Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:Ledest:erlang:25
erlang
0522-public_key-Add-policy-checks.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0522-public_key-Add-policy-checks.patch of Package erlang
From 9d1dda7bad5a64b58c10a1554751689e94131a73 Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin <ingela@erlang.org> Date: Fri, 20 Jan 2023 13:47:39 +0100 Subject: [PATCH 2/2] public_key: Add policy checks --- lib/public_key/asn1/OTP-PKIX.asn1 | 16 + lib/public_key/doc/src/public_key.xml | 44 +- lib/public_key/doc/src/public_key_app.xml | 2 +- lib/public_key/include/public_key.hrl | 80 +- lib/public_key/src/Makefile | 1 + lib/public_key/src/pubkey_cert.erl | 1611 ++++++++++++------ lib/public_key/src/pubkey_policy_tree.erl | 420 +++++ lib/public_key/src/public_key.app.src | 27 +- lib/public_key/src/public_key.erl | 50 +- lib/public_key/test/pkits_SUITE.erl | 1895 +++++++++++++++++---- lib/public_key/test/pubkey_cert_SUITE.erl | 42 +- 11 files changed, 3251 insertions(+), 937 deletions(-) create mode 100644 lib/public_key/src/pubkey_policy_tree.erl diff --git a/lib/public_key/asn1/OTP-PKIX.asn1 b/lib/public_key/asn1/OTP-PKIX.asn1 index e1d8f2e121..8c15bdc7ea 100644 --- a/lib/public_key/asn1/OTP-PKIX.asn1 +++ b/lib/public_key/asn1/OTP-PKIX.asn1 @@ -834,4 +834,20 @@ invalidityDate EXTENSION-CLASS ::= { ID id-ce-invalidityDate TYPE InvalidityDate } +-- Used to workaround that some CAs create too long User Notices + +OTPUserNotice ::= SEQUENCE { + noticeRef OTPNoticeReference OPTIONAL, + explicitText OTPDisplayText OPTIONAL} + +OTPNoticeReference ::= SEQUENCE { + organization OTPDisplayText, + noticeNumbers SEQUENCE OF INTEGER } + +OTPDisplayText ::= CHOICE { + ia5String IA5String (SIZE (1..350)), + visibleString VisibleString (SIZE (1..350)), + bmpString BMPString (SIZE (1..350)), + utf8String UTF8String (SIZE (1..350)) } + END diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml index 501b7be954..c726b17595 100644 --- a/lib/public_key/doc/src/public_key.xml +++ b/lib/public_key/doc/src/public_key.xml @@ -44,7 +44,6 @@ <title>Common Records and ASN.1 Types</title> <note><p>All records used in this Reference Manual - <!-- except #policy_tree_node{} --> are generated from ASN.1 specifications and are documented in the User's Guide. See <seeguide marker="public_key_records">Public-key Records</seeguide>. @@ -215,6 +214,12 @@ </desc> </datatype> + <datatype> + <name name="policy_node"/> + <desc> + </desc> + </datatype> + <datatype> <name name="bad_cert_reason"/> <desc> @@ -534,12 +539,20 @@ <fsummary>Performs a basic path validation according to RFC 5280.</fsummary> <desc> <p> - Performs a basic path validation according to - <url href="http://www.ietf.org/rfc/rfc5280.txt">RFC 5280.</url> + Performs a basic path validation according to <url + href="http://www.ietf.org/rfc/rfc5280.txt">RFC 5280.</url> However, CRL validation is done separately by <seemfa - marker="#pkix_crls_validate/3">pkix_crls_validate/3 </seemfa> and is to be called - from the supplied <c>verify_fun</c>. The optional policy tree check is currently not implemented - but an empty place holder list is returned instead. + marker="#pkix_crls_validate/3">pkix_crls_validate/3 </seemfa> + and is to be called from the supplied <c>verify_fun</c>. The + policy tree check was added in OTP-26.2 and if the + certificates include policies the constrained policy set with + potential qualifiers will be returned, these values are + derived from the policy tree created as part of the path + validation algorithm. The constrained set can be constrained + only by the Certificate Authorities or also by the user when + the option <c>policy_set</c> is provided to this + function. The qualifiers convey information about the valid + policy and is intended as information to end users. </p> <p>Available options:</p> @@ -583,6 +596,25 @@ fun(OtpCert :: #'OTPCertificate'{}, be PEER, CA, ROOT-CA, if it is 2, the path can be PEER, CA, CA, ROOT-CA, and so on. </item> + + <tag since="OTP 26.2" >{policy_set, [oid()]}</tag> + <item> The set of policies that will be accepted, defaults to the special + value <c>[?anyPolicy]</c> that will accept all policies. + </item> + + <tag since="OTP 26.2">{explicit_policy, boolean()}</tag> + <item>Explicitly require that each certificate in the path must include + at least one of the certificate policies in the + <c>policy_set</c>. + </item> + <tag since="OTP 26.2">{inhibit_policy_mapping, boolean()}</tag> + <item>Prevent policies to be mapped to other policies. + </item> + <tag since="OTP 26.2">{inhibit_any_policy, boolean()}</tag> + <item>Prevent the special policy <c>?anyPolicy</c> from being + accepted. + </item> + </taglist> <p>Explanations of reasons for a bad certificate: </p> diff --git a/lib/public_key/doc/src/public_key_app.xml b/lib/public_key/doc/src/public_key_app.xml index 497c4fbd77..a866a8bfcb 100644 --- a/lib/public_key/doc/src/public_key_app.xml +++ b/lib/public_key/doc/src/public_key_app.xml @@ -41,7 +41,7 @@ <list type="bulleted"> <item>Supports <url href="http://www.ietf.org/rfc/rfc5280.txt">RFC 5280 </url> - Internet X.509 Public-Key Infrastructure Certificate and Certificate Revocation List - (CRL) Profile. Certificate policies are currently not supported. </item> + (CRL) Profile. Certificate policies supported since OTP-26.2 </item> <item>Supports <url href="http://www.ietf.org/rfc/rfc3447.txt"> PKCS-1 </url> - RSA Cryptography Standard </item> <item>Supports <url href="http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf"> DSS</url> - diff --git a/lib/public_key/include/public_key.hrl b/lib/public_key/include/public_key.hrl index 236cfa071b..1ebe541e3a 100644 --- a/lib/public_key/include/public_key.hrl +++ b/lib/public_key/include/public_key.hrl @@ -41,47 +41,51 @@ {valid, UserState} end, []}). --record(path_validation_state, { - valid_policy_tree, - explicit_policy, - inhibit_any_policy, - policy_mapping, - cert_num, - last_cert = false, - permitted_subtrees = no_constraints, %% Name constraints - excluded_subtrees = [], %% Name constraints - working_public_key_algorithm, - working_public_key, - working_public_key_parameters, - working_issuer_name, - max_path_length, - verify_fun, - user_state - }). +-record(path_validation_state, + { + valid_policy_tree, + user_initial_policy_set, + explicit_policy, + inhibit_any_policy, + inhibit_policy_mapping, + policy_mapping_ext, + policy_constraint_ext, + policy_inhibitany_ext, + policy_ext_present, + policy_ext_any, + current_any_policy_qualifiers, + cert_num, + last_cert = false, + permitted_subtrees = no_constraints, %% Name constraints + excluded_subtrees = [], %% Name constraints + working_public_key_algorithm, + working_public_key, + working_public_key_parameters, + working_issuer_name, + max_path_length, + verify_fun, + user_state + }). --record(policy_tree_node, { - valid_policy, - qualifier_set, - criticality_indicator, - expected_policy_set - }). +-record(revoke_state, + { + reasons_mask, + cert_status, + interim_reasons_mask, + valid_ext, + details + }). --record(revoke_state, { - reasons_mask, - cert_status, - interim_reasons_mask, - valid_ext, - details - }). +-record('ECPoint', + { + point + }). --record('ECPoint', { - point - }). - --record(cert, { - der :: public_key:der_encoded(), - otp :: #'OTPCertificate'{} - }). +-record(cert, + { + der :: public_key:der_encoded(), + otp :: #'OTPCertificate'{} + }). -define(unspecified, 0). -define(keyCompromise, 1). diff --git a/lib/public_key/src/Makefile b/lib/public_key/src/Makefile index 9b2b442794..a2444c64d8 100644 --- a/lib/public_key/src/Makefile +++ b/lib/public_key/src/Makefile @@ -45,6 +45,7 @@ MODULES = \ pubkey_ssh \ pubkey_pbe \ pubkey_cert \ + pubkey_policy_tree \ pubkey_cert_records \ pubkey_crl\ pubkey_ocsp \ diff --git a/lib/public_key/src/pubkey_cert.erl b/lib/public_key/src/pubkey_cert.erl index 85c4572952..879e4e7fd1 100644 --- a/lib/public_key/src/pubkey_cert.erl +++ b/lib/public_key/src/pubkey_cert.erl @@ -18,34 +18,38 @@ %% %CopyrightEnd% %% -%% - -module(pubkey_cert). -include("public_key.hrl"). --export([init_validation_state/3, - prepare_for_next_cert/2, - validate_time/3, - validate_signature/6, - validate_issuer/4, +%% path validation +-export([init_validation_state/3, + validate_extensions/4, + validate_time/3, + validate_issuer/4, validate_names/6, - validate_extensions/4, - normalize_general_name/1, + validate_signature/6, + verify_data/1, + verify_fun/4, + prepare_for_next_cert/2]). + +%% Utility functions +-export([normalize_general_name/1, is_self_signed/1, - is_issuer/2, + is_issuer/2, issuer_id/2, subject_id/1, - distribution_points/1, - is_fixed_dh_cert/1, - verify_data/1, - verify_fun/4, - select_extension/2, + distribution_points/1, + is_fixed_dh_cert/1, + select_extension/2, match_name/3, - extensions_list/1, - cert_auth_key_id/1, - time_str_2_gregorian_sec/1, - gen_test_certs/1, + extensions_list/1, + cert_auth_key_id/1, + time_str_2_gregorian_sec/1 + ]). + +%% Generate test data +-export([gen_test_certs/1, x509_pkix_sign_types/1, root_cert/2]). @@ -55,18 +59,9 @@ %% Internal application APIs %%==================================================================== -%%-------------------------------------------------------------------- --spec verify_data(DER::binary()) -> - {DigestType, PlainText, Signature} - when DigestType :: md5 | crypto:sha1() | crypto:sha2() | none, - PlainText :: binary(), - Signature :: binary(). -%% -%% Description: Extracts data from DerCert needed to call public_key:verify/4. -%%-------------------------------------------------------------------- -verify_data(DerCert) -> - {ok, OtpCert} = pubkey_cert_records:decode_cert(DerCert), - extract_verify_data(OtpCert, DerCert). +%%==================================================================== +%% Path validation +%%==================================================================== %%-------------------------------------------------------------------- -spec init_validation_state(#'OTPCertificate'{}, integer(), list()) -> @@ -74,74 +69,87 @@ verify_data(DerCert) -> %% %% Description: Creates initial version of path_validation_state for %% basic path validation of x509 certificates. -%%-------------------------------------------------------------------- -init_validation_state(#'OTPCertificate'{} = OtpCert, DefaultPathLen, +%%-------------------------------------------------------------------- +init_validation_state(#'OTPCertificate'{} = OtpCert, DefaultPathLen, Options) -> - PolicyTree = #policy_tree_node{valid_policy = ?anyPolicy, - qualifier_set = [], - criticality_indicator = false, - expected_policy_set = [?anyPolicy]}, + PolicyTree = pubkey_policy_tree:root(), MaxLen = proplists:get_value(max_path_length, Options, DefaultPathLen), - ExplicitPolicy = policy_indicator(MaxLen, - proplists:get_value(explicit_policy, Options, false)), - InhibitAnyPolicy = policy_indicator(MaxLen, - proplists:get_value(inhibit_any_policy, - Options, false)), - PolicyMapping = policy_indicator(MaxLen, - proplists:get_value(policy_mapping, Options, false)), - {VerifyFun, UserState} = proplists:get_value(verify_fun, Options, ?DEFAULT_VERIFYFUN), - State = #path_validation_state{max_path_length = MaxLen, - valid_policy_tree = PolicyTree, - explicit_policy = ExplicitPolicy, - inhibit_any_policy = InhibitAnyPolicy, - policy_mapping = PolicyMapping, - verify_fun = VerifyFun, - user_state = UserState, - cert_num = 0}, + UserPolicySet = policy_set(Options, [?anyPolicy]), + ExplicitPolicyConstraint = + policy_indicator(MaxLen, + proplists:get_value(explicit_policy, Options, false)), + AnyPolicyConstraint = + policy_indicator(MaxLen, + proplists:get_value(inhibit_any_policy, Options, false)), + PolicyMappingConstraint = + policy_indicator(MaxLen, + proplists:get_value(inhibit_policy_mapping, Options, false)), + {VerifyFun, UserState} = proplists:get_value(verify_fun, Options, + ?DEFAULT_VERIFYFUN), + State = #path_validation_state{max_path_length = MaxLen, + user_initial_policy_set = UserPolicySet, + valid_policy_tree = PolicyTree, + explicit_policy = ExplicitPolicyConstraint, + inhibit_any_policy = AnyPolicyConstraint, + inhibit_policy_mapping = PolicyMappingConstraint, + verify_fun = VerifyFun, + user_state = UserState, + cert_num = 0}, prepare_for_next_cert(OtpCert, State). %%-------------------------------------------------------------------- --spec prepare_for_next_cert(#'OTPCertificate'{}, #path_validation_state{}) -> - #path_validation_state{}. +-spec validate_extensions(#'OTPCertificate'{}, #path_validation_state{}, + term(), fun())-> + {#path_validation_state{}, UserState :: term()}. %% -%% Description: Update path_validation_state for next iteration. -%%-------------------------------------------------------------------- -prepare_for_next_cert(OtpCert, ValidationState = #path_validation_state{ - working_public_key_algorithm = PrevAlgo, - working_public_key_parameters = - PrevParams}) -> - TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, - Issuer = TBSCert#'OTPTBSCertificate'.subject, - - {Algorithm, PublicKey, PublicKeyParams0} = - public_key_info(TBSCert#'OTPTBSCertificate'.subjectPublicKeyInfo, - ValidationState), - PublicKeyParams = - case PublicKeyParams0 of - 'NULL' when Algorithm =:= PrevAlgo -> - PrevParams; - asn1_NOVALUE when Algorithm =:= PrevAlgo -> - PrevParams; - _ -> PublicKeyParams0 - end, - - ValidationState#path_validation_state{ - working_public_key_algorithm = Algorithm, - working_public_key = PublicKey, - working_public_key_parameters = PublicKeyParams, - working_issuer_name = Issuer, - cert_num = ValidationState#path_validation_state.cert_num + 1 - }. - - %%-------------------------------------------------------------------- --spec validate_time(#'OTPCertificate'{}, term(), fun()) -> term() | no_return(). +%% Description: Check extensions included in basic path validation. +%%-------------------------------------------------------------------- +validate_extensions(OtpCert, ValidationState0, UserState0, VerifyFun) -> + TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, + case TBSCert#'OTPTBSCertificate'.version of + N when N >= 3 -> + Extensions = TBSCert#'OTPTBSCertificate'.extensions, + validate_extensions(OtpCert, Extensions, + ValidationState0, no_basic_constraint, + is_self_signed(OtpCert), UserState0, VerifyFun); + _ -> %% Extensions not present in versions 1 & 2 + {ValidationState0, UserState0} + end. +%%-------------------------------------------------------------------- +-spec validate_policy_tree(#'OTPCertificate'{}, #path_validation_state{})-> + #path_validation_state{} | no_return(). +%% +%% Description: Check policy tree requirements after handling of certificate extensions +%%-------------------------------------------------------------------- +validate_policy_tree(OtpCert, + #path_validation_state{explicit_policy = ExplicitPolicyConstraint, + valid_policy_tree = Tree, + user_state = UserState0, + verify_fun = VerifyFun} = + ValidationState) -> + case (ExplicitPolicyConstraint > 0) orelse not pubkey_policy_tree:is_empty(Tree) of + true -> + ValidationState; + false -> + UserState = + verify_fun(OtpCert, {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, ExplicitPolicyConstraint}, + {policy_set, + pubkey_policy_tree:constrained_policy_node_set(Tree)}}}}, + UserState0, VerifyFun), + ValidationState#path_validation_state{user_state = UserState} + end. + +%%-------------------------------------------------------------------- +-spec validate_time(#'OTPCertificate'{}, term(), fun()) -> term(). %% -%% Description: Check that the certificate validity period includes the +%% Description: Check that the certificate validity period includes the %% current time. -%%-------------------------------------------------------------------- +%%-------------------------------------------------------------------- validate_time(OtpCert, UserState, VerifyFun) -> TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, - {'Validity', NotBeforeStr, NotAfterStr} + {'Validity', NotBeforeStr, NotAfterStr} = TBSCert#'OTPTBSCertificate'.validity, Now = calendar:datetime_to_gregorian_seconds(calendar:universal_time()), NotBefore = time_str_2_gregorian_sec(notBefore, NotBeforeStr), @@ -158,7 +166,7 @@ validate_time(OtpCert, UserState, VerifyFun) -> %% %% Description: Check that the certificate issuer name is the working_issuer_name %% in path_validation_state. -%%-------------------------------------------------------------------- +%%-------------------------------------------------------------------- validate_issuer(OtpCert, Issuer, UserState, VerifyFun) -> TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, case is_issuer(Issuer, TBSCert#'OTPTBSCertificate'.issuer) of @@ -166,54 +174,36 @@ validate_issuer(OtpCert, Issuer, UserState, VerifyFun) -> UserState; _ -> verify_fun(OtpCert, {bad_cert, invalid_issuer}, UserState, VerifyFun) - end. -%%-------------------------------------------------------------------- --spec validate_signature(#'OTPCertificate'{}, DER::binary(), - term(),term(), term(), fun()) -> term() | no_return(). - -%% -%% Description: Check that the signature on the certificate can be verified using -%% working_public_key_algorithm, the working_public_key, and -%% the working_public_key_parameters in path_validation_state. -%%-------------------------------------------------------------------- -validate_signature(OtpCert, DerCert, Key, KeyParams, - UserState, VerifyFun) -> - - case verify_signature(OtpCert, DerCert, Key, KeyParams) of - true -> - UserState; - false -> - verify_fun(OtpCert, {bad_cert, invalid_signature}, UserState, VerifyFun) end. %%-------------------------------------------------------------------- -spec validate_names(#'OTPCertificate'{}, no_constraints | list(), list(), term(), term(), fun())-> term() | no_return(). %% %% Description: Validate Subject Alternative Name. -%%-------------------------------------------------------------------- +%%-------------------------------------------------------------------- validate_names(OtpCert, Permit, Exclude, Last, UserState, VerifyFun) -> case is_self_signed(OtpCert) andalso (not Last) of - true -> + true -> UserState; false -> - TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, + TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, Subject = TBSCert#'OTPTBSCertificate'.subject, - Extensions = + Extensions = extensions_list(TBSCert#'OTPTBSCertificate'.extensions), - AltSubject = + AltSubject = select_extension(?'id-ce-subjectAltName', Extensions), - + EmailAddress = extract_email(Subject), Name = [{directoryName, Subject}|EmailAddress], - + AltNames = case AltSubject of - undefined -> + undefined -> []; - _ -> + _ -> AltSubject#'Extension'.extnValue end, - - case (is_permitted(Name, Permit) andalso + + case (is_permitted(Name, Permit) andalso is_permitted(AltNames, Permit) andalso (not is_excluded(Name, Exclude)) andalso (not is_excluded(AltNames, Exclude))) of @@ -226,30 +216,146 @@ validate_names(OtpCert, Permit, Exclude, Last, UserState, VerifyFun) -> end. %%-------------------------------------------------------------------- --spec validate_extensions(#'OTPCertificate'{}, #path_validation_state{}, - term(), fun())-> - {#path_validation_state{}, UserState :: term()}. +-spec validate_signature(#'OTPCertificate'{}, DER::binary(), + term(),term(), term(), fun()) -> term() | no_return(). + %% -%% Description: Check extensions included in basic path validation. -%%-------------------------------------------------------------------- -validate_extensions(OtpCert, ValidationState, UserState, VerifyFun) -> - TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, - case TBSCert#'OTPTBSCertificate'.version of - N when N >= 3 -> - Extensions = TBSCert#'OTPTBSCertificate'.extensions, - validate_extensions(OtpCert, Extensions, - ValidationState, no_basic_constraint, - is_self_signed(OtpCert), UserState, VerifyFun); - _ -> %% Extensions not present in versions 1 & 2 - {ValidationState, UserState} +%% Description: Check that the signature on the certificate can be verified using +%% working_public_key_algorithm, the working_public_key, and +%% the working_public_key_parameters in path_validation_state. +%%-------------------------------------------------------------------- +validate_signature(OtpCert, DerCert, Key, KeyParams, + UserState, VerifyFun) -> + + case verify_signature(OtpCert, DerCert, Key, KeyParams) of + true -> + UserState; + false -> + verify_fun(OtpCert, {bad_cert, invalid_signature}, UserState, VerifyFun) + end. + +%%-------------------------------------------------------------------- +-spec verify_data(DER::binary()) -> + {DigestType, PlainText, Signature} + when DigestType :: md5 | crypto:sha1() | crypto:sha2() | none, + PlainText :: binary(), + Signature :: binary(). +%% +%% Description: Extracts data from DerCert needed to call public_key:verify/4. +%%-------------------------------------------------------------------- +verify_data(DerCert) -> + {ok, OtpCert} = pubkey_cert_records:decode_cert(DerCert), + extract_verify_data(OtpCert, DerCert). + +%%-------------------------------------------------------------------- +-spec verify_fun(#'OTPCertificate'{}, {bad_cert, public_key:bad_cert_reason()} | + {extension, #'Extension'{}}| + valid | valid_peer, term(), fun()) -> term() | no_return(). +%% +%% Description: Gives the user application the opportunity handle path +%% validation errors and unknown extensions and optional do other +%% things with a validated certificate. +%% -------------------------------------------------------------------- +verify_fun(Otpcert, Result, UserState0, VerifyFun) -> + case VerifyFun(Otpcert, Result, UserState0) of + {valid, UserState} -> + UserState; + {valid_peer, UserState} -> + UserState; + {fail, Reason} -> + case Reason of + {bad_cert, _} -> + throw(Reason); + _ -> + throw({bad_cert, Reason}) + end; + {unknown, UserState} -> + case Result of + {extension, #'Extension'{critical = true}} -> + throw({bad_cert, unknown_critical_extension}); + _ -> + UserState + end end. + +%%-------------------------------------------------------------------- +-spec prepare_for_next_cert(#'OTPCertificate'{}, #path_validation_state{}) -> + #path_validation_state{} | no_return(). +%% +%% Description: Update path_validation_state for next iteration. +%%-------------------------------------------------------------------- +prepare_for_next_cert(OtpCert, #path_validation_state{policy_mapping_ext = Ext} = + ValidationState0) when Ext =/= undefined -> + ValidationState1 = handle_policy_mappings(OtpCert, ValidationState0), + ValidationState = + ValidationState1#path_validation_state{policy_mapping_ext = + undefined, + current_any_policy_qualifiers = + undefined}, + prepare_for_next_cert(OtpCert, ValidationState); +prepare_for_next_cert(OtpCert, #path_validation_state{ + working_public_key_algorithm = PrevAlgo, + working_public_key_parameters = + PrevParams, + cert_num = CertNum, + explicit_policy = ExplicitPolicyConstraint, + inhibit_policy_mapping = PolicyMappingConstraint, + inhibit_any_policy = AnyPolicyConstraint + } = ValidationState0) -> + TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, + Issuer = TBSCert#'OTPTBSCertificate'.subject, + + {Algorithm, PublicKey, PublicKeyParams0} = + public_key_info(TBSCert#'OTPTBSCertificate'.subjectPublicKeyInfo, + ValidationState0), + PublicKeyParams = + case PublicKeyParams0 of + 'NULL' when Algorithm =:= PrevAlgo -> + PrevParams; + asn1_NOVALUE when Algorithm =:= PrevAlgo -> + PrevParams; + _ -> PublicKeyParams0 + end, + + IsSelfSigned = is_self_signed(OtpCert), + ValidationState1 = + ValidationState0#path_validation_state{ + working_public_key_algorithm = Algorithm, + working_public_key = PublicKey, + working_public_key_parameters = PublicKeyParams, + working_issuer_name = Issuer, + cert_num = CertNum + 1, + policy_ext_present = false, + valid_policy_tree = + assert_valid_policy_tree(ValidationState0#path_validation_state.explicit_policy, + ValidationState0#path_validation_state.policy_ext_present, + ValidationState0#path_validation_state.valid_policy_tree), + current_any_policy_qualifiers = undefined, + policy_ext_any = undefined, + + %% 6.1.4 h from RFC + %% Step 1 or 6.1.5 a (if last cert) from RFC + explicit_policy = maybe_decrement(ExplicitPolicyConstraint, IsSelfSigned), + % Step 2 from RFC + inhibit_policy_mapping = maybe_decrement(PolicyMappingConstraint, IsSelfSigned), + % Step 3 from RFC + inhibit_any_policy = maybe_decrement(AnyPolicyConstraint, IsSelfSigned) + }, + ValidationState2 = handle_policy_constraints(ValidationState1), + ValidationState = handle_inhibit_anypolicy(ValidationState2), + handle_last_cert(OtpCert, ValidationState). + +%%==================================================================== +%% Utility functions +%%==================================================================== + %%-------------------------------------------------------------------- --spec normalize_general_name({rdnSequence, term()}| binary()) -> {rdnSequence, term()}. +-spec normalize_general_name({rdnSequence, term()}| binary()) -> {rdnSequence, term()}. %% %% Description: Normalizes a general name so that it can be easily -%% compared to another general name. -%%-------------------------------------------------------------------- -normalize_general_name({rdnSequence, Issuer}) -> +%% compared to another general name. +%%-------------------------------------------------------------------- +normalize_general_name({rdnSequence, Issuer}) -> NormIssuer = do_normalize_general_name(Issuer), {rdnSequence, NormIssuer}. @@ -257,26 +363,26 @@ normalize_general_name({rdnSequence, Issuer}) -> -spec is_self_signed(#'OTPCertificate'{}) -> boolean(). %% %% Description: Checks if the certificate is self signed. -%%-------------------------------------------------------------------- +%%-------------------------------------------------------------------- is_self_signed(#'OTPCertificate'{tbsCertificate= - #'OTPTBSCertificate'{issuer = Issuer, + #'OTPTBSCertificate'{issuer = Issuer, subject = Subject}}) -> is_issuer(Issuer, Subject). %%-------------------------------------------------------------------- --spec is_issuer({rdnSequence, term()}, {rdnSequence, term()}) -> boolean(). +-spec is_issuer({rdnSequence, term()}, {rdnSequence, term()}) -> boolean(). %% %% Description: Checks if <Issuer> issued <Candidate>. -%%-------------------------------------------------------------------- +%%-------------------------------------------------------------------- is_issuer({rdnSequence, _} = Issuer, {rdnSequence, _} = Candidate) -> {rdnSequence, IssuerDirName} = normalize_general_name(Issuer), {rdnSequence, CandidateDirName} = normalize_general_name(Candidate), is_dir_name(IssuerDirName, CandidateDirName, true). %%-------------------------------------------------------------------- --spec issuer_id(#'OTPCertificate'{}, self | other) -> +-spec issuer_id(#'OTPCertificate'{}, self | other) -> {ok, {integer(), term()}} | {error, issuer_not_found}. %% %% Description: Extracts the issuer id from a certificate if possible. -%%-------------------------------------------------------------------- +%%-------------------------------------------------------------------- issuer_id(Otpcert, other) -> TBSCert = Otpcert#'OTPCertificate'.tbsCertificate, Extensions = extensions_list(TBSCert#'OTPTBSCertificate'.extensions), @@ -286,25 +392,25 @@ issuer_id(Otpcert, other) -> AuthKeyExt -> cert_auth_key_id(AuthKeyExt#'Extension'.extnValue) end; - + issuer_id(Otpcert, self) -> - TBSCert = Otpcert#'OTPCertificate'.tbsCertificate, + TBSCert = Otpcert#'OTPCertificate'.tbsCertificate, Issuer = TBSCert#'OTPTBSCertificate'.issuer, SerialNr = TBSCert#'OTPTBSCertificate'.serialNumber, - {ok, {SerialNr, normalize_general_name(Issuer)}}. + {ok, {SerialNr, normalize_general_name(Issuer)}}. %%-------------------------------------------------------------------- --spec subject_id(#'OTPCertificate'{}) -> +-spec subject_id(#'OTPCertificate'{}) -> {integer(), term()}. %% %% Description: Extracts the subject and serial number from a certificate. %%-------------------------------------------------------------------- subject_id(Otpcert) -> - TBSCert = Otpcert#'OTPCertificate'.tbsCertificate, + TBSCert = Otpcert#'OTPCertificate'.tbsCertificate, Subject = TBSCert#'OTPTBSCertificate'.subject, SerialNr = TBSCert#'OTPTBSCertificate'.serialNumber, - {SerialNr, normalize_general_name(Subject)}. + {SerialNr, normalize_general_name(Subject)}. distribution_points(Otpcert) -> @@ -318,48 +424,18 @@ distribution_points(Otpcert) -> end. %%-------------------------------------------------------------------- --spec is_fixed_dh_cert(#'OTPCertificate'{}) -> boolean(). +-spec is_fixed_dh_cert(#'OTPCertificate'{}) -> boolean(). %% %% Description: Checks if the certificate can be be used %% for DH key agreement. -%%-------------------------------------------------------------------- +%%-------------------------------------------------------------------- is_fixed_dh_cert(#'OTPCertificate'{tbsCertificate = - #'OTPTBSCertificate'{subjectPublicKeyInfo = + #'OTPTBSCertificate'{subjectPublicKeyInfo = SubjectPublicKeyInfo, - extensions = + extensions = Extensions}}) -> - is_fixed_dh_cert(SubjectPublicKeyInfo, extensions_list(Extensions)). + is_fixed_dh_cert(SubjectPublicKeyInfo, extensions_list(Extensions)). - -%%-------------------------------------------------------------------- --spec verify_fun(#'OTPCertificate'{}, {bad_cert, atom()} | {extension, #'Extension'{}}| - valid | valid_peer, term(), fun()) -> term() | no_return(). -%% -%% Description: Gives the user application the opportunity handle path -%% validation errors and unknown extensions and optional do other -%% things with a validated certificate. -%% -------------------------------------------------------------------- -verify_fun(Otpcert, Result, UserState0, VerifyFun) -> - case VerifyFun(Otpcert, Result, UserState0) of - {valid, UserState} -> - UserState; - {valid_peer, UserState} -> - UserState; - {fail, Reason} -> - case Reason of - {bad_cert, _} -> - throw(Reason); - _ -> - throw({bad_cert, Reason}) - end; - {unknown, UserState} -> - case Result of - {extension, #'Extension'{critical = true}} -> - throw({bad_cert, unknown_critical_extension}); - _ -> - UserState - end - end. %%-------------------------------------------------------------------- -spec select_extension(Oid ::tuple(),[#'Extension'{}]) -> #'Extension'{} | undefined. @@ -379,9 +455,12 @@ select_extension(Id, [_ | Extensions]) -> select_extension(Id, Extensions). %%-------------------------------------------------------------------- -%% TODO: +-spec match_name(Type:: rfc822Name | directoryName | uniformResourceIdentifier | + emailAddress | dNSName | x400Address | ipAdress, + Name::term(), Names::[term()]) -> boolean(). %% -%% Description: +%% Description: Does <Name> match any of name in Names according to +%% the match rules for the Type. %%-------------------------------------------------------------------- match_name(rfc822Name, Name, [PermittedName | Rest]) -> match_name(fun is_valid_host_or_domain/2, Name, PermittedName, Rest); @@ -443,25 +522,19 @@ match_name(ipAdress, IP, [PermittedIP | Rest]) -> end, match_name(Fun, IP, PermittedIP, Rest). -match_name(Fun, Name, PermittedName, []) -> - Fun(Name, PermittedName); -match_name(Fun, Name, PermittedName, [Head | Tail]) -> - case Fun(Name, PermittedName) of - true -> - true; - false -> - match_name(Fun, Name, Head, Tail) - end. +%%==================================================================== +%% Generate test data +%%==================================================================== -%%% +%%-------------------------------------------------------------------- -spec gen_test_certs(#{server_chain:= public_key:chain_opts(), client_chain:= public_key:chain_opts()} | public_key:chain_opts()) -> public_key:test_config() | [public_key:conf_opt()]. -%% -%% Generates server and and client configuration for testing +%% Description: Generates server and and client configuration for testing %% purposes. All certificate options have default values +%%-------------------------------------------------------------------- gen_test_certs( #{client_chain := #{root := ClientRoot, @@ -521,9 +594,17 @@ gen_test_certs( DERCAs = ca_config(RootCert, CAsKeys), [{cert, DERCert}, {key, DERKey}, {cacerts, DERCAs}]. - -x509_pkix_sign_types(#'SignatureAlgorithm'{algorithm = ?'id-RSASSA-PSS', - parameters = #'RSASSA-PSS-params'{saltLength = SaltLen, hashAlgorithm = #'HashAlgorithm'{algorithm = Alg}}}) -> +%%%%-------------------------------------------------------------------- +-spec x509_pkix_sign_types(#'SignatureAlgorithm'{}) -> {Hash::atom(), Sign::atom(), + Options::list()}. +%% +%% Description: Extract signature algorithm options. +%%%%-------------------------------------------------------------------- +x509_pkix_sign_types( + #'SignatureAlgorithm'{algorithm = ?'id-RSASSA-PSS', + parameters = #'RSASSA-PSS-params'{ + saltLength = SaltLen, + hashAlgorithm = #'HashAlgorithm'{algorithm = Alg}}}) -> Hash = public_key:pkix_hash_type(Alg), {Hash, rsa_pss_pss, [{rsa_padding, rsa_pkcs1_pss_padding}, {rsa_pss_saltlen, SaltLen}, @@ -532,17 +613,18 @@ x509_pkix_sign_types(#'SignatureAlgorithm'{algorithm = Alg}) -> {Hash, Sign} = public_key:pkix_sign_types(Alg), {Hash, Sign, []}. -%%% +%%%%-------------------------------------------------------------------- -spec root_cert(string(), [public_key:cert_opt()]) -> public_key:test_root_cert(). %% -%% Generate a self-signed root cert +%% Description: Generate a self-signed root cert +%%%%-------------------------------------------------------------------- root_cert(Name, Opts) -> PrivKey = gen_key(proplists:get_value(key, Opts, default_key_gen())), TBS = cert_template(), Issuer = subject("root", Name), SignatureId = sign_algorithm(PrivKey, Opts), SPI = public_key(PrivKey, SignatureId), - + OTPTBS = TBS#'OTPTBSCertificate'{ signature = SignatureId, @@ -558,82 +640,621 @@ root_cert(Name, Opts) -> %%-------------------------------------------------------------------- %%% Internal functions %%-------------------------------------------------------------------- -do_normalize_general_name(Issuer) -> - Normalize = fun([{Description, Type, {printableString, Value}}]) -> - NewValue = string:casefold(strip_spaces(Value, false)), - [{Description, Type, {printableString, NewValue}}]; - (Atter) -> - Atter + +%% No extensions present +validate_extensions(OtpCert, asn1_NOVALUE, ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun) -> + validate_extensions(OtpCert, [], ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun); + +validate_extensions(_,[], ValidationState, basic_constraint, _SelfSigned, + UserState, _) -> + {ValidationState, UserState}; +validate_extensions(OtpCert, [], ValidationState = + #path_validation_state{max_path_length = Len, + last_cert = Last}, + no_basic_constraint, SelfSigned, UserState0, VerifyFun) -> + case Last of + true when SelfSigned -> + {ValidationState, UserState0}; + true -> + {ValidationState#path_validation_state{max_path_length = Len - 1}, + UserState0}; + false -> + %% basic_constraint must appear in certs used for digital sign + %% see 4.2.1.10 in rfc 3280 + case is_digitally_sign_cert(OtpCert) of + true -> + missing_basic_constraints(OtpCert, SelfSigned, + ValidationState, VerifyFun, + UserState0, Len); + false -> %% Example CRL signer only + {ValidationState, UserState0} + end + end; + +validate_extensions(OtpCert, + [#'Extension'{extnID = ?'id-ce-basicConstraints', + extnValue = + #'BasicConstraints'{cA = true, + pathLenConstraint = N}} | + Rest], + ValidationState = + #path_validation_state{max_path_length = Len}, _, + SelfSigned, UserState, VerifyFun) -> + Length = if SelfSigned -> erlang:min(N, Len); + true -> erlang:min(N, Len-1) + end, + validate_extensions(OtpCert, Rest, + ValidationState#path_validation_state{max_path_length = + Length}, + basic_constraint, SelfSigned, + UserState, VerifyFun); +%% The pathLenConstraint field is meaningful only if cA is set to +%% TRUE. +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-basicConstraints', + extnValue = + #'BasicConstraints'{cA = false}} | + Rest], ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun) -> + validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun); + +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-keyUsage', + extnValue = KeyUse + } | Rest], + #path_validation_state{last_cert=Last} = ValidationState, + ExistBasicCon, SelfSigned, + UserState0, VerifyFun) -> + case Last orelse is_valid_key_usage(KeyUse, keyCertSign) of + true -> + validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, + SelfSigned, UserState0, VerifyFun); + false -> + UserState = verify_fun(OtpCert, {bad_cert, invalid_key_usage}, + UserState0, VerifyFun), + validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun) + end; + +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-subjectAltName', + extnValue = Names, + critical = true} = Ext | Rest], + ValidationState, ExistBasicCon, + SelfSigned, UserState0, VerifyFun) -> + case validate_subject_alt_names(Names) of + true -> + validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, + SelfSigned, UserState0, VerifyFun); + false -> + UserState = verify_fun(OtpCert, {extension, Ext}, + UserState0, VerifyFun), + validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun) + end; + +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-nameConstraints', + extnValue = NameConst} | Rest], + ValidationState, + ExistBasicCon, SelfSigned, UserState, VerifyFun) -> + Permitted = NameConst#'NameConstraints'.permittedSubtrees, + Excluded = NameConst#'NameConstraints'.excludedSubtrees, + + NewValidationState = add_name_constraints(Permitted, Excluded, + ValidationState), + + validate_extensions(OtpCert, Rest, NewValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun); +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-certificatePolicies', + extnValue = Info} + | Rest], + ValidationState, + ExistBasicCon, SelfSigned, UserState, VerifyFun) -> + Tree = process_policy_tree(Info, SelfSigned, ValidationState), + validate_extensions(OtpCert, Rest, + ValidationState#path_validation_state{ + policy_ext_present = true, + current_any_policy_qualifiers = + current_any_policy_qualifiers(Info), + valid_policy_tree = Tree}, + ExistBasicCon, SelfSigned, UserState, VerifyFun); +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-policyConstraints'} = Ext + | Rest], ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun) -> + NewValidationState = ValidationState#path_validation_state{policy_constraint_ext = Ext}, + validate_extensions(OtpCert, Rest, NewValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun); +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-policyMappings'} = Ext + | Rest], ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun) -> + NewValidationState = ValidationState#path_validation_state{policy_mapping_ext = Ext}, + validate_extensions(OtpCert, Rest, NewValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun); +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-inhibitAnyPolicy'} = Ext + | Rest], ValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun) -> + NewValidationState = ValidationState#path_validation_state{policy_inhibitany_ext = Ext}, + validate_extensions(OtpCert, Rest, NewValidationState, ExistBasicCon, + SelfSigned, UserState, VerifyFun); +validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-extKeyUsage', + critical = true, + extnValue = KeyUse} = Extension | Rest], + #path_validation_state{last_cert = false} = ValidationState, ExistBasicCon, + SelfSigned, UserState0, VerifyFun) -> + UserState = + case ext_keyusage_includes_any(KeyUse) of + true -> %% CA cert that specifies ?anyExtendedKeyUsage should not be marked critical + verify_fun(OtpCert, {bad_cert, invalid_ext_key_usage}, UserState0, VerifyFun); + false -> + verify_fun(OtpCert, {extension, Extension}, UserState0, VerifyFun) end, - lists:map(Normalize, Issuer). + validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, SelfSigned, + UserState, VerifyFun); +validate_extensions(OtpCert, [#'Extension'{} = Extension | Rest], + ValidationState, ExistBasicCon, + SelfSigned, UserState0, VerifyFun) -> + UserState = verify_fun(OtpCert, {extension, Extension}, UserState0, VerifyFun), + validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, SelfSigned, + UserState, VerifyFun). -%% See rfc3280 4.1.2.6 Subject: regarding emails. -extract_email({rdnSequence, List}) -> - extract_email2(List). -extract_email2([[#'AttributeTypeAndValue'{type=?'id-emailAddress', - value=Mail}]|_]) -> - [{rfc822Name, Mail}]; -extract_email2([_|Rest]) -> - extract_email2(Rest); -extract_email2([]) -> []. +handle_last_cert(OtpCert, #path_validation_state{last_cert = true, + user_initial_policy_set = PolicySet, + valid_policy_tree = Tree} = ValidationState0) -> + TBSCert = OtpCert#'OTPCertificate'.tbsCertificate, + Extensions = + extensions_list(TBSCert#'OTPTBSCertificate'.extensions), + %% 6.1.5 b + ValidationState = + case select_extension(?'id-ce-policyConstraints', Extensions) of + undefined -> + ValidationState0; + #'Extension'{extnValue = #'PolicyConstraints'{requireExplicitPolicy = 0}} -> + ValidationState0#path_validation_state{explicit_policy = 0}; + _ -> + ValidationState0 + end, + ValidTree = policy_tree_intersection(PolicySet, Tree), + validate_policy_tree(OtpCert, + ValidationState#path_validation_state{valid_policy_tree = ValidTree}); +handle_last_cert(_, ValidationState) -> + ValidationState. -extensions_list(asn1_NOVALUE) -> - []; -extensions_list(Extensions) -> - Extensions. -extract_verify_data(OtpCert, DerCert) -> - Signature = OtpCert#'OTPCertificate'.signature, - SigAlg = OtpCert#'OTPCertificate'.signatureAlgorithm, - PlainText = encoded_tbs_cert(DerCert), - {DigestType,_,_} = x509_pkix_sign_types(SigAlg), - {DigestType, PlainText, Signature}. +%%==================================================================== +%% Policy handling +%%==================================================================== +%% Start initialization RFC 5280 Section 6.1.2 ---------------------- -verify_signature(OtpCert, DerCert, Key, KeyParams) -> - {DigestType, PlainText, Signature} = extract_verify_data(OtpCert, DerCert), - case Key of - #'RSAPublicKey'{} -> - case KeyParams of - #'RSASSA-PSS-params'{} -> - public_key:verify(PlainText, DigestType, Signature, Key, verify_options(KeyParams)); - 'NULL' -> - public_key:verify(PlainText, DigestType, Signature, Key) - end; - _ -> - public_key:verify(PlainText, DigestType, Signature, {Key, KeyParams}) +%% 6.1.2 d, e, f: If <indicator> is set, then the initial value +%% is 0, otherwise the initial value is n+1. (N = max path length) +policy_indicator(_, true) -> + 0; +policy_indicator(N, false) -> + N + 1. + +policy_set(Opts, Default) -> + case proplists:get_value(policy_set, Opts, undefined) of + undefined -> + Default; + Set -> + [oidify(OidStr) || OidStr <- Set] end. -encoded_tbs_cert(Cert) -> - {ok, PKIXCert} = - 'OTP-PUB-KEY':decode_TBSCert_exclusive(Cert), - {'Certificate', - {'Certificate_tbsCertificate', EncodedTBSCert}, _, _} = PKIXCert, - EncodedTBSCert. +oidify(Oid) when is_tuple(Oid) -> + Oid; +oidify(Oid) when is_list(Oid) -> + Tokens = string:tokens(Oid, "$."), + OidList = [list_to_integer(StrInt) || StrInt <- Tokens], + list_to_tuple(OidList). -public_key_info(PublicKeyInfo, - #path_validation_state{working_public_key_algorithm = - WorkingAlgorithm, - working_public_key_parameters = - WorkingParams}) -> - PublicKey = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.subjectPublicKey, - AlgInfo = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.algorithm, - - PublicKeyParams = AlgInfo#'PublicKeyAlgorithm'.parameters, - Algorithm = AlgInfo#'PublicKeyAlgorithm'.algorithm, +%% End initialization ---------------------------------------------------------- + +%% Start Basic Policy Processing RFC 5280 Section 6.1.3 ----------------------- + +%% 6.1.3 f +assert_valid_policy_tree(0, PresentPolicyExtension, Tree) -> + assert_valid_policy_tree(PresentPolicyExtension, Tree); +assert_valid_policy_tree(_, _, Tree) -> + Tree. + +assert_valid_policy_tree(undefined, Tree) -> + Tree; %% Initial tree, happens when called in init_validation_state/3 +assert_valid_policy_tree(true, Tree) -> + Tree; %% Policy extension present in step n +assert_valid_policy_tree(false, _Tree) -> % 6.1.3 e + %% Policy extension missing in step n, tree becomes empty + pubkey_policy_tree:empty(). + +%% 6.1.3 d: If the certificate policies extension is present in the +%% certificate and the valid_policy_tree is not NULL, process the +%% policy information by performing the following steps in order: +process_policy_tree(PolicyInformation, SelfSigned, + #path_validation_state{valid_policy_tree = Tree0} = + ValidationState) -> + case pubkey_policy_tree:is_empty(Tree0) of + true -> + Tree0; + false -> + %% Step 1 & 2 + Tree = add_policy_children(PolicyInformation, + SelfSigned, ValidationState), + %% Step 3: If there is a node in the valid_policy_tree of depth i-1 or + %% less without any child nodes, delete that node. Repeat this step + %% until there are no nodes of depth i-1 or less without children. + pubkey_policy_tree:prune_tree(Tree) + end. + +%% 6.1.3 d +add_policy_children(PolicyInfoList0, SelfSigned, + #path_validation_state{valid_policy_tree = Tree0, + inhibit_any_policy = AnyPolicyConstraint, + cert_num = CertNum, + max_path_length = PathLen + }) -> + {AnyExt, PolicyInfoList} = + case lists:keytake(?anyPolicy, + #'PolicyInformation'.policyIdentifier, PolicyInfoList0) of + {value, AnyExt0, PolicyInfoList1} -> + {AnyExt0, PolicyInfoList1}; + false -> + {undefined, PolicyInfoList0} + end, + %% Step 1 + %% i + LeafFun = + fun(#{expected_policy_set := ExpPolicySet}) -> + policy_children(ExpPolicySet, PolicyInfoList) + end, + Tree1 = pubkey_policy_tree:add_leaves(Tree0, LeafFun), - NewPublicKeyParams = - case PublicKeyParams of - {null, 'NULL'} when WorkingAlgorithm == Algorithm -> - WorkingParams; - asn1_NOVALUE when Algorithm == ?'id-Ed25519'; - Algorithm == ?'id-Ed448' -> - {namedCurve, Algorithm}; - {params, Params} -> - Params; - Params -> - Params - end, - {Algorithm, PublicKey, NewPublicKeyParams}. + %% posibly ii + AllLeaves = pubkey_policy_tree:all_leaves(Tree1), + Siblings = fun(#{valid_policy := ?anyPolicy}) -> + any_policy_children(AllLeaves, PolicyInfoList); + (_) -> [] + end, + Tree = pubkey_policy_tree:add_leaf_siblings(Tree1, Siblings), + %% Step 2 + handle_any_ext(Tree, AnyExt, AnyPolicyConstraint, SelfSigned, CertNum, PathLen). + +%% 6.1.3 - d 1 i +%% Step 1: For each policy P not equal to anyPolicy in the certificate +%% policies extension, let P-OID denote the OID for policy P and P-Q +%% denote the qualifier set for policy P. Perform the following +%% steps in order: + +%% (i) For each node of depth i-1 in the valid_policy_tree where +%% P-OID is in the expected_policy_set, create a child node as +%% follows: set the valid_policy to P-OID, set the qualifier_set to +%% P-Q, and set the expected_policy_set to {P-OID}. +policy_children(ExpPolicySet, PolicyInfoList) -> + lists:foldl(fun(#'PolicyInformation'{ + policyIdentifier = Policy, + policyQualifiers = Qualifiers + }, Acc0 + ) -> + case lists:member(Policy, ExpPolicySet) of + true -> + [pubkey_policy_tree:policy_node(Policy, Qualifiers, [Policy]) | Acc0]; + false -> + Acc0 + end + end, [], PolicyInfoList). + +%% 6.1.3 - d 1 ii +%% If there was no match in step (i) and the valid_policy_tree +%% includes a node of depth i-1 with the valid_policy anyPolicy, +%% generate a child node with the following values: set the +%% valid_policy to P-OID, set the qualifier_set to P-Q, and set the +%% expected_policy_set to {P-OID}. +any_policy_children([], PolicyInfoList) -> + lists:foldl(fun(#'PolicyInformation'{ + policyIdentifier = Policy, + policyQualifiers = Qualifiers + }, Acc0 + ) -> + Node = pubkey_policy_tree:policy_node(Policy, Qualifiers, [Policy]), + [Node | Acc0] + end, [], PolicyInfoList); +any_policy_children(_, _) -> + no_sibling. + +%% 6.1.3 - 2 d +%% For each node in the valid_policy_tree of depth i-1, for each +%% value in the expected_policy_set (including anyPolicy) that does +%% not appear in a child node, create a child node with the +%% following values: set the valid_policy to the value from the +%% expected_policy_set in the parent node, set the qualifier_set to +%% AP-Q, and set the expected_policy_set to the value in the +%% valid_policy from this node. +handle_any_ext(Tree, undefined, _, _, _,_) -> + Tree; +handle_any_ext(Tree, #'PolicyInformation'{ + policyIdentifier = ?anyPolicy, + policyQualifiers = Qualifiers}, AnyPolicyConstraint, + SelfSigned, CertNum, PathLen) -> + case AnyPolicyConstraint > 0 orelse + ((CertNum < PathLen) andalso SelfSigned) of + true -> + AllLeaves = pubkey_policy_tree:all_leaves(Tree), + Siblings = fun(Node) -> + any_ext_policy_children(Node, Qualifiers, AllLeaves) + end, + pubkey_policy_tree:add_leaf_siblings(Tree, Siblings); + false -> + Tree + end. + +any_ext_policy_children(#{expected_policy_set := ExpPolicySet}, Qualifiers, AllLeaves) -> + [pubkey_policy_tree:policy_node(Policy, Qualifiers, [Policy]) + || Policy <- ExpPolicySet, not pubkey_policy_tree:in_set(Policy, AllLeaves) + ]. + +%% End Basic Policy Processing ------------------------------------------------- + +%% Start Prepare Next Cert Policy Handling RFC 5280 Section 6.1.4 ------------- + +%% 6.1.4. b start: +handle_policy_mappings(OtpCert, + #path_validation_state{valid_policy_tree = Tree0, + policy_mapping_ext = + #'Extension'{extnID = ?'id-ce-policyMappings', + extnValue = PolicyMappings}} + = ValidationState) -> + case handle_policy_mappings(PolicyMappings, OtpCert, Tree0, ValidationState) of + {tree, Tree} -> + ValidationState#path_validation_state{valid_policy_tree = Tree}; + {user_state, UState} -> + ValidationState#path_validation_state{user_state = UState} + end. + +handle_policy_mappings([], _, Tree, _) -> + {tree, Tree}; +handle_policy_mappings([Mappings | Rest], OtpCert, Tree0, ValidationState) -> + case handle_policy_mapping(Mappings, OtpCert, Tree0, ValidationState) of + {tree, Tree} -> + handle_policy_mappings(Rest, OtpCert, Tree, ValidationState); + Other -> + Other + end. + +%% 6.1.4. a: If a policy mappings extension is present, verify that the +%% special value anyPolicy does not appear as an issuerDomainPolicy or +%% a subjectDomainPolicy. +handle_policy_mapping(#'PolicyMappings_SEQOF'{ + issuerDomainPolicy = + IssuerPolicy, + subjectDomainPolicy = + SubjectPolicy} = Ext, + OtpCert, Tree0, + #path_validation_state{inhibit_policy_mapping = + PolicyMappingConstraint, + current_any_policy_qualifiers = + AnyQualifiers, + verify_fun = VerifyFun, + user_state = UserState} + ) -> + case not (?anyPolicy == IssuerPolicy) andalso + not (?anyPolicy == SubjectPolicy) of + true -> + Tree = handle_policy_mapping_ext(Ext, Tree0, + PolicyMappingConstraint, AnyQualifiers), + {tree, Tree}; + false -> + UserState = verify_fun(OtpCert, {bad_cert, {invalid_policy_mapping, Ext}}, + UserState, VerifyFun), + {user_state, UserState} + end. + +%% 6.1.4. b continue: +handle_policy_mapping_ext(#'PolicyMappings_SEQOF'{ + issuerDomainPolicy = + IssuerPolicy}, + Tree0, 0, _) -> %% 6.1.4. b 2: + %% (2) If the policy_mapping variable is equal to 0: + + %% (i) delete each node of depth i in the valid_policy_tree where + %% ID-P is the valid_policy. + %% + %% (ii) If there is a node in the valid_policy_tree of depth i-1 + %% or less without any child nodes, delete that node. Repeat this + %% step until there are no nodes of depth i-1 or less without + %% children. + + Tree = pubkey_policy_tree:prune_leaves(Tree0, IssuerPolicy), + pubkey_policy_tree:prune_tree(Tree); +handle_policy_mapping_ext(#'PolicyMappings_SEQOF'{ + issuerDomainPolicy = IssuerPolicy, + subjectDomainPolicy = SubjectPolicy}, + Tree, N, AnyQualifiers) when N > 0 -> %% 6.1.4. b 1: + + %% (1) If the policy_mapping variable is greater than 0, for each + %% node in the valid_policy_tree of depth i where ID-P is the + %% valid_policy, set expected_policy_set to the set of + %% subjectDomainPolicy values that are specified as equivalent to + %% ID-P by the policy mappings extension. + MapPolicy = + fun(#{valid_policy := ValidPolicy, expected_policy_set := Set} = Node) + when ValidPolicy == IssuerPolicy -> + case Set of %% Initial policy should be mapped over, but can be mapped to itself + [ValidPolicy] when ValidPolicy =/= SubjectPolicy -> + Node#{expected_policy_set => [SubjectPolicy]}; + _ -> + %% Avoid duplicating self mapping + case lists:member(SubjectPolicy, Set) of + true -> + Node; + false -> + Node#{expected_policy_set => Set ++ [SubjectPolicy]} + end + end; + (Node) -> + Node + end, + + %% If no node of depth i in the valid_policy_tree has a + %% valid_policy of ID-P but there is a node of depth i with a + %% valid_policy of anyPolicy, then generate a child node of the + %% node of depth i-1 that has a valid_policy of anyPolicy as + %% follows: + + %% (i) set the valid_policy to ID-P; + + %% (ii) set the qualifier_set to the qualifier set of the policy + %% anyPolicy in the certificate policies extension of certificate + %% i; and + + %% (iii) set the expected_policy_set to the set of + %% subjectDomainPolicy values that are specified as equivalent to + %% ID-P by the policy mappings extension. + AnySiblings = fun(#{valid_policy := ?anyPolicy}) -> + [pubkey_policy_tree:policy_node(IssuerPolicy, + AnyQualifiers, + [SubjectPolicy])]; + (_) -> + no_sibling + end, + + case pubkey_policy_tree:map_leaves(Tree, MapPolicy) of + Tree -> %% If no policy was mapped! + pubkey_policy_tree:add_leaf_siblings(Tree, AnySiblings); + NewTree -> + NewTree + end. + +%% 6.1.4 i +handle_policy_constraints(#path_validation_state{ + policy_constraint_ext = + #'Extension'{extnID = ?'id-ce-policyConstraints', + extnValue = + #'PolicyConstraints'{requireExplicitPolicy = + ExplicitPolicy, + inhibitPolicyMapping = + InhibitMapPolicy}}, + explicit_policy = CurrentExplicitPolicyConstraint, + inhibit_policy_mapping = CurrentPolicyMappingConstraint} = + ValidationState) -> + ExplicitPolicyConstraint = + policy_constraint(CurrentExplicitPolicyConstraint, ExplicitPolicy), % Step 1 + PolicyMappingConstraint = + policy_constraint(CurrentPolicyMappingConstraint, InhibitMapPolicy), % Step 2 + ValidationState#path_validation_state{explicit_policy = ExplicitPolicyConstraint, + inhibit_policy_mapping = PolicyMappingConstraint, + policy_constraint_ext = undefined}; +handle_policy_constraints(ValidationState) -> + ValidationState. + +%% 6.4.1 j +handle_inhibit_anypolicy(#path_validation_state{policy_inhibitany_ext = + #'Extension'{extnID = ?'id-ce-inhibitAnyPolicy', + extnValue = InhibitAnyPolicy + }, + inhibit_any_policy = CurrentAnyPolicy} = + ValidationState) -> + AnyPolicyConstraint = policy_constraint(CurrentAnyPolicy, InhibitAnyPolicy), + ValidationState#path_validation_state{inhibit_any_policy = AnyPolicyConstraint, + policy_inhibitany_ext = undefined}; +handle_inhibit_anypolicy(ValidationState) -> + ValidationState. + +policy_constraint(Current, asn1_NOVALUE) -> + Current; +policy_constraint(Current, New) -> + erlang:min(Current, New). + +current_any_policy_qualifiers(Info) -> + case lists:keyfind(?anyPolicy, #'PolicyInformation'.policyIdentifier, Info) of + #'PolicyInformation'{policyQualifiers = AnyQualifiers} -> + AnyQualifiers; + _ -> + [] + end. + +maybe_decrement(0, _) -> + 0; +maybe_decrement(N, false) -> + N-1; +maybe_decrement(N, true) -> + N. + +%% End Prepare Next Cert Policy Handling --------------------------------------- + +%% Start Wrap Up Policy Handling RFC 5280 Section 6.1.5 %% --------------------- + +%% Step G from RFC + +policy_tree_intersection([?anyPolicy], Tree) -> % (ii) from RFC + Tree; +policy_tree_intersection(UserPolicySet, Tree0) -> + case pubkey_policy_tree:is_empty(Tree0) of + true -> % (i) from RFC + Tree0; + false -> % (iii) from RFC + %% Step 1 from RFC + ValidPolicyNodeSet = pubkey_policy_tree:valid_policy_node_set(Tree0), + + %% Step 2 from RFC + InvalidNodes = apply_user_constraints(ValidPolicyNodeSet, UserPolicySet), + Tree1 = pubkey_policy_tree:prune_invalid_nodes(Tree0, InvalidNodes), + + %% Step 3 from RFC + Tree = handle_any_policy_leaves(Tree1, ValidPolicyNodeSet, UserPolicySet), + + %% Step 4 from RFC + pubkey_policy_tree:prune_tree(Tree) + end. + +apply_user_constraints(_, [?anyPolicy]) -> + []; +apply_user_constraints(ValidPolicyNodeSet, UserPolicySet) -> + apply_user_constraints(ValidPolicyNodeSet, UserPolicySet, []). + +apply_user_constraints([], _, Acc) -> + Acc; +apply_user_constraints([#{valid_policy := ?anyPolicy} | Rest], + UserPolicySet, Acc) -> + apply_user_constraints(Rest, UserPolicySet, Acc); +apply_user_constraints([#{valid_policy := Policy} = Node | Rest], + UserPolicySet, Acc) -> + case lists:member(Policy, UserPolicySet) of + true -> + apply_user_constraints(Rest, UserPolicySet, Acc); + false -> + apply_user_constraints(Rest, UserPolicySet, [Node | Acc]) + end. + +handle_any_policy_leaves(Tree, _, [?anyPolicy]) -> + Tree; +handle_any_policy_leaves(Tree0, ValidPolicyNodeSet, UserPolicySet) -> + case pubkey_policy_tree:any_leaves(Tree0) of + [] -> + Tree0; + AnyLeaves -> + Tree = add_policy_nodes(AnyLeaves, Tree0, ValidPolicyNodeSet, UserPolicySet), + pubkey_policy_tree:prune_leaves(Tree, ?anyPolicy) + end. + +add_policy_nodes([], Tree, _, _) -> + Tree; +add_policy_nodes([#{qualifier_set := Qualifiers} | Rest], Tree0, + ValidPolicyNodeSet, UserPolicySet) -> + PolicySet = [UPolicy || UPolicy <- UserPolicySet, + not pubkey_policy_tree:in_set(UPolicy, ValidPolicyNodeSet)], + Children = + [pubkey_policy_tree:policy_node(Policy, Qualifiers, [Policy]) || Policy <- PolicySet], + Siblings = fun(#{valid_policy := ?anyPolicy, qualifier_set := QSet}) when QSet == Qualifiers-> + Children; + (_) -> [] + end, + add_policy_nodes(Rest, pubkey_policy_tree:add_leaf_siblings(Tree0, Siblings), + ValidPolicyNodeSet, UserPolicySet). + +%% End Wrap Up Policy Handling ------------------------------------------------- + +%%==================================================================== +%% Date handling +%%==================================================================== + %% time_str_2_gregorian_sec/2 is a wrapper (decorator pattern) over %% time_str_2_gregorian_sec/1. the decorator deals with notBefore and notAfter @@ -703,6 +1324,37 @@ mod(A, B) when A > 0 -> A rem B; mod(A, B) when A < 0 -> mod(A+B, B); mod(0, _) -> 0. +%%==================================================================== +%% Name handling +%%==================================================================== +match_name(Fun, Name, PermittedName, []) -> + Fun(Name, PermittedName); +match_name(Fun, Name, PermittedName, [Head | Tail]) -> + case Fun(Name, PermittedName) of + true -> + true; + false -> + match_name(Fun, Name, Head, Tail) + end. + +do_normalize_general_name(Issuer) -> + Normalize = fun([{Description, Type, {printableString, Value}}]) -> + NewValue = string:casefold(strip_spaces(Value, false)), + [{Description, Type, {printableString, NewValue}}]; + (Atter) -> + Atter + end, + lists:map(Normalize, Issuer). + +%% See rfc3280 4.1.2.6 Subject: regarding emails. +extract_email({rdnSequence, List}) -> + extract_email2(List). +extract_email2([[#'AttributeTypeAndValue'{type=?'id-emailAddress', + value=Mail}]|_]) -> + [{rfc822Name, Mail}]; +extract_email2([_|Rest]) -> + extract_email2(Rest); +extract_email2([]) -> []. is_dir_name([], [], _Exact) -> true; is_dir_name([H|R1],[H|R2], Exact) -> is_dir_name(R1,R2, Exact); @@ -742,20 +1394,6 @@ is_dir_name2(Str1, Str2) is_dir_name2(_, _) -> false. -cert_auth_key_id(#'AuthorityKeyIdentifier'{authorityCertIssuer - = asn1_NOVALUE}) -> - {error, issuer_not_found}; -cert_auth_key_id(#'AuthorityKeyIdentifier'{authorityCertIssuer = - AuthCertIssuer, - authorityCertSerialNumber = - SerialNr}) -> - {ok, {SerialNr, decode_general_name(AuthCertIssuer)}}. - -decode_general_name([{directoryName, Issuer}]) -> - normalize_general_name(Issuer); -decode_general_name([{_, Issuer}]) -> - Issuer. - strip_spaces(String0, KeepDeep) -> Trimmed = string:trim(String0), strip_many_spaces(string:split(Trimmed, " ", all), KeepDeep). @@ -770,184 +1408,20 @@ strip_many_spaces(Strings, KeepDeep) -> false -> unicode:characters_to_list(DeepList) end. -%% No extensions present -validate_extensions(OtpCert, asn1_NOVALUE, ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun) -> - validate_extensions(OtpCert, [], ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun); - -validate_extensions(_,[], ValidationState, basic_constraint, _SelfSigned, - UserState, _) -> - {ValidationState, UserState}; -validate_extensions(OtpCert, [], ValidationState = - #path_validation_state{max_path_length = Len, - last_cert = Last}, - no_basic_constraint, SelfSigned, UserState0, VerifyFun) -> - case Last of - true when SelfSigned -> - {ValidationState, UserState0}; - true -> - {ValidationState#path_validation_state{max_path_length = Len - 1}, - UserState0}; - false -> - %% basic_constraint must appear in certs used for digital sign - %% see 4.2.1.10 in rfc 3280 - case is_digitally_sign_cert(OtpCert) of - true -> - missing_basic_constraints(OtpCert, SelfSigned, - ValidationState, VerifyFun, - UserState0, Len); - false -> %% Example CRL signer only - {ValidationState, UserState0} - end - end; - -validate_extensions(OtpCert, - [#'Extension'{extnID = ?'id-ce-basicConstraints', - extnValue = - #'BasicConstraints'{cA = true, - pathLenConstraint = N}} | - Rest], - ValidationState = - #path_validation_state{max_path_length = Len}, _, - SelfSigned, UserState, VerifyFun) -> - Length = if SelfSigned -> erlang:min(N, Len); - true -> erlang:min(N, Len-1) - end, - validate_extensions(OtpCert, Rest, - ValidationState#path_validation_state{max_path_length = - Length}, - basic_constraint, SelfSigned, - UserState, VerifyFun); -%% The pathLenConstraint field is meaningful only if cA is set to -%% TRUE. -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-basicConstraints', - extnValue = - #'BasicConstraints'{cA = false}} | - Rest], ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun) -> - validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun); - -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-keyUsage', - extnValue = KeyUse - } | Rest], - #path_validation_state{last_cert=Last} = ValidationState, - ExistBasicCon, SelfSigned, - UserState0, VerifyFun) -> - case Last orelse is_valid_key_usage(KeyUse, keyCertSign) of - true -> - validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, - SelfSigned, UserState0, VerifyFun); - false -> - UserState = verify_fun(OtpCert, {bad_cert, invalid_key_usage}, - UserState0, VerifyFun), - validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun) - end; - -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-subjectAltName', - extnValue = Names, - critical = true} = Ext | Rest], - ValidationState, ExistBasicCon, - SelfSigned, UserState0, VerifyFun) -> - case validate_subject_alt_names(Names) of - true -> - validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, - SelfSigned, UserState0, VerifyFun); - false -> - UserState = verify_fun(OtpCert, {extension, Ext}, - UserState0, VerifyFun), - validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun) - end; - -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-nameConstraints', - extnValue = NameConst} | Rest], - ValidationState, - ExistBasicCon, SelfSigned, UserState, VerifyFun) -> - Permitted = NameConst#'NameConstraints'.permittedSubtrees, - Excluded = NameConst#'NameConstraints'.excludedSubtrees, - - NewValidationState = add_name_constraints(Permitted, Excluded, - ValidationState), - - validate_extensions(OtpCert, Rest, NewValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun); - -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-certificatePolicies', - critical = true} = Ext| Rest], ValidationState, - ExistBasicCon, SelfSigned, UserState0, VerifyFun) -> - %% TODO: Remove this clause when policy handling is - %% fully implemented - UserState = verify_fun(OtpCert, {extension, Ext}, - UserState0, VerifyFun), - validate_extensions(OtpCert,Rest, ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun); - -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-certificatePolicies', - extnValue = #'PolicyInformation'{ - policyIdentifier = Id, - policyQualifiers = Qualifier}} - | Rest], #path_validation_state{valid_policy_tree = Tree} - = ValidationState, - ExistBasicCon, SelfSigned, UserState, VerifyFun) -> - - %% TODO: Policy imp incomplete - NewTree = process_policy_tree(Id, Qualifier, Tree), - - validate_extensions(OtpCert, Rest, - ValidationState#path_validation_state{ - valid_policy_tree = NewTree}, - ExistBasicCon, SelfSigned, UserState, VerifyFun); - -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-policyConstraints', - critical = true} = Ext | Rest], ValidationState, - ExistBasicCon, SelfSigned, UserState0, VerifyFun) -> - %% TODO: Remove this clause when policy handling is - %% fully implemented - UserState = verify_fun(OtpCert, {extension, Ext}, - UserState0, VerifyFun), - validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun); -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-policyConstraints', - extnValue = #'PolicyConstraints'{ - requireExplicitPolicy = ExpPolicy, - inhibitPolicyMapping = MapPolicy}} - | Rest], ValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun) -> - - %% TODO: Policy imp incomplete - NewValidationState = add_policy_constraints(ExpPolicy, MapPolicy, - ValidationState), - - validate_extensions(OtpCert, Rest, NewValidationState, ExistBasicCon, - SelfSigned, UserState, VerifyFun); +decode_general_name([{directoryName, Issuer}]) -> + normalize_general_name(Issuer); +decode_general_name([{_, Issuer}]) -> + Issuer. -validate_extensions(OtpCert, [#'Extension'{extnID = ?'id-ce-extKeyUsage', - critical = true, - extnValue = KeyUse} = Extension | Rest], - #path_validation_state{last_cert = false} = ValidationState, ExistBasicCon, - SelfSigned, UserState0, VerifyFun) -> - UserState = - case ext_keyusage_includes_any(KeyUse) of - true -> %% CA cert that specifies ?anyExtendedKeyUsage should not be marked critical - verify_fun(OtpCert, {bad_cert, invalid_ext_key_usage}, UserState0, VerifyFun); - false -> - verify_fun(OtpCert, {extension, Extension}, UserState0, VerifyFun) - end, - validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, SelfSigned, - UserState, VerifyFun); -validate_extensions(OtpCert, [#'Extension'{} = Extension | Rest], - ValidationState, ExistBasicCon, - SelfSigned, UserState0, VerifyFun) -> - UserState = verify_fun(OtpCert, {extension, Extension}, UserState0, VerifyFun), - validate_extensions(OtpCert, Rest, ValidationState, ExistBasicCon, SelfSigned, - UserState, VerifyFun). +cert_auth_key_id(#'AuthorityKeyIdentifier'{authorityCertIssuer + = asn1_NOVALUE}) -> + {error, issuer_not_found}; +cert_auth_key_id(#'AuthorityKeyIdentifier'{authorityCertIssuer = + AuthCertIssuer, + authorityCertSerialNumber = + SerialNr}) -> + {ok, {SerialNr, decode_general_name(AuthCertIssuer)}}. -is_valid_key_usage(KeyUse, Use) -> - lists:member(Use, KeyUse). - validate_subject_alt_names([]) -> false; validate_subject_alt_names([AltName | Rest]) -> @@ -959,12 +1433,12 @@ validate_subject_alt_names([AltName | Rest]) -> end. is_valid_subject_alt_name({Name, Value}) when Name == rfc822Name; - Name == dNSName -> + Name == dNSName -> case Value of "" -> false; _ -> - true + true end; is_valid_subject_alt_name({iPAdress, Addr}) -> @@ -988,7 +1462,7 @@ is_valid_subject_alt_name({otherName, #'AnotherName'{}}) -> is_valid_subject_alt_name({_, _}) -> false. -is_valid_uri(AbsURI) -> +is_valid_uri(AbsURI) -> case uri_string:normalize(AbsURI, [return_map]) of #{scheme := _} -> true; @@ -996,7 +1470,7 @@ is_valid_uri(AbsURI) -> false end. -is_rdnSeq({rdnSequence,[]}, {rdnSequence,[none]}) -> +is_rdnSeq({rdnSequence,[]}, {rdnSequence,[none]}) -> true; is_rdnSeq({rdnSequence,DirName}, {rdnSequence,Permitted}) -> is_dir_name(DirName, Permitted, false). @@ -1026,13 +1500,13 @@ is_valid_name([{Type, Name} | Rest], Constraints, Default) -> is_valid_name(Rest, Constraints,Default) end. -add_name_constraints(NewPermittedTrees, NewExcludedTrees, +add_name_constraints(NewPermittedTrees, NewExcludedTrees, #path_validation_state{ permitted_subtrees = PermittedTrees, excluded_subtrees = ExcludedTrees} = ValidationState) -> NewPermitted = subtree_intersection(NewPermittedTrees, PermittedTrees), - NewExcluded = subtree_union(NewExcludedTrees, ExcludedTrees), + NewExcluded = subtree_union(NewExcludedTrees, ExcludedTrees), ValidationState#path_validation_state{permitted_subtrees = NewPermitted, excluded_subtrees = NewExcluded}. subtree_union(asn1_NOVALUE, Trees) -> @@ -1050,27 +1524,27 @@ subtree_intersection([Tree | Trees1], Trees2) -> subtree_intersection([], TreesInt) -> TreesInt. -is_in_intersection(#'GeneralSubtree'{base = - {directoryName, {rdnSequence, Name1}}} - = Name, - [#'GeneralSubtree'{base = - {directoryName, {rdnSequence, Name2}}} +is_in_intersection(#'GeneralSubtree'{base = + {directoryName, {rdnSequence, Name1}}} + = Name, + [#'GeneralSubtree'{base = + {directoryName, {rdnSequence, Name2}}} | Trees]) -> case is_dir_name(Name1, Name2, false) of true -> [Name|Trees]; false -> - [Name#'GeneralSubtree'{base = - {directoryName, {rdnSequence,[none]}}} + [Name#'GeneralSubtree'{base = + {directoryName, {rdnSequence,[none]}}} | Trees] end; -is_in_intersection(#'GeneralSubtree'{base = {ipAdress, Ip}}, +is_in_intersection(#'GeneralSubtree'{base = {ipAdress, Ip}}, Trees = [#'GeneralSubtree'{base = {ipAdress, Ip}} | _]) -> %% BUGBUG Trees; -is_in_intersection(#'GeneralSubtree'{base = {x400Address, OrAddr1}} = Addr, - [#'GeneralSubtree'{base = {x400Address, OrAddr2}} - | Trees]) -> +is_in_intersection(#'GeneralSubtree'{base = {x400Address, OrAddr1}} = Addr, + [#'GeneralSubtree'{base = {x400Address, OrAddr2}} + | Trees]) -> case is_or_address(OrAddr1, OrAddr2) of true -> [Addr|Trees]; @@ -1078,8 +1552,8 @@ is_in_intersection(#'GeneralSubtree'{base = {x400Address, OrAddr1}} = Addr, [#'GeneralSubtree'{base = {x400Address, ""}} | Trees] end; -is_in_intersection(#'GeneralSubtree'{base = {Type, Name1}} = Name, - [#'GeneralSubtree'{base = {Type, Name2}} +is_in_intersection(#'GeneralSubtree'{base = {Type, Name1}} = Name, + [#'GeneralSubtree'{base = {Type, Name2}} | Trees]) -> case case_insensitive_match(Name1, Name2) of true -> @@ -1098,8 +1572,8 @@ type_subtree_names(Type, SubTrees) -> is_permitted_ip([], [], []) -> true; -is_permitted_ip([CandidatIp | CandidatIpRest], - [PermittedIp | PermittedIpRest], [Mask | MaskRest] ) -> +is_permitted_ip([CandidatIp | CandidatIpRest], + [PermittedIp | PermittedIpRest], [Mask | MaskRest] ) -> case mask_cmp(CandidatIp, PermittedIp, Mask) of true -> is_permitted_ip(CandidatIpRest, PermittedIpRest, MaskRest); @@ -1121,28 +1595,28 @@ is_valid_host_or_domain(Canditate, Permitted) -> [_, CanditateHost] -> case_insensitive_match(CanditateHost, Permitted) end. + is_valid_email_address(Canditate, [$.|Permitted], [_]) -> is_suffix(Permitted, Canditate); - is_valid_email_address(Canditate, PermittedHost, [_]) -> [_ , CanditateHost] = string:tokens(Canditate,"@"), case_insensitive_match(CanditateHost, PermittedHost); - is_valid_email_address(Canditate, Permitted, [_, _]) -> case_insensitive_match(Canditate, Permitted). is_suffix(Suffix, Str) -> lists:suffix(string:casefold(Suffix), string:casefold(Str)). + case_insensitive_match(Str1, Str2) -> string:equal(Str1, Str2, true). is_or_address(Address, Canditate) -> %% TODO: Is case_insensitive_match sufficient? %% study rfc2156 probably need more a complex check. - is_double_quoted(Address) andalso - is_double_quoted(Canditate) andalso + is_double_quoted(Address) andalso + is_double_quoted(Canditate) andalso case_insensitive_match(Address, Canditate). - + is_double_quoted(["\"" | Tail]) -> is_double_quote(lists:last(Tail)); is_double_quoted("%22" ++ Tail) -> @@ -1163,33 +1637,69 @@ is_double_quote("\"") -> is_double_quote(_) -> false. -add_policy_constraints(ExpPolicy, MapPolicy, - #path_validation_state{cert_num = CertNum, - explicit_policy = CurExpPolicy, - policy_mapping = CurMapPolicy} = - ValidationState) -> - - NewExpPolicy = policy_constraint(CurExpPolicy, ExpPolicy, CertNum), - NewMapPolicy = policy_constraint(CurMapPolicy, MapPolicy, CertNum), +%%==================================================================== +%% Signature handling +%%==================================================================== - ValidationState#path_validation_state{explicit_policy = NewExpPolicy, - policy_mapping = NewMapPolicy}. +extract_verify_data(OtpCert, DerCert) -> + Signature = OtpCert#'OTPCertificate'.signature, + SigAlg = OtpCert#'OTPCertificate'.signatureAlgorithm, + PlainText = encoded_tbs_cert(DerCert), + {DigestType,_,_} = x509_pkix_sign_types(SigAlg), + {DigestType, PlainText, Signature}. -policy_constraint(Current, asn1_NOVALUE, _) -> - Current; -policy_constraint(Current, New, CertNum) -> - erlang:min(Current, New + CertNum). +verify_signature(OtpCert, DerCert, Key, KeyParams) -> + {DigestType, PlainText, Signature} = extract_verify_data(OtpCert, DerCert), + case Key of + #'RSAPublicKey'{} -> + case KeyParams of + #'RSASSA-PSS-params'{} -> + public_key:verify(PlainText, DigestType, Signature, Key, + verify_options(KeyParams)); + 'NULL' -> + public_key:verify(PlainText, DigestType, Signature, Key) + end; + _ -> + public_key:verify(PlainText, DigestType, Signature, {Key, KeyParams}) + end. -process_policy_tree(_,_, ?NULL) -> - ?NULL; -process_policy_tree(_Id, _Qualifier, Tree) -> - %% TODO real imp. - Tree. +encoded_tbs_cert(Cert) -> + {ok, PKIXCert} = + 'OTP-PUB-KEY':decode_TBSCert_exclusive(Cert), + {'Certificate', + {'Certificate_tbsCertificate', EncodedTBSCert}, _, _} = PKIXCert, + EncodedTBSCert. -policy_indicator(_, true) -> - 0; -policy_indicator(N, false) -> - N + 1. +public_key_info(PublicKeyInfo, + #path_validation_state{working_public_key_algorithm = + WorkingAlgorithm, + working_public_key_parameters = + WorkingParams}) -> + PublicKey = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.subjectPublicKey, + AlgInfo = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.algorithm, + + PublicKeyParams = AlgInfo#'PublicKeyAlgorithm'.parameters, + Algorithm = AlgInfo#'PublicKeyAlgorithm'.algorithm, + + NewPublicKeyParams = + case PublicKeyParams of + {null, 'NULL'} when WorkingAlgorithm == Algorithm -> + WorkingParams; + asn1_NOVALUE when Algorithm == ?'id-Ed25519'; + Algorithm == ?'id-Ed448' -> + {namedCurve, Algorithm}; + {params, Params} -> + Params; + Params -> + Params + end, + {Algorithm, PublicKey, NewPublicKeyParams}. + + +extensions_list(asn1_NOVALUE) -> + []; +extensions_list(Extensions) -> + Extensions. is_fixed_dh_cert(PublicKeyInfo, Extensions) -> AlgInfo = PublicKeyInfo#'OTPSubjectPublicKeyInfo'.algorithm, @@ -1229,6 +1739,13 @@ missing_basic_constraints(OtpCert, SelfSigned, ValidationState, VerifyFun, UserS UserState} end. +is_valid_key_usage(KeyUse, Use) -> + lists:member(Use, KeyUse). + +%%==================================================================== +%% Generate test data +%%==================================================================== + gen_key(KeyGen) -> case is_key(KeyGen) of true -> @@ -1251,9 +1768,9 @@ is_key(_) -> cert_template() -> #'OTPTBSCertificate'{ - version = v3, + version = v3, serialNumber = erlang:unique_integer([positive, monotonic]), - issuerUniqueID = asn1_NOVALUE, + issuerUniqueID = asn1_NOVALUE, subjectUniqueID = asn1_NOVALUE }. @@ -1273,37 +1790,36 @@ subject(SubjectOpts) when is_list(SubjectOpts) -> end, {rdnSequence, [Encode(Opt) || Opt <- SubjectOpts]}. -subject_enc({name, Name}) -> +subject_enc({name, Name}) -> {?'id-at-commonName', {printableString, Name}}; -subject_enc({email, Email}) -> +subject_enc({email, Email}) -> {?'id-emailAddress', Email}; -subject_enc({city, City}) -> +subject_enc({city, City}) -> {?'id-at-localityName', {printableString, City}}; -subject_enc({org, Org}) -> +subject_enc({org, Org}) -> {?'id-at-organizationName', {printableString, Org}}; -subject_enc({org_unit, OrgUnit}) -> +subject_enc({org_unit, OrgUnit}) -> {?'id-at-organizationalUnitName', {printableString, OrgUnit}}; -subject_enc({country, Country}) -> +subject_enc({country, Country}) -> {?'id-at-countryName', Country}. validity(Opts) -> DefFrom0 = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())-1), DefTo0 = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())+7), {DefFrom, DefTo} = proplists:get_value(validity, Opts, {DefFrom0, DefTo0}), - + GenFormat = fun({Y,M,D}) -> lists:flatten( io_lib:format("~4..0w~2..0w~2..0w130000Z",[Y,M,D])) end, - + UTCFormat = fun({Y,M,D}) -> [_, _, Y3, Y4] = integer_to_list(Y), lists:flatten( io_lib:format("~s~2..0w~2..0w130000Z",[[Y3, Y4],M,D])) end, - #'Validity'{notBefore = validity_format(DefFrom, GenFormat, UTCFormat), notAfter = validity_format(DefTo, GenFormat, UTCFormat)}. @@ -1324,12 +1840,13 @@ sign_algorithm(#'RSAPrivateKey'{} = Key , Opts) -> end; sign_algorithm({#'RSAPrivateKey'{} = Key,#'RSASSA-PSS-params'{} = Params}, _Opts) -> rsa_sign_algo(Key, ?'id-RSASSA-PSS', Params); - + sign_algorithm(#'DSAPrivateKey'{p=P, q=Q, g=G}, _Opts) -> #'SignatureAlgorithm'{algorithm = ?'id-dsa-with-sha1', parameters = {params,#'Dss-Parms'{p=P, q=Q, g=G}}}; -sign_algorithm(#'ECPrivateKey'{parameters = {namedCurve, EDCurve}}, _Opts) when EDCurve == ?'id-Ed25519'; - EDCurve == ?'id-Ed448' -> +sign_algorithm(#'ECPrivateKey'{parameters = {namedCurve, EDCurve}}, _Opts) + when EDCurve == ?'id-Ed25519'; + EDCurve == ?'id-Ed448' -> #'SignatureAlgorithm'{algorithm = EDCurve, parameters = asn1_NOVALUE}; sign_algorithm(#'ECPrivateKey'{parameters = Parms}, Opts) -> @@ -1339,12 +1856,12 @@ sign_algorithm(#'ECPrivateKey'{parameters = Parms}, Opts) -> rsa_sign_algo(#'RSAPrivateKey'{}, ?'id-RSASSA-PSS' = Type, #'RSASSA-PSS-params'{} = Params) -> #'SignatureAlgorithm'{algorithm = Type, - parameters = Params}; + parameters = Params}; rsa_sign_algo(#'RSAPrivateKey'{}, Type, Parms) -> #'SignatureAlgorithm'{algorithm = Type, parameters = Parms}. -rsa_digest_oid(Oid) when is_tuple(Oid) -> +rsa_digest_oid(Oid) when is_tuple(Oid) -> Oid; rsa_digest_oid(sha1) -> ?'sha1WithRSAEncryption'; @@ -1359,7 +1876,7 @@ rsa_digest_oid(sha256) -> rsa_digest_oid(md5) -> ?'md5WithRSAEncryption'. -ecdsa_digest_oid(Oid) when is_tuple(Oid) -> +ecdsa_digest_oid(Oid) when is_tuple(Oid) -> Oid; ecdsa_digest_oid(sha1) -> ?'ecdsa-with-SHA1'; @@ -1380,23 +1897,23 @@ cert_chain(Role, Root, RootKey, Opts) -> cert_chain(Role, IssuerCert, IssuerKey, [PeerOpts], _, Acc) -> Key = gen_key(proplists:get_value(key, PeerOpts, default_key_gen())), - Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), + Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), IssuerKey, Key, "admin", " Peer cert", PeerOpts, peer), [{Cert, encode_key(Key)}, {IssuerCert, encode_key(IssuerKey)} | Acc]; cert_chain(Role, IssuerCert, IssuerKey, [CAOpts | Rest], N, Acc) -> Key = gen_key(proplists:get_value(key, CAOpts, default_key_gen())), - Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), IssuerKey, Key, "webadmin", + Cert = cert(Role, public_key:pkix_decode_cert(IssuerCert, otp), IssuerKey, Key, "webadmin", " Intermediate CA " ++ integer_to_list(N), CAOpts, ca), cert_chain(Role, Cert, Key, Rest, N+1, [{IssuerCert, encode_key(IssuerKey)} | Acc]). -cert(Role, #'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = Issuer}}, +cert(Role, #'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = Issuer}}, PrivKey, Key, Contact, Name, Opts, Type) -> TBS = cert_template(), SignAlgoId = sign_algorithm(PrivKey, Opts), OTPTBS = TBS#'OTPTBSCertificate'{ signature = SignAlgoId, issuer = Issuer, - validity = validity(Opts), + validity = validity(Opts), subject = subject(Contact, atom_to_list(Role) ++ Name), subjectPublicKeyInfo = public_key(Key, SignAlgoId), extensions = extensions(Role, Type, Opts) @@ -1422,7 +1939,7 @@ public_key(#'RSAPrivateKey'{modulus=N, publicExponent=E}, Algo = #'PublicKeyAlgorithm'{algorithm= ?rsaEncryption, parameters = Params}, #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Public}; -public_key({#'RSAPrivateKey'{modulus=N, publicExponent=E}, #'RSASSA-PSS-params'{} = Params}, +public_key({#'RSAPrivateKey'{modulus=N, publicExponent=E}, #'RSASSA-PSS-params'{} = Params}, #'SignatureAlgorithm'{algorithm = ?'id-RSASSA-PSS', parameters = #'RSASSA-PSS-params'{} = Params}) -> Public = #'RSAPublicKey'{modulus=N, publicExponent=E}, @@ -1435,7 +1952,7 @@ public_key(#'RSAPrivateKey'{modulus=N, publicExponent=E}, _) -> #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Public}; public_key(#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y}, _) -> - Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-dsa', + Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-dsa', parameters={params, #'Dss-Parms'{p=P, q=Q, g=G}}}, #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Y}; public_key(#'ECPrivateKey'{version = _Version, @@ -1483,18 +2000,18 @@ add_default_extensions(server, peer, Exts) -> critical = false} ], add_default_extensions(Default, Exts); - + add_default_extensions(client, peer, Exts) -> Exts. add_default_extensions(Defaults0, Exts) -> Defaults = lists:filtermap(fun(#'Extension'{extnID = ID} = Ext) -> - case lists:keymember(ID, 2, Exts) of - true -> - false; - false -> - {true, Ext} - end + case lists:keymember(ID, 2, Exts) of + true -> + false; + false -> + {true, Ext} + end end, Defaults0), Exts ++ Defaults. @@ -1508,17 +2025,19 @@ encode_key(#'ECPrivateKey'{} = Key) -> encode_key(#'DSAPrivateKey'{} = Key) -> {'DSAPrivateKey', public_key:der_encode('DSAPrivateKey', Key)}. -verify_options(#'RSASSA-PSS-params'{saltLength = SaltLen, - maskGenAlgorithm = - #'MaskGenAlgorithm'{algorithm = ?'id-mgf1', - parameters = #'HashAlgorithm'{algorithm = HashOid}}}) -> +verify_options( + #'RSASSA-PSS-params'{saltLength = SaltLen, + maskGenAlgorithm = + #'MaskGenAlgorithm'{algorithm = ?'id-mgf1', + parameters = + #'HashAlgorithm'{algorithm = HashOid}}}) -> HashAlgo = public_key:pkix_hash_type(HashOid), [{rsa_padding, rsa_pkcs1_pss_padding}, {rsa_pss_saltlen, SaltLen}, {rsa_mgf1_md, HashAlgo}]. - ext_keyusage_includes_any(KeyUse) when is_list(KeyUse) -> lists:member(?anyExtendedKeyUsage, KeyUse); ext_keyusage_includes_any(_) -> false. + diff --git a/lib/public_key/src/pubkey_policy_tree.erl b/lib/public_key/src/pubkey_policy_tree.erl new file mode 100644 index 0000000000..bacdfd5137 --- /dev/null +++ b/lib/public_key/src/pubkey_policy_tree.erl @@ -0,0 +1,420 @@ +%% +%% %CopyrightBegin% +%% +%% Copyright Ericsson AB 2023-2023. All Rights Reserved. +%% +%% Licensed under the Apache License, Version 2.0 (the "License"); +%% you may not use this file except in compliance with the License. +%% You may obtain a copy of the License at +%% +%% http://www.apache.org/licenses/LICENSE-2.0 +%% +%% Unless required by applicable law or agreed to in writing, software +%% distributed under the License is distributed on an "AS IS" BASIS, +%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +%% See the License for the specific language governing permissions and +%% limitations under the License. +%% +%% %CopyrightEnd% +%% +-module(pubkey_policy_tree). + +-include("../include/public_key.hrl"). + +%% API +-export([add_leaves/2, + add_leaf_siblings/2, + any_leaves/1, + all_leaves/1, + collect_qualifiers/2, + constrained_policy_node_set/1, + empty/0, + in_set/2, + is_empty/1, + map_leaves/2, + policy_node/3, + prune_leaves/2, + prune_tree/1, + prune_invalid_nodes/2, + root/0, + valid_policy_node_set/1 + ]). + +-export_type([policy_tree/0]). + +-type policy_node() :: + #{valid_policy := public_key:oid(), + qualifier_set := [#'PolicyQualifierInfo'{}], + expected_policy_set := [public_key:oid()]}. + +-type policy_tree_node() :: {policy_node(), [policy_tree_node()] | + [policy_node()]}. + +-opaque policy_tree() :: {} | policy_tree_node(). + +%%%=================================================================== +%%% Internal API +%%%=================================================================== + +%%-------------------------------------------------------------------- +-spec add_leaves(policy_tree(), LeafFun) -> policy_tree() when + LeafFun :: fun((policy_tree_node()) -> [policy_node()]). + +%% +%% Add leaves specified by calling LeafFun with the current leaves +%% as input +%%-------------------------------------------------------------------- +add_leaves({Parent, []}, LeafFun) -> + {Parent, LeafFun(Parent)}; +add_leaves(Tree, LeafFun0) -> + LeafFun = fun(Leaf) -> + NewLeaves = LeafFun0(Leaf), + {Leaf, NewLeaves} + end, + map_leaves(Tree, LeafFun). + +%%-------------------------------------------------------------------- +-spec add_leaf_siblings(policy_tree(), SiblingFun) -> policy_tree() when + SiblingFun ::fun((policy_tree_node()) -> no_sibling | [policy_node()]). + +%% +%% Add sibling leaves if SiblingFun returns a list of policy nodes +%% for the leaf parent. +%%-------------------------------------------------------------------- +add_leaf_siblings({Parent,[{_, _}|_] = ChildNodes}, SiblingFun) -> + {Parent, lists:map(fun(ChildNode)-> + add_leaf_siblings(ChildNode, SiblingFun) + end, ChildNodes)}; +add_leaf_siblings({Parent, Leaves} = Node, SiblingFun) -> + case SiblingFun(Parent) of + no_sibling -> + Node; + Siblings -> + {Parent, Leaves ++ Siblings} + end. + +%%-------------------------------------------------------------------- +-spec any_leaves(policy_tree()) -> [policy_node()]. +%% +%% Find leaf policy nodes with valid_policy = ?anyPolicy if they exists +%%-------------------------------------------------------------------- +any_leaves({}) -> + []; +any_leaves({_,[{_, _}|_] = ChildNodes}) -> + lists:flatmap(fun(ChildNode)-> + any_leaves(ChildNode) + end, ChildNodes); +any_leaves({_, Leaves}) -> + AnyLeaf = fun(#{valid_policy := ?anyPolicy} = Node) -> + {true, Node}; + (_) -> + false + end, + lists:filtermap(AnyLeaf, Leaves). + +%%-------------------------------------------------------------------- +-spec all_leaves(policy_tree()) -> [policy_node()]. +%% +%% Return list of all leaves +%%-------------------------------------------------------------------- +all_leaves({}) -> + []; +all_leaves({_,[{_, _}|_] = ChildNodes}) -> + lists:flatmap(fun(ChildNode)-> + all_leaves(ChildNode) + end, ChildNodes); +all_leaves({_, Leaves}) -> + Leaves. + +%%-------------------------------------------------------------------- +-spec collect_qualifiers(policy_tree(), Policy::public_key:oid()) -> + [{uri, string()} | #'UserNotice'{}]. +%% +%% Collect qualifiers from tree branch asserting Policy +%%-------------------------------------------------------------------- +collect_qualifiers({_, ChildNodes}, Policy) -> + FormatQualifier = + fun(#'PolicyQualifierInfo'{policyQualifierId = ?'id-qt-unotice', + qualifier = Qualifier}) -> + try public_key:der_decode('UserNotice', Qualifier) of + Notice -> + Notice + catch error:_ -> + handle_too_long_notice(Qualifier) + end; + (#'PolicyQualifierInfo'{policyQualifierId = ?'id-qt-cps', + qualifier = Qualifier}) -> + {uri, public_key:der_decode('CPSuri', Qualifier)} + end, + Collect = fun(#{qualifier_set := QSet}) -> + lists:map(FormatQualifier, QSet) + end, + case collect_children_qualifiers(Collect, ChildNodes, Policy) of + [] -> + collect_children_qualifiers(Collect, ChildNodes, ?anyPolicy); + QSet -> + QSet + end. + +%% -------------------------------------------------------------------- +-spec constrained_policy_node_set(policy_tree()) -> [policy_node()]. + +%% +%% From: PKITS.pdf: +%% If the valid_policy_tree includes a leaf node with a valid_policy +%% of anyPolicy, then the user-constrained-policy-set is +%% any-policy. Otherwise, the user-constrained-policy-set consists of +%% the set containing the valid_policy from each node in the +%% valid_policy_tree in which the valid_policy is not anyPolicy and +%% the valid_policy of that node's parent is anyPolicy. The +%% authorities-constrained-policy-set may be computed using the same +%% procedure on the valid_policy_tree before its intersection with the +%% user-initial-policy-set has been computed (in step g of section 6.1.5). +%% +%% That is this function calculates the valid policy node +%% set after being constrained either by the user or only by the +%% authorities (certificate extensions). +%% -------------------------------------------------------------------- +constrained_policy_node_set({}) -> + []; +constrained_policy_node_set(Tree) -> + case any_leaves(Tree) of + [] -> + constrain(Tree); + AnyLeaves -> + AnyLeaves + end. + +%%-------------------------------------------------------------------- +-spec empty() -> policy_tree(). +%%-------------------------------------------------------------------- +empty() -> + %% The empty tree is refered to as NULL in RFC 5280 + {}. + +%%-------------------------------------------------------------------- +-spec in_set(Policy::public_key:oid(), Set::[policy_node()]) -> boolean(). +%% +%% Is there a node with <Policy> in <Set> +%%-------------------------------------------------------------------- +in_set(_, []) -> + false; +in_set(Policy, [#{valid_policy := Policy} |_]) -> + true; +in_set(Policy, [_ | Rest]) -> + in_set(Policy, Rest). + +%%-------------------------------------------------------------------- +-spec is_empty(policy_tree()) -> boolean(). +%%-------------------------------------------------------------------- +is_empty({}) -> + true; +is_empty(_) -> + false. + +%%-------------------------------------------------------------------- +-spec map_leaves(policy_tree(), LeafFun::function()) -> policy_tree(). +%% +%% Update all leaves as determined by <LeafFun> +%%-------------------------------------------------------------------- +map_leaves({Parent, [{_, _}|_] = ChildNodes}, LeafFun) -> + {Parent, lists:map(fun(ChildNode)-> + map_leaves(ChildNode, LeafFun) + end, ChildNodes)}; +map_leaves({Parent, Leaves}, LeafFun) -> + {Parent, lists:map(LeafFun, Leaves)}. + +%%-------------------------------------------------------------------- +-spec prune_leaves(policy_tree(), Policy::public_key:oid()) -> policy_tree(). +%% +%% Delete all leaves with the valid_policy <Policy> in a pruned policy tree +%%-------------------------------------------------------------------- +prune_leaves({} = Empty, _) -> + Empty; +prune_leaves({_, _} = Tree, Policy) -> + LeafFun = fun(#{valid_policy := ValidPolicy} = Node) -> + case ValidPolicy of + Policy -> + false; + _ -> + {true, Node} + end + end, + filter_leaves(Tree, LeafFun). + +%%-------------------------------------------------------------------- +-spec prune_tree(policy_tree()) -> policy_tree(). +%% +%% Delete branches that are shorher than the total depth of the tree. +%%-------------------------------------------------------------------- +prune_tree({} = Empty) -> + Empty; +prune_tree({_, []}) -> + empty(); +prune_tree({Root, ChildNodes}) -> + case prune_children(ChildNodes) of + [] -> + empty(); + NewChildNodes -> + {Root, NewChildNodes} + end. + +%%-------------------------------------------------------------------- +-spec prune_invalid_nodes(policy_tree(), [policy_node()]) -> policy_tree(). +%% +%% Delete all invalid policy nodes and their children. +%%-------------------------------------------------------------------- +prune_invalid_nodes(Tree, []) -> + Tree; +prune_invalid_nodes({Root, ChildNodes}, InvalidNodes) -> + case prune_invalid_nodes_children(ChildNodes, InvalidNodes) of + [] -> %% No leaves left the tree becomes empty + empty(); + NewChildNodes -> %% Keep root that is always ?anyPolicy + {Root, NewChildNodes} + end. +%%-------------------------------------------------------------------- +-spec policy_node(public_key:oid(), term(), [public_key:oid()]) -> policy_node(). +%% +%% Creates a policy node +%%-------------------------------------------------------------------- +policy_node(ValidPolicy, Qualifiers, ExpPolicySet) -> + QualifierSet = + case Qualifiers of + asn1_NOVALUE -> + []; + _ -> + Qualifiers + end, + #{valid_policy => ValidPolicy, + qualifier_set => QualifierSet, + expected_policy_set => ExpPolicySet}. + +%%-------------------------------------------------------------------- +-spec root() -> policy_tree(). +%% +%% Create initial root node used as start value when building the policy tree. +%%-------------------------------------------------------------------- +root() -> + {any_policy_node(), []}. + +%%-------------------------------------------------------------------- +-spec valid_policy_node_set(policy_tree()) -> [policy_node()]. +%% +%% Determine the set of policy nodes whose parent nodes have a +%% valid_policy of anyPolicy. This is the valid_policy_node_set. +%%-------------------------------------------------------------------- +valid_policy_node_set({#{valid_policy := ?anyPolicy}, [{_, _}| _] = ChildNodes}) -> + Parents = [Parent || {Parent, _} <- ChildNodes], + Parents ++ lists:foldl(fun(ChildNode, Acc) -> + valid_policy_node_set(ChildNode) ++ Acc + end, [], ChildNodes); +valid_policy_node_set({#{valid_policy := ?anyPolicy}, Leaves}) when is_list(Leaves) -> + Leaves; +valid_policy_node_set(_) -> + []. + +%%%=================================================================== +%%% Internal functions +%%%=================================================================== +any_policy_node() -> + policy_node(?anyPolicy, [], [?anyPolicy]). + +collect_children_qualifiers(_, [], _) -> + []; +collect_children_qualifiers(Collect, [{#{expected_policy_set := Set}, _} = ChildNode | ChildNodes], + Policy) -> + case lists:member(Policy, Set) of + true -> + lists:flatten(children_collect(Collect, ChildNode)); + false -> + collect_children_qualifiers(Collect, ChildNodes, Policy) + end; +collect_children_qualifiers(Collect, ChildNodes, _) -> + lists:flatten(children_collect(Collect, ChildNodes)). + +children_collect(Collect, {Parent, ChildNodes}) -> + Collect(Parent) ++ children_collect(Collect, ChildNodes); +children_collect(Collect, [ {_,_} = ChildNode | ChildNodes]) -> + children_collect(Collect, ChildNode) ++ children_collect(Collect, ChildNodes); +children_collect(Collect, Leaves) -> + lists:map(Collect, Leaves). + +constrain({#{valid_policy := ?anyPolicy}, [{_, _}| _] = ChildNodes}) -> + Parents = [Parent || {Parent, _} <- ChildNodes], + lists:filtermap(fun(#{valid_policy := ?anyPolicy}) -> + false; + (Node) -> + {true, Node} + end, Parents) ++ + lists:foldl(fun(Child, Acc) -> + constrain(Child) ++ Acc + end, [], ChildNodes); +constrain({#{valid_policy := ?anyPolicy}, Leaves}) when is_list(Leaves) -> + lists:filtermap(fun(#{valid_policy := ?anyPolicy}) -> + false; + (Node) -> + {true, Node} + end, Leaves); +constrain(_) -> + []. + +filter_leaves({Parent,[{_, _}|_] = ChildNodes}, LeafFun) -> + {Parent, lists:map(fun(ChildNode)-> + filter_leaves(ChildNode, LeafFun) + end, ChildNodes)}; +filter_leaves({Parent, Leaves}, LeafFun) -> + {Parent, lists:filtermap(LeafFun, Leaves)}. + +keep_policy_node(#{valid_policy := ?anyPolicy} = Node, _) -> + {true, Node}; +keep_policy_node(Node, InvalidNodes) -> + case lists:member(Node, InvalidNodes) of + true -> + false; + false -> + {true, Node} + end. + +prune_children(ChildNodes) when is_list(ChildNodes) -> + lists:filtermap(fun({Parent, Children}) -> + case prune_nodes(Parent, Children) of + {Parent, []} -> + false; + {Parent, NewChildren} -> + {true, {Parent, NewChildren}} + end; + (Leaf) -> + {true, Leaf} + end, ChildNodes). + +prune_nodes(Parent, Children) -> + {Parent, prune_children(Children)}. + +prune_invalid_nodes_children(ChildNodes, InvalidNodes) when is_list(ChildNodes)-> + lists:filtermap(fun({Parent, Children}) -> + case keep_policy_node(Parent, InvalidNodes) of + false -> %% Prune subtree + false; + {true, #{valid_policy := ?anyPolicy} = Parent} -> %% Keep Parent + {true, {Parent, + prune_invalid_nodes_children(Children, InvalidNodes)}}; + {true, Parent} -> + {true, {Parent, Children}} %% Keep subtree + end; + (#{} = Child) -> % Possibly prune leaf + keep_policy_node(Child, InvalidNodes) + end, ChildNodes). + +handle_too_long_notice(Qualifier) -> + %% RFC 3280 states that certificate users SHOULD gracefully handle + %% explicitText with more than 200 characters. + try public_key:der_decode('OTPUserNotice', Qualifier) of % Allow real value up to 350 + #'OTPUserNotice'{noticeRef = Ref, + explicitText = DispText} -> + #'UserNotice'{noticeRef = Ref, + explicitText = DispText} + catch error:_ -> %% Otherwhise return gracefully default + #'UserNotice'{noticeRef = asn1_NOVALUE, + explicitText = "User Notice much too long, so value is ignored"} + end. diff --git a/lib/public_key/src/public_key.app.src b/lib/public_key/src/public_key.app.src index 5d8f936e33..345b7554c2 100644 --- a/lib/public_key/src/public_key.app.src +++ b/lib/public_key/src/public_key.app.src @@ -1,23 +1,24 @@ {application, public_key, [{description, "Public key infrastructure"}, {vsn, "%VSN%"}, - {modules, [ public_key, - pubkey_pem, - pubkey_pbe, - pubkey_ssh, - pubkey_cert, - pubkey_cert_records, - pubkey_crl, - pubkey_ocsp, - pubkey_os_cacerts, - 'OTP-PUB-KEY', - 'PKCS-FRAME' - ]}, + {modules, [public_key, + pubkey_pem, + pubkey_pbe, + pubkey_ssh, + pubkey_cert, + pubkey_policy_tree, + pubkey_cert_records, + pubkey_crl, + pubkey_ocsp, + pubkey_os_cacerts, + 'OTP-PUB-KEY', + 'PKCS-FRAME' + ]}, {applications, [asn1, crypto, kernel, stdlib]}, {registered, []}, {env, []}, {runtime_dependencies, ["stdlib-3.5","kernel-3.0","erts-6.0","crypto-4.6", "asn1-3.0"]} - ] + ] }. diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl index 33b404089a..35ef83f58a 100644 --- a/lib/public_key/src/public_key.erl +++ b/lib/public_key/src/public_key.erl @@ -90,25 +90,27 @@ %%---------------------------------------------------------------- %% Types --export_type([public_key/0, - private_key/0, - pem_entry/0, - pki_asn1_type/0, - asn1_type/0, - der_encoded/0, - key_params/0, - digest_type/0, - issuer_name/0, +-export_type([asn1_type/0, + bad_cert_reason/0, cert/0, - combined_cert/0, cert_id/0, - oid/0, cert_opt/0, chain_opts/0, + combined_cert/0, conf_opt/0, + der_encoded/0, + digest_type/0, + issuer_name/0, + key_params/0, + oid/0, + pem_entry/0, + pki_asn1_type/0, + policy_node/0, + private_key/0, + public_key/0, test_config/0, - test_root_cert/0]). - + test_root_cert/0 + ]). -type public_key() :: rsa_public_key() | rsa_pss_public_key() | dsa_public_key() | ec_public_key() | ed_public_key() . -type private_key() :: rsa_private_key() | rsa_pss_private_key() | dsa_private_key() | ec_private_key() | ed_private_key() . @@ -160,11 +162,16 @@ -type oid() :: tuple(). -type cert_id() :: {SerialNr::integer(), issuer_name()} . -type issuer_name() :: {rdnSequence,[[#'AttributeTypeAndValue'{}]]} . --type bad_cert_reason() :: cert_expired | invalid_issuer | invalid_signature | name_not_permitted | missing_basic_constraint | invalid_key_usage | duplicate_cert_in_path | {revoked, crl_reason()} | atom(). +-type bad_cert_reason() :: cert_expired | invalid_issuer | invalid_signature | name_not_permitted | missing_basic_constraint | invalid_key_usage | duplicate_cert_in_path | + {'policy_requirement_not_met', term()} | {'invalid_policy_mapping', term()} | {revoked, crl_reason()} | atom(). -type combined_cert() :: #cert{}. -type cert() :: der_cert() | otp_cert(). -type der_cert() :: der_encoded(). +-type policy_node() :: + #{valid_policy := public_key:oid(), + qualifier_set := [#'UserNotice'{}| {uri, string()}], + expected_policy_set := [public_key:oid()]}. -type otp_cert() :: #'OTPCertificate'{}. -type public_key_info() :: {key_oid_name(), rsa_public_key() | #'ECPoint'{} | dss_public_key(), public_key_params()}. -type key_oid_name() :: 'rsaEncryption' | 'id-RSASSA-PSS' | 'id-ecPublicKey' | 'id-Ed25519' | 'id-Ed448' | 'id-dsa'. @@ -1134,14 +1141,14 @@ pkix_normalize_name(Issuer) -> %%-------------------------------------------------------------------- -spec pkix_path_validation(Cert, CertChain, Options) -> - {ok, {PublicKeyInfo, PolicyTree}} | + {ok, {PublicKeyInfo, ConstrainedPolicyNodes}} | {error, {bad_cert, Reason :: bad_cert_reason()}} when Cert :: cert() | atom(), CertChain :: [cert() | combined_cert()], Options :: [{max_path_length, integer()} | {verify_fun, {fun(), term()}}], PublicKeyInfo :: public_key_info(), - PolicyTree :: list(). + ConstrainedPolicyNodes :: [policy_node()]. %% Description: Performs a basic path validation according to RFC 5280. %%-------------------------------------------------------------------- @@ -1580,7 +1587,16 @@ path_validation([], #path_validation_state{working_public_key_algorithm = PublicKeyParams, valid_policy_tree = Tree }) -> - {ok, {{Algorithm, PublicKey, PublicKeyParams}, Tree}}; + ValidPolicyNodeSet0 = pubkey_policy_tree:constrained_policy_node_set(Tree), + CollectQualifiers = fun(#{expected_policy_set := PolicySet} = Node) -> + QF = fun(Policy) -> + pubkey_policy_tree:collect_qualifiers(Tree, Policy) + end, + Qualifiers = lists:flatmap(QF, PolicySet), + Node#{qualifier_set => Qualifiers} + end, + ValidPolicyNodeSet = lists:map(CollectQualifiers, ValidPolicyNodeSet0), + {ok, {{Algorithm, PublicKey, PublicKeyParams}, ValidPolicyNodeSet}}; path_validation([DerCert | Rest], ValidationState = #path_validation_state{ max_path_length = Len}) when Len >= 0 -> diff --git a/lib/public_key/test/pkits_SUITE.erl b/lib/public_key/test/pkits_SUITE.erl index baa212ff65..0cd7feb58f 100644 --- a/lib/public_key/test/pkits_SUITE.erl +++ b/lib/public_key/test/pkits_SUITE.erl @@ -14,7 +14,7 @@ %% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. %% See the License for the specific language governing permissions and %% limitations under the License. -%% +%% %% %CopyrightEnd% %% @@ -167,18 +167,102 @@ valid_uri_name_constraints/0, whitespace_name_chain/1, whitespace_name_chain/0, - - %% Marked as "Not supported yet": - certificate_policies/0, - certificate_policies/1, - require_explicit_policy/0, - require_explicit_policy/1, - policy_mappings/0, - policy_mappings/1, - inhibit_policy_mapping/0, - inhibit_policy_mapping/1, - inhibit_any_policy/0, - inhibit_any_policy/1 + certificate_all_same_policy/0, + certificate_all_same_policy/1, + certificate_no_policies/0, + certificate_no_policies/1, + certificate_different_policies_first_ca/0, + certificate_different_policies_first_ca/1, + certificate_different_policies_end_entity/0, + certificate_different_policies_end_entity/1, + certificate_different_policies_second_ca/0, + certificate_different_policies_second_ca/1, + certificate_overlapping_policies/0, + certificate_overlapping_policies/1, + certificate_different_policies_no_overlapp_7/0, + certificate_different_policies_no_overlapp_7/1, + certificate_different_policies_no_overlapp_8/0, + certificate_different_policies_no_overlapp_8/1, + certificate_different_policies_no_overlapp_9/0, + certificate_different_policies_no_overlapp_9/1, + certificate_all_same_policies/0, + certificate_all_same_policies/1, + certificate_all_any_policy/0, + certificate_all_any_policy/1, + certificate_different_policies/0, + certificate_different_policies/1, + certificate_all_same_policies_13/0, + certificate_all_same_policies_13/1, + certificate_any_policy/0, + certificate_any_policy/1, + certificate_user_notice_qualifier_15/0, + certificate_user_notice_qualifier_15/1, + certificate_user_notice_qualifier_16/0, + certificate_user_notice_qualifier_16/1, + certificate_user_notice_qualifier_17/0, + certificate_user_notice_qualifier_17/1, + certificate_user_notice_qualifier_18/0, + certificate_user_notice_qualifier_18/1, + certificate_user_notice_qualifier_19/0, + certificate_user_notice_qualifier_19/1, + certificate_cps_pointer_qualifier/0, + certificate_cps_pointer_qualifier/1, + require_explicit_valid_empty/0, + require_explicit_valid_empty/1, + require_explicit_valid/0, + require_explicit_valid/1, + require_explicit_invalid/0, + require_explicit_invalid/1, + require_explicit_valid_selfissued/0, + require_explicit_valid_selfissued/1, + require_explicit_invalid_selfissued/0, + require_explicit_invalid_selfissued/1, + valid_policy_mapping/0, + valid_policy_mapping/1, + invalid_policy_mapping_2/0, + invalid_policy_mapping_2/1, + valid_policy_mapping_3/0, + valid_policy_mapping_3/1, + invalid_policy_mapping_4/0, + invalid_policy_mapping_4/1, + valid_policy_mapping_5/0, + valid_policy_mapping_5/1, + valid_policy_mapping_6/0, + valid_policy_mapping_6/1, + invalid_policy_mapping_7/0, + invalid_policy_mapping_7/1, + invalid_policy_mapping_8/0, + invalid_policy_mapping_8/1, + valid_policy_mapping_9/0, + valid_policy_mapping_9/1, + invalid_policy_mapping_10/0, + invalid_policy_mapping_10/1, + valid_policy_mapping_11/0, + valid_policy_mapping_11/1, + valid_policy_mapping_12/0, + valid_policy_mapping_12/1, + valid_policy_mapping_13/0, + valid_policy_mapping_13/1, + valid_policy_mapping_14/0, + valid_policy_mapping_14/1, + inhibit_mapping_invalid/0, + inhibit_mapping_invalid/1, + inhibit_mapping_valid/0, + inhibit_mapping_valid/1, + inhibit_mapping_valid_selfissued/0, + inhibit_mapping_valid_selfissued/1, + inhibit_mapping_invalid_selfissued/0, + inhibit_mapping_invalid_selfissued/1, + inhibit_any_invalid_empty/0, + inhibit_any_invalid_empty/1, + inhibit_any_valid/0, + inhibit_any_valid/1, + inhibit_any_invalid/0, + inhibit_any_invalid/1, + inhibit_any_valid_selfissued/0, + inhibit_any_valid_selfissued/1, + inhibit_any_invalid_selfissued/0, + inhibit_any_invalid_selfissued/1 ]). -define(error(Format,Args), error(Format,Args,?FILE,?LINE)). @@ -198,10 +282,23 @@ -define(NIST5, "2.16.840.1.101.3.2.1.48.5"). -define(NIST6, "2.16.840.1.101.3.2.1.48.6"). +-define(NIST1_OID, {2,16,840,1,101,3,2,1,48,1}). +-define(NIST2_OID, {2,16,840,1,101,3,2,1,48,2}). +-define(NIST3_OID, {2,16,840,1,101,3,2,1,48,3}). +-define(NIST4_OID, {2,16,840,1,101,3,2,1,48,4}). +-define(NIST5_OID, {2,16,840,1,101,3,2,1,48,5}). +-define(NIST6_OID, {2,16,840,1,101,3,2,1,48,6}). +-define(NIST7_OID, {2,16,840,1,101,3,2,1,48,7}). +-define(NIST8_OID, {2,16,840,1,101,3,2,1,48,8}). + +-define(POLICY_ROOT, [[{expected_policy_set,[?anyPolicy]}, + {valid_policy, ?anyPolicy} + ]]). + -record(verify_state, { - crls, - crl_paths, - revoke_state}). + crls, + crl_paths, + revoke_state}). %%-------------------------------------------------------------------- %% Common Test interface functions ----------------------------------- %%-------------------------------------------------------------------- @@ -209,7 +306,7 @@ suite() -> []. -all() -> +all() -> [{group, signature_verification}, {group, validity_periods}, {group, verifying_name_chaining}, @@ -220,9 +317,15 @@ all() -> {group, verifying_basic_constraints}, {group, key_usage}, {group, name_constraints}, - {group, private_certificate_extensions}]. + {group, private_certificate_extensions}, + {group, policies}, + {group, require_explicit_policy}, + {group, policy_mappings}, + {group, inhibit_policy_mapping}, + {group, inhibit_any_policy} + ]. -groups() -> +groups() -> [{signature_verification, [], [valid_rsa_signature, invalid_rsa_signature, valid_dsa_signature, invalid_dsa_signature]}, @@ -261,7 +364,68 @@ groups() -> invalid_dns_name_constraints, valid_uri_name_constraints, invalid_uri_name_constraints]}, {private_certificate_extensions, [], - [unknown_critical_extension, unknown_not_critical_extension]} + [unknown_critical_extension, unknown_not_critical_extension]}, + {policies, [], [certificate_all_same_policy, + certificate_no_policies, + certificate_different_policies_first_ca, + certificate_different_policies_end_entity, + certificate_different_policies_second_ca, + certificate_overlapping_policies, + certificate_different_policies_no_overlapp_7, + certificate_different_policies_no_overlapp_8, + certificate_different_policies_no_overlapp_9, + certificate_all_same_policies, + certificate_all_any_policy, + certificate_different_policies, + certificate_all_same_policies_13, + certificate_any_policy, + certificate_user_notice_qualifier_15, + certificate_user_notice_qualifier_16, + certificate_user_notice_qualifier_17, + certificate_user_notice_qualifier_18, + certificate_user_notice_qualifier_19, + certificate_cps_pointer_qualifier + ]}, + {require_explicit_policy, [], + [ + require_explicit_valid_empty, + require_explicit_valid, + require_explicit_invalid, + require_explicit_valid_selfissued, + require_explicit_invalid_selfissued + ]}, + {policy_mappings, [], + [ + valid_policy_mapping, + invalid_policy_mapping_2, + valid_policy_mapping_3, + invalid_policy_mapping_4, + valid_policy_mapping_5, + valid_policy_mapping_6, + invalid_policy_mapping_7, + invalid_policy_mapping_8, + valid_policy_mapping_9, + invalid_policy_mapping_10, + valid_policy_mapping_11, + valid_policy_mapping_12, + valid_policy_mapping_13, + valid_policy_mapping_14 + ]}, + {inhibit_policy_mapping, [], + [ + inhibit_mapping_invalid, + inhibit_mapping_valid, + inhibit_mapping_valid_selfissued, + inhibit_mapping_invalid_selfissued + ]}, + {inhibit_any_policy, [], + [ + inhibit_any_invalid_empty, + inhibit_any_valid, + inhibit_any_invalid, + inhibit_any_valid_selfissued, + inhibit_any_invalid_selfissued + ]} ]. %%-------------------------------------------------------------------- @@ -419,13 +583,13 @@ missing_CRL() -> [{doc,"Test basic CRL handling"}]. missing_CRL(Config) when is_list(Config) -> run([{ "4.4.1", "Invalid Missing CRL Test1 EE",{bad_cert, - revocation_status_undetermined}}]). + revocation_status_undetermined}}]). revoked_CA() -> [{doc,"Test basic CRL handling"}]. revoked_CA(Config) when is_list(Config) -> run([{ "4.4.2", "Invalid Revoked CA Test2 EE", {bad_cert, - {revoked, keyCompromise}}}]). + {revoked, keyCompromise}}}]). revoked_peer() -> [{doc,"Test basic CRL handling"}]. @@ -437,7 +601,7 @@ invalid_CRL_signature() -> [{doc,"Test basic CRL handling"}]. invalid_CRL_signature(Config) when is_list(Config) -> run([{ "4.4.4", "Invalid Bad CRL Signature Test4 EE", - {bad_cert, revocation_status_undetermined}}]). + {bad_cert, revocation_status_undetermined}}]). invalid_CRL_issuer() -> [{doc,"Test basic CRL handling"}]. invalid_CRL_issuer(Config) when is_list(Config) -> @@ -565,31 +729,509 @@ valid_key_usage() -> valid_key_usage(Config) when is_list(Config) -> run([{ "4.7.3", "Valid keyUsage Not Critical Test3 EE", ok}]). +%%-----------------------------Certificate Policies------------------------------------- +certificate_all_same_policy() -> + [{doc,"Certificate all same policy tests"}]. +certificate_all_same_policy(Config) when is_list(Config) -> + run([{"4.8.1.1", "Valid Certificate Path Test1 EE", ok}, + {"4.8.1.2", "Valid Certificate Path Test1 EE", ok}, + {"4.8.1.3", "Valid Certificate Path Test1 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}}, + {"4.8.1.4", "Valid Certificate Path Test1 EE", ok}]). + +certificate_no_policies() -> + [{doc,"In this test, the certificatePolicies extension is omitted from " + "every certificate in the path."}]. +certificate_no_policies(Config) when is_list(Config) -> + run([{"4.8.2.1", "All Certificates No Policies Test2 EE ", ok}, + {"4.8.2.2", "All Certificates No Policies Test2 EE ", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}}]). + +certificate_different_policies_first_ca() -> + [{doc,"In this test, every certificate in the path asserts the same certificate " + "policy except the first certificate in the path."}]. +certificate_different_policies_first_ca(Config) when is_list(Config) -> + run([{"4.8.3.1", "Different Policies Test3 EE", ok}, + {"4.8.3.2", "Different Policies Test3 EE ", {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}}, + {"4.8.3.3", "Different Policies Test3 EE", {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}} + ]). + +certificate_different_policies_end_entity() -> + [{doc,"In this test, every certificate in the path asserts the same certificate policy " + "except the end entity certificate"}]. +certificate_different_policies_end_entity(Config) when is_list(Config) -> + run([{"4.8.4", "Different Policies Test4 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}} + ]). + +certificate_different_policies_second_ca() -> + [{doc,"In this test, every certificate in the path except the second certificate asserts the same policy."}]. +certificate_different_policies_second_ca(Config) when is_list(Config) -> + run([{"4.8.5", "Different Policies Test5 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}} + ]). + +certificate_overlapping_policies() -> + [{doc,"The following path is such that the intersection of certificate policies among " + "all the certificates has exactly one policy, NIST-test-policy-1"}]. +certificate_overlapping_policies(Config) when is_list(Config) -> + run([{"4.8.6.1", "Overlapping Policies Test6 EE", ok}, + {"4.8.6.2", "Overlapping Policies Test6 EE", ok}, + {"4.8.6.3", "Overlapping Policies Test6 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}} + ]). + + +certificate_different_policies_no_overlapp_7() -> + [{doc,""}]. +certificate_different_policies_no_overlapp_7(Config) when is_list(Config) -> + run([{"4.8.7", "Different Policies Test7 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}} + ]). + + +certificate_different_policies_no_overlapp_8() -> + [{doc,""}]. +certificate_different_policies_no_overlapp_8(Config) when is_list(Config) -> + run([{"4.8.8", "Different Policies Test8 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}} + ]). + +certificate_different_policies_no_overlapp_9() -> + [{doc,""}]. +certificate_different_policies_no_overlapp_9(Config) when is_list(Config) -> + run([{"4.8.9", "Different Policies Test9 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}} + ]). + +certificate_all_same_policies() -> + [{doc,"Certificate all same policies tests"}]. +certificate_all_same_policies(Config) when is_list(Config) -> + run([{"4.8.10.1", "All Certificates Same Policies Test10 EE", ok}, + {"4.8.10.2", "All Certificates Same Policies Test10 EE", ok}, + {"4.8.10.3", "All Certificates Same Policies Test10 EE", ok}]). + +certificate_all_any_policy() -> + [{doc,"Every certificate in the path asserts the special policy anyPolicy"}]. +certificate_all_any_policy(Config) when is_list(Config) -> + run([{"4.8.11.1", "All Certificates anyPolicy Test11 EE", ok}, + {"4.8.11.2", "All Certificates anyPolicy Test11 EE", ok}]). + +certificate_different_policies() -> + [{doc,"Every certificate in the path asserts the special policy anyPolicy"}]. +certificate_different_policies(Config) when is_list(Config) -> + run([{"4.8.12", "Different Policies Test12 EE", {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}}]). +certificate_all_same_policies_13() -> + [{doc,"In this test, every certificate in the path asserts the same policies, NIST-test-policy-1, " + "NIST-testpolicy-2, and NIST-test-policy-3"}]. +certificate_all_same_policies_13(Config) when is_list(Config) -> + run([{"4.8.13.1", "All Certificates Same Policies Test13 EE", ok}, + {"4.8.13.2", "All Certificates Same Policies Test13 EE", ok}, + {"4.8.13.3", "All Certificates Same Policies Test13 EE", ok} + ]). + +certificate_any_policy() -> + [{doc,"In this test, the intermediate certificate asserts anyPolicy and the end entity certificate " + "asserts NIST-test-policy-1"}]. +certificate_any_policy(Config) when is_list(Config) -> + run([{"4.8.14.1", "AnyPolicy Test14 EE", ok}, + {"4.8.14.2", "AnyPolicy Test14 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy, 0}, + {policy_set, []}}}}} + ]). + +certificate_user_notice_qualifier_15() -> + [{doc, "In this test, the path consists of a single certificate. " + "The certificate asserts the policy NIST-testpolicy-1 and includes " + "a user notice policy qualifier."}]. +certificate_user_notice_qualifier_15(Config) when is_list(Config) -> + run([{"4.8.15", "User Notice Qualifier Test15 EE", ok}]). + +certificate_user_notice_qualifier_16() -> + [{doc, "In this test, the path consists of an intermediate certificate " + "and an end entity certificate. The intermediate certificate asserts " + "the policy NIST-test-policy-1. The end entity certificate asserts " + "both NIST-test-policy-1 and NIST-test-policy-2. Each policy in the " + "end entity certificate has a different user notice qualifier associated with it."}]. +certificate_user_notice_qualifier_16(Config) when is_list(Config) -> + run([{"4.8.16", "User Notice Qualifier Test16 EE", ok}]). + +certificate_user_notice_qualifier_17() -> + [{doc, "In this test, the path consists of an intermediate certificate and an end entity " + "certificate. The intermediate certificate asserts the policy NIST-test-policy-1. The " + "end entity certificate asserts anyPolicy. There is a user notice policy qualifier " + "associated with anyPolicy in the end entity certificate"}]. +certificate_user_notice_qualifier_17(Config) when is_list(Config) -> + run([{"4.8.17", "User Notice Qualifier Test17 EE", ok}]). + +certificate_user_notice_qualifier_18() -> + [{doc, "In this test, the intermediate certificate asserts policies" + "NIST-test-policy-1 and NIST-test-policy-2. The end certificate " + "asserts NIST-test-policy-1 and anyPolicy. Each of the policies in the end ", + "entity certificate asserts a different user notice policy qualifier. " + "If possible, it is recommended that the certification path in this " + "test be validated using the following inputs"}]. +certificate_user_notice_qualifier_18(Config) when is_list(Config)-> + run([{"4.8.18.1", "User Notice Qualifier Test18 EE", ok}, + {"4.8.18.2", "User Notice Qualifier Test18 EE", ok} + ]). + +certificate_user_notice_qualifier_19() -> + [{doc, "In this test, the path consists of a single certificate." + "The certificate asserts the policy NIST-testpolicy-1 and " + "includes a user notice policy qualifier. The user notice qualifier contains explicit text " + "that is longer than 200 bytes. "}]. +certificate_user_notice_qualifier_19(Config) when is_list(Config)-> + run([{"4.8.19", "User Notice Qualifier Test19 EE", ok}]). + +certificate_cps_pointer_qualifier() -> + [{doc, "In this test, the path consists of an intermediate certificate and an end entity " + "certificate, both of which assert the policy NIST-test-policy-1. There is a CPS pointer " + "policy qualifier associated with NIST-test-policy-1 in the end entity certificate. "}]. +certificate_cps_pointer_qualifier(Config) when is_list(Config)-> + run([{"4.8.20", "CPS Pointer Qualifier Test20 EE", ok}]). + + + +%%-----------------------------Require explicit policy ------------------------- + +require_explicit_valid_empty() -> + [{doc, "The path should validate successfully since the explicit-policyindicator is not set"}]. +require_explicit_valid_empty(Config) when is_list(Config)-> + run([{ "4.9.1", "Valid requireExplicitPolicy Test1 EE", ok}, + { "4.9.2", "Valid requireExplicitPolicy Test2 EE ", ok} + ]). + +require_explicit_valid() -> + [{doc, "The path should validate successfully (as long as the initial-policy-set " + "is either any-policy or otherwise includes NIST-test-policy-1) since " + "the user-constrained-policy-set is not empty."}]. +require_explicit_valid(Config) when is_list(Config)-> + run([{ "4.9.4", "Valid requireExplicitPolicy Test4 EE ", ok} + ]). + +require_explicit_invalid() -> + [{doc, "The path should not validate successfully since the explicit-policyindicator is set " + "and the authorities-constrained-policy-set is empty. "}]. +require_explicit_invalid(Config) when is_list(Config)-> + run([{ "4.9.3", "Invalid requireExplicitPolicy Test3 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + {"4.9.5", "Invalid requireExplicitPolicy Test5 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). +require_explicit_valid_selfissued() -> + [{doc, "The path should validate successfully since the explicit-policyindicator is not set"}]. +require_explicit_valid_selfissued(Config) when is_list(Config)-> + run([{ "4.9.6", "Valid Self-Issued requireExplicitPolicy Test6 EE", ok} + ]). + +require_explicit_invalid_selfissued() -> + [{doc, "The path should not validate successfully since the explicit-policyindicator " + "is set and the authorities-constrained-policy-set is empty"}]. +require_explicit_invalid_selfissued(Config) when is_list(Config)-> + run([{ "4.9.7", "Invalid Self-Issued requireExplicitPolicy Test7 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.9.8", "Invalid Self-Issued requireExplicitPolicy Test8 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). %%----------------------------------------------------------------------------- -certificate_policies() -> - [{doc,"Not supported yet"}]. -certificate_policies(Config) when is_list(Config) -> - run(certificate_policies_tests()). -%%----------------------------------------------------------------------------- -require_explicit_policy() -> - [{doc,"Not supported yet"}]. -require_explicit_policy(Config) when is_list(Config) -> - run(require_explicit_policy_tests()). -%%----------------------------------------------------------------------------- -policy_mappings() -> - [{doc,"Not supported yet"}]. -policy_mappings(Config) when is_list(Config) -> - run(policy_mappings_tests()). -%%----------------------------------------------------------------------------- -inhibit_policy_mapping() -> - [{doc,"Not supported yet"}]. -inhibit_policy_mapping(Config) when is_list(Config) -> - run(inhibit_policy_mapping_tests()). -%%----------------------------------------------------------------------------- -inhibit_any_policy() -> - [{doc,"Not supported yet"}]. -inhibit_any_policy(Config) when is_list(Config) -> - run(inhibit_any_policy_tests()). + +valid_policy_mapping() -> + [{doc, ""}]. +valid_policy_mapping(Config) when is_list(Config)-> + run([{"4.10.1.1", "Valid Policy Mapping Test1 EE", ok}, + {"4.10.1.2", "Valid Policy Mapping Test1 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + {"4.10.1.3", "Valid Policy Mapping Test1 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +invalid_policy_mapping_2() -> + [{doc, ""}]. +invalid_policy_mapping_2(Config) when is_list(Config)-> + run([{"4.10.2.1", "Invalid Policy Mapping Test2 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + {"4.10.2.2", "Invalid Policy Mapping Test2 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +valid_policy_mapping_3() -> + [{doc, ""}]. +valid_policy_mapping_3(Config) when is_list(Config)-> + run([{"4.10.3.1", "Valid Policy Mapping Test3 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.10.3.2", "Valid Policy Mapping Test3 EE", ok} + ]). + +invalid_policy_mapping_4() -> + [{doc, ""}]. +invalid_policy_mapping_4(Config) when is_list(Config)-> + run([{"4.10.4", "Invalid Policy Mapping Test4 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +valid_policy_mapping_5() -> + [{doc, ""}]. +valid_policy_mapping_5(Config) when is_list(Config)-> + run([{"4.10.5.1", "Valid Policy Mapping Test5 EE", ok}, + {"4.10.5.2", "Valid Policy Mapping Test5 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +valid_policy_mapping_6() -> + [{doc, ""}]. +valid_policy_mapping_6(Config) when is_list(Config)-> + run([{"4.10.6.1", "Valid Policy Mapping Test6 EE", ok}, + {"4.10.6.2", "Valid Policy Mapping Test6 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +invalid_policy_mapping_7() -> + [{doc, "In this test, the intermediate certificate includes a policyMappings extension " + "that includes a mapping in which the issuerDomainPolicy is anyPolicy. The intermediate " + "certificate also includes a critical policyConstraints extension with requireExplicitPolicy " + "set to 0. "}]. +invalid_policy_mapping_7(Config) when is_list(Config)-> + run([{"4.10.7", "Invalid Mapping From anyPolicy Test7 EE", + {bad_cert, + {invalid_policy_mapping, + #'PolicyMappings_SEQOF'{ + issuerDomainPolicy = ?anyPolicy, + subjectDomainPolicy = oidify(?NIST1) + }}}} + ]). +invalid_policy_mapping_8() -> + [{doc, "In this test, the intermediate certificate includes a policyMappings " + "extension that includes a mapping in which the subjectDomainPolicy is anyPolicy. " + "The intermediate certificate also includes a critical policyConstraints extension with " + "requireExplicitPolicy set to 0. "}]. +invalid_policy_mapping_8(Config) when is_list(Config)-> + run([{"4.10.8", "Invalid Mapping To anyPolicy Test8 EE", + {bad_cert, + {invalid_policy_mapping, + #'PolicyMappings_SEQOF'{ + issuerDomainPolicy = oidify(?NIST1), + subjectDomainPolicy = ?anyPolicy}}}} + ]). + +valid_policy_mapping_9() -> + [{doc, ""}]. +valid_policy_mapping_9(Config) when is_list(Config)-> + run([{"4.10.9", "Valid Policy Mapping Test9 EE", ok} + ]). + +invalid_policy_mapping_10() -> + [{doc, ""}]. +invalid_policy_mapping_10(Config) when is_list(Config)-> + run([{"4.10.10", "Invalid Policy Mapping Test10 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +valid_policy_mapping_11() -> + [{doc, ""}]. +valid_policy_mapping_11(Config) when is_list(Config)-> + run([{"4.10.11", "Valid Policy Mapping Test11 EE", ok} + ]). + +valid_policy_mapping_12() -> + [{doc, ""}]. +valid_policy_mapping_12(Config) when is_list(Config)-> + run([{"4.10.12.1", "Valid Policy Mapping Test12 EE", ok}, + {"4.10.12.2", "Valid Policy Mapping Test12 EE", ok} + ]). + +valid_policy_mapping_13() -> + [{doc, ""}]. +valid_policy_mapping_13(Config) when is_list(Config)-> + run([{"4.10.13", "Valid Policy Mapping Test13 EE", ok} + ]). + +valid_policy_mapping_14() -> + [{doc, ""}]. +valid_policy_mapping_14(Config) when is_list(Config)-> + run([{ "4.10.14", "Valid Policy Mapping Test14 EE", ok} + ]). + + +%%-------------------Inhibit policy mapping tests ----------------------------- + +inhibit_mapping_invalid() -> + [{doc, ""}]. +inhibit_mapping_invalid(Config) when is_list(Config)-> + run([{ "4.11.1", "Invalid inhibitPolicyMapping Test1 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.11.3", "Invalid inhibitPolicyMapping Test3 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.11.5", "Invalid inhibitPolicyMapping Test5 EE ", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.11.6", "Invalid inhibitPolicyMapping Test6 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +inhibit_mapping_valid() -> + [{doc," "}]. +inhibit_mapping_valid(Config) when is_list(Config) -> + run([{ "4.11.2", "Valid inhibitPolicyMapping Test2 EE", ok}, + { "4.11.4", "Valid inhibitPolicyMapping Test4 EE", ok} + ]). + +inhibit_mapping_valid_selfissued() -> + [{doc, ""}]. +inhibit_mapping_valid_selfissued(Config) when is_list(Config)-> + run([{ "4.11.7", "Valid Self-Issued inhibitPolicyMapping Test7 EE", ok} + ]). + +inhibit_mapping_invalid_selfissued() -> + [{doc, ""}]. +inhibit_mapping_invalid_selfissued(Config) when is_list(Config)-> + run([{ "4.11.8", "Invalid Self-Issued inhibitPolicyMapping Test8 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.11.9", "Invalid Self-Issued inhibitPolicyMapping Test9 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.11.10", "Invalid Self-Issued inhibitPolicyMapping Test10 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.11.11", "Invalid Self-Issued inhibitPolicyMapping Test11 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +%%---------------------- Inhibit any policy tests ------------------------------ + +inhibit_any_invalid_empty() -> + [{doc, ""}]. +inhibit_any_invalid_empty(Config) when is_list(Config)-> + run([{ "4.12.1", "Invalid inhibitAnyPolicy Test1 EE ", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.12.6", "Invalid inhibitAnyPolicy Test6 EE ", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +inhibit_any_valid() -> + [{doc, ""}]. +inhibit_any_valid(Config) when is_list(Config)-> + run([{ "4.12.2", "Valid inhibitAnyPolicy Test2 EE", ok}, + { "4.12.3.1", "inhibitAnyPolicy Test3 EE", ok}, + { "4.12.3.2", "inhibitAnyPolicy Test3 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +inhibit_any_invalid() -> + [{doc, " "}]. +inhibit_any_invalid(Config) when is_list(Config)-> + run([{ "4.12.4", "Invalid inhibitAnyPolicy Test4 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + {"4.12.5", "Invalid inhibitAnyPolicy Test5 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). +inhibit_any_valid_selfissued() -> + [{doc, ""}]. +inhibit_any_valid_selfissued(Config) when is_list(Config)-> + run([{ "4.12.7", "Valid Self-Issued inhibitAnyPolicy Test7 EE", ok}, + { "4.12.9", "Valid Self-Issued inhibitAnyPolicy Test9 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + +inhibit_any_invalid_selfissued() -> + [{doc, ""}]. +inhibit_any_invalid_selfissued(Config) when is_list(Config)-> + run([{ "4.12.8", "Invalid Self-Issued inhibitAnyPolicy Test8 EE", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}}, + { "4.12.10", "Invalid Self-Issued inhibitAnyPolicy Test10 EE ", + {bad_cert, + {policy_requirement_not_met, + {{explicit_policy,0},{policy_set,[]}}}}} + ]). + %%-------------------------------name_constraints---------------------------------------------- valid_DN_name_constraints() -> @@ -680,10 +1322,10 @@ invalid_uri_name_constraints(Config) when is_list(Config) -> delta_without_crl() -> [{doc,"Delta CRL tests"}]. delta_without_crl(Config) when is_list(Config) -> - run([{ "4.15.1", "Invalid deltaCRLIndicator No Base Test1 EE",{bad_cert, - revocation_status_undetermined}}, - {"4.15.10", "Invalid delta-CRL Test10 EE", {bad_cert, - revocation_status_undetermined}}]). + run([{ "4.15.1", "Invalid deltaCRLIndicator No Base Test1 EE",{bad_cert, + revocation_status_undetermined}}, + {"4.15.10", "Invalid delta-CRL Test10 EE", {bad_cert, + revocation_status_undetermined}}]). valid_delta_crls() -> [{doc,"Delta CRL tests"}]. valid_delta_crls(Config) when is_list(Config) -> @@ -722,12 +1364,12 @@ invalid_distribution_points() -> invalid_distribution_points(Config) when is_list(Config) -> run([{ "4.14.2", "Invalid distributionPoint Test2 EE", {bad_cert,{revoked, keyCompromise}}}, { "4.14.3", "Invalid distributionPoint Test3 EE", {bad_cert, - revocation_status_undetermined}}, + revocation_status_undetermined}}, { "4.14.6", "Invalid distributionPoint Test6 EE", {bad_cert,{revoked, keyCompromise}}}, { "4.14.8", "Invalid distributionPoint Test8 EE", {bad_cert, - revocation_status_undetermined}}, + revocation_status_undetermined}}, { "4.14.9", "Invalid distributionPoint Test9 EE", {bad_cert, - revocation_status_undetermined}} + revocation_status_undetermined}} ]). valid_only_contains() -> @@ -829,7 +1471,7 @@ unknown_not_critical_extension(Config) when is_list(Config) -> %%-------------------------------------------------------------------- -spec run([tuple()]) -> ok. -run(Tests) -> +run(Tests) -> [TA] = read_certs("Trust Anchor Root Certificate"), run(Tests, TA). @@ -842,23 +1484,27 @@ run(Tests) -> CertificateBodies :: [binary()]. run({Chap, Test, Result}, TA) -> run({Chap, Test, Result, read_certs(Test)}, TA); - run({Chap, Test, Result, CertsBody}, TA) -> + TestStr = lists:flatten(io_lib:format("Running ~p ~p ~n", [Chap, Test])), + ct:log("~s", [TestStr]), CertChain = cas(Chap) ++ CertsBody, Options = path_validation_options(Chap), try public_key:pkix_path_validation(TA, CertChain, Options) of - {Result, _} -> ok; + {Result, {_, PolicySet}} -> + true = validate_policy_set(Chap, PolicySet); {error,Result} when Result =/= ok -> - ok; + ok; {error, Error} -> ?error(" ~p ~p~n Expected ~p got ~p ~n", [Chap, Test, Result, Error]), fail; {ok, _OK} when Result =/= ok -> - ?error(" ~p ~p~n Expected ~p got ~p ~n", [Chap, Test, Result, ok]), + ?error(" ~p ~p~n Expected ~p got ~p ~n", [Chap, Test, Result, _OK]), fail catch Type:Reason:Stack -> - io:format("Crash ~p:~p in ~p~n",[Type,Reason,Stack]), - io:format(" ~p ~p Expected ~p ~n", [Chap, Test, Result]), + Str1 = lists:flatten(io_lib:format("Crash ~p:~p in ~p~n",[Type,Reason,Stack])), + Str2 = lists:flatten(io_lib:format(" ~p ~p Expected ~p ~n", [Chap, Test, Result])), + erlang:display(Str1), + erlang:display(Str2), exit(crash) end; @@ -867,21 +1513,22 @@ run(Tests,TA) when is_list(Tests) -> ok. path_validation_options(Chap) -> - case needs_crl_options(Chap) of - true -> - crl_options(Chap); - false -> - Fun = - fun(_,{bad_cert, _} = Reason, _) -> - {fail, Reason}; - (_,{extension, _}, UserState) -> - {unknown, UserState}; - (_, Valid, UserState) when Valid == valid; - Valid == valid_peer -> - {valid, UserState} - end, - [{verify_fun, {Fun, []}}] - end. + Options = case needs_crl_options(Chap) of + true -> + crl_options(Chap); + false -> + Fun = + fun(_,{bad_cert, _} = Reason, _) -> + {fail, Reason}; + (_,{extension, _}, UserState) -> + {unknown, UserState}; + (_, Valid, UserState) when Valid == valid; + Valid == valid_peer -> + {valid, UserState} + end, + [{verify_fun, {Fun, []}}] + end, + policy_options(Chap, Options). -spec read_certs(TestCase :: string()) -> [CertificateContent :: binary()]. read_certs(Test) -> @@ -1015,14 +1662,14 @@ crl_path_db([{_, CRL} |CRLs], [Path | Paths], Acc) -> crl_info(_, [], Acc) -> Acc; crl_info(OtpCert, [{_, #'CertificateList'{tbsCertList = - #'TBSCertList'{issuer = Issuer, - crlExtensions = CRLExtensions}}} - = CRL | Rest], Acc) -> + #'TBSCertList'{issuer = Issuer, + crlExtensions = CRLExtensions}}} + = CRL | Rest], Acc) -> OtpTBSCert = OtpCert#'OTPCertificate'.tbsCertificate, Extensions = OtpTBSCert#'OTPTBSCertificate'.extensions, ExtList = pubkey_cert:extensions_list(CRLExtensions), DPs = case pubkey_cert:select_extension(?'id-ce-cRLDistributionPoints', Extensions) of - #'Extension'{extnValue = Value} -> + #'Extension'{extnValue = Value} -> lists:foldl(fun(Point, Acc0) -> Dp = pubkey_cert_records:transform(Point, decode), IDP = pubkey_cert:select_extension(?'id-ce-issuingDistributionPoint', @@ -1090,7 +1737,7 @@ trusted_cert_and_path(_, #'CertificateList'{} = CRL, _, PathDb) -> case lists:keysearch(CRL, 1, PathDb) of {_, {CRL, [ _| _] = Path}} -> - {ok, TrustedCert, [TrustedDERCert | Path]}; + {ok, TrustedCert, [TrustedDERCert | Path]}; {_, {CRL, []}} -> {ok, TrustedCert, [TrustedDERCert]} end. @@ -1107,7 +1754,7 @@ cas(Chap) -> CAS = intermidiate_cas(Chap), lists:foldl(fun([], Acc) -> Acc; - (CA, Acc) -> + (CA, Acc) -> [CACert] = read_certs(CA), [CACert | Acc] end, [], CAS). @@ -1125,8 +1772,14 @@ intermidiate_cas(Chap) when Chap == "4.1.1"; Chap == "4.3.3"; Chap == "4.3.4"; Chap == "4.3.5"; - Chap == "4.4.3" - -> + Chap == "4.4.3"; + Chap == "4.8.1.1"; + Chap == "4.8.1.2"; + Chap == "4.8.1.3"; + Chap == "4.8.1.4"; + Chap == "4.8.16"; + Chap == "4.8.17"; + Chap == "4.8.20"-> ["Good CA Cert"]; intermidiate_cas(Chap) when Chap == "4.1.2" -> @@ -1140,12 +1793,12 @@ intermidiate_cas(Chap) when Chap == "4.1.5" -> ["DSA Parameters Inherited CA Cert", "DSA CA Cert"]; intermidiate_cas(Chap) when Chap == "4.2.1"; - Chap == "4.2.5" -> + Chap == "4.2.5" -> ["Bad notBefore Date CA Cert"]; intermidiate_cas(Chap) when Chap == "4.16.1"; - Chap == "4.16.2" -> - ["Trust Anchor Root Certificate"]; + Chap == "4.16.2" -> + ["Trust Anchor Root Certificate"]; intermidiate_cas(Chap) when Chap == "4.3.2" -> ["Name Ordering CA Cert"]; @@ -1154,7 +1807,7 @@ intermidiate_cas(Chap) when Chap == "4.13.34"; Chap == "4.13.35" -> ["nameConstraints URI1 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.13.36"; - Chap == "4.13.37" -> + Chap == "4.13.37" -> ["nameConstraints URI2 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.13.30"; @@ -1164,13 +1817,13 @@ intermidiate_cas(Chap) when Chap == "4.13.30"; ["nameConstraints DNS1 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.13.32"; - Chap == "4.13.33" -> + Chap == "4.13.33" -> ["nameConstraints DNS2 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.13.27"; Chap == "4.13.28"; Chap == "4.13.29" -> - ["nameConstraints DN1 subCA3 Cert", + ["nameConstraints DN1 subCA3 Cert", "nameConstraints DN1 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.13.21"; @@ -1205,7 +1858,7 @@ intermidiate_cas(Chap) when Chap == "4.5.4"; Chap == "4.5.5" -> ["Basic Self-Issued Old Key CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.13.1"; +intermidiate_cas(Chap) when Chap == "4.13.1"; Chap == "4.13.2"; Chap == "4.13.3"; Chap == "4.13.4"; @@ -1252,78 +1905,78 @@ intermidiate_cas(Chap) when Chap == "4.13.19" -> "nameConstraints DN1 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.7.1"; - Chap == "4.7.4" -> + Chap == "4.7.4" -> ["keyUsage Critical keyCertSign False CA Cert"]; intermidiate_cas(Chap) when Chap == "4.7.2"; - Chap == "4.7.5" -> + Chap == "4.7.5" -> ["keyUsage Not Critical keyCertSign False CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.7.3" -> +intermidiate_cas(Chap) when Chap == "4.7.3" -> ["keyUsage Not Critical CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.3.7" -> +intermidiate_cas(Chap) when Chap == "4.3.7" -> ["RFC3280 Mandatory Attribute Types CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.3.8" -> +intermidiate_cas(Chap) when Chap == "4.3.8" -> ["RFC3280 Optional Attribute Types CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.3.6" -> +intermidiate_cas(Chap) when Chap == "4.3.6" -> ["UIDCACert"]; -intermidiate_cas(Chap) when Chap == "4.6.4" -> +intermidiate_cas(Chap) when Chap == "4.6.4" -> ["basicConstraints Not Critical CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.1.26" -> +intermidiate_cas(Chap) when Chap == "4.1.26" -> ["nameConstraints RFC822 CA3 Cert"]; -intermidiate_cas(Chap) when Chap == "4.3.9" -> +intermidiate_cas(Chap) when Chap == "4.3.9" -> ["UTF8String Encoded Names CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.3.10" -> +intermidiate_cas(Chap) when Chap == "4.3.10" -> ["Rollover from PrintableString to UTF8String CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.3.11" -> +intermidiate_cas(Chap) when Chap == "4.3.11" -> ["UTF8String Case Insensitive Match CA Cert"]; intermidiate_cas(Chap) when Chap == "4.6.7"; Chap == "4.6.8" - -> + -> ["pathLenConstraint0 CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.6.13" -> +intermidiate_cas(Chap) when Chap == "4.6.13" -> [ "pathLenConstraint6 subsubsubCA41X Cert", - "pathLenConstraint6 subsubCA41 Cert", - "pathLenConstraint6 subCA4 Cert", + "pathLenConstraint6 subsubCA41 Cert", + "pathLenConstraint6 subCA4 Cert", "pathLenConstraint6 CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.6.14" -> +intermidiate_cas(Chap) when Chap == "4.6.14" -> [ "pathLenConstraint6 subsubsubCA41X Cert", - "pathLenConstraint6 subsubCA41 Cert", - "pathLenConstraint6 subCA4 Cert", + "pathLenConstraint6 subsubCA41 Cert", + "pathLenConstraint6 subCA4 Cert", "pathLenConstraint6 CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.6.15" -> - [ "pathLenConstraint0 Self-Issued CA Cert", - "pathLenConstraint0 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.6.15" -> + [ "pathLenConstraint0 Self-Issued CA Cert", + "pathLenConstraint0 CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.6.17" -> +intermidiate_cas(Chap) when Chap == "4.6.17" -> ["pathLenConstraint1 Self-Issued subCA Cert", - "pathLenConstraint1 subCA Cert", - "pathLenConstraint1 Self-Issued CA Cert", + "pathLenConstraint1 subCA Cert", + "pathLenConstraint1 Self-Issued CA Cert", "pathLenConstraint1 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.6.5"; - Chap == "4.6.6" -> - ["pathLenConstraint0 subCA Cert", - "pathLenConstraint0 CA Cert"]; + Chap == "4.6.6" -> + ["pathLenConstraint0 subCA Cert", + "pathLenConstraint0 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.6.9"; - Chap == "4.6.10" -> + Chap == "4.6.10" -> ["pathLenConstraint6 subsubCA00 Cert", "pathLenConstraint6 subCA0 Cert", "pathLenConstraint6 CA Cert"]; intermidiate_cas(Chap) when Chap == "4.6.11"; - Chap == "4.6.12" -> + Chap == "4.6.12" -> ["pathLenConstraint6 subsubsubCA11X Cert", "pathLenConstraint6 subsubCA11 Cert", "pathLenConstraint6 subCA1 Cert", @@ -1340,9 +1993,6 @@ intermidiate_cas(Chap) when Chap == "4.4.1" -> intermidiate_cas(Chap) when Chap == "4.4.2" -> ["Revoked subCA Cert", "Good CA Cert"]; -intermidiate_cas(Chap) when Chap == "4.4.3" -> - ["Good CA Cert"]; - intermidiate_cas(Chap) when Chap == "4.4.4" -> ["Bad CRL Signature CA Cert"]; @@ -1474,8 +2124,244 @@ intermidiate_cas(Chap) when Chap == "4.5.6"; Chap == "4.5.7" -> ["Basic Self-Issued CRL Signing Key CA Cert"]; intermidiate_cas(Chap) when Chap == "4.5.8" -> - ["Basic Self-Issued CRL Signing Key CRL Cert"]. - + ["Basic Self-Issued CRL Signing Key CRL Cert"]; +intermidiate_cas(Chap) when Chap == "4.8.2.1"; + Chap == "4.8.2.2" -> + ["No Policies CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.8.3.1"; + Chap == "4.8.3.2"; + Chap == "4.8.3.3" -> + ["Policies P2 subCA Cert","Good CA Cert" + ]; +intermidiate_cas("4.8.4") -> + ["Good subCA Cert", "Good CA Cert" + ]; +intermidiate_cas("4.8.5") -> + ["Policies P2 subCA2 Cert", "Good CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.8.6.1"; + Chap == "4.8.6.2"; + Chap == "4.8.6.3" -> + ["Policies P1234 subsubCAP123P12 Cert", + "Policies P1234 subCAP123 Cert", + "Policies P1234 CA Cert"]; + +intermidiate_cas("4.8.7") -> + ["Policies P123 subsubCAP12P1 Cert", + "Policies P123 subCAP12 Cert", + "Policies P123 CA Cert"]; +intermidiate_cas("4.8.8") -> + ["Policies P12 subsubCAP1P2 Cert", + "Policies P12 subCAP1 Cert", + "Policies P12 CA Cert" + ]; +intermidiate_cas("4.8.9") -> + ["Policies P123 subsubsubCAP12P2P1 Cert", + "Policies P123 subsubCAP12P2 Cert", + "Policies P123 subCAP12 Cert", + "Policies P123 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.8.10.1"; + Chap == "4.8.10.2"; + Chap == "4.8.10.3"; + Chap == "4.8.18.1"; + Chap == "4.8.18.2"-> + ["Policies P12 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.8.11.1"; + Chap == "4.8.11.2" -> + ["anyPolicy CA Cert"]; +intermidiate_cas("4.8.12") -> + ["Policies P3 CA Cert"]; + +intermidiate_cas(Chap) when Chap == "4.8.13.1"; + Chap == "4.8.13.2"; + Chap == "4.8.13.3" -> + ["Policies P123 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.8.14.1"; + Chap == "4.8.14.2" -> + ["anyPolicy CA Cert"]; + +intermidiate_cas(Chap) when Chap == "4.9.1" -> + ["requireExplicitPolicy10 subsubsubCA Cert", + "requireExplicitPolicy10 subsubCA Cert", + "requireExplicitPolicy10 subCA Cert", + "requireExplicitPolicy10 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.9.2" -> + ["requireExplicitPolicy5 subsubsubCA Cert", + "requireExplicitPolicy5 subsubCA Cert", + "requireExplicitPolicy5 subCA Cert", + "requireExplicitPolicy5 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.9.3" -> + ["requireExplicitPolicy4 subsubsubCA Cert", + "requireExplicitPolicy4 subsubCA Cert", + "requireExplicitPolicy4 subCA Cert", + "requireExplicitPolicy4 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.9.4" -> + ["requireExplicitPolicy0 subsubsubCA Cert", + "requireExplicitPolicy0 subsubCA Cert", + "requireExplicitPolicy0 subCA Cert", + "requireExplicitPolicy0 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.9.5" -> + ["requireExplicitPolicy7 subsubsubCARE2RE4 Cert", + "requireExplicitPolicy7 subsubCARE2RE4 Cert", + "requireExplicitPolicy7 subCARE2 Cert", + "requireExplicitPolicy7 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.9.6" -> + ["requireExplicitPolicy2 Self-Issued CA Cert", + "requireExplicitPolicy2 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.9.7" -> + ["requireExplicitPolicy2 subCA Cert", + "requireExplicitPolicy2 Self-Issued CA Cert", + "requireExplicitPolicy2 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.9.8" -> + ["requireExplicitPolicy2 Self-Issued subCA Cert", + "requireExplicitPolicy2 subCA Cert", + "requireExplicitPolicy2 Self-Issued CA Cert", + "requireExplicitPolicy2 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.8.15"; + Chap == "4.8.19" -> + []; +intermidiate_cas(Chap) when Chap == "4.10.1.1"; + Chap == "4.10.1.2"; + Chap == "4.10.1.3"; + Chap == "4.10.2.1"; + Chap == "4.10.2.2" -> + ["Mapping 1to2 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.10.3.1"; + Chap == "4.10.3.2"; + Chap == "4.10.4"-> + [ + "P12 Mapping 1to3 subsubCA Cert", + "P12 Mapping 1to3 subCA Cert", + "P12 Mapping 1to3 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.10.5.1"; + Chap == "4.10.5.2"; + Chap == "4.10.6.1"; + Chap == "4.10.6.2"-> + [ + "P1 Mapping 1to234 subCA Cert", + "P1 Mapping 1to234 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.10.7" -> + [ + "Mapping From anyPolicy CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.10.8" -> + [ + "Mapping To anyPolicy CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.10.9" -> + [ + "PanyPolicy Mapping 1to2 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.10.10"; + Chap == "4.10.11" -> + [ + "Good subCA PanyPolicy Mapping 1to2 CA Cert", + "Good CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.10.12.1"; + Chap == "4.10.12.2" -> + [ + "P12 Mapping 1to3 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.10.13"; + Chap == "4.10.14" -> + [ + "P1anyPolicy Mapping 1to2 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.11.1" -> + [ + "inhibitPolicyMapping0 subCA Cert", + "inhibitPolicyMapping0 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.11.2" -> + [ + "inhibitPolicyMapping1 P12 subCA Cert", + "inhibitPolicyMapping1 P12 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.11.3"; + Chap == "4.11.4" -> + [ + "inhibitPolicyMapping1 P12 subsubCA Cert", + "inhibitPolicyMapping1 P12 subCA Cert", + "inhibitPolicyMapping1 P12 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.11.5" -> + [ + "inhibitPolicyMapping5 subsubsubCA Cert", + "inhibitPolicyMapping5 subsubCA Cert", + "inhibitPolicyMapping5 subCA Cert", + "inhibitPolicyMapping5 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.11.6" -> + [ + "inhibitPolicyMapping1 P12 subsubCAIPM5 Cert", + "inhibitPolicyMapping1 P12 subCAIPM5 Cert", + "inhibitPolicyMapping1 P12 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.11.7" -> + [ + "inhibitPolicyMapping1 P1 subCA Cert", + "inhibitPolicyMapping1 P1 Self-Issued CA Cert", + "inhibitPolicyMapping1 P1 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.11.8"; + Chap == "4.11.9" -> + [ + "inhibitPolicyMapping1 P1 subsubCA Cert", + "inhibitPolicyMapping1 P1 subCA Cert", + "inhibitPolicyMapping1 P1 Self-Issued CA Cert ", + "inhibitPolicyMapping1 P1 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.11.10"; + Chap == "4.11.11" -> + [ + "inhibitPolicyMapping1 P1 Self-Issued subCA Cert", + "inhibitPolicyMapping1 P1 subCA Cert", + "inhibitPolicyMapping1 P1 Self-Issued CA Cert", + "inhibitPolicyMapping1 P1 CA Cert" + ]; +intermidiate_cas(Chap) when Chap == "4.12.1"; + Chap == "4.12.2" -> + ["inhibitAnyPolicy0 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.12.3.1"; + Chap == "4.12.3.2"; + Chap == "4.12.4" -> + ["inhibitAnyPolicy1 subCA1 Cert", + "inhibitAnyPolicy1 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.12.5" -> + ["inhibitAnyPolicy5 subsubCA Cert", + "inhibitAnyPolicy5 subCA Cert", + "inhibitAnyPolicy5 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.12.6" -> + ["inhibitAnyPolicy1 subCAIAP5 Cert", + "inhibitAnyPolicy1 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.12.7" -> + ["inhibitAnyPolicy1 subCA2 Cert", + "inhibitAnyPolicy1 Self-Issued CA Cert", + "inhibitAnyPolicy1 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.12.8" -> + ["inhibitAnyPolicy1 subsubCA2 Cert", + "inhibitAnyPolicy1 subCA2 Cert", + "inhibitAnyPolicy1 Self-Issued CA Cert", + "inhibitAnyPolicy1 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.12.9" -> + ["inhibitAnyPolicy1 Self-Issued subCA2 Cert", + "inhibitAnyPolicy1 subCA2 Cert", + "inhibitAnyPolicy1 Self-Issued CA Cert", + "inhibitAnyPolicy1 CA Cert"]; +intermidiate_cas(Chap) when Chap == "4.12.10" -> + ["inhibitAnyPolicy1 subCA2 Cert", + "inhibitAnyPolicy1 Self-Issued CA Cert", + "inhibitAnyPolicy1 CA Cert"]. %%%%%%%%%%%%%%% CRL mappings %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% crl_names("4.3.10") -> @@ -1487,123 +2373,361 @@ crl_names("4.4.2") -> crl_names("4.4.3") -> ["Trust Anchor Root CRL", "Good CA CRL", "Revoked subCA CRL"]; crl_names("4.4.4") -> - ["Trust Anchor Root CRL", "Bad CRL Signature CA CRL"]; + ["Trust Anchor Root CRL", "Bad CRL Signature CA CRL"]; crl_names("4.4.5") -> - ["Trust Anchor Root CRL", "Bad CRL Issuer Name CA CRL"]; + ["Trust Anchor Root CRL", "Bad CRL Issuer Name CA CRL"]; crl_names("4.4.6") -> - ["Trust Anchor Root CRL", "Wrong CRL CA CRL"]; + ["Trust Anchor Root CRL", "Wrong CRL CA CRL"]; crl_names("4.4.7") -> - ["Trust Anchor Root CRL", "Two CRLs CA Good CRL", "Two CRLs CA Bad CRL"]; + ["Trust Anchor Root CRL", "Two CRLs CA Good CRL", "Two CRLs CA Bad CRL"]; crl_names("4.4.8") -> - ["Trust Anchor Root CRL", "Unknown CRL Entry Extension CA CRL"]; + ["Trust Anchor Root CRL", "Unknown CRL Entry Extension CA CRL"]; crl_names(Chap) when Chap == "4.4.9"; - Chap == "4.4.10"-> - ["Trust Anchor Root CRL", "Unknown CRL Extension CA CRL"]; + Chap == "4.4.10"-> + ["Trust Anchor Root CRL", "Unknown CRL Extension CA CRL"]; crl_names("4.4.11") -> - ["Trust Anchor Root CRL", "Old CRL nextUpdate CA CRL"]; + ["Trust Anchor Root CRL", "Old CRL nextUpdate CA CRL"]; crl_names("4.4.12") -> - ["Trust Anchor Root CRL", "pre2000 CRL nextUpdate CA CRL"]; + ["Trust Anchor Root CRL", "pre2000 CRL nextUpdate CA CRL"]; crl_names("4.4.13") -> - ["Trust Anchor Root CRL", "GeneralizedTime CRL nextUpdate CA CRL"]; + ["Trust Anchor Root CRL", "GeneralizedTime CRL nextUpdate CA CRL"]; crl_names(Chap) when Chap == "4.4.14"; - Chap == "4.4.15"-> + Chap == "4.4.15"-> ["Trust Anchor Root CRL", "Negative Serial Number CA CRL"]; crl_names(Chap) when Chap == "4.4.16"; - Chap == "4.4.17"; - Chap == "4.4.18" -> + Chap == "4.4.17"; + Chap == "4.4.18" -> ["Trust Anchor Root CRL", "Long Serial Number CA CRL"]; crl_names(Chap)when Chap == "4.4.19"; - Chap == "4.4.20" -> + Chap == "4.4.20" -> ["Trust Anchor Root CRL", "Separate Certificate and CRL Keys CRL"]; crl_names("4.4.21") -> - ["Trust Anchor Root CRL", "Separate Certificate and CRL Keys CA2 CRL"]; + ["Trust Anchor Root CRL", "Separate Certificate and CRL Keys CA2 CRL"]; crl_names(Chap) when Chap == "4.5.1"; Chap == "4.5.2"-> - ["Trust Anchor Root CRL", "Basic Self-Issued New Key CA CRL"]; + ["Trust Anchor Root CRL", "Basic Self-Issued New Key CA CRL"]; crl_names(Chap) when Chap == "4.5.3"; - Chap == "4.5.4"; - Chap == "4.5.5" -> - ["Trust Anchor Root CRL", "Basic Self-Issued Old Key Self-Issued Cert CRL", - "Basic Self-Issued Old Key CA CRL"]; + Chap == "4.5.4"; + Chap == "4.5.5" -> + ["Trust Anchor Root CRL", "Basic Self-Issued Old Key Self-Issued Cert CRL", + "Basic Self-Issued Old Key CA CRL"]; crl_names(Chap) when Chap == "4.5.6"; Chap == "4.5.7"; Chap == "4.5.8" -> - ["Trust Anchor Root CRL", "Basic Self-Issued CRL Signing Key CRL Cert CRL", - "Basic Self-Issued CRL Signing Key CA CRL" - ]; + ["Trust Anchor Root CRL", "Basic Self-Issued CRL Signing Key CRL Cert CRL", + "Basic Self-Issued CRL Signing Key CA CRL" + ]; crl_names("4.7.4") -> - ["Trust Anchor Root CRL", "keyUsage Critical cRLSign False CA CRL"]; + ["Trust Anchor Root CRL", "keyUsage Critical cRLSign False CA CRL"]; crl_names("4.7.5") -> - ["Trust Anchor Root CRL", "keyUsage Not Critical cRLSign False CA CRL"]; + ["Trust Anchor Root CRL", "keyUsage Not Critical cRLSign False CA CRL"]; crl_names(Chap) when Chap == "4.14.1"; - Chap == "4.14.2"; - Chap == "4.14.3"; - Chap == "4.14.4" -> + Chap == "4.14.2"; + Chap == "4.14.3"; + Chap == "4.14.4" -> ["Trust Anchor Root CRL", "distributionPoint1 CA CRL"]; crl_names(Chap) when Chap == "4.14.5"; - Chap == "4.14.6"; - Chap == "4.14.7"; - Chap == "4.14.8"; - Chap == "4.14.9" -> + Chap == "4.14.6"; + Chap == "4.14.7"; + Chap == "4.14.8"; + Chap == "4.14.9" -> ["Trust Anchor Root CRL", "distributionPoint2 CA CRL"]; crl_names("4.14.10") -> - ["Trust Anchor Root CRL", "No issuingDistributionPoint CA CRL"]; + ["Trust Anchor Root CRL", "No issuingDistributionPoint CA CRL"]; crl_names("4.14.11") -> - ["Trust Anchor Root CRL", "onlyContainsUserCerts CA CRL"]; + ["Trust Anchor Root CRL", "onlyContainsUserCerts CA CRL"]; crl_names(Chap) when Chap == "4.14.12"; - Chap == "4.14.13" -> + Chap == "4.14.13" -> ["Trust Anchor Root CRL", "onlyContainsCACerts CA CRL"]; crl_names("4.14.14") -> ["Trust Anchor Root CRL", "onlyContainsAttributeCerts CA CRL"]; crl_names(Chap) when Chap == "4.14.15"; - Chap == "4.14.16" -> - ["Trust Anchor Root CRL", "onlySomeReasons CA1 compromise CRL", - "onlySomeReasons CA1 other reasons CRL"]; + Chap == "4.14.16" -> + ["Trust Anchor Root CRL", "onlySomeReasons CA1 compromise CRL", + "onlySomeReasons CA1 other reasons CRL"]; crl_names("4.14.17") -> - ["Trust Anchor Root CRL", - "onlySomeReasons CA2 CRL1", "onlySomeReasons CA2 CRL2"]; + ["Trust Anchor Root CRL", + "onlySomeReasons CA2 CRL1", "onlySomeReasons CA2 CRL2"]; crl_names("4.14.18") -> - ["Trust Anchor Root CRL", - "onlySomeReasons CA3 compromise CRL", "onlySomeReasons CA3 other reasons CRL"]; + ["Trust Anchor Root CRL", + "onlySomeReasons CA3 compromise CRL", "onlySomeReasons CA3 other reasons CRL"]; crl_names(Chap) when Chap == "4.14.19"; - Chap == "4.14.20"; - Chap == "4.14.21" -> - ["Trust Anchor Root CRL", "onlySomeReasons CA4 compromise CRL", - "onlySomeReasons CA4 other reasons CRL"]; + Chap == "4.14.20"; + Chap == "4.14.21" -> + ["Trust Anchor Root CRL", "onlySomeReasons CA4 compromise CRL", + "onlySomeReasons CA4 other reasons CRL"]; crl_names(Chap) when Chap == "4.14.22"; - Chap == "4.14.23"; - Chap == "4.14.24"; - Chap == "4.14.25"; - Chap == "4.14.26" -> - ["Trust Anchor Root CRL", "indirectCRL CA1 CRL"]; -crl_names("4.14.27") -> - ["Trust Anchor Root CRL", "Good CA CRL"]; - + Chap == "4.14.23"; + Chap == "4.14.24"; + Chap == "4.14.25"; + Chap == "4.14.26" -> + ["Trust Anchor Root CRL", "indirectCRL CA1 CRL"]; +crl_names(Chap) when Chap == "4.14.27"; + Chap == "4.8.1.1"; + Chap == "4.8.1.2"; + Chap == "4.8.1.3"; + Chap == "4.8.1.4"; + Chap == "4.8.16"; + Chap == "4.8.17"; + Chap == "4.8.20" -> + ["Trust Anchor Root CRL", "Good CA CRL"]; crl_names(Chap) when Chap == "4.14.28"; Chap == "4.14.29" -> ["Trust Anchor Root CRL", "indirectCRL CA3 CRL", "indirectCRL CA3 cRLIssuer CRL"]; crl_names("4.14.30") -> - ["Trust Anchor Root CRL", "indirectCRL CA4 cRLIssuer CRL"]; + ["Trust Anchor Root CRL", "indirectCRL CA4 cRLIssuer CRL"]; crl_names(Chap) when Chap == "4.14.31"; - Chap == "4.14.32"; - Chap == "4.14.33"; - Chap == "4.14.34"; - Chap == "4.14.35" -> - ["Trust Anchor Root CRL", "indirectCRL CA5 CRL"]; + Chap == "4.14.32"; + Chap == "4.14.33"; + Chap == "4.14.34"; + Chap == "4.14.35" -> + ["Trust Anchor Root CRL", "indirectCRL CA5 CRL"]; crl_names("4.15.1") -> - ["Trust Anchor Root CRL", "deltaCRLIndicator No Base CA CRL"]; + ["Trust Anchor Root CRL", "deltaCRLIndicator No Base CA CRL"]; crl_names(Chap) when Chap == "4.15.2"; - Chap == "4.15.3"; - Chap == "4.15.4"; - Chap == "4.15.5"; - Chap == "4.15.6"; - Chap == "4.15.7" -> + Chap == "4.15.3"; + Chap == "4.15.4"; + Chap == "4.15.5"; + Chap == "4.15.6"; + Chap == "4.15.7" -> ["Trust Anchor Root CRL", "deltaCRL CA1 CRL", "deltaCRL CA1 deltaCRL"]; crl_names(Chap) when Chap == "4.15.8"; - Chap == "4.15.9" -> - ["Trust Anchor Root CRL", "deltaCRL CA2 CRL", "deltaCRL CA2 deltaCRL"]; + Chap == "4.15.9" -> + ["Trust Anchor Root CRL", "deltaCRL CA2 CRL", "deltaCRL CA2 deltaCRL"]; crl_names("4.15.10") -> - ["Trust Anchor Root CRL", "deltaCRL CA3 CRL", "deltaCRL CA3 deltaCRL"]. + ["Trust Anchor Root CRL", "deltaCRL CA3 CRL", "deltaCRL CA3 deltaCRL"]; +crl_names(Chap) when Chap == "4.8.2.1"; + Chap == "4.8.2.2" -> + ["No Policies CA CRL"]; +crl_names(Chap) when Chap == "4.8.3.1"; + Chap == "4.8.3.2"; + Chap == "4.8.3.3" -> + ["Trust Anchor Root CRL", "Good CA CRL", "Policies P2 subCA CRL"]; +crl_names("4.8.4") -> + ["Trust Anchor Root CRL", "Good CA CRL", "Good subCA CRL"]; +crl_names("4.8.5") -> + ["Trust Anchor Root CRL", "Good CA CRL", "Policies P2 subCA2 CRL"]; +crl_names(Chap) when Chap == "4.8.6.1"; + Chap == "4.8.6.2"; + Chap == "4.8.6.3" -> + ["Trust Anchor Root CRL", "Policies P1234 CA CRL", + "Policies P1234 subCAP123 CRL", "Policies P1234 subsubCAP123P12 CRL"]; +crl_names("4.8.7") -> + ["Trust Anchor Root CRL", "Policies P123 CA CRL", + "Policies P123 subCAP12 CRL", "Policies P123 subsubCAP12P1 CRL"]; +crl_names("4.8.8") -> + ["Trust Anchor Root CRL", "Policies P12 CA CRL", + "Policies P12 subCAP1 CRL", "Policies P12 subsubCAP1P2 CRL"]; +crl_names("4.8.9") -> + ["Trust Anchor Root CRL", "Policies P123 CA CRL", + "Policies P123 subCAP12 CRL", "Policies P123 subsubCAP2P2 CRL", "Policies P123 subsubsubCAP12P2P1 CRL"]; +crl_names(Chap) when Chap == "4.8.10.1"; + Chap == "4.8.10.2"; + Chap == "4.8.10.3"; + Chap == "4.8.18.1"; + Chap == "4.8.18.2" -> + ["Policies P12 CA CRL"]; +crl_names(Chap) when Chap == "4.8.11.1"; + Chap == "4.8.11.2" -> + ["Trust Anchor Root CRL", "anyPolicy CA CRL"]; +crl_names("4.8.12") -> + ["Policies P3 CA CRL"]; +crl_names(Chap) when Chap == "4.8.13.1"; + Chap == "4.8.13.2"; + Chap == "4.8.13.3" -> + ["Policies Policies P123 CA CRL"]; +crl_names(Chap) when Chap == "4.8.14.1"; + Chap == "4.8.14.2" -> + ["anyPolicy CA CRL"]; +crl_names(Chap) when Chap == "4.8.15" -> + ["Trust Anchor Root CRL"]; + +crl_names(Chap) when Chap == "4.9.1" -> + ["Trust Anchor Root CRL", + "requireExplicitPolicy10 CA CRL" + "requireExplicitPolicy10 subCA CRL", + "requireExplicitPolicy10 subsubCA CRL", + "requireExplicitPolicy10 subsubsubCA CRL" + ]; +crl_names(Chap) when Chap == "4.9.2" -> + ["Trust Anchor Root CRL", + "requireExplicitPolicy5 CA CRL" + "requireExplicitPolicy5 subCA CRL", + "requireExplicitPolicy5 subsubCA CRL", + "requireExplicitPolicy5 subsubsubCA CRL" + ]; +crl_names(Chap) when Chap == "4.9.3" -> + ["Trust Anchor Root CRL", + "requireExplicitPolicy4 CA CRL" + "requireExplicitPolicy4 subCA CRL", + "requireExplicitPolicy4 subsubCA CRL", + "requireExplicitPolicy4 subsubsubCA CRL" + ]; +crl_names(Chap) when Chap == "4.9.4" -> + ["Trust Anchor Root CRL", + "requireExplicitPolicy0 CA CRL" + "requireExplicitPolicy0 subCA CRL", + "requireExplicitPolicy0 subsubCA CRL", + "requireExplicitPolicy0 subsubsubCA CRL" + ]; +crl_names(Chap) when Chap == "4.9.5" -> + ["Trust Anchor Root CRL", + "requireExplicitPolicy7 CA CRL" + "requireExplicitPolicy7 subCARE2 CRL ", + "requireExplicitPolicy7 subsubCARE2RE4 CRL", + "requireExplicitPolicy7 subsubsubCARE2RE4 CRL" + ]; +crl_names(Chap) when Chap == "4.9.6" -> + ["Trust Anchor Root CRL", + "requireExplicitPolicy2 CA CRL"]; +crl_names(Chap) when Chap == "4.9.7"; + Chap == "4.9.8" -> + ["Trust Anchor Root CRL", + "requireExplicitPolicy2 CA CRL", + "requireExplicitPolicy2 subCA CRL"]; +crl_names(Chap) when Chap == "4.10.1.1"; + Chap == "4.10.1.2"; + Chap == "4.10.1.3"; + Chap == "4.10.2.1"; + Chap == "4.10.2.2" -> + ["Trust Anchor Root CRL", + "Mapping 1to2 CA CRL"]; +crl_names(Chap) when Chap == "4.10.3.1"; + Chap == "4.10.3.2"; + Chap == "4.10.4" -> + ["Trust Anchor Root CRL", + "P12 Mapping 1to3 CA CRL", + "P12 Mapping 1to3 subCA CRL", + "P12 Mapping 1to3 subsubCA CRL" + ]; +crl_names(Chap) when Chap == "4.10.5.1"; + Chap == "4.10.5.2" -> + ["Trust Anchor Root CRL", + "P1 Mapping 1to234 CA CRL", + "P1 Mapping 1to234 subCA CRL" + ]; +crl_names(Chap) when Chap == "4.10.5.1"; + Chap == "4.10.5.2"; + Chap == "4.10.6.1"; + Chap == "4.10.6.2" -> + ["Trust Anchor Root CRL", + "P1 Mapping 1to234 CA CRL", + "P1 Mapping 1to234 subCA CRL" + ]; +crl_names(Chap) when Chap == "4.10.7" -> + ["Trust Anchor Root CRL", + "Mapping From anyPolicy CA CRL" + ]; +crl_names(Chap) when Chap == "4.10.8" -> + ["Trust Anchor Root CRL", + "Mapping To anyPolicy CA CRL" + ]; +crl_names(Chap) when Chap == "4.10.9" -> + ["Trust Anchor Root CRL", + "PannyPolicy Mapping 1to2 CA CRL" + ]; +crl_names(Chap) when Chap == "4.10.10"; + Chap == "4.10.11" -> + ["Trust Anchor Root CRL", + "Good CA CRL", + "Good subCA PannyPolicy Mapping 1to2 CA CRL" + ]; +crl_names(Chap) when Chap == "4.10.12" -> + ["Trust Anchor Root CRL", + "P12 Mapping 1to3 CA CRL" + ]; +crl_names(Chap) when Chap == "4.10.13"; + Chap == "4.10.14" -> + ["Trust Anchor Root CRL", + "P1anyPolicy Mapping 1to2 CA CRL" + ]; +crl_names(Chap) when Chap == "4.11.1" -> + ["Trust Anchor Root CRL", + "inhibitPolicyMapping0 CA CRL", + "inhibitPolicyMapping0 subCA CRL" + ]; +crl_names(Chap) when Chap == "4.11.2" -> + ["Trust Anchor Root CRL", + "inhibitPolicyMapping1 P12 CA CRL", + "inhibitPolicyMapping1 P12 subCA CRL" + ]; +crl_names(Chap) when Chap == "4.11.3"; + Chap == "4.11.4" -> + ["Trust Anchor Root CRL", + "inhibitPolicyMapping1 P12 CA CRL", + "inhibitPolicyMapping1 P12 subCA CRL", + "inhibitPolicyMapping1 P12 subsubCA CRL" + ]; +crl_names(Chap) when Chap == "4.11.5" -> + ["Trust Anchor Root CRL", + "inhibitPolicyMapping5 CA CRL", + "inhibitPolicyMapping5 subCA CRL", + "inhibitPolicyMapping5 subsubCA CRL", + "inhibitPolicyMapping5 subsubsubCA CRL" + ]; +crl_names(Chap) when Chap == "4.11.6" -> + ["Trust Anchor Root CRL", + "inhibitPolicyMapping1 P12 CA CRL", + "inhibitPolicyMapping1 P12 subCAIPM5 CRL", + " inhibitPolicyMapping1 P12 subsubCAIPM5 CRL" + ]; +crl_names(Chap) when Chap == "4.11.7" -> + ["Trust Anchor Root CRL", + "inhibitPolicyMapping1 P1 CA CRL", + "inhibitPolicyMapping1 P1 subCA CRL" + ]; +crl_names(Chap) when Chap == "4.11.8"; + Chap == "4.11.9" -> + ["Trust Anchor Root CRL", + "inhibitPolicyMapping1 P1 CA CRL", + "inhibitPolicyMapping1 P1 subCA CRL", + "inhibitPolicyMapping1 P1 subsubCA" + ]; +crl_names(Chap) when Chap == "4.11.10"; + Chap == "4.11.11" -> + ["Trust Anchor Root CRL", + "inhibitPolicyMapping1 P1 CA CRL", + "inhibitPolicyMapping1 P1 subCA CRL"]; +crl_names(Chap) when Chap == "4.12.1"; + Chap == "4.12.2" -> + ["Trust Anchor Root CRL", + "inhibitAnyPolicy0 CA CRL"]; +crl_names(Chap) when Chap == "4.12.3.1"; + Chap == "4.12.3.2"; + Chap == "4.12.4" -> + ["Trust Anchor Root CRL", + "inhibitAnyPolicy1 CA CRL", + "inhibitAnyPolicy1 subCA1 CRL" + ]; +crl_names(Chap) when Chap == "4.12.5" -> + ["Trust Anchor Root CRL", + "inhibitAnyPolicy5 CA CRL", + "inhibitAnyPolicy5 subCA CRL", + "inhibitAnyPolicy5 subsubCA CRL" + ]; +crl_names(Chap) when Chap == "4.12.6" -> + ["Trust Anchor Root CRL", + "inhibitAnyPolicy1 CA CRL", + "inhibitAnyPolicy1 subCAIAP5 CRL" + ]; +crl_names(Chap) when Chap == "4.12.7" -> + ["Trust Anchor Root CRL", + "inhibitAnyPolicy1 CA CRL", + "nhibitAnyPolicy1 subCA2 CRL"]; +crl_names(Chap) when Chap == "4.12.8" -> + ["Trust Anchor Root CRL", + "inhibitAnyPolicy1 CA CRL", + "inhibitAnyPolicy1 subCA2 CRL" + "inhibitAnyPolicy1 subsubCA2 CRL" + ]; +crl_names(Chap) when Chap == "4.12.9"; + Chap == "4.12.10" -> + ["Trust Anchor Root CRL" + "inhibitAnyPolicy1 CA CRL", + "inhibitAnyPolicy1 subCA2 CRL"]; + +crl_names(_) -> + []. crl_root_cert() -> "Trust Anchor Root Certificate". @@ -1625,7 +2749,7 @@ crl_path("Separate Certificate and CRL Keys CA2 CRL") -> crl_path("Basic Self-Issued Old Key Self-Issued Cert CRL") -> ["Basic Self-Issued Old Key CA Cert"]; crl_path("Basic Self-Issued Old Key CA CRL") -> - ["Basic Self-Issued Old Key CA Cert", "Basic Self-Issued Old Key NewWithOld CA Cert"]; + ["Basic Self-Issued Old Key CA Cert", "Basic Self-Issued Old Key NewWithOld CA Cert"]; crl_path("Basic Self-Issued CRL Signing Key CRL Cert CRL") -> ["Basic Self-Issued CRL Signing Key CA Cert"]; @@ -1662,118 +2786,283 @@ crl_path(CRL) -> [Base ++ "Cert"]. crls(CRLS) -> - lists:foldl(fun([], Acc) -> + lists:foldl(fun([], Acc) -> Acc; (CRLFile, Acc) -> [CRL] = read_crls(CRLFile), [CRL | Acc] end, [], CRLS). +policy_options(Chap, Options) when Chap == "4.8.1.1"; + Chap == "4.8.2.2"; + Chap == "4.8.3.2"; + Chap == "4.8.7"; + Chap == "4.8.8"; + Chap == "4.8.9"; + Chap == "4.8.12"; + Chap == "4.8.15"; + Chap == "4.8.16"; + Chap == "4.8.17"; + Chap == "4.8.20"; + Chap == "4.9.3"; + Chap == "4.9.5"; + Chap == "4.9.7"; + Chap == "4.9.8"; + Chap == "4.12.1"; + Chap == "4.12.2"; + Chap == "4.8.10.1"; + Chap == "4.8.11.1" -> + [{explicit_policy, true} | Options]; +policy_options(Chap, Options) when Chap == "4.9.4"; + Chap == "4.8.1.2"; + Chap == "4.8.6.2"; + Chap == "4.8.10.2"; + Chap == "4.8.11.2"; + Chap == "4.8.13.1"; + Chap == "4.8.14.1"; + Chap == "4.8.18.1"; + Chap == "4.10.1.1"; + Chap == "4.10.3.1"; + Chap == "4.10.5.1"; + Chap == "4.10.6.1"; + Chap == "4.10.12.1"; + Chap == "4.11.2"; + Chap == "4.11.7" -> + [{explicit_policy, true}, {policy_set, [?NIST1]} | Options]; +policy_options(Chap, Options) when Chap == "4.8.1.3"; + Chap == "4.8.6.3"; + Chap == "4.8.10.3"; + Chap == "4.8.13.2"; + Chap == "4.8.14.2"; + Chap == "4.8.18.2"; + Chap == "4.10.1.2"; + Chap == "4.10.3.2"; + Chap == "4.10.12.2"; + Chap == "4.11.4"-> + [{explicit_policy, true}, {policy_set, [?NIST2]} | Options]; +policy_options(Chap, Options) when Chap == "4.8.1.4" -> + [{explicit_policy, true}, {policy_set, [?NIST1, ?NIST2]} | Options]; +policy_options(Chap, Options) when Chap == "4.8.13.3"-> + [{explicit_policy, true}, {policy_set, [?NIST3]} | Options]; +policy_options(Chap, Options) when Chap == "4.8.1.4"; + Chap == "4.8.3.3"-> + [{explicit_policy, true}, {policy_set, [?NIST1, ?NIST2]} | Options]; +policy_options(Chap, Options) when Chap == "4.10.5.2"; + Chap == "4.10.6.2" -> + [{explicit_policy, true}, {policy_set, [?NIST6]} | Options]; +policy_options(Chap, Options) when Chap == "4.10.1.3" -> + [{explicit_policy, true}, {inhibit_policy_mapping, true} | Options]; +policy_options(Chap, Options) when Chap == "4.10.2.2"; + Chap == "4.12.3.2" -> + [{explicit_policy, true}, {inhibit_any_policy, true} | Options]; +policy_options(Chap, Options) when Chap == "4.10.10"; + Chap == "4.10.4"; + Chap == "4.12.4"; + Chap == "4.12.5"; + Chap == "4.12.8"; + Chap == "4.12.10"; + Chap == "4.11.1"; + Chap == "4.11.3"; + Chap == "4.11.5"; + Chap == "4.11.6"; + Chap == "4.11.8"; + Chap == "4.11.9"; + Chap == "4.11.10"; + Chap == "4.11.11" -> + [{explicit_policy, true} | Options]; +policy_options(_, Options) -> + Options. + +oidify(Oid) when is_tuple(Oid) -> + Oid; +oidify(Oid) when is_list(Oid) -> + Tokens = string:tokens(Oid, "$."), + OidList = [list_to_integer(StrInt) || StrInt <- Tokens], + list_to_tuple(OidList). + +validate_policy_set(Chap, Set) when Chap == "4.8.1.1"; + Chap == "4.8.1.2"; + Chap == "4.8.1.4"; + Chap == "4.8.6.1"; + Chap == "4.8.6.2"; + Chap == "4.12.7"; + Chap == "4.8.10.2"; + Chap == "4.8.13.1"; + Chap == "4.8.11.2"; + Chap == "4.8.14.1"; + Chap == "4.9.1"; + Chap == "4.9.2"; + Chap == "4.9.4"; + Chap == "4.9.6"; + Chap == "4.10.9"; + Chap == "4.10.11"; + Chap == "4.11.2"; + Chap == "4.11.7"; + Chap == "4.12.2"; + Chap == "4.12.3.1"; + Chap == "4.12.7" -> + validate_nodes([[{expected_policy_set,[?NIST1_OID]}, + {valid_policy, ?NIST1_OID}]], Set); + +validate_policy_set(Chap, []) when Chap == "4.8.2.1"; + Chap == "4.8.3.1"-> + true; +validate_policy_set(Chap, Set) when Chap == "4.8.10.1" -> + validate_nodes([[{expected_policy_set,[?NIST1_OID]}, + {valid_policy, ?NIST1_OID}], + [{expected_policy_set,[?NIST2_OID]}, + {valid_policy, ?NIST2_OID}] + ], Set); +validate_policy_set(Chap, Set) when Chap == "4.8.10.3"; + Chap == "4.8.13.2"; + Chap == "4.10.3.2"; + Chap == "4.11.4" -> + validate_nodes([[{expected_policy_set,[?NIST2_OID]}, + {valid_policy, ?NIST2_OID}]], Set); +validate_policy_set(Chap, Set) when Chap == "4.8.13.3" -> + validate_nodes([[{expected_policy_set,[?NIST3_OID]}, + {valid_policy, ?NIST3_OID}]], Set); +validate_policy_set("4.8.11.1", Set) -> + validate_nodes([[{expected_policy_set,[?anyPolicy]}, + {valid_policy, ?anyPolicy}]], Set); +validate_policy_set(Chap, Set) when Chap == "4.8.15"; + Chap == "4.8.16"; + Chap == "4.8.17"; + Chap == "4.8.19"; + Chap == "4.8.18.1"; + Chap == "4.8.20" -> + validate_nodes([[{expected_policy_set,[?NIST1_OID]}, + {valid_policy, ?NIST1_OID}]], Set), + validate_qualifiers(Chap, Set); +validate_policy_set(Chap, Set) when Chap == "4.10.1.1" -> + validate_nodes([[{expected_policy_set,[?NIST2_OID]}, + {valid_policy, ?NIST1_OID}]], Set); +validate_policy_set(Chap, Set) when Chap == "4.10.5.1"; + Chap == "4.10.6.1" -> + validate_nodes([[{expected_policy_set,[?NIST2_OID, ?NIST3_OID, ?NIST4_OID]}, + {valid_policy, ?NIST1_OID}]], Set); +validate_policy_set(Chap, Set) when Chap == "4.10.12.1" -> + true = validate_nodes([[{expected_policy_set,[?NIST3_OID]}, + {valid_policy, ?NIST1_OID}] + ], Set), + validate_qualifiers(Chap, Set); +validate_policy_set(Chap, Set) when Chap == "4.8.18.2"; + Chap == "4.10.12.2" -> + true = validate_nodes([[{expected_policy_set,[?NIST2_OID]}, + {valid_policy, ?NIST2_OID}] + ], Set), + validate_qualifiers(Chap, Set); +validate_policy_set(Chap, Set) when Chap == "4.10.13" -> + true = validate_nodes([[{expected_policy_set,[?NIST2_OID]}, + {valid_policy, ?NIST1_OID}], + [{expected_policy_set,[?NIST2_OID]}, + {valid_policy, ?NIST2_OID}] + ], Set), + validate_qualifiers(Chap, Set); +validate_policy_set(Chap, Set) when Chap == "4.10.14" -> + true = validate_nodes([[{expected_policy_set,[?NIST1_OID]}, + {valid_policy, ?NIST1_OID}] + ], Set), + validate_qualifiers(Chap, Set); +validate_policy_set(_Chap, _Set) -> + true. + +validate_nodes([], []) -> + true; +validate_nodes([], _) -> + false; +validate_nodes([Expected | Rest], Nodes) -> + Remaining = lists:filtermap(fun(Node) -> + not validate_node(Expected, Node) + end, Nodes), + validate_nodes(Rest, Remaining). + +validate_node([{Key, Value}], Node) -> + case maps:get(Key, Node) of + Value -> + true; + _ -> + false + end; +validate_node([{Key, Value}| Rest], Node) -> + case maps:get(Key, Node) of + Value -> + validate_node(Rest, Node); + _ -> + false + end. -%% TODO: If we implement policy support -%% Certificate policy tests need special handling. They can have several -%% sub tests and we need to check the outputs are correct. - -certificate_policies_tests() -> - %%{ "4.8", "Certificate Policies" }, - [{"4.8.1.1", "All Certificates Same Policy Test1", "-policy anyPolicy -explicit_policy", "True", ?NIST1, ?NIST1, 0}, - {"4.8.1.2", "All Certificates Same Policy Test1", "-policy ?NIST1BasicSelfIssuedCRLSigningKeyCACert.pem -explicit_policy", "True", ?NIST1, ?NIST1, 0}, - {"4.8.1.3", "All Certificates Same Policy Test1", "-policy ?NIST2 -explicit_policy", "True", ?NIST1, "<empty>", 43}, - {"4.8.1.4", "All Certificates Same Policy Test1", "-policy ?NIST1 -policy ?NIST2 -explicit_policy", "True", ?NIST1, ?NIST1, 0}, - {"4.8.2.1", "All Certificates No Policies Test2", "-policy anyPolicy", "False", "<empty>", "<empty>", 0}, - {"4.8.2.2", "All Certificates No Policies Test2", "-policy anyPolicy -explicit_policy", "True", "<empty>", "<empty>", 43}, - {"4.8.3.1", "Different Policies Test3", "-policy anyPolicy", "False", "<empty>", "<empty>", 0}, - {"4.8.3.2", "Different Policies Test3", "-policy anyPolicy -explicit_policy", "True", "<empty>", "<empty>", 43}, - {"4.8.3.3", "Different Policies Test3", "-policy ?NIST1 -policy ?NIST2 -explicit_policy", "True", "<empty>", "<empty>", 43}, - {"4.8.4", "Different Policies Test4", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.8.5", "Different Policies Test5", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.8.6.1", "Overlapping Policies Test6", "-policy anyPolicy", "True", ?NIST1, ?NIST1, 0}, - {"4.8.6.2", "Overlapping Policies Test6", "-policy ?NIST1", "True", ?NIST1, ?NIST1, 0}, - {"4.8.6.3", "Overlapping Policies Test6", "-policy ?NIST2", "True", ?NIST1, "<empty>", 43}, - {"4.8.7", "Different Policies Test7", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.8.8", "Different Policies Test8", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.8.9", "Different Policies Test9", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.8.10.1", "All Certificates Same Policies Test10", "-policy ?NIST1", "True", "?NIST1:?NIST2", "?NIST1", 0}, - {"4.8.10.2", "All Certificates Same Policies Test10", "-policy ?NIST2", "True", "?NIST1:?NIST2", "?NIST2", 0}, - {"4.8.10.3", "All Certificates Same Policies Test10", "-policy anyPolicy", "True", "?NIST1:?NIST2", "?NIST1:?NIST2", 0}, - {"4.8.11.1", "All Certificates AnyPolicy Test11", "-policy anyPolicy", "True", "$apolicy", "$apolicy", 0}, - {"4.8.11.2", "All Certificates AnyPolicy Test11", "-policy ?NIST1", "True", "$apolicy", "?NIST1", 0}, - {"4.8.12", "Different Policies Test12", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.8.13.1", "All Certificates Same Policies Test13", "-policy ?NIST1", "True", "?NIST1:?NIST2:?NIST3", "?NIST1", 0}, - {"4.8.13.2", "All Certificates Same Policies Test13", "-policy ?NIST2", "True", "?NIST1:?NIST2:?NIST3", "?NIST2", 0}, - {"4.8.13.3", "All Certificates Same Policies Test13", "-policy ?NIST3", "True", "?NIST1:?NIST2:?NIST3", "?NIST3", 0}, - {"4.8.14.1", "AnyPolicy Test14", "-policy ?NIST1", "True", "?NIST1", "?NIST1", 0}, - {"4.8.14.2", "AnyPolicy Test14", "-policy ?NIST2", "True", "?NIST1", "<empty>", 43}, - {"4.8.15", "User Notice Qualifier Test15", "-policy anyPolicy", "False", "?NIST1", "?NIST1", 0}, - {"4.8.16", "User Notice Qualifier Test16", "-policy anyPolicy", "False", "?NIST1", "?NIST1", 0}, - {"4.8.17", "User Notice Qualifier Test17", "-policy anyPolicy", "False", "?NIST1", "?NIST1", 0}, - {"4.8.18.1", "User Notice Qualifier Test18", "-policy ?NIST1", "True", "?NIST1:?NIST2", "?NIST1", 0}, - {"4.8.18.2", "User Notice Qualifier Test18", "-policy ?NIST2", "True", "?NIST1:?NIST2", "?NIST2", 0}, - {"4.8.19", "User Notice Qualifier Test19", "-policy anyPolicy", "False", "?NIST1", "?NIST1", 0}, - {"4.8.20", "CPS Pointer Qualifier Test20", "-policy anyPolicy -explicit_policy", "True", "?NIST1", "?NIST1", 0}]. -require_explicit_policy_tests() -> - %%{ "4.9", "Require Explicit Policy" }, - [{"4.9.1", "Valid RequireExplicitPolicy Test1", "-policy anyPolicy", "False", "<empty>", "<empty>", 0}, - {"4.9.2", "Valid RequireExplicitPolicy Test2", "-policy anyPolicy", "False", "<empty>", "<empty>", 0}, - {"4.9.3", "Invalid RequireExplicitPolicy Test3", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.9.4", "Valid RequireExplicitPolicy Test4", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}, - {"4.9.5", "Invalid RequireExplicitPolicy Test5", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.9.6", "Valid Self-Issued requireExplicitPolicy Test6", "-policy anyPolicy", "False", "<empty>", "<empty>", 0}, - {"4.9.7", "Invalid Self-Issued requireExplicitPolicy Test7", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.9.8", "Invalid Self-Issued requireExplicitPolicy Test8", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}]. -policy_mappings_tests() -> - %%{ "4.10", "Policy Mappings" }, - [{"4.10.1.1", "Valid Policy Mapping Test1", "-policy ?NIST1", "True", "?NIST1", "?NIST1", 0}, - {"4.10.1.2", "Valid Policy Mapping Test1", "-policy ?NIST2", "True", "?NIST1", "<empty>", 43}, - {"4.10.1.3", "Valid Policy Mapping Test1", "-policy anyPolicy -inhibit_map", "True", "<empty>", "<empty>", 43}, - {"4.10.2.1", "Invalid Policy Mapping Test2", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.10.2.2", "Invalid Policy Mapping Test2", "-policy anyPolicy -inhibit_map", "True", "<empty>", "<empty>", 43}, - {"4.10.3.1", "Valid Policy Mapping Test3", "-policy ?NIST1", "True", "?NIST2", "<empty>", 43}, - {"4.10.3.2", "Valid Policy Mapping Test3", "-policy ?NIST2", "True", "?NIST2", "?NIST2", 0}, - {"4.10.4", "Invalid Policy Mapping Test4", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.10.5.1", "Valid Policy Mapping Test5", "-policy ?NIST1", "True", "?NIST1", "?NIST1", 0}, - {"4.10.5.2", "Valid Policy Mapping Test5", "-policy ?NIST6", "True", "?NIST1", "<empty>", 43}, - {"4.10.6.1", "Valid Policy Mapping Test6", "-policy ?NIST1", "True", "?NIST1", "?NIST1", 0}, - {"4.10.6.2", "Valid Policy Mapping Test6", "-policy ?NIST6", "True", "?NIST1", "<empty>", 43}, - { "4.10.7", "Invalid Mapping From anyPolicy Test7", 42 }, - { "4.10.8", "Invalid Mapping To anyPolicy Test8", 42 }, - {"4.10.9", "Valid Policy Mapping Test9", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}, - {"4.10.10", "Invalid Policy Mapping Test10", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.10.11", "Valid Policy Mapping Test11", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}, - - %% TODO: check notice display - {"4.10.12.1", "Valid Policy Mapping Test12", "-policy ?NIST1", "True", "?NIST1:?NIST2", "?NIST1", 0}, - - %% TODO: check notice display - {"4.10.12.2", "Valid Policy Mapping Test12", "-policy ?NIST2", "True", "?NIST1:?NIST2", "?NIST2", 0}, - {"4.10.13", "Valid Policy Mapping Test13", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}, - - %% TODO: check notice display - {"4.10.14", "Valid Policy Mapping Test14", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}]. - -inhibit_policy_mapping_tests() -> - %%{ "4.11", "Inhibit Policy Mapping" }, - [{"4.11.1", "Invalid inhibitPolicyMapping Test1", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.11.2", "Valid inhibitPolicyMapping Test2", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}, - {"4.11.3", "Invalid inhibitPolicyMapping Test3", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.11.4", "Valid inhibitPolicyMapping Test4", "-policy anyPolicy", "True", "?NIST2", "?NIST2", 0}, - {"4.11.5", "Invalid inhibitPolicyMapping Test5", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.11.6", "Invalid inhibitPolicyMapping Test6", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.11.7", "Valid Self-Issued inhibitPolicyMapping Test7", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}, - {"4.11.8", "Invalid Self-Issued inhibitPolicyMapping Test8", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.11.9", "Invalid Self-Issued inhibitPolicyMapping Test9", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.11.10", "Invalid Self-Issued inhibitPolicyMapping Test10", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.11.11", "Invalid Self-Issued inhibitPolicyMapping Test11", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}]. -inhibit_any_policy_tests() -> - %%{ "4.12", "Inhibit Any Policy" }, - [{"4.12.1", "Invalid inhibitAnyPolicy Test1", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.12.2", "Valid inhibitAnyPolicy Test2", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}, - {"4.12.3.1", "inhibitAnyPolicy Test3", "-policy anyPolicy", "True", "?NIST1", "?NIST1", 0}, - {"4.12.3.2", "inhibitAnyPolicy Test3", "-policy anyPolicy -inhibit_any", "True", "<empty>", "<empty>", 43}, - {"4.12.4", "Invalid inhibitAnyPolicy Test4", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.12.5", "Invalid inhibitAnyPolicy Test5", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.12.6", "Invalid inhibitAnyPolicy Test6", "-policy anyPolicy", "True", "<empty>", "<empty>", 43}, - {"4.12.7", "Valid Self-Issued inhibitAnyPolicy Test7", ok}, - {"4.12.8", "Invalid Self-Issued inhibitAnyPolicy Test8", 43 }, - {"4.12.9", "Valid Self-Issued inhibitAnyPolicy Test9", ok}, - {"4.12.10", "Invalid Self-Issued inhibitAnyPolicy Test10", 43 }]. +validate_qualifiers("4.8.15", [#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, + "q1: This is the user notice from qualifier 1. " + "This certificate is for test purposes only"}}] == QSet; +validate_qualifiers("4.8.16", [#{qualifier_set := QSet}]) -> + ct:log("~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, + "q1: This is the user notice from qualifier 1. " + "This certificate is for test purposes only"}}] == QSet; +validate_qualifiers("4.8.17", [#{qualifier_set := QSet}]) -> + ct:log("~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, + "q3: This is the user notice from qualifier 3. " + "This certificate is for test purposes only"}}] == QSet; +validate_qualifiers("4.8.18.1",[#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, + "q4: This is the user notice from qualifier 4 associated " + "with NIST-test-policy-1. " + "This certificate is for test purposes only"}}] == QSet; +validate_qualifiers("4.8.18.2", [#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, + "q5: This is the user notice from qualifier 5 associated" + " with anyPolicy. This user notice should be associated " + "with NIST-test-policy-2" }}] == QSet; +validate_qualifiers("4.8.19", [#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, "q6: Section 4.2.1.5 of RFC 3280 states the maximum size of " + "explicitText is 200 characters, but warns that some non-conforming CAs " + "exceed this limit. Thus RFC 3280 states that certificate users SHOULD " + "gracefully handle explicitText with more than 200 characters. This " + "explicitText is over 200 characters long" + }}] == QSet; +validate_qualifiers("4.8.20", [#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [{uri, "http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/pki_registration.html#PKITest"}] + == QSet; + +validate_qualifiers("4.10.12.1", [#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, "q7: This is the user notice from qualifier 7" + " associated with NIST-test-policy-3. This user notice should " + "be displayed when NIST-test-policy-1 is in the user-constrained-policy-set" + }}] == QSet; +validate_qualifiers("4.10.12.2", [#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, "q8: This is the user notice from qualifier 8 " + "associated with anyPolicy. This user notice should be displayed" + " when NIST-test-policy-2 is in the user-constrained-policy-set" + }}] == QSet; +validate_qualifiers("4.10.13", [#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, "q9: This is the user notice from qualifier 9 " + "associated with NIST-test-policy-1. This user notice should be" + " displayed for Valid Policy Mapping Test13" + }}] == QSet; +validate_qualifiers("4.10.14", [#{qualifier_set := QSet}]) -> + ct:log("QS ~p", [QSet]), + true = [#'UserNotice'{explicitText = + {visibleString, "q10: This is the user notice from qualifier 10 " + "associated with anyPolicy. This user notice should be displayed" + " for Valid Policy Mapping Test14" + }}] == QSet. diff --git a/lib/public_key/test/pubkey_cert_SUITE.erl b/lib/public_key/test/pubkey_cert_SUITE.erl index 7d51d5afda..43907d5b8a 100644 --- a/lib/public_key/test/pubkey_cert_SUITE.erl +++ b/lib/public_key/test/pubkey_cert_SUITE.erl @@ -21,10 +21,27 @@ -module(pubkey_cert_SUITE). -include_lib("common_test/include/ct.hrl"). -%% -include_lib("public_key/include/public_key.hrl"). -%% Note: This directive should only be used in test suites. --compile(export_all). +%% CT callbacks +-export([all/0, + groups/0]). + +%% Test cases +-export([time_str_2_gregorian_utc_post2000/0, + time_str_2_gregorian_utc_post2000/1, + time_str_2_gregorian_utc_limit_50_years_before_current_time/0, + time_str_2_gregorian_utc_limit_50_years_before_current_time/1, + time_str_2_gregorian_utc_limit_51_years_before_current_time/0, + time_str_2_gregorian_utc_limit_51_years_before_current_time/1, + time_str_2_gregorian_utc_limit_50_years_from_current_time/0, + time_str_2_gregorian_utc_limit_50_years_from_current_time/1, + time_str_2_gregorian_utc_limit_49_years_from_current_time/0, + time_str_2_gregorian_utc_limit_49_years_from_current_time/1, + time_str_2_gregorian_generaltime_50_years_before_current_time/0, + time_str_2_gregorian_generaltime_50_years_before_current_time/1, + time_str_2_gregorian_generaltime_50_years_from_current_time/0, + time_str_2_gregorian_generaltime_50_years_from_current_time/1 + ]). %%-------------------------------------------------------------------- %% Common Test interface functions ----------------------------------- @@ -37,15 +54,14 @@ groups() -> [{time_str_2_gregorian_sec, [], time_str_two_gregorian()}]. time_str_two_gregorian() -> - [ time_str_2_gregorian_utc_post2000 - , time_str_2_gregorian_utc_limit_50_years_before_current_time - , time_str_2_gregorian_utc_limit_51_years_before_current_time - , time_str_2_gregorian_utc_limit_50_years_from_current_time - , time_str_2_gregorian_utc_limit_49_years_from_current_time - , time_str_2_gregorian_generaltime_50_years_before_current_time - , time_str_2_gregorian_generaltime_50_years_from_current_time + [time_str_2_gregorian_utc_post2000, + time_str_2_gregorian_utc_limit_50_years_before_current_time, + time_str_2_gregorian_utc_limit_51_years_before_current_time, + time_str_2_gregorian_utc_limit_50_years_from_current_time, + time_str_2_gregorian_utc_limit_49_years_from_current_time, + time_str_2_gregorian_generaltime_50_years_before_current_time, + time_str_2_gregorian_generaltime_50_years_from_current_time ]. - %%-------------------------------------------------------------------- %% Test Cases -------------------------------------------------------- %%-------------------------------------------------------------------- @@ -132,8 +148,8 @@ convert_to_datetime_format({Format, Date}, ExpectedYear) -> [Y, M, D] = lists:map(fun (Str) -> erlang:list_to_integer(Str) end, YYMMDD), %% assertions to test that the result is the expected one case Format of - utcTime -> (ExpectedYear rem 100) =:= Y; - generalTime -> ExpectedYear =:= Y + utcTime -> true = (ExpectedYear rem 100) == Y; + generalTime -> true = ExpectedYear == Y end, {{ExpectedYear, M, D}, {0, 0, 0}}. -- 2.35.3
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
