From f866359136ac3ba5785e345380eee17d8a70dbaf Mon Sep 17 00:00:00 2001
From: Joseph Birr-Pixton <jpixton@gmail.com>
Date: Sun, 18 Sep 2022 12:06:45 +0100
Subject: [PATCH] Add basic tests for ipv4/ipv6 SANs

---
 tests/cloudflare_dns/ca.der    | Bin 0 -> 947 bytes
 tests/cloudflare_dns/ee.der    | Bin 0 -> 1533 bytes
 tests/cloudflare_dns/inter.der | Bin 0 -> 1051 bytes
 tests/integration.rs           |  53 +++++++++++++++++++++++++++++++++
 4 files changed, 53 insertions(+)
 create mode 100644 tests/cloudflare_dns/ca.der
 create mode 100644 tests/cloudflare_dns/ee.der
 create mode 100644 tests/cloudflare_dns/inter.der

diff --git a/tests/cloudflare_dns/ca.der b/tests/cloudflare_dns/ca.der
new file mode 100644
index 0000000000000000000000000000000000000000..2f1e5523af47d44e35ea27be89e25a663ea7f99f
GIT binary patch
literal 947
zcmXqLVqS01#58>YGZP~dlK_YHgRlusZW|YtW}S?jc-+f?myJ`a&7<u*FC!x>D}zCz
zA-4f18*?ZNn=n&ou%W1dFo?q?%;S=op6Q%gRHERSmux6$APy4d78WQkFV{-}N+koO
z^pf*)4HXRJKvK-Y;&2`AIr&M6ISN7f`6UX@js|k#yar~5hK2?Z5GBrQ4CKMN^l(BG
zqY|>m8Ce;an;7{S44N3Zn3@<F86H_b6fC;8V#(#j;j01`^>dd`IJs!)JE3#aq8T|A
z&M;11?q{$)_`CCwOos5ek9w8vwzD}fG;*FhC*8dN{#olnw@25~j<aqqQy1&6o+mf8
z_T6@m#T>V;t*_#-WJ|60ik06Z{$usNcN*7A>Z>YdMz&_;#V8wj@Ao_KA}aTB!TxfA
z{eKw0wccFeA`oG;vQ*;g#YOwvAE{@3nPvRLlOv(~O8ge9mi-G?dHK}Zo%fH=DT`a+
zZ9Z|{9i?Zv=R~CXvQGayyICYf{CKqHJfr=e-u=4F?Q~`Jc1NRIJXhZTXuP_+H^P3a
z^b1doMFqDES?+${B=*UN%a47<TQA$Vt@Vp19A2-^#LURRxH#D$(SQ#anX>$hjQ?3!
zfC;G0fFHyc2Ju-9n1PgmEJ%QlMT|v+`Cfo&*hQb+X&)9pl9oO^eUt6QPy>08v@(l?
zfmj1}1*qu{7!8aJr{|cj@(>o{`gPZ3j(^aGFZb86e66hHSga!P$6LGQfbPz#$Nzmf
zC?9cpNA8@elIJrtR|{@^T(Dr_S)Y!XlY1r>JX*~!vv2as|H)UMuqRwzynk*q=f|sk
zkAuJTCI7NtetS#W{iL*O7xNr@Kk06LRqi!^Zp0()$O8__Z*?`AT<t1DCaKMM(BQGc
z{QZY(l?h_^*1X_5o43YA+(O^;)<ai2t(|7U=dA+RzU#d>67HFks3>ujWo?Cxj#WeU
z^4IG{MPA<MJh;;$=h4KRuKy`J%T>b-4oIsket75QefOHJTU0n$4c_SP<=*eQKVav|
c&#z}N3avfSacqW3d@q;Hv6ok;PR+ds0Q5R<IsgCw

literal 0
HcmV?d00001

diff --git a/tests/cloudflare_dns/ee.der b/tests/cloudflare_dns/ee.der
new file mode 100644
index 0000000000000000000000000000000000000000..afa7087f6447696523cbfe6e0166b8a5bd5976e3
GIT binary patch
literal 1533
zcmXqLV*P2*#M-ccnTe5!Nr1m}ajwz9Z06&q;^Pawm<tTJ*f_M>JkHs&Ff$v38FCwN
zvN4CUun9AT1{;bR2!l9W!aOdS>6y-{MI{QJdC7(b26`Z2W?^->aEMQ^f=6XiQD%yQ
ztFyC0u!p0ug^7ZZfsuiNv!kJboH(zMp`n41sR0;70l7vXu92~+rKx3<K@qCG!UlpM
z3pj+ioD*|0)AEb*G7}BO3`9VJ?83akiFpccMTvRInZ?QZhLQ&25Jw6)=j4~Bq~#<Q
zrRsp(sb?r{API4(P%>OfHzluFFF8NgAQI>~cCgQx7@<MH%*f8{#K7`f)8*3)`x|?k
z!Y=FV?c<zps69h%p3=15YVSX{j#gJ|uIe+*nZxD5n$ubQR)O!Vo8pHzzMGf6TrX`g
z^XZpcA6phTu?QJ7vG5tl18tX8W|1%uYY^eu!=WkOv(z%Titn89alOrNe;=+gkOe8=
zV-aH!k#v<-miSR}OG)IkTlOR2%?YAS4hD_OK=Ohtjq?l|XE$N-M3ab?9;Vlt`1A8p
z^^kBo3nLH!Nd^WWxoEx$nABrz7f@q!XK-hL0YO1@5djP}3@PYpQWy;QK<?ycWc<&<
z!py|p0P&Y93n<DswAmP0S=pI^VGLz40X+j!FVE6A*`RTPf!hL?1x{@a86_nJR{HwM
zMLEWLDZu2G3`}mIh|-58GGH2mBr#wLgCsCe`T`~|T|+&fE=+Sw$TP<d<TwQua|2TY
zV>Y(*Mjl|cG0-$nhk1aBQA`@@*z)pnR6Cplf(;s5VJaCJSt<?64OC!!1I9K9sLuT4
z;sO+{2L5nWOl{7vz(@pzLNSU$ed5BS#DE9n4`EQGFc~lyG%?n(aRFn1h4ES?6AKed
z6Js6_XEA0llrv~n?)xy$(o*q5Sn>SirR7ieh1bqW;QH~?H&!i1HTHN5Fxk}XOg#9W
zfq{jY!Nb6fNs-|+_a5K3AI~g~I4HgH)80)h#8#`k+U)cD-{Z1PkALr(IsvHU8&_iU
z3E>qHM^~3BPYe=%&%oHm%iqu$sD1lNoA#AJPKHv3z{MNB{$;G36PCNfyrQ3HN!1x?
z_0!+ybvVu9{dc9C^(oZiUto*f3|yEL>JKP(SzMW6e;~Q=`qb%K=8BHZ%R;7h9AMUy
zF4kI>_=8D-{ZWwHtK*)bcjD7$C$(~|y71OE%a?QRWoaFOzZ|jezA%(AIG#AQ@xGFq
zm%y=wR-8`laeju~(#)@4dmqpEFd=Cg+c&7SJHXbu8@Mtlq}-bNPTypkMr8gvZm}go
zi{|eC&XB*dF=fs*KZcKM1uB5v?Pt2$J+msB<7{jBxrvWXbfz3xa(8Nn$+Y5se|=<S
z%^HvkTIO^HgA^tM!JuVJPVy`~8IwO}&WF>w$L!^u43-F<az1RoQt{)ZD}m9`UC&xF
zq!bSGl<DzHdr31HcrN_8y1OXsw|QNH;KIH4!_q%p<Jx)8+bc;d;6P%*`dM3EPmAwv
P5oEtSb(Ko=b~z~k)xzV-

literal 0
HcmV?d00001

diff --git a/tests/cloudflare_dns/inter.der b/tests/cloudflare_dns/inter.der
new file mode 100644
index 0000000000000000000000000000000000000000..7d8413a3474b4cfb6a84d46dc35f75628d29ccc6
GIT binary patch
literal 1051
zcmXqLVi7lJV*0;;nTe5!Nr3&+=a}{t<?E~7zjU8zs=C*JmyJ`a&7<u*FC!xlD}zCz
zA-4f18*?ZNn=n&ou%W1dFo?q?%;S=op6Q%gRHERSmux6$APy4d78WQkFV{-}N+koO
z^pf*)4HXRJKvK-Y;&2`AIr&M6ISN7f`6UX@js|k#yherwCWa;kU=StFYYgHV8yTBg
znp#E~gc0Qg0|PyXJ?e0KLVSW1JSvllGE)>>ot+heJsgcKOcaa^j0}L*8XA-t2(YmO
z{d&%piII&}yOD)Ki8+aZ<)HMjS<y3YF40`@@(Rn=+pm{x$_YL2|Lu%pp89O+fv5Ku
z9AvFJym4-O=dQI|gvC#;*wTDr$ApV#N=(gcnu|7Uz3^Qr^Tfx7Bh?Q5=QG;XVk|p9
z`cCw{)!F@o`LOfT{rbg=n;4r6ni%U0gn;gq6=r1o&%$BA2Ber684P4WVtg!OEFxTc
zI5fq3mRjak@tre1uDAK^@55CF@*rtt76}8f1`+0a0j6OWeRijPSo}y@`tbBkwiiPU
z_&^HyL1wZ5<F^fBo+^u&fe0IiHX9==D?2kIoW*2N24gcavSb-#7^uMb28?YI86_nJ
zR{Hw+$;AaIQEK1-SH;w30#%iq2#WDy6ovY*n1Dn$D88K?^^%K944gpDlxMLvurx4V
zV7kD#%@AfxQI0WDX5<*yg3M50F*7hR;AZ1YX!Brf`<uhWXu!_Kn%>C6$Y{X9#s*>l
zg<vcuIExuAoijHvGBUVFHr8K}mfukLZAPrbt{Lt#Hq@1AzxprLy+&=bQ?KDOuNRUR
z-ro{=eqChJ!bzW&>*=olE&J_v@P;n?KR3j<UT)Cawv=09f~ne~Ti;e}H~KSG+54F5
z&Liia)VzCk^2da|MUQ75mgQ!x$(o+KX*HACjYE5M7$@1YEbcB9Jib$NkKl#2U6b~x
z{Y*V!epc;Un=lW{s?Mhs8xQ(b?kQW$9r)zvg?U;3q;$g8v6-naE|%e_oosaBkc;H4
z-Y<OBvKq|VoLyz7%I~ySt*H)D3te8sKlf6H|G$ljN2M07viur$`%udfQ~82hyWKvt
e?N4DiV)uQ%oAg{|)}6JR{rOkAT0Jf?m;nI9=3nIi

literal 0
HcmV?d00001

diff --git a/tests/integration.rs b/tests/integration.rs
index 0f3f4ce1..0ae7bea8 100644
--- a/tests/integration.rs
+++ b/tests/integration.rs
@@ -53,6 +53,59 @@ pub fn netflix() {
     );
 }
 
+/* This is notable because it is a popular use of IP address subjectAltNames. */
+#[cfg(feature = "alloc")]
+#[test]
+pub fn cloudflare_dns() {
+    let ee: &[u8] = include_bytes!("cloudflare_dns/ee.der");
+    let inter = include_bytes!("cloudflare_dns/inter.der");
+    let ca = include_bytes!("cloudflare_dns/ca.der");
+
+    let anchors = vec![webpki::TrustAnchor::try_from_cert_der(ca).unwrap()];
+    let anchors = webpki::TLSServerTrustAnchors(&anchors);
+
+    #[allow(clippy::unreadable_literal)]
+    let time = webpki::Time::from_seconds_since_unix_epoch(1663495771);
+
+    let cert = webpki::EndEntityCert::try_from(ee).unwrap();
+    assert_eq!(
+        Ok(()),
+        cert.verify_is_valid_tls_server_cert(ALL_SIGALGS, &anchors, &[inter], time)
+    );
+
+    let check_name = |name: &str| {
+        let dns_name_ref = webpki::DnsNameRef::try_from_ascii_str(name).unwrap();
+        assert_eq!(Ok(()), cert.verify_is_valid_for_dns_name(dns_name_ref));
+        let subject_name_ref = webpki::SubjectNameRef::from(dns_name_ref);
+        assert_eq!(
+            Ok(()),
+            cert.verify_is_valid_for_subject_name(subject_name_ref)
+        );
+        println!("{:?} ok as name", name);
+    };
+
+    let check_addr = |addr: &str| {
+        let subject_name_ref = webpki::SubjectNameRef::try_from_ascii(addr.as_bytes()).unwrap();
+        assert_eq!(
+            Ok(()),
+            cert.verify_is_valid_for_subject_name(subject_name_ref)
+        );
+        println!("{:?} ok as address", addr);
+    };
+
+    check_name("cloudflare-dns.com");
+    check_name("wildcard.cloudflare-dns.com");
+    check_name("one.one.one.one");
+    check_addr("1.1.1.1");
+    check_addr("1.0.0.1");
+    check_addr("162.159.36.1");
+    check_addr("162.159.46.1");
+    check_addr("2606:4700:4700:0000:0000:0000:0000:1111");
+    check_addr("2606:4700:4700:0000:0000:0000:0000:1001");
+    check_addr("2606:4700:4700:0000:0000:0000:0000:0064");
+    check_addr("2606:4700:4700:0000:0000:0000:0000:6400");
+}
+
 #[test]
 pub fn ed25519() {
     let ee: &[u8] = include_bytes!("ed25519/ee.der");