tests/cert-tests: add tests for #1825

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

diff --git a/tests/cert-tests/email-certs/oversized-san.pem b/tests/cert-tests/email-certs/oversized-san.pem
new file mode 100644 (file)
index 0000000..44c0f69
--- /dev/null
+++ b/tests/cert-tests/email-certs/oversized-san.pem
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICezCCAi2gAwIBAgIUWECpllJihTypDAKZQgEJeM02fG8wBQYDK2VwMDcxFDAS
+BgNVBAMTC2V4YW1wbGUuY29tMR8wHQYJKoZIhvcNAQkBFhB0ZXN0QGV4YW1wbGUu
+Y29tMB4XDTI2MDQxNTE1NTE1MloXDTI3MDQxNTE1NTE1MlowNzEUMBIGA1UEAxML
+ZXhhbXBsZS5jb20xHzAdBgkqhkiG9w0BCQEWEHRlc3RAZXhhbXBsZS5jb20wKjAF
+BgMrZXADIQCn95fhASNNgr5I/qAX+kiY8SiwPJcTVy1ugWJdX3d4uqOCAUkwggFF
+MA8GA1UdEwEB/wQFMAMBAf8wggERBgNVHREEggEIMIIBBIGCAQBhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
+YWFhYWFhMB0GA1UdDgQWBBTeT2MAM29EwVLvTom8wGN05B7QhDAFBgMrZXADQQAQ
+zTZqdt4LXX21VFce7S99k6XX+N+xPAUo4beursVrlaesdVsfvDtEk2t+0b5WLbtW
+7UI9PxB9CN4hULrxrI8N
+-----END CERTIFICATE-----

diff --git a/tests/cert-tests/email.sh b/tests/cert-tests/email.sh
index 68fbe3e126a3e243f47e3b80723941c12dfebfd5..8d3ca3317a42e9f6434ce7f7339d83722834e284 100644 (file)
--- a/tests/cert-tests/email.sh
+++ b/tests/cert-tests/email.sh
@@ -95,5 +95,16 @@ if test "${rc}" != "1"; then
        exit 1
 fi
 
+# #1825: oversized SAN does not preclude fallback to DN email
+${VALGRIND} "${CERTTOOL}" \
+       --infile "${srcdir}/email-certs/oversized-san.pem" \
+       --load-ca-certificate "${srcdir}/email-certs/oversized-san.pem" \
+       --verify --verify-email test@example.com
+rc=$?
+
+if test "${rc}" != "1"; then
+       echo "email test 9 failed"
+       exit 1
+fi
 
 exit 0

diff --git a/tests/hostname-check.c b/tests/hostname-check.c
index 4357f33f31656f6736a8ba1692f26f23790857ec..4a4cdf9568ae9512742c01bda72ce8a66bc71ed5 100644 (file)
--- a/tests/hostname-check.c
+++ b/tests/hostname-check.c
@@ -897,6 +897,25 @@ char srv_and_cn[] =
        "p9Nnj64WFIqbTLoqM3nt7+zqFZDvwh+8ZEVcE1MazHOYhDQj1uU3jqIq/sZE8w==\n"
        "-----END CERTIFICATE-----\n";
 
+char pem_1825_oversized_san[] =
+       "ca\n"
+       "cn = example.com\n"
+       "dns_name = <'a' * 256>\n"
+       "-----BEGIN CERTIFICATE-----\n"
+       "MIICOTCCAeugAwIBAgIURFygaiK3EBmc5AMZToFitMMikhcwBQYDK2VwMBYxFDAS\n"
+       "BgNVBAMTC2V4YW1wbGUuY29tMB4XDTI2MDQxNTE2MDYwMFoXDTI3MDQxNTE2MDYw\n"
+       "MFowFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wKjAFBgMrZXADIQBHqgbjhT1zZ3h9\n"
+       "okSrhd2+0Lr0Uj1q81sqHrcCEdqVpaOCAUkwggFFMA8GA1UdEwEB/wQFMAMBAf8w\n"
+       "ggERBgNVHREEggEIMIIBBIKCAQBhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh\n"
+       "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh\n"
+       "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh\n"
+       "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh\n"
+       "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh\n"
+       "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhMB0GA1UdDgQWBBT+\n"
+       "/oWt1Lrfz7Awk9h8yDoz1TKyHjAFBgMrZXADQQBfR5ByQyxpLEsVM5+ihYjSbmYF\n"
+       "1pOFndq0UIKPkWsRqBpitzDIVrVTLlIcY0fQpsxITNgdoIU68WynLGVrRHIF\n"
+       "-----END CERTIFICATE-----\n";
+
 void doit(void)
 {
        gnutls_x509_crt_t x509;
@@ -1315,6 +1334,21 @@ void doit(void)
                fail("%d: Hostname incorrectly falls back to CN (%d)\n",
                     __LINE__, ret);
 
+       if (debug)
+               success("Testing oversized SAN (#1825)...\n");
+       data.data = (unsigned char *)pem_1825_oversized_san;
+       data.size = strlen(pem_1825_oversized_san);
+
+       ret = gnutls_x509_crt_import(x509, &data, GNUTLS_X509_FMT_PEM);
+       if (ret < 0)
+               fail("%d: gnutls_x509_crt_import: %d\n", __LINE__, ret);
+
+       ret = gnutls_x509_crt_check_hostname(x509, "example.com");
+       if (ret)
+               fail("%d: Hostname incorrectly falls back to CN "
+                    "with oversized SAN (%d)\n",
+                    __LINE__, ret);
+
        gnutls_x509_crt_deinit(x509);
 
        gnutls_global_deinit();