Test ASN1_TYPE parsing more extensively - #3345
Draft
nebeid wants to merge 1 commit into
Draft
Conversation
Cherry-picked from BoringSSL 074b6dad0ca0fbb2087b7a85e828c666746bf61a. We should be able to parse a variety of valid types, and also reject syntax errors in any types that we recognize. Also double-check that nothing went wrong in the translation from i2d_ASN1_TYPE to X509_ALGOR. Adapted for AWS-LC: - Dropped upstream's claim that X509_ALGOR is "basically the only use of ASN1_TYPE in the library": in AWS-LC, ASN1_TYPE is also consumed by PKCS#7 (d.other content and signed attributes), X509_ATTRIBUTE values (CSR/PKCS#8/PKCS#12 paths), and OCSP, so this test covers more surface here than upstream - Replaced CBB_add_asn1_element (not in AWS-LC) with CBB_add_asn1 + CBB_add_bytes, producing identical DER - Replaced C++17 std::vector CTAD with explicit std::vector<uint8_t> - AWS-LC intentionally accepts BER constructed strings and EOC for OpenSSL/PKCS#7 compatibility (see PRs aws#2306, aws#2310), and does not validate UTF8String contents; moved those inputs from the invalid table to explicit ExpectParse acceptance pins with a comment noting the intent - Unknown universal tags <= V_ASN1_MAX_UNIVERSAL parse as ASN1_STRING with type == tag number (BoringSSL uses V_ASN1_OTHER); adapted the [UNIVERSAL 128] row accordingly Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
🔒 Security Review — View Report Please review before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3345 +/- ##
==========================================
+ Coverage 78.16% 78.19% +0.02%
==========================================
Files 693 693
Lines 123954 123989 +35
Branches 17212 17214 +2
==========================================
+ Hits 96892 96954 +62
+ Misses 26141 26116 -25
+ Partials 921 919 -2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes:
BoringSSL commit 074b6dad0: "Test ASN1_TYPE parsing more extensively"
Test-only. Expands
ASN1Test.ASN1Typeincrypto/asn1/asn1_test.cc:ASN1_TYPE_get/type/ASN1_STRING_typeconsistency, round-tripped throughi2d_ASN1_TYPE, and additionally exercised embedded asX509_ALGORAlgorithmIdentifier parametersV_ASN1_NEG_INTEGER, tag-number overflow)InvalidASN1TypetoEncodeInvalidASN1Typefor clarityIn AWS-LC,
ASN1_TYPEis consumed beyondX509_ALGOR— PKCS#7 (d.other, signed attributes),X509_ATTRIBUTEvalues (CSR/PKCS#8/PKCS#12), and OCSP — so this coverage matters more here than upstream.Adaptations for AWS-LC:
CBB_add_asn1_element(not in AWS-LC) withCBB_add_asn1+CBB_add_bytes(identical DER); replaced C++17std::vectorCTAD with explicitstd::vector<uint8_t>ExpectParsewith a comment noting the intent, so a change in either direction is caughtV_ASN1_MAX_UNIVERSALparse asASN1_STRINGwithtype == tagin AWS-LC (BoringSSL usesV_ASN1_OTHER); the[UNIVERSAL 128]row asserts our representationTesting:
Built with cmake/ninja (clang, Release); full
ASN1Testsuite passes (51 tests).By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.