/* * (C) 2009 Jack Lloyd * * Botan is released under the Simplified BSD License (see license.txt) */ #include "tests.h" #if defined(BOTAN_HAS_X509_CERTIFICATES) #include #include #include #include #include #include #include #if defined(BOTAN_HAS_RSA) #include #endif #if defined(BOTAN_HAS_DSA) #include #endif #if defined(BOTAN_HAS_ECDSA) #include #endif #endif namespace Botan_Tests { namespace { #if defined(BOTAN_HAS_X509_CERTIFICATES) Botan::X509_Time from_date(const int y, const int m, const int d) { Botan::calendar_point t(y, m, d, 0, 0, 0); return Botan::X509_Time(t.to_std_timepoint()); } /* Return some option sets */ Botan::X509_Cert_Options ca_opts() { Botan::X509_Cert_Options opts("Test CA/US/Botan Project/Testing"); opts.uri = "http://botan.randombit.net"; opts.dns = "botan.randombit.net"; opts.email = "testing@randombit.net"; opts.CA_key(1); return opts; } Botan::X509_Cert_Options req_opts1() { Botan::X509_Cert_Options opts("Test User 1/US/Botan Project/Testing"); opts.uri = "http://botan.randombit.net"; opts.dns = "botan.randombit.net"; opts.email = "testing@randombit.net"; return opts; } Botan::X509_Cert_Options req_opts2() { Botan::X509_Cert_Options opts("Test User 2/US/Botan Project/Testing"); opts.uri = "http://botan.randombit.net"; opts.dns = "botan.randombit.net"; opts.email = "testing@randombit.net"; opts.add_ex_constraint("PKIX.EmailProtection"); return opts; } std::unique_ptr make_a_private_key() { #if defined(BOTAN_HAS_ECDSA) Botan::EC_Group grp("secp256r1"); return std::unique_ptr(new Botan::ECDSA_PrivateKey(Test::rng(), grp)); #elif defined(BOTAN_HAS_RSA) return std::unique_ptr(new Botan::RSA_PrivateKey(Test::rng(), 1024)); #elif defined(BOTAN_HAS_DSA) Botan::DL_Group grp("dsa/botan/2048"); return std::unique_ptr(new Botan::DSA_PrivateKey(Test::rng(), grp)); #else return std::unique_ptr(nullptr); #endif } class X509_Cert_Unit_Tests : public Test { public: std::vector run() override; private: Test::Result test_x509_dates() { Test::Result result("X509_Time"); Botan::X509_Time time; result.confirm("unset time not set", !time.time_is_set()); time = Botan::X509_Time("0802011822Z", Botan::ASN1_Tag::UTC_TIME); result.confirm("time set after construction", time.time_is_set()); result.test_eq("time readable_string", time.readable_string(), "2008/02/01 18:22:00 UTC"); const std::vector valid = { "0802010000Z", "0802011724Z", "0406142334Z", "9906142334Z", "0006142334Z", "080201000000Z", "080201172412Z", "040614233433Z", "990614233444Z", "000614233455Z", }; // Dates that are valid per X.500 but rejected as unsupported const std::vector valid_but_unsup = { "0802010000-0000", "0802011724+0000", "0406142334-0500", "9906142334+0500", "0006142334-0530", "0006142334+0530", "080201000000-0000", "080201172412+0000", "040614233433-0500", "990614233444+0500", "000614233455-0530", "000614233455+0530", }; const std::vector invalid = { "", " ", "2008`02-01", "9999-02-01", "2000-02-01 17", "999921", // valid length 13 -> range check "080201000061Z", // seconds too big (61) "080201000060Z", // seconds too big (60, leap seconds not covered by the standard) "0802010000-1Z", // seconds too small (-1) "080201006000Z", // minutes too big (60) "080201240000Z", // hours too big (24:00) // valid length 13 -> invalid numbers "08020123112 Z", "08020123112!Z", "08020123112,Z", "08020123112\nZ", "080201232 33Z", "080201232!33Z", "080201232,33Z", "080201232\n33Z", "0802012 3344Z", "0802012!3344Z", "0802012,3344Z", "08022\n334455Z", "08022 334455Z", "08022!334455Z", "08022,334455Z", "08022\n334455Z", "082 33445511Z", "082!33445511Z", "082,33445511Z", "082\n33445511Z", "2 2211221122Z", "2!2211221122Z", "2,2211221122Z", "2\n2211221122Z", // wrong time zone "0802010000", "0802010000z" }; for(auto&& v : valid) { Botan::X509_Time t(v, Botan::ASN1_Tag::UTC_TIME); } for(auto&& v : valid_but_unsup) { result.test_throws("valid but unsupported", [v]() { Botan::X509_Time t(v, Botan::ASN1_Tag::UTC_TIME); }); } for(auto&& v : invalid) { result.test_throws("invalid", [v]() { Botan::X509_Time t(v, Botan::ASN1_Tag::UTC_TIME); }); } return result; } }; std::vector X509_Cert_Unit_Tests::run() { std::vector results; Test::Result result("X509 Unit"); const std::string hash_fn = "SHA-256"; /* Create the CA's key and self-signed cert */ std::unique_ptr ca_key(make_a_private_key()); if(!ca_key) { // Failure because X.509 enabled but no RSA or ECDSA seems off result.test_failure("Skipping due to no enabled signature algorithms"); results.push_back(result); return results; } Botan::X509_Certificate ca_cert = Botan::X509::create_self_signed_cert(ca_opts(), *ca_key, hash_fn, Test::rng()); /* Create user #1's key and cert request */ std::unique_ptr user1_key(make_a_private_key()); Botan::PKCS10_Request user1_req = Botan::X509::create_cert_req(req_opts1(), *user1_key, hash_fn, Test::rng()); /* Create user #2's key and cert request */ std::unique_ptr user2_key(make_a_private_key()); Botan::PKCS10_Request user2_req = Botan::X509::create_cert_req(req_opts2(), *user2_key, hash_fn, Test::rng()); /* Create the CA object */ Botan::X509_CA ca(ca_cert, *ca_key, hash_fn); /* Sign the requests to create the certs */ Botan::X509_Certificate user1_cert = ca.sign_request(user1_req, Test::rng(), from_date(2008, 01, 01), from_date(2033, 01, 01)); Botan::X509_Certificate user2_cert = ca.sign_request(user2_req, Test::rng(), from_date(2008, 01, 01), from_date(2033, 01, 01)); Botan::X509_CRL crl1 = ca.new_crl(Test::rng()); /* Verify the certs */ Botan::Certificate_Store_In_Memory store; store.add_certificate(ca_cert); Botan::Path_Validation_Restrictions restrictions(false); Botan::Path_Validation_Result result_u1 = Botan::x509_path_validate(user1_cert, restrictions, store); if(!result.confirm("user 1 validates", result_u1.successful_validation())) { result.test_note("user 1 validation result was " + result_u1.result_string()); } Botan::Path_Validation_Result result_u2 = Botan::x509_path_validate(user2_cert, restrictions, store); if(!result.confirm("user 2 validates", result_u2.successful_validation())) { result.test_note("user 2 validation result was " + result_u2.result_string()); } store.add_crl(crl1); std::vector revoked; revoked.push_back(Botan::CRL_Entry(user1_cert, Botan::CESSATION_OF_OPERATION)); revoked.push_back(user2_cert); Botan::X509_CRL crl2 = ca.update_crl(crl1, revoked, Test::rng()); store.add_crl(crl2); const std::string revoked_str = Botan::Path_Validation_Result::status_string(Botan::Certificate_Status_Code::CERT_IS_REVOKED); result_u1 = Botan::x509_path_validate(user1_cert, restrictions, store); result.test_eq("user 1 revoked", result_u1.result_string(), revoked_str); result_u2 = Botan::x509_path_validate(user2_cert, restrictions, store); result.test_eq("user 1 revoked", result_u2.result_string(), revoked_str); revoked.clear(); revoked.push_back(Botan::CRL_Entry(user1_cert, Botan::REMOVE_FROM_CRL)); Botan::X509_CRL crl3 = ca.update_crl(crl2, revoked, Test::rng()); store.add_crl(crl3); result_u1 = Botan::x509_path_validate(user1_cert, restrictions, store); if(!result.confirm("user 1 validates", result_u1.successful_validation())) { result.test_note("user 1 validation result was " + result_u1.result_string()); } result_u2 = Botan::x509_path_validate(user2_cert, restrictions, store); result.test_eq("user 2 still revoked", result_u2.result_string(), revoked_str); results.push_back(result); results.push_back(test_x509_dates()); return results; } BOTAN_REGISTER_TEST("unit_x509", X509_Cert_Unit_Tests); #endif } }