@@ -137,19 +137,133 @@
return false;
}
+static const char *
+fieldname_to_oid(const char *fieldname)
+{
+ if (strcmp(fieldname, "C") == 0)
+ {
+ return MBEDTLS_OID_AT_COUNTRY;
+ }
+ else if (strcmp(fieldname, "ST") == 0)
+ {
+ return MBEDTLS_OID_AT_STATE;
+ }
+ else if (strcmp(fieldname, "LOCALITY") == 0)
+ {
+ return MBEDTLS_OID_AT_LOCALITY;
+ }
+ else if (strcmp(fieldname, "O") == 0)
+ {
+ return MBEDTLS_OID_AT_ORGANIZATION;
+ }
+ else if (strcmp(fieldname, "OU") == 0)
+ {
+ return MBEDTLS_OID_AT_ORG_UNIT;
+ }
+ else if (strcmp(fieldname, "CN") == 0)
+ {
+ return MBEDTLS_OID_AT_CN;
+ }
+ else if (strcmp(fieldname, "GN") == 0)
+ {
+ return MBEDTLS_OID_AT_GIVEN_NAME;
+ }
+ else if (strcmp(fieldname, "SN") == 0)
+ {
+ return MBEDTLS_OID_AT_SUR_NAME;
+ }
+ else if (strcmp(fieldname, "initials") == 0)
+ {
+ return MBEDTLS_OID_AT_INITIALS;
+ }
+ else if (strcmp(fieldname, "pseudonym") == 0)
+ {
+ return MBEDTLS_OID_AT_PSEUDONYM;
+ }
+ else if (strcmp(fieldname, "title") == 0)
+ {
+ return MBEDTLS_OID_AT_TITLE;
+ }
+ else if (strcmp(fieldname, "generationQualifier") == 0)
+ {
+ return MBEDTLS_OID_AT_GENERATION_QUALIFIER;
+ }
+ else if (strcmp(fieldname, "postalAddress") == 0)
+ {
+ return MBEDTLS_OID_AT_POSTAL_ADDRESS;
+ }
+ else if (strcmp(fieldname, "postalCode") == 0)
+ {
+ return MBEDTLS_OID_AT_POSTAL_CODE;
+ }
+ else if (strcmp(fieldname, "emailAddress") == 0)
+ {
+ return MBEDTLS_OID_PKCS9_EMAIL;
+ }
+ else if (strcmp(fieldname, "uid") == 0)
+ {
+ return MBEDTLS_OID_AT_UNIQUE_IDENTIFIER;
+ }
+ else if (strcmp(fieldname, "dnQualifier") == 0)
+ {
+ return MBEDTLS_OID_AT_DN_QUALIFIER;
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
result_t
backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mbedtls_x509_crt *cert)
{
- mbedtls_x509_name *name;
+ ASSERT(cn != NULL && cn_len > 0 && cert != NULL);
- ASSERT(cn != NULL);
+ if (x509_username_field == NULL)
+ {
+ goto fail;
+ }
- name = &cert->subject;
+ if (strcmp(x509_username_field, "serialNumber") == 0)
+ {
+ if (cn_len < 2)
+ {
+ goto fail;
+ }
+ cn[0] = '0';
+ cn[1] = 'x';
+ size_t cn_index = 2;
+ bool leading_zeros = true;
+ for (size_t i = 0; i < cert->serial.len; i++)
+ {
+ uint8_t serial_byte = cert->serial.p[i];
+ if (leading_zeros && serial_byte == 0)
+ {
+ continue;
+ }
+ leading_zeros = false;
+ if (cn_index > cn_len - 3)
+ {
+ goto fail;
+ }
+ snprintf(&cn[cn_index], cn_len - cn_index, "%02X", serial_byte);
+ cn_index += 2;
+ }
+ return SUCCESS;
+ }
- /* Find common name */
+ const char *field_oid = fieldname_to_oid(x509_username_field);
+ if (field_oid == NULL)
+ {
+ goto fail;
+ }
+
+ /* Find field_oid in the subject name. */
+ mbedtls_x509_name *name = &cert->subject;
while (name != NULL)
{
- if (0 == memcmp(name->oid.p, MBEDTLS_OID_AT_CN, MBEDTLS_OID_SIZE(MBEDTLS_OID_AT_CN)))
+ if (strlen(field_oid) == name->oid.len
+ && 0 == memcmp(name->oid.p, field_oid, name->oid.len))
{
break;
}
@@ -160,22 +274,23 @@
/* Not found, return an error if this is the peer's certificate */
if (name == NULL)
{
- return FAILURE;
+ goto fail;
}
- /* Found, extract CN */
- if (cn_len > name->val.len)
+ /* Check that we have room in the buffer, including the terminating '/0' byte. */
+ if (cn_len <= name->val.len)
{
- memcpy(cn, name->val.p, name->val.len);
- cn[name->val.len] = '\0';
+ goto fail;
}
- else
- {
- memcpy(cn, name->val.p, cn_len);
- cn[cn_len - 1] = '\0';
- }
+
+ memcpy(cn, name->val.p, name->val.len);
+ cn[name->val.len] = '\0';
return SUCCESS;
+
+fail:
+ cn[0] = '\0';
+ return FAILURE;
}
#if MBEDTLS_VERSION_NUMBER >= 0x04000000
@@ -775,7 +775,7 @@
static openvpn_x509_cert_t *
get_certificate(const char *cert_str)
{
- BIO *in = BIO_new_mem_buf((char *)cert1, -1);
+ BIO *in = BIO_new_mem_buf((char *)cert_str, -1);
assert_non_null(in);
X509 *cert = PEM_read_bio_X509(in, NULL, NULL, NULL);
assert_non_null(cert);
@@ -790,10 +790,37 @@
}
#endif
+/* Generated with:
+ * openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout - -noenc -sha256 -days 3650 \
+ * -subj '/CN=ovpn-test-secp384r1/O=OpenVPN Unit Test Example Corp./OU=Cert Details Dept.'
+ * -addext 'subjectAltName=DNS:unittest.example.com' -addext 'extendedKeyUsage=clientAuth' */
+static const char *cert_details_test_cert =
+ "-----BEGIN CERTIFICATE-----\n"
+ "MIICkzCCAhqgAwIBAgIUKDsZM+PApGdaD2QF9iYaxoFJAkowCgYIKoZIzj0EAwIw\n"
+ "ZTEcMBoGA1UEAwwTb3Zwbi10ZXN0LXNlY3AzODRyMTEoMCYGA1UECgwfT3BlblZQ\n"
+ "TiBVbml0IFRlc3QgRXhhbXBsZSBDb3JwLjEbMBkGA1UECwwSQ2VydCBEZXRhaWxz\n"
+ "IERlcHQuMB4XDTI2MDcwNzEwNTIxNloXDTM2MDcwNDEwNTIxNlowZTEcMBoGA1UE\n"
+ "AwwTb3Zwbi10ZXN0LXNlY3AzODRyMTEoMCYGA1UECgwfT3BlblZQTiBVbml0IFRl\n"
+ "c3QgRXhhbXBsZSBDb3JwLjEbMBkGA1UECwwSQ2VydCBEZXRhaWxzIERlcHQuMHYw\n"
+ "EAYHKoZIzj0CAQYFK4EEACIDYgAEOlKoQVk+wbBD6V/6kg+/oHfqF0Dq08LlCL+B\n"
+ "om4RhutG99QDrow251Ps+Ds/7LQYYRA8+hHyEFrmGM+j2o6KhS5K2uA6dIZL4zLK\n"
+ "vl0NeF2M61Z8tt/IjrFZd+CrEANco4GKMIGHMB0GA1UdDgQWBBSEyG6m+QdWazeg\n"
+ "0CHN7q0edJlqMjAfBgNVHSMEGDAWgBSEyG6m+QdWazeg0CHN7q0edJlqMjAPBgNV\n"
+ "HRMBAf8EBTADAQH/MB8GA1UdEQQYMBaCFHVuaXR0ZXN0LmV4YW1wbGUuY29tMBMG\n"
+ "A1UdJQQMMAoGCCsGAQUFBwMCMAoGCCqGSM49BAMCA2cAMGQCMCyK7aQcyKGW8BWQ\n"
+ "UOYqbJUJZJcviP6ACgJRzK6pgkqt9gY0E0Tb00Qh6D5dBV5i3wIwCMhSgpVJxDrc\n"
+ "pRfligoK8bmv4HEgnV6BDeoDYd41WVMpE9u1issQDHY0SnWC7d9q\n"
+ "-----END CERTIFICATE-----\n";
+const char *const cert_details_cname = "ovpn-test-secp384r1";
+const char *const cert_details_org = "OpenVPN Unit Test Example Corp.";
+const char *const cert_details_org_unit = "Cert Details Dept.";
+const char *const cert_details_serial_number = "229677570263950905252266749734450551528150860362";
+const char *const cert_details_serial_number_hex = "0x283B1933E3C0A4675A0F6405F6261AC68149024A";
+
void
crypto_test_print_cert_details(void **state)
{
- openvpn_x509_cert_t *cert = get_certificate(cert1);
+ openvpn_x509_cert_t *cert = get_certificate(cert_details_test_cert);
struct gc_arena gc = gc_new();
const char *fp = backend_x509_get_serial_hex(cert, &gc);
@@ -801,29 +828,57 @@
/* we messed this up between TLS libraries. But let's at least notice in
* the future ...*/
#if defined(ENABLE_CRYPTO_MBEDTLS)
- assert_string_equal(fp, "82:6B:DD:CC:BD:E5:5E:B7:08:F1:2D:68:00:3C:24:DE");
+ assert_string_equal(fp, "28:3B:19:33:E3:C0:A4:67:5A:0F:64:05:F6:26:1A:C6:81:49:02:4A");
#else
- assert_string_equal(fp, "82:6b:dd:cc:bd:e5:5e:b7:08:f1:2d:68:00:3c:24:de");
+ assert_string_equal(fp, "28:3b:19:33:e3:c0:a4:67:5a:0f:64:05:f6:26:1a:c6:81:49:02:4a");
#endif
const char *sn = backend_x509_get_serial(cert, &gc);
- assert_string_equal(sn, "173359713849739808110610111821055272158");
+ assert_string_equal(sn, cert_details_serial_number);
char username[TLS_USERNAME_LEN + 1] = { 0 }; /* null-terminated */
- int ret = backend_x509_get_username(username, sizeof(username), "CN",
- cert);
+ int ret = backend_x509_get_username(username, sizeof(username), "CN", cert);
- assert_string_equal(username, "ovpn-test-ec1");
+ assert_string_equal(username, cert_details_cname);
assert_int_equal(ret, SUCCESS);
-#ifndef ENABLE_CRYPTO_MBEDTLS
- /* mbed TLS does not implement this */
- ret = backend_x509_get_username(username, sizeof(username), "serialNumber",
- cert);
+ ret = backend_x509_get_username(username, sizeof(username), "serialNumber", cert);
assert_int_equal(ret, SUCCESS);
- assert_string_equal(username, "0x826BDDCCBDE55EB708F12D68003C24DE");
-#endif
+ assert_string_equal(username, cert_details_serial_number_hex);
+
+ ret = backend_x509_get_username(username, sizeof(username), "O", cert);
+
+ assert_string_equal(username, cert_details_org);
+ assert_int_equal(ret, SUCCESS);
+
+ ret = backend_x509_get_username(username, sizeof(username), "OU", cert);
+
+ assert_string_equal(username, cert_details_org_unit);
+ assert_int_equal(ret, SUCCESS);
+
+ /* Check that FAILURE is returned if a field does not exist. */
+ ret = backend_x509_get_username(username, sizeof(username), "SN", cert);
+ assert_int_equal(ret, FAILURE);
+
+ /* Check that FAILURE is returned for invalid field names. */
+ ret = backend_x509_get_username(username, sizeof(username), "invalidField", cert);
+ assert_int_equal(ret, FAILURE);
+
+ /* Check that FAILURE is returned if the output buffer is too small. Do this separately
+ * for a subject field and for the serial number, because these are different code paths.
+ *
+ * First case: Can't fit all characters. */
+ ret = backend_x509_get_username(username, strlen(cert_details_cname) / 2, "CN", cert);
+ assert_int_equal(ret, FAILURE);
+ ret = backend_x509_get_username(username, strlen(cert_details_serial_number_hex) / 2, "serialNumber", cert);
+ assert_int_equal(ret, FAILURE);
+
+ /* Second case: Can fit the characters but not the terminating '\0'. */
+ ret = backend_x509_get_username(username, strlen(cert_details_cname), "CN", cert);
+ assert_int_equal(ret, FAILURE);
+ ret = backend_x509_get_username(username, strlen(cert_details_serial_number_hex), "serialNumber", cert);
+ assert_int_equal(ret, FAILURE);
gc_free(&gc);
free_certificate(cert);