mirror of https://github.com/briansmith/webpki
101 lines
3.6 KiB
Rust
101 lines
3.6 KiB
Rust
// Copyright 2015 Brian Smith.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
|
|
// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
|
|
// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
#![no_std]
|
|
|
|
extern crate alloc;
|
|
use alloc::{string::ToString, vec, vec::Vec};
|
|
use core::convert::TryFrom;
|
|
use webpki::{
|
|
EndEntityCert, ErrorExt, Time, TlsServerTrustAnchors, TrustAnchor, ECDSA_P256_SHA256,
|
|
};
|
|
|
|
enum ChainTrustAnchor {
|
|
InChain,
|
|
NotInChain,
|
|
}
|
|
|
|
fn build_degenerate_chain(intermediate_count: usize, trust_anchor: ChainTrustAnchor) -> ErrorExt {
|
|
let alg = &rcgen::PKCS_ECDSA_P256_SHA256;
|
|
|
|
let make_issuer = |org_name| {
|
|
let mut ca_params = rcgen::CertificateParams::new(Vec::new());
|
|
ca_params
|
|
.distinguished_name
|
|
.push(rcgen::DnType::OrganizationName, org_name);
|
|
ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
|
|
ca_params.key_usages = vec![
|
|
rcgen::KeyUsagePurpose::KeyCertSign,
|
|
rcgen::KeyUsagePurpose::DigitalSignature,
|
|
rcgen::KeyUsagePurpose::CrlSign,
|
|
];
|
|
ca_params.alg = alg;
|
|
rcgen::Certificate::from_params(ca_params).unwrap()
|
|
};
|
|
|
|
let ca_cert = make_issuer("Bogus Subject");
|
|
let ca_cert_der = ca_cert.serialize_der().unwrap();
|
|
|
|
let mut intermediates = Vec::with_capacity(intermediate_count);
|
|
if let ChainTrustAnchor::InChain = trust_anchor {
|
|
intermediates.push(ca_cert_der.to_vec());
|
|
}
|
|
|
|
let mut issuer = ca_cert;
|
|
for _ in 0..intermediate_count {
|
|
let intermediate = make_issuer("Bogus Subject");
|
|
let intermediate_der = intermediate.serialize_der_with_signer(&issuer).unwrap();
|
|
intermediates.push(intermediate_der);
|
|
issuer = intermediate;
|
|
}
|
|
|
|
let mut ee_params = rcgen::CertificateParams::new(vec!["example.com".to_string()]);
|
|
ee_params.is_ca = rcgen::IsCa::ExplicitNoCa;
|
|
ee_params.alg = alg;
|
|
let ee_cert = rcgen::Certificate::from_params(ee_params).unwrap();
|
|
let ee_cert_der = ee_cert.serialize_der_with_signer(&issuer).unwrap();
|
|
|
|
let trust_anchor = match trust_anchor {
|
|
ChainTrustAnchor::InChain => make_issuer("Bogus Trust Anchor").serialize_der().unwrap(),
|
|
ChainTrustAnchor::NotInChain => ca_cert_der.clone(),
|
|
};
|
|
|
|
let anchors = &[TrustAnchor::try_from_cert_der(&trust_anchor).unwrap()];
|
|
let time = Time::from_seconds_since_unix_epoch(0x1fed_f00d);
|
|
let cert = EndEntityCert::try_from(&ee_cert_der[..]).unwrap();
|
|
let intermediate_certs = intermediates.iter().map(|x| x.as_ref()).collect::<Vec<_>>();
|
|
|
|
cert.verify_is_valid_tls_server_cert_ext(
|
|
&[&ECDSA_P256_SHA256],
|
|
&TlsServerTrustAnchors(anchors),
|
|
&intermediate_certs,
|
|
time,
|
|
)
|
|
.unwrap_err()
|
|
}
|
|
|
|
#[test]
|
|
fn test_too_many_signatures() {
|
|
assert!(matches!(
|
|
build_degenerate_chain(5, ChainTrustAnchor::NotInChain),
|
|
ErrorExt::MaximumSignatureChecksExceeded
|
|
));
|
|
}
|
|
|
|
#[test]
|
|
fn test_too_many_path_calls() {
|
|
let result = build_degenerate_chain(10, ChainTrustAnchor::InChain);
|
|
assert!(matches!(result, ErrorExt::MaximumPathBuildCallsExceeded));
|
|
}
|