1 /* 2 * Copyright 2012-2018 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <string.h> 11 12 #include <openssl/e_os2.h> 13 #include <openssl/x509.h> 14 #include <openssl/x509v3.h> 15 #include "internal/nelem.h" 16 #include "testutil.h" 17 18 #ifdef OPENSSL_SYS_WINDOWS 19 # define strcasecmp _stricmp 20 #endif 21 22 static const char *const names[] = { 23 "a", "b", ".", "*", "@", 24 ".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..", 25 "-example.com", "example-.com", 26 "@@", "**", "*.com", "*com", "*.*.com", "*com", "com*", "*example.com", 27 "*@example.com", "test@*.example.com", "example.com", "www.example.com", 28 "test.www.example.com", "*.example.com", "*.www.example.com", 29 "test.*.example.com", "www.*.com", 30 ".www.example.com", "*www.example.com", 31 "example.net", "xn--rger-koa.example.com", 32 "*.xn--rger-koa.example.com", "www.xn--rger-koa.example.com", 33 "*.good--example.com", "www.good--example.com", 34 "*.xn--bar.com", "xn--foo.xn--bar.com", 35 "a.example.com", "b.example.com", 36 "postmaster@example.com", "Postmaster@example.com", 37 "postmaster@EXAMPLE.COM", 38 NULL 39 }; 40 41 static const char *const exceptions[] = { 42 "set CN: host: [*.example.com] matches [a.example.com]", 43 "set CN: host: [*.example.com] matches [b.example.com]", 44 "set CN: host: [*.example.com] matches [www.example.com]", 45 "set CN: host: [*.example.com] matches [xn--rger-koa.example.com]", 46 "set CN: host: [*.www.example.com] matches [test.www.example.com]", 47 "set CN: host: [*.www.example.com] matches [.www.example.com]", 48 "set CN: host: [*www.example.com] matches [www.example.com]", 49 "set CN: host: [test.www.example.com] matches [.www.example.com]", 50 "set CN: host: [*.xn--rger-koa.example.com] matches [www.xn--rger-koa.example.com]", 51 "set CN: host: [*.xn--bar.com] matches [xn--foo.xn--bar.com]", 52 "set CN: host: [*.good--example.com] matches [www.good--example.com]", 53 "set CN: host-no-wildcards: [*.www.example.com] matches [.www.example.com]", 54 "set CN: host-no-wildcards: [test.www.example.com] matches [.www.example.com]", 55 "set emailAddress: email: [postmaster@example.com] does not match [Postmaster@example.com]", 56 "set emailAddress: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]", 57 "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@example.com]", 58 "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]", 59 "set dnsName: host: [*.example.com] matches [www.example.com]", 60 "set dnsName: host: [*.example.com] matches [a.example.com]", 61 "set dnsName: host: [*.example.com] matches [b.example.com]", 62 "set dnsName: host: [*.example.com] matches [xn--rger-koa.example.com]", 63 "set dnsName: host: [*.www.example.com] matches [test.www.example.com]", 64 "set dnsName: host-no-wildcards: [*.www.example.com] matches [.www.example.com]", 65 "set dnsName: host-no-wildcards: [test.www.example.com] matches [.www.example.com]", 66 "set dnsName: host: [*.www.example.com] matches [.www.example.com]", 67 "set dnsName: host: [*www.example.com] matches [www.example.com]", 68 "set dnsName: host: [test.www.example.com] matches [.www.example.com]", 69 "set dnsName: host: [*.xn--rger-koa.example.com] matches [www.xn--rger-koa.example.com]", 70 "set dnsName: host: [*.xn--bar.com] matches [xn--foo.xn--bar.com]", 71 "set dnsName: host: [*.good--example.com] matches [www.good--example.com]", 72 "set rfc822Name: email: [postmaster@example.com] does not match [Postmaster@example.com]", 73 "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@example.com]", 74 "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]", 75 "set rfc822Name: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]", 76 NULL 77 }; 78 79 static int is_exception(const char *msg) 80 { 81 const char *const *p; 82 83 for (p = exceptions; *p; ++p) 84 if (strcmp(msg, *p) == 0) 85 return 1; 86 return 0; 87 } 88 89 static int set_cn(X509 *crt, ...) 90 { 91 int ret = 0; 92 X509_NAME *n = NULL; 93 va_list ap; 94 95 va_start(ap, crt); 96 n = X509_NAME_new(); 97 if (n == NULL) 98 goto out; 99 100 while (1) { 101 int nid; 102 const char *name; 103 104 nid = va_arg(ap, int); 105 if (nid == 0) 106 break; 107 name = va_arg(ap, const char *); 108 if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC, 109 (unsigned char *)name, -1, -1, 1)) 110 goto out; 111 } 112 if (!X509_set_subject_name(crt, n)) 113 goto out; 114 ret = 1; 115 out: 116 X509_NAME_free(n); 117 va_end(ap); 118 return ret; 119 } 120 121 /*- 122 int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc); 123 X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex, 124 int nid, int crit, ASN1_OCTET_STRING *data); 125 int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc); 126 */ 127 128 static int set_altname(X509 *crt, ...) 129 { 130 int ret = 0; 131 GENERAL_NAMES *gens = NULL; 132 GENERAL_NAME *gen = NULL; 133 ASN1_IA5STRING *ia5 = NULL; 134 va_list ap; 135 va_start(ap, crt); 136 gens = sk_GENERAL_NAME_new_null(); 137 if (gens == NULL) 138 goto out; 139 while (1) { 140 int type; 141 const char *name; 142 type = va_arg(ap, int); 143 if (type == 0) 144 break; 145 name = va_arg(ap, const char *); 146 147 gen = GENERAL_NAME_new(); 148 if (gen == NULL) 149 goto out; 150 ia5 = ASN1_IA5STRING_new(); 151 if (ia5 == NULL) 152 goto out; 153 if (!ASN1_STRING_set(ia5, name, -1)) 154 goto out; 155 switch (type) { 156 case GEN_EMAIL: 157 case GEN_DNS: 158 GENERAL_NAME_set0_value(gen, type, ia5); 159 ia5 = NULL; 160 break; 161 default: 162 abort(); 163 } 164 sk_GENERAL_NAME_push(gens, gen); 165 gen = NULL; 166 } 167 if (!X509_add1_ext_i2d(crt, NID_subject_alt_name, gens, 0, 0)) 168 goto out; 169 ret = 1; 170 out: 171 ASN1_IA5STRING_free(ia5); 172 GENERAL_NAME_free(gen); 173 GENERAL_NAMES_free(gens); 174 va_end(ap); 175 return ret; 176 } 177 178 static int set_cn1(X509 *crt, const char *name) 179 { 180 return set_cn(crt, NID_commonName, name, 0); 181 } 182 183 static int set_cn_and_email(X509 *crt, const char *name) 184 { 185 return set_cn(crt, NID_commonName, name, 186 NID_pkcs9_emailAddress, "dummy@example.com", 0); 187 } 188 189 static int set_cn2(X509 *crt, const char *name) 190 { 191 return set_cn(crt, NID_commonName, "dummy value", 192 NID_commonName, name, 0); 193 } 194 195 static int set_cn3(X509 *crt, const char *name) 196 { 197 return set_cn(crt, NID_commonName, name, 198 NID_commonName, "dummy value", 0); 199 } 200 201 static int set_email1(X509 *crt, const char *name) 202 { 203 return set_cn(crt, NID_pkcs9_emailAddress, name, 0); 204 } 205 206 static int set_email2(X509 *crt, const char *name) 207 { 208 return set_cn(crt, NID_pkcs9_emailAddress, "dummy@example.com", 209 NID_pkcs9_emailAddress, name, 0); 210 } 211 212 static int set_email3(X509 *crt, const char *name) 213 { 214 return set_cn(crt, NID_pkcs9_emailAddress, name, 215 NID_pkcs9_emailAddress, "dummy@example.com", 0); 216 } 217 218 static int set_email_and_cn(X509 *crt, const char *name) 219 { 220 return set_cn(crt, NID_pkcs9_emailAddress, name, 221 NID_commonName, "www.example.org", 0); 222 } 223 224 static int set_altname_dns(X509 *crt, const char *name) 225 { 226 return set_altname(crt, GEN_DNS, name, 0); 227 } 228 229 static int set_altname_email(X509 *crt, const char *name) 230 { 231 return set_altname(crt, GEN_EMAIL, name, 0); 232 } 233 234 struct set_name_fn { 235 int (*fn) (X509 *, const char *); 236 const char *name; 237 int host; 238 int email; 239 }; 240 241 static const struct set_name_fn name_fns[] = { 242 {set_cn1, "set CN", 1, 0}, 243 {set_cn2, "set CN", 1, 0}, 244 {set_cn3, "set CN", 1, 0}, 245 {set_cn_and_email, "set CN", 1, 0}, 246 {set_email1, "set emailAddress", 0, 1}, 247 {set_email2, "set emailAddress", 0, 1}, 248 {set_email3, "set emailAddress", 0, 1}, 249 {set_email_and_cn, "set emailAddress", 0, 1}, 250 {set_altname_dns, "set dnsName", 1, 0}, 251 {set_altname_email, "set rfc822Name", 0, 1}, 252 }; 253 254 static X509 *make_cert(void) 255 { 256 X509 *crt = NULL; 257 258 if (!TEST_ptr(crt = X509_new())) 259 return NULL; 260 if (!TEST_true(X509_set_version(crt, 2))) { 261 X509_free(crt); 262 return NULL; 263 } 264 return crt; 265 } 266 267 static int check_message(const struct set_name_fn *fn, const char *op, 268 const char *nameincert, int match, const char *name) 269 { 270 char msg[1024]; 271 272 if (match < 0) 273 return 1; 274 BIO_snprintf(msg, sizeof(msg), "%s: %s: [%s] %s [%s]", 275 fn->name, op, nameincert, 276 match ? "matches" : "does not match", name); 277 if (is_exception(msg)) 278 return 1; 279 TEST_error("%s", msg); 280 return 0; 281 } 282 283 static int run_cert(X509 *crt, const char *nameincert, 284 const struct set_name_fn *fn) 285 { 286 const char *const *pname = names; 287 int failed = 0; 288 289 for (; *pname != NULL; ++pname) { 290 int samename = strcasecmp(nameincert, *pname) == 0; 291 size_t namelen = strlen(*pname); 292 char *name = OPENSSL_malloc(namelen); 293 int match, ret; 294 295 memcpy(name, *pname, namelen); 296 297 match = -1; 298 if (!TEST_int_ge(ret = X509_check_host(crt, name, namelen, 0, NULL), 299 0)) { 300 failed = 1; 301 } else if (fn->host) { 302 if (ret == 1 && !samename) 303 match = 1; 304 if (ret == 0 && samename) 305 match = 0; 306 } else if (ret == 1) 307 match = 1; 308 if (!TEST_true(check_message(fn, "host", nameincert, match, *pname))) 309 failed = 1; 310 311 match = -1; 312 if (!TEST_int_ge(ret = X509_check_host(crt, name, namelen, 313 X509_CHECK_FLAG_NO_WILDCARDS, 314 NULL), 0)) { 315 failed = 1; 316 } else if (fn->host) { 317 if (ret == 1 && !samename) 318 match = 1; 319 if (ret == 0 && samename) 320 match = 0; 321 } else if (ret == 1) 322 match = 1; 323 if (!TEST_true(check_message(fn, "host-no-wildcards", 324 nameincert, match, *pname))) 325 failed = 1; 326 327 match = -1; 328 ret = X509_check_email(crt, name, namelen, 0); 329 if (fn->email) { 330 if (ret && !samename) 331 match = 1; 332 if (!ret && samename && strchr(nameincert, '@') != NULL) 333 match = 0; 334 } else if (ret) 335 match = 1; 336 if (!TEST_true(check_message(fn, "email", nameincert, match, *pname))) 337 failed = 1; 338 OPENSSL_free(name); 339 } 340 341 return failed == 0; 342 } 343 344 static int call_run_cert(int i) 345 { 346 int failed = 0; 347 const struct set_name_fn *pfn = &name_fns[i]; 348 X509 *crt; 349 const char *const *pname; 350 351 TEST_info("%s", pfn->name); 352 for (pname = names; *pname != NULL; pname++) { 353 if (!TEST_ptr(crt = make_cert()) 354 || !TEST_true(pfn->fn(crt, *pname)) 355 || !run_cert(crt, *pname, pfn)) 356 failed = 1; 357 X509_free(crt); 358 } 359 return failed == 0; 360 } 361 362 int setup_tests(void) 363 { 364 ADD_ALL_TESTS(call_run_cert, OSSL_NELEM(name_fns)); 365 return 1; 366 } 367