+++ /dev/null
-/* Copyright (c) 2002-2004,2006,2008 Apple Inc.
- *
- * sslSubjName.c
- *
- * Verify comparision of app-specified host name vs. various
- * forms of hostname in a cert.
- *
- */
-
-#include <utilLib/common.h>
-#include <utilLib/cspwrap.h>
-#include <clAppUtils/clutils.h>
-#include <clAppUtils/certVerify.h>
-#include <clAppUtils/BlobList.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <Security/cssm.h>
-#include <Security/x509defs.h>
-#include <Security/oidsattr.h>
-#include <Security/oidscert.h>
-#include <Security/oidsalg.h>
-#include <Security/certextensions.h>
-#include <Security/cssmapple.h>
-#include <string.h>
-#include <security_cdsa_utils/cuFileIo.h>
-
-/* key labels */
-#define SUBJ_KEY_LABEL "subjectKey"
-#define ROOT_KEY_LABEL "rootKey"
-
-/* key and signature algorithm - shouldn't matter for this test */
-#define SIG_ALG_DEFAULT CSSM_ALGID_SHA1WithRSA
-#define SIG_OID_DEFAULT CSSMOID_SHA1WithRSA
-#define KEY_ALG_DEFAULT CSSM_ALGID_RSA
-
-#define KEY_SIZE_DEFAULT 512
-
-#define CERT_FILE "sslCert.cer"
-
-static void usage(char **argv)
-{
- printf("Usage: %s [options]\n", argv[0]);
- printf("Options:\n");
- printf(" w(write certs)\n");
- printf(" q(uiet)\n");
- printf(" v(erbose)\n");
- exit(1);
-}
-
-/*
- * RDN components for root, subject
- */
-CSSM_APPLE_TP_NAME_OID rootRdn[] =
-{
- { "Apple Computer", &CSSMOID_OrganizationName },
- { "The Big Cheese", &CSSMOID_Title }
-};
-#define NUM_ROOT_NAMES (sizeof(rootRdn) / sizeof(CSSM_APPLE_TP_NAME_OID))
-
-#define SUBJ_COMMON_NAME "something.org"
-
-CSSM_APPLE_TP_NAME_OID subjRdn[] =
-{
- { "Apple Computer", &CSSMOID_OrganizationName },
- /* overridden when creating the cert */
- { NULL, &CSSMOID_CommonName }
-};
-#define SUBJ_COMMON_NAME_DEX 1
-
-#define NUM_SUBJ_NAMES (sizeof(subjRdn) / sizeof(CSSM_APPLE_TP_NAME_OID))
-
-
-/*
- * Test cases
- */
-typedef struct {
- /* test description */
- const char *testDesc;
-
- /* host names for leaf cert - zero or one of these */
- const char *certDnsName;
- const char *certIpAddr;
-
- /* subject common name */
- const char *commonName;
-
- /* host name for CertGroupVerify */
- const char *vfyHostName;
-
- /* expected error - NULL or e.g. "CSSMERR_APPLETP_CRL_NOT_TRUSTED" */
- const char *expectErrStr;
-
- /* one optional per-cert error string */
- const char *certErrorStr;
-
-} SSN_TestCase;
-
-SSN_TestCase testCases[] =
-{
- {
- "DNS Name foo.bar, vfyName foo.bar",
- "foo.bar", NULL, SUBJ_COMMON_NAME, "foo.bar",
- NULL,
- NULL
- },
- {
- "DNS Name foo.bar, vfyName something.org, expect fail due to "
- "DNS present",
- "foo.bar", NULL, SUBJ_COMMON_NAME, "something.org",
- "CSSMERR_APPLETP_HOSTNAME_MISMATCH",
- "0:CSSMERR_APPLETP_HOSTNAME_MISMATCH"
- },
- {
- "DNS Name foo.bar, vfyName foo.foo.bar, expect fail",
- "foo.bar", NULL, SUBJ_COMMON_NAME, "foo.foo.bar",
- "CSSMERR_APPLETP_HOSTNAME_MISMATCH",
- "0:CSSMERR_APPLETP_HOSTNAME_MISMATCH"
- },
- {
- "IP Name 1.0.5.8, vfyName 1.0.5.8",
- NULL, "1.0.5.8", SUBJ_COMMON_NAME, "1.0.5.8",
- NULL,
- NULL
- },
- {
- "IP Name 1.0.5.8, vfyName 1.00.5.008",
- NULL, "1.0.5.8", SUBJ_COMMON_NAME, "1.00.5.008",
- NULL,
- NULL
- },
- {
- "IP Name 1.0.5.8, vfyName something.org",
- NULL, "1.0.5.8", SUBJ_COMMON_NAME, "something.org",
- NULL,
- NULL
- },
- {
- "IP Name 1.0.5.8, vfyName 2.0.5.8, expect fail",
- NULL, "1.0.5.8", SUBJ_COMMON_NAME, "2.0.5.8",
- "CSSMERR_APPLETP_HOSTNAME_MISMATCH",
- "0:CSSMERR_APPLETP_HOSTNAME_MISMATCH"
- },
- {
- "DNS Name *.foo.bar, vfyName bar.foo.bar",
- "*.foo.bar", NULL, SUBJ_COMMON_NAME, "bar.foo.bar",
- NULL,
- NULL
- },
- {
- "DNS Name *.foo.bar, vfyName foo.bar, expect fail",
- "*.foo.bar", NULL, SUBJ_COMMON_NAME, "foo.bar",
- "CSSMERR_APPLETP_HOSTNAME_MISMATCH",
- "0:CSSMERR_APPLETP_HOSTNAME_MISMATCH"
- },
- {
- "DNS Name *foo.bar, vfyName barfoo.bar",
- "*foo.bar", NULL, SUBJ_COMMON_NAME, "barfoo.bar",
- NULL,
- NULL
- },
- {
- "DNS Name *foo*.bar, vfyName barfoo.bar",
- "*foo*.bar", NULL, SUBJ_COMMON_NAME, "barfoo.bar",
- NULL,
- NULL
- },
- {
- "DNS Name *foo*.bar, vfyName foobar.bar",
- "*foo*.bar", NULL, SUBJ_COMMON_NAME, "foobar.bar",
- NULL,
- NULL
- },
- {
- "DNS Name *foo*.bar, vfyName foo.bar",
- "*foo*.bar", NULL, SUBJ_COMMON_NAME, "foo.bar",
- NULL,
- NULL
- },
- {
- "DNS Name *foo.bar, vfyName bar.foo.bar, should fail",
- "*foo.bar", NULL, SUBJ_COMMON_NAME, "bar.foo.bar",
- "CSSMERR_APPLETP_HOSTNAME_MISMATCH",
- "0:CSSMERR_APPLETP_HOSTNAME_MISMATCH"
- },
- {
- "DNS Name *foo.bar, vfyName foobar.bar, should fail",
- "*foo.bar", NULL, SUBJ_COMMON_NAME, "foobar.bar",
- "CSSMERR_APPLETP_HOSTNAME_MISMATCH",
- "0:CSSMERR_APPLETP_HOSTNAME_MISMATCH"
- },
- {
- "No DNS or IP name, commonName = vfyName = 1.0.5.8",
- NULL, NULL, "1.0.5.8", "1.0.5.8",
- "CSSMERR_APPLETP_HOSTNAME_MISMATCH",
- "0:CSSMERR_APPLETP_HOSTNAME_MISMATCH"
- },
-};
-
-#define NUM_TEST_CASES (sizeof(testCases) / sizeof(SSN_TestCase))
-
-/*
- * Convert a string containing a dotted IP address to 4 bytes.
- * Returns nonzero on error.
- * FIXME - should handle 16-byte IP addresses.
- */
-static int convertIp(
- const char *str,
- uint8 *buf)
-{
- char cbuf[4];
- for(unsigned dex=0; dex<3; dex++) {
- char *nextDot = strchr(str, '.');
- if(nextDot == NULL) {
- return 1;
- }
- memset(cbuf, 0, sizeof(cbuf));
- memmove(cbuf, str, nextDot - str);
- *buf = atoi(cbuf);
- buf++; // next out char
- str = nextDot + 1; // next in char after dot
-
- }
- /* str points to last char */
- if(str == NULL) {
- return 1;
- }
- *buf = atoi(str);
- return 0;
-}
-
-/*
- * Generate a pair of certs.
- */
-static CSSM_RETURN genCerts(
- CSSM_CL_HANDLE clHand,
- CSSM_CSP_HANDLE cspHand,
- CSSM_TP_HANDLE tpHand,
- CSSM_KEY_PTR rootPrivKey,
- CSSM_KEY_PTR rootPubKey,
- CSSM_KEY_PTR subjPubKey,
- /* one of these goes into leaf's subjectAltName */
- const char *subjIpAddr,
- const char *subjDnsName,
- const char *commonName,
- CSSM_DATA &rootCert, // RETURNED
- CSSM_DATA &subjCert) // RETURNED
-
-{
- CSSM_DATA refId;
- // mallocd by CSSM_TP_SubmitCredRequest
- CSSM_RETURN crtn;
- CSSM_APPLE_TP_CERT_REQUEST certReq;
- CSSM_TP_REQUEST_SET reqSet;
- sint32 estTime;
- CSSM_BOOL confirmRequired;
- CSSM_TP_RESULT_SET_PTR resultSet;
- CSSM_ENCODED_CERT *encCert;
- CSSM_TP_CALLERAUTH_CONTEXT CallerAuthContext;
- CSSM_FIELD policyId;
- CE_GeneralNames genNames;
- CE_GeneralName genName;
- uint8 ipNameBuf[4];
- /*
- * Two extensions. Subject has two (KeyUsage and possibly
- * subjectAltName); root has KeyUsage and BasicConstraints.
- */
- CE_DataAndType rootExts[2];
- CE_DataAndType leafExts[2];
- unsigned numLeafExts;
-
- if(subjIpAddr && subjDnsName) {
- printf("***Max of one of {subjIpAddr, subjDnsName} at a "
- "time, please.\n");
- exit(1);
- }
- if(subjIpAddr) {
- if(convertIp(subjIpAddr, ipNameBuf)) {
- printf("**Malformed IP address. Aborting.\n");
- exit(1);
- }
- }
-
- /* A KeyUsage extension for both certs */
- rootExts[0].type = DT_KeyUsage;
- rootExts[0].critical = CSSM_FALSE;
- rootExts[0].extension.keyUsage =
- CE_KU_DigitalSignature | CE_KU_KeyCertSign;
-
- leafExts[0].type = DT_KeyUsage;
- leafExts[0].critical = CSSM_FALSE;
- leafExts[0].extension.keyUsage = CE_KU_DigitalSignature;
-
- /* BasicConstraints for root only */
- rootExts[1].type = DT_BasicConstraints;
- rootExts[1].critical = CSSM_TRUE;
- rootExts[1].extension.basicConstraints.cA = CSSM_TRUE;
- rootExts[1].extension.basicConstraints.pathLenConstraintPresent =
- CSSM_TRUE;
- rootExts[1].extension.basicConstraints.pathLenConstraint = 2;
-
- /* possible subjectAltName for leaf */
- numLeafExts = 1;
- if(subjIpAddr || subjDnsName) {
- numLeafExts++;
- leafExts[1].type = DT_SubjectAltName;
- leafExts[1].critical = CSSM_TRUE;
-
- genName.berEncoded = CSSM_FALSE;
- if(subjIpAddr) {
- genName.name.Data = (uint8 *)ipNameBuf;
- genName.name.Length = 4;
- genName.nameType = GNT_IPAddress;
- }
- else {
- genName.name.Data = (uint8 *)subjDnsName;
- genName.nameType = GNT_DNSName;
- genName.name.Length = strlen(subjDnsName);
- }
- genNames.numNames = 1;
- genNames.generalName = &genName;
- leafExts[1].extension.subjectAltName = genNames;
- }
-
- /* certReq for root */
- memset(&certReq, 0, sizeof(CSSM_APPLE_TP_CERT_REQUEST));
- certReq.cspHand = cspHand;
- certReq.clHand = clHand;
- certReq.serialNumber = 0x12345678;
- certReq.numSubjectNames = NUM_ROOT_NAMES;
- certReq.subjectNames = rootRdn;
- certReq.numIssuerNames = 0;
- certReq.issuerNames = NULL;
- certReq.certPublicKey = rootPubKey;
- certReq.issuerPrivateKey = rootPrivKey;
- certReq.signatureAlg = SIG_ALG_DEFAULT;
- certReq.signatureOid = SIG_OID_DEFAULT;
- certReq.notBefore = 0; // now
- certReq.notAfter = 10000; // seconds from now
- certReq.numExtensions = 2;
- certReq.extensions = rootExts;
-
- reqSet.NumberOfRequests = 1;
- reqSet.Requests = &certReq;
-
- /* a big CSSM_TP_CALLERAUTH_CONTEXT just to specify an OID */
- memset(&CallerAuthContext, 0, sizeof(CSSM_TP_CALLERAUTH_CONTEXT));
- memset(&policyId, 0, sizeof(CSSM_FIELD));
- policyId.FieldOid = CSSMOID_APPLE_TP_LOCAL_CERT_GEN;
- CallerAuthContext.Policy.NumberOfPolicyIds = 1;
- CallerAuthContext.Policy.PolicyIds = &policyId;
-
- /* generate root cert */
- crtn = CSSM_TP_SubmitCredRequest(tpHand,
- NULL, // PreferredAuthority
- CSSM_TP_AUTHORITY_REQUEST_CERTISSUE,
- &reqSet,
- &CallerAuthContext,
- &estTime,
- &refId);
- if(crtn) {
- printError("CSSM_TP_SubmitCredRequest", crtn);
- return crtn;
- }
- crtn = CSSM_TP_RetrieveCredResult(tpHand,
- &refId,
- NULL, // CallerAuthCredentials
- &estTime,
- &confirmRequired,
- &resultSet);
- if(crtn) {
- printError("CSSM_TP_RetrieveCredResult", crtn);
- return crtn;
- }
- if(resultSet == NULL) {
- printf("***CSSM_TP_RetrieveCredResult returned NULL result set.\n");
- return crtn;
- }
- encCert = (CSSM_ENCODED_CERT *)resultSet->Results;
- rootCert = encCert->CertBlob;
-
- /* now a subject cert signed by the root cert */
- certReq.serialNumber = 0x8765;
- certReq.numSubjectNames = NUM_SUBJ_NAMES;
- subjRdn[SUBJ_COMMON_NAME_DEX].string = commonName;
- certReq.subjectNames = subjRdn;
- certReq.numIssuerNames = NUM_ROOT_NAMES;
- certReq.issuerNames = rootRdn;
- certReq.certPublicKey = subjPubKey;
- certReq.issuerPrivateKey = rootPrivKey;
- certReq.numExtensions = numLeafExts;
- certReq.extensions = leafExts;
-
- crtn = CSSM_TP_SubmitCredRequest(tpHand,
- NULL, // PreferredAuthority
- CSSM_TP_AUTHORITY_REQUEST_CERTISSUE,
- &reqSet,
- &CallerAuthContext,
- &estTime,
- &refId);
- if(crtn) {
- printError("CSSM_TP_SubmitCredRequest (2)", crtn);
- return crtn;
- }
- crtn = CSSM_TP_RetrieveCredResult(tpHand,
- &refId,
- NULL, // CallerAuthCredentials
- &estTime,
- &confirmRequired,
- &resultSet); // leaks.....
- if(crtn) {
- printError("CSSM_TP_RetrieveCredResult (2)", crtn);
- return crtn;
- }
- if(resultSet == NULL) {
- printf("***CSSM_TP_RetrieveCredResult (2) returned NULL "
- "result set.\n");
- return crtn;
- }
- encCert = (CSSM_ENCODED_CERT *)resultSet->Results;
- subjCert = encCert->CertBlob;
-
- return CSSM_OK;
-}
-
-int main(int argc, char **argv)
-{
- CSSM_CL_HANDLE clHand; // CL handle
- CSSM_CSP_HANDLE cspHand; // CSP handle
- CSSM_TP_HANDLE tpHand; // TP handle
- CSSM_DATA rootCert;
- CSSM_DATA subjCert;
- CSSM_KEY subjPubKey; // subject's RSA public key blob
- CSSM_KEY subjPrivKey; // subject's RSA private key - ref format
- CSSM_KEY rootPubKey; // root's RSA public key blob
- CSSM_KEY rootPrivKey; // root's RSA private key - ref format
- CSSM_RETURN crtn = CSSM_OK;
- int vfyRtn = 0;
- int arg;
- SSN_TestCase *testCase;
- unsigned testNum;
-
- CSSM_BOOL quiet = CSSM_FALSE;
- CSSM_BOOL verbose = CSSM_FALSE;
- CSSM_BOOL writeCerts = CSSM_FALSE;
-
- for(arg=1; arg<argc; arg++) {
- char *argp = argv[arg];
- switch(argp[0]) {
- case 'q':
- quiet = CSSM_TRUE;
- break;
- case 'v':
- verbose = CSSM_TRUE;
- break;
- case 'w':
- writeCerts = CSSM_TRUE;
- break;
- default:
- usage(argv);
- }
- }
-
- testStartBanner("sslSubjName", argc, argv);
-
- /* connect to CL, TP, and CSP */
- clHand = clStartup();
- if(clHand == 0) {
- return 0;
- }
- tpHand = tpStartup();
- if(tpHand == 0) {
- return 0;
- }
- cspHand = cspStartup();
- if(cspHand == 0) {
- return 0;
- }
-
- /* subsequent errors to abort: to detach */
-
- /* cook up an RSA key pair for the subject */
- crtn = cspGenKeyPair(cspHand,
- KEY_ALG_DEFAULT,
- SUBJ_KEY_LABEL,
- strlen(SUBJ_KEY_LABEL),
- KEY_SIZE_DEFAULT,
- &subjPubKey,
- CSSM_FALSE, // pubIsRef
- CSSM_KEYUSE_VERIFY,
- CSSM_KEYBLOB_RAW_FORMAT_NONE,
- &subjPrivKey,
- CSSM_TRUE, // privIsRef - doesn't matter
- CSSM_KEYUSE_SIGN,
- CSSM_KEYBLOB_RAW_FORMAT_NONE,
- CSSM_FALSE);
- if(crtn) {
- return crtn;
- }
-
- /* and the root */
- crtn = cspGenKeyPair(cspHand,
- KEY_ALG_DEFAULT,
- ROOT_KEY_LABEL,
- strlen(ROOT_KEY_LABEL),
- KEY_SIZE_DEFAULT,
- &rootPubKey,
- CSSM_FALSE, // pubIsRef
- CSSM_KEYUSE_VERIFY,
- CSSM_KEYBLOB_RAW_FORMAT_NONE,
- &rootPrivKey,
- CSSM_TRUE, // privIsRef - doesn't matter
- CSSM_KEYUSE_SIGN,
- CSSM_KEYBLOB_RAW_FORMAT_NONE,
- CSSM_FALSE);
- if(crtn) {
- goto abort;
- }
-
- for(testNum=0; testNum<NUM_TEST_CASES; testNum++) {
- testCase = &testCases[testNum];
- if(!quiet) {
- printf("%s\n", testCase->testDesc);
- }
- crtn = genCerts(clHand, cspHand, tpHand,
- &rootPrivKey, &rootPubKey, &subjPubKey,
- testCase->certIpAddr, testCase->certDnsName, testCase->commonName,
- rootCert, subjCert);
- BlobList leaf;
- BlobList root;
- /* BlobList uses regular free() on the referent of the blobs */
- leaf.addBlob(subjCert, CSSM_TRUE);
- root.addBlob(rootCert, CSSM_TRUE);
- if(crtn) {
- if(testError(quiet)) {
- break;
- }
- }
- if(writeCerts) {
- if(writeFile(CERT_FILE, subjCert.Data, subjCert.Length)) {
- printf("***Error writing cert to %s\n", CERT_FILE);
- }
- else {
- printf("...wrote %lu bytes to %s\n", subjCert.Length, CERT_FILE);
- }
- }
- vfyRtn = certVerifySimple(tpHand, clHand, cspHand,
- leaf, root,
- CSSM_FALSE, // useSystemAnchors
- CSSM_FALSE, // leafCertIsCA
- CSSM_FALSE, // allow expired root
- CVP_SSL,
- testCase->vfyHostName,
- CSSM_FALSE, // sslClient
- NULL,
- NULL,
- testCase->expectErrStr,
- testCase->certErrorStr ? 1 : 0,
- testCase->certErrorStr ? (const char **)&testCase->certErrorStr :
- NULL,
- 0, NULL, // certStatus
- CSSM_FALSE, // trustSettings
- quiet,
- verbose);
- if(vfyRtn) {
- if(testError(quiet)) {
- break;
- }
- }
- /* cert data freed by ~BlobList */
- }
-
- /* free keys */
- cspFreeKey(cspHand, &rootPubKey);
- cspFreeKey(cspHand, &rootPrivKey);
- cspFreeKey(cspHand, &subjPubKey);
- cspFreeKey(cspHand, &subjPrivKey);
-
-abort:
- if(cspHand != 0) {
- CSSM_ModuleDetach(cspHand);
- }
- if(clHand != 0) {
- CSSM_ModuleDetach(clHand);
- }
- if(tpHand != 0) {
- CSSM_ModuleDetach(tpHand);
- }
- if(!vfyRtn && !crtn && !quiet) {
- printf("...test passed\n");
- }
- return 0;
-}
-
-
projects / apple / security.git / blobdiff