libgo: update to Go 1.11

[gcc.git] / libgo / go / crypto / x509 / name_constraints_test.go

diff --git a/libgo/go/crypto/x509/name_constraints_test.go b/libgo/go/crypto/x509/name_constraints_test.go
index 95d55fd7619b4f5ab3310b4fcfbd40e8e4179037..4c9bc1b87a60f3b41c9f8ff1778ac230f47cf122 100644 (file)
--- a/libgo/go/crypto/x509/name_constraints_test.go
+++ b/libgo/go/crypto/x509/name_constraints_test.go
@@ -46,6 +46,7 @@ type nameConstraintsTest struct {
        requestedEKUs []ExtKeyUsage
        expectedError string
        noOpenSSL     bool
+       ignoreCN      bool
 }
 
 type constraintsSpec struct {
@@ -57,6 +58,7 @@ type constraintsSpec struct {
 type leafSpec struct {
        sans []string
        ekus []string
+       cn   string
 }
 
 var nameConstraintsTests = []nameConstraintsTest{
@@ -633,7 +635,7 @@ var nameConstraintsTests = []nameConstraintsTest{
                },
        },
 
-       // #30: without SANs, a certificate is rejected in a constrained chain.
+       // #30: without SANs, a certificate with a CN is rejected in a constrained chain.
        nameConstraintsTest{
                roots: []constraintsSpec{
                        constraintsSpec{
@@ -647,9 +649,9 @@ var nameConstraintsTests = []nameConstraintsTest{
                },
                leaf: leafSpec{
                        sans: []string{},
+                       cn:   "foo.com",
                },
                expectedError: "leaf doesn't have a SAN extension",
-               noOpenSSL:     true, // OpenSSL doesn't require SANs in this case.
        },
 
        // #31: IPv6 addresses work in constraints: roots can permit them as
@@ -1580,6 +1582,80 @@ var nameConstraintsTests = []nameConstraintsTest{
                        ekus: []string{"email", "serverAuth"},
                },
        },
+
+       // #82: a certificate without SANs and CN is accepted in a constrained chain.
+       nameConstraintsTest{
+               roots: []constraintsSpec{
+                       constraintsSpec{
+                               ok: []string{"dns:foo.com", "dns:.foo.com"},
+                       },
+               },
+               intermediates: [][]constraintsSpec{
+                       []constraintsSpec{
+                               constraintsSpec{},
+                       },
+               },
+               leaf: leafSpec{
+                       sans: []string{},
+               },
+       },
+
+       // #83: a certificate without SANs and with a CN that does not parse as a
+       // hostname is accepted in a constrained chain.
+       nameConstraintsTest{
+               roots: []constraintsSpec{
+                       constraintsSpec{
+                               ok: []string{"dns:foo.com", "dns:.foo.com"},
+                       },
+               },
+               intermediates: [][]constraintsSpec{
+                       []constraintsSpec{
+                               constraintsSpec{},
+                       },
+               },
+               leaf: leafSpec{
+                       sans: []string{},
+                       cn:   "foo,bar",
+               },
+       },
+
+       // #84: a certificate with SANs and CN is accepted in a constrained chain.
+       nameConstraintsTest{
+               roots: []constraintsSpec{
+                       constraintsSpec{
+                               ok: []string{"dns:foo.com", "dns:.foo.com"},
+                       },
+               },
+               intermediates: [][]constraintsSpec{
+                       []constraintsSpec{
+                               constraintsSpec{},
+                       },
+               },
+               leaf: leafSpec{
+                       sans: []string{"dns:foo.com"},
+                       cn:   "foo.bar",
+               },
+       },
+
+       // #85: without SANs, a certificate with a valid CN is accepted in a
+       // constrained chain if x509ignoreCN is set.
+       nameConstraintsTest{
+               roots: []constraintsSpec{
+                       constraintsSpec{
+                               ok: []string{"dns:foo.com", "dns:.foo.com"},
+                       },
+               },
+               intermediates: [][]constraintsSpec{
+                       []constraintsSpec{
+                               constraintsSpec{},
+                       },
+               },
+               leaf: leafSpec{
+                       sans: []string{},
+                       cn:   "foo.com",
+               },
+               ignoreCN: true,
+       },
 }
 
 func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) {
@@ -1625,9 +1701,8 @@ func makeConstraintsLeafCert(leaf leafSpec, key *ecdsa.PrivateKey, parent *Certi
        template := &Certificate{
                SerialNumber: new(big.Int).SetBytes(serialBytes[:]),
                Subject: pkix.Name{
-                       // Don't set a CommonName because OpenSSL (at least) will try to
-                       // match it against name constraints.
                        OrganizationalUnit: []string{"Leaf"},
+                       CommonName:         leaf.cn,
                },
                NotBefore:             time.Unix(1000, 0),
                NotAfter:              time.Unix(2000, 0),
@@ -1831,6 +1906,10 @@ func parseEKUs(ekuStrs []string) (ekus []ExtKeyUsage, unknowns []asn1.ObjectIden
 }
 
 func TestConstraintCases(t *testing.T) {
+       defer func(savedIgnoreCN bool) {
+               ignoreCN = savedIgnoreCN
+       }(ignoreCN)
+
        privateKeys := sync.Pool{
                New: func() interface{} {
                        priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
@@ -1899,7 +1978,9 @@ func TestConstraintCases(t *testing.T) {
                        t.Fatalf("#%d: cannot create leaf: %s", i, err)
                }
 
-               if !test.noOpenSSL && testNameConstraintsAgainstOpenSSL {
+               // Skip tests with CommonName set because OpenSSL will try to match it
+               // against name constraints, while we ignore it when it's not hostname-looking.
+               if !test.noOpenSSL && testNameConstraintsAgainstOpenSSL && test.leaf.cn == "" {
                        output, err := testChainAgainstOpenSSL(leafCert, intermediatePool, rootPool)
                        if err == nil && len(test.expectedError) > 0 {
                                t.Errorf("#%d: unexpectedly succeeded against OpenSSL", i)
@@ -1912,7 +1993,7 @@ func TestConstraintCases(t *testing.T) {
                                if _, ok := err.(*exec.ExitError); !ok {
                                        t.Errorf("#%d: OpenSSL failed to run: %s", i, err)
                                } else if len(test.expectedError) == 0 {
-                                       t.Errorf("#%d: OpenSSL unexpectedly failed: %q", i, output)
+                                       t.Errorf("#%d: OpenSSL unexpectedly failed: %v", i, output)
                                        if debugOpenSSLFailure {
                                                return
                                        }
@@ -1920,6 +2001,7 @@ func TestConstraintCases(t *testing.T) {
                        }
                }
 
+               ignoreCN = test.ignoreCN
                verifyOpts := VerifyOptions{
                        Roots:         rootPool,
                        Intermediates: intermediatePool,
@@ -1949,7 +2031,7 @@ func TestConstraintCases(t *testing.T) {
                        certAsPEM := func(cert *Certificate) string {
                                var buf bytes.Buffer
                                pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
-                               return string(buf.Bytes())
+                               return buf.String()
                        }
                        t.Errorf("#%d: root:\n%s", i, certAsPEM(rootPool.certs[0]))
                        t.Errorf("#%d: leaf:\n%s", i, certAsPEM(leafCert))
@@ -2012,7 +2094,7 @@ func testChainAgainstOpenSSL(leaf *Certificate, intermediates, roots *CertPool)
        cmd.Stderr = &output
 
        err := cmd.Run()
-       return string(output.Bytes()), err
+       return output.String(), err
 }
 
 var rfc2821Tests = []struct {