Skip to content

Commit 69fd7f8

Browse files
Skip PKCS7 with indefinite length test in AWS-LC
AWS-LC had been decoding the indefinite BER to an unusable output. We should skip the test until indefinite BER decoding in AWS-LC is properly fixed. Changes: 1. AWS-LC will be looking to fix the parsing for indefinite BER constructed strings in AWS-LC soon, so I've marked the test as `pend` for now and removed the AWS-LC specific logic at the end. 2. I've added an assertion to verify that `OpenSSL::PKCS7.verify` behaves correctly before doing content comparisons. I noticed this was failing initially in AWS-LC, but that will be fixed soon as well. This shouldn't effect OpenSSL/LibreSSL builds and should improve the test.
1 parent b4877f8 commit 69fd7f8

File tree

1 file changed

+4
-7
lines changed

1 file changed

+4
-7
lines changed

test/openssl/test_pkcs7.rb

+4-7
Original file line numberDiff line numberDiff line change
@@ -308,6 +308,8 @@ def test_degenerate_pkcs7
308308
end
309309

310310
def test_split_content
311+
pend "AWS-LC ASN.1 parsers has no current support for parsing indefinite BER constructed strings" if aws_lc?
312+
311313
pki_message_pem = <<END
312314
-----BEGIN PKCS7-----
313315
MIIHSwYJKoZIhvcNAQcCoIIHPDCCBzgCAQExCzAJBgUrDgMCGgUAMIIDiAYJKoZI
@@ -376,14 +378,9 @@ def test_split_content
376378
END
377379
pki_msg = OpenSSL::PKCS7.new(pki_message_pem)
378380
store = OpenSSL::X509::Store.new
379-
pki_msg.verify(nil, store, nil, OpenSSL::PKCS7::NOVERIFY)
381+
assert_equal(true, pki_msg.verify(nil, store, nil, OpenSSL::PKCS7::NOVERIFY))
380382
p7enc = OpenSSL::PKCS7.new(pki_msg.data)
381-
# AWS-LC uses explicit OCTET STRING headers when encoding PKCS7 EncryptedContent,
382-
# while OpenSSL traditionally uses indefinite-length encoding (ASN1_TFLG_NDEF)
383-
# in its PKCS7 implementation.
384-
unless aws_lc?
385-
assert_equal(pki_message_content_pem, p7enc.to_pem)
386-
end
383+
assert_equal(pki_message_content_pem, p7enc.to_pem)
387384
end
388385
end
389386

0 commit comments

Comments
 (0)