diff --git a/data_files/Makefile b/data_files/Makefile index 4a1b03f63..5a379a99a 100644 --- a/data_files/Makefile +++ b/data_files/Makefile @@ -2328,6 +2328,22 @@ parse_input/server5.basic-constraints-sequence-overflow.selfsigned.crt: parse_in -inform DER -in $< -outform DER -out $@ all_final += parse_input/server5.basic-constraints-sequence-overflow.selfsigned.crt +# Replace a well-formed basicConstraints extension containing CA:TRUE with +# a malformed extension that is empty with trailing junk. The trailing +# junk is a boolean with the value true, thus it would be interpreted as +# CA:TRUE if it was properly inside the basicConstraints extension. +parse_input/server5.basic-constraints-integer-first.badsign.crt: server5-ca.der + perl -0777 -pe '$$n = s/\x04\x05\x30\x03\x01\x01\xff/\x04\x05\x30\x03\x02\x01\x01/g; die "More substitutions than expected" if $$n > 1; die "Substitution not found" if $$n < 1' <$< >$@.tmp + mv $@.tmp $@ +all_final += parse_input/server5.basic-constraints-integer-first.badsign.crt + +parse_input/server5.basic-constraints-integer-first.selfsigned.crt: parse_input/server5.basic-constraints-integer-first.badsign.crt server5.key + $(OPENSSL) x509 -subj '/CN=Eve/' \ + -key server5.key \ + -days 3653 \ + -inform DER -in $< -outform DER -out $@ +all_final += parse_input/server5.basic-constraints-integer-first.selfsigned.crt + # MD5 test certificate cert_md_test_key = $(cli_crt_key_file_rsa) diff --git a/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt b/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt new file mode 100644 index 000000000..75d734a9a Binary files /dev/null and b/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt differ diff --git a/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt b/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt new file mode 100644 index 000000000..d57fe4a21 Binary files /dev/null and b/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt differ