Update tests for OpenSSL 4.0 compatibility

* add workaround for fedora disabled SHA-1 policy

IB-8759

Signed-off-by: Raul Metsma <raul@metsma.ee>

Author: metsma

.github/workflows/build.yml

@@ -64,7 +64,8 @@ jobs:
         sudo ln -s $PWD/cache/* /Library/
         cmake --preset ${{ matrix.target }} -DCMAKE_BUILD_TYPE=RelWithDebInfo
         cmake --build --preset ${{ matrix.target }}
-        cmake --build --preset ${{ matrix.target }} --target test pkcs11sign embedlibs
+        ctest --preset ${{ matrix.target }}
+        cmake --build --preset ${{ matrix.target }} --target pkcs11sign embedlibs
         cmake --build --preset ${{ matrix.target }} --target zipdebug pkgbuild
     - name: Build ${{ matrix.target }}
       if: matrix.target != 'macos'
@@ -86,7 +87,7 @@ jobs:
         test -n "$UDID" || { echo "no available simulator"; exit 1; }
         xcrun simctl boot "$UDID"
         xcrun simctl bootstatus "$UDID" -b
-        ctest --preset iphonesimulator --no-tests=error
+        ctest --preset iphonesimulator
     - name: Archive artifacts
       uses: actions/upload-artifact@v7
       with:
@@ -134,35 +135,38 @@ jobs:
   fedora:
     name: Build on Fedora ${{ matrix.container }}
     runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.container == 'rawhide' }}
     container: fedora:${{ matrix.container }}
     strategy:
       matrix:
-        container: [43, 44, rawhide]
+        container: [43, 44, 45, rawhide]
     steps:
     - name: Install Deps
       run: |
         dnf install -y --setopt=install_weak_deps=False \
-          ${FEDORA_DEPS} doxygen boost-test swig python3-devel java-25-openjdk-devel rpm-build
+          ${FEDORA_DEPS} ninja-build doxygen boost-devel swig python3-devel java-25-openjdk-devel rpm-build
     - name: Checkout
       uses: actions/checkout@v6
     - name: Build
       run: |
-        cmake -DCMAKE_INSTALL_SYSCONFDIR=/etc -B build -S .
-        cmake --build build
-        cmake --build build --target package
+        cmake --preset default -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_SYSCONFDIR=/etc
+        cmake --build --preset default
+        cmake --build --preset default --target package
+    - name: Test
+      run: ctest --preset default
     - name: Archive artifacts
       uses: actions/upload-artifact@v7
       with:
         name: fedora_${{ matrix.container }}
-        path: build/*.rpm
+        path: build/default/*.rpm
   ubuntu:
     name: Build on ${{ matrix.dist }} ${{ matrix.ver }} ${{ matrix.arch }}
     runs-on: ubuntu-24.04${{ matrix.arch == 'arm64' && '-arm' || '' }}
     container: ${{ matrix.dist }}:${{ matrix.ver }}
     strategy:
       matrix:
         dist: [ubuntu]
-        ver: ['22.04', '24.04', '26.04']
+        ver: ['22.04', '24.04', '26.04', '26.10']
         arch: [amd64, arm64]
         java: [17]
         include: [

CMakePresets.json

@@ -47,6 +47,7 @@
       "cacheVariables": {
         "CMAKE_DISABLE_FIND_PACKAGE_Boost": "YES",
         "CMAKE_DISABLE_FIND_PACKAGE_Doxygen": "YES",
+        "CMAKE_FIND_ROOT_PATH": null,
         "BUILD_TOOLS": "NO",
         "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake"
       }
@@ -134,6 +135,11 @@
       "name": "windows",
       "displayName": "Windows",
       "inherits": "base",
+      "condition": {
+        "type": "equals",
+        "lhs": "${hostSystemName}",
+        "rhs": "Windows"
+      },
       "environment": {
         "BUILD_SUFFIX": "-$env{PLATFORM}"
       },
@@ -156,6 +162,10 @@
     }
   ],
   "buildPresets": [
+    {
+      "name": "default",
+      "configurePreset": "default"
+    },
     {
       "name": "macos",
       "configurePreset": "macos"
@@ -197,25 +207,30 @@
   "testPresets":
   [
     {
-      "name": "base",
-      "hidden": true,
+      "name": "default",
+      "configurePreset": "default",
       "output": {
         "outputOnFailure": true
       },
       "execution": {
         "noTestsAction": "error"
       }
     },
+    {
+      "name": "macos",
+      "configurePreset": "macos",
+      "inherits": "default"
+    },
     {
       "name": "iphonesimulator",
       "configurePreset": "iphonesimulator",
-      "inherits": "base"
+      "inherits": "default"
     },
     {
       "name": "windows-static",
       "configurePreset": "windows-static",
       "configuration": "RelWithDebInfo",
-      "inherits": "base"
+      "inherits": "default"
     }
   ]
 }

debian/rules

@@ -1,5 +1,4 @@
 #!/usr/bin/make -f
-DEB_MAKE_CHECK_TARGET = test
 
 %:
 	dh $@

src/Exports.h

@@ -33,25 +33,10 @@
   #else
     #define DIGIDOCPP_DEPRECATED
   #endif
-  #define DIGIDOCPP_WARNING_PUSH __pragma(warning(push))
-  #define DIGIDOCPP_WARNING_POP __pragma(warning(pop))
-  #define DIGIDOCPP_WARNING_DISABLE_CLANG(text)
-  #define DIGIDOCPP_WARNING_DISABLE_GCC(text)
-  #define DIGIDOCPP_WARNING_DISABLE_MSVC(number) __pragma(warning(disable: number))
   #pragma warning( disable: 4251 ) // shut up std::vector warnings
 #else
   #define DIGIDOCPP_EXPORT __attribute__ ((visibility("default")))
   #define DIGIDOCPP_DEPRECATED __attribute__ ((__deprecated__))
-  #define DIGIDOCPP_DO_PRAGMA(text) _Pragma(#text)
-  #define DIGIDOCPP_WARNING_PUSH DIGIDOCPP_DO_PRAGMA(GCC diagnostic push)
-  #define DIGIDOCPP_WARNING_POP DIGIDOCPP_DO_PRAGMA(GCC diagnostic pop)
-  #if __clang__
-  #define DIGIDOCPP_WARNING_DISABLE_CLANG(text) DIGIDOCPP_DO_PRAGMA(clang diagnostic ignored text)
-  #else
-  #define DIGIDOCPP_WARNING_DISABLE_CLANG(text)
-  #endif
-  #define DIGIDOCPP_WARNING_DISABLE_GCC(text) DIGIDOCPP_DO_PRAGMA(GCC diagnostic ignored text)
-  #define DIGIDOCPP_WARNING_DISABLE_MSVC(text)
 #endif
 
 #define DISABLE_COPY(Class) \

src/crypto/OCSP.cpp

@@ -216,7 +216,27 @@ void OCSP::verifyResponse(const X509Cert &cert, const vector<X509Cert> &untruste
     }
     auto store = X509CertStore::createStore(X509CertStore::OCSP, tm);
     ERR_clear_error();
-    if(OCSP_basic_verify(basic.get(), stack.get(), store.get(), OCSP_NOCHECKS | OCSP_PARTIAL_CHAIN) != 1)
+    int verified = OCSP_basic_verify(basic.get(), stack.get(), store.get(), OCSP_NOCHECKS | OCSP_PARTIAL_CHAIN);
+    if(verified != 1)
+    {
+        const ASN1_OBJECT *algorithm {};
+        X509_ALGOR_get0(&algorithm, nullptr, nullptr, OCSP_resp_get0_tbs_sigalg(basic.get()));
+        int digest = NID_undef;
+        X509 *signer {};
+        if(OBJ_find_sigid_algs(OBJ_obj2nid(algorithm), &digest, nullptr) == 1 && digest == NID_sha1 &&
+           OCSP_resp_get0_signer(basic.get(), &signer, stack.get()) == 1 && signer)
+        {
+            // OCSP_basic_verify uses the responder certificate's context. External
+            // certificates take precedence over certificates embedded in the response.
+            auto local = X509CertStore::legacyCertificate(signer);
+            if(local && sk_X509_insert(stack.get(), local.get(), 0) != 0)
+            {
+                verified = OCSP_basic_verify(basic.get(), stack.get(), store.get(), OCSP_NOCHECKS | OCSP_PARTIAL_CHAIN);
+                sk_X509_delete(stack.get(), 0);
+            }
+        }
+    }
+    if(verified != 1)
     {
         unsigned long err = ERR_get_error();
         if(ERR_GET_LIB(err) == ERR_LIB_OCSP &&

src/crypto/X509CertStore.cpp

@@ -32,6 +32,10 @@
 #include <openssl/ssl.h>
 #include <openssl/x509v3.h>
 
+#ifndef _WIN32
+#include <dlfcn.h>
+#endif
+
 using namespace digidoc;
 using namespace std;
 
@@ -166,6 +170,38 @@ unique_free_t<X509_STORE> X509CertStore::createStore(const Type &type, tm &tm)
     return store;
 }
 
+unique_free_t<X509> X509CertStore::legacyCertificate(X509 *cert)
+{
+#ifndef _WIN32
+    // Fedora/RHEL can disable SHA-1 even for historical certificate and OCSP signatures.
+    // Keep that exception in a private context, leaving the caller's policy intact.
+    static const auto context = [] {
+        auto ctx = make_unique_ptr<OSSL_LIB_CTX_free>(nullptr);
+        auto *allow = reinterpret_cast<int(*)(void*, int, int)>(
+            dlsym(RTLD_DEFAULT, "ossl_ctx_legacy_digest_signatures_allowed_set"));
+        if(!allow)
+            return ctx;
+        ctx.reset(OSSL_LIB_CTX_new());
+        if(!ctx || OSSL_LIB_CTX_load_config(ctx.get(), nullptr) != 1 || allow(ctx.get(), 1, 0) != 1)
+        {
+            WARN("Failed to enable legacy certificate verification in private OpenSSL context");
+            ctx.reset();
+        }
+        return ctx;
+    }();
+    if(context)
+    {
+        ERR_clear_error();
+        auto der = i2d<i2d_X509>(cert);
+        X509 *local = X509_new_ex(context.get(), nullptr);
+        // d2i_X509 frees local and sets it to nullptr on failure.
+        if(const unsigned char *data = der.data(); local && d2i_X509(&local, &data, long(der.size())))
+            return {local, X509_free};
+    }
+#endif
+    return {nullptr, X509_free};
+}
+
 int X509CertStore::validate(int ok, X509_STORE_CTX *ctx)
 {
     switch(X509_STORE_CTX_get_error(ctx))
@@ -201,9 +237,21 @@ int X509CertStore::validate(int ok, X509_STORE_CTX *ctx)
                 if(none_of(s.certs, [&](const X509Cert &issuer) {
                         if(issuer == x509) // certificate is listed by service
                             return true;
-                        if(X509_check_issued(issuer.handle(), x509) == X509_V_OK && // certificate is issued by service (function checks only issuer name)
-                            X509_verify(x509, X509_get0_pubkey(issuer.handle())) == 1) // certificate is signed by service
-                            return true;
+                        if(X509_check_issued(issuer.handle(), x509) == X509_V_OK) // certificate is issued by service (function checks only issuer name)
+                        {
+                            auto *key = X509_get0_pubkey(issuer.handle());
+                            if(X509_verify(x509, key) == 1) // certificate is signed by service
+                                return true;
+#ifndef _WIN32
+                            if(int digest = NID_undef;
+                               OBJ_find_sigid_algs(X509_get_signature_nid(x509), &digest, nullptr) == 1 && digest == NID_sha1)
+                            {
+                                // X509_verify uses the context of the certificate, not X509_STORE_CTX.
+                                if(auto local = legacyCertificate(x509); local && X509_verify(local.get(), key) == 1)
+                                    return true;
+                            }
+#endif
+                        }
                         ERR_clear_error();
                         return false;
                     })) // certificate is trusted by service

src/crypto/X509CertStore.h

@@ -30,6 +30,7 @@
 
 using X509_STORE = struct x509_store_st;
 using X509_STORE_CTX = struct x509_store_ctx_st;
+using X509 = struct x509_st;
 
 namespace digidoc
 {
@@ -50,6 +51,7 @@ namespace digidoc
         X509Cert findIssuer(const X509Cert &cert, const Type &type) const;
         static X509Cert issuerFromAIA(const X509Cert &cert);
         static unique_free_t<X509_STORE> createStore(const Type &type, tm &tm);
+        static unique_free_t<X509> legacyCertificate(X509 *cert);
         void update() const;
         bool verify(const X509Cert &cert, bool noqscd, tm validation_time, const std::vector<X509Cert> &untrusted) const;
 

src/util/log.h

@@ -54,3 +54,22 @@ namespace digidoc
 #define EXCEPTION_ADD(_main, ...) _main.addCause(digidoc::Exception(EXCEPTION_PARAMS(__VA_ARGS__)))
 #define THROW(...) throw digidoc::Exception(EXCEPTION_PARAMS(__VA_ARGS__))
 #define THROW_CAUSE(_cause, ...) throw digidoc::Exception(EXCEPTION_PARAMS(__VA_ARGS__), _cause)
+
+#ifdef WIN32
+#define DIGIDOCPP_WARNING_PUSH __pragma(warning(push))
+#define DIGIDOCPP_WARNING_POP __pragma(warning(pop))
+#define DIGIDOCPP_WARNING_DISABLE_CLANG(text)
+#define DIGIDOCPP_WARNING_DISABLE_GCC(text)
+#define DIGIDOCPP_WARNING_DISABLE_MSVC(number) __pragma(warning(disable: number))
+#else
+#define DIGIDOCPP_DO_PRAGMA(text) _Pragma(#text)
+#define DIGIDOCPP_WARNING_PUSH DIGIDOCPP_DO_PRAGMA(GCC diagnostic push)
+#define DIGIDOCPP_WARNING_POP DIGIDOCPP_DO_PRAGMA(GCC diagnostic pop)
+#if __clang__
+#define DIGIDOCPP_WARNING_DISABLE_CLANG(text) DIGIDOCPP_DO_PRAGMA(clang diagnostic ignored text)
+#else
+#define DIGIDOCPP_WARNING_DISABLE_CLANG(text)
+#endif
+#define DIGIDOCPP_WARNING_DISABLE_GCC(text) DIGIDOCPP_DO_PRAGMA(GCC diagnostic ignored text)
+#define DIGIDOCPP_WARNING_DISABLE_MSVC(text)
+#endif

test/CMakeLists.txt

@@ -1,4 +1,3 @@
-set_env(TEST_FORMAT XML CACHE STRING "Test result format (XML/JUNIT)")
 set( CMAKE_SKIP_RPATH OFF )
 add_definitions(
     -DDIGIDOCPPCONF="${PROJECT_SOURCE_DIR}/etc/schema"
@@ -10,11 +9,10 @@ add_executable(TSLTests TSLTests.cpp)
 target_link_libraries(unittests digidocpp digidocpp_tsl Boost::unit_test_framework)
 target_link_libraries(TSLTests digidocpp digidocpp_util Boost::unit_test_framework)
 if(WIN32)
-    string(REPLACE "/EHsc" "/EHa" CMAKE_CXX_FLAGS ${CMAKE_CXX_FLAGS})
     set_target_properties(unittests TSLTests PROPERTIES COMPILE_FLAGS "/bigobj")
 endif()
-add_test(NAME runtest
-    COMMAND unittests --build_info=YES --report_level=no --logger=${TEST_FORMAT},all,$<TARGET_FILE_DIR:unittests>/libdigidocpp.xml -- ${CMAKE_CURRENT_SOURCE_DIR}/data
+add_test(NAME unittests
+    COMMAND unittests --build_info=YES --report_level=no -- ${CMAKE_CURRENT_SOURCE_DIR}/data
     WORKING_DIRECTORY $<TARGET_FILE_DIR:digidocpp>
 )
 
@@ -42,5 +40,3 @@ foreach(TEST CA-withdrawn-granted-before CA-noqscd-granted-before
         WORKING_DIRECTORY $<TARGET_FILE_DIR:digidocpp>
     )
 endforeach()
-
-add_custom_target(check COMMAND ${CMAKE_CTEST_COMMAND} -C $<CONFIG> DEPENDS unittests TSLTests)