| #!/usr/bin/env python |
| # Copyright 2015 The Chromium Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| import base64 |
| import copy |
| import os |
| import random |
| import subprocess |
| import sys |
| import tempfile |
| |
| sys.path += [os.path.join('..', 'verify_name_match_unittest', 'scripts')] |
| |
| import generate_names |
| |
| |
| def generate(s, out_fn): |
| conf_tempfile = tempfile.NamedTemporaryFile() |
| conf_tempfile.write(str(s)) |
| conf_tempfile.flush() |
| der_tmpfile = tempfile.NamedTemporaryFile() |
| description_tmpfile = tempfile.NamedTemporaryFile() |
| subprocess.check_call(['openssl', 'asn1parse', '-genconf', conf_tempfile.name, |
| '-i', '-out', der_tmpfile.name], |
| stdout=description_tmpfile) |
| conf_tempfile.close() |
| |
| output_file = open(out_fn, 'w') |
| description_tmpfile.seek(0) |
| output_file.write(description_tmpfile.read()) |
| output_file.write('-----BEGIN %s-----\n' % s.token()) |
| output_file.write(base64.encodestring(der_tmpfile.read())) |
| output_file.write('-----END %s-----\n' % s.token()) |
| output_file.close() |
| |
| |
| class SubjectAltNameGenerator: |
| def __init__(self): |
| self.names = [] |
| |
| def token(self): |
| return "SUBJECT ALTERNATIVE NAME" |
| |
| def add_name(self, general_name): |
| self.names.append(general_name) |
| |
| def __str__(self): |
| s = "asn1 = SEQUENCE:subjectAltNameSequence\n" |
| s += "[subjectAltNameSequence]\n" |
| s_suffix = "" |
| for n, name in enumerate(self.names): |
| n1, n2 = (str(name) + '\n').split('\n', 1) |
| if n2: |
| s_suffix += n2 + '\n' |
| s += '%s%s\n' % (n, n1) |
| |
| return s + s_suffix |
| |
| |
| class NameConstraintsGenerator: |
| def __init__(self, |
| force_permitted_sequence=False, |
| force_excluded_sequence=False): |
| self.permitted = [] |
| self.excluded = [] |
| self.force_permitted_sequence = force_permitted_sequence |
| self.force_excluded_sequence = force_excluded_sequence |
| |
| def token(self): |
| return "NAME CONSTRAINTS" |
| |
| def union_from(self, c): |
| self.permitted.extend(c.permitted) |
| self.excluded.extend(c.excluded) |
| |
| def add_permitted(self, general_name): |
| self.permitted.append(general_name) |
| |
| def add_excluded(self, general_name): |
| self.excluded.append(general_name) |
| |
| def __str__(self): |
| s = "asn1 = SEQUENCE:nameConstraintsSequence\n[nameConstraintsSequence]\n" |
| |
| if self.permitted or self.force_permitted_sequence: |
| s += "permittedSubtrees = IMPLICIT:0,SEQUENCE:permittedSubtreesSequence\n" |
| if self.excluded or self.force_excluded_sequence: |
| s += "excludedSubtrees = IMPLICIT:1,SEQUENCE:excludedSubtreesSequence\n" |
| |
| if self.permitted or self.force_permitted_sequence: |
| s += "[permittedSubtreesSequence]\n" |
| for n, subtree in enumerate(self.permitted): |
| s += 'subtree%i = SEQUENCE:permittedSubtree%i\n' % (n, n) |
| |
| if self.excluded or self.force_excluded_sequence: |
| s += "[excludedSubtreesSequence]\n" |
| for n, subtree in enumerate(self.excluded): |
| s += 'subtree%i = SEQUENCE:excludedSubtree%i\n' % (n, n) |
| |
| for n, subtree in enumerate(self.permitted): |
| s += '[permittedSubtree%i]\n%s\n' % (n, subtree) |
| |
| for n, subtree in enumerate(self.excluded): |
| s += '[excludedSubtree%i]\n%s\n' % (n, subtree) |
| |
| return s |
| |
| |
| def other_name(): |
| i = random.randint(0, sys.maxint) |
| s = 'otherName = IMPLICIT:0,SEQUENCE:otherNameSequence%i\n' % i |
| s += '[otherNameSequence%i]\n' % i |
| s += 'type_id = OID:1.2.3.4.5\n' |
| s += 'value = FORMAT:HEX,OCTETSTRING:DEADBEEF\n' |
| return s |
| |
| |
| def rfc822_name(name): |
| return 'rfc822Name = IMPLICIT:1,IA5STRING:' + name |
| |
| |
| def dns_name(name): |
| return 'dNSName = IMPLICIT:2,IA5STRING:' + name |
| |
| |
| def x400_address(): |
| i = random.randint(0, sys.maxint) |
| s = 'x400Address = IMPLICIT:3,SEQUENCE:x400AddressSequence%i\n' % i |
| s += '[x400AddressSequence%i]\n' % i |
| s += 'builtinstandardattributes = SEQUENCE:BuiltInStandardAttributes%i\n' % i |
| s += '[BuiltInStandardAttributes%i]\n' % i |
| s += 'countryname = EXPLICIT:1A,PRINTABLESTRING:US\n' |
| return s |
| |
| |
| def directory_name(name): |
| return str(name).replace( |
| 'asn1 = SEQUENCE', 'directoryName = EXPLICIT:4,SEQUENCE') |
| |
| |
| def edi_party_name(): |
| i = random.randint(0, sys.maxint) |
| s = 'ediPartyName = IMPLICIT:5,SEQUENCE:ediPartyNameSequence%i\n' % i |
| s += '[ediPartyNameSequence%i]\n' % i |
| s += 'partyName = IMPLICIT:1,UTF8:foo\n' |
| return s |
| |
| |
| def uniform_resource_identifier(name): |
| return 'uniformResourceIdentifier = IMPLICIT:6,IA5STRING:' + name |
| |
| |
| def ip_address(addr, enforce_length=True): |
| if enforce_length: |
| assert len(addr) in (4,16) |
| addr_str = "" |
| for addr_byte in addr: |
| addr_str += '%02X'%(addr_byte) |
| return 'iPAddress = IMPLICIT:7,FORMAT:HEX,OCTETSTRING:' + addr_str |
| |
| |
| def ip_address_range(addr, netmask, enforce_length=True): |
| if enforce_length: |
| assert len(addr) == len(netmask) |
| assert len(addr) in (4,16) |
| addr_str = "" |
| netmask_str = "" |
| for addr_byte, mask_byte in map(None, addr, netmask): |
| assert (addr_byte & ~mask_byte) == 0 |
| addr_str += '%02X'%(addr_byte) |
| netmask_str += '%02X'%(mask_byte) |
| return ('iPAddress = IMPLICIT:7,FORMAT:HEX,OCTETSTRING:' + addr_str + |
| netmask_str) |
| |
| |
| def registered_id(oid): |
| return 'registeredID = IMPLICIT:8,OID:' + oid |
| |
| |
| def with_min_max(val, minimum=None, maximum=None): |
| s = val |
| s += '\n' |
| assert '\n[' not in s |
| if minimum is not None: |
| s += 'minimum = IMPLICIT:0,INTEGER:%i\n' % minimum |
| if maximum is not None: |
| s += 'maximum = IMPLICIT:1,INTEGER:%i\n' % maximum |
| return s |
| |
| |
| def main(): |
| dnsname_constraints = NameConstraintsGenerator() |
| dnsname_constraints.add_permitted(dns_name("permitted.example.com")) |
| dnsname_constraints.add_permitted(dns_name("permitted.example2.com")) |
| dnsname_constraints.add_permitted(dns_name("permitted.example3.com.")) |
| dnsname_constraints.add_permitted(dns_name("alsopermitted.example.com")) |
| dnsname_constraints.add_excluded(dns_name("excluded.permitted.example.com")) |
| dnsname_constraints.add_permitted( |
| dns_name("stillnotpermitted.excluded.permitted.example.com")) |
| dnsname_constraints.add_excluded(dns_name("extraneousexclusion.example.com")) |
| generate(dnsname_constraints, "dnsname.pem") |
| |
| dnsname_constraints2 = NameConstraintsGenerator() |
| dnsname_constraints2.add_permitted(dns_name("com")) |
| dnsname_constraints2.add_excluded(dns_name("foo.bar.com")) |
| generate(dnsname_constraints2, "dnsname2.pem") |
| |
| dnsname_constraints3 = NameConstraintsGenerator() |
| dnsname_constraints3.add_permitted(dns_name(".bar.com")) |
| generate(dnsname_constraints3, "dnsname-permitted_with_leading_dot.pem") |
| |
| dnsname_constraints4 = NameConstraintsGenerator() |
| dnsname_constraints4.add_excluded(dns_name(".bar.com")) |
| generate(dnsname_constraints4, "dnsname-excluded_with_leading_dot.pem") |
| |
| dnsname_constraints5 = NameConstraintsGenerator() |
| dnsname_constraints5.add_permitted(dns_name("..")) |
| generate(dnsname_constraints5, "dnsname-permitted_two_dot.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_excluded(dns_name("excluded.permitted.example.com")) |
| generate(c, "dnsname-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(dns_name("permitted.example.com")) |
| c.add_excluded(dns_name("")) |
| generate(c, "dnsname-excludeall.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(dns_name("permitted.example.com")) |
| c.add_excluded(dns_name(".")) |
| generate(c, "dnsname-exclude_dot.pem") |
| |
| ipaddress_constraints = NameConstraintsGenerator() |
| ipaddress_constraints.add_permitted( |
| ip_address_range((192,168,0,0),(255,255,0,0))) |
| ipaddress_constraints.add_excluded( |
| ip_address_range((192,168,5,0),(255,255,255,0))) |
| ipaddress_constraints.add_permitted( |
| ip_address_range((192,168,5,32),(255,255,255,224))) |
| ipaddress_constraints.add_permitted( |
| ip_address_range((192,167,5,32),(255,255,255,224))) |
| ipaddress_constraints.add_excluded( |
| ip_address_range((192,166,5,32),(255,255,255,224))) |
| ipaddress_constraints.add_permitted(ip_address_range( |
| (1,2,3,4,5,6,7,8,9,10,11,12,0,0,0,0), |
| (255,255,255,255,255,255,255,255,255,255,255,255,0,0,0,0))) |
| ipaddress_constraints.add_excluded(ip_address_range( |
| (1,2,3,4,5,6,7,8,9,10,11,12,5,0,0,0), |
| (255,255,255,255,255,255,255,255,255,255,255,255,255,0,0,0))) |
| ipaddress_constraints.add_permitted(ip_address_range( |
| (1,2,3,4,5,6,7,8,9,10,11,12,5,32,0,0), |
| (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0))) |
| ipaddress_constraints.add_permitted(ip_address_range( |
| (1,2,3,4,5,6,7,8,9,10,11,11,5,32,0,0), |
| (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0))) |
| ipaddress_constraints.add_excluded(ip_address_range( |
| (1,2,3,4,5,6,7,8,9,10,11,10,5,32,0,0), |
| (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0))) |
| generate(ipaddress_constraints, "ipaddress.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((192,168,1,3),(255,255,255,255))) |
| generate(c, "ipaddress-permit_singlehost.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((0,0,0,0),(0,0,0,0))) |
| generate(c, "ipaddress-permit_all.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((0x80,0,0,0),(0x80,0,0,0))) |
| generate(c, "ipaddress-permit_prefix1.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((192,168,1,2),(255,255,255,254))) |
| generate(c, "ipaddress-permit_prefix31.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((192,168,1,0),(255,255,255,253))) |
| generate(c, "ipaddress-invalid_mask_not_contiguous_1.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((192,168,0,0),(255,253,0,0))) |
| generate(c, "ipaddress-invalid_mask_not_contiguous_2.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((0,0,0,0),(0x40,0,0,0))) |
| generate(c, "ipaddress-invalid_mask_not_contiguous_3.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((192,0,0,0),(0xFF,0,0xFF,0))) |
| generate(c, "ipaddress-invalid_mask_not_contiguous_4.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_excluded(ip_address_range((192,168,5,0),(255,255,255,0))) |
| generate(c, "ipaddress-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((192,168,0,0),(255,255,0,0))) |
| c.add_permitted(ip_address_range((1,2,3,4,5,6,7,8,9,10,11,12,0,0,0,0), |
| (255,255,255,255,255,255,255,255, |
| 255,255,255,255,0,0,0,0))) |
| c.add_excluded(ip_address_range((0,0,0,0),(0,0,0,0))) |
| c.add_excluded(ip_address_range((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0), |
| (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0))) |
| generate(c, "ipaddress-excludeall.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(ip_address_range((192,168,0,0),(255,255,255,0))) |
| c.add_permitted(ip_address_range((192,168,5,0,0),(255,255,255,0,0), |
| enforce_length=False)) |
| generate(c, "ipaddress-invalid_addr.pem") |
| |
| n_us = generate_names.NameGenerator() |
| n_us.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'US') |
| generate(n_us, "name-us.pem") |
| n_us_az = copy.deepcopy(n_us) |
| n_us_az.add_rdn().add_attr('stateOrProvinceName', 'UTF8', 'Arizona') |
| generate(n_us_az, "name-us-arizona.pem") |
| n_us_ca = copy.deepcopy(n_us) |
| n_us_ca.add_rdn().add_attr('stateOrProvinceName', 'UTF8', 'California') |
| generate(n_us_ca, "name-us-california.pem") |
| n_us_ca_mountain_view = copy.deepcopy(n_us_ca) |
| n_us_ca_mountain_view.add_rdn().add_attr( |
| 'localityName', 'UTF8', 'Mountain View') |
| generate(n_us_ca_mountain_view, "name-us-california-mountain_view.pem") |
| |
| n_jp = generate_names.NameGenerator() |
| n_jp.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'JP') |
| generate(n_jp, "name-jp.pem") |
| n_jp_tokyo = copy.deepcopy(n_jp) |
| n_jp_tokyo.add_rdn().add_attr( |
| 'stateOrProvinceName', 'UTF8', '\xe6\x9d\xb1\xe4\xba\xac', 'FORMAT:UTF8') |
| generate(n_jp_tokyo, "name-jp-tokyo.pem") |
| |
| n_us_az_foodotcom = copy.deepcopy(n_us_az) |
| n_us_az_foodotcom.add_rdn().add_attr('commonName', 'UTF8', 'foo.com') |
| generate(n_us_az_foodotcom, "name-us-arizona-foo.com.pem") |
| |
| n_us_az_permittedexamplecom = copy.deepcopy(n_us_az) |
| n_us_az_permittedexamplecom.add_rdn().add_attr('commonName', 'UTF8', |
| 'permitted.example.com') |
| generate(n_us_az_permittedexamplecom, |
| "name-us-arizona-permitted.example.com.pem") |
| |
| n_us_ca_permittedexamplecom = copy.deepcopy(n_us_ca) |
| n_us_ca_permittedexamplecom.add_rdn().add_attr('commonName', 'UTF8', |
| 'permitted.example.com') |
| generate(n_us_ca_permittedexamplecom, |
| "name-us-california-permitted.example.com.pem") |
| |
| n_us_az_ip1111 = copy.deepcopy(n_us_az) |
| n_us_az_ip1111.add_rdn().add_attr('commonName', 'UTF8', '1.1.1.1') |
| generate(n_us_az_ip1111, "name-us-arizona-1.1.1.1.pem") |
| |
| n_us_az_192_168_1_1 = copy.deepcopy(n_us_az) |
| n_us_az_192_168_1_1.add_rdn().add_attr('commonName', 'UTF8', '192.168.1.1') |
| generate(n_us_az_192_168_1_1, "name-us-arizona-192.168.1.1.pem") |
| |
| n_us_az_ipv6 = copy.deepcopy(n_us_az) |
| n_us_az_ipv6.add_rdn().add_attr('commonName', 'UTF8', |
| '102:304:506:708:90a:b0c::1') |
| generate(n_us_az_ipv6, "name-us-arizona-ipv6.pem") |
| |
| n_us_ca_192_168_1_1 = copy.deepcopy(n_us_ca) |
| n_us_ca_192_168_1_1.add_rdn().add_attr('commonName', 'UTF8', '192.168.1.1') |
| generate(n_us_ca_192_168_1_1, "name-us-california-192.168.1.1.pem") |
| |
| n_us_az_email = copy.deepcopy(n_us_az) |
| n_us_az_email.add_rdn().add_attr('emailAddress', 'IA5STRING', |
| 'bar@example.com') |
| generate(n_us_az_email, "name-us-arizona-email.pem") |
| |
| n_ca = generate_names.NameGenerator() |
| n_ca.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'CA') |
| generate(n_ca, "name-ca.pem") |
| |
| n_de = generate_names.NameGenerator() |
| n_de.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'DE') |
| generate(n_de, "name-de.pem") |
| |
| n_empty = generate_names.NameGenerator() |
| generate(n_empty, "name-empty.pem") |
| |
| |
| directoryname_constraints = NameConstraintsGenerator() |
| directoryname_constraints.add_permitted(directory_name(n_us)) |
| directoryname_constraints.add_excluded(directory_name(n_us_ca)) |
| directoryname_constraints.add_permitted(directory_name(n_us_ca_mountain_view)) |
| directoryname_constraints.add_excluded(directory_name(n_de)) |
| directoryname_constraints.add_permitted(directory_name(n_jp_tokyo)) |
| generate(directoryname_constraints, "directoryname.pem") |
| |
| c = NameConstraintsGenerator() |
| c.union_from(directoryname_constraints) |
| c.union_from(dnsname_constraints) |
| generate(c, "directoryname_and_dnsname.pem") |
| |
| c = NameConstraintsGenerator() |
| c.union_from(directoryname_constraints) |
| c.union_from(dnsname_constraints) |
| c.union_from(ipaddress_constraints) |
| generate(c, "directoryname_and_dnsname_and_ipaddress.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_excluded(directory_name(n_us_ca)) |
| generate(c, "directoryname-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(directory_name(n_us)) |
| c.add_excluded(directory_name(n_empty)) |
| generate(c, "directoryname-excludeall.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(dns_name("permitted.example.com")) |
| san.add_name(ip_address((192,168,1,2))) |
| san.add_name(directory_name(n_us_az)) |
| generate(san, "san-permitted.pem") |
| |
| san2 = copy.deepcopy(san) |
| san2.add_name( |
| dns_name("foo.stillnotpermitted.excluded.permitted.example.com")) |
| generate(san2, "san-excluded-dnsname.pem") |
| |
| san2 = copy.deepcopy(san) |
| san2.add_name(ip_address((192,168,5,5))) |
| generate(san2, "san-excluded-ipaddress.pem") |
| |
| san2 = copy.deepcopy(san) |
| san2.add_name(directory_name(n_us_ca_mountain_view)) |
| generate(san2, "san-excluded-directoryname.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(other_name()) |
| generate(san, "san-othername.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(rfc822_name("foo@example.com")) |
| generate(san, "san-rfc822name.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(dns_name("foo.example.com")) |
| generate(san, "san-dnsname.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(x400_address()) |
| generate(san, "san-x400address.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(directory_name(n_us)) |
| generate(san, "san-directoryname.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(uniform_resource_identifier('http://example.com')) |
| generate(san, "san-uri.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(ip_address((192,168,6,7))) |
| generate(san, "san-ipaddress4.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(ip_address((0xFE, 0x80, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, |
| 13, 14))) |
| generate(san, "san-ipaddress6.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(registered_id("1.2.3.4")) |
| generate(san, "san-registeredid.pem") |
| |
| san = SubjectAltNameGenerator() |
| generate(san, "san-invalid-empty.pem") |
| |
| san = SubjectAltNameGenerator() |
| san.add_name(ip_address((192,168,0,5,0), enforce_length=False)) |
| generate(san, "san-invalid-ipaddress.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(other_name()) |
| generate(c, "othername-permitted.pem") |
| c = NameConstraintsGenerator() |
| c.add_excluded(other_name()) |
| generate(c, "othername-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(rfc822_name("foo@example.com")) |
| generate(c, "rfc822name-permitted.pem") |
| c = NameConstraintsGenerator() |
| c.add_excluded(rfc822_name("foo@example.com")) |
| generate(c, "rfc822name-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(x400_address()) |
| generate(c, "x400address-permitted.pem") |
| c = NameConstraintsGenerator() |
| c.add_excluded(x400_address()) |
| generate(c, "x400address-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(edi_party_name()) |
| generate(c, "edipartyname-permitted.pem") |
| c = NameConstraintsGenerator() |
| c.add_excluded(edi_party_name()) |
| generate(c, "edipartyname-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(uniform_resource_identifier("http://example.com")) |
| generate(c, "uri-permitted.pem") |
| c = NameConstraintsGenerator() |
| c.add_excluded(uniform_resource_identifier("http://example.com")) |
| generate(c, "uri-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(registered_id("1.2.3.4")) |
| generate(c, "registeredid-permitted.pem") |
| c = NameConstraintsGenerator() |
| c.add_excluded(registered_id("1.2.3.4")) |
| generate(c, "registeredid-excluded.pem") |
| |
| c = NameConstraintsGenerator() |
| generate(c, "invalid-no_subtrees.pem") |
| |
| c = NameConstraintsGenerator(force_permitted_sequence=True) |
| generate(c, "invalid-empty_permitted_subtree.pem") |
| |
| c = NameConstraintsGenerator(force_excluded_sequence=True) |
| generate(c, "invalid-empty_excluded_subtree.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(with_min_max(dns_name("permitted.example.com"), minimum=0)) |
| generate(c, "dnsname-with_min_0.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(with_min_max(dns_name("permitted.example.com"), minimum=1)) |
| generate(c, "dnsname-with_min_1.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(with_min_max( |
| dns_name("permitted.example.com"), minimum=0, maximum=2)) |
| generate(c, "dnsname-with_min_0_and_max.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(with_min_max( |
| dns_name("permitted.example.com"), minimum=1, maximum=2)) |
| generate(c, "dnsname-with_min_1_and_max.pem") |
| |
| c = NameConstraintsGenerator() |
| c.add_permitted(with_min_max(dns_name("permitted.example.com"), maximum=2)) |
| generate(c, "dnsname-with_max.pem") |
| |
| |
| if __name__ == '__main__': |
| main() |
