generate_name_constraints.py 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554
  1. #!/usr/bin/env python
  2. # Copyright 2015 The Chromium Authors. All rights reserved.
  3. # Use of this source code is governed by a BSD-style license that can be
  4. # found in the LICENSE file.
  5. import base64
  6. import copy
  7. import os
  8. import random
  9. import subprocess
  10. import sys
  11. import tempfile
  12. sys.path += [os.path.join('..', 'verify_name_match_unittest', 'scripts')]
  13. import generate_names
  14. def generate(s, out_fn):
  15. conf_tempfile = tempfile.NamedTemporaryFile()
  16. conf_tempfile.write(str(s))
  17. conf_tempfile.flush()
  18. der_tmpfile = tempfile.NamedTemporaryFile()
  19. description_tmpfile = tempfile.NamedTemporaryFile()
  20. subprocess.check_call(['openssl', 'asn1parse', '-genconf', conf_tempfile.name,
  21. '-i', '-out', der_tmpfile.name],
  22. stdout=description_tmpfile)
  23. conf_tempfile.close()
  24. output_file = open(out_fn, 'w')
  25. description_tmpfile.seek(0)
  26. output_file.write(description_tmpfile.read())
  27. output_file.write('-----BEGIN %s-----\n' % s.token())
  28. output_file.write(base64.encodestring(der_tmpfile.read()))
  29. output_file.write('-----END %s-----\n' % s.token())
  30. output_file.close()
  31. class SubjectAltNameGenerator:
  32. def __init__(self):
  33. self.names = []
  34. def token(self):
  35. return "SUBJECT ALTERNATIVE NAME"
  36. def add_name(self, general_name):
  37. self.names.append(general_name)
  38. def __str__(self):
  39. s = "asn1 = SEQUENCE:subjectAltNameSequence\n"
  40. s += "[subjectAltNameSequence]\n"
  41. s_suffix = ""
  42. for n, name in enumerate(self.names):
  43. n1, n2 = (str(name) + '\n').split('\n', 1)
  44. if n2:
  45. s_suffix += n2 + '\n'
  46. s += '%s%s\n' % (n, n1)
  47. return s + s_suffix
  48. class NameConstraintsGenerator:
  49. def __init__(self,
  50. force_permitted_sequence=False,
  51. force_excluded_sequence=False):
  52. self.permitted = []
  53. self.excluded = []
  54. self.force_permitted_sequence = force_permitted_sequence
  55. self.force_excluded_sequence = force_excluded_sequence
  56. def token(self):
  57. return "NAME CONSTRAINTS"
  58. def union_from(self, c):
  59. self.permitted.extend(c.permitted)
  60. self.excluded.extend(c.excluded)
  61. def add_permitted(self, general_name):
  62. self.permitted.append(general_name)
  63. def add_excluded(self, general_name):
  64. self.excluded.append(general_name)
  65. def __str__(self):
  66. s = "asn1 = SEQUENCE:nameConstraintsSequence\n[nameConstraintsSequence]\n"
  67. if self.permitted or self.force_permitted_sequence:
  68. s += "permittedSubtrees = IMPLICIT:0,SEQUENCE:permittedSubtreesSequence\n"
  69. if self.excluded or self.force_excluded_sequence:
  70. s += "excludedSubtrees = IMPLICIT:1,SEQUENCE:excludedSubtreesSequence\n"
  71. if self.permitted or self.force_permitted_sequence:
  72. s += "[permittedSubtreesSequence]\n"
  73. for n, subtree in enumerate(self.permitted):
  74. s += 'subtree%i = SEQUENCE:permittedSubtree%i\n' % (n, n)
  75. if self.excluded or self.force_excluded_sequence:
  76. s += "[excludedSubtreesSequence]\n"
  77. for n, subtree in enumerate(self.excluded):
  78. s += 'subtree%i = SEQUENCE:excludedSubtree%i\n' % (n, n)
  79. for n, subtree in enumerate(self.permitted):
  80. s += '[permittedSubtree%i]\n%s\n' % (n, subtree)
  81. for n, subtree in enumerate(self.excluded):
  82. s += '[excludedSubtree%i]\n%s\n' % (n, subtree)
  83. return s
  84. def other_name():
  85. i = random.randint(0, sys.maxint)
  86. s = 'otherName = IMPLICIT:0,SEQUENCE:otherNameSequence%i\n' % i
  87. s += '[otherNameSequence%i]\n' % i
  88. s += 'type_id = OID:1.2.3.4.5\n'
  89. s += 'value = FORMAT:HEX,OCTETSTRING:DEADBEEF\n'
  90. return s
  91. def rfc822_name(name):
  92. return 'rfc822Name = IMPLICIT:1,IA5STRING:' + name
  93. def dns_name(name):
  94. return 'dNSName = IMPLICIT:2,IA5STRING:' + name
  95. def x400_address():
  96. i = random.randint(0, sys.maxint)
  97. s = 'x400Address = IMPLICIT:3,SEQUENCE:x400AddressSequence%i\n' % i
  98. s += '[x400AddressSequence%i]\n' % i
  99. s += 'builtinstandardattributes = SEQUENCE:BuiltInStandardAttributes%i\n' % i
  100. s += '[BuiltInStandardAttributes%i]\n' % i
  101. s += 'countryname = EXPLICIT:1A,PRINTABLESTRING:US\n'
  102. return s
  103. def directory_name(name):
  104. return str(name).replace(
  105. 'asn1 = SEQUENCE', 'directoryName = EXPLICIT:4,SEQUENCE')
  106. def edi_party_name():
  107. i = random.randint(0, sys.maxint)
  108. s = 'ediPartyName = IMPLICIT:5,SEQUENCE:ediPartyNameSequence%i\n' % i
  109. s += '[ediPartyNameSequence%i]\n' % i
  110. s += 'partyName = IMPLICIT:1,UTF8:foo\n'
  111. return s
  112. def uniform_resource_identifier(name):
  113. return 'uniformResourceIdentifier = IMPLICIT:6,IA5STRING:' + name
  114. def ip_address(addr, enforce_length=True):
  115. if enforce_length:
  116. assert len(addr) in (4,16)
  117. addr_str = ""
  118. for addr_byte in addr:
  119. addr_str += '%02X'%(addr_byte)
  120. return 'iPAddress = IMPLICIT:7,FORMAT:HEX,OCTETSTRING:' + addr_str
  121. def ip_address_range(addr, netmask, enforce_length=True):
  122. if enforce_length:
  123. assert len(addr) == len(netmask)
  124. assert len(addr) in (4,16)
  125. addr_str = ""
  126. netmask_str = ""
  127. for addr_byte, mask_byte in map(None, addr, netmask):
  128. assert (addr_byte & ~mask_byte) == 0
  129. addr_str += '%02X'%(addr_byte)
  130. netmask_str += '%02X'%(mask_byte)
  131. return ('iPAddress = IMPLICIT:7,FORMAT:HEX,OCTETSTRING:' + addr_str +
  132. netmask_str)
  133. def registered_id(oid):
  134. return 'registeredID = IMPLICIT:8,OID:' + oid
  135. def with_min_max(val, minimum=None, maximum=None):
  136. s = val
  137. s += '\n'
  138. assert '\n[' not in s
  139. if minimum is not None:
  140. s += 'minimum = IMPLICIT:0,INTEGER:%i\n' % minimum
  141. if maximum is not None:
  142. s += 'maximum = IMPLICIT:1,INTEGER:%i\n' % maximum
  143. return s
  144. def main():
  145. dnsname_constraints = NameConstraintsGenerator()
  146. dnsname_constraints.add_permitted(dns_name("permitted.example.com"))
  147. dnsname_constraints.add_permitted(dns_name("permitted.example2.com"))
  148. dnsname_constraints.add_permitted(dns_name("permitted.example3.com."))
  149. dnsname_constraints.add_permitted(dns_name("alsopermitted.example.com"))
  150. dnsname_constraints.add_excluded(dns_name("excluded.permitted.example.com"))
  151. dnsname_constraints.add_permitted(
  152. dns_name("stillnotpermitted.excluded.permitted.example.com"))
  153. dnsname_constraints.add_excluded(dns_name("extraneousexclusion.example.com"))
  154. generate(dnsname_constraints, "dnsname.pem")
  155. dnsname_constraints2 = NameConstraintsGenerator()
  156. dnsname_constraints2.add_permitted(dns_name("com"))
  157. dnsname_constraints2.add_excluded(dns_name("foo.bar.com"))
  158. generate(dnsname_constraints2, "dnsname2.pem")
  159. dnsname_constraints3 = NameConstraintsGenerator()
  160. dnsname_constraints3.add_permitted(dns_name(".bar.com"))
  161. generate(dnsname_constraints3, "dnsname-permitted_with_leading_dot.pem")
  162. dnsname_constraints4 = NameConstraintsGenerator()
  163. dnsname_constraints4.add_excluded(dns_name(".bar.com"))
  164. generate(dnsname_constraints4, "dnsname-excluded_with_leading_dot.pem")
  165. dnsname_constraints5 = NameConstraintsGenerator()
  166. dnsname_constraints5.add_permitted(dns_name(".."))
  167. generate(dnsname_constraints5, "dnsname-permitted_two_dot.pem")
  168. c = NameConstraintsGenerator()
  169. c.add_excluded(dns_name("excluded.permitted.example.com"))
  170. generate(c, "dnsname-excluded.pem")
  171. c = NameConstraintsGenerator()
  172. c.add_permitted(dns_name("permitted.example.com"))
  173. c.add_excluded(dns_name(""))
  174. generate(c, "dnsname-excludeall.pem")
  175. c = NameConstraintsGenerator()
  176. c.add_permitted(dns_name("permitted.example.com"))
  177. c.add_excluded(dns_name("."))
  178. generate(c, "dnsname-exclude_dot.pem")
  179. ipaddress_constraints = NameConstraintsGenerator()
  180. ipaddress_constraints.add_permitted(
  181. ip_address_range((192,168,0,0),(255,255,0,0)))
  182. ipaddress_constraints.add_excluded(
  183. ip_address_range((192,168,5,0),(255,255,255,0)))
  184. ipaddress_constraints.add_permitted(
  185. ip_address_range((192,168,5,32),(255,255,255,224)))
  186. ipaddress_constraints.add_permitted(
  187. ip_address_range((192,167,5,32),(255,255,255,224)))
  188. ipaddress_constraints.add_excluded(
  189. ip_address_range((192,166,5,32),(255,255,255,224)))
  190. ipaddress_constraints.add_permitted(ip_address_range(
  191. (1,2,3,4,5,6,7,8,9,10,11,12,0,0,0,0),
  192. (255,255,255,255,255,255,255,255,255,255,255,255,0,0,0,0)))
  193. ipaddress_constraints.add_excluded(ip_address_range(
  194. (1,2,3,4,5,6,7,8,9,10,11,12,5,0,0,0),
  195. (255,255,255,255,255,255,255,255,255,255,255,255,255,0,0,0)))
  196. ipaddress_constraints.add_permitted(ip_address_range(
  197. (1,2,3,4,5,6,7,8,9,10,11,12,5,32,0,0),
  198. (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0)))
  199. ipaddress_constraints.add_permitted(ip_address_range(
  200. (1,2,3,4,5,6,7,8,9,10,11,11,5,32,0,0),
  201. (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0)))
  202. ipaddress_constraints.add_excluded(ip_address_range(
  203. (1,2,3,4,5,6,7,8,9,10,11,10,5,32,0,0),
  204. (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0)))
  205. generate(ipaddress_constraints, "ipaddress.pem")
  206. c = NameConstraintsGenerator()
  207. c.add_permitted(ip_address_range((192,168,1,3),(255,255,255,255)))
  208. generate(c, "ipaddress-permit_singlehost.pem")
  209. c = NameConstraintsGenerator()
  210. c.add_permitted(ip_address_range((0,0,0,0),(0,0,0,0)))
  211. generate(c, "ipaddress-permit_all.pem")
  212. c = NameConstraintsGenerator()
  213. c.add_permitted(ip_address_range((0x80,0,0,0),(0x80,0,0,0)))
  214. generate(c, "ipaddress-permit_prefix1.pem")
  215. c = NameConstraintsGenerator()
  216. c.add_permitted(ip_address_range((192,168,1,2),(255,255,255,254)))
  217. generate(c, "ipaddress-permit_prefix31.pem")
  218. c = NameConstraintsGenerator()
  219. c.add_permitted(ip_address_range((192,168,1,0),(255,255,255,253)))
  220. generate(c, "ipaddress-invalid_mask_not_contiguous_1.pem")
  221. c = NameConstraintsGenerator()
  222. c.add_permitted(ip_address_range((192,168,0,0),(255,253,0,0)))
  223. generate(c, "ipaddress-invalid_mask_not_contiguous_2.pem")
  224. c = NameConstraintsGenerator()
  225. c.add_permitted(ip_address_range((0,0,0,0),(0x40,0,0,0)))
  226. generate(c, "ipaddress-invalid_mask_not_contiguous_3.pem")
  227. c = NameConstraintsGenerator()
  228. c.add_permitted(ip_address_range((192,0,0,0),(0xFF,0,0xFF,0)))
  229. generate(c, "ipaddress-invalid_mask_not_contiguous_4.pem")
  230. c = NameConstraintsGenerator()
  231. c.add_excluded(ip_address_range((192,168,5,0),(255,255,255,0)))
  232. generate(c, "ipaddress-excluded.pem")
  233. c = NameConstraintsGenerator()
  234. c.add_permitted(ip_address_range((192,168,0,0),(255,255,0,0)))
  235. c.add_permitted(ip_address_range((1,2,3,4,5,6,7,8,9,10,11,12,0,0,0,0),
  236. (255,255,255,255,255,255,255,255,
  237. 255,255,255,255,0,0,0,0)))
  238. c.add_excluded(ip_address_range((0,0,0,0),(0,0,0,0)))
  239. c.add_excluded(ip_address_range((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0),
  240. (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)))
  241. generate(c, "ipaddress-excludeall.pem")
  242. c = NameConstraintsGenerator()
  243. c.add_permitted(ip_address_range((192,168,0,0),(255,255,255,0)))
  244. c.add_permitted(ip_address_range((192,168,5,0,0),(255,255,255,0,0),
  245. enforce_length=False))
  246. generate(c, "ipaddress-invalid_addr.pem")
  247. n_us = generate_names.NameGenerator()
  248. n_us.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'US')
  249. generate(n_us, "name-us.pem")
  250. n_us_az = copy.deepcopy(n_us)
  251. n_us_az.add_rdn().add_attr('stateOrProvinceName', 'UTF8', 'Arizona')
  252. generate(n_us_az, "name-us-arizona.pem")
  253. n_us_ca = copy.deepcopy(n_us)
  254. n_us_ca.add_rdn().add_attr('stateOrProvinceName', 'UTF8', 'California')
  255. generate(n_us_ca, "name-us-california.pem")
  256. n_us_ca_mountain_view = copy.deepcopy(n_us_ca)
  257. n_us_ca_mountain_view.add_rdn().add_attr(
  258. 'localityName', 'UTF8', 'Mountain View')
  259. generate(n_us_ca_mountain_view, "name-us-california-mountain_view.pem")
  260. n_jp = generate_names.NameGenerator()
  261. n_jp.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'JP')
  262. generate(n_jp, "name-jp.pem")
  263. n_jp_tokyo = copy.deepcopy(n_jp)
  264. n_jp_tokyo.add_rdn().add_attr(
  265. 'stateOrProvinceName', 'UTF8', '\xe6\x9d\xb1\xe4\xba\xac', 'FORMAT:UTF8')
  266. generate(n_jp_tokyo, "name-jp-tokyo.pem")
  267. n_us_az_foodotcom = copy.deepcopy(n_us_az)
  268. n_us_az_foodotcom.add_rdn().add_attr('commonName', 'UTF8', 'foo.com')
  269. generate(n_us_az_foodotcom, "name-us-arizona-foo.com.pem")
  270. n_us_az_permittedexamplecom = copy.deepcopy(n_us_az)
  271. n_us_az_permittedexamplecom.add_rdn().add_attr('commonName', 'UTF8',
  272. 'permitted.example.com')
  273. generate(n_us_az_permittedexamplecom,
  274. "name-us-arizona-permitted.example.com.pem")
  275. n_us_ca_permittedexamplecom = copy.deepcopy(n_us_ca)
  276. n_us_ca_permittedexamplecom.add_rdn().add_attr('commonName', 'UTF8',
  277. 'permitted.example.com')
  278. generate(n_us_ca_permittedexamplecom,
  279. "name-us-california-permitted.example.com.pem")
  280. n_us_az_ip1111 = copy.deepcopy(n_us_az)
  281. n_us_az_ip1111.add_rdn().add_attr('commonName', 'UTF8', '1.1.1.1')
  282. generate(n_us_az_ip1111, "name-us-arizona-1.1.1.1.pem")
  283. n_us_az_192_168_1_1 = copy.deepcopy(n_us_az)
  284. n_us_az_192_168_1_1.add_rdn().add_attr('commonName', 'UTF8', '192.168.1.1')
  285. generate(n_us_az_192_168_1_1, "name-us-arizona-192.168.1.1.pem")
  286. n_us_az_ipv6 = copy.deepcopy(n_us_az)
  287. n_us_az_ipv6.add_rdn().add_attr('commonName', 'UTF8',
  288. '102:304:506:708:90a:b0c::1')
  289. generate(n_us_az_ipv6, "name-us-arizona-ipv6.pem")
  290. n_us_ca_192_168_1_1 = copy.deepcopy(n_us_ca)
  291. n_us_ca_192_168_1_1.add_rdn().add_attr('commonName', 'UTF8', '192.168.1.1')
  292. generate(n_us_ca_192_168_1_1, "name-us-california-192.168.1.1.pem")
  293. n_us_az_email = copy.deepcopy(n_us_az)
  294. n_us_az_email.add_rdn().add_attr('emailAddress', 'IA5STRING',
  295. 'bar@example.com')
  296. generate(n_us_az_email, "name-us-arizona-email.pem")
  297. n_ca = generate_names.NameGenerator()
  298. n_ca.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'CA')
  299. generate(n_ca, "name-ca.pem")
  300. n_de = generate_names.NameGenerator()
  301. n_de.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'DE')
  302. generate(n_de, "name-de.pem")
  303. n_empty = generate_names.NameGenerator()
  304. generate(n_empty, "name-empty.pem")
  305. directoryname_constraints = NameConstraintsGenerator()
  306. directoryname_constraints.add_permitted(directory_name(n_us))
  307. directoryname_constraints.add_excluded(directory_name(n_us_ca))
  308. directoryname_constraints.add_permitted(directory_name(n_us_ca_mountain_view))
  309. directoryname_constraints.add_excluded(directory_name(n_de))
  310. directoryname_constraints.add_permitted(directory_name(n_jp_tokyo))
  311. generate(directoryname_constraints, "directoryname.pem")
  312. c = NameConstraintsGenerator()
  313. c.union_from(directoryname_constraints)
  314. c.union_from(dnsname_constraints)
  315. generate(c, "directoryname_and_dnsname.pem")
  316. c = NameConstraintsGenerator()
  317. c.union_from(directoryname_constraints)
  318. c.union_from(dnsname_constraints)
  319. c.union_from(ipaddress_constraints)
  320. generate(c, "directoryname_and_dnsname_and_ipaddress.pem")
  321. c = NameConstraintsGenerator()
  322. c.add_excluded(directory_name(n_us_ca))
  323. generate(c, "directoryname-excluded.pem")
  324. c = NameConstraintsGenerator()
  325. c.add_permitted(directory_name(n_us))
  326. c.add_excluded(directory_name(n_empty))
  327. generate(c, "directoryname-excludeall.pem")
  328. san = SubjectAltNameGenerator()
  329. san.add_name(dns_name("permitted.example.com"))
  330. san.add_name(ip_address((192,168,1,2)))
  331. san.add_name(directory_name(n_us_az))
  332. generate(san, "san-permitted.pem")
  333. san2 = copy.deepcopy(san)
  334. san2.add_name(
  335. dns_name("foo.stillnotpermitted.excluded.permitted.example.com"))
  336. generate(san2, "san-excluded-dnsname.pem")
  337. san2 = copy.deepcopy(san)
  338. san2.add_name(ip_address((192,168,5,5)))
  339. generate(san2, "san-excluded-ipaddress.pem")
  340. san2 = copy.deepcopy(san)
  341. san2.add_name(directory_name(n_us_ca_mountain_view))
  342. generate(san2, "san-excluded-directoryname.pem")
  343. san = SubjectAltNameGenerator()
  344. san.add_name(other_name())
  345. generate(san, "san-othername.pem")
  346. san = SubjectAltNameGenerator()
  347. san.add_name(rfc822_name("foo@example.com"))
  348. generate(san, "san-rfc822name.pem")
  349. san = SubjectAltNameGenerator()
  350. san.add_name(dns_name("foo.example.com"))
  351. generate(san, "san-dnsname.pem")
  352. san = SubjectAltNameGenerator()
  353. san.add_name(x400_address())
  354. generate(san, "san-x400address.pem")
  355. san = SubjectAltNameGenerator()
  356. san.add_name(directory_name(n_us))
  357. generate(san, "san-directoryname.pem")
  358. san = SubjectAltNameGenerator()
  359. san.add_name(uniform_resource_identifier('http://example.com'))
  360. generate(san, "san-uri.pem")
  361. san = SubjectAltNameGenerator()
  362. san.add_name(ip_address((192,168,6,7)))
  363. generate(san, "san-ipaddress4.pem")
  364. san = SubjectAltNameGenerator()
  365. san.add_name(ip_address((0xFE, 0x80, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12,
  366. 13, 14)))
  367. generate(san, "san-ipaddress6.pem")
  368. san = SubjectAltNameGenerator()
  369. san.add_name(registered_id("1.2.3.4"))
  370. generate(san, "san-registeredid.pem")
  371. san = SubjectAltNameGenerator()
  372. generate(san, "san-invalid-empty.pem")
  373. san = SubjectAltNameGenerator()
  374. san.add_name(ip_address((192,168,0,5,0), enforce_length=False))
  375. generate(san, "san-invalid-ipaddress.pem")
  376. c = NameConstraintsGenerator()
  377. c.add_permitted(other_name())
  378. generate(c, "othername-permitted.pem")
  379. c = NameConstraintsGenerator()
  380. c.add_excluded(other_name())
  381. generate(c, "othername-excluded.pem")
  382. c = NameConstraintsGenerator()
  383. c.add_permitted(rfc822_name("foo@example.com"))
  384. generate(c, "rfc822name-permitted.pem")
  385. c = NameConstraintsGenerator()
  386. c.add_excluded(rfc822_name("foo@example.com"))
  387. generate(c, "rfc822name-excluded.pem")
  388. c = NameConstraintsGenerator()
  389. c.add_permitted(x400_address())
  390. generate(c, "x400address-permitted.pem")
  391. c = NameConstraintsGenerator()
  392. c.add_excluded(x400_address())
  393. generate(c, "x400address-excluded.pem")
  394. c = NameConstraintsGenerator()
  395. c.add_permitted(edi_party_name())
  396. generate(c, "edipartyname-permitted.pem")
  397. c = NameConstraintsGenerator()
  398. c.add_excluded(edi_party_name())
  399. generate(c, "edipartyname-excluded.pem")
  400. c = NameConstraintsGenerator()
  401. c.add_permitted(uniform_resource_identifier("http://example.com"))
  402. generate(c, "uri-permitted.pem")
  403. c = NameConstraintsGenerator()
  404. c.add_excluded(uniform_resource_identifier("http://example.com"))
  405. generate(c, "uri-excluded.pem")
  406. c = NameConstraintsGenerator()
  407. c.add_permitted(registered_id("1.2.3.4"))
  408. generate(c, "registeredid-permitted.pem")
  409. c = NameConstraintsGenerator()
  410. c.add_excluded(registered_id("1.2.3.4"))
  411. generate(c, "registeredid-excluded.pem")
  412. c = NameConstraintsGenerator()
  413. generate(c, "invalid-no_subtrees.pem")
  414. c = NameConstraintsGenerator(force_permitted_sequence=True)
  415. generate(c, "invalid-empty_permitted_subtree.pem")
  416. c = NameConstraintsGenerator(force_excluded_sequence=True)
  417. generate(c, "invalid-empty_excluded_subtree.pem")
  418. c = NameConstraintsGenerator()
  419. c.add_permitted(with_min_max(dns_name("permitted.example.com"), minimum=0))
  420. generate(c, "dnsname-with_min_0.pem")
  421. c = NameConstraintsGenerator()
  422. c.add_permitted(with_min_max(dns_name("permitted.example.com"), minimum=1))
  423. generate(c, "dnsname-with_min_1.pem")
  424. c = NameConstraintsGenerator()
  425. c.add_permitted(with_min_max(
  426. dns_name("permitted.example.com"), minimum=0, maximum=2))
  427. generate(c, "dnsname-with_min_0_and_max.pem")
  428. c = NameConstraintsGenerator()
  429. c.add_permitted(with_min_max(
  430. dns_name("permitted.example.com"), minimum=1, maximum=2))
  431. generate(c, "dnsname-with_min_1_and_max.pem")
  432. c = NameConstraintsGenerator()
  433. c.add_permitted(with_min_max(dns_name("permitted.example.com"), maximum=2))
  434. generate(c, "dnsname-with_max.pem")
  435. if __name__ == '__main__':
  436. main()