crypto/bn/asm/rsaz-x86_64.pl: make it work on Win64.
[openssl.git] / crypto / x509v3 / v3nametest.c
1 #include <openssl/x509.h>
2 #include <openssl/x509v3.h>
3 #include "../e_os.h"
4 #include <string.h>
5
6 static const char *const names[] =
7         {
8         "a", "b", ".", "*", "@",
9         ".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..",
10         "@@", "**",
11         "*.com", "*com", "*.*.com", "*com", "com*", "*example.com",
12         "*@example.com", "test@*.example.com",
13         "example.com", "www.example.com", "test.www.example.com",
14         "*.example.com", "*.www.example.com", "test.*.example.com", "www.*.com",
15         "example.net", "xn--rger-koa.example.com",
16         "a.example.com", "b.example.com",
17         "postmaster@example.com", "Postmaster@example.com",
18         "postmaster@EXAMPLE.COM",
19         NULL
20         };
21
22 static const char *const exceptions[] =
23         {
24         "set CN: host: [*.example.com] does not match [*.example.com]",
25         "set CN: host: [*.example.com] matches [a.example.com]",
26         "set CN: host: [*.example.com] matches [b.example.com]",
27         "set CN: host: [*.example.com] matches [www.example.com]",
28         "set CN: host: [*.example.com] matches [xn--rger-koa.example.com]",
29         "set CN: host: [test.*.example.com] does not match [test.*.example.com]",
30         "set CN: host: [test.*.example.com] matches [test.www.example.com]",
31         "set CN: host: [*.www.example.com] does not match [*.www.example.com]",
32         "set CN: host: [*.www.example.com] matches [test.www.example.com]",
33         "set emailAddress: email: [postmaster@example.com] does not match [Postmaster@example.com]",
34         "set emailAddress: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
35         "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@example.com]",
36         "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
37         "set dnsName: host: [*.example.com] matches [www.example.com]",
38         "set dnsName: host: [*.example.com] does not match [*.example.com]",
39         "set dnsName: host: [*.example.com] matches [a.example.com]",
40         "set dnsName: host: [*.example.com] matches [b.example.com]",
41         "set dnsName: host: [*.example.com] matches [xn--rger-koa.example.com]",
42         "set dnsName: host: [*.www.example.com] matches [test.www.example.com]",
43         "set dnsName: host: [*.www.example.com] does not match [*.www.example.com]",
44         "set dnsName: host: [test.*.example.com] matches [test.www.example.com]",
45         "set dnsName: host: [test.*.example.com] does not match [test.*.example.com]",
46         "set rfc822Name: email: [postmaster@example.com] does not match [Postmaster@example.com]",
47         "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@example.com]",
48         "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
49         "set rfc822Name: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
50         NULL
51         };
52
53 static int is_exception(const char *msg)
54         {
55         const char *const *p;
56         for (p = exceptions; *p; ++p)
57                 if (strcmp(msg, *p) == 0)
58                         return 1;
59         return 0;
60         }
61
62 static int set_cn(X509 *crt, ...)
63         {
64         int ret = 0;
65         X509_NAME *n = NULL;
66         va_list ap;
67         va_start(ap, crt);
68         n = X509_NAME_new();
69         if (n == NULL)
70                 goto out;
71         while (1) {
72                 int nid;
73                 const char *name;
74                 nid = va_arg(ap, int);
75                 if (nid == 0)
76                         break;
77                 name = va_arg(ap, const char *);
78                 if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC,
79                                                         (unsigned char *)name,
80                                                 -1, -1, 1))
81                         goto out;
82         }
83         if (!X509_set_subject_name(crt, n))
84                 goto out;
85         ret = 1;
86  out:
87         X509_NAME_free(n);
88         va_end(ap);
89         return ret;
90         }
91
92 /*
93 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
94 X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
95                         int nid, int crit, ASN1_OCTET_STRING *data);
96 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
97 */
98
99 static int set_altname(X509 *crt, ...)
100         {
101         int ret = 0;
102         GENERAL_NAMES *gens = NULL;
103         GENERAL_NAME *gen = NULL;
104         ASN1_IA5STRING *ia5 = NULL;
105         va_list ap;
106         va_start(ap, crt);
107         gens = sk_GENERAL_NAME_new_null();
108         if (gens == NULL)
109                 goto out;
110         while (1) {
111                 int type;
112                 const char *name;
113                 type = va_arg(ap, int);
114                 if (type == 0)
115                         break;
116                 name = va_arg(ap, const char *);
117
118                 gen = GENERAL_NAME_new();
119                 if (gen == NULL)
120                         goto out;
121                 ia5 = ASN1_IA5STRING_new();
122                 if (ia5 == NULL)
123                         goto out;
124                 if (!ASN1_STRING_set(ia5, name, -1))
125                         goto out;
126                 switch (type)
127                         {
128                         case GEN_EMAIL:
129                         case GEN_DNS:
130                                 GENERAL_NAME_set0_value(gen, type, ia5);
131                                 ia5 = NULL;
132                                 break;
133                         default:
134                                 abort();
135                         }
136                 sk_GENERAL_NAME_push(gens, gen);
137                 gen = NULL;
138         }
139         if (!X509_add1_ext_i2d(crt, NID_subject_alt_name, gens, 0, 0))
140                 goto out;
141         ret = 1;
142  out:
143         ASN1_IA5STRING_free(ia5);
144         GENERAL_NAME_free(gen);
145         GENERAL_NAMES_free(gens);
146         va_end(ap);
147         return ret;
148         }
149
150 static int set_cn1(X509 *crt, const char *name)
151         {
152         return set_cn(crt, NID_commonName, name, 0);
153         }
154
155
156 static int set_cn_and_email(X509 *crt, const char *name)
157         {
158         return set_cn(crt, NID_commonName, name,
159                       NID_pkcs9_emailAddress, "dummy@example.com", 0);
160         }
161
162 static int set_cn2(X509 *crt, const char *name)
163         {
164         return set_cn(crt, NID_commonName, "dummy value",
165                       NID_commonName, name, 0);
166         }
167
168 static int set_cn3(X509 *crt, const char *name)
169         {
170         return set_cn(crt, NID_commonName, name,
171                       NID_commonName, "dummy value", 0);
172         }
173
174 static int set_email1(X509 *crt, const char *name)
175         {
176         return set_cn(crt, NID_pkcs9_emailAddress, name, 0);
177         }
178
179 static int set_email2(X509 *crt, const char *name)
180         {
181         return set_cn(crt, NID_pkcs9_emailAddress, "dummy@example.com",
182                       NID_pkcs9_emailAddress, name, 0);
183         }
184
185 static int set_email3(X509 *crt, const char *name)
186         {
187         return set_cn(crt, NID_pkcs9_emailAddress, name,
188                       NID_pkcs9_emailAddress, "dummy@example.com", 0);
189         }
190
191 static int set_email_and_cn(X509 *crt, const char *name)
192         {
193         return set_cn(crt, NID_pkcs9_emailAddress, name,
194                       NID_commonName, "www.example.org", 0);
195         }
196
197 static int set_altname_dns(X509 *crt, const char *name)
198         {
199         return set_altname(crt, GEN_DNS, name, 0);
200         }
201
202 static int set_altname_email(X509 *crt, const char *name)
203         {
204         return set_altname(crt, GEN_EMAIL, name, 0);
205         }
206
207 struct set_name_fn
208         {
209         int (*fn)(X509 *, const char *);
210         const char *name;
211         int host;
212         int email;
213         };
214
215 static const struct set_name_fn name_fns[] =
216         {
217         {set_cn1, "set CN", 1, 0},
218         {set_cn2, "set CN", 1, 0},
219         {set_cn3, "set CN", 1, 0},
220         {set_cn_and_email, "set CN", 1, 0},
221         {set_email1, "set emailAddress", 0, 1},
222         {set_email2, "set emailAddress", 0, 1},
223         {set_email3, "set emailAddress", 0, 1},
224         {set_email_and_cn, "set emailAddress", 0, 1},
225         {set_altname_dns, "set dnsName", 1, 0},
226         {set_altname_email, "set rfc822Name", 0, 1},
227         {NULL, NULL, 0}
228         };
229
230 static X509 *make_cert()
231         {
232         X509 *ret = NULL;
233         X509 *crt = NULL;
234         X509_NAME *issuer = NULL;
235         crt = X509_new();
236         if (crt == NULL)
237                 goto out;
238         if (!X509_set_version(crt, 3))
239                 goto out;
240         ret = crt;
241         crt = NULL;
242  out:
243         X509_NAME_free(issuer);
244         return ret;
245         }
246
247 static int errors;
248
249 static void check_message(const struct set_name_fn *fn, const char *op,
250                           const char *nameincert, int match, const char *name)
251         {
252         char msg[1024];
253         if (match < 0)
254                 return;
255         BIO_snprintf(msg, sizeof(msg), "%s: %s: [%s] %s [%s]",
256                  fn->name, op, nameincert,
257                  match ? "matches" : "does not match", name);
258         if (is_exception(msg))
259                 return;
260         puts(msg);
261         ++errors;
262         }
263
264 static void run_cert(X509 *crt, const char *nameincert,
265                      const struct set_name_fn *fn)
266         {
267         const char *const *pname = names;
268         while (*pname)
269                 {
270                 int samename = strcasecmp(nameincert, *pname) == 0;
271                 size_t namelen = strlen(*pname);
272                 char *name = malloc(namelen);
273                 int match, ret;
274                 memcpy(name, *pname, namelen);
275
276                 ret = X509_check_host(crt, (const unsigned char *)name,
277                                       namelen, 0);
278                 match = -1;
279                 if (ret < 0)
280                         {
281                         fprintf(stderr, "internal error in X509_check_host");
282                         ++errors;
283                         }
284                 else if (fn->host)
285                         {
286                         if (ret == 1 && !samename)
287                                 match = 1;
288                         if (ret == 0 && samename)
289                                 match = 0;
290                         }
291                 else if (ret == 1)
292                         match = 1;
293                 check_message(fn, "host", nameincert, match, *pname);
294
295                 ret = X509_check_host(crt, (const unsigned char *)name,
296                                       namelen, X509_CHECK_FLAG_NO_WILDCARDS);
297                 match = -1;
298                 if (ret < 0)
299                         {
300                         fprintf(stderr, "internal error in X509_check_host");
301                         ++errors;
302                         }
303                 else if (fn->host)
304                         {
305                         if (ret == 1 && !samename)
306                                 match = 1;
307                         if (ret == 0 && samename)
308                                 match = 0;
309                         }
310                 else if (ret == 1)
311                         match = 1;
312                 check_message(fn, "host-no-wildcards",
313                               nameincert, match, *pname);
314
315                 ret = X509_check_email(crt, (const unsigned char *)name,
316                                        namelen, 0);
317                 match = -1;
318                 if (fn->email)
319                         {
320                         if (ret && !samename)
321                                 match = 1;
322                         if (!ret && samename && strchr(nameincert, '@') != NULL)
323                                 match = 0;
324                         }
325                 else if (ret)
326                         match = 1;
327                 check_message(fn, "email", nameincert, match, *pname);
328                 ++pname;
329                 free(name);
330                 }
331         }
332
333 int
334 main(void)
335         {
336         const struct set_name_fn *pfn = name_fns;
337         while (pfn->name) {
338                 const char *const *pname = names;
339                 while (*pname)
340                         {
341                         X509 *crt = make_cert();
342                         if (crt == NULL)
343                                 {
344                                 fprintf(stderr, "make_cert failed\n");
345                                 return 1;
346                                 }
347                         if (!pfn->fn(crt, *pname))
348                                 {
349                                 fprintf(stderr, "X509 name setting failed\n");
350                                 return 1;
351                                 }
352                         run_cert(crt, *pname, pfn);
353                         X509_free(crt);
354                         ++pname;
355                         }
356                 ++pfn;
357         }
358         return errors > 0 ? 1 : 0;
359         }