Skip to content

Add modified certificate DNS check #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
KarthikaRajendran11 wants to merge 18 commits into
base: master
Choose a base branch
from
Open

Add modified certificate DNS check #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
72b95c0
Add modified certificate DNS check
KarthikaRajendran11 Mar 12, 2022
06d5c57
Remove log
KarthikaRajendran11 Mar 14, 2022
1b6cc4f
Address PR comments
KarthikaRajendran11 Mar 14, 2022
0bb9d01
Add comment
KarthikaRajendran11 Mar 14, 2022
e37c4f7
Address PR comments
KarthikaRajendran11 Mar 15, 2022
e84afdf
Check for IP v4 or v6 inputs
KarthikaRajendran11 Mar 15, 2022
34cea36
Address PR comments
KarthikaRajendran11 Mar 16, 2022
ddd2f57
Adding regex matching
KarthikaRajendran11 Mar 17, 2022
2706fd0
Add libraries
KarthikaRajendran11 Mar 17, 2022
6f6b68c
Fix tests
KarthikaRajendran11 Mar 19, 2022
ce1ddfb
Cleanup
KarthikaRajendran11 Mar 21, 2022
1b0e791
Cleanup
KarthikaRajendran11 Mar 21, 2022
92b5a34
Add IDN examples in code
KarthikaRajendran11 Mar 21, 2022
521d294
Free regex1; Rename fn
KarthikaRajendran11 Mar 21, 2022
5172582
Use goto blocks
KarthikaRajendran11 Mar 23, 2022
1511ae1
Modify calculateLenOfLabel
KarthikaRajendran11 Mar 23, 2022
834d6c9
Cleanup
KarthikaRajendran11 Mar 23, 2022
4f8c53e
Replace 1st memcpy with strcpy
KarthikaRajendran11 Mar 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 34 additions & 61 deletions tests/t_verify_cert.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,8 @@ int
main (int argc, char *argv[])
{
struct clsrvconf conf;
// X509

X509
/* /CN=test */
*certsimple = getcert("-----BEGIN CERTIFICATE-----\n\
Expand Down Expand Up @@ -64,16 +66,6 @@ tCGaM1KbqRZA/3VgQt+6iEFuoxkwFzAVBgNVHREEDjAMggp0ZXN0LmxvY2FsMAkG\n\
ByqGSM49BAEDJAAwIQIPAId8FJW00y8XSFmd2lBvAg5K6WAMIFgjhtwcRFcfQg==\n\
-----END CERTIFICATE-----"),

/* /CN=other, SAN DNS:other.local */
*certsandnsother = getcert("-----BEGIN CERTIFICATE-----\n\
MIHuMIG6oAMCAQICFAiFPNqpXcSIwxS0bfJZs8KDDafVMAkGByqGSM49BAEwEDEO\n\
MAwGA1UEAwwFb3RoZXIwHhcNMjAwOTI5MTYxMTM2WhcNMjAxMDA5MTYxMTM2WjAQ\n\
MQ4wDAYDVQQDDAVvdGhlcjAyMBAGByqGSM49AgEGBSuBBAAGAx4ABJxnszX24oQM\n\
NcK0IZozUpupFkD/dWBC37qIQW6jGjAYMBYGA1UdEQQPMA2CC290aGVyLmxvY2Fs\n\
MAkGByqGSM49BAEDJAAwIQIOTrQCgOkGcknZEchJFDgCDwCY84F0R2BnNEba95o9\n\
NA==\n\
-----END CERTIFICATE-----"),

/* /CN=test, SAN IP Address:192.0.2.1 */
*certsanip = getcert("-----BEGIN CERTIFICATE-----\n\
MIHlMIGxoAMCAQICFEukd75rE75+qB95Bo7fcb9wXlA9MAkGByqGSM49BAEwDzEN\n\
Expand All @@ -92,6 +84,25 @@ NcK0IZozUpupFkD/dWBC37qIQW6jEzARMA8GA1UdEQQIMAaHBMAAAgIwCQYHKoZI\n\
zj0EAQMjADAgAg5trehJeRpM04SJJZ6XnAIOFfzRRnQtm5rnsP+QBe8=\n\
-----END CERTIFICATE-----"),

/* /CN=test, SAN DNS:192.0.2.1 */
*certsanipindns = getcert("-----BEGIN CERTIFICATE-----\n\
MIHqMIG2oAMCAQICFFUjZGG96kpFI2fu90+jAhWsTr8YMAkGByqGSM49BAEwDzEN\n\
MAsGA1UEAwwEdGVzdDAeFw0yMDA5MjkxNTU4NDBaFw0yMDEwMDkxNTU4NDBaMA8x\n\
DTALBgNVBAMMBHRlc3QwMjAQBgcqhkjOPQIBBgUrgQQABgMeAAScZ7M19uKEDDXC\n\
tCGaM1KbqRZA/3VgQt+6iEFuoxgwFjAUBgNVHREEDTALggkxOTIuMC4yLjEwCQYH\n\
KoZIzj0EAQMkADAhAg5BngyplTbRlQ8o/oWWwQIPAL9SfgIaXi/gD6YlQCOU\n\
-----END CERTIFICATE-----"),

/* /CN=test, DNS:somethinglese, DNS:test.local, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1 */
*certcomplex = getcert("-----BEGIN CERTIFICATE-----\n\
MIIBEjCB3qADAgECAhRgxyW7klgZvTf9isALCvwlVwvRtDAJBgcqhkjOPQQBMA8x\n\
DTALBgNVBAMMBHRlc3QwHhcNMjAwOTMwMDU1MjIyWhcNMjAxMDEwMDU1MjIyWjAP\n\
MQ0wCwYDVQQDDAR0ZXN0MDIwEAYHKoZIzj0CAQYFK4EEAAYDHgAEnGezNfbihAw1\n\
wrQhmjNSm6kWQP91YELfuohBbqNAMD4wPAYDVR0RBDUwM4INc29tZXRoaW5nbGVz\n\
ZYIKdGVzdC5sb2NhbIcEwAACAYcQIAENuAAAAAAAAAAAAAAAATAJBgcqhkjOPQQB\n\
AyQAMCECDlTfJfMJElZZgvUdkatdAg8ApiXkPXLXXrV6OMRG9us=\n\
-----END CERTIFICATE-----"),

/* /CN=test, SAN IP Address:2001:DB8:0:0:0:0:0:1 */
*certsanipv6 = getcert("-----BEGIN CERTIFICATE-----\n\
MIHxMIG9oAMCAQICFGhkABYXfolor1EF6Li3hDQeEVU+MAkGByqGSM49BAEwDzEN\n\
Expand All @@ -102,15 +113,6 @@ AAABMAkGByqGSM49BAEDJAAwIQIPAKsn++FWaDIcpnNBOFTuAg5C7gs7DxaNWgEu\n\
OrBTXA==\n\
-----END CERTIFICATE-----"),

/* /CN=test, SAN DNS:192.0.2.1 */
*certsanipindns = getcert("-----BEGIN CERTIFICATE-----\n\
MIHqMIG2oAMCAQICFFUjZGG96kpFI2fu90+jAhWsTr8YMAkGByqGSM49BAEwDzEN\n\
MAsGA1UEAwwEdGVzdDAeFw0yMDA5MjkxNTU4NDBaFw0yMDEwMDkxNTU4NDBaMA8x\n\
DTALBgNVBAMMBHRlc3QwMjAQBgcqhkjOPQIBBgUrgQQABgMeAAScZ7M19uKEDDXC\n\
tCGaM1KbqRZA/3VgQt+6iEFuoxgwFjAUBgNVHREEDTALggkxOTIuMC4yLjEwCQYH\n\
KoZIzj0EAQMkADAhAg5BngyplTbRlQ8o/oWWwQIPAL9SfgIaXi/gD6YlQCOU\n\
-----END CERTIFICATE-----"),

/* /CN=test, SAN DNS:2001:DB8::1 */
*certsanipv6indns = getcert("-----BEGIN CERTIFICATE-----\n\
MIHsMIG4oAMCAQICFFgnXltbOEGcWsS0vCv6Lsj4FhO3MAkGByqGSM49BAEwDzEN\n\
Expand All @@ -120,28 +122,18 @@ tCGaM1KbqRZA/3VgQt+6iEFuoxowGDAWBgNVHREEDzANggsyMDAxOmRiODo6MTAJ\n\
BgcqhkjOPQQBAyQAMCECDlWFhJxpHRgt93ZzN9k7Ag8Ag0YN+dL3MEIo2sqgRWg=\n\
-----END CERTIFICATE-----"),

/* /CN=test, DNS:somethinglese, DNS:test.local, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1 */
*certcomplex = getcert("-----BEGIN CERTIFICATE-----\n\
MIIBEjCB3qADAgECAhRgxyW7klgZvTf9isALCvwlVwvRtDAJBgcqhkjOPQQBMA8x\n\
DTALBgNVBAMMBHRlc3QwHhcNMjAwOTMwMDU1MjIyWhcNMjAxMDEwMDU1MjIyWjAP\n\
MQ0wCwYDVQQDDAR0ZXN0MDIwEAYHKoZIzj0CAQYFK4EEAAYDHgAEnGezNfbihAw1\n\
wrQhmjNSm6kWQP91YELfuohBbqNAMD4wPAYDVR0RBDUwM4INc29tZXRoaW5nbGVz\n\
ZYIKdGVzdC5sb2NhbIcEwAACAYcQIAENuAAAAAAAAAAAAAAAATAJBgcqhkjOPQQB\n\
AyQAMCECDlTfJfMJElZZgvUdkatdAg8ApiXkPXLXXrV6OMRG9us=\n\
/* /CN=other, SAN DNS:other.local */
*certsandnsother = getcert("-----BEGIN CERTIFICATE-----\n\
MIHuMIG6oAMCAQICFAiFPNqpXcSIwxS0bfJZs8KDDafVMAkGByqGSM49BAEwEDEO\n\
MAwGA1UEAwwFb3RoZXIwHhcNMjAwOTI5MTYxMTM2WhcNMjAxMDA5MTYxMTM2WjAQ\n\
MQ4wDAYDVQQDDAVvdGhlcjAyMBAGByqGSM49AgEGBSuBBAAGAx4ABJxnszX24oQM\n\
NcK0IZozUpupFkD/dWBC37qIQW6jGjAYMBYGA1UdEQQPMA2CC290aGVyLmxvY2Fs\n\
MAkGByqGSM49BAEDJAAwIQIOTrQCgOkGcknZEchJFDgCDwCY84F0R2BnNEba95o9\n\
NA==\n\
-----END CERTIFICATE-----"),

/* /CN=test, DNS:somethinglese, DNS:other.local, IP Address:192.0.2.2, IP Address:2001:DB8:0:0:0:0:0:2 */
*certcomplexother = getcert("-----BEGIN CERTIFICATE-----\n\
MIIBFTCB4aADAgECAhR0GSgeV7pqQnbHRgv5y5plz/6+NjAJBgcqhkjOPQQBMBAx\n\
DjAMBgNVBAMMBW90aGVyMB4XDTIwMDkzMDA1NTI1NVoXDTIwMTAxMDA1NTI1NVow\n\
EDEOMAwGA1UEAwwFb3RoZXIwMjAQBgcqhkjOPQIBBgUrgQQABgMeAAScZ7M19uKE\n\
DDXCtCGaM1KbqRZA/3VgQt+6iEFuo0EwPzA9BgNVHREENjA0gg1zb21ldGhpbmds\n\
ZXNlggtvdGhlci5sb2NhbIcEwAACAocQIAENuAAAAAAAAAAAAAAAAjAJBgcqhkjO\n\
PQQBAyQAMCECDwCEaHL6oHT4zwH6jD91YwIOYO3L8cHIzmnGCOJYIQ4=\n\
-----END CERTIFICATE-----"),

/* /CN=test, URI:https://test.local/profile#me */
*certsanuri = getcert("-----BEGIN CERTIFICATE-----\n\
/* /CN=test, URI:https://test.local/profile#me */
*certsanuri = getcert("-----BEGIN CERTIFICATE-----\n\
MIH9MIHKoAMCAQICFHsSOjcYexRKQpNlH1oHV1cxvdgHMAkGByqGSM49BAEwDzEN\n\
MAsGA1UEAwwEdGVzdDAeFw0yMDEwMDYwODU5MzRaFw0yMDEwMTYwODU5MzRaMA8x\n\
DTALBgNVBAMMBHRlc3QwMjAQBgcqhkjOPQIBBgUrgQQABgMeAAScZ7M19uKEDDXC\n\
Expand Down Expand Up @@ -238,8 +230,7 @@ vY/uPjA=\n\

while(list_shift(conf.hostports));
}

/* test no check if prefixlen != 255 (CIDR) */
/* test no check if prefixlen != 255 (CIDR) */
{
struct hostportres hp;

Expand All @@ -253,7 +244,6 @@ vY/uPjA=\n\

while(list_shift(conf.hostports));
}

/* test simple match for CN=test */
{
struct hostportres hp;
Expand All @@ -272,7 +262,6 @@ vY/uPjA=\n\

while(list_shift(conf.hostports));
}

/* test literal ip match to SAN IP */
{
struct hostportres hp;
Expand All @@ -288,12 +277,11 @@ vY/uPjA=\n\
ok(0,verifyconfcert(certsanipother, &conf, &hp),"wrong san ip");
ok(0,verifyconfcert(certsimple, &conf, &hp), "negative san ip");
ok(1,verifyconfcert(certsanipindns, &conf, &hp),"san ip in dns");
ok(1,verifyconfcert(certcomplex,&conf, &hp),"san ip in complex cert");
ok(1,verifyconfcert(certcomplex, &conf, &hp),"san ip in complex cert");

freeaddrinfo(hp.addrinfo);
while(list_shift(conf.hostports));
}

/* test literal ipv6 match to SAN IP */
{
struct hostportres hp;
Expand All @@ -315,7 +303,6 @@ vY/uPjA=\n\
freeaddrinfo(hp.addrinfo);
while(list_shift(conf.hostports));
}

/* test simple match for SAN DNS:test.local */
{
struct hostportres hp;
Expand All @@ -333,7 +320,6 @@ vY/uPjA=\n\

while(list_shift(conf.hostports));
}

/* test multiple hostports san dns(match in second) */
{
struct hostportres hp1, hp2;
Expand All @@ -352,7 +338,6 @@ vY/uPjA=\n\

while(list_shift(conf.hostports));
}

/* test multiple hostports san dns(match in second) */
{
struct hostportres hp1, hp2;
Expand All @@ -377,7 +362,6 @@ vY/uPjA=\n\

while(list_shift(conf.hostports));
}

/* test explicit CN regex */
{
conf.name = "test";
Expand All @@ -391,7 +375,6 @@ vY/uPjA=\n\

freematchcertattr(&conf);
}

/* test explicit ip match to SAN IP */
{
conf.name = "test";
Expand All @@ -406,7 +389,6 @@ vY/uPjA=\n\

freematchcertattr(&conf);
}

/* test explicit ipv6 match to SAN IP */
{
conf.name = "test";
Expand All @@ -421,7 +403,6 @@ vY/uPjA=\n\

freematchcertattr(&conf);
}

/* test explicit SAN DNS regex */
{
conf.name = "test";
Expand All @@ -436,7 +417,6 @@ vY/uPjA=\n\

freematchcertattr(&conf);
}

/* test explicit SAN URI regex */
{
conf.name = "test";
Expand All @@ -450,7 +430,6 @@ vY/uPjA=\n\

freematchcertattr(&conf);
}

/* test explicit SAN rID */
{
conf.name = "test";
Expand All @@ -464,7 +443,6 @@ vY/uPjA=\n\

freematchcertattr(&conf);
}

/* test explicit SAN otherNAME */
{
conf.name = "test";
Expand All @@ -478,7 +456,6 @@ vY/uPjA=\n\

freematchcertattr(&conf);
}

/* test valid config syntax */
{
conf.name = "test";
Expand All @@ -489,7 +466,6 @@ vY/uPjA=\n\

freematchcertattr(&conf);
}

/* test invalid config syntax */
{
conf.name = "test";
Expand All @@ -510,7 +486,6 @@ vY/uPjA=\n\
ok(0,addmatchcertattr(&conf, "SubjectAltName:rID:1:2"),"test invalid syntax rID");
freematchcertattr(&conf);
}

/* test explicit & implicit combined */
{
struct hostportres hp;
Expand All @@ -531,7 +506,6 @@ vY/uPjA=\n\
while(list_shift(conf.hostports));
freematchcertattr(&conf);
}

/* test multiple explicit checks*/
{
struct hostportres hp;
Expand All @@ -556,6 +530,7 @@ vY/uPjA=\n\
freematchcertattr(&conf);
}


printf("1..%d\n", numtests);
list_free(conf.hostports);
X509_free(certsimple);
Expand All @@ -568,7 +543,6 @@ vY/uPjA=\n\
X509_free(certsanipv6);
X509_free(certsanipv6indns);
X509_free(certcomplex);
X509_free(certcomplexother);
Copy link

@DaveTuchlinsky DaveTuchlinsky Mar 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was this certificate removed?

Copy link
Author

@KarthikaRajendran11 KarthikaRajendran11 Mar 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not being used in any tests. They are just allocating it and freeing

X509_free(certsanuri);
X509_free(certsanuriother);
X509_free(certsanrid);
Expand All @@ -577,6 +551,5 @@ vY/uPjA=\n\
X509_free(certsanothernameother);
X509_free(certmulti);
X509_free(certmultiother);

return 0;
}
Loading