/*	$OpenBSD: constraints.c,v 1.18 2023/12/13 05:59:50 tb Exp $	*/
/*
 * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <err.h>
#include <string.h>

#include <openssl/safestack.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include "x509_internal.h"

#define FAIL(msg, ...)							\
do {									\
	fprintf(stderr, "[%s:%d] FAIL: ", __FILE__, __LINE__);		\
	fprintf(stderr, msg, ##__VA_ARGS__);				\
} while(0)

unsigned char *valid_hostnames[] = {
	"openbsd.org",
	"op3nbsd.org",
	"org",
	"3openbsd.com",
	"3-0penb-d.c-m",
	"a",
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com",
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
	"open_bsd.org", /* because this is liberal */
	NULL,
};

unsigned char *valid_sandns_names[] = {
	"*.ca",
	"*.op3nbsd.org",
	"c*.openbsd.org",
	"foo.*.d*.c*.openbsd.org",
	NULL,
};

unsigned char *valid_domain_constraints[] = {
	"",
	".ca",
	".op3nbsd.org",
	".aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
	"www.openbsd.org",
	NULL,
};

unsigned char *valid_mbox_names[] = {
	"\"!#$%&\\\"*+-/=?\002^_`{|}~.\"@openbsd.org",
	"beck@openbsd.org",
	"beck@openbsd.org",
	"beck@op3nbsd.org",
	"beck@org",
	"beck@3openbsd.com",
	"beck@3-0penb-d.c-m",
	"bec@a",
	"beck@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com",
	"beck@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
	"beck@open_bsd.org", /* because this is liberal */
	NULL,
};

unsigned char *invalid_hostnames[] = {
	"openbsd.org.",
	"openbsd..org",
	"openbsd.org-",
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com",
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.a",
	"-p3nbsd.org",
	"openbs-.org",
	"openbsd\n.org",
	"open\177bsd.org",
	"open\255bsd.org",
	"*.openbsd.org",
	NULL,
};

unsigned char *invalid_sandns_names[] = {
	"",
	".",
	"*.a",
	"*.",
	"*.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com",
	".aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.a",
	"*.-p3nbsd.org",
	"*.*..openbsd.org",
	"*..openbsd.org",
	".openbsd.org",
	"c*c.openbsd.org",
	NULL,
};

unsigned char *invalid_mbox_names[] = {
	"beck@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com",
	"beck@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.a",
	"beck@.-openbsd.org",
	"beck@.openbsd.org.",
	"beck@.a",
	"beck@.",
	"beck@",
	"beck@.ca",
	"@openbsd.org",
	NULL,
};

unsigned char *invalid_domain_constraints[] = {
	".",
	".a",
	"..",
	".aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.com",
	".aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
	"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.a",
	".-p3nbsd.org",
	"..openbsd.org",
	NULL,
};

unsigned char *invaliduri[] = {
	"https://-www.openbsd.org",
	"https://.www.openbsd.org/",
	"https://www.ope|nbsd.org%",
	"https://www.openbsd.org.#",
	"https://192.168.1.1./",
	"https://192.168.1.1|/",
	"https://.192.168.1.1/",
	"https://192.168..1.1/",
	"https://.2001:0DB8:AC10:FE01::/",
	"https://.2001:0DB8:AC10:FE01::|/",
	"///",
	"//",
	"/",
	"",
	NULL,
};

unsigned char *validuri[] = {
	"https://www.openbsd.org/meep/meep/meep/",
	"https://192.168.1.1/",
	"https://2001:0DB8:AC10:FE01::/",
	"https://192.168.1/",  /* Not an IP, but valid component */
	"https://999.999.999.999/", /* Not an IP, but valid component */
	NULL,
};

static int
test_valid_hostnames(void)
{
	int i, failure = 0;

	for (i = 0; valid_hostnames[i] != NULL; i++) {
		CBS cbs;
		CBS_init(&cbs, valid_hostnames[i], strlen(valid_hostnames[i]));
		if (!x509_constraints_valid_host(&cbs, 0)) {
			FAIL("Valid hostname '%s' rejected\n",
			    valid_hostnames[i]);
			failure = 1;
			goto done;
		}
		CBS_init(&cbs, valid_hostnames[i], strlen(valid_hostnames[i]));
		if (!x509_constraints_valid_sandns(&cbs)) {
			FAIL("Valid sandns '%s' rejected\n",
			    valid_hostnames[i]);
			failure = 1;
			goto done;
		}
	}

 done:
	return failure;
}

static int
test_valid_sandns_names(void)
{
	int i, failure = 0;
	for (i = 0; valid_sandns_names[i] != NULL; i++) {
		CBS cbs;
		CBS_init(&cbs, valid_sandns_names[i],
		    strlen(valid_sandns_names[i]));
		if (!x509_constraints_valid_sandns(&cbs)) {
			FAIL("Valid dnsname '%s' rejected\n",
			    valid_sandns_names[i]);
			failure = 1;
			goto done;
		}
	}

 done:
	return failure;
}

static int
test_valid_domain_constraints(void)
{
	int i, failure = 0;
	for (i = 0; valid_domain_constraints[i] != NULL; i++) {
		CBS cbs;
		CBS_init(&cbs, valid_domain_constraints[i],
		    strlen(valid_domain_constraints[i]));
		if (!x509_constraints_valid_domain_constraint(&cbs)) {
			FAIL("Valid dnsname '%s' rejected\n",
			    valid_domain_constraints[i]);
			failure = 1;
			goto done;
		}
	}

 done:
	return failure;
}

static int
test_valid_mbox_names(void)
{
	struct x509_constraints_name name = {0};
	int i, failure = 0;
	for (i = 0; valid_mbox_names[i] != NULL; i++) {
		CBS cbs;
		CBS_init(&cbs, valid_mbox_names[i],
		    strlen(valid_mbox_names[i]));
		if (!x509_constraints_parse_mailbox(&cbs, &name)) {
			FAIL("Valid mailbox name '%s' rejected\n",
			    valid_mbox_names[i]);
			failure = 1;
			goto done;
		}
		free(name.name);
		name.name = NULL;
		free(name.local);
		name.local = NULL;
	}

 done:
	return failure;
}

static int
test_invalid_hostnames(void)
{
	int i, failure = 0;
	char *nulhost = "www.openbsd.org\0";
	CBS cbs;

	for (i = 0; invalid_hostnames[i] != NULL; i++) {
		CBS_init(&cbs, invalid_hostnames[i],
		    strlen(invalid_hostnames[i]));
		if (x509_constraints_valid_host(&cbs, 0)) {
			FAIL("Invalid hostname '%s' accepted\n",
			    invalid_hostnames[i]);
			failure = 1;
			goto done;
		}
	}
	CBS_init(&cbs, nulhost, strlen(nulhost) + 1);
	if (x509_constraints_valid_host(&cbs, 0)) {
		FAIL("hostname with NUL byte accepted\n");
		failure = 1;
		goto done;
	}
	CBS_init(&cbs, nulhost, strlen(nulhost) + 1);
	if (x509_constraints_valid_sandns(&cbs)) {
		FAIL("sandns with NUL byte accepted\n");
		failure = 1;
		goto done;
	}

 done:
	return failure;
}

static int
test_invalid_sandns_names(void)
{
	int i, failure = 0;
	for (i = 0; invalid_sandns_names[i] != NULL; i++) {
		CBS cbs;
		CBS_init(&cbs, invalid_sandns_names[i],
		    strlen(invalid_sandns_names[i]));
		if (x509_constraints_valid_sandns(&cbs)) {
			FAIL("Valid dnsname '%s' rejected\n",
			    invalid_sandns_names[i]);
			failure = 1;
			goto done;
		}
	}

 done:
	return failure;
}

static int
test_invalid_mbox_names(void)
{
	int i, failure = 0;
	struct x509_constraints_name name = {0};
	for (i = 0; invalid_mbox_names[i] != NULL; i++) {
		CBS cbs;
		CBS_init(&cbs, invalid_mbox_names[i],
		    strlen(invalid_mbox_names[i]));
		if (x509_constraints_parse_mailbox(&cbs, &name)) {
			FAIL("invalid mailbox name '%s' accepted\n",
			    invalid_mbox_names[i]);
			failure = 1;
			goto done;
		}
		free(name.name);
		name.name = NULL;
		free(name.local);
		name.local = NULL;
	}

 done:
	return failure;
}

static int
test_invalid_domain_constraints(void)
{
	int i, failure = 0;
	for (i = 0; invalid_domain_constraints[i] != NULL; i++) {
		CBS cbs;
		CBS_init(&cbs, invalid_domain_constraints[i],
		    strlen(invalid_domain_constraints[i]));
		if (x509_constraints_valid_domain_constraint(&cbs)) {
			FAIL("invalid dnsname '%s' accepted\n",
			    invalid_domain_constraints[i]);
			failure = 1;
			goto done;
		}
	}

 done:
	return failure;
}

static int
test_invalid_uri(void)
{
	int j, failure = 0;
	char *hostpart = NULL;

	for (j = 0; invaliduri[j] != NULL; j++) {
		if (x509_constraints_uri_host(invaliduri[j],
		    strlen(invaliduri[j]), &hostpart) != 0) {
			FAIL("invalid URI '%s' accepted\n",
			    invaliduri[j]);
			failure = 1;
			goto done;
		}
		free(hostpart);
		hostpart = NULL;
	}

 done:
	return failure;
}

static int
test_valid_uri(void)
{
	int j, failure = 0;
	char *hostpart = NULL;

	for (j = 0; validuri[j] != NULL; j++) {
		if (x509_constraints_uri_host(validuri[j],
		    strlen(invaliduri[j]), &hostpart) == 0) {
			FAIL("Valid URI '%s' NOT accepted\n",
			    validuri[j]);
			failure = 1;
			goto done;
		}
		free(hostpart);
		hostpart = NULL;
	}

 done:
	return failure;
}

static int
test_constraints1(void)
{
	char *c;
	size_t cl;
	char *d;
	size_t dl;
	int failure = 0;
	int error = 0;
	int i, j;
	unsigned char *constraints[] = {
		".org",
		".openbsd.org",
		"www.openbsd.org",
		NULL,
	};
	unsigned char *failing[] = {
		".ca",
		"openbsd.ca",
		"org",
		NULL,
	};
	unsigned char *matching[] = {
		"www.openbsd.org",
		NULL,
	};
	unsigned char *matchinguri[] = {
		"https://www.openbsd.org",
		"https://www.openbsd.org/",
		"https://www.openbsd.org?",
		"https://www.openbsd.org#",
		"herp://beck@www.openbsd.org:",
		"spiffe://beck@www.openbsd.org/this/is/so/spiffe/",
		NULL,
	};
	unsigned char *failinguri[] = {
		"https://www.openbsd.ca",
		"https://www.freebsd.com/",
		"https://www.openbsd.net?",
		"https://org#",
		"herp://beck@org:",
		"///",
		"//",
		"/",
		"",
		NULL,
	};
	unsigned char *noauthority[] = {
		"urn:open62541.server.application",
		NULL,
	};
	for (i = 0; constraints[i] != NULL; i++) {
		char *constraint = constraints[i];
		size_t clen = strlen(constraints[i]);
		for (j = 0; matching[j] != NULL; j++) {
			if (!x509_constraints_domain(matching[j],
			    strlen(matching[j]), constraint, clen)) {
				FAIL("constraint '%s' should have matched"
				    " '%s'\n",
				    constraint, matching[j]);
				failure = 1;
				goto done;
			}
		}
		for (j = 0; matchinguri[j] != NULL; j++) {
			error = 0;
			if (!x509_constraints_uri(matchinguri[j],
			    strlen(matchinguri[j]), constraint, clen, &error)) {
				FAIL("constraint '%s' should have matched URI"
				    " '%s' (error %d)\n",
				    constraint, matchinguri[j], error);
				failure = 1;
				goto done;
			}
		}
		for (j = 0; failing[j] != NULL; j++) {
			if (x509_constraints_domain(failing[j],
			    strlen(failing[j]), constraint, clen)) {
				FAIL("constraint '%s' should not have matched"
				    " '%s'\n",
				    constraint, failing[j]);
				failure = 1;
				goto done;
			}
		}
		for (j = 0; failinguri[j] != NULL; j++) {
			error = 0;
			if (x509_constraints_uri(failinguri[j],
			    strlen(failinguri[j]), constraint, clen, &error)) {
				FAIL("constraint '%s' should not have matched URI"
				    " '%s' (error %d)\n",
				    constraint, failinguri[j], error);
				failure = 1;
				goto done;
			}
		}
		for (j = 0; noauthority[j] != NULL; j++) {
			char *hostpart = NULL;
			error = 0;
			if (!x509_constraints_uri_host(noauthority[j],
			    strlen(noauthority[j]), NULL) ||
			    !x509_constraints_uri_host(noauthority[j],
			    strlen(noauthority[j]), &hostpart)) {
				FAIL("name '%s' should parse as a URI",
				    noauthority[j]);
				failure = 1;
				free(hostpart);
				goto done;
			}
			free(hostpart);

			if (x509_constraints_uri(noauthority[j],
			    strlen(noauthority[j]), constraint, clen, &error)) {
				FAIL("constraint '%s' should not have matched URI"
				    " '%s' (error %d)\n",
				    constraint, failinguri[j], error);
				failure = 1;
				goto done;
			}
		}
	}
	c = ".openbsd.org";
	cl = strlen(".openbsd.org");
	d = "*.openbsd.org";
	dl = strlen("*.openbsd.org");
	if (!x509_constraints_domain(d, dl, c, cl)) {
		FAIL("constraint '%s' should have matched '%s'\n",
		    c, d);
		failure = 1;
		goto done;
	}
	c = "www.openbsd.org";
	cl = strlen("www.openbsd.org");
	if (x509_constraints_domain(d, dl, c, cl)) {
		FAIL("constraint '%s' should not have matched '%s'\n",
		    c, d);
		failure = 1;
		goto done;
	}
	c = "";
	cl = 0;
	if (!x509_constraints_domain(d, dl, c, cl)) {
		FAIL("constraint '%s' should have matched '%s'\n",
		    c, d);
		failure = 1;
		goto done;
	}

 done:
	return failure;
}

int
main(int argc, char **argv)
{
	int failed = 0;

	failed |= test_valid_hostnames();
	failed |= test_invalid_hostnames();
	failed |= test_valid_sandns_names();
	failed |= test_invalid_sandns_names();
	failed |= test_valid_mbox_names();
	failed |= test_invalid_mbox_names();
	failed |= test_valid_domain_constraints();
	failed |= test_invalid_domain_constraints();
	failed |= test_invalid_uri();
	failed |= test_valid_uri();
	failed |= test_constraints1();

	return (failed);
}