denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

identification: Optionally match RDNs in any order and accept missing RDNs

Browse Source
This commit is contained in:
Tobias Brunner
2019-08-26 11:15:53 +02:00
parent c0d5c6553a
commit 770f4ccee1
3 changed files with 338 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/tests/suites/test_identification.c
+101 -12
View File
@@ -626,23 +626,111 @@ static bool id_matches(identification_t *a, char *b_str, id_match_t expected)
return match == expected;
}
static char* rdn_matching[] = { NULL, "reordered", "relaxed" };
static struct {
char *id;
id_match_t match[3];
} matches_data[] = {
/* C=CH, [email protected], CN=moon */
{ "C=CH, [email protected], CN=moon", {
ID_MATCH_PERFECT, ID_MATCH_PERFECT, ID_MATCH_PERFECT }},
{ "C=CH, [email protected], CN=moon", {
ID_MATCH_PERFECT, ID_MATCH_PERFECT, ID_MATCH_PERFECT }},
{ "C=CH, [email protected], CN=moon", {
ID_MATCH_PERFECT, ID_MATCH_PERFECT, ID_MATCH_PERFECT }},
{ "CN=moon, C=CH, [email protected]", {
ID_MATCH_NONE, ID_MATCH_PERFECT, ID_MATCH_PERFECT }},
{ "C=CH, E=*@strongswan.org, CN=moon", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_NONE }},
{ "C=CH, E=*, CN=moon", {
ID_MATCH_ONE_WILDCARD, ID_MATCH_ONE_WILDCARD, ID_MATCH_ONE_WILDCARD }},
{ "C=CH, E=*, CN=*", {
ID_MATCH_ONE_WILDCARD - 1, ID_MATCH_ONE_WILDCARD - 1, ID_MATCH_ONE_WILDCARD - 1 }},
{ "C=*, E=*, CN=*", {
ID_MATCH_ONE_WILDCARD - 2, ID_MATCH_ONE_WILDCARD - 2, ID_MATCH_ONE_WILDCARD - 2 }},
{ "C=*, E=*, CN=*, O=BADInc", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_NONE }},
{ "C=CH, CN=*", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_ONE_WILDCARD - 1 }},
{ "C=*, E=*", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_ONE_WILDCARD - 2 }},
{ "C=*, [email protected], CN=*", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_NONE }},
{ "C=CH, O=strongSwan, E=*, CN=*", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_NONE }},
{ "", {
ID_MATCH_ANY, ID_MATCH_ANY, ID_MATCH_ANY }},
{ "%any", {
ID_MATCH_ANY, ID_MATCH_ANY, ID_MATCH_ANY }},
};
START_TEST(test_matches)
{
identification_t *a;
int i;
if (rdn_matching[_i])
{
lib->settings->set_str(lib->settings, "%s.rdn_matching",
rdn_matching[_i], lib->ns);
}
a = identification_create_from_string("C=CH, [email protected], CN=moon");
ck_assert(id_matches(a, "C=CH, [email protected], CN=moon", ID_MATCH_PERFECT));
ck_assert(id_matches(a, "C=CH, [email protected], CN=moon", ID_MATCH_PERFECT));
ck_assert(id_matches(a, "C=CH, [email protected], CN=moon", ID_MATCH_PERFECT));
ck_assert(id_matches(a, "C=CH, E=*@strongswan.org, CN=moon", ID_MATCH_NONE));
ck_assert(id_matches(a, "C=CH, E=*, CN=moon", ID_MATCH_ONE_WILDCARD));
ck_assert(id_matches(a, "C=CH, E=*, CN=*", ID_MATCH_ONE_WILDCARD - 1));
ck_assert(id_matches(a, "C=*, E=*, CN=*", ID_MATCH_ONE_WILDCARD - 2));
ck_assert(id_matches(a, "C=*, E=*, CN=*, O=BADInc", ID_MATCH_NONE));
ck_assert(id_matches(a, "C=*, E=*", ID_MATCH_NONE));
ck_assert(id_matches(a, "C=*, [email protected], CN=*", ID_MATCH_NONE));
ck_assert(id_matches(a, "%any", ID_MATCH_ANY));
for (i = 0; i < countof(matches_data); i++)
{
ck_assert(id_matches(a, matches_data[i].id, matches_data[i].match[_i]));
}
a->destroy(a);
}
END_TEST
static struct {
char *id;
id_match_t match[3];
} matches_two_ou_data[] = {
/* C=CH, OU=Research, OU=Floor A, CN=moon */
{ "C=CH, OU=Research, OU=Floor A, CN=moon", {
ID_MATCH_PERFECT, ID_MATCH_PERFECT, ID_MATCH_PERFECT }},
{ "C=CH, OU=Floor A, CN=moon", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_ONE_WILDCARD }},
{ "C=CH, CN=moon", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_ONE_WILDCARD - 1 }},
{ "C=CH, OU=*, CN=moon", {
ID_MATCH_NONE, ID_MATCH_NONE, ID_MATCH_ONE_WILDCARD - 1 }},
{ "C=CH, OU=*, OU=*, CN=moon", {
ID_MATCH_ONE_WILDCARD - 1, ID_MATCH_ONE_WILDCARD - 1, ID_MATCH_ONE_WILDCARD - 1 }},
{ "C=CH, OU=Research, OU=*, CN=moon", {
ID_MATCH_ONE_WILDCARD, ID_MATCH_ONE_WILDCARD, ID_MATCH_ONE_WILDCARD }},
{ "C=CH, OU=*, OU=Floor A, CN=moon", {
ID_MATCH_ONE_WILDCARD, ID_MATCH_ONE_WILDCARD, ID_MATCH_ONE_WILDCARD }},
{ "C=CH, OU=*, OU=Research, CN=moon", {
ID_MATCH_NONE, ID_MATCH_ONE_WILDCARD, ID_MATCH_ONE_WILDCARD }},
{ "C=CH, OU=Floor A, OU=*, CN=moon", {
ID_MATCH_NONE, ID_MATCH_ONE_WILDCARD, ID_MATCH_ONE_WILDCARD }},
{ "C=CH, OU=Floor A, OU=Research, CN=moon", {
ID_MATCH_NONE, ID_MATCH_PERFECT, ID_MATCH_PERFECT }},
};
START_TEST(test_matches_two_ou)
{
identification_t *a;
int i;
if (rdn_matching[_i])
{
lib->settings->set_str(lib->settings, "%s.rdn_matching",
rdn_matching[_i], lib->ns);
}
a = identification_create_from_string("C=CH, OU=Research, OU=Floor A, CN=moon");
for (i = 0; i < countof(matches_two_ou_data); i++)
{
ck_assert(id_matches(a, matches_two_ou_data[i].id, matches_two_ou_data[i].match[_i]));
}
a->destroy(a);
}
@@ -1094,7 +1182,8 @@ Suite *identification_suite_create()
suite_add_tcase(s, tc);
tc = tcase_create("matches");
tcase_add_test(tc, test_matches);
tcase_add_loop_test(tc, test_matches, 0, countof(rdn_matching));
tcase_add_loop_test(tc, test_matches_two_ou, 0, countof(rdn_matching));
tcase_add_test(tc, test_matches_any);
tcase_add_test(tc, test_matches_binary);
tcase_add_test(tc, test_matches_range);