aboutsummaryrefslogtreecommitdiff
path: root/libjava/java/io/ObjectInput.java
blob: 4b10cf9c3ad5f58ea2428c540c647440fc6ee7c6 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
/* ObjectInput.java -- Read object data from a stream
   Copyright (C) 1998 Free Software Foundation, Inc.

This file is part of GNU Classpath.

GNU Classpath is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2, or (at your option)
any later version.
 
GNU Classpath is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
General Public License for more details.

You should have received a copy of the GNU General Public License
along with GNU Classpath; see the file COPYING.  If not, write to the
Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
02111-1307 USA.

Linking this library statically or dynamically with other modules is
making a combined work based on this library.  Thus, the terms and
conditions of the GNU General Public License cover the whole
combination.

As a special exception, the copyright holders of this library give you
permission to link this library with independent modules to produce an
executable, regardless of the license terms of these independent
modules, and to copy and distribute the resulting executable under
terms of your choice, provided that you also meet, for each linked
independent module, the terms and conditions of the license of that
module.  An independent module is a module which is not derived from
or based on this library.  If you modify this library, you may extend
this exception to your version of the library, but you are not
obligated to do so.  If you do not wish to do so, delete this
exception statement from your version. */


package java.io; 

/**
  * This interface extends the <code>DataInput</code> interface to provide a
  * facility to read objects as well as primitive types from a stream.  It
  * also has methods that allow input to be done in a manner similar to
  * <code>InputStream</code>
  *
  * @version 0.0
  *
  * @author Aaron M. Renn (arenn@urbanophile.com)
  */
public interface ObjectInput extends DataInput
{

/**
  * This method returns the number of bytes that can be read without
  * blocking.
  *
  * @return The number of bytes available before blocking
  *
  * @exception IOException If an error occurs
  */
public abstract int
available() throws IOException;

/*************************************************************************/

/**
  * This method reading a byte of data from a stream.  It returns that byte
  * as an int.  This method blocks if no data is available to be read.
  * 
  * @return The byte of data read
  *
  * @exception IOException If an error occurs
  */
public abstract int
read() throws IOException;

/*************************************************************************/

/**
  * This method reads raw bytes and stores them them a byte array buffer.
  * Note that this method will block if no data is available.  However, 
  * it will not necessarily block until it fills the entire buffer.  That is,
  * a "short count" is possible.
  *
  * @param buf The byte array to receive the data read
  *
  * @return The actual number fo bytes read or -1 if end of stream
  *
  * @exception IOException If an error occurs
  */
public abstract int
read(byte[] buf) throws IOException;

/*************************************************************************/

/**
  * This method reads raw bytes and stores them in a byte array buffer
  * <code>buf</code> starting at position <code>offset</code> into the buffer.  A 
  * maximum of <code>len</code> bytes will be read.  Note that this method
  * blocks if no data is available, but will not necessarily block until
  * it can read <code>len</code> bytes of data.  That is, a "short count" is
  * possible.
  *
  * @param buf The byte array to receive the data read
  * @param offset The offset into @code{buf} to start storing data
  * @param len The maximum number of bytes to read
  *
  * @return The actual number fo bytes read or -1 if end of stream
  *
  * @exception IOException If an error occurs
  */
public abstract int
read(byte[] buf, int offset, int len) throws IOException;

/*************************************************************************/

/**
  * Reads an object instance and returns it.  If the class for the object
  * being read cannot be found, then a ClassNotFoundException will
  * be thrown.
  *
  * @return The object instance that was read
  *
  * @exception ClassNotFoundException If a class for the object cannot be found
  * @exception IOException If an error occurs
  */
public abstract Object
readObject() throws ClassNotFoundException, IOException;

/*************************************************************************/

/**
  * This method causes the specified number of bytes to be read and
  * discarded.  It is possible that fewer than the requested number of bytes
  * will actually be skipped.
  *
  * @param num_bytes The number of bytes to skip
  *
  * @return The actual number of bytes skipped
  *
  * @exception IOException If an error occurs
  */
public abstract long
skip(long num_bytes) throws IOException;

/*************************************************************************/

/**
  * This method closes the input source
  *
  * @exception IOException If an error occurs
  */
public abstract void
close() throws IOException;

} // interface ObjectInput

'n557' href='#n557'>557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640
/*
 * Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.
 * Copyright Nokia 2007-2019
 * Copyright Siemens AG 2015-2019
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include "helpers/cmp_testlib.h"

static const char *ir_protected_f;
static const char *genm_prot_Ed_f;
static const char *ir_unprotected_f;
static const char *ip_PBM_f;

typedef struct test_fixture {
    const char *test_case_name;
    OSSL_CMP_CTX *cmp_ctx;
    /* for protection tests */
    OSSL_CMP_MSG *msg;
    OSSL_CMP_PKISI *si; /* for error and response messages */
    EVP_PKEY *pubkey;
    unsigned char *mem;
    int memlen;
    X509 *cert;
    STACK_OF(X509) *certs;
    STACK_OF(X509) *chain;
    int with_ss;
    int callback_arg;
    int expected;
} CMP_PROTECT_TEST_FIXTURE;

static OSSL_LIB_CTX *libctx = NULL;
static OSSL_PROVIDER *default_null_provider = NULL, *provider = NULL;

static void tear_down(CMP_PROTECT_TEST_FIXTURE *fixture)
{
    if (fixture != NULL) {
        OSSL_CMP_CTX_free(fixture->cmp_ctx);
        OSSL_CMP_MSG_free(fixture->msg);
        OSSL_CMP_PKISI_free(fixture->si);

        OPENSSL_free(fixture->mem);
        sk_X509_free(fixture->certs);
        sk_X509_free(fixture->chain);

        OPENSSL_free(fixture);
    }
}

static CMP_PROTECT_TEST_FIXTURE *set_up(const char *const test_case_name)
{
    CMP_PROTECT_TEST_FIXTURE *fixture;

    if (!TEST_ptr(fixture = OPENSSL_zalloc(sizeof(*fixture))))
        return NULL;
    fixture->test_case_name = test_case_name;
    if (!TEST_ptr(fixture->cmp_ctx = OSSL_CMP_CTX_new(libctx, NULL))) {
        tear_down(fixture);
        return NULL;
    }
    return fixture;
}

static EVP_PKEY *prot_RSA_key = NULL;
#ifndef OPENSSL_NO_ECX
static EVP_PKEY *prot_Ed_key = NULL;
static OSSL_CMP_MSG *genm_protected_Ed;
#endif
static EVP_PKEY *server_key = NULL;
static X509 *server_cert = NULL;
static unsigned char rand_data[OSSL_CMP_TRANSACTIONID_LENGTH];
static OSSL_CMP_MSG *ir_unprotected, *ir_protected;
static X509 *endentity1 = NULL, *endentity2 = NULL,
    *root = NULL, *intermediate = NULL;

static int execute_calc_protection_fails_test(CMP_PROTECT_TEST_FIXTURE *fixture)
{
    ASN1_BIT_STRING *protection =
        ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
    int res = TEST_ptr_null(protection);

    ASN1_BIT_STRING_free(protection);
    return res;
}

static int execute_calc_protection_pbmac_test(CMP_PROTECT_TEST_FIXTURE *fixture)
{
    ASN1_BIT_STRING *protection =
        ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
    int res = TEST_ptr(protection)
            && TEST_true(ASN1_STRING_cmp(protection,
                                         fixture->msg->protection) == 0);

    ASN1_BIT_STRING_free(protection);
    return res;
}

/*
 * This function works similarly to parts of verify_signature in cmp_vfy.c,
 * but without the need for an OSSL_CMP_CTX or an X509 certificate.
 */
static int verify_signature(OSSL_CMP_MSG *msg,
                            ASN1_BIT_STRING *protection,
                            EVP_PKEY *pkey, EVP_MD *digest)
{
    OSSL_CMP_PROTECTEDPART prot_part;

    prot_part.header = OSSL_CMP_MSG_get0_header(msg);
    prot_part.body = msg->body;
    return ASN1_item_verify_ex(ASN1_ITEM_rptr(OSSL_CMP_PROTECTEDPART),
                               msg->header->protectionAlg, protection,
                               &prot_part, NULL, pkey, libctx, NULL) > 0;
}

/* Calls OSSL_CMP_calc_protection and compares and verifies signature */
static int execute_calc_protection_signature_test(CMP_PROTECT_TEST_FIXTURE *
                                                  fixture)
{
    ASN1_BIT_STRING *protection =
        ossl_cmp_calc_protection(fixture->cmp_ctx, fixture->msg);
    int ret = (TEST_ptr(protection)
               && TEST_true(verify_signature(fixture->msg, protection,
                                             fixture->pubkey,
                                             fixture->cmp_ctx->digest)));

    ASN1_BIT_STRING_free(protection);
    return ret;
}

static int test_cmp_calc_protection_no_key_no_secret(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    if (!TEST_ptr(fixture->msg = load_pkimsg(ir_unprotected_f, libctx))
            || !TEST_ptr(fixture->msg->header->protectionAlg =
                         X509_ALGOR_new() /* no specific alg needed here */)) {
        tear_down(fixture);
        fixture = NULL;
    }

    EXECUTE_TEST(execute_calc_protection_fails_test, tear_down);
    return result;
}

static int test_cmp_calc_protection_pkey(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->pubkey = prot_RSA_key;
    if (!TEST_true(OSSL_CMP_CTX_set1_pkey(fixture->cmp_ctx, prot_RSA_key))
        || !TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f, libctx))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_calc_protection_signature_test, tear_down);
    return result;
}

#ifndef OPENSSL_NO_ECX
static int test_cmp_calc_protection_pkey_Ed(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->pubkey = prot_Ed_key;
    if (!TEST_true(OSSL_CMP_CTX_set1_pkey(fixture->cmp_ctx, prot_Ed_key))
        || !TEST_ptr(fixture->msg = load_pkimsg(genm_prot_Ed_f, libctx))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_calc_protection_signature_test, tear_down);
    return result;
}
#endif

static int test_cmp_calc_protection_pbmac(void)
{
    unsigned char sec_insta[] = { 'i', 'n', 's', 't', 'a' };

    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    if (!TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
                                                 sec_insta, sizeof(sec_insta)))
            || !TEST_ptr(fixture->msg = load_pkimsg(ip_PBM_f, libctx))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_calc_protection_pbmac_test, tear_down);
    return result;
}
static int execute_MSG_protect_test(CMP_PROTECT_TEST_FIXTURE *fixture)
{
    return TEST_int_eq(fixture->expected,
                       ossl_cmp_msg_protect(fixture->cmp_ctx, fixture->msg));
}

#define SET_OPT_UNPROTECTED_SEND(ctx, val) \
    OSSL_CMP_CTX_set_option((ctx), OSSL_CMP_OPT_UNPROTECTED_SEND, (val))
static int test_MSG_protect_unprotected_request(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);

    fixture->expected = 1;
    if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
            || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 1))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_MSG_protect_test, tear_down);
    return result;
}

static int test_MSG_protect_with_msg_sig_alg_protection_plus_rsa_key(void)
{
    const int size = sizeof(rand_data) / 2;

    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = 1;

    if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
            || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))
            /*
             * Use half of the 16 bytes of random input
             * for each reference and secret value
             */
            || !TEST_true(OSSL_CMP_CTX_set1_referenceValue(fixture->cmp_ctx,
                                                           rand_data, size))
            || !TEST_true(OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
                                                        rand_data + size,
                                                        size))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_MSG_protect_test, tear_down);
    return result;
}

static int test_MSG_protect_with_certificate_and_key(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = 1;

    if (!TEST_ptr(fixture->msg =
                  OSSL_CMP_MSG_dup(ir_unprotected))
            || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))
            || !TEST_true(OSSL_CMP_CTX_set1_pkey(fixture->cmp_ctx, server_key))
            || !TEST_true(OSSL_CMP_CTX_set1_cert(fixture->cmp_ctx,
                                                 server_cert))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_MSG_protect_test, tear_down);
    return result;
}

static int test_MSG_protect_certificate_based_without_cert(void)
{
    OSSL_CMP_CTX *ctx;

    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    ctx = fixture->cmp_ctx;
    fixture->expected = 0;
    if (!TEST_ptr(fixture->msg =
                  OSSL_CMP_MSG_dup(ir_unprotected))
            || !TEST_true(SET_OPT_UNPROTECTED_SEND(ctx, 0))
            || !TEST_true(EVP_PKEY_up_ref(server_key))
            || !TEST_true(OSSL_CMP_CTX_set0_newPkey(ctx, 1, server_key))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_MSG_protect_test, tear_down);
    return result;
}

static int test_MSG_protect_no_key_no_secret(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = 0;
    if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
            || !TEST_true(SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_MSG_protect_test, tear_down);
    return result;
}

static int test_MSG_protect_pbmac_no_sender(int with_ref)
{
    static unsigned char secret[] = { 47, 11, 8, 15 };
    static unsigned char ref[] = { 0xca, 0xfe, 0xba, 0xbe };

    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = with_ref;
    if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_unprotected))
            || !SET_OPT_UNPROTECTED_SEND(fixture->cmp_ctx, 0)
            || !ossl_cmp_hdr_set1_sender(fixture->msg->header, NULL)
            || !OSSL_CMP_CTX_set1_secretValue(fixture->cmp_ctx,
                                              secret, sizeof(secret))
            || (!OSSL_CMP_CTX_set1_referenceValue(fixture->cmp_ctx,
                                                  with_ref ? ref : NULL,
                                                  sizeof(ref)))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_MSG_protect_test, tear_down);
    return result;
}

static int test_MSG_protect_pbmac_no_sender_with_ref(void)
{
    return test_MSG_protect_pbmac_no_sender(1);
}

static int test_MSG_protect_pbmac_no_sender_no_ref(void)
{
    return test_MSG_protect_pbmac_no_sender(0);
}

static int execute_MSG_add_extraCerts_test(CMP_PROTECT_TEST_FIXTURE *fixture)
{
    return TEST_true(ossl_cmp_msg_add_extraCerts(fixture->cmp_ctx,
                                                 fixture->msg));
}

static int test_MSG_add_extraCerts(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    if (!TEST_ptr(fixture->msg = OSSL_CMP_MSG_dup(ir_protected))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_MSG_add_extraCerts_test, tear_down);
    return result;
}

#ifndef OPENSSL_NO_EC
/* The cert chain tests use EC certs so we skip them in no-ec builds */
static int execute_cmp_build_cert_chain_test(CMP_PROTECT_TEST_FIXTURE *fixture)
{
    int ret = 0;
    OSSL_CMP_CTX *ctx = fixture->cmp_ctx;
    X509_STORE *store;
    STACK_OF(X509) *chain =
        X509_build_chain(fixture->cert, fixture->certs, NULL,
                         fixture->with_ss, ctx->libctx, ctx->propq);

    if (TEST_ptr(chain)) {
        /* Check whether chain built is equal to the expected one */
        ret = TEST_int_eq(0, STACK_OF_X509_cmp(chain, fixture->chain));
        OSSL_STACK_OF_X509_free(chain);
    }
    if (!ret)
        return 0;

    if (TEST_ptr(store = X509_STORE_new())
            && TEST_true(X509_STORE_add_cert(store, root))) {
        X509_VERIFY_PARAM_set_flags(X509_STORE_get0_param(store),
                                    X509_V_FLAG_NO_CHECK_TIME);
        chain = X509_build_chain(fixture->cert, fixture->certs, store,
                                 fixture->with_ss, ctx->libctx, ctx->propq);
        ret = TEST_int_eq(fixture->expected, chain != NULL);
        if (ret && chain != NULL) {
            /* Check whether chain built is equal to the expected one */
            ret = TEST_int_eq(0, STACK_OF_X509_cmp(chain, fixture->chain));
            OSSL_STACK_OF_X509_free(chain);
        }
    }
    X509_STORE_free(store);
    return ret;
}

static int test_cmp_build_cert_chain(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = 1;
    fixture->with_ss = 0;
    fixture->cert = endentity2;
    if (!TEST_ptr(fixture->certs = sk_X509_new_null())
            || !TEST_ptr(fixture->chain = sk_X509_new_null())
            || !TEST_true(sk_X509_push(fixture->certs, endentity1))
            || !TEST_true(sk_X509_push(fixture->certs, root))
            || !TEST_true(sk_X509_push(fixture->certs, intermediate))
            || !TEST_true(sk_X509_push(fixture->chain, endentity2))
            || !TEST_true(sk_X509_push(fixture->chain, intermediate))) {
        tear_down(fixture);
        fixture = NULL;
    }
    if (fixture != NULL) {
        result = execute_cmp_build_cert_chain_test(fixture);
        fixture->with_ss = 1;
        if (result && TEST_true(sk_X509_push(fixture->chain, root)))
            result = execute_cmp_build_cert_chain_test(fixture);
    }
    tear_down(fixture);
    return result;
}

static int test_cmp_build_cert_chain_missing_intermediate(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = 0;
    fixture->with_ss = 0;
    fixture->cert = endentity2;
    if (!TEST_ptr(fixture->certs = sk_X509_new_null())
            || !TEST_ptr(fixture->chain = sk_X509_new_null())
            || !TEST_true(sk_X509_push(fixture->certs, endentity1))
            || !TEST_true(sk_X509_push(fixture->certs, root))
            || !TEST_true(sk_X509_push(fixture->chain, endentity2))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
    return result;
}

static int test_cmp_build_cert_chain_no_root(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = 1;
    fixture->with_ss = 0;
    fixture->cert = endentity2;
    if (!TEST_ptr(fixture->certs = sk_X509_new_null())
            || !TEST_ptr(fixture->chain = sk_X509_new_null())
            || !TEST_true(sk_X509_push(fixture->certs, endentity1))
            || !TEST_true(sk_X509_push(fixture->certs, intermediate))
            || !TEST_true(sk_X509_push(fixture->chain, endentity2))
            || !TEST_true(sk_X509_push(fixture->chain, intermediate))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
    return result;
}

static int test_cmp_build_cert_chain_only_root(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = 1;
    fixture->with_ss = 0; /* still chain must include the only cert (root) */
    fixture->cert = root;
    if (!TEST_ptr(fixture->certs = sk_X509_new_null())
            || !TEST_ptr(fixture->chain = sk_X509_new_null())
            || !TEST_true(sk_X509_push(fixture->certs, root))
            || !TEST_true(sk_X509_push(fixture->chain, root))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
    return result;
}

static int test_cmp_build_cert_chain_no_certs(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->expected = 0;
    fixture->with_ss = 0;
    fixture->cert = endentity2;
    if (!TEST_ptr(fixture->certs = sk_X509_new_null())
            || !TEST_ptr(fixture->chain = sk_X509_new_null())
            || !TEST_true(sk_X509_push(fixture->chain, endentity2))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_cmp_build_cert_chain_test, tear_down);
    return result;
}
#endif /* OPENSSL_NO_EC */

static int execute_X509_STORE_test(CMP_PROTECT_TEST_FIXTURE *fixture)
{
    X509_STORE *store = X509_STORE_new();
    STACK_OF(X509) *sk = NULL;
    int res = 0;

    if (!TEST_true(ossl_cmp_X509_STORE_add1_certs(store,
                                                  fixture->certs,
                                                  fixture->callback_arg)))
        goto err;
    sk = X509_STORE_get1_all_certs(store);
    if (!TEST_int_eq(0, STACK_OF_X509_cmp(sk, fixture->chain)))
        goto err;
    res = 1;
 err:
    X509_STORE_free(store);
    OSSL_STACK_OF_X509_free(sk);
    return res;

}

static int test_X509_STORE(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->callback_arg = 0; /* self-issued allowed */
    if (!TEST_ptr(fixture->certs = sk_X509_new_null())
            || !sk_X509_push(fixture->certs, endentity1)
            || !sk_X509_push(fixture->certs, endentity2)
            || !sk_X509_push(fixture->certs, root)
            || !sk_X509_push(fixture->certs, intermediate)
            || !TEST_ptr(fixture->chain = sk_X509_dup(fixture->certs))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_X509_STORE_test, tear_down);
    return result;
}

static int test_X509_STORE_only_self_issued(void)
{
    SETUP_TEST_FIXTURE(CMP_PROTECT_TEST_FIXTURE, set_up);
    fixture->certs = sk_X509_new_null();
    fixture->chain = sk_X509_new_null();
    fixture->callback_arg = 1; /* only self-issued */
    if (!TEST_true(sk_X509_push(fixture->certs, endentity1))
            || !TEST_true(sk_X509_push(fixture->certs, endentity2))
            || !TEST_true(sk_X509_push(fixture->certs, root))
            || !TEST_true(sk_X509_push(fixture->certs, intermediate))
            || !TEST_true(sk_X509_push(fixture->chain, root))) {
        tear_down(fixture);
        fixture = NULL;
    }
    EXECUTE_TEST(execute_X509_STORE_test, tear_down);
    return result;
}

void cleanup_tests(void)
{
    EVP_PKEY_free(prot_RSA_key);
#ifndef OPENSSL_NO_ECX
    EVP_PKEY_free(prot_Ed_key);
    OSSL_CMP_MSG_free(genm_protected_Ed);
#endif
    EVP_PKEY_free(server_key);
    X509_free(server_cert);
    X509_free(endentity1);
    X509_free(endentity2);
    X509_free(root);
    X509_free(intermediate);
    OSSL_CMP_MSG_free(ir_protected);
    OSSL_CMP_MSG_free(ir_unprotected);
    OSSL_PROVIDER_unload(default_null_provider);
    OSSL_PROVIDER_unload(provider);
    OSSL_LIB_CTX_free(libctx);
}

#define USAGE "prot_RSA.pem IR_protected.der prot_Ed.pem " \
    "GENM_protected_Ed.der IR_unprotected.der IP_PBM.der " \
    "server.crt server.pem EndEntity1.crt EndEntity2.crt Root_CA.crt " \
    "Intermediate_CA.crt module_name [module_conf_file]\n"
OPT_TEST_DECLARE_USAGE(USAGE)

int setup_tests(void)
{
    char *prot_RSA_f;
    char *prot_Ed_f;
    char *server_key_f;
    char *server_cert_f;
    char *endentity1_f;
    char *endentity2_f;
    char *root_f;
    char *intermediate_f;

    if (!test_skip_common_options()) {
        TEST_error("Error parsing test options\n");
        return 0;
    }

    RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH);
    if (!TEST_ptr(prot_RSA_f = test_get_argument(0))
            || !TEST_ptr(ir_protected_f = test_get_argument(1))
            || !TEST_ptr(prot_Ed_f = test_get_argument(2))
            || !TEST_ptr(genm_prot_Ed_f = test_get_argument(3))
            || !TEST_ptr(ir_unprotected_f = test_get_argument(4))
            || !TEST_ptr(ip_PBM_f = test_get_argument(5))
            || !TEST_ptr(server_cert_f = test_get_argument(6))
            || !TEST_ptr(server_key_f = test_get_argument(7))
            || !TEST_ptr(endentity1_f = test_get_argument(8))
            || !TEST_ptr(endentity2_f = test_get_argument(9))
            || !TEST_ptr(root_f = test_get_argument(10))
            || !TEST_ptr(intermediate_f = test_get_argument(11))) {
        TEST_error("usage: cmp_protect_test %s", USAGE);
        return 0;
    }

    if (!test_arg_libctx(&libctx, &default_null_provider, &provider, 12, USAGE))
        return 0;

    if (!TEST_ptr(server_key = load_pkey_pem(server_key_f, libctx))
            || !TEST_ptr(server_cert = load_cert_pem(server_cert_f, libctx)))
        return 0;

    if (!TEST_ptr(prot_RSA_key = load_pkey_pem(prot_RSA_f, libctx)))
        return 0;
#ifndef OPENSSL_NO_ECX
    if (!TEST_ptr(prot_Ed_key = load_pkey_pem(prot_Ed_f, libctx)))
        return 0;
#endif
    if (!TEST_ptr(ir_protected = load_pkimsg(ir_protected_f, libctx))
#ifndef OPENSSL_NO_ECX
        || !TEST_ptr(genm_protected_Ed = load_pkimsg(genm_prot_Ed_f, libctx))
#endif
        || !TEST_ptr(ir_unprotected = load_pkimsg(ir_unprotected_f, libctx)))
        return 0;
    if (!TEST_ptr(endentity1 = load_cert_pem(endentity1_f, libctx))
            || !TEST_ptr(endentity2 = load_cert_pem(endentity2_f, libctx))
            || !TEST_ptr(root = load_cert_pem(root_f, libctx))
            || !TEST_ptr(intermediate = load_cert_pem(intermediate_f, libctx)))
        return 0;
    if (!TEST_int_eq(1, RAND_bytes(rand_data, OSSL_CMP_TRANSACTIONID_LENGTH)))
        return 0;

    /* Message protection tests */
    ADD_TEST(test_cmp_calc_protection_no_key_no_secret);
    ADD_TEST(test_cmp_calc_protection_pkey);
#ifndef OPENSSL_NO_ECX
    ADD_TEST(test_cmp_calc_protection_pkey_Ed);
#endif
    ADD_TEST(test_cmp_calc_protection_pbmac);

    ADD_TEST(test_MSG_protect_with_msg_sig_alg_protection_plus_rsa_key);
    ADD_TEST(test_MSG_protect_with_certificate_and_key);
    ADD_TEST(test_MSG_protect_certificate_based_without_cert);
    ADD_TEST(test_MSG_protect_unprotected_request);
    ADD_TEST(test_MSG_protect_no_key_no_secret);
    ADD_TEST(test_MSG_protect_pbmac_no_sender_with_ref);
    ADD_TEST(test_MSG_protect_pbmac_no_sender_no_ref);
    ADD_TEST(test_MSG_add_extraCerts);

#ifndef OPENSSL_NO_EC
    ADD_TEST(test_cmp_build_cert_chain);
    ADD_TEST(test_cmp_build_cert_chain_only_root);
    ADD_TEST(test_cmp_build_cert_chain_no_root);
    ADD_TEST(test_cmp_build_cert_chain_missing_intermediate);
    ADD_TEST(test_cmp_build_cert_chain_no_certs);
#endif

    ADD_TEST(test_X509_STORE);
    ADD_TEST(test_X509_STORE_only_self_issued);

    return 1;
}