tests/ocsp.c

   1 /*
   2  * Copyright (C) 2011-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Simon Josefsson
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * GnuTLS is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 3 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * GnuTLS is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with GnuTLS; if not, write to the Free Software Foundation,
  20  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 #ifdef HAVE_CONFIG_H
  24 #include <config.h>
  25 #endif
  26
  27 #include <stdlib.h>
  28 #include <stdio.h>
  29 #include <string.h>
  30 #include <gnutls/gnutls.h>
  31 #include <gnutls/ocsp.h>
  32 #include <gnutls/x509.h>
  33
  34 #include "utils.h"
  35
  36 static time_t mytime (time_t * t)
  37 {
  38   time_t then = 1332548220;
  39
  40   if (t)
  41     *t = then;
  42
  43   return then;
  44 }
  45
  46 /* sample request */
  47
  48 static void
  49 tls_log_func (int level, const char *str)
  50 {
  51   fprintf (stderr, "|<%d>| %s", level, str);
  52 }
  53
  54 #define REQ1 "\x30\x67\x30\x65\x30\x3e\x30\x3c\x30\x3a\x30\x09\x06\x05\x2b\x0e\x03\x02\x1a\x05\x00\x04\x14\x13\x9d\xa0\x9e\xf4\x32\xab\x8f\xe2\x89\x56\x67\xfa\xd0\xd4\xe3\x35\x86\x71\xb9\x04\x14\x5d\xa7\xdd\x70\x06\x51\x32\x7e\xe7\xb6\x6d\xb3\xb5\xe5\xe0\x60\xea\x2e\x4d\xef\x02\x01\x1d\xa2\x23\x30\x21\x30\x1f\x06\x09\x2b\x06\x01\x05\x05\x07\x30\x01\x02\x04\x12\x04\x10\x35\xc5\xe3\x50\xc3\xcf\x04\x33\xcc\x9e\x06\x3a\x9a\x18\x80\xcc"
  55
  56 static const gnutls_datum_t req1 =
  57   { (unsigned char *) REQ1, sizeof (REQ1) - 1 };
  58
  59 #define REQ1INFO                                                        \
  60   "OCSP Request Information:\n"                                         \
  61   "     Version: 1\n"                                                   \
  62   "     Request List:\n"                                                \
  63   "             Certificate ID:\n"                                      \
  64   "                     Hash Algorithm: SHA1\n"                         \
  65   "                     Issuer Name Hash: 139da09ef432ab8fe2895667fad0d4e3358671b9\n" \
  66   "                     Issuer Key Hash: 5da7dd700651327ee7b66db3b5e5e060ea2e4def\n" \
  67   "                     Serial Number: 1d\n"                            \
  68   "     Extensions:\n"                                                  \
  69   "             Nonce: 35c5e350c3cf0433cc9e063a9a1880cc\n"
  70
  71 #define REQ1NONCE "\x04\x10\x35\xc5\xe3\x50\xc3\xcf\x04\x33\xcc\x9e\x06\x3a\x9a\x18\x80\xcc"
  72
  73 #define REQ1INH "\x13\x9d\xa0\x9e\xf4\x32\xab\x8f\xe2\x89\x56\x67\xfa\xd0\xd4\xe3\x35\x86\x71\xb9"
  74 #define REQ1IKH "\x5d\xa7\xdd\x70\x06\x51\x32\x7e\xe7\xb6\x6d\xb3\xb5\xe5\xe0\x60\xea\x2e\x4d\xef"
  75 #define REQ1SN "\x1d"
  76
  77 /* sample response */
  78
  79 #define RESP1 "\x30\x03\x0a\x01\x01"
  80
  81 static const gnutls_datum_t resp1 =
  82   { (unsigned char*) RESP1, sizeof (RESP1) - 1 };
  83
  84 #define RESP1INFO                                                       \
  85   "OCSP Response Information:\n"                                        \
  86   "     Response Status: malformedRequest\n"
  87
  88 #define RESP2 "\x30\x82\x06\x8C\x0A\x01\x00\xA0\x82\x06\x85\x30\x82\x06\x81\x06\x09\x2B\x06\x01\x05\x05\x07\x30\x01\x01\x04\x82\x06\x72\x30\x82\x06\x6E\x30\x82\x01\x07\xA1\x69\x30\x67\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x43\x48\x31\x19\x30\x17\x06\x03\x55\x04\x0A\x13\x10\x4C\x69\x6E\x75\x78\x20\x73\x74\x72\x6F\x6E\x67\x53\x77\x61\x6E\x31\x1F\x30\x1D\x06\x03\x55\x04\x0B\x13\x16\x4F\x43\x53\x50\x20\x53\x69\x67\x6E\x69\x6E\x67\x20\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x31\x1C\x30\x1A\x06\x03\x55\x04\x03\x13\x13\x6F\x63\x73\x70\x2E\x73\x74\x72\x6F\x6E\x67\x73\x77\x61\x6E\x2E\x6F\x72\x67\x18\x0F\x32\x30\x31\x31\x30\x39\x32\x37\x30\x39\x35\x34\x32\x38\x5A\x30\x64\x30\x62\x30\x3A\x30\x09\x06\x05\x2B\x0E\x03\x02\x1A\x05\x00\x04\x14\x13\x9D\xA0\x9E\xF4\x32\xAB\x8F\xE2\x89\x56\x67\xFA\xD0\xD4\xE3\x35\x86\x71\xB9\x04\x14\x5D\xA7\xDD\x70\x06\x51\x32\x7E\xE7\xB6\x6D\xB3\xB5\xE5\xE0\x60\xEA\x2E\x4D\xEF\x02\x01\x1D\x80\x00\x18\x0F\x32\x30\x31\x31\x30\x39\x32\x37\x30\x39\x35\x34\x32\x38\x5A\xA0\x11\x18\x0F\x32\x30\x31\x31\x30\x39\x32\x37\x30\x39\x35\x39\x32\x38\x5A\xA1\x23\x30\x21\x30\x1F\x06\x09\x2B\x06\x01\x05\x05\x07\x30\x01\x02\x04\x12\x04\x10\x16\x89\x7D\x91\x3A\xB5\x25\xA4\x45\xFE\xC9\xFD\xC2\xE5\x08\xA4\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x05\x05\x00\x03\x82\x01\x01\x00\x4E\xAD\x6B\x2B\xF7\xF2\xBF\xA9\x23\x1E\x3A\x0B\x06\xDB\x55\x53\x2B\x64\x54\x11\x32\xBF\x60\xF7\x4F\xE0\x8E\x9B\xA0\xA2\x4C\x79\xC3\x2A\xE0\x43\xF7\x40\x1A\xDC\xB9\xB4\x25\xEF\x48\x01\x97\x8C\xF5\x1E\xDB\xD1\x30\x37\x73\x69\xD6\xA7\x7A\x2D\x8E\xDE\x5C\xAA\xEA\x39\xB9\x52\xAA\x25\x1E\x74\x7D\xF9\x78\x95\x8A\x92\x1F\x98\x21\xF4\x60\x7F\xD3\x28\xEE\x47\x9C\xBF\xE2\x5D\xF6\x3F\x68\x0A\xD6\xFF\x08\xC1\xDC\x95\x1E\x29\xD7\x3E\x85\xD5\x65\xA4\x4B\xC0\xAF\xC3\x78\xAB\x06\x98\x88\x19\x8A\x64\xA6\x83\x91\x87\x13\xDB\x17\xCC\x46\xBD\xAB\x4E\xC7\x16\xD1\xF8\x35\xFD\x27\xC8\xF6\x6B\xEB\x37\xB8\x08\x6F\xE2\x6F\xB4\x7E\xD5\x68\xDB\x7F\x5D\x5E\x36\x38\xF2\x77\x59\x13\xE7\x3E\x4D\x67\x5F\xDB\xA2\xF5\x5D\x7C\xBF\xBD\xB5\x37\x33\x51\x36\x63\xF8\x21\x1E\xFC\x73\x8F\x32\x69\xBB\x97\xA7\xBD\xF1\xB6\xE0\x40\x09\x68\xEA\xD5\x93\xB8\xBB\x39\x8D\xA8\x16\x1B\xBF\x04\x7A\xBC\x18\x43\x01\xE9\x3C\x19\x5C\x4D\x4B\x98\xD8\x23\x37\x39\xA4\xC4\xDD\xED\x9C\xEC\x37\xAB\x66\x44\x9B\xE7\x5B\x5D\x32\xA2\xDB\xA6\x0B\x3B\x8C\xE1\xF5\xDB\xCB\x7D\x58\xA0\x82\x04\x4B\x30\x82\x04\x47\x30\x82\x04\x43\x30\x82\x03\x2B\xA0\x03\x02\x01\x02\x02\x01\x1E\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x0B\x05\x00\x30\x45\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x43\x48\x31\x19\x30\x17\x06\x03\x55\x04\x0A\x13\x10\x4C\x69\x6E\x75\x78\x20\x73\x74\x72\x6F\x6E\x67\x53\x77\x61\x6E\x31\x1B\x30\x19\x06\x03\x55\x04\x03\x13\x12\x73\x74\x72\x6F\x6E\x67\x53\x77\x61\x6E\x20\x52\x6F\x6F\x74\x20\x43\x41\x30\x1E\x17\x0D\x30\x39\x31\x31\x32\x34\x31\x32\x35\x31\x35\x33\x5A\x17\x0D\x31\x34\x31\x31\x32\x33\x31\x32\x35\x31\x35\x33\x5A\x30\x67\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x43\x48\x31\x19\x30\x17\x06\x03\x55\x04\x0A\x13\x10\x4C\x69\x6E\x75\x78\x20\x73\x74\x72\x6F\x6E\x67\x53\x77\x61\x6E\x31\x1F\x30\x1D\x06\x03\x55\x04\x0B\x13\x16\x4F\x43\x53\x50\x20\x53\x69\x67\x6E\x69\x6E\x67\x20\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x31\x1C\x30\x1A\x06\x03\x55\x04\x03\x13\x13\x6F\x63\x73\x70\x2E\x73\x74\x72\x6F\x6E\x67\x73\x77\x61\x6E\x2E\x6F\x72\x67\x30\x82\x01\x22\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01\x05\x00\x03\x82\x01\x0F\x00\x30\x82\x01\x0A\x02\x82\x01\x01\x00\xBC\x05\x3E\x4B\xBE\xC6\xB1\x33\x48\x0E\xC3\xD4\x0C\xEF\x83\x0B\xBD\xBC\x57\x5F\x14\xEF\xF5\x6D\x0B\xFF\xFA\x01\x9C\xFA\x21\x6D\x5C\xAE\x79\x29\x74\xFE\xBD\xAB\x70\x87\x98\x6B\x48\x35\x79\xE3\xE0\xC1\x14\x41\x1F\x0A\xF7\xE7\xA3\xA6\xDA\x6B\xFF\xCD\x74\xE9\x95\x00\x38\xAA\xD6\x3A\x60\xC6\x64\xA1\xE6\x02\x39\x58\x4E\xFD\xF2\x78\x08\x63\xB6\xD7\x7A\x96\x79\x62\x18\x39\xEE\x27\x8D\x3B\xA2\x3D\x48\x88\xDB\x43\xD6\x6A\x77\x20\x6A\x27\x39\x50\xE0\x02\x50\x19\xF2\x7A\xCF\x78\x23\x99\x01\xD4\xE5\xB1\xD1\x31\xE6\x6B\x84\xAF\xD0\x77\x41\x46\x85\xB0\x3B\xE6\x6A\x00\x0F\x3B\x7E\x95\x7F\x59\xA8\x22\xE8\x49\x49\x05\xC8\xCB\x6C\xEE\x47\xA7\x2D\xC9\x74\x5B\xEB\x8C\xD5\x99\xC2\xE2\x70\xDB\xEA\x87\x43\x84\x0E\x4F\x83\x1C\xA6\xEB\x1F\x22\x38\x17\x69\x9B\x72\x12\x95\x48\x71\xB2\x7B\x92\x73\x52\xAB\xE3\x1A\xA5\xD3\xF4\x44\x14\xBA\xC3\x35\xDA\x91\x6C\x7D\xB4\xC2\x00\x07\xD8\x0A\x51\xF1\x0D\x4C\xD9\x7A\xD1\x99\xE6\xA8\x8D\x0A\x80\xA8\x91\xDD\x8A\xA2\x6B\xF6\xDB\xB0\x3E\xC9\x71\xA9\xE0\x39\xC3\xA3\x58\x0D\x87\xD0\xB2\xA7\x9C\xB7\x69\x02\x03\x01\x00\x01\xA3\x82\x01\x1A\x30\x82\x01\x16\x30\x09\x06\x03\x55\x1D\x13\x04\x02\x30\x00\x30\x0B\x06\x03\x55\x1D\x0F\x04\x04\x03\x02\x03\xA8\x30\x1D\x06\x03\x55\x1D\x0E\x04\x16\x04\x14\x34\x91\x6E\x91\x32\xBF\x35\x25\x43\xCC\x28\x74\xEF\x82\xC2\x57\x92\x79\x13\x73\x30\x6D\x06\x03\x55\x1D\x23\x04\x66\x30\x64\x80\x14\x5D\xA7\xDD\x70\x06\x51\x32\x7E\xE7\xB6\x6D\xB3\xB5\xE5\xE0\x60\xEA\x2E\x4D\xEF\xA1\x49\xA4\x47\x30\x45\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x43\x48\x31\x19\x30\x17\x06\x03\x55\x04\x0A\x13\x10\x4C\x69\x6E\x75\x78\x20\x73\x74\x72\x6F\x6E\x67\x53\x77\x61\x6E\x31\x1B\x30\x19\x06\x03\x55\x04\x03\x13\x12\x73\x74\x72\x6F\x6E\x67\x53\x77\x61\x6E\x20\x52\x6F\x6F\x74\x20\x43\x41\x82\x01\x00\x30\x1E\x06\x03\x55\x1D\x11\x04\x17\x30\x15\x82\x13\x6F\x63\x73\x70\x2E\x73\x74\x72\x6F\x6E\x67\x73\x77\x61\x6E\x2E\x6F\x72\x67\x30\x13\x06\x03\x55\x1D\x25\x04\x0C\x30\x0A\x06\x08\x2B\x06\x01\x05\x05\x07\x03\x09\x30\x39\x06\x03\x55\x1D\x1F\x04\x32\x30\x30\x30\x2E\xA0\x2C\xA0\x2A\x86\x28\x68\x74\x74\x70\x3A\x2F\x2F\x63\x72\x6C\x2E\x73\x74\x72\x6F\x6E\x67\x73\x77\x61\x6E\x2E\x6F\x72\x67\x2F\x73\x74\x72\x6F\x6E\x67\x73\x77\x61\x6E\x2E\x63\x72\x6C\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x0B\x05\x00\x03\x82\x01\x01\x00\x6D\x78\xD7\x66\x90\xA6\xEB\xDD\xB5\x09\x48\xA4\xDA\x27\xFA\xAC\xB1\xBC\x8F\x8C\xBE\xCC\x8C\x09\xA2\x40\x0D\x6C\x4A\xAE\x72\x22\x1E\xC8\xAF\x6D\xF1\x12\xAF\xD7\x40\x51\x79\xD4\xDD\xB2\x0C\xDB\x97\x84\xB6\x24\xD5\xF5\xA8\xBB\xC0\x4B\xF9\x7F\x71\xF7\xB0\x65\x42\x4A\x7D\xFE\x76\x7E\x05\xD2\x46\xB8\x7D\xB3\x39\x4C\x5C\xB1\xFA\xB9\xEE\x3B\x70\x33\x39\x57\x1A\xB9\x95\x51\x33\x00\x25\x1B\x4C\xAA\xB4\xA7\x55\xAF\x63\x6D\x6F\x88\x17\x6A\x7F\xB0\x97\xDE\x49\x14\x6A\x27\x6A\xB0\x42\x80\xD6\xA6\x9B\xEF\x04\x5E\x11\x7D\xD5\x8E\x54\x20\xA2\x76\xD4\x66\x58\xAC\x9C\x12\xD3\xF5\xCA\x54\x98\xCA\x21\xEC\xC1\x55\xA1\x2F\x68\x0B\x5D\x04\x50\xD2\x5E\x70\x25\xD8\x13\xD9\x44\x51\x0E\x8A\x42\x08\x18\x84\xE6\x61\xCE\x5A\x7D\x7B\x81\x35\x90\xC3\xD4\x9D\x19\xB6\x37\xEE\x8F\x63\x5C\xDA\xD8\xF0\x64\x60\x39\xEB\x9B\x1C\x54\x66\x75\x76\xB5\x0A\x58\xB9\x3F\x91\xE1\x21\x9C\xA0\x50\x15\x97\xB6\x7E\x41\xBC\xD0\xC4\x21\x4C\xF5\xD7\xF0\x13\xF8\x77\xE9\x74\xC4\x8A\x0E\x20\x17\x32\xAE\x38\xC2\xA5\xA8\x62\x85\x17\xB1\xA2\xD3\x22\x9F\x95\xB7\xA3\x4C"
  89
  90 #define RESP2INFO                               \
  91   "OCSP Response Information:\n"                \
  92   "     Response Status: Successful\n"          \
  93   "     Response Type: Basic OCSP Response\n"   \
  94   "     Version: 1\n" \
  95   "     Responder ID: C=CH,O=Linux strongSwan,OU=OCSP Signing Authority,CN=ocsp.strongswan.org\n" \
  96   "     Produced At: Tue Sep 27 09:54:28 UTC 2011\n" \
  97   "     Responses:\n" \
  98   "             Certificate ID:\n" \
  99   "                     Hash Algorithm: SHA1\n" \
 100   "                     Issuer Name Hash: 139da09ef432ab8fe2895667fad0d4e3358671b9\n" \
 101   "                     Issuer Key Hash: 5da7dd700651327ee7b66db3b5e5e060ea2e4def\n" \
 102   "                     Serial Number: 1d\n" \
 103   "             Certificate Status: good\n" \
 104   "             This Update: Tue Sep 27 09:54:28 UTC 2011\n" \
 105   "             Next Update: Tue Sep 27 09:59:28 UTC 2011\n" \
 106   "     Extensions:\n" \
 107   "             Nonce: 16897d913ab525a445fec9fdc2e508a4\n" \
 108   "     Signature Algorithm: RSA-SHA1\n" \
 109   "     Signature:\n" \
 110   "             4e:ad:6b:2b:f7:f2:bf:a9:23:1e:3a:0b:06:db:55:53\n" \
 111   "             2b:64:54:11:32:bf:60:f7:4f:e0:8e:9b:a0:a2:4c:79\n" \
 112   "             c3:2a:e0:43:f7:40:1a:dc:b9:b4:25:ef:48:01:97:8c\n" \
 113   "             f5:1e:db:d1:30:37:73:69:d6:a7:7a:2d:8e:de:5c:aa\n" \
 114   "             ea:39:b9:52:aa:25:1e:74:7d:f9:78:95:8a:92:1f:98\n" \
 115   "             21:f4:60:7f:d3:28:ee:47:9c:bf:e2:5d:f6:3f:68:0a\n" \
 116   "             d6:ff:08:c1:dc:95:1e:29:d7:3e:85:d5:65:a4:4b:c0\n" \
 117   "             af:c3:78:ab:06:98:88:19:8a:64:a6:83:91:87:13:db\n" \
 118   "             17:cc:46:bd:ab:4e:c7:16:d1:f8:35:fd:27:c8:f6:6b\n" \
 119   "             eb:37:b8:08:6f:e2:6f:b4:7e:d5:68:db:7f:5d:5e:36\n" \
 120   "             38:f2:77:59:13:e7:3e:4d:67:5f:db:a2:f5:5d:7c:bf\n" \
 121   "             bd:b5:37:33:51:36:63:f8:21:1e:fc:73:8f:32:69:bb\n" \
 122   "             97:a7:bd:f1:b6:e0:40:09:68:ea:d5:93:b8:bb:39:8d\n" \
 123   "             a8:16:1b:bf:04:7a:bc:18:43:01:e9:3c:19:5c:4d:4b\n" \
 124   "             98:d8:23:37:39:a4:c4:dd:ed:9c:ec:37:ab:66:44:9b\n" \
 125   "             e7:5b:5d:32:a2:db:a6:0b:3b:8c:e1:f5:db:cb:7d:58\n"
 126   /* cut */
 127
 128 static const gnutls_datum_t resp2 =
 129   { (unsigned char*) RESP2, sizeof (RESP2) - 1 };
 130
 131 static unsigned char issuer_pem[] =
 132   "-----BEGIN CERTIFICATE-----\n"
 133   "MIIDuDCCAqCgAwIBAgIBADANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJDSDEZ\n"
 134   "MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS\n"
 135   "b290IENBMB4XDTA0MDkxMDEwMDExOFoXDTE5MDkwNzEwMDExOFowRTELMAkGA1UE\n"
 136   "BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9u\n"
 137   "Z1N3YW4gUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL/y\n"
 138   "X2LqPVZuWLPIeknK86xhz6ljd3NNhC2z+P1uoCP3sBMuZiZQEjFzhnKcbXxCeo2f\n"
 139   "FnvhOOjrrisSuVkzuu82oxXD3fIkzuS7m9V4E10EZzgmKWIf+WuNRfbgAuUINmLc\n"
 140   "4YGAXBQLPyzpP4Ou48hhz/YQo58Bics6PHy5v34qCVROIXDvqhj91P8g+pS+F21/\n"
 141   "7P+CH2jRcVIEHZtG8M/PweTPQ95dPzpYd2Ov6SZ/U7EWmbMmT8VcUYn1aChxFmy5\n"
 142   "gweVBWlkH6MP+1DeE0/tL5c87xo5KCeGK8Tdqpe7sBRC4pPEEHDQciTUvkeuJ1Pr\n"
 143   "K+1LwdqRxo7HgMRiDw8CAwEAAaOBsjCBrzASBgNVHRMBAf8ECDAGAQH/AgEBMAsG\n"
 144   "A1UdDwQEAwIBBjAdBgNVHQ4EFgQUXafdcAZRMn7ntm2zteXgYOouTe8wbQYDVR0j\n"
 145   "BGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNIMRkw\n"
 146   "FwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJv\n"
 147   "b3QgQ0GCAQAwDQYJKoZIhvcNAQELBQADggEBACOSmqEBtBLR9aV3UyCI8gmzR5in\n"
 148   "Lte9aUXXS+qis6F2h2Stf4sN+Nl6Gj7REC6SpfEH4wWdwiUL5J0CJhyoOjQuDl3n\n"
 149   "1Dw3dE4/zqMZdyDKEYTU75TmvusNJBdGsLkrf7EATAjoi/nrTOYPPhSUZvPp/D+Y\n"
 150   "vORJ9Ej51GXlK1nwEB5iA8+tDYniNQn6BD1MEgIejzK+fbiy7braZB1kqhoEr2Si\n"
 151   "7luBSnU912sw494E88a2EWbmMvg2TVHPNzCpVkpNk7kifCiwmw9VldkqYy9y/lCa\n"
 152   "Epyp7lTfKw7cbD04Vk8QJW782L6Csuxkl346b17wmOqn8AZips3tFsuAY3w=\n"
 153   "-----END CERTIFICATE-----\n";
 154 const gnutls_datum_t issuer_data = { issuer_pem, sizeof (issuer_pem) };
 155
 156 static unsigned char subject_pem[] =
 157   "-----BEGIN CERTIFICATE-----\n"
 158   "MIIEIjCCAwqgAwIBAgIBHTANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJDSDEZ\n"
 159   "MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS\n"
 160   "b290IENBMB4XDTA5MDgyNzEwNDQ1MVoXDTE0MDgyNjEwNDQ1MVowWjELMAkGA1UE\n"
 161   "BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh\n"
 162   "cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN\n"
 163   "AQEBBQADggEPADCCAQoCggEBANBdWU+BF7x4lyo+xHnr4UAOU89yQQuT5vdPoXzx\n"
 164   "6kRPsjYAuuktgXR+SaLkQHw/YRgDPSKj5nzmmlOQf/rWRr+8O2q+C92aUICmkNvZ\n"
 165   "Gamo5w2WlOMZ6T5dk2Hv+QM6xT/GzWyVr1dMYu/7tywD1Bw7aW/HqkRESDu6q95V\n"
 166   "Wu+Lzg6XlxCNEez0YsZrN/fC6BL2qzKAqMBbIHFW8OOnh+nEY4IF5AzkZnFrw12G\n"
 167   "I72Z882pw97lyKwZhSz/GMQFBJx+rnNdw5P1IJwTlG5PUdoDCte/Mcr1iiA+zOov\n"
 168   "x55x1GoGxduoXWU5egrf1MtalRf9Pc8Xr4q3WEKTAmsZrVECAwEAAaOCAQYwggEC\n"
 169   "MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBQfoamI2WSMtaCiVGQ5\n"
 170   "tPI9dF1ufDBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL\n"
 171   "MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT\n"
 172   "EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz\n"
 173   "d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u\n"
 174   "b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQC8pqX3KrSzKeul\n"
 175   "GdzydAV4hGwYB3WiB02oJ2nh5MJBu7J0Kn4IVkvLUHSSZhSRxx55tQZfdYqtXVS7\n"
 176   "ZuyG+6rV7sb595SIRwfkLAdjbvv0yZIl4xx8j50K3yMR+9aXW1NSGPEkb8BjBUMr\n"
 177   "F2kjGTOqomo8OIzyI369z9kJrtEhnS37nHcdpewZC1wHcWfJ6wd9wxmz2dVXmgVQ\n"
 178   "L2BjXd/BcpLFaIC4h7jMXQ5FURjnU7K9xSa4T8PpR6FrQhOcIYBXAp94GiM8JqmK\n"
 179   "ZBGUpeP+3cy4i3DV18Kyr64Q4XZlzhZClNE43sgMqiX88dc3znpDzT7T51j+d+9k\n"
 180   "Rf5Z0GOR\n"
 181   "-----END CERTIFICATE-----\n";
 182 const gnutls_datum_t subject_data = { subject_pem, sizeof (subject_pem) };
 183
 184 /* For testing verify functions. */
 185
 186 #define BLOG_RESP "\x30\x82\x06\xF8\x0A\x01\x00\xA0\x82\x06\xF1\x30\x82\x06\xED\x06\x09\x2B\x06\x01\x05\x05\x07\x30\x01\x01\x04\x82\x06\xDE\x30\x82\x06\xDA\x30\x82\x01\x25\xA1\x7E\x30\x7C\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x41\x55\x31\x0C\x30\x0A\x06\x03\x55\x04\x08\x13\x03\x4E\x53\x57\x31\x0F\x30\x0D\x06\x03\x55\x04\x07\x13\x06\x53\x79\x64\x6E\x65\x79\x31\x14\x30\x12\x06\x03\x55\x04\x0A\x13\x0B\x43\x41\x63\x65\x72\x74\x20\x49\x6E\x63\x2E\x31\x1E\x30\x1C\x06\x03\x55\x04\x0B\x13\x15\x53\x65\x72\x76\x65\x72\x20\x41\x64\x6D\x69\x6E\x69\x73\x74\x72\x61\x74\x69\x6F\x6E\x31\x18\x30\x16\x06\x03\x55\x04\x03\x13\x0F\x6F\x63\x73\x70\x2E\x63\x61\x63\x65\x72\x74\x2E\x6F\x72\x67\x18\x0F\x32\x30\x31\x32\x30\x31\x31\x33\x30\x38\x35\x30\x34\x32\x5A\x30\x66\x30\x64\x30\x3C\x30\x09\x06\x05\x2B\x0E\x03\x02\x1A\x05\x00\x04\x14\xF2\x2A\x62\x16\x93\xA6\xDA\x5A\xD0\xB9\x8D\x3A\x13\x5E\x35\xD1\xEB\x18\x36\x61\x04\x14\x75\xA8\x71\x60\x4C\x88\x13\xF0\x78\xD9\x89\x77\xB5\x6D\xC5\x89\xDF\xBC\xB1\x7A\x02\x03\x00\xBC\xE0\x80\x00\x18\x0F\x32\x30\x31\x32\x30\x31\x31\x33\x30\x37\x32\x30\x34\x39\x5A\xA0\x11\x18\x0F\x32\x30\x31\x32\x30\x31\x31\x35\x30\x38\x35\x30\x34\x32\x5A\xA1\x2A\x30\x28\x30\x26\x06\x09\x2B\x06\x01\x05\x05\x07\x30\x01\x02\x04\x19\x04\x17\x73\x69\xD2\xC5\x6F\xC7\x7E\x2E\xB0\x2F\xCC\xC3\xE2\x80\xD6\x2A\xCE\xD3\xDE\x8F\x27\x1B\xB2\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x05\x05\x00\x03\x82\x01\x01\x00\x3E\x50\x9D\xE9\xA2\xE0\xCA\x33\x88\x9B\x28\x7E\xE7\xA4\xAF\xDA\xBB\x75\x2D\xD9\x66\xA6\xD5\xFA\x17\x56\xC0\x3B\xDD\x74\xB6\x7E\x42\x2C\x28\xD0\x73\x91\x54\x69\xFA\xCF\xD8\xC7\x74\x1C\x5D\xBC\x8E\xCD\xE3\x0E\xD5\x3F\x80\x71\x9C\x95\x53\xC4\xD1\x95\x63\x5D\x72\xCE\xCC\x77\x9D\x7C\xAD\x47\x3F\x34\xDA\x90\x80\xC5\x15\xE1\x2B\xEE\x98\x57\xA3\xA7\x9F\xA2\xC3\xF5\x5E\xF7\x13\x26\x52\xDA\x09\x38\x5B\x18\x91\x07\x38\xCF\x09\xDA\x08\xED\x80\x4F\x26\x3A\xB9\xBE\xF6\xED\x65\x3F\xB1\x3A\x6D\xA3\x87\x22\xA3\x2A\xA5\x99\xCC\x06\xF3\x5A\xD5\x34\xFB\x9E\x32\x28\xC3\x3E\xF4\xAF\x33\x02\xCF\x6A\x74\x73\x17\x24\x17\x41\x0D\x7E\x86\x79\x83\x34\xE8\x82\x0A\x0D\x21\xED\xCB\x3B\xB7\x31\x64\xC9\xB6\x1E\xC7\x0C\x75\xCE\xBA\xB7\xDC\xB2\x67\x96\x2B\xAD\xBF\x86\x22\x81\x54\x66\xBA\x68\x89\xD7\x7E\x35\x60\x93\xEC\x6B\xD8\x59\x23\xA0\xD0\x95\x55\x8F\x93\x52\x48\x4E\x48\xCB\x92\xE9\x67\x71\x60\x07\xC9\xA3\x3B\xAC\xD1\xEA\x5B\x71\xDB\xC1\x94\x79\x85\x55\x8C\x03\x61\x9E\xC7\xD6\x32\x40\xFA\xDD\xF6\xC9\xF8\xE0\xFF\x4D\xAC\x54\xED\x61\xFE\xB2\xA0\x82\x04\x99\x30\x82\x04\x95\x30\x82\x04\x91\x30\x82\x02\x79\xA0\x03\x02\x01\x02\x02\x03\x00\xDC\xA6\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x05\x05\x00\x30\x54\x31\x14\x30\x12\x06\x03\x55\x04\x0A\x13\x0B\x43\x41\x63\x65\x72\x74\x20\x49\x6E\x63\x2E\x31\x1E\x30\x1C\x06\x03\x55\x04\x0B\x13\x15\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x43\x41\x63\x65\x72\x74\x2E\x6F\x72\x67\x31\x1C\x30\x1A\x06\x03\x55\x04\x03\x13\x13\x43\x41\x63\x65\x72\x74\x20\x43\x6C\x61\x73\x73\x20\x33\x20\x52\x6F\x6F\x74\x30\x1E\x17\x0D\x31\x31\x30\x38\x32\x33\x30\x30\x30\x38\x33\x37\x5A\x17\x0D\x31\x33\x30\x38\x32\x32\x30\x30\x30\x38\x33\x37\x5A\x30\x7C\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x41\x55\x31\x0C\x30\x0A\x06\x03\x55\x04\x08\x13\x03\x4E\x53\x57\x31\x0F\x30\x0D\x06\x03\x55\x04\x07\x13\x06\x53\x79\x64\x6E\x65\x79\x31\x14\x30\x12\x06\x03\x55\x04\x0A\x13\x0B\x43\x41\x63\x65\x72\x74\x20\x49\x6E\x63\x2E\x31\x1E\x30\x1C\x06\x03\x55\x04\x0B\x13\x15\x53\x65\x72\x76\x65\x72\x20\x41\x64\x6D\x69\x6E\x69\x73\x74\x72\x61\x74\x69\x6F\x6E\x31\x18\x30\x16\x06\x03\x55\x04\x03\x13\x0F\x6F\x63\x73\x70\x2E\x63\x61\x63\x65\x72\x74\x2E\x6F\x72\x67\x30\x82\x01\x22\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01\x05\x00\x03\x82\x01\x0F\x00\x30\x82\x01\x0A\x02\x82\x01\x01\x00\x9C\xC6\xD4\x6F\xE4\x23\xC7\xC3\x70\x4B\x75\x1F\xE4\xFC\xAE\xF6\x62\xC4\x60\xA1\xD6\xCF\xF9\x47\x40\x38\xD9\xAF\x06\xF5\xB3\x87\x09\xBA\x07\xC8\x7A\x3B\xE3\x3A\xE2\xC1\x6B\xDB\x0E\x9B\x7B\xB4\x98\x04\x40\x88\xC8\xE4\x20\x34\x9D\x5F\x94\xAE\x0C\xA0\x05\xA1\x74\x10\x3F\x1F\x93\x6D\xC5\xA0\xCE\x29\xB0\x2A\x03\x6E\xED\x3B\xD1\x9A\x7A\xF7\x0F\xA7\xB7\x39\xD7\xC3\xB4\xDE\x15\x67\x94\xF2\xEF\xB0\xDD\x5F\xE3\xC9\xD8\xD2\x34\x0E\x5D\x44\xDF\xBF\x99\xD8\x5E\x60\xF4\x39\x24\x8A\xFD\x5D\xC8\x46\x8D\x0A\xB1\x60\x7A\x4F\xD5\x27\x30\x60\x9E\x13\x06\xF8\x3A\xAA\xB3\xBB\x33\x34\x6F\x84\x81\x7E\x5C\xCC\x12\x89\xF2\xFE\x6E\x93\x83\xFA\x8B\xEE\xAB\x36\x4C\xB6\x40\xA9\xEE\xFB\xF8\x16\x5A\x55\xD1\x64\x0D\x49\xDA\x04\xDE\xD1\xC8\xCA\xEE\x5F\x24\xB1\x79\x78\xB3\x9A\x88\x13\xDD\x68\x51\x39\xE9\x68\x31\xAF\xD7\xF8\x4D\x35\x6D\x60\x58\x04\x42\xBB\x55\x92\x18\xF6\x98\x01\xA5\x74\x3B\xBC\x36\xDB\x20\x68\x18\xB8\x85\xD4\x8B\x6D\x30\x87\x4D\xD6\x33\x2D\x7A\x54\x36\x1D\x57\x42\x14\x5C\x7A\x62\x74\xD5\x1E\x2B\xD5\xBF\x04\xF3\xFF\xEC\x03\xC1\x02\x03\x01\x00\x01\xA3\x44\x30\x42\x30\x0C\x06\x03\x55\x1D\x13\x01\x01\xFF\x04\x02\x30\x00\x30\x27\x06\x03\x55\x1D\x25\x04\x20\x30\x1E\x06\x08\x2B\x06\x01\x05\x05\x07\x03\x02\x06\x08\x2B\x06\x01\x05\x05\x07\x03\x01\x06\x08\x2B\x06\x01\x05\x05\x07\x03\x09\x30\x09\x06\x03\x55\x1D\x11\x04\x02\x30\x00\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x05\x05\x00\x03\x82\x02\x01\x00\x50\xDD\x63\xB7\x1A\x6F\x91\x4C\xE8\x7F\x82\x1A\x27\x04\x81\x05\xBB\xA6\x69\xAC\x41\x7B\x62\xFC\x4B\x08\xDC\x60\xCF\xB2\x5A\xF1\xB4\xB5\x27\x69\x6B\x12\xE4\x07\xC8\x16\xCE\x3B\x42\xCC\x02\x90\x66\x0E\x79\xB8\x6C\x4B\x90\x00\xC5\x66\x64\x92\x2B\x2B\x48\x0E\x84\xC2\x6D\xBF\xA5\xDE\x16\xE3\xBD\x19\xF5\x5C\x93\xA1\x86\x7F\xD9\x89\x78\x6A\x3F\x83\xF0\xAA\xF8\xEA\x1D\xA4\x13\xF7\x2A\x15\x4C\x51\x9C\xC4\xB0\xBE\x58\x66\xCF\x4C\x6C\x3D\x31\xE5\xF9\x54\x21\xCD\xA1\x30\x01\x6A\xB3\x1A\x48\x85\x34\x93\xB8\xF9\x15\x19\x48\x34\x8D\x73\xE7\x03\x50\xAF\xDE\x50\xC7\x62\xAF\x25\x22\x2B\xF6\xE8\x37\x2E\xE4\x71\xA9\x5C\x26\xEA\x79\xCB\x04\x29\x73\x6B\x8F\xDF\x1F\x5C\x41\x52\xC0\x36\xAA\xD7\x7D\x8E\x44\x54\x98\x06\x4C\x63\xA6\x0B\x01\x94\x5D\x0C\x5C\xD4\xCF\xCB\x0B\x7B\x2D\x56\xCC\xBF\x97\x7F\x15\x24\x1D\xBA\xEA\xB7\x97\xB0\x32\xAD\xFC\xEA\x6D\x94\x39\x7A\xE3\x25\x54\xFC\x4A\xF5\x3D\xBD\x2E\xD5\x31\x07\x49\x24\xCC\x92\x69\x0E\x79\xB9\xDF\xDB\x36\xBF\x04\x44\x15\xD0\x46\x99\x8C\xD2\x4C\x94\x38\x0E\x10\x64\x13\xAB\xD9\x1B\x54\x02\x31\x56\x20\xEE\x69\x95\xDF\x39\xBB\xE9\xA7\x6D\xC3\x23\x86\x0B\xD6\x34\x40\x37\xC3\xD4\x41\xA8\x2E\x71\x1D\x6E\x5B\xD7\xC5\x9F\x2A\xE6\x02\x80\xAE\x0A\x28\x69\x63\x4B\x89\x2E\xBD\x4F\x42\x58\xFB\x86\x9A\xA2\x18\xDC\xC6\x32\xC1\x46\xBA\x28\xD2\x8B\xCE\x56\x63\x04\x80\x51\x51\x39\x00\x3B\x00\xB9\x5F\x67\xFA\x90\x1E\xDA\x76\xB5\x31\xA5\xBD\x11\xD2\x5F\xDA\x5D\xD5\xF7\xEE\xAB\xC0\x62\x74\x60\x47\x32\x42\xFD\xB2\x2E\x04\x3A\x2E\xF2\xC8\xB3\x41\xA3\xBD\xFE\x94\x5F\xEF\x6E\xD7\x92\x7C\x1D\x04\xF0\xC6\x53\x8E\x46\xDC\x30\x3A\x35\x5F\x1A\x4B\xEA\x3B\x00\x8B\x97\xB5\xB9\xCE\x71\x6E\x5C\xD5\xA0\x0B\xB1\x33\x08\x89\x61\x23\xCF\x97\x9F\x8F\x9A\x50\xB5\xEC\xCE\x40\x8D\x82\x95\x8B\x79\x26\x66\xF3\xF4\x70\xD8\xEE\x58\xDD\x75\x29\xD5\x6A\x91\x51\x7A\x17\xBC\x4F\xD4\xA3\x45\x7B\x84\xE7\xBE\x69\x53\xC1\xE2\x5C\xC8\x45\xA0\x3A\xEC\xDF\x8A\x1E\xC1\x18\x84\x8B\x7A\x4E\x4E\x9E\x3A\x26\xFE\x5D\x22\xD4\xC5\x14\xBE\xEE\x06\xEB\x05\x4A\x66\xC9\xA4\xB3\x68\x04\xB0\x5D\x25\x54\xB3\x05\xED\x41\xF0\x65\x69\x6D\xA5\x4E\xB7\x97\xD8\xD8\xF5"
 187
 188 static const gnutls_datum_t blog_resp =
 189   { (unsigned char*) BLOG_RESP, sizeof (BLOG_RESP) - 1 };
 190
 191 static unsigned char blog_cert_pem[] =
 192   "-----BEGIN CERTIFICATE-----\n"
 193   "MIIE8DCCAtigAwIBAgIDALzgMA0GCSqGSIb3DQEBBQUAMFQxFDASBgNVBAoTC0NB\n"
 194   "Y2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5vcmcxHDAaBgNV\n"
 195   "BAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwHhcNMTAxMTE2MjI1MjMzWhcNMTIxMTE1\n"
 196   "MjI1MjMzWjAdMRswGQYDVQQDExJibG9nLmpvc2Vmc3Nvbi5vcmcwggEiMA0GCSqG\n"
 197   "SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBKA6bm/Kip0i00vU+BOmUF2MBDTwps41c\n"
 198   "xKN5bDn7usWZj8loi6BHRPE2WzCVPnPRD1FJXBc4rXL8zZWrCRe1b4A+l8NjPN2o\n"
 199   "uUgJvYLXYQ2hXkvxlPBQPKNOudaOAVsahpyxk6g6Z3mskOfqPhxvjutHvMC4fOsJ\n"
 200   "1+FstMzvg5SpDd4uYM9m0UK8pbEUSuwW+fxyWqhciSi7kJtdrD6bwx3ub3t9GFkM\n"
 201   "9uTzImIslTq19w8AHQsTICNnmNwfUGF5XMUIuxun0HlFt2KUP5G3Qg9Cd18wZFql\n"
 202   "RQJvLA3nbVFtmN3M3yKXnGSsEn38ZJvC+UxFuSfYJN9UwgoG6gwhAgMBAAGjggEA\n"
 203   "MIH9MAwGA1UdEwEB/wQCMAAwNAYDVR0lBC0wKwYIKwYBBQUHAwIGCCsGAQUFBwMB\n"
 204   "BglghkgBhvhCBAEGCisGAQQBgjcKAwMwCwYDVR0PBAQDAgWgMDMGCCsGAQUFBwEB\n"
 205   "BCcwJTAjBggrBgEFBQcwAYYXaHR0cDovL29jc3AuY2FjZXJ0Lm9yZy8wdQYDVR0R\n"
 206   "BG4wbIISYmxvZy5qb3NlZnNzb24ub3JnoCAGCCsGAQUFBwgFoBQMEmJsb2cuam9z\n"
 207   "ZWZzc29uLm9yZ4ISYmxvZy5qb3NlZnNzb24ub3JnoCAGCCsGAQUFBwgFoBQMEmJs\n"
 208   "b2cuam9zZWZzc29uLm9yZzANBgkqhkiG9w0BAQUFAAOCAgEACQX0KziT81G0XJ4C\n"
 209   "SlVumGN0KcVPDjtiUYskMpUvyLF951Q4Uuih0Aa9c0LynyZq8yqr6sW5OTmnRfSU\n"
 210   "DuUK5IH+IPq5PU7qteQSIy+63yjMQ+1wye1zfCWI+MyaS54AOn6uZObsr4grq41i\n"
 211   "sTwnX8OF/z15dQBjDR18WoehsnbuMz3Ld7+w5UcVWRGDzTyZ7JrYisEywQ7TXcoK\n"
 212   "1IlhD1TqwFucH7lIr4mPWNjL7Nw0sw11HN0Syt9H3upcq6lqyEI0ygfNZ9cdxvmX\n"
 213   "WqOBxxLc6G/87G4nGW4jw3WrCX7LqSmChlR3SbEC1UhWpaQMQ+mOU5+vXon7blRV\n"
 214   "zGJ/1wK8mKu3fKw9rm5TQ1xfJuRABbzsD3BrrUaHlREQQ+i6SCPVFGer6oeAaxyv\n"
 215   "so0NCbmBQkcpmUUl0COIR/Lh/YT78PjIEfxaUnUlaZXvCbKPKP2cM8LY7ltEaTgJ\n"
 216   "4W6sZi3QNFySzd4sz7J/YhY/jGjqku7TfpN/GOheW8AzKTBlm3WLps1YXys4TKrB\n"
 217   "0RStfaPfRJI1PeSlrWl6+kQu/5O8WA8NK0JZ/0Jc4d5LNrtUXo4VU9XCthrxLkgL\n"
 218   "3XWgZKFrqJd1UeJJ7OvkRYfI1c5i4oAP5ksuF0SHTpqnXE8K39kUnUx3B+ItJlZP\n"
 219   "VXTFhXRc06QwYqYXuYSAmj7/GJk=\n"
 220   "-----END CERTIFICATE-----\n";
 221 const gnutls_datum_t blog_cert_data = { blog_cert_pem,
 222                                         sizeof (blog_cert_pem) };
 223
 224 static unsigned char blog_issuer_pem[] =
 225   "-----BEGIN CERTIFICATE-----\n"
 226   "MIIHWTCCBUGgAwIBAgIDCkGKMA0GCSqGSIb3DQEBCwUAMHkxEDAOBgNVBAoTB1Jv\n"
 227   "b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ\n"
 228   "Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y\n"
 229   "dEBjYWNlcnQub3JnMB4XDTExMDUyMzE3NDgwMloXDTIxMDUyMDE3NDgwMlowVDEU\n"
 230   "MBIGA1UEChMLQ0FjZXJ0IEluYy4xHjAcBgNVBAsTFWh0dHA6Ly93d3cuQ0FjZXJ0\n"
 231   "Lm9yZzEcMBoGA1UEAxMTQ0FjZXJ0IENsYXNzIDMgUm9vdDCCAiIwDQYJKoZIhvcN\n"
 232   "AQEBBQADggIPADCCAgoCggIBAKtJNRFIfNImflOUz0Op3SjXQiqL84d4GVh8D57a\n"
 233   "iX3h++tykA10oZZkq5+gJJlz2uJVdscXe/UErEa4w75/ZI0QbCTzYZzA8pD6Ueb1\n"
 234   "aQFjww9W4kpCz+JEjCUoqMV5CX1GuYrz6fM0KQhF5Byfy5QEHIGoFLOYZcRD7E6C\n"
 235   "jQnRvapbjZLQ7N6QxX8KwuPr5jFaXnQ+lzNZ6MMDPWAzv/fRb0fEze5ig1JuLgia\n"
 236   "pNkVGJGmhZJHsK5I6223IeyFGmhyNav/8BBdwPSUp2rVO5J+TJAFfpPBLIukjmJ0\n"
 237   "FXFuC3ED6q8VOJrU0gVyb4z5K+taciX5OUbjchs+BMNkJyIQKopPWKcDrb60LhPt\n"
 238   "XapI19V91Cp7XPpGBFDkzA5CW4zt2/LP/JaT4NsRNlRiNDiPDGCbO5dWOK3z0luL\n"
 239   "oFvqTpa4fNfVoIZwQNORKbeiPK31jLvPGpKK5DR7wNhsX+kKwsOnIJpa3yxdUly6\n"
 240   "R9Wb7yQocDggL9V/KcCyQQNokszgnMyXS0XvOhAKq3A6mJVwrTWx6oUrpByAITGp\n"
 241   "rmB6gCZIALgBwJNjVSKRPFbnr9s6JfOPMVTqJouBWfmh0VMRxXudA/Z0EeBtsSw/\n"
 242   "LIaRmXGapneLNGDRFLQsrJ2vjBDTn8Rq+G8T/HNZ92ZCdB6K4/jc0m+YnMtHmJVA\n"
 243   "BfvpAgMBAAGjggINMIICCTAdBgNVHQ4EFgQUdahxYEyIE/B42Yl3tW3Fid+8sXow\n"
 244   "gaMGA1UdIwSBmzCBmIAUFrUyG9TH8+DmjvO90rA67rI5GNGhfaR7MHkxEDAOBgNV\n"
 245   "BAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAG\n"
 246   "A1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS\n"
 247   "c3VwcG9ydEBjYWNlcnQub3JnggEAMA8GA1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUH\n"
 248   "AQEEUTBPMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5DQWNlcnQub3JnLzAoBggr\n"
 249   "BgEFBQcwAoYcaHR0cDovL3d3dy5DQWNlcnQub3JnL2NhLmNydDBKBgNVHSAEQzBB\n"
 250   "MD8GCCsGAQQBgZBKMDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9y\n"
 251   "Zy9pbmRleC5waHA/aWQ9MTAwNAYJYIZIAYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0Fj\n"
 252   "ZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAwUAYJYIZIAYb4QgENBEMWQVRvIGdldCB5\n"
 253   "b3VyIG93biBjZXJ0aWZpY2F0ZSBmb3IgRlJFRSwgZ28gdG8gaHR0cDovL3d3dy5D\n"
 254   "QWNlcnQub3JnMA0GCSqGSIb3DQEBCwUAA4ICAQApKIWuRKm5r6R5E/CooyuXYPNc\n"
 255   "7uMvwfbiZqARrjY3OnYVBFPqQvX56sAV2KaC2eRhrnILKVyQQ+hBsuF32wITRHhH\n"
 256   "Va9Y/MyY9kW50SD42CEH/m2qc9SzxgfpCYXMO/K2viwcJdVxjDm1Luq+GIG6sJO4\n"
 257   "D+Pm1yaMMVpyA4RS5qb1MyJFCsgLDYq4Nm+QCaGrvdfVTi5xotSu+qdUK+s1jVq3\n"
 258   "VIgv7nSf7UgWyg1I0JTTrKSi9iTfkuO960NAkW4cGI5WtIIS86mTn9S8nK2cde5a\n"
 259   "lxuV53QtHA+wLJef+6kzOXrnAzqSjiL2jA3k2X4Ndhj3AfnvlpaiVXPAPHG0HRpW\n"
 260   "Q7fDCo1y/OIQCQtBzoyUoPkD/XFzS4pXM+WOdH4VAQDmzEoc53+VGS3FpQyLu7Xt\n"
 261   "hbNc09+4ufLKxw0BFKxwWMWMjTPUnWajGlCVI/xI4AZDEtnNp4Y5LzZyo4AQ5OHz\n"
 262   "0ctbGsDkgJp8E3MGT9ujayQKurMcvEp4u+XjdTilSKeiHq921F73OIZWWonO1sOn\n"
 263   "ebJSoMbxhbQljPI/lrMQ2Y1sVzufb4Y6GIIiNsiwkTjbKqGTqoQ/9SdlrnPVyNXT\n"
 264   "d+pLncdBu8fA46A/5H2kjXPmEkvfoXNzczqA6NXLji/L6hOn1kGLrPo8idck9U60\n"
 265   "4GGSt/M3mMS+lqO3ig==\n"
 266   "-----END CERTIFICATE-----\n";
 267 const gnutls_datum_t blog_issuer_data = { blog_issuer_pem,
 268                                           sizeof (blog_issuer_pem) };
 269
 270 static unsigned char blog_signer_pem[] =
 271   "-----BEGIN CERTIFICATE-----\n"
 272   "MIIEkTCCAnmgAwIBAgIDANymMA0GCSqGSIb3DQEBBQUAMFQxFDASBgNVBAoTC0NB\n"
 273   "Y2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5vcmcxHDAaBgNV\n"
 274   "BAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwHhcNMTEwODIzMDAwODM3WhcNMTMwODIy\n"
 275   "MDAwODM3WjB8MQswCQYDVQQGEwJBVTEMMAoGA1UECBMDTlNXMQ8wDQYDVQQHEwZT\n"
 276   "eWRuZXkxFDASBgNVBAoTC0NBY2VydCBJbmMuMR4wHAYDVQQLExVTZXJ2ZXIgQWRt\n"
 277   "aW5pc3RyYXRpb24xGDAWBgNVBAMTD29jc3AuY2FjZXJ0Lm9yZzCCASIwDQYJKoZI\n"
 278   "hvcNAQEBBQADggEPADCCAQoCggEBAJzG1G/kI8fDcEt1H+T8rvZixGCh1s/5R0A4\n"
 279   "2a8G9bOHCboHyHo74zriwWvbDpt7tJgEQIjI5CA0nV+UrgygBaF0ED8fk23FoM4p\n"
 280   "sCoDbu070Zp69w+ntznXw7TeFWeU8u+w3V/jydjSNA5dRN+/mdheYPQ5JIr9XchG\n"
 281   "jQqxYHpP1ScwYJ4TBvg6qrO7MzRvhIF+XMwSifL+bpOD+ovuqzZMtkCp7vv4FlpV\n"
 282   "0WQNSdoE3tHIyu5fJLF5eLOaiBPdaFE56Wgxr9f4TTVtYFgEQrtVkhj2mAGldDu8\n"
 283   "NtsgaBi4hdSLbTCHTdYzLXpUNh1XQhRcemJ01R4r1b8E8//sA8ECAwEAAaNEMEIw\n"
 284   "DAYDVR0TAQH/BAIwADAnBgNVHSUEIDAeBggrBgEFBQcDAgYIKwYBBQUHAwEGCCsG\n"
 285   "AQUFBwMJMAkGA1UdEQQCMAAwDQYJKoZIhvcNAQEFBQADggIBAFDdY7cab5FM6H+C\n"
 286   "GicEgQW7pmmsQXti/EsI3GDPslrxtLUnaWsS5AfIFs47QswCkGYOebhsS5AAxWZk\n"
 287   "kisrSA6Ewm2/pd4W470Z9VyToYZ/2Yl4aj+D8Kr46h2kE/cqFUxRnMSwvlhmz0xs\n"
 288   "PTHl+VQhzaEwAWqzGkiFNJO4+RUZSDSNc+cDUK/eUMdiryUiK/boNy7kcalcJup5\n"
 289   "ywQpc2uP3x9cQVLANqrXfY5EVJgGTGOmCwGUXQxc1M/LC3stVsy/l38VJB266reX\n"
 290   "sDKt/OptlDl64yVU/Er1Pb0u1TEHSSTMkmkOebnf2za/BEQV0EaZjNJMlDgOEGQT\n"
 291   "q9kbVAIxViDuaZXfObvpp23DI4YL1jRAN8PUQagucR1uW9fFnyrmAoCuCihpY0uJ\n"
 292   "Lr1PQlj7hpqiGNzGMsFGuijSi85WYwSAUVE5ADsAuV9n+pAe2na1MaW9EdJf2l3V\n"
 293   "9+6rwGJ0YEcyQv2yLgQ6LvLIs0Gjvf6UX+9u15J8HQTwxlOORtwwOjVfGkvqOwCL\n"
 294   "l7W5znFuXNWgC7EzCIlhI8+Xn4+aULXszkCNgpWLeSZm8/Rw2O5Y3XUp1WqRUXoX\n"
 295   "vE/Uo0V7hOe+aVPB4lzIRaA67N+KHsEYhIt6Tk6eOib+XSLUxRS+7gbrBUpmyaSz\n"
 296   "aASwXSVUswXtQfBlaW2lTreX2Nj1\n"
 297   "-----END CERTIFICATE-----\n";
 298 const gnutls_datum_t blog_signer_data = { blog_signer_pem,
 299                                           sizeof (blog_signer_pem) };
 300
 301 static void
 302 ocsp_invalid_calls (void)
 303 {
 304   gnutls_ocsp_req_t req;
 305   gnutls_ocsp_resp_t resp;
 306   gnutls_datum_t dat;
 307   char c = 42;
 308   void *p = &c;
 309   int rc;
 310
 311   rc = gnutls_ocsp_req_init (&req);
 312   if (rc != GNUTLS_E_SUCCESS)
 313     {
 314       fail ("gnutls_ocsp_req_init alloc\n");
 315       exit (1);
 316     }
 317   rc = gnutls_ocsp_resp_init (&resp);
 318   if (rc != GNUTLS_E_SUCCESS)
 319     {
 320       fail ("gnutls_ocsp_resp_init alloc\n");
 321       exit (1);
 322     }
 323
 324   gnutls_ocsp_req_deinit (NULL);
 325   gnutls_ocsp_resp_deinit (NULL);
 326
 327   rc = gnutls_ocsp_req_import (NULL, NULL);
 328   if (rc != GNUTLS_E_INVALID_REQUEST)
 329     {
 330       fail ("gnutls_ocsp_req_import NULL\n");
 331       exit (1);
 332     }
 333
 334   rc = gnutls_ocsp_req_import (NULL, p);
 335   if (rc != GNUTLS_E_INVALID_REQUEST)
 336     {
 337       fail ("gnutls_ocsp_req_import NULL\n");
 338       exit (1);
 339     }
 340
 341   rc = gnutls_ocsp_req_import (req, NULL);
 342   if (rc != GNUTLS_E_INVALID_REQUEST)
 343     {
 344       fail ("gnutls_ocsp_req_import NULL\n");
 345       exit (1);
 346     }
 347
 348   rc = gnutls_ocsp_resp_import (NULL, NULL);
 349   if (rc != GNUTLS_E_INVALID_REQUEST)
 350     {
 351       fail ("gnutls_ocsp_resp_import NULL\n");
 352       exit (1);
 353     }
 354
 355   rc = gnutls_ocsp_resp_import (NULL, p);
 356   if (rc != GNUTLS_E_INVALID_REQUEST)
 357     {
 358       fail ("gnutls_ocsp_resp_import NULL\n");
 359       exit (1);
 360     }
 361
 362   rc = gnutls_ocsp_resp_import (resp, NULL);
 363   if (rc != GNUTLS_E_INVALID_REQUEST)
 364     {
 365       fail ("gnutls_ocsp_resp_import NULL\n");
 366       exit (1);
 367     }
 368
 369   rc = gnutls_ocsp_req_export (NULL, NULL);
 370   if (rc != GNUTLS_E_INVALID_REQUEST)
 371     {
 372       fail ("gnutls_ocsp_req_export NULL\n");
 373       exit (1);
 374     }
 375
 376   rc = gnutls_ocsp_req_export (NULL, p);
 377   if (rc != GNUTLS_E_INVALID_REQUEST)
 378     {
 379       fail ("gnutls_ocsp_req_export NULL\n");
 380       exit (1);
 381     }
 382
 383   rc = gnutls_ocsp_req_export (req, NULL);
 384   if (rc != GNUTLS_E_INVALID_REQUEST)
 385     {
 386       fail ("gnutls_ocsp_req_export NULL\n");
 387       exit (1);
 388     }
 389
 390   rc = gnutls_ocsp_resp_export (NULL, NULL);
 391   if (rc != GNUTLS_E_INVALID_REQUEST)
 392     {
 393       fail ("gnutls_ocsp_resp_export NULL\n");
 394       exit (1);
 395     }
 396
 397   rc = gnutls_ocsp_resp_export (NULL, p);
 398   if (rc != GNUTLS_E_INVALID_REQUEST)
 399     {
 400       fail ("gnutls_ocsp_resp_export NULL\n");
 401       exit (1);
 402     }
 403
 404   rc = gnutls_ocsp_resp_export (resp, NULL);
 405   if (rc != GNUTLS_E_INVALID_REQUEST)
 406     {
 407       fail ("gnutls_ocsp_resp_export NULL\n");
 408       exit (1);
 409     }
 410
 411   rc = gnutls_ocsp_req_get_version (NULL);
 412   if (rc != GNUTLS_E_INVALID_REQUEST)
 413     {
 414       fail ("gnutls_ocsp_req_get_version NULL\n");
 415       exit (1);
 416     }
 417
 418   rc = gnutls_ocsp_req_get_cert_id (NULL, 0, NULL, NULL, NULL, NULL);
 419   if (rc != GNUTLS_E_INVALID_REQUEST)
 420     {
 421       fail ("gnutls_ocsp_req_get_cert_id NULL\n");
 422       exit (1);
 423     }
 424
 425   rc = gnutls_ocsp_req_get_cert_id (req, 0, NULL, NULL, NULL, NULL);
 426   if (rc != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
 427     {
 428       fail ("gnutls_ocsp_req_get_cert_id empty\n");
 429       exit (1);
 430     }
 431
 432   rc = gnutls_ocsp_req_add_cert_id (NULL, 0, NULL, NULL, NULL);
 433   if (rc != GNUTLS_E_INVALID_REQUEST)
 434     {
 435       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 436       exit (1);
 437     }
 438
 439   rc = gnutls_ocsp_req_add_cert_id (req, 0, NULL, NULL, NULL);
 440   if (rc != GNUTLS_E_INVALID_REQUEST)
 441     {
 442       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 443       exit (1);
 444     }
 445
 446   rc = gnutls_ocsp_req_add_cert_id (req, GNUTLS_DIG_SHA1, NULL, NULL, NULL);
 447   if (rc != GNUTLS_E_INVALID_REQUEST)
 448     {
 449       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 450       exit (1);
 451     }
 452
 453   rc = gnutls_ocsp_req_add_cert_id (req, GNUTLS_DIG_SHA1, p, NULL, NULL);
 454   if (rc != GNUTLS_E_INVALID_REQUEST)
 455     {
 456       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 457       exit (1);
 458     }
 459
 460   rc = gnutls_ocsp_req_add_cert_id (req, GNUTLS_DIG_SHA1, NULL, p, NULL);
 461   if (rc != GNUTLS_E_INVALID_REQUEST)
 462     {
 463       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 464       exit (1);
 465     }
 466
 467   rc = gnutls_ocsp_req_add_cert_id (req, GNUTLS_DIG_SHA1, NULL, NULL, p);
 468   if (rc != GNUTLS_E_INVALID_REQUEST)
 469     {
 470       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 471       exit (1);
 472     }
 473
 474   rc = gnutls_ocsp_req_add_cert_id (req, GNUTLS_DIG_SHA1, p, p, NULL);
 475   if (rc != GNUTLS_E_INVALID_REQUEST)
 476     {
 477       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 478       exit (1);
 479     }
 480
 481   rc = gnutls_ocsp_req_add_cert_id (req, GNUTLS_DIG_SHA1, p, NULL, p);
 482   if (rc != GNUTLS_E_INVALID_REQUEST)
 483     {
 484       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 485       exit (1);
 486     }
 487
 488   rc = gnutls_ocsp_req_add_cert_id (req, GNUTLS_DIG_SHA1, NULL, p, p);
 489   if (rc != GNUTLS_E_INVALID_REQUEST)
 490     {
 491       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 492       exit (1);
 493     }
 494
 495   rc = gnutls_ocsp_req_add_cert (NULL, 0, NULL, NULL);
 496   if (rc != GNUTLS_E_INVALID_REQUEST)
 497     {
 498       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 499       exit (1);
 500     }
 501
 502   rc = gnutls_ocsp_req_add_cert (req, 0, NULL, NULL);
 503   if (rc != GNUTLS_E_INVALID_REQUEST)
 504     {
 505       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 506       exit (1);
 507     }
 508
 509
 510   rc = gnutls_ocsp_req_add_cert (req, 0, p, NULL);
 511   if (rc != GNUTLS_E_INVALID_REQUEST)
 512     {
 513       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 514       exit (1);
 515     }
 516
 517   rc = gnutls_ocsp_req_add_cert (req, 0, NULL, p);
 518   if (rc != GNUTLS_E_INVALID_REQUEST)
 519     {
 520       fail ("gnutls_ocsp_req_add_cert_id NULL\n");
 521       exit (1);
 522     }
 523
 524   rc = gnutls_ocsp_req_get_extension (NULL, 0, NULL, NULL, NULL);
 525   if (rc != GNUTLS_E_INVALID_REQUEST)
 526     {
 527       fail ("gnutls_ocsp_req_get_extension NULL\n");
 528       exit (1);
 529     }
 530
 531   rc = gnutls_ocsp_req_get_extension (req, 0, NULL, NULL, NULL);
 532   if (rc != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
 533     {
 534       fail ("gnutls_ocsp_req_get_extension NULL\n");
 535       exit (1);
 536     }
 537
 538   rc = gnutls_ocsp_req_get_extension (req, 0, p, p, p);
 539   if (rc != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
 540     {
 541       fail ("gnutls_ocsp_req_get_extension NULL\n");
 542       exit (1);
 543     }
 544
 545   rc = gnutls_ocsp_req_set_extension (NULL, NULL, 0, NULL);
 546   if (rc != GNUTLS_E_INVALID_REQUEST)
 547     {
 548       fail ("gnutls_ocsp_req_set_extension NULL\n");
 549       exit (1);
 550     }
 551
 552   rc = gnutls_ocsp_req_set_extension (req, NULL, 0, NULL);
 553   if (rc != GNUTLS_E_INVALID_REQUEST)
 554     {
 555       fail ("gnutls_ocsp_req_set_extension NULL\n");
 556       exit (1);
 557     }
 558
 559   rc = gnutls_ocsp_req_set_extension (req, p, 0, NULL);
 560   if (rc != GNUTLS_E_INVALID_REQUEST)
 561     {
 562       fail ("gnutls_ocsp_req_set_extension NULL\n");
 563       exit (1);
 564     }
 565
 566   rc = gnutls_ocsp_req_set_extension (req, NULL, 0, p);
 567   if (rc != GNUTLS_E_INVALID_REQUEST)
 568     {
 569       fail ("gnutls_ocsp_req_set_extension NULL\n");
 570       exit (1);
 571     }
 572
 573   rc = gnutls_ocsp_req_get_nonce (NULL, NULL, NULL);
 574   if (rc != GNUTLS_E_INVALID_REQUEST)
 575     {
 576       fail ("gnutls_ocsp_req_get_nonce NULL\n");
 577       exit (1);
 578     }
 579
 580   rc = gnutls_ocsp_req_get_nonce (NULL, NULL, p);
 581   if (rc != GNUTLS_E_INVALID_REQUEST)
 582     {
 583       fail ("gnutls_ocsp_req_get_nonce NULL\n");
 584       exit (1);
 585     }
 586
 587   rc = gnutls_ocsp_req_set_nonce (NULL, 0, NULL);
 588   if (rc != GNUTLS_E_INVALID_REQUEST)
 589     {
 590       fail ("gnutls_ocsp_req_set_nonce NULL\n");
 591       exit (1);
 592     }
 593
 594   rc = gnutls_ocsp_req_set_nonce (req, 0, NULL);
 595   if (rc != GNUTLS_E_INVALID_REQUEST)
 596     {
 597       fail ("gnutls_ocsp_req_set_nonce NULL\n");
 598       exit (1);
 599     }
 600
 601   rc = gnutls_ocsp_req_randomize_nonce (NULL);
 602   if (rc != GNUTLS_E_INVALID_REQUEST)
 603     {
 604       fail ("gnutls_ocsp_req_randomize_nonce NULL\n");
 605       exit (1);
 606     }
 607
 608   rc = gnutls_ocsp_resp_get_status (NULL);
 609   if (rc != GNUTLS_E_INVALID_REQUEST)
 610     {
 611       fail ("gnutls_ocsp_resp_get_status NULL\n");
 612       exit (1);
 613     }
 614
 615   rc = gnutls_ocsp_resp_get_status (resp);
 616   if (rc != GNUTLS_E_ASN1_VALUE_NOT_FOUND)
 617     {
 618       fail ("gnutls_ocsp_resp_get_status %d\n", rc);
 619       exit (1);
 620     }
 621
 622   rc = gnutls_ocsp_resp_get_response (NULL, NULL, NULL);
 623   if (rc != GNUTLS_E_INVALID_REQUEST)
 624     {
 625       fail ("gnutls_ocsp_resp_get_response NULL\n");
 626       exit (1);
 627     }
 628
 629   rc = gnutls_ocsp_resp_get_response (NULL, p, p);
 630   if (rc != GNUTLS_E_INVALID_REQUEST)
 631     {
 632       fail ("gnutls_ocsp_resp_get_response NULL\n");
 633       exit (1);
 634     }
 635
 636   rc = gnutls_ocsp_resp_get_response (resp, NULL, NULL);
 637   if (rc != GNUTLS_E_SUCCESS)
 638     {
 639       fail ("gnutls_ocsp_resp_get_response %d\n", rc);
 640       exit (1);
 641     }
 642
 643   rc = gnutls_ocsp_resp_get_version (NULL);
 644   if (rc != GNUTLS_E_INVALID_REQUEST)
 645     {
 646       fail ("gnutls_ocsp_resp_get_version NULL\n");
 647       exit (1);
 648     }
 649
 650   rc = gnutls_ocsp_resp_get_version (resp);
 651   if (rc != 1)
 652     {
 653       fail ("gnutls_ocsp_resp_get_version ret %d\n", rc);
 654       exit (1);
 655     }
 656
 657   rc = gnutls_ocsp_resp_get_responder (NULL, NULL);
 658   if (rc != GNUTLS_E_INVALID_REQUEST)
 659     {
 660       fail ("gnutls_ocsp_resp_get_responder NULL\n");
 661       exit (1);
 662     }
 663
 664   rc = gnutls_ocsp_resp_get_responder (resp, NULL);
 665   if (rc != GNUTLS_E_INVALID_REQUEST)
 666     {
 667       fail ("gnutls_ocsp_resp_get_responder 2nd %d\n", rc);
 668       exit (1);
 669     }
 670
 671   rc = gnutls_ocsp_resp_get_responder (resp, &dat);
 672   if (rc != GNUTLS_E_SUCCESS || dat.size != 0)
 673     {
 674       fail ("gnutls_ocsp_resp_get_responder %d\n", rc);
 675       exit (1);
 676     }
 677
 678   gnutls_free (dat.data);
 679
 680   gnutls_ocsp_req_deinit (req);
 681   gnutls_ocsp_resp_deinit (resp);
 682 }
 683
 684 /* import a request, query some fields and print and export it */
 685 static void
 686 req_parse (void)
 687 {
 688   gnutls_ocsp_req_t req;
 689   int ret;
 690   gnutls_datum_t d;
 691
 692   /* init request */
 693
 694   ret = gnutls_ocsp_req_init (&req);
 695   if (ret != 0)
 696     {
 697       fail ("gnutls_ocsp_req_init\n");
 698       exit (1);
 699     }
 700
 701   /* import ocsp request */
 702
 703   ret = gnutls_ocsp_req_import (req, &req1);
 704   if (ret != 0)
 705     {
 706       fail ("gnutls_ocsp_req_import %d\n", ret);
 707       exit (1);
 708     }
 709
 710   /* simple version query */
 711
 712   ret = gnutls_ocsp_req_get_version (req);
 713   if (ret != 1)
 714     {
 715       fail ("gnutls_ocsp_req_get_version %d\n", ret);
 716       exit (1);
 717     }
 718
 719   /* check nonce */
 720   {
 721     gnutls_datum_t expect =
 722       { (unsigned char*) REQ1NONCE + 2, sizeof (REQ1NONCE) - 3 };
 723     gnutls_datum_t got;
 724     unsigned int critical;
 725
 726     ret = gnutls_ocsp_req_get_nonce (req, &critical, &got);
 727     if (ret != 0)
 728       {
 729         fail ("gnutls_ocsp_req_get_nonce %d\n", ret);
 730         exit (1);
 731       }
 732
 733     if (critical != 0)
 734       {
 735         fail ("unexpected critical %d\n", critical);
 736         exit (1);
 737       }
 738
 739     if (expect.size != got.size ||
 740         memcmp (expect.data, got.data, got.size) != 0)
 741       {
 742         fail ("ocsp request nonce memcmp failed\n");
 743         exit (1);
 744       }
 745
 746     gnutls_free (got.data);
 747   }
 748
 749   /* print request */
 750
 751   ret = gnutls_ocsp_req_print (req, GNUTLS_OCSP_PRINT_FULL, &d);
 752   if (ret != 0)
 753     {
 754       fail ("gnutls_ocsp_req_print\n");
 755       exit (1);
 756     }
 757
 758   if (strlen (REQ1INFO) != d.size - 1 ||
 759       memcmp (REQ1INFO, d.data, strlen (REQ1INFO)) != 0)
 760     {
 761       printf ("expected (len %ld):\n%s\ngot (len %d):\n%.*s\n",
 762               strlen (REQ1INFO), REQ1INFO, (int) d.size - 1,
 763               (int) d.size, d.data);
 764       fail ("ocsp request print failed\n");
 765       exit (1);
 766     }
 767   gnutls_free (d.data);
 768
 769   /* test export */
 770   ret = gnutls_ocsp_req_export (req, &d);
 771   if (ret != 0)
 772     {
 773       fail ("gnutls_ocsp_req_export %d\n", ret);
 774       exit (1);
 775     }
 776
 777   /* compare against earlier imported bytes */
 778
 779   if (req1.size != d.size ||
 780       memcmp (req1.data, d.data, d.size) != 0)
 781     {
 782       fail ("ocsp request export memcmp failed\n");
 783       exit (1);
 784     }
 785   gnutls_free (d.data);
 786
 787   /* test setting nonce */
 788   {
 789     gnutls_datum_t n1 = { (unsigned char *) "foo", 3 };
 790     gnutls_datum_t n2 = { (unsigned char *) "foobar", 6 };
 791     gnutls_datum_t got;
 792     unsigned critical;
 793
 794     ret = gnutls_ocsp_req_set_nonce (req, 0, &n1);
 795     if (ret != 0)
 796       {
 797         fail ("gnutls_ocsp_req_set_nonce %d\n", ret);
 798         exit (1);
 799       }
 800
 801     ret = gnutls_ocsp_req_get_nonce (req, &critical, &got);
 802     if (ret != 0)
 803       {
 804         fail ("gnutls_ocsp_req_get_nonce %d\n", ret);
 805         exit (1);
 806       }
 807
 808     if (critical != 0)
 809       {
 810         fail ("unexpected critical %d\n", critical);
 811         exit (1);
 812       }
 813
 814     if (n1.size != got.size ||
 815         memcmp (n1.data, got.data, got.size) != 0)
 816       {
 817         fail ("ocsp request parse nonce memcmp failed\n");
 818         exit (1);
 819       }
 820
 821     gnutls_free (got.data);
 822
 823     /* set another time */
 824
 825     ret = gnutls_ocsp_req_set_nonce (req, 1, &n2);
 826     if (ret != 0)
 827       {
 828         fail ("gnutls_ocsp_req_set_nonce %d\n", ret);
 829         exit (1);
 830       }
 831
 832     ret = gnutls_ocsp_req_get_nonce (req, &critical, &got);
 833     if (ret != 0)
 834       {
 835         fail ("gnutls_ocsp_req_get_nonce %d\n", ret);
 836         exit (1);
 837       }
 838
 839     if (critical != 1)
 840       {
 841         fail ("unexpected critical %d\n", critical);
 842         exit (1);
 843       }
 844
 845     if (n2.size != got.size ||
 846         memcmp (n2.data, got.data, got.size) != 0)
 847       {
 848         fail ("ocsp request parse2 nonce memcmp failed\n");
 849         exit (1);
 850       }
 851
 852     gnutls_free (got.data);
 853
 854     /* randomize nonce */
 855
 856     ret = gnutls_ocsp_req_randomize_nonce (req);
 857     if (ret != 0)
 858       {
 859         fail ("gnutls_ocsp_req_randomize_nonce %d\n", ret);
 860         exit (1);
 861       }
 862
 863     ret = gnutls_ocsp_req_get_nonce (req, &critical, &n1);
 864     if (ret != 0)
 865       {
 866         fail ("gnutls_ocsp_req_get_nonce %d\n", ret);
 867         exit (1);
 868       }
 869
 870     if (critical != 0)
 871       {
 872         fail ("unexpected random critical %d\n", critical);
 873         exit (1);
 874       }
 875
 876     ret = gnutls_ocsp_req_randomize_nonce (req);
 877     if (ret != 0)
 878       {
 879         fail ("gnutls_ocsp_req_randomize_nonce %d\n", ret);
 880         exit (1);
 881       }
 882
 883     ret = gnutls_ocsp_req_get_nonce (req, &critical, &n2);
 884     if (ret != 0)
 885       {
 886         fail ("gnutls_ocsp_req_get_nonce %d\n", ret);
 887         exit (1);
 888       }
 889
 890     if (critical != 0)
 891       {
 892         fail ("unexpected random critical %d\n", critical);
 893         exit (1);
 894       }
 895
 896     if (n2.size == got.size && memcmp (n1.data, n2.data, n1.size) == 0)
 897       {
 898         fail ("ocsp request random nonce memcmp failed\n");
 899         exit (1);
 900       }
 901
 902     gnutls_free (n1.data);
 903     gnutls_free (n2.data);
 904   }
 905
 906   /* cleanup */
 907
 908   gnutls_ocsp_req_deinit (req);
 909 }
 910
 911 /* check that creating a request (using low-level add_cert_id) ends up
 912    with same DER as above. */
 913 static void
 914 req_addcert_id (void)
 915 {
 916   gnutls_ocsp_req_t req;
 917   int ret;
 918   gnutls_datum_t d;
 919
 920   /* init request */
 921
 922   ret = gnutls_ocsp_req_init (&req);
 923   if (ret != 0)
 924     {
 925       fail ("gnutls_ocsp_req_init\n");
 926       exit (1);
 927     }
 928
 929   /* add ocsp request nonce */
 930
 931   {
 932     gnutls_datum_t nonce =
 933       { (unsigned char*) REQ1NONCE, sizeof (REQ1NONCE) - 1 };
 934
 935     ret = gnutls_ocsp_req_set_extension (req, "1.3.6.1.5.5.7.48.1.2",
 936                                          0, &nonce);
 937     if (ret != 0)
 938       {
 939         fail ("gnutls_ocsp_req_set_extension %d\n", ret);
 940         exit (1);
 941       }
 942   }
 943
 944   /* add cert_id */
 945   {
 946     gnutls_datum_t issuer_name_hash =
 947       { (unsigned char*) REQ1INH, sizeof (REQ1INH) - 1 };
 948     gnutls_datum_t issuer_key_hash =
 949       { (unsigned char*) REQ1IKH, sizeof (REQ1IKH) - 1 };
 950     gnutls_datum_t serial_number =
 951       { (unsigned char*) REQ1SN, sizeof (REQ1SN) - 1 };
 952
 953     ret = gnutls_ocsp_req_add_cert_id (req, GNUTLS_DIG_SHA1,
 954                                       &issuer_name_hash,
 955                                       &issuer_key_hash,
 956                                       &serial_number);
 957     if (ret != 0)
 958       {
 959         fail ("gnutls_ocsp_add_cert_id %d\n", ret);
 960         exit (1);
 961       }
 962   }
 963
 964   /* print request */
 965
 966   ret = gnutls_ocsp_req_print (req, GNUTLS_OCSP_PRINT_FULL, &d);
 967   if (ret != 0)
 968     {
 969       fail ("gnutls_ocsp_req_print\n");
 970       exit (1);
 971     }
 972
 973   if (strlen (REQ1INFO) != d.size - 1 ||
 974       memcmp (REQ1INFO, d.data, strlen (REQ1INFO)) != 0)
 975     {
 976       printf ("expected (len %ld):\n%s\ngot (len %d):\n%.*s\n",
 977               strlen (REQ1INFO), REQ1INFO, (int) d.size - 1,
 978               (int) d.size, d.data);
 979       fail ("ocsp request print failed\n");
 980       exit (1);
 981     }
 982   gnutls_free (d.data);
 983
 984   /* test export */
 985   ret = gnutls_ocsp_req_export (req, &d);
 986   if (ret != 0)
 987     {
 988       fail ("gnutls_ocsp_req_export %d\n", ret);
 989       exit (1);
 990     }
 991
 992   /* compare against earlier imported bytes */
 993
 994   if (req1.size != d.size ||
 995       memcmp (req1.data, d.data, d.size) != 0)
 996     {
 997       fail ("ocsp request export memcmp failed\n");
 998       exit (1);
 999     }
1000   gnutls_free (d.data);
1001
1002   /* cleanup */
1003
1004   gnutls_ocsp_req_deinit (req);
1005 }
1006
1007 /* check that creating a request (using high-level add_cert) ends up
1008    with same DER as above. */
1009 static void
1010 req_addcert (void)
1011 {
1012   gnutls_ocsp_req_t req;
1013   int ret;
1014   gnutls_datum_t d;
1015
1016   /* init request */
1017
1018   ret = gnutls_ocsp_req_init (&req);
1019   if (ret != 0)
1020     {
1021       fail ("gnutls_ocsp_req_init\n");
1022       exit (1);
1023     }
1024
1025   /* add ocsp request nonce */
1026
1027   {
1028     gnutls_datum_t nonce =
1029       { (unsigned char*) REQ1NONCE, sizeof (REQ1NONCE) - 1 };
1030
1031     ret = gnutls_ocsp_req_set_extension (req, "1.3.6.1.5.5.7.48.1.2",
1032                                          0, &nonce);
1033     if (ret != 0)
1034       {
1035         fail ("gnutls_ocsp_req_set_extension %d\n", ret);
1036         exit (1);
1037       }
1038   }
1039
1040   /* add cert_id */
1041   {
1042     gnutls_x509_crt_t issuer = NULL, subject = NULL;
1043
1044     ret = gnutls_x509_crt_init (&issuer);
1045     if (ret < 0)
1046       {
1047         fail ("gnutls_x509_crt_init (issuer) %d\n", ret);
1048         exit (1);
1049       }
1050
1051     ret = gnutls_x509_crt_init (&subject);
1052     if (ret < 0)
1053       {
1054         fail ("gnutls_x509_crt_init (subject) %d\n", ret);
1055         exit (1);
1056       }
1057
1058     ret = gnutls_x509_crt_import (issuer, &issuer_data, GNUTLS_X509_FMT_PEM);
1059     if (ret < 0)
1060       {
1061         fail ("gnutls_x509_crt_import (issuer) %d\n", ret);
1062         exit (1);
1063       }
1064
1065     ret = gnutls_x509_crt_import (subject, &subject_data, GNUTLS_X509_FMT_PEM);
1066     if (ret < 0)
1067       {
1068         fail ("gnutls_x509_crt_import (subject) %d\n", ret);
1069         exit (1);
1070       }
1071
1072     ret = gnutls_ocsp_req_add_cert (req, GNUTLS_DIG_SHA1,
1073                                     issuer, subject);
1074     if (ret != 0)
1075       {
1076         fail ("gnutls_ocsp_add_cert %d\n", ret);
1077         exit (1);
1078       }
1079
1080     gnutls_x509_crt_deinit (subject);
1081     gnutls_x509_crt_deinit (issuer);
1082   }
1083
1084   /* print request */
1085
1086   ret = gnutls_ocsp_req_print (req, GNUTLS_OCSP_PRINT_FULL, &d);
1087   if (ret != 0)
1088     {
1089       fail ("gnutls_ocsp_req_print\n");
1090       exit (1);
1091     }
1092
1093   if (strlen (REQ1INFO) != d.size - 1 ||
1094       memcmp (REQ1INFO, d.data, strlen (REQ1INFO)) != 0)
1095     {
1096       printf ("expected (len %ld):\n%s\ngot (len %d):\n%.*s\n",
1097               strlen (REQ1INFO), REQ1INFO, (int) d.size - 1,
1098               (int) d.size, d.data);
1099       fail ("ocsp request print failed\n");
1100       exit (1);
1101     }
1102   gnutls_free (d.data);
1103
1104   /* test export */
1105   ret = gnutls_ocsp_req_export (req, &d);
1106   if (ret != 0)
1107     {
1108       fail ("gnutls_ocsp_req_export %d\n", ret);
1109       exit (1);
1110     }
1111
1112   /* compare against earlier imported bytes */
1113
1114   if (req1.size != d.size ||
1115       memcmp (req1.data, d.data, d.size) != 0)
1116     {
1117       fail ("ocsp request export memcmp failed\n");
1118       exit (1);
1119     }
1120   gnutls_free (d.data);
1121
1122   /* cleanup */
1123
1124   gnutls_ocsp_req_deinit (req);
1125 }
1126
1127 static void
1128 resp_import (void)
1129 {
1130   gnutls_ocsp_resp_t resp;
1131   int ret;
1132   gnutls_datum_t d;
1133
1134   /* init response */
1135
1136   ret = gnutls_ocsp_resp_init (&resp);
1137   if (ret != 0)
1138     {
1139       fail ("gnutls_ocsp_resp_init\n");
1140       exit (1);
1141     }
1142
1143   /* import ocsp response */
1144
1145   ret = gnutls_ocsp_resp_import (resp, &resp1);
1146   if (ret != 0)
1147     {
1148       fail ("gnutls_ocsp_resp_import %d\n", ret);
1149       exit (1);
1150     }
1151
1152   /* print response */
1153
1154   ret = gnutls_ocsp_resp_print (resp, GNUTLS_OCSP_PRINT_FULL, &d);
1155   if (ret != 0)
1156     {
1157       fail ("gnutls_ocsp_resp_print\n");
1158       exit (1);
1159     }
1160
1161   if (strlen (RESP1INFO) != d.size - 1 ||
1162       memcmp (RESP1INFO, d.data, strlen (RESP1INFO)) != 0)
1163     {
1164       printf ("expected (len %ld):\n%s\ngot (len %d):\n%.*s\n",
1165               strlen (RESP1INFO), RESP1INFO, (int) d.size - 1,
1166               (int) d.size, d.data);
1167       fail ("ocsp response print failed\n");
1168       exit (1);
1169     }
1170   gnutls_free (d.data);
1171
1172   /* import ocsp response */
1173
1174   ret = gnutls_ocsp_resp_import (resp, &resp2);
1175   if (ret != 0)
1176     {
1177       fail ("gnutls_ocsp_resp_import %d\n", ret);
1178       exit (1);
1179     }
1180
1181   /* print response */
1182
1183   ret = gnutls_ocsp_resp_print (resp, GNUTLS_OCSP_PRINT_FULL, &d);
1184   if (ret != 0)
1185     {
1186       fail ("gnutls_ocsp_resp_print\n");
1187       exit (1);
1188     }
1189
1190   if (memcmp (RESP2INFO, d.data, strlen (RESP2INFO)) != 0)
1191     {
1192       printf ("expected (len %ld):\n%s\ngot (len %d):\n%.*s\n",
1193               strlen (RESP2INFO), RESP2INFO, (int) d.size - 1,
1194               (int) d.size, d.data);
1195       fail ("ocsp response print failed\n");
1196       exit (1);
1197     }
1198   gnutls_free (d.data);
1199
1200   /* cleanup */
1201
1202   gnutls_ocsp_resp_deinit (resp);
1203 }
1204
1205 static void
1206 resp_verify (void)
1207 {
1208   gnutls_ocsp_resp_t resp;
1209   int ret;
1210   gnutls_x509_crt_t cert = NULL, issuer = NULL, signer = NULL;
1211   gnutls_x509_trust_list_t list;
1212   unsigned verify;
1213
1214   /* init response */
1215
1216   ret = gnutls_ocsp_resp_init (&resp);
1217   if (ret != 0)
1218     {
1219       fail ("gnutls_ocsp_resp_init\n");
1220       exit (1);
1221     }
1222
1223   /* import ocsp response */
1224
1225   ret = gnutls_ocsp_resp_import (resp, &blog_resp);
1226   if (ret != 0)
1227     {
1228       fail ("gnutls_ocsp_resp_import %d\n", ret);
1229       exit (1);
1230     }
1231
1232   ret = gnutls_x509_crt_init (&cert);
1233   if (ret < 0)
1234     {
1235       fail ("gnutls_x509_crt_init (cert) %d\n", ret);
1236       exit (1);
1237     }
1238
1239   ret = gnutls_x509_crt_init (&issuer);
1240   if (ret < 0)
1241     {
1242       fail ("gnutls_x509_crt_init (issuer) %d\n", ret);
1243       exit (1);
1244     }
1245
1246   ret = gnutls_x509_crt_init (&signer);
1247   if (ret < 0)
1248     {
1249       fail ("gnutls_x509_crt_init (signer) %d\n", ret);
1250       exit (1);
1251     }
1252
1253   ret = gnutls_x509_crt_import (cert, &blog_cert_data, GNUTLS_X509_FMT_PEM);
1254   if (ret < 0)
1255     {
1256       fail ("gnutls_x509_crt_import (cert) %d\n", ret);
1257       exit (1);
1258     }
1259
1260   ret = gnutls_x509_crt_import (issuer, &blog_issuer_data, GNUTLS_X509_FMT_PEM);
1261   if (ret < 0)
1262     {
1263       fail ("gnutls_x509_crt_import (issuer) %d\n", ret);
1264       exit (1);
1265     }
1266
1267   ret = gnutls_x509_crt_import (signer, &blog_signer_data, GNUTLS_X509_FMT_PEM);
1268   if (ret < 0)
1269     {
1270       fail ("gnutls_x509_crt_import (signer) %d\n", ret);
1271       exit (1);
1272     }
1273
1274   /* check direct verify with signer (should succeed) */
1275
1276   ret = gnutls_ocsp_resp_verify_direct (resp, signer, &verify, 0);
1277   if (ret < 0)
1278     {
1279       fail ("gnutls_ocsp_resp_verify_direct (signer) %d\n", ret);
1280       exit (1);
1281     }
1282
1283   if (verify != 0)
1284     {
1285       fail ("gnutls_ocsp_resp_verify_direct %d\n", verify);
1286       exit (1);
1287     }
1288
1289   /* check direct verify with cert (should fail) */
1290
1291   ret = gnutls_ocsp_resp_verify_direct (resp, cert, &verify, 0);
1292   if (ret < 0)
1293     {
1294       fail ("gnutls_ocsp_resp_verify_direct (cert) %d\n", ret);
1295       exit (1);
1296     }
1297
1298   if (verify != GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER)
1299     {
1300       fail ("gnutls_ocsp_resp_verify_direct3 %d\n", verify);
1301       exit (1);
1302     }
1303
1304   /* check trust verify with issuer (should succeed) */
1305
1306   ret = gnutls_x509_trust_list_init (&list, 0);
1307   if (ret < 0)
1308     {
1309       fail ("gnutls_x509_trust_list_init %d\n", ret);
1310       exit (1);
1311     }
1312
1313   ret = gnutls_x509_trust_list_add_cas (list, &issuer, 1, 0);
1314   if (ret < 0)
1315     {
1316       fail ("gnutls_x509_trust_list_add_cas %d\n", ret);
1317       exit (1);
1318     }
1319
1320   ret = gnutls_ocsp_resp_verify (resp, list, &verify, 0);
1321   if (ret < 0)
1322     {
1323       fail ("gnutls_ocsp_resp_verify (issuer) %d\n", ret);
1324       exit (1);
1325     }
1326
1327   if (verify != 0)
1328     {
1329       fail ("gnutls_ocsp_resp_verify %d\n", verify);
1330       exit (1);
1331     }
1332
1333   gnutls_x509_trust_list_deinit (list, 0);
1334
1335   /* check trust verify with signer (should succeed) */
1336
1337   ret = gnutls_x509_trust_list_init (&list, 0);
1338   if (ret < 0)
1339     {
1340       fail ("gnutls_x509_trust_list_init %d\n", ret);
1341       exit (1);
1342     }
1343
1344   ret = gnutls_x509_trust_list_add_cas (list, &signer, 1, 0);
1345   if (ret < 0)
1346     {
1347       fail ("gnutls_x509_trust_list_add_cas %d\n", ret);
1348       exit (1);
1349     }
1350
1351   ret = gnutls_ocsp_resp_verify (resp, list, &verify, 0);
1352   if (ret < 0)
1353     {
1354       fail ("gnutls_ocsp_resp_verify (issuer) %d\n", ret);
1355       exit (1);
1356     }
1357
1358   if (verify != 0)
1359     {
1360       fail ("gnutls_ocsp_resp_verify %d\n", verify);
1361       exit (1);
1362     }
1363
1364   gnutls_x509_trust_list_deinit (list, 0);
1365
1366   /* check trust verify with cert (should fail) */
1367
1368   ret = gnutls_x509_trust_list_init (&list, 0);
1369   if (ret < 0)
1370     {
1371       fail ("gnutls_x509_trust_list_init %d\n", ret);
1372       exit (1);
1373     }
1374
1375   ret = gnutls_x509_trust_list_add_cas (list, &cert, 1, 0);
1376   if (ret < 0)
1377     {
1378       fail ("gnutls_x509_trust_list_add_cas %d\n", ret);
1379       exit (1);
1380     }
1381
1382   ret = gnutls_ocsp_resp_verify (resp, list, &verify, 0);
1383   if (ret < 0)
1384     {
1385       fail ("gnutls_ocsp_resp_verify (issuer) %d\n", ret);
1386       exit (1);
1387     }
1388
1389   if (verify != GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER)
1390     {
1391       fail ("gnutls_ocsp_resp_verify %d\n", verify);
1392       exit (1);
1393     }
1394
1395   gnutls_x509_trust_list_deinit (list, 0);
1396
1397   /* check trust verify with all certs (should succeed) */
1398
1399   ret = gnutls_x509_trust_list_init (&list, 0);
1400   if (ret < 0)
1401     {
1402       fail ("gnutls_x509_trust_list_init %d\n", ret);
1403       exit (1);
1404     }
1405
1406   ret = gnutls_x509_trust_list_add_cas (list, &cert, 1, 0);
1407   if (ret < 0)
1408     {
1409       fail ("gnutls_x509_trust_list_add_cas %d\n", ret);
1410       exit (1);
1411     }
1412
1413   ret = gnutls_x509_trust_list_add_cas (list, &issuer, 1, 0);
1414   if (ret < 0)
1415     {
1416       fail ("gnutls_x509_trust_list_add_cas %d\n", ret);
1417       exit (1);
1418     }
1419
1420   ret = gnutls_x509_trust_list_add_cas (list, &signer, 1, 0);
1421   if (ret < 0)
1422     {
1423       fail ("gnutls_x509_trust_list_add_cas %d\n", ret);
1424       exit (1);
1425     }
1426
1427   ret = gnutls_ocsp_resp_verify (resp, list, &verify, 0);
1428   if (ret < 0)
1429     {
1430       fail ("gnutls_ocsp_resp_verify (issuer) %d\n", ret);
1431       exit (1);
1432     }
1433
1434   if (verify != 0)
1435     {
1436       fail ("gnutls_ocsp_resp_verify %d\n", verify);
1437       exit (1);
1438     }
1439
1440   gnutls_x509_trust_list_deinit (list, 0);
1441
1442   /* cleanup */
1443
1444   gnutls_ocsp_resp_deinit (resp);
1445   gnutls_x509_crt_deinit (cert);
1446   gnutls_x509_crt_deinit (issuer);
1447   gnutls_x509_crt_deinit (signer);
1448 }
1449
1450 void
1451 doit (void)
1452 {
1453   int ret;
1454
1455   ret = gnutls_global_init ();
1456   if (ret < 0)
1457     {
1458       fail ("gnutls_global_init\n");
1459       exit (1);
1460     }
1461
1462   gnutls_global_set_time_function (mytime);
1463   gnutls_global_set_log_function (tls_log_func);
1464   if (debug)
1465     gnutls_global_set_log_level (99);
1466
1467   ocsp_invalid_calls ();
1468   req_parse ();
1469   resp_import ();
1470   req_addcert_id ();
1471   req_addcert ();
1472   resp_verify ();
1473
1474   /* we're done */
1475
1476   gnutls_global_deinit ();
1477 }