tests/name-constraints.c

   1 /*
   2  * Copyright (C) 2014 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * GnuTLS is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 3 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * GnuTLS is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with GnuTLS; if not, write to the Free Software Foundation,
  20  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 /* Parts copied from GnuTLS example programs. */
  24
  25 #ifdef HAVE_CONFIG_H
  26 #include <config.h>
  27 #endif
  28
  29 #include <stdio.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <sys/types.h>
  33 #include <unistd.h>
  34 #include <gnutls/gnutls.h>
  35 #include <gnutls/x509.h>
  36
  37 #include "utils.h"
  38
  39 /* Test for name constraints PKIX extension.
  40  */
  41
  42 static void tls_log_func(int level, const char *str)
  43 {
  44         fprintf(stderr, "<%d>| %s", level, str);
  45 }
  46
  47 static unsigned char cert_pem[] =
  48     "-----BEGIN CERTIFICATE-----\n"
  49     "MIIEMTCCAxmgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBlTELMAkGA1UEBhMCR1Ix\n"
  50     "RDBCBgNVBAoTO0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1\n"
  51     "dGlvbnMgQ2VydC4gQXV0aG9yaXR5MUAwPgYDVQQDEzdIZWxsZW5pYyBBY2FkZW1p\n"
  52     "YyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIFJvb3RDQSAyMDExMB4XDTExMTIw\n"
  53     "NjEzNDk1MloXDTMxMTIwMTEzNDk1MlowgZUxCzAJBgNVBAYTAkdSMUQwQgYDVQQK\n"
  54     "EztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENl\n"
  55     "cnQuIEF1dGhvcml0eTFAMD4GA1UEAxM3SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl\n"
  56     "c2VhcmNoIEluc3RpdHV0aW9ucyBSb290Q0EgMjAxMTCCASIwDQYJKoZIhvcNAQEB\n"
  57     "BQADggEPADCCAQoCggEBAKlTAOMupvaO+mDYLZU++CwqVE7NuYRhlFhPjz2L5EPz\n"
  58     "dYmNUeTDN9KKiE15HrcS3UN4SoqS5tdI1Q+kOilENbgH9mgdVc04UfCMJDGFr4PJ\n"
  59     "fel3r+0ae50X+bOdOFAPplp5kYCvN66m0zH7tSYJnTxa71HFK9+WXesyHgLacEns\n"
  60     "bgzImjeN9/E2YEsmLIKe0HjzDQ9jpFEw4fkrJxIH2Oq9GGKYsFk3fb7u8yBRQlqD\n"
  61     "75O6aRXxYp2fmTmCobd0LovUxQt7L/DICto9eQqakxylKHJzkUOap9FNhYS5qXSP\n"
  62     "FEDH3N6sQWRstBmbAmNtJGSPRLIl6s5ddAxjMlyNh+UCAwEAAaOBiTCBhjAPBgNV\n"
  63     "HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUppFC/RNhSiOeCKQp\n"
  64     "5dgTBCPuQSUwRwYDVR0eBEAwPqA8MAWCAy5ncjAFggMuZXUwBoIELmVkdTAGggQu\n"
  65     "b3JnMAWBAy5ncjAFgQMuZXUwBoEELmVkdTAGgQQub3JnMA0GCSqGSIb3DQEBBQUA\n"
  66     "A4IBAQAf73lB4XtuP7KMhjdCSk4cNx6NZrokgclPEg8hwAOXhiVtXdMiKahsog2p\n"
  67     "6z0GW5k6x8zDmjR/qw7IThzh+uTczQ2+vyT+bOdrwg3IBp5OjWEopmr95fZi6hg8\n"
  68     "TqBTnbI6nOulnJEWtk2C4AwFSKls9cz4y51JtPACpf1wA+2KIaWuE4ZJwzNzvoc7\n"
  69     "dIsXRSZMFpGD/md9zU1jZ/rzAxKWeAaNsWftjj++n08C9bMJL/NMh98qy5V8Acys\n"
  70     "Nnq/onN694/BtZqhFLKPM58N7yLcZnuEvUUXBj08yrl3NI/K6s8/MT7jiOOASSXI\n"
  71     "l7WdmplNsDz4SgCbZN2fOUvRJ9e4\n"
  72     "-----END CERTIFICATE-----\n";
  73
  74 const gnutls_datum_t cert = { cert_pem, sizeof(cert_pem) };
  75
  76 const gnutls_datum_t name1 = { (void*)"com", 3 };
  77 const gnutls_datum_t name2 = { (void*)"example.com", sizeof("example.com")-1 };
  78 const gnutls_datum_t name3 = { (void*)"another.example.com", sizeof("another.example.com")-1 };
  79 const gnutls_datum_t name4 = { (void*)".gr", 3 };
  80
  81 const gnutls_datum_t mail1 = { (void*)"example.com", sizeof("example.com")-1 };
  82 const gnutls_datum_t mail2 = { (void*)".example.net", sizeof(".example.net")-1 };
  83 const gnutls_datum_t mail3 = { (void*)"nmav@redhat.com", sizeof("nmav@redhat.com")-1 };
  84 const gnutls_datum_t mail4 = { (void*)"koko.example.net", sizeof("koko.example.net")-1 };
  85
  86 void doit(void)
  87 {
  88         int ret;
  89         unsigned int crit, i;
  90         gnutls_x509_crt_t crt;
  91         gnutls_x509_name_constraints_t nc;
  92         unsigned type;
  93         gnutls_datum_t name;
  94
  95         /* this must be called once in the program
  96          */
  97         global_init();
  98
  99         gnutls_global_set_log_function(tls_log_func);
 100         if (debug)
 101                 gnutls_global_set_log_level(6);
 102
 103         /* 0: test the reading of name constraints */
 104
 105         ret = gnutls_x509_name_constraints_init(&nc);
 106         if (ret < 0)
 107                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 108
 109         ret = gnutls_x509_crt_init(&crt);
 110         if (ret < 0)
 111                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 112
 113         ret = gnutls_x509_crt_import(crt, &cert, GNUTLS_X509_FMT_PEM);
 114         if (ret < 0)
 115                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 116
 117         ret = gnutls_x509_crt_get_name_constraints(crt, nc, 0, &crit);
 118         if (ret < 0)
 119                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 120
 121         if (crit != 0) {
 122                 fail("error reading criticality\n");
 123         }
 124
 125         i = 0;
 126         do {
 127                 ret = gnutls_x509_name_constraints_get_permitted(nc, i++, &type, &name);
 128
 129                 if (ret >= 0 && i == 2) {
 130                         if (name.size != 3 || memcmp(name.data, ".eu", 3) != 0) {
 131                                 fail("error reading 2nd constraint\n");
 132                         }
 133                 }
 134         } while(ret == 0);
 135
 136         if (i-1 != 8) {
 137                 fail("Could not read all contraints; read %d, expected %d\n", i-1, 8);
 138         }
 139
 140         gnutls_x509_name_constraints_deinit(nc);
 141         gnutls_x509_crt_deinit(crt);
 142
 143         /* 1: test the generation of name constraints */
 144
 145         ret = gnutls_x509_name_constraints_init(&nc);
 146         if (ret < 0)
 147                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 148
 149         ret = gnutls_x509_crt_init(&crt);
 150         if (ret < 0)
 151                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 152
 153         ret = gnutls_x509_crt_import(crt, &cert, GNUTLS_X509_FMT_PEM);
 154         if (ret < 0)
 155                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 156
 157         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_DNSNAME,
 158                 &name1);
 159         if (ret < 0)
 160                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 161
 162         ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_DNSNAME,
 163                 &name2);
 164         if (ret < 0)
 165                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 166
 167         ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_DNSNAME,
 168                 &name3);
 169         if (ret < 0)
 170                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 171
 172         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_DNSNAME,
 173                 &name4);
 174         if (ret < 0)
 175                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 176
 177         ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_URI,
 178                 &name3);
 179         if (ret < 0)
 180                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 181
 182         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_RFC822NAME,
 183                 &mail1);
 184         if (ret < 0)
 185                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 186
 187         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_RFC822NAME,
 188                 &mail2);
 189         if (ret < 0)
 190                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 191
 192         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_RFC822NAME,
 193                 &mail3);
 194         if (ret < 0)
 195                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 196
 197         ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_RFC822NAME,
 198                 &mail4);
 199         if (ret < 0)
 200                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 201
 202         ret = gnutls_x509_crt_set_name_constraints(crt, nc, 1);
 203         if (ret < 0)
 204                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 205
 206         /* 2: test the reading of the generated constraints */
 207
 208         i = 0;
 209         do {
 210                 ret = gnutls_x509_name_constraints_get_permitted(nc, i++, &type, &name);
 211
 212                 if (ret >= 0 && i == 1) {
 213                         if (name.size != name1.size || memcmp(name.data, name1.data, name1.size) != 0) {
 214                                 fail("%d: error reading 1st constraint\n", __LINE__);
 215                         }
 216                 }
 217         } while(ret == 0);
 218
 219         if (i-1 != 5) {
 220                 fail("Could not read all contraints; read %d, expected %d\n", i-1, 5);
 221         }
 222
 223         i = 0;
 224         do {
 225                 ret = gnutls_x509_name_constraints_get_excluded(nc, i++, &type, &name);
 226
 227                 if (ret >= 0 && i == 1) {
 228                         if (name.size != name2.size || memcmp(name.data, name2.data, name2.size) != 0) {
 229                                 fail("%d: error reading 1st excluded constraint\n", __LINE__);
 230                         }
 231                 }
 232                 if (ret >= 0 && i == 2) {
 233                         if (name.size != name3.size || memcmp(name.data, name3.data, name3.size) != 0) {
 234                                 fail("%d: error reading 1st excluded constraint\n", __LINE__);
 235                         }
 236                 }
 237         } while(ret == 0);
 238
 239         if (i-1 != 4) {
 240                 fail("Could not read all excluded contraints; read %d, expected %d\n", i-1, 4);
 241         }
 242
 243         /* 3: test the name constraints check function */
 244
 245         /* This name constraints structure doesn't have any excluded GNUTLS_SAN_DN so
 246          * this test should succeed */
 247         name.data = (unsigned char*)"ASFHAJHjhafjs";
 248         name.size = strlen((char*)name.data);
 249         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DN, &name);
 250         if (ret == 0)
 251                 fail("Checking DN should have succeeded\n");
 252
 253         /* Test e-mails */
 254         name.data = (unsigned char*)"nmav@redhat.com";
 255         name.size = strlen((char*)name.data);
 256         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 257         if (ret == 0)
 258                 fail("Checking email should have succeeded\n");
 259
 260         name.data = (unsigned char*)"nmav@radhat.com";
 261         name.size = strlen((char*)name.data);
 262         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 263         if (ret != 0)
 264                 fail("Checking email should have failed\n");
 265
 266         name.data = (unsigned char*)"nmav@example.com";
 267         name.size = strlen((char*)name.data);
 268         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 269         if (ret == 0)
 270                 fail("Checking email should have succeeded\n");
 271
 272         name.data = (unsigned char*)"nmav@test.example.net";
 273         name.size = strlen((char*)name.data);
 274         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 275         if (ret == 0)
 276                 fail("Checking email should have succeeded\n");
 277
 278         name.data = (unsigned char*)"nmav@example.net";
 279         name.size = strlen((char*)name.data);
 280         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 281         if (ret != 0)
 282                 fail("Checking email should have failed\n");
 283
 284         name.data = (unsigned char*)"nmav@koko.example.net";
 285         name.size = strlen((char*)name.data);
 286         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 287         if (ret != 0)
 288                 fail("Checking email should have failed\n");
 289
 290         /* This name constraints structure does have an excluded URI so
 291          * this test should fail */
 292         name.data = (unsigned char*)"http://www.com";
 293         name.size = strlen((char*)name.data);
 294         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_URI, &name);
 295         if (ret != 0)
 296                 fail("Checking URI should have failed\n");
 297
 298         name.data = (unsigned char*)"goodexample.com";
 299         name.size = strlen((char*)name.data);
 300         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 301         if (ret == 0)
 302                 fail("Checking %s should have succeeded\n", name.data);
 303
 304         name.data = (unsigned char*)"good.com";
 305         name.size = strlen((char*)name.data);
 306         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 307         if (ret == 0)
 308                 fail("Checking %s should have succeeded\n", name.data);
 309
 310         name.data = (unsigned char*)"www.example.com";
 311         name.size = strlen((char*)name.data);
 312         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 313         if (ret != 0)
 314                 fail("Checking %s should have failed\n", name.data);
 315
 316         name.data = (unsigned char*)"www.example.net";
 317         name.size = strlen((char*)name.data);
 318         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 319         if (ret != 0)
 320                 fail("Checking %s should have failed\n", name.data);
 321
 322         name.data = (unsigned char*)"www.example.gr";
 323         name.size = strlen((char*)name.data);
 324         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 325         if (ret == 0)
 326                 fail("Checking %s should have succeeded\n", name.data);
 327
 328         gnutls_x509_name_constraints_deinit(nc);
 329         gnutls_x509_crt_deinit(crt);
 330
 331         gnutls_global_deinit();
 332
 333         if (debug)
 334                 success("success");
 335 }