v3nametest.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716
  1. /*
  2. * Copyright 2012-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <string.h>
  10. #include <openssl/e_os2.h>
  11. #include <openssl/x509.h>
  12. #include <openssl/x509v3.h>
  13. #include "internal/nelem.h"
  14. #include "testutil.h"
  15. static const char *const names[] = {
  16. "a", "b", ".", "*", "@",
  17. ".a", "a.", ".b", "b.", ".*", "*.", "*@", "@*", "a@", "@a", "b@", "..",
  18. "-example.com", "example-.com",
  19. "@@", "**", "*.com", "*com", "*.*.com", "*com", "com*", "*example.com",
  20. "*@example.com", "test@*.example.com", "example.com", "www.example.com",
  21. "test.www.example.com", "*.example.com", "*.www.example.com",
  22. "test.*.example.com", "www.*.com",
  23. ".www.example.com", "*www.example.com",
  24. "example.net", "xn--rger-koa.example.com",
  25. "*.xn--rger-koa.example.com", "www.xn--rger-koa.example.com",
  26. "*.good--example.com", "www.good--example.com",
  27. "*.xn--bar.com", "xn--foo.xn--bar.com",
  28. "a.example.com", "b.example.com",
  29. "postmaster@example.com", "Postmaster@example.com",
  30. "postmaster@EXAMPLE.COM",
  31. NULL
  32. };
  33. static const char *const exceptions[] = {
  34. "set CN: host: [*.example.com] matches [a.example.com]",
  35. "set CN: host: [*.example.com] matches [b.example.com]",
  36. "set CN: host: [*.example.com] matches [www.example.com]",
  37. "set CN: host: [*.example.com] matches [xn--rger-koa.example.com]",
  38. "set CN: host: [*.www.example.com] matches [test.www.example.com]",
  39. "set CN: host: [*.www.example.com] matches [.www.example.com]",
  40. "set CN: host: [*www.example.com] matches [www.example.com]",
  41. "set CN: host: [test.www.example.com] matches [.www.example.com]",
  42. "set CN: host: [*.xn--rger-koa.example.com] matches [www.xn--rger-koa.example.com]",
  43. "set CN: host: [*.xn--bar.com] matches [xn--foo.xn--bar.com]",
  44. "set CN: host: [*.good--example.com] matches [www.good--example.com]",
  45. "set CN: host-no-wildcards: [*.www.example.com] matches [.www.example.com]",
  46. "set CN: host-no-wildcards: [test.www.example.com] matches [.www.example.com]",
  47. "set emailAddress: email: [postmaster@example.com] does not match [Postmaster@example.com]",
  48. "set emailAddress: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
  49. "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@example.com]",
  50. "set emailAddress: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
  51. "set dnsName: host: [*.example.com] matches [www.example.com]",
  52. "set dnsName: host: [*.example.com] matches [a.example.com]",
  53. "set dnsName: host: [*.example.com] matches [b.example.com]",
  54. "set dnsName: host: [*.example.com] matches [xn--rger-koa.example.com]",
  55. "set dnsName: host: [*.www.example.com] matches [test.www.example.com]",
  56. "set dnsName: host-no-wildcards: [*.www.example.com] matches [.www.example.com]",
  57. "set dnsName: host-no-wildcards: [test.www.example.com] matches [.www.example.com]",
  58. "set dnsName: host: [*.www.example.com] matches [.www.example.com]",
  59. "set dnsName: host: [*www.example.com] matches [www.example.com]",
  60. "set dnsName: host: [test.www.example.com] matches [.www.example.com]",
  61. "set dnsName: host: [*.xn--rger-koa.example.com] matches [www.xn--rger-koa.example.com]",
  62. "set dnsName: host: [*.xn--bar.com] matches [xn--foo.xn--bar.com]",
  63. "set dnsName: host: [*.good--example.com] matches [www.good--example.com]",
  64. "set rfc822Name: email: [postmaster@example.com] does not match [Postmaster@example.com]",
  65. "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@example.com]",
  66. "set rfc822Name: email: [Postmaster@example.com] does not match [postmaster@EXAMPLE.COM]",
  67. "set rfc822Name: email: [postmaster@EXAMPLE.COM] does not match [Postmaster@example.com]",
  68. NULL
  69. };
  70. static int is_exception(const char *msg)
  71. {
  72. const char *const *p;
  73. for (p = exceptions; *p; ++p)
  74. if (strcmp(msg, *p) == 0)
  75. return 1;
  76. return 0;
  77. }
  78. static int set_cn(X509 *crt, ...)
  79. {
  80. int ret = 0;
  81. X509_NAME *n = NULL;
  82. va_list ap;
  83. va_start(ap, crt);
  84. n = X509_NAME_new();
  85. if (n == NULL)
  86. goto out;
  87. while (1) {
  88. int nid;
  89. const char *name;
  90. nid = va_arg(ap, int);
  91. if (nid == 0)
  92. break;
  93. name = va_arg(ap, const char *);
  94. if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC,
  95. (unsigned char *)name, -1, -1, 1))
  96. goto out;
  97. }
  98. if (!X509_set_subject_name(crt, n))
  99. goto out;
  100. ret = 1;
  101. out:
  102. X509_NAME_free(n);
  103. va_end(ap);
  104. return ret;
  105. }
  106. /*-
  107. int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
  108. X509_EXTENSION *X509_EXTENSION_create_by_NID(X509_EXTENSION **ex,
  109. int nid, int crit, ASN1_OCTET_STRING *data);
  110. int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);
  111. */
  112. static int set_altname(X509 *crt, ...)
  113. {
  114. int ret = 0;
  115. GENERAL_NAMES *gens = NULL;
  116. GENERAL_NAME *gen = NULL;
  117. ASN1_IA5STRING *ia5 = NULL;
  118. va_list ap;
  119. va_start(ap, crt);
  120. gens = sk_GENERAL_NAME_new_null();
  121. if (gens == NULL)
  122. goto out;
  123. while (1) {
  124. int type;
  125. const char *name;
  126. type = va_arg(ap, int);
  127. if (type == 0)
  128. break;
  129. name = va_arg(ap, const char *);
  130. gen = GENERAL_NAME_new();
  131. if (gen == NULL)
  132. goto out;
  133. ia5 = ASN1_IA5STRING_new();
  134. if (ia5 == NULL)
  135. goto out;
  136. if (!ASN1_STRING_set(ia5, name, -1))
  137. goto out;
  138. switch (type) {
  139. case GEN_EMAIL:
  140. case GEN_DNS:
  141. GENERAL_NAME_set0_value(gen, type, ia5);
  142. ia5 = NULL;
  143. break;
  144. default:
  145. abort();
  146. }
  147. sk_GENERAL_NAME_push(gens, gen);
  148. gen = NULL;
  149. }
  150. if (!X509_add1_ext_i2d(crt, NID_subject_alt_name, gens, 0, 0))
  151. goto out;
  152. ret = 1;
  153. out:
  154. ASN1_IA5STRING_free(ia5);
  155. GENERAL_NAME_free(gen);
  156. GENERAL_NAMES_free(gens);
  157. va_end(ap);
  158. return ret;
  159. }
  160. static int set_cn1(X509 *crt, const char *name)
  161. {
  162. return set_cn(crt, NID_commonName, name, 0);
  163. }
  164. static int set_cn_and_email(X509 *crt, const char *name)
  165. {
  166. return set_cn(crt, NID_commonName, name,
  167. NID_pkcs9_emailAddress, "dummy@example.com", 0);
  168. }
  169. static int set_cn2(X509 *crt, const char *name)
  170. {
  171. return set_cn(crt, NID_commonName, "dummy value",
  172. NID_commonName, name, 0);
  173. }
  174. static int set_cn3(X509 *crt, const char *name)
  175. {
  176. return set_cn(crt, NID_commonName, name,
  177. NID_commonName, "dummy value", 0);
  178. }
  179. static int set_email1(X509 *crt, const char *name)
  180. {
  181. return set_cn(crt, NID_pkcs9_emailAddress, name, 0);
  182. }
  183. static int set_email2(X509 *crt, const char *name)
  184. {
  185. return set_cn(crt, NID_pkcs9_emailAddress, "dummy@example.com",
  186. NID_pkcs9_emailAddress, name, 0);
  187. }
  188. static int set_email3(X509 *crt, const char *name)
  189. {
  190. return set_cn(crt, NID_pkcs9_emailAddress, name,
  191. NID_pkcs9_emailAddress, "dummy@example.com", 0);
  192. }
  193. static int set_email_and_cn(X509 *crt, const char *name)
  194. {
  195. return set_cn(crt, NID_pkcs9_emailAddress, name,
  196. NID_commonName, "www.example.org", 0);
  197. }
  198. static int set_altname_dns(X509 *crt, const char *name)
  199. {
  200. return set_altname(crt, GEN_DNS, name, 0);
  201. }
  202. static int set_altname_email(X509 *crt, const char *name)
  203. {
  204. return set_altname(crt, GEN_EMAIL, name, 0);
  205. }
  206. struct set_name_fn {
  207. int (*fn) (X509 *, const char *);
  208. const char *name;
  209. int host;
  210. int email;
  211. };
  212. static const struct set_name_fn name_fns[] = {
  213. {set_cn1, "set CN", 1, 0},
  214. {set_cn2, "set CN", 1, 0},
  215. {set_cn3, "set CN", 1, 0},
  216. {set_cn_and_email, "set CN", 1, 0},
  217. {set_email1, "set emailAddress", 0, 1},
  218. {set_email2, "set emailAddress", 0, 1},
  219. {set_email3, "set emailAddress", 0, 1},
  220. {set_email_and_cn, "set emailAddress", 0, 1},
  221. {set_altname_dns, "set dnsName", 1, 0},
  222. {set_altname_email, "set rfc822Name", 0, 1},
  223. };
  224. static X509 *make_cert(void)
  225. {
  226. X509 *crt = NULL;
  227. if (!TEST_ptr(crt = X509_new()))
  228. return NULL;
  229. if (!TEST_true(X509_set_version(crt, X509_VERSION_3))) {
  230. X509_free(crt);
  231. return NULL;
  232. }
  233. return crt;
  234. }
  235. static int check_message(const struct set_name_fn *fn, const char *op,
  236. const char *nameincert, int match, const char *name)
  237. {
  238. char msg[1024];
  239. if (match < 0)
  240. return 1;
  241. BIO_snprintf(msg, sizeof(msg), "%s: %s: [%s] %s [%s]",
  242. fn->name, op, nameincert,
  243. match ? "matches" : "does not match", name);
  244. if (is_exception(msg))
  245. return 1;
  246. TEST_error("%s", msg);
  247. return 0;
  248. }
  249. static int run_cert(X509 *crt, const char *nameincert,
  250. const struct set_name_fn *fn)
  251. {
  252. const char *const *pname = names;
  253. int failed = 0;
  254. for (; *pname != NULL; ++pname) {
  255. int samename = OPENSSL_strcasecmp(nameincert, *pname) == 0;
  256. size_t namelen = strlen(*pname);
  257. char *name = OPENSSL_malloc(namelen + 1);
  258. int match, ret;
  259. if (!TEST_ptr(name))
  260. return 0;
  261. memcpy(name, *pname, namelen + 1);
  262. match = -1;
  263. if (!TEST_int_ge(ret = X509_check_host(crt, name, namelen, 0, NULL),
  264. 0)) {
  265. failed = 1;
  266. } else if (fn->host) {
  267. if (ret == 1 && !samename)
  268. match = 1;
  269. if (ret == 0 && samename)
  270. match = 0;
  271. } else if (ret == 1)
  272. match = 1;
  273. if (!TEST_true(check_message(fn, "host", nameincert, match, *pname)))
  274. failed = 1;
  275. match = -1;
  276. if (!TEST_int_ge(ret = X509_check_host(crt, name, namelen,
  277. X509_CHECK_FLAG_NO_WILDCARDS,
  278. NULL), 0)) {
  279. failed = 1;
  280. } else if (fn->host) {
  281. if (ret == 1 && !samename)
  282. match = 1;
  283. if (ret == 0 && samename)
  284. match = 0;
  285. } else if (ret == 1)
  286. match = 1;
  287. if (!TEST_true(check_message(fn, "host-no-wildcards",
  288. nameincert, match, *pname)))
  289. failed = 1;
  290. match = -1;
  291. ret = X509_check_email(crt, name, namelen, 0);
  292. if (fn->email) {
  293. if (ret && !samename)
  294. match = 1;
  295. if (!ret && samename && strchr(nameincert, '@') != NULL)
  296. match = 0;
  297. } else if (ret)
  298. match = 1;
  299. if (!TEST_true(check_message(fn, "email", nameincert, match, *pname)))
  300. failed = 1;
  301. OPENSSL_free(name);
  302. }
  303. return failed == 0;
  304. }
  305. static int call_run_cert(int i)
  306. {
  307. int failed = 0;
  308. const struct set_name_fn *pfn = &name_fns[i];
  309. X509 *crt;
  310. const char *const *pname;
  311. TEST_info("%s", pfn->name);
  312. for (pname = names; *pname != NULL; pname++) {
  313. if (!TEST_ptr(crt = make_cert())
  314. || !TEST_true(pfn->fn(crt, *pname))
  315. || !run_cert(crt, *pname, pfn))
  316. failed = 1;
  317. X509_free(crt);
  318. }
  319. return failed == 0;
  320. }
  321. static struct gennamedata {
  322. const unsigned char der[22];
  323. size_t derlen;
  324. } gennames[] = {
  325. {
  326. /*
  327. * [0] {
  328. * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
  329. * [0] {
  330. * SEQUENCE {}
  331. * }
  332. * }
  333. */
  334. {
  335. 0xa0, 0x13, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
  336. 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x02, 0x30, 0x00
  337. },
  338. 21
  339. }, {
  340. /*
  341. * [0] {
  342. * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
  343. * [0] {
  344. * [APPLICATION 0] {}
  345. * }
  346. * }
  347. */
  348. {
  349. 0xa0, 0x13, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
  350. 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x02, 0x60, 0x00
  351. },
  352. 21
  353. }, {
  354. /*
  355. * [0] {
  356. * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
  357. * [0] {
  358. * UTF8String { "a" }
  359. * }
  360. * }
  361. */
  362. {
  363. 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
  364. 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x03, 0x0c, 0x01, 0x61
  365. },
  366. 22
  367. }, {
  368. /*
  369. * [0] {
  370. * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.2 }
  371. * [0] {
  372. * UTF8String { "a" }
  373. * }
  374. * }
  375. */
  376. {
  377. 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
  378. 0x01, 0x84, 0xb7, 0x09, 0x02, 0x02, 0xa0, 0x03, 0x0c, 0x01, 0x61
  379. },
  380. 22
  381. }, {
  382. /*
  383. * [0] {
  384. * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
  385. * [0] {
  386. * UTF8String { "b" }
  387. * }
  388. * }
  389. */
  390. {
  391. 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
  392. 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x03, 0x0c, 0x01, 0x62
  393. },
  394. 22
  395. }, {
  396. /*
  397. * [0] {
  398. * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
  399. * [0] {
  400. * BOOLEAN { TRUE }
  401. * }
  402. * }
  403. */
  404. {
  405. 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
  406. 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x03, 0x01, 0x01, 0xff
  407. },
  408. 22
  409. }, {
  410. /*
  411. * [0] {
  412. * OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2.1 }
  413. * [0] {
  414. * BOOLEAN { FALSE }
  415. * }
  416. * }
  417. */
  418. {
  419. 0xa0, 0x14, 0x06, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04,
  420. 0x01, 0x84, 0xb7, 0x09, 0x02, 0x01, 0xa0, 0x03, 0x01, 0x01, 0x00
  421. },
  422. 22
  423. }, {
  424. /* [1 PRIMITIVE] { "a" } */
  425. {
  426. 0x81, 0x01, 0x61
  427. },
  428. 3
  429. }, {
  430. /* [1 PRIMITIVE] { "b" } */
  431. {
  432. 0x81, 0x01, 0x62
  433. },
  434. 3
  435. }, {
  436. /* [2 PRIMITIVE] { "a" } */
  437. {
  438. 0x82, 0x01, 0x61
  439. },
  440. 3
  441. }, {
  442. /* [2 PRIMITIVE] { "b" } */
  443. {
  444. 0x82, 0x01, 0x62
  445. },
  446. 3
  447. }, {
  448. /*
  449. * [4] {
  450. * SEQUENCE {
  451. * SET {
  452. * SEQUENCE {
  453. * # commonName
  454. * OBJECT_IDENTIFIER { 2.5.4.3 }
  455. * UTF8String { "a" }
  456. * }
  457. * }
  458. * }
  459. * }
  460. */
  461. {
  462. 0xa4, 0x0e, 0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55,
  463. 0x04, 0x03, 0x0c, 0x01, 0x61
  464. },
  465. 16
  466. }, {
  467. /*
  468. * [4] {
  469. * SEQUENCE {
  470. * SET {
  471. * SEQUENCE {
  472. * # commonName
  473. * OBJECT_IDENTIFIER { 2.5.4.3 }
  474. * UTF8String { "b" }
  475. * }
  476. * }
  477. * }
  478. * }
  479. */
  480. {
  481. 0xa4, 0x0e, 0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55,
  482. 0x04, 0x03, 0x0c, 0x01, 0x62
  483. },
  484. 16
  485. }, {
  486. /*
  487. * [5] {
  488. * [1] {
  489. * UTF8String { "a" }
  490. * }
  491. * }
  492. */
  493. {
  494. 0xa5, 0x05, 0xa1, 0x03, 0x0c, 0x01, 0x61
  495. },
  496. 7
  497. }, {
  498. /*
  499. * [5] {
  500. * [1] {
  501. * UTF8String { "b" }
  502. * }
  503. * }
  504. */
  505. {
  506. 0xa5, 0x05, 0xa1, 0x03, 0x0c, 0x01, 0x62
  507. },
  508. 7
  509. }, {
  510. /*
  511. * [5] {
  512. * [0] {
  513. * UTF8String {}
  514. * }
  515. * [1] {
  516. * UTF8String { "a" }
  517. * }
  518. * }
  519. */
  520. {
  521. 0xa5, 0x09, 0xa0, 0x02, 0x0c, 0x00, 0xa1, 0x03, 0x0c, 0x01, 0x61
  522. },
  523. 11
  524. }, {
  525. /*
  526. * [5] {
  527. * [0] {
  528. * UTF8String { "a" }
  529. * }
  530. * [1] {
  531. * UTF8String { "a" }
  532. * }
  533. * }
  534. */
  535. {
  536. 0xa5, 0x0a, 0xa0, 0x03, 0x0c, 0x01, 0x61, 0xa1, 0x03, 0x0c, 0x01,
  537. 0x61
  538. },
  539. 12
  540. }, {
  541. /*
  542. * [5] {
  543. * [0] {
  544. * UTF8String { "b" }
  545. * }
  546. * [1] {
  547. * UTF8String { "a" }
  548. * }
  549. * }
  550. */
  551. {
  552. 0xa5, 0x0a, 0xa0, 0x03, 0x0c, 0x01, 0x62, 0xa1, 0x03, 0x0c, 0x01,
  553. 0x61
  554. },
  555. 12
  556. }, {
  557. /* [6 PRIMITIVE] { "a" } */
  558. {
  559. 0x86, 0x01, 0x61
  560. },
  561. 3
  562. }, {
  563. /* [6 PRIMITIVE] { "b" } */
  564. {
  565. 0x86, 0x01, 0x62
  566. },
  567. 3
  568. }, {
  569. /* [7 PRIMITIVE] { `11111111` } */
  570. {
  571. 0x87, 0x04, 0x11, 0x11, 0x11, 0x11
  572. },
  573. 6
  574. }, {
  575. /* [7 PRIMITIVE] { `22222222`} */
  576. {
  577. 0x87, 0x04, 0x22, 0x22, 0x22, 0x22
  578. },
  579. 6
  580. }, {
  581. /* [7 PRIMITIVE] { `11111111111111111111111111111111` } */
  582. {
  583. 0x87, 0x10, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
  584. 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11
  585. },
  586. 18
  587. }, {
  588. /* [7 PRIMITIVE] { `22222222222222222222222222222222` } */
  589. {
  590. 0x87, 0x10, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
  591. 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22
  592. },
  593. 18
  594. }, {
  595. /* [8 PRIMITIVE] { 1.2.840.113554.4.1.72585.2.1 } */
  596. {
  597. 0x88, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04, 0x01, 0x84,
  598. 0xb7, 0x09, 0x02, 0x01
  599. },
  600. 15
  601. }, {
  602. /* [8 PRIMITIVE] { 1.2.840.113554.4.1.72585.2.2 } */
  603. {
  604. 0x88, 0x0d, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04, 0x01, 0x84,
  605. 0xb7, 0x09, 0x02, 0x02
  606. },
  607. 15
  608. }, {
  609. /*
  610. * Regression test for CVE-2023-0286.
  611. */
  612. {
  613. 0xa3, 0x00
  614. },
  615. 2
  616. }
  617. };
  618. static int test_GENERAL_NAME_cmp(void)
  619. {
  620. size_t i, j;
  621. GENERAL_NAME **namesa = OPENSSL_malloc(sizeof(*namesa)
  622. * OSSL_NELEM(gennames));
  623. GENERAL_NAME **namesb = OPENSSL_malloc(sizeof(*namesb)
  624. * OSSL_NELEM(gennames));
  625. int testresult = 0;
  626. if (!TEST_ptr(namesa) || !TEST_ptr(namesb))
  627. goto end;
  628. for (i = 0; i < OSSL_NELEM(gennames); i++) {
  629. const unsigned char *derp = gennames[i].der;
  630. /*
  631. * We create two versions of each GENERAL_NAME so that we ensure when
  632. * we compare them they are always different pointers.
  633. */
  634. namesa[i] = d2i_GENERAL_NAME(NULL, &derp, gennames[i].derlen);
  635. derp = gennames[i].der;
  636. namesb[i] = d2i_GENERAL_NAME(NULL, &derp, gennames[i].derlen);
  637. if (!TEST_ptr(namesa[i]) || !TEST_ptr(namesb[i]))
  638. goto end;
  639. }
  640. /* Every name should be equal to itself and not equal to any others. */
  641. for (i = 0; i < OSSL_NELEM(gennames); i++) {
  642. for (j = 0; j < OSSL_NELEM(gennames); j++) {
  643. if (i == j) {
  644. if (!TEST_int_eq(GENERAL_NAME_cmp(namesa[i], namesb[j]), 0))
  645. goto end;
  646. } else {
  647. if (!TEST_int_ne(GENERAL_NAME_cmp(namesa[i], namesb[j]), 0))
  648. goto end;
  649. }
  650. }
  651. }
  652. testresult = 1;
  653. end:
  654. for (i = 0; i < OSSL_NELEM(gennames); i++) {
  655. if (namesa != NULL)
  656. GENERAL_NAME_free(namesa[i]);
  657. if (namesb != NULL)
  658. GENERAL_NAME_free(namesb[i]);
  659. }
  660. OPENSSL_free(namesa);
  661. OPENSSL_free(namesb);
  662. return testresult;
  663. }
  664. int setup_tests(void)
  665. {
  666. ADD_ALL_TESTS(call_run_cert, OSSL_NELEM(name_fns));
  667. ADD_TEST(test_GENERAL_NAME_cmp);
  668. return 1;
  669. }