Merge branch 'kazuho/verify-sign-sha384512' into kazuho/cert-ed25519
diff --git a/t/assets/ec256-key-pair.pem b/t/assets/ec256-key-pair.pem
deleted file mode 100644
index ce786ed..0000000
--- a/t/assets/ec256-key-pair.pem
+++ /dev/null
@@ -1,5 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MHcCAQEEIBswGBU5+SsrFYQupnJ/GVf1bYhBEmJiBpxLL4jXZRrpoAoGCCqGSM49
-AwEHoUQDQgAEWF0BvlHl/ZVaoApefcN5+emI6cjSDbR3aP843VWgMLfxNqvmWut0
-KsoRQC2OHJ+Z8HoLZcNnA7Mc3/ypHSUqrw==
------END EC PRIVATE KEY-----
diff --git a/t/assets/ec256-pub.pem b/t/assets/ec256-pub.pem
deleted file mode 100644
index 76a3396..0000000
--- a/t/assets/ec256-pub.pem
+++ /dev/null
@@ -1,4 +0,0 @@
------BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWF0BvlHl/ZVaoApefcN5+emI6cjS
-DbR3aP843VWgMLfxNqvmWut0KsoRQC2OHJ+Z8HoLZcNnA7Mc3/ypHSUqrw==
------END PUBLIC KEY-----
diff --git a/t/assets/server.crt b/t/assets/rsa/cert.pem
similarity index 100%
rename from t/assets/server.crt
rename to t/assets/rsa/cert.pem
diff --git a/t/assets/server.key b/t/assets/rsa/key.pem
similarity index 100%
rename from t/assets/server.key
rename to t/assets/rsa/key.pem
diff --git a/t/assets/server.pub b/t/assets/rsa/pub.pem
similarity index 100%
rename from t/assets/server.pub
rename to t/assets/rsa/pub.pem
diff --git a/t/assets/secp256r1/cert.pem b/t/assets/secp256r1/cert.pem
new file mode 100644
index 0000000..ef2ae2c
--- /dev/null
+++ b/t/assets/secp256r1/cert.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICYDCCAUigAwIBAgIBATANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9waWNv
+dGxzIHRlc3QgY2EwHhcNMTgwMjIzMDUzMTA0WhcNMjgwMjIxMDUzMTA0WjAbMRkw
+FwYDVQQDExB0ZXN0LmV4YW1wbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
+QgAE2silQFS6M9oYqUF/SVPfYOamPbaOUzqf3RkUXqsDz7z7NpgWJI8HKW0V2E8w
+6Alk+xT8hnzUBsL9neiZP0iMK6N7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0E
+HxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFO4whhah
+0mmtZOTXd2uy/VxPAaK1MB8GA1UdIwQYMBaAFL95ypeyYHgglqpGV5zfp7Ij9SVj
+MA0GCSqGSIb3DQEBCwUAA4IBAQCPrJwBbYGqjK5dtRZ06ujrJluxZtVr1E15DW2H
+qba/dC3Bsi5StkvKDQFFOFga0mptIJhaUbBvLD8PEojtfAmldAAhPUvSLVSqU4tk
++R7qpYrnYV5WklI2PqBoWZx9s+hcS3du3ijtGJGpnDnSlsyYBYx03B4SWzi9Vsuj
+6OEqWivSMkXBEIUgbGs06maRDi64ZIefB7wjTyOtvonfCphH6WMC00H0LaTO3ePY
+QQj+30fA52OOH/BLxa6rwLo4PuOQnAi9dRy5uFRDHZlC4KK3dbsUA3ma9gfYpasr
+OnCLd4Vwipg4mzUJ9mJrKUqnp/k73tjIkFfydiojCwFoxpry
+-----END CERTIFICATE-----
diff --git a/t/assets/secp256r1/key.pem b/t/assets/secp256r1/key.pem
new file mode 100644
index 0000000..71ba2ed
--- /dev/null
+++ b/t/assets/secp256r1/key.pem
@@ -0,0 +1,8 @@
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMF0tPle/noBDr5K6DOyNhP8Zellkag5npqA+6vR/7o6oAoGCCqGSM49
+AwEHoUQDQgAE2silQFS6M9oYqUF/SVPfYOamPbaOUzqf3RkUXqsDz7z7NpgWJI8H
+KW0V2E8w6Alk+xT8hnzUBsL9neiZP0iMKw==
+-----END EC PRIVATE KEY-----
diff --git a/t/assets/secp256r1/pub.pem b/t/assets/secp256r1/pub.pem
new file mode 100644
index 0000000..0402946
--- /dev/null
+++ b/t/assets/secp256r1/pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2silQFS6M9oYqUF/SVPfYOamPbaO
+Uzqf3RkUXqsDz7z7NpgWJI8HKW0V2E8w6Alk+xT8hnzUBsL9neiZP0iMKw==
+-----END PUBLIC KEY-----
diff --git a/t/assets/secp384r1/cert.pem b/t/assets/secp384r1/cert.pem
new file mode 100644
index 0000000..8d33af8
--- /dev/null
+++ b/t/assets/secp384r1/cert.pem
@@ -0,0 +1,65 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 3 (0x3)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: CN=picotls test ca
+ Validity
+ Not Before: Mar 22 00:14:34 2021 GMT
+ Not After : Mar 20 00:14:34 2031 GMT
+ Subject: CN=secp384r1.test.example.com
+ Subject Public Key Info:
+ Public Key Algorithm: id-ecPublicKey
+ Public-Key: (384 bit)
+ pub:
+ 04:01:0f:f2:01:e8:b2:24:58:9b:4a:80:21:44:2c:
+ 56:19:86:d8:41:f3:f1:7e:00:b2:01:94:ff:38:c5:
+ d6:29:83:36:3e:6d:dc:38:88:93:5f:c2:11:9f:de:
+ 04:65:bd:41:cf:8a:3c:f6:6f:0b:5b:07:51:6c:f1:
+ 59:20:9b:16:79:35:d2:0d:f6:7c:3f:86:8f:c2:1d:
+ 54:2d:2b:f5:25:4c:89:a8:62:b1:9f:80:1f:f1:c2:
+ dc:9e:4b:a6:b8:c5:5a
+ ASN1 OID: secp384r1
+ NIST CURVE: P-384
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Comment:
+ OpenSSL Generated Certificate
+ X509v3 Subject Key Identifier:
+ C3:D2:A4:8C:90:23:54:D8:9F:ED:59:94:83:09:0D:D5:22:83:A0:F1
+ X509v3 Authority Key Identifier:
+ keyid:BF:79:CA:97:B2:60:78:20:96:AA:46:57:9C:DF:A7:B2:23:F5:25:63
+
+ Signature Algorithm: sha256WithRSAEncryption
+ 37:c8:be:48:a7:68:57:4e:aa:92:b9:19:0d:f8:84:4b:9d:94:
+ 32:26:ba:d4:1d:4e:1f:88:69:a0:68:d7:4f:48:05:c7:80:2a:
+ 04:d9:67:76:4c:c0:49:93:69:1b:20:58:ce:44:8b:a6:54:8a:
+ 54:a1:00:93:52:d1:a3:ad:a0:cf:e6:18:30:64:20:a9:4c:8c:
+ ed:c2:7a:7b:7a:c3:8c:c0:65:4f:16:7a:b1:9b:3e:03:10:6c:
+ 9f:6c:33:fc:2d:d5:a0:75:93:78:c6:db:21:5d:23:20:15:46:
+ 3d:bb:77:16:41:43:71:58:de:d6:0c:be:b5:6f:27:87:c3:91:
+ 99:3c:a7:fe:48:3f:7d:7d:03:ac:b5:8c:ce:f1:70:1e:4f:7c:
+ 42:28:d8:95:98:ed:6b:17:3b:51:ac:ff:ee:cb:79:c1:6c:2e:
+ 39:4c:ab:f5:c9:a2:42:6b:a8:1c:38:17:4d:49:78:ba:10:7f:
+ 25:5d:6c:f4:01:20:2e:17:bf:e3:42:0f:7b:43:01:b7:d4:85:
+ 2d:0e:f2:3b:c8:82:76:43:ca:8b:4b:af:1c:05:18:ef:da:7c:
+ 3c:ad:30:90:fd:4b:f7:00:11:bd:99:7f:9f:6d:67:0e:80:c4:
+ 08:e9:cf:2f:38:e3:d9:ff:ad:7e:99:5a:39:47:7b:c1:4a:b7:
+ af:54:e0:c5
+-----BEGIN CERTIFICATE-----
+MIIChzCCAW+gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9waWNv
+dGxzIHRlc3QgY2EwHhcNMjEwMzIyMDAxNDM0WhcNMzEwMzIwMDAxNDM0WjAlMSMw
+IQYDVQQDDBpzZWNwMzg0cjEudGVzdC5leGFtcGxlLmNvbTB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABAEP8gHosiRYm0qAIUQsVhmG2EHz8X4AsgGU/zjF1imDNj5t3DiI
+k1/CEZ/eBGW9Qc+KPPZvC1sHUWzxWSCbFnk10g32fD+Gj8IdVC0r9SVMiahisZ+A
+H/HC3J5LprjFWqN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNT
+TCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFMPSpIyQI1TYn+1ZlIMJ
+DdUig6DxMB8GA1UdIwQYMBaAFL95ypeyYHgglqpGV5zfp7Ij9SVjMA0GCSqGSIb3
+DQEBCwUAA4IBAQA3yL5Ip2hXTqqSuRkN+IRLnZQyJrrUHU4fiGmgaNdPSAXHgCoE
+2Wd2TMBJk2kbIFjORIumVIpUoQCTUtGjraDP5hgwZCCpTIztwnp7esOMwGVPFnqx
+mz4DEGyfbDP8LdWgdZN4xtshXSMgFUY9u3cWQUNxWN7WDL61byeHw5GZPKf+SD99
+fQOstYzO8XAeT3xCKNiVmO1rFztRrP/uy3nBbC45TKv1yaJCa6gcOBdNSXi6EH8l
+XWz0ASAuF7/jQg97QwG31IUtDvI7yIJ2Q8qLS68cBRjv2nw8rTCQ/Uv3ABG9mX+f
+bWcOgMQI6c8vOOPZ/61+mVo5R3vBSrevVODF
+-----END CERTIFICATE-----
diff --git a/t/assets/secp384r1/key.pem b/t/assets/secp384r1/key.pem
new file mode 100644
index 0000000..849b07d
--- /dev/null
+++ b/t/assets/secp384r1/key.pem
@@ -0,0 +1,9 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIg==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDDKRvwSCQcP5gx5uH0nUkITtNjhXTyWQOBxixOqvBviKE+8ypVluHbg
+Ya/evmF1A52gBwYFK4EEACKhZANiAAQBD/IB6LIkWJtKgCFELFYZhthB8/F+ALIB
+lP84xdYpgzY+bdw4iJNfwhGf3gRlvUHPijz2bwtbB1Fs8VkgmxZ5NdIN9nw/ho/C
+HVQtK/UlTImoYrGfgB/xwtyeS6a4xVo=
+-----END EC PRIVATE KEY-----
diff --git a/t/assets/secp384r1/pub.pem b/t/assets/secp384r1/pub.pem
new file mode 100644
index 0000000..2238c41
--- /dev/null
+++ b/t/assets/secp384r1/pub.pem
@@ -0,0 +1,5 @@
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEAQ/yAeiyJFibSoAhRCxWGYbYQfPxfgCy
+AZT/OMXWKYM2Pm3cOIiTX8IRn94EZb1Bz4o89m8LWwdRbPFZIJsWeTXSDfZ8P4aP
+wh1ULSv1JUyJqGKxn4Af8cLcnkumuMVa
+-----END PUBLIC KEY-----
diff --git a/t/assets/secp521r1/cert.pem b/t/assets/secp521r1/cert.pem
new file mode 100644
index 0000000..f9a963c
--- /dev/null
+++ b/t/assets/secp521r1/cert.pem
@@ -0,0 +1,68 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 4 (0x4)
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: CN=picotls test ca
+ Validity
+ Not Before: Mar 22 00:34:45 2021 GMT
+ Not After : Mar 20 00:34:45 2031 GMT
+ Subject: CN=secp521r1.test.example.com
+ Subject Public Key Info:
+ Public Key Algorithm: id-ecPublicKey
+ Public-Key: (521 bit)
+ pub:
+ 04:00:2c:95:0a:72:ae:8e:93:32:bf:9f:2b:f4:bf:
+ f7:1c:bd:29:33:d3:f1:83:1f:f4:ed:ce:7f:7f:e4:
+ 82:d6:e9:2a:62:8f:25:22:e2:ee:0b:bf:27:07:79:
+ a7:e3:00:01:f0:fb:13:f2:9c:fc:5d:06:68:60:12:
+ 39:e7:69:63:f8:70:62:00:7b:13:92:2f:58:f9:a9:
+ b3:70:3a:39:40:29:73:a2:a3:ba:1a:d5:cd:ec:73:
+ 88:2e:ca:81:80:55:1b:95:ff:9a:bf:a9:35:f4:e5:
+ f5:f3:95:fe:aa:73:bc:3d:bd:4a:c3:0b:e2:11:65:
+ c3:a2:4b:b8:41:32:16:a1:08:e3:e1:51:92
+ ASN1 OID: secp521r1
+ NIST CURVE: P-521
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Comment:
+ OpenSSL Generated Certificate
+ X509v3 Subject Key Identifier:
+ BF:5B:DB:18:6B:81:70:CB:39:CC:47:53:18:75:8B:90:9E:66:5B:08
+ X509v3 Authority Key Identifier:
+ keyid:BF:79:CA:97:B2:60:78:20:96:AA:46:57:9C:DF:A7:B2:23:F5:25:63
+
+ Signature Algorithm: sha256WithRSAEncryption
+ 12:c1:bc:3d:8b:bb:24:bc:e0:01:ab:a1:51:15:0a:9e:aa:8a:
+ 3a:49:5b:0c:d0:ed:29:3c:01:94:18:af:49:8f:50:af:a6:75:
+ 7f:f8:e3:ff:0e:0b:66:ca:95:4c:9e:2e:d7:d1:06:ea:db:42:
+ 32:d7:b6:7e:14:0b:ca:86:25:57:01:76:76:24:bc:a2:a7:6b:
+ e1:9a:3e:00:fc:a9:db:b3:a9:ec:89:a2:dd:e8:30:3d:e5:64:
+ eb:e0:d5:c6:60:c9:4c:a7:3a:61:69:0d:03:11:f9:61:ae:7e:
+ 16:87:7f:af:10:da:08:11:d7:54:a1:5f:97:f1:3a:78:8c:5a:
+ 0c:f8:a2:0c:fa:ae:17:d5:8c:1a:84:d5:77:b7:fd:c1:5f:f9:
+ 56:9d:79:be:ba:5d:a1:17:1a:10:94:e7:09:49:48:e6:08:d7:
+ ee:68:64:19:17:c5:91:b0:b0:e0:0d:42:67:de:9c:3c:5f:34:
+ d7:1d:f5:98:a8:66:29:87:65:fe:b6:15:ab:47:1e:42:10:62:
+ dd:cb:86:0f:68:3e:5d:51:0a:22:c3:07:3d:e5:cb:44:2b:89:
+ 9c:33:dd:8f:db:88:b4:0a:8c:d7:da:a1:19:55:18:87:26:c0:
+ e2:2e:ee:b7:1c:64:31:27:97:8d:09:d7:6d:ab:2f:0b:4c:97:
+ 0f:5a:d3:eb
+-----BEGIN CERTIFICATE-----
+MIICrTCCAZWgAwIBAgIBBDANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9waWNv
+dGxzIHRlc3QgY2EwHhcNMjEwMzIyMDAzNDQ1WhcNMzEwMzIwMDAzNDQ1WjAlMSMw
+IQYDVQQDDBpzZWNwNTIxcjEudGVzdC5leGFtcGxlLmNvbTCBmzAQBgcqhkjOPQIB
+BgUrgQQAIwOBhgAEACyVCnKujpMyv58r9L/3HL0pM9Pxgx/07c5/f+SC1ukqYo8l
+IuLuC78nB3mn4wAB8PsT8pz8XQZoYBI552lj+HBiAHsTki9Y+amzcDo5QClzoqO6
+GtXN7HOILsqBgFUblf+av6k19OX185X+qnO8Pb1KwwviEWXDoku4QTIWoQjj4VGS
+o3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRl
+ZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUv1vbGGuBcMs5zEdTGHWLkJ5mWwgwHwYD
+VR0jBBgwFoAUv3nKl7JgeCCWqkZXnN+nsiP1JWMwDQYJKoZIhvcNAQELBQADggEB
+ABLBvD2LuyS84AGroVEVCp6qijpJWwzQ7Sk8AZQYr0mPUK+mdX/44/8OC2bKlUye
+LtfRBurbQjLXtn4UC8qGJVcBdnYkvKKna+GaPgD8qduzqeyJot3oMD3lZOvg1cZg
+yUynOmFpDQMR+WGufhaHf68Q2ggR11ShX5fxOniMWgz4ogz6rhfVjBqE1Xe3/cFf
++Vadeb66XaEXGhCU5wlJSOYI1+5oZBkXxZGwsOANQmfenDxfNNcd9ZioZimHZf62
+FatHHkIQYt3Lhg9oPl1RCiLDBz3ly0QriZwz3Y/biLQKjNfaoRlVGIcmwOIu7rcc
+ZDEnl40J122rLwtMlw9a0+s=
+-----END CERTIFICATE-----
diff --git a/t/assets/secp521r1/key.pem b/t/assets/secp521r1/key.pem
new file mode 100644
index 0000000..8ec1749
--- /dev/null
+++ b/t/assets/secp521r1/key.pem
@@ -0,0 +1,10 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MIHcAgEBBEIA2fGi1/ysuxTrmnDf6rdqCDzvPomZKLbOCNAckjas5FDIYvpYoYI9
+0gUpNTZWhL/50Wckg1kxmUNR10lRDb4bNKmgBwYFK4EEACOhgYkDgYYABAAslQpy
+ro6TMr+fK/S/9xy9KTPT8YMf9O3Of3/kgtbpKmKPJSLi7gu/Jwd5p+MAAfD7E/Kc
+/F0GaGASOedpY/hwYgB7E5IvWPmps3A6OUApc6KjuhrVzexziC7KgYBVG5X/mr+p
+NfTl9fOV/qpzvD29SsML4hFlw6JLuEEyFqEI4+FRkg==
+-----END EC PRIVATE KEY-----
diff --git a/t/assets/secp521r1/pub.pem b/t/assets/secp521r1/pub.pem
new file mode 100644
index 0000000..656e591
--- /dev/null
+++ b/t/assets/secp521r1/pub.pem
@@ -0,0 +1,6 @@
+-----BEGIN PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQALJUKcq6OkzK/nyv0v/ccvSkz0/GD
+H/Ttzn9/5ILW6SpijyUi4u4LvycHeafjAAHw+xPynPxdBmhgEjnnaWP4cGIAexOS
+L1j5qbNwOjlAKXOio7oa1c3sc4guyoGAVRuV/5q/qTX05fXzlf6qc7w9vUrDC+IR
+ZcOiS7hBMhahCOPhUZI=
+-----END PUBLIC KEY-----
diff --git a/t/e2e.t b/t/e2e.t
index e6a4ff9..d72fc24 100755
--- a/t/e2e.t
+++ b/t/e2e.t
@@ -70,34 +70,23 @@
is $resp, "hello";
};
-subtest "raw-certificates-rsa" => sub {
- my $guard = spawn_server("rsa", qw(-r - -i t/assets/hello.txt));
- my $resp = `$cli -v -r t/assets/server.pub 127.0.0.1 $port 2> /dev/null`;
- is $resp, "hello";
+# This test acts as an end-to-end testing of the certificate verifier of the OpenSSL backend.
+subtest "raw-public-keys" => sub {
+ for my $key_type (qw(rsa secp256r1 secp384r1 secp521r1)) {
+ subtest $key_type => sub {
+ my $guard = spawn_server($key_type, qw(-r - -i t/assets/hello.txt));
+ my $resp = `$cli -v -r t/assets/$key_type/pub.pem 127.0.0.1 $port 2> /dev/null`;
+ is $resp, "hello";
+ };
+ }
};
-
-subtest "raw-certificates-ec" => sub {
- my $guard = spawn_server("ec", qw(-r - -i t/assets/hello.txt));
- my $resp = `$cli -v -r t/assets/ec256-pub.pem 127.0.0.1 $port 2> /dev/null`;
- is $resp, "hello";
-};
-
-
done_testing;
sub spawn_server {
my $key_type = shift;
- my @cmd;
- if ($key_type eq "rsa") {
- my $ext = "crt";
- $ext = "pub" if (grep(/^-r$/, @_));
- @cmd = ($cli, "-k", "t/assets/server.key", "-c", "t/assets/server.$ext", @_, "127.0.0.1", $port);
- } elsif ($key_type eq "ec") {
- @cmd = ($cli, "-k", "t/assets/ec256-key-pair.pem", "-c", "t/assets/ec256-pub.pem", @_, "127.0.0.1", $port);
- } else {
- die "Unexpected key type: $key_type";
- }
+ my $cert_type = grep(/^-r$/, @_) ? "pub" : "cert";
+ my @cmd = ($cli, "-k", "t/assets/$key_type/key.pem", "-c", "t/assets/$key_type/$cert_type.pem", @_, "127.0.0.1", $port);
my $pid = fork;
die "fork failed:$!"
unless defined $pid;
