\n"); ret = APPLETLS_PEM_ERROR_UNSUPPORTED; goto cleanup; } +#else + fprintf(stderr, "Apple TLS local identities require an SDK with SecIdentityCreate\n"); + ret = APPLETLS_PEM_ERROR_UNSUPPORTED; + goto cleanup; #endif -#endif - - data = appletls_cfdata(&certificates.items[0]); - if (data == NULL) goto cleanup; - leaf = SecCertificateCreateWithData(NULL, data); - CFRelease(data); - data = NULL; - if (leaf == NULL) { - fprintf(stderr, "Apple TLS leaf certificate is invalid\n"); - goto cleanup; - } - - data = appletls_cfdata(&key_data); - if (data == NULL) goto cleanup; - { - const void* keys[] = {kSecAttrKeyType, kSecAttrKeyClass}; - const void* values[] = {kSecAttrKeyTypeRSA, kSecAttrKeyClassPrivate}; - attributes = CFDictionaryCreate(NULL, keys, values, 2, - &kCFTypeDictionaryKeyCallBacks, - &kCFTypeDictionaryValueCallBacks); - } - if (attributes == NULL) goto cleanup; - private_key = SecKeyCreateWithData(data, attributes, &error); - CFRelease(data); - data = NULL; - if (private_key == NULL) { - fprintf(stderr, "Apple TLS could not create the RSA private key\n"); - goto cleanup; - } - identity = SecIdentityCreate(NULL, leaf, private_key); - if (identity == NULL) { - fprintf(stderr, "Apple TLS certificate and private key do not match\n"); - goto cleanup; - } chain = CFArrayCreateMutable(NULL, (CFIndex)certificates.count, &kCFTypeArrayCallBacks); if (chain == NULL) goto cleanup; @@ -991,55 +972,44 @@ void hssl_ctx_free(hssl_ctx_t ssl_ctx) { typedef struct appletls_s { SSLContextRef session; appletls_ctx_t* ctx; + char* hostname; int fd; + int endpoint; + int blocked_on; + bool peer_auth_handled; } appletls_t; hssl_t hssl_new(hssl_ctx_t ssl_ctx, int fd) { if (ssl_ctx == NULL) return NULL; - appletls_t* appletls = (appletls_t*)malloc(sizeof(appletls_t)); + appletls_t* appletls = (appletls_t*)calloc(1, sizeof(appletls_t)); if (appletls == NULL) return NULL; - appletls->session = NULL; appletls->ctx = (appletls_ctx_t*)ssl_ctx; appletls->fd = fd; + appletls->endpoint = -1; return (hssl_t)appletls; } static OSStatus SocketRead(SSLConnectionRef conn, void* data, size_t* len) { - // printf("SocketRead(%d)\n", (int)*len); appletls_t* appletls = (appletls_t*)conn; uint8_t* buffer = (uint8_t*)data; size_t remain = *len; *len = 0; int fd = appletls->fd; - // int timeout = 1000; - // struct timeval tv = { timeout / 1000, (timeout % 1000) * 1000 }; - // fd_set readfds; while (remain) { - /* - FD_ZERO(&readfds); - FD_SET(fd, &readfds); - int nselect = select(fd + 1, &readfds, 0, 0, &tv); - printf("nselect=%d\n", nselect); - if (nselect < 0) { - return errSSLClosedAbort; - } - if (nselect == 0) { - return errSSLWouldBlock; - } - */ - // printf("read(%d)\n", (int)remain); - // NOTE: avoid blocking - if (remain < 16) { - so_rcvtimeo(fd, 1000); - } ssize_t nread = read(fd, buffer, remain); - // printf("nread=%d errno=%d\n", (int)nread, (int)errno); if (nread == 0) return errSSLClosedGraceful; if (nread < 0) { switch (errno) { case ENOENT: return errSSLClosedGraceful; case ECONNRESET:return errSSLClosedAbort; - case EAGAIN: return errSSLWouldBlock; + case EINTR: + continue; + case EAGAIN: +#if EWOULDBLOCK != EAGAIN + case EWOULDBLOCK: +#endif + appletls->blocked_on = HSSL_WANT_READ; + return errSSLWouldBlock; default: return errSSLClosedAbort; } } @@ -1051,22 +1021,23 @@ static OSStatus SocketRead(SSLConnectionRef conn, void* data, size_t* len) { } static OSStatus SocketWrite(SSLConnectionRef conn, const void* data, size_t* len) { - // printf("SocketWrite(%d)\n", (int)*len); appletls_t* appletls = (appletls_t*)conn; uint8_t* buffer = (uint8_t*)data; size_t remain = *len; *len = 0; int fd = appletls->fd; while (remain) { - if (remain < 16) { - so_sndtimeo(fd, 1000); - } - // printf("write(%d)\n", (int)remain); ssize_t nwrite = write(fd, buffer, remain); - // printf("nwrite=%d errno=%d\n", (int)nwrite, (int)errno); if (nwrite <= 0) { switch (errno) { - case EAGAIN: return errSSLWouldBlock; + case EINTR: + continue; + case EAGAIN: +#if EWOULDBLOCK != EAGAIN + case EWOULDBLOCK: +#endif + appletls->blocked_on = HSSL_WANT_WRITE; + return errSSLWouldBlock; default: return errSSLClosedAbort; } } @@ -1081,6 +1052,12 @@ static int hssl_init(hssl_t ssl, int endpoint) { if (ssl == NULL) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; OSStatus ret = noErr; + if (appletls->endpoint != -1 && appletls->endpoint != endpoint) return HSSL_ERROR; + if (appletls->ctx->configured_endpoint != endpoint) return HSSL_ERROR; + if (endpoint == HSSL_SERVER && appletls->ctx->identity == NULL) { + fprintf(stderr, "Apple TLS server requires a local identity\n"); + return HSSL_ERROR; + } if (appletls->session == NULL) { #if defined(__MAC_10_8) appletls->session = SSLCreateContext(NULL, endpoint == HSSL_SERVER ? kSSLServerSide : kSSLClientSide, kSSLStreamType); @@ -1100,17 +1077,20 @@ static int hssl_init(hssl_t ssl, int endpoint) { return HSSL_ERROR; } - bool verify_peer = false; - if (appletls->ctx->verify_peer) { - verify_peer = true; - } #if defined(__MAC_10_8) - ret = SSLSetSessionOption(appletls->session, kSSLSessionOptionBreakOnServerAuth, !verify_peer); + if (endpoint == HSSL_CLIENT) { + ret = SSLSetSessionOption(appletls->session, kSSLSessionOptionBreakOnServerAuth, true); + } else if (appletls->ctx->verify_peer) { + ret = SSLSetClientSideAuthenticate(appletls->session, kAlwaysAuthenticate); + if (ret == noErr) { + ret = SSLSetSessionOption(appletls->session, kSSLSessionOptionBreakOnClientAuth, true); + } + } #else - ret = SSLSetEnableCertVerify(appletls->session, verify_peer); + ret = SSLSetEnableCertVerify(appletls->session, appletls->ctx->verify_peer); #endif if (ret != noErr) { - fprintf(stderr, "SSLSetEnableCertVerify failed!\n"); + fprintf(stderr, "Apple TLS authentication setup failed\n"); return HSSL_ERROR; } @@ -1180,6 +1160,7 @@ static int hssl_init(hssl_t ssl, int endpoint) { } */ + appletls->endpoint = endpoint; return HSSL_OK; error: if (all_ciphers) { @@ -1202,43 +1183,104 @@ void hssl_free(hssl_t ssl) { #endif appletls->session = NULL; } + free(appletls->hostname); free(appletls); } +static int appletls_evaluate_trust(SecTrustRef trust) { +#if defined(__has_builtin) +#if __has_builtin(__builtin_available) + if (__builtin_available(macOS 10.14, iOS 12.0, *)) { + CFErrorRef error = NULL; + bool trusted = SecTrustEvaluateWithError(trust, &error); + if (error) CFRelease(error); + return trusted ? HSSL_OK : HSSL_ERROR; + } +#endif +#endif + { + SecTrustResultType result = kSecTrustResultInvalid; + OSStatus status = SecTrustEvaluate(trust, &result); + if (status != errSecSuccess) return HSSL_ERROR; + return result == kSecTrustResultProceed || result == kSecTrustResultUnspecified + ? HSSL_OK : HSSL_ERROR; + } +} + +static int appletls_verify_peer(appletls_t* appletls, int peer_is_server) { + SecTrustRef trust = NULL; + SecPolicyRef policy = NULL; + CFStringRef hostname = NULL; + int result = HSSL_ERROR; + + if (SSLCopyPeerTrust(appletls->session, &trust) != errSecSuccess || trust == NULL) { + fprintf(stderr, "Apple TLS peer did not provide a certificate\n"); + goto cleanup; + } + if (peer_is_server && appletls->hostname) { + hostname = CFStringCreateWithCString(NULL, appletls->hostname, kCFStringEncodingUTF8); + if (hostname == NULL) goto cleanup; + } + policy = SecPolicyCreateSSL(peer_is_server, hostname); + if (policy == NULL || SecTrustSetPolicies(trust, policy) != errSecSuccess) goto cleanup; +#if (TARGET_OS_MAC && MAC_OS_X_VERSION_MAX_ALLOWED >= 1090) || \ + ((TARGET_OS_EMBEDDED || TARGET_OS_IPHONE) && __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000) + if (__builtin_available(macOS 10.9, iOS 7.0, *)) { + if (SecTrustSetNetworkFetchAllowed(trust, false) != errSecSuccess) goto cleanup; + } +#endif + if (appletls->ctx->trust_anchors) { + if (SecTrustSetAnchorCertificates(trust, appletls->ctx->trust_anchors) != errSecSuccess || + SecTrustSetAnchorCertificatesOnly(trust, true) != errSecSuccess) { + goto cleanup; + } + } + result = appletls_evaluate_trust(trust); + if (result != HSSL_OK) fprintf(stderr, "Apple TLS peer certificate verification failed\n"); + +cleanup: + if (policy) CFRelease(policy); + if (hostname) CFRelease(hostname); + if (trust) CFRelease(trust); + return result; +} + static int hssl_handshake(hssl_t ssl) { if (ssl == NULL) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; - OSStatus ret = SSLHandshake(appletls->session); - // printf("SSLHandshake retval=%d\n", (int)ret); - switch(ret) { - case noErr: - break; - case errSSLWouldBlock: - return HSSL_WANT_READ; - case errSSLPeerAuthCompleted: /* peer cert is valid, or was ignored if verification disabled */ - return hssl_handshake(ssl); - case errSSLBadConfiguration: - return HSSL_WANT_READ; - default: - return HSSL_ERROR; + int continuation; + for (continuation = 0; continuation < 3; ++continuation) { + OSStatus ret; + appletls->blocked_on = HSSL_WANT_READ; + ret = SSLHandshake(appletls->session); + switch(ret) { + case noErr: + return HSSL_OK; + case errSSLWouldBlock: + return appletls->blocked_on; + case errSSLPeerAuthCompleted: + if (appletls->peer_auth_handled) return HSSL_ERROR; + if (appletls->ctx->verify_peer && + appletls_verify_peer(appletls, appletls->endpoint == HSSL_CLIENT) != HSSL_OK) { + return HSSL_ERROR; + } + appletls->peer_auth_handled = true; + break; + case errSSLClientCertRequested: + if (appletls->ctx->identity == NULL) return HSSL_ERROR; + break; + default: + return HSSL_ERROR; + } } - - /* - SSLProtocol protocol = kSSLProtocolUnknown; - SSLGetNegotiatedProtocolVersion(appletls->session, &protocol); - SSLCipherSuite cipher = SSL_NO_SUCH_CIPHERSUITE; - SSLGetNegotiatedCipher(appletls->session, &cipher); - printf("* %s connection using %s\n", SSLProtocolToString(protocol), SSLCipherSuiteToString(cipher)); - */ - - return HSSL_OK; + return HSSL_ERROR; } int hssl_accept(hssl_t ssl) { if (ssl == NULL) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; if (appletls->session == NULL) { - hssl_init(ssl, HSSL_SERVER); + if (hssl_init(ssl, HSSL_SERVER) != HSSL_OK) return HSSL_ERROR; } return hssl_handshake(ssl); } @@ -1247,7 +1289,7 @@ int hssl_connect(hssl_t ssl) { if (ssl == NULL) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; if (appletls->session == NULL) { - hssl_init(ssl, HSSL_CLIENT); + if (hssl_init(ssl, HSSL_CLIENT) != HSSL_OK) return HSSL_ERROR; } return hssl_handshake(ssl); } @@ -1255,6 +1297,7 @@ int hssl_connect(hssl_t ssl) { int hssl_read(hssl_t ssl, void* buf, int len) { if (ssl == NULL) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; + if (appletls->session == NULL) return HSSL_ERROR; size_t processed = 0; // printf("SSLRead(%d)\n", len); OSStatus ret = SSLRead(appletls->session, buf, len, &processed); @@ -1263,11 +1306,14 @@ int hssl_read(hssl_t ssl, void* buf, int len) { case noErr: return processed; case errSSLWouldBlock: - return processed ? processed : HSSL_WOULD_BLOCK; + if (processed) return (int)processed; + errno = EAGAIN; + return HSSL_WOULD_BLOCK; case errSSLClosedGraceful: case errSSLClosedNoNotify: return 0; default: + errno = EIO; return HSSL_ERROR; } } @@ -1275,6 +1321,7 @@ int hssl_read(hssl_t ssl, void* buf, int len) { int hssl_write(hssl_t ssl, const void* buf, int len) { if (ssl == NULL) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; + if (appletls->session == NULL) return HSSL_ERROR; size_t processed = 0; // printf("SSLWrite(%d)\n", len); OSStatus ret = SSLWrite(appletls->session, buf, len, &processed); @@ -1283,11 +1330,14 @@ int hssl_write(hssl_t ssl, const void* buf, int len) { case noErr: return processed; case errSSLWouldBlock: - return processed ? processed : HSSL_WOULD_BLOCK; + if (processed) return (int)processed; + errno = EAGAIN; + return HSSL_WOULD_BLOCK; case errSSLClosedGraceful: case errSSLClosedNoNotify: return 0; default: + errno = EIO; return HSSL_ERROR; } } @@ -1295,18 +1345,32 @@ int hssl_write(hssl_t ssl, const void* buf, int len) { int hssl_close(hssl_t ssl) { if (ssl == NULL) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; - SSLClose(appletls->session); + if (appletls->session) SSLClose(appletls->session); return 0; } int hssl_set_sni_hostname(hssl_t ssl, const char* hostname) { - if (ssl == NULL) return HSSL_ERROR; + size_t len; + char* copy; + OSStatus status; + if (ssl == NULL || hostname == NULL || *hostname == '\0') return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; if (appletls->session == NULL) { - hssl_init(ssl, HSSL_CLIENT); + if (hssl_init(ssl, HSSL_CLIENT) != HSSL_OK) return HSSL_ERROR; } - SSLSetPeerDomainName(appletls->session, hostname, strlen(hostname)); - return 0; + len = strlen(hostname); + status = SSLSetPeerDomainName(appletls->session, hostname, len); + if (status != noErr) return HSSL_ERROR; + copy = (char*)malloc(len + 1); + if (copy == NULL) return HSSL_ERROR; + memcpy(copy, hostname, len + 1); + free(appletls->hostname); + appletls->hostname = copy; + return HSSL_OK; } +#if defined(__clang__) +#pragma clang diagnostic pop +#endif + #endif // WITH_APPLETLS diff --git a/ssl/appletls_pem.c b/ssl/appletls_pem.c index 5db0b88f6..7821a0a09 100644 --- a/ssl/appletls_pem.c +++ b/ssl/appletls_pem.c @@ -107,7 +107,7 @@ static int decode_base64(const unsigned char* begin, const unsigned char* end, a b = base64_value(quartet[1]); c = quartet[2] == '=' ? -2 : base64_value(quartet[2]); d = quartet[3] == '=' ? -2 : base64_value(quartet[3]); - if (a < 0 || b < 0 || c < -2 || d < -2 || (c == -2 && d != -2)) { + if (a < 0 || b < 0 || c == -1 || d == -1 || (c == -2 && d != -2)) { free(out); return APPLETLS_PEM_ERROR_FORMAT; } diff --git a/unittest/appletls_test.c b/unittest/appletls_test.c index 23d83cb8b..c73a75ce1 100644 --- a/unittest/appletls_test.c +++ b/unittest/appletls_test.c @@ -1,7 +1,11 @@ #include +#include #include #include +#include +#include +#include "hsocket.h" #include "hssl.h" #define FIXTURE(name) "unittest/fixtures/appletls/" name @@ -83,6 +87,178 @@ static void test_context_rejects_empty_ca_source(void) { assert(hssl_ctx_new(&options) == NULL); } +static void test_invalid_sni_and_identityless_server_fail_cleanly(void) { + hssl_ctx_t ctx = hssl_ctx_new(NULL); + hssl_t ssl; + assert(ctx != NULL); + ssl = hssl_new(ctx, -1); + assert(ssl != NULL); + assert(hssl_set_sni_hostname(ssl, NULL) == HSSL_ERROR); + assert(hssl_set_sni_hostname(ssl, "") == HSSL_ERROR); + assert(hssl_accept(ssl) == HSSL_ERROR); + hssl_free(ssl); + hssl_ctx_free(ctx); +} + +typedef struct { + hssl_ctx_t server_ctx; + hssl_ctx_t client_ctx; + hssl_t server; + hssl_t client; + int fds[2]; +} tls_pair_t; + +static void tls_pair_close(tls_pair_t* pair) { + if (pair->server) hssl_free(pair->server); + if (pair->client) hssl_free(pair->client); + if (pair->server_ctx) hssl_ctx_free(pair->server_ctx); + if (pair->client_ctx) hssl_ctx_free(pair->client_ctx); + if (pair->fds[0] >= 0) close(pair->fds[0]); + if (pair->fds[1] >= 0) close(pair->fds[1]); + memset(pair, 0, sizeof(*pair)); + pair->fds[0] = pair->fds[1] = -1; +} + +static int tls_pair_open(tls_pair_t* pair, const hssl_ctx_opt_t* server_options, + const hssl_ctx_opt_t* client_options, const char* hostname) { + int i; + int server_status = HSSL_WANT_READ; + int client_status = HSSL_WANT_READ; + memset(pair, 0, sizeof(*pair)); + pair->fds[0] = pair->fds[1] = -1; + pair->server_ctx = hssl_ctx_new((hssl_ctx_opt_t*)server_options); + pair->client_ctx = hssl_ctx_new((hssl_ctx_opt_t*)client_options); + if (pair->server_ctx == NULL || pair->client_ctx == NULL) goto error; + if (socketpair(AF_UNIX, SOCK_STREAM, 0, pair->fds) != 0) goto error; + if (nonblocking(pair->fds[0]) != 0 || nonblocking(pair->fds[1]) != 0) goto error; + pair->server = hssl_new(pair->server_ctx, pair->fds[0]); + pair->client = hssl_new(pair->client_ctx, pair->fds[1]); + if (pair->server == NULL || pair->client == NULL) goto error; + if (hostname && hssl_set_sni_hostname(pair->client, hostname) != HSSL_OK) goto error; + + for (i = 0; i < 10000; ++i) { + if (server_status != HSSL_OK) server_status = hssl_accept(pair->server); + if (client_status != HSSL_OK) client_status = hssl_connect(pair->client); + if (server_status == HSSL_ERROR || client_status == HSSL_ERROR) goto error; + if (server_status == HSSL_OK && client_status == HSSL_OK) return 0; + } + +error: + tls_pair_close(pair); + return -1; +} + +static void assert_bidirectional_data(tls_pair_t* pair) { + static const char request[] = "client-to-server"; + static const char response[] = "server-to-client"; + char buffer[64]; + int ret; + int i; + + assert(hssl_write(pair->client, request, (int)sizeof(request)) == (int)sizeof(request)); + ret = HSSL_WOULD_BLOCK; + for (i = 0; i < 1000 && ret == HSSL_WOULD_BLOCK; ++i) { + ret = hssl_read(pair->server, buffer, sizeof(buffer)); + } + assert(ret == (int)sizeof(request)); + assert(memcmp(buffer, request, sizeof(request)) == 0); + + assert(hssl_write(pair->server, response, (int)sizeof(response)) == (int)sizeof(response)); + ret = HSSL_WOULD_BLOCK; + for (i = 0; i < 1000 && ret == HSSL_WOULD_BLOCK; ++i) { + ret = hssl_read(pair->client, buffer, sizeof(buffer)); + } + assert(ret == (int)sizeof(response)); + assert(memcmp(buffer, response, sizeof(response)) == 0); +} + +static hssl_ctx_opt_t verified_client_options(const char* ca_file) { + hssl_ctx_opt_t options; + memset(&options, 0, sizeof(options)); + options.endpoint = HSSL_CLIENT; + options.verify_peer = 1; + options.ca_file = ca_file; + return options; +} + +static void test_server_handshake_and_bidirectional_data(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client; + tls_pair_t pair; + memset(&client, 0, sizeof(client)); + client.endpoint = HSSL_CLIENT; + assert(tls_pair_open(&pair, &server, &client, NULL) == 0); + assert_bidirectional_data(&pair); + tls_pair_close(&pair); +} + +static void test_custom_ca_and_matching_hostname_succeed(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client = verified_client_options(FIXTURE("root.crt")); + tls_pair_t pair; + assert(tls_pair_open(&pair, &server, &client, "localhost") == 0); + tls_pair_close(&pair); +} + +static void test_custom_ca_directory_and_matching_hostname_succeed(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client = verified_client_options(NULL); + tls_pair_t pair; + client.ca_path = FIXTURE("ca-dir"); + assert(tls_pair_open(&pair, &server, &client, "localhost") == 0); + tls_pair_close(&pair); +} + +static void test_empty_read_is_nonblocking(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client; + tls_pair_t pair; + char byte; + memset(&client, 0, sizeof(client)); + client.endpoint = HSSL_CLIENT; + assert(tls_pair_open(&pair, &server, &client, NULL) == 0); + errno = 0; + assert(hssl_read(pair.client, &byte, 1) == HSSL_WOULD_BLOCK); + assert(errno == EAGAIN || errno == EWOULDBLOCK); + tls_pair_close(&pair); +} + +static void test_wrong_hostname_fails(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client = verified_client_options(FIXTURE("root.crt")); + tls_pair_t pair; + assert(tls_pair_open(&pair, &server, &client, "wrong.example") != 0); +} + +static void test_wrong_custom_ca_fails(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client = verified_client_options(FIXTURE("wrong-root.crt")); + tls_pair_t pair; + assert(tls_pair_open(&pair, &server, &client, "localhost") != 0); +} + +static void test_server_mtls_rejects_missing_client_certificate(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client = verified_client_options(FIXTURE("root.crt")); + tls_pair_t pair; + server.verify_peer = 1; + server.ca_file = FIXTURE("root.crt"); + assert(tls_pair_open(&pair, &server, &client, "localhost") != 0); +} + +static void test_server_mtls_accepts_trusted_client_certificate(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client = verified_client_options(FIXTURE("root.crt")); + tls_pair_t pair; + server.verify_peer = 1; + server.ca_file = FIXTURE("root.crt"); + client.crt_file = FIXTURE("client-chain.pem"); + client.key_file = FIXTURE("client.key"); + assert(tls_pair_open(&pair, &server, &client, "localhost") == 0); + assert_bidirectional_data(&pair); + tls_pair_close(&pair); +} + int main(void) { test_server_context_accepts_matching_pkcs1_identity(); test_server_context_accepts_matching_pkcs8_identity(); @@ -92,6 +268,15 @@ int main(void) { test_context_loads_ca_file(); test_context_loads_ca_directory_and_skips_noise(); test_context_rejects_empty_ca_source(); + test_invalid_sni_and_identityless_server_fail_cleanly(); + test_server_handshake_and_bidirectional_data(); + test_custom_ca_and_matching_hostname_succeed(); + test_custom_ca_directory_and_matching_hostname_succeed(); + test_empty_read_is_nonblocking(); + test_wrong_hostname_fails(); + test_wrong_custom_ca_fails(); + test_server_mtls_rejects_missing_client_certificate(); + test_server_mtls_accepts_trusted_client_certificate(); puts("appletls_test: PASS"); return 0; } diff --git a/unittest/fixtures/appletls/ca-dir/root.crt b/unittest/fixtures/appletls/ca-dir/root.crt index 34c0fc273..096e53443 100644 --- a/unittest/fixtures/appletls/ca-dir/root.crt +++ b/unittest/fixtures/appletls/ca-dir/root.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDOTCCAiGgAwIBAgIUdsy7efSOuc3Tckn3MvtOPCjyz8wwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz -MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs -ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2 -AsbGXP0ZwKn6k/pZbBI9AbzG8UTj9M/lV6lugynolHAXweKFTPMkeF85ZbFKArPV -4CPCXRanlNH37gaeaT9imXcSyLdvTtpIwF/FpFtMbPKNeOLu7ci+SlB+20BWAUsq -flmogmmq5eGKaPA9eEQILDuPbjzAvowcz413JkKrUFle4KriRb1dN3eAKm7QnCMx -hDLjSCcxjj6S2lGLi1cuvs9FS73jyx9TaCMv095jhLeSoF8Jfz/67HxIW/DFVl9d -6KVpJdToHxZyqfaJ3iRQXsbMq0Wh8fJP9ac8LORFOD7/Seo5VekgTBZOhE5SwfPC -7lYG94SDeLXpVU6gntIVAgMBAAGjYzBhMB0GA1UdDgQWBBSMG/0lKegkP3ay7vUy -TpK/gmdOsTAfBgNVHSMEGDAWgBSMG/0lKegkP3ay7vUyTpK/gmdOsTAPBgNVHRMB -Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAmIPm -3TWnQ3sF+yYgsnQhWdBkC0bAVXsCtdpgwCXujIfjsklVa7i93iXC4ypH92C7+jzw -NWIYbbG2Kv2NYc5H7TYUMO57nURC7hPh4pRse0yW+EdfpHnb6tM65mWwoE8ECuBD -3TdHiD97NXlODQhdhnxGsg8qVJ8h7Tcll8BARzfumVxL+78iQiJOTR0haRdIip+1 -+++2AIv82MkMSh18JISg4ym8DQjMYnY0I/SasQCWkF/V2dsjzwjX5qRU4mBN71Ub -rgUI+8m0yDCYgf5fyKbkBkoVjvqorVed/SXhyMzGl4peFCC5u2ijTRwoFs3lPMCo -FTAq4PmJPf0CVhgrog== +MIIDOTCCAiGgAwIBAgIUaNSS3l3MNTJvIi7E+jzTF57vBxswDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw +MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs +ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDR +AaPFPG9m57ORbo5elu+23P/CdHJgOu8Xgga81/V35vo/sv3Pwhx60kVLxKTrsEVR +MjYqSPyoDOHMQZhrK80qdt/I4NYgb+CCqk7yt2m28yTXFPo5lAKlez5p6bTL5kvi +0u3fv96Tebu1v7cI183x3MgBMvMhcs8GkJHJIx0d5YNbG2uiiS7+BokfdHzQBKzA +YaXnngJAq+CxJ6HhgMNg3UpcbzgrAml7/n1DJgdsW5ITiS+HUUuHaNv+CnW5XlGY +kMDITJzVlJCOvKG116HnZ5BEYzt5FRRkEsUVhA6+t1uAMYlQBTqnDQHk2ep3WLcA +KHBGCfP5T5pDVMh811wtAgMBAAGjYzBhMB0GA1UdDgQWBBTjTUJODoeym8/z5rR/ +bPbq9Mfk/DAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DAPBgNVHRMB +Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAQb/L +SvAjFOCO0QYV3O3VNypEH4lDGfptVSAZbVb0+C5cWY9/bC88D8yke2vGkgS+IkOz +YKDLkYxDQsYpaIrGYtsruDelgNEPww8m26Aps2ciuWW+oCgToPjvea146NdqrBT8 +d9AbuZEGrQkn+JSz6Qe3sE4I3t8CjLZHEY7YK7y8jSOdkDVvc4TxMxEuiVBbQMSR +QddtXv2Qa20G4kCrn/EJMEGzlcJwkKtsQafT/aZBeySUIjM35P3tb/5JKjhERihS +NJPLU5G0kKhh2m3BwAT5ugja+846zQqSe69ehiMaLFjWTIphZS7EGFexFZoSSBXD +755LxDlauvz3rREOUg== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client-chain.pem b/unittest/fixtures/appletls/client-chain.pem index 87df1f423..f1c56429e 100644 --- a/unittest/fixtures/appletls/client-chain.pem +++ b/unittest/fixtures/appletls/client-chain.pem @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDTTCCAjWgAwIBAgIUa1xt7fbLCcces2WETU+Dj6XY6uMwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz -MDE5MjcwMVoYDzIxMjYwOTA2MTkyNzAxWjAlMSMwIQYDVQQDDBpsaWJodi1hcHBs +MIIDTTCCAjWgAwIBAgIUUCbVWLU3xvd10p6EmaNbjLUfJLUwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw +MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAlMSMwIQYDVQQDDBpsaWJodi1hcHBs ZXRscy10ZXN0LWNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB -AKfycz1z9vLhyKSzZkq4mX0nV/Deiwmn7xZkQhfCpVRaRPtr5kie4hRnibVVZEVc -qlsdLBS2nUT8RdYI1NyPYdYwKkr4LjdEHIv+ih3cfKjVV7zKZRkObX55RqaRxNXB -AOXejXLCSxpeY+DEB/atPw8C1OjrNBj6Ew8B/ijLF5pG7tn386IcAqIaFpZqXv9k -6q5OtXCgruScm/iciAxLSH7qgzcQcBBzD+inGBwxVMvHJATNHoLsji32efY+Ixj6 -1hBm9q8iCALTSUr53p8jC6DFWZxe7Mqgi7TpBms2vbxgl+rx9HoI6xWC97UyfBO4 -Ye+Fv/HygLhjSrd//F3WCssCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8B -Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFHzMup588/DN -SB+VFmgLFFmu3zBtMB8GA1UdIwQYMBaAFIwb/SUp6CQ/drLu9TJOkr+CZ06xMA0G -CSqGSIb3DQEBCwUAA4IBAQAujf++SCVGpobUF8H5Wj+Od1Nd6M9BKBjjGiJ5k3CN -N2txnC1YaDjAFUXBlGTsaRUrBZko/L+0q/o0DffS9X7b6SvJb7TBa/PjQf5LjeP2 -Cs/TBuVnZgB20cNlZQz7xVYp5hKDumyy9wVGU07H0WfiqUrp8JTeTsiKse8tHYul -cExtsZasQ5OIr6FXwZdwtx1r9awISfAIfVV6vh/nRbDKyBpCOyZuNQ36eco0iWNK -nBvDfdO2vfRT0+qNYp1W2oCri+IallzT10+Gld5p4k6N2leUT24VA4MGGkZAOBH5 -ExUc9uYQytcG9hRwpvRgR4f7ExU7BBwV9YuskVKJxxZ1 +ALKW0bN6IcfLrAZHHuR8L655t/ksqTirWvj/pqKfUhMqPdD7gId38PpAUX3agQfL +Kd9SvUFJu9T680H63vrgH3yMCfgM66xe09T4S2RxgmysLvTdysnG5UJ0X9VCDGYr +cUhi1oOuUT4JdOTSzOrbidVxfl4vqufCng0aYhM4Ig1ssJKEZdt1vNVHHg5axcSF +8UJaffY/GBHHoK9BG6RE6skgOEuoCXzTZaOJtoVxLHJaoZknfdjvRc+LbAy93l8E +kSQmm0uxrVIceZMZGeCdyYakLCNyNgt89BHuF447W1nLfGqCAf+2/APutNMSAorl ++LzIkzLwwohI6jwUzwTdJtkCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8B +Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFACRMn6L6OlG +BK9jK0G+2ngfTr4LMB8GA1UdIwQYMBaAFONNQk4Oh7Kbz/PmtH9s9ur0x+T8MA0G +CSqGSIb3DQEBCwUAA4IBAQB/glOjZXtZIZVYL/V6jHPSPCbitdp3jLmEylsAWr/4 +WZQe1hsQ8es7c5fVqDiTaJDYhvHc+KgggUF8L8C0Dxlw3TXCWpnakPPVFvOW4YQg ++2FWIZHZ1vsv97IF2RfGeDOZfPrkaaYeY9hd7Z6O8CjA60mFyv15ZDijWEBrlrYt +XA3xDvqF+zECi0s+zSdYyKyXl/MX5zP8syONJ1vsvYT7lVzEHgM7b1RvRDJiDiCX +7PtUyYEPzdRM1ikZZjuWdLX4O9hu2GpHU+eQ8X9xPTTjwH2aZ41eMM6XojZfVFoh +7AZvIOTebqOmUCt9cnPpXAnkVHuY187n3VNMc5bB9KyA -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client.crt b/unittest/fixtures/appletls/client.crt index 87df1f423..f1c56429e 100644 --- a/unittest/fixtures/appletls/client.crt +++ b/unittest/fixtures/appletls/client.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDTTCCAjWgAwIBAgIUa1xt7fbLCcces2WETU+Dj6XY6uMwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz -MDE5MjcwMVoYDzIxMjYwOTA2MTkyNzAxWjAlMSMwIQYDVQQDDBpsaWJodi1hcHBs +MIIDTTCCAjWgAwIBAgIUUCbVWLU3xvd10p6EmaNbjLUfJLUwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw +MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAlMSMwIQYDVQQDDBpsaWJodi1hcHBs ZXRscy10ZXN0LWNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB -AKfycz1z9vLhyKSzZkq4mX0nV/Deiwmn7xZkQhfCpVRaRPtr5kie4hRnibVVZEVc -qlsdLBS2nUT8RdYI1NyPYdYwKkr4LjdEHIv+ih3cfKjVV7zKZRkObX55RqaRxNXB -AOXejXLCSxpeY+DEB/atPw8C1OjrNBj6Ew8B/ijLF5pG7tn386IcAqIaFpZqXv9k -6q5OtXCgruScm/iciAxLSH7qgzcQcBBzD+inGBwxVMvHJATNHoLsji32efY+Ixj6 -1hBm9q8iCALTSUr53p8jC6DFWZxe7Mqgi7TpBms2vbxgl+rx9HoI6xWC97UyfBO4 -Ye+Fv/HygLhjSrd//F3WCssCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8B -Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFHzMup588/DN -SB+VFmgLFFmu3zBtMB8GA1UdIwQYMBaAFIwb/SUp6CQ/drLu9TJOkr+CZ06xMA0G -CSqGSIb3DQEBCwUAA4IBAQAujf++SCVGpobUF8H5Wj+Od1Nd6M9BKBjjGiJ5k3CN -N2txnC1YaDjAFUXBlGTsaRUrBZko/L+0q/o0DffS9X7b6SvJb7TBa/PjQf5LjeP2 -Cs/TBuVnZgB20cNlZQz7xVYp5hKDumyy9wVGU07H0WfiqUrp8JTeTsiKse8tHYul -cExtsZasQ5OIr6FXwZdwtx1r9awISfAIfVV6vh/nRbDKyBpCOyZuNQ36eco0iWNK -nBvDfdO2vfRT0+qNYp1W2oCri+IallzT10+Gld5p4k6N2leUT24VA4MGGkZAOBH5 -ExUc9uYQytcG9hRwpvRgR4f7ExU7BBwV9YuskVKJxxZ1 +ALKW0bN6IcfLrAZHHuR8L655t/ksqTirWvj/pqKfUhMqPdD7gId38PpAUX3agQfL +Kd9SvUFJu9T680H63vrgH3yMCfgM66xe09T4S2RxgmysLvTdysnG5UJ0X9VCDGYr +cUhi1oOuUT4JdOTSzOrbidVxfl4vqufCng0aYhM4Ig1ssJKEZdt1vNVHHg5axcSF +8UJaffY/GBHHoK9BG6RE6skgOEuoCXzTZaOJtoVxLHJaoZknfdjvRc+LbAy93l8E +kSQmm0uxrVIceZMZGeCdyYakLCNyNgt89BHuF447W1nLfGqCAf+2/APutNMSAorl ++LzIkzLwwohI6jwUzwTdJtkCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8B +Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFACRMn6L6OlG +BK9jK0G+2ngfTr4LMB8GA1UdIwQYMBaAFONNQk4Oh7Kbz/PmtH9s9ur0x+T8MA0G +CSqGSIb3DQEBCwUAA4IBAQB/glOjZXtZIZVYL/V6jHPSPCbitdp3jLmEylsAWr/4 +WZQe1hsQ8es7c5fVqDiTaJDYhvHc+KgggUF8L8C0Dxlw3TXCWpnakPPVFvOW4YQg ++2FWIZHZ1vsv97IF2RfGeDOZfPrkaaYeY9hd7Z6O8CjA60mFyv15ZDijWEBrlrYt +XA3xDvqF+zECi0s+zSdYyKyXl/MX5zP8syONJ1vsvYT7lVzEHgM7b1RvRDJiDiCX +7PtUyYEPzdRM1ikZZjuWdLX4O9hu2GpHU+eQ8X9xPTTjwH2aZ41eMM6XojZfVFoh +7AZvIOTebqOmUCt9cnPpXAnkVHuY187n3VNMc5bB9KyA -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client.key b/unittest/fixtures/appletls/client.key index 581ba790e..a79e0bb8c 100644 --- a/unittest/fixtures/appletls/client.key +++ b/unittest/fixtures/appletls/client.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEowIBAAKCAQEAp/JzPXP28uHIpLNmSriZfSdX8N6LCafvFmRCF8KlVFpE+2vm -SJ7iFGeJtVVkRVyqWx0sFLadRPxF1gjU3I9h1jAqSvguN0Qci/6KHdx8qNVXvMpl -GQ5tfnlGppHE1cEA5d6NcsJLGl5j4MQH9q0/DwLU6Os0GPoTDwH+KMsXmkbu2ffz -ohwCohoWlmpe/2Tqrk61cKCu5Jyb+JyIDEtIfuqDNxBwEHMP6KcYHDFUy8ckBM0e -guyOLfZ59j4jGPrWEGb2ryIIAtNJSvnenyMLoMVZnF7syqCLtOkGaza9vGCX6vH0 -egjrFYL3tTJ8E7hh74W/8fKAuGNKt3/8XdYKywIDAQABAoIBAAvDoUGOEfT0I93a -7dtmEDpYEIJAKcpvXQFbMdYAPccphj4mUhHcL0dGnrrOVHZssJzZRPEz1Chfk3S+ -rEpsML+UIszwPYHZijZe33CKtUtjm6sPHQMi+OssYOqMuMD7Aq5svHPBcF6p0KKP -Q2TgFdQIsBPwsHbfbYkA7BC8ySvL7HnNJffMLIJtb/90HF8YP6I6Lmm5hd8Vyrri -IBhIJjiR8QbpQBwrZRSmEJoJg/wPVMjWZl07yFasU+5/311vyaHxMVn2KJp7jt9O -wiFQo3tJoiDLG+Q5tz5I5XDroaIFis/E3jyDxHzeuSERwJcekVkEtU7pHjZmgiru -cp0sZEECgYEA0ows+jM46hBtS566X8eYeApG8BHYl8haPQKFhgTYEkWKPtWEjD7f -iEqW8avOI2KsYpuN2+CWKjGMlzhlzBh164LU13Tjy9xgoE0gL+LbvyFKF7N3cwQV -bZVcb88aNpTnUEmnUMbMVIp60t8LF4n+W3cGxfENK3UjwyleR9D68HMCgYEAzDP5 -1IA9pEiNDqd0JuSP65/9B0C/CqjOgDvvSSAyPFr5keJsWBplb2AsjtN1Eul6Lbwy -cQ0jcebjYhnB2vs2hmBa15j/Q1OlXkFFyX+srEUNNZSXp+l5c3s4NktzwFB9GYgt -h5d3H3eYWmIAVrvjVwTV6kMCfc/1qh+umAT+HkkCgYBaUGa6rF4tiP5ZAa1QiH2O -gFoNgJo4AWkz4nEEG+/TZqD2cwB4aD/aZqR45gl2hE0Nv0wKlTvUvYxhEYAZHCT4 -8RX7ldhhChcoq+yync1FHzJ5GDKU05uddgRAscW8xAK1HeL3c08StJQbADHx1u+U -rGnrXosXqRe+D3CxvaLmoQKBgFviE0sz/QicAKSUYqZReBTs41zNHGk+ddSro0sD -KrePs/aZrGikT/oii0olCevdlLVZllTaNZW975inwFu5Z9plJtsWI932mFVmB3HY -eij11TDD0M2kN5rn2e5MWyQw02mWpe36EIbfOHWK3V4pouz35w1G46sa1Q6cvOH4 -dSPJAoGBAMhGs9k7+yDq3kGHbraIIq3LVvwk9wF34CInIRf5EpnjbpWkqwSI4Amf -2PvXVhAw+oqHNalFbPK0usM4VdWIRjw4s5aGnrYep9QiGRdiLq/Hobcf3u5kDgNf -9/8OKmEKFFisfrbM4EOSVqNMxH2OicWNSvBW0Q2QuBs/mLLnU2FH +MIIEogIBAAKCAQEAspbRs3ohx8usBkce5Hwvrnm3+SypOKta+P+mop9SEyo90PuA +h3fw+kBRfdqBB8sp31K9QUm71PrzQfre+uAffIwJ+AzrrF7T1PhLZHGCbKwu9N3K +ycblQnRf1UIMZitxSGLWg65RPgl05NLM6tuJ1XF+Xi+q58KeDRpiEzgiDWywkoRl +23W81UceDlrFxIXxQlp99j8YEcegr0EbpETqySA4S6gJfNNlo4m2hXEsclqhmSd9 +2O9Fz4tsDL3eXwSRJCabS7GtUhx5kxkZ4J3JhqQsI3I2C3z0Ee4XjjtbWct8aoIB +/7b8A+600xICiuX4vMiTMvDCiEjqPBTPBN0m2QIDAQABAoIBAFH+Lo8RTrsVRoin +VIaggZ/AYHf1SkgrXBwf+9iD/0GvTixJnAwWRDwRFZkLndv/Kd1PdnaoLKWvBcpQ +LNnP1oTvIpCRFg7Qhr8rtCmMd83/C5v+zGDxgUaOeYVGyryJy3vpbQWOHdy2qMV6 +Bvz5CIJHljYV+ohncPshFtAuIGw6q0Hsk6S35ZqB9CACq9xnqeqp3zjMGjU7sT5L +a9qVjg6scTJC+NT2F5IYxPQe//HgVCdXxPFOfM6ihP6kiXO/VfOhOe/OhSSx1Q+6 +vK24Iegj5/Vu0JLMG8kJiWpe9xUx9bSi7X/BOhfWvCN8NuvAbp0uI6LrOi2ropjH +pTxslcUCgYEA2i0YbFa81L/aPysbhmmCedSrshssgEG68bI74rEdmOfv5nH9PsOh +bo09+6kNJMFGIAGUUDGTzcAMbY4KvRWCFqLIKu8oLyu1eOYWOh7n04K7ca/9QwYy +2s7CSxA91KM7RR2fWMfgxpr15kx29l4iWU8Zf0EjzrmTAiLT/bPMEBsCgYEA0YzO +oTOx8+XixTpC1JqU4Cbaz0UzJ0gkYg7snaSe09sXu4GbYggq/hZwBDokTcp7oe8k +D2pTOULh1fYDP/tfh6Ri/pLvFpz612GbEDcDcodlDmXAkbVZoScD26MosULANgTg +QrTxLAzzKFXZ7Wsbw3R75RB/u2qsi6M+b2wFnBsCgYAvIEaCQEoRek9eDaWoZunz +/ugHVK9MFOaYhnNBCBjoilDbagvVntQj2QZmcaGRKt5G05CBsfPHIZCNqXzQUvEC +iq7J91aqubo9HxX1/+77VOXALM97xr79XGPDawKwB4Ip77gXqTT4MUikMigQF008 +FUXgouVlJdiHQZag2lFduQKBgH/24bP1UqVjbCEO3ALixyk+8P4D/yHs3zL2dC4s +ekVblNmPYyjxXfe+Efey3bqXfPo9hCLZxirAmhLD4eYvhn3ZuA5IAjMn99KRK1Uy +kytcXSz2nCseuLY9khCNSWs+HQyf26dAwcopuk+WZbejYdfxCTuv4KC9mtLHBHic +WayjAoGAQlBF/4qmPN57JRyYAuKhLNKvFLAvx+nB0ceWRMy3KKGRLo3VwF56vbbr +cYHwds4FKlUZQN5KJ6dAjUwIYPsB7cwYjmijnVoVP8GYrrj1WHkkRMEgtkSgnY7A +19cSm3rtzaMwzjEqxEsHiV2xBm9K9Xn9JzkTgvMwLkvNLrstf4o= -----END RSA PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/ec-pkcs8.key b/unittest/fixtures/appletls/ec-pkcs8.key index e3edacde3..8dd88b536 100644 --- a/unittest/fixtures/appletls/ec-pkcs8.key +++ b/unittest/fixtures/appletls/ec-pkcs8.key @@ -1,5 +1,5 @@ -----BEGIN PRIVATE KEY----- -MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg7PiKZ5Zhg+sGzzH1 -U2FvX+7gimH6hMsvSkv2hnHimsGhRANCAARlxNONLD8pbXyFy/AAtgOo2QGxlpQY -3pYQY4NCIXpaN/QAPf5PDJqBIWdtNsrG5w1GDm3XkoXMT6AHOnpulVv8 +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOZ5kavaoFQJXIf/C +96usD7lm5R0hrDVir2/s1qrSs1GhRANCAARzlFxg1JK1/PiETlkJ6J9OcV2c+lzX +7gwDNippKi/xSgMoSF01UgwWz7YVZa+xKywm1leNsvEh1601HknTNcxq -----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/ec-sec1.key b/unittest/fixtures/appletls/ec-sec1.key index c66c81c2f..8d2e3afaa 100644 --- a/unittest/fixtures/appletls/ec-sec1.key +++ b/unittest/fixtures/appletls/ec-sec1.key @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIOz4imeWYYPrBs8x9VNhb1/u4Iph+oTLL0pL9oZx4prBoAoGCCqGSM49 -AwEHoUQDQgAEZcTTjSw/KW18hcvwALYDqNkBsZaUGN6WEGODQiF6Wjf0AD3+Twya -gSFnbTbKxucNRg5t15KFzE+gBzp6bpVb/A== +MHcCAQEEIDmeZGr2qBUCVyH/wverrA+5ZuUdIaw1Yq9v7Naq0rNRoAoGCCqGSM49 +AwEHoUQDQgAEc5RcYNSStfz4hE5ZCeifTnFdnPpc1+4MAzYqaSov8UoDKEhdNVIM +Fs+2FWWvsSssJtZXjbLxIdetNR5J0zXMag== -----END EC PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/encrypted-key.pem b/unittest/fixtures/appletls/encrypted-key.pem index 707297e2d..3f2157ae7 100644 --- a/unittest/fixtures/appletls/encrypted-key.pem +++ b/unittest/fixtures/appletls/encrypted-key.pem @@ -1,30 +1,30 @@ -----BEGIN ENCRYPTED PRIVATE KEY----- -MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQ3Vziw7buZE36o2dd -aoZxOQICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEPBOjTWPWiXRAO/u -npu1uRAEggTQ3RW4DR+2eq7srsj3VOMl4q1EvwVyuPa8At2uSoI2KUgsxZ0/Njje -SnHpG+WomXefG1ABwAqdyTwpSUiYVf0u5zPhAjYzRzPDFOOMSxNAGZ9N4dPXOyTq -bSghOgnuAvjuZOP5kJ2SIpgDNWZe6K5ehy4OBgNOnLXqGhzqdf3cWh8gyzjuddge -1YWkITvxT3kRxMooIeCvt2CzgfRWTG1Al0bafOrtWDHOrAEh/1Yjvab8I8eYbkCY -k/L+bpLWJE8zRgyLCCQZSHdaisBZPLn7MkfbuPfCJxmXVQwYEKvLj2GW95OpufVX -qn6qX6JJFO9wKOG0xK/IXO0VDqP4EsnqmLmYByKJf18kq/fjC8OoK4hY4oQbkmVE -qvf9145EqYQYIWcLyYwULu2M1sCPtjCs5D8k7k8ZeuSrqaDEn+mAuC14To22IxEN -K3U8Mr3K3Sd+21D3YnC1/aRaZZPO77V0LbRFbB3uazNlCBWuenCB3ranmbcGcku9 -uklZR6PafA8/clu68+Y/4xYTPA01xUCA6O7BH/gXKLoAS+O/HBcIkMaUjnhhVBIp -IGORKfrH0KgEy1H/o/VQn7H6ddGAXdsL4Ogt+yWertx5+5yImVe+txPfANOpcdpE -Q+n9cWwfN8Eak5hW9/i+09JvkKbb083XTxFvwzulgrZXsp0gGzDO990SscnIfsHv -tEG4QYI3x9Wzsd1PeN3epChRClUTUBuGTm9eh3ZkcFsbI2xAv4y70cSBarTte/ou -Fqbd9yxtPfwAJc1RFWgkzrhrLgvqfukE2Ok5V/1/p1WqCrQvBs5rFEA5rfcZDGrz -A6CHTtmqu0HNTcLJf75U/gsGnRmP2x8RMW8GNnMW4/wTLIeZFfH60M6UblY2xMVv -WXYwc+CrduTcW6VvLKD6ecIgbvjLmZmaOW3k5P7obYJRLPmt/0+Acbl28L5UcR1M -7yP0M0tXllUR5O2R+Mt5JXND776gZr4R37yCkI0I6VpjVups+5OBJyg/hkF1GSOn -WjnOxdyb7U5F8zkYT2rqWCjvpwUAzdE3CACzcCEvCTGLHpfUyV0Ja7E9FGHWRVRr -yo58f6BXNhM9pIGipAyI0OS7FU6c05IhsY2ylkepvLb9m8qp1bDqRRIg6Js/33Ws -XpSmXbCKuJrSA7d3nw2sojF9iV8jy4Qg01o0xfuXL30+rZbnZqeo5GBbc8Ov67WA -RW46jnEc/vvVclSTTnvobcf6k3MhrQkte6dResdxPNqsc8avbe42XNaVxETSo0vH -mQxRywcLITclB72qmxDsYQMwYQaLz108al9fs3yoQnxsYbZQqq9NvuYK9iZu+Uez -RPLEsQN70JObdkpEIkzIa7jXmTFXX/4NdurQQWbyhJG+N94FZk9zYBhl6MESRvBf -Xxd6tjcFk1djRMDJqIX0VB17bKA7RjOKj35FdnxRgF+YY70kpvnIAAoiNYIW32t+ -JgnBaKPt9YyDkC95BZFBNuzZzoEsbJzd7Ep/68J75Qh8PPZLiokaU/F2jSHJ4lQf -1fOm2oadN7TnhW1Nv8/id9Qz0i1bpLzTto98OsKx1bwkada3flhQwwJ5Wrmx/0k9 -r8Xc4Ef5wM6CsGqdfR8LAy9V8RAVq7OwuoCsW8KzRsL1beryC71PCNQ= +MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQxToiyK9AGJH9KTvD +HIvgYgICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEECftlVl+KScYNHmu +nQnu13YEggTQV3E3m4SjPY8kTUbiEbPuWy695LUFpmBoRyFwimbrpuE1TsOW0N1S +evYH0o/6aHsI6iB0O3M7wDzX3+BgK2ikYSwRJNVITbYwjr4RYy2bhCJpR3qhclqp +Am3n33tGZk3/FhfT/metuWbx/ZuaLNHc1y9rwQIsi6PF5jl6fBYsBJfQGlWZCHmx ++ZBRwIzjcvn9SB+I+hFaLwifyFI7Zvlc61Ibf2n+pHcHU4IIa7s3Y96OER3nyNv2 +/IXuSf/43Jbm/1oCtMKwzEgq4jvJvh0NYT77nSqvi+x6mJgDOnm6qtC59EaMkH+k +GEPkr18y/JH0TqI5YEfRLR2msQ9NEbjmhYQO8oCkdQOLx+Qb+6QLw0trfiA1+5vj ++7NP8oBQKl29ndJlh5ha5YLA1ELQ2NX40FM+OVhnGXAD82Ow+HbxnlRmR+YRGGPi ++v2X8uoQIKBm8F16V3jrYgr8sAF8KvI1Ha4o5pV/5UCqucr/Qf+HazCQSRIrRdDo +ona2ezC3bgWurLmSrqRcg+3jds6679ZdsHeu5SFbQH2K/wVD+qxP/0GejtncWPat +Xs7r1TgxD9gzHNbFdqbsvuN4na1kwYVHmBsZjj7VhO2iWXENQvbi4jwNePnuw1ku +wj8ZAqd48hcreZKauWCpxvZA3RdmuntQNlS/xVxAwCz9e9tWHVOgCL/kl3ODNeZ5 +epO6ubxr5lzI56Sj5CIyi2aJjqQ2N9TL83150tklagBTGuhlTNeouf6sdyZg4ZAv +PyFcTzRAoWa+ZMk/2FItSb9k3RorzvuKo2IPok7/uOdLvet15sAHD92wpHV/yGAI +nNcnHOtVaoklBcFGUApmwTQb/grAGkLQlDqIg7TwY4T0y0kCmp/+L5dbOqhs4KWe +Twrs4Yhs0GXAjyMZBkqARVjYVavY/yeWZkEyeihQn2icObxJKXgcFAMfarNTIOr6 +OetGI+OyY0f5RN4H7jW5a+wzlZd7uePCZFQFbUs3y3uo7vk31EwRGt9vWIG3C5Re +c8K6ndScfyJqYhDA6oEzs1VvySbSFnFQxTEURuMfqyxmP5u1OpEHRBjKTxKAocoy +NXn+TEcLfbJWAzkcVpje3pKfBIDZniBy2NxCuZENxODAHbhoJNM1yR5zO4ghUYH5 +Q7rvnpft4dPvyDfaq7+mktH/Q9olQ9z8ypODMDBKy6kdSErv4bdXH+67qfotema/ +vtjkt0LMRiBl7UwqhNx9LCsbkzGfWly7aMsk5Zt67xuJ1zIR4GMmdPW2z70zfn0K +7z/icM28NCwZCtyQqvDBS06BfXy/8tmGouZarxdR8Pf23CPhAOqZpkmx01+lJw45 +a+v4l/jK0nQqIlQHY9j9CANr6MVDq5eeFuxTHbwkRgQ5zzNCcpulYE2Z9ERxJ36X +2hvzh58u7JmLIn76LoE1cFBF7VZPgMMpbcHkP6vTcfzdRpqwyiaMX+XVfKiozF0L +4yvGf3SbiWn8qUbEq+bWPwMO89jRJWw89XrZN9MtFfhrIVlCHWCb+6yKAp99Xfzg +OI926Bo8i50wvc3IvyXamk+6j9zOc5D+9fI2JzepG+8vknxO6kHgpOjOm0SlpCkj +bmsdW3cCQ1JKLitXmqu6LU8mdfcghPvD3N9KaWfz/H9lCd5xoxvhLXk= -----END ENCRYPTED PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/generate.sh b/unittest/fixtures/appletls/generate.sh index 960450c37..a47ae2f37 100755 --- a/unittest/fixtures/appletls/generate.sh +++ b/unittest/fixtures/appletls/generate.sh @@ -24,7 +24,7 @@ printf '%s\n' \ 'keyUsage=critical,keyCertSign,cRLSign' \ 'subjectKeyIdentifier=hash' \ 'authorityKeyIdentifier=keyid,issuer' > "$tmp_dir/intermediate.ext" -openssl x509 -req -sha256 -days 36500 \ +openssl x509 -req -sha256 -days 365 \ -in "$tmp_dir/intermediate.csr" -CA "$fixture_dir/root.crt" \ -CAkey "$tmp_dir/root.key" -CAserial "$tmp_dir/root.srl" -CAcreateserial \ -out "$fixture_dir/intermediate.crt" -extfile "$tmp_dir/intermediate.ext" @@ -39,7 +39,7 @@ printf '%s\n' \ 'keyUsage=critical,digitalSignature,keyEncipherment' \ 'extendedKeyUsage=serverAuth' \ 'subjectAltName=DNS:localhost' > "$tmp_dir/server.ext" -openssl x509 -req -sha256 -days 36500 \ +openssl x509 -req -sha256 -days 365 \ -in "$tmp_dir/server.csr" -CA "$fixture_dir/intermediate.crt" \ -CAkey "$tmp_dir/intermediate.key" -CAserial "$tmp_dir/intermediate.srl" -CAcreateserial \ -out "$fixture_dir/server.crt" -extfile "$tmp_dir/server.ext" @@ -51,7 +51,7 @@ printf '%s\n' \ 'basicConstraints=critical,CA:false' \ 'keyUsage=critical,digitalSignature,keyEncipherment' \ 'extendedKeyUsage=clientAuth' > "$tmp_dir/client.ext" -openssl x509 -req -sha256 -days 36500 \ +openssl x509 -req -sha256 -days 365 \ -in "$tmp_dir/client.csr" -CA "$fixture_dir/root.crt" \ -CAkey "$tmp_dir/root.key" -CAserial "$tmp_dir/root.srl" \ -out "$fixture_dir/client.crt" -extfile "$tmp_dir/client.ext" diff --git a/unittest/fixtures/appletls/intermediate.crt b/unittest/fixtures/appletls/intermediate.crt index 4d2b2dd18..0e0520711 100644 --- a/unittest/fixtures/appletls/intermediate.crt +++ b/unittest/fixtures/appletls/intermediate.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDRDCCAiygAwIBAgIUa1xt7fbLCcces2WETU+Dj6XY6uIwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz -MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjArMSkwJwYDVQQDDCBsaWJodi1hcHBs -ZXRscy10ZXN0LWludGVybWVkaWF0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC -AQoCggEBALqhdB4aYuvfa/oKpswqsJ1Qfw1Kcl02ek21AzW9oCt2P4W+aQQXP5wK -GagRqrVQpb0WW7yF2PGU9asr3RpqhNWZidRARMuT/d87TPkd526pQbHC6TtnHF15 -HNvyZsm/mJ32szSKndDEc4JMc+X/VL3Pg6s60UHDCOqAz9sOUNF25cwAd/cpj+oT -7Hqucg9qvqITLd6VykKk8kJ36jyvE/ltuGToJ/ieA3KSqMW0Dpv9sqwGyUM792WC -8gpgeeC3Uj92nPCxqKDKkLatgoz7IK+xB7FtUZCPxtmhRhRHFLxW+FwgAN7HcY/c -PacBQIg5uMzrgJsyHFoxlGIQr1zLA4cCAwEAAaNmMGQwEgYDVR0TAQH/BAgwBgEB -/wIBADAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFH22Q3yuCTWaUPJB7lBIqGn1 -SBcCMB8GA1UdIwQYMBaAFIwb/SUp6CQ/drLu9TJOkr+CZ06xMA0GCSqGSIb3DQEB -CwUAA4IBAQCD1uOpUFCftbc0cb+cSgRbSIWj8zCh+Cbf7VWggDSZr1opxzxBeZw0 -axtdT9TIWZl3LmpCQKkHTOlzDvjiokh9o52T5ztgZ+T4e9zjKs93Qm8sjMHXTVUs -tYR8d480gsw0JstvGxe3O2EMrDNteKb6yDBhNlho57dyMCmzsSqvceA9OiTYRhdG -BiDxJVSlhBR0YWiwq0NdD2KR7zVpaSOHimVwpq9ilHxGXv0bri6BYkI3pNnhn8Kz -WDIqyfZwdfPgO6rRt5q9TccRtVoBOecWsHNunNoYhdNW4i5cxNXWN0v5HAKBfDkL -LitHx/SgxkG+bU5Q9sgBHhXwP/l+LI7t +MIIDQjCCAiqgAwIBAgIUUCbVWLU3xvd10p6EmaNbjLUfJLQwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAw +MTAxMTYxNloXDTI3MTAwMTAxMTYxNlowKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0 +bHMtdGVzdC1pbnRlcm1lZGlhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQDG9cDQkfFzXerFq0qhMKu4TsS8yZayBfdKbWk8kbjMf1HJHMEBuvp1DG/N +KeqOywRrVmMjupc7M9WmrPZaUHysQ4cqP4h6Ut+hJx7exkTs/Te+q4zH65yNjoAC +OzBHAsFGi+oTQD4YRFknRESFKV4pu1N48AZ2fjHytoYJfEItKrvUBHX3ADazgza1 +7FMl5HdvAMHWrVNjTJ7Xw/PVQz4iV331+2jxpSAV+sSEaL6ECRkr8zt5SuUhs6MB +yesDoFQ2mRq1FekI5hrcmuonZtss+3nRHgmeKJN3DsgUNcl/TN+5Xds5FHpf9Srl +FRBQBfP4hfGWRUrVfn52vcuXwY3LAgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8C +AQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQWwyFZgNvZ5n09iufG30bMNjyR +KzAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DANBgkqhkiG9w0BAQsF +AAOCAQEAtW8mE1j2owQRQ+xi/3JW1vD8vdQ9uj+bdYRjXjJUKQuut1ppO370dUH7 +3yFPprO/uPjSAfzHNJ7kG5ksXlDqU9zECAihfiGPr8Ohw9qvUrrpeFBlFFOpY1o3 +CYV+s3Sr63SI4eJDo/I9PkXCy6NU7eBt5+c3JzAyfQPhI4SWhRXUC2xKW0LJvuuc +08lwL6G4ZyYmniJxFBkNUvvmQEMzAXRcy6GmCMLM4Y5PnV/ysromqumKQiFPqC49 +7cyPTcWvKv5wS7RtNkjHF9IxQeRJeZEtyQJKnaXwbW2UWLd5le++Sl4Rc2QgBbxv +ElpykATo49xSDNaKZjQmU1694zli1Q== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/multi-ca.pem b/unittest/fixtures/appletls/multi-ca.pem index 5428834e8..1f18322f7 100644 --- a/unittest/fixtures/appletls/multi-ca.pem +++ b/unittest/fixtures/appletls/multi-ca.pem @@ -1,40 +1,40 @@ -----BEGIN CERTIFICATE----- -MIIDOTCCAiGgAwIBAgIUdsy7efSOuc3Tckn3MvtOPCjyz8wwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz -MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs -ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2 -AsbGXP0ZwKn6k/pZbBI9AbzG8UTj9M/lV6lugynolHAXweKFTPMkeF85ZbFKArPV -4CPCXRanlNH37gaeaT9imXcSyLdvTtpIwF/FpFtMbPKNeOLu7ci+SlB+20BWAUsq -flmogmmq5eGKaPA9eEQILDuPbjzAvowcz413JkKrUFle4KriRb1dN3eAKm7QnCMx -hDLjSCcxjj6S2lGLi1cuvs9FS73jyx9TaCMv095jhLeSoF8Jfz/67HxIW/DFVl9d -6KVpJdToHxZyqfaJ3iRQXsbMq0Wh8fJP9ac8LORFOD7/Seo5VekgTBZOhE5SwfPC -7lYG94SDeLXpVU6gntIVAgMBAAGjYzBhMB0GA1UdDgQWBBSMG/0lKegkP3ay7vUy -TpK/gmdOsTAfBgNVHSMEGDAWgBSMG/0lKegkP3ay7vUyTpK/gmdOsTAPBgNVHRMB -Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAmIPm -3TWnQ3sF+yYgsnQhWdBkC0bAVXsCtdpgwCXujIfjsklVa7i93iXC4ypH92C7+jzw -NWIYbbG2Kv2NYc5H7TYUMO57nURC7hPh4pRse0yW+EdfpHnb6tM65mWwoE8ECuBD -3TdHiD97NXlODQhdhnxGsg8qVJ8h7Tcll8BARzfumVxL+78iQiJOTR0haRdIip+1 -+++2AIv82MkMSh18JISg4ym8DQjMYnY0I/SasQCWkF/V2dsjzwjX5qRU4mBN71Ub -rgUI+8m0yDCYgf5fyKbkBkoVjvqorVed/SXhyMzGl4peFCC5u2ijTRwoFs3lPMCo -FTAq4PmJPf0CVhgrog== +MIIDOTCCAiGgAwIBAgIUaNSS3l3MNTJvIi7E+jzTF57vBxswDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw +MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs +ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDR +AaPFPG9m57ORbo5elu+23P/CdHJgOu8Xgga81/V35vo/sv3Pwhx60kVLxKTrsEVR +MjYqSPyoDOHMQZhrK80qdt/I4NYgb+CCqk7yt2m28yTXFPo5lAKlez5p6bTL5kvi +0u3fv96Tebu1v7cI183x3MgBMvMhcs8GkJHJIx0d5YNbG2uiiS7+BokfdHzQBKzA +YaXnngJAq+CxJ6HhgMNg3UpcbzgrAml7/n1DJgdsW5ITiS+HUUuHaNv+CnW5XlGY +kMDITJzVlJCOvKG116HnZ5BEYzt5FRRkEsUVhA6+t1uAMYlQBTqnDQHk2ep3WLcA +KHBGCfP5T5pDVMh811wtAgMBAAGjYzBhMB0GA1UdDgQWBBTjTUJODoeym8/z5rR/ +bPbq9Mfk/DAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DAPBgNVHRMB +Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAQb/L +SvAjFOCO0QYV3O3VNypEH4lDGfptVSAZbVb0+C5cWY9/bC88D8yke2vGkgS+IkOz +YKDLkYxDQsYpaIrGYtsruDelgNEPww8m26Aps2ciuWW+oCgToPjvea146NdqrBT8 +d9AbuZEGrQkn+JSz6Qe3sE4I3t8CjLZHEY7YK7y8jSOdkDVvc4TxMxEuiVBbQMSR +QddtXv2Qa20G4kCrn/EJMEGzlcJwkKtsQafT/aZBeySUIjM35P3tb/5JKjhERihS +NJPLU5G0kKhh2m3BwAT5ugja+846zQqSe69ehiMaLFjWTIphZS7EGFexFZoSSBXD +755LxDlauvz3rREOUg== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIDOzCCAiOgAwIBAgIUVAOKBiVPejb5caic5l+eJveEnAUwDQYJKoZIhvcNAQEL -BQAwJDEiMCAGA1UEAwwZbGliaHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAgFw0yNjA5 -MzAxOTI3MDFaGA8yMTI2MDkwNjE5MjcwMVowJDEiMCAGA1UEAwwZbGliaHYtYXBw +MIIDOzCCAiOgAwIBAgIUGFgaO7KB7AD4CoR+ZKzj4gsxd9gwDQYJKoZIhvcNAQEL +BQAwJDEiMCAGA1UEAwwZbGliaHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAgFw0yNjEw +MDEwMTE2MTZaGA8yMTI2MDkwNzAxMTYxNlowJDEiMCAGA1UEAwwZbGliaHYtYXBw bGV0bHMtd3Jvbmctcm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB -AN9WxNrZ0pUrLVu2WriBgLDbVQLfIUlYHlQ6o1PVt6bbPoQoeVNfXCX1dV0DeJ3p -wDgnbDGRvpZmyl3vDGHsvnO7ICgAWz2W9YiM9WXOdb+a6FJ19hRlfrVY69MwP6qF -xNOcpxxHOL++N+YRwRgRArIx7/I4yWEWF5Qgf92HxxO4VOFdvSvgFXRHizDIImTH -EMNtUqW1Gl6a7ktDaPpiaX9fe/If0rlpO071A3FOhtuc3iJfF9nGu2bwdHreST9H -WSus8ObaPI3to+DnpGcU8kZKiq3pZHy/NWQPT1iKyj9IvE+VfaTuym4TgVBiY/ev -5u3Ij7joMAHm/tvhBgDWCqkCAwEAAaNjMGEwHQYDVR0OBBYEFC+6qgDhXcZ2pM9X -tPuj+F24AfvcMB8GA1UdIwQYMBaAFC+6qgDhXcZ2pM9XtPuj+F24AfvcMA8GA1Ud -EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQA5 -3k2v79uWtYcLq1jvrPz2Uf6tsJdAkFngyqEW1wVg/ONAwMszrUI+K6AC3AazJO0B -D0nM5ocDK3rkXeJzkZYhdQa1H67f+1+714iyov2tK4cJaKVsBr3kz5eQhwexkuJr -15rkb/EM+z49PEl2uVsji4ivWhEmgD8Yu1G7mjZMCGPxz+4MBXSKw7xLjbloYAq7 -HjNsTK+C1no6EmU0mXwiqBhASFAD5OqCLzTzDPEvtYuRoG7GSb27IyG+gtOokhSn -uxuNjRbS1iE1QeNDsXryG0tuWqvHR+CQB7bTsedsqiRXRpEPbs/lfnKci20sI8iC -8aFaMoGLa/bzDHlj/ShT +AI6w0DdMs8ddB/XF+c8Ufr5Npc08HLDNbfOd3twDGXKW3oUoMe0gL1zfUZaGUdVi +g75PO79aJDDaiUSVjfUclLeV+06SAJcQcE/gk54PVwdNIfyiLYMOBp68KKZSZ3/y +4yzfnFxw88u1zIW/a1kdnMzrBOYRePoGAk+VpdpwP7blSaeUcrdy0Xi91DhPH7yf +guraCb4dWPDSRNZeBQOIOo+mnGOz8MX45uOZcXvscU2ysAYHUw7oat7xey5em6aJ +UbKKDV2P2gIxCEABHCT4UrP551u5Azkauc/ifbhu05ei0uyJ62x+Jpo2W9I4RNKX +7tENCos0+6ZJguP/rOqcTG0CAwEAAaNjMGEwHQYDVR0OBBYEFOQFxEzRNwt6CI8o +y8YveRoTTSWvMB8GA1UdIwQYMBaAFOQFxEzRNwt6CI8oy8YveRoTTSWvMA8GA1Ud +EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAR +DlVDu3IGNVuF4AXw1z2Kxts6vZOU7kp5cH0n3aKonrIbiuT+NsMaw/Bz0wchiWJL +PanINnxxzN2tjhtqbtJSFcGEULj5S8oj42igFuCPlRyj4qmd/bZNZXj2MSGEDXzG +Auhr2V0EKdyuQLLTdXSR268zFtZ8ywM/+D5bWmWRSHnPFOrZTAgEliUoSJAO/9+j +ajtkriUGfb4dXPoKvXtLLR2b95XTCWBpXLPpF8H+90jEaYhu+f8GeGUikqEyJAzE +vy8tMxf2ZlTHyW4hOSrymJWBzCUjzpezJOX6icDsRiyTVueEvSjzFUlUqpDtlFp2 +aGx0jSpWQOVxsFyXlQ0a -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/root.crt b/unittest/fixtures/appletls/root.crt index 34c0fc273..096e53443 100644 --- a/unittest/fixtures/appletls/root.crt +++ b/unittest/fixtures/appletls/root.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDOTCCAiGgAwIBAgIUdsy7efSOuc3Tckn3MvtOPCjyz8wwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz -MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs -ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2 -AsbGXP0ZwKn6k/pZbBI9AbzG8UTj9M/lV6lugynolHAXweKFTPMkeF85ZbFKArPV -4CPCXRanlNH37gaeaT9imXcSyLdvTtpIwF/FpFtMbPKNeOLu7ci+SlB+20BWAUsq -flmogmmq5eGKaPA9eEQILDuPbjzAvowcz413JkKrUFle4KriRb1dN3eAKm7QnCMx -hDLjSCcxjj6S2lGLi1cuvs9FS73jyx9TaCMv095jhLeSoF8Jfz/67HxIW/DFVl9d -6KVpJdToHxZyqfaJ3iRQXsbMq0Wh8fJP9ac8LORFOD7/Seo5VekgTBZOhE5SwfPC -7lYG94SDeLXpVU6gntIVAgMBAAGjYzBhMB0GA1UdDgQWBBSMG/0lKegkP3ay7vUy -TpK/gmdOsTAfBgNVHSMEGDAWgBSMG/0lKegkP3ay7vUyTpK/gmdOsTAPBgNVHRMB -Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAmIPm -3TWnQ3sF+yYgsnQhWdBkC0bAVXsCtdpgwCXujIfjsklVa7i93iXC4ypH92C7+jzw -NWIYbbG2Kv2NYc5H7TYUMO57nURC7hPh4pRse0yW+EdfpHnb6tM65mWwoE8ECuBD -3TdHiD97NXlODQhdhnxGsg8qVJ8h7Tcll8BARzfumVxL+78iQiJOTR0haRdIip+1 -+++2AIv82MkMSh18JISg4ym8DQjMYnY0I/SasQCWkF/V2dsjzwjX5qRU4mBN71Ub -rgUI+8m0yDCYgf5fyKbkBkoVjvqorVed/SXhyMzGl4peFCC5u2ijTRwoFs3lPMCo -FTAq4PmJPf0CVhgrog== +MIIDOTCCAiGgAwIBAgIUaNSS3l3MNTJvIi7E+jzTF57vBxswDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw +MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs +ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDR +AaPFPG9m57ORbo5elu+23P/CdHJgOu8Xgga81/V35vo/sv3Pwhx60kVLxKTrsEVR +MjYqSPyoDOHMQZhrK80qdt/I4NYgb+CCqk7yt2m28yTXFPo5lAKlez5p6bTL5kvi +0u3fv96Tebu1v7cI183x3MgBMvMhcs8GkJHJIx0d5YNbG2uiiS7+BokfdHzQBKzA +YaXnngJAq+CxJ6HhgMNg3UpcbzgrAml7/n1DJgdsW5ITiS+HUUuHaNv+CnW5XlGY +kMDITJzVlJCOvKG116HnZ5BEYzt5FRRkEsUVhA6+t1uAMYlQBTqnDQHk2ep3WLcA +KHBGCfP5T5pDVMh811wtAgMBAAGjYzBhMB0GA1UdDgQWBBTjTUJODoeym8/z5rR/ +bPbq9Mfk/DAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DAPBgNVHRMB +Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAQb/L +SvAjFOCO0QYV3O3VNypEH4lDGfptVSAZbVb0+C5cWY9/bC88D8yke2vGkgS+IkOz +YKDLkYxDQsYpaIrGYtsruDelgNEPww8m26Aps2ciuWW+oCgToPjvea146NdqrBT8 +d9AbuZEGrQkn+JSz6Qe3sE4I3t8CjLZHEY7YK7y8jSOdkDVvc4TxMxEuiVBbQMSR +QddtXv2Qa20G4kCrn/EJMEGzlcJwkKtsQafT/aZBeySUIjM35P3tb/5JKjhERihS +NJPLU5G0kKhh2m3BwAT5ugja+846zQqSe69ehiMaLFjWTIphZS7EGFexFZoSSBXD +755LxDlauvz3rREOUg== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/server-chain.pem b/unittest/fixtures/appletls/server-chain.pem index dfb5fd72b..980a79162 100644 --- a/unittest/fixtures/appletls/server-chain.pem +++ b/unittest/fixtures/appletls/server-chain.pem @@ -1,40 +1,40 @@ -----BEGIN CERTIFICATE----- -MIIDXDCCAkSgAwIBAgIUesmG0zycKPRO5//Ww3V2wBsRbrIwDQYJKoZIhvcNAQEL +MIIDWjCCAkKgAwIBAgIUJPkTLlf7usDaSbjoaiSCcEMohDcwDQYJKoZIhvcNAQEL BQAwKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUw -IBcNMjYwOTMwMTkyNzAwWhgPMjEyNjA5MDYxOTI3MDBaMBQxEjAQBgNVBAMMCWxv -Y2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJuAfYq+tA/ -IjaWxGh2n45kxdriLcQGcuwCtq705+vZS1axBDg65F/pRHZ/r24qyd8YCrMUW5jk -AXBlg0ZwONy0HUnAknTIwoDyM78VWnQ6HAl2LIFQzX5s3BJ9j+na3vpjb4uW2LCd -+3JPDKYQ4dSlqNge+9nQAMmuE5OYrc4+TvEMwlyBPGgqQpbOa2r+GbP9s5Re88BO -UeaABymfwjTpyBSWAgjXXIT/emQKe/nFbYqPOsbVzKsQk3XhuLDdZ6j5i23HKtNj -vMAngYCwf+6VJK1/sCceO3EN9BFZcMc1AWNuU3INFNUMxOjD4p+oYygBz/f0qOgZ -1G8P0b+A7/8CAwEAAaOBjDCBiTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF -oDATBgNVHSUEDDAKBggrBgEFBQcDATAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYD -VR0OBBYEFL7nojwnBsrbpNrsV5D8puq+E0+sMB8GA1UdIwQYMBaAFH22Q3yuCTWa -UPJB7lBIqGn1SBcCMA0GCSqGSIb3DQEBCwUAA4IBAQBS0HokPSmrhhNU9OpF9N4n -suxW7gT2Q9hSjG7Quct21NuiXLlPLkC4dqNyKwFfTZPm8fYacVzEb6k+3zcIlOQI -vf0U1+tRfNd6RdZkf6+2W5iWaTXQYieZ82TPvkv1TWhFeskXd93Fw9ir+3pCCF2M -c5GNfSZz3iNOOGFbPvvJfGHppqO5ggx6e3hOoArmLc/mvTNkptlIxpU/DseWgo14 -PdXgkuBjjhJexBapTDkk12jzwCNjFUvPdfy85mR7tH8hH98S9HChrZSXd3JT4p+F -g5hv5XzVWUBPyirrVb5wZMI10Z2OA1d80OSUBUUg4j40V4wg/ViTrU1weRjPufGC +HhcNMjYxMDAxMDExNjE2WhcNMjcxMDAxMDExNjE2WjAUMRIwEAYDVQQDDAlsb2Nh +bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqBwfTboti1xTt +TjmJ2cniO8QhAYTE1JON+k7Qe3WUqn/CZCdxZad61pO8UXesTdKrqs0Acj6McSdg +h4bikyG50CnonUAkIONx8uS1mTmStdCiI04HdHGAVqKMFYEH4bmCmMnN+JzGJ5IM +R8f1bscNdH/HxHZyKFmJ/GY9tjPVWESztSd2s3Commkhw9A5HmGnF64+UeHxQeK1 +k2TjY4Mv9UxvfxO0YfbwEP35ePCJ2Q+e1htrLatcem5xiTWrJBqDM49LvsFX3Snz +nsD8gCrMGlIf4pt1/qpy5JPqxOWqgtjl78otTQvpkJjfZ8+OS1FOpWRoqxJz7GC8 +hJrM3PIjAgMBAAGjgYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAw +EwYDVR0lBAwwCgYIKwYBBQUHAwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1Ud +DgQWBBRU+ynMt8p8+bI0ZpdG3N0vSrCXFDAfBgNVHSMEGDAWgBQWwyFZgNvZ5n09 +iufG30bMNjyRKzANBgkqhkiG9w0BAQsFAAOCAQEAJUQ0Ozhyz4iWmO0F/umfAeGq +93DPAFFwVW8s8P1FV16XnoWL89jNDvCMsaRfYLRONwtu3WgvhLePMEiQ3j8oM4FM +k0Rv2aZdvquNU7+zar3Zo9lsVsAGE3pBqp75j6jmHjO9Jl0RTB9vuO81Xwha2lRZ +9ijpmLUeHiI+ogL1PCyfqzduv5I8bUNLkzv/3vWXs9342pP5WRjC6XRPP/6yfXj7 ++q9Bm+ptfkC+pQldAajXHqZZ9rz5UlwTzzrkoS68nsOCRo8zxkcGyIf6mqoywVFp +6xrQ7Za9kPLjC+UN8/pRMPzXtWNIN2Mm9j4/Rto01VV/+Jw/q4YoRCcDvgpkSw== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIDRDCCAiygAwIBAgIUa1xt7fbLCcces2WETU+Dj6XY6uIwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MDkz -MDE5MjcwMFoYDzIxMjYwOTA2MTkyNzAwWjArMSkwJwYDVQQDDCBsaWJodi1hcHBs -ZXRscy10ZXN0LWludGVybWVkaWF0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC -AQoCggEBALqhdB4aYuvfa/oKpswqsJ1Qfw1Kcl02ek21AzW9oCt2P4W+aQQXP5wK -GagRqrVQpb0WW7yF2PGU9asr3RpqhNWZidRARMuT/d87TPkd526pQbHC6TtnHF15 -HNvyZsm/mJ32szSKndDEc4JMc+X/VL3Pg6s60UHDCOqAz9sOUNF25cwAd/cpj+oT -7Hqucg9qvqITLd6VykKk8kJ36jyvE/ltuGToJ/ieA3KSqMW0Dpv9sqwGyUM792WC -8gpgeeC3Uj92nPCxqKDKkLatgoz7IK+xB7FtUZCPxtmhRhRHFLxW+FwgAN7HcY/c -PacBQIg5uMzrgJsyHFoxlGIQr1zLA4cCAwEAAaNmMGQwEgYDVR0TAQH/BAgwBgEB -/wIBADAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFH22Q3yuCTWaUPJB7lBIqGn1 -SBcCMB8GA1UdIwQYMBaAFIwb/SUp6CQ/drLu9TJOkr+CZ06xMA0GCSqGSIb3DQEB -CwUAA4IBAQCD1uOpUFCftbc0cb+cSgRbSIWj8zCh+Cbf7VWggDSZr1opxzxBeZw0 -axtdT9TIWZl3LmpCQKkHTOlzDvjiokh9o52T5ztgZ+T4e9zjKs93Qm8sjMHXTVUs -tYR8d480gsw0JstvGxe3O2EMrDNteKb6yDBhNlho57dyMCmzsSqvceA9OiTYRhdG -BiDxJVSlhBR0YWiwq0NdD2KR7zVpaSOHimVwpq9ilHxGXv0bri6BYkI3pNnhn8Kz -WDIqyfZwdfPgO6rRt5q9TccRtVoBOecWsHNunNoYhdNW4i5cxNXWN0v5HAKBfDkL -LitHx/SgxkG+bU5Q9sgBHhXwP/l+LI7t +MIIDQjCCAiqgAwIBAgIUUCbVWLU3xvd10p6EmaNbjLUfJLQwDQYJKoZIhvcNAQEL +BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAw +MTAxMTYxNloXDTI3MTAwMTAxMTYxNlowKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0 +bHMtdGVzdC1pbnRlcm1lZGlhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQDG9cDQkfFzXerFq0qhMKu4TsS8yZayBfdKbWk8kbjMf1HJHMEBuvp1DG/N +KeqOywRrVmMjupc7M9WmrPZaUHysQ4cqP4h6Ut+hJx7exkTs/Te+q4zH65yNjoAC +OzBHAsFGi+oTQD4YRFknRESFKV4pu1N48AZ2fjHytoYJfEItKrvUBHX3ADazgza1 +7FMl5HdvAMHWrVNjTJ7Xw/PVQz4iV331+2jxpSAV+sSEaL6ECRkr8zt5SuUhs6MB +yesDoFQ2mRq1FekI5hrcmuonZtss+3nRHgmeKJN3DsgUNcl/TN+5Xds5FHpf9Srl +FRBQBfP4hfGWRUrVfn52vcuXwY3LAgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8C +AQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQWwyFZgNvZ5n09iufG30bMNjyR +KzAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DANBgkqhkiG9w0BAQsF +AAOCAQEAtW8mE1j2owQRQ+xi/3JW1vD8vdQ9uj+bdYRjXjJUKQuut1ppO370dUH7 +3yFPprO/uPjSAfzHNJ7kG5ksXlDqU9zECAihfiGPr8Ohw9qvUrrpeFBlFFOpY1o3 +CYV+s3Sr63SI4eJDo/I9PkXCy6NU7eBt5+c3JzAyfQPhI4SWhRXUC2xKW0LJvuuc +08lwL6G4ZyYmniJxFBkNUvvmQEMzAXRcy6GmCMLM4Y5PnV/ysromqumKQiFPqC49 +7cyPTcWvKv5wS7RtNkjHF9IxQeRJeZEtyQJKnaXwbW2UWLd5le++Sl4Rc2QgBbxv +ElpykATo49xSDNaKZjQmU1694zli1Q== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/server-pkcs1.key b/unittest/fixtures/appletls/server-pkcs1.key index 34aa7f729..8dfb8ceec 100644 --- a/unittest/fixtures/appletls/server-pkcs1.key +++ b/unittest/fixtures/appletls/server-pkcs1.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEowIBAAKCAQEAwm4B9ir60D8iNpbEaHafjmTF2uItxAZy7AK2rvTn69lLVrEE -ODrkX+lEdn+vbirJ3xgKsxRbmOQBcGWDRnA43LQdScCSdMjCgPIzvxVadDocCXYs -gVDNfmzcEn2P6dre+mNvi5bYsJ37ck8MphDh1KWo2B772dAAya4Tk5itzj5O8QzC -XIE8aCpCls5rav4Zs/2zlF7zwE5R5oAHKZ/CNOnIFJYCCNdchP96ZAp7+cVtio86 -xtXMqxCTdeG4sN1nqPmLbccq02O8wCeBgLB/7pUkrX+wJx47cQ30EVlwxzUBY25T -cg0U1QzE6MPin6hjKAHP9/So6BnUbw/Rv4Dv/wIDAQABAoIBAAaZFRf1fW1ztwWD -OEcTP3bllJFI+6SbU2sO7IQja3tldFkMyMfft8BJejlLO/jRGuinODW7iyA1HJdj -2oCZblSPCC9oiY/NAEy/62Ggp+Ep16m6iOgahd60cwNtn2SgONDmbvKdu9zCf7Xx -WMyJ5iABPymWY5WQqXYuohtwIvXMuD0OdOydcycgrrGj1iyG687yOMYlTW8IKtmH -W434H8M2HND34fb5z8gKub7R69BTbXklF9DGFLNIseq+7U7D3IISBvenLGMdQXv3 -G8arHmpC7Um6UjTvBU2TJpJGSkovIwkzBftKsNA0qDrphk0L3+uidXPjxGHwj60q -Er5RwwECgYEA/X2cDCS4+OQnGHYQCe9VnjOO/UzYfyEd+c8I3i/eJK3DOO37MHRQ -p06IIKIqSkV91VtrJO2GQ/VPdLjxJrdFhctowDIeh1J7FgQTGVJK4UWQSx3HPR2U -Amkj1a+x1C7ANYqnv+ACTBTUVHxWWLsNTMxKUivLqJULjhpebs1yUpcCgYEAxFq6 -JyFohUp6NOkzWhMDm/o2klLMB3YGsEyfF8lyrqPxJVt5VHli7+9FaxNpGYDMc76A -D6X8BrYN37kovJmwXmuMEfI0JRT6igwgaG/nzBWGvlIRUfjStqkDbPODLDITgTfZ -FobqFNlf/HHARtWfHrPYhG8DNutZmXhnumHiQtkCgYAxhU9t4+Kq5M9qbO4XMsVU -IZhmjZOhylNz0OlXlpxcKAICZiNzRNXYyXO4hFWkqsy5WKGm1iwrrIm4MMUTniwb -xjARk/j40LkxBNzCTpxIQ/G7avbYTqXyjp2siiVAYV21WAALcPSh7lPIqX2o2enw -PdyrDtk7dtqKCUa3eLVDwwKBgQCjWXsN/KwQX0JFbE/tOm5BP6pQlpLoDhdIaaXc -yxkeEoMV+gB49zcItnyAtLg1oEH2dF/jJMoC50epfEdYh18DXeM8NsuMoeRAHhCD -8bzbunjLMkj4cdESZo7T/817Yfl6AXUXWYu5ZpGE2TkFdMgYabPRkO0Srj5u/40D -sFTkGQKBgG0ErBfZ/fLlaFKuUg/15QmLtbthq4pBodYTlEwCls561x2c9lin/b4Q -DnCiXeh/kAefAKnFGvXNJUiAVgC0p25HfviYC+zQn3zhGdYX0oypWvfhzo/gBF5/ -Hejz474qi/GemqOzhnlpcsYfLhmYVYJvIiPxNUN+xt0ousHYc9iy +MIIEpAIBAAKCAQEAqgcH026LYtcU7U45idnJ4jvEIQGExNSTjfpO0Ht1lKp/wmQn +cWWnetaTvFF3rE3Sq6rNAHI+jHEnYIeG4pMhudAp6J1AJCDjcfLktZk5krXQoiNO +B3RxgFaijBWBB+G5gpjJzficxieSDEfH9W7HDXR/x8R2cihZifxmPbYz1VhEs7Un +drNwqJppIcPQOR5hpxeuPlHh8UHitZNk42ODL/VMb38TtGH28BD9+XjwidkPntYb +ay2rXHpucYk1qyQagzOPS77BV90p857A/IAqzBpSH+Kbdf6qcuST6sTlqoLY5e/K +LU0L6ZCY32fPjktRTqVkaKsSc+xgvISazNzyIwIDAQABAoIBAAMDwOXEzf/gpGRY +wLhq/iNev+l952a+Bie8Sm1z4u/R3hYKRJDEJqYM6+2o3CBX+OZGTwA1BlrjHrmd +bYzS4wQyZqvTLfH2C1JX5io6H0U0qBBX4+hJ7kFCR/uH3hPPssRYBSv7vnvc87/3 +/dmiLzFT4XgfSaJYiM3jhcSOWHjt4k9j2uoSFjoGBRGvf1qHyNlaxdqKSvX1cwco +xvnXFXbrwkY+OHOtrabMXtmhN4/JPNcf6PYdx8BBRQ//MRspkaDl0VWWOSryxyP9 +6w2ezWNezhZ+CiV4r7AcqSWK9lsoHcVUfZfIbSpS7yKYr4CLT+3edqxjZZQK8kGl +tw44LXECgYEA36p8jY/Ay7X0v5gmYa75QgBY2yt1LX5e5lHSQF666+SyzFgZMRzz +PPIHFUVyJkxGvJ9egyvjBCYttItYg1Xp5UOu0Tzn56XupelU2uBvHM2ruIXvICit +VDlkHlH+bTcZEC5opTGzT4uUFPTQqya9YNksVjCOH4ktslsXd3RYtKcCgYEAwpt4 +bIjgEqNIApuOOMcj8EELqrAhjS2eePNwer5d1r398OO8iLo2eY6OnOqmCCWaHgsy +1s81+SjbMlmTl9FVWihJpfR/4c8GSiZBS/6Tsk6VDaOd3FiXI9FwUdybT+M5/idj +QD2wcGpNRJIQu0QgHueBv5nqSPYV26I0JK6bOiUCgYEAoHQmzEtPTRSokvYsurES +obWsCPcBJfTdUa9q/MC4qde0KQIeeGxDVvpt+GWMgUsBB/nwjHtkbaqR6U553iY5 +GD7Y38Qovbb9IErmk+qj627kfQigRlrIFX7igxnhQypesYwJiFDCSRNh1TLXq6Cs +BRlnRCGrI5Z+kM/mYsy1gksCgYB2HitPpRxr85MnkgcWyzgzASf1qAYVTJUdUJT6 +y0TlrFfPuEqcqnmZ+j7xWzL/SuNqTN3Ep+xYmMXCn8AHq9UkbcOV6PsdsaxdoS6M +064N0ciCiMauEU9bPCnyZfYW3RI8Augo+8h10u+nKQjiwQzF9To5c1BSjJrjvmXr +xdcNyQKBgQDXBKQyms7LPHZa+AB/1o2tPbU/4To85d3GlcfZM7FCZOVOXLNt0AZ7 +fKcLMBaCNfIdNhI4ZNSc/OD4lX+SCpVSF7JMbwpVfPP2Y+M/z5YiWtmQFL/D3I78 +clhzyW/og/OR0exVWfwTPplhvxzbigO8orgTCRyMOhSwhYhIb7g/pQ== -----END RSA PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/server-pkcs8.key b/unittest/fixtures/appletls/server-pkcs8.key index 551759bcd..dc810c8f9 100644 --- a/unittest/fixtures/appletls/server-pkcs8.key +++ b/unittest/fixtures/appletls/server-pkcs8.key @@ -1,28 +1,28 @@ -----BEGIN PRIVATE KEY----- -MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDCbgH2KvrQPyI2 -lsRodp+OZMXa4i3EBnLsArau9Ofr2UtWsQQ4OuRf6UR2f69uKsnfGAqzFFuY5AFw -ZYNGcDjctB1JwJJ0yMKA8jO/FVp0OhwJdiyBUM1+bNwSfY/p2t76Y2+Lltiwnfty -TwymEOHUpajYHvvZ0ADJrhOTmK3OPk7xDMJcgTxoKkKWzmtq/hmz/bOUXvPATlHm -gAcpn8I06cgUlgII11yE/3pkCnv5xW2KjzrG1cyrEJN14biw3Weo+YttxyrTY7zA -J4GAsH/ulSStf7AnHjtxDfQRWXDHNQFjblNyDRTVDMTow+KfqGMoAc/39KjoGdRv -D9G/gO//AgMBAAECggEABpkVF/V9bXO3BYM4RxM/duWUkUj7pJtTaw7shCNre2V0 -WQzIx9+3wEl6OUs7+NEa6Kc4NbuLIDUcl2PagJluVI8IL2iJj80ATL/rYaCn4SnX -qbqI6BqF3rRzA22fZKA40OZu8p273MJ/tfFYzInmIAE/KZZjlZCpdi6iG3Ai9cy4 -PQ507J1zJyCusaPWLIbrzvI4xiVNbwgq2YdbjfgfwzYc0Pfh9vnPyAq5vtHr0FNt -eSUX0MYUs0ix6r7tTsPcghIG96csYx1Be/cbxqseakLtSbpSNO8FTZMmkkZKSi8j -CTMF+0qw0DSoOumGTQvf66J1c+PEYfCPrSoSvlHDAQKBgQD9fZwMJLj45CcYdhAJ -71WeM479TNh/IR35zwjeL94krcM47fswdFCnToggoipKRX3VW2sk7YZD9U90uPEm -t0WFy2jAMh6HUnsWBBMZUkrhRZBLHcc9HZQCaSPVr7HULsA1iqe/4AJMFNRUfFZY -uw1MzEpSK8uolQuOGl5uzXJSlwKBgQDEWronIWiFSno06TNaEwOb+jaSUswHdgaw -TJ8XyXKuo/ElW3lUeWLv70VrE2kZgMxzvoAPpfwGtg3fuSi8mbBea4wR8jQlFPqK -DCBob+fMFYa+UhFR+NK2qQNs84MsMhOBN9kWhuoU2V/8ccBG1Z8es9iEbwM261mZ -eGe6YeJC2QKBgDGFT23j4qrkz2ps7hcyxVQhmGaNk6HKU3PQ6VeWnFwoAgJmI3NE -1djJc7iEVaSqzLlYoabWLCusibgwxROeLBvGMBGT+PjQuTEE3MJOnEhD8btq9thO -pfKOnayKJUBhXbVYAAtw9KHuU8ipfajZ6fA93KsO2Tt22ooJRrd4tUPDAoGBAKNZ -ew38rBBfQkVsT+06bkE/qlCWkugOF0hppdzLGR4SgxX6AHj3Nwi2fIC0uDWgQfZ0 -X+MkygLnR6l8R1iHXwNd4zw2y4yh5EAeEIPxvNu6eMsySPhx0RJmjtP/zXth+XoB -dRdZi7lmkYTZOQV0yBhps9GQ7RKuPm7/jQOwVOQZAoGAbQSsF9n98uVoUq5SD/Xl -CYu1u2GrikGh1hOUTAKWznrXHZz2WKf9vhAOcKJd6H+QB58AqcUa9c0lSIBWALSn -bkd++JgL7NCffOEZ1hfSjKla9+HOj+AEXn8d6PPjviqL8Z6ao7OGeWlyxh8uGZhV -gm8iI/E1Q37G3Si6wdhz2LI= +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCqBwfTboti1xTt +TjmJ2cniO8QhAYTE1JON+k7Qe3WUqn/CZCdxZad61pO8UXesTdKrqs0Acj6McSdg +h4bikyG50CnonUAkIONx8uS1mTmStdCiI04HdHGAVqKMFYEH4bmCmMnN+JzGJ5IM +R8f1bscNdH/HxHZyKFmJ/GY9tjPVWESztSd2s3Commkhw9A5HmGnF64+UeHxQeK1 +k2TjY4Mv9UxvfxO0YfbwEP35ePCJ2Q+e1htrLatcem5xiTWrJBqDM49LvsFX3Snz +nsD8gCrMGlIf4pt1/qpy5JPqxOWqgtjl78otTQvpkJjfZ8+OS1FOpWRoqxJz7GC8 +hJrM3PIjAgMBAAECggEAAwPA5cTN/+CkZFjAuGr+I16/6X3nZr4GJ7xKbXPi79He +FgpEkMQmpgzr7ajcIFf45kZPADUGWuMeuZ1tjNLjBDJmq9Mt8fYLUlfmKjofRTSo +EFfj6EnuQUJH+4feE8+yxFgFK/u+e9zzv/f92aIvMVPheB9JoliIzeOFxI5YeO3i +T2Pa6hIWOgYFEa9/WofI2VrF2opK9fVzByjG+dcVduvCRj44c62tpsxe2aE3j8k8 +1x/o9h3HwEFFD/8xGymRoOXRVZY5KvLHI/3rDZ7NY17OFn4KJXivsBypJYr2Wygd +xVR9l8htKlLvIpivgItP7d52rGNllAryQaW3DjgtcQKBgQDfqnyNj8DLtfS/mCZh +rvlCAFjbK3Utfl7mUdJAXrrr5LLMWBkxHPM88gcVRXImTEa8n16DK+MEJi20i1iD +VenlQ67RPOfnpe6l6VTa4G8czau4he8gKK1UOWQeUf5tNxkQLmilMbNPi5QU9NCr +Jr1g2SxWMI4fiS2yWxd3dFi0pwKBgQDCm3hsiOASo0gCm444xyPwQQuqsCGNLZ54 +83B6vl3Wvf3w47yIujZ5jo6c6qYIJZoeCzLWzzX5KNsyWZOX0VVaKEml9H/hzwZK +JkFL/pOyTpUNo53cWJcj0XBR3JtP4zn+J2NAPbBwak1EkhC7RCAe54G/mepI9hXb +ojQkrps6JQKBgQCgdCbMS09NFKiS9iy6sRKhtawI9wEl9N1Rr2r8wLip17QpAh54 +bENW+m34ZYyBSwEH+fCMe2RtqpHpTnneJjkYPtjfxCi9tv0gSuaT6qPrbuR9CKBG +WsgVfuKDGeFDKl6xjAmIUMJJE2HVMteroKwFGWdEIasjln6Qz+ZizLWCSwKBgHYe +K0+lHGvzkyeSBxbLODMBJ/WoBhVMlR1QlPrLROWsV8+4SpyqeZn6PvFbMv9K42pM +3cSn7FiYxcKfwAer1SRtw5Xo+x2xrF2hLozTrg3RyIKIxq4RT1s8KfJl9hbdEjwC +6Cj7yHXS76cpCOLBDMX1OjlzUFKMmuO+ZevF1w3JAoGBANcEpDKazss8dlr4AH/W +ja09tT/hOjzl3caVx9kzsUJk5U5cs23QBnt8pwswFoI18h02Ejhk1Jz84PiVf5IK +lVIXskxvClV88/Zj4z/PliJa2ZAUv8PcjvxyWHPJb+iD85HR7FVZ/BM+mWG/HNuK +A7yiuBMJHIw6FLCFiEhvuD+l -----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/server.crt b/unittest/fixtures/appletls/server.crt index cb20449f2..47f88a0e5 100644 --- a/unittest/fixtures/appletls/server.crt +++ b/unittest/fixtures/appletls/server.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDXDCCAkSgAwIBAgIUesmG0zycKPRO5//Ww3V2wBsRbrIwDQYJKoZIhvcNAQEL +MIIDWjCCAkKgAwIBAgIUJPkTLlf7usDaSbjoaiSCcEMohDcwDQYJKoZIhvcNAQEL BQAwKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUw -IBcNMjYwOTMwMTkyNzAwWhgPMjEyNjA5MDYxOTI3MDBaMBQxEjAQBgNVBAMMCWxv -Y2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJuAfYq+tA/ -IjaWxGh2n45kxdriLcQGcuwCtq705+vZS1axBDg65F/pRHZ/r24qyd8YCrMUW5jk -AXBlg0ZwONy0HUnAknTIwoDyM78VWnQ6HAl2LIFQzX5s3BJ9j+na3vpjb4uW2LCd -+3JPDKYQ4dSlqNge+9nQAMmuE5OYrc4+TvEMwlyBPGgqQpbOa2r+GbP9s5Re88BO -UeaABymfwjTpyBSWAgjXXIT/emQKe/nFbYqPOsbVzKsQk3XhuLDdZ6j5i23HKtNj -vMAngYCwf+6VJK1/sCceO3EN9BFZcMc1AWNuU3INFNUMxOjD4p+oYygBz/f0qOgZ -1G8P0b+A7/8CAwEAAaOBjDCBiTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIF -oDATBgNVHSUEDDAKBggrBgEFBQcDATAUBgNVHREEDTALgglsb2NhbGhvc3QwHQYD -VR0OBBYEFL7nojwnBsrbpNrsV5D8puq+E0+sMB8GA1UdIwQYMBaAFH22Q3yuCTWa -UPJB7lBIqGn1SBcCMA0GCSqGSIb3DQEBCwUAA4IBAQBS0HokPSmrhhNU9OpF9N4n -suxW7gT2Q9hSjG7Quct21NuiXLlPLkC4dqNyKwFfTZPm8fYacVzEb6k+3zcIlOQI -vf0U1+tRfNd6RdZkf6+2W5iWaTXQYieZ82TPvkv1TWhFeskXd93Fw9ir+3pCCF2M -c5GNfSZz3iNOOGFbPvvJfGHppqO5ggx6e3hOoArmLc/mvTNkptlIxpU/DseWgo14 -PdXgkuBjjhJexBapTDkk12jzwCNjFUvPdfy85mR7tH8hH98S9HChrZSXd3JT4p+F -g5hv5XzVWUBPyirrVb5wZMI10Z2OA1d80OSUBUUg4j40V4wg/ViTrU1weRjPufGC +HhcNMjYxMDAxMDExNjE2WhcNMjcxMDAxMDExNjE2WjAUMRIwEAYDVQQDDAlsb2Nh +bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqBwfTboti1xTt +TjmJ2cniO8QhAYTE1JON+k7Qe3WUqn/CZCdxZad61pO8UXesTdKrqs0Acj6McSdg +h4bikyG50CnonUAkIONx8uS1mTmStdCiI04HdHGAVqKMFYEH4bmCmMnN+JzGJ5IM +R8f1bscNdH/HxHZyKFmJ/GY9tjPVWESztSd2s3Commkhw9A5HmGnF64+UeHxQeK1 +k2TjY4Mv9UxvfxO0YfbwEP35ePCJ2Q+e1htrLatcem5xiTWrJBqDM49LvsFX3Snz +nsD8gCrMGlIf4pt1/qpy5JPqxOWqgtjl78otTQvpkJjfZ8+OS1FOpWRoqxJz7GC8 +hJrM3PIjAgMBAAGjgYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAw +EwYDVR0lBAwwCgYIKwYBBQUHAwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1Ud +DgQWBBRU+ynMt8p8+bI0ZpdG3N0vSrCXFDAfBgNVHSMEGDAWgBQWwyFZgNvZ5n09 +iufG30bMNjyRKzANBgkqhkiG9w0BAQsFAAOCAQEAJUQ0Ozhyz4iWmO0F/umfAeGq +93DPAFFwVW8s8P1FV16XnoWL89jNDvCMsaRfYLRONwtu3WgvhLePMEiQ3j8oM4FM +k0Rv2aZdvquNU7+zar3Zo9lsVsAGE3pBqp75j6jmHjO9Jl0RTB9vuO81Xwha2lRZ +9ijpmLUeHiI+ogL1PCyfqzduv5I8bUNLkzv/3vWXs9342pP5WRjC6XRPP/6yfXj7 ++q9Bm+ptfkC+pQldAajXHqZZ9rz5UlwTzzrkoS68nsOCRo8zxkcGyIf6mqoywVFp +6xrQ7Za9kPLjC+UN8/pRMPzXtWNIN2Mm9j4/Rto01VV/+Jw/q4YoRCcDvgpkSw== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/wrong-root.crt b/unittest/fixtures/appletls/wrong-root.crt index 9fb837e59..f86814b88 100644 --- a/unittest/fixtures/appletls/wrong-root.crt +++ b/unittest/fixtures/appletls/wrong-root.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDOzCCAiOgAwIBAgIUVAOKBiVPejb5caic5l+eJveEnAUwDQYJKoZIhvcNAQEL -BQAwJDEiMCAGA1UEAwwZbGliaHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAgFw0yNjA5 -MzAxOTI3MDFaGA8yMTI2MDkwNjE5MjcwMVowJDEiMCAGA1UEAwwZbGliaHYtYXBw +MIIDOzCCAiOgAwIBAgIUGFgaO7KB7AD4CoR+ZKzj4gsxd9gwDQYJKoZIhvcNAQEL +BQAwJDEiMCAGA1UEAwwZbGliaHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAgFw0yNjEw +MDEwMTE2MTZaGA8yMTI2MDkwNzAxMTYxNlowJDEiMCAGA1UEAwwZbGliaHYtYXBw bGV0bHMtd3Jvbmctcm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB -AN9WxNrZ0pUrLVu2WriBgLDbVQLfIUlYHlQ6o1PVt6bbPoQoeVNfXCX1dV0DeJ3p -wDgnbDGRvpZmyl3vDGHsvnO7ICgAWz2W9YiM9WXOdb+a6FJ19hRlfrVY69MwP6qF -xNOcpxxHOL++N+YRwRgRArIx7/I4yWEWF5Qgf92HxxO4VOFdvSvgFXRHizDIImTH -EMNtUqW1Gl6a7ktDaPpiaX9fe/If0rlpO071A3FOhtuc3iJfF9nGu2bwdHreST9H -WSus8ObaPI3to+DnpGcU8kZKiq3pZHy/NWQPT1iKyj9IvE+VfaTuym4TgVBiY/ev -5u3Ij7joMAHm/tvhBgDWCqkCAwEAAaNjMGEwHQYDVR0OBBYEFC+6qgDhXcZ2pM9X -tPuj+F24AfvcMB8GA1UdIwQYMBaAFC+6qgDhXcZ2pM9XtPuj+F24AfvcMA8GA1Ud -EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQA5 -3k2v79uWtYcLq1jvrPz2Uf6tsJdAkFngyqEW1wVg/ONAwMszrUI+K6AC3AazJO0B -D0nM5ocDK3rkXeJzkZYhdQa1H67f+1+714iyov2tK4cJaKVsBr3kz5eQhwexkuJr -15rkb/EM+z49PEl2uVsji4ivWhEmgD8Yu1G7mjZMCGPxz+4MBXSKw7xLjbloYAq7 -HjNsTK+C1no6EmU0mXwiqBhASFAD5OqCLzTzDPEvtYuRoG7GSb27IyG+gtOokhSn -uxuNjRbS1iE1QeNDsXryG0tuWqvHR+CQB7bTsedsqiRXRpEPbs/lfnKci20sI8iC -8aFaMoGLa/bzDHlj/ShT +AI6w0DdMs8ddB/XF+c8Ufr5Npc08HLDNbfOd3twDGXKW3oUoMe0gL1zfUZaGUdVi +g75PO79aJDDaiUSVjfUclLeV+06SAJcQcE/gk54PVwdNIfyiLYMOBp68KKZSZ3/y +4yzfnFxw88u1zIW/a1kdnMzrBOYRePoGAk+VpdpwP7blSaeUcrdy0Xi91DhPH7yf +guraCb4dWPDSRNZeBQOIOo+mnGOz8MX45uOZcXvscU2ysAYHUw7oat7xey5em6aJ +UbKKDV2P2gIxCEABHCT4UrP551u5Azkauc/ifbhu05ei0uyJ62x+Jpo2W9I4RNKX +7tENCos0+6ZJguP/rOqcTG0CAwEAAaNjMGEwHQYDVR0OBBYEFOQFxEzRNwt6CI8o +y8YveRoTTSWvMB8GA1UdIwQYMBaAFOQFxEzRNwt6CI8oy8YveRoTTSWvMA8GA1Ud +EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAR +DlVDu3IGNVuF4AXw1z2Kxts6vZOU7kp5cH0n3aKonrIbiuT+NsMaw/Bz0wchiWJL +PanINnxxzN2tjhtqbtJSFcGEULj5S8oj42igFuCPlRyj4qmd/bZNZXj2MSGEDXzG +Auhr2V0EKdyuQLLTdXSR268zFtZ8ywM/+D5bWmWRSHnPFOrZTAgEliUoSJAO/9+j +ajtkriUGfb4dXPoKvXtLLR2b95XTCWBpXLPpF8H+90jEaYhu+f8GeGUikqEyJAzE +vy8tMxf2ZlTHyW4hOSrymJWBzCUjzpezJOX6icDsRiyTVueEvSjzFUlUqpDtlFp2 +aGx0jSpWQOVxsFyXlQ0a -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/wrong-server.key b/unittest/fixtures/appletls/wrong-server.key index b1e4b2fdf..a3960afce 100644 --- a/unittest/fixtures/appletls/wrong-server.key +++ b/unittest/fixtures/appletls/wrong-server.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEA111jNkaM5Y5rKkKg30Xk2Qo4cd5i5xCp+feeVdHtIQU+LTNp -FsCH7QcoEAlHmcnIOiDtxqgY78JaSjOK3dmeJPReyyeGkM2HsXG5c9iCFugSOtaZ -+LP5Gqc1BNS2RWXOtbY3XO2kJhQzVkr00Wr0GPIoJPM5lwKqgNvBhSfO+KF2vzWN -BBL50tn0NG5ys4i1KV33bkL0wW8gUXWLEQsPZOEwsoycSoDcyyVYudppsngIESB1 -6mTJOSFhHJvyXQU7zXL/bfcnDMeYV8XF0P7z/dU9Ll0NjgtA0V2axxcU2vIAuzkO -boe5/xuwAYZyt5L66VP2KAUrRT4l4qDj4zPMlQIDAQABAoIBAAaGGm+GNxXsGMR0 -tL1Wt244sEmIwEu6FkAPd3EnlQyTRVUmscgB6IwuU5Eaytu2gFV8cl96b5jxtPz6 -7zm1siPx8B4s0hd4VmQyavj+pcAuYwD7x7nAL+tWBdXh4Kyc/yRDgw1SWI7bvUtf -pWdjm0XXLg6ifIvdxY72OThAorUm1rv1q3GPW4sDhRMeZO0jQ1fJg1MJ0oKgxwO8 -zh3RqhfkRgELnJyFIcXnQ/UXqj47VM5/OniHMP3kriG6TPyIODpu7eZ5Mrbeosm2 -oV+GOykFUJcm8fDtaCk3LRy7gcoyOJ4cOiJj3su88hq49RXzdS+Doq7hBcM1PPZm -IiHD44kCgYEA+CFZqhY8L09CMFfpDkZ0Ze13rqpgDbEH9wKyjQcyLQklHEk/TfIl -IEXFW4U/m+DdevYAZEoOtmTXY4uSDQn6qqohFx42j3LKegHD/B/KMtNMKALEsHiq -UPap5Cg+jFX+t+NCsXy5EAHO3O9mOrNnrRZiZE0RaCbu2w9J3jz8jtkCgYEA3jIA -+Or2mLDpN+6DhEXakv3DhH6/6xmmfXp/0+NBL0U3uZa1xLSG5a8eLXOU3HfP3hO9 -AaKzbnhjpgVL9KBq5Fsq69aGkn/Me9AJlAdU9/AXdmdTv+ieua3ZGWBizFJFawmQ -ZU+u2oaJjGqLyedoT/zPsdVQ+btOuOZZDI+tzh0CgYEAj+roEtsqtVYHUfrrVjhP -Mv91N33ikI5pzD9oSJwv4ic3uxxQ92jHV9ygB+FVb5gRXkxpFcJOnkQHGdnOMHnl -Ri+/WaVQiAtQnUuA3S+jG6+qsFpKswCJ6MPo7kjZXpRSVV4fRMrOnBYwYb0JUmrU -a3RcRUjeG8bZK33GnnxJEKECgYB7UlmDzjUrrhTi/Dh2c6bKqpmXshmmzMfBIPpN -ifYl3E7/bIxaLrAoTrd7Folqi/0NDvt6KulXyO3VuV7c2SQ6tfbuilSKfu/pUB/g -zujz64e6KcMr4lomSD0UfpCXQppQvDAuarlrg/xXuNL5LryQmIpV80VMNg+NRBvs -gto+aQKBgQDhMLdz+UvhV1Z+MPI9XKQtyXaa4UQ+p9tWnzYUxuvODiTcWshNeP+9 -OQQi0qaV+7xAiIcvVpg1wiELk70q7YqjPwsy5VfMeKEuZ5K28sbZjXq4O7pJ4vNF -TZ+F4Ak7h1EAtFT7A0WIT3pCz2mblp9UXKSO0Ih9L4PbYPPX/km1Qg== +MIIEpAIBAAKCAQEAnX+XlVjQzYnuklKaCTcyxv73tgyIf9x+kP352Qnd5LTV9Rrf +FHEwRX/JQt03V8LTBhf+5HsV7N2FciktMlNBjdNBA7HAe6+1yU0nOufJOQWd+xSw +lvqYrsD70Xb5jRKWV7pANRJLnqFgNI9giqRxx85aX121nkZH04F5Lpls4oY89+Ii +4DgoNJaxEqo+zjfDRXAuveM107s/iuSpnsxZAJyGtuBQb2OBlMvTB9GlhMAmLzXe +3vNDpPzKMOykT4ZmB+PVaqSUtbRh4zYavl7NWYflZ8H2/AIYgzwm8CTu+ArDoOak +CnWLnucRJjhzS1HJapLp2SHGCdiHN7u8aXo2KQIDAQABAoIBAATOIUJRuOEkfa5i +LcftMrPmkIkx3bJE+GmVDhvklKwHJmX5gWfewjHEoc/T7v3S+Fw9vC2dYcBdy9X9 +Up8v8haRJPEnaa98X2f6XiGKc9W1Capg6bhZgfIG+kfcQOXgdMzNZmsYGU2IL+a6 +nx/rv3rwnUo+ki13iHZ4A0n8LVnF4XGpfGfScxbWh5/yICnI8nC/bmQpkwHyPE2I +zBQyEJ6fJikQgVIwSTke9FCABF/ETwt+hpO4g2GLe0/KM0//GeQ52ERPs3zTpZOf +Geznt12Eb2eq+0F1bLo9mG4k/Drv7V9l7yKjOL9iJ+FJDo4ybU1HibETiy25M/q8 +tb5kGF8CgYEAzeAFR076kARdy5pzi9iWeaAZ7fQDr6PPS+uV9J+gIixPokfCdFiS +BxNtIa/vfjHIw/nYjbm++P62ENiA+ycjxzXHERKffLVw2tySdzGzKPBbM5x9tUrP +qrBbU0Uuxhd0aquo0u+XFfgOecEefJ2zTQFfkkeXZoZyU65sJc1WU1MCgYEAw9hN +xfRbHgJOuwe0msXcJ07uh4Om6YmTtKj2B8U4RdljIj8E+N8cUxVaJ+giDsUE+qfh +TxC1JI10pFA5lk/UhOqZqcHXqwrPKKHKjfmr7Xy5mosCVHTe7aR9QpOrqT1DJqnr +XCN3JwbRhBHTHkWIBDn6LfGIzde5ND+KSx9D/RMCgYEAzD9znTJa3aSnVYbvGZAQ +gav37Z6IRanT0HNyu1XebejePJbK8dipT4HTZHeCuAU2NE/cq4bbU3aINKBHHmTP +VyUgUOzT88qio0/vs3dIUtZa9RJNmR4WdzYt9KgPZpIAeo/BlzwB/dayrdKNp35h +U4WIRrzmFN5P8Ht8aeiUu2cCgYEArh3u92HKaKGwkYPGRBxJIQGB/CVGDjdshJ/7 +LOlgoGknQ9k3eHQT4KIJJ5WwQeVUCe2b2QmHotnIrBVPPZ332bwhpdVbAwx3JS7C +wPsKqffLo+SWy7OkRy+I1dooMizvOL61K5O0aZQcTgjy4+T5iphpHtOwxyFV3Wfo +ceV4MtUCgYAswdXH0jgqwIhKy+wPvXIJQIePS1H7A78SX32CV7gdOCfzMUfZ2Hf9 +31VtNidLt4BmUo7mC3Sr6GMmSkHmxUF02myqgj3YPyzDgC4nNABZ7JENUUiArEd4 +3XZ3vNzWnsU4Y4OTxzji69eemVPEx8AOyYNCptWo6sZK/Jq7TIFU7A== -----END RSA PRIVATE KEY----- From 6e62e45c351a5a40d2646d531573ea00e6566800 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 15:13:50 +0800 Subject: [PATCH 04/12] fix(ssl): preserve nonblocking Apple TLS handshakes Co-authored-by: TRAE CLI --- ssl/appletls.c | 46 ++++++++++++++++++++++------------------ unittest/appletls_test.c | 29 +++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 21 deletions(-) diff --git a/ssl/appletls.c b/ssl/appletls.c index 85946ca67..cd4b9ee7a 100644 --- a/ssl/appletls.c +++ b/ssl/appletls.c @@ -745,7 +745,6 @@ typedef struct appletls_ctx { CFArrayRef certificate_chain; CFArrayRef trust_anchors; short verify_peer; - short configured_endpoint; } appletls_ctx_t; static CFDataRef appletls_cfdata(const appletls_der_t* der) { @@ -941,7 +940,6 @@ hssl_ctx_t hssl_ctx_new(hssl_ctx_opt_t* param) { appletls_ctx_t* ctx = (appletls_ctx_t*)calloc(1, sizeof(appletls_ctx_t)); if (ctx == NULL) return NULL; ctx->verify_peer = param ? param->verify_peer : 0; - ctx->configured_endpoint = param ? param->endpoint : HSSL_CLIENT; if ((crt_file == NULL) != (key_file == NULL)) { fprintf(stderr, "Apple TLS requires both crt_file and key_file\n"); @@ -1048,12 +1046,27 @@ static OSStatus SocketWrite(SSLConnectionRef conn, const void* data, size_t* len return noErr; } +static void appletls_free_session(appletls_t* appletls) { + if (appletls->session == NULL) return; +#if defined(__MAC_10_8) + CFRelease(appletls->session); +#else + SSLDisposeContext(appletls->session); +#endif + appletls->session = NULL; + appletls->endpoint = -1; + appletls->peer_auth_handled = false; +} + static int hssl_init(hssl_t ssl, int endpoint) { if (ssl == NULL) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; OSStatus ret = noErr; + size_t all_ciphers_count = 0; + size_t allowed_ciphers_count = 0; + SSLCipherSuite* all_ciphers = NULL; + SSLCipherSuite* allowed_ciphers = NULL; if (appletls->endpoint != -1 && appletls->endpoint != endpoint) return HSSL_ERROR; - if (appletls->ctx->configured_endpoint != endpoint) return HSSL_ERROR; if (endpoint == HSSL_SERVER && appletls->ctx->identity == NULL) { fprintf(stderr, "Apple TLS server requires a local identity\n"); return HSSL_ERROR; @@ -1074,7 +1087,7 @@ static int hssl_init(hssl_t ssl, int endpoint) { ret = SSLSetProtocolVersionMin(appletls->session, kTLSProtocol12); if (ret != noErr) { fprintf(stderr, "SSLSetProtocolVersionMin failed!\n"); - return HSSL_ERROR; + goto error; } #if defined(__MAC_10_8) @@ -1091,19 +1104,17 @@ static int hssl_init(hssl_t ssl, int endpoint) { #endif if (ret != noErr) { fprintf(stderr, "Apple TLS authentication setup failed\n"); - return HSSL_ERROR; + goto error; } if (appletls->ctx->certificate_chain) { ret = SSLSetCertificate(appletls->session, appletls->ctx->certificate_chain); if (ret != noErr) { fprintf(stderr, "SSLSetCertificate failed!\n"); - return HSSL_ERROR; + goto error; } } - size_t all_ciphers_count = 0, allowed_ciphers_count = 0; - SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL; ret = SSLGetNumberSupportedCiphers(appletls->session, &all_ciphers_count); if (ret != noErr) { fprintf(stderr, "SSLGetNumberSupportedCiphers failed!\n"); @@ -1142,12 +1153,12 @@ static int hssl_init(hssl_t ssl, int endpoint) { ret = SSLSetIOFuncs(appletls->session, SocketRead, SocketWrite); if (ret != noErr) { fprintf(stderr, "SSLSetIOFuncs failed!\n"); - return HSSL_ERROR; + goto error; } ret = SSLSetConnection(appletls->session, appletls); if (ret != noErr) { fprintf(stderr, "SSLSetConnection failed!\n"); - return HSSL_ERROR; + goto error; } /* @@ -1169,34 +1180,27 @@ static int hssl_init(hssl_t ssl, int endpoint) { if (allowed_ciphers) { free(allowed_ciphers); } + appletls_free_session(appletls); return HSSL_ERROR; } void hssl_free(hssl_t ssl) { if (ssl == NULL) return; appletls_t* appletls = (appletls_t*)ssl; - if (appletls->session) { -#if defined(__MAC_10_8) - CFRelease(appletls->session); -#else - SSLDisposeContext(appletls->session); -#endif - appletls->session = NULL; - } + appletls_free_session(appletls); free(appletls->hostname); free(appletls); } static int appletls_evaluate_trust(SecTrustRef trust) { -#if defined(__has_builtin) -#if __has_builtin(__builtin_available) +#if (TARGET_OS_MAC && MAC_OS_X_VERSION_MAX_ALLOWED >= 101400) || \ + ((TARGET_OS_EMBEDDED || TARGET_OS_IPHONE) && __IPHONE_OS_VERSION_MAX_ALLOWED >= 120000) if (__builtin_available(macOS 10.14, iOS 12.0, *)) { CFErrorRef error = NULL; bool trusted = SecTrustEvaluateWithError(trust, &error); if (error) CFRelease(error); return trusted ? HSSL_OK : HSSL_ERROR; } -#endif #endif { SecTrustResultType result = kSecTrustResultInvalid; diff --git a/unittest/appletls_test.c b/unittest/appletls_test.c index c73a75ce1..9a508064f 100644 --- a/unittest/appletls_test.c +++ b/unittest/appletls_test.c @@ -223,6 +223,34 @@ static void test_empty_read_is_nonblocking(void) { tls_pair_close(&pair); } +static void test_handshake_reports_write_block(void) { + hssl_ctx_opt_t options; + hssl_ctx_t ctx; + hssl_t ssl; + int fds[2]; + char fill[4096] = {0}; + ssize_t nwrite; + + memset(&options, 0, sizeof(options)); + options.endpoint = HSSL_CLIENT; + ctx = hssl_ctx_new(&options); + assert(ctx != NULL); + assert(socketpair(AF_UNIX, SOCK_STREAM, 0, fds) == 0); + assert(nonblocking(fds[0]) == 0 && nonblocking(fds[1]) == 0); + do { + nwrite = write(fds[0], fill, sizeof(fill)); + } while (nwrite > 0); + assert(errno == EAGAIN || errno == EWOULDBLOCK); + + ssl = hssl_new(ctx, fds[0]); + assert(ssl != NULL); + assert(hssl_connect(ssl) == HSSL_WANT_WRITE); + hssl_free(ssl); + hssl_ctx_free(ctx); + close(fds[0]); + close(fds[1]); +} + static void test_wrong_hostname_fails(void) { hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); hssl_ctx_opt_t client = verified_client_options(FIXTURE("root.crt")); @@ -273,6 +301,7 @@ int main(void) { test_custom_ca_and_matching_hostname_succeed(); test_custom_ca_directory_and_matching_hostname_succeed(); test_empty_read_is_nonblocking(); + test_handshake_reports_write_block(); test_wrong_hostname_fails(); test_wrong_custom_ca_fails(); test_server_mtls_rejects_missing_client_certificate(); From d1b257a79ee7d3f6bec71b222ad19b81aece62de Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 16:26:09 +0800 Subject: [PATCH 05/12] docs(ssl): describe Apple TLS verification Co-authored-by: TRAE CLI --- docs/cn/TcpClient.md | 32 ++++++++++++++++++++++++++++++++ docs/cn/TcpServer.md | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 65 insertions(+) diff --git a/docs/cn/TcpClient.md b/docs/cn/TcpClient.md index 18a2aa9b5..6783fdda2 100644 --- a/docs/cn/TcpClient.md +++ b/docs/cn/TcpClient.md @@ -61,3 +61,35 @@ class TcpClient { ``` 测试代码见 [evpp/TcpClient_test.cpp](../../evpp/TcpClient_test.cpp) + +## TLS 证书验证 + +`withTLS()` 默认只启用 TLS，不验证对端证书。需要验证服务端身份时， +将 `verify_peer` 设为 `1`： + +```cpp +hssl_ctx_opt_t ssl = {}; +ssl.verify_peer = 1; +client.withTLS(&ssl); +``` + +未设置 `ca_file` 和 `ca_path` 时，Apple TLS、OpenSSL 和 GnuTLS 后端使用 +系统信任根。设置了任一项时，仅信任指定的自定义 CA，不再使用系统信任根。 +`ca_file` 可以包含多个 PEM `CERTIFICATE` 块，`ca_path` 指向包含 PEM 或 +DER CA 证书的目录。通过域名连接时还会校验证书中的 DNS 主机名。 + +客户端双向 TLS 示例： + +```cpp +hssl_ctx_opt_t ssl = {}; +ssl.crt_file = "cert/client-chain.pem"; +ssl.key_file = "cert/client.key"; +ssl.ca_file = "cert/server-ca.pem"; +ssl.verify_peer = 1; +client.withTLS(&ssl); +``` + +Apple TLS 后端的本地身份目前只支持未加密的 RSA 私钥： +`RSA PRIVATE KEY`（PKCS#1）或 RSA `PRIVATE KEY`（PKCS#8）。不支持 EC +私钥和加密私钥。加载本地身份要求 macOS 10.12 或 iOS 11.2 及以上； +不加载客户端身份时仍可在更早的系统版本上使用客户端 TLS。 diff --git a/docs/cn/TcpServer.md b/docs/cn/TcpServer.md index e0ebdb06a..cfa3f83db 100644 --- a/docs/cn/TcpServer.md +++ b/docs/cn/TcpServer.md @@ -60,3 +60,36 @@ class TcpServer { ``` 测试代码见 [evpp/TcpServer_test.cpp](../../evpp/TcpServer_test.cpp) + +## TLS 证书与双向认证 + +TLS 服务端必须提供证书链和对应私钥： + +```cpp +hssl_ctx_opt_t ssl = {}; +ssl.crt_file = "cert/server-chain.pem"; +ssl.key_file = "cert/server.key"; +server.withTLS(&ssl); +``` + +证书链文件使用 PEM 格式，第一张为服务端证书，后续依次为中间证书。 + +将 `verify_peer` 设为 `1` 会启用强制双向 TLS：客户端必须提供受信任的 +证书，否则握手失败。 + +```cpp +hssl_ctx_opt_t ssl = {}; +ssl.crt_file = "cert/server-chain.pem"; +ssl.key_file = "cert/server.key"; +ssl.ca_file = "cert/client-ca.pem"; +ssl.verify_peer = 1; +server.withTLS(&ssl); +``` + +未设置 `ca_file` 和 `ca_path` 时使用系统信任根；设置了任一项时，仅信任 +指定的自定义 CA。`ca_file` 可以包含多张 PEM 证书，`ca_path` 可以包含 +PEM 或 DER CA 证书。 + +Apple TLS 后端的本地身份目前只支持未加密的 RSA 私钥： +`RSA PRIVATE KEY`（PKCS#1）或 RSA `PRIVATE KEY`（PKCS#8）。不支持 EC +私钥和加密私钥，且服务端身份要求 macOS 10.12 或 iOS 11.2 及以上。 From 7c7b6ab27c23112310c920dd72dc10db187f5bcb Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 17:17:55 +0800 Subject: [PATCH 06/12] fix(ssl): harden Apple TLS validation Co-authored-by: TRAE CLI --- Makefile | 13 +-- event/tls.c | 6 +- http/client/HttpClient.cpp | 6 +- scripts/unittest.sh | 2 +- ssl/appletls.c | 27 ++++-- ssl/appletls_pem.c | 5 ++ ssl/appletls_pem.h | 26 ++++-- unittest/appletls_pem_test.c | 6 +- unittest/fixtures/appletls/README.md | 6 ++ unittest/fixtures/appletls/ca-dir/root.crt | 35 ++++---- unittest/fixtures/appletls/client-chain.pem | 36 ++++---- unittest/fixtures/appletls/client.crt | 36 ++++---- unittest/fixtures/appletls/client.key | 50 +++++------ unittest/fixtures/appletls/ec-pkcs8.key | 6 +- unittest/fixtures/appletls/ec-sec1.key | 6 +- unittest/fixtures/appletls/encrypted-key.pem | 56 ++++++------- unittest/fixtures/appletls/generate.sh | 87 +++++++++++++++----- unittest/fixtures/appletls/intermediate.crt | 36 ++++---- unittest/fixtures/appletls/multi-ca.pem | 70 ++++++++-------- unittest/fixtures/appletls/root.crt | 35 ++++---- unittest/fixtures/appletls/server-chain.pem | 72 ++++++++-------- unittest/fixtures/appletls/server-pkcs1.key | 50 +++++------ unittest/fixtures/appletls/server-pkcs8.key | 52 ++++++------ unittest/fixtures/appletls/server.crt | 36 ++++---- unittest/fixtures/appletls/wrong-root.crt | 35 ++++---- unittest/fixtures/appletls/wrong-server.key | 50 +++++------ 26 files changed, 466 insertions(+), 379 deletions(-) create mode 100644 unittest/fixtures/appletls/README.md diff --git a/Makefile b/Makefile index 9fef643f6..fb356ee58 100644 --- a/Makefile +++ b/Makefile @@ -430,13 +430,16 @@ endif endif appletls_pem_test: prepare - $(CC) -g -Wall -Wextra -O0 -std=c99 -I. -Ibase -Issl \ + $(CC) -g -Wall -Wextra -O0 -std=c99 -DAPPLETLS_PEM_TESTING -I. -Ibase -Issl \ -o bin/appletls_pem_test unittest/appletls_pem_test.c ssl/appletls_pem.c -appletls_test: prepare libhv - $(CC) -g -Wall -Wextra -O0 -std=c99 -I. -Ibase -Issl -Ievent \ - -o bin/appletls_test unittest/appletls_test.c \ - -Llib -lhv -framework CoreFoundation -framework Security +ifeq ($(shell uname -s),Darwin) +appletls_test: prepare + $(CC) -g -Wall -Wextra -O0 -std=c99 -DAPPLETLS_TESTING \ + -I. -Ibase -Issl -Ievent -o bin/appletls_test \ + unittest/appletls_test.c ssl/appletls.c ssl/appletls_pem.c \ + -framework CoreFoundation -framework Security +endif ifeq ($(WITH_LUA), yes) $(CXX) -g -Wall -O0 -std=c++11 -DWITH_LUA $(LUA_CFLAGS) -I. -Ibase -Issl -Ievent -Icpputil -Ievpp -Ilua -o bin/lua_binding_test unittest/lua_binding_test.cpp -Llib -lhv -pthread $(LUA_LIBS) $(CXX) -g -Wall -O0 -std=c++11 -DWITH_LUA $(LUA_CFLAGS) -I. -Ibase -Issl -Ievent -Icpputil -Ievpp -Ilua -o bin/lua_io_test unittest/lua_io_test.cpp -Llib -lhv -pthread $(LUA_LIBS) diff --git a/event/tls.c b/event/tls.c index 23fba18f8..606a7e1eb 100644 --- a/event/tls.c +++ b/event/tls.c @@ -61,7 +61,11 @@ int tls_client_handshake_start(hio_t* io) { sni = io->hostname; } if (sni) { - hssl_set_sni_hostname(io->ssl, sni); + if (hssl_set_sni_hostname(io->ssl, sni) != HSSL_OK) { + io->error = ERR_SSL_HANDSHAKE; + hio_close(io); + return -1; + } } io->phase = HIO_PHASE_TLS_CLIENT_HANDSHAKING; diff --git a/http/client/HttpClient.cpp b/http/client/HttpClient.cpp index 6bb90146a..d35d96bfd 100644 --- a/http/client/HttpClient.cpp +++ b/http/client/HttpClient.cpp @@ -266,7 +266,11 @@ static int http_client_ssl_handshake(http_client_t* cli, int connfd, const char* return NABS(ERR_NEW_SSL); } if (sni_host && !is_ipaddr(sni_host)) { - hssl_set_sni_hostname(cli->ssl, sni_host); + if (hssl_set_sni_hostname(cli->ssl, sni_host) != HSSL_OK) { + hssl_free(cli->ssl); + cli->ssl = NULL; + return NABS(ERR_SSL_HANDSHAKE); + } } #ifdef WITH_OPENSSL // Offer ALPN "h2" only when HTTP/2 is intended, so an h2-capable server diff --git a/scripts/unittest.sh b/scripts/unittest.sh index 03fec5957..abcc21a6a 100755 --- a/scripts/unittest.sh +++ b/scripts/unittest.sh @@ -31,7 +31,7 @@ bin/socketpair_test if [ -x bin/appletls_pem_test ]; then bin/appletls_pem_test || exit $? fi -if [ -x bin/appletls_test ]; then +if [ "$(uname -s)" = "Darwin" ] && [ -x bin/appletls_test ]; then bin/appletls_test || exit $? fi # bin/threadpool_test diff --git a/ssl/appletls.c b/ssl/appletls.c index cd4b9ee7a..868d63481 100644 --- a/ssl/appletls.c +++ b/ssl/appletls.c @@ -761,7 +761,8 @@ static int appletls_create_identity(appletls_ctx_t* ctx, const char* cert_file, CFDataRef data = NULL; CFDictionaryRef attributes = NULL; CFErrorRef error = NULL; - int ret = APPLETLS_PEM_ERROR_FORMAT; + int ret; + int result = HSSL_ERROR; size_t i; ret = appletls_pem_load_certificates(cert_file, 0, 64, &certificates); @@ -843,7 +844,7 @@ static int appletls_create_identity(appletls_ctx_t* ctx, const char* cert_file, ctx->certificate_chain = chain; identity = NULL; chain = NULL; - ret = APPLETLS_PEM_OK; + result = HSSL_OK; cleanup: if (error) CFRelease(error); @@ -855,7 +856,7 @@ static int appletls_create_identity(appletls_ctx_t* ctx, const char* cert_file, if (chain) CFRelease(chain); appletls_der_free(&key_data); appletls_der_list_free(&certificates); - return ret == APPLETLS_PEM_OK ? HSSL_OK : HSSL_ERROR; + return result; } static int appletls_append_anchor_file(CFMutableArrayRef anchors, const char* path, @@ -868,6 +869,9 @@ static int appletls_append_anchor_file(CFMutableArrayRef anchors, const char* pa ret = appletls_pem_load_certificates(path, 1, APPLETLS_PEM_MAX_CERTIFICATES - *anchor_count, &certificates); if (ret != APPLETLS_PEM_OK) { + if (!strict && (ret == APPLETLS_PEM_ERROR_LIMIT || ret == APPLETLS_PEM_ERROR_NOMEM)) { + return HSSL_ERROR; + } if (strict) { fprintf(stderr, "Apple TLS CA file failed: %s\n", appletls_pem_error_string(ret)); } @@ -1193,6 +1197,16 @@ void hssl_free(hssl_t ssl) { } static int appletls_evaluate_trust(SecTrustRef trust) { +#ifdef APPLETLS_TESTING + /* Keep checked-in TLS fixtures deterministic instead of making tests + * depend on their wall-clock validity at runtime. */ + CFDateRef verify_date = CFDateCreate(NULL, 812592000.0); /* 2026-10-02 UTC */ + if (verify_date == NULL || SecTrustSetVerifyDate(trust, verify_date) != errSecSuccess) { + if (verify_date) CFRelease(verify_date); + return HSSL_ERROR; + } + CFRelease(verify_date); +#endif #if (TARGET_OS_MAC && MAC_OS_X_VERSION_MAX_ALLOWED >= 101400) || \ ((TARGET_OS_EMBEDDED || TARGET_OS_IPHONE) && __IPHONE_OS_VERSION_MAX_ALLOWED >= 120000) if (__builtin_available(macOS 10.14, iOS 12.0, *)) { @@ -1363,11 +1377,14 @@ int hssl_set_sni_hostname(hssl_t ssl, const char* hostname) { if (hssl_init(ssl, HSSL_CLIENT) != HSSL_OK) return HSSL_ERROR; } len = strlen(hostname); - status = SSLSetPeerDomainName(appletls->session, hostname, len); - if (status != noErr) return HSSL_ERROR; copy = (char*)malloc(len + 1); if (copy == NULL) return HSSL_ERROR; memcpy(copy, hostname, len + 1); + status = SSLSetPeerDomainName(appletls->session, hostname, len); + if (status != noErr) { + free(copy); + return HSSL_ERROR; + } free(appletls->hostname); appletls->hostname = copy; return HSSL_OK; diff --git a/ssl/appletls_pem.c b/ssl/appletls_pem.c index 7821a0a09..bca00803e 100644 --- a/ssl/appletls_pem.c +++ b/ssl/appletls_pem.c @@ -1,4 +1,7 @@ #include "appletls_pem.h" +#include "hssl.h" + +#if defined(WITH_APPLETLS) || defined(APPLETLS_PEM_TESTING) #include #include @@ -440,3 +443,5 @@ const char* appletls_pem_error_string(int error) { default: return "unknown parser error"; } } + +#endif diff --git a/ssl/appletls_pem.h b/ssl/appletls_pem.h index b3af70fbd..e85e0843f 100644 --- a/ssl/appletls_pem.h +++ b/ssl/appletls_pem.h @@ -3,6 +3,12 @@ #include +#if defined(__GNUC__) +#define APPLETLS_PRIVATE __attribute__((visibility("hidden"))) +#else +#define APPLETLS_PRIVATE +#endif + #define APPLETLS_PEM_MAX_FILE_SIZE (16u * 1024u * 1024u) #define APPLETLS_PEM_MAX_BLOCK_SIZE (4u * 1024u * 1024u) #define APPLETLS_PEM_MAX_CERTIFICATES 1024u @@ -26,14 +32,16 @@ typedef enum { APPLETLS_PEM_ERROR_NOMEM = -5 } appletls_pem_error_t; -int appletls_pem_load_certificates(const char* path, - int allow_der, - size_t max_certificates, - appletls_der_list_t* certificates); -int appletls_pem_load_rsa_private_key(const char* path, - appletls_der_t* pkcs1_key); -void appletls_der_free(appletls_der_t* der); -void appletls_der_list_free(appletls_der_list_t* list); -const char* appletls_pem_error_string(int error); +APPLETLS_PRIVATE int appletls_pem_load_certificates(const char* path, + int allow_der, + size_t max_certificates, + appletls_der_list_t* certificates); +APPLETLS_PRIVATE int appletls_pem_load_rsa_private_key(const char* path, + appletls_der_t* pkcs1_key); +APPLETLS_PRIVATE void appletls_der_free(appletls_der_t* der); +APPLETLS_PRIVATE void appletls_der_list_free(appletls_der_list_t* list); +APPLETLS_PRIVATE const char* appletls_pem_error_string(int error); + +#undef APPLETLS_PRIVATE #endif diff --git a/unittest/appletls_pem_test.c b/unittest/appletls_pem_test.c index 181f08888..436074deb 100644 --- a/unittest/appletls_pem_test.c +++ b/unittest/appletls_pem_test.c @@ -1,3 +1,5 @@ +#define _POSIX_C_SOURCE 200809L + #include #include #include @@ -14,7 +16,7 @@ static void assert_file_equal(const appletls_der_t* lhs, const appletls_der_t* r } static char* write_temp(const void* data, size_t len) { - char* path = strdup("/private/tmp/libhv-appletls-pem-XXXXXX"); + char* path = strdup("/tmp/libhv-appletls-pem-XXXXXX"); assert(path != NULL); int fd = mkstemp(path); assert(fd >= 0); @@ -129,7 +131,7 @@ static void test_enforce_file_block_and_count_limits(void) { int fd; assert(appletls_pem_load_certificates(FIXTURE("server-chain.pem"), 0, 1, &certs) == APPLETLS_PEM_ERROR_LIMIT); - path = strdup("/private/tmp/libhv-appletls-large-XXXXXX"); + path = strdup("/tmp/libhv-appletls-large-XXXXXX"); assert(path != NULL); fd = mkstemp(path); assert(fd >= 0); diff --git a/unittest/fixtures/appletls/README.md b/unittest/fixtures/appletls/README.md new file mode 100644 index 000000000..4f1cf55a5 --- /dev/null +++ b/unittest/fixtures/appletls/README.md @@ -0,0 +1,6 @@ +# Apple TLS test certificates + +All private keys in this directory are disposable test fixtures and must never +be used outside the unit tests. Run `generate.sh` from any directory to replace +the fixture set. The checked-in files let tests run without an OpenSSL runtime +dependency. diff --git a/unittest/fixtures/appletls/ca-dir/root.crt b/unittest/fixtures/appletls/ca-dir/root.crt index 096e53443..003114cc7 100644 --- a/unittest/fixtures/appletls/ca-dir/root.crt +++ b/unittest/fixtures/appletls/ca-dir/root.crt @@ -1,20 +1,19 @@ -----BEGIN CERTIFICATE----- -MIIDOTCCAiGgAwIBAgIUaNSS3l3MNTJvIi7E+jzTF57vBxswDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw -MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs -ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDR -AaPFPG9m57ORbo5elu+23P/CdHJgOu8Xgga81/V35vo/sv3Pwhx60kVLxKTrsEVR -MjYqSPyoDOHMQZhrK80qdt/I4NYgb+CCqk7yt2m28yTXFPo5lAKlez5p6bTL5kvi -0u3fv96Tebu1v7cI183x3MgBMvMhcs8GkJHJIx0d5YNbG2uiiS7+BokfdHzQBKzA -YaXnngJAq+CxJ6HhgMNg3UpcbzgrAml7/n1DJgdsW5ITiS+HUUuHaNv+CnW5XlGY -kMDITJzVlJCOvKG116HnZ5BEYzt5FRRkEsUVhA6+t1uAMYlQBTqnDQHk2ep3WLcA -KHBGCfP5T5pDVMh811wtAgMBAAGjYzBhMB0GA1UdDgQWBBTjTUJODoeym8/z5rR/ -bPbq9Mfk/DAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DAPBgNVHRMB -Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAQb/L -SvAjFOCO0QYV3O3VNypEH4lDGfptVSAZbVb0+C5cWY9/bC88D8yke2vGkgS+IkOz -YKDLkYxDQsYpaIrGYtsruDelgNEPww8m26Aps2ciuWW+oCgToPjvea146NdqrBT8 -d9AbuZEGrQkn+JSz6Qe3sE4I3t8CjLZHEY7YK7y8jSOdkDVvc4TxMxEuiVBbQMSR -QddtXv2Qa20G4kCrn/EJMEGzlcJwkKtsQafT/aZBeySUIjM35P3tb/5JKjhERihS -NJPLU5G0kKhh2m3BwAT5ugja+846zQqSe69ehiMaLFjWTIphZS7EGFexFZoSSBXD -755LxDlauvz3rREOUg== +MIIDBDCCAeygAwIBAgICAQAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli +aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw +MDAwMFowIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMDd6nejls/LrXQQ7UCG+j1q3t+9 +qnYJXn0Cvdzxub33PNMc5WbGTqxJG1/mqzSSU6Hm6ISNQZJStQlI9L1WhIrFX0gp +9DZjaUI0eeIOii4LxPBV9QHs1zWZcZehCzz6hNoPoXUBzEaBpxWj2wjVLN9AjKVO +4JMpyShGyw4ieXyDmsft4ALummVWh+C1tVBcO3baOMN2k4PvLB6zUEqhT554ppvO +EQtlzEW1JPEd0i0VpQ9QHUMSDMhYljljYhMzn9x10nABdD6q++STypw1dk5YJycO +cwCeCOMRGs/IbOKyaUiutZMieXQlCyJJsDLunTSgQO/0xo2wNwqRDN8dSQIDAQAB +o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU +DbCaHy5SWiDFIuavQxJ1xGPBJqkwDQYJKoZIhvcNAQELBQADggEBAJU5OA8vGXAQ +7c/6sPpgznzNHiN3snGQImClfeImO5U09rYhGSU0pG/hTRy+FiQTpl3/SJ0w3h0/ +tq8OMdES4/HRK6voOkwzK926eWk9biyn1mhRKOHmCzLZdvYYly7Z7TFG1S3fmKIx +uVdz9Ot56Vs9KZllvHd85AZigiVvH4cJNlZZfzGeETWS0h0sfJOTtyDUuQBcs7QO +rWKw/qSFSsuwNGs++SdygYrT0EJ17Vc5jRWc4EetDIUUS/cBK092vaPUxv04IK+f +p4gzLWHPFL/E4yjfZXCdwUUW3Xbc6Fl2oDWDDmNKcXAtPJThMtUDHbRUYMVosYJ+ +1jMlDK+GsdM= -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client-chain.pem b/unittest/fixtures/appletls/client-chain.pem index f1c56429e..c26c0fd31 100644 --- a/unittest/fixtures/appletls/client-chain.pem +++ b/unittest/fixtures/appletls/client-chain.pem @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDTTCCAjWgAwIBAgIUUCbVWLU3xvd10p6EmaNbjLUfJLUwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw -MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAlMSMwIQYDVQQDDBpsaWJodi1hcHBs -ZXRscy10ZXN0LWNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB -ALKW0bN6IcfLrAZHHuR8L655t/ksqTirWvj/pqKfUhMqPdD7gId38PpAUX3agQfL -Kd9SvUFJu9T680H63vrgH3yMCfgM66xe09T4S2RxgmysLvTdysnG5UJ0X9VCDGYr -cUhi1oOuUT4JdOTSzOrbidVxfl4vqufCng0aYhM4Ig1ssJKEZdt1vNVHHg5axcSF -8UJaffY/GBHHoK9BG6RE6skgOEuoCXzTZaOJtoVxLHJaoZknfdjvRc+LbAy93l8E -kSQmm0uxrVIceZMZGeCdyYakLCNyNgt89BHuF447W1nLfGqCAf+2/APutNMSAorl -+LzIkzLwwohI6jwUzwTdJtkCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8B -Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFACRMn6L6OlG -BK9jK0G+2ngfTr4LMB8GA1UdIwQYMBaAFONNQk4Oh7Kbz/PmtH9s9ur0x+T8MA0G -CSqGSIb3DQEBCwUAA4IBAQB/glOjZXtZIZVYL/V6jHPSPCbitdp3jLmEylsAWr/4 -WZQe1hsQ8es7c5fVqDiTaJDYhvHc+KgggUF8L8C0Dxlw3TXCWpnakPPVFvOW4YQg -+2FWIZHZ1vsv97IF2RfGeDOZfPrkaaYeY9hd7Z6O8CjA60mFyv15ZDijWEBrlrYt -XA3xDvqF+zECi0s+zSdYyKyXl/MX5zP8syONJ1vsvYT7lVzEHgM7b1RvRDJiDiCX -7PtUyYEPzdRM1ikZZjuWdLX4O9hu2GpHU+eQ8X9xPTTjwH2aZ41eMM6XojZfVFoh -7AZvIOTebqOmUCt9cnPpXAnkVHuY187n3VNMc5bB9KyA +MIIDOTCCAiGgAwIBAgICMAAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli +aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTI3MTAwMTAw +MDAwMFowJTEjMCEGA1UEAwwabGliaHYtYXBwbGV0bHMtdGVzdC1jbGllbnQwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJdX7hCoagbj7bgF+HWne5pULP +4/0XKNDrbeJ7muBb5rVMMtSqWCTgNkFjKjtU1upA8RZW50BN3CZLJBY0c6kO1z39 +W5PFkgcTUSScRM+MVQCW+WWKcI3d5tMNIr0QgAtv7xJ+lyAaMeuKyN94Gune3Gay +0MQhABd7GPbHEWzYOQ9p9mhgGOHPW2XQsEJfhydZ+nj3H3shZgvScTyxReAtwDn6 +wqQHJajr7Gnvhl8jW7c4OXB3PWwT97xvIKTtp7ljFbbuDzp01cXqBsvtAXcqDlOV +rdn1uNzJoEulZnU802BWwix8OSIpPXm7xqa5VAxY3/ngMlYlxMOhQALHF/ylAgMB +AAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG +CCsGAQUFBwMCMB0GA1UdDgQWBBSRUOw0La9aq6jGQipugjTmwUPmnzAfBgNVHSME +GDAWgBQNsJofLlJaIMUi5q9DEnXEY8EmqTANBgkqhkiG9w0BAQsFAAOCAQEAJ5lT +CPluyKPJ3ugvnVx/64BWVSs9huLMnzQsG991Az451ywvTjEQnfH574wplocEbGf3 +fNinwKg7tzOEqyFdSvnjEg9UD8dRVdyVqxqeBhbdmx0fJSgbwdEJYt4nfFYfs1uO +TusnLxe+XFs/EMlzK7vGNoEb0bobb0SzIaVSPHUROi3kArvyIIOC+IGALoqk/cI2 +ppO2dFNCYGGRZwgjCG25Msk4sRARSFTDprThkkVOwieSsLHUlOrqetK1vap3wsYv +rcZ+RA4JF8WGWBj2l84B2hPaGVFHFP3o+70fc8DD7dKE2t8bQTOO4sgNSKP35EDB +RQvCHhyq1QiGV3BYGQ== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client.crt b/unittest/fixtures/appletls/client.crt index f1c56429e..c26c0fd31 100644 --- a/unittest/fixtures/appletls/client.crt +++ b/unittest/fixtures/appletls/client.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDTTCCAjWgAwIBAgIUUCbVWLU3xvd10p6EmaNbjLUfJLUwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw -MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAlMSMwIQYDVQQDDBpsaWJodi1hcHBs -ZXRscy10ZXN0LWNsaWVudDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB -ALKW0bN6IcfLrAZHHuR8L655t/ksqTirWvj/pqKfUhMqPdD7gId38PpAUX3agQfL -Kd9SvUFJu9T680H63vrgH3yMCfgM66xe09T4S2RxgmysLvTdysnG5UJ0X9VCDGYr -cUhi1oOuUT4JdOTSzOrbidVxfl4vqufCng0aYhM4Ig1ssJKEZdt1vNVHHg5axcSF -8UJaffY/GBHHoK9BG6RE6skgOEuoCXzTZaOJtoVxLHJaoZknfdjvRc+LbAy93l8E -kSQmm0uxrVIceZMZGeCdyYakLCNyNgt89BHuF447W1nLfGqCAf+2/APutNMSAorl -+LzIkzLwwohI6jwUzwTdJtkCAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8B -Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFACRMn6L6OlG -BK9jK0G+2ngfTr4LMB8GA1UdIwQYMBaAFONNQk4Oh7Kbz/PmtH9s9ur0x+T8MA0G -CSqGSIb3DQEBCwUAA4IBAQB/glOjZXtZIZVYL/V6jHPSPCbitdp3jLmEylsAWr/4 -WZQe1hsQ8es7c5fVqDiTaJDYhvHc+KgggUF8L8C0Dxlw3TXCWpnakPPVFvOW4YQg -+2FWIZHZ1vsv97IF2RfGeDOZfPrkaaYeY9hd7Z6O8CjA60mFyv15ZDijWEBrlrYt -XA3xDvqF+zECi0s+zSdYyKyXl/MX5zP8syONJ1vsvYT7lVzEHgM7b1RvRDJiDiCX -7PtUyYEPzdRM1ikZZjuWdLX4O9hu2GpHU+eQ8X9xPTTjwH2aZ41eMM6XojZfVFoh -7AZvIOTebqOmUCt9cnPpXAnkVHuY187n3VNMc5bB9KyA +MIIDOTCCAiGgAwIBAgICMAAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli +aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTI3MTAwMTAw +MDAwMFowJTEjMCEGA1UEAwwabGliaHYtYXBwbGV0bHMtdGVzdC1jbGllbnQwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJdX7hCoagbj7bgF+HWne5pULP +4/0XKNDrbeJ7muBb5rVMMtSqWCTgNkFjKjtU1upA8RZW50BN3CZLJBY0c6kO1z39 +W5PFkgcTUSScRM+MVQCW+WWKcI3d5tMNIr0QgAtv7xJ+lyAaMeuKyN94Gune3Gay +0MQhABd7GPbHEWzYOQ9p9mhgGOHPW2XQsEJfhydZ+nj3H3shZgvScTyxReAtwDn6 +wqQHJajr7Gnvhl8jW7c4OXB3PWwT97xvIKTtp7ljFbbuDzp01cXqBsvtAXcqDlOV +rdn1uNzJoEulZnU802BWwix8OSIpPXm7xqa5VAxY3/ngMlYlxMOhQALHF/ylAgMB +AAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG +CCsGAQUFBwMCMB0GA1UdDgQWBBSRUOw0La9aq6jGQipugjTmwUPmnzAfBgNVHSME +GDAWgBQNsJofLlJaIMUi5q9DEnXEY8EmqTANBgkqhkiG9w0BAQsFAAOCAQEAJ5lT +CPluyKPJ3ugvnVx/64BWVSs9huLMnzQsG991Az451ywvTjEQnfH574wplocEbGf3 +fNinwKg7tzOEqyFdSvnjEg9UD8dRVdyVqxqeBhbdmx0fJSgbwdEJYt4nfFYfs1uO +TusnLxe+XFs/EMlzK7vGNoEb0bobb0SzIaVSPHUROi3kArvyIIOC+IGALoqk/cI2 +ppO2dFNCYGGRZwgjCG25Msk4sRARSFTDprThkkVOwieSsLHUlOrqetK1vap3wsYv +rcZ+RA4JF8WGWBj2l84B2hPaGVFHFP3o+70fc8DD7dKE2t8bQTOO4sgNSKP35EDB +RQvCHhyq1QiGV3BYGQ== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client.key b/unittest/fixtures/appletls/client.key index a79e0bb8c..2ea9e2717 100644 --- a/unittest/fixtures/appletls/client.key +++ b/unittest/fixtures/appletls/client.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEogIBAAKCAQEAspbRs3ohx8usBkce5Hwvrnm3+SypOKta+P+mop9SEyo90PuA -h3fw+kBRfdqBB8sp31K9QUm71PrzQfre+uAffIwJ+AzrrF7T1PhLZHGCbKwu9N3K -ycblQnRf1UIMZitxSGLWg65RPgl05NLM6tuJ1XF+Xi+q58KeDRpiEzgiDWywkoRl -23W81UceDlrFxIXxQlp99j8YEcegr0EbpETqySA4S6gJfNNlo4m2hXEsclqhmSd9 -2O9Fz4tsDL3eXwSRJCabS7GtUhx5kxkZ4J3JhqQsI3I2C3z0Ee4XjjtbWct8aoIB -/7b8A+600xICiuX4vMiTMvDCiEjqPBTPBN0m2QIDAQABAoIBAFH+Lo8RTrsVRoin -VIaggZ/AYHf1SkgrXBwf+9iD/0GvTixJnAwWRDwRFZkLndv/Kd1PdnaoLKWvBcpQ -LNnP1oTvIpCRFg7Qhr8rtCmMd83/C5v+zGDxgUaOeYVGyryJy3vpbQWOHdy2qMV6 -Bvz5CIJHljYV+ohncPshFtAuIGw6q0Hsk6S35ZqB9CACq9xnqeqp3zjMGjU7sT5L -a9qVjg6scTJC+NT2F5IYxPQe//HgVCdXxPFOfM6ihP6kiXO/VfOhOe/OhSSx1Q+6 -vK24Iegj5/Vu0JLMG8kJiWpe9xUx9bSi7X/BOhfWvCN8NuvAbp0uI6LrOi2ropjH -pTxslcUCgYEA2i0YbFa81L/aPysbhmmCedSrshssgEG68bI74rEdmOfv5nH9PsOh -bo09+6kNJMFGIAGUUDGTzcAMbY4KvRWCFqLIKu8oLyu1eOYWOh7n04K7ca/9QwYy -2s7CSxA91KM7RR2fWMfgxpr15kx29l4iWU8Zf0EjzrmTAiLT/bPMEBsCgYEA0YzO -oTOx8+XixTpC1JqU4Cbaz0UzJ0gkYg7snaSe09sXu4GbYggq/hZwBDokTcp7oe8k -D2pTOULh1fYDP/tfh6Ri/pLvFpz612GbEDcDcodlDmXAkbVZoScD26MosULANgTg -QrTxLAzzKFXZ7Wsbw3R75RB/u2qsi6M+b2wFnBsCgYAvIEaCQEoRek9eDaWoZunz -/ugHVK9MFOaYhnNBCBjoilDbagvVntQj2QZmcaGRKt5G05CBsfPHIZCNqXzQUvEC -iq7J91aqubo9HxX1/+77VOXALM97xr79XGPDawKwB4Ip77gXqTT4MUikMigQF008 -FUXgouVlJdiHQZag2lFduQKBgH/24bP1UqVjbCEO3ALixyk+8P4D/yHs3zL2dC4s -ekVblNmPYyjxXfe+Efey3bqXfPo9hCLZxirAmhLD4eYvhn3ZuA5IAjMn99KRK1Uy -kytcXSz2nCseuLY9khCNSWs+HQyf26dAwcopuk+WZbejYdfxCTuv4KC9mtLHBHic -WayjAoGAQlBF/4qmPN57JRyYAuKhLNKvFLAvx+nB0ceWRMy3KKGRLo3VwF56vbbr -cYHwds4FKlUZQN5KJ6dAjUwIYPsB7cwYjmijnVoVP8GYrrj1WHkkRMEgtkSgnY7A -19cSm3rtzaMwzjEqxEsHiV2xBm9K9Xn9JzkTgvMwLkvNLrstf4o= +MIIEpAIBAAKCAQEAyXV+4QqGoG4+24Bfh1p3uaVCz+P9FyjQ623ie5rgW+a1TDLU +qlgk4DZBYyo7VNbqQPEWVudATdwmSyQWNHOpDtc9/VuTxZIHE1EknETPjFUAlvll +inCN3ebTDSK9EIALb+8SfpcgGjHrisjfeBrp3txmstDEIQAXexj2xxFs2DkPafZo +YBjhz1tl0LBCX4cnWfp49x97IWYL0nE8sUXgLcA5+sKkByWo6+xp74ZfI1u3ODlw +dz1sE/e8byCk7ae5YxW27g86dNXF6gbL7QF3Kg5Tla3Z9bjcyaBLpWZ1PNNgVsIs +fDkiKT15u8amuVQMWN/54DJWJcTDoUACxxf8pQIDAQABAoIBAAFakSznkM2iYzjy +Y37AJ66cFhdAWI9y4ZFTcbXG7dvWo9oMbv8EcwSWslj9cnY4sEyza6UCqAORISi/ +Toh+Ga3upsBj5ya17oCj7cBArh+RSqm5D1E415s2iK1XHtIhKiW2A5FnAcfRrtvs +Sz2+LVtabwFwnOcwqve5/56JPXDOhLPGz9b+G/WIbHPRwZMeOK89b63UKlV2vQXo +MFzrRKfK1vkxk19mBqb9ULFs3tTNgam8SbfySOolKyAxbDKaKmY0cJvvPr2Gforf +56hT6tnIC38+Pf9oImAkx6V+vAC/dpTlkY7lZqud3kR04RuOmURVFFXkKvskOyNh +kroLHsECgYEA5f6nz9uoRNscBdrki9Sg1r1rAQvTz+FRm4aU+t1XrchWxL8nFT0K +NJ4WauDFpfd7q32B1JSqf1OxqD95Ekfac+StaQaixM3rdNOZOZb/EciHRk9Rtl5w +Zf+g9P+XskNWr7URxSH1YaOBlEgqL5G/cmj9qJJN3qLTKp1eJNpAbR0CgYEA4Dza +j5AYZsDfHy3xgBc5q5sYWeMD9aNwO19ifpFprXpmOP3nfml/aBaEGkvs/BfqPP+S +BrTELsSkq+zWFNeU4rESuvgEXXzPTjL/+tU1y2Xjx7OPu9xDeaZyydDVkFrBrAEq +cVAshRqyMrDLONG4ZRRrlCtrhDx8A7ufEnbQHykCgYAgN1eSShZ77qUyPMMewx30 +dnvynZGB4PHpcySTL0YE1bcxwATdeLthO3OwbOPCp7PvBZmWCW0IgNS12I5A/Ueg +TDvuJjvOjXmZ17ny0y/PceNg+eNcREZCQ1hseRDqq3wNCLQAhQ02LA0OlD00hJno +kMRXRIcb1Hr30StKxjeYEQKBgQDLdIt+LOjm+mK3wJDZfrk1yfBLRl5GVvey9zW/ +zyJKY78yQLX1DbWq9JsB3Rf2F6DRnbWZ3hQOtx8OW0JXAM+266EqAXS8ek0CD+YQ +abl4hkco3/QvKIgUbYDDOnc7lg0Ziqk+zNbIIlPDCIQrVqXvGJsPgmH4RoTjQi3v +q9vkGQKBgQDX6t1/nwPNvbbiiULZOCvbUUab1shxQ1Auku2KJcUCcw+KW0noetQA +FqPGerpJ9eBfPWPE69sWHDhdExMbkaXnhKSq5KQd3mnMStyNZ794VdNuObqsczz8 +D2QSgLDtUXeQqzTvtLwLHg85mrcX1T36+0Dyc075mNp8kUez71IaUg== -----END RSA PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/ec-pkcs8.key b/unittest/fixtures/appletls/ec-pkcs8.key index 8dd88b536..3d24cde73 100644 --- a/unittest/fixtures/appletls/ec-pkcs8.key +++ b/unittest/fixtures/appletls/ec-pkcs8.key @@ -1,5 +1,5 @@ -----BEGIN PRIVATE KEY----- -MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOZ5kavaoFQJXIf/C -96usD7lm5R0hrDVir2/s1qrSs1GhRANCAARzlFxg1JK1/PiETlkJ6J9OcV2c+lzX -7gwDNippKi/xSgMoSF01UgwWz7YVZa+xKywm1leNsvEh1601HknTNcxq +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQghNgOnBBkVedL5Gnl +NBLPZmb70fe5VnFC40wsxeuJOMyhRANCAAQaqrOSRS14Z4irOjuqptHl1FDn9m3g +2mnlS221UoQiaNuUB8Jl5gbudm3nnAuACzGUrqt7rogDlYlN/hOhbQDf -----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/ec-sec1.key b/unittest/fixtures/appletls/ec-sec1.key index 8d2e3afaa..387ee3f62 100644 --- a/unittest/fixtures/appletls/ec-sec1.key +++ b/unittest/fixtures/appletls/ec-sec1.key @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIDmeZGr2qBUCVyH/wverrA+5ZuUdIaw1Yq9v7Naq0rNRoAoGCCqGSM49 -AwEHoUQDQgAEc5RcYNSStfz4hE5ZCeifTnFdnPpc1+4MAzYqaSov8UoDKEhdNVIM -Fs+2FWWvsSssJtZXjbLxIdetNR5J0zXMag== +MHcCAQEEIITYDpwQZFXnS+Rp5TQSz2Zm+9H3uVZxQuNMLMXriTjMoAoGCCqGSM49 +AwEHoUQDQgAEGqqzkkUteGeIqzo7qqbR5dRQ5/Zt4Npp5UtttVKEImjblAfCZeYG +7nZt55wLgAsxlK6re66IA5WJTf4ToW0A3w== -----END EC PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/encrypted-key.pem b/unittest/fixtures/appletls/encrypted-key.pem index 3f2157ae7..99abc7ee7 100644 --- a/unittest/fixtures/appletls/encrypted-key.pem +++ b/unittest/fixtures/appletls/encrypted-key.pem @@ -1,30 +1,30 @@ -----BEGIN ENCRYPTED PRIVATE KEY----- -MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQxToiyK9AGJH9KTvD -HIvgYgICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEECftlVl+KScYNHmu -nQnu13YEggTQV3E3m4SjPY8kTUbiEbPuWy695LUFpmBoRyFwimbrpuE1TsOW0N1S -evYH0o/6aHsI6iB0O3M7wDzX3+BgK2ikYSwRJNVITbYwjr4RYy2bhCJpR3qhclqp -Am3n33tGZk3/FhfT/metuWbx/ZuaLNHc1y9rwQIsi6PF5jl6fBYsBJfQGlWZCHmx -+ZBRwIzjcvn9SB+I+hFaLwifyFI7Zvlc61Ibf2n+pHcHU4IIa7s3Y96OER3nyNv2 -/IXuSf/43Jbm/1oCtMKwzEgq4jvJvh0NYT77nSqvi+x6mJgDOnm6qtC59EaMkH+k -GEPkr18y/JH0TqI5YEfRLR2msQ9NEbjmhYQO8oCkdQOLx+Qb+6QLw0trfiA1+5vj -+7NP8oBQKl29ndJlh5ha5YLA1ELQ2NX40FM+OVhnGXAD82Ow+HbxnlRmR+YRGGPi -+v2X8uoQIKBm8F16V3jrYgr8sAF8KvI1Ha4o5pV/5UCqucr/Qf+HazCQSRIrRdDo -ona2ezC3bgWurLmSrqRcg+3jds6679ZdsHeu5SFbQH2K/wVD+qxP/0GejtncWPat -Xs7r1TgxD9gzHNbFdqbsvuN4na1kwYVHmBsZjj7VhO2iWXENQvbi4jwNePnuw1ku -wj8ZAqd48hcreZKauWCpxvZA3RdmuntQNlS/xVxAwCz9e9tWHVOgCL/kl3ODNeZ5 -epO6ubxr5lzI56Sj5CIyi2aJjqQ2N9TL83150tklagBTGuhlTNeouf6sdyZg4ZAv -PyFcTzRAoWa+ZMk/2FItSb9k3RorzvuKo2IPok7/uOdLvet15sAHD92wpHV/yGAI -nNcnHOtVaoklBcFGUApmwTQb/grAGkLQlDqIg7TwY4T0y0kCmp/+L5dbOqhs4KWe -Twrs4Yhs0GXAjyMZBkqARVjYVavY/yeWZkEyeihQn2icObxJKXgcFAMfarNTIOr6 -OetGI+OyY0f5RN4H7jW5a+wzlZd7uePCZFQFbUs3y3uo7vk31EwRGt9vWIG3C5Re -c8K6ndScfyJqYhDA6oEzs1VvySbSFnFQxTEURuMfqyxmP5u1OpEHRBjKTxKAocoy -NXn+TEcLfbJWAzkcVpje3pKfBIDZniBy2NxCuZENxODAHbhoJNM1yR5zO4ghUYH5 -Q7rvnpft4dPvyDfaq7+mktH/Q9olQ9z8ypODMDBKy6kdSErv4bdXH+67qfotema/ -vtjkt0LMRiBl7UwqhNx9LCsbkzGfWly7aMsk5Zt67xuJ1zIR4GMmdPW2z70zfn0K -7z/icM28NCwZCtyQqvDBS06BfXy/8tmGouZarxdR8Pf23CPhAOqZpkmx01+lJw45 -a+v4l/jK0nQqIlQHY9j9CANr6MVDq5eeFuxTHbwkRgQ5zzNCcpulYE2Z9ERxJ36X -2hvzh58u7JmLIn76LoE1cFBF7VZPgMMpbcHkP6vTcfzdRpqwyiaMX+XVfKiozF0L -4yvGf3SbiWn8qUbEq+bWPwMO89jRJWw89XrZN9MtFfhrIVlCHWCb+6yKAp99Xfzg -OI926Bo8i50wvc3IvyXamk+6j9zOc5D+9fI2JzepG+8vknxO6kHgpOjOm0SlpCkj -bmsdW3cCQ1JKLitXmqu6LU8mdfcghPvD3N9KaWfz/H9lCd5xoxvhLXk= +MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQI0e6pr2sDCdNBQcr +cuBfdgICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEGuljhBq0Xb6As96 +46+uaY0EggTQxZ855DV2dLDUvWt68mZivv37CEpqShM5hltuCNths9+PiAn1xHpC +kOjbZuFgNp12dbPLsnxC67sGOmSgaVCIilPtoO5Ku4LabBnNHXk025hhyajm44lA +0MThKa3gYWRq5jRBOiD20iS8VYxIWTC3Vi5BAR577sOK7yBsG7wmXgmIVfirQ1Z3 +V5/j0TlBHZKmUwvThhf9GWtwGRGAzi5u/WuilxK8SoCsd+PJVLNr031qt4fqphLQ +pA0sdxGLsck9IflHXzEIlE5R1Fic577RRtGQMl02QfHtkxZZWRNGe5+Z1Uchony3 +FZf68kH/dJdtEQTkuj8LZzySkRhpi2HecgxowZfYE4IRhd5sXU4e9t7vgXdUHiU2 +XObmaPalWyhpCMGKQRB9fyxaYUEhvzDirOmz0qByf2KhuuMfldrvsV7olVEDNxD2 +rhWlFejRa0GcTZqDzwphhGPEk+IBNnYNWv+q93AwWGbbFn9CcgzBNqOjtx1OD2gv +XGX5ZY0UxeS9R0e7NDFSzdo4DKrTaUcaLBTS+vOIkIMvEnyf1Hou+gwNgIC8q0Sf +7WlwGuBDhGndPnoHy0mbfpi5+t5VO1rJ0ZP3bMRPSjOP+zdlnOORMQpPWYD9Czqm +074pDI7sxrBdbl8ezpgRYhwILi2nPtNzJHTWiUR8bQ2rSZLOX+Dd+IkLWh1SKAKL +58tfvle8jQiwEQVYypYOtiGSwxrt+mh+gW+iwuyg/jE073UzLLeXAakyBQpL4ll6 +IAJmwLiA9lD+EIC862nV5J9T6xi06t9tWzJW79ooIJ+va/xF5X12FBeBtsNYPWpG +fBZnfh5VXubxXDv+Bf8J5MXq+3+WGtAj0f9dzxxot6kJ7GDUhvg03Mw8V9wzl8Y5 +LgyqTGnkOpY+5ACDjD1u/XnSLIyC8n3/0h44t4lYRka1WDujalM4KQNCYQUwy5sE +5LscXX3VbSlAe56wsnHj9Hjqtgvo226Tdih94xS28RilL6gL1BwJGoY7Pc7qdTaI +wVDnGgWjJmW0R/iE75j1HGNIKvb5n93SBHdP+75LzpOPm2Jewssku+2fgsyTiX1n +eQds+A1zrgnowEQETcpaTVWqcACpzoUB47Onj7kD1GMh4kVfbTr0n9qmhZ4TJXND +wX+KMM8keHmh8WpopL8tASWUxvlIG2VYv6pk6WgfJIsyKtWnKnJcIF2wWZg8rJOu +CHRPIMJgp7WJVtM62bXWNSpIIUkjE7zH7HR2HVdSFdQeIt/rkFoOwpa6ZXRlF2TV +9zWfDV/9YhWllLm17cq8eOKE7x3XcYJz6ZxGOjRJa4MZMJUWZA83THuZ2Bg9D2Ql +t8MhQqGKuPtQ4XNr5M+Su1iyreSBwEJKXKRoXeJ1K7GbPt+LrFhQaEkT7Smiy3ni +uu7Kg88DCMxyAhESAs3X64kV0xsZUMVltME1LPg3j25u+gXzc3GTD0V7GcNtBpeX ++zNZJYBZRSKd1/OtypScBVc/OJj1DrnOy5fUHQ2eoCTbuvFxdTU+f4u6/g1bI3fW +Hgct2gvr3iqyF74yrsQVponxfRxEo2spVo8pDXJkLUYgO0RzesmwErm1FChkTwJ2 +UWutwrsmyCYKVOpmAaTu6UqQ6qoEM9N0c1MhIIcshM/xT13DCWDjeEE= -----END ENCRYPTED PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/generate.sh b/unittest/fixtures/appletls/generate.sh index a47ae2f37..63e546ed5 100755 --- a/unittest/fixtures/appletls/generate.sh +++ b/unittest/fixtures/appletls/generate.sh @@ -4,30 +4,61 @@ set -eu fixture_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) tmp_dir=$(mktemp -d) trap 'rm -rf "$tmp_dir"' EXIT INT TERM +start_date=20261001000000Z +ca_end_date=20461001000000Z +leaf_end_date=20271001000000Z + +cat > "$tmp_dir/ca.cnf" < "$tmp_dir/serial" make_key() { openssl genrsa -traditional -out "$1" 2048 } make_key "$tmp_dir/root.key" -openssl req -new -x509 -sha256 -days 36500 \ - -key "$tmp_dir/root.key" -out "$fixture_dir/root.crt" \ - -subj /CN=libhv-appletls-test-root \ - -addext basicConstraints=critical,CA:true \ - -addext keyUsage=critical,keyCertSign,cRLSign +openssl req -new -sha256 -key "$tmp_dir/root.key" -out "$tmp_dir/root.csr" \ + -subj /CN=libhv-appletls-test-root +printf '%s\n' \ + '[x509_ext]' \ + 'basicConstraints=critical,CA:true' \ + 'keyUsage=critical,keyCertSign,cRLSign' \ + 'subjectKeyIdentifier=hash' > "$tmp_dir/root.ext" +openssl ca -batch -selfsign -config "$tmp_dir/ca.cnf" \ + -keyfile "$tmp_dir/root.key" -in "$tmp_dir/root.csr" \ + -startdate "$start_date" -enddate "$ca_end_date" \ + -extensions x509_ext -extfile "$tmp_dir/root.ext" \ + -out "$fixture_dir/root.crt" -notext make_key "$tmp_dir/intermediate.key" openssl req -new -sha256 -key "$tmp_dir/intermediate.key" \ -out "$tmp_dir/intermediate.csr" -subj /CN=libhv-appletls-test-intermediate printf '%s\n' \ + '[x509_ext]' \ 'basicConstraints=critical,CA:true,pathlen:0' \ 'keyUsage=critical,keyCertSign,cRLSign' \ 'subjectKeyIdentifier=hash' \ 'authorityKeyIdentifier=keyid,issuer' > "$tmp_dir/intermediate.ext" -openssl x509 -req -sha256 -days 365 \ - -in "$tmp_dir/intermediate.csr" -CA "$fixture_dir/root.crt" \ - -CAkey "$tmp_dir/root.key" -CAserial "$tmp_dir/root.srl" -CAcreateserial \ - -out "$fixture_dir/intermediate.crt" -extfile "$tmp_dir/intermediate.ext" +cp "$tmp_dir/root.key" "$tmp_dir/signer.key" +cp "$fixture_dir/root.crt" "$tmp_dir/signer.crt" +printf '1000\n' > "$tmp_dir/serial" +openssl ca -batch -config "$tmp_dir/ca.cnf" -in "$tmp_dir/intermediate.csr" \ + -startdate "$start_date" -enddate "$ca_end_date" \ + -extensions x509_ext -extfile "$tmp_dir/intermediate.ext" \ + -out "$fixture_dir/intermediate.crt" -notext make_key "$fixture_dir/server-pkcs1.key" openssl pkcs8 -topk8 -nocrypt -in "$fixture_dir/server-pkcs1.key" \ @@ -35,33 +66,45 @@ openssl pkcs8 -topk8 -nocrypt -in "$fixture_dir/server-pkcs1.key" \ openssl req -new -sha256 -key "$fixture_dir/server-pkcs1.key" \ -out "$tmp_dir/server.csr" -subj /CN=localhost printf '%s\n' \ + '[x509_ext]' \ 'basicConstraints=critical,CA:false' \ 'keyUsage=critical,digitalSignature,keyEncipherment' \ 'extendedKeyUsage=serverAuth' \ 'subjectAltName=DNS:localhost' > "$tmp_dir/server.ext" -openssl x509 -req -sha256 -days 365 \ - -in "$tmp_dir/server.csr" -CA "$fixture_dir/intermediate.crt" \ - -CAkey "$tmp_dir/intermediate.key" -CAserial "$tmp_dir/intermediate.srl" -CAcreateserial \ - -out "$fixture_dir/server.crt" -extfile "$tmp_dir/server.ext" +cp "$tmp_dir/intermediate.key" "$tmp_dir/signer.key" +cp "$fixture_dir/intermediate.crt" "$tmp_dir/signer.crt" +printf '2000\n' > "$tmp_dir/serial" +openssl ca -batch -config "$tmp_dir/ca.cnf" -in "$tmp_dir/server.csr" \ + -startdate "$start_date" -enddate "$leaf_end_date" \ + -extensions x509_ext -extfile "$tmp_dir/server.ext" \ + -out "$fixture_dir/server.crt" -notext make_key "$fixture_dir/client.key" openssl req -new -sha256 -key "$fixture_dir/client.key" \ -out "$tmp_dir/client.csr" -subj /CN=libhv-appletls-test-client printf '%s\n' \ + '[x509_ext]' \ 'basicConstraints=critical,CA:false' \ 'keyUsage=critical,digitalSignature,keyEncipherment' \ 'extendedKeyUsage=clientAuth' > "$tmp_dir/client.ext" -openssl x509 -req -sha256 -days 365 \ - -in "$tmp_dir/client.csr" -CA "$fixture_dir/root.crt" \ - -CAkey "$tmp_dir/root.key" -CAserial "$tmp_dir/root.srl" \ - -out "$fixture_dir/client.crt" -extfile "$tmp_dir/client.ext" +cp "$tmp_dir/root.key" "$tmp_dir/signer.key" +cp "$fixture_dir/root.crt" "$tmp_dir/signer.crt" +printf '3000\n' > "$tmp_dir/serial" +openssl ca -batch -config "$tmp_dir/ca.cnf" -in "$tmp_dir/client.csr" \ + -startdate "$start_date" -enddate "$leaf_end_date" \ + -extensions x509_ext -extfile "$tmp_dir/client.ext" \ + -out "$fixture_dir/client.crt" -notext make_key "$tmp_dir/wrong-root.key" -openssl req -new -x509 -sha256 -days 36500 \ - -key "$tmp_dir/wrong-root.key" -out "$fixture_dir/wrong-root.crt" \ - -subj /CN=libhv-appletls-wrong-root \ - -addext basicConstraints=critical,CA:true \ - -addext keyUsage=critical,keyCertSign,cRLSign +openssl req -new -sha256 -key "$tmp_dir/wrong-root.key" \ + -out "$tmp_dir/wrong-root.csr" -subj /CN=libhv-appletls-wrong-root +cp "$tmp_dir/wrong-root.key" "$tmp_dir/signer.key" +printf '4000\n' > "$tmp_dir/serial" +openssl ca -batch -selfsign -config "$tmp_dir/ca.cnf" \ + -keyfile "$tmp_dir/wrong-root.key" -in "$tmp_dir/wrong-root.csr" \ + -startdate "$start_date" -enddate "$ca_end_date" \ + -extensions x509_ext -extfile "$tmp_dir/root.ext" \ + -out "$fixture_dir/wrong-root.crt" -notext make_key "$fixture_dir/wrong-server.key" openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \ diff --git a/unittest/fixtures/appletls/intermediate.crt b/unittest/fixtures/appletls/intermediate.crt index 0e0520711..e09bc483c 100644 --- a/unittest/fixtures/appletls/intermediate.crt +++ b/unittest/fixtures/appletls/intermediate.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDQjCCAiqgAwIBAgIUUCbVWLU3xvd10p6EmaNbjLUfJLQwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAw -MTAxMTYxNloXDTI3MTAwMTAxMTYxNlowKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0 -bHMtdGVzdC1pbnRlcm1lZGlhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK -AoIBAQDG9cDQkfFzXerFq0qhMKu4TsS8yZayBfdKbWk8kbjMf1HJHMEBuvp1DG/N -KeqOywRrVmMjupc7M9WmrPZaUHysQ4cqP4h6Ut+hJx7exkTs/Te+q4zH65yNjoAC -OzBHAsFGi+oTQD4YRFknRESFKV4pu1N48AZ2fjHytoYJfEItKrvUBHX3ADazgza1 -7FMl5HdvAMHWrVNjTJ7Xw/PVQz4iV331+2jxpSAV+sSEaL6ECRkr8zt5SuUhs6MB -yesDoFQ2mRq1FekI5hrcmuonZtss+3nRHgmeKJN3DsgUNcl/TN+5Xds5FHpf9Srl -FRBQBfP4hfGWRUrVfn52vcuXwY3LAgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8C -AQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQWwyFZgNvZ5n09iufG30bMNjyR -KzAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DANBgkqhkiG9w0BAQsF -AAOCAQEAtW8mE1j2owQRQ+xi/3JW1vD8vdQ9uj+bdYRjXjJUKQuut1ppO370dUH7 -3yFPprO/uPjSAfzHNJ7kG5ksXlDqU9zECAihfiGPr8Ohw9qvUrrpeFBlFFOpY1o3 -CYV+s3Sr63SI4eJDo/I9PkXCy6NU7eBt5+c3JzAyfQPhI4SWhRXUC2xKW0LJvuuc -08lwL6G4ZyYmniJxFBkNUvvmQEMzAXRcy6GmCMLM4Y5PnV/ysromqumKQiFPqC49 -7cyPTcWvKv5wS7RtNkjHF9IxQeRJeZEtyQJKnaXwbW2UWLd5le++Sl4Rc2QgBbxv -ElpykATo49xSDNaKZjQmU1694zli1Q== +MIIDMDCCAhigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli +aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw +MDAwMFowKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlh +dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCelEw9R6bJjPvx5VY5 +RrAqjGJy6NY057K1uuwOUe5d5Ox8kH9U1mfES+Nd1kxcZBrY2Y/iNXHZYImnZRm1 +Gnw1P3Kyi769pz3Pb4G7SIq3E7vtdoMpGMvNr5kDSlVPWhd5Pcux7575e7cShH7F +prsXsxPlKCZNFPm6b4fJm7BZgU8Jbn+g2djl5uMJ9AfS17I1eDpnllrB7yFgYhSC +rIpKVtpWwB3iUZAwUviO8+/wXCWBBuhvt2nTh9eSARuMvGS9m8W6DCowALQ634ca +LzQQV0vY3M3R3A+1h/ykB8O/QcNVq2JwAw62+kBL9jX6N/RwPIftLzZGaQ5tq793 +nyn9AgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEG +MB0GA1UdDgQWBBSxcwEiCcoVUNnaTtB4Rf5hSYkD7DAfBgNVHSMEGDAWgBQNsJof +LlJaIMUi5q9DEnXEY8EmqTANBgkqhkiG9w0BAQsFAAOCAQEAEair+Wd0S03dEA+l +xf6ABZoGx2hOQ3fRtGVxVc86n0t489bTwULVZhHBVbK35IDWxpw6DHR0jI9kcPJ2 +kznTGjl3nkrktHx7tA1xQLsgCsXq99IuxkyEHjBRn0VKAAlJU9gT2ud2F86Fs7NO +l70H6P2Vj7FdHLW0XH3/Vx4SZVABkGpLuAnqaXtzF4muppFvyTiw+aXaVWhoyMoH +p8/WgBNUgxMsnWIr7dCN90sybwGTynudU99qdjmz+k+kiVw5v6qUbrZy8qHvcV2V +Xj/x40EbZlhWMPKn/j7yJ+nDc9Rpk2F0SLtqISAZ1tESmW3jdlgQ8LCRXMLx5yPI +TgDsdA== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/multi-ca.pem b/unittest/fixtures/appletls/multi-ca.pem index 1f18322f7..1c217cc51 100644 --- a/unittest/fixtures/appletls/multi-ca.pem +++ b/unittest/fixtures/appletls/multi-ca.pem @@ -1,40 +1,38 @@ -----BEGIN CERTIFICATE----- -MIIDOTCCAiGgAwIBAgIUaNSS3l3MNTJvIi7E+jzTF57vBxswDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw -MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs -ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDR -AaPFPG9m57ORbo5elu+23P/CdHJgOu8Xgga81/V35vo/sv3Pwhx60kVLxKTrsEVR -MjYqSPyoDOHMQZhrK80qdt/I4NYgb+CCqk7yt2m28yTXFPo5lAKlez5p6bTL5kvi -0u3fv96Tebu1v7cI183x3MgBMvMhcs8GkJHJIx0d5YNbG2uiiS7+BokfdHzQBKzA -YaXnngJAq+CxJ6HhgMNg3UpcbzgrAml7/n1DJgdsW5ITiS+HUUuHaNv+CnW5XlGY -kMDITJzVlJCOvKG116HnZ5BEYzt5FRRkEsUVhA6+t1uAMYlQBTqnDQHk2ep3WLcA -KHBGCfP5T5pDVMh811wtAgMBAAGjYzBhMB0GA1UdDgQWBBTjTUJODoeym8/z5rR/ -bPbq9Mfk/DAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DAPBgNVHRMB -Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAQb/L -SvAjFOCO0QYV3O3VNypEH4lDGfptVSAZbVb0+C5cWY9/bC88D8yke2vGkgS+IkOz -YKDLkYxDQsYpaIrGYtsruDelgNEPww8m26Aps2ciuWW+oCgToPjvea146NdqrBT8 -d9AbuZEGrQkn+JSz6Qe3sE4I3t8CjLZHEY7YK7y8jSOdkDVvc4TxMxEuiVBbQMSR -QddtXv2Qa20G4kCrn/EJMEGzlcJwkKtsQafT/aZBeySUIjM35P3tb/5JKjhERihS -NJPLU5G0kKhh2m3BwAT5ugja+846zQqSe69ehiMaLFjWTIphZS7EGFexFZoSSBXD -755LxDlauvz3rREOUg== +MIIDBDCCAeygAwIBAgICAQAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli +aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw +MDAwMFowIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMDd6nejls/LrXQQ7UCG+j1q3t+9 +qnYJXn0Cvdzxub33PNMc5WbGTqxJG1/mqzSSU6Hm6ISNQZJStQlI9L1WhIrFX0gp +9DZjaUI0eeIOii4LxPBV9QHs1zWZcZehCzz6hNoPoXUBzEaBpxWj2wjVLN9AjKVO +4JMpyShGyw4ieXyDmsft4ALummVWh+C1tVBcO3baOMN2k4PvLB6zUEqhT554ppvO +EQtlzEW1JPEd0i0VpQ9QHUMSDMhYljljYhMzn9x10nABdD6q++STypw1dk5YJycO +cwCeCOMRGs/IbOKyaUiutZMieXQlCyJJsDLunTSgQO/0xo2wNwqRDN8dSQIDAQAB +o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU +DbCaHy5SWiDFIuavQxJ1xGPBJqkwDQYJKoZIhvcNAQELBQADggEBAJU5OA8vGXAQ +7c/6sPpgznzNHiN3snGQImClfeImO5U09rYhGSU0pG/hTRy+FiQTpl3/SJ0w3h0/ +tq8OMdES4/HRK6voOkwzK926eWk9biyn1mhRKOHmCzLZdvYYly7Z7TFG1S3fmKIx +uVdz9Ot56Vs9KZllvHd85AZigiVvH4cJNlZZfzGeETWS0h0sfJOTtyDUuQBcs7QO +rWKw/qSFSsuwNGs++SdygYrT0EJ17Vc5jRWc4EetDIUUS/cBK092vaPUxv04IK+f +p4gzLWHPFL/E4yjfZXCdwUUW3Xbc6Fl2oDWDDmNKcXAtPJThMtUDHbRUYMVosYJ+ +1jMlDK+GsdM= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIDOzCCAiOgAwIBAgIUGFgaO7KB7AD4CoR+ZKzj4gsxd9gwDQYJKoZIhvcNAQEL -BQAwJDEiMCAGA1UEAwwZbGliaHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAgFw0yNjEw -MDEwMTE2MTZaGA8yMTI2MDkwNzAxMTYxNlowJDEiMCAGA1UEAwwZbGliaHYtYXBw -bGV0bHMtd3Jvbmctcm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB -AI6w0DdMs8ddB/XF+c8Ufr5Npc08HLDNbfOd3twDGXKW3oUoMe0gL1zfUZaGUdVi -g75PO79aJDDaiUSVjfUclLeV+06SAJcQcE/gk54PVwdNIfyiLYMOBp68KKZSZ3/y -4yzfnFxw88u1zIW/a1kdnMzrBOYRePoGAk+VpdpwP7blSaeUcrdy0Xi91DhPH7yf -guraCb4dWPDSRNZeBQOIOo+mnGOz8MX45uOZcXvscU2ysAYHUw7oat7xey5em6aJ -UbKKDV2P2gIxCEABHCT4UrP551u5Azkauc/ifbhu05ei0uyJ62x+Jpo2W9I4RNKX -7tENCos0+6ZJguP/rOqcTG0CAwEAAaNjMGEwHQYDVR0OBBYEFOQFxEzRNwt6CI8o -y8YveRoTTSWvMB8GA1UdIwQYMBaAFOQFxEzRNwt6CI8oy8YveRoTTSWvMA8GA1Ud -EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAR -DlVDu3IGNVuF4AXw1z2Kxts6vZOU7kp5cH0n3aKonrIbiuT+NsMaw/Bz0wchiWJL -PanINnxxzN2tjhtqbtJSFcGEULj5S8oj42igFuCPlRyj4qmd/bZNZXj2MSGEDXzG -Auhr2V0EKdyuQLLTdXSR268zFtZ8ywM/+D5bWmWRSHnPFOrZTAgEliUoSJAO/9+j -ajtkriUGfb4dXPoKvXtLLR2b95XTCWBpXLPpF8H+90jEaYhu+f8GeGUikqEyJAzE -vy8tMxf2ZlTHyW4hOSrymJWBzCUjzpezJOX6icDsRiyTVueEvSjzFUlUqpDtlFp2 -aGx0jSpWQOVxsFyXlQ0a +MIIDBjCCAe6gAwIBAgICQAAwDQYJKoZIhvcNAQELBQAwJDEiMCAGA1UEAwwZbGli +aHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAeFw0yNjEwMDEwMDAwMDBaFw00NjEwMDEw +MDAwMDBaMCQxIjAgBgNVBAMMGWxpYmh2LWFwcGxldGxzLXdyb25nLXJvb3QwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCcu7OMtEsMCAxiLmcV8opGOcA +ArvaEtOxbe2ephawjZA2fGZa5nVzD6UXxhGwVIoqI1pLAwsBqCawnZrP+SrOIklo +0uH+tSe8DfDAYROEVlt0F9xUum79fEwEy57TkywooeeZV7A1HCaU2uKqAEWlAWMi +Bl6x+xZu1nAytrl4gTi0yVveGXM3K8VcaFS2jWsol8md6h48IxnFt5YMeGxgvVbQ +vKj9ecrkGsAXw3ivzs9T3RwQQa+NJJP5lSa6yv5zdGdCf/ReCyhwFWirEE33rn/v +Lz2IU5hivvya50irO8a+pZs9ggGKlL3SxT88YT4cF3YkQnBabXqYC9UwhTvBAgMB +AAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW +BBT5t6zFn+OT5JRva4hit6YtiMt+0jANBgkqhkiG9w0BAQsFAAOCAQEAYkxuYPMZ +TdUJCpK90WV7KSNMtaLxC0kTPYAOe9hc+jIevIwroqYSDbRrapsbKN+lW6oIy+6V +e5tjWtmRg6KFOgkg9eSyhchT9U8oS7mYHQIUFystCNyWCvsbYPv6dXoCMX4EY5Zz +VDgpgqgvnEINTx83X+ZEYYwu5tdjX+0rtZqFa40KXlofEGFNsY4z0698nUqLR30I +uy6wiT5NEyia3d6glousk31+dSsJJtbeWKX5bUawsaVDpe7pn6h0N86vmxPsAT0E +K8cIp74x+0VOd6TfdmL63WDGIwwwAr5rGQEKMlWoDbmX9ywYdxwcECHg6rfQ2JpQ +Y598JtncvZ1OqA== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/root.crt b/unittest/fixtures/appletls/root.crt index 096e53443..003114cc7 100644 --- a/unittest/fixtures/appletls/root.crt +++ b/unittest/fixtures/appletls/root.crt @@ -1,20 +1,19 @@ -----BEGIN CERTIFICATE----- -MIIDOTCCAiGgAwIBAgIUaNSS3l3MNTJvIi7E+jzTF57vBxswDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MCAXDTI2MTAw -MTAxMTYxNloYDzIxMjYwOTA3MDExNjE2WjAjMSEwHwYDVQQDDBhsaWJodi1hcHBs -ZXRscy10ZXN0LXJvb3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDR -AaPFPG9m57ORbo5elu+23P/CdHJgOu8Xgga81/V35vo/sv3Pwhx60kVLxKTrsEVR -MjYqSPyoDOHMQZhrK80qdt/I4NYgb+CCqk7yt2m28yTXFPo5lAKlez5p6bTL5kvi -0u3fv96Tebu1v7cI183x3MgBMvMhcs8GkJHJIx0d5YNbG2uiiS7+BokfdHzQBKzA -YaXnngJAq+CxJ6HhgMNg3UpcbzgrAml7/n1DJgdsW5ITiS+HUUuHaNv+CnW5XlGY -kMDITJzVlJCOvKG116HnZ5BEYzt5FRRkEsUVhA6+t1uAMYlQBTqnDQHk2ep3WLcA -KHBGCfP5T5pDVMh811wtAgMBAAGjYzBhMB0GA1UdDgQWBBTjTUJODoeym8/z5rR/ -bPbq9Mfk/DAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DAPBgNVHRMB -Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAQb/L -SvAjFOCO0QYV3O3VNypEH4lDGfptVSAZbVb0+C5cWY9/bC88D8yke2vGkgS+IkOz -YKDLkYxDQsYpaIrGYtsruDelgNEPww8m26Aps2ciuWW+oCgToPjvea146NdqrBT8 -d9AbuZEGrQkn+JSz6Qe3sE4I3t8CjLZHEY7YK7y8jSOdkDVvc4TxMxEuiVBbQMSR -QddtXv2Qa20G4kCrn/EJMEGzlcJwkKtsQafT/aZBeySUIjM35P3tb/5JKjhERihS -NJPLU5G0kKhh2m3BwAT5ugja+846zQqSe69ehiMaLFjWTIphZS7EGFexFZoSSBXD -755LxDlauvz3rREOUg== +MIIDBDCCAeygAwIBAgICAQAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli +aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw +MDAwMFowIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMDd6nejls/LrXQQ7UCG+j1q3t+9 +qnYJXn0Cvdzxub33PNMc5WbGTqxJG1/mqzSSU6Hm6ISNQZJStQlI9L1WhIrFX0gp +9DZjaUI0eeIOii4LxPBV9QHs1zWZcZehCzz6hNoPoXUBzEaBpxWj2wjVLN9AjKVO +4JMpyShGyw4ieXyDmsft4ALummVWh+C1tVBcO3baOMN2k4PvLB6zUEqhT554ppvO +EQtlzEW1JPEd0i0VpQ9QHUMSDMhYljljYhMzn9x10nABdD6q++STypw1dk5YJycO +cwCeCOMRGs/IbOKyaUiutZMieXQlCyJJsDLunTSgQO/0xo2wNwqRDN8dSQIDAQAB +o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU +DbCaHy5SWiDFIuavQxJ1xGPBJqkwDQYJKoZIhvcNAQELBQADggEBAJU5OA8vGXAQ +7c/6sPpgznzNHiN3snGQImClfeImO5U09rYhGSU0pG/hTRy+FiQTpl3/SJ0w3h0/ +tq8OMdES4/HRK6voOkwzK926eWk9biyn1mhRKOHmCzLZdvYYly7Z7TFG1S3fmKIx +uVdz9Ot56Vs9KZllvHd85AZigiVvH4cJNlZZfzGeETWS0h0sfJOTtyDUuQBcs7QO +rWKw/qSFSsuwNGs++SdygYrT0EJ17Vc5jRWc4EetDIUUS/cBK092vaPUxv04IK+f +p4gzLWHPFL/E4yjfZXCdwUUW3Xbc6Fl2oDWDDmNKcXAtPJThMtUDHbRUYMVosYJ+ +1jMlDK+GsdM= -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/server-chain.pem b/unittest/fixtures/appletls/server-chain.pem index 980a79162..1b08814d4 100644 --- a/unittest/fixtures/appletls/server-chain.pem +++ b/unittest/fixtures/appletls/server-chain.pem @@ -1,40 +1,40 @@ -----BEGIN CERTIFICATE----- -MIIDWjCCAkKgAwIBAgIUJPkTLlf7usDaSbjoaiSCcEMohDcwDQYJKoZIhvcNAQEL -BQAwKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUw -HhcNMjYxMDAxMDExNjE2WhcNMjcxMDAxMDExNjE2WjAUMRIwEAYDVQQDDAlsb2Nh -bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqBwfTboti1xTt -TjmJ2cniO8QhAYTE1JON+k7Qe3WUqn/CZCdxZad61pO8UXesTdKrqs0Acj6McSdg -h4bikyG50CnonUAkIONx8uS1mTmStdCiI04HdHGAVqKMFYEH4bmCmMnN+JzGJ5IM -R8f1bscNdH/HxHZyKFmJ/GY9tjPVWESztSd2s3Commkhw9A5HmGnF64+UeHxQeK1 -k2TjY4Mv9UxvfxO0YfbwEP35ePCJ2Q+e1htrLatcem5xiTWrJBqDM49LvsFX3Snz -nsD8gCrMGlIf4pt1/qpy5JPqxOWqgtjl78otTQvpkJjfZ8+OS1FOpWRoqxJz7GC8 -hJrM3PIjAgMBAAGjgYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAw -EwYDVR0lBAwwCgYIKwYBBQUHAwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1Ud -DgQWBBRU+ynMt8p8+bI0ZpdG3N0vSrCXFDAfBgNVHSMEGDAWgBQWwyFZgNvZ5n09 -iufG30bMNjyRKzANBgkqhkiG9w0BAQsFAAOCAQEAJUQ0Ozhyz4iWmO0F/umfAeGq -93DPAFFwVW8s8P1FV16XnoWL89jNDvCMsaRfYLRONwtu3WgvhLePMEiQ3j8oM4FM -k0Rv2aZdvquNU7+zar3Zo9lsVsAGE3pBqp75j6jmHjO9Jl0RTB9vuO81Xwha2lRZ -9ijpmLUeHiI+ogL1PCyfqzduv5I8bUNLkzv/3vWXs9342pP5WRjC6XRPP/6yfXj7 -+q9Bm+ptfkC+pQldAajXHqZZ9rz5UlwTzzrkoS68nsOCRo8zxkcGyIf6mqoywVFp -6xrQ7Za9kPLjC+UN8/pRMPzXtWNIN2Mm9j4/Rto01VV/+Jw/q4YoRCcDvgpkSw== +MIIDSDCCAjCgAwIBAgICIAAwDQYJKoZIhvcNAQELBQAwKzEpMCcGA1UEAwwgbGli +aHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUwHhcNMjYxMDAxMDAwMDAwWhcN +MjcxMDAxMDAwMDAwWjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQC4vRm3M80oD6rMCbiKj+x9Dzbr71v8sPjVcLTE +43tR2wCmYY9x5VVo06OvsbUusGSGMwjIgjaq96L3t9jQAcHpC4mXm9g9LRGwoHe8 +g6Epd38Vyqr3E2sRoZap3Fqq+rrKOs4+KA3HUr8XK0L+WQvDPiCaKHyf+QQL2Vtg +FZnFBE8PmAnCyu12cbEYDs1Opb4QSdoTjoksKo56EBuigecdtB07c5ZiM9PYP7VI +G0sqTU5gZpvNkwb06xY6lKU5mSGo+gx7Pq8u1/NDaFf9MflNNCQbzeBscNaaPcWD +nzbQovyfhWbMHBWQxtTNOWckNqPrqkmXXPlyQfr8cqnaFNVzAgMBAAGjgYwwgYkw +DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH +AwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1UdDgQWBBRnnnCuUK1ZGFsqMiQk +L636ez4JNTAfBgNVHSMEGDAWgBSxcwEiCcoVUNnaTtB4Rf5hSYkD7DANBgkqhkiG +9w0BAQsFAAOCAQEAHDAn5jMS2ModMPWVmLEVoQBW41fDtrZgXnaXnHNKylH3PzZm +GijZKxwRuL13kVZ794nH+i57pK7bxjfwUPDhIEPueMTj0849GnEWTsUefRnymFaJ +FscqsVGB8HU4q1tevbukC2JvIsFSkV52/8i865TA23v8NuG+1Fkoxxf98RQqr8pb +vpvBjeEkldMVeXh3828y0m0WOu4gDVhx8ku5t6AA69AhbHYc3SJzj5DculG2ZqGW +X18Lm1YqDmrL4f15VHVko++AOvRXWUmAfFLrlJYJKdK8K3J1dIZJSvtesDAdQ2KN +Y85a0ded1kbCGJHSTTAHljrlRgJOUg901Uh4bw== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIDQjCCAiqgAwIBAgIUUCbVWLU3xvd10p6EmaNbjLUfJLQwDQYJKoZIhvcNAQEL -BQAwIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAw -MTAxMTYxNloXDTI3MTAwMTAxMTYxNlowKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0 -bHMtdGVzdC1pbnRlcm1lZGlhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK -AoIBAQDG9cDQkfFzXerFq0qhMKu4TsS8yZayBfdKbWk8kbjMf1HJHMEBuvp1DG/N -KeqOywRrVmMjupc7M9WmrPZaUHysQ4cqP4h6Ut+hJx7exkTs/Te+q4zH65yNjoAC -OzBHAsFGi+oTQD4YRFknRESFKV4pu1N48AZ2fjHytoYJfEItKrvUBHX3ADazgza1 -7FMl5HdvAMHWrVNjTJ7Xw/PVQz4iV331+2jxpSAV+sSEaL6ECRkr8zt5SuUhs6MB -yesDoFQ2mRq1FekI5hrcmuonZtss+3nRHgmeKJN3DsgUNcl/TN+5Xds5FHpf9Srl -FRBQBfP4hfGWRUrVfn52vcuXwY3LAgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8C -AQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQWwyFZgNvZ5n09iufG30bMNjyR -KzAfBgNVHSMEGDAWgBTjTUJODoeym8/z5rR/bPbq9Mfk/DANBgkqhkiG9w0BAQsF -AAOCAQEAtW8mE1j2owQRQ+xi/3JW1vD8vdQ9uj+bdYRjXjJUKQuut1ppO370dUH7 -3yFPprO/uPjSAfzHNJ7kG5ksXlDqU9zECAihfiGPr8Ohw9qvUrrpeFBlFFOpY1o3 -CYV+s3Sr63SI4eJDo/I9PkXCy6NU7eBt5+c3JzAyfQPhI4SWhRXUC2xKW0LJvuuc -08lwL6G4ZyYmniJxFBkNUvvmQEMzAXRcy6GmCMLM4Y5PnV/ysromqumKQiFPqC49 -7cyPTcWvKv5wS7RtNkjHF9IxQeRJeZEtyQJKnaXwbW2UWLd5le++Sl4Rc2QgBbxv -ElpykATo49xSDNaKZjQmU1694zli1Q== +MIIDMDCCAhigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli +aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw +MDAwMFowKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlh +dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCelEw9R6bJjPvx5VY5 +RrAqjGJy6NY057K1uuwOUe5d5Ox8kH9U1mfES+Nd1kxcZBrY2Y/iNXHZYImnZRm1 +Gnw1P3Kyi769pz3Pb4G7SIq3E7vtdoMpGMvNr5kDSlVPWhd5Pcux7575e7cShH7F +prsXsxPlKCZNFPm6b4fJm7BZgU8Jbn+g2djl5uMJ9AfS17I1eDpnllrB7yFgYhSC +rIpKVtpWwB3iUZAwUviO8+/wXCWBBuhvt2nTh9eSARuMvGS9m8W6DCowALQ634ca +LzQQV0vY3M3R3A+1h/ykB8O/QcNVq2JwAw62+kBL9jX6N/RwPIftLzZGaQ5tq793 +nyn9AgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEG +MB0GA1UdDgQWBBSxcwEiCcoVUNnaTtB4Rf5hSYkD7DAfBgNVHSMEGDAWgBQNsJof +LlJaIMUi5q9DEnXEY8EmqTANBgkqhkiG9w0BAQsFAAOCAQEAEair+Wd0S03dEA+l +xf6ABZoGx2hOQ3fRtGVxVc86n0t489bTwULVZhHBVbK35IDWxpw6DHR0jI9kcPJ2 +kznTGjl3nkrktHx7tA1xQLsgCsXq99IuxkyEHjBRn0VKAAlJU9gT2ud2F86Fs7NO +l70H6P2Vj7FdHLW0XH3/Vx4SZVABkGpLuAnqaXtzF4muppFvyTiw+aXaVWhoyMoH +p8/WgBNUgxMsnWIr7dCN90sybwGTynudU99qdjmz+k+kiVw5v6qUbrZy8qHvcV2V +Xj/x40EbZlhWMPKn/j7yJ+nDc9Rpk2F0SLtqISAZ1tESmW3jdlgQ8LCRXMLx5yPI +TgDsdA== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/server-pkcs1.key b/unittest/fixtures/appletls/server-pkcs1.key index 8dfb8ceec..74465a5eb 100644 --- a/unittest/fixtures/appletls/server-pkcs1.key +++ b/unittest/fixtures/appletls/server-pkcs1.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAqgcH026LYtcU7U45idnJ4jvEIQGExNSTjfpO0Ht1lKp/wmQn -cWWnetaTvFF3rE3Sq6rNAHI+jHEnYIeG4pMhudAp6J1AJCDjcfLktZk5krXQoiNO -B3RxgFaijBWBB+G5gpjJzficxieSDEfH9W7HDXR/x8R2cihZifxmPbYz1VhEs7Un -drNwqJppIcPQOR5hpxeuPlHh8UHitZNk42ODL/VMb38TtGH28BD9+XjwidkPntYb -ay2rXHpucYk1qyQagzOPS77BV90p857A/IAqzBpSH+Kbdf6qcuST6sTlqoLY5e/K -LU0L6ZCY32fPjktRTqVkaKsSc+xgvISazNzyIwIDAQABAoIBAAMDwOXEzf/gpGRY -wLhq/iNev+l952a+Bie8Sm1z4u/R3hYKRJDEJqYM6+2o3CBX+OZGTwA1BlrjHrmd -bYzS4wQyZqvTLfH2C1JX5io6H0U0qBBX4+hJ7kFCR/uH3hPPssRYBSv7vnvc87/3 -/dmiLzFT4XgfSaJYiM3jhcSOWHjt4k9j2uoSFjoGBRGvf1qHyNlaxdqKSvX1cwco -xvnXFXbrwkY+OHOtrabMXtmhN4/JPNcf6PYdx8BBRQ//MRspkaDl0VWWOSryxyP9 -6w2ezWNezhZ+CiV4r7AcqSWK9lsoHcVUfZfIbSpS7yKYr4CLT+3edqxjZZQK8kGl -tw44LXECgYEA36p8jY/Ay7X0v5gmYa75QgBY2yt1LX5e5lHSQF666+SyzFgZMRzz -PPIHFUVyJkxGvJ9egyvjBCYttItYg1Xp5UOu0Tzn56XupelU2uBvHM2ruIXvICit -VDlkHlH+bTcZEC5opTGzT4uUFPTQqya9YNksVjCOH4ktslsXd3RYtKcCgYEAwpt4 -bIjgEqNIApuOOMcj8EELqrAhjS2eePNwer5d1r398OO8iLo2eY6OnOqmCCWaHgsy -1s81+SjbMlmTl9FVWihJpfR/4c8GSiZBS/6Tsk6VDaOd3FiXI9FwUdybT+M5/idj -QD2wcGpNRJIQu0QgHueBv5nqSPYV26I0JK6bOiUCgYEAoHQmzEtPTRSokvYsurES -obWsCPcBJfTdUa9q/MC4qde0KQIeeGxDVvpt+GWMgUsBB/nwjHtkbaqR6U553iY5 -GD7Y38Qovbb9IErmk+qj627kfQigRlrIFX7igxnhQypesYwJiFDCSRNh1TLXq6Cs -BRlnRCGrI5Z+kM/mYsy1gksCgYB2HitPpRxr85MnkgcWyzgzASf1qAYVTJUdUJT6 -y0TlrFfPuEqcqnmZ+j7xWzL/SuNqTN3Ep+xYmMXCn8AHq9UkbcOV6PsdsaxdoS6M -064N0ciCiMauEU9bPCnyZfYW3RI8Augo+8h10u+nKQjiwQzF9To5c1BSjJrjvmXr -xdcNyQKBgQDXBKQyms7LPHZa+AB/1o2tPbU/4To85d3GlcfZM7FCZOVOXLNt0AZ7 -fKcLMBaCNfIdNhI4ZNSc/OD4lX+SCpVSF7JMbwpVfPP2Y+M/z5YiWtmQFL/D3I78 -clhzyW/og/OR0exVWfwTPplhvxzbigO8orgTCRyMOhSwhYhIb7g/pQ== +MIIEpAIBAAKCAQEAuL0ZtzPNKA+qzAm4io/sfQ826+9b/LD41XC0xON7UdsApmGP +ceVVaNOjr7G1LrBkhjMIyII2qvei97fY0AHB6QuJl5vYPS0RsKB3vIOhKXd/Fcqq +9xNrEaGWqdxaqvq6yjrOPigNx1K/FytC/lkLwz4gmih8n/kEC9lbYBWZxQRPD5gJ +wsrtdnGxGA7NTqW+EEnaE46JLCqOehAbooHnHbQdO3OWYjPT2D+1SBtLKk1OYGab +zZMG9OsWOpSlOZkhqPoMez6vLtfzQ2hX/TH5TTQkG83gbHDWmj3Fg5820KL8n4Vm +zBwVkMbUzTlnJDaj66pJl1z5ckH6/HKp2hTVcwIDAQABAoIBAEgX59qyWPwqzQ0O +OBm+29vcHaNKSDwfNiRZdPonCj+h9yl3Bjs8861Sdl0AvUOoq7ohXWqeQkZLGKqS +cQaPwQQ4r+vd8i/BkFc88C09sx2TGCHBcyGzzsNVK45DQ5DZAx8bftQL3oCsPo2E +oQLQbkI10xRF+4iUbatQGhQvqdAT2ZsCcYEHZnZ61hCMepz1VjsBoGpIx06bfoQl +WPJLoikR9T5eF856Dh+fTa87RgzitrmztJs7lwbyZoHNWu0BeI4INvbuRAmwILou +pYKHg9GgMnC2HIOB53Ww4dbDr/Y+tE6py4ePw2x9t+Lpz+bQd+HzRGwX+W1HPa9o +k6D/bCECgYEA67tKAPH+wko9yK8WZTvCkTHxSXe5hpvnsVsxqU6c4xhjKlSgEk0c +gSd6RNdC7UrNqoD8/PETuFsvnWgGtukHhGeewwmM9Xe1wbXjOQO3Fk+KCOWkSOOj +LDReje0EeJodYbeKKjGSVu7oSDpgVDyV0oLJaMYaZ8t21+KNJQOzktMCgYEAyJ9m +tTnUOffQjBzkYDEd6NriUo9rEp1yH2wxvYnLnek313eXZtQlNI4Nwqd1Nsdu0/MW +TDfEhpLfGLVeLEU5VtU3JG/vbMCOUWFS76ChNwKHat0cmiz8gDJURhxY4fpWbzc3 +WOrNTKkihoBiHzH+5B0Hgu3QOrSvZBOsSKOZzuECgYEAnps6NJ6eGZ2YKnHbsKtf +ww+GWDcs5ev6HTPNmyvglU+wUSf1N7sYZbHpK25mgoAlFwaIsauG6DC6Pb9jXSg3 +PZf2kyXW6MXtzfMSeicMxf8oUcopGj3HaROnVvjVXEvdXwT9+lu2KbW/JfHZJHRL +HgOPfmZkF9gnEyREcVYnOa8CgYABthJbM14TDIET4N81ztVxegR6Lcz9AKjLidG2 +yykYdLfMN7Hr551VoGyPn3wJdpQEbMtg5QzhFPmgLVPbTs/ZZMIupmHFbLMKEKlz +b8xQOs5K5A3tZrrUoRlE69L6QndgRXlMYdxUbhDkUs4DdBq3eWPqAvtGtOnWEbDj +gbm7IQKBgQCEqZCgS3X7It0H2depIwM+X09W+mdCZiPkMB6cj8cwr3jQz8R5Dhcv +St27BeEEtoipzon/LZ8lMfkq/d1a3f5nIV5PbAxzjZjToeoz/HU6OvTM3A5yE2LI +ETgK0WnuDkURhNPRjt8BauDI0K7MyDsqNhjctus9JRoJETQt/jRSQg== -----END RSA PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/server-pkcs8.key b/unittest/fixtures/appletls/server-pkcs8.key index dc810c8f9..07ec1ce9b 100644 --- a/unittest/fixtures/appletls/server-pkcs8.key +++ b/unittest/fixtures/appletls/server-pkcs8.key @@ -1,28 +1,28 @@ -----BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCqBwfTboti1xTt -TjmJ2cniO8QhAYTE1JON+k7Qe3WUqn/CZCdxZad61pO8UXesTdKrqs0Acj6McSdg -h4bikyG50CnonUAkIONx8uS1mTmStdCiI04HdHGAVqKMFYEH4bmCmMnN+JzGJ5IM -R8f1bscNdH/HxHZyKFmJ/GY9tjPVWESztSd2s3Commkhw9A5HmGnF64+UeHxQeK1 -k2TjY4Mv9UxvfxO0YfbwEP35ePCJ2Q+e1htrLatcem5xiTWrJBqDM49LvsFX3Snz -nsD8gCrMGlIf4pt1/qpy5JPqxOWqgtjl78otTQvpkJjfZ8+OS1FOpWRoqxJz7GC8 -hJrM3PIjAgMBAAECggEAAwPA5cTN/+CkZFjAuGr+I16/6X3nZr4GJ7xKbXPi79He -FgpEkMQmpgzr7ajcIFf45kZPADUGWuMeuZ1tjNLjBDJmq9Mt8fYLUlfmKjofRTSo -EFfj6EnuQUJH+4feE8+yxFgFK/u+e9zzv/f92aIvMVPheB9JoliIzeOFxI5YeO3i -T2Pa6hIWOgYFEa9/WofI2VrF2opK9fVzByjG+dcVduvCRj44c62tpsxe2aE3j8k8 -1x/o9h3HwEFFD/8xGymRoOXRVZY5KvLHI/3rDZ7NY17OFn4KJXivsBypJYr2Wygd -xVR9l8htKlLvIpivgItP7d52rGNllAryQaW3DjgtcQKBgQDfqnyNj8DLtfS/mCZh -rvlCAFjbK3Utfl7mUdJAXrrr5LLMWBkxHPM88gcVRXImTEa8n16DK+MEJi20i1iD -VenlQ67RPOfnpe6l6VTa4G8czau4he8gKK1UOWQeUf5tNxkQLmilMbNPi5QU9NCr -Jr1g2SxWMI4fiS2yWxd3dFi0pwKBgQDCm3hsiOASo0gCm444xyPwQQuqsCGNLZ54 -83B6vl3Wvf3w47yIujZ5jo6c6qYIJZoeCzLWzzX5KNsyWZOX0VVaKEml9H/hzwZK -JkFL/pOyTpUNo53cWJcj0XBR3JtP4zn+J2NAPbBwak1EkhC7RCAe54G/mepI9hXb -ojQkrps6JQKBgQCgdCbMS09NFKiS9iy6sRKhtawI9wEl9N1Rr2r8wLip17QpAh54 -bENW+m34ZYyBSwEH+fCMe2RtqpHpTnneJjkYPtjfxCi9tv0gSuaT6qPrbuR9CKBG -WsgVfuKDGeFDKl6xjAmIUMJJE2HVMteroKwFGWdEIasjln6Qz+ZizLWCSwKBgHYe -K0+lHGvzkyeSBxbLODMBJ/WoBhVMlR1QlPrLROWsV8+4SpyqeZn6PvFbMv9K42pM -3cSn7FiYxcKfwAer1SRtw5Xo+x2xrF2hLozTrg3RyIKIxq4RT1s8KfJl9hbdEjwC -6Cj7yHXS76cpCOLBDMX1OjlzUFKMmuO+ZevF1w3JAoGBANcEpDKazss8dlr4AH/W -ja09tT/hOjzl3caVx9kzsUJk5U5cs23QBnt8pwswFoI18h02Ejhk1Jz84PiVf5IK -lVIXskxvClV88/Zj4z/PliJa2ZAUv8PcjvxyWHPJb+iD85HR7FVZ/BM+mWG/HNuK -A7yiuBMJHIw6FLCFiEhvuD+l +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4vRm3M80oD6rM +CbiKj+x9Dzbr71v8sPjVcLTE43tR2wCmYY9x5VVo06OvsbUusGSGMwjIgjaq96L3 +t9jQAcHpC4mXm9g9LRGwoHe8g6Epd38Vyqr3E2sRoZap3Fqq+rrKOs4+KA3HUr8X +K0L+WQvDPiCaKHyf+QQL2VtgFZnFBE8PmAnCyu12cbEYDs1Opb4QSdoTjoksKo56 +EBuigecdtB07c5ZiM9PYP7VIG0sqTU5gZpvNkwb06xY6lKU5mSGo+gx7Pq8u1/ND +aFf9MflNNCQbzeBscNaaPcWDnzbQovyfhWbMHBWQxtTNOWckNqPrqkmXXPlyQfr8 +cqnaFNVzAgMBAAECggEASBfn2rJY/CrNDQ44Gb7b29wdo0pIPB82JFl0+icKP6H3 +KXcGOzzzrVJ2XQC9Q6iruiFdap5CRksYqpJxBo/BBDiv693yL8GQVzzwLT2zHZMY +IcFzIbPOw1UrjkNDkNkDHxt+1AvegKw+jYShAtBuQjXTFEX7iJRtq1AaFC+p0BPZ +mwJxgQdmdnrWEIx6nPVWOwGgakjHTpt+hCVY8kuiKRH1Pl4XznoOH59NrztGDOK2 +ubO0mzuXBvJmgc1a7QF4jgg29u5ECbAgui6lgoeD0aAycLYcg4HndbDh1sOv9j60 +TqnLh4/DbH234unP5tB34fNEbBf5bUc9r2iToP9sIQKBgQDru0oA8f7CSj3IrxZl +O8KRMfFJd7mGm+exWzGpTpzjGGMqVKASTRyBJ3pE10LtSs2qgPz88RO4Wy+daAa2 +6QeEZ57DCYz1d7XBteM5A7cWT4oI5aRI46MsNF6N7QR4mh1ht4oqMZJW7uhIOmBU +PJXSgsloxhpny3bX4o0lA7OS0wKBgQDIn2a1OdQ599CMHORgMR3o2uJSj2sSnXIf +bDG9icud6TfXd5dm1CU0jg3Cp3U2x27T8xZMN8SGkt8YtV4sRTlW1Tckb+9swI5R +YVLvoKE3Aodq3RyaLPyAMlRGHFjh+lZvNzdY6s1MqSKGgGIfMf7kHQeC7dA6tK9k +E6xIo5nO4QKBgQCemzo0np4ZnZgqcduwq1/DD4ZYNyzl6/odM82bK+CVT7BRJ/U3 +uxhlsekrbmaCgCUXBoixq4boMLo9v2NdKDc9l/aTJdboxe3N8xJ6JwzF/yhRyika +PcdpE6dW+NVcS91fBP36W7Yptb8l8dkkdEseA49+ZmQX2CcTJERxVic5rwKBgAG2 +ElszXhMMgRPg3zXO1XF6BHotzP0AqMuJ0bbLKRh0t8w3sevnnVWgbI+ffAl2lARs +y2DlDOEU+aAtU9tOz9lkwi6mYcVsswoQqXNvzFA6zkrkDe1mutShGUTr0vpCd2BF +eUxh3FRuEORSzgN0Grd5Y+oC+0a06dYRsOOBubshAoGBAISpkKBLdfsi3QfZ16kj +Az5fT1b6Z0JmI+QwHpyPxzCveNDPxHkOFy9K3bsF4QS2iKnOif8tnyUx+Sr93Vrd +/mchXk9sDHONmNOh6jP8dTo69MzcDnITYsgROArRae4ORRGE09GO3wFq4MjQrszI +Oyo2GNy26z0lGgkRNC3+NFJC -----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/server.crt b/unittest/fixtures/appletls/server.crt index 47f88a0e5..528724127 100644 --- a/unittest/fixtures/appletls/server.crt +++ b/unittest/fixtures/appletls/server.crt @@ -1,20 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDWjCCAkKgAwIBAgIUJPkTLlf7usDaSbjoaiSCcEMohDcwDQYJKoZIhvcNAQEL -BQAwKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUw -HhcNMjYxMDAxMDExNjE2WhcNMjcxMDAxMDExNjE2WjAUMRIwEAYDVQQDDAlsb2Nh -bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqBwfTboti1xTt -TjmJ2cniO8QhAYTE1JON+k7Qe3WUqn/CZCdxZad61pO8UXesTdKrqs0Acj6McSdg -h4bikyG50CnonUAkIONx8uS1mTmStdCiI04HdHGAVqKMFYEH4bmCmMnN+JzGJ5IM -R8f1bscNdH/HxHZyKFmJ/GY9tjPVWESztSd2s3Commkhw9A5HmGnF64+UeHxQeK1 -k2TjY4Mv9UxvfxO0YfbwEP35ePCJ2Q+e1htrLatcem5xiTWrJBqDM49LvsFX3Snz -nsD8gCrMGlIf4pt1/qpy5JPqxOWqgtjl78otTQvpkJjfZ8+OS1FOpWRoqxJz7GC8 -hJrM3PIjAgMBAAGjgYwwgYkwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAw -EwYDVR0lBAwwCgYIKwYBBQUHAwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1Ud -DgQWBBRU+ynMt8p8+bI0ZpdG3N0vSrCXFDAfBgNVHSMEGDAWgBQWwyFZgNvZ5n09 -iufG30bMNjyRKzANBgkqhkiG9w0BAQsFAAOCAQEAJUQ0Ozhyz4iWmO0F/umfAeGq -93DPAFFwVW8s8P1FV16XnoWL89jNDvCMsaRfYLRONwtu3WgvhLePMEiQ3j8oM4FM -k0Rv2aZdvquNU7+zar3Zo9lsVsAGE3pBqp75j6jmHjO9Jl0RTB9vuO81Xwha2lRZ -9ijpmLUeHiI+ogL1PCyfqzduv5I8bUNLkzv/3vWXs9342pP5WRjC6XRPP/6yfXj7 -+q9Bm+ptfkC+pQldAajXHqZZ9rz5UlwTzzrkoS68nsOCRo8zxkcGyIf6mqoywVFp -6xrQ7Za9kPLjC+UN8/pRMPzXtWNIN2Mm9j4/Rto01VV/+Jw/q4YoRCcDvgpkSw== +MIIDSDCCAjCgAwIBAgICIAAwDQYJKoZIhvcNAQELBQAwKzEpMCcGA1UEAwwgbGli +aHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUwHhcNMjYxMDAxMDAwMDAwWhcN +MjcxMDAxMDAwMDAwWjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQC4vRm3M80oD6rMCbiKj+x9Dzbr71v8sPjVcLTE +43tR2wCmYY9x5VVo06OvsbUusGSGMwjIgjaq96L3t9jQAcHpC4mXm9g9LRGwoHe8 +g6Epd38Vyqr3E2sRoZap3Fqq+rrKOs4+KA3HUr8XK0L+WQvDPiCaKHyf+QQL2Vtg +FZnFBE8PmAnCyu12cbEYDs1Opb4QSdoTjoksKo56EBuigecdtB07c5ZiM9PYP7VI +G0sqTU5gZpvNkwb06xY6lKU5mSGo+gx7Pq8u1/NDaFf9MflNNCQbzeBscNaaPcWD +nzbQovyfhWbMHBWQxtTNOWckNqPrqkmXXPlyQfr8cqnaFNVzAgMBAAGjgYwwgYkw +DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH +AwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1UdDgQWBBRnnnCuUK1ZGFsqMiQk +L636ez4JNTAfBgNVHSMEGDAWgBSxcwEiCcoVUNnaTtB4Rf5hSYkD7DANBgkqhkiG +9w0BAQsFAAOCAQEAHDAn5jMS2ModMPWVmLEVoQBW41fDtrZgXnaXnHNKylH3PzZm +GijZKxwRuL13kVZ794nH+i57pK7bxjfwUPDhIEPueMTj0849GnEWTsUefRnymFaJ +FscqsVGB8HU4q1tevbukC2JvIsFSkV52/8i865TA23v8NuG+1Fkoxxf98RQqr8pb +vpvBjeEkldMVeXh3828y0m0WOu4gDVhx8ku5t6AA69AhbHYc3SJzj5DculG2ZqGW +X18Lm1YqDmrL4f15VHVko++AOvRXWUmAfFLrlJYJKdK8K3J1dIZJSvtesDAdQ2KN +Y85a0ded1kbCGJHSTTAHljrlRgJOUg901Uh4bw== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/wrong-root.crt b/unittest/fixtures/appletls/wrong-root.crt index f86814b88..539d57f86 100644 --- a/unittest/fixtures/appletls/wrong-root.crt +++ b/unittest/fixtures/appletls/wrong-root.crt @@ -1,20 +1,19 @@ -----BEGIN CERTIFICATE----- -MIIDOzCCAiOgAwIBAgIUGFgaO7KB7AD4CoR+ZKzj4gsxd9gwDQYJKoZIhvcNAQEL -BQAwJDEiMCAGA1UEAwwZbGliaHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAgFw0yNjEw -MDEwMTE2MTZaGA8yMTI2MDkwNzAxMTYxNlowJDEiMCAGA1UEAwwZbGliaHYtYXBw -bGV0bHMtd3Jvbmctcm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB -AI6w0DdMs8ddB/XF+c8Ufr5Npc08HLDNbfOd3twDGXKW3oUoMe0gL1zfUZaGUdVi -g75PO79aJDDaiUSVjfUclLeV+06SAJcQcE/gk54PVwdNIfyiLYMOBp68KKZSZ3/y -4yzfnFxw88u1zIW/a1kdnMzrBOYRePoGAk+VpdpwP7blSaeUcrdy0Xi91DhPH7yf -guraCb4dWPDSRNZeBQOIOo+mnGOz8MX45uOZcXvscU2ysAYHUw7oat7xey5em6aJ -UbKKDV2P2gIxCEABHCT4UrP551u5Azkauc/ifbhu05ei0uyJ62x+Jpo2W9I4RNKX -7tENCos0+6ZJguP/rOqcTG0CAwEAAaNjMGEwHQYDVR0OBBYEFOQFxEzRNwt6CI8o -y8YveRoTTSWvMB8GA1UdIwQYMBaAFOQFxEzRNwt6CI8oy8YveRoTTSWvMA8GA1Ud -EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAR -DlVDu3IGNVuF4AXw1z2Kxts6vZOU7kp5cH0n3aKonrIbiuT+NsMaw/Bz0wchiWJL -PanINnxxzN2tjhtqbtJSFcGEULj5S8oj42igFuCPlRyj4qmd/bZNZXj2MSGEDXzG -Auhr2V0EKdyuQLLTdXSR268zFtZ8ywM/+D5bWmWRSHnPFOrZTAgEliUoSJAO/9+j -ajtkriUGfb4dXPoKvXtLLR2b95XTCWBpXLPpF8H+90jEaYhu+f8GeGUikqEyJAzE -vy8tMxf2ZlTHyW4hOSrymJWBzCUjzpezJOX6icDsRiyTVueEvSjzFUlUqpDtlFp2 -aGx0jSpWQOVxsFyXlQ0a +MIIDBjCCAe6gAwIBAgICQAAwDQYJKoZIhvcNAQELBQAwJDEiMCAGA1UEAwwZbGli +aHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAeFw0yNjEwMDEwMDAwMDBaFw00NjEwMDEw +MDAwMDBaMCQxIjAgBgNVBAMMGWxpYmh2LWFwcGxldGxzLXdyb25nLXJvb3QwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCcu7OMtEsMCAxiLmcV8opGOcA +ArvaEtOxbe2ephawjZA2fGZa5nVzD6UXxhGwVIoqI1pLAwsBqCawnZrP+SrOIklo +0uH+tSe8DfDAYROEVlt0F9xUum79fEwEy57TkywooeeZV7A1HCaU2uKqAEWlAWMi +Bl6x+xZu1nAytrl4gTi0yVveGXM3K8VcaFS2jWsol8md6h48IxnFt5YMeGxgvVbQ +vKj9ecrkGsAXw3ivzs9T3RwQQa+NJJP5lSa6yv5zdGdCf/ReCyhwFWirEE33rn/v +Lz2IU5hivvya50irO8a+pZs9ggGKlL3SxT88YT4cF3YkQnBabXqYC9UwhTvBAgMB +AAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW +BBT5t6zFn+OT5JRva4hit6YtiMt+0jANBgkqhkiG9w0BAQsFAAOCAQEAYkxuYPMZ +TdUJCpK90WV7KSNMtaLxC0kTPYAOe9hc+jIevIwroqYSDbRrapsbKN+lW6oIy+6V +e5tjWtmRg6KFOgkg9eSyhchT9U8oS7mYHQIUFystCNyWCvsbYPv6dXoCMX4EY5Zz +VDgpgqgvnEINTx83X+ZEYYwu5tdjX+0rtZqFa40KXlofEGFNsY4z0698nUqLR30I +uy6wiT5NEyia3d6glousk31+dSsJJtbeWKX5bUawsaVDpe7pn6h0N86vmxPsAT0E +K8cIp74x+0VOd6TfdmL63WDGIwwwAr5rGQEKMlWoDbmX9ywYdxwcECHg6rfQ2JpQ +Y598JtncvZ1OqA== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/wrong-server.key b/unittest/fixtures/appletls/wrong-server.key index a3960afce..ef8d3d58e 100644 --- a/unittest/fixtures/appletls/wrong-server.key +++ b/unittest/fixtures/appletls/wrong-server.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAnX+XlVjQzYnuklKaCTcyxv73tgyIf9x+kP352Qnd5LTV9Rrf -FHEwRX/JQt03V8LTBhf+5HsV7N2FciktMlNBjdNBA7HAe6+1yU0nOufJOQWd+xSw -lvqYrsD70Xb5jRKWV7pANRJLnqFgNI9giqRxx85aX121nkZH04F5Lpls4oY89+Ii -4DgoNJaxEqo+zjfDRXAuveM107s/iuSpnsxZAJyGtuBQb2OBlMvTB9GlhMAmLzXe -3vNDpPzKMOykT4ZmB+PVaqSUtbRh4zYavl7NWYflZ8H2/AIYgzwm8CTu+ArDoOak -CnWLnucRJjhzS1HJapLp2SHGCdiHN7u8aXo2KQIDAQABAoIBAATOIUJRuOEkfa5i -LcftMrPmkIkx3bJE+GmVDhvklKwHJmX5gWfewjHEoc/T7v3S+Fw9vC2dYcBdy9X9 -Up8v8haRJPEnaa98X2f6XiGKc9W1Capg6bhZgfIG+kfcQOXgdMzNZmsYGU2IL+a6 -nx/rv3rwnUo+ki13iHZ4A0n8LVnF4XGpfGfScxbWh5/yICnI8nC/bmQpkwHyPE2I -zBQyEJ6fJikQgVIwSTke9FCABF/ETwt+hpO4g2GLe0/KM0//GeQ52ERPs3zTpZOf -Geznt12Eb2eq+0F1bLo9mG4k/Drv7V9l7yKjOL9iJ+FJDo4ybU1HibETiy25M/q8 -tb5kGF8CgYEAzeAFR076kARdy5pzi9iWeaAZ7fQDr6PPS+uV9J+gIixPokfCdFiS -BxNtIa/vfjHIw/nYjbm++P62ENiA+ycjxzXHERKffLVw2tySdzGzKPBbM5x9tUrP -qrBbU0Uuxhd0aquo0u+XFfgOecEefJ2zTQFfkkeXZoZyU65sJc1WU1MCgYEAw9hN -xfRbHgJOuwe0msXcJ07uh4Om6YmTtKj2B8U4RdljIj8E+N8cUxVaJ+giDsUE+qfh -TxC1JI10pFA5lk/UhOqZqcHXqwrPKKHKjfmr7Xy5mosCVHTe7aR9QpOrqT1DJqnr -XCN3JwbRhBHTHkWIBDn6LfGIzde5ND+KSx9D/RMCgYEAzD9znTJa3aSnVYbvGZAQ -gav37Z6IRanT0HNyu1XebejePJbK8dipT4HTZHeCuAU2NE/cq4bbU3aINKBHHmTP -VyUgUOzT88qio0/vs3dIUtZa9RJNmR4WdzYt9KgPZpIAeo/BlzwB/dayrdKNp35h -U4WIRrzmFN5P8Ht8aeiUu2cCgYEArh3u92HKaKGwkYPGRBxJIQGB/CVGDjdshJ/7 -LOlgoGknQ9k3eHQT4KIJJ5WwQeVUCe2b2QmHotnIrBVPPZ332bwhpdVbAwx3JS7C -wPsKqffLo+SWy7OkRy+I1dooMizvOL61K5O0aZQcTgjy4+T5iphpHtOwxyFV3Wfo -ceV4MtUCgYAswdXH0jgqwIhKy+wPvXIJQIePS1H7A78SX32CV7gdOCfzMUfZ2Hf9 -31VtNidLt4BmUo7mC3Sr6GMmSkHmxUF02myqgj3YPyzDgC4nNABZ7JENUUiArEd4 -3XZ3vNzWnsU4Y4OTxzji69eemVPEx8AOyYNCptWo6sZK/Jq7TIFU7A== +MIIEpAIBAAKCAQEAlHBnSXI8hNj1THttaZfjkXkGrN2TCm5o2jNPWo1XLJwMB5g4 +xRTzXzLZGSnfPfy9g+FYSd2lgSj3u3N+Y1dXUFT3sbP2x6xTAUO3GQIeolw912ec +IxXpGmL2ckcwt8m+M7Rh94jqsRqdk28DNqiP2BHHIBVrqd9HC2tRekwFWXWRpNbo +Vv+CJKvsTSQzyhudXPCNaDzUPyFl0sC+3LXSOEvLrph8+IO0cmloeXZdQJxXoN2n +uF1qf5Y+9mMwm4KnxjNpBcM4JuVHyli+Pw4WyT1rS7Z1CT6DCDB9FdDnCW8XtPWe +vmU5nvLgbgrb2eHXp29MmhnZO8Bm+dgfcRwSTwIDAQABAoIBAAEd4du1x6nYyn7e +79ysF+uIyeX0GkwHhXBU6P9nYAWY65vBylYAdl/f0ww+dblhP4R8Zg195L+fnOI1 +nu+8MmsP0JTqqDP4ufXouqyDdu2xgbJDgUr4fahpJxTXoHW4Go5rAbxx32ZF4ydn +R1uM+S3jUeUo40DPLz0pW/VKhMDNPX7dZ33i6Taw1I0BQWh6jsKpWZwXqlg79Qx3 +XPjsJw8Bvnodr5LH3JdWnnQv9FHHdkPr5g24ICw4sLHAAG+1YNiwCfmiZWmtr88E +HhJE6Mjayqf86a/4sa6qvMv+r4PAbxP+ei1xGCuH6TYXOOSJP/0MGV5hZn3pZTLC +0vlGOM0CgYEAw2X0SsHfDNiSn8Ioc56fkRfB9VxsK1ii0EuObfTRqKRukK0KJbaM +tgIg6ZruB5JOohoLsomqcOhspBdLvZB4jkHI4qlUfW4Q8IKdzygEnTyaIgo0S8UU +/10QoymU53sXFbX+vShJAg0/ITQz0yFhk+KZtHd5MhdiE6t396A/ufUCgYEAwnoH +TMGQ/Jfgy/0SX3j/rKozP8Mwv7BjeVj7Nu2sq4KfbIhUEkAMlwlc/o/tTCGxm/Vd +tvb1QTx17Kl4ApvNn2IroMBghZqhg4lfeAAtrb1yPurk80uR/V77PMqqwae9VMNT +O21AP+XwMVhNwOpdDwEkTOBtlInacK8gVUY1XLMCgYEAr6STLywMs4BudNtT/3KE +HynK+SLGPUSkvjZc5qxeVojQto5Fg9cPr4BEU5koBHhY5NAi2a90HaBgIDSsqc8W +/1FVIaJyx3lMEtZmwtNHKoxSRO0FS2LyWAYxMWnsZxQ3kRWS0jhHQGfl6pQBTfVA +wG2+GwIWWJe6WtIUuew7vI0CgYBWigyziDMnY8JBo7TITUSgpgA2MHqB4lDxj7oC +IFNE4tRkbGnU0TGJCD6cfJlg1mF9f/saztwmEmx7SpI/vusKMJovZ0vMSBn1OW0F +LjclZ/btroMBDLDDKb/stlaz5BupG13vRNdhV8XBf4TiAqg0ZBKuLvQ0M//DQvrF +V3+pZwKBgQCfX9poNBSBpbohG4HcowpmM5rokYEYeL0Sx+DjN4ZlPRXL7QjZ0wfa +hlZyxcfvGGicGQMoKOZ42/mIxXN4217WPi1BkoeG8L+ircBw2QM/uUf3011Gjt2D +xhjWNc+OIdDJMa5L8yV3qgNirDcGVykgG3F6PfFFk2fivA5AfFjs2g== -----END RSA PRIVATE KEY----- From e3e338f6f139bc06dbcc4297b33054cfbb249308 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 17:19:05 +0800 Subject: [PATCH 07/12] fix(ssl): bound PEM marker scans Co-authored-by: TRAE CLI --- ssl/appletls_pem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssl/appletls_pem.c b/ssl/appletls_pem.c index bca00803e..34c75bd26 100644 --- a/ssl/appletls_pem.c +++ b/ssl/appletls_pem.c @@ -254,7 +254,7 @@ static const unsigned char* find_bytes(const unsigned char* begin, const unsigne size_t needle_len = strlen(needle); const unsigned char* ptr; if ((size_t)(end - begin) < needle_len) return NULL; - for (ptr = begin; ptr + needle_len <= end; ++ptr) { + for (ptr = begin; (size_t)(end - ptr) >= needle_len; ++ptr) { if (memcmp(ptr, needle, needle_len) == 0) return ptr; } return NULL; From dc5ad4b580bbe4eb2e3469d018dc711b75514353 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 17:21:46 +0800 Subject: [PATCH 08/12] fix(ssl): address Apple TLS review findings Co-authored-by: TRAE CLI --- docs/cn/TcpClient.md | 1 + ssl/appletls_pem.c | 22 ++++++++++------------ ssl/appletls_pem.h | 8 ++------ unittest/appletls_test.c | 3 +-- 4 files changed, 14 insertions(+), 20 deletions(-) diff --git a/docs/cn/TcpClient.md b/docs/cn/TcpClient.md index 6783fdda2..95d012382 100644 --- a/docs/cn/TcpClient.md +++ b/docs/cn/TcpClient.md @@ -77,6 +77,7 @@ client.withTLS(&ssl); 系统信任根。设置了任一项时，仅信任指定的自定义 CA，不再使用系统信任根。 `ca_file` 可以包含多个 PEM `CERTIFICATE` 块，`ca_path` 指向包含 PEM 或 DER CA 证书的目录。通过域名连接时还会校验证书中的 DNS 主机名。 +Apple TLS 的证书验证不会在线下载缺失的中间证书，服务端应发送完整证书链。 客户端双向 TLS 示例： diff --git a/ssl/appletls_pem.c b/ssl/appletls_pem.c index 34c75bd26..e3210a63e 100644 --- a/ssl/appletls_pem.c +++ b/ssl/appletls_pem.c @@ -15,9 +15,7 @@ typedef struct { const unsigned char* end; } der_cursor_t; -static const unsigned char rsa_encryption_oid[] = { - 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01 -}; +static const unsigned char rsa_encryption_oid[] = {0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01}; static int read_file(const char* path, unsigned char** data, size_t* len) { FILE* fp = NULL; @@ -118,12 +116,14 @@ static int decode_base64(const unsigned char* begin, const unsigned char* end, a if (c == -2) { if ((b & 0x0f) != 0) goto invalid_padding; padded = 1; - } else { + } + else { out[out_len++] = (unsigned char)((b << 4) | (c >> 2)); if (d == -2) { if ((c & 0x03) != 0) goto invalid_padding; padded = 1; - } else { + } + else { out[out_len++] = (unsigned char)((c << 6) | d); } } @@ -195,8 +195,7 @@ static int validate_pkcs1_rsa(const unsigned char* data, size_t len) { int ret = der_read_tlv(&outer, 0x30, &sequence); if (ret != APPLETLS_PEM_OK || outer.ptr != outer.end) return APPLETLS_PEM_ERROR_FORMAT; ret = der_read_tlv(&sequence, 0x02, &integer); - if (ret != APPLETLS_PEM_OK || !der_integer_is_minimal(&integer) || - integer.end - integer.ptr != 1 || integer.ptr[0] != 0) { + if (ret != APPLETLS_PEM_OK || !der_integer_is_minimal(&integer) || integer.end - integer.ptr != 1 || integer.ptr[0] != 0) { return APPLETLS_PEM_ERROR_FORMAT; } for (i = 0; i < 8; ++i) { @@ -233,8 +232,7 @@ static int unwrap_pkcs8_rsa(const unsigned char* data, size_t len, appletls_der_ if (ret != APPLETLS_PEM_OK) return ret; ret = der_read_tlv(&algorithm, 0x06, &oid); if (ret != APPLETLS_PEM_OK) return ret; - if ((size_t)(oid.end - oid.ptr) != sizeof(rsa_encryption_oid) || - memcmp(oid.ptr, rsa_encryption_oid, sizeof(rsa_encryption_oid)) != 0) { + if ((size_t)(oid.end - oid.ptr) != sizeof(rsa_encryption_oid) || memcmp(oid.ptr, rsa_encryption_oid, sizeof(rsa_encryption_oid)) != 0) { return APPLETLS_PEM_ERROR_UNSUPPORTED; } if (algorithm.ptr != algorithm.end) { @@ -371,8 +369,7 @@ int appletls_pem_load_rsa_private_key(const char* path, appletls_der_t* pkcs1_ke ret = read_file(path, &file, &file_len); if (ret != APPLETLS_PEM_OK) return ret; end = file + file_len; - if (find_bytes(file, end, encrypted_begin) || find_bytes(file, end, ec_begin) || - find_bytes(file, end, "Proc-Type: 4,ENCRYPTED")) { + if (find_bytes(file, end, encrypted_begin) || find_bytes(file, end, ec_begin) || find_bytes(file, end, "Proc-Type: 4,ENCRYPTED")) { ret = APPLETLS_PEM_ERROR_UNSUPPORTED; goto done; } @@ -401,7 +398,8 @@ int appletls_pem_load_rsa_private_key(const char* path, appletls_der_t* pkcs1_ke if (ret != APPLETLS_PEM_OK) goto done; if (pkcs8) { ret = unwrap_pkcs8_rsa(decoded.data, decoded.len, pkcs1_key); - } else { + } + else { ret = validate_pkcs1_rsa(decoded.data, decoded.len); if (ret == APPLETLS_PEM_OK) { *pkcs1_key = decoded; diff --git a/ssl/appletls_pem.h b/ssl/appletls_pem.h index e85e0843f..f36bd70b4 100644 --- a/ssl/appletls_pem.h +++ b/ssl/appletls_pem.h @@ -32,12 +32,8 @@ typedef enum { APPLETLS_PEM_ERROR_NOMEM = -5 } appletls_pem_error_t; -APPLETLS_PRIVATE int appletls_pem_load_certificates(const char* path, - int allow_der, - size_t max_certificates, - appletls_der_list_t* certificates); -APPLETLS_PRIVATE int appletls_pem_load_rsa_private_key(const char* path, - appletls_der_t* pkcs1_key); +APPLETLS_PRIVATE int appletls_pem_load_certificates(const char* path, int allow_der, size_t max_certificates, appletls_der_list_t* certificates); +APPLETLS_PRIVATE int appletls_pem_load_rsa_private_key(const char* path, appletls_der_t* pkcs1_key); APPLETLS_PRIVATE void appletls_der_free(appletls_der_t* der); APPLETLS_PRIVATE void appletls_der_list_free(appletls_der_list_t* list); APPLETLS_PRIVATE const char* appletls_pem_error_string(int error); diff --git a/unittest/appletls_test.c b/unittest/appletls_test.c index 9a508064f..e2734ac90 100644 --- a/unittest/appletls_test.c +++ b/unittest/appletls_test.c @@ -119,8 +119,7 @@ static void tls_pair_close(tls_pair_t* pair) { pair->fds[0] = pair->fds[1] = -1; } -static int tls_pair_open(tls_pair_t* pair, const hssl_ctx_opt_t* server_options, - const hssl_ctx_opt_t* client_options, const char* hostname) { +static int tls_pair_open(tls_pair_t* pair, const hssl_ctx_opt_t* server_options, const hssl_ctx_opt_t* client_options, const char* hostname) { int i; int server_status = HSSL_WANT_READ; int client_status = HSSL_WANT_READ; From 15f4c49c15212614fcc7aec9754d20f202892333 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 17:28:01 +0800 Subject: [PATCH 09/12] fix(ssl): remove dead identity error state Co-authored-by: TRAE CLI --- ssl/appletls.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/ssl/appletls.c b/ssl/appletls.c index 868d63481..b3ca307c2 100644 --- a/ssl/appletls.c +++ b/ssl/appletls.c @@ -813,12 +813,10 @@ static int appletls_create_identity(appletls_ctx_t* ctx, const char* cert_file, } } else { fprintf(stderr, "Apple TLS local identities require macOS 10.12 or iOS 11.2\n"); - ret = APPLETLS_PEM_ERROR_UNSUPPORTED; goto cleanup; } #else fprintf(stderr, "Apple TLS local identities require an SDK with SecIdentityCreate\n"); - ret = APPLETLS_PEM_ERROR_UNSUPPORTED; goto cleanup; #endif From 3066798f56a57cc889c4485ebe70d7bac2bdde09 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 17:29:17 +0800 Subject: [PATCH 10/12] test(ssl): scope Apple TLS tests to Darwin Co-authored-by: TRAE CLI --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index fb356ee58..e7406e555 100644 --- a/Makefile +++ b/Makefile @@ -379,10 +379,10 @@ hrpc_calc_server: prepare hrpc_calc_protoc APPLE_TLS_UNITTESTS = ifeq ($(shell uname -s),Darwin) -APPLE_TLS_UNITTESTS += appletls_test +APPLE_TLS_UNITTESTS += appletls_pem_test appletls_test endif -unittest: prepare libhv appletls_pem_test $(APPLE_TLS_UNITTESTS) +unittest: prepare libhv $(APPLE_TLS_UNITTESTS) $(CC) -g -Wall -O0 -std=c99 -I. -Ibase -o bin/rbtree_test unittest/rbtree_test.c base/rbtree.c $(CC) -g -Wall -O0 -std=c99 -I. -Ibase -o bin/hbase_test unittest/hbase_test.c base/hbase.c $(CC) -g -Wall -O0 -std=c99 -I. -Ibase -o bin/mkdir_p unittest/mkdir_test.c base/hbase.c From a25616d8675a5b9a1eb895f470f31ac66525b2a5 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 17:31:42 +0800 Subject: [PATCH 11/12] test(ssl): extend Apple TLS trust coverage Co-authored-by: TRAE CLI --- ssl/appletls.c | 22 +++---- unittest/appletls_pem_test.c | 8 +++ unittest/appletls_test.c | 8 +++ unittest/fixtures/appletls/ca-dir/root.crt | 26 ++++----- unittest/fixtures/appletls/client-chain.pem | 28 ++++----- unittest/fixtures/appletls/client.crt | 28 ++++----- unittest/fixtures/appletls/client.key | 50 ++++++++-------- unittest/fixtures/appletls/ec-pkcs8.key | 6 +- unittest/fixtures/appletls/ec-sec1.key | 6 +- unittest/fixtures/appletls/encrypted-key.pem | 56 +++++++++--------- unittest/fixtures/appletls/generate.sh | 1 + unittest/fixtures/appletls/intermediate.crt | 30 +++++----- unittest/fixtures/appletls/multi-ca.pem | 52 ++++++++--------- unittest/fixtures/appletls/root.crt | 26 ++++----- unittest/fixtures/appletls/root.der | Bin 0 -> 776 bytes unittest/fixtures/appletls/server-chain.pem | 58 +++++++++---------- unittest/fixtures/appletls/server-pkcs1.key | 50 ++++++++-------- unittest/fixtures/appletls/server-pkcs8.key | 52 ++++++++--------- unittest/fixtures/appletls/server.crt | 28 ++++----- unittest/fixtures/appletls/wrong-root.crt | 26 ++++----- unittest/fixtures/appletls/wrong-server.key | 50 ++++++++-------- 21 files changed, 314 insertions(+), 297 deletions(-) create mode 100644 unittest/fixtures/appletls/root.der diff --git a/ssl/appletls.c b/ssl/appletls.c index b3ca307c2..0f14e5d8f 100644 --- a/ssl/appletls.c +++ b/ssl/appletls.c @@ -1013,8 +1013,8 @@ static OSStatus SocketRead(SSLConnectionRef conn, void* data, size_t* len) { default: return errSSLClosedAbort; } } - *len += nread; - remain -= nread; + *len += (size_t)nread; + remain -= (size_t)nread; buffer += nread; } return noErr; @@ -1041,9 +1041,9 @@ static OSStatus SocketWrite(SSLConnectionRef conn, const void* data, size_t* len default: return errSSLClosedAbort; } } - remain -= nwrite; + remain -= (size_t)nwrite; buffer += nwrite; - *len += nwrite; + *len += (size_t)nwrite; } return noErr; } @@ -1237,7 +1237,7 @@ static int appletls_verify_peer(appletls_t* appletls, int peer_is_server) { hostname = CFStringCreateWithCString(NULL, appletls->hostname, kCFStringEncodingUTF8); if (hostname == NULL) goto cleanup; } - policy = SecPolicyCreateSSL(peer_is_server, hostname); + policy = SecPolicyCreateSSL((Boolean)peer_is_server, hostname); if (policy == NULL || SecTrustSetPolicies(trust, policy) != errSecSuccess) goto cleanup; #if (TARGET_OS_MAC && MAC_OS_X_VERSION_MAX_ALLOWED >= 1090) || \ ((TARGET_OS_EMBEDDED || TARGET_OS_IPHONE) && __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000) @@ -1311,16 +1311,16 @@ int hssl_connect(hssl_t ssl) { } int hssl_read(hssl_t ssl, void* buf, int len) { - if (ssl == NULL) return HSSL_ERROR; + if (ssl == NULL || buf == NULL || len <= 0) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; if (appletls->session == NULL) return HSSL_ERROR; size_t processed = 0; // printf("SSLRead(%d)\n", len); - OSStatus ret = SSLRead(appletls->session, buf, len, &processed); + OSStatus ret = SSLRead(appletls->session, buf, (size_t)len, &processed); // printf("SSLRead retval=%d processed=%d\n", (int)ret, (int)processed); switch (ret) { case noErr: - return processed; + return (int)processed; case errSSLWouldBlock: if (processed) return (int)processed; errno = EAGAIN; @@ -1335,16 +1335,16 @@ int hssl_read(hssl_t ssl, void* buf, int len) { } int hssl_write(hssl_t ssl, const void* buf, int len) { - if (ssl == NULL) return HSSL_ERROR; + if (ssl == NULL || buf == NULL || len <= 0) return HSSL_ERROR; appletls_t* appletls = (appletls_t*)ssl; if (appletls->session == NULL) return HSSL_ERROR; size_t processed = 0; // printf("SSLWrite(%d)\n", len); - OSStatus ret = SSLWrite(appletls->session, buf, len, &processed); + OSStatus ret = SSLWrite(appletls->session, buf, (size_t)len, &processed); // printf("SSLWrite retval=%d processed=%d\n", (int)ret, (int)processed); switch (ret) { case noErr: - return processed; + return (int)processed; case errSSLWouldBlock: if (processed) return (int)processed; errno = EAGAIN; diff --git a/unittest/appletls_pem_test.c b/unittest/appletls_pem_test.c index 436074deb..76f6c7a6e 100644 --- a/unittest/appletls_pem_test.c +++ b/unittest/appletls_pem_test.c @@ -70,6 +70,13 @@ static void test_load_certificate_chain_in_order(void) { appletls_der_list_free(&intermediate); } +static void test_load_der_certificate(void) { + appletls_der_list_t certificates = {0}; + assert(appletls_pem_load_certificates(FIXTURE("root.der"), 1, 1, &certificates) == APPLETLS_PEM_OK); + assert(certificates.count == 1); + appletls_der_list_free(&certificates); +} + static void test_reject_ec_and_encrypted_keys(void) { appletls_der_t key = {0}; assert(appletls_pem_load_rsa_private_key(FIXTURE("ec-sec1.key"), &key) == APPLETLS_PEM_ERROR_UNSUPPORTED); @@ -145,6 +152,7 @@ int main(void) { test_load_pkcs1_rsa(); test_unwrap_pkcs8_rsa(); test_load_certificate_chain_in_order(); + test_load_der_certificate(); test_reject_ec_and_encrypted_keys(); test_reject_invalid_base64(); test_reject_invalid_der_lengths(); diff --git a/unittest/appletls_test.c b/unittest/appletls_test.c index e2734ac90..2c4185a63 100644 --- a/unittest/appletls_test.c +++ b/unittest/appletls_test.c @@ -264,6 +264,13 @@ static void test_wrong_custom_ca_fails(void) { assert(tls_pair_open(&pair, &server, &client, "localhost") != 0); } +static void test_system_roots_reject_fixture_server(void) { + hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); + hssl_ctx_opt_t client = verified_client_options(NULL); + tls_pair_t pair; + assert(tls_pair_open(&pair, &server, &client, "localhost") != 0); +} + static void test_server_mtls_rejects_missing_client_certificate(void) { hssl_ctx_opt_t server = server_options(FIXTURE("server-pkcs1.key")); hssl_ctx_opt_t client = verified_client_options(FIXTURE("root.crt")); @@ -303,6 +310,7 @@ int main(void) { test_handshake_reports_write_block(); test_wrong_hostname_fails(); test_wrong_custom_ca_fails(); + test_system_roots_reject_fixture_server(); test_server_mtls_rejects_missing_client_certificate(); test_server_mtls_accepts_trusted_client_certificate(); puts("appletls_test: PASS"); diff --git a/unittest/fixtures/appletls/ca-dir/root.crt b/unittest/fixtures/appletls/ca-dir/root.crt index 003114cc7..ca46c5887 100644 --- a/unittest/fixtures/appletls/ca-dir/root.crt +++ b/unittest/fixtures/appletls/ca-dir/root.crt @@ -2,18 +2,18 @@ MIIDBDCCAeygAwIBAgICAQAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw MDAwMFowIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MIIBIjAN -BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMDd6nejls/LrXQQ7UCG+j1q3t+9 -qnYJXn0Cvdzxub33PNMc5WbGTqxJG1/mqzSSU6Hm6ISNQZJStQlI9L1WhIrFX0gp -9DZjaUI0eeIOii4LxPBV9QHs1zWZcZehCzz6hNoPoXUBzEaBpxWj2wjVLN9AjKVO -4JMpyShGyw4ieXyDmsft4ALummVWh+C1tVBcO3baOMN2k4PvLB6zUEqhT554ppvO -EQtlzEW1JPEd0i0VpQ9QHUMSDMhYljljYhMzn9x10nABdD6q++STypw1dk5YJycO -cwCeCOMRGs/IbOKyaUiutZMieXQlCyJJsDLunTSgQO/0xo2wNwqRDN8dSQIDAQAB +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvqo6cJBRm1lKsQX5Fsz+jnnzfDqW +jl0M7fSs0zDVW8WbPk+6OkysFvgIzPclV7jkFrEYcB4UuHUifSmsFROf+CCqL4m2 +mFaSrmStqasjiNN/r3DW8XgjMn4KWgUae1X6xvjhfOI5qOEui0Zn7/x3HbwD/Ha0 +1WyjtY5+ZLvkn11dSlioWVBnk6vEnxtEphTbhGWi68cgF1RLElU0VeyXzjqkewTW +qtbqToAfY7wkRDBvcLg2p2tsLyyeAPWJCxmBKDZO+J6AYz5idi/0RdlFSXqBmEPU +O1qzTDEO/K78GS614e1DFNhYhNgk6b+wqWGvfr7qxqE+5D5IJ9fkU7zewwIDAQAB o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU -DbCaHy5SWiDFIuavQxJ1xGPBJqkwDQYJKoZIhvcNAQELBQADggEBAJU5OA8vGXAQ -7c/6sPpgznzNHiN3snGQImClfeImO5U09rYhGSU0pG/hTRy+FiQTpl3/SJ0w3h0/ -tq8OMdES4/HRK6voOkwzK926eWk9biyn1mhRKOHmCzLZdvYYly7Z7TFG1S3fmKIx -uVdz9Ot56Vs9KZllvHd85AZigiVvH4cJNlZZfzGeETWS0h0sfJOTtyDUuQBcs7QO -rWKw/qSFSsuwNGs++SdygYrT0EJ17Vc5jRWc4EetDIUUS/cBK092vaPUxv04IK+f -p4gzLWHPFL/E4yjfZXCdwUUW3Xbc6Fl2oDWDDmNKcXAtPJThMtUDHbRUYMVosYJ+ -1jMlDK+GsdM= +9e3jmUuilGBydDW7H3Zl7N9ldhwwDQYJKoZIhvcNAQELBQADggEBAHbaSvL/Ai19 +hA/h/0/nHXwRjspzcD8BsRkgwtE1uA6TOly5qzecRD+1yuNxSM3IvdVxhTdOrCyu +HsPgQCDczz09JqkSgX1F/pSgsIdC+ygl+GFJW+Om+84lXrNfn0EFiWmj9e8qsOR/ +3nAmn9Wn/RC4WMypHBCQyxNMJ74X1Zzq8VToki8iThA62nmYb+7jbwkHFj7jMF6f +y/75EwjZ7zZyK4ObpEgcOdp32LOl6/H2ERduN48WI2WRCLKmZLvsVEsp7WxPzWJc +2WZIFHptfRO8byuE/911PgDskTJedCuIActXE8zt4LBEIRVXIMsUUS6fO7ZJSBgx +JgqB1zRUvZE= -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client-chain.pem b/unittest/fixtures/appletls/client-chain.pem index c26c0fd31..115959f12 100644 --- a/unittest/fixtures/appletls/client-chain.pem +++ b/unittest/fixtures/appletls/client-chain.pem @@ -2,19 +2,19 @@ MIIDOTCCAiGgAwIBAgICMAAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTI3MTAwMTAw MDAwMFowJTEjMCEGA1UEAwwabGliaHYtYXBwbGV0bHMtdGVzdC1jbGllbnQwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJdX7hCoagbj7bgF+HWne5pULP -4/0XKNDrbeJ7muBb5rVMMtSqWCTgNkFjKjtU1upA8RZW50BN3CZLJBY0c6kO1z39 -W5PFkgcTUSScRM+MVQCW+WWKcI3d5tMNIr0QgAtv7xJ+lyAaMeuKyN94Gune3Gay -0MQhABd7GPbHEWzYOQ9p9mhgGOHPW2XQsEJfhydZ+nj3H3shZgvScTyxReAtwDn6 -wqQHJajr7Gnvhl8jW7c4OXB3PWwT97xvIKTtp7ljFbbuDzp01cXqBsvtAXcqDlOV -rdn1uNzJoEulZnU802BWwix8OSIpPXm7xqa5VAxY3/ngMlYlxMOhQALHF/ylAgMB +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHBf/7eOrciHGTNSRFfryJhpPN +VfOnPt4Oja5ZHHmLx6L12vm95f3dYOu3otQof2kC/3vYQ7Np3s3ebf2k7YX2agyB +DpaqwSOd6RBclF7qse9oyy+Z+5zySP7xzfU3SAscudstw6y/2uANDHeA7FbQ7INk +WOen4VizU5vytAw0b/5Dq0w60cG+MfXyZp+qiP6mZOV3yUzY9++bduCiHIm84LLq +bbVx3uz/F2ElwZnsAbFQvwz+S5KnXuWIrdVNu3jEzw7fLeJPWs6psvDPpgSgh9qn +BLPyvYeXwRdazahsE7YeaYuc8K7QRbi+ZACTUHktlxo6EGfmMEoDDwf9pMaLAgMB AAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG -CCsGAQUFBwMCMB0GA1UdDgQWBBSRUOw0La9aq6jGQipugjTmwUPmnzAfBgNVHSME -GDAWgBQNsJofLlJaIMUi5q9DEnXEY8EmqTANBgkqhkiG9w0BAQsFAAOCAQEAJ5lT -CPluyKPJ3ugvnVx/64BWVSs9huLMnzQsG991Az451ywvTjEQnfH574wplocEbGf3 -fNinwKg7tzOEqyFdSvnjEg9UD8dRVdyVqxqeBhbdmx0fJSgbwdEJYt4nfFYfs1uO -TusnLxe+XFs/EMlzK7vGNoEb0bobb0SzIaVSPHUROi3kArvyIIOC+IGALoqk/cI2 -ppO2dFNCYGGRZwgjCG25Msk4sRARSFTDprThkkVOwieSsLHUlOrqetK1vap3wsYv -rcZ+RA4JF8WGWBj2l84B2hPaGVFHFP3o+70fc8DD7dKE2t8bQTOO4sgNSKP35EDB -RQvCHhyq1QiGV3BYGQ== +CCsGAQUFBwMCMB0GA1UdDgQWBBTbunsLFLbkCb8wVTzyd7dANQS/YjAfBgNVHSME +GDAWgBT17eOZS6KUYHJ0NbsfdmXs32V2HDANBgkqhkiG9w0BAQsFAAOCAQEAjnE5 +QQRSZfkaB3xFKoa5TZIA4qcoKe755XIf3ZDzeorRt194P2+tL2zlQgxlzT5cbla8 +KWJj7gKNyfN/OAAjUGhHs7L9WhdsWrLPOaqA87li3hg/IpjvTVHGexIUG1SSBNbd +2Wc2oVcMIl+Qm+kyUYzl+g4PbuPk99jjCYtRtlkb05J0yR+13OU+HeYyGuGyreyI +yUzYS+S0xC9HYrG8FXcixjPxbY99aXft7ILd/jfw1DaAUuCXu04TMT/x+dGuNVpg +HxRinOAHierP8qqQ2FyfiooipmW2uTPeZamoL2zTYByfwv5EAxrWdNYonSYZ1DLk +7LMrgqOHnnTeuCi2gQ== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client.crt b/unittest/fixtures/appletls/client.crt index c26c0fd31..115959f12 100644 --- a/unittest/fixtures/appletls/client.crt +++ b/unittest/fixtures/appletls/client.crt @@ -2,19 +2,19 @@ MIIDOTCCAiGgAwIBAgICMAAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTI3MTAwMTAw MDAwMFowJTEjMCEGA1UEAwwabGliaHYtYXBwbGV0bHMtdGVzdC1jbGllbnQwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJdX7hCoagbj7bgF+HWne5pULP -4/0XKNDrbeJ7muBb5rVMMtSqWCTgNkFjKjtU1upA8RZW50BN3CZLJBY0c6kO1z39 -W5PFkgcTUSScRM+MVQCW+WWKcI3d5tMNIr0QgAtv7xJ+lyAaMeuKyN94Gune3Gay -0MQhABd7GPbHEWzYOQ9p9mhgGOHPW2XQsEJfhydZ+nj3H3shZgvScTyxReAtwDn6 -wqQHJajr7Gnvhl8jW7c4OXB3PWwT97xvIKTtp7ljFbbuDzp01cXqBsvtAXcqDlOV -rdn1uNzJoEulZnU802BWwix8OSIpPXm7xqa5VAxY3/ngMlYlxMOhQALHF/ylAgMB +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHBf/7eOrciHGTNSRFfryJhpPN +VfOnPt4Oja5ZHHmLx6L12vm95f3dYOu3otQof2kC/3vYQ7Np3s3ebf2k7YX2agyB +DpaqwSOd6RBclF7qse9oyy+Z+5zySP7xzfU3SAscudstw6y/2uANDHeA7FbQ7INk +WOen4VizU5vytAw0b/5Dq0w60cG+MfXyZp+qiP6mZOV3yUzY9++bduCiHIm84LLq +bbVx3uz/F2ElwZnsAbFQvwz+S5KnXuWIrdVNu3jEzw7fLeJPWs6psvDPpgSgh9qn +BLPyvYeXwRdazahsE7YeaYuc8K7QRbi+ZACTUHktlxo6EGfmMEoDDwf9pMaLAgMB AAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG -CCsGAQUFBwMCMB0GA1UdDgQWBBSRUOw0La9aq6jGQipugjTmwUPmnzAfBgNVHSME -GDAWgBQNsJofLlJaIMUi5q9DEnXEY8EmqTANBgkqhkiG9w0BAQsFAAOCAQEAJ5lT -CPluyKPJ3ugvnVx/64BWVSs9huLMnzQsG991Az451ywvTjEQnfH574wplocEbGf3 -fNinwKg7tzOEqyFdSvnjEg9UD8dRVdyVqxqeBhbdmx0fJSgbwdEJYt4nfFYfs1uO -TusnLxe+XFs/EMlzK7vGNoEb0bobb0SzIaVSPHUROi3kArvyIIOC+IGALoqk/cI2 -ppO2dFNCYGGRZwgjCG25Msk4sRARSFTDprThkkVOwieSsLHUlOrqetK1vap3wsYv -rcZ+RA4JF8WGWBj2l84B2hPaGVFHFP3o+70fc8DD7dKE2t8bQTOO4sgNSKP35EDB -RQvCHhyq1QiGV3BYGQ== +CCsGAQUFBwMCMB0GA1UdDgQWBBTbunsLFLbkCb8wVTzyd7dANQS/YjAfBgNVHSME +GDAWgBT17eOZS6KUYHJ0NbsfdmXs32V2HDANBgkqhkiG9w0BAQsFAAOCAQEAjnE5 +QQRSZfkaB3xFKoa5TZIA4qcoKe755XIf3ZDzeorRt194P2+tL2zlQgxlzT5cbla8 +KWJj7gKNyfN/OAAjUGhHs7L9WhdsWrLPOaqA87li3hg/IpjvTVHGexIUG1SSBNbd +2Wc2oVcMIl+Qm+kyUYzl+g4PbuPk99jjCYtRtlkb05J0yR+13OU+HeYyGuGyreyI +yUzYS+S0xC9HYrG8FXcixjPxbY99aXft7ILd/jfw1DaAUuCXu04TMT/x+dGuNVpg +HxRinOAHierP8qqQ2FyfiooipmW2uTPeZamoL2zTYByfwv5EAxrWdNYonSYZ1DLk +7LMrgqOHnnTeuCi2gQ== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/client.key b/unittest/fixtures/appletls/client.key index 2ea9e2717..5b666cb5f 100644 --- a/unittest/fixtures/appletls/client.key +++ b/unittest/fixtures/appletls/client.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAyXV+4QqGoG4+24Bfh1p3uaVCz+P9FyjQ623ie5rgW+a1TDLU -qlgk4DZBYyo7VNbqQPEWVudATdwmSyQWNHOpDtc9/VuTxZIHE1EknETPjFUAlvll -inCN3ebTDSK9EIALb+8SfpcgGjHrisjfeBrp3txmstDEIQAXexj2xxFs2DkPafZo -YBjhz1tl0LBCX4cnWfp49x97IWYL0nE8sUXgLcA5+sKkByWo6+xp74ZfI1u3ODlw -dz1sE/e8byCk7ae5YxW27g86dNXF6gbL7QF3Kg5Tla3Z9bjcyaBLpWZ1PNNgVsIs -fDkiKT15u8amuVQMWN/54DJWJcTDoUACxxf8pQIDAQABAoIBAAFakSznkM2iYzjy -Y37AJ66cFhdAWI9y4ZFTcbXG7dvWo9oMbv8EcwSWslj9cnY4sEyza6UCqAORISi/ -Toh+Ga3upsBj5ya17oCj7cBArh+RSqm5D1E415s2iK1XHtIhKiW2A5FnAcfRrtvs -Sz2+LVtabwFwnOcwqve5/56JPXDOhLPGz9b+G/WIbHPRwZMeOK89b63UKlV2vQXo -MFzrRKfK1vkxk19mBqb9ULFs3tTNgam8SbfySOolKyAxbDKaKmY0cJvvPr2Gforf -56hT6tnIC38+Pf9oImAkx6V+vAC/dpTlkY7lZqud3kR04RuOmURVFFXkKvskOyNh -kroLHsECgYEA5f6nz9uoRNscBdrki9Sg1r1rAQvTz+FRm4aU+t1XrchWxL8nFT0K -NJ4WauDFpfd7q32B1JSqf1OxqD95Ekfac+StaQaixM3rdNOZOZb/EciHRk9Rtl5w -Zf+g9P+XskNWr7URxSH1YaOBlEgqL5G/cmj9qJJN3qLTKp1eJNpAbR0CgYEA4Dza -j5AYZsDfHy3xgBc5q5sYWeMD9aNwO19ifpFprXpmOP3nfml/aBaEGkvs/BfqPP+S -BrTELsSkq+zWFNeU4rESuvgEXXzPTjL/+tU1y2Xjx7OPu9xDeaZyydDVkFrBrAEq -cVAshRqyMrDLONG4ZRRrlCtrhDx8A7ufEnbQHykCgYAgN1eSShZ77qUyPMMewx30 -dnvynZGB4PHpcySTL0YE1bcxwATdeLthO3OwbOPCp7PvBZmWCW0IgNS12I5A/Ueg -TDvuJjvOjXmZ17ny0y/PceNg+eNcREZCQ1hseRDqq3wNCLQAhQ02LA0OlD00hJno -kMRXRIcb1Hr30StKxjeYEQKBgQDLdIt+LOjm+mK3wJDZfrk1yfBLRl5GVvey9zW/ -zyJKY78yQLX1DbWq9JsB3Rf2F6DRnbWZ3hQOtx8OW0JXAM+266EqAXS8ek0CD+YQ -abl4hkco3/QvKIgUbYDDOnc7lg0Ziqk+zNbIIlPDCIQrVqXvGJsPgmH4RoTjQi3v -q9vkGQKBgQDX6t1/nwPNvbbiiULZOCvbUUab1shxQ1Auku2KJcUCcw+KW0noetQA -FqPGerpJ9eBfPWPE69sWHDhdExMbkaXnhKSq5KQd3mnMStyNZ794VdNuObqsczz8 -D2QSgLDtUXeQqzTvtLwLHg85mrcX1T36+0Dyc075mNp8kUez71IaUg== +MIIEoQIBAAKCAQEAxwX/+3jq3IhxkzUkRX68iYaTzVXzpz7eDo2uWRx5i8ei9dr5 +veX93WDrt6LUKH9pAv972EOzad7N3m39pO2F9moMgQ6WqsEjnekQXJRe6rHvaMsv +mfuc8kj+8c31N0gLHLnbLcOsv9rgDQx3gOxW0OyDZFjnp+FYs1Ob8rQMNG/+Q6tM +OtHBvjH18mafqoj+pmTld8lM2Pfvm3bgohyJvOCy6m21cd7s/xdhJcGZ7AGxUL8M +/kuSp17liK3VTbt4xM8O3y3iT1rOqbLwz6YEoIfapwSz8r2Hl8EXWs2obBO2HmmL +nPCu0EW4vmQAk1B5LZcaOhBn5jBKAw8H/aTGiwIDAQABAoH/WJ0QIfhgsyiTeeb9 +BJwmH3HhJpQm6FSLCDL4IlBdLmnrcG6qeENcIWOQe1z8DPs8YagHLIJhMakbiw9d +TQlfvbwqW2U0Pw23P1TNenN4Adk32LQQeYdw2/oqprWoY/TI/dMjQYzeK1/9RMV6 +mfC6Bp/OTdc/d65LPTkebPX4RtFBolwJRQ/uCkieiqht6mAAI3I9QlBV4aCTGomf +UylfDNtjc864ifcwm33KNd6J+fATTyN9/Sb9B2oj4L7fOdxuEgftSVvbCaoJycYm +eA2x9YLIocJJoly3Uph2AxwMcvuEGQEHRjh8Tw+Zo/lQSgG1tW1sy0io//6MUVL9 +5AH5AoGBAP5x+0vE/qa6QO8dbDdxsiaybSavP57J3upwdxyr7mZrnlI2ZHzGK7M9 +qXgv5z0FfwmM8FpX7+mq58OqrSk4dOgQhwf+qOD59XPtVXWNlOrrLa0M/G4eJIRr +wfVvPfc/XS701gDPBzftLOK63n6tPgiFp/WxUVeNjm5NIr5v7dQfAoGBAMg9UwBy +Le48IDhESL+qwPDeDSKiehiKvqyPjnbEcd39pZzeowddnMlGxBgFh63FAJsrq7AU +p73cOkJrrfyrUnUF8Nin80oBrleobRVjMBCDLzMPxkpcGobX+d/wSARYT13kjTiD ++RluL3aDk32zKzi0ecJbVxlIGn84lahbkaAVAoGAb4cadQ216PK+v5CP/IVzZw7S +VSB/rGQjt3LwYrrh1jbZwINi7GYYhYpDnBCzNMYR9ue1+oOM/0kQKW3IVMcQRx/n +cBOphmNJuTSQPuR+H7JR5QZKJyJDM1/gNmo6KQO3HnvmyZf1PAhTolXybGgXRrj+ +8+xzEQNVKPfagMqi3lUCgYAHNrZbyMFA2OesP0GDriofQ1Cj08ikQ7NU0iMmwjL7 +9VxXB2pGJKg2VBdSajiWGQfJj0wzHrtgSqPKqshs1ts0ng8sLvjDzMW0ILw1Tgp4 +PdGgfEv/d8v42aUF3Ukq5ueNEWPJCnAZ629ITLsuhxrigxXz24iKv588wBQcKZhY +dQKBgQCyqe9ZFiOmPKTaSF//AbLPLub1kdAfB1aAVq4hICH+m1G83Fz0hRX2cns0 +S3Sz5TYGnrIeZX00FKRWVYy+NHdLUxQkkJ6/egtcLLyIwYsmtZSmfJOyTDWlAKTu +7Z0sBlP/608xdjIQtoGhVxUNXIGNA6u3teonBVQeo/nxDQmxMw== -----END RSA PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/ec-pkcs8.key b/unittest/fixtures/appletls/ec-pkcs8.key index 3d24cde73..0234db2bb 100644 --- a/unittest/fixtures/appletls/ec-pkcs8.key +++ b/unittest/fixtures/appletls/ec-pkcs8.key @@ -1,5 +1,5 @@ -----BEGIN PRIVATE KEY----- -MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQghNgOnBBkVedL5Gnl -NBLPZmb70fe5VnFC40wsxeuJOMyhRANCAAQaqrOSRS14Z4irOjuqptHl1FDn9m3g -2mnlS221UoQiaNuUB8Jl5gbudm3nnAuACzGUrqt7rogDlYlN/hOhbQDf +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgGK7POP0d0lemDmWY +Nc9wJwJ1kKZpPilEKl+kjo8YWhGhRANCAAT5quos7H62iqN9U4SrhuVYCtaC6KXk +K3yhHvaKhIDdsEvSfexojCF8HZk/ojRqvSVPoPisesqRxKsvmuUumvJJ -----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/ec-sec1.key b/unittest/fixtures/appletls/ec-sec1.key index 387ee3f62..ba1f6b243 100644 --- a/unittest/fixtures/appletls/ec-sec1.key +++ b/unittest/fixtures/appletls/ec-sec1.key @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIITYDpwQZFXnS+Rp5TQSz2Zm+9H3uVZxQuNMLMXriTjMoAoGCCqGSM49 -AwEHoUQDQgAEGqqzkkUteGeIqzo7qqbR5dRQ5/Zt4Npp5UtttVKEImjblAfCZeYG -7nZt55wLgAsxlK6re66IA5WJTf4ToW0A3w== +MHcCAQEEIBiuzzj9HdJXpg5lmDXPcCcCdZCmaT4pRCpfpI6PGFoRoAoGCCqGSM49 +AwEHoUQDQgAE+arqLOx+toqjfVOEq4blWArWguil5Ct8oR72ioSA3bBL0n3saIwh +fB2ZP6I0ar0lT6D4rHrKkcSrL5rlLprySQ== -----END EC PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/encrypted-key.pem b/unittest/fixtures/appletls/encrypted-key.pem index 99abc7ee7..12f939231 100644 --- a/unittest/fixtures/appletls/encrypted-key.pem +++ b/unittest/fixtures/appletls/encrypted-key.pem @@ -1,30 +1,30 @@ -----BEGIN ENCRYPTED PRIVATE KEY----- -MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQI0e6pr2sDCdNBQcr -cuBfdgICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEGuljhBq0Xb6As96 -46+uaY0EggTQxZ855DV2dLDUvWt68mZivv37CEpqShM5hltuCNths9+PiAn1xHpC -kOjbZuFgNp12dbPLsnxC67sGOmSgaVCIilPtoO5Ku4LabBnNHXk025hhyajm44lA -0MThKa3gYWRq5jRBOiD20iS8VYxIWTC3Vi5BAR577sOK7yBsG7wmXgmIVfirQ1Z3 -V5/j0TlBHZKmUwvThhf9GWtwGRGAzi5u/WuilxK8SoCsd+PJVLNr031qt4fqphLQ -pA0sdxGLsck9IflHXzEIlE5R1Fic577RRtGQMl02QfHtkxZZWRNGe5+Z1Uchony3 -FZf68kH/dJdtEQTkuj8LZzySkRhpi2HecgxowZfYE4IRhd5sXU4e9t7vgXdUHiU2 -XObmaPalWyhpCMGKQRB9fyxaYUEhvzDirOmz0qByf2KhuuMfldrvsV7olVEDNxD2 -rhWlFejRa0GcTZqDzwphhGPEk+IBNnYNWv+q93AwWGbbFn9CcgzBNqOjtx1OD2gv -XGX5ZY0UxeS9R0e7NDFSzdo4DKrTaUcaLBTS+vOIkIMvEnyf1Hou+gwNgIC8q0Sf -7WlwGuBDhGndPnoHy0mbfpi5+t5VO1rJ0ZP3bMRPSjOP+zdlnOORMQpPWYD9Czqm -074pDI7sxrBdbl8ezpgRYhwILi2nPtNzJHTWiUR8bQ2rSZLOX+Dd+IkLWh1SKAKL -58tfvle8jQiwEQVYypYOtiGSwxrt+mh+gW+iwuyg/jE073UzLLeXAakyBQpL4ll6 -IAJmwLiA9lD+EIC862nV5J9T6xi06t9tWzJW79ooIJ+va/xF5X12FBeBtsNYPWpG -fBZnfh5VXubxXDv+Bf8J5MXq+3+WGtAj0f9dzxxot6kJ7GDUhvg03Mw8V9wzl8Y5 -LgyqTGnkOpY+5ACDjD1u/XnSLIyC8n3/0h44t4lYRka1WDujalM4KQNCYQUwy5sE -5LscXX3VbSlAe56wsnHj9Hjqtgvo226Tdih94xS28RilL6gL1BwJGoY7Pc7qdTaI -wVDnGgWjJmW0R/iE75j1HGNIKvb5n93SBHdP+75LzpOPm2Jewssku+2fgsyTiX1n -eQds+A1zrgnowEQETcpaTVWqcACpzoUB47Onj7kD1GMh4kVfbTr0n9qmhZ4TJXND -wX+KMM8keHmh8WpopL8tASWUxvlIG2VYv6pk6WgfJIsyKtWnKnJcIF2wWZg8rJOu -CHRPIMJgp7WJVtM62bXWNSpIIUkjE7zH7HR2HVdSFdQeIt/rkFoOwpa6ZXRlF2TV -9zWfDV/9YhWllLm17cq8eOKE7x3XcYJz6ZxGOjRJa4MZMJUWZA83THuZ2Bg9D2Ql -t8MhQqGKuPtQ4XNr5M+Su1iyreSBwEJKXKRoXeJ1K7GbPt+LrFhQaEkT7Smiy3ni -uu7Kg88DCMxyAhESAs3X64kV0xsZUMVltME1LPg3j25u+gXzc3GTD0V7GcNtBpeX -+zNZJYBZRSKd1/OtypScBVc/OJj1DrnOy5fUHQ2eoCTbuvFxdTU+f4u6/g1bI3fW -Hgct2gvr3iqyF74yrsQVponxfRxEo2spVo8pDXJkLUYgO0RzesmwErm1FChkTwJ2 -UWutwrsmyCYKVOpmAaTu6UqQ6qoEM9N0c1MhIIcshM/xT13DCWDjeEE= +MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQxmdbcASuFeL+WbjT +t4DdrgICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEKj2uV4GkALqChfb +bHpinTEEggTQ8dLs/RBfZG8M1k8YnERnZCuBXopVpTzHJ+D4taVog9mTEnosgzI9 +U+pHo7/Vt73eyFsQZ3Jbv0m5fxkvAfxbVs8LWqUpD5t1zPausPKTFWgwUwzm+Lj1 +hcNKFpj8RT4PnYukcH2uSXCXFvlQBIZBvcIIiWyZxhjTr32v78BKTm2Gi3KEZwTH +xZeKV/k1fK88R6L4RJQPea8Ski9xXYgLiyPU22zAClWGu/6cjJ2/zQhlGwrPhgoe +OXSCOc2NpSHvl4eWh4gW+Ne/eHA/sLBQ/gSEEnVvpFgF5Dqj8nmsskAqUWQa5qyP +E3OmY6oGkJjd9CRkcDTzxKnT3ccseKX02LNEZsF1TVbnYfAmPo2HdF93MwOYRo9s +aXGiMlOOF1zG33mG5AexcV7KuFvtSRPPAe+X89+deciloZfcCZHKWcYSCrvKG8v9 +GDBCjebiHLNPYntBbWlT+YPDG3Tik8ew8LH7WEMrDPxBq6snOHmTbamYGVcMP6tj +6O3u79vQt1zDBdErAp0QOU02HO3LWF6GsphUhxxGnZgKr6iq3ZW1mUmeAYHJk1sL +/c1/rRuyNI+/KOyhmJcGN7uxQr1VNTact/aZRm2epfVwOMwJUoWOwWkNkk35C9Hw +1BJqIQaDSusBkMURs4sITu78nHdNesow0vD52qgdWOVqrgm+NYzrlEhf0LLkoOt7 +lWht/4Dg5a76Mhe+QS4/g99W9Ox1mEzT/Wjdm5WxlkVeLOp2JhoVnfe6EwBQWA3N +6/np1Q89WXfpjriGRO0u2Xys971UrBcTVyhjqGtEUJ8OG2k29fx0FyWR44lFHNc2 +3Loblc63kO3OKpcff8PGiKC26hR/OVuI822MQiRAZF5GDFyzdC2M+MRrL2PMlxM6 +frXp+fcGskaxnEi9N+ZFFrdiFEOzwZD/IHYT1Lg/GiF53pOGSA/SfmN4GBDEokX3 +92Z5D/vwJ55Rg63nidQvP6pyxSPy/xfTa2yCmSsImdOHLKIRlOGl8BDrWSSPt7x9 +4tVtS3zWdVqvcCe91o8j2H3TYgFPjJG/GQHMS5npyFoeuCNj/YjV973GvNW7xBCi +Sllf/zarF6FmwZq/DGLh8CGodU+xEJmydHuws7Q/nVhiY2y4ieT7x5k+Ro0gOSL0 +5oeNgMsrdyfUWicWFj1HDZa9R3pFSPXKVU+YF0TIl2V5wH8vls921zLM61IieioC +/1Cd1IwFjrNUm6uC7nbSHqY41DdHcVDAflkCBA832gGR8bYfty54DJxtd+Wmnj4Z +WYG7qsgkGIeJsakoeTs6v7XstW3D+8fJEqcJUAhWXlz4/bNs9xYR1ZFLQy+JZEpc +0E6NgTbsuKhVNf969tolhMVnObWyCcqa8Dt3RqoWUQysOv7opq3ULGfsTdvlDOCF +7LNtS4a9dbu5DNSkssYWVOma1yxQZ4UwMDBICPaJVvrbTgYFCOhkEPpfiLeJolvK +7pm4QI5R5yaaGXE2e6MVQ/oWq6UZWv2rWBg/+G/3mW8g7Uz88Nfk7se9URd1tnzi +UamYgZpbBmGYh/jhj6qzo8ntxS/pqIavSOcjEhNpEWU0uVt+AlltGtw6TOrY5J8D +z/OTOmYISVqRFZlImqCQaTAKrwF3aUA4o1pulGto9a5KCzy/P5VBR8s= -----END ENCRYPTED PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/generate.sh b/unittest/fixtures/appletls/generate.sh index 63e546ed5..c0894da82 100755 --- a/unittest/fixtures/appletls/generate.sh +++ b/unittest/fixtures/appletls/generate.sh @@ -122,6 +122,7 @@ cat "$fixture_dir/root.crt" "$fixture_dir/wrong-root.crt" \ mkdir -p "$fixture_dir/ca-dir" cp "$fixture_dir/root.crt" "$fixture_dir/ca-dir/root.crt" +openssl x509 -in "$fixture_dir/root.crt" -outform DER -out "$fixture_dir/root.der" printf '%s\n' 'not a certificate' > "$fixture_dir/ca-dir/README.txt" mkdir -p "$fixture_dir/empty-ca-dir" printf '%s\n' 'not a certificate' > "$fixture_dir/empty-ca-dir/README.txt" diff --git a/unittest/fixtures/appletls/intermediate.crt b/unittest/fixtures/appletls/intermediate.crt index e09bc483c..b04a73dd4 100644 --- a/unittest/fixtures/appletls/intermediate.crt +++ b/unittest/fixtures/appletls/intermediate.crt @@ -2,19 +2,19 @@ MIIDMDCCAhigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw MDAwMFowKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlh -dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCelEw9R6bJjPvx5VY5 -RrAqjGJy6NY057K1uuwOUe5d5Ox8kH9U1mfES+Nd1kxcZBrY2Y/iNXHZYImnZRm1 -Gnw1P3Kyi769pz3Pb4G7SIq3E7vtdoMpGMvNr5kDSlVPWhd5Pcux7575e7cShH7F -prsXsxPlKCZNFPm6b4fJm7BZgU8Jbn+g2djl5uMJ9AfS17I1eDpnllrB7yFgYhSC -rIpKVtpWwB3iUZAwUviO8+/wXCWBBuhvt2nTh9eSARuMvGS9m8W6DCowALQ634ca -LzQQV0vY3M3R3A+1h/ykB8O/QcNVq2JwAw62+kBL9jX6N/RwPIftLzZGaQ5tq793 -nyn9AgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEG -MB0GA1UdDgQWBBSxcwEiCcoVUNnaTtB4Rf5hSYkD7DAfBgNVHSMEGDAWgBQNsJof -LlJaIMUi5q9DEnXEY8EmqTANBgkqhkiG9w0BAQsFAAOCAQEAEair+Wd0S03dEA+l -xf6ABZoGx2hOQ3fRtGVxVc86n0t489bTwULVZhHBVbK35IDWxpw6DHR0jI9kcPJ2 -kznTGjl3nkrktHx7tA1xQLsgCsXq99IuxkyEHjBRn0VKAAlJU9gT2ud2F86Fs7NO -l70H6P2Vj7FdHLW0XH3/Vx4SZVABkGpLuAnqaXtzF4muppFvyTiw+aXaVWhoyMoH -p8/WgBNUgxMsnWIr7dCN90sybwGTynudU99qdjmz+k+kiVw5v6qUbrZy8qHvcV2V -Xj/x40EbZlhWMPKn/j7yJ+nDc9Rpk2F0SLtqISAZ1tESmW3jdlgQ8LCRXMLx5yPI -TgDsdA== +dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD2Sl9gWEHIQhObIrRG +JxqX9f1SUu90pSzkeSZqLIazFa+yd09rsoDvTHKtbyZ86ybFpB5NG0LlD8RUFTEi +o5BjW2E5Gl3IkcdAckydO3DbYEvPzR+Of3uC2up/oHZGOx7LvKJA/2jgRUPPGV0X +lGZYchwUg8lqczzME4UT7wWX4zdQIdxOlt8ANjLs6/Kqrkg/NT7RTH7+yxG4aWyZ +7ch6aR8X3r4PTj0enKGrMgcqLnoDGHefwNzA6Fn4OwSbquQGCTRulm7JIPPMLbNo +OBPIw+TeJRIxNvc1051NujbHlDMwISPsuuJe0Mus4pzad6NFtUFdWUG5CoAHkbnL +TGmDAgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEG +MB0GA1UdDgQWBBSIuIWrJdxJfk0S9ZFxv4YDZ2NN5zAfBgNVHSMEGDAWgBT17eOZ +S6KUYHJ0NbsfdmXs32V2HDANBgkqhkiG9w0BAQsFAAOCAQEAM6T7H8KLo9fzkcDQ +/bLaSO8McclVrgFgaI5L8wBumX5aGAa8TmfpVVPseM54J4a5qx6zuI83QBWRfqv2 +tcX8da04cOoKHE935VsbSgh6V/h47EPheWR9v2AwNGF7EWFYZCZT+KDBSwdCn7ms +NuWiocBAzZO5sitvy/1vmPbU+4tZ8PODlRO6DF2XKthb0upkrXkMMerbYqH4L/hF +Ujw4L53/3gmEvw/kB+//53IZOvrEC5QJpyy8ED9jLnzquNVLJEWf2RlLLfYIDMfD +0bq1On8LiToqK4wS0Ykc7P97L292jERDkMYbIaDROaPKC+SzqgluFJI/O2LCPGRS +y35Nrg== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/multi-ca.pem b/unittest/fixtures/appletls/multi-ca.pem index 1c217cc51..5143925e7 100644 --- a/unittest/fixtures/appletls/multi-ca.pem +++ b/unittest/fixtures/appletls/multi-ca.pem @@ -2,37 +2,37 @@ MIIDBDCCAeygAwIBAgICAQAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw MDAwMFowIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MIIBIjAN -BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMDd6nejls/LrXQQ7UCG+j1q3t+9 -qnYJXn0Cvdzxub33PNMc5WbGTqxJG1/mqzSSU6Hm6ISNQZJStQlI9L1WhIrFX0gp -9DZjaUI0eeIOii4LxPBV9QHs1zWZcZehCzz6hNoPoXUBzEaBpxWj2wjVLN9AjKVO -4JMpyShGyw4ieXyDmsft4ALummVWh+C1tVBcO3baOMN2k4PvLB6zUEqhT554ppvO -EQtlzEW1JPEd0i0VpQ9QHUMSDMhYljljYhMzn9x10nABdD6q++STypw1dk5YJycO -cwCeCOMRGs/IbOKyaUiutZMieXQlCyJJsDLunTSgQO/0xo2wNwqRDN8dSQIDAQAB +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvqo6cJBRm1lKsQX5Fsz+jnnzfDqW +jl0M7fSs0zDVW8WbPk+6OkysFvgIzPclV7jkFrEYcB4UuHUifSmsFROf+CCqL4m2 +mFaSrmStqasjiNN/r3DW8XgjMn4KWgUae1X6xvjhfOI5qOEui0Zn7/x3HbwD/Ha0 +1WyjtY5+ZLvkn11dSlioWVBnk6vEnxtEphTbhGWi68cgF1RLElU0VeyXzjqkewTW +qtbqToAfY7wkRDBvcLg2p2tsLyyeAPWJCxmBKDZO+J6AYz5idi/0RdlFSXqBmEPU +O1qzTDEO/K78GS614e1DFNhYhNgk6b+wqWGvfr7qxqE+5D5IJ9fkU7zewwIDAQAB o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU -DbCaHy5SWiDFIuavQxJ1xGPBJqkwDQYJKoZIhvcNAQELBQADggEBAJU5OA8vGXAQ -7c/6sPpgznzNHiN3snGQImClfeImO5U09rYhGSU0pG/hTRy+FiQTpl3/SJ0w3h0/ -tq8OMdES4/HRK6voOkwzK926eWk9biyn1mhRKOHmCzLZdvYYly7Z7TFG1S3fmKIx -uVdz9Ot56Vs9KZllvHd85AZigiVvH4cJNlZZfzGeETWS0h0sfJOTtyDUuQBcs7QO -rWKw/qSFSsuwNGs++SdygYrT0EJ17Vc5jRWc4EetDIUUS/cBK092vaPUxv04IK+f -p4gzLWHPFL/E4yjfZXCdwUUW3Xbc6Fl2oDWDDmNKcXAtPJThMtUDHbRUYMVosYJ+ -1jMlDK+GsdM= +9e3jmUuilGBydDW7H3Zl7N9ldhwwDQYJKoZIhvcNAQELBQADggEBAHbaSvL/Ai19 +hA/h/0/nHXwRjspzcD8BsRkgwtE1uA6TOly5qzecRD+1yuNxSM3IvdVxhTdOrCyu +HsPgQCDczz09JqkSgX1F/pSgsIdC+ygl+GFJW+Om+84lXrNfn0EFiWmj9e8qsOR/ +3nAmn9Wn/RC4WMypHBCQyxNMJ74X1Zzq8VToki8iThA62nmYb+7jbwkHFj7jMF6f +y/75EwjZ7zZyK4ObpEgcOdp32LOl6/H2ERduN48WI2WRCLKmZLvsVEsp7WxPzWJc +2WZIFHptfRO8byuE/911PgDskTJedCuIActXE8zt4LBEIRVXIMsUUS6fO7ZJSBgx +JgqB1zRUvZE= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDBjCCAe6gAwIBAgICQAAwDQYJKoZIhvcNAQELBQAwJDEiMCAGA1UEAwwZbGli aHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAeFw0yNjEwMDEwMDAwMDBaFw00NjEwMDEw MDAwMDBaMCQxIjAgBgNVBAMMGWxpYmh2LWFwcGxldGxzLXdyb25nLXJvb3QwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCcu7OMtEsMCAxiLmcV8opGOcA -ArvaEtOxbe2ephawjZA2fGZa5nVzD6UXxhGwVIoqI1pLAwsBqCawnZrP+SrOIklo -0uH+tSe8DfDAYROEVlt0F9xUum79fEwEy57TkywooeeZV7A1HCaU2uKqAEWlAWMi -Bl6x+xZu1nAytrl4gTi0yVveGXM3K8VcaFS2jWsol8md6h48IxnFt5YMeGxgvVbQ -vKj9ecrkGsAXw3ivzs9T3RwQQa+NJJP5lSa6yv5zdGdCf/ReCyhwFWirEE33rn/v -Lz2IU5hivvya50irO8a+pZs9ggGKlL3SxT88YT4cF3YkQnBabXqYC9UwhTvBAgMB +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCadHYZpthCrE4ajMa+5sSAY+dc +cKhrbj804NNizFnBn13K+mdEtwhW6TssACxPe0Hp9M1D4+rYbSE9bRv+mCTdtO6J +oK/5q3aT+WxDCuPBMhY4aubPk/OA+mMGvciqyET9raIf3jrO0XHc1Iw7Ilknqr0N +IQ7gL9JN7uJtsW7hB3t4KgsdzXMpqr/oGbowjC2XyMGh0AWQcQszHoN6pTQQBqEM +KJVXrRIA6pVaxAgrFXfQg4hvk+qjQObi81TMbnl5Itfv4cgq4cKSS8EMwYVI/YP5 +R6M4+FO4xJzKSPQbX/NefUx7oj6lD5kx3qCJL7FciqBG9k7CkWhFMXkZ4izxAgMB AAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW -BBT5t6zFn+OT5JRva4hit6YtiMt+0jANBgkqhkiG9w0BAQsFAAOCAQEAYkxuYPMZ -TdUJCpK90WV7KSNMtaLxC0kTPYAOe9hc+jIevIwroqYSDbRrapsbKN+lW6oIy+6V -e5tjWtmRg6KFOgkg9eSyhchT9U8oS7mYHQIUFystCNyWCvsbYPv6dXoCMX4EY5Zz -VDgpgqgvnEINTx83X+ZEYYwu5tdjX+0rtZqFa40KXlofEGFNsY4z0698nUqLR30I -uy6wiT5NEyia3d6glousk31+dSsJJtbeWKX5bUawsaVDpe7pn6h0N86vmxPsAT0E -K8cIp74x+0VOd6TfdmL63WDGIwwwAr5rGQEKMlWoDbmX9ywYdxwcECHg6rfQ2JpQ -Y598JtncvZ1OqA== +BBTOFmrv/JS9Ia81lBQKjaFQZBaqnDANBgkqhkiG9w0BAQsFAAOCAQEALslwHXii +hmqp7A8L/cDMvTCZSJu12JD27kmUTocnLQ+r8y/m31aCERd0QcXint/qEudb45RW +sXXTFv9P5Gg+YA0yc6aN/1Rw/43XKfjl/68P0GeNi6xlsmctYqtznBziuEVhes8Q +qukGOpxZ3ptLRHLURlt1U7MHleWA3Blr8SVAkSdaDpB1dqA9OGxA7i3FgVMvpXzh +ltyyF1kAtzDZpN8WNTlZ/J/qNpGc8sN8yaQf4rsIHeg1yrRwPRDhqYL0y6usBofr +GZszxv6YSYhr3svuEbzxfcQBn2SBhdLsR24vuzozCShmENsNzUtmzLSsPpzfcqJb +dswNO4O4e3pIAg== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/root.crt b/unittest/fixtures/appletls/root.crt index 003114cc7..ca46c5887 100644 --- a/unittest/fixtures/appletls/root.crt +++ b/unittest/fixtures/appletls/root.crt @@ -2,18 +2,18 @@ MIIDBDCCAeygAwIBAgICAQAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw MDAwMFowIzEhMB8GA1UEAwwYbGliaHYtYXBwbGV0bHMtdGVzdC1yb290MIIBIjAN -BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMDd6nejls/LrXQQ7UCG+j1q3t+9 -qnYJXn0Cvdzxub33PNMc5WbGTqxJG1/mqzSSU6Hm6ISNQZJStQlI9L1WhIrFX0gp -9DZjaUI0eeIOii4LxPBV9QHs1zWZcZehCzz6hNoPoXUBzEaBpxWj2wjVLN9AjKVO -4JMpyShGyw4ieXyDmsft4ALummVWh+C1tVBcO3baOMN2k4PvLB6zUEqhT554ppvO -EQtlzEW1JPEd0i0VpQ9QHUMSDMhYljljYhMzn9x10nABdD6q++STypw1dk5YJycO -cwCeCOMRGs/IbOKyaUiutZMieXQlCyJJsDLunTSgQO/0xo2wNwqRDN8dSQIDAQAB +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvqo6cJBRm1lKsQX5Fsz+jnnzfDqW +jl0M7fSs0zDVW8WbPk+6OkysFvgIzPclV7jkFrEYcB4UuHUifSmsFROf+CCqL4m2 +mFaSrmStqasjiNN/r3DW8XgjMn4KWgUae1X6xvjhfOI5qOEui0Zn7/x3HbwD/Ha0 +1WyjtY5+ZLvkn11dSlioWVBnk6vEnxtEphTbhGWi68cgF1RLElU0VeyXzjqkewTW +qtbqToAfY7wkRDBvcLg2p2tsLyyeAPWJCxmBKDZO+J6AYz5idi/0RdlFSXqBmEPU +O1qzTDEO/K78GS614e1DFNhYhNgk6b+wqWGvfr7qxqE+5D5IJ9fkU7zewwIDAQAB o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU -DbCaHy5SWiDFIuavQxJ1xGPBJqkwDQYJKoZIhvcNAQELBQADggEBAJU5OA8vGXAQ -7c/6sPpgznzNHiN3snGQImClfeImO5U09rYhGSU0pG/hTRy+FiQTpl3/SJ0w3h0/ -tq8OMdES4/HRK6voOkwzK926eWk9biyn1mhRKOHmCzLZdvYYly7Z7TFG1S3fmKIx -uVdz9Ot56Vs9KZllvHd85AZigiVvH4cJNlZZfzGeETWS0h0sfJOTtyDUuQBcs7QO -rWKw/qSFSsuwNGs++SdygYrT0EJ17Vc5jRWc4EetDIUUS/cBK092vaPUxv04IK+f -p4gzLWHPFL/E4yjfZXCdwUUW3Xbc6Fl2oDWDDmNKcXAtPJThMtUDHbRUYMVosYJ+ -1jMlDK+GsdM= +9e3jmUuilGBydDW7H3Zl7N9ldhwwDQYJKoZIhvcNAQELBQADggEBAHbaSvL/Ai19 +hA/h/0/nHXwRjspzcD8BsRkgwtE1uA6TOly5qzecRD+1yuNxSM3IvdVxhTdOrCyu +HsPgQCDczz09JqkSgX1F/pSgsIdC+ygl+GFJW+Om+84lXrNfn0EFiWmj9e8qsOR/ +3nAmn9Wn/RC4WMypHBCQyxNMJ74X1Zzq8VToki8iThA62nmYb+7jbwkHFj7jMF6f +y/75EwjZ7zZyK4ObpEgcOdp32LOl6/H2ERduN48WI2WRCLKmZLvsVEsp7WxPzWJc +2WZIFHptfRO8byuE/911PgDskTJedCuIActXE8zt4LBEIRVXIMsUUS6fO7ZJSBgx +JgqB1zRUvZE= -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/root.der b/unittest/fixtures/appletls/root.der new file mode 100644 index 0000000000000000000000000000000000000000..15aa0fb50f7b02f94c16dd46ddebf4021d69e7f4 GIT binary patch literal 776 zcmXqLVrDUDVtliJnTe5!iHVWHfR~L^tIebBJ1-+6H!FjIvZ11ZJR5T;3p0;IPG(X@ znQmf1K~8E(PO)xDYH^8fQGR}jft)z6k(r@^0T6*elsK;mGM6|*ni!RkEoWq9U~XdM zX8^j6i>Zl`kzwB|tAYuEvm?DWvi=l1^RKV+bB)!szF3~OU)EeUxEg(Qww?bjE1xxD zKRC{OR}J6sL~Nr(ft<*WQl(nWHKM}ve<-Zd@7y*cY|^@vwJTREcU-PtUvTYXg|bl{ zR}`yMb?C2SKOWXRvRv^{uiGvC{hxB#Jnw63qUDCl%l#Wx zCa$mB_v+X}yC-%Y>ertH@40uFiJ6gsaj}zug8@G{fQvLHSmix`W@*SC*ndM}!iP*h^NTfQvy&HdCe8RSp~Mlmpy85zoMd42lNq+8p< z|M0*6bJ-ffzEi~o_KX`P6%JiA-N856DrV*NkU za8S5&-qu!arBGw7>%S=rHncna)=>SC=o$TZ+3$0zahv1kJF<3WF8=ynYr~WJdj)Fq zuP*;9up{EkN*RF(r-gmg_laMf^Xg;Bi%I%QegamvDre-sdz{b7E@t=GAa4HYe?Nse zZoW4w(r%u;#6!mNR{4$1OJ9HdCMcd~-Y=${I+0`3vXtF#LcBHK=J=mYin*EQAySoF zE4(LPyXF7gQagq>6OH0Zv^yA2hYO#1`(T5MqG-6nX^}v^`PSP!JtPd(xEimUgzTLN E04=dM%m4rY literal 0 HcmV?d00001 diff --git a/unittest/fixtures/appletls/server-chain.pem b/unittest/fixtures/appletls/server-chain.pem index 1b08814d4..c30cb4e62 100644 --- a/unittest/fixtures/appletls/server-chain.pem +++ b/unittest/fixtures/appletls/server-chain.pem @@ -2,39 +2,39 @@ MIIDSDCCAjCgAwIBAgICIAAwDQYJKoZIhvcNAQELBQAwKzEpMCcGA1UEAwwgbGli aHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUwHhcNMjYxMDAxMDAwMDAwWhcN MjcxMDAxMDAwMDAwWjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3 -DQEBAQUAA4IBDwAwggEKAoIBAQC4vRm3M80oD6rMCbiKj+x9Dzbr71v8sPjVcLTE -43tR2wCmYY9x5VVo06OvsbUusGSGMwjIgjaq96L3t9jQAcHpC4mXm9g9LRGwoHe8 -g6Epd38Vyqr3E2sRoZap3Fqq+rrKOs4+KA3HUr8XK0L+WQvDPiCaKHyf+QQL2Vtg -FZnFBE8PmAnCyu12cbEYDs1Opb4QSdoTjoksKo56EBuigecdtB07c5ZiM9PYP7VI -G0sqTU5gZpvNkwb06xY6lKU5mSGo+gx7Pq8u1/NDaFf9MflNNCQbzeBscNaaPcWD -nzbQovyfhWbMHBWQxtTNOWckNqPrqkmXXPlyQfr8cqnaFNVzAgMBAAGjgYwwgYkw +DQEBAQUAA4IBDwAwggEKAoIBAQCeokqQLxGsQrZkqkghZM1vrdh2NBp3b1h5N/ea +s6P+Yg6XbGNm2gg2g+vNNfJgUE772L/huvTcJr04qqI6uIP0gN4uAtog9604rgaC +TdyB3oTKuU/Uf3S5SPbpGuMIL3I4hoLp8ND+S+074u2B/oEg2ZtlMqDlriJbpFFD +tFl4atlyxur5j3GB8iZ9nfsP1Pc7NPEL565fQPILx3eKG8PpRCQTX4pQZD2fNqBZ +Pl+dGbvtPNe/TS/Z2pB1o1G4MEfMGO0HZbOIU9e08da0IZ3r6kl97Hi+aemNnACH +Zu95Pe+J+RfW4R8IBL23hYHijlc/qaeRXGZYU4PDjepVppgTAgMBAAGjgYwwgYkw DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH -AwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1UdDgQWBBRnnnCuUK1ZGFsqMiQk -L636ez4JNTAfBgNVHSMEGDAWgBSxcwEiCcoVUNnaTtB4Rf5hSYkD7DANBgkqhkiG -9w0BAQsFAAOCAQEAHDAn5jMS2ModMPWVmLEVoQBW41fDtrZgXnaXnHNKylH3PzZm -GijZKxwRuL13kVZ794nH+i57pK7bxjfwUPDhIEPueMTj0849GnEWTsUefRnymFaJ -FscqsVGB8HU4q1tevbukC2JvIsFSkV52/8i865TA23v8NuG+1Fkoxxf98RQqr8pb -vpvBjeEkldMVeXh3828y0m0WOu4gDVhx8ku5t6AA69AhbHYc3SJzj5DculG2ZqGW -X18Lm1YqDmrL4f15VHVko++AOvRXWUmAfFLrlJYJKdK8K3J1dIZJSvtesDAdQ2KN -Y85a0ded1kbCGJHSTTAHljrlRgJOUg901Uh4bw== +AwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1UdDgQWBBQDVKB33y0wpzacDhGt +h/ThhnSkZDAfBgNVHSMEGDAWgBSIuIWrJdxJfk0S9ZFxv4YDZ2NN5zANBgkqhkiG +9w0BAQsFAAOCAQEAni/iXfN+7uJATUqtIyZM4nOIKulHczuXYrqQP4MXy5FK1yYZ +lhh/q5P0EPn05D5on8HbNmhTebukOziUi7CxusxD46RP/GBkEGGCjauIQPupENOg +fdNyRDjjOpn5A7CqgUcuZFpPCaSSGAX22VcEmXQBbAmGLtdszZo/9s6wty4sqtXn +xMmRwgrYNvad/JNxnbS1xVxCCJFMLMp+JJU4w62TpibmIsINUOmip/wkA27rcb5+ +sfsul/LEVZWx4+Zkom4qEmYWlgHZf75gNHID/LbLfbNlX07AIuWkIiozTvBzrXxt +wnWXghfCUmDhPJtalBKTVjKifGnoxOuM+p51aA== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDMDCCAhigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwIzEhMB8GA1UEAwwYbGli aHYtYXBwbGV0bHMtdGVzdC1yb290MB4XDTI2MTAwMTAwMDAwMFoXDTQ2MTAwMTAw MDAwMFowKzEpMCcGA1UEAwwgbGliaHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlh -dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCelEw9R6bJjPvx5VY5 -RrAqjGJy6NY057K1uuwOUe5d5Ox8kH9U1mfES+Nd1kxcZBrY2Y/iNXHZYImnZRm1 -Gnw1P3Kyi769pz3Pb4G7SIq3E7vtdoMpGMvNr5kDSlVPWhd5Pcux7575e7cShH7F -prsXsxPlKCZNFPm6b4fJm7BZgU8Jbn+g2djl5uMJ9AfS17I1eDpnllrB7yFgYhSC -rIpKVtpWwB3iUZAwUviO8+/wXCWBBuhvt2nTh9eSARuMvGS9m8W6DCowALQ634ca -LzQQV0vY3M3R3A+1h/ykB8O/QcNVq2JwAw62+kBL9jX6N/RwPIftLzZGaQ5tq793 -nyn9AgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEG -MB0GA1UdDgQWBBSxcwEiCcoVUNnaTtB4Rf5hSYkD7DAfBgNVHSMEGDAWgBQNsJof -LlJaIMUi5q9DEnXEY8EmqTANBgkqhkiG9w0BAQsFAAOCAQEAEair+Wd0S03dEA+l -xf6ABZoGx2hOQ3fRtGVxVc86n0t489bTwULVZhHBVbK35IDWxpw6DHR0jI9kcPJ2 -kznTGjl3nkrktHx7tA1xQLsgCsXq99IuxkyEHjBRn0VKAAlJU9gT2ud2F86Fs7NO -l70H6P2Vj7FdHLW0XH3/Vx4SZVABkGpLuAnqaXtzF4muppFvyTiw+aXaVWhoyMoH -p8/WgBNUgxMsnWIr7dCN90sybwGTynudU99qdjmz+k+kiVw5v6qUbrZy8qHvcV2V -Xj/x40EbZlhWMPKn/j7yJ+nDc9Rpk2F0SLtqISAZ1tESmW3jdlgQ8LCRXMLx5yPI -TgDsdA== +dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD2Sl9gWEHIQhObIrRG +JxqX9f1SUu90pSzkeSZqLIazFa+yd09rsoDvTHKtbyZ86ybFpB5NG0LlD8RUFTEi +o5BjW2E5Gl3IkcdAckydO3DbYEvPzR+Of3uC2up/oHZGOx7LvKJA/2jgRUPPGV0X +lGZYchwUg8lqczzME4UT7wWX4zdQIdxOlt8ANjLs6/Kqrkg/NT7RTH7+yxG4aWyZ +7ch6aR8X3r4PTj0enKGrMgcqLnoDGHefwNzA6Fn4OwSbquQGCTRulm7JIPPMLbNo +OBPIw+TeJRIxNvc1051NujbHlDMwISPsuuJe0Mus4pzad6NFtUFdWUG5CoAHkbnL +TGmDAgMBAAGjZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEG +MB0GA1UdDgQWBBSIuIWrJdxJfk0S9ZFxv4YDZ2NN5zAfBgNVHSMEGDAWgBT17eOZ +S6KUYHJ0NbsfdmXs32V2HDANBgkqhkiG9w0BAQsFAAOCAQEAM6T7H8KLo9fzkcDQ +/bLaSO8McclVrgFgaI5L8wBumX5aGAa8TmfpVVPseM54J4a5qx6zuI83QBWRfqv2 +tcX8da04cOoKHE935VsbSgh6V/h47EPheWR9v2AwNGF7EWFYZCZT+KDBSwdCn7ms +NuWiocBAzZO5sitvy/1vmPbU+4tZ8PODlRO6DF2XKthb0upkrXkMMerbYqH4L/hF +Ujw4L53/3gmEvw/kB+//53IZOvrEC5QJpyy8ED9jLnzquNVLJEWf2RlLLfYIDMfD +0bq1On8LiToqK4wS0Ykc7P97L292jERDkMYbIaDROaPKC+SzqgluFJI/O2LCPGRS +y35Nrg== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/server-pkcs1.key b/unittest/fixtures/appletls/server-pkcs1.key index 74465a5eb..0204e9496 100644 --- a/unittest/fixtures/appletls/server-pkcs1.key +++ b/unittest/fixtures/appletls/server-pkcs1.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAuL0ZtzPNKA+qzAm4io/sfQ826+9b/LD41XC0xON7UdsApmGP -ceVVaNOjr7G1LrBkhjMIyII2qvei97fY0AHB6QuJl5vYPS0RsKB3vIOhKXd/Fcqq -9xNrEaGWqdxaqvq6yjrOPigNx1K/FytC/lkLwz4gmih8n/kEC9lbYBWZxQRPD5gJ -wsrtdnGxGA7NTqW+EEnaE46JLCqOehAbooHnHbQdO3OWYjPT2D+1SBtLKk1OYGab -zZMG9OsWOpSlOZkhqPoMez6vLtfzQ2hX/TH5TTQkG83gbHDWmj3Fg5820KL8n4Vm -zBwVkMbUzTlnJDaj66pJl1z5ckH6/HKp2hTVcwIDAQABAoIBAEgX59qyWPwqzQ0O -OBm+29vcHaNKSDwfNiRZdPonCj+h9yl3Bjs8861Sdl0AvUOoq7ohXWqeQkZLGKqS -cQaPwQQ4r+vd8i/BkFc88C09sx2TGCHBcyGzzsNVK45DQ5DZAx8bftQL3oCsPo2E -oQLQbkI10xRF+4iUbatQGhQvqdAT2ZsCcYEHZnZ61hCMepz1VjsBoGpIx06bfoQl -WPJLoikR9T5eF856Dh+fTa87RgzitrmztJs7lwbyZoHNWu0BeI4INvbuRAmwILou -pYKHg9GgMnC2HIOB53Ww4dbDr/Y+tE6py4ePw2x9t+Lpz+bQd+HzRGwX+W1HPa9o -k6D/bCECgYEA67tKAPH+wko9yK8WZTvCkTHxSXe5hpvnsVsxqU6c4xhjKlSgEk0c -gSd6RNdC7UrNqoD8/PETuFsvnWgGtukHhGeewwmM9Xe1wbXjOQO3Fk+KCOWkSOOj -LDReje0EeJodYbeKKjGSVu7oSDpgVDyV0oLJaMYaZ8t21+KNJQOzktMCgYEAyJ9m -tTnUOffQjBzkYDEd6NriUo9rEp1yH2wxvYnLnek313eXZtQlNI4Nwqd1Nsdu0/MW -TDfEhpLfGLVeLEU5VtU3JG/vbMCOUWFS76ChNwKHat0cmiz8gDJURhxY4fpWbzc3 -WOrNTKkihoBiHzH+5B0Hgu3QOrSvZBOsSKOZzuECgYEAnps6NJ6eGZ2YKnHbsKtf -ww+GWDcs5ev6HTPNmyvglU+wUSf1N7sYZbHpK25mgoAlFwaIsauG6DC6Pb9jXSg3 -PZf2kyXW6MXtzfMSeicMxf8oUcopGj3HaROnVvjVXEvdXwT9+lu2KbW/JfHZJHRL -HgOPfmZkF9gnEyREcVYnOa8CgYABthJbM14TDIET4N81ztVxegR6Lcz9AKjLidG2 -yykYdLfMN7Hr551VoGyPn3wJdpQEbMtg5QzhFPmgLVPbTs/ZZMIupmHFbLMKEKlz -b8xQOs5K5A3tZrrUoRlE69L6QndgRXlMYdxUbhDkUs4DdBq3eWPqAvtGtOnWEbDj -gbm7IQKBgQCEqZCgS3X7It0H2depIwM+X09W+mdCZiPkMB6cj8cwr3jQz8R5Dhcv -St27BeEEtoipzon/LZ8lMfkq/d1a3f5nIV5PbAxzjZjToeoz/HU6OvTM3A5yE2LI -ETgK0WnuDkURhNPRjt8BauDI0K7MyDsqNhjctus9JRoJETQt/jRSQg== +MIIEowIBAAKCAQEAnqJKkC8RrEK2ZKpIIWTNb63YdjQad29YeTf3mrOj/mIOl2xj +ZtoINoPrzTXyYFBO+9i/4br03Ca9OKqiOriD9IDeLgLaIPetOK4Ggk3cgd6EyrlP +1H90uUj26RrjCC9yOIaC6fDQ/kvtO+Ltgf6BINmbZTKg5a4iW6RRQ7RZeGrZcsbq ++Y9xgfImfZ37D9T3OzTxC+euX0DyC8d3ihvD6UQkE1+KUGQ9nzagWT5fnRm77TzX +v00v2dqQdaNRuDBHzBjtB2WziFPXtPHWtCGd6+pJfex4vmnpjZwAh2bveT3vifkX +1uEfCAS9t4WB4o5XP6mnkVxmWFODw43qVaaYEwIDAQABAoIBAAbmiA157AVic4ex +JpPD9vHJjgB6UhUUSV912/X6pC1v0N2tD9fiBSMbSE8ew80vwSJ7HRcHKG6ehXL+ +bTHWY/BnXgLXX0C5isChRVQ2vzBWYHq8ZpNs+0QHagIy3WG2RVGIfGULyN4+/vIG +HuRy5eVqwd6Rk2aFACactmeWY/afxwD6YlJYLXSLYWjZ713nSBpqd+dibaFvx6Mh +iIPwrXXUQrMjLerEmrjG+fSbweRE4BLKvVIOKqH/mHHRtnPPGJvh5FQcjouHv9+V +1VhQmfEaxQXRdrLOfADRykxkTxIDEm07XMaihRrnOTDnoc8zeBEcVyIY5QnU0YJz +qJaGH3UCgYEA2iuiSMPEZn02rwR4T+AjiRF51ZfrgkL1f5ruhTkqd0AnpzICBV8p +KvM3MgTfNzgN40TQ7zCJDsizd+3bYZqOBh3NgNE6umuOXDCIaEhhmVuZt/ySP7uy +IV3KPI6nxgjOjqe2g4EqV5kFRVN7dQZ4AB4qvdU6fC6uz75fhKaklPUCgYEAuiPk +ciHuzP4pbci8w8K5d3gl9+vOWAi2NejoTcsJNa/ENqb6Mo6dhdGiqdQLuF5zuigG +2GW+kyA/jlalr3lX7QhsD3bwDSUBpBsepovnFkPzw+8h0BoYDEGtiUl+5k0WLy7g +gQdHTYY559GnauDpT/hBuTgvs5cD/lWBdQH+E+cCgYEAnI37IiP452KqvuSCQS8h +0NYNi0w833iVGkBfMJJY+sG6squb76bdr8hfrzD3zHQY4yEanMlDUKyMvF6esmdp +ytHQCcQaVHOh8F2TROHLx3SH1hMUD0/s/yyCVvo3QlBHiO6oda1WaQ2RTrIdQVim ++86p9RbxpPMK1mBRwqqiJ5ECgYBr5cRVWFAZabbQGY06GJTzqKSxqnGo3Bvq8gA+ +n9PN1/3wBCiBx+ONn3Af63eDvtRscylMpOWsWQQeWSGfrsIF91zUNgh+RhZGbyX8 +OpqQcIFL8UDzZTzNVgDm1MCHdOXIIe8nO/Xb/VNxijj2njsADRLj76rO+lnpQt1Q +2v/RvwKBgBon5F7DSI/ZVoXRda3JWS8k5eFt3L09brQl/wm/edkI+FZIfuD0wNb/ +CY4lecMpH9esWle1T1JsTL8SryIbI5PFRNkvzrsOmi/YsALnvdospeI7gCQ4eLo9 +1Q0dJKXa73tuKq5bP+5Atc3rdfCRtNnKUGqG8ZJWs45bUiykq7k2 -----END RSA PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/server-pkcs8.key b/unittest/fixtures/appletls/server-pkcs8.key index 07ec1ce9b..45f4d42af 100644 --- a/unittest/fixtures/appletls/server-pkcs8.key +++ b/unittest/fixtures/appletls/server-pkcs8.key @@ -1,28 +1,28 @@ -----BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4vRm3M80oD6rM -CbiKj+x9Dzbr71v8sPjVcLTE43tR2wCmYY9x5VVo06OvsbUusGSGMwjIgjaq96L3 -t9jQAcHpC4mXm9g9LRGwoHe8g6Epd38Vyqr3E2sRoZap3Fqq+rrKOs4+KA3HUr8X -K0L+WQvDPiCaKHyf+QQL2VtgFZnFBE8PmAnCyu12cbEYDs1Opb4QSdoTjoksKo56 -EBuigecdtB07c5ZiM9PYP7VIG0sqTU5gZpvNkwb06xY6lKU5mSGo+gx7Pq8u1/ND -aFf9MflNNCQbzeBscNaaPcWDnzbQovyfhWbMHBWQxtTNOWckNqPrqkmXXPlyQfr8 -cqnaFNVzAgMBAAECggEASBfn2rJY/CrNDQ44Gb7b29wdo0pIPB82JFl0+icKP6H3 -KXcGOzzzrVJ2XQC9Q6iruiFdap5CRksYqpJxBo/BBDiv693yL8GQVzzwLT2zHZMY -IcFzIbPOw1UrjkNDkNkDHxt+1AvegKw+jYShAtBuQjXTFEX7iJRtq1AaFC+p0BPZ -mwJxgQdmdnrWEIx6nPVWOwGgakjHTpt+hCVY8kuiKRH1Pl4XznoOH59NrztGDOK2 -ubO0mzuXBvJmgc1a7QF4jgg29u5ECbAgui6lgoeD0aAycLYcg4HndbDh1sOv9j60 -TqnLh4/DbH234unP5tB34fNEbBf5bUc9r2iToP9sIQKBgQDru0oA8f7CSj3IrxZl -O8KRMfFJd7mGm+exWzGpTpzjGGMqVKASTRyBJ3pE10LtSs2qgPz88RO4Wy+daAa2 -6QeEZ57DCYz1d7XBteM5A7cWT4oI5aRI46MsNF6N7QR4mh1ht4oqMZJW7uhIOmBU -PJXSgsloxhpny3bX4o0lA7OS0wKBgQDIn2a1OdQ599CMHORgMR3o2uJSj2sSnXIf -bDG9icud6TfXd5dm1CU0jg3Cp3U2x27T8xZMN8SGkt8YtV4sRTlW1Tckb+9swI5R -YVLvoKE3Aodq3RyaLPyAMlRGHFjh+lZvNzdY6s1MqSKGgGIfMf7kHQeC7dA6tK9k -E6xIo5nO4QKBgQCemzo0np4ZnZgqcduwq1/DD4ZYNyzl6/odM82bK+CVT7BRJ/U3 -uxhlsekrbmaCgCUXBoixq4boMLo9v2NdKDc9l/aTJdboxe3N8xJ6JwzF/yhRyika -PcdpE6dW+NVcS91fBP36W7Yptb8l8dkkdEseA49+ZmQX2CcTJERxVic5rwKBgAG2 -ElszXhMMgRPg3zXO1XF6BHotzP0AqMuJ0bbLKRh0t8w3sevnnVWgbI+ffAl2lARs -y2DlDOEU+aAtU9tOz9lkwi6mYcVsswoQqXNvzFA6zkrkDe1mutShGUTr0vpCd2BF -eUxh3FRuEORSzgN0Grd5Y+oC+0a06dYRsOOBubshAoGBAISpkKBLdfsi3QfZ16kj -Az5fT1b6Z0JmI+QwHpyPxzCveNDPxHkOFy9K3bsF4QS2iKnOif8tnyUx+Sr93Vrd -/mchXk9sDHONmNOh6jP8dTo69MzcDnITYsgROArRae4ORRGE09GO3wFq4MjQrszI -Oyo2GNy26z0lGgkRNC3+NFJC +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCeokqQLxGsQrZk +qkghZM1vrdh2NBp3b1h5N/eas6P+Yg6XbGNm2gg2g+vNNfJgUE772L/huvTcJr04 +qqI6uIP0gN4uAtog9604rgaCTdyB3oTKuU/Uf3S5SPbpGuMIL3I4hoLp8ND+S+07 +4u2B/oEg2ZtlMqDlriJbpFFDtFl4atlyxur5j3GB8iZ9nfsP1Pc7NPEL565fQPIL +x3eKG8PpRCQTX4pQZD2fNqBZPl+dGbvtPNe/TS/Z2pB1o1G4MEfMGO0HZbOIU9e0 +8da0IZ3r6kl97Hi+aemNnACHZu95Pe+J+RfW4R8IBL23hYHijlc/qaeRXGZYU4PD +jepVppgTAgMBAAECggEABuaIDXnsBWJzh7Emk8P28cmOAHpSFRRJX3Xb9fqkLW/Q +3a0P1+IFIxtITx7DzS/BInsdFwcobp6Fcv5tMdZj8GdeAtdfQLmKwKFFVDa/MFZg +erxmk2z7RAdqAjLdYbZFUYh8ZQvI3j7+8gYe5HLl5WrB3pGTZoUAJpy2Z5Zj9p/H +APpiUlgtdIthaNnvXedIGmp352JtoW/HoyGIg/CtddRCsyMt6sSauMb59JvB5ETg +Esq9Ug4qof+YcdG2c88Ym+HkVByOi4e/35XVWFCZ8RrFBdF2ss58ANHKTGRPEgMS +bTtcxqKFGuc5MOehzzN4ERxXIhjlCdTRgnOoloYfdQKBgQDaK6JIw8RmfTavBHhP +4COJEXnVl+uCQvV/mu6FOSp3QCenMgIFXykq8zcyBN83OA3jRNDvMIkOyLN37dth +mo4GHc2A0Tq6a45cMIhoSGGZW5m3/JI/u7IhXco8jqfGCM6Op7aDgSpXmQVFU3t1 +BngAHiq91Tp8Lq7Pvl+EpqSU9QKBgQC6I+RyIe7M/iltyLzDwrl3eCX3685YCLY1 +6OhNywk1r8Q2pvoyjp2F0aKp1Au4XnO6KAbYZb6TID+OVqWveVftCGwPdvANJQGk +Gx6mi+cWQ/PD7yHQGhgMQa2JSX7mTRYvLuCBB0dNhjnn0adq4OlP+EG5OC+zlwP+ +VYF1Af4T5wKBgQCcjfsiI/jnYqq+5IJBLyHQ1g2LTDzfeJUaQF8wklj6wbqyq5vv +pt2vyF+vMPfMdBjjIRqcyUNQrIy8Xp6yZ2nK0dAJxBpUc6HwXZNE4cvHdIfWExQP +T+z/LIJW+jdCUEeI7qh1rVZpDZFOsh1BWKb7zqn1FvGk8wrWYFHCqqInkQKBgGvl +xFVYUBlpttAZjToYlPOopLGqcajcG+ryAD6f083X/fAEKIHH442fcB/rd4O+1Gxz +KUyk5axZBB5ZIZ+uwgX3XNQ2CH5GFkZvJfw6mpBwgUvxQPNlPM1WAObUwId05cgh +7yc79dv9U3GKOPaeOwANEuPvqs76WelC3VDa/9G/AoGAGifkXsNIj9lWhdF1rclZ +LyTl4W3cvT1utCX/Cb952Qj4Vkh+4PTA1v8JjiV5wykf16xaV7VPUmxMvxKvIhsj +k8VE2S/Ouw6aL9iwAue92iyl4juAJDh4uj3VDR0kpdrve24qrls/7kC1zet18JG0 +2cpQaobxklazjltSLKSruTY= -----END PRIVATE KEY----- diff --git a/unittest/fixtures/appletls/server.crt b/unittest/fixtures/appletls/server.crt index 528724127..171f9d3ed 100644 --- a/unittest/fixtures/appletls/server.crt +++ b/unittest/fixtures/appletls/server.crt @@ -2,19 +2,19 @@ MIIDSDCCAjCgAwIBAgICIAAwDQYJKoZIhvcNAQELBQAwKzEpMCcGA1UEAwwgbGli aHYtYXBwbGV0bHMtdGVzdC1pbnRlcm1lZGlhdGUwHhcNMjYxMDAxMDAwMDAwWhcN MjcxMDAxMDAwMDAwWjAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3 -DQEBAQUAA4IBDwAwggEKAoIBAQC4vRm3M80oD6rMCbiKj+x9Dzbr71v8sPjVcLTE -43tR2wCmYY9x5VVo06OvsbUusGSGMwjIgjaq96L3t9jQAcHpC4mXm9g9LRGwoHe8 -g6Epd38Vyqr3E2sRoZap3Fqq+rrKOs4+KA3HUr8XK0L+WQvDPiCaKHyf+QQL2Vtg -FZnFBE8PmAnCyu12cbEYDs1Opb4QSdoTjoksKo56EBuigecdtB07c5ZiM9PYP7VI -G0sqTU5gZpvNkwb06xY6lKU5mSGo+gx7Pq8u1/NDaFf9MflNNCQbzeBscNaaPcWD -nzbQovyfhWbMHBWQxtTNOWckNqPrqkmXXPlyQfr8cqnaFNVzAgMBAAGjgYwwgYkw +DQEBAQUAA4IBDwAwggEKAoIBAQCeokqQLxGsQrZkqkghZM1vrdh2NBp3b1h5N/ea +s6P+Yg6XbGNm2gg2g+vNNfJgUE772L/huvTcJr04qqI6uIP0gN4uAtog9604rgaC +TdyB3oTKuU/Uf3S5SPbpGuMIL3I4hoLp8ND+S+074u2B/oEg2ZtlMqDlriJbpFFD +tFl4atlyxur5j3GB8iZ9nfsP1Pc7NPEL565fQPILx3eKG8PpRCQTX4pQZD2fNqBZ +Pl+dGbvtPNe/TS/Z2pB1o1G4MEfMGO0HZbOIU9e08da0IZ3r6kl97Hi+aemNnACH +Zu95Pe+J+RfW4R8IBL23hYHijlc/qaeRXGZYU4PDjepVppgTAgMBAAGjgYwwgYkw DAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH -AwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1UdDgQWBBRnnnCuUK1ZGFsqMiQk -L636ez4JNTAfBgNVHSMEGDAWgBSxcwEiCcoVUNnaTtB4Rf5hSYkD7DANBgkqhkiG -9w0BAQsFAAOCAQEAHDAn5jMS2ModMPWVmLEVoQBW41fDtrZgXnaXnHNKylH3PzZm -GijZKxwRuL13kVZ794nH+i57pK7bxjfwUPDhIEPueMTj0849GnEWTsUefRnymFaJ -FscqsVGB8HU4q1tevbukC2JvIsFSkV52/8i865TA23v8NuG+1Fkoxxf98RQqr8pb -vpvBjeEkldMVeXh3828y0m0WOu4gDVhx8ku5t6AA69AhbHYc3SJzj5DculG2ZqGW -X18Lm1YqDmrL4f15VHVko++AOvRXWUmAfFLrlJYJKdK8K3J1dIZJSvtesDAdQ2KN -Y85a0ded1kbCGJHSTTAHljrlRgJOUg901Uh4bw== +AwEwFAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1UdDgQWBBQDVKB33y0wpzacDhGt +h/ThhnSkZDAfBgNVHSMEGDAWgBSIuIWrJdxJfk0S9ZFxv4YDZ2NN5zANBgkqhkiG +9w0BAQsFAAOCAQEAni/iXfN+7uJATUqtIyZM4nOIKulHczuXYrqQP4MXy5FK1yYZ +lhh/q5P0EPn05D5on8HbNmhTebukOziUi7CxusxD46RP/GBkEGGCjauIQPupENOg +fdNyRDjjOpn5A7CqgUcuZFpPCaSSGAX22VcEmXQBbAmGLtdszZo/9s6wty4sqtXn +xMmRwgrYNvad/JNxnbS1xVxCCJFMLMp+JJU4w62TpibmIsINUOmip/wkA27rcb5+ +sfsul/LEVZWx4+Zkom4qEmYWlgHZf75gNHID/LbLfbNlX07AIuWkIiozTvBzrXxt +wnWXghfCUmDhPJtalBKTVjKifGnoxOuM+p51aA== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/wrong-root.crt b/unittest/fixtures/appletls/wrong-root.crt index 539d57f86..cd989adea 100644 --- a/unittest/fixtures/appletls/wrong-root.crt +++ b/unittest/fixtures/appletls/wrong-root.crt @@ -2,18 +2,18 @@ MIIDBjCCAe6gAwIBAgICQAAwDQYJKoZIhvcNAQELBQAwJDEiMCAGA1UEAwwZbGli aHYtYXBwbGV0bHMtd3Jvbmctcm9vdDAeFw0yNjEwMDEwMDAwMDBaFw00NjEwMDEw MDAwMDBaMCQxIjAgBgNVBAMMGWxpYmh2LWFwcGxldGxzLXdyb25nLXJvb3QwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCcu7OMtEsMCAxiLmcV8opGOcA -ArvaEtOxbe2ephawjZA2fGZa5nVzD6UXxhGwVIoqI1pLAwsBqCawnZrP+SrOIklo -0uH+tSe8DfDAYROEVlt0F9xUum79fEwEy57TkywooeeZV7A1HCaU2uKqAEWlAWMi -Bl6x+xZu1nAytrl4gTi0yVveGXM3K8VcaFS2jWsol8md6h48IxnFt5YMeGxgvVbQ -vKj9ecrkGsAXw3ivzs9T3RwQQa+NJJP5lSa6yv5zdGdCf/ReCyhwFWirEE33rn/v -Lz2IU5hivvya50irO8a+pZs9ggGKlL3SxT88YT4cF3YkQnBabXqYC9UwhTvBAgMB +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCadHYZpthCrE4ajMa+5sSAY+dc +cKhrbj804NNizFnBn13K+mdEtwhW6TssACxPe0Hp9M1D4+rYbSE9bRv+mCTdtO6J +oK/5q3aT+WxDCuPBMhY4aubPk/OA+mMGvciqyET9raIf3jrO0XHc1Iw7Ilknqr0N +IQ7gL9JN7uJtsW7hB3t4KgsdzXMpqr/oGbowjC2XyMGh0AWQcQszHoN6pTQQBqEM +KJVXrRIA6pVaxAgrFXfQg4hvk+qjQObi81TMbnl5Itfv4cgq4cKSS8EMwYVI/YP5 +R6M4+FO4xJzKSPQbX/NefUx7oj6lD5kx3qCJL7FciqBG9k7CkWhFMXkZ4izxAgMB AAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW -BBT5t6zFn+OT5JRva4hit6YtiMt+0jANBgkqhkiG9w0BAQsFAAOCAQEAYkxuYPMZ -TdUJCpK90WV7KSNMtaLxC0kTPYAOe9hc+jIevIwroqYSDbRrapsbKN+lW6oIy+6V -e5tjWtmRg6KFOgkg9eSyhchT9U8oS7mYHQIUFystCNyWCvsbYPv6dXoCMX4EY5Zz -VDgpgqgvnEINTx83X+ZEYYwu5tdjX+0rtZqFa40KXlofEGFNsY4z0698nUqLR30I -uy6wiT5NEyia3d6glousk31+dSsJJtbeWKX5bUawsaVDpe7pn6h0N86vmxPsAT0E -K8cIp74x+0VOd6TfdmL63WDGIwwwAr5rGQEKMlWoDbmX9ywYdxwcECHg6rfQ2JpQ -Y598JtncvZ1OqA== +BBTOFmrv/JS9Ia81lBQKjaFQZBaqnDANBgkqhkiG9w0BAQsFAAOCAQEALslwHXii +hmqp7A8L/cDMvTCZSJu12JD27kmUTocnLQ+r8y/m31aCERd0QcXint/qEudb45RW +sXXTFv9P5Gg+YA0yc6aN/1Rw/43XKfjl/68P0GeNi6xlsmctYqtznBziuEVhes8Q +qukGOpxZ3ptLRHLURlt1U7MHleWA3Blr8SVAkSdaDpB1dqA9OGxA7i3FgVMvpXzh +ltyyF1kAtzDZpN8WNTlZ/J/qNpGc8sN8yaQf4rsIHeg1yrRwPRDhqYL0y6usBofr +GZszxv6YSYhr3svuEbzxfcQBn2SBhdLsR24vuzozCShmENsNzUtmzLSsPpzfcqJb +dswNO4O4e3pIAg== -----END CERTIFICATE----- diff --git a/unittest/fixtures/appletls/wrong-server.key b/unittest/fixtures/appletls/wrong-server.key index ef8d3d58e..033373b9e 100644 --- a/unittest/fixtures/appletls/wrong-server.key +++ b/unittest/fixtures/appletls/wrong-server.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAlHBnSXI8hNj1THttaZfjkXkGrN2TCm5o2jNPWo1XLJwMB5g4 -xRTzXzLZGSnfPfy9g+FYSd2lgSj3u3N+Y1dXUFT3sbP2x6xTAUO3GQIeolw912ec -IxXpGmL2ckcwt8m+M7Rh94jqsRqdk28DNqiP2BHHIBVrqd9HC2tRekwFWXWRpNbo -Vv+CJKvsTSQzyhudXPCNaDzUPyFl0sC+3LXSOEvLrph8+IO0cmloeXZdQJxXoN2n -uF1qf5Y+9mMwm4KnxjNpBcM4JuVHyli+Pw4WyT1rS7Z1CT6DCDB9FdDnCW8XtPWe -vmU5nvLgbgrb2eHXp29MmhnZO8Bm+dgfcRwSTwIDAQABAoIBAAEd4du1x6nYyn7e -79ysF+uIyeX0GkwHhXBU6P9nYAWY65vBylYAdl/f0ww+dblhP4R8Zg195L+fnOI1 -nu+8MmsP0JTqqDP4ufXouqyDdu2xgbJDgUr4fahpJxTXoHW4Go5rAbxx32ZF4ydn -R1uM+S3jUeUo40DPLz0pW/VKhMDNPX7dZ33i6Taw1I0BQWh6jsKpWZwXqlg79Qx3 -XPjsJw8Bvnodr5LH3JdWnnQv9FHHdkPr5g24ICw4sLHAAG+1YNiwCfmiZWmtr88E -HhJE6Mjayqf86a/4sa6qvMv+r4PAbxP+ei1xGCuH6TYXOOSJP/0MGV5hZn3pZTLC -0vlGOM0CgYEAw2X0SsHfDNiSn8Ioc56fkRfB9VxsK1ii0EuObfTRqKRukK0KJbaM -tgIg6ZruB5JOohoLsomqcOhspBdLvZB4jkHI4qlUfW4Q8IKdzygEnTyaIgo0S8UU -/10QoymU53sXFbX+vShJAg0/ITQz0yFhk+KZtHd5MhdiE6t396A/ufUCgYEAwnoH -TMGQ/Jfgy/0SX3j/rKozP8Mwv7BjeVj7Nu2sq4KfbIhUEkAMlwlc/o/tTCGxm/Vd -tvb1QTx17Kl4ApvNn2IroMBghZqhg4lfeAAtrb1yPurk80uR/V77PMqqwae9VMNT -O21AP+XwMVhNwOpdDwEkTOBtlInacK8gVUY1XLMCgYEAr6STLywMs4BudNtT/3KE -HynK+SLGPUSkvjZc5qxeVojQto5Fg9cPr4BEU5koBHhY5NAi2a90HaBgIDSsqc8W -/1FVIaJyx3lMEtZmwtNHKoxSRO0FS2LyWAYxMWnsZxQ3kRWS0jhHQGfl6pQBTfVA -wG2+GwIWWJe6WtIUuew7vI0CgYBWigyziDMnY8JBo7TITUSgpgA2MHqB4lDxj7oC -IFNE4tRkbGnU0TGJCD6cfJlg1mF9f/saztwmEmx7SpI/vusKMJovZ0vMSBn1OW0F -LjclZ/btroMBDLDDKb/stlaz5BupG13vRNdhV8XBf4TiAqg0ZBKuLvQ0M//DQvrF -V3+pZwKBgQCfX9poNBSBpbohG4HcowpmM5rokYEYeL0Sx+DjN4ZlPRXL7QjZ0wfa -hlZyxcfvGGicGQMoKOZ42/mIxXN4217WPi1BkoeG8L+ircBw2QM/uUf3011Gjt2D -xhjWNc+OIdDJMa5L8yV3qgNirDcGVykgG3F6PfFFk2fivA5AfFjs2g== +MIIEpAIBAAKCAQEAuz3le6CgeKyCzN5/1l9hawkG7RwYDiePzxh5gRKhVGGjzghR +o1DT7u8/YpluTSSpy32oud9BSGI1QYPgr7IREpjPECqgmlfU3nE5X6Gh1ha1M19w +eMZ+z+V+aV7qDQ8PWBn7wYWoKvxlSGfHt10mk+gv3RXK9EM+7yN72qqWEex9GHtb +7xd/BvBFGR170yqUYWefgF9YoqVPPTJ8qvM9yUqvEV4nmQeKELrQvXOD2vebtKDk +3BT3W6/JBqTigyOJOK0ybIo5/0cDLKl5QD9AzGVNrTQWETtVR6zpyYAbbMr2GCcU +pq9kWYhJFzdW+SQy4bLSAtAujXKo8CwxOnINgwIDAQABAoIBADehfr6Z7UOdQal7 +y/CV2xxRjMjC6ZS/BVeq9mK2dc9byS7MQvEqcSVS2PrDCkYKSBZpCcnbvooyf48t +DwM0fSUQ2Kh9ecURpnHGoxy6KZqxmXmfeAuyMfgzv7iv1gs2N8FdyvJm8x1+ats1 +1l0w5Gbae+oMcQXcuuSTHtfLihXdsuCW4kBaGTgVqFzN4KYjJUPWShctxhRf6AKc +jCOonmJX02o6ZGkZpeauB/rjIEXBuHY77fKd55KzqqW5Ub3jfmL5kK+yMwarfYSZ +YmW1yrdiJHjy/TBb3J8V2JZ38SaPcl6Vgs1KmgQ6Rga3TidzQwjhWs4fUIjZ3Lm1 +QhcnmhUCgYEA5Fc5qy/2MeXsDisoJYSqnkQ6DsQ9DJVB2fmB04dSkkdrWlekj1kM +JTl6OP3nHp0Mf9lrRsQcDfwt6wqq8rr+yQ/XjEpZOLgqlg4odcynKHcMFMJ4WZbV +tTv+Zpi1Ll/48QG8WNW9LJj2kOECtrvcPpFYdT/HH46P6vEBgo7lniUCgYEA0ew0 +ruIVoBzy7te8bdwsLkRPgaKwXV2ReA7ZjxxzymksFQuVVsGTSujpAlXf5+H8MpUL +B9nTjqrpQqst5Uzy+jm6yWKLALN1botitx3KpCrEERXqo0om32/F/4B8Qb7oUZ5I +sJ4ATRsa6NnLaKlwfp90tRR4DAq4QVoJDBp4iIcCgYB2HqEYazEiUtwv4CdecSiJ +wqV96gnirntoNOfx8rjGLufbzia0eM4Nm5QcU0vxzDAhGumhq+UPXvqp8dTIx+7x +N567VeKdsrdk9GH9viZiimLXglobjilzHVvW2vwuxzrSAaHbGoZHwcEa5SswODIQ +s8Ncs+df7bGJSa8MSLuDeQKBgQDJiKGTfA4S53f7ATcvqX7o9D/4Tv5OxHPR9T+8 ++y3XF11w3uwCnFkSQ8Tfrx4E+poq3Zf3c5J9l2vVy42GZHeo7x96E5crlx6YgEzH +TFytezk8xfO7zIbBYAeQogOpAuT65qEWnrnfTLRq9B0qX/FWPzPGXN5bgTcf1pZ0 +/jzVpQKBgQDZHgo80xUGlPdUDG2G32E/IcWyQ+vNNYHIOwuomVePJ4MIryTQp/Mr +DJW4FXd8swxW5NXJIDdJFVeR2JjpOO5qLR1SzDfdeHBjhJyIN+fB7tCDLxA8JM1t +N7nKhtmfUiLc+Wgl0Mp57jC6rbXE7t7C4AlPXjFXWsn2iYGjdYzBtw== -----END RSA PRIVATE KEY----- From 92917b527805553bef40457da40bb8141810f969 Mon Sep 17 00:00:00 2001 From: ithewei Date: Thu, 1 Oct 2026 17:47:24 +0800 Subject: [PATCH 12/12] ci(ssl): run Apple TLS regression tests Co-authored-by: TRAE CLI --- .github/workflows/CI.yml | 2 ++ docs/cn/TcpClient.md | 10 +++++----- docs/cn/TcpServer.md | 11 ++++++----- 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml index 960129ed7..3db0917af 100644 --- a/.github/workflows/CI.yml +++ b/.github/workflows/CI.yml @@ -86,6 +86,8 @@ jobs: - name: test run: | + bin/appletls_pem_test + bin/appletls_test bin/curl -v -X HEAD http://example.com/ bin/curl -v -X HEAD https://example.com/ diff --git a/docs/cn/TcpClient.md b/docs/cn/TcpClient.md index 95d012382..3a3f75ef4 100644 --- a/docs/cn/TcpClient.md +++ b/docs/cn/TcpClient.md @@ -73,11 +73,11 @@ ssl.verify_peer = 1; client.withTLS(&ssl); ``` -未设置 `ca_file` 和 `ca_path` 时，Apple TLS、OpenSSL 和 GnuTLS 后端使用 -系统信任根。设置了任一项时，仅信任指定的自定义 CA，不再使用系统信任根。 -`ca_file` 可以包含多个 PEM `CERTIFICATE` 块，`ca_path` 指向包含 PEM 或 -DER CA 证书的目录。通过域名连接时还会校验证书中的 DNS 主机名。 -Apple TLS 的证书验证不会在线下载缺失的中间证书，服务端应发送完整证书链。 +Apple TLS 后端在未设置 `ca_file` 和 `ca_path` 时使用系统信任根；设置了 +任一项时，仅信任指定的自定义 CA，不再使用系统信任根。`ca_file` 可以 +包含多个 PEM `CERTIFICATE` 块，`ca_path` 指向包含 PEM 或 DER CA 证书的 +普通文件目录。通过域名连接时，Apple TLS 后端还会校验证书中的 DNS +主机名。验证时不会在线下载缺失的中间证书，服务端应发送完整证书链。 客户端双向 TLS 示例： diff --git a/docs/cn/TcpServer.md b/docs/cn/TcpServer.md index cfa3f83db..cb5d1e059 100644 --- a/docs/cn/TcpServer.md +++ b/docs/cn/TcpServer.md @@ -74,8 +74,8 @@ server.withTLS(&ssl); 证书链文件使用 PEM 格式，第一张为服务端证书，后续依次为中间证书。 -将 `verify_peer` 设为 `1` 会启用强制双向 TLS：客户端必须提供受信任的 -证书，否则握手失败。 +Apple TLS 后端将 `verify_peer` 设为 `1` 时会启用强制双向 TLS：客户端 +必须提供受信任的证书，否则握手失败。 ```cpp hssl_ctx_opt_t ssl = {}; @@ -86,9 +86,10 @@ ssl.verify_peer = 1; server.withTLS(&ssl); ``` -未设置 `ca_file` 和 `ca_path` 时使用系统信任根；设置了任一项时，仅信任 -指定的自定义 CA。`ca_file` 可以包含多张 PEM 证书，`ca_path` 可以包含 -PEM 或 DER CA 证书。 +Apple TLS 后端在未设置 `ca_file` 和 `ca_path` 时使用系统信任根；设置了 +任一项时，仅信任指定的自定义 CA。`ca_file` 可以包含多张 PEM 证书， +`ca_path` 指向包含 PEM 或 DER CA 证书的普通文件目录。其他 TLS 后端的 +证书验证和 CA 目录格式由相应后端实现决定。 Apple TLS 后端的本地身份目前只支持未加密的 RSA 私钥： `RSA PRIVATE KEY`（PKCS#1）或 RSA `PRIVATE KEY`（PKCS#8）。不支持 EC