| // Copyright 2015 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "name_constraints.h" |
| |
| #include <memory> |
| |
| #include "fillins/ip_address.h" |
| #include "common_cert_errors.h" |
| #include "test_helpers.h" |
| #include <gtest/gtest.h> |
| |
| namespace bssl { |
| namespace { |
| |
| ::testing::AssertionResult LoadTestData(const char* token, |
| const std::string& basename, |
| std::string* result) { |
| std::string path = "testdata/name_constraints_unittest/" + basename; |
| |
| const PemBlockMapping mappings[] = { |
| {token, result}, |
| }; |
| |
| return ReadTestDataFromPemFile(path, mappings); |
| } |
| |
| ::testing::AssertionResult LoadTestName(const std::string& basename, |
| std::string* result) { |
| return LoadTestData("NAME", basename, result); |
| } |
| |
| ::testing::AssertionResult LoadTestNameConstraint(const std::string& basename, |
| std::string* result) { |
| return LoadTestData("NAME CONSTRAINTS", basename, result); |
| } |
| |
| ::testing::AssertionResult LoadTestSubjectAltNameData( |
| const std::string& basename, |
| std::string* result) { |
| return LoadTestData("SUBJECT ALTERNATIVE NAME", basename, result); |
| } |
| |
| ::testing::AssertionResult LoadTestSubjectAltName( |
| const std::string& basename, |
| std::unique_ptr<GeneralNames>* result, |
| std::string* result_der) { |
| ::testing::AssertionResult load_result = |
| LoadTestSubjectAltNameData(basename, result_der); |
| if (!load_result) { |
| return load_result; |
| } |
| CertErrors errors; |
| *result = GeneralNames::Create(der::Input(*result_der), &errors); |
| if (!*result) { |
| return ::testing::AssertionFailure() << "Create failed"; |
| } |
| return ::testing::AssertionSuccess(); |
| } |
| |
| ::testing::AssertionResult IsPermittedCert( |
| const NameConstraints* name_constraints, |
| const der::Input& subject_rdn_sequence, |
| const GeneralNames* subject_alt_names) { |
| CertErrors errors; |
| name_constraints->IsPermittedCert(subject_rdn_sequence, subject_alt_names, |
| &errors); |
| if (!errors.ContainsAnyErrorWithSeverity(CertError::SEVERITY_HIGH)) |
| return ::testing::AssertionSuccess(); |
| if (!errors.ContainsError(cert_errors::kNotPermittedByNameConstraints)) |
| ADD_FAILURE() << "unexpected error " << errors.ToDebugString(); |
| return ::testing::AssertionFailure(); |
| } |
| |
| } // namespace |
| |
| class ParseNameConstraints |
| : public ::testing::TestWithParam<::testing::tuple<bool>> { |
| public: |
| bool is_critical() const { return ::testing::get<0>(GetParam()); } |
| }; |
| |
| // Run the tests with the name constraints marked critical and non-critical. For |
| // supported name types, the results should be the same for both. |
| INSTANTIATE_TEST_SUITE_P(InstantiationName, |
| ParseNameConstraints, |
| ::testing::Values(true, false)); |
| |
| TEST_P(ParseNameConstraints, DNSNames) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example.com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example.com.")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("a.permitted.example.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("apermitted.example.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("apermitted.example.com.")); |
| EXPECT_TRUE( |
| name_constraints->IsPermittedDNSName("alsopermitted.example.com")); |
| EXPECT_FALSE( |
| name_constraints->IsPermittedDNSName("excluded.permitted.example.com")); |
| EXPECT_FALSE( |
| name_constraints->IsPermittedDNSName("a.excluded.permitted.example.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName( |
| "stillnotpermitted.excluded.permitted.example.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName( |
| "a.stillnotpermitted.excluded.permitted.example.com")); |
| EXPECT_FALSE( |
| name_constraints->IsPermittedDNSName("extraneousexclusion.example.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName( |
| "a.extraneousexclusion.example.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("other.example.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("other.com")); |
| |
| // Wildcard names: |
| // Pattern could match excluded.permitted.example.com, thus should not be |
| // allowed. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.permitted.example.com")); |
| // Entirely within excluded name, obviously not allowed. |
| EXPECT_FALSE( |
| name_constraints->IsPermittedDNSName("*.excluded.permitted.example.com")); |
| // Within permitted.example.com and cannot match any exclusion, thus these are |
| // allowed. |
| EXPECT_TRUE( |
| name_constraints->IsPermittedDNSName("*.foo.permitted.example.com")); |
| EXPECT_TRUE( |
| name_constraints->IsPermittedDNSName("*.alsopermitted.example.com")); |
| // Matches permitted.example2.com, but also matches other .example2.com names |
| // which are not in either permitted or excluded, so not allowed. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.example2.com")); |
| // Partial wildcards are not supported, so these name are permitted even if |
| // it seems like they shouldn't be. It's fine, since certificate verification |
| // won't treat them as wildcard names either. |
| EXPECT_TRUE( |
| name_constraints->IsPermittedDNSName("*xcluded.permitted.example.com")); |
| EXPECT_TRUE( |
| name_constraints->IsPermittedDNSName("exclude*.permitted.example.com")); |
| EXPECT_TRUE( |
| name_constraints->IsPermittedDNSName("excl*ded.permitted.example.com")); |
| // Garbage wildcard data. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.*")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName(".*")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*")); |
| // Matches SAN with trailing dot. |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example3.com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example3.com.")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("a.permitted.example3.com")); |
| EXPECT_TRUE( |
| name_constraints->IsPermittedDNSName("a.permitted.example3.com.")); |
| |
| EXPECT_EQ(GENERAL_NAME_DNS_NAME, name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-permitted.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-dnsname.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-directoryname.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-ipaddress.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, |
| DNSNamesWithMultipleLevelsBetweenExcludedAndPermitted) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname2.pem", &a)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // Matches permitted exactly. |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("com")); |
| // Contained within permitted and doesn't match excluded (foo.bar.com). |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("bar.com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("baz.bar.com")); |
| // Matches excluded exactly. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("foo.bar.com")); |
| // Contained within excluded. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("baz.foo.bar.com")); |
| |
| // Cannot match anything within excluded. |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("*.baz.bar.com")); |
| // Wildcard hostnames only match a single label, so cannot match excluded |
| // which has two labels before .com. |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("*.com")); |
| |
| // Partial match of foo.bar.com. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.bar.com")); |
| // All expansions of wildcard are within excluded. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.foo.bar.com")); |
| } |
| |
| TEST_P(ParseNameConstraints, DNSNamesPermittedWithLeadingDot) { |
| std::string a; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("dnsname-permitted_with_leading_dot.pem", &a)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // A permitted dNSName constraint of ".bar.com" should only match subdomains |
| // of .bar.com, but not bar.com itself. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("bar.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("foobar.com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("foo.bar.com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("*.bar.com")); |
| } |
| |
| TEST_P(ParseNameConstraints, DNSNamesExcludedWithLeadingDot) { |
| std::string a; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("dnsname-excluded_with_leading_dot.pem", &a)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // An excluded dNSName constraint of ".bar.com" should only match subdomains |
| // of .bar.com, but not bar.com itself. |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("bar.com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("foobar.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("foo.bar.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.bar.com")); |
| } |
| |
| TEST_P(ParseNameConstraints, DNSNamesPermittedTwoDot) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname-permitted_two_dot.pem", &a)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // A dNSName constraint of ".." isn't meaningful. Shouldn't match anything. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("com.")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("foo.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.com")); |
| } |
| |
| TEST_P(ParseNameConstraints, DNSNamesExcludeOnly) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname-excluded.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // Only "excluded.permitted.example.com" is excluded, and since permitted is |
| // empty, any dNSName outside that is allowed. |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("foo.com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example.com")); |
| EXPECT_FALSE( |
| name_constraints->IsPermittedDNSName("excluded.permitted.example.com")); |
| EXPECT_FALSE( |
| name_constraints->IsPermittedDNSName("a.excluded.permitted.example.com")); |
| } |
| |
| TEST_P(ParseNameConstraints, DNSNamesExcludeAll) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname-excludeall.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // "permitted.example.com" is in the permitted section, but since "" is |
| // excluded, nothing is permitted. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("foo.com")); |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("permitted.example.com")); |
| EXPECT_FALSE( |
| name_constraints->IsPermittedDNSName("foo.permitted.example.com")); |
| } |
| |
| TEST_P(ParseNameConstraints, DNSNamesExcludeDot) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname-exclude_dot.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // "." is excluded, which should match nothing. |
| EXPECT_FALSE(name_constraints->IsPermittedDNSName("foo.com")); |
| EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example.com")); |
| EXPECT_TRUE( |
| name_constraints->IsPermittedDNSName("foo.permitted.example.com")); |
| } |
| |
| TEST_P(ParseNameConstraints, DNSNamesFailOnInvalidIA5String) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname.pem", &a)); |
| |
| size_t replace_location = a.find("permitted.example2.com"); |
| ASSERT_NE(std::string::npos, replace_location); |
| a.replace(replace_location, 1, 1, -1); |
| |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, DirectoryNames) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("directoryname.pem", &constraints_der)); |
| |
| std::string name_us; |
| ASSERT_TRUE(LoadTestName("name-us.pem", &name_us)); |
| std::string name_us_ca; |
| ASSERT_TRUE(LoadTestName("name-us-california.pem", &name_us_ca)); |
| std::string name_us_ca_mountain_view; |
| ASSERT_TRUE(LoadTestName("name-us-california-mountain_view.pem", |
| &name_us_ca_mountain_view)); |
| std::string name_us_az; |
| ASSERT_TRUE(LoadTestName("name-us-arizona.pem", &name_us_az)); |
| std::string name_jp; |
| ASSERT_TRUE(LoadTestName("name-jp.pem", &name_jp)); |
| std::string name_jp_tokyo; |
| ASSERT_TRUE(LoadTestName("name-jp-tokyo.pem", &name_jp_tokyo)); |
| std::string name_de; |
| ASSERT_TRUE(LoadTestName("name-de.pem", &name_de)); |
| std::string name_ca; |
| ASSERT_TRUE(LoadTestName("name-ca.pem", &name_ca)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // Not in any permitted subtree. |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_ca))); |
| // Within the permitted C=US subtree. |
| EXPECT_TRUE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us))); |
| // Within the permitted C=US subtree. |
| EXPECT_TRUE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us_az))); |
| // Within the permitted C=US subtree, however the excluded C=US,ST=California |
| // subtree takes priority. |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us_ca))); |
| // Within the permitted C=US subtree as well as the permitted |
| // C=US,ST=California,L=Mountain View subtree, however the excluded |
| // C=US,ST=California subtree still takes priority. |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us_ca_mountain_view))); |
| // Not in any permitted subtree, and also inside the extraneous excluded C=DE |
| // subtree. |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_de))); |
| // Not in any permitted subtree. |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_jp))); |
| // Within the permitted C=JP,ST=Tokyo subtree. |
| EXPECT_TRUE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_jp_tokyo))); |
| |
| EXPECT_EQ(GENERAL_NAME_DIRECTORY_NAME, |
| name_constraints->constrained_name_types()); |
| |
| // Within the permitted C=US subtree. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us), |
| nullptr /* subject_alt_names */)); |
| // Within the permitted C=US subtree, however the excluded C=US,ST=California |
| // subtree takes priority. |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us_ca), |
| nullptr /* subject_alt_names */)); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-permitted.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-dnsname.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-directoryname.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-ipaddress.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, DirectoryNamesExcludeOnly) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("directoryname-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string name_empty; |
| ASSERT_TRUE(LoadTestName("name-empty.pem", &name_empty)); |
| std::string name_us; |
| ASSERT_TRUE(LoadTestName("name-us.pem", &name_us)); |
| std::string name_us_ca; |
| ASSERT_TRUE(LoadTestName("name-us-california.pem", &name_us_ca)); |
| std::string name_us_ca_mountain_view; |
| ASSERT_TRUE(LoadTestName("name-us-california-mountain_view.pem", |
| &name_us_ca_mountain_view)); |
| |
| // Only "C=US,ST=California" is excluded, and since permitted is empty, |
| // any directoryName outside that is allowed. |
| EXPECT_TRUE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_empty))); |
| EXPECT_TRUE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us))); |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us_ca))); |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us_ca_mountain_view))); |
| } |
| |
| TEST_P(ParseNameConstraints, DirectoryNamesExcludeAll) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("directoryname-excludeall.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string name_empty; |
| ASSERT_TRUE(LoadTestName("name-empty.pem", &name_empty)); |
| std::string name_us; |
| ASSERT_TRUE(LoadTestName("name-us.pem", &name_us)); |
| std::string name_us_ca; |
| ASSERT_TRUE(LoadTestName("name-us-california.pem", &name_us_ca)); |
| std::string name_us_ca_mountain_view; |
| ASSERT_TRUE(LoadTestName("name-us-california-mountain_view.pem", |
| &name_us_ca_mountain_view)); |
| std::string name_jp; |
| ASSERT_TRUE(LoadTestName("name-jp.pem", &name_jp)); |
| |
| // "C=US" is in the permitted section, but since an empty |
| // directoryName is excluded, nothing is permitted. |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_empty))); |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us))); |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_us_ca))); |
| EXPECT_FALSE(name_constraints->IsPermittedDirectoryName( |
| SequenceValueFromString(name_jp))); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddresses) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // IPv4 tests: |
| |
| // Not in any permitted range. |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 169, 0, 1))); |
| |
| // Within the permitted 192.168.0.0/255.255.0.0 range. |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 0, 1))); |
| |
| // Within the permitted 192.168.0.0/255.255.0.0 range, however the |
| // excluded 192.168.5.0/255.255.255.0 takes priority. |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 5, 1))); |
| |
| // Within the permitted 192.168.0.0/255.255.0.0 range as well as the |
| // permitted 192.168.5.32/255.255.255.224 range, however the excluded |
| // 192.168.5.0/255.255.255.0 still takes priority. |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 5, 33))); |
| |
| // Not in any permitted range. (Just outside the |
| // 192.167.5.32/255.255.255.224 range.) |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 167, 5, 31))); |
| |
| // Within the permitted 192.167.5.32/255.255.255.224 range. |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 167, 5, 32))); |
| |
| // Within the permitted 192.167.5.32/255.255.255.224 range. |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 167, 5, 63))); |
| |
| // Not in any permitted range. (Just outside the |
| // 192.167.5.32/255.255.255.224 range.) |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 167, 5, 64))); |
| |
| // Not in any permitted range, and also inside the extraneous excluded |
| // 192.166.5.32/255.255.255.224 range. |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 166, 5, 32))); |
| |
| // IPv6 tests: |
| |
| // Not in any permitted range. |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 0, 0, 0, 1))); |
| |
| // Within the permitted |
| // 102:304:506:708:90a:b0c::/ffff:ffff:ffff:ffff:ffff:ffff:: range. |
| EXPECT_TRUE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 0, 0, 0, 1))); |
| |
| // Within the permitted |
| // 102:304:506:708:90a:b0c::/ffff:ffff:ffff:ffff:ffff:ffff:: range, however |
| // the excluded |
| // 102:304:506:708:90a:b0c:500:0/ffff:ffff:ffff:ffff:ffff:ffff:ff00:0 takes |
| // priority. |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 5, 0, 0, 1))); |
| |
| // Within the permitted |
| // 102:304:506:708:90a:b0c::/ffff:ffff:ffff:ffff:ffff:ffff:: range as well |
| // as the permitted |
| // 102:304:506:708:90a:b0c:520:0/ffff:ffff:ffff:ffff:ffff:ffff:ff60:0, |
| // however the excluded |
| // 102:304:506:708:90a:b0c:500:0/ffff:ffff:ffff:ffff:ffff:ffff:ff00:0 takes |
| // priority. |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 5, 33, 0, 1))); |
| |
| // Not in any permitted range. (Just outside the |
| // 102:304:506:708:90a:b0b:520:0/ffff:ffff:ffff:ffff:ffff:ffff:ff60:0 |
| // range.) |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 11, 5, 31, 255, 255))); |
| |
| // Within the permitted |
| // 102:304:506:708:90a:b0b:520:0/ffff:ffff:ffff:ffff:ffff:ffff:ff60:0 range. |
| EXPECT_TRUE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 11, 5, 32, 0, 0))); |
| |
| // Within the permitted |
| // 102:304:506:708:90a:b0b:520:0/ffff:ffff:ffff:ffff:ffff:ffff:ff60:0 range. |
| EXPECT_TRUE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 11, 5, 63, 255, 255))); |
| |
| // Not in any permitted range. (Just outside the |
| // 102:304:506:708:90a:b0b:520:0/ffff:ffff:ffff:ffff:ffff:ffff:ff60:0 |
| // range.) |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 11, 5, 64, 0, 0))); |
| |
| // Not in any permitted range, and also inside the extraneous excluded |
| // 102:304:506:708:90a:b0a:520:0/ffff:ffff:ffff:ffff:ffff:ffff:ff60:0 range. |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 10, 5, 33, 0, 1))); |
| |
| EXPECT_EQ(GENERAL_NAME_IP_ADDRESS, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-permitted.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-dnsname.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-directoryname.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-excluded-ipaddress.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddressesExcludeOnly) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress-excluded.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // Only 192.168.5.0/255.255.255.0 is excluded, and since permitted is empty, |
| // any iPAddress outside that is allowed. |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 0, 1))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 5, 1))); |
| EXPECT_TRUE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 0, 0, 0, 1))); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddressesExcludeAll) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress-excludeall.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // 192.168.0.0/255.255.0.0 and |
| // 102:304:506:708:90a:b0c::/ffff:ffff:ffff:ffff:ffff:ffff:: are permitted, |
| // but since 0.0.0.0/0 and ::/0 are excluded nothing is permitted. |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 0, 1))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(1, 1, 1, 1))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 0, 0, 0, 1))); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddressesNetmaskPermitSingleHost) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress-permit_singlehost.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress::IPv4AllZeros())); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 1))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 2))); |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 3))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 4))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(255, 255, 255, 255))); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddressesNetmaskPermitPrefixLen31) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress-permit_prefix31.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress::IPv4AllZeros())); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 1))); |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 2))); |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 3))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 4))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 5))); |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(255, 255, 255, 255))); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddressesNetmaskPermitPrefixLen1) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress-permit_prefix1.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress::IPv4AllZeros())); |
| EXPECT_FALSE( |
| name_constraints->IsPermittedIP(fillins::IPAddress(0x7F, 0xFF, 0xFF, 0xFF))); |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(0x80, 0, 0, 0))); |
| EXPECT_TRUE( |
| name_constraints->IsPermittedIP(fillins::IPAddress(0xFF, 0xFF, 0xFF, 0xFF))); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddressesNetmaskPermitAll) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress-permit_all.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress::IPv4AllZeros())); |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 1))); |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(255, 255, 255, 255))); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddressesFailOnInvalidAddr) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress-invalid_addr.pem", &a)); |
| |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, IPAddressesFailOnInvalidMaskNotContiguous) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint( |
| "ipaddress-invalid_mask_not_contiguous_1.pem", &a)); |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| |
| ASSERT_TRUE(LoadTestNameConstraint( |
| "ipaddress-invalid_mask_not_contiguous_2.pem", &a)); |
| EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| |
| ASSERT_TRUE(LoadTestNameConstraint( |
| "ipaddress-invalid_mask_not_contiguous_3.pem", &a)); |
| EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| |
| ASSERT_TRUE(LoadTestNameConstraint( |
| "ipaddress-invalid_mask_not_contiguous_4.pem", &a)); |
| EXPECT_FALSE(NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| } |
| |
| // Test that v4/v6 mapping is not applied when evaluating name constraints. |
| TEST_P(ParseNameConstraints, IPAddressesMapped) { |
| std::string a; |
| ASSERT_TRUE(LoadTestNameConstraint("ipaddress-mapped_addrs.pem", &a)); |
| |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints( |
| NameConstraints::Create(der::Input(a), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| // 192.168.1.0/24 is a permitted subtree. |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 0))); |
| // This does not cover ::ffff:192.168.1.0. |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 192, 168, 1, 0))); |
| // 192.168.1.1 is excluded. |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 1))); |
| // ::ffff:192.168.1.2 is excluded, but that does not exclude 192.168.1.2. |
| EXPECT_TRUE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 1, 2))); |
| |
| // ::ffff:192.168.2.0/120 is a permitted subtree. |
| EXPECT_TRUE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 192, 168, 2, 0))); |
| // This does not cover 192.168.2.0. |
| EXPECT_FALSE(name_constraints->IsPermittedIP(fillins::IPAddress(192, 168, 2, 0))); |
| // ::ffff:192.168.2.1 is excluded. |
| EXPECT_FALSE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 192, 168, 2, 1))); |
| // 192.168.2.2 is excluded, but that does not exclude ::ffff:192.168.2.2. |
| EXPECT_TRUE(name_constraints->IsPermittedIP( |
| fillins::IPAddress(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 192, 168, 2, 2))); |
| } |
| |
| TEST_P(ParseNameConstraints, OtherNamesInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("othername-permitted.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_OTHER_NAME, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-othername.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, OtherNamesInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("othername-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_OTHER_NAME, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-othername.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NamesInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("rfc822name-permitted.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-domaincase.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-localpartcase.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-no-at.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-two-ats.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-quoted.pem", &san, &san_der)); |
| // `"foo"@example.com` and `foo@example.com` are the same address, but we |
| // don't support quoted address at all. |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-ipv4.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-multiple.pem", &san, &san_der)); |
| // SAN contains multiple email addresses, only the first matches the |
| // permitted constraint. |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NamesInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("rfc822name-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-domaincase.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-localpartcase.pem", &san, |
| &san_der)); |
| // Excluded names are matched case-sensitive in the local-part for addresses |
| // from subjectAlternativeName, so this is allowed. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-no-at.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-two-ats.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-ipv4.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameHostnameInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-permitted-hostname.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-domaincase.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-localpartcase.pem", &san, |
| &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-no-at.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-two-ats.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-empty-localpart.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-quoted.pem", &san, &san_der)); |
| // `"foo"@example.com` would match `example.com` hostname, but we don't |
| // support quoted address at all. |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-multiple.pem", &san, &san_der)); |
| // SAN contains multiple email addresses, all match the permitted hostname. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameHostnameInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-excluded-hostname.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-domaincase.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-localpartcase.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-no-at.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-two-ats.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-empty-localpart.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameHostnameWithAtInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-permitted-hostnamewithat.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-empty-localpart.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-domaincase.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-localpartcase.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-no-at.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-two-ats.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameHostnameWithAtInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-excluded-hostnamewithat.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-empty-localpart.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-domaincase.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-localpartcase.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-no-at.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-two-ats.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameSubdomainInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-permitted-subdomains.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-subdomaincase.pem", &san, |
| &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-subdomain-no-at.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-subdomain-two-ats.pem", |
| &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameSubdomainInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-excluded-subdomains.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-subdomaincase.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-subdomain-no-at.pem", &san, |
| &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name-subdomain-two-ats.pem", |
| &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameEmptyPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-permitted-empty.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-empty.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameEmptyExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-excluded-empty.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-empty.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameIPv4Permitted) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-permitted-ipv4.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-empty.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-ipv4.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, Rfc822NameIPv4Excluded) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("rfc822name-excluded-ipv4.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| EXPECT_EQ(GENERAL_NAME_RFC822_NAME, |
| name_constraints->constrained_name_types()); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| |
| ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-empty.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-ipv4.pem", &san, &san_der)); |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, QuotedRfc822SanWithNoRfc822Constraints) { |
| // Load an unrelated (non-rfc822) constraint. |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("othername-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-quoted.pem", &san, &san_der)); |
| // A rfc822 in SAN with quotes should be allowed since we only try to parse |
| // the name if we are enforcing a constraint against it. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, QuotedRfc822SanMatchesQuotedPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-permitted-quoted.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-quoted.pem", &san, &san_der)); |
| // Both SAN and constraint are `"foo"@example.com`, but we don't support |
| // quoted address at all. |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, UnquotedRfc822SanNotMatchingQuotedExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-excluded-quoted.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE( |
| LoadTestSubjectAltName("san-rfc822name-subdomain.pem", &san, &san_der)); |
| // The name `foo@subdomain.example.com` should be allowed since it doesn't |
| // match an exclude of `"foo"@example.com`, but we don't support quoted |
| // address at all so this is not allowed. |
| EXPECT_FALSE( |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, X400AddresssInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("x400address-permitted.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_X400_ADDRESS, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-x400address.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, X400AddresssInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("x400address-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_X400_ADDRESS, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-x400address.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, EdiPartyNamesInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("edipartyname-permitted.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_EDI_PARTY_NAME, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-edipartyname.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, EdiPartyNamesInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("edipartyname-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_EDI_PARTY_NAME, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-edipartyname.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, URIsInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("uri-permitted.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_UNIFORM_RESOURCE_IDENTIFIER, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-uri.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, URIsInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("uri-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_UNIFORM_RESOURCE_IDENTIFIER, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-uri.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, RegisteredIDsInPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("registeredid-permitted.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_REGISTERED_ID, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-registeredid.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, RegisteredIDsInExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("registeredid-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| if (is_critical()) { |
| EXPECT_EQ(GENERAL_NAME_REGISTERED_ID, |
| name_constraints->constrained_name_types()); |
| } else { |
| EXPECT_EQ(0, name_constraints->constrained_name_types()); |
| } |
| |
| std::string san_der; |
| std::unique_ptr<GeneralNames> san; |
| ASSERT_TRUE(LoadTestSubjectAltName("san-registeredid.pem", &san, &san_der)); |
| EXPECT_EQ(!is_critical(), |
| IsPermittedCert(name_constraints.get(), der::Input(), san.get())); |
| } |
| |
| TEST_P(ParseNameConstraints, |
| failsOnGeneralSubtreeWithMinimumZeroEncodedUnnecessarily) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("dnsname-with_min_0.pem", &constraints_der)); |
| // The value should not be in the DER encoding if it is the default. But this |
| // could be changed to allowed if there are buggy encoders out there that |
| // include it anyway. |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, FailsOnGeneralSubtreeWithMinimum) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("dnsname-with_min_1.pem", &constraints_der)); |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, |
| failsOnGeneralSubtreeWithMinimumZeroEncodedUnnecessarilyAndMaximum) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname-with_min_0_and_max.pem", |
| &constraints_der)); |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, FailsOnGeneralSubtreeWithMinimumAndMaximum) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname-with_min_1_and_max.pem", |
| &constraints_der)); |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, FailsOnGeneralSubtreeWithMaximum) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("dnsname-with_max.pem", &constraints_der)); |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, FailsOnEmptyExtensionValue) { |
| std::string constraints_der = ""; |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, FailsOnNoPermittedAndExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("invalid-no_subtrees.pem", &constraints_der)); |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, FailsOnEmptyPermitted) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("invalid-empty_permitted_subtree.pem", |
| &constraints_der)); |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, FailsOnEmptyExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("invalid-empty_excluded_subtree.pem", |
| &constraints_der)); |
| CertErrors errors; |
| EXPECT_FALSE(NameConstraints::Create(der::Input(constraints_der), |
| is_critical(), &errors)); |
| } |
| |
| TEST_P(ParseNameConstraints, |
| IsPermittedCertSubjectEmailAddressNoEmailConstraint) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("directoryname.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string name; |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email.pem", &name)); |
| // Name constraints don't contain rfc822Name, so emailAddress in subject is |
| // allowed regardless. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email-invalidstring.pem", &name)); |
| // Name constraints don't contain rfc822Name, so emailAddress in subject is |
| // allowed regardless. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| } |
| |
| TEST_P(ParseNameConstraints, IsPermittedCertSubjectEmailAddressIsOk) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("rfc822name-permitted-hostname.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string name; |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email.pem", &name)); |
| |
| // Name constraints contain rfc822Name, and the address matches the |
| // constraint (which is all addresses on the hostname.) |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email-invalidstring.pem", &name)); |
| // The bytes of the name string match, but the string type is VISIBLESTRING |
| // which is not supported, so this should fail. |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email-multiple.pem", &name)); |
| // Subject contains multiple rfc822Names, and they all match the constraint |
| // (which is all addresses on the hostname.) |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| } |
| |
| TEST_P(ParseNameConstraints, IsPermittedCertSubjectEmailAddressIsNotOk) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("rfc822name-permitted.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string name; |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email.pem", &name)); |
| |
| // Name constraints contain rfc822Name, and the address does not match the |
| // constraint. |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| |
| // Address is a case-insensitive match, but name constraints (permitted) are |
| // case-sensitive, so this fails. |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email-localpartcase.pem", &name)); |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email-multiple.pem", &name)); |
| // Subject contains multiple rfc822Names, and only the first one matches the |
| // constraint. |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| } |
| |
| TEST_P(ParseNameConstraints, IsPermittedCertSubjectEmailAddressExcluded) { |
| std::string constraints_der; |
| ASSERT_TRUE( |
| LoadTestNameConstraint("rfc822name-excluded.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string name; |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email.pem", &name)); |
| |
| // Name constraints contain excluded rfc822Name, and the address does not |
| // match the constraint. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| |
| // Name constraints for excluded are done case-insensitive in the local part, |
| // so this is not allowed. |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email-localpartcase.pem", &name)); |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| |
| ASSERT_TRUE(LoadTestName("name-us-arizona-email-multiple.pem", &name)); |
| // Subject contains multiple rfc822Names, and one of them is excluded by the |
| // constraint. |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name), |
| /*subject_alt_names=*/nullptr)); |
| } |
| |
| // Hostname in commonName is not allowed (crbug.com/308330), so these are tests |
| // are not particularly interesting, just verifying that the commonName is |
| // ignored for dNSName constraints. |
| TEST_P(ParseNameConstraints, IsPermittedCertSubjectDnsNames) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint("directoryname_and_dnsname.pem", |
| &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string name_us_az_foocom; |
| ASSERT_TRUE(LoadTestName("name-us-arizona-foo.com.pem", &name_us_az_foocom)); |
| // The subject is within permitted directoryName constraints, so permitted. |
| // (The commonName hostname is not within permitted dNSName constraints, so |
| // this would not be permitted if hostnames in commonName were checked.) |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us_az_foocom), |
| nullptr /* subject_alt_names */)); |
| |
| std::string name_us_az_permitted; |
| ASSERT_TRUE(LoadTestName("name-us-arizona-permitted.example.com.pem", |
| &name_us_az_permitted)); |
| // The subject is in permitted directoryName and the commonName is within |
| // permitted dNSName constraints, so this should be permitted regardless if |
| // hostnames in commonName are checked or not. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us_az_permitted), |
| nullptr /* subject_alt_names */)); |
| |
| std::string name_us_ca_permitted; |
| ASSERT_TRUE(LoadTestName("name-us-california-permitted.example.com.pem", |
| &name_us_ca_permitted)); |
| // The subject is within the excluded C=US,ST=California directoryName, so |
| // this should not be allowed, regardless of checking the |
| // permitted.example.com in commonName. |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us_ca_permitted), |
| nullptr /* subject_alt_names */)); |
| } |
| |
| // IP addresses in commonName are not allowed (crbug.com/308330), so these are |
| // tests are not particularly interesting, just verifying that the commonName is |
| // ignored for iPAddress constraints. |
| TEST_P(ParseNameConstraints, IsPermittedCertSubjectIpAddresses) { |
| std::string constraints_der; |
| ASSERT_TRUE(LoadTestNameConstraint( |
| "directoryname_and_dnsname_and_ipaddress.pem", &constraints_der)); |
| CertErrors errors; |
| std::unique_ptr<NameConstraints> name_constraints(NameConstraints::Create( |
| der::Input(constraints_der), is_critical(), &errors)); |
| ASSERT_TRUE(name_constraints); |
| |
| std::string name_us_az_1_1_1_1; |
| ASSERT_TRUE(LoadTestName("name-us-arizona-1.1.1.1.pem", &name_us_az_1_1_1_1)); |
| // The subject is within permitted directoryName constraints, so permitted. |
| // (The commonName IP address is not within permitted iPAddresses constraints, |
| // so this would not be permitted if IP addresses in commonName were checked.) |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us_az_1_1_1_1), |
| nullptr /* subject_alt_names */)); |
| |
| std::string name_us_az_192_168_1_1; |
| ASSERT_TRUE( |
| LoadTestName("name-us-arizona-192.168.1.1.pem", &name_us_az_192_168_1_1)); |
| // The subject is in permitted directoryName and the commonName is within |
| // permitted iPAddress constraints, so this should be permitted regardless if |
| // IP addresses in commonName are checked or not. |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us_az_192_168_1_1), |
| nullptr /* subject_alt_names */)); |
| |
| std::string name_us_ca_192_168_1_1; |
| ASSERT_TRUE(LoadTestName("name-us-california-192.168.1.1.pem", |
| &name_us_ca_192_168_1_1)); |
| // The subject is within the excluded C=US,ST=California directoryName, so |
| // this should not be allowed, regardless of checking the |
| // IP address in commonName. |
| EXPECT_FALSE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us_ca_192_168_1_1), |
| nullptr /* subject_alt_names */)); |
| |
| std::string name_us_az_ipv6; |
| ASSERT_TRUE(LoadTestName("name-us-arizona-ipv6.pem", &name_us_az_ipv6)); |
| // The subject is within permitted directoryName constraints, so permitted. |
| // (The commonName is an ipv6 address which wasn't supported in the past, but |
| // since commonName checking is ignored entirely, this is permitted.) |
| EXPECT_TRUE(IsPermittedCert(name_constraints.get(), |
| SequenceValueFromString(name_us_az_ipv6), |
| nullptr /* subject_alt_names */)); |
| } |
| |
| } // namespace net |
