From adb3cc5a5a93fb571676f6e19028c4fb2320b02a Mon Sep 17 00:00:00 2001 From: John Safranek Date: Mon, 2 Jul 2018 13:39:11 -0700 Subject: [PATCH 1/2] Subject Alt Name Matching 1. Added certificates for localhost where the CN and SAN match and differ. 2. Change subject name matching so the CN is checked if the SAN list doesn't exit, and only check the SAN list if present. 3. Added a test case for the CN/SAN mismatch. 4. Old matching behavior restored with build option WOLFSSL_ALLOW_NO_CN_IN_SAN. 5. Add test case for a correct certificate. Note: The test for the garbage certificate should fail. If you enable the old behavior, that test case will start succeeding, causing the test to fail. --- certs/test/gen-testcerts.sh | 6 +++ certs/test/server-garbage.der | Bin 0 -> 917 bytes certs/test/server-garbage.pem | 75 ++++++++++++++++++++++++++++++++ certs/test/server-localhost.der | Bin 0 -> 919 bytes certs/test/server-localhost.pem | 75 ++++++++++++++++++++++++++++++++ src/internal.c | 24 ++++++++++ tests/test-fails.conf | 14 ++++++ tests/test.conf | 12 +++++ 8 files changed, 206 insertions(+) create mode 100644 certs/test/server-garbage.der create mode 100644 certs/test/server-garbage.pem create mode 100644 certs/test/server-localhost.der create mode 100644 certs/test/server-localhost.pem diff --git a/certs/test/gen-testcerts.sh b/certs/test/gen-testcerts.sh index 634b62166..f07721c42 100755 --- a/certs/test/gen-testcerts.sh +++ b/certs/test/gen-testcerts.sh @@ -95,3 +95,9 @@ generate_test_cert server-badaltnull www.nomatch.com DER:30:0d:82:0b:6c:6f:63:61 # Generate Bad Alt Name CN=www.nomatch.com, Alt=www.nomatch.com generate_test_cert server-badaltname www.nomatch.com www.nomatch.com + +# Generate Good Alt Name CN=localhost, Alt=localhost +generate_test_cert server-localhost localhost localhost + +# Generate Bad Alt Name CN=localhost, Alt=garbage +generate_test_cert server-garbage localhost garbage diff --git a/certs/test/server-garbage.der b/certs/test/server-garbage.der new file mode 100644 index 0000000000000000000000000000000000000000..febc7b770d194b10bd76ee0b30ce2b94ab198741 GIT binary patch literal 917 zcmXqLVxDNw#8kO}nTe5!iIbu4#$t|R77K41@Un4gwRyCC=VfH%W@Rv_G2}MjWMd9x zVH0Kw4K@@o-~(|uc-VdO^GXu)5@90jJnT;SRjIj&d4?heLLfEVJlw8%>6v+{sYRK2 z>4riE0w7Ul9?qQn`IvZJdl^0-1Sf`3~jzIcdekIeN+Yxdw9LyoMGA zW=7_QmZru=22tX?MurB)M#fO?0K2YZ zsW5l@C09pv#?)i3>ptyKG1xKnoW9?+Z!#TwYUcl5kzW5VW=>$~_pVdy&rS9FAMUL_ zpkK2(Wrg^kQ?b>%9wb9C3#i-A0{UUc5|oLuXWzBR3^q` z^E!qF$w$A{b4O-W6ff(MSjm*T{;(vY-VTAs$Idux$z1GaoY|gtWViUT&oAz-E#6bD zuekMZS|HEfkj)Qs<7M_J7hmLL?i9HsuruYb)`f-By!Jf2A{Bjn!GVLx75pyd21e5w zjFhJ?EZ-%3X?pRaSk;qRyoW6lmTcLO>Ey)u@&?BqV};ETO3PQhKJxHcV)M~U)9&BA z;J@}d6Eh_RWZ^d8Y+_GOEJ{jDPel$nZg9vkGK81!TwK~V%!vErf`e1p?>o9zNHw-I1nCzkq$MJSD3IO*AP);6)ID%&}QVds~) yf350@+P(OyyXxKpm)0t+kGyte+R6>AUo4J?xk+A?Hkj|Gw6v+{sYRK2 z>4riE0w7Ul9?qQn`IvZJdl^0-1Sf`3~jzIcdekIeN+Yxdw9LyoMGA zW=7_QmZru=22tX?MurB)M#fO?0K2YZ zsW5l@C09pv#?)i3>ptyKG1xKnoW9?+Z!#TwYUcl5kzW5VW=>$~_pVdy&rS9FAMUL_ zpkK2(Wrg^kQ?b>%9wb9C3#i-A0{UUc5|oLuXWzBR3^q` z^E!qF$w$A{b4O-W6ff(MSjm*T{;(vY-VTAs$Idux$z1GaoY|gtWViUT&oAz-E#6bD zuekMZS|HEfkj)Qs<7M_J7hmLL?i9HsuruYb)`f-By!Jf2A{Bjn!GVLx75pyd21e5w zjFhJ?EZ-%3X?pRaSk;qRyoW6lmTcLO>Ey)u@&?BqV};ETO3PQhKJxHcV)M~U)9&BA z;J@}d6Eh=+qLrHW=I9w^|B7fSzC@|98h zQdIf;33s1p-`akMX@aS)&Ix3O_<`D}fEu0ZDN?5_V3>*W7zi}bYQ z5-d)hvdnJ9m9?^yf5o4F|0_tjz542|uqjT9SrfNDU3=(K=O&((iw4)O$7pTW{OG&$ zRQ*Gr|7%uCo6mLlbvnrPo~-7pM2j_NEP37D{qN*I)v@EFMvhK={z3JCr&fyllG&H< z+|w!X?bG7eurLXubGAz?options.verifyNone && ssl->buffers.domainName.buffer) { + #ifndef WOLFSSL_ALLOW_NO_CN_IN_SAN + /* Per RFC 5280 section 4.2.1.6, "Whenever such identities + * are to be bound into a certificate, the subject + * alternative name extension MUST be used." */ + if (args->dCert->altNames) { + if (CheckAltNames(args->dCert, + (char*)ssl->buffers.domainName.buffer) == 0 ) { + WOLFSSL_MSG("DomainName match on alt names failed"); + /* try to get peer key still */ + ret = DOMAIN_NAME_MISMATCH; + } + } + else { + if (MatchDomainName( + args->dCert->subjectCN, + args->dCert->subjectCNLen, + (char*)ssl->buffers.domainName.buffer) == 0) { + WOLFSSL_MSG("DomainName match on common name failed"); + ret = DOMAIN_NAME_MISMATCH; + } + } + #else /* WOLFSSL_ALL_NO_CN_IN_SAN */ + /* Old behavior. */ if (MatchDomainName(args->dCert->subjectCN, args->dCert->subjectCNLen, (char*)ssl->buffers.domainName.buffer) == 0) { @@ -9170,6 +9193,7 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx, ret = DOMAIN_NAME_MISMATCH; } } + #endif /* WOLFSSL_ALL_NO_CN_IN_SAN */ } /* decode peer key */ diff --git a/tests/test-fails.conf b/tests/test-fails.conf index e9fda3021..1c8f6e5ef 100644 --- a/tests/test-fails.conf +++ b/tests/test-fails.conf @@ -94,3 +94,17 @@ # client ECC bad sig error -v 3 -l ECDHE-ECDSA-AES128-GCM-SHA256 + +# server missing CN from alternate names list +-v 3 +-l ECDHE-RSA-AES128-GCM-SHA256 +-c ./certs/test/server-garbage.pem + +# client missing CN from alternate names list +-v 3 +-l ECDHE-RSA-AES128-GCM-SHA256 +-h localhost +-A ./certs/test/server-garbage.pem +-m +-X + diff --git a/tests/test.conf b/tests/test.conf index 2bee587ae..b1b8fe9fb 100644 --- a/tests/test.conf +++ b/tests/test.conf @@ -2306,3 +2306,15 @@ -A ./certs/test/server-goodaltwild.pem -m -C + +# server CN in alternate names list +-v 3 +-l ECDHE-RSA-AES128-GCM-SHA256 +-c ./certs/test/server-localhost.pem + +# client CN in alternate names list +-v 3 +-l ECDHE-RSA-AES128-GCM-SHA256 +-h localhost +-A ./certs/test/server-localhost.pem +-m From 239880a9de714e0a8f2dc1a97a18296cbb91735c Mon Sep 17 00:00:00 2001 From: John Safranek Date: Tue, 10 Jul 2018 17:07:48 -0700 Subject: [PATCH 2/2] Subject Alt Name Matching 1. Removed an external test tag from a failure test case. Ends up leaving a thread still running on exit. --- tests/test-fails.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/test-fails.conf b/tests/test-fails.conf index 1c8f6e5ef..e41fcd35e 100644 --- a/tests/test-fails.conf +++ b/tests/test-fails.conf @@ -106,5 +106,4 @@ -h localhost -A ./certs/test/server-garbage.pem -m --X