packages/botan2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
botan2/backport-CVE-2024-39312.patch
liweigang b1af91ba54 fix CVE-2024-39312 
fix CVE-2024-34702

Signed-off-by: liweigang <liweiganga@uniontech.com>
(cherry picked from commit 038d73babab508da6d9bee6b8890cadbfec83d68)
2024-07-10 11:23:36 +08:00

746 lines
24 KiB
Diff
Raw Permalink Blame History

From 68338f5912534c74469f7f4e6e22b37aa5159952 Mon Sep 17 00:00:00 2001
From: Jack Lloyd <jack@randombit.net>
Date: Sun, 7 Jul 2024 05:02:48 -0400
Subject: [PATCH] Address various name constraint bugs
---
src/lib/x509/asn1_alt_name.cpp | 4 +
src/lib/x509/name_constraint.cpp | 313 ++++++++++++++++++++++++++++-
src/lib/x509/pkix_types.h | 37 +++-
src/lib/x509/x509_ext.cpp | 80 +++-----
src/lib/x509/x509cert.cpp | 30 ++-
src/python/botan2.py | 2 +
src/scripts/test_python.py | 3 -
src/tests/test_name_constraint.cpp | 10 +-
8 files changed, 401 insertions(+), 78 deletions(-)
diff --git a/src/lib/x509/asn1_alt_name.cpp b/src/lib/x509/asn1_alt_name.cpp
index a347a3114c6..574b9fb3ed9 100644
--- a/src/lib/x509/asn1_alt_name.cpp
+++ b/src/lib/x509/asn1_alt_name.cpp
@@ -257,6 +257,10 @@ void AlternativeName::decode_from(BER_Decoder& source)
const uint32_t ip = load_be<uint32_t>(obj.bits(), 0);
add_attribute("IP", ipv4_to_string(ip));
}
+ else if(obj.length() != 16)
+ {
+ throw Decoding_Error("Invalid length for IP address SAN");
+ }
}
}
diff --git a/src/lib/x509/name_constraint.cpp b/src/lib/x509/name_constraint.cpp
index c9045729de1..632bc8c3aa9 100644
--- a/src/lib/x509/name_constraint.cpp
+++ b/src/lib/x509/name_constraint.cpp
@@ -163,31 +163,48 @@ GeneralName::MatchResult GeneralName::matches(const X509_Certificate& cert) cons
bool GeneralName::matches_dns(const std::string& nam) const
{
- if(nam.size() == name().size())
+ const std::string constraint = tolower_string(name());
+ const std::string issued = tolower_string(nam);
+
+ if(nam.size() == constraint.size())
{
- return tolower_string(nam) == tolower_string(name());
+ return issued == constraint;
}
- else if(name().size() > nam.size())
+ else if(constraint.size() > nam.size())
{
// The constraint is longer than the issued name: not possibly a match
return false;
}
- else // name.size() < nam.size()
+ else
{
- // constr is suffix of nam
- const std::string constr = name().front() == '.' ? name() : "." + name();
- const std::string substr = nam.substr(nam.size() - constr.size(), constr.size());
- return tolower_string(constr) == tolower_string(substr);
+ if(constraint.empty()) {
+ return true;
+ }
+
+ std::string substr = issued.substr(nam.size() - constraint.size(), constraint.size());
+
+ if(constraint.front() == '.') {
+ return substr == constraint;
+ } else if(substr[0] == '.') {
+ return substr.substr(1) == constraint;
+ } else {
+ return substr == constraint && issued[issued.size() - constraint.size() - 1] == '.';
}
}
+}
bool GeneralName::matches_dn(const std::string& nam) const
{
std::stringstream ss(nam);
- std::stringstream tt(name());
- X509_DN nam_dn, my_dn;
-
+ X509_DN nam_dn;
ss >> nam_dn;
+ return matches_dn_obj(nam_dn);
+ }
+
+bool GeneralName::matches_dn_obj(const X509_DN& nam_dn) const
+ {
+ std::stringstream tt(name());
+ X509_DN my_dn;
tt >> my_dn;
auto attr = nam_dn.get_attributes();
@@ -270,4 +287,278 @@ std::ostream& operator<<(std::ostream& os, const GeneralSubtree& gs)
os << gs.minimum() << "," << gs.maximum() << "," << gs.base();
return os;
}
+
+NameConstraints::NameConstraints(std::vector<GeneralSubtree>&& permitted_subtrees,
+ std::vector<GeneralSubtree>&& excluded_subtrees) :
+ m_permitted_subtrees(permitted_subtrees), m_excluded_subtrees(excluded_subtrees)
+ {
+ for(const auto& c : m_permitted_subtrees)
+ {
+ m_permitted_name_types.insert(c.base().type());
+ }
+ for(const auto& c : m_excluded_subtrees)
+ {
+ m_excluded_name_types.insert(c.base().type());
+ }
+ }
+
+namespace {
+
+bool looks_like_ipv4(const std::string& s)
+ {
+ try
+ {
+ // ignores return value
+ string_to_ipv4(s);
+ return true;
+ }
+ catch(...)
+ {
+ return false;
+ }
+ }
+
+}
+
+bool NameConstraints::is_permitted(const X509_Certificate& cert, bool reject_unknown) const {
+ if(permitted().empty()) {
+ return true;
+ }
+
+ const auto& alt_name = cert.subject_alt_name();
+
+ if(reject_unknown) {
+ if(m_permitted_name_types.find("URI") != m_permitted_name_types.end() && !alt_name.get_attribute("URI").empty()) {
+ return false;
+ }
+ if(m_permitted_name_types.find("RFC822") != m_permitted_name_types.end() && !alt_name.get_attribute("RFC822").empty()) {
+ return false;
+ }
+ }
+
+ auto is_permitted_dn = [&](const X509_DN& dn) {
+ // If no restrictions, then immediate accept
+ if(m_permitted_name_types.find("DN") == m_permitted_name_types.end()) {
+ return true;
+ }
+
+ if(dn.empty()) {
+ return true;
+ }
+
+ for(const auto& c : m_permitted_subtrees) {
+ if(c.base().type() == "DN" && c.base().matches_dn_obj(dn)) {
+ return true;
+ }
+ }
+
+ // There is at least one permitted name and we didn't match
+ return false;
+ };
+
+ auto is_permitted_dns_name = [&](const std::string& name) {
+ if(name.empty() || name[0] == '.') {
+ return false;
+ }
+
+ // If no restrictions, then immediate accept
+ if(m_permitted_name_types.find("DNS") == m_permitted_name_types.end()) {
+ return true;
+ }
+
+ for(const auto& c : m_permitted_subtrees) {
+ if(c.base().type() == "DNS" && c.base().matches_dns(name)) {
+ return true;
+ }
+ }
+
+ // There is at least one permitted name and we didn't match
+ return false;
+ };
+
+ auto is_permitted_ipv4 = [&](const std::string& ipv4) {
+ // If no restrictions, then immediate accept
+ if(m_permitted_name_types.find("IP") == m_permitted_name_types.end()) {
+ return true;
+ }
+
+ for(const auto& c : m_permitted_subtrees) {
+ if(c.base().type() == "IP" && c.base().matches_ip(ipv4)) {
+ return true;
+ }
+ }
+
+ // There is at least one permitted name and we didn't match
+ return false;
+ };
+
+ if(!is_permitted_dn(cert.subject_dn())) {
+ return false;
+ }
+
+ if(!is_permitted_dn(alt_name.dn()))
+ {
+ return false;
+ }
+
+ for(const auto& alt_dns : alt_name.get_attribute("DNS")) {
+ if(!is_permitted_dns_name(alt_dns)) {
+ return false;
+ }
+ }
+
+ for(const auto& alt_ipv4 : alt_name.get_attribute("IP")) {
+ if(!is_permitted_ipv4(alt_ipv4)) {
+ return false;
+ }
+ }
+
+ if(!alt_name.has_items())
+ {
+ for(const auto& cn : cert.subject_info("Name"))
+ {
+ if(cn.find(".") != std::string::npos)
+ {
+ if(looks_like_ipv4(cn))
+ {
+ if(!is_permitted_ipv4(cn))
+ {
+ return false;
+ }
+ }
+ else
+ {
+ if(!is_permitted_dns_name(cn))
+ {
+ return false;
+ }
+ }
+ }
+ }
+ }
+
+ // We didn't encounter a name that doesn't have a matching constraint
+ return true;
}
+
+bool NameConstraints::is_excluded(const X509_Certificate& cert, bool reject_unknown) const {
+ if(excluded().empty()) {
+ return false;
+ }
+
+ const auto& alt_name = cert.subject_alt_name();
+
+ if(reject_unknown) {
+ if(m_excluded_name_types.find("URI") != m_excluded_name_types.end() && !alt_name.get_attribute("URI").empty()) {
+ return false;
+ }
+ if(m_excluded_name_types.find("RFC822") != m_excluded_name_types.end() && !alt_name.get_attribute("RFC822").empty()) {
+ return false;
+ }
+ }
+
+ auto is_excluded_dn = [&](const X509_DN& dn) {
+ // If no restrictions, then immediate accept
+ if(m_excluded_name_types.find("DN") == m_excluded_name_types.end()) {
+ return false;
+ }
+
+ if(dn.empty()) {
+ return false;
+ }
+
+ for(const auto& c : m_excluded_subtrees) {
+ if(c.base().type() == "DN" && c.base().matches_dn_obj(dn)) {
+ return true;
+ }
+ }
+
+ // There is at least one excluded name and we didn't match
+ return false;
+ };
+
+ auto is_excluded_dns_name = [&](const std::string& name) {
+ if(name.empty() || name[0] == '.') {
+ return true;
+ }
+
+ // If no restrictions, then immediate accept
+ if(m_excluded_name_types.find("DNS") == m_excluded_name_types.end()) {
+ return false;
+ }
+
+ for(const auto& c : m_excluded_subtrees) {
+ if(c.base().type() == "DNS" && c.base().matches_dns(name)) {
+ return true;
+ }
+ }
+
+ // There is at least one excluded name and we didn't match
+ return false;
+ };
+
+ auto is_excluded_ipv4 = [&](const std::string& ipv4) {
+ // If no restrictions, then immediate accept
+ if(m_excluded_name_types.find("IP") == m_excluded_name_types.end()) {
+ return false;
+ }
+
+ for(const auto& c : m_excluded_subtrees) {
+ if(c.base().type() == "IP" && c.base().matches_ip(ipv4)) {
+ return true;
+ }
+ }
+
+ // There is at least one excluded name and we didn't match
+ return false;
+ };
+
+ if(is_excluded_dn(cert.subject_dn())) {
+ return true;
+ }
+
+ if(is_excluded_dn(alt_name.dn())) {
+ return true;
+ }
+
+ for(const auto& alt_dns : alt_name.get_attribute("DNS")) {
+ if(is_excluded_dns_name(alt_dns)) {
+ return true;
+ }
+ }
+
+ for(const auto& alt_ipv4 : alt_name.get_attribute("IP")) {
+ if(is_excluded_ipv4(alt_ipv4)) {
+ return true;
+ }
+ }
+
+ if(!alt_name.has_items())
+ {
+ for(const auto& cn : cert.subject_info("Name"))
+ {
+ if(cn.find(".") != std::string::npos)
+ {
+ if(looks_like_ipv4(cn))
+ {
+ if(is_excluded_ipv4(cn))
+ {
+ return true;
+ }
+ }
+ else
+ {
+ if(is_excluded_dns_name(cn))
+ {
+ return true;
+ }
+ }
+ }
+ }
+ }
+
+ // We didn't encounter a name that matched any prohibited name
+ return false;
+}
+
+} // namespace Botan
diff --git a/src/lib/x509/pkix_types.h b/src/lib/x509/pkix_types.h
index f6eac487582..a9e467becaf 100644
--- a/src/lib/x509/pkix_types.h
+++ b/src/lib/x509/pkix_types.h
@@ -191,6 +191,9 @@ class BOTAN_PUBLIC_API(2,0) Attribute final : public ASN1_Object
* Handles parsing GeneralName types in their BER and canonical string
* encoding. Allows matching GeneralNames against each other using
* the rules laid out in the RFC 5280, sec. 4.2.1.10 (Name Contraints).
+*
+* This entire class is deprecated and will be removed in a future
+* major release
*/
class BOTAN_PUBLIC_API(2,0) GeneralName final : public ASN1_Object
{
@@ -213,6 +216,7 @@ class BOTAN_PUBLIC_API(2,0) GeneralName final : public ASN1_Object
* Creates a new GeneralName for its string format.
* @param str type and name, colon-separated, e.g., "DNS:google.com"
*/
+ BOTAN_DEPRECATED("Deprecated no replacement")
GeneralName(const std::string& str);
void encode_into(DER_Encoder&) const override;
@@ -234,15 +238,17 @@ class BOTAN_PUBLIC_API(2,0) GeneralName final : public ASN1_Object
* @param cert certificate to be matched
* @return the match result
*/
+ BOTAN_DEPRECATED("Deprecated no replacement")
MatchResult matches(const X509_Certificate& cert) const;
- private:
- std::string m_type;
- std::string m_name;
-
bool matches_dns(const std::string&) const;
bool matches_dn(const std::string&) const;
+ bool matches_dn_obj(const X509_DN& dn) const;
bool matches_ip(const std::string&) const;
+
+ private:
+ std::string m_type;
+ std::string m_name;
};
std::ostream& operator<<(std::ostream& os, const GeneralName& gn);
@@ -253,6 +259,9 @@ std::ostream& operator<<(std::ostream& os, const GeneralName& gn);
* The Name Constraint extension adds a minimum and maximum path
* length to a GeneralName to form a constraint. The length limits
* are currently unused.
+*
+* This entire class is deprecated and will be removed in a future
+* major release
*/
class BOTAN_PUBLIC_API(2,0) GeneralSubtree final : public ASN1_Object
{
@@ -260,6 +269,7 @@ class BOTAN_PUBLIC_API(2,0) GeneralSubtree final : public ASN1_Object
/**
* Creates an empty name constraint.
*/
+ BOTAN_DEPRECATED("Deprecated no replacement")
GeneralSubtree() : m_base(), m_minimum(0), m_maximum(std::numeric_limits<std::size_t>::max())
{}
@@ -269,6 +279,7 @@ class BOTAN_PUBLIC_API(2,0) GeneralSubtree final : public ASN1_Object
* @param min minimum path length
* @param max maximum path length
*/
+ BOTAN_DEPRECATED("Deprecated no replacement")
GeneralSubtree(const GeneralName& base, size_t min, size_t max)
: m_base(base), m_minimum(min), m_maximum(max)
{}
@@ -277,6 +288,7 @@ class BOTAN_PUBLIC_API(2,0) GeneralSubtree final : public ASN1_Object
* Creates a new name constraint for its string format.
* @param str name constraint
*/
+ BOTAN_DEPRECATED("Deprecated no replacement")
GeneralSubtree(const std::string& str);
void encode_into(DER_Encoder&) const override;
@@ -325,9 +337,7 @@ class BOTAN_PUBLIC_API(2,0) NameConstraints final
* @param excluded_subtrees names for which the certificate is not permitted
*/
NameConstraints(std::vector<GeneralSubtree>&& permitted_subtrees,
- std::vector<GeneralSubtree>&& excluded_subtrees)
- : m_permitted_subtrees(permitted_subtrees), m_excluded_subtrees(excluded_subtrees)
- {}
+ std::vector<GeneralSubtree>&& excluded_subtrees);
/**
* @return permitted names
@@ -339,9 +349,22 @@ class BOTAN_PUBLIC_API(2,0) NameConstraints final
*/
const std::vector<GeneralSubtree>& excluded() const { return m_excluded_subtrees; }
+ /**
+ * Return true if all of the names in the certificate are permitted
+ */
+ bool is_permitted(const X509_Certificate& cert, bool reject_unknown) const;
+
+ /**
+ * Return true if any of the names in the certificate are excluded
+ */
+ bool is_excluded(const X509_Certificate& cert, bool reject_unknown) const;
+
private:
std::vector<GeneralSubtree> m_permitted_subtrees;
std::vector<GeneralSubtree> m_excluded_subtrees;
+
+ std::set<std::string> m_permitted_name_types;
+ std::set<std::string> m_excluded_name_types;
};
/**
diff --git a/src/lib/x509/x509_ext.cpp b/src/lib/x509/x509_ext.cpp
index 83b80c1c69d..0b45e19839f 100644
--- a/src/lib/x509/x509_ext.cpp
+++ b/src/lib/x509/x509_ext.cpp
@@ -602,27 +602,27 @@ void Name_Constraints::decode_inner(const std::vector<uint8_t>& in)
{
std::vector<GeneralSubtree> permit, exclude;
BER_Decoder ber(in);
- BER_Decoder ext = ber.start_cons(SEQUENCE);
- BER_Object per = ext.get_next_object();
+ BER_Decoder inner = ber.start_cons(SEQUENCE);
+ BER_Object per = inner.get_next_object();
- ext.push_back(per);
+ inner.push_back(per);
if(per.is_a(0, ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC)))
{
- ext.decode_list(permit,ASN1_Tag(0),ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
+ inner.decode_list(permit,ASN1_Tag(0),ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
if(permit.empty())
throw Encoding_Error("Empty Name Contraint list");
}
- BER_Object exc = ext.get_next_object();
- ext.push_back(exc);
- if(per.is_a(1, ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC)))
+ BER_Object exc = inner.get_next_object();
+ inner.push_back(exc);
+ if(exc.is_a(1, ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC)))
{
- ext.decode_list(exclude,ASN1_Tag(1),ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
+ inner.decode_list(exclude,ASN1_Tag(1),ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
if(exclude.empty())
throw Encoding_Error("Empty Name Contraint list");
}
- ext.end_cons();
+ inner.end_cons();
if(permit.empty() && exclude.empty())
throw Encoding_Error("Empty Name Contraint extension");
@@ -651,11 +651,17 @@ void Name_Constraints::contents_to(Data_Store& subject, Data_Store&) const
}
}
-void Name_Constraints::validate(const X509_Certificate& subject, const X509_Certificate& issuer,
+void Name_Constraints::validate(const X509_Certificate& subject, const X509_Certificate& /*issuer*/,
const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
std::vector<std::set<Certificate_Status_Code>>& cert_status,
size_t pos)
{
+ // This is much smaller limit than in Botan3 because here name constraint checks
+ // are much more expensive due to optimizations which would be difficult to
+ // backport here.
+ const size_t MAX_NC_COMPARES = (1 << 12);
+ const size_t total_constraints = m_name_constraints.permitted().size() + m_name_constraints.excluded().size();
+
if(!m_name_constraints.permitted().empty() || !m_name_constraints.excluded().empty())
{
if(!subject.is_CA_cert())
@@ -664,54 +670,34 @@ void Name_Constraints::validate(const X509_Certificate& subject, const X509_Cert
}
const bool issuer_name_constraint_critical =
- issuer.is_critical("X509v3.NameConstraints");
+ subject.is_critical("X509v3.NameConstraints");
// Check that all subordinate certs pass the name constraint
for(size_t j = 0; j < pos; ++j)
{
- bool permitted = m_name_constraints.permitted().empty();
- bool failed = false;
+ const auto& cert = cert_path.at(j);
- for(auto c: m_name_constraints.permitted())
- {
- switch(c.base().matches(*cert_path.at(j)))
- {
- case GeneralName::MatchResult::NotFound:
- case GeneralName::MatchResult::All:
- permitted = true;
- break;
- case GeneralName::MatchResult::UnknownType:
- failed = issuer_name_constraint_critical;
- permitted = true;
- break;
- default:
- break;
- }
- }
+ const size_t total_names =
+ cert->subject_dn().dn_info().size() +
+ cert->subject_alt_name().get_attributes().size();
- for(auto c: m_name_constraints.excluded())
- {
- switch(c.base().matches(*cert_path.at(j)))
- {
- case GeneralName::MatchResult::All:
- case GeneralName::MatchResult::Some:
- failed = true;
- break;
- case GeneralName::MatchResult::UnknownType:
- failed = issuer_name_constraint_critical;
- break;
- default:
- break;
- }
- }
+ if(total_names * total_constraints >= MAX_NC_COMPARES) {
+ cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
+ continue;
+ }
- if(failed || !permitted)
- {
+ if(!m_name_constraints.is_permitted(*cert, issuer_name_constraint_critical)) {
cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
- }
+ continue;
+ }
+
+ if(m_name_constraints.is_excluded(*cert, issuer_name_constraint_critical)) {
+ cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
+ continue;
}
}
}
+}
namespace {
diff --git a/src/lib/x509/x509cert.cpp b/src/lib/x509/x509cert.cpp
index 55f279c58c1..fd1bb4c1d38 100644
--- a/src/lib/x509/x509cert.cpp
+++ b/src/lib/x509/x509cert.cpp
@@ -17,6 +17,7 @@
#include <botan/oids.h>
#include <botan/hash.h>
#include <botan/hex.h>
+#include <botan/internal/stl_util.h>
#include <algorithm>
#include <sstream>
@@ -788,16 +789,35 @@ bool X509_Certificate::matches_dns_name(const std::string& name) const
if(name.empty())
return false;
- std::vector<std::string> issued_names = subject_info("DNS");
+ bool is_ipv4 = false;
- // Fall back to CN only if no DNS names are set (RFC 6125 sec 6.4.4)
- if(issued_names.empty())
+ try {
+ string_to_ipv4(name);
+ is_ipv4 = true;
+ }
+ catch(...) {}
+
+ std::vector<std::string> issued_names;
+
+ if(subject_alt_name().has_items()) {
+ issued_names = subject_alt_name().get_attribute(is_ipv4 ? "IP" : "DNS");
+ } else if(is_ipv4 == false) {
+ // Use CN only if no SAN is included
issued_names = subject_info("Name");
+ }
for(size_t i = 0; i != issued_names.size(); ++i)
{
- if(host_wildcard_match(issued_names[i], name))
- return true;
+ if(is_ipv4)
+ {
+ if(issued_names[i] == name)
+ return true;
+ }
+ else
+ {
+ if(host_wildcard_match(issued_names[i], name))
+ return true;
+ }
}
return false;
diff --git a/src/python/botan2.py b/src/python/botan2.py
index 6ae1bd6da32..f4243037719 100755
--- a/src/python/botan2.py
+++ b/src/python/botan2.py
@@ -1285,6 +1285,7 @@ def _load_buf_or_file(filename, buf, file_fn, buf_fn):
#
class X509Cert(object): # pylint: disable=invalid-name
def __init__(self, filename=None, buf=None):
+ self.__obj = c_void_p(0)
self.__obj = _load_buf_or_file(filename, buf, _DLL.botan_x509_cert_load_file, _DLL.botan_x509_cert_load)
def __del__(self):
@@ -1464,6 +1465,7 @@ def is_revoked(self, crl):
#
class X509CRL(object):
def __init__(self, filename=None, buf=None):
+ self.__obj = c_void_p(0)
self.__obj = _load_buf_or_file(filename, buf, _DLL.botan_x509_crl_load_file, _DLL.botan_x509_crl_load)
def __del__(self):
diff --git a/src/scripts/test_python.py b/src/scripts/test_python.py
index 2202c0e4bcb..c45b9f1fc5f 100644
--- a/src/scripts/test_python.py
+++ b/src/scripts/test_python.py
@@ -474,9 +474,6 @@ def test_certs(self):
self.assertEqual(cert.issuer_dn('Organizational Unit', 0), 'bsi')
self.assertEqual(cert.issuer_dn('Country', 0), 'DE')
- self.assertTrue(cert.hostname_match('csca-germany'))
- self.assertFalse(cert.hostname_match('csca-slovakia'))
-
self.assertEqual(cert.not_before(), 1184858838)
self.assertEqual(cert.not_after(), 1831907880)
diff --git a/src/tests/test_name_constraint.cpp b/src/tests/test_name_constraint.cpp
index d99e967b251..7e086418382 100644
--- a/src/tests/test_name_constraint.cpp
+++ b/src/tests/test_name_constraint.cpp
@@ -29,17 +29,17 @@ class Name_Constraint_Tests final : public Test
std::make_tuple(
"Root_Email_Name_Constraint.crt",
"Invalid_Email_Name_Constraint.crt",
- "Invalid Email Name Constraint",
+ "",
"Certificate does not pass name constraint"),
std::make_tuple(
"Root_DN_Name_Constraint.crt",
"Invalid_DN_Name_Constraint.crt",
- "Invalid DN Name Constraint",
+ "",
"Certificate does not pass name constraint"),
std::make_tuple(
"Root_DN_Name_Constraint.crt",
"Valid_DN_Name_Constraint.crt",
- "Valid DN Name Constraint",
+ "",
"Verified"),
std::make_tuple(
"Root_DNS_Name_Constraint.crt",
@@ -49,12 +49,12 @@ class Name_Constraint_Tests final : public Test
std::make_tuple(
"Root_IP_Name_Constraint.crt",
"Valid_IP_Name_Constraint.crt",
- "Valid IP Name Constraint",
+ "",
"Verified"),
std::make_tuple(
"Root_IP_Name_Constraint.crt",
"Invalid_IP_Name_Constraint.crt",
- "Invalid IP Name Constraint",
+ "",
"Certificate does not pass name constraint"),
};
std::vector<Test::Result> results;
Reference in New Issue View Git Blame Copy Permalink