← Back to branch summary

~ubuntu-branches/ubuntu/utopic/golang/utopic

« back to all changes in this revision

Viewing changes to src/pkg/crypto/x509/x509_test.go

  • Committer: Package Import Robot
  • Author(s): James Page
  • Date: 2013-08-20 14:06:23 UTC
  • mfrom: (14.1.23 saucy-proposed)
  • Revision ID: package-import@ubuntu.com-20130820140623-b414jfxi3m0qkmrq
Tags: 2:1.1.2-2ubuntu1
https://launchpad.net/bugs/1211749
https://launchpad.net/bugs/1202027
* Merge from Debian unstable (LP: #1211749, #1202027). Remaining changes:
  - 016-armhf-elf-header.patch: Use correct ELF header for armhf binaries.
  - d/control,control.cross: Update Breaks/Replaces for Ubuntu
    versions to ensure smooth upgrades, regenerate control file.

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/pkg/crypto/x509/x509_test.go
7
7
import (
8
8
        "bytes"
9
9
        "crypto/dsa"
 
10
        "crypto/ecdsa"
 
11
        "crypto/elliptic"
10
12
        "crypto/rand"
11
13
        "crypto/rsa"
 
14
        _ "crypto/sha256"
 
15
        _ "crypto/sha512"
12
16
        "crypto/x509/pkix"
13
17
        "encoding/asn1"
14
18
        "encoding/base64"
15
19
        "encoding/hex"
16
20
        "encoding/pem"
17
21
        "math/big"
 
22
        "net"
 
23
        "reflect"
18
24
        "testing"
19
25
        "time"
20
26
)
169
175
        }
170
176
}
171
177
 
 
178
func TestMatchIP(t *testing.T) {
 
179
        // Check that pattern matching is working.
 
180
        c := &Certificate{
 
181
                DNSNames: []string{"*.foo.bar.baz"},
 
182
                Subject: pkix.Name{
 
183
                        CommonName: "*.foo.bar.baz",
 
184
                },
 
185
        }
 
186
        err := c.VerifyHostname("quux.foo.bar.baz")
 
187
        if err != nil {
 
188
                t.Fatalf("VerifyHostname(quux.foo.bar.baz): %v", err)
 
189
        }
 
190
 
 
191
        // But check that if we change it to be matching against an IP address,
 
192
        // it is rejected.
 
193
        c = &Certificate{
 
194
                DNSNames: []string{"*.2.3.4"},
 
195
                Subject: pkix.Name{
 
196
                        CommonName: "*.2.3.4",
 
197
                },
 
198
        }
 
199
        err = c.VerifyHostname("1.2.3.4")
 
200
        if err == nil {
 
201
                t.Fatalf("VerifyHostname(1.2.3.4) should have failed, did not")
 
202
        }
 
203
 
 
204
        c = &Certificate{
 
205
                IPAddresses: []net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("::1")},
 
206
        }
 
207
        err = c.VerifyHostname("127.0.0.1")
 
208
        if err != nil {
 
209
                t.Fatalf("VerifyHostname(127.0.0.1): %v", err)
 
210
        }
 
211
        err = c.VerifyHostname("::1")
 
212
        if err != nil {
 
213
                t.Fatalf("VerifyHostname(::1): %v", err)
 
214
        }
 
215
        err = c.VerifyHostname("[::1]")
 
216
        if err != nil {
 
217
                t.Fatalf("VerifyHostname([::1]): %v", err)
 
218
        }
 
219
}
 
220
 
172
221
func TestCertificateParse(t *testing.T) {
173
222
        s, _ := hex.DecodeString(certBytes)
174
223
        certs, err := ParseCertificates(s)
237
286
        random := rand.Reader
238
287
 
239
288
        block, _ := pem.Decode([]byte(pemPrivateKey))
240
 
        priv, err := ParsePKCS1PrivateKey(block.Bytes)
241
 
        if err != nil {
242
 
                t.Errorf("Failed to parse private key: %s", err)
243
 
                return
244
 
        }
245
 
 
246
 
        commonName := "test.example.com"
247
 
        template := Certificate{
248
 
                SerialNumber: big.NewInt(1),
249
 
                Subject: pkix.Name{
250
 
                        CommonName:   commonName,
251
 
                        Organization: []string{"Acme Co"},
252
 
                },
253
 
                NotBefore: time.Unix(1000, 0),
254
 
                NotAfter:  time.Unix(100000, 0),
255
 
 
256
 
                SubjectKeyId: []byte{1, 2, 3, 4},
257
 
                KeyUsage:     KeyUsageCertSign,
258
 
 
259
 
                BasicConstraintsValid: true,
260
 
                IsCA:                  true,
261
 
                DNSNames:              []string{"test.example.com"},
262
 
 
263
 
                PolicyIdentifiers:   []asn1.ObjectIdentifier{[]int{1, 2, 3}},
264
 
                PermittedDNSDomains: []string{".example.com", "example.com"},
265
 
        }
266
 
 
267
 
        derBytes, err := CreateCertificate(random, &template, &template, &priv.PublicKey, priv)
268
 
        if err != nil {
269
 
                t.Errorf("Failed to create certificate: %s", err)
270
 
                return
271
 
        }
272
 
 
273
 
        cert, err := ParseCertificate(derBytes)
274
 
        if err != nil {
275
 
                t.Errorf("Failed to parse certificate: %s", err)
276
 
                return
277
 
        }
278
 
 
279
 
        if len(cert.PolicyIdentifiers) != 1 || !cert.PolicyIdentifiers[0].Equal(template.PolicyIdentifiers[0]) {
280
 
                t.Errorf("Failed to parse policy identifiers: got:%#v want:%#v", cert.PolicyIdentifiers, template.PolicyIdentifiers)
281
 
        }
282
 
 
283
 
        if len(cert.PermittedDNSDomains) != 2 || cert.PermittedDNSDomains[0] != ".example.com" || cert.PermittedDNSDomains[1] != "example.com" {
284
 
                t.Errorf("Failed to parse name constraints: %#v", cert.PermittedDNSDomains)
285
 
        }
286
 
 
287
 
        if cert.Subject.CommonName != commonName {
288
 
                t.Errorf("Subject wasn't correctly copied from the template. Got %s, want %s", cert.Subject.CommonName, commonName)
289
 
        }
290
 
 
291
 
        if cert.Issuer.CommonName != commonName {
292
 
                t.Errorf("Issuer wasn't correctly copied from the template. Got %s, want %s", cert.Issuer.CommonName, commonName)
293
 
        }
294
 
 
295
 
        err = cert.CheckSignatureFrom(cert)
296
 
        if err != nil {
297
 
                t.Errorf("Signature verification failed: %s", err)
298
 
                return
 
289
        rsaPriv, err := ParsePKCS1PrivateKey(block.Bytes)
 
290
        if err != nil {
 
291
                t.Fatalf("Failed to parse private key: %s", err)
 
292
        }
 
293
 
 
294
        ecdsaPriv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 
295
        if err != nil {
 
296
                t.Fatalf("Failed to generate ECDSA key: %s", err)
 
297
        }
 
298
 
 
299
        tests := []struct {
 
300
                name      string
 
301
                pub, priv interface{}
 
302
                checkSig  bool
 
303
        }{
 
304
                {"RSA/RSA", &rsaPriv.PublicKey, rsaPriv, true},
 
305
                {"RSA/ECDSA", &rsaPriv.PublicKey, ecdsaPriv, false},
 
306
                {"ECDSA/RSA", &ecdsaPriv.PublicKey, rsaPriv, false},
 
307
                {"ECDSA/ECDSA", &ecdsaPriv.PublicKey, ecdsaPriv, true},
 
308
        }
 
309
 
 
310
        testExtKeyUsage := []ExtKeyUsage{ExtKeyUsageClientAuth, ExtKeyUsageServerAuth}
 
311
        testUnknownExtKeyUsage := []asn1.ObjectIdentifier{[]int{1, 2, 3}, []int{3, 2, 1}}
 
312
 
 
313
        for _, test := range tests {
 
314
                commonName := "test.example.com"
 
315
                template := Certificate{
 
316
                        SerialNumber: big.NewInt(1),
 
317
                        Subject: pkix.Name{
 
318
                                CommonName:   commonName,
 
319
                                Organization: []string{"Σ Acme Co"},
 
320
                        },
 
321
                        NotBefore: time.Unix(1000, 0),
 
322
                        NotAfter:  time.Unix(100000, 0),
 
323
 
 
324
                        SubjectKeyId: []byte{1, 2, 3, 4},
 
325
                        KeyUsage:     KeyUsageCertSign,
 
326
 
 
327
                        ExtKeyUsage:        testExtKeyUsage,
 
328
                        UnknownExtKeyUsage: testUnknownExtKeyUsage,
 
329
 
 
330
                        BasicConstraintsValid: true,
 
331
                        IsCA: true,
 
332
 
 
333
                        DNSNames:       []string{"test.example.com"},
 
334
                        EmailAddresses: []string{"gopher@golang.org"},
 
335
                        IPAddresses:    []net.IP{net.IPv4(127, 0, 0, 1).To4(), net.ParseIP("2001:4860:0:2001::68")},
 
336
 
 
337
                        PolicyIdentifiers:   []asn1.ObjectIdentifier{[]int{1, 2, 3}},
 
338
                        PermittedDNSDomains: []string{".example.com", "example.com"},
 
339
                }
 
340
 
 
341
                derBytes, err := CreateCertificate(random, &template, &template, test.pub, test.priv)
 
342
                if err != nil {
 
343
                        t.Errorf("%s: failed to create certificate: %s", test.name, err)
 
344
                        continue
 
345
                }
 
346
 
 
347
                cert, err := ParseCertificate(derBytes)
 
348
                if err != nil {
 
349
                        t.Errorf("%s: failed to parse certificate: %s", test.name, err)
 
350
                        continue
 
351
                }
 
352
 
 
353
                if len(cert.PolicyIdentifiers) != 1 || !cert.PolicyIdentifiers[0].Equal(template.PolicyIdentifiers[0]) {
 
354
                        t.Errorf("%s: failed to parse policy identifiers: got:%#v want:%#v", test.name, cert.PolicyIdentifiers, template.PolicyIdentifiers)
 
355
                }
 
356
 
 
357
                if len(cert.PermittedDNSDomains) != 2 || cert.PermittedDNSDomains[0] != ".example.com" || cert.PermittedDNSDomains[1] != "example.com" {
 
358
                        t.Errorf("%s: failed to parse name constraints: %#v", test.name, cert.PermittedDNSDomains)
 
359
                }
 
360
 
 
361
                if cert.Subject.CommonName != commonName {
 
362
                        t.Errorf("%s: subject wasn't correctly copied from the template. Got %s, want %s", test.name, cert.Subject.CommonName, commonName)
 
363
                }
 
364
 
 
365
                if cert.Issuer.CommonName != commonName {
 
366
                        t.Errorf("%s: issuer wasn't correctly copied from the template. Got %s, want %s", test.name, cert.Issuer.CommonName, commonName)
 
367
                }
 
368
 
 
369
                if !reflect.DeepEqual(cert.ExtKeyUsage, testExtKeyUsage) {
 
370
                        t.Errorf("%s: extkeyusage wasn't correctly copied from the template. Got %v, want %v", test.name, cert.ExtKeyUsage, testExtKeyUsage)
 
371
                }
 
372
 
 
373
                if !reflect.DeepEqual(cert.UnknownExtKeyUsage, testUnknownExtKeyUsage) {
 
374
                        t.Errorf("%s: unknown extkeyusage wasn't correctly copied from the template. Got %v, want %v", test.name, cert.UnknownExtKeyUsage, testUnknownExtKeyUsage)
 
375
                }
 
376
 
 
377
                if !reflect.DeepEqual(cert.DNSNames, template.DNSNames) {
 
378
                        t.Errorf("%s: SAN DNS names differ from template. Got %v, want %v", test.name, cert.DNSNames, template.DNSNames)
 
379
                }
 
380
 
 
381
                if !reflect.DeepEqual(cert.EmailAddresses, template.EmailAddresses) {
 
382
                        t.Errorf("%s: SAN emails differ from template. Got %v, want %v", test.name, cert.EmailAddresses, template.EmailAddresses)
 
383
                }
 
384
 
 
385
                if !reflect.DeepEqual(cert.IPAddresses, template.IPAddresses) {
 
386
                        t.Errorf("%s: SAN IPs differ from template. Got %v, want %v", test.name, cert.IPAddresses, template.IPAddresses)
 
387
                }
 
388
 
 
389
                if test.checkSig {
 
390
                        err = cert.CheckSignatureFrom(cert)
 
391
                        if err != nil {
 
392
                                t.Errorf("%s: signature verification failed: %s", test.name, err)
 
393
                        }
 
394
                }
 
395
        }
 
396
}
 
397
 
 
398
// Self-signed certificate using ECDSA with SHA1 & secp256r1
 
399
var ecdsaSHA1CertPem = `
 
400
-----BEGIN CERTIFICATE-----
 
401
MIICDjCCAbUCCQDF6SfN0nsnrjAJBgcqhkjOPQQBMIGPMQswCQYDVQQGEwJVUzET
 
402
MBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEVMBMG
 
403
A1UECgwMR29vZ2xlLCBJbmMuMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEG
 
404
CSqGSIb3DQEJARYUZ29sYW5nLWRldkBnbWFpbC5jb20wHhcNMTIwNTIwMjAyMDUw
 
405
WhcNMjIwNTE4MjAyMDUwWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
 
406
b3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFTATBgNVBAoMDEdvb2dsZSwg
 
407
SW5jLjEXMBUGA1UEAwwOd3d3Lmdvb2dsZS5jb20xIzAhBgkqhkiG9w0BCQEWFGdv
 
408
bGFuZy1kZXZAZ21haWwuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE/Wgn
 
409
WQDo5+bz71T0327ERgd5SDDXFbXLpzIZDXTkjpe8QTEbsF+ezsQfrekrpDPC4Cd3
 
410
P9LY0tG+aI8IyVKdUjAJBgcqhkjOPQQBA0gAMEUCIGlsqMcRqWVIWTD6wXwe6Jk2
 
411
DKxL46r/FLgJYnzBEH99AiEA3fBouObsvV1R3oVkb4BQYnD4/4LeId6lAT43YvyV
 
412
a/A=
 
413
-----END CERTIFICATE-----
 
414
`
 
415
 
 
416
// Self-signed certificate using ECDSA with SHA256 & secp256r1
 
417
var ecdsaSHA256p256CertPem = `
 
418
-----BEGIN CERTIFICATE-----
 
419
MIICDzCCAbYCCQDlsuMWvgQzhTAKBggqhkjOPQQDAjCBjzELMAkGA1UEBhMCVVMx
 
420
EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFTAT
 
421
BgNVBAoMDEdvb2dsZSwgSW5jLjEXMBUGA1UEAwwOd3d3Lmdvb2dsZS5jb20xIzAh
 
422
BgkqhkiG9w0BCQEWFGdvbGFuZy1kZXZAZ21haWwuY29tMB4XDTEyMDUyMTAwMTkx
 
423
NloXDTIyMDUxOTAwMTkxNlowgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxp
 
424
Zm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRUwEwYDVQQKDAxHb29nbGUs
 
425
IEluYy4xFzAVBgNVBAMMDnd3dy5nb29nbGUuY29tMSMwIQYJKoZIhvcNAQkBFhRn
 
426
b2xhbmctZGV2QGdtYWlsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPMt
 
427
2ErhxAty5EJRu9yM+MTy+hUXm3pdW1ensAv382KoGExSXAFWP7pjJnNtHO+XSwVm
 
428
YNtqjcAGFKpweoN//kQwCgYIKoZIzj0EAwIDRwAwRAIgIYSaUA/IB81gjbIw/hUV
 
429
70twxJr5EcgOo0hLp3Jm+EYCIFDO3NNcgmURbJ1kfoS3N/0O+irUtoPw38YoNkqJ
 
430
h5wi
 
431
-----END CERTIFICATE-----
 
432
`
 
433
 
 
434
// Self-signed certificate using ECDSA with SHA256 & secp384r1
 
435
var ecdsaSHA256p384CertPem = `
 
436
-----BEGIN CERTIFICATE-----
 
437
MIICSjCCAdECCQDje/no7mXkVzAKBggqhkjOPQQDAjCBjjELMAkGA1UEBhMCVVMx
 
438
EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFDAS
 
439
BgNVBAoMC0dvb2dsZSwgSW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEG
 
440
CSqGSIb3DQEJARYUZ29sYW5nLWRldkBnbWFpbC5jb20wHhcNMTIwNTIxMDYxMDM0
 
441
WhcNMjIwNTE5MDYxMDM0WjCBjjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
 
442
b3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFDASBgNVBAoMC0dvb2dsZSwg
 
443
SW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEGCSqGSIb3DQEJARYUZ29s
 
444
YW5nLWRldkBnbWFpbC5jb20wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARRuzRNIKRK
 
445
jIktEmXanNmrTR/q/FaHXLhWRZ6nHWe26Fw7Rsrbk+VjGy4vfWtNn7xSFKrOu5ze
 
446
qxKnmE0h5E480MNgrUiRkaGO2GMJJVmxx20aqkXOk59U8yGA4CghE6MwCgYIKoZI
 
447
zj0EAwIDZwAwZAIwBZEN8gvmRmfeP/9C1PRLzODIY4JqWub2PLRT4mv9GU+yw3Gr
 
448
PU9A3CHMdEcdw/MEAjBBO1lId8KOCh9UZunsSMfqXiVurpzmhWd6VYZ/32G+M+Mh
 
449
3yILeYQzllt/g0rKVRk=
 
450
-----END CERTIFICATE-----
 
451
`
 
452
 
 
453
// Self-signed certificate using ECDSA with SHA384 & secp521r1
 
454
var ecdsaSHA384p521CertPem = `
 
455
-----BEGIN CERTIFICATE-----
 
456
MIICljCCAfcCCQDhp1AFD/ahKjAKBggqhkjOPQQDAzCBjjELMAkGA1UEBhMCVVMx
 
457
EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFDAS
 
458
BgNVBAoMC0dvb2dsZSwgSW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEG
 
459
CSqGSIb3DQEJARYUZ29sYW5nLWRldkBnbWFpbC5jb20wHhcNMTIwNTIxMTUwNDI5
 
460
WhcNMjIwNTE5MTUwNDI5WjCBjjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
 
461
b3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFDASBgNVBAoMC0dvb2dsZSwg
 
462
SW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEGCSqGSIb3DQEJARYUZ29s
 
463
YW5nLWRldkBnbWFpbC5jb20wgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABACqx9Rv
 
464
IssRs1LWYcNN+WffwlHw4Tv3y8/LIAA9MF1ZScIonU9nRMxt4a2uGJVCPDw6JHpz
 
465
PaYc0E9puLoE9AfKpwFr59Jkot7dBg55SKPEFkddoip/rvmN7NPAWjMBirOwjOkm
 
466
8FPthvPhGPqsu9AvgVuHu3PosWiHGNrhh379pva8MzAKBggqhkjOPQQDAwOBjAAw
 
467
gYgCQgEHNmswkUdPpHqrVxp9PvLVl+xxPuHBkT+75z9JizyxtqykHQo9Uh6SWCYH
 
468
BF9KLolo01wMt8DjoYP5Fb3j5MH7xwJCAbWZzTOp4l4DPkIvAh4LeC4VWbwPPyqh
 
469
kBg71w/iEcSY3wUKgHGcJJrObZw7wys91I5kENljqw/Samdr3ka+jBJa
 
470
-----END CERTIFICATE-----
 
471
`
 
472
 
 
473
var ecdsaTests = []struct {
 
474
        sigAlgo SignatureAlgorithm
 
475
        pemCert string
 
476
}{
 
477
        {ECDSAWithSHA1, ecdsaSHA1CertPem},
 
478
        {ECDSAWithSHA256, ecdsaSHA256p256CertPem},
 
479
        {ECDSAWithSHA256, ecdsaSHA256p384CertPem},
 
480
        {ECDSAWithSHA384, ecdsaSHA384p521CertPem},
 
481
}
 
482
 
 
483
func TestECDSA(t *testing.T) {
 
484
        for i, test := range ecdsaTests {
 
485
                pemBlock, _ := pem.Decode([]byte(test.pemCert))
 
486
                cert, err := ParseCertificate(pemBlock.Bytes)
 
487
                if err != nil {
 
488
                        t.Errorf("%d: failed to parse certificate: %s", i, err)
 
489
                        continue
 
490
                }
 
491
                if sa := cert.SignatureAlgorithm; sa != test.sigAlgo {
 
492
                        t.Errorf("%d: signature algorithm is %v, want %v", i, sa, test.sigAlgo)
 
493
                }
 
494
                if parsedKey, ok := cert.PublicKey.(*ecdsa.PublicKey); !ok {
 
495
                        t.Errorf("%d: wanted an ECDSA public key but found: %#v", i, parsedKey)
 
496
                }
 
497
                if pka := cert.PublicKeyAlgorithm; pka != ECDSA {
 
498
                        t.Errorf("%d: public key algorithm is %v, want ECDSA", i, pka)
 
499
                }
 
500
                if err = cert.CheckSignatureFrom(cert); err != nil {
 
501
                        t.Errorf("%d: certificate verification failed: %s", i, err)
 
502
                }
299
503
        }
300
504
}
301
505
 
374
578
        }
375
579
        // test cert is self-signed
376
580
        if err = cert.CheckSignatureFrom(cert); err != nil {
377
 
                t.Fatalf("DSA Certificate verfication failed: %s", err)
 
581
                t.Fatalf("DSA Certificate verification failed: %s", err)
378
582
        }
379
583
}
380
584