wbtiger
/
foundationdb
mirror of https://github.com/apple/foundationdb.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
foundationdb/FDBLibTLS/verify-test.cpp

268 lines
10 KiB
C++
Raw Normal View History

fix headers of FDBLibTLS files
2018-04-20 01:11:55 +08:00
/*
* verify-test.cpp
*
* This source file is part of the FoundationDB open source project
*
* Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
#include <iostream>
#include <string>
#include <vector>
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
#include <string.h>
Fix Subject Alternative Name matching and add test cases. The previous change was done in the optimistic hope that NID_subject_alt_name could be handled in the same fashion as all the rest of the attributes we match against. However, X509 is not a place for optimisim. Instead, it turns out that the Subject Alternative Name is an X509v3 extension, and needs to be handled separately. Therefore, this change... * Introduces the idea of Criteria matching against a location in the certificate, and not just against the entirety of the certificate. * Extracts the Subject Alternative Name extension, and allows iteration and matching against its components. * Extends our constraint language to sensibly match against SubjectAlternativeNames. The `S.subjectAltName` syntax has been kept, but the value is now required to provide what type of field the rest of the value is intended to match against. The code currently supports DNS, EMAIL, URI, and IP. Prefix and suffix matching is supported. Both verify-test and plugin-test were updated to cover Subject Alternative Name matching. I've additionally run plugin-test under valgrind to verify that I've understood object lifetimes correctly.
2018-06-30 08:10:27 +08:00
#include <boost/lexical_cast.hpp>
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
#include <openssl/objects.h>
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
Fix FDBLibTLS to specify includes from the root.
2018-10-20 09:53:09 +08:00
#include "fdbrpc/ITLSPlugin.h"
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
Fix FDBLibTLS to specify includes from the root.
2018-10-20 09:53:09 +08:00
#include "FDBLibTLS/FDBLibTLSPlugin.h"
#include "FDBLibTLS/FDBLibTLSPolicy.h"
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
struct FDBLibTLSVerifyTest {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
FDBLibTLSVerifyTest(std::string input)
: input(input), valid(false), verify_cert(true), verify_time(true), subject_criteria({}), issuer_criteria({}),
root_criteria({}){};
FDBLibTLSVerifyTest(std::string input,
bool verify_cert,
bool verify_time,
std::map<int, Criteria> subject,
std::map<int, Criteria> issuer,
std::map<int, Criteria> root)
: input(input), valid(true), verify_cert(verify_cert), verify_time(verify_time), subject_criteria(subject),
issuer_criteria(issuer), root_criteria(root){};
~FDBLibTLSVerifyTest(){};
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
int run();
std::string input;
bool valid;
bool verify_cert;
bool verify_time;
Implement prefix and suffix matching for TLS certificate verification. This extends our language for specifying verification rules from, e.g. S.O=XYZCorp to also include two more operators S.O>=XYZ # Prefix S.O<=Corp # Suffix both of which would match against an Organization of XYZCorp (among others).
2018-06-28 09:06:24 +08:00
std::map<int, Criteria> subject_criteria;
std::map<int, Criteria> issuer_criteria;
std::map<int, Criteria> root_criteria;
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
};
Implement prefix and suffix matching for TLS certificate verification. This extends our language for specifying verification rules from, e.g. S.O=XYZCorp to also include two more operators S.O>=XYZ # Prefix S.O<=Corp # Suffix both of which would match against an Organization of XYZCorp (among others).
2018-06-28 09:06:24 +08:00
static std::string criteriaToString(std::map<int, Criteria> const& criteria) {
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
std::string s;
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
for (auto& pair : criteria) {
s += "{" + std::to_string(pair.first) + ":(" + printable(pair.second.criteria) + ", " +
boost::lexical_cast<std::string>((int)pair.second.match_type) + ", " +
boost::lexical_cast<std::string>((int)pair.second.location) + ")}";
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
}
return "{" + s + "}";
}
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
static void logf(const char* event, void* uid, bool is_error, ...) {}
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
int FDBLibTLSVerifyTest::run() {
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
Reference<FDBLibTLSVerify> verify;
try {
Add uses of makeReference
2020-11-07 15:50:55 +08:00
verify = makeReference<FDBLibTLSVerify>(input);
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
} catch (const std::runtime_error& e) {
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
if (valid) {
std::cerr << "FAIL: Verify test failed, but should have succeeded - '" << input << "'\n";
return 1;
}
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
return 0;
}
if (!valid) {
std::cerr << "FAIL: Verify test should have failed, but succeeded - '" << input << "'\n";
return 1;
}
if (verify->verify_cert != verify_cert) {
std::cerr << "FAIL: Got verify cert " << verify->verify_cert << ", want " << verify_cert << "\n";
return 1;
}
if (verify->verify_time != verify_time) {
std::cerr << "FAIL: Got verify time " << verify->verify_time << ", want " << verify_time << "\n";
return 1;
}
if (verify->subject_criteria != subject_criteria) {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
std::cerr << "FAIL: Got subject criteria " << criteriaToString(verify->subject_criteria) << ", want "
<< criteriaToString(subject_criteria) << "\n";
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
return 1;
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
}
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
if (verify->issuer_criteria != issuer_criteria) {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
std::cerr << "FAIL: Got issuer criteria " << criteriaToString(verify->issuer_criteria) << ", want "
<< criteriaToString(issuer_criteria) << "\n";
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
return 1;
}
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
if (verify->root_criteria != root_criteria) {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
std::cerr << "FAIL: Got root criteria " << criteriaToString(verify->root_criteria) << ", want "
<< criteriaToString(root_criteria) << "\n";
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
return 1;
}
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
return 0;
}
static int policy_verify_test() {
Add uses of makeReference
2020-11-07 15:50:55 +08:00
auto plugin = makeReference<FDBLibTLSPlugin>();
auto policy = makeReference<FDBLibTLSPolicy>(plugin, (ITLSLogFunc)logf);
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
const char* verify_peers[] = {
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
"S.CN=abc",
"I.CN=def",
"R.CN=xyz,Check.Unexpired=0",
};
int verify_peers_len[] = {
(int)strlen(verify_peers[0]),
(int)strlen(verify_peers[1]),
(int)strlen(verify_peers[2]),
};
Reference<FDBLibTLSVerify> verify_rules[] = {
Add uses of makeReference
2020-11-07 15:50:55 +08:00
makeReference<FDBLibTLSVerify>(std::string(verify_peers[0], verify_peers_len[0])),
makeReference<FDBLibTLSVerify>(std::string(verify_peers[1], verify_peers_len[1])),
makeReference<FDBLibTLSVerify>(std::string(verify_peers[2], verify_peers_len[2])),
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
};
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
if (!policy->set_verify_peers(3, (const uint8_t**)verify_peers, verify_peers_len)) {
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
std::cerr << "FAIL: Policy verify test failed, but should have succeeded\n";
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
return 1;
}
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
if (policy->verify_rules.size() != 3) {
std::cerr << "FAIL: Got " << policy->verify_rules.size() << " verify rule, want 3\n";
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
return 1;
}
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
int i = 0;
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
for (auto& verify_rule : policy->verify_rules) {
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
if (verify_rule->verify_cert != verify_rules[i]->verify_cert) {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
std::cerr << "FAIL: Got verify cert " << verify_rule->verify_cert << ", want "
<< verify_rules[i]->verify_cert << "\n";
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
return 1;
}
if (verify_rule->verify_time != verify_rules[i]->verify_time) {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
std::cerr << "FAIL: Got verify time " << verify_rule->verify_time << ", want "
<< verify_rules[i]->verify_time << "\n";
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
return 1;
}
if (verify_rule->subject_criteria != verify_rules[i]->subject_criteria) {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
std::cerr << "FAIL: Got subject criteria " << criteriaToString(verify_rule->subject_criteria) << ", want "
<< criteriaToString(verify_rules[i]->subject_criteria) << "\n";
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
return 1;
}
if (verify_rule->issuer_criteria != verify_rules[i]->issuer_criteria) {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
std::cerr << "FAIL: Got issuer criteria " << criteriaToString(verify_rule->issuer_criteria) << ", want "
<< criteriaToString(verify_rules[i]->issuer_criteria) << "\n";
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
return 1;
}
if (verify_rule->root_criteria != verify_rules[i]->root_criteria) {
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
std::cerr << "FAIL: Got root criteria " << criteriaToString(verify_rule->root_criteria) << ", want "
<< criteriaToString(verify_rules[i]->root_criteria) << "\n";
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
return 1;
}
i++;
}
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
return 0;
}
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
int main(int argc, char** argv) {
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
int failed = 0;
Fix Subject Alternative Name matching and add test cases. The previous change was done in the optimistic hope that NID_subject_alt_name could be handled in the same fashion as all the rest of the attributes we match against. However, X509 is not a place for optimisim. Instead, it turns out that the Subject Alternative Name is an X509v3 extension, and needs to be handled separately. Therefore, this change... * Introduces the idea of Criteria matching against a location in the certificate, and not just against the entirety of the certificate. * Extracts the Subject Alternative Name extension, and allows iteration and matching against its components. * Extends our constraint language to sensibly match against SubjectAlternativeNames. The `S.subjectAltName` syntax has been kept, but the value is now required to provide what type of field the rest of the value is intended to match against. The code currently supports DNS, EMAIL, URI, and IP. Prefix and suffix matching is supported. Both verify-test and plugin-test were updated to cover Subject Alternative Name matching. I've additionally run plugin-test under valgrind to verify that I've understood object lifetimes correctly.
2018-06-30 08:10:27 +08:00
#define EXACT(x) Criteria(x, MatchType::EXACT, X509Location::NAME)
#define PREFIX(x) Criteria(x, MatchType::PREFIX, X509Location::NAME)
#define SUFFIX(x) Criteria(x, MatchType::SUFFIX, X509Location::NAME)
Implement prefix and suffix matching for TLS certificate verification. This extends our language for specifying verification rules from, e.g. S.O=XYZCorp to also include two more operators S.O>=XYZ # Prefix S.O<=Corp # Suffix both of which would match against an Organization of XYZCorp (among others).
2018-06-28 09:06:24 +08:00
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
std::vector<FDBLibTLSVerifyTest> tests = {
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
FDBLibTLSVerifyTest("", true, true, {}, {}, {}),
FDBLibTLSVerifyTest("Check.Valid=1", true, true, {}, {}, {}),
FDBLibTLSVerifyTest("Check.Valid=0", false, true, {}, {}, {}),
FDBLibTLSVerifyTest("Check.Unexpired=1", true, true, {}, {}, {}),
FDBLibTLSVerifyTest("Check.Unexpired=0", true, false, {}, {}, {}),
FDBLibTLSVerifyTest("Check.Valid=1,Check.Unexpired=0", true, false, {}, {}, {}),
FDBLibTLSVerifyTest("Check.Unexpired=0,Check.Valid=0", false, false, {}, {}, {}),
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
FDBLibTLSVerifyTest("Check.Unexpired=0,I.C=US,C=US,S.O=XYZCorp\\, LLC",
true,
false,
{ { NID_countryName, EXACT("US") }, { NID_organizationName, EXACT("XYZCorp, LLC") } },
{ { NID_countryName, EXACT("US") } },
{}),
FDBLibTLSVerifyTest("Check.Unexpired=0,I.C=US,C=US,S.O=XYZCorp\\= LLC",
true,
false,
{ { NID_countryName, EXACT("US") }, { NID_organizationName, EXACT("XYZCorp= LLC") } },
{ { NID_countryName, EXACT("US") } },
{}),
FDBLibTLSVerifyTest("Check.Unexpired=0,R.C=US,C=US,S.O=XYZCorp\\= LLC",
true,
false,
{ { NID_countryName, EXACT("US") }, { NID_organizationName, EXACT("XYZCorp= LLC") } },
{},
{ { NID_countryName, EXACT("US") } }),
FDBLibTLSVerifyTest("Check.Unexpired=0,I.C=US,C=US,S.O=XYZCorp=LLC",
true,
false,
{ { NID_countryName, EXACT("US") }, { NID_organizationName, EXACT("XYZCorp=LLC") } },
{ { NID_countryName, EXACT("US") } },
{}),
FDBLibTLSVerifyTest("I.C=US,C=US,Check.Unexpired=0,S.O=XYZCorp=LLC",
true,
false,
{ { NID_countryName, EXACT("US") }, { NID_organizationName, EXACT("XYZCorp=LLC") } },
{ { NID_countryName, EXACT("US") } },
{}),
FDBLibTLSVerifyTest("I.C=US,C=US,S.O=XYZCorp\\, LLC",
true,
true,
{ { NID_countryName, EXACT("US") }, { NID_organizationName, EXACT("XYZCorp, LLC") } },
{ { NID_countryName, EXACT("US") } },
{}),
FDBLibTLSVerifyTest("I.C=US,C=US,S.O=XYZCorp\\, LLC,R.CN=abc",
true,
true,
{ { NID_countryName, EXACT("US") }, { NID_organizationName, EXACT("XYZCorp, LLC") } },
{ { NID_countryName, EXACT("US") } },
{ { NID_commonName, EXACT("abc") } }),
FDBLibTLSVerifyTest("C=\\,S=abc", true, true, { { NID_countryName, EXACT(",S=abc") } }, {}, {}),
FDBLibTLSVerifyTest("CN=\\61\\62\\63", true, true, { { NID_commonName, EXACT("abc") } }, {}, {}),
FDBLibTLSVerifyTest("CN=a\\62c", true, true, { { NID_commonName, EXACT("abc") } }, {}, {}),
FDBLibTLSVerifyTest("CN=a\\01c", true, true, { { NID_commonName, EXACT("a\001c") } }, {}, {}),
FDBLibTLSVerifyTest("S.subjectAltName=XYZCorp",
true,
true,
{ { NID_subject_alt_name, { "XYZCorp", MatchType::EXACT, X509Location::EXTENSION } } },
{},
{}),
FDBLibTLSVerifyTest("S.O>=XYZ", true, true, { { NID_organizationName, PREFIX("XYZ") } }, {}, {}),
FDBLibTLSVerifyTest("S.O<=LLC", true, true, { { NID_organizationName, SUFFIX("LLC") } }, {}, {}),
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
// Invalid cases.
FDBLibTLSVerifyTest("Check.Invalid=0"),
FDBLibTLSVerifyTest("Valid=1"),
FDBLibTLSVerifyTest("C= US,S=abc"),
FDBLibTLSVerifyTest("C=#US,S=abc"),
FDBLibTLSVerifyTest("C=abc,S=\\"),
FDBLibTLSVerifyTest("XYZ=abc"),
FDBLibTLSVerifyTest("GN=abc"),
FDBLibTLSVerifyTest("CN=abc,Check.Expired=1"),
};
Implement prefix and suffix matching for TLS certificate verification. This extends our language for specifying verification rules from, e.g. S.O=XYZCorp to also include two more operators S.O>=XYZ # Prefix S.O<=Corp # Suffix both of which would match against an Organization of XYZCorp (among others).
2018-06-28 09:06:24 +08:00
#undef EXACT
#undef PREFIX
#undef SUFFIX
apply clang-format to *.c, *.cpp, *.h, *.hpp files
2021-03-11 02:06:03 +08:00
for (auto& test : tests)
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
failed |= test.run();
TLS Plugin Changes.
2018-05-09 07:27:21 +08:00
failed |= policy_verify_test();
Import LibreSSL TLS Plugin. This does not integrate it into the FoundationDB build system at all, though the original Makefile exists and could be used to build this plugin.
2018-04-13 03:28:52 +08:00
return (failed);
}