From a5c2e8b912c8a661577ec7180bfddbbfb7552c16 Mon Sep 17 00:00:00 2001 From: David Garske Date: Thu, 24 May 2018 14:39:35 -0700 Subject: [PATCH] Added test for common name with invalid domain fails as expected when set with `wolfSSL_check_domain_name`. --- ...gen-badaltnamenull.sh => gen-testcerts.sh} | 23 ++++++ certs/test/include.am | 24 +++--- certs/test/server-nomatch.conf | 16 ++++ certs/test/server-nomatch.csr | 17 +++++ certs/test/server-nomatch.der | Bin 0 -> 837 bytes certs/test/server-nomatch.key | 27 +++++++ certs/test/server-nomatch.pem | 69 ++++++++++++++++++ tests/test-fails.conf | 15 ++++ 8 files changed, 181 insertions(+), 10 deletions(-) rename certs/test/{gen-badaltnamenull.sh => gen-testcerts.sh} (50%) create mode 100644 certs/test/server-nomatch.conf create mode 100644 certs/test/server-nomatch.csr create mode 100644 certs/test/server-nomatch.der create mode 100644 certs/test/server-nomatch.key create mode 100644 certs/test/server-nomatch.pem diff --git a/certs/test/gen-badaltnamenull.sh b/certs/test/gen-testcerts.sh similarity index 50% rename from certs/test/gen-badaltnamenull.sh rename to certs/test/gen-testcerts.sh index 8ca9d8c7a..f51942597 100755 --- a/certs/test/gen-badaltnamenull.sh +++ b/certs/test/gen-testcerts.sh @@ -1,5 +1,6 @@ #!/bin/sh +# Generate CN=localhost, AltName=localhost\0h echo "step 1 create key" openssl genrsa -out server-badaltnamenull.key 2048 @@ -18,3 +19,25 @@ openssl x509 -inform pem -in server-badaltnamenull.pem -text > tmp.pem mv tmp.pem server-badaltnamenull.pem openssl x509 -inform pem -in server-badaltnamenull.pem -outform der -out server-badaltnamenull.der + + +# Generate CN=www.nomatch.com, no AltName +echo "step 1 create key" +openssl genrsa -out server-nomatch.key 2048 + +echo "step 2 create csr" +echo "US\nMontana\nBozeman\nEngineering\nwww.nomatch.com\n.\n" | openssl req -new -sha256 -out server-nomatch.csr -key server-nomatch.key -config server-nomatch.conf + +echo "step 3 check csr" +openssl req -text -noout -in server-nomatch.csr + +echo "step 4 create cert" +openssl x509 -req -days 1000 -in server-nomatch.csr -signkey server-nomatch.key \ + -out server-nomatch.pem -extensions req_ext -extfile server-nomatch.conf + +echo "step 5 make human reviewable" +openssl x509 -inform pem -in server-nomatch.pem -text > tmp.pem +mv tmp.pem server-nomatch.pem + +openssl x509 -inform pem -in server-nomatch.pem -outform der -out server-nomatch.der + diff --git a/certs/test/include.am b/certs/test/include.am index 6b9d07d72..f62e97084 100644 --- a/certs/test/include.am +++ b/certs/test/include.am @@ -3,26 +3,30 @@ # EXTRA_DIST += \ - certs/test/cert-ext-ia.cfg \ - certs/test/cert-ext-ia.der \ - certs/test/cert-ext-nc.cfg \ - certs/test/cert-ext-nc.der \ - certs/test/cert-ext-ns.der \ - certs/test/gen-ext-certs.sh \ + certs/test/cert-ext-ia.cfg \ + certs/test/cert-ext-ia.der \ + certs/test/cert-ext-nc.cfg \ + certs/test/cert-ext-nc.der \ + certs/test/cert-ext-ns.der \ + certs/test/gen-ext-certs.sh \ certs/test/server-duplicate-policy.pem # The certs/server-cert with the last byte (signature byte) changed EXTRA_DIST += \ certs/test/server-cert-rsa-badsig.der \ certs/test/server-cert-rsa-badsig.pem \ - certs/test/server-cert-ecc-badsig.der \ + certs/test/server-cert-ecc-badsig.der \ certs/test/server-cert-ecc-badsig.pem - EXTRA_DIST += \ - certs/test/gen-badaltnamenull.sh \ + certs/test/gen-testcerts.sh \ certs/test/server-badaltnamenull.conf \ certs/test/server-badaltnamenull.csr \ certs/test/server-badaltnamenull.key \ certs/test/server-badaltnamenull.pem \ - certs/test/server-badaltnamenull.der + certs/test/server-badaltnamenull.der \ + certs/test/server-nomatch.conf \ + certs/test/server-nomatch.csr \ + certs/test/server-nomatch.key \ + certs/test/server-nomatch.pem \ + certs/test/server-nomatch.der diff --git a/certs/test/server-nomatch.conf b/certs/test/server-nomatch.conf new file mode 100644 index 000000000..b53010c37 --- /dev/null +++ b/certs/test/server-nomatch.conf @@ -0,0 +1,16 @@ +[ req ] +default_bits = 2048 +distinguished_name = req_distinguished_name +req_extensions = req_ext + +[ req_distinguished_name ] +countryName = US +stateOrProvinceName = Montana +localityName = Bozeman +organizationName = Engineering +commonName = www.nomatch.com +commonName_max = 64 + +[ req_ext ] +#subjectAltName = localhost\0h +#subjectAltName = DER:30:0d:82:0b:6c:6f:63:61:6c:68:6f:73:74:00:68 diff --git a/certs/test/server-nomatch.csr b/certs/test/server-nomatch.csr new file mode 100644 index 000000000..5fdc8f777 --- /dev/null +++ b/certs/test/server-nomatch.csr @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICtDCCAZwCAQAwYDELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAO +BgNVBAcMB0JvemVtYW4xFDASBgNVBAoMC0VuZ2luZWVyaW5nMRcwFQYDVQQDDA53 +d3cubm9uYW1lLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ1B +JYwNWaXJdfnKJAz61T0m1w6xMGxELhZWjDks49zn98lW8E8wMZtCoguE1feuu9pF +6yGnfRmK2J+4QjeWVejmMqt8SQyJpW8nWCvRpFVha0RFbmT60nuvKMRX68Lku6iU +Vav2KHU+cz4yBj1m9QO6AqzJWQWiLY5t25OBq+EkhWUd9I39rGmF8ba1Bnpus27U +tqRVJ8cmEwnNPc8ihvcN8RsrYdnQNyYIiIUdJIA2iduDE7PeOSY3jT9mtmeWQOHp +l91xh/RGbJWNpLBd66TkreLTnz4zmQMMTzZGj1pdv9B3UFc6mIMNWmLsERRhiOMO +hiaFfEJwFJZBN9PaXYsCAwEAAaAPMA0GCSqGSIb3DQEJDjEAMA0GCSqGSIb3DQEB +CwUAA4IBAQCA0S++HN0qb94u8setTM5akJjpM1b2o4rcrQluFKMel8mMip9hinvG +sPkJL1KB28/O9TcdmMX57zfXBsumxLSpjzmjIqri7fVabcu/kybE2wdNNvM+9ZzT +pNbYhWEhsCS8XAegiApx/JVszmH77GLExuVAY2XqxA7Cy2Ia/qyiR6v0agMd6I4z +T7nlJHBckOOEdJ6cjqy67vqWy+BKwCK/kRnOJuirIeJ+SechS4tXuRrVni0pkDuK +xQ2uHQjpzFR40U6pFGgwZcdR1bvLCWOlC7efS4ayIETZzhOuXTZa4qQ5/IcCyM+N +scJS5z+YQpQMgOs5jj5DWYLUtMs63UmQ +-----END CERTIFICATE REQUEST----- diff --git a/certs/test/server-nomatch.der b/certs/test/server-nomatch.der new file mode 100644 index 0000000000000000000000000000000000000000..0dcf502a06857e1ab2ee8b5a8c1b6474a8178ea1 GIT binary patch literal 837 zcmXqLVs)N8c56ub&ylk9WZ60mkc^Mg5Ss4rx47m+B*_cCF z*o2uvgAD}?_&^*E9(LdSypqJcM3@LW54%%-RcdZxo}q|=5J(Ld54USxdS+f~YEfoh zx}ms%C`gootyqzdrP2_lhZ@tG{WK+7;UwvDv15W!}ZK=42%6BHg~++mjnt zKU8T=mHpEDcTHyN$8B5Ls`57HUD>uIRQ{Nqm_@q5Egm~Fa`hsa4?bBN zeQsi&@ZOk0t;`#>E7;HHH}kNbzhYT0U~4)<=4ZKD@YTkTS=^_7xBblBJ!$8I@I}_n zB4-|ystX(nkezsH{SUK_GqJMf<^N<~ZN52W+mnsUHMO6}9siap8+rYaF5@MRg+&WC zeYBtRSN*43>toiXCL5OJxO{LDGb+?S+jPj7mCMHFdAs;^`IUanhveLr@>d<2@qNa^ z(j7%=H>FcmK778eGw1xWjw3x`4DDk3JT)dR*mHdTV