/*      $OpenBSD: x509_name_test.c,v 1.3 2025/05/05 06:33:34 tb Exp $ */

/*
 * Copyright (c) 2025 Theo Buehler <tb@openbsd.org>
 * Copyright (c) 2025 Kenjiro Nakayama <nakayamakenjiro@gmail.com>
 * Copyright (c) 2018 Ingo Schwarze <schwarze@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <err.h>
#include <stdio.h>
#include <string.h>

#include <openssl/x509.h>

static const struct x509_name_legacy {
        const char      *compat;
        const char      *oneline;
        const uint8_t    der[255];
        size_t           der_len;
} x509_name_legacy_test[] = {
        {
                .compat =
                    "C=HU, "
                    "L=Budapest, "
                    "O=Microsec Ltd., "
                    "CN=Microsec e-Szigno Root CA 2009, "
                    "emailAddress=info@e-szigno.hu",
                .oneline =
                    "/C=HU"
                    "/L=Budapest"
                    "/O=Microsec Ltd."
                    "/CN=Microsec e-Szigno Root CA 2009"
                    "/emailAddress=info@e-szigno.hu",
                .der = {
                        0x30, 0x81, 0x82, 0x31, 0x0b, 0x30, 0x09, 0x06,
                        0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x48, 0x55,
                        0x31, 0x11, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x04,
                        0x07, 0x0c, 0x08, 0x42, 0x75, 0x64, 0x61, 0x70,
                        0x65, 0x73, 0x74, 0x31, 0x16, 0x30, 0x14, 0x06,
                        0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0d, 0x4d, 0x69,
                        0x63, 0x72, 0x6f, 0x73, 0x65, 0x63, 0x20, 0x4c,
                        0x74, 0x64, 0x2e, 0x31, 0x27, 0x30, 0x25, 0x06,
                        0x03, 0x55, 0x04, 0x03, 0x0c, 0x1e, 0x4d, 0x69,
                        0x63, 0x72, 0x6f, 0x73, 0x65, 0x63, 0x20, 0x65,
                        0x2d, 0x53, 0x7a, 0x69, 0x67, 0x6e, 0x6f, 0x20,
                        0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x20,
                        0x32, 0x30, 0x30, 0x39, 0x31, 0x1f, 0x30, 0x1d,
                        0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
                        0x01, 0x09, 0x01, 0x16, 0x10, 0x69, 0x6e, 0x66,
                        0x6f, 0x40, 0x65, 0x2d, 0x73, 0x7a, 0x69, 0x67,
                        0x6e, 0x6f, 0x2e, 0x68, 0x75,
                },
                .der_len = 133,
        },

        {
                .compat =
                    "serialNumber=G63287510, "
                    "C=ES, "
                    "O=ANF Autoridad de Certificacion, "
                    "OU=ANF CA Raiz, "
                    "CN=ANF Secure Server Root CA",
                .oneline =
                    "/serialNumber=G63287510"
                    "/C=ES"
                    "/O=ANF Autoridad de Certificacion"
                    "/OU=ANF CA Raiz"
                    "/CN=ANF Secure Server Root CA",
                .der = {
                        0x30, 0x81, 0x84, 0x31, 0x12, 0x30, 0x10, 0x06,
                        0x03, 0x55, 0x04, 0x05, 0x13, 0x09, 0x47, 0x36,
                        0x33, 0x32, 0x38, 0x37, 0x35, 0x31, 0x30, 0x31,
                        0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
                        0x13, 0x02, 0x45, 0x53, 0x31, 0x27, 0x30, 0x25,
                        0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x1e, 0x41,
                        0x4e, 0x46, 0x20, 0x41, 0x75, 0x74, 0x6f, 0x72,
                        0x69, 0x64, 0x61, 0x64, 0x20, 0x64, 0x65, 0x20,
                        0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
                        0x61, 0x63, 0x69, 0x6f, 0x6e, 0x31, 0x14, 0x30,
                        0x12, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x0b,
                        0x41, 0x4e, 0x46, 0x20, 0x43, 0x41, 0x20, 0x52,
                        0x61, 0x69, 0x7a, 0x31, 0x22, 0x30, 0x20, 0x06,
                        0x03, 0x55, 0x04, 0x03, 0x13, 0x19, 0x41, 0x4e,
                        0x46, 0x20, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65,
                        0x20, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20,
                        0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41,
                },
                .der_len = 135,
        },

        {
                .compat =
                    "C=GB, "
                    "ST=Greater Manchester, "
                    "L=Salford, "
                    "O=COMODO CA Limited, "
                    "CN=COMODO Certification Authority",
                .oneline =
                    "/C=GB"
                    "/ST=Greater Manchester"
                    "/L=Salford"
                    "/O=COMODO CA Limited"
                    "/CN=COMODO Certification Authority",
                .der = {
                        0x30, 0x81, 0x81, 0x31, 0x0b, 0x30, 0x09, 0x06,
                        0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42,
                        0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04,
                        0x08, 0x13, 0x12, 0x47, 0x72, 0x65, 0x61, 0x74,
                        0x65, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63, 0x68,
                        0x65, 0x73, 0x74, 0x65, 0x72, 0x31, 0x10, 0x30,
                        0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07,
                        0x53, 0x61, 0x6c, 0x66, 0x6f, 0x72, 0x64, 0x31,
                        0x1a, 0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0a,
                        0x13, 0x11, 0x43, 0x4f, 0x4d, 0x4f, 0x44, 0x4f,
                        0x20, 0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d, 0x69,
                        0x74, 0x65, 0x64, 0x31, 0x27, 0x30, 0x25, 0x06,
                        0x03, 0x55, 0x04, 0x03, 0x13, 0x1e, 0x43, 0x4f,
                        0x4d, 0x4f, 0x44, 0x4f, 0x20, 0x43, 0x65, 0x72,
                        0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69,
                        0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f,
                        0x72, 0x69, 0x74, 0x79,
                },
                .der_len = 132,
        },

        {
                .compat =
                    "C=HU, "
                    "L=Budapest, "
                    "O=Microsec Ltd., "
                    "2.5.4.97=VATHU-23584497, "
                    "CN=e-Szigno Root CA 2017",
                .oneline =
                    "/C=HU"
                    "/L=Budapest"
                    "/O=Microsec Ltd."
                    "/2.5.4.97=VATHU-23584497"
                    "/CN=e-Szigno Root CA 2017",
                .der = {
                        0x30, 0x71, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
                        0x55, 0x04, 0x06, 0x13, 0x02, 0x48, 0x55, 0x31,
                        0x11, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x04, 0x07,
                        0x0c, 0x08, 0x42, 0x75, 0x64, 0x61, 0x70, 0x65,
                        0x73, 0x74, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03,
                        0x55, 0x04, 0x0a, 0x0c, 0x0d, 0x4d, 0x69, 0x63,
                        0x72, 0x6f, 0x73, 0x65, 0x63, 0x20, 0x4c, 0x74,
                        0x64, 0x2e, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03,
                        0x55, 0x04, 0x61, 0x0c, 0x0e, 0x56, 0x41, 0x54,
                        0x48, 0x55, 0x2d, 0x32, 0x33, 0x35, 0x38, 0x34,
                        0x34, 0x39, 0x37, 0x31, 0x1e, 0x30, 0x1c, 0x06,
                        0x03, 0x55, 0x04, 0x03, 0x0c, 0x15, 0x65, 0x2d,
                        0x53, 0x7a, 0x69, 0x67, 0x6e, 0x6f, 0x20, 0x52,
                        0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x20, 0x32,
                        0x30, 0x31, 0x37,
                },
                .der_len = 115,
        },

        {

                .compat =
                    "C=ES, "
                    "O=FNMT-RCM, "
                    "OU=Ceres, "
                    "2.5.4.97=VATES-Q2826004J, "
                    "CN=AC RAIZ FNMT-RCM SERVIDORES SEGUROS",
                .oneline =
                    "/C=ES"
                    "/O=FNMT-RCM"
                    "/OU=Ceres"
                    "/2.5.4.97=VATES-Q2826004J"
                    "/CN=AC RAIZ FNMT-RCM SERVIDORES SEGUROS",
                .der = {
                        0x30, 0x78, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
                        0x55, 0x04, 0x06, 0x13, 0x02, 0x45, 0x53, 0x31,
                        0x11, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x04, 0x0a,
                        0x0c, 0x08, 0x46, 0x4e, 0x4d, 0x54, 0x2d, 0x52,
                        0x43, 0x4d, 0x31, 0x0e, 0x30, 0x0c, 0x06, 0x03,
                        0x55, 0x04, 0x0b, 0x0c, 0x05, 0x43, 0x65, 0x72,
                        0x65, 0x73, 0x31, 0x18, 0x30, 0x16, 0x06, 0x03,
                        0x55, 0x04, 0x61, 0x0c, 0x0f, 0x56, 0x41, 0x54,
                        0x45, 0x53, 0x2d, 0x51, 0x32, 0x38, 0x32, 0x36,
                        0x30, 0x30, 0x34, 0x4a, 0x31, 0x2c, 0x30, 0x2a,
                        0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x23, 0x41,
                        0x43, 0x20, 0x52, 0x41, 0x49, 0x5a, 0x20, 0x46,
                        0x4e, 0x4d, 0x54, 0x2d, 0x52, 0x43, 0x4d, 0x20,
                        0x53, 0x45, 0x52, 0x56, 0x49, 0x44, 0x4f, 0x52,
                        0x45, 0x53, 0x20, 0x53, 0x45, 0x47, 0x55, 0x52,
                        0x4f, 0x53
                },
                .der_len = 122,
        },
};

#define N_X509_NAME_COMPAT \
        (sizeof(x509_name_legacy_test) / sizeof(x509_name_legacy_test[0]))

static int
x509_name_compat_testcase(const struct x509_name_legacy *test)
{
        const uint8_t *p;
        X509_NAME *name = NULL;
        unsigned char *der = NULL;
        int der_len = 0;
        BIO *bio = NULL;
        char *got;
        int got_len;
        char *buf = NULL;
        int failed = 1;

        p = test->der;
        if ((name = d2i_X509_NAME(NULL, &p, test->der_len)) == NULL)
                errx(1, "d2i_X509_NAME");

        if ((der_len = i2d_X509_NAME(name, &der)) <= 0) {
                fprintf(stderr, "FAIL: %s: i2d_X509_NAME", __func__);
                der_len = 0;
                goto err;
        }

        if (test->der_len != (size_t)der_len) {
                fprintf(stderr, "FAIL: %s: der len: want %zu, got %d\n",
                    __func__, test->der_len, der_len);
                goto err;
        }

        if (memcmp(test->der, der, test->der_len) != 0) {
                fprintf(stderr, "FAIL: %s: DER mismatch\n", __func__);
                goto err;
        }

        if ((bio = BIO_new(BIO_s_mem())) == NULL)
                errx(1, "BIO_new");

        if (!X509_NAME_print_ex(bio, name, 0, XN_FLAG_COMPAT)) {
                fprintf(stderr, "FAIL: %s: X509_NAME_print_ex", __func__);
                goto err;
        }

        if ((got_len = BIO_get_mem_data(bio, &got)) < 0)
                errx(1, "BIO_get_mem_data");

        if (strcmp(test->compat, got) != 0) {
                fprintf(stderr, "FAIL: %s compat:\nwant: \"%s\",\ngot:  \"%s\"\n",
                    __func__, test->compat, got);
                goto err;
        }

        if ((buf = X509_NAME_oneline(name, NULL, 0)) == NULL)
                errx(1, "X509_NAME_oneline");

        if (strcmp(test->oneline, buf) != 0) {
                fprintf(stderr, "FAIL: %s oneline:\nwant: \"%s\",\ngot:  \"%s\"\n",
                    __func__, test->compat, got);
                goto err;
        }

        failed = 0;

 err:
        BIO_free(bio);
        free(buf);
        X509_NAME_free(name);
        freezero(der, der_len);

        return failed;
}

static int
x509_name_compat_test(void)
{
        size_t i;
        int failed = 0;

        for (i = 0; i < N_X509_NAME_COMPAT; i++)
                failed |= x509_name_compat_testcase(&x509_name_legacy_test[i]);

        return failed;
}

static const struct x509_name_entry_test {
        const char *field;
        const char *value;
        int loc;
        int set;
        const char *expected_str;
        const int expected_set[4];
        const int expected_count;
} entry_tests[] = {
        {
                .field = "ST",
                .value = "BaWue",
                .loc = -1,
                .set = 0,
                .expected_str = "ST=BaWue",
                .expected_set = { 0 },
                .expected_count = 1,
        },
        {
                .field = "O",
                .value = "KIT",
                .loc = -1,
                .set = 0,
                .expected_str = "ST=BaWue, O=KIT",
                .expected_set = { 0, 1 },
                .expected_count = 2,
        },
        {
                .field = "L",
                .value = "Karlsruhe",
                .loc = 1,
                .set = 0,
                .expected_str = "ST=BaWue, L=Karlsruhe, O=KIT",
                .expected_set = { 0, 1, 2 },
                .expected_count = 3,
        },
        {
                .field = "C",
                .value = "DE",
                .loc = 0,
                .set = 1,
                .expected_str = "C=DE + ST=BaWue, L=Karlsruhe, O=KIT",
                .expected_set = { 0, 0, 1, 2 },
                .expected_count = 4,
        },
};

#define N_ENTRY_TESTS (sizeof(entry_tests) / sizeof(entry_tests[0]))

static int
verify_x509_name_output(X509_NAME *name, const struct x509_name_entry_test *tc)
{
        BIO *bio;
        char *got;
        long got_len;
        int loc, ret;
        int failed = 1;

        if ((bio = BIO_new(BIO_s_mem())) == NULL)
                goto fail;

        if ((ret = X509_NAME_print_ex(bio, name, 0, XN_FLAG_SEP_CPLUS_SPC)) == -1)
                goto fail;

        if ((got_len = BIO_get_mem_data(bio, &got)) < 0)
                goto fail;

        if (ret != got_len || strlen(tc->expected_str) != (size_t)ret)
                goto fail;

        if (strncmp(tc->expected_str, got, got_len) != 0)
                goto fail;

        if (X509_NAME_entry_count(name) != tc->expected_count)
                goto fail;

        for (loc = 0; loc < X509_NAME_entry_count(name); loc++) {
                X509_NAME_ENTRY *e = X509_NAME_get_entry(name, loc);
                if (e == NULL || X509_NAME_ENTRY_set(e) != tc->expected_set[loc])
                        goto fail;
        }

        failed = 0;

 fail:
        BIO_free(bio);

        return failed;
}

static int
x509_name_add_entry_test(void)
{
        X509_NAME *name;
        int failed = 1;

        if ((name = X509_NAME_new()) == NULL)
                goto done;

        for (size_t i = 0; i < N_ENTRY_TESTS; i++) {
                const struct x509_name_entry_test *t = &entry_tests[i];

                if (!X509_NAME_add_entry_by_txt(name, t->field, MBSTRING_ASC,
                    (const unsigned char *)t->value, -1, t->loc, t->set))
                        goto done;

                if (verify_x509_name_output(name, t))
                        goto done;
        }

        failed = 0;

 done:
        X509_NAME_free(name);

        return failed;
}

int
main(void)
{
        int failed = 0;

        failed |= x509_name_compat_test();
        failed |= x509_name_add_entry_test();

        return failed;
}