crypto/x509v3/v3nametest.c

   1 #include <openssl/x509.h>
   2 #include <openssl/x509v3.h>
   3 #include "../e_os.h"
   4 #include <string.h>
   5
   6 static const char *const names[] =
   7         {
   8         "a", "b", ".", "*", "@",
   9         ".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..",
  10         "@@", "**", "*.com", "*com", "*.*.com", "*com", "com*", "*example.com",
  11         "*@example.com", "test@*.example.com", "example.com", "www.example.com",
  12         "test.www.example.com", "*.example.com", "*.www.example.com",
  13         "test.*.example.com", "www.*.com",
  14         ".www.example.com", "*www.example.com",
  15         "example.net", "xn--rger-koa.example.com",
  16         "a.example.com", "b.example.com",
  17         "postmaster@example.com", "Postmaster@example.com",
  18         "postmaster@EXAMPLE.COM",
  19         NULL
  20         };
  21
  22 static const char *const exceptions[] =
  23         {
  24         "set CN: host: [*.example.com] matches [a.example.com]",
  25         "set CN: host: [*.example.com] matches [b.example.com]",
  26         "set CN: host: [*.example.com] matches [www.example.com]",
  27         "set CN: host: [*.example.com] matches [xn--rger-koa.example.com]",
  28         "set CN: host: [*.www.example.com] matches [test.www.example.com]",
  29         "set CN: host: [*.www.example.com] matches [.www.example.com]",
  30         "set CN: host: [*www.example.com] matches [www.example.com]",
  31         "set CN: host: [test.www.example.com] matches [.www.example.com]",
  32         "set CN: host-no-wildcards: [*.www.example.com] matches [.www.example.com]",
  33         "set CN: host-no-wildcards: [test.www.example.com] matches [.www.example.com]",
  34         "set emailAddress: email: [postmaster@example.com] does not match [Postmaster@example.com]",
  35         "set emailAddress: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
  36         "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@example.com]",
  37         "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
  38         "set dnsName: host: [*.example.com] matches [www.example.com]",
  39         "set dnsName: host: [*.example.com] matches [a.example.com]",
  40         "set dnsName: host: [*.example.com] matches [b.example.com]",
  41         "set dnsName: host: [*.example.com] matches [xn--rger-koa.example.com]",
  42         "set dnsName: host: [*.www.example.com] matches [test.www.example.com]",
  43         "set dnsName: host-no-wildcards: [*.www.example.com] matches [.www.example.com]",
  44         "set dnsName: host-no-wildcards: [test.www.example.com] matches [.www.example.com]",
  45         "set dnsName: host: [*.www.example.com] matches [.www.example.com]",
  46         "set dnsName: host: [*www.example.com] matches [www.example.com]",
  47         "set dnsName: host: [test.www.example.com] matches [.www.example.com]",
  48         "set rfc822Name: email: [postmaster@example.com] does not match [Postmaster@example.com]",
  49         "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@example.com]",
  50         "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
  51         "set rfc822Name: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
  52         NULL
  53         };
  54
  55 static int is_exception(const char *msg)
  56         {
  57         const char *const *p;
  58         for (p = exceptions; *p; ++p)
  59                 if (strcmp(msg, *p) == 0)
  60                         return 1;
  61         return 0;
  62         }
  63
  64 static int set_cn(X509 *crt, ...)
  65         {
  66         int ret = 0;
  67         X509_NAME *n = NULL;
  68         va_list ap;
  69         va_start(ap, crt);
  70         n = X509_NAME_new();
  71         if (n == NULL)
  72                 goto out;
  73         while (1) {
  74                 int nid;
  75                 const char *name;
  76                 nid = va_arg(ap, int);
  77                 if (nid == 0)
  78                         break;
  79                 name = va_arg(ap, const char *);
  80                 if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC,
  81                                                         (unsigned char *)name,
  82                                                 -1, -1, 1))
  83                         goto out;
  84         }
  85         if (!X509_set_subject_name(crt, n))
  86                 goto out;
  87         ret = 1;
  88  out:
  89         X509_NAME_free(n);
  90         va_end(ap);
  91         return ret;
  92         }
  93
  94 /*
  95 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
  96 X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
  97                         int nid, int crit, ASN1_OCTET_STRING *data);
  98 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
  99 */
 100
 101 static int set_altname(X509 *crt, ...)
 102         {
 103         int ret = 0;
 104         GENERAL_NAMES *gens = NULL;
 105         GENERAL_NAME *gen = NULL;
 106         ASN1_IA5STRING *ia5 = NULL;
 107         va_list ap;
 108         va_start(ap, crt);
 109         gens = sk_GENERAL_NAME_new_null();
 110         if (gens == NULL)
 111                 goto out;
 112         while (1) {
 113                 int type;
 114                 const char *name;
 115                 type = va_arg(ap, int);
 116                 if (type == 0)
 117                         break;
 118                 name = va_arg(ap, const char *);
 119
 120                 gen = GENERAL_NAME_new();
 121                 if (gen == NULL)
 122                         goto out;
 123                 ia5 = ASN1_IA5STRING_new();
 124                 if (ia5 == NULL)
 125                         goto out;
 126                 if (!ASN1_STRING_set(ia5, name, -1))
 127                         goto out;
 128                 switch (type)
 129                         {
 130                         case GEN_EMAIL:
 131                         case GEN_DNS:
 132                                 GENERAL_NAME_set0_value(gen, type, ia5);
 133                                 ia5 = NULL;
 134                                 break;
 135                         default:
 136                                 abort();
 137                         }
 138                 sk_GENERAL_NAME_push(gens, gen);
 139                 gen = NULL;
 140         }
 141         if (!X509_add1_ext_i2d(crt, NID_subject_alt_name, gens, 0, 0))
 142                 goto out;
 143         ret = 1;
 144  out:
 145         ASN1_IA5STRING_free(ia5);
 146         GENERAL_NAME_free(gen);
 147         GENERAL_NAMES_free(gens);
 148         va_end(ap);
 149         return ret;
 150         }
 151
 152 static int set_cn1(X509 *crt, const char *name)
 153         {
 154         return set_cn(crt, NID_commonName, name, 0);
 155         }
 156
 157
 158 static int set_cn_and_email(X509 *crt, const char *name)
 159         {
 160         return set_cn(crt, NID_commonName, name,
 161                       NID_pkcs9_emailAddress, "dummy@example.com", 0);
 162         }
 163
 164 static int set_cn2(X509 *crt, const char *name)
 165         {
 166         return set_cn(crt, NID_commonName, "dummy value",
 167                       NID_commonName, name, 0);
 168         }
 169
 170 static int set_cn3(X509 *crt, const char *name)
 171         {
 172         return set_cn(crt, NID_commonName, name,
 173                       NID_commonName, "dummy value", 0);
 174         }
 175
 176 static int set_email1(X509 *crt, const char *name)
 177         {
 178         return set_cn(crt, NID_pkcs9_emailAddress, name, 0);
 179         }
 180
 181 static int set_email2(X509 *crt, const char *name)
 182         {
 183         return set_cn(crt, NID_pkcs9_emailAddress, "dummy@example.com",
 184                       NID_pkcs9_emailAddress, name, 0);
 185         }
 186
 187 static int set_email3(X509 *crt, const char *name)
 188         {
 189         return set_cn(crt, NID_pkcs9_emailAddress, name,
 190                       NID_pkcs9_emailAddress, "dummy@example.com", 0);
 191         }
 192
 193 static int set_email_and_cn(X509 *crt, const char *name)
 194         {
 195         return set_cn(crt, NID_pkcs9_emailAddress, name,
 196                       NID_commonName, "www.example.org", 0);
 197         }
 198
 199 static int set_altname_dns(X509 *crt, const char *name)
 200         {
 201         return set_altname(crt, GEN_DNS, name, 0);
 202         }
 203
 204 static int set_altname_email(X509 *crt, const char *name)
 205         {
 206         return set_altname(crt, GEN_EMAIL, name, 0);
 207         }
 208
 209 struct set_name_fn
 210         {
 211         int (*fn)(X509 *, const char *);
 212         const char *name;
 213         int host;
 214         int email;
 215         };
 216
 217 static const struct set_name_fn name_fns[] =
 218         {
 219         {set_cn1, "set CN", 1, 0},
 220         {set_cn2, "set CN", 1, 0},
 221         {set_cn3, "set CN", 1, 0},
 222         {set_cn_and_email, "set CN", 1, 0},
 223         {set_email1, "set emailAddress", 0, 1},
 224         {set_email2, "set emailAddress", 0, 1},
 225         {set_email3, "set emailAddress", 0, 1},
 226         {set_email_and_cn, "set emailAddress", 0, 1},
 227         {set_altname_dns, "set dnsName", 1, 0},
 228         {set_altname_email, "set rfc822Name", 0, 1},
 229         {NULL, NULL, 0}
 230         };
 231
 232 static X509 *make_cert()
 233         {
 234         X509 *ret = NULL;
 235         X509 *crt = NULL;
 236         X509_NAME *issuer = NULL;
 237         crt = X509_new();
 238         if (crt == NULL)
 239                 goto out;
 240         if (!X509_set_version(crt, 3))
 241                 goto out;
 242         ret = crt;
 243         crt = NULL;
 244  out:
 245         X509_NAME_free(issuer);
 246         return ret;
 247         }
 248
 249 static int errors;
 250
 251 static void check_message(const struct set_name_fn *fn, const char *op,
 252                           const char *nameincert, int match, const char *name)
 253         {
 254         char msg[1024];
 255         if (match < 0)
 256                 return;
 257         BIO_snprintf(msg, sizeof(msg), "%s: %s: [%s] %s [%s]",
 258                  fn->name, op, nameincert,
 259                  match ? "matches" : "does not match", name);
 260         if (is_exception(msg))
 261                 return;
 262         puts(msg);
 263         ++errors;
 264         }
 265
 266 static void run_cert(X509 *crt, const char *nameincert,
 267                      const struct set_name_fn *fn)
 268         {
 269         const char *const *pname = names;
 270         while (*pname)
 271                 {
 272                 int samename = strcasecmp(nameincert, *pname) == 0;
 273                 size_t namelen = strlen(*pname);
 274                 char *name = malloc(namelen);
 275                 int match, ret;
 276                 memcpy(name, *pname, namelen);
 277
 278                 ret = X509_check_host(crt, (const unsigned char *)name,
 279                                       namelen, 0);
 280                 match = -1;
 281                 if (ret < 0)
 282                         {
 283                         fprintf(stderr, "internal error in X509_check_host");
 284                         ++errors;
 285                         }
 286                 else if (fn->host)
 287                         {
 288                         if (ret == 1 && !samename)
 289                                 match = 1;
 290                         if (ret == 0 && samename)
 291                                 match = 0;
 292                         }
 293                 else if (ret == 1)
 294                         match = 1;
 295                 check_message(fn, "host", nameincert, match, *pname);
 296
 297                 ret = X509_check_host(crt, (const unsigned char *)name,
 298                                       namelen, X509_CHECK_FLAG_NO_WILDCARDS);
 299                 match = -1;
 300                 if (ret < 0)
 301                         {
 302                         fprintf(stderr, "internal error in X509_check_host");
 303                         ++errors;
 304                         }
 305                 else if (fn->host)
 306                         {
 307                         if (ret == 1 && !samename)
 308                                 match = 1;
 309                         if (ret == 0 && samename)
 310                                 match = 0;
 311                         }
 312                 else if (ret == 1)
 313                         match = 1;
 314                 check_message(fn, "host-no-wildcards",
 315                               nameincert, match, *pname);
 316
 317                 ret = X509_check_email(crt, (const unsigned char *)name,
 318                                        namelen, 0);
 319                 match = -1;
 320                 if (fn->email)
 321                         {
 322                         if (ret && !samename)
 323                                 match = 1;
 324                         if (!ret && samename && strchr(nameincert, '@') != NULL)
 325                                 match = 0;
 326                         }
 327                 else if (ret)
 328                         match = 1;
 329                 check_message(fn, "email", nameincert, match, *pname);
 330                 ++pname;
 331                 free(name);
 332                 }
 333         }
 334
 335 int
 336 main(void)
 337         {
 338         const struct set_name_fn *pfn = name_fns;
 339         while (pfn->name) {
 340                 const char *const *pname = names;
 341                 while (*pname)
 342                         {
 343                         X509 *crt = make_cert();
 344                         if (crt == NULL)
 345                                 {
 346                                 fprintf(stderr, "make_cert failed\n");
 347                                 return 1;
 348                                 }
 349                         if (!pfn->fn(crt, *pname))
 350                                 {
 351                                 fprintf(stderr, "X509 name setting failed\n");
 352                                 return 1;
 353                                 }
 354                         run_cert(crt, *pname, pfn);
 355                         X509_free(crt);
 356                         ++pname;
 357                         }
 358                 ++pfn;
 359         }
 360         return errors > 0 ? 1 : 0;
 361         }