Land #1341 - wire up libssl verify test

15 files changed, 213 insertions, 5 deletions

diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 2addcec..bd4c9a7 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -22,6 +22,12 @@ jobs:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: "Install test dependencies"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libio-socket-ssl-perl
+          perl -MIO::Socket::SSL::Utils -e 1
+
       - name: "Setup emsdk"
         uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
         with:
@@ -50,6 +56,12 @@ jobs:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: "Install test dependencies"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libio-socket-ssl-perl
+          perl -MIO::Socket::SSL::Utils -e 1
+
       - name: "Setup emsdk"
         uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
         with:
diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml
index 1283c4a..078bc02 100644
--- a/.github/workflows/fedora-rawhide.yml
+++ b/.github/workflows/fedora-rawhide.yml
@@ -26,7 +26,8 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install dependencies
       run: |
-        dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk
+        dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk perl-IO-Socket-SSL
+        perl -MIO::Socket::SSL::Utils -e 1
     - name: Pull upstream source
       run: |
         ./update.sh
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 64de243..4e38efd 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -36,8 +36,9 @@ jobs:
           release: "${{ env.FREEBSD_VERSION }}"
           copyback: false
           prepare: |
-            pkg install -y autoconf automake libtool
+            pkg install -y autoconf automake libtool p5-IO-Socket-SSL
           run: |
+            perl -MIO::Socket::SSL::Utils -e 1
             ./configure
             make -j2 check || (cat tests/test-suite.log && exit 1)
 
@@ -63,8 +64,9 @@ jobs:
           release: "${{ env.FREEBSD_VERSION }}"
           copyback: false
           prepare: |
-            pkg install -y cmake ninja perl5
+            pkg install -y cmake ninja p5-IO-Socket-SSL
           run: |
+            perl -MIO::Socket::SSL::Utils -e 1
             export CTEST_OUTPUT_ON_FAILURE=1
             cmake -G Ninja -B build
             ninja -C build
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index a44df9d..197e894 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -46,6 +46,12 @@ jobs:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: "Install test dependencies"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libio-socket-ssl-perl
+          perl -MIO::Socket::SSL::Utils -e 1
+
       - name: "Run tests"
         run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status)
         env:
@@ -68,6 +74,12 @@ jobs:
       - name: "Checkout repository"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: "Install test dependencies"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libio-socket-ssl-perl
+          perl -MIO::Socket::SSL::Utils -e 1
+
       - name: "Run tests"
         run: ./scripts/test
         env:
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 9b9d5e4..c619b17 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -25,7 +25,12 @@ jobs:
         arch: ["arm64", "x86_64"]
     steps:
     - name: "Install required packages"
-      run: brew install automake libtool
+      run: |
+        brew install automake libtool perl cpanminus
+        PERL="$(brew --prefix perl)/bin/perl"
+        "$PERL" "$(command -v cpanm)" --notest IO::Socket::SSL
+        echo "$(brew --prefix perl)/bin" >> "$GITHUB_PATH"
+        "$PERL" -MIO::Socket::SSL::Utils -e 1
 
     - name: "Checkout repository"
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml
index 24c4056..0e50f5f 100644
--- a/.github/workflows/solaris.yml
+++ b/.github/workflows/solaris.yml
@@ -32,6 +32,8 @@ jobs:
         with:
           prepare: |
             pkg install gcc make
+            PERL_MM_USE_DEFAULT=1 cpan -T IO::Socket::SSL
           run: |
+            perl -MIO::Socket::SSL::Utils -e 1
             MAKE=gmake ./configure
             gmake -j2 check || (cat tests/test-suite.log && exit 1)
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 0cd342e..4814ffa 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -29,6 +29,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: "Setup MSYS2"
+        id: msys2
         uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
         with:
           update: true
@@ -38,6 +39,7 @@ jobs:
             git
             patch
             perl
+            perl-IO-Socket-SSL
 
       - name: "Update"
         shell: msys2 {0}
@@ -46,6 +48,11 @@ jobs:
       - name: "Configure CMake"
         shell: pwsh
         run: |
+          $perl = Join-Path '${{ steps.msys2.outputs.msys2-location }}' 'usr\bin\perl.exe'
+          & $perl -MIO::Socket::SSL::Utils -e 1
+          if ($LASTEXITCODE -ne 0) {
+            throw "IO::Socket::SSL::Utils is unavailable"
+          }
           $generator = cmake --help |
             Select-String '^\s*\*?\s*(Visual Studio \d+ \d+)' |
             Select-Object -First 1 |
@@ -54,7 +61,7 @@ jobs:
             throw "No Visual Studio CMake generator found"
           }
           Write-Host "Using generator: $generator"
-          cmake -Bbuild -G "$generator" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local
+          cmake -Bbuild -G "$generator" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local "-DPERL_EXECUTABLE=$perl"
 
       - name: "Build"
         shell: cmd
diff --git a/.gitignore b/.gitignore
index 8a72400..d85df81 100644
--- a/.gitignore
+++ b/.gitignore
@@ -141,10 +141,12 @@ tests/*test.c
 tests/pbkdf2*
 tests/*.pem
 tests/certs/
+tests/create-libressl-test-certs.pl
 tests/make-dir-roots.pl
 tests/testssl
 tests/*.txt
 tests/compat/*.c
+tests/ssl_verify.c
 tests/verify*
 tests/x509_verify*
 !tests/x509_verify.sh
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 699603b..4ffe67b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -33,6 +33,15 @@ include(GNUInstallDirs)
 
 enable_testing()
 find_program(PERL_EXECUTABLE perl perl5)
+set(HAVE_PERL_IO_SOCKET_SSL_UTILS FALSE)
+if(PERL_EXECUTABLE)
+        execute_process(COMMAND ${PERL_EXECUTABLE} -MIO::Socket::SSL::Utils -e 1
+            RESULT_VARIABLE PERL_IO_SOCKET_SSL_UTILS_RESULT
+            OUTPUT_QUIET ERROR_QUIET)
+        if(PERL_IO_SOCKET_SSL_UTILS_RESULT EQUAL 0)
+                set(HAVE_PERL_IO_SOCKET_SSL_UTILS TRUE)
+        endif()
+endif()
 
 file(READ ${CMAKE_CURRENT_SOURCE_DIR}/ssl/VERSION SSL_VERSION)
 string(STRIP ${SSL_VERSION} SSL_VERSION)
diff --git a/configure.ac b/configure.ac
index 9012535..23f0c38 100644
--- a/configure.ac
+++ b/configure.ac
@@ -34,6 +34,17 @@ LT_INIT([pic-only])
 
 AC_CHECK_PROGS([PERL], [perl perl5])
 AM_CONDITIONAL([HAVE_PERL], [test "x$PERL" != x])
+AC_CACHE_CHECK([for IO::Socket::SSL::Utils],
+        [ac_cv_perl_io_socket_ssl_utils],
+        [if test "x$PERL" = x; then
+                ac_cv_perl_io_socket_ssl_utils=no
+        elif "$PERL" -MIO::Socket::SSL::Utils -e 1 >/dev/null 2>&1; then
+                ac_cv_perl_io_socket_ssl_utils=yes
+        else
+                ac_cv_perl_io_socket_ssl_utils=no
+        fi])
+AM_CONDITIONAL([HAVE_PERL_IO_SOCKET_SSL_UTILS],
+        [test "x$ac_cv_perl_io_socket_ssl_utils" = xyes])
 
 CHECK_OS_OPTIONS
 
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index ede7463..92588cc 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -844,6 +844,25 @@ add_executable(ssl_verify_param ssl_verify_param.c)
 target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS})
 add_platform_test(ssl_verify_param ssl_verify_param)
 
+# ssl_verify
+add_executable(ssl_verify ssl_verify.c)
+target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(ssl_verify)
+if(HAVE_PERL_IO_SOCKET_SSL_UTILS)
+        if(WIN32)
+                add_test(NAME ssl_verify COMMAND
+                    ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.bat
+                    $<TARGET_FILE:ssl_verify>)
+        else()
+                add_test(NAME ssl_verify COMMAND
+                    ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh
+                    $<TARGET_FILE:ssl_verify>)
+        endif()
+        set_tests_properties(ssl_verify PROPERTIES
+            ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
+            WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+endif()
+
 # ssl_versions
 add_executable(ssl_versions ssl_versions.c)
 target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS})
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 9b58724..9d30359 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -104,6 +104,7 @@ EXTRA_DIST = CMakeLists.txt
 DISTCLEANFILES = pidwraptest.txt
 
 distclean-local:
+        rm -rf ssl_verify-certs
         rm -rf x509_verify-certs
 
 # XXX - should probably be in their own static lib
@@ -855,6 +856,16 @@ TESTS += ssl_verify_param
 check_PROGRAMS += ssl_verify_param
 ssl_verify_param_SOURCES = ssl_verify_param.c
 
+# ssl_verify
+if HAVE_PERL_IO_SOCKET_SSL_UTILS
+TESTS += ssl_verify.sh
+check_PROGRAMS += ssl_verify
+endif
+ssl_verify_SOURCES = ssl_verify.c
+EXTRA_DIST += ssl_verify.sh
+EXTRA_DIST += ssl_verify.bat
+EXTRA_DIST += create-libressl-test-certs.pl
+
 # ssl_versions
 TESTS += ssl_versions
 check_PROGRAMS += ssl_versions
diff --git a/tests/ssl_verify.bat b/tests/ssl_verify.bat
new file mode 100644
index 0000000..1b8c1dc
--- /dev/null
+++ b/tests/ssl_verify.bat
@@ -0,0 +1,42 @@
+@echo off

+setlocal

+

+:: Copyright (c) 2026 Kenjiro Nakayama

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+if "%~1" == "" exit /b 1

+

+set "ssl_verify_bin=%~1"

+set "ssl_verify_bin=%ssl_verify_bin:/=\%"

+if not exist "%ssl_verify_bin%" exit /b 1

+

+if not defined srcdir set "srcdir=."

+if not defined PERL set "PERL=perl"

+

+set "workdir=ssl_verify-certs"

+if exist "%workdir%" rmdir /s /q "%workdir%"

+mkdir "%workdir%" || exit /b 1

+pushd "%workdir%" || exit /b 1

+

+set "status=1"

+"%PERL%" "%srcdir%/create-libressl-test-certs.pl"

+if errorlevel 1 goto cleanup

+

+"%ssl_verify_bin%"

+set "status=%errorlevel%"

+

+:cleanup

+popd

+rmdir /s /q "%workdir%"

+exit /b %status%

diff --git a/tests/ssl_verify.sh b/tests/ssl_verify.sh
new file mode 100755
index 0000000..bb090db
--- /dev/null
+++ b/tests/ssl_verify.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+#
+# Copyright (c) 2026 Kenjiro Nakayama
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+if [ -z "$srcdir" ]; then
+        srcdir=.
+fi
+
+if [ -z "$PERL" ]; then
+        PERL=perl
+fi
+
+case "$srcdir" in
+/*)
+        create_certs="$srcdir/create-libressl-test-certs.pl"
+        ;;
+*)
+        create_certs="`pwd`/$srcdir/create-libressl-test-certs.pl"
+        ;;
+esac
+
+if [ $# -ge 1 ]; then
+        verify_bin=$1
+else
+        verify_bin="`pwd`/ssl_verify"
+        if [ -e ./ssl_verify.exe ]; then
+                verify_bin="`pwd`/ssl_verify.exe"
+        fi
+fi
+
+workdir=ssl_verify-certs
+
+cleanup()
+{
+        rm -rf "$workdir"
+}
+trap cleanup EXIT
+
+rm -rf "$workdir"
+mkdir "$workdir"
+
+(
+        cd "$workdir"
+        "$PERL" "$create_certs"
+        case "$verify_bin" in
+        *.js)
+                node "$verify_bin"
+                ;;
+        *)
+                "$verify_bin"
+                ;;
+        esac
+)
diff --git a/update.sh b/update.sh
index a6d0ebd..83864d3 100755
--- a/update.sh
+++ b/update.sh
@@ -336,6 +336,8 @@ for i in `find $libcrypto_regress -name '*.[ch]'`; do
 done
 # x509/verify.c collides with x509/bettertls/verify.c when flattened.
 $CP $libcrypto_regress/x509/verify.c tests/x509_verify.c
+# Do not copy x509/bettertls/verify.c: it requires the large bettertls
+# certificate corpus, which is not worth bundling in release tarballs.
 $CP $libcrypto_regress/evp/evptests.txt tests
 $CP $libcrypto_regress/aead/*.txt tests
 $CP $libcrypto_regress/ct/ctlog.conf tests
@@ -371,6 +373,10 @@ for i in `find $libssl_regress -name '*.c'`; do
 done
 # tls/tlstest.c collides with libtls/tls/tlstest.c when flattened.
 $CP $libssl_regress/tls/tlstest.c tests/ssl_tlstest.c
+# verify/verify.c collides with other verify tests when flattened.
+rm -f tests/verify.c
+$CP $libssl_regress/verify/verify.c tests/ssl_verify.c
+$CP $libssl_regress/verify/create-libressl-test-certs.pl tests
 $CP $libssl_regress/unit/tests.h tests
 $CP $libssl_regress/certs/*.pem tests
 $CP $libssl_regress/certs/*.crl tests