| /* |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include "../sslheaders.h" |
| #include <cstdio> |
| #include <cstdarg> |
| #include <openssl/ssl.h> |
| #include <openssl/bio.h> |
| #include <openssl/pem.h> |
| |
| #include <catch.hpp> |
| |
| // Mock TS API functions. |
| |
| char * |
| _TSstrdup(const char *str, int64_t length, const char *) |
| { |
| if (length == -1) { |
| return strdup(str); |
| } else { |
| return strndup(str, length); |
| } |
| } |
| |
| void |
| _TSfree(void *ptr) |
| { |
| free(ptr); |
| } |
| |
| void |
| TSDebug(const char *tag, const char *fmt, ...) |
| { |
| va_list args; |
| |
| std::printf("%s", tag); |
| va_start(args, fmt); |
| std::vprintf(fmt, args); |
| va_end(args); |
| std::printf("\n"); |
| } |
| |
| void |
| TSError(const char *fmt, ...) |
| { |
| va_list args; |
| |
| va_start(args, fmt); |
| std::vprintf(fmt, args); |
| va_end(args); |
| std::printf("\n"); |
| } |
| |
| // Given a PEM formatted object, remove the newlines to get what we would |
| // see in a HTTP header. |
| static char * |
| make_pem_header(const char *pem) |
| { |
| char *hdr; |
| char *ptr; |
| unsigned remain; |
| |
| hdr = ptr = strdup(pem); |
| remain = strlen(hdr); |
| |
| for (char *nl; (nl = static_cast<char *>(memchr(ptr, '\n', remain))); ptr = nl) { |
| *nl = ' '; |
| remain -= nl - ptr; |
| } |
| |
| return hdr; |
| } |
| |
| #define LOG_CHECK(expression, ...) \ |
| (([&]() -> void { \ |
| if (!(expression)) { \ |
| std::printf(__VA_ARGS__); \ |
| std::putchar('\n'); \ |
| CHECK(false); \ |
| } \ |
| })()) |
| |
| TEST_CASE("SSLHeaders", "[ssl_hdrs]") |
| { |
| SSL_library_init(); |
| |
| SECTION("Parse expansion") |
| { |
| #define EXPECT_TRUE(expression, _name, _scope, _field) \ |
| do { \ |
| SslHdrExpansion exp; \ |
| LOG_CHECK(SslHdrParseExpansion(expression, exp) == true, "'%s' failed (expected success)", (expression)); \ |
| LOG_CHECK(strcmp(exp.name.c_str(), _name) == 0, "'%s' expected name %s, received %s", (expression), (_name), \ |
| exp.name.c_str()); \ |
| LOG_CHECK(exp.scope == (_scope), "'%s' expected scope 0x%x (%s), received 0x%x", (expression), (_scope), #_scope, exp.scope); \ |
| LOG_CHECK(exp.field == (_field), "'%s' expected field 0x%x (%s), received 0x%x", (expression), (_field), #_field, exp.field); \ |
| } while (0) |
| |
| #define EXPECT_FALSE(expression) \ |
| do { \ |
| SslHdrExpansion exp; \ |
| LOG_CHECK(SslHdrParseExpansion(expression, exp) == false, "'%s' succeeded (expected failure)", (expression)); \ |
| } while (0) |
| |
| EXPECT_FALSE(""); |
| EXPECT_FALSE("missing-certificate-selector"); |
| EXPECT_FALSE("missing-field-selector="); |
| EXPECT_FALSE("missing-field-selector=client"); |
| EXPECT_FALSE("missing-field-selector=client."); |
| |
| EXPECT_TRUE("ssl-client-cert=client.certificate", "ssl-client-cert", SSL_HEADERS_SCOPE_CLIENT, SSL_HEADERS_FIELD_CERTIFICATE); |
| EXPECT_TRUE("ssl-server-signature=server.signature", "ssl-server-signature", SSL_HEADERS_SCOPE_SERVER, |
| SSL_HEADERS_FIELD_SIGNATURE); |
| |
| EXPECT_TRUE("certificate=server.certificate", "certificate", SSL_HEADERS_SCOPE_SERVER, SSL_HEADERS_FIELD_CERTIFICATE); |
| EXPECT_TRUE("subject=server.subject", "subject", SSL_HEADERS_SCOPE_SERVER, SSL_HEADERS_FIELD_SUBJECT); |
| EXPECT_TRUE("issuer=server.issuer", "issuer", SSL_HEADERS_SCOPE_SERVER, SSL_HEADERS_FIELD_ISSUER); |
| EXPECT_TRUE("serial=server.serial", "serial", SSL_HEADERS_SCOPE_SERVER, SSL_HEADERS_FIELD_SERIAL); |
| EXPECT_TRUE("signature=server.signature", "signature", SSL_HEADERS_SCOPE_SERVER, SSL_HEADERS_FIELD_SIGNATURE); |
| EXPECT_TRUE("notbefore=server.notbefore", "notbefore", SSL_HEADERS_SCOPE_SERVER, SSL_HEADERS_FIELD_NOTBEFORE); |
| EXPECT_TRUE("notafter=server.notafter", "notafter", SSL_HEADERS_SCOPE_SERVER, SSL_HEADERS_FIELD_NOTAFTER); |
| |
| #undef EXPECT_FALSE |
| #undef EXPECT_TRUE |
| } |
| |
| // Certificate: |
| // Data: |
| // Version: 3 (0x2) |
| // Serial Number: 16125629757001825863 (0xdfc9bed3a58ffe47) |
| // Signature Algorithm: sha1WithRSAEncryption |
| // Issuer: CN=test.sslheaders.trafficserver.apache.org |
| // Validity |
| // Not Before: Jul 23 17:51:08 2014 GMT |
| // Not After : May 12 17:51:08 2017 GMT |
| // Subject: CN=test.sslheaders.trafficserver.apache.org |
| // Subject Public Key Info: |
| // Public Key Algorithm: rsaEncryption |
| // Public-Key: (1024 bit) |
| // Modulus: |
| // 00:cd:ba:29:dc:57:9e:a2:30:0d:44:ed:2b:3d:06: |
| // 53:6f:46:65:1d:57:70:27:e5:2e:af:5c:73:ff:85: |
| // 74:95:4d:28:fe:de:8d:08:ed:eb:3f:da:7a:01:33: |
| // b5:26:5d:64:c1:18:d8:dc:41:8c:c1:79:df:d0:22: |
| // fa:8c:f6:9e:50:e0:1e:e4:28:54:db:d7:10:4e:97: |
| // 81:14:dc:b1:e5:f5:fc:f3:87:16:d9:30:07:36:30: |
| // 75:b9:5f:cf:9e:09:1e:8a:e8:80:6e:e6:c4:6e:2d: |
| // 33:ef:21:98:60:eb:7f:df:7e:13:49:4c:89:b2:5b: |
| // 6f:9e:1f:c8:2e:54:67:77:f1 |
| // Exponent: 65537 (0x10001) |
| // X509v3 extensions: |
| // X509v3 Subject Alternative Name: |
| // DNS:test.sslheaders.trafficserver.apache.org |
| // Signature Algorithm: sha1WithRSAEncryption |
| // 26:b2:1d:1c:39:7b:48:9e:8c:d9:22:80:b0:11:93:d6:91:5a: |
| // 2c:b4:58:59:14:75:f7:e1:cb:08:e7:38:ac:44:1a:f7:d9:1a: |
| // 43:50:3c:53:7e:d1:21:e4:ee:b0:26:f1:29:73:b4:e2:04:95: |
| // 2b:f1:ff:2f:43:07:29:f8:21:e4:b0:d9:a5:3a:cd:98:99:51: |
| // 23:e2:f5:2b:60:f3:fb:56:bf:d3:2f:39:25:3f:27:b0:87:68: |
| // 79:16:b9:86:df:05:30:4d:0e:89:1f:a8:5b:6a:63:75:09:ec: |
| // f9:fe:eb:26:d2:d9:16:73:c2:64:a3:8a:74:fc:1a:09:44:df: |
| // 42:51 |
| |
| SECTION("Parse X509 fields") |
| { |
| // A self-signed certificate for CN=test.sslheaders.trafficserver.apache.org. |
| static const char *test_certificate = "-----BEGIN CERTIFICATE-----\n" |
| "MIICGzCCAYSgAwIBAgIJAN/JvtOlj/5HMA0GCSqGSIb3DQEBBQUAMDMxMTAvBgNV\n" |
| "BAMMKHRlc3Quc3NsaGVhZGVycy50cmFmZmljc2VydmVyLmFwYWNoZS5vcmcwHhcN\n" |
| "MTQwNzIzMTc1MTA4WhcNMTcwNTEyMTc1MTA4WjAzMTEwLwYDVQQDDCh0ZXN0LnNz\n" |
| "bGhlYWRlcnMudHJhZmZpY3NlcnZlci5hcGFjaGUub3JnMIGfMA0GCSqGSIb3DQEB\n" |
| "AQUAA4GNADCBiQKBgQDNuincV56iMA1E7Ss9BlNvRmUdV3An5S6vXHP/hXSVTSj+\n" |
| "3o0I7es/2noBM7UmXWTBGNjcQYzBed/QIvqM9p5Q4B7kKFTb1xBOl4EU3LHl9fzz\n" |
| "hxbZMAc2MHW5X8+eCR6K6IBu5sRuLTPvIZhg63/ffhNJTImyW2+eH8guVGd38QID\n" |
| "AQABozcwNTAzBgNVHREELDAqgih0ZXN0LnNzbGhlYWRlcnMudHJhZmZpY3NlcnZl\n" |
| "ci5hcGFjaGUub3JnMA0GCSqGSIb3DQEBBQUAA4GBACayHRw5e0iejNkigLARk9aR\n" |
| "Wiy0WFkUdffhywjnOKxEGvfZGkNQPFN+0SHk7rAm8SlztOIElSvx/y9DByn4IeSw\n" |
| "2aU6zZiZUSPi9Stg8/tWv9MvOSU/J7CHaHkWuYbfBTBNDokfqFtqY3UJ7Pn+6ybS\n" |
| "2RZzwmSjinT8GglE30JR\n" |
| "-----END CERTIFICATE-----\n"; |
| #if 0 |
| "-----BEGIN RSA PRIVATE KEY-----" |
| "MIICXgIBAAKBgQDNuincV56iMA1E7Ss9BlNvRmUdV3An5S6vXHP/hXSVTSj+3o0I" |
| "7es/2noBM7UmXWTBGNjcQYzBed/QIvqM9p5Q4B7kKFTb1xBOl4EU3LHl9fzzhxbZ" |
| "MAc2MHW5X8+eCR6K6IBu5sRuLTPvIZhg63/ffhNJTImyW2+eH8guVGd38QIDAQAB" |
| "AoGBAJLTO48DhbbxHndD4SkTe7aeAgpX3jbK7W/ARxVldNgdkpWb1gI6czxGO+7h" |
| "rXatDvx1NEi2C7QFvEN6w2CZnlCIEYLdC3JPA9qQXD66vHSVttNqwLHezm+tf3Ci" |
| "DgPoSWABHJbDc/TFHjeVDvzkGJ/x0E6CO8lMvvDRbzjcNRoBAkEA80ulSvbCpZHL" |
| "aTqMwB/djvEFyrlyDyD8WkJewkL2q7HRWimNTAU+AsYftzn9kVaIHcVC3x1T47bB" |
| "qP1yEn+eoQJBANh4TtlZOEX6ykm4KqrCQXzOU5sp3m0RmqzYGQ3g8+8X8VTHjduw" |
| "OoJ/vJo6peluh0JalDbdSkCHU0OiILYD51ECQEoEP3s46yq32ixfVaa1ixALn3l3" |
| "RY34uQ00l+N9v9GoPUqyzXvNNHpfkBKMH+pxauOzuY5rO7RRS0WAJY4fKUECQQCd" |
| "R6R6lTGm3tYVhAM0OJoeVUc3yM78Tjsk9IoXpGd4Q9wrriYrBbstUCQ3pv8fQRhz" |
| "pJ5l0pj9k5Vy4ZyEwwdRAkEA3WViCDYe+uxeXcJxqiRHFoGm7YvkqcpBk9UQaWiz" |
| "d9D304LUJ+dfMHNUmhBe/HKG35VU8dG5/0E9vkQyz99zCw==" |
| "-----END RSA PRIVATE KEY-----" |
| ; |
| #endif |
| |
| BIO *exp = BIO_new(BIO_s_mem()); |
| BIO *bio = BIO_new_mem_buf((void *)test_certificate, -1); |
| X509 *x509 = PEM_read_bio_X509(bio, nullptr, nullptr, nullptr); |
| |
| LOG_CHECK(x509 != nullptr, "failed to load the test certificate"); |
| |
| #define EXPECT_FIELD(_field, _value) \ |
| do { \ |
| long len; \ |
| char *ptr; \ |
| SslHdrExpandX509Field(exp, x509, _field); \ |
| len = BIO_get_mem_data(exp, &ptr); \ |
| LOG_CHECK(strncmp(_value, ptr, len) == 0, "expected '%s' for %s, received '%.*s'", _value, #_field, (int)len, ptr); \ |
| } while (0) |
| |
| // Munge the PEM certificate to what we expect in the HTTP header. |
| char *certhdr = make_pem_header(test_certificate); |
| |
| EXPECT_FIELD(SSL_HEADERS_FIELD_NONE, ""); |
| EXPECT_FIELD(SSL_HEADERS_FIELD_CERTIFICATE, certhdr); |
| EXPECT_FIELD(SSL_HEADERS_FIELD_SUBJECT, "CN = test.sslheaders.trafficserver.apache.org"); |
| EXPECT_FIELD(SSL_HEADERS_FIELD_ISSUER, "CN = test.sslheaders.trafficserver.apache.org"); |
| EXPECT_FIELD(SSL_HEADERS_FIELD_SERIAL, "DFC9BED3A58FFE47"); |
| EXPECT_FIELD(SSL_HEADERS_FIELD_SIGNATURE, "26B21D1C397B489E8CD92280B01193D6915A" |
| "2CB458591475F7E1CB08E738AC441AF7D91A" |
| "43503C537ED121E4EEB026F12973B4E20495" |
| "2BF1FF2F430729F821E4B0D9A53ACD989951" |
| "23E2F52B60F3FB56BFD32F39253F27B08768" |
| "7916B986DF05304D0E891FA85B6A637509EC" |
| "F9FEEB26D2D91673C264A38A74FC1A0944DF" |
| "4251"); |
| |
| EXPECT_FIELD(SSL_HEADERS_FIELD_NOTBEFORE, "Jul 23 17:51:08 2014 GMT"); |
| EXPECT_FIELD(SSL_HEADERS_FIELD_NOTAFTER, "May 12 17:51:08 2017 GMT"); |
| |
| #undef EXPECT_FIELD |
| |
| BIO_free(exp); |
| BIO_free(bio); |
| free(certhdr); |
| } |
| } |
