summaryrefslogtreecommitdiffstats
path: root/tests
diff options
context:
space:
mode:
authorThiago Macieira <thiago.macieira@nokia.com>2009-08-07 11:17:05 (GMT)
committerThiago Macieira <thiago.macieira@nokia.com>2009-08-07 11:19:03 (GMT)
commit41d27eac40cecbc0067be9622c9bc1c579582a47 (patch)
tree1bd96796ed706f3198aca17fc8478b8d8d1a60d5 /tests
parent8efe6915c9a6dfa531ec39d5de7e8af34f76dc3c (diff)
downloadQt-41d27eac40cecbc0067be9622c9bc1c579582a47.zip
Qt-41d27eac40cecbc0067be9622c9bc1c579582a47.tar.gz
Qt-41d27eac40cecbc0067be9622c9bc1c579582a47.tar.bz2
Autotest: ensure we don't mishandle SSL certificates with NULs
This is a vulnerability in some implementations. Qt isn't affected because... well, we never implemented the decoding of escape sequences :-)
Diffstat (limited to 'tests')
-rw-r--r--tests/auto/qsslcertificate/more-certificates/badguy-nul-cn.crt81
-rw-r--r--tests/auto/qsslcertificate/tst_qsslcertificate.cpp17
2 files changed, 98 insertions, 0 deletions
diff --git a/tests/auto/qsslcertificate/more-certificates/badguy-nul-cn.crt b/tests/auto/qsslcertificate/more-certificates/badguy-nul-cn.crt
new file mode 100644
index 0000000..b899733
--- /dev/null
+++ b/tests/auto/qsslcertificate/more-certificates/badguy-nul-cn.crt
@@ -0,0 +1,81 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 1 (0x1)
+ Signature Algorithm: sha1WithRSAEncryption
+ Issuer: C=GB, ST=Berkshire, L=Newbury, O=My Company Ltd, OU=CA, CN=NULL-friendly CA
+ Validity
+ Not Before: Aug 4 07:33:43 2009 GMT
+ Not After : Aug 2 07:33:43 2019 GMT
+ Subject: CN=www.bank.com\x00.badguy.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ RSA Public Key: (2048 bit)
+ Modulus (2048 bit):
+ 00:cd:26:70:96:a9:a6:5d:3e:9c:ed:0f:08:15:5a:
+ 7c:17:25:68:68:af:13:b9:ad:41:fa:12:54:e2:84:
+ 72:7d:58:d1:e2:40:42:c1:59:ed:05:3d:aa:10:53:
+ 70:00:88:3a:77:a0:c0:56:9e:ac:7d:21:2a:71:44:
+ 51:08:bc:17:07:da:a8:a3:76:dc:51:bc:1b:8a:f6:
+ 02:1a:55:bf:46:b4:44:6b:27:5e:be:e5:17:8b:56:
+ b2:c6:82:36:11:83:a8:bf:f7:2f:0d:17:f6:cd:47:
+ b5:6f:2b:a6:41:b6:8d:33:5f:ea:ea:8b:b1:1a:e2:
+ 99:38:ff:59:5b:0a:a1:71:13:ca:37:3f:b9:b0:1e:
+ 91:9a:c8:93:35:0c:4a:e0:9d:f4:d2:61:c7:4e:5b:
+ 41:0a:7c:31:54:99:db:f5:65:ce:80:d3:c2:02:37:
+ 64:fd:54:12:7b:ea:ac:85:59:5c:17:e1:2e:f6:d0:
+ a8:f2:d0:2e:94:59:2f:c2:a6:5f:da:07:de:7b:2e:
+ 14:07:ed:e4:27:24:37:9d:09:2e:b1:f9:5a:48:b9:
+ 80:24:43:e6:cb:c7:6e:35:df:d5:69:34:ff:e6:d6:
+ 9e:e8:76:66:6e:5f:59:01:3c:96:3b:ec:72:0b:3c:
+ 1e:95:0f:ce:68:13:9c:22:dd:1b:b5:44:28:50:4a:
+ 05:7f
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:FALSE
+ Netscape Comment:
+ OpenSSL Generated Certificate
+ X509v3 Subject Key Identifier:
+ 33:15:24:BE:DA:66:3A:06:8B:D9:27:34:3A:AF:62:40:E4:95:66:5D
+ X509v3 Authority Key Identifier:
+ keyid:0A:69:39:5F:9D:30:04:18:08:2E:02:0E:E6:EA:9D:B2:26:F6:E2:6A
+
+ Signature Algorithm: sha1WithRSAEncryption
+ 32:65:23:1f:c8:d9:53:84:82:d0:0a:eb:14:51:24:03:bc:6c:
+ 1b:2a:5a:fe:1b:f0:e8:69:0c:2b:19:86:cf:7f:32:76:d8:2b:
+ d2:cf:8b:c4:d1:b6:5b:9c:60:a3:99:2e:92:72:06:ce:de:8b:
+ d2:a2:d2:89:7c:13:a9:0b:4e:be:12:09:e5:d6:28:3a:ac:a7:
+ 26:56:94:7f:13:ee:64:7d:de:94:60:75:c1:bc:55:97:d4:aa:
+ 13:8e:02:d8:b0:b0:70:53:ae:18:53:ce:aa:b2:2c:85:3e:e3:
+ f3:e1:26:f3:fa:5c:ee:f8:7b:0b:c6:39:b5:04:33:5e:ae:b8:
+ 5e:0e:66:cc:a8:c0:6a:0d:ec:60:c1:c5:d9:39:ea:bd:1b:8f:
+ 1c:7d:16:38:b1:e8:c8:37:01:aa:4b:99:df:e4:0f:10:be:61:
+ ee:9a:cf:cd:27:05:46:00:60:d8:6a:74:08:32:3c:8b:90:01:
+ 6a:07:33:0c:6c:90:db:ea:fb:6a:17:1a:76:bb:73:14:27:e1:
+ a4:7e:d5:dd:30:b1:5d:f2:0e:aa:d4:b2:d5:4c:f6:4f:91:2a:
+ 07:f4:37:c1:cf:48:19:c5:fe:7e:92:96:a8:df:50:6a:31:92:
+ a3:b1:14:fe:41:cc:49:62:98:4d:ea:c5:ba:05:2d:49:c3:22:
+ 72:ef:41:09
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIBATANBgkqhkiG9w0BAQUFADB0MQswCQYDVQQGEwJHQjES
+MBAGA1UECBMJQmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcwFQYDVQQKEw5N
+eSBDb21wYW55IEx0ZDELMAkGA1UECxMCQ0ExGTAXBgNVBAMTEE5VTEwtZnJpZW5k
+bHkgQ0EwHhcNMDkwODA0MDczMzQzWhcNMTkwODAyMDczMzQzWjAjMSEwHwYDVQQD
+Exh3d3cuYmFuay5jb20ALmJhZGd1eS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDNJnCWqaZdPpztDwgVWnwXJWhorxO5rUH6ElTihHJ9WNHiQELB
+We0FPaoQU3AAiDp3oMBWnqx9ISpxRFEIvBcH2qijdtxRvBuK9gIaVb9GtERrJ16+
+5ReLVrLGgjYRg6i/9y8NF/bNR7VvK6ZBto0zX+rqi7Ea4pk4/1lbCqFxE8o3P7mw
+HpGayJM1DErgnfTSYcdOW0EKfDFUmdv1Zc6A08ICN2T9VBJ76qyFWVwX4S720Kjy
+0C6UWS/Cpl/aB957LhQH7eQnJDedCS6x+VpIuYAkQ+bLx24139VpNP/m1p7odmZu
+X1kBPJY77HILPB6VD85oE5wi3Ru1RChQSgV/AgMBAAGjezB5MAkGA1UdEwQCMAAw
+LAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0G
+A1UdDgQWBBQzFSS+2mY6BovZJzQ6r2JA5JVmXTAfBgNVHSMEGDAWgBQKaTlfnTAE
+GAguAg7m6p2yJvbiajANBgkqhkiG9w0BAQUFAAOCAQEAMmUjH8jZU4SC0ArrFFEk
+A7xsGypa/hvw6GkMKxmGz38ydtgr0s+LxNG2W5xgo5kuknIGzt6L0qLSiXwTqQtO
+vhIJ5dYoOqynJlaUfxPuZH3elGB1wbxVl9SqE44C2LCwcFOuGFPOqrIshT7j8+Em
+8/pc7vh7C8Y5tQQzXq64Xg5mzKjAag3sYMHF2TnqvRuPHH0WOLHoyDcBqkuZ3+QP
+EL5h7prPzScFRgBg2Gp0CDI8i5ABagczDGyQ2+r7ahcadrtzFCfhpH7V3TCxXfIO
+qtSy1Uz2T5EqB/Q3wc9IGcX+fpKWqN9QajGSo7EU/kHMSWKYTerFugUtScMicu9B
+CQ==
+-----END CERTIFICATE-----
diff --git a/tests/auto/qsslcertificate/tst_qsslcertificate.cpp b/tests/auto/qsslcertificate/tst_qsslcertificate.cpp
index 7fd92d6..80ac228 100644
--- a/tests/auto/qsslcertificate/tst_qsslcertificate.cpp
+++ b/tests/auto/qsslcertificate/tst_qsslcertificate.cpp
@@ -100,6 +100,7 @@ private slots:
void fromPath();
void certInfo();
void task256066toPem();
+ void nulInCN();
// ### add tests for certificate bundles (multiple certificates concatenated into a single
// structure); both PEM and DER formatted
#endif
@@ -727,6 +728,22 @@ void tst_QSslCertificate::task256066toPem()
QCOMPARE(pem1, pem2);
}
+void tst_QSslCertificate::nulInCN()
+{
+ QList<QSslCertificate> certList =
+ QSslCertificate::fromPath(SRCDIR "more-certificates/badguy-nul-cn.crt");
+ QCOMPARE(certList.size(), 1);
+
+ const QSslCertificate &cert = certList.at(0);
+ QVERIFY(!cert.isNull());
+
+ QString cn = cert.subjectInfo(QSslCertificate::CommonName);
+ QVERIFY(cn != "www.bank.com");
+
+ static const char realCN[] = "www.bank.com\\x00.badguy.com";
+ QCOMPARE(cn, QString::fromLatin1(realCN, sizeof realCN - 1));
+}
+
#endif // QT_NO_OPENSSL
QTEST_MAIN(tst_QSslCertificate)