wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-24 09:27:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

[NSS] ported mozilla upstream changes:

Browse source 
- Bug 1552254 internal_error alert on Certificate Request with sha1+ecdsa in TLS 1.3 (be6a9782)
- Bug 1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate. r=rrelyea (800111fa)
- Bug 1756271 - Remove token member from NSSSlot struct. r=rrelyea (55052f78)
- Bug 1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun. r=nss-reviewers,jschanck (2f2c8564)
- Bug 1755264 - TLS 1.3 Illegal legacy_version handling/alerts. r=djackson (7d931c59)
- Bug 1751305 - Remove expired explicitly distrusted certificates from certdata.txt. r=KathleenWilson (b722e523)
- Bug 1751298 - Add Telia Root CA v2 root certificate. r=KathleenWilson (1fcbbd7e)
- Bug 1754890 - Add two D-TRUST 2020 root certificates. r=KathleenWilson (f63fb86d)
This commit is contained in:
roytam1 2022-03-25 23:38:11 +08:00
commit 3336114a36
37 changed files with 1556 additions and 671 deletions
Download patch file Download diff file Expand all files Collapse all files

120
security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc
View file

@ -268,6 +268,126 @@ static SECStatus GetClientAuthDataHook(void* self, PRFileDesc* fd,
return SECSuccess;
}
typedef struct AutoClientTestStr {
SECStatus result;
const std::string cert;
} AutoClientTest;
typedef struct AutoClientResultsStr {
AutoClientTest isRsa2048;
AutoClientTest isClient;
AutoClientTest isNull;
bool hookCalled;
} AutoClientResults;
void VerifyClientCertMatch(CERTCertificate* clientCert,
const std::string expectedName) {
const char* name = clientCert->nickname;
std::cout << "Match name=\"" << name << "\" expected=\"" << expectedName
<< "\"" << std::endl;
EXPECT_TRUE(PORT_Strcmp(name, expectedName.c_str()) == 0)
<< " Certmismatch: \"" << name << "\" != \"" << expectedName << "\"";
}
static SECStatus GetAutoClientAuthDataHook(void* expectResults, PRFileDesc* fd,
CERTDistNames* caNames,
CERTCertificate** clientCert,
SECKEYPrivateKey** clientKey) {
AutoClientResults& results = *(AutoClientResults*)expectResults;
SECStatus rv;
results.hookCalled = true;
*clientCert = NULL;
*clientKey = NULL;
rv = NSS_GetClientAuthData((void*)TlsAgent::kRsa2048.c_str(), fd, caNames,
clientCert, clientKey);
if (rv == SECSuccess) {
VerifyClientCertMatch(*clientCert, results.isRsa2048.cert);
CERT_DestroyCertificate(*clientCert);
SECKEY_DestroyPrivateKey(*clientKey);
*clientCert = NULL;
*clientKey = NULL;
}
EXPECT_EQ(results.isRsa2048.result, rv);
rv = NSS_GetClientAuthData((void*)TlsAgent::kClient.c_str(), fd, caNames,
clientCert, clientKey);
if (rv == SECSuccess) {
VerifyClientCertMatch(*clientCert, results.isClient.cert);
CERT_DestroyCertificate(*clientCert);
SECKEY_DestroyPrivateKey(*clientKey);
*clientCert = NULL;
*clientKey = NULL;
}
EXPECT_EQ(results.isClient.result, rv);
EXPECT_EQ(*clientCert, nullptr);
EXPECT_EQ(*clientKey, nullptr);
rv = NSS_GetClientAuthData(NULL, fd, caNames, clientCert, clientKey);
if (rv == SECSuccess) {
VerifyClientCertMatch(*clientCert, results.isNull.cert);
// return this result
}
EXPECT_EQ(results.isNull.result, rv);
return rv;
}
// while I would have liked to use a new INSTANTIATE macro the
// generates the following three tests, figuring out how to make that
// work on top of the existing TlsConnect* plumbing hurts my head.
TEST_P(TlsConnectTls12, AutoClientSelectRsaPss) {
AutoClientResults rsa = {{SECSuccess, TlsAgent::kRsa2048},
{SECSuccess, TlsAgent::kClient},
{SECSuccess, TlsAgent::kDelegatorRsaPss2048},
false};
static const SSLSignatureScheme kSchemes[] = {ssl_sig_rsa_pss_pss_sha256,
ssl_sig_rsa_pkcs1_sha256,
ssl_sig_rsa_pkcs1_sha1};
Reset("rsa_pss_noparam");
client_->SetupClientAuth();
server_->RequestClientAuth(true);
EXPECT_EQ(SECSuccess,
SSL_GetClientAuthDataHook(client_->ssl_fd(),
GetAutoClientAuthDataHook, (void*)&rsa));
server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
Connect();
EXPECT_TRUE(rsa.hookCalled);
}
TEST_P(TlsConnectTls12, AutoClientSelectEcc) {
AutoClientResults ecc = {{SECFailure, TlsAgent::kClient},
{SECFailure, TlsAgent::kClient},
{SECSuccess, TlsAgent::kDelegatorEcdsa256},
false};
static const SSLSignatureScheme kSchemes[] = {ssl_sig_ecdsa_secp256r1_sha256};
client_->SetupClientAuth();
server_->RequestClientAuth(true);
EXPECT_EQ(SECSuccess,
SSL_GetClientAuthDataHook(client_->ssl_fd(),
GetAutoClientAuthDataHook, (void*)&ecc));
server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
Connect();
EXPECT_TRUE(ecc.hookCalled);
}
TEST_P(TlsConnectTls12, AutoClientSelectDsa) {
AutoClientResults dsa = {{SECFailure, TlsAgent::kClient},
{SECFailure, TlsAgent::kClient},
{SECSuccess, TlsAgent::kServerDsa},
false};
static const SSLSignatureScheme kSchemes[] = {ssl_sig_dsa_sha256};
client_->SetupClientAuth();
server_->RequestClientAuth(true);
EXPECT_EQ(SECSuccess,
SSL_GetClientAuthDataHook(client_->ssl_fd(),
GetAutoClientAuthDataHook, (void*)&dsa));
server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
Connect();
EXPECT_TRUE(dsa.hookCalled);
}
TEST_F(TlsConnectStreamTls13, PostHandshakeAuthMultiple) {
client_->SetupClientAuth();
EXPECT_EQ(SECSuccess, SSL_OptionSet(client_->ssl_fd(),