GeezerVison is showing github.com — test: add script to create 0-dns-cert.pem · nodejs/node@aa98150
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboard +19Lines changed: 19 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +-----BEGIN CERTIFICATE----- | | 2 | +MIIDGDCCAgCgAwIBAgIBATANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDEw5jYS5l | | 3 | +eGFtcGxlLmNvbTAeFw0xNzAzMDIwMTMxMjJaFw0yNzAyMjgwMTMxMjJaMBsxGTAX | | 4 | +BgNVBAMTEGV2aWwuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw | | 5 | +ggEKAoIBAQDFyJT0kv2P9L6iNY6TL7IZonAR8R9ev7iD1tR5ycMEpM/y6WTefIco | | 6 | +civMcBGVZWtCgkoePHiveH9UIep7HFGB4gxCYDZFYB46yGS0YH2fB5GWXTLYObYa | | 7 | +zxuEhgFRG0DLIwNDRLW0+0FG3disp7YdRHBtdbL58F/qNORqPEjIpoQxOJc2UqX2 | | 8 | +/gfomJRdFW/PSgN7uH2QwMzRQRIrKmyAFzeuEWVP+UAV4853Yg66PmYpAASyt069 | | 9 | +sE8QNTNE75KrerMmYzH7AmTEGvY8bukrDuVQZce2/lcK2rAE+G6at2eBNMZKOnzR | | 10 | +y9kWIiJ3rR7+WK55EKelLz0doZFKteu1AgMBAAGjaTBnMGUGA1UdEQReMFyCImdv | | 11 | +b2QuZXhhbXBsZS5vcmcALmV2aWwuZXhhbXBsZS5jb22CGGp1c3QtYW5vdGhlci5l | | 12 | +eGFtcGxlLmNvbYcECAgICIcECAgEBIIQbGFzdC5leGFtcGxlLmNvbTANBgkqhkiG | | 13 | +9w0BAQsFAAOCAQEAvreVoOZO2gpM4Dmzp70D30XZjsK9i0BCsRHBvPLPw3y8B2xg | | 14 | +BRtOREOI69NU0WGpj5Lbqww5M8M1hjHshiGEu2aXfZ6qM3lENaIMCpKlF9jbm02/ | | 15 | +wmxNaAnS8bDSZyO5rbsGr2tJb4ds7DazmMEKWhOBEpJoOp9rG6SAey+a6MkZ7NEN | | 16 | +0p3THCqNf3lL1KblPrMvdsyhHPEzv4uT7+YAnLKHwGzbihcWJRsRo5oipWL8ZDhn | | 17 | +bd3SMWtfRTSWDmghJaHke2xIjDtTwSjHjjPTFsK+rl227W8r4/EQI/X6fTQV2j3T | | 18 | +7zqrJLF9h9F/v3mo57k6sxsQNZ12XvhuTHC2dA== | | 19 | +-----END CERTIFICATE----- |
Collapse file Copy file name to clipboard +27Lines changed: 27 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +-----BEGIN RSA PRIVATE KEY----- | | 2 | +MIIEowIBAAKCAQEAxciU9JL9j/S+ojWOky+yGaJwEfEfXr+4g9bUecnDBKTP8ulk | | 3 | +3nyHKHIrzHARlWVrQoJKHjx4r3h/VCHqexxRgeIMQmA2RWAeOshktGB9nweRll0y | | 4 | +2Dm2Gs8bhIYBURtAyyMDQ0S1tPtBRt3YrKe2HURwbXWy+fBf6jTkajxIyKaEMTiX | | 5 | +NlKl9v4H6JiUXRVvz0oDe7h9kMDM0UESKypsgBc3rhFlT/lAFePOd2IOuj5mKQAE | | 6 | +srdOvbBPEDUzRO+Sq3qzJmMx+wJkxBr2PG7pKw7lUGXHtv5XCtqwBPhumrdngTTG | | 7 | +Sjp80cvZFiIid60e/liueRCnpS89HaGRSrXrtQIDAQABAoIBABcGA3j5B3VTi0F8 | | 8 | +tI0jtzrOsvcTt5AjB0qpnnBS8VXADcj8LFbN7jniGIEi5pkahkLmwdQFPBNJFqFn | | 9 | +lVEheceB1eWAJ7EpwDsdisOIm/cAPY1gagPLrAww4cYqh0q2vnMnL0EMZY6c1Pt3 | | 10 | +5borh8KebewAEIaR2ch8wb4wKFTbAM0DftYBFzHAF88OeCuIpdsk2Tz0sVQbA3/1 | | 11 | +XNLOVcJvDOVIRPEpo2l7RIN33KvDhzpMoV3qVzWxqdccPRZZFU5KmJ6DtouIPT3S | | 12 | +3WauIL5oVpAyYNJETTyxjBQE4DgFeNX1Wyycgk27EoLcn6Trcs0kNVrmXXblNAtJ | | 13 | +Nko6g10CgYEA+TjzNjyAXPrOpY88uiPVMAgepEQOnDYtMwasdDVaW3xK9KH1rrhU | | 14 | +dx1IDTMmOUfyU2qsj5txmJtReQz//1bpd7e73VO8mHQDUubhs2TivgGs+fqzAdmT | | 15 | +vJsjerfNsxf+4JENzzWmqT/Ybc976Tu55VH5mcRG9Q66fTxdAJ51+8MCgYEAyymF | | 16 | +gntRMBd9e/KIiqlvcxelo0ahyKEzaJC7/FkZotuSB+kAwpdJ5Unb0FeVQZxNhDPg | | 17 | +xgsrGOOOvHvfhv7DPU0TQ/vp6VDPdg+N6m/Ow2vr79A2v6s+7gZj3MLiLRFyEF6l | | 18 | +bxQNGe3qavnm3owUQQCY2RLBKYCFfv/cykYlGycCgYB6etKMRQ+QonIMS2i80f9j | | 19 | +q5njgM7tVnLAMPdv5QiTDXKI50+mnlBkea9/TTPr0r/03ugPa4VYSnyv0QO+qSfz | | 20 | +/ggFrbFx+xHnHDCvyVTlrE0mTV7L+fHxLw0wskQVUCWil6cBvow5gXcMAHwVE5U4 | | 21 | +biEMwLlele5wvcm3FClHoQKBgACV/RGUQ3atCqqZ13T26iBd2Bdxc7P9awWJLVGb | | 22 | +/CvxECm/rUXiY88qeFzQc9i9l6ei8qn/jD9FILtAbDOadnutxjly94i5t+9yOgmM | | 23 | +Cv+bRxHo+s9wsfzDvfP8B+TzYO3VKAr69tK1UfC/CcBojQJm+wndOPtiqH/mQv++ | | 24 | +VgsPAoGBAJ0aNJe3zb+blvAQ3W4iPSjhyxdMC00x46pr6ds+Y8WygbN6lzCvNDw6 | | 25 | +FFTINBckOs5Z/UWUNbExWYjBHZhLlhhxTezCzvIrwNvgUB8Y4sPk3S4KDsnkyy6f | | 26 | +/qMmEHlVyKjh2BCNs7PVnWDlfl3vECE7n8dBizFHgja76l1ia+0z | | 27 | +-----END RSA PRIVATE KEY----- |
Collapse file Copy file name to clipboard Collapse file Copy file name to clipboard +26Lines changed: 26 additions & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +## Purpose | | 2 | +The test cert file for use `test/parallel/test-tls-0-dns-altname.js` | | 3 | +can be created by using `asn1.js` and `asn1.js-rfc5280`, | | 4 | + | | 5 | +## How to create a test cert. | | 6 | + | | 7 | +```sh | | 8 | +$ openssl genrsa -out 0-dns-key.pem 2048 | | 9 | +Generating RSA private key, 2048 bit long modulus | | 10 | +...................+++ | | 11 | +..............................................................................................+++ | | 12 | +e is 65537 (0x10001) | | 13 | +$ openssl rsa -in 0-dns-key.pem -RSAPublicKey_out -outform der -out 0-dns-rsapub.der | | 14 | +writing RSA key | | 15 | +$ npm install | | 16 | + | | 17 | + | | 18 | + | | 19 | + | | 20 | + | | 21 | + | | 22 | + | | 23 | +$ node ./createCert.js | | 24 | +$ openssl x509 -text -in 0-dns-cert.pem | | 25 | +(You can not see evil.example.com in subjectAltName field) | | 26 | +``` |
Collapse file Copy file name to clipboard +75Lines changed: 75 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +'use strict'; | | 2 | +const asn1 = require('asn1.js'); | | 3 | +const crypto = require('crypto'); | | 4 | +const fs = require('fs'); | | 5 | +const rfc5280 = require('asn1.js-rfc5280'); | | 6 | +const BN = asn1.bignum; | | 7 | + | | 8 | +const id_at_commonName = [ 2, 5, 4, 3 ]; | | 9 | +const rsaEncryption = [1, 2, 840, 113549, 1, 1, 1]; | | 10 | +const sha256WithRSAEncryption = [1, 2, 840, 113549, 1, 1, 11]; | | 11 | +const sigalg = 'RSA-SHA256'; | | 12 | + | | 13 | +const private_key = fs.readFileSync('./0-dns-key.pem'); | | 14 | +// public key file can be generated from the private key with | | 15 | +// openssl rsa -in 0-dns-key.pem -RSAPublicKey_out -outform der | | 16 | +// -out 0-dns-rsapub.der | | 17 | +const public_key = fs.readFileSync('./0-dns-rsapub.der'); | | 18 | + | | 19 | +const now = Date.now(); | | 20 | +const days = 3650; | | 21 | + | | 22 | +const Null_ = asn1.define('Null_', function() { | | 23 | + this.null_(); | | 24 | +}); | | 25 | +const null_ = Null_.encode('der'); | | 26 | + | | 27 | +const PrintStr = asn1.define('PrintStr', function() { | | 28 | + this.printstr(); | | 29 | +}); | | 30 | +const issuer = PrintStr.encode('ca.example.com', 'der'); | | 31 | +const subject = PrintStr.encode('evil.example.com', 'der'); | | 32 | + | | 33 | +const tbs = { | | 34 | + version: 'v3', | | 35 | + serialNumber: new BN('01', 16), | | 36 | + signature: { algorithm: sha256WithRSAEncryption, parameters: null_}, | | 37 | + issuer: { type: 'rdnSequence', | | 38 | + value: [ [{type: id_at_commonName, value: issuer}] ] }, | | 39 | + validity: | | 40 | + { notBefore: { type: 'utcTime', value: now }, | | 41 | + notAfter: { type: 'utcTime', value: now + days * 86400000} }, | | 42 | + subject: { type: 'rdnSequence', | | 43 | + value: [ [{type: id_at_commonName, value: subject}] ] }, | | 44 | + subjectPublicKeyInfo: | | 45 | + { algorithm: { algorithm: rsaEncryption, parameters: null_}, | | 46 | + subjectPublicKey: { unused: 0, data: public_key} }, | | 47 | + extensions: | | 48 | + [ { extnID: 'subjectAlternativeName', | | 49 | + critical: false, | | 50 | + // subjectAltName which contains '\0' character to check CVE-2009-2408 | | 51 | + extnValue: [ | | 52 | + { type: 'dNSName', value: 'good.example.org\u0000.evil.example.com' }, | | 53 | + { type: 'dNSName', value: 'just-another.example.com' }, | | 54 | + { type: 'iPAddress', value: Buffer.from('08080808', 'hex') }, | | 55 | + { type: 'iPAddress', value: Buffer.from('08080404', 'hex') }, | | 56 | + { type: 'dNSName', value: 'last.example.com' } ] } | | 57 | + ] | | 58 | +}; | | 59 | + | | 60 | +const tbs_der = rfc5280.TBSCertificate.encode(tbs, 'der'); | | 61 | + | | 62 | +const sign = crypto.createSign(sigalg); | | 63 | +sign.update(tbs_der); | | 64 | +const signature = sign.sign(private_key); | | 65 | + | | 66 | +const cert = { | | 67 | + tbsCertificate: tbs, | | 68 | + signatureAlgorithm: { algorithm: sha256WithRSAEncryption, parameters: null_ }, | | 69 | + signature: | | 70 | + { unused: 0, | | 71 | + data: signature } | | 72 | +}; | | 73 | +const pem = rfc5280.Certificate.encode(cert, 'pem', {label: 'CERTIFICATE'}); | | 74 | + | | 75 | +fs.writeFileSync('./0-dns-cert.pem', pem + '\n'); |
Collapse file Copy file name to clipboard +16Lines changed: 16 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +{ | | 2 | + "name": "0-dns", | | 3 | + "version": "1.0.0", | | 4 | + "description": "create certificate for 0-dns test", | | 5 | + "main": "createCert.js", | | 6 | + "scripts": { | | 7 | + "test": "echo \"Error: no test specified\" && exit 1" | | 8 | + }, | | 9 | + "author": "", | | 10 | + "license": "SEE LICENSE IN ../../../LICENSE", | | 11 | + "private": true, | | 12 | + "dependencies": { | | 13 | + "asn1.js": "^4.9.1", | | 14 | + "asn1.js-rfc5280": "^1.2.2" | | 15 | + } | | 16 | +} |
Collapse file Copy file name to clipboardExpand all lines: test/fixtures/keys/0-dns-cert.pem -19Lines changed: 0 additions & 19 deletions Collapse file Copy file name to clipboardExpand all lines: test/fixtures/keys/0-dns-key.pem -27Lines changed: 0 additions & 27 deletions Collapse file Copy file name to clipboardExpand all lines: test/parallel/test-tls-0-dns-altname.js +7-5Lines changed: 7 additions & 5 deletions | Original file line number | Diff line number | Diff line change |
|---|
| 2 | 2 | const common = require('../common'); | 3 | 3 | const assert = require('assert'); | 4 | 4 |
| | 5 | +// Check getPeerCertificate can properly handle '\0' for fix CVE-2009-2408. | | 6 | + | 5 | 7 | if (!common.hasCrypto) { | 6 | 8 | common.skip('missing crypto'); | 7 | 9 | return; | @@ -11,8 +13,8 @@ const tls = require('tls'); | 11 | 13 | const fs = require('fs'); | 12 | 14 |
| 13 | 15 | const server = tls.createServer({ | 14 | | - key: fs.readFileSync(common.fixturesDir + '/keys/0-dns-key.pem'), | 15 | | - cert: fs.readFileSync(common.fixturesDir + '/keys/0-dns-cert.pem') | | 16 | + key: fs.readFileSync(common.fixturesDir + '/0-dns/0-dns-key.pem'), | | 17 | + cert: fs.readFileSync(common.fixturesDir + '/0-dns/0-dns-cert.pem') | 16 | 18 | }, function(c) { | 17 | 19 | c.once('data', function() { | 18 | 20 | c.destroy(); | @@ -24,11 +26,11 @@ const server = tls.createServer({ | 24 | 26 | }, common.mustCall(function() { | 25 | 27 | const cert = c.getPeerCertificate(); | 26 | 28 | assert.strictEqual(cert.subjectaltname, | 27 | | - 'DNS:google.com\0.evil.com, ' + | 28 | | - 'DNS:just-another.com, ' + | | 29 | + 'DNS:good.example.org\0.evil.example.com, ' + | | 30 | + 'DNS:just-another.example.com, ' + | 29 | 31 | 'IP Address:8.8.8.8, ' + | 30 | 32 | 'IP Address:8.8.4.4, ' + | 31 | | - 'DNS:last.com'); | | 33 | + 'DNS:last.example.com'); | 32 | 34 | c.write('ok'); | 33 | 35 | })); | 34 | 36 | })); |
|