mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-25 18:07:31 +09:00
Update NSS to 3.48 while keeping vc2013 hackfix and no-sslkeylogfile intact.
This commit is contained in:
Roy Tam
parent
0b9855b841
commit
171849c8e5
351 changed files with 115185 additions and 57946 deletions
|
|
@ -1,104 +1,20 @@
|
|||
#include <cstdlib>
|
||||
#if defined(_WIN32)
|
||||
#include <windows.h>
|
||||
#include <codecvt>
|
||||
#endif
|
||||
|
||||
#include "cert.h"
|
||||
#include "certdb.h"
|
||||
#include "nspr.h"
|
||||
#include "nss.h"
|
||||
#include "pk11pub.h"
|
||||
#include "secmod.h"
|
||||
#include "secerr.h"
|
||||
|
||||
#include "nss_scoped_ptrs.h"
|
||||
#include "util.h"
|
||||
|
||||
#define GTEST_HAS_RTTI 0
|
||||
#include "gtest/gtest.h"
|
||||
#include <fstream>
|
||||
|
||||
namespace nss_test {
|
||||
|
||||
// Given a prefix, attempts to create a unique directory that the user can do
|
||||
// work in without impacting other tests. For example, if given the prefix
|
||||
// "scratch", a directory like "scratch05c17b25" will be created in the current
|
||||
// working directory (or the location specified by NSS_GTEST_WORKDIR, if
|
||||
// defined).
|
||||
// Upon destruction, the implementation will attempt to delete the directory.
|
||||
// However, no attempt is made to first remove files in the directory - the
|
||||
// user is responsible for this. If the directory is not empty, deleting it will
|
||||
// fail.
|
||||
// Statistically, it is technically possible to fail to create a unique
|
||||
// directory name, but this is extremely unlikely given the expected workload of
|
||||
// this implementation.
|
||||
class ScopedUniqueDirectory {
|
||||
public:
|
||||
explicit ScopedUniqueDirectory(const std::string &prefix);
|
||||
|
||||
// NB: the directory must be empty upon destruction
|
||||
~ScopedUniqueDirectory() { assert(rmdir(mPath.c_str()) == 0); }
|
||||
|
||||
const std::string &GetPath() { return mPath; }
|
||||
const std::string &GetUTF8Path() { return mUTF8Path; }
|
||||
|
||||
private:
|
||||
static const int RETRY_LIMIT = 5;
|
||||
static void GenerateRandomName(/*in/out*/ std::string &prefix);
|
||||
static bool TryMakingDirectory(/*in/out*/ std::string &prefix);
|
||||
|
||||
std::string mPath;
|
||||
std::string mUTF8Path;
|
||||
};
|
||||
|
||||
ScopedUniqueDirectory::ScopedUniqueDirectory(const std::string &prefix) {
|
||||
std::string path;
|
||||
const char *workingDirectory = PR_GetEnvSecure("NSS_GTEST_WORKDIR");
|
||||
if (workingDirectory) {
|
||||
path.assign(workingDirectory);
|
||||
}
|
||||
path.append(prefix);
|
||||
for (int i = 0; i < RETRY_LIMIT; i++) {
|
||||
std::string pathCopy(path);
|
||||
// TryMakingDirectory will modify its input. If it fails, we want to throw
|
||||
// away the modified result.
|
||||
if (TryMakingDirectory(pathCopy)) {
|
||||
mPath.assign(pathCopy);
|
||||
break;
|
||||
}
|
||||
}
|
||||
assert(mPath.length() > 0);
|
||||
#if defined(_WIN32)
|
||||
// sqldb always uses UTF-8 regardless of the current system locale.
|
||||
DWORD len =
|
||||
MultiByteToWideChar(CP_ACP, 0, mPath.data(), mPath.size(), nullptr, 0);
|
||||
std::vector<wchar_t> buf(len, L'\0');
|
||||
MultiByteToWideChar(CP_ACP, 0, mPath.data(), mPath.size(), buf.data(),
|
||||
buf.size());
|
||||
std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
|
||||
mUTF8Path = converter.to_bytes(std::wstring(buf.begin(), buf.end()));
|
||||
#else
|
||||
mUTF8Path = mPath;
|
||||
#endif
|
||||
}
|
||||
|
||||
void ScopedUniqueDirectory::GenerateRandomName(std::string &prefix) {
|
||||
std::stringstream ss;
|
||||
ss << prefix;
|
||||
// RAND_MAX is at least 32767.
|
||||
ss << std::setfill('0') << std::setw(4) << std::hex << rand() << rand();
|
||||
// This will overwrite the value of prefix. This is a little inefficient, but
|
||||
// at least it makes the code simple.
|
||||
ss >> prefix;
|
||||
}
|
||||
|
||||
bool ScopedUniqueDirectory::TryMakingDirectory(std::string &prefix) {
|
||||
GenerateRandomName(prefix);
|
||||
#if defined(_WIN32)
|
||||
return _mkdir(prefix.c_str()) == 0;
|
||||
#else
|
||||
return mkdir(prefix.c_str(), 0777) == 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
class SoftokenTest : public ::testing::Test {
|
||||
protected:
|
||||
SoftokenTest() : mNSSDBDir("SoftokenTest.d-") {}
|
||||
|
|
@ -205,6 +121,27 @@ TEST_F(SoftokenTest, CreateObjectChangePassword) {
|
|||
EXPECT_EQ(nullptr, obj);
|
||||
}
|
||||
|
||||
// The size limit for a password is 500 characters as defined in pkcs11i.h
|
||||
TEST_F(SoftokenTest, CreateObjectChangeToBigPassword) {
|
||||
ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
|
||||
ASSERT_TRUE(slot);
|
||||
EXPECT_EQ(SECSuccess, PK11_InitPin(slot.get(), nullptr, nullptr));
|
||||
EXPECT_EQ(
|
||||
SECSuccess,
|
||||
PK11_ChangePW(slot.get(), "",
|
||||
"rUIFIFr2bxKnbJbitsfkyqttpk6vCJzlYMNxcxXcaN37gSZKbLk763X7iR"
|
||||
"yeVNWZHQ02lSF69HYjzTyPW3318ZD0DBFMMbALZ8ZPZP73CIo5uIQlaowV"
|
||||
"IbP8eOhRYtGUqoLGlcIFNEYogV8Q3GN58VeBMs0KxrIOvPQ9s8SnYYkqvt"
|
||||
"zzgntmAvCgvk64x6eQf0okHwegd5wi6m0WVJytEepWXkP9J629FSa5kNT8"
|
||||
"FvL3jvslkiImzTNuTvl32fQDXXMSc8vVk5Q3mH7trMZM0VDdwHWYERjHbz"
|
||||
"kGxFgp0VhediHx7p9kkz6H6ac4et9sW4UkTnN7xhYc1Zr17wRSk2heQtcX"
|
||||
"oZJGwuzhiKm8A8wkuVxms6zO56P4JORIk8oaUW6lyNTLo2kWWnTA"));
|
||||
EXPECT_EQ(SECSuccess, PK11_Logout(slot.get()));
|
||||
ScopedPK11GenericObject obj(PK11_CreateGenericObject(
|
||||
slot.get(), attributes, PR_ARRAY_SIZE(attributes), true));
|
||||
EXPECT_EQ(nullptr, obj);
|
||||
}
|
||||
|
||||
TEST_F(SoftokenTest, CreateObjectChangeToEmptyPassword) {
|
||||
ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
|
||||
ASSERT_TRUE(slot);
|
||||
|
|
@ -221,6 +158,76 @@ TEST_F(SoftokenTest, CreateObjectChangeToEmptyPassword) {
|
|||
EXPECT_NE(nullptr, obj);
|
||||
}
|
||||
|
||||
// We should be able to read CRLF, LF and CR.
|
||||
// During the Initialization of the NSS Database, is called a function to load
|
||||
// PKCS11 modules defined in pkcs11.txt. This file is read to get the
|
||||
// specifications, parse them and load the modules. Here we are ensuring that
|
||||
// the parsing will work correctly, independent of the breaking line format of
|
||||
// pkcs11.txt file, which could vary depending where it was created.
|
||||
// If the parsing is not well interpreted, the database cannot initialize.
|
||||
TEST_F(SoftokenTest, CreateObjectReadBreakLine) {
|
||||
const std::string path = mNSSDBDir.GetPath();
|
||||
const std::string dbname_in = path + "/pkcs11.txt";
|
||||
const std::string dbname_out_cr = path + "/pkcs11_cr.txt";
|
||||
const std::string dbname_out_crlf = path + "/pkcs11_crlf.txt";
|
||||
const std::string dbname_out_lf = path + "/pkcs11_lf.txt";
|
||||
|
||||
std::ifstream in(dbname_in);
|
||||
ASSERT_TRUE(in);
|
||||
std::ofstream out_cr(dbname_out_cr);
|
||||
ASSERT_TRUE(out_cr);
|
||||
std::ofstream out_crlf(dbname_out_crlf);
|
||||
ASSERT_TRUE(out_crlf);
|
||||
std::ofstream out_lf(dbname_out_lf);
|
||||
ASSERT_TRUE(out_lf);
|
||||
|
||||
// Database should be correctly initialized by Setup()
|
||||
ASSERT_TRUE(NSS_IsInitialized());
|
||||
ASSERT_EQ(SECSuccess, NSS_Shutdown());
|
||||
|
||||
// Prepare the file formats with CR, CRLF and LF
|
||||
for (std::string line; getline(in, line);) {
|
||||
out_cr << line << "\r";
|
||||
out_crlf << line << "\r\n";
|
||||
out_lf << line << "\n";
|
||||
}
|
||||
in.close();
|
||||
out_cr.close();
|
||||
out_crlf.close();
|
||||
out_lf.close();
|
||||
|
||||
// Change the pkcs11.txt to CR format.
|
||||
ASSERT_TRUE(!remove(dbname_in.c_str()));
|
||||
ASSERT_TRUE(!rename(dbname_out_cr.c_str(), dbname_in.c_str()));
|
||||
|
||||
// Try to initialize with CR format.
|
||||
std::string nssInitArg("sql:");
|
||||
nssInitArg.append(mNSSDBDir.GetUTF8Path());
|
||||
ASSERT_EQ(SECSuccess, NSS_Initialize(nssInitArg.c_str(), "", "", SECMOD_DB,
|
||||
NSS_INIT_NOROOTINIT));
|
||||
ASSERT_TRUE(NSS_IsInitialized());
|
||||
ASSERT_EQ(SECSuccess, NSS_Shutdown());
|
||||
|
||||
// Change the pkcs11.txt to CRLF format.
|
||||
ASSERT_TRUE(!remove(dbname_in.c_str()));
|
||||
ASSERT_TRUE(!rename(dbname_out_crlf.c_str(), dbname_in.c_str()));
|
||||
|
||||
// Try to initialize with CRLF format.
|
||||
ASSERT_EQ(SECSuccess, NSS_Initialize(nssInitArg.c_str(), "", "", SECMOD_DB,
|
||||
NSS_INIT_NOROOTINIT));
|
||||
ASSERT_TRUE(NSS_IsInitialized());
|
||||
ASSERT_EQ(SECSuccess, NSS_Shutdown());
|
||||
|
||||
// Change the pkcs11.txt to LF format.
|
||||
ASSERT_TRUE(!remove(dbname_in.c_str()));
|
||||
ASSERT_TRUE(!rename(dbname_out_lf.c_str(), dbname_in.c_str()));
|
||||
|
||||
// Try to initialize with LF format.
|
||||
ASSERT_EQ(SECSuccess, NSS_Initialize(nssInitArg.c_str(), "", "", SECMOD_DB,
|
||||
NSS_INIT_NOROOTINIT));
|
||||
ASSERT_TRUE(NSS_IsInitialized());
|
||||
}
|
||||
|
||||
class SoftokenNonAsciiTest : public SoftokenTest {
|
||||
protected:
|
||||
SoftokenNonAsciiTest() : SoftokenTest("SoftokenTest.\xF7-") {}
|
||||
|
|
@ -351,6 +358,100 @@ TEST_F(SoftokenNoDBTest, NeedUserInitNoDB) {
|
|||
ASSERT_EQ(SECSuccess, NSS_Shutdown());
|
||||
}
|
||||
|
||||
#ifndef NSS_FIPS_DISABLED
|
||||
|
||||
class SoftokenFipsTest : public SoftokenTest {
|
||||
protected:
|
||||
SoftokenFipsTest() : SoftokenTest("SoftokenFipsTest.d-") {}
|
||||
|
||||
virtual void SetUp() {
|
||||
SoftokenTest::SetUp();
|
||||
|
||||
// Turn on FIPS mode (code borrowed from FipsMode in modutil/pk11.c)
|
||||
char *internal_name;
|
||||
ASSERT_FALSE(PK11_IsFIPS());
|
||||
internal_name = PR_smprintf("%s", SECMOD_GetInternalModule()->commonName);
|
||||
ASSERT_EQ(SECSuccess, SECMOD_DeleteInternalModule(internal_name));
|
||||
PR_smprintf_free(internal_name);
|
||||
ASSERT_TRUE(PK11_IsFIPS());
|
||||
}
|
||||
};
|
||||
|
||||
const std::vector<std::string> kFipsPasswordCases[] = {
|
||||
// FIPS level1 -> level1 -> level1
|
||||
{"", "", ""},
|
||||
// FIPS level1 -> level1 -> level2
|
||||
{"", "", "strong-_123"},
|
||||
// FIXME: this should work: FIPS level1 -> level2 -> level2
|
||||
// {"", "strong-_123", "strong-_456"},
|
||||
// FIPS level2 -> level2 -> level2
|
||||
{"strong-_123", "strong-_456", "strong-_123"}};
|
||||
|
||||
const std::vector<std::string> kFipsPasswordBadCases[] = {
|
||||
// FIPS level1 -> level2 -> level1
|
||||
{"", "strong-_123", ""},
|
||||
// FIPS level2 -> level1 -> level1
|
||||
{"strong-_123", ""},
|
||||
// FIPS level2 -> level2 -> level1
|
||||
{"strong-_123", "strong-_456", ""},
|
||||
// initialize with a weak password
|
||||
{"weak"},
|
||||
// FIPS level1 -> weak password
|
||||
{"", "weak"},
|
||||
// FIPS level2 -> weak password
|
||||
{"strong-_123", "weak"}};
|
||||
|
||||
class SoftokenFipsPasswordTest
|
||||
: public SoftokenFipsTest,
|
||||
public ::testing::WithParamInterface<std::vector<std::string>> {};
|
||||
|
||||
class SoftokenFipsBadPasswordTest
|
||||
: public SoftokenFipsTest,
|
||||
public ::testing::WithParamInterface<std::vector<std::string>> {};
|
||||
|
||||
TEST_P(SoftokenFipsPasswordTest, SetPassword) {
|
||||
const std::vector<std::string> &passwords = GetParam();
|
||||
ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
|
||||
ASSERT_TRUE(slot);
|
||||
|
||||
auto it = passwords.begin();
|
||||
auto prev_it = it;
|
||||
EXPECT_EQ(SECSuccess, PK11_InitPin(slot.get(), nullptr, (*it).c_str()));
|
||||
for (it++; it != passwords.end(); it++, prev_it++) {
|
||||
EXPECT_EQ(SECSuccess,
|
||||
PK11_ChangePW(slot.get(), (*prev_it).c_str(), (*it).c_str()));
|
||||
}
|
||||
}
|
||||
|
||||
TEST_P(SoftokenFipsBadPasswordTest, SetBadPassword) {
|
||||
const std::vector<std::string> &passwords = GetParam();
|
||||
ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
|
||||
ASSERT_TRUE(slot);
|
||||
|
||||
auto it = passwords.begin();
|
||||
auto prev_it = it;
|
||||
SECStatus rv = PK11_InitPin(slot.get(), nullptr, (*it).c_str());
|
||||
if (it + 1 == passwords.end())
|
||||
EXPECT_EQ(SECFailure, rv);
|
||||
else
|
||||
EXPECT_EQ(SECSuccess, rv);
|
||||
for (it++; it != passwords.end(); it++, prev_it++) {
|
||||
rv = PK11_ChangePW(slot.get(), (*prev_it).c_str(), (*it).c_str());
|
||||
if (it + 1 == passwords.end())
|
||||
EXPECT_EQ(SECFailure, rv);
|
||||
else
|
||||
EXPECT_EQ(SECSuccess, rv);
|
||||
}
|
||||
}
|
||||
|
||||
INSTANTIATE_TEST_CASE_P(FipsPasswordCases, SoftokenFipsPasswordTest,
|
||||
::testing::ValuesIn(kFipsPasswordCases));
|
||||
|
||||
INSTANTIATE_TEST_CASE_P(BadFipsPasswordCases, SoftokenFipsBadPasswordTest,
|
||||
::testing::ValuesIn(kFipsPasswordBadCases));
|
||||
|
||||
#endif
|
||||
|
||||
} // namespace nss_test
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue