tests/name-constraints.c

   1 /*
   2  * Copyright (C) 2014 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * GnuTLS is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 3 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * GnuTLS is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with GnuTLS; if not, write to the Free Software Foundation,
  20  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 /* Parts copied from GnuTLS example programs. */
  24
  25 #ifdef HAVE_CONFIG_H
  26 #include <config.h>
  27 #endif
  28
  29 #include <stdio.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <sys/types.h>
  33 #include <unistd.h>
  34 #include <gnutls/gnutls.h>
  35 #include <gnutls/x509.h>
  36
  37 #include "utils.h"
  38
  39 /* Test for name constraints PKIX extension.
  40  */
  41
  42 static void tls_log_func(int level, const char *str)
  43 {
  44         fprintf(stderr, "<%d>| %s", level, str);
  45 }
  46
  47 static unsigned char cert_pem[] =
  48     "-----BEGIN CERTIFICATE-----\n"
  49     "MIIEMTCCAxmgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBlTELMAkGA1UEBhMCR1Ix\n"
  50     "RDBCBgNVBAoTO0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1\n"
  51     "dGlvbnMgQ2VydC4gQXV0aG9yaXR5MUAwPgYDVQQDEzdIZWxsZW5pYyBBY2FkZW1p\n"
  52     "YyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIFJvb3RDQSAyMDExMB4XDTExMTIw\n"
  53     "NjEzNDk1MloXDTMxMTIwMTEzNDk1MlowgZUxCzAJBgNVBAYTAkdSMUQwQgYDVQQK\n"
  54     "EztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENl\n"
  55     "cnQuIEF1dGhvcml0eTFAMD4GA1UEAxM3SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl\n"
  56     "c2VhcmNoIEluc3RpdHV0aW9ucyBSb290Q0EgMjAxMTCCASIwDQYJKoZIhvcNAQEB\n"
  57     "BQADggEPADCCAQoCggEBAKlTAOMupvaO+mDYLZU++CwqVE7NuYRhlFhPjz2L5EPz\n"
  58     "dYmNUeTDN9KKiE15HrcS3UN4SoqS5tdI1Q+kOilENbgH9mgdVc04UfCMJDGFr4PJ\n"
  59     "fel3r+0ae50X+bOdOFAPplp5kYCvN66m0zH7tSYJnTxa71HFK9+WXesyHgLacEns\n"
  60     "bgzImjeN9/E2YEsmLIKe0HjzDQ9jpFEw4fkrJxIH2Oq9GGKYsFk3fb7u8yBRQlqD\n"
  61     "75O6aRXxYp2fmTmCobd0LovUxQt7L/DICto9eQqakxylKHJzkUOap9FNhYS5qXSP\n"
  62     "FEDH3N6sQWRstBmbAmNtJGSPRLIl6s5ddAxjMlyNh+UCAwEAAaOBiTCBhjAPBgNV\n"
  63     "HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUppFC/RNhSiOeCKQp\n"
  64     "5dgTBCPuQSUwRwYDVR0eBEAwPqA8MAWCAy5ncjAFggMuZXUwBoIELmVkdTAGggQu\n"
  65     "b3JnMAWBAy5ncjAFgQMuZXUwBoEELmVkdTAGgQQub3JnMA0GCSqGSIb3DQEBBQUA\n"
  66     "A4IBAQAf73lB4XtuP7KMhjdCSk4cNx6NZrokgclPEg8hwAOXhiVtXdMiKahsog2p\n"
  67     "6z0GW5k6x8zDmjR/qw7IThzh+uTczQ2+vyT+bOdrwg3IBp5OjWEopmr95fZi6hg8\n"
  68     "TqBTnbI6nOulnJEWtk2C4AwFSKls9cz4y51JtPACpf1wA+2KIaWuE4ZJwzNzvoc7\n"
  69     "dIsXRSZMFpGD/md9zU1jZ/rzAxKWeAaNsWftjj++n08C9bMJL/NMh98qy5V8Acys\n"
  70     "Nnq/onN694/BtZqhFLKPM58N7yLcZnuEvUUXBj08yrl3NI/K6s8/MT7jiOOASSXI\n"
  71     "l7WdmplNsDz4SgCbZN2fOUvRJ9e4\n"
  72     "-----END CERTIFICATE-----\n";
  73
  74 const gnutls_datum_t cert = { cert_pem, sizeof(cert_pem) };
  75
  76 const gnutls_datum_t name1 = { (void*)"com", 3 };
  77 const gnutls_datum_t name2 = { (void*)"example.com", sizeof("example.com")-1 };
  78 const gnutls_datum_t name3 = { (void*)"another.example.com", sizeof("another.example.com")-1 };
  79
  80 const gnutls_datum_t mail1 = { (void*)"example.com", sizeof("example.com")-1 };
  81 const gnutls_datum_t mail2 = { (void*)".example.net", sizeof(".example.net")-1 };
  82 const gnutls_datum_t mail3 = { (void*)"nmav@redhat.com", sizeof("nmav@redhat.com")-1 };
  83 const gnutls_datum_t mail4 = { (void*)"koko.example.net", sizeof("koko.example.net")-1 };
  84
  85 void doit(void)
  86 {
  87         int ret;
  88         unsigned int crit, i;
  89         gnutls_x509_crt_t crt;
  90         gnutls_x509_name_constraints_t nc;
  91         unsigned type;
  92         gnutls_datum_t name;
  93
  94         /* this must be called once in the program
  95          */
  96         global_init();
  97
  98         gnutls_global_set_log_function(tls_log_func);
  99         if (debug)
 100                 gnutls_global_set_log_level(6);
 101
 102         /* 0: test the reading of name constraints */
 103
 104         ret = gnutls_x509_name_constraints_init(&nc);
 105         if (ret < 0)
 106                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 107
 108         ret = gnutls_x509_crt_init(&crt);
 109         if (ret < 0)
 110                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 111
 112         ret = gnutls_x509_crt_import(crt, &cert, GNUTLS_X509_FMT_PEM);
 113         if (ret < 0)
 114                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 115
 116         ret = gnutls_x509_crt_get_name_constraints(crt, nc, 0, &crit);
 117         if (ret < 0)
 118                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 119
 120         if (crit != 0) {
 121                 fail("error reading criticality\n");
 122         }
 123
 124         i = 0;
 125         do {
 126                 ret = gnutls_x509_name_constraints_get_permitted(nc, i++, &type, &name);
 127
 128                 if (ret >= 0 && i == 2) {
 129                         if (name.size != 3 || memcmp(name.data, ".eu", 3) != 0) {
 130                                 fail("error reading 2nd constraint\n");
 131                         }
 132                 }
 133         } while(ret == 0);
 134
 135         if (i-1 != 8) {
 136                 fail("Could not read all contraints; read %d, expected %d\n", i-1, 8);
 137         }
 138
 139         gnutls_x509_name_constraints_deinit(nc);
 140         gnutls_x509_crt_deinit(crt);
 141
 142         /* 1: test the generation of name constraints */
 143
 144         ret = gnutls_x509_name_constraints_init(&nc);
 145         if (ret < 0)
 146                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 147
 148         ret = gnutls_x509_crt_init(&crt);
 149         if (ret < 0)
 150                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 151
 152         ret = gnutls_x509_crt_import(crt, &cert, GNUTLS_X509_FMT_PEM);
 153         if (ret < 0)
 154                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 155
 156         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_DNSNAME,
 157                 &name1);
 158         if (ret < 0)
 159                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 160
 161         ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_DNSNAME,
 162                 &name2);
 163         if (ret < 0)
 164                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 165
 166         ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_DNSNAME,
 167                 &name3);
 168         if (ret < 0)
 169                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 170
 171         ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_URI,
 172                 &name3);
 173         if (ret < 0)
 174                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 175
 176         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_RFC822NAME,
 177                 &mail1);
 178         if (ret < 0)
 179                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 180
 181         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_RFC822NAME,
 182                 &mail2);
 183         if (ret < 0)
 184                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 185
 186         ret = gnutls_x509_name_constraints_add_permitted(nc, GNUTLS_SAN_RFC822NAME,
 187                 &mail3);
 188         if (ret < 0)
 189                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 190
 191         ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_RFC822NAME,
 192                 &mail4);
 193         if (ret < 0)
 194                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 195
 196         ret = gnutls_x509_crt_set_name_constraints(crt, nc, 1);
 197         if (ret < 0)
 198                 fail("error in %d: %s\n", __LINE__, gnutls_strerror(ret));
 199
 200         /* 2: test the reading of the generated constraints */
 201
 202         i = 0;
 203         do {
 204                 ret = gnutls_x509_name_constraints_get_permitted(nc, i++, &type, &name);
 205
 206                 if (ret >= 0 && i == 1) {
 207                         if (name.size != name1.size || memcmp(name.data, name1.data, name1.size) != 0) {
 208                                 fail("%d: error reading 1st constraint\n", __LINE__);
 209                         }
 210                 }
 211         } while(ret == 0);
 212
 213         if (i-1 != 4) {
 214                 fail("Could not read all contraints; read %d, expected %d\n", i-1, 4);
 215         }
 216
 217         i = 0;
 218         do {
 219                 ret = gnutls_x509_name_constraints_get_excluded(nc, i++, &type, &name);
 220
 221                 if (ret >= 0 && i == 1) {
 222                         if (name.size != name2.size || memcmp(name.data, name2.data, name2.size) != 0) {
 223                                 fail("%d: error reading 1st excluded constraint\n", __LINE__);
 224                         }
 225                 }
 226                 if (ret >= 0 && i == 2) {
 227                         if (name.size != name3.size || memcmp(name.data, name3.data, name3.size) != 0) {
 228                                 fail("%d: error reading 1st excluded constraint\n", __LINE__);
 229                         }
 230                 }
 231         } while(ret == 0);
 232
 233         if (i-1 != 4) {
 234                 fail("Could not read all excluded contraints; read %d, expected %d\n", i-1, 4);
 235         }
 236
 237         /* 3: test the name constraints check function */
 238
 239         /* This name constraints structure doesn't have any excluded GNUTLS_SAN_DN so
 240          * this test should succeed */
 241         name.data = (unsigned char*)"ASFHAJHjhafjs";
 242         name.size = strlen((char*)name.data);
 243         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DN, &name);
 244         if (ret == 0)
 245                 fail("Checking DN should have succeeded\n");
 246
 247         /* Test e-mails */
 248         name.data = (unsigned char*)"nmav@redhat.com";
 249         name.size = strlen((char*)name.data);
 250         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 251         if (ret == 0)
 252                 fail("Checking email should have succeeded\n");
 253
 254         name.data = (unsigned char*)"nmav@radhat.com";
 255         name.size = strlen((char*)name.data);
 256         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 257         if (ret != 0)
 258                 fail("Checking email should have failed\n");
 259
 260         name.data = (unsigned char*)"nmav@example.com";
 261         name.size = strlen((char*)name.data);
 262         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 263         if (ret == 0)
 264                 fail("Checking email should have succeeded\n");
 265
 266         name.data = (unsigned char*)"nmav@test.example.net";
 267         name.size = strlen((char*)name.data);
 268         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 269         if (ret == 0)
 270                 fail("Checking email should have succeeded\n");
 271
 272         name.data = (unsigned char*)"nmav@example.net";
 273         name.size = strlen((char*)name.data);
 274         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 275         if (ret != 0)
 276                 fail("Checking email should have failed\n");
 277
 278         name.data = (unsigned char*)"nmav@koko.example.net";
 279         name.size = strlen((char*)name.data);
 280         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_RFC822NAME, &name);
 281         if (ret != 0)
 282                 fail("Checking email should have failed\n");
 283
 284         /* This name constraints structure does have an excluded URI so
 285          * this test should fail */
 286         name.data = (unsigned char*)"http://www.com";
 287         name.size = strlen((char*)name.data);
 288         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_URI, &name);
 289         if (ret != 0)
 290                 fail("Checking URI should have failed\n");
 291
 292         name.data = (unsigned char*)"goodexample.com";
 293         name.size = strlen((char*)name.data);
 294         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 295         if (ret == 0)
 296                 fail("Checking %s should have succeeded\n", name.data);
 297
 298         name.data = (unsigned char*)"good.com";
 299         name.size = strlen((char*)name.data);
 300         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 301         if (ret == 0)
 302                 fail("Checking %s should have succeeded\n", name.data);
 303
 304         name.data = (unsigned char*)"www.example.com";
 305         name.size = strlen((char*)name.data);
 306         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 307         if (ret != 0)
 308                 fail("Checking %s should have failed\n", name.data);
 309
 310         name.data = (unsigned char*)"www.example.net";
 311         name.size = strlen((char*)name.data);
 312         ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
 313         if (ret != 0)
 314                 fail("Checking %s should have failed\n", name.data);
 315
 316         gnutls_x509_name_constraints_deinit(nc);
 317         gnutls_x509_crt_deinit(crt);
 318
 319         gnutls_global_deinit();
 320
 321         if (debug)
 322                 success("success");
 323 }