1 /*
2 * verify-test.cpp
3 *
4 * This source file is part of the FoundationDB open source project
5 *
6 * Copyright 2013-2018 Apple Inc. and the FoundationDB project authors
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License");
9 * you may not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS,
16 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
19 */
20
21 #include <iostream>
22 #include <string>
23 #include <vector>
24
25 #include <string.h>
26 #include <boost/lexical_cast.hpp>
27
28 #include <openssl/objects.h>
29
30 #include "fdbrpc/ITLSPlugin.h"
31 #include "ReferenceCounted.h"
32
33 #include "FDBLibTLS/FDBLibTLSPlugin.h"
34 #include "FDBLibTLS/FDBLibTLSPolicy.h"
35
36 struct FDBLibTLSVerifyTest {
FDBLibTLSVerifyTestFDBLibTLSVerifyTest37 FDBLibTLSVerifyTest(std::string input):
38 input(input), valid(false), verify_cert(true), verify_time(true), subject_criteria({}), issuer_criteria({}), root_criteria({}) {};
FDBLibTLSVerifyTestFDBLibTLSVerifyTest39 FDBLibTLSVerifyTest(std::string input, bool verify_cert, bool verify_time, std::map<int, Criteria> subject, std::map<int, Criteria> issuer, std::map<int, Criteria> root):
40 input(input), valid(true), verify_cert(verify_cert), verify_time(verify_time), subject_criteria(subject), issuer_criteria(issuer), root_criteria(root) {};
~FDBLibTLSVerifyTestFDBLibTLSVerifyTest41 ~FDBLibTLSVerifyTest() {};
42
43 int run();
44
45 std::string input;
46
47 bool valid;
48 bool verify_cert;
49 bool verify_time;
50
51 std::map<int, Criteria> subject_criteria;
52 std::map<int, Criteria> issuer_criteria;
53 std::map<int, Criteria> root_criteria;
54 };
55
printable(std::string const & val)56 static std::string printable( std::string const& val ) {
57 static char const digits[] = "0123456789ABCDEF";
58 std::string s;
59
60 for ( int i = 0; i < val.size(); i++ ) {
61 uint8_t b = val[i];
62 if (b >= 32 && b < 127 && b != '\\')
63 s += (char)b;
64 else if (b == '\\')
65 s += "\\\\";
66 else {
67 s += "\\x";
68 s += digits[(b >> 4) & 15];
69 s += digits[b & 15];
70 }
71 }
72 return s;
73 }
74
criteriaToString(std::map<int,Criteria> const & criteria)75 static std::string criteriaToString(std::map<int, Criteria> const& criteria) {
76 std::string s;
77 for (auto &pair: criteria) {
78 s += "{" + std::to_string(pair.first) + ":(" + printable(pair.second.criteria) + ", " + boost::lexical_cast<std::string>((int)pair.second.match_type) + ", " + boost::lexical_cast<std::string>((int)pair.second.location) + ")}";
79 }
80 return "{" + s + "}";
81 }
82
logf(const char * event,void * uid,bool is_error,...)83 static void logf(const char* event, void* uid, bool is_error, ...) {
84 }
85
run()86 int FDBLibTLSVerifyTest::run() {
87 Reference<FDBLibTLSVerify> verify;
88 try {
89 verify = Reference<FDBLibTLSVerify>(new FDBLibTLSVerify(input));
90 } catch ( const std::runtime_error& e ) {
91 if (valid) {
92 std::cerr << "FAIL: Verify test failed, but should have succeeded - '" << input << "'\n";
93 return 1;
94 }
95 return 0;
96 }
97 if (!valid) {
98 std::cerr << "FAIL: Verify test should have failed, but succeeded - '" << input << "'\n";
99 return 1;
100 }
101 if (verify->verify_cert != verify_cert) {
102 std::cerr << "FAIL: Got verify cert " << verify->verify_cert << ", want " << verify_cert << "\n";
103 return 1;
104 }
105 if (verify->verify_time != verify_time) {
106 std::cerr << "FAIL: Got verify time " << verify->verify_time << ", want " << verify_time << "\n";
107 return 1;
108 }
109 if (verify->subject_criteria != subject_criteria) {
110 std::cerr << "FAIL: Got subject criteria " << criteriaToString(verify->subject_criteria) << ", want " << criteriaToString(subject_criteria) << "\n";
111 return 1;
112 }
113 if (verify->issuer_criteria != issuer_criteria) {
114 std::cerr << "FAIL: Got issuer criteria " << criteriaToString(verify->issuer_criteria) << ", want " << criteriaToString(issuer_criteria) << "\n";
115 return 1;
116 }
117 if (verify->root_criteria != root_criteria) {
118 std::cerr << "FAIL: Got root criteria " << criteriaToString(verify->root_criteria) << ", want " << criteriaToString(root_criteria) << "\n";
119 return 1;
120 }
121 return 0;
122 }
123
policy_verify_test()124 static int policy_verify_test() {
125 Reference<FDBLibTLSPlugin> plugin = Reference<FDBLibTLSPlugin>(new FDBLibTLSPlugin());
126 Reference<FDBLibTLSPolicy> policy = Reference<FDBLibTLSPolicy>(new FDBLibTLSPolicy(plugin, (ITLSLogFunc)logf));
127
128 const char *verify_peers[] = {
129 "S.CN=abc",
130 "I.CN=def",
131 "R.CN=xyz,Check.Unexpired=0",
132 };
133 int verify_peers_len[] = {
134 (int)strlen(verify_peers[0]),
135 (int)strlen(verify_peers[1]),
136 (int)strlen(verify_peers[2]),
137 };
138 Reference<FDBLibTLSVerify> verify_rules[] = {
139 Reference<FDBLibTLSVerify>(new FDBLibTLSVerify(std::string(verify_peers[0], verify_peers_len[0]))),
140 Reference<FDBLibTLSVerify>(new FDBLibTLSVerify(std::string(verify_peers[1], verify_peers_len[1]))),
141 Reference<FDBLibTLSVerify>(new FDBLibTLSVerify(std::string(verify_peers[2], verify_peers_len[2]))),
142 };
143
144 if (!policy->set_verify_peers(3, (const uint8_t **)verify_peers, verify_peers_len)) {
145 std::cerr << "FAIL: Policy verify test failed, but should have succeeded\n";
146 return 1;
147 }
148 if (policy->verify_rules.size() != 3) {
149 std::cerr << "FAIL: Got " << policy->verify_rules.size() << " verify rule, want 3\n";
150 return 1;
151 }
152
153 int i = 0;
154 for (auto &verify_rule: policy->verify_rules) {
155 if (verify_rule->verify_cert != verify_rules[i]->verify_cert) {
156 std::cerr << "FAIL: Got verify cert " << verify_rule->verify_cert << ", want " << verify_rules[i]->verify_cert << "\n";
157 return 1;
158 }
159 if (verify_rule->verify_time != verify_rules[i]->verify_time) {
160 std::cerr << "FAIL: Got verify time " << verify_rule->verify_time << ", want " << verify_rules[i]->verify_time << "\n";
161 return 1;
162 }
163 if (verify_rule->subject_criteria != verify_rules[i]->subject_criteria) {
164 std::cerr << "FAIL: Got subject criteria " << criteriaToString(verify_rule->subject_criteria) << ", want " << criteriaToString(verify_rules[i]->subject_criteria) << "\n";
165 return 1;
166 }
167 if (verify_rule->issuer_criteria != verify_rules[i]->issuer_criteria) {
168 std::cerr << "FAIL: Got issuer criteria " << criteriaToString(verify_rule->issuer_criteria) << ", want " << criteriaToString(verify_rules[i]->issuer_criteria) << "\n";
169 return 1;
170 }
171 if (verify_rule->root_criteria != verify_rules[i]->root_criteria) {
172 std::cerr << "FAIL: Got root criteria " << criteriaToString(verify_rule->root_criteria) << ", want " << criteriaToString(verify_rules[i]->root_criteria) << "\n";
173 return 1;
174 }
175 i++;
176 }
177 return 0;
178 }
179
main(int argc,char ** argv)180 int main(int argc, char **argv)
181 {
182 int failed = 0;
183
184 #define EXACT(x) Criteria(x, MatchType::EXACT, X509Location::NAME)
185 #define PREFIX(x) Criteria(x, MatchType::PREFIX, X509Location::NAME)
186 #define SUFFIX(x) Criteria(x, MatchType::SUFFIX, X509Location::NAME)
187
188 std::vector<FDBLibTLSVerifyTest> tests = {
189 FDBLibTLSVerifyTest("", true, true, {}, {}, {}),
190 FDBLibTLSVerifyTest("Check.Valid=1", true, true, {}, {}, {}),
191 FDBLibTLSVerifyTest("Check.Valid=0", false, true, {}, {}, {}),
192 FDBLibTLSVerifyTest("Check.Unexpired=1", true, true, {}, {}, {}),
193 FDBLibTLSVerifyTest("Check.Unexpired=0", true, false, {}, {}, {}),
194 FDBLibTLSVerifyTest("Check.Valid=1,Check.Unexpired=0", true, false, {}, {}, {}),
195 FDBLibTLSVerifyTest("Check.Unexpired=0,Check.Valid=0", false, false, {}, {}, {}),
196 FDBLibTLSVerifyTest("Check.Unexpired=0,I.C=US,C=US,S.O=XYZCorp\\, LLC", true, false,
197 {{NID_countryName, EXACT("US")}, {NID_organizationName, EXACT("XYZCorp, LLC")}}, {{NID_countryName, EXACT("US")}}, {}),
198 FDBLibTLSVerifyTest("Check.Unexpired=0,I.C=US,C=US,S.O=XYZCorp\\= LLC", true, false,
199 {{NID_countryName, EXACT("US")}, {NID_organizationName, EXACT("XYZCorp= LLC")}}, {{NID_countryName, EXACT("US")}}, {}),
200 FDBLibTLSVerifyTest("Check.Unexpired=0,R.C=US,C=US,S.O=XYZCorp\\= LLC", true, false,
201 {{NID_countryName, EXACT("US")}, {NID_organizationName, EXACT("XYZCorp= LLC")}}, {}, {{NID_countryName, EXACT("US")}}),
202 FDBLibTLSVerifyTest("Check.Unexpired=0,I.C=US,C=US,S.O=XYZCorp=LLC", true, false,
203 {{NID_countryName, EXACT("US")}, {NID_organizationName, EXACT("XYZCorp=LLC")}}, {{NID_countryName, EXACT("US")}}, {}),
204 FDBLibTLSVerifyTest("I.C=US,C=US,Check.Unexpired=0,S.O=XYZCorp=LLC", true, false,
205 {{NID_countryName, EXACT("US")}, {NID_organizationName, EXACT("XYZCorp=LLC")}}, {{NID_countryName, EXACT("US")}}, {}),
206 FDBLibTLSVerifyTest("I.C=US,C=US,S.O=XYZCorp\\, LLC", true, true,
207 {{NID_countryName, EXACT("US")}, {NID_organizationName, EXACT("XYZCorp, LLC")}}, {{NID_countryName, EXACT("US")}}, {}),
208 FDBLibTLSVerifyTest("I.C=US,C=US,S.O=XYZCorp\\, LLC,R.CN=abc", true, true,
209 {{NID_countryName, EXACT("US")}, {NID_organizationName, EXACT("XYZCorp, LLC")}},
210 {{NID_countryName, EXACT("US")}},
211 {{NID_commonName, EXACT("abc")}}),
212 FDBLibTLSVerifyTest("C=\\,S=abc", true, true, {{NID_countryName, EXACT(",S=abc")}}, {}, {}),
213 FDBLibTLSVerifyTest("CN=\\61\\62\\63", true, true, {{NID_commonName, EXACT("abc")}}, {}, {}),
214 FDBLibTLSVerifyTest("CN=a\\62c", true, true, {{NID_commonName, EXACT("abc")}}, {}, {}),
215 FDBLibTLSVerifyTest("CN=a\\01c", true, true, {{NID_commonName, EXACT("a\001c")}}, {}, {}),
216 FDBLibTLSVerifyTest("S.subjectAltName=XYZCorp", true, true, {{NID_subject_alt_name, {"XYZCorp", MatchType::EXACT, X509Location::EXTENSION}}}, {}, {}),
217 FDBLibTLSVerifyTest("S.O>=XYZ", true, true, {{NID_organizationName, PREFIX("XYZ")}}, {}, {}),
218 FDBLibTLSVerifyTest("S.O<=LLC", true, true, {{NID_organizationName, SUFFIX("LLC")}}, {}, {}),
219
220 // Invalid cases.
221 FDBLibTLSVerifyTest("Check.Invalid=0"),
222 FDBLibTLSVerifyTest("Valid=1"),
223 FDBLibTLSVerifyTest("C= US,S=abc"),
224 FDBLibTLSVerifyTest("C=#US,S=abc"),
225 FDBLibTLSVerifyTest("C=abc,S=\\"),
226 FDBLibTLSVerifyTest("XYZ=abc"),
227 FDBLibTLSVerifyTest("GN=abc"),
228 FDBLibTLSVerifyTest("CN=abc,Check.Expired=1"),
229 };
230
231 #undef EXACT
232 #undef PREFIX
233 #undef SUFFIX
234
235 for (auto &test: tests)
236 failed |= test.run();
237
238 failed |= policy_verify_test();
239
240 return (failed);
241 }
242