crypto/x509v3/v3nametest.c

   1 #include <openssl/x509.h>
   2 #include <openssl/x509v3.h>
   3 #include "../e_os.h"
   4 #include <string.h>
   5
   6 static const char *const names[] =
   7         {
   8         "a", "b", ".", "*", "@",
   9         ".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..",
  10         "@@", "**",
  11         "*.com", "*com", "*.*.com", "*com", "com*", "*example.com",
  12         "*@example.com", "test@*.example.com",
  13         "example.com", "www.example.com", "test.www.example.com",
  14         "*.example.com", "*.www.example.com", "test.*.example.com", "www.*.com",
  15         "example.net", "xn--rger-koa.example.com",
  16         "a.example.com", "b.example.com",
  17         "postmaster@example.com", "Postmaster@example.com",
  18         "postmaster@EXAMPLE.COM",
  19         NULL
  20         };
  21
  22 static const char *const exceptions[] =
  23         {
  24         "set CN: host: [*.example.com] does not match [*.example.com]",
  25         "set CN: host: [*.example.com] matches [a.example.com]",
  26         "set CN: host: [*.example.com] matches [b.example.com]",
  27         "set CN: host: [*.example.com] matches [www.example.com]",
  28         "set CN: host: [*.example.com] matches [xn--rger-koa.example.com]",
  29         "set CN: host: [test.*.example.com] does not match [test.*.example.com]",
  30         "set CN: host: [test.*.example.com] matches [test.www.example.com]",
  31         "set CN: host: [*.www.example.com] does not match [*.www.example.com]",
  32         "set CN: host: [*.www.example.com] matches [test.www.example.com]",
  33         "set emailAddress: email: [postmaster@example.com] does not match [Postmaster@example.com]",
  34         "set emailAddress: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
  35         "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@example.com]",
  36         "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
  37         "set dnsName: host: [*.example.com] matches [www.example.com]",
  38         "set dnsName: host: [*.example.com] does not match [*.example.com]",
  39         "set dnsName: host: [*.example.com] matches [a.example.com]",
  40         "set dnsName: host: [*.example.com] matches [b.example.com]",
  41         "set dnsName: host: [*.example.com] matches [xn--rger-koa.example.com]",
  42         "set dnsName: host: [*.www.example.com] matches [test.www.example.com]",
  43         "set dnsName: host: [*.www.example.com] does not match [*.www.example.com]",
  44         "set dnsName: host: [test.*.example.com] matches [test.www.example.com]",
  45         "set dnsName: host: [test.*.example.com] does not match [test.*.example.com]",
  46         "set rfc822Name: email: [postmaster@example.com] does not match [Postmaster@example.com]",
  47         "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@example.com]",
  48         "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
  49         "set rfc822Name: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
  50         NULL
  51         };
  52
  53 static int is_exception(const char *msg)
  54         {
  55         const char *const *p;
  56         for (p = exceptions; *p; ++p)
  57                 if (strcmp(msg, *p) == 0)
  58                         return 1;
  59         return 0;
  60         }
  61
  62 static int set_cn(X509 *crt, ...)
  63         {
  64         int ret = 0;
  65         X509_NAME *n = NULL;
  66         va_list ap;
  67         va_start(ap, crt);
  68         n = X509_NAME_new();
  69         if (n == NULL)
  70                 goto out;
  71         while (1) {
  72                 int nid;
  73                 const char *name;
  74                 nid = va_arg(ap, int);
  75                 if (nid == 0)
  76                         break;
  77                 name = va_arg(ap, const char *);
  78                 if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC,
  79                                                         (unsigned char *)name,
  80                                                 -1, -1, 1))
  81                         goto out;
  82         }
  83         if (!X509_set_subject_name(crt, n))
  84                 goto out;
  85         ret = 1;
  86  out:
  87         X509_NAME_free(n);
  88         va_end(ap);
  89         return ret;
  90         }
  91
  92 /*
  93 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
  94 X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
  95                         int nid, int crit, ASN1_OCTET_STRING *data);
  96 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
  97 */
  98
  99 static int set_altname(X509 *crt, ...)
 100         {
 101         int ret = 0;
 102         GENERAL_NAMES *gens = NULL;
 103         GENERAL_NAME *gen = NULL;
 104         ASN1_IA5STRING *ia5 = NULL;
 105         va_list ap;
 106         va_start(ap, crt);
 107         gens = sk_GENERAL_NAME_new_null();
 108         if (gens == NULL)
 109                 goto out;
 110         while (1) {
 111                 int type;
 112                 const char *name;
 113                 type = va_arg(ap, int);
 114                 if (type == 0)
 115                         break;
 116                 name = va_arg(ap, const char *);
 117
 118                 gen = GENERAL_NAME_new();
 119                 if (gen == NULL)
 120                         goto out;
 121                 ia5 = ASN1_IA5STRING_new();
 122                 if (ia5 == NULL)
 123                         goto out;
 124                 if (!ASN1_STRING_set(ia5, name, -1))
 125                         goto out;
 126                 switch (type)
 127                         {
 128                         case GEN_EMAIL:
 129                         case GEN_DNS:
 130                                 GENERAL_NAME_set0_value(gen, type, ia5);
 131                                 ia5 = NULL;
 132                                 break;
 133                         default:
 134                                 abort();
 135                         }
 136                 sk_GENERAL_NAME_push(gens, gen);
 137                 gen = NULL;
 138         }
 139         if (!X509_add1_ext_i2d(crt, NID_subject_alt_name, gens, 0, 0))
 140                 goto out;
 141         ret = 1;
 142  out:
 143         ASN1_IA5STRING_free(ia5);
 144         GENERAL_NAME_free(gen);
 145         GENERAL_NAMES_free(gens);
 146         va_end(ap);
 147         return ret;
 148         }
 149
 150 static int set_cn1(X509 *crt, const char *name)
 151         {
 152         return set_cn(crt, NID_commonName, name, 0);
 153         }
 154
 155
 156 static int set_cn_and_email(X509 *crt, const char *name)
 157         {
 158         return set_cn(crt, NID_commonName, name,
 159                       NID_pkcs9_emailAddress, "dummy@example.com", 0);
 160         }
 161
 162 static int set_cn2(X509 *crt, const char *name)
 163         {
 164         return set_cn(crt, NID_commonName, "dummy value",
 165                       NID_commonName, name, 0);
 166         }
 167
 168 static int set_cn3(X509 *crt, const char *name)
 169         {
 170         return set_cn(crt, NID_commonName, name,
 171                       NID_commonName, "dummy value", 0);
 172         }
 173
 174 static int set_email1(X509 *crt, const char *name)
 175         {
 176         return set_cn(crt, NID_pkcs9_emailAddress, name, 0);
 177         }
 178
 179 static int set_email2(X509 *crt, const char *name)
 180         {
 181         return set_cn(crt, NID_pkcs9_emailAddress, "dummy@example.com",
 182                       NID_pkcs9_emailAddress, name, 0);
 183         }
 184
 185 static int set_email3(X509 *crt, const char *name)
 186         {
 187         return set_cn(crt, NID_pkcs9_emailAddress, name,
 188                       NID_pkcs9_emailAddress, "dummy@example.com", 0);
 189         }
 190
 191 static int set_email_and_cn(X509 *crt, const char *name)
 192         {
 193         return set_cn(crt, NID_pkcs9_emailAddress, name,
 194                       NID_commonName, "www.example.org", 0);
 195         }
 196
 197 static int set_altname_dns(X509 *crt, const char *name)
 198         {
 199         return set_altname(crt, GEN_DNS, name, 0);
 200         }
 201
 202 static int set_altname_email(X509 *crt, const char *name)
 203         {
 204         return set_altname(crt, GEN_EMAIL, name, 0);
 205         }
 206
 207 struct set_name_fn
 208         {
 209         int (*fn)(X509 *, const char *);
 210         const char *name;
 211         int host;
 212         int email;
 213         };
 214
 215 static const struct set_name_fn name_fns[] =
 216         {
 217         {set_cn1, "set CN", 1, 0},
 218         {set_cn2, "set CN", 1, 0},
 219         {set_cn3, "set CN", 1, 0},
 220         {set_cn_and_email, "set CN", 1, 0},
 221         {set_email1, "set emailAddress", 0, 1},
 222         {set_email2, "set emailAddress", 0, 1},
 223         {set_email3, "set emailAddress", 0, 1},
 224         {set_email_and_cn, "set emailAddress", 0, 1},
 225         {set_altname_dns, "set dnsName", 1, 0},
 226         {set_altname_email, "set rfc822Name", 0, 1},
 227         {NULL, NULL, 0}
 228         };
 229
 230 static X509 *make_cert()
 231         {
 232         X509 *ret = NULL;
 233         X509 *crt = NULL;
 234         X509_NAME *issuer = NULL;
 235         crt = X509_new();
 236         if (crt == NULL)
 237                 goto out;
 238         if (!X509_set_version(crt, 3))
 239                 goto out;
 240         ret = crt;
 241         crt = NULL;
 242  out:
 243         X509_NAME_free(issuer);
 244         return ret;
 245         }
 246
 247 static int errors;
 248
 249 static void check_message(const struct set_name_fn *fn, const char *op,
 250                           const char *nameincert, int match, const char *name)
 251         {
 252         char msg[1024];
 253         if (match < 0)
 254                 return;
 255         BIO_snprintf(msg, sizeof(msg), "%s: %s: [%s] %s [%s]",
 256                  fn->name, op, nameincert,
 257                  match ? "matches" : "does not match", name);
 258         if (is_exception(msg))
 259                 return;
 260         puts(msg);
 261         ++errors;
 262         }
 263
 264 static void run_cert(X509 *crt, const char *nameincert,
 265                      const struct set_name_fn *fn)
 266         {
 267         const char *const *pname = names;
 268         while (*pname)
 269                 {
 270                 int samename = strcasecmp(nameincert, *pname) == 0;
 271                 size_t namelen = strlen(*pname);
 272                 char *name = malloc(namelen);
 273                 int match, ret;
 274                 memcpy(name, *pname, namelen);
 275
 276                 ret = X509_check_host(crt, (const unsigned char *)name,
 277                                       namelen, 0);
 278                 match = -1;
 279                 if (ret < 0)
 280                         {
 281                         fprintf(stderr, "internal error in X509_check_host");
 282                         ++errors;
 283                         }
 284                 else if (fn->host)
 285                         {
 286                         if (ret == 1 && !samename)
 287                                 match = 1;
 288                         if (ret == 0 && samename)
 289                                 match = 0;
 290                         }
 291                 else if (ret == 1)
 292                         match = 1;
 293                 check_message(fn, "host", nameincert, match, *pname);
 294
 295                 ret = X509_check_host(crt, (const unsigned char *)name,
 296                                       namelen, X509_CHECK_FLAG_NO_WILDCARDS);
 297                 match = -1;
 298                 if (ret < 0)
 299                         {
 300                         fprintf(stderr, "internal error in X509_check_host");
 301                         ++errors;
 302                         }
 303                 else if (fn->host)
 304                         {
 305                         if (ret == 1 && !samename)
 306                                 match = 1;
 307                         if (ret == 0 && samename)
 308                                 match = 0;
 309                         }
 310                 else if (ret == 1)
 311                         match = 1;
 312                 check_message(fn, "host-no-wildcards",
 313                               nameincert, match, *pname);
 314
 315                 ret = X509_check_email(crt, (const unsigned char *)name,
 316                                        namelen, 0);
 317                 match = -1;
 318                 if (fn->email)
 319                         {
 320                         if (ret && !samename)
 321                                 match = 1;
 322                         if (!ret && samename && strchr(nameincert, '@') != NULL)
 323                                 match = 0;
 324                         }
 325                 else if (ret)
 326                         match = 1;
 327                 check_message(fn, "email", nameincert, match, *pname);
 328                 ++pname;
 329                 free(name);
 330                 }
 331         }
 332
 333 int
 334 main(void)
 335         {
 336         const struct set_name_fn *pfn = name_fns;
 337         while (pfn->name) {
 338                 const char *const *pname = names;
 339                 while (*pname)
 340                         {
 341                         X509 *crt = make_cert();
 342                         if (crt == NULL)
 343                                 {
 344                                 fprintf(stderr, "make_cert failed\n");
 345                                 return 1;
 346                                 }
 347                         if (!pfn->fn(crt, *pname))
 348                                 {
 349                                 fprintf(stderr, "X509 name setting failed\n");
 350                                 return 1;
 351                                 }
 352                         run_cert(crt, *pname, pfn);
 353                         X509_free(crt);
 354                         ++pname;
 355                         }
 356                 ++pfn;
 357         }
 358         return errors > 0 ? 1 : 0;
 359         }