From 962d24212dbc61b6e2f4092ef1d27c19e926c8a1 Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Thu, 25 May 2017 21:16:54 +0100 Subject: [PATCH] Add test case for non-ASCII password on PKCS#12 keys Signed-off-by: David Woodhouse --- tests/Makefile.am | 10 ++++- tests/auth-nonascii | 45 +++++++++++++++++++++ tests/certs/user-key-nonascii-password.p12 | Bin 0 -> 2739 bytes tests/pass-ISO8859-2 | 1 + tests/pass-UTF-8 | 1 + 5 files changed, 55 insertions(+), 2 deletions(-) create mode 100755 tests/auth-nonascii create mode 100644 tests/certs/user-key-nonascii-password.p12 create mode 100644 tests/pass-ISO8859-2 create mode 100644 tests/pass-UTF-8 diff --git a/tests/Makefile.am b/tests/Makefile.am index 06e9cb65..88261546 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -42,7 +42,7 @@ EXTRA_DIST = certs/ca.pem certs/ca-key.pem certs/user-cert.pem $(USER_KEYS) $(US dist_check_SCRIPTS = if HAVE_CWRAP -dist_check_SCRIPTS += auth-username-pass auth-certificate id-test +dist_check_SCRIPTS += auth-username-pass auth-certificate auth-nonascii id-test if TEST_PKCS11 dist_check_SCRIPTS += auth-pkcs11 @@ -99,7 +99,7 @@ keyfiles: $(USER_KEYS) $(USER_CERTS) OPENSSL = openssl OSSLARGS = -in $< -out $@ -passout pass:password -OSSLARGSP12 = -inkey $< -out $@ -in $${KEYFILE%-key-pkcs8.pem}-cert.pem -passout pass:password +OSSLARGSP12 = -inkey $< -out $@ -in $${KEYFILE%-key-pkcs8.pem}-cert.pem -passout pass:$${PASSWORD%-password} # Strictly speaking this is only PKCS#1 for RSA. For EC it's probably # best described as RFC5915§4, and no idea what defines it for DSA. @@ -156,6 +156,12 @@ $(certsdir)/ec-key-pkcs1-aes128.pem: certs/ec-key-pkcs1.pem KEYFILE="$<"; $(OPENSSL) pkcs12 $(OSSLARGSP12) -export -macalg SHA256 \ -certpbe AES-256-CBC -keypbe AES-256-CBC +# NB: Needs OpenSSL 1.1 or newer +%-key-nonascii-password.p12: %-key-pkcs8.pem %-cert.pem + LC_ALL=en_GB.UTF-8 PASSWORD="$$(cat $(srcdir)/pass-UTF-8)" KEYFILE="$<" ; \ + $(OPENSSL) pkcs12 $(OSSLARGSP12) -export -macalg SHA256 \ + -certpbe AES-256-CBC -keypbe AES-256-CBC + # This one makes GnuTLS behave strangely... %-key-aes256-cbc-md5-des-sha256.p12: %-key-pkcs8.pem %-cert.pem KEYFILE="$<"; $(OPENSSL) pkcs12 $(OSSLARGSP12) -export -macalg SHA256 \ diff --git a/tests/auth-nonascii b/tests/auth-nonascii new file mode 100755 index 00000000..d930b117 --- /dev/null +++ b/tests/auth-nonascii @@ -0,0 +1,45 @@ +#!/bin/sh +# +# Copyright (C) 2016 Red Hat, Inc. +# +# This file is part of openconnect. +# +# This is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public License +# as published by the Free Software Foundation; either version 2.1 of +# the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this program. If not, see + +SERV="${SERV:-../src/ocserv}" +srcdir=${srcdir:-.} +top_builddir=${top_builddir:-..} + +. `dirname $0`/common.sh + +echo "Testing certificate auth with non-ASCII passwords... " + +launch_simple_sr_server -d 1 -f -c configs/test-user-cert.config +PID=$! +wait_server $PID + +KEY=${srcdir}/certs/user-key-nonascii-password.p12 +set -x +for CHARSET in UTF-8 ISO8859-2; do + echo -n "Connecting to obtain cookie (with password charset ${CHARSET})... " + CERTARGS="-c ${KEY} --key-password $(cat ${srcdir}/pass-${CHARSET})" + ( echo "test" | LC_CTYPE=cs_CZ.${CHARSET} LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:443 -u test $CERTARGS --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly --passwd-on-stdin ) || + fail $PID "Could not connect with charset ${CHARSET}!" +done + +echo ok + +cleanup + +exit 0 diff --git a/tests/certs/user-key-nonascii-password.p12 b/tests/certs/user-key-nonascii-password.p12 new file mode 100644 index 0000000000000000000000000000000000000000..1c903473fea905d111ad369a3050f71c66e29ad9 GIT binary patch literal 2739 zcmai$X*kpi1I3LQV`)&*M3X(q{x=#TW$bIlo@FR|mLX*+OU$1;j5Rxhh!SqLNegL^ z>>-jwi|orF23g1Z+~<9t?#K7zdCrIP>HN+CK&~2A2owOhJm8!%Btz0~ZU{T1804~r zfn1gV$YlnA(Di>Ucrgf_0zl{wRtO6KLP!5~Ai&i>f{hz62BiO$2;ek~gHUkXbr@Uj z$jZvW0wCZV|4n1%WMct@;GEYVKfv=1>afxl10z*NVRMv9k7^}Z=;tR z+XpMs;lCTtEjOj0?goc-^wJbAK$miBth(EhZ^9W;^({a9vaN{p{Fe))uD zJcy8p>N|ZD;M2LfE*9%Qc{E<*!&SS82%h+s#jjI-V)@6LguY(azWcG@@^|gloxdxN zSl4gcVv?fc{AHgNc|e|oUON~5*QjsL!g1|IHa-)BL0w1~W1lx4f2=INCckbz%ljOc zDYxyF&`4{WkGT;z$)sJvL7Y!b8ZGO!`)+&796JW}1QTgG{GTT$uPyBiL$|e4! zvRqEOE7EW0cic^W^k|wffe|D4`B7!(3PkP=D$H* zu`?0Pk{#>DRZI9j~@^TMwF0y^UE8+CfRr-yixuK zsuQFrD$XZMfBC!qN*Jk9fV$XeQgwq~7*Xcrofk;?d22daX^}&6-h{^drP^M4@5PVb zbw(?Rh*z1bd|o+>R4<5NA((gN<^^5w5ac!o_?WY!7Q5FWz(i zhTAagOWh97;XCKd`pVJpn)Jii(!ZzRZ&Ddp|<%Z(@*KkAL5vZM;Yuz_>Me?=}Vp2{P*l^}7 z;f1$Yb34Y;MqFl$_?@2Y@=i#O7E}e!v54o7j+~cVY&)qHb}3|_#G@*xP+SfRfN<+S z{rv|Ba6K3Z*8)KJB>;r0!H@ip6$mZ}YcU9i03h4J{{uk9Xz_N(1cLZ~0pKRn?^oj8 ztWXFePK|7;D#AdvVxvd`j&RYu=V6=MvcwAiwRFx@crH=;7!%St)!KFOef#wWS%PG| zUmjk$QXqv~YT(Fk(nsf?yKOQE>L#F)&-m&o_`7#57^HJ!bjz%YGO_Mv_>kKval834 zg}W_$_2%eSnJZvKMr}yR*Dqq346S-4qyZzRc!ctRQp9fD-3$j(fT*; zAMz`Id^?(TzN`M_SpEr{J=*7ZRU0JOQC^O#c$~OGrKRmrxFCpNs0_ zM)p+t*>Tv@GRN>@y)$r2+4=0RYb_h0nSdI9=d=;`MuNI-cZ`}dbC*p7LOo(=4PkE2WfpVu2))hTqeZlbVw)2@WpqKh^Vm zU0!%9I!Z&j(An8)u$DOyhc$&MJAS!yFJGO$&XY(TPOvccGNaHlo{$*MGz#nY?A>8= z(n?~SztUcGy$aRo1783ouo(M>>9H}EGYrb9~`s}B&$L{a!Y9^D@9mG zjt0DK(DNv0cj)gnEQ~$!XJ#g@}8vxH*|r% zP=ZBCv&|+~YBe4ozMRoPtUG*M`D{kx*SFSg+RGWiQ|rE8+wP!j>sUntg!-wrK=AVE zq?9a-yP;k}?&~IgH_w{b6{9x4MI7%UxqZ4_BDy?w{D;hRb5QBxn~mZPRcxftmcaMc^(xh zW`lR&Z*?@%pLr^Xxg$xgcCR(kpb4XxD`I3}UDk612bhC+P06cAE~{uVo)g*Qk+FjL zwAAkk9ReJBwU6)Z+fhB)^!605qZ5)>ar7n4I=5{5)gx8n`rCHJ&UnOf&-L}>Ey0^k z!cAKv$g^`fA{)AL8uHSh$PuQ!-D{M+v0?dyDB9wx!43EGHRkWQ_`CO^WIm@96<>0y zbu45I-i`9VrKqFk@hQSC`7m$8h$2*IRnY>J)Ld8&c*tFjV>%fpD|UUhm|o4N{N+-+2(r`*ogEC_phP{4dVzwOl#$=I z`7kM#{3G@qCpBj1Xt>MeX{~#9L@(Fx4btP(``GkM85oxL>|@1no>220Xv=zIbWg6 jNy($_9RtHYj#1c_JM&p3?l6uh%Mbngp{n2hnU4Pe|CI%i literal 0 HcmV?d00001 diff --git a/tests/pass-ISO8859-2 b/tests/pass-ISO8859-2 new file mode 100644 index 00000000..4731a84b --- /dev/null +++ b/tests/pass-ISO8859-2 @@ -0,0 +1 @@ +ï diff --git a/tests/pass-UTF-8 b/tests/pass-UTF-8 new file mode 100644 index 00000000..198277f8 --- /dev/null +++ b/tests/pass-UTF-8 @@ -0,0 +1 @@ +ĂŻ -- 2.49.0