Commit 223fba0b5c for openssl.org
commit 223fba0b5cd0f7c5e95fbd7801e9cbe76b75fef5
Author: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Mon Sep 7 16:37:21 2026 +0200
Properly capture STDERR in pkcs12 tests
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Merge-date: Mon Sep 14 14:16:51 2026
Merged-from: https://github.com/openssl/openssl/pull/32724
diff --git a/test/recipes/80-test_pkcs12.t b/test/recipes/80-test_pkcs12.t
index c82b07a1bf..ad38af5ba0 100644
--- a/test/recipes/80-test_pkcs12.t
+++ b/test/recipes/80-test_pkcs12.t
@@ -55,6 +55,7 @@ if (eval { require Win32::API; 1; }) {
$ENV{OPENSSL_WIN32_UTF8}=1;
my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
+my $no_err = disabled('err') || disabled('autoerrinit');
plan tests => 65 + ($no_fips ? 0 : 5);
@@ -417,114 +418,145 @@ ok(run(test(["pkcs12_api_test",
# NULL is being received and dereferenced
unless ($no_fips) {
- my $file = "sha256mac_cert.oct-is-null.p12";
- my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
- with({ exit_checker => sub { return shift == 1; } },
- sub {
- my @output = run(app(["openssl", "storeutl", "-certs", "-text",
- "-passin", "pass:RedHatEnterpriseLinux10.0", $path]),
- capture => 1, stderr => "outerr.txt");
- open DATA, "outerr.txt";
- my @match = grep /PKCS12_item_decrypt_d2i_ex:passed a null parameter/, <DATA>;
- close DATA;
- ok(scalar @match > 0 ? 0 : 1, "Test against CVE-2025-69421 - null parameter, sha256mac");
- }
- );
+ SKIP: {
+ skip "Error messages are not compiled in", 1 if $no_err;
+ {
+ my $file = "sha256mac_cert.oct-is-null.p12";
+ my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
+ with({ exit_checker => sub { return shift == 1; } },
+ sub {
+ my @output = run(app(["openssl", "storeutl", "-certs", "-text",
+ "-passin", "pass:RedHatEnterpriseLinux10.0", $path],
+ stderr => "outerr.txt"),
+ capture => 1);
+ open DATA, "outerr.txt";
+ my @match = grep /PKCS12_item_decrypt_d2i_ex:passed a null parameter/, <DATA>;
+ close DATA;
+ ok(scalar @match > 0, "Test against CVE-2025-69421 - null parameter, sha256mac");
+ }
+ );
+ }
+ }
}
-{
- my $file = "pbmac1_cert.oct-is-null.p12";
- my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
- with({ exit_checker => sub { return shift == 1; } },
- sub {
- my @output = run(app(["openssl", "storeutl", "-certs", "-text",
- "-passin", "pass:RedHatEnterpriseLinux10.0", $path]),
- capture => 1, stderr => "outerr.txt");
- open DATA, "outerr.txt";
- my @match = grep /PKCS12_item_decrypt_d2i_ex:passed a null parameter/, <DATA>;
- close DATA;
- ok(scalar @match > 0 ? 0 : 1, "Test against CVE-2025-69421 - null parameter, pbmac1");
- }
- );
+ SKIP: {
+ skip "Error messages are not compiled in", 1 if $no_err;
+ {
+ my $file = "pbmac1_cert.oct-is-null.p12";
+ my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
+ with({ exit_checker => sub { return shift == 1; } },
+ sub {
+ my @output = run(app(["openssl", "storeutl", "-certs", "-text",
+ "-passin", "pass:RedHatEnterpriseLinux10.0", $path],
+ stderr => "outerr.txt"),
+ capture => 1);
+ open DATA, "outerr.txt";
+ my @match = grep /PKCS12_item_decrypt_d2i_ex:passed a null parameter/, <DATA>;
+ close DATA;
+ ok(scalar @match > 0, "Test against CVE-2025-69421 - null parameter, pbmac1");
+ }
+ );
+ }
}
# Test against CVE-2026-22795 , missing ASN1_TYPE validation in cert
unless ($no_fips) {
- for my $file ("BOOLEAN-in-friendlyName-of-cert-pkcs12-sha256mac.p12",
- "BOOLEAN-in-localKeyID-of-cert-pkcs12-sha256mac.p12"
+ SKIP: {
+ skip "Error messages are not compiled in", 2 if $no_err;
+ {
+ for my $file ("BOOLEAN-in-friendlyName-of-cert-pkcs12-sha256mac.p12",
+ "BOOLEAN-in-localKeyID-of-cert-pkcs12-sha256mac.p12"
+ )
+ {
+ my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
+ with({ exit_checker => sub { return shift == 1; } },
+ sub {
+ my @output = run(app(["openssl", "storeutl", "-certs", "-text",
+ "-passin", "pass:RedHatEnterpriseLinux10.0", $path],
+ stderr => "outerr.txt"),
+ capture => 1);
+ open DATA, "outerr.txt";
+ my @match = grep /:PKCS12_parse:parse error:/, <DATA>;
+ close DATA;
+ ok(scalar @match > 0, "Test against CVE-2026-22795 , missing ASN1_TYPE validation in cert, sha256mac");
+ }
+ );
+ }
+ }
+ }
+}
+
+ SKIP: {
+ skip "Error messages are not compiled in", 2 if $no_err;
+ for my $file ("BOOLEAN-in-friendlyName-of-cert-pbmac1.p12",
+ "BOOLEAN-in-localKeyID-of-cert-pbmac1.p12"
)
{
my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
with({ exit_checker => sub { return shift == 1; } },
- sub {
- my @output = run(app(["openssl", "storeutl", "-certs", "-text",
- "-passin", "pass:RedHatEnterpriseLinux10.0", $path]),
- capture => 1, stderr => "outerr.txt");
- open DATA, "outerr.txt";
- my @match = grep /:PKCS12_parse:parse error:/, <DATA>;
- close DATA;
- ok(scalar @match > 0 ? 0 : 1, "Test against CVE-2026-22795 , missing ASN1_TYPE validation in cert, sha256mac");
+ sub {
+ my @output = run(app(["openssl", "storeutl", "-certs", "-text",
+ "-passin", "pass:RedHatEnterpriseLinux10.0", $path],
+ stderr => "outerr.txt"),
+ capture => 1);
+ open DATA, "outerr.txt";
+ my @match = grep /:PKCS12_parse:parse error:/, <DATA>;
+ close DATA;
+ ok(scalar @match > 0, "Test against CVE-2026-22795 , missing ASN1_TYPE validation in cert, pbmac1");
}
);
}
}
-for my $file ("BOOLEAN-in-friendlyName-of-cert-pbmac1.p12",
- "BOOLEAN-in-localKeyID-of-cert-pbmac1.p12"
- )
-{
- my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
- with({ exit_checker => sub { return shift == 1; } },
- sub {
- my @output = run(app(["openssl", "storeutl", "-certs", "-text",
- "-passin", "pass:RedHatEnterpriseLinux10.0", $path]),
- capture => 1, stderr => "outerr.txt");
- open DATA, "outerr.txt";
- my @match = grep /:PKCS12_parse:parse error:/, <DATA>;
- close DATA;
- ok(scalar @match > 0 ? 0 : 1, "Test against CVE-2026-22795 , missing ASN1_TYPE validation in cert, pbmac1");
+# Test against CVE-2026-22795, missing ASN1_TYPE validation in keys
+unless ($no_fips) {
+ SKIP: {
+ skip "Error messages are not compiled in", 2 if $no_err;
+ {
+ for my $file ("BOOLEAN-in-friendlyName-of-key-pkcs12-sha256mac.p12",
+ "BOOLEAN-in-localKeyID-of-key-pkcs12-sha256mac.p12"
+ )
+ {
+ my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
+ with({ exit_checker => sub { return shift == 1; } },
+ sub {
+ my @output = run(app(["openssl", "storeutl", "-keys", "-text",
+ "-passin", "pass:RedHatEnterpriseLinux10.0", $path],
+ stderr => "outerr.txt"),
+ capture => 1);
+ open DATA, "outerr.txt";
+ my @match = grep /:PKCS12_parse:parse error:/, <DATA>;
+ close DATA;
+ ok(scalar @match > 0, "Test against CVE-2026-22795 , missing ASN1_TYPE validation in keys, sha256mac");
+ }
+ );
+ }
}
- );
+ }
}
-# Test against CVE-2026-22795, missing ASN1_TYPE validation in keys
-unless ($no_fips) {
- for my $file ("BOOLEAN-in-friendlyName-of-key-pkcs12-sha256mac.p12",
- "BOOLEAN-in-localKeyID-of-key-pkcs12-sha256mac.p12"
- )
+ SKIP: {
+ skip "Error messages are not compiled in", 2 if $no_err;
{
+ for my $file ("BOOLEAN-in-friendlyName-of-key-pbmac1.p12",
+ "BOOLEAN-in-localKeyID-of-key-pbmac1.p12"
+ )
+ {
my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
with({ exit_checker => sub { return shift == 1; } },
sub {
-
my @output = run(app(["openssl", "storeutl", "-keys", "-text",
- "-passin", "pass:RedHatEnterpriseLinux10.0", $path]),
- capture => 1, stderr => "outerr.txt");
+ "-passin", "pass:RedHatEnterpriseLinux10.0", $path],
+ stderr => "outerr.txt"),
+ capture => 1);
open DATA, "outerr.txt";
my @match = grep /:PKCS12_parse:parse error:/, <DATA>;
close DATA;
- ok(scalar @match > 0 ? 0 : 1, "Test against CVE-2026-22795 , missing ASN1_TYPE validation in keys, sha256mac");
+ ok(scalar @match > 0, "Test against CVE-2026-22795 , missing ASN1_TYPE validation in keys, pbmac1");
}
);
- }
-}
-
-for my $file ("BOOLEAN-in-friendlyName-of-key-pbmac1.p12",
- "BOOLEAN-in-localKeyID-of-key-pbmac1.p12"
- )
-{
- my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
- with({ exit_checker => sub { return shift == 1; } },
- sub {
- my @output = run(app(["openssl", "storeutl", "-keys", "-text",
- "-passin", "pass:RedHatEnterpriseLinux10.0", $path]),
- capture => 1, stderr => "outerr.txt");
- open DATA, "outerr.txt";
- my @match = grep /:PKCS12_parse:parse error:/, <DATA>;
- close DATA;
- ok(scalar @match > 0 ? 0 : 1, "Test against CVE-2026-22795 , missing ASN1_TYPE validation in keys, pbmac1");
}
- );
+ }
}
SetConsoleOutputCP($savedcp) if (defined($savedcp));