mark all block comments that need format preserving so that
[openssl.git] / crypto / x509v3 / v3nametest.c
1 #include <openssl/x509.h>
2 #include <openssl/x509v3.h>
3 #include "../e_os.h"
4 #include <string.h>
5
6 static const char *const names[] =
7         {
8         "a", "b", ".", "*", "@",
9         ".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..",
10         "@@", "**", "*.com", "*com", "*.*.com", "*com", "com*", "*example.com",
11         "*@example.com", "test@*.example.com", "example.com", "www.example.com",
12         "test.www.example.com", "*.example.com", "*.www.example.com",
13         "test.*.example.com", "www.*.com",
14         ".www.example.com", "*www.example.com",
15         "example.net", "xn--rger-koa.example.com",
16         "a.example.com", "b.example.com",
17         "postmaster@example.com", "Postmaster@example.com",
18         "postmaster@EXAMPLE.COM",
19         NULL
20         };
21
22 static const char *const exceptions[] =
23         {
24         "set CN: host: [*.example.com] matches [a.example.com]",
25         "set CN: host: [*.example.com] matches [b.example.com]",
26         "set CN: host: [*.example.com] matches [www.example.com]",
27         "set CN: host: [*.example.com] matches [xn--rger-koa.example.com]",
28         "set CN: host: [*.www.example.com] matches [test.www.example.com]",
29         "set CN: host: [*.www.example.com] matches [.www.example.com]",
30         "set CN: host: [*www.example.com] matches [www.example.com]",
31         "set CN: host: [test.www.example.com] matches [.www.example.com]",
32         "set CN: host-no-wildcards: [*.www.example.com] matches [.www.example.com]",
33         "set CN: host-no-wildcards: [test.www.example.com] matches [.www.example.com]",
34         "set emailAddress: email: [postmaster@example.com] does not match [Postmaster@example.com]",
35         "set emailAddress: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
36         "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@example.com]",
37         "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
38         "set dnsName: host: [*.example.com] matches [www.example.com]",
39         "set dnsName: host: [*.example.com] matches [a.example.com]",
40         "set dnsName: host: [*.example.com] matches [b.example.com]",
41         "set dnsName: host: [*.example.com] matches [xn--rger-koa.example.com]",
42         "set dnsName: host: [*.www.example.com] matches [test.www.example.com]",
43         "set dnsName: host-no-wildcards: [*.www.example.com] matches [.www.example.com]",
44         "set dnsName: host-no-wildcards: [test.www.example.com] matches [.www.example.com]",
45         "set dnsName: host: [*.www.example.com] matches [.www.example.com]",
46         "set dnsName: host: [*www.example.com] matches [www.example.com]",
47         "set dnsName: host: [test.www.example.com] matches [.www.example.com]",
48         "set rfc822Name: email: [postmaster@example.com] does not match [Postmaster@example.com]",
49         "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@example.com]",
50         "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
51         "set rfc822Name: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
52         NULL
53         };
54
55 static int is_exception(const char *msg)
56         {
57         const char *const *p;
58         for (p = exceptions; *p; ++p)
59                 if (strcmp(msg, *p) == 0)
60                         return 1;
61         return 0;
62         }
63
64 static int set_cn(X509 *crt, ...)
65         {
66         int ret = 0;
67         X509_NAME *n = NULL;
68         va_list ap;
69         va_start(ap, crt);
70         n = X509_NAME_new();
71         if (n == NULL)
72                 goto out;
73         while (1) {
74                 int nid;
75                 const char *name;
76                 nid = va_arg(ap, int);
77                 if (nid == 0)
78                         break;
79                 name = va_arg(ap, const char *);
80                 if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC,
81                                                         (unsigned char *)name,
82                                                 -1, -1, 1))
83                         goto out;
84         }
85         if (!X509_set_subject_name(crt, n))
86                 goto out;
87         ret = 1;
88  out:
89         X509_NAME_free(n);
90         va_end(ap);
91         return ret;
92         }
93
94 /*-
95 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
96 X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
97                         int nid, int crit, ASN1_OCTET_STRING *data);
98 int             X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
99 */
100
101 static int set_altname(X509 *crt, ...)
102         {
103         int ret = 0;
104         GENERAL_NAMES *gens = NULL;
105         GENERAL_NAME *gen = NULL;
106         ASN1_IA5STRING *ia5 = NULL;
107         va_list ap;
108         va_start(ap, crt);
109         gens = sk_GENERAL_NAME_new_null();
110         if (gens == NULL)
111                 goto out;
112         while (1) {
113                 int type;
114                 const char *name;
115                 type = va_arg(ap, int);
116                 if (type == 0)
117                         break;
118                 name = va_arg(ap, const char *);
119
120                 gen = GENERAL_NAME_new();
121                 if (gen == NULL)
122                         goto out;
123                 ia5 = ASN1_IA5STRING_new();
124                 if (ia5 == NULL)
125                         goto out;
126                 if (!ASN1_STRING_set(ia5, name, -1))
127                         goto out;
128                 switch (type)
129                         {
130                         case GEN_EMAIL:
131                         case GEN_DNS:
132                                 GENERAL_NAME_set0_value(gen, type, ia5);
133                                 ia5 = NULL;
134                                 break;
135                         default:
136                                 abort();
137                         }
138                 sk_GENERAL_NAME_push(gens, gen);
139                 gen = NULL;
140         }
141         if (!X509_add1_ext_i2d(crt, NID_subject_alt_name, gens, 0, 0))
142                 goto out;
143         ret = 1;
144  out:
145         ASN1_IA5STRING_free(ia5);
146         GENERAL_NAME_free(gen);
147         GENERAL_NAMES_free(gens);
148         va_end(ap);
149         return ret;
150         }
151
152 static int set_cn1(X509 *crt, const char *name)
153         {
154         return set_cn(crt, NID_commonName, name, 0);
155         }
156
157
158 static int set_cn_and_email(X509 *crt, const char *name)
159         {
160         return set_cn(crt, NID_commonName, name,
161                       NID_pkcs9_emailAddress, "dummy@example.com", 0);
162         }
163
164 static int set_cn2(X509 *crt, const char *name)
165         {
166         return set_cn(crt, NID_commonName, "dummy value",
167                       NID_commonName, name, 0);
168         }
169
170 static int set_cn3(X509 *crt, const char *name)
171         {
172         return set_cn(crt, NID_commonName, name,
173                       NID_commonName, "dummy value", 0);
174         }
175
176 static int set_email1(X509 *crt, const char *name)
177         {
178         return set_cn(crt, NID_pkcs9_emailAddress, name, 0);
179         }
180
181 static int set_email2(X509 *crt, const char *name)
182         {
183         return set_cn(crt, NID_pkcs9_emailAddress, "dummy@example.com",
184                       NID_pkcs9_emailAddress, name, 0);
185         }
186
187 static int set_email3(X509 *crt, const char *name)
188         {
189         return set_cn(crt, NID_pkcs9_emailAddress, name,
190                       NID_pkcs9_emailAddress, "dummy@example.com", 0);
191         }
192
193 static int set_email_and_cn(X509 *crt, const char *name)
194         {
195         return set_cn(crt, NID_pkcs9_emailAddress, name,
196                       NID_commonName, "www.example.org", 0);
197         }
198
199 static int set_altname_dns(X509 *crt, const char *name)
200         {
201         return set_altname(crt, GEN_DNS, name, 0);
202         }
203
204 static int set_altname_email(X509 *crt, const char *name)
205         {
206         return set_altname(crt, GEN_EMAIL, name, 0);
207         }
208
209 struct set_name_fn
210         {
211         int (*fn)(X509 *, const char *);
212         const char *name;
213         int host;
214         int email;
215         };
216
217 static const struct set_name_fn name_fns[] =
218         {
219         {set_cn1, "set CN", 1, 0},
220         {set_cn2, "set CN", 1, 0},
221         {set_cn3, "set CN", 1, 0},
222         {set_cn_and_email, "set CN", 1, 0},
223         {set_email1, "set emailAddress", 0, 1},
224         {set_email2, "set emailAddress", 0, 1},
225         {set_email3, "set emailAddress", 0, 1},
226         {set_email_and_cn, "set emailAddress", 0, 1},
227         {set_altname_dns, "set dnsName", 1, 0},
228         {set_altname_email, "set rfc822Name", 0, 1},
229         {NULL, NULL, 0}
230         };
231
232 static X509 *make_cert()
233         {
234         X509 *ret = NULL;
235         X509 *crt = NULL;
236         X509_NAME *issuer = NULL;
237         crt = X509_new();
238         if (crt == NULL)
239                 goto out;
240         if (!X509_set_version(crt, 3))
241                 goto out;
242         ret = crt;
243         crt = NULL;
244  out:
245         X509_NAME_free(issuer);
246         return ret;
247         }
248
249 static int errors;
250
251 static void check_message(const struct set_name_fn *fn, const char *op,
252                           const char *nameincert, int match, const char *name)
253         {
254         char msg[1024];
255         if (match < 0)
256                 return;
257         BIO_snprintf(msg, sizeof(msg), "%s: %s: [%s] %s [%s]",
258                  fn->name, op, nameincert,
259                  match ? "matches" : "does not match", name);
260         if (is_exception(msg))
261                 return;
262         puts(msg);
263         ++errors;
264         }
265
266 static void run_cert(X509 *crt, const char *nameincert,
267                      const struct set_name_fn *fn)
268         {
269         const char *const *pname = names;
270         while (*pname)
271                 {
272                 int samename = strcasecmp(nameincert, *pname) == 0;
273                 size_t namelen = strlen(*pname);
274                 char *name = malloc(namelen);
275                 int match, ret;
276                 memcpy(name, *pname, namelen);
277
278                 ret = X509_check_host(crt, name, namelen, 0, NULL);
279                 match = -1;
280                 if (ret < 0)
281                         {
282                         fprintf(stderr, "internal error in X509_check_host");
283                         ++errors;
284                         }
285                 else if (fn->host)
286                         {
287                         if (ret == 1 && !samename)
288                                 match = 1;
289                         if (ret == 0 && samename)
290                                 match = 0;
291                         }
292                 else if (ret == 1)
293                         match = 1;
294                 check_message(fn, "host", nameincert, match, *pname);
295
296                 ret = X509_check_host(crt, name, namelen,
297                                       X509_CHECK_FLAG_NO_WILDCARDS, NULL);
298                 match = -1;
299                 if (ret < 0)
300                         {
301                         fprintf(stderr, "internal error in X509_check_host");
302                         ++errors;
303                         }
304                 else if (fn->host)
305                         {
306                         if (ret == 1 && !samename)
307                                 match = 1;
308                         if (ret == 0 && samename)
309                                 match = 0;
310                         }
311                 else if (ret == 1)
312                         match = 1;
313                 check_message(fn, "host-no-wildcards",
314                               nameincert, match, *pname);
315
316                 ret = X509_check_email(crt, name, namelen, 0);
317                 match = -1;
318                 if (fn->email)
319                         {
320                         if (ret && !samename)
321                                 match = 1;
322                         if (!ret && samename && strchr(nameincert, '@') != NULL)
323                                 match = 0;
324                         }
325                 else if (ret)
326                         match = 1;
327                 check_message(fn, "email", nameincert, match, *pname);
328                 ++pname;
329                 free(name);
330                 }
331         }
332
333 int
334 main(void)
335         {
336         const struct set_name_fn *pfn = name_fns;
337         while (pfn->name) {
338                 const char *const *pname = names;
339                 while (*pname)
340                         {
341                         X509 *crt = make_cert();
342                         if (crt == NULL)
343                                 {
344                                 fprintf(stderr, "make_cert failed\n");
345                                 return 1;
346                                 }
347                         if (!pfn->fn(crt, *pname))
348                                 {
349                                 fprintf(stderr, "X509 name setting failed\n");
350                                 return 1;
351                                 }
352                         run_cert(crt, *pname, pfn);
353                         X509_free(crt);
354                         ++pname;
355                         }
356                 ++pfn;
357         }
358         return errors > 0 ? 1 : 0;
359         }