1#!/usr/bin/env python3 2# Copyright 2015 The Chromium Authors 3# Use of this source code is governed by a BSD-style license that can be 4# found in the LICENSE file. 5 6import base64 7import copy 8import os 9import random 10import subprocess 11import sys 12import tempfile 13 14sys.path += [os.path.join('..', 'verify_name_match_unittest', 'scripts')] 15 16import generate_names 17 18 19def generate(s, out_fn): 20 conf_tempfile = tempfile.NamedTemporaryFile(mode='wt', encoding='utf-8') 21 conf_tempfile.write(str(s)) 22 conf_tempfile.flush() 23 der_tmpfile = tempfile.NamedTemporaryFile() 24 subprocess.check_call([ 25 'openssl', 'asn1parse', '-genconf', conf_tempfile.name, '-i', '-out', 26 der_tmpfile.name 27 ], 28 stdout=subprocess.DEVNULL) 29 conf_tempfile.close() 30 31 description_tmpfile = tempfile.NamedTemporaryFile() 32 subprocess.check_call(['der2ascii', '-i', der_tmpfile.name], 33 stdout=description_tmpfile) 34 35 output_file = open(out_fn, 'wb') 36 description_tmpfile.seek(0) 37 output_file.write(description_tmpfile.read()) 38 output_file.write(b'-----BEGIN %b-----\n' % s.token()) 39 output_file.write(base64.encodebytes(der_tmpfile.read())) 40 output_file.write(b'-----END %b-----\n' % s.token()) 41 output_file.close() 42 43 44class SubjectAltNameGenerator: 45 def __init__(self): 46 self.names = [] 47 48 def token(self): 49 return b"SUBJECT ALTERNATIVE NAME" 50 51 def add_name(self, general_name): 52 self.names.append(general_name) 53 54 def __str__(self): 55 s = "asn1 = SEQUENCE:subjectAltNameSequence\n" 56 s += "[subjectAltNameSequence]\n" 57 s_suffix = "" 58 for n, name in enumerate(self.names): 59 n1, n2 = (str(name) + '\n').split('\n', 1) 60 if n2: 61 s_suffix += n2 + '\n' 62 s += '%s%s\n' % (n, n1) 63 64 return s + s_suffix 65 66 67class NameConstraintsGenerator: 68 def __init__(self, 69 force_permitted_sequence=False, 70 force_excluded_sequence=False): 71 self.permitted = [] 72 self.excluded = [] 73 self.force_permitted_sequence = force_permitted_sequence 74 self.force_excluded_sequence = force_excluded_sequence 75 76 def token(self): 77 return b"NAME CONSTRAINTS" 78 79 def union_from(self, c): 80 self.permitted.extend(c.permitted) 81 self.excluded.extend(c.excluded) 82 83 def add_permitted(self, general_name): 84 self.permitted.append(general_name) 85 86 def add_excluded(self, general_name): 87 self.excluded.append(general_name) 88 89 def __str__(self): 90 s = "asn1 = SEQUENCE:nameConstraintsSequence\n[nameConstraintsSequence]\n" 91 92 if self.permitted or self.force_permitted_sequence: 93 s += "permittedSubtrees = IMPLICIT:0,SEQUENCE:permittedSubtreesSequence\n" 94 if self.excluded or self.force_excluded_sequence: 95 s += "excludedSubtrees = IMPLICIT:1,SEQUENCE:excludedSubtreesSequence\n" 96 97 if self.permitted or self.force_permitted_sequence: 98 s += "[permittedSubtreesSequence]\n" 99 for n, subtree in enumerate(self.permitted): 100 s += 'subtree%i = SEQUENCE:permittedSubtree%i\n' % (n, n) 101 102 if self.excluded or self.force_excluded_sequence: 103 s += "[excludedSubtreesSequence]\n" 104 for n, subtree in enumerate(self.excluded): 105 s += 'subtree%i = SEQUENCE:excludedSubtree%i\n' % (n, n) 106 107 for n, subtree in enumerate(self.permitted): 108 s += '[permittedSubtree%i]\n%s\n' % (n, subtree) 109 110 for n, subtree in enumerate(self.excluded): 111 s += '[excludedSubtree%i]\n%s\n' % (n, subtree) 112 113 return s 114 115 116def other_name(): 117 i = random.randint(0, sys.maxsize) 118 s = 'otherName = IMPLICIT:0,SEQUENCE:otherNameSequence%i\n' % i 119 s += '[otherNameSequence%i]\n' % i 120 s += 'type_id = OID:1.2.3.4.5\n' 121 s += 'value = FORMAT:HEX,OCTETSTRING:DEADBEEF\n' 122 return s 123 124 125def rfc822_name(name): 126 return 'rfc822Name = IMPLICIT:1,IA5STRING:' + name 127 128 129def dns_name(name): 130 return 'dNSName = IMPLICIT:2,IA5STRING:' + name 131 132 133def x400_address(): 134 i = random.randint(0, sys.maxsize) 135 s = 'x400Address = IMPLICIT:3,SEQUENCE:x400AddressSequence%i\n' % i 136 s += '[x400AddressSequence%i]\n' % i 137 s += 'builtinstandardattributes = SEQUENCE:BuiltInStandardAttributes%i\n' % i 138 s += '[BuiltInStandardAttributes%i]\n' % i 139 s += 'countryname = EXPLICIT:1A,PRINTABLESTRING:US\n' 140 return s 141 142 143def directory_name(name): 144 return str(name).replace( 145 'asn1 = SEQUENCE', 'directoryName = EXPLICIT:4,SEQUENCE') 146 147 148def edi_party_name(): 149 i = random.randint(0, sys.maxsize) 150 s = 'ediPartyName = IMPLICIT:5,SEQUENCE:ediPartyNameSequence%i\n' % i 151 s += '[ediPartyNameSequence%i]\n' % i 152 s += 'partyName = IMPLICIT:1,UTF8:foo\n' 153 return s 154 155 156def uniform_resource_identifier(name): 157 return 'uniformResourceIdentifier = IMPLICIT:6,IA5STRING:' + name 158 159 160def ip_address(addr, enforce_length=True): 161 if enforce_length: 162 assert len(addr) in (4,16) 163 addr_str = "" 164 for addr_byte in addr: 165 addr_str += '%02X'%(addr_byte) 166 return 'iPAddress = IMPLICIT:7,FORMAT:HEX,OCTETSTRING:' + addr_str 167 168 169def ip_address_range(addr, netmask, enforce_length=True): 170 if enforce_length: 171 assert len(addr) in (4,16) 172 addr_str = "" 173 netmask_str = "" 174 for addr_byte, mask_byte in zip(addr, netmask, strict=True): 175 assert (addr_byte & ~mask_byte) == 0 176 addr_str += '%02X'%(addr_byte) 177 netmask_str += '%02X'%(mask_byte) 178 return ('iPAddress = IMPLICIT:7,FORMAT:HEX,OCTETSTRING:' + addr_str + 179 netmask_str) 180 181 182def registered_id(oid): 183 return 'registeredID = IMPLICIT:8,OID:' + oid 184 185 186def with_min_max(val, minimum=None, maximum=None): 187 s = val 188 s += '\n' 189 assert '\n[' not in s 190 if minimum is not None: 191 s += 'minimum = IMPLICIT:0,INTEGER:%i\n' % minimum 192 if maximum is not None: 193 s += 'maximum = IMPLICIT:1,INTEGER:%i\n' % maximum 194 return s 195 196 197def main(): 198 dnsname_constraints = NameConstraintsGenerator() 199 dnsname_constraints.add_permitted(dns_name("permitted.example.com")) 200 dnsname_constraints.add_permitted(dns_name("permitted.example2.com")) 201 dnsname_constraints.add_permitted(dns_name("permitted.example3.com.")) 202 dnsname_constraints.add_permitted(dns_name("alsopermitted.example.com")) 203 dnsname_constraints.add_excluded(dns_name("excluded.permitted.example.com")) 204 dnsname_constraints.add_permitted( 205 dns_name("stillnotpermitted.excluded.permitted.example.com")) 206 dnsname_constraints.add_excluded(dns_name("extraneousexclusion.example.com")) 207 generate(dnsname_constraints, "dnsname.pem") 208 209 dnsname_constraints2 = NameConstraintsGenerator() 210 dnsname_constraints2.add_permitted(dns_name("com")) 211 dnsname_constraints2.add_excluded(dns_name("foo.bar.com")) 212 generate(dnsname_constraints2, "dnsname2.pem") 213 214 dnsname_constraints3 = NameConstraintsGenerator() 215 dnsname_constraints3.add_permitted(dns_name(".bar.com")) 216 generate(dnsname_constraints3, "dnsname-permitted_with_leading_dot.pem") 217 218 dnsname_constraints4 = NameConstraintsGenerator() 219 dnsname_constraints4.add_excluded(dns_name(".bar.com")) 220 generate(dnsname_constraints4, "dnsname-excluded_with_leading_dot.pem") 221 222 dnsname_constraints5 = NameConstraintsGenerator() 223 dnsname_constraints5.add_permitted(dns_name("..")) 224 generate(dnsname_constraints5, "dnsname-permitted_two_dot.pem") 225 226 c = NameConstraintsGenerator() 227 c.add_excluded(dns_name("excluded.permitted.example.com")) 228 generate(c, "dnsname-excluded.pem") 229 230 c = NameConstraintsGenerator() 231 c.add_permitted(dns_name("permitted.example.com")) 232 c.add_excluded(dns_name("")) 233 generate(c, "dnsname-excludeall.pem") 234 235 c = NameConstraintsGenerator() 236 c.add_permitted(dns_name("permitted.example.com")) 237 c.add_excluded(dns_name(".")) 238 generate(c, "dnsname-exclude_dot.pem") 239 240 ipaddress_constraints = NameConstraintsGenerator() 241 ipaddress_constraints.add_permitted( 242 ip_address_range((192,168,0,0),(255,255,0,0))) 243 ipaddress_constraints.add_excluded( 244 ip_address_range((192,168,5,0),(255,255,255,0))) 245 ipaddress_constraints.add_permitted( 246 ip_address_range((192,168,5,32),(255,255,255,224))) 247 ipaddress_constraints.add_permitted( 248 ip_address_range((192,167,5,32),(255,255,255,224))) 249 ipaddress_constraints.add_excluded( 250 ip_address_range((192,166,5,32),(255,255,255,224))) 251 ipaddress_constraints.add_permitted(ip_address_range( 252 (1,2,3,4,5,6,7,8,9,10,11,12,0,0,0,0), 253 (255,255,255,255,255,255,255,255,255,255,255,255,0,0,0,0))) 254 ipaddress_constraints.add_excluded(ip_address_range( 255 (1,2,3,4,5,6,7,8,9,10,11,12,5,0,0,0), 256 (255,255,255,255,255,255,255,255,255,255,255,255,255,0,0,0))) 257 ipaddress_constraints.add_permitted(ip_address_range( 258 (1,2,3,4,5,6,7,8,9,10,11,12,5,32,0,0), 259 (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0))) 260 ipaddress_constraints.add_permitted(ip_address_range( 261 (1,2,3,4,5,6,7,8,9,10,11,11,5,32,0,0), 262 (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0))) 263 ipaddress_constraints.add_excluded(ip_address_range( 264 (1,2,3,4,5,6,7,8,9,10,11,10,5,32,0,0), 265 (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0))) 266 generate(ipaddress_constraints, "ipaddress.pem") 267 268 c = NameConstraintsGenerator() 269 c.add_permitted(ip_address_range((192,168,1,3),(255,255,255,255))) 270 generate(c, "ipaddress-permit_singlehost.pem") 271 272 c = NameConstraintsGenerator() 273 c.add_permitted(ip_address_range((0,0,0,0),(0,0,0,0))) 274 generate(c, "ipaddress-permit_all.pem") 275 276 c = NameConstraintsGenerator() 277 c.add_permitted(ip_address_range((0x80,0,0,0),(0x80,0,0,0))) 278 generate(c, "ipaddress-permit_prefix1.pem") 279 280 c = NameConstraintsGenerator() 281 c.add_permitted(ip_address_range((192,168,1,2),(255,255,255,254))) 282 generate(c, "ipaddress-permit_prefix31.pem") 283 284 c = NameConstraintsGenerator() 285 c.add_permitted(ip_address_range((192,168,1,0),(255,255,255,253))) 286 generate(c, "ipaddress-invalid_mask_not_contiguous_1.pem") 287 288 c = NameConstraintsGenerator() 289 c.add_permitted(ip_address_range((192,168,0,0),(255,253,0,0))) 290 generate(c, "ipaddress-invalid_mask_not_contiguous_2.pem") 291 292 c = NameConstraintsGenerator() 293 c.add_permitted(ip_address_range((0,0,0,0),(0x40,0,0,0))) 294 generate(c, "ipaddress-invalid_mask_not_contiguous_3.pem") 295 296 c = NameConstraintsGenerator() 297 c.add_permitted(ip_address_range((192,0,0,0),(0xFF,0,0xFF,0))) 298 generate(c, "ipaddress-invalid_mask_not_contiguous_4.pem") 299 300 c = NameConstraintsGenerator() 301 c.add_excluded(ip_address_range((192,168,5,0),(255,255,255,0))) 302 generate(c, "ipaddress-excluded.pem") 303 304 c = NameConstraintsGenerator() 305 c.add_permitted(ip_address_range((192,168,0,0),(255,255,0,0))) 306 c.add_permitted(ip_address_range((1,2,3,4,5,6,7,8,9,10,11,12,0,0,0,0), 307 (255,255,255,255,255,255,255,255, 308 255,255,255,255,0,0,0,0))) 309 c.add_excluded(ip_address_range((0,0,0,0),(0,0,0,0))) 310 c.add_excluded(ip_address_range((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), 311 (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0))) 312 generate(c, "ipaddress-excludeall.pem") 313 314 c = NameConstraintsGenerator() 315 c.add_permitted(ip_address_range((192,168,0,0),(255,255,255,0))) 316 c.add_permitted(ip_address_range((192,168,5,0,0),(255,255,255,0,0), 317 enforce_length=False)) 318 generate(c, "ipaddress-invalid_addr.pem") 319 320 v4_mapped_prefix = (0, ) * 10 + (255, ) * 2 321 v4_mapped_mask = (255, ) * 12 322 c = NameConstraintsGenerator() 323 c.add_permitted(ip_address_range((192, 168, 1, 0), (255, 255, 255, 0))) 324 c.add_excluded(ip_address_range((192, 168, 1, 1), (255, 255, 255, 255))) 325 c.add_excluded( 326 ip_address_range(v4_mapped_prefix + (192, 168, 1, 2), 327 v4_mapped_mask + (255, 255, 255, 255))) 328 c.add_permitted( 329 ip_address_range(v4_mapped_prefix + (192, 168, 2, 0), 330 v4_mapped_mask + (255, 255, 255, 0))) 331 c.add_excluded( 332 ip_address_range(v4_mapped_prefix + (192, 168, 2, 1), 333 v4_mapped_mask + (255, 255, 255, 255))) 334 c.add_excluded(ip_address_range((192, 168, 2, 2), (255, 255, 255, 255))) 335 generate(c, "ipaddress-mapped_addrs.pem") 336 337 n_us = generate_names.NameGenerator() 338 n_us.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'US') 339 generate(n_us, "name-us.pem") 340 n_us_az = copy.deepcopy(n_us) 341 n_us_az.add_rdn().add_attr('stateOrProvinceName', 'UTF8', 'Arizona') 342 generate(n_us_az, "name-us-arizona.pem") 343 n_us_ca = copy.deepcopy(n_us) 344 n_us_ca.add_rdn().add_attr('stateOrProvinceName', 'UTF8', 'California') 345 generate(n_us_ca, "name-us-california.pem") 346 n_us_ca_mountain_view = copy.deepcopy(n_us_ca) 347 n_us_ca_mountain_view.add_rdn().add_attr( 348 'localityName', 'UTF8', 'Mountain View') 349 generate(n_us_ca_mountain_view, "name-us-california-mountain_view.pem") 350 351 n_jp = generate_names.NameGenerator() 352 n_jp.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'JP') 353 generate(n_jp, "name-jp.pem") 354 n_jp_tokyo = copy.deepcopy(n_jp) 355 n_jp_tokyo.add_rdn().add_attr('stateOrProvinceName', 'UTF8', '\u6771\u4eac', 356 'FORMAT:UTF8') 357 generate(n_jp_tokyo, "name-jp-tokyo.pem") 358 359 n_us_az_foodotcom = copy.deepcopy(n_us_az) 360 n_us_az_foodotcom.add_rdn().add_attr('commonName', 'UTF8', 'foo.com') 361 generate(n_us_az_foodotcom, "name-us-arizona-foo.com.pem") 362 363 n_us_az_permittedexamplecom = copy.deepcopy(n_us_az) 364 n_us_az_permittedexamplecom.add_rdn().add_attr('commonName', 'UTF8', 365 'permitted.example.com') 366 generate(n_us_az_permittedexamplecom, 367 "name-us-arizona-permitted.example.com.pem") 368 369 n_us_ca_permittedexamplecom = copy.deepcopy(n_us_ca) 370 n_us_ca_permittedexamplecom.add_rdn().add_attr('commonName', 'UTF8', 371 'permitted.example.com') 372 generate(n_us_ca_permittedexamplecom, 373 "name-us-california-permitted.example.com.pem") 374 375 n_us_az_ip1111 = copy.deepcopy(n_us_az) 376 n_us_az_ip1111.add_rdn().add_attr('commonName', 'UTF8', '1.1.1.1') 377 generate(n_us_az_ip1111, "name-us-arizona-1.1.1.1.pem") 378 379 n_us_az_192_168_1_1 = copy.deepcopy(n_us_az) 380 n_us_az_192_168_1_1.add_rdn().add_attr('commonName', 'UTF8', '192.168.1.1') 381 generate(n_us_az_192_168_1_1, "name-us-arizona-192.168.1.1.pem") 382 383 n_us_az_ipv6 = copy.deepcopy(n_us_az) 384 n_us_az_ipv6.add_rdn().add_attr('commonName', 'UTF8', 385 '102:304:506:708:90a:b0c::1') 386 generate(n_us_az_ipv6, "name-us-arizona-ipv6.pem") 387 388 n_us_ca_192_168_1_1 = copy.deepcopy(n_us_ca) 389 n_us_ca_192_168_1_1.add_rdn().add_attr('commonName', 'UTF8', '192.168.1.1') 390 generate(n_us_ca_192_168_1_1, "name-us-california-192.168.1.1.pem") 391 392 n_us_az_email = copy.deepcopy(n_us_az) 393 n_us_az_email.add_rdn().add_attr('emailAddress', 'IA5STRING', 394 'bar@example.com') 395 generate(n_us_az_email, "name-us-arizona-email.pem") 396 397 n_us_az_email = copy.deepcopy(n_us_az) 398 n_us_az_email.add_rdn().add_attr('emailAddress', 'IA5STRING', 399 'FoO@example.com') 400 generate(n_us_az_email, "name-us-arizona-email-localpartcase.pem") 401 402 n_us_az_email = copy.deepcopy(n_us_az) 403 n_us_az_email.add_rdn().add_attr('emailAddress', 'IA5STRING', 404 'foo@example.com') 405 n_us_az_email.add_rdn().add_attr('emailAddress', 'IA5STRING', 406 'bar@example.com') 407 generate(n_us_az_email, "name-us-arizona-email-multiple.pem") 408 409 n_us_az_email = copy.deepcopy(n_us_az) 410 n_us_az_email.add_rdn().add_attr('emailAddress', 'VISIBLESTRING', 411 'bar@example.com') 412 generate(n_us_az_email, "name-us-arizona-email-invalidstring.pem") 413 414 n_ca = generate_names.NameGenerator() 415 n_ca.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'CA') 416 generate(n_ca, "name-ca.pem") 417 418 n_de = generate_names.NameGenerator() 419 n_de.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'DE') 420 generate(n_de, "name-de.pem") 421 422 n_empty = generate_names.NameGenerator() 423 generate(n_empty, "name-empty.pem") 424 425 426 directoryname_constraints = NameConstraintsGenerator() 427 directoryname_constraints.add_permitted(directory_name(n_us)) 428 directoryname_constraints.add_excluded(directory_name(n_us_ca)) 429 directoryname_constraints.add_permitted(directory_name(n_us_ca_mountain_view)) 430 directoryname_constraints.add_excluded(directory_name(n_de)) 431 directoryname_constraints.add_permitted(directory_name(n_jp_tokyo)) 432 generate(directoryname_constraints, "directoryname.pem") 433 434 c = NameConstraintsGenerator() 435 c.union_from(directoryname_constraints) 436 c.union_from(dnsname_constraints) 437 generate(c, "directoryname_and_dnsname.pem") 438 439 c = NameConstraintsGenerator() 440 c.union_from(directoryname_constraints) 441 c.union_from(dnsname_constraints) 442 c.union_from(ipaddress_constraints) 443 generate(c, "directoryname_and_dnsname_and_ipaddress.pem") 444 445 c = NameConstraintsGenerator() 446 c.add_excluded(directory_name(n_us_ca)) 447 generate(c, "directoryname-excluded.pem") 448 449 c = NameConstraintsGenerator() 450 c.add_permitted(directory_name(n_us)) 451 c.add_excluded(directory_name(n_empty)) 452 generate(c, "directoryname-excludeall.pem") 453 454 san = SubjectAltNameGenerator() 455 san.add_name(dns_name("permitted.example.com")) 456 san.add_name(ip_address((192,168,1,2))) 457 san.add_name(directory_name(n_us_az)) 458 generate(san, "san-permitted.pem") 459 460 san2 = copy.deepcopy(san) 461 san2.add_name( 462 dns_name("foo.stillnotpermitted.excluded.permitted.example.com")) 463 generate(san2, "san-excluded-dnsname.pem") 464 465 san2 = copy.deepcopy(san) 466 san2.add_name(ip_address((192,168,5,5))) 467 generate(san2, "san-excluded-ipaddress.pem") 468 469 san2 = copy.deepcopy(san) 470 san2.add_name(directory_name(n_us_ca_mountain_view)) 471 generate(san2, "san-excluded-directoryname.pem") 472 473 san = SubjectAltNameGenerator() 474 san.add_name(other_name()) 475 generate(san, "san-othername.pem") 476 477 san = SubjectAltNameGenerator() 478 san.add_name(rfc822_name("foo@example.com")) 479 generate(san, "san-rfc822name.pem") 480 481 san = SubjectAltNameGenerator() 482 san.add_name(rfc822_name("foo@eXaMplE.cOm")) 483 generate(san, "san-rfc822name-domaincase.pem") 484 485 san = SubjectAltNameGenerator() 486 san.add_name(rfc822_name("FoO@example.com")) 487 generate(san, "san-rfc822name-localpartcase.pem") 488 489 san = SubjectAltNameGenerator() 490 san.add_name(rfc822_name('\\"foo\\"@example.com')) 491 generate(san, "san-rfc822name-quoted.pem") 492 493 san = SubjectAltNameGenerator() 494 san.add_name(rfc822_name("@example.com")) 495 generate(san, "san-rfc822name-empty-localpart.pem") 496 497 san = SubjectAltNameGenerator() 498 san.add_name(rfc822_name("foo@subdomain.example.com")) 499 generate(san, "san-rfc822name-subdomain.pem") 500 501 san = SubjectAltNameGenerator() 502 san.add_name(rfc822_name("foo@sUbdoMAin.exAmPLe.COm")) 503 generate(san, "san-rfc822name-subdomaincase.pem") 504 505 san = SubjectAltNameGenerator() 506 san.add_name(rfc822_name("example.com")) 507 generate(san, "san-rfc822name-no-at.pem") 508 509 san = SubjectAltNameGenerator() 510 san.add_name(rfc822_name("foo@bar@example.com")) 511 generate(san, "san-rfc822name-two-ats.pem") 512 513 san = SubjectAltNameGenerator() 514 san.add_name(rfc822_name("subdomain.example.com")) 515 generate(san, "san-rfc822name-subdomain-no-at.pem") 516 517 san = SubjectAltNameGenerator() 518 san.add_name(rfc822_name("foo@bar@subdomain.example.com")) 519 generate(san, "san-rfc822name-subdomain-two-ats.pem") 520 521 san = SubjectAltNameGenerator() 522 san.add_name(rfc822_name("")) 523 generate(san, "san-rfc822name-empty.pem") 524 525 san = SubjectAltNameGenerator() 526 san.add_name(rfc822_name("foo@[8.8.8.8]")) 527 generate(san, "san-rfc822name-ipv4.pem") 528 529 san = SubjectAltNameGenerator() 530 san.add_name(rfc822_name("foo@example.com")) 531 san.add_name(rfc822_name("bar@example.com")) 532 generate(san, "san-rfc822name-multiple.pem") 533 534 san = SubjectAltNameGenerator() 535 san.add_name(dns_name("foo.example.com")) 536 generate(san, "san-dnsname.pem") 537 538 san = SubjectAltNameGenerator() 539 san.add_name(x400_address()) 540 generate(san, "san-x400address.pem") 541 542 san = SubjectAltNameGenerator() 543 san.add_name(directory_name(n_us)) 544 generate(san, "san-directoryname.pem") 545 546 san = SubjectAltNameGenerator() 547 san.add_name(uniform_resource_identifier('http://example.com')) 548 generate(san, "san-uri.pem") 549 550 san = SubjectAltNameGenerator() 551 san.add_name(ip_address((192,168,6,7))) 552 generate(san, "san-ipaddress4.pem") 553 554 san = SubjectAltNameGenerator() 555 san.add_name(ip_address((0xFE, 0x80, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 556 13, 14))) 557 generate(san, "san-ipaddress6.pem") 558 559 san = SubjectAltNameGenerator() 560 san.add_name(registered_id("1.2.3.4")) 561 generate(san, "san-registeredid.pem") 562 563 san = SubjectAltNameGenerator() 564 generate(san, "san-invalid-empty.pem") 565 566 san = SubjectAltNameGenerator() 567 san.add_name(ip_address((192,168,0,5,0), enforce_length=False)) 568 generate(san, "san-invalid-ipaddress.pem") 569 570 c = NameConstraintsGenerator() 571 c.add_permitted(other_name()) 572 generate(c, "othername-permitted.pem") 573 c = NameConstraintsGenerator() 574 c.add_excluded(other_name()) 575 generate(c, "othername-excluded.pem") 576 577 c = NameConstraintsGenerator() 578 c.add_permitted(rfc822_name("foo@example.com")) 579 generate(c, "rfc822name-permitted.pem") 580 581 c = NameConstraintsGenerator() 582 c.add_permitted(rfc822_name('\\"foo\\"@example.com')) 583 generate(c, "rfc822name-permitted-quoted.pem") 584 585 c = NameConstraintsGenerator() 586 c.add_permitted(rfc822_name("example.com")) 587 generate(c, "rfc822name-permitted-hostname.pem") 588 589 c = NameConstraintsGenerator() 590 c.add_permitted(rfc822_name("@example.com")) 591 generate(c, "rfc822name-permitted-hostnamewithat.pem") 592 593 c = NameConstraintsGenerator() 594 c.add_permitted(rfc822_name(".example.com")) 595 generate(c, "rfc822name-permitted-subdomains.pem") 596 597 c = NameConstraintsGenerator() 598 c.add_permitted(rfc822_name("")) 599 generate(c, "rfc822name-permitted-empty.pem") 600 601 c = NameConstraintsGenerator() 602 c.add_permitted(rfc822_name("[8.8.8.8]")) 603 generate(c, "rfc822name-permitted-ipv4.pem") 604 605 c = NameConstraintsGenerator() 606 c.add_excluded(rfc822_name("foo@example.com")) 607 generate(c, "rfc822name-excluded.pem") 608 609 c = NameConstraintsGenerator() 610 c.add_excluded(rfc822_name('\\"foo\\"@example.com')) 611 generate(c, "rfc822name-excluded-quoted.pem") 612 613 c = NameConstraintsGenerator() 614 c.add_excluded(rfc822_name("example.com")) 615 generate(c, "rfc822name-excluded-hostname.pem") 616 617 c = NameConstraintsGenerator() 618 c.add_excluded(rfc822_name("@example.com")) 619 generate(c, "rfc822name-excluded-hostnamewithat.pem") 620 621 c = NameConstraintsGenerator() 622 c.add_excluded(rfc822_name(".example.com")) 623 generate(c, "rfc822name-excluded-subdomains.pem") 624 625 c = NameConstraintsGenerator() 626 c.add_excluded(rfc822_name("")) 627 generate(c, "rfc822name-excluded-empty.pem") 628 629 c = NameConstraintsGenerator() 630 c.add_excluded(rfc822_name("[8.8.8.8]")) 631 generate(c, "rfc822name-excluded-ipv4.pem") 632 633 c = NameConstraintsGenerator() 634 c.add_permitted(x400_address()) 635 generate(c, "x400address-permitted.pem") 636 c = NameConstraintsGenerator() 637 c.add_excluded(x400_address()) 638 generate(c, "x400address-excluded.pem") 639 640 c = NameConstraintsGenerator() 641 c.add_permitted(edi_party_name()) 642 generate(c, "edipartyname-permitted.pem") 643 c = NameConstraintsGenerator() 644 c.add_excluded(edi_party_name()) 645 generate(c, "edipartyname-excluded.pem") 646 647 c = NameConstraintsGenerator() 648 c.add_permitted(uniform_resource_identifier("http://example.com")) 649 generate(c, "uri-permitted.pem") 650 c = NameConstraintsGenerator() 651 c.add_excluded(uniform_resource_identifier("http://example.com")) 652 generate(c, "uri-excluded.pem") 653 654 c = NameConstraintsGenerator() 655 c.add_permitted(registered_id("1.2.3.4")) 656 generate(c, "registeredid-permitted.pem") 657 c = NameConstraintsGenerator() 658 c.add_excluded(registered_id("1.2.3.4")) 659 generate(c, "registeredid-excluded.pem") 660 661 c = NameConstraintsGenerator() 662 generate(c, "invalid-no_subtrees.pem") 663 664 c = NameConstraintsGenerator(force_permitted_sequence=True) 665 generate(c, "invalid-empty_permitted_subtree.pem") 666 667 c = NameConstraintsGenerator(force_excluded_sequence=True) 668 generate(c, "invalid-empty_excluded_subtree.pem") 669 670 c = NameConstraintsGenerator() 671 c.add_permitted(with_min_max(dns_name("permitted.example.com"), minimum=0)) 672 generate(c, "dnsname-with_min_0.pem") 673 674 c = NameConstraintsGenerator() 675 c.add_permitted(with_min_max(dns_name("permitted.example.com"), minimum=1)) 676 generate(c, "dnsname-with_min_1.pem") 677 678 c = NameConstraintsGenerator() 679 c.add_permitted(with_min_max( 680 dns_name("permitted.example.com"), minimum=0, maximum=2)) 681 generate(c, "dnsname-with_min_0_and_max.pem") 682 683 c = NameConstraintsGenerator() 684 c.add_permitted(with_min_max( 685 dns_name("permitted.example.com"), minimum=1, maximum=2)) 686 generate(c, "dnsname-with_min_1_and_max.pem") 687 688 c = NameConstraintsGenerator() 689 c.add_permitted(with_min_max(dns_name("permitted.example.com"), maximum=2)) 690 generate(c, "dnsname-with_max.pem") 691 692 693if __name__ == '__main__': 694 main() 695