mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-28 19:37:32 +09:00
import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo
This commit is contained in:
Roy Tam
commit
dcd9973243
150858 changed files with 23884658 additions and 0 deletions
435
security/nss/cmd/libpkix/pkix/top/test_customcrlchecker.c
Normal file
435
security/nss/cmd/libpkix/pkix/top/test_customcrlchecker.c
Normal file
|
|
@ -0,0 +1,435 @@
|
|||
/* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||||
/*
|
||||
* test_customcrlchecker.c
|
||||
*
|
||||
* Test Custom CRL Checking
|
||||
*
|
||||
*/
|
||||
|
||||
#include "testutil.h"
|
||||
#include "testutil_nss.h"
|
||||
|
||||
#define PKIX_TEST_MAX_CERTS 10
|
||||
#define PKIX_TEST_COLLECTIONCERTSTORE_NUM_CRLS 5
|
||||
|
||||
static void *plContext = NULL;
|
||||
char *dirName = NULL; /* also used in callback */
|
||||
|
||||
static void
|
||||
printUsage1(char *pName)
|
||||
{
|
||||
printf("\nUSAGE: %s test-purpose [ENE|EE] ", pName);
|
||||
printf("cert [certs].\n");
|
||||
}
|
||||
|
||||
static void
|
||||
printUsageMax(PKIX_UInt32 numCerts)
|
||||
{
|
||||
printf("\nUSAGE ERROR: number of certs %d exceed maximum %d\n",
|
||||
numCerts, PKIX_TEST_MAX_CERTS);
|
||||
}
|
||||
|
||||
static PKIX_Error *
|
||||
getCRLCallback(
|
||||
PKIX_CertStore *store,
|
||||
PKIX_CRLSelector *crlSelector,
|
||||
void **pNBIOContext,
|
||||
PKIX_List **pCrlList,
|
||||
void *plContext)
|
||||
{
|
||||
char *crlFileNames[] = { "chem.crl",
|
||||
"phys.crl",
|
||||
"prof.crl",
|
||||
"sci.crl",
|
||||
"test.crl",
|
||||
0 };
|
||||
PKIX_PL_CRL *crl = NULL;
|
||||
PKIX_List *crlList = NULL;
|
||||
PKIX_UInt32 i = 0;
|
||||
|
||||
PKIX_TEST_STD_VARS();
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&crlList, plContext));
|
||||
|
||||
while (crlFileNames[i]) {
|
||||
|
||||
crl = createCRL(dirName, crlFileNames[i++], plContext);
|
||||
|
||||
if (crl != NULL) {
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(crlList, (PKIX_PL_Object *)crl, plContext));
|
||||
|
||||
PKIX_TEST_DECREF_BC(crl);
|
||||
}
|
||||
}
|
||||
|
||||
*pCrlList = crlList;
|
||||
|
||||
cleanup:
|
||||
|
||||
PKIX_TEST_RETURN();
|
||||
|
||||
return (0); /* this function is called by libpkix */
|
||||
}
|
||||
|
||||
static PKIX_Error *
|
||||
getCRLContinue(
|
||||
PKIX_CertStore *store,
|
||||
PKIX_CRLSelector *crlSelector,
|
||||
void **pNBIOContext,
|
||||
PKIX_List **pCrlList,
|
||||
void *plContext)
|
||||
{
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
static PKIX_Error *
|
||||
getCertCallback(
|
||||
PKIX_CertStore *store,
|
||||
PKIX_CertSelector *certSelector,
|
||||
void **pNBIOContext,
|
||||
PKIX_List **pCerts,
|
||||
void *plContext)
|
||||
{
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
static PKIX_Error *
|
||||
getCertContinue(
|
||||
PKIX_CertStore *store,
|
||||
PKIX_CertSelector *certSelector,
|
||||
void **pNBIOContext,
|
||||
PKIX_List **pCerts,
|
||||
void *plContext)
|
||||
{
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
static PKIX_Error *
|
||||
testCRLSelectorMatchCallback(
|
||||
PKIX_CRLSelector *selector,
|
||||
PKIX_PL_CRL *crl,
|
||||
void *plContext)
|
||||
{
|
||||
PKIX_ComCRLSelParams *comCrlSelParams = NULL;
|
||||
PKIX_List *issuerList = NULL;
|
||||
PKIX_PL_X500Name *issuer = NULL;
|
||||
PKIX_PL_X500Name *crlIssuer = NULL;
|
||||
PKIX_UInt32 numIssuers = 0;
|
||||
PKIX_UInt32 i = 0;
|
||||
PKIX_Boolean result = PKIX_FALSE;
|
||||
PKIX_Error *error = NULL;
|
||||
char *errorText = "Not an error, CRL Select mismatch";
|
||||
|
||||
PKIX_TEST_STD_VARS();
|
||||
|
||||
subTest("Custom_Selector_MatchCallback");
|
||||
|
||||
if (selector != NULL) {
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_GetCommonCRLSelectorParams(selector, &comCrlSelParams, plContext));
|
||||
}
|
||||
|
||||
if (crl != NULL) {
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CRL_GetIssuer(crl, &crlIssuer, plContext));
|
||||
}
|
||||
|
||||
if (comCrlSelParams != NULL) {
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_GetIssuerNames(comCrlSelParams, &issuerList, plContext));
|
||||
}
|
||||
|
||||
if (issuerList != NULL) {
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(issuerList, &numIssuers, plContext));
|
||||
|
||||
for (i = 0; i < numIssuers; i++) {
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(issuerList,
|
||||
i, (PKIX_PL_Object **)&issuer,
|
||||
plContext));
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_Equals((PKIX_PL_Object *)crlIssuer,
|
||||
(PKIX_PL_Object *)issuer,
|
||||
&result,
|
||||
plContext));
|
||||
|
||||
if (result != PKIX_TRUE) {
|
||||
break;
|
||||
}
|
||||
|
||||
if (i == numIssuers - 1) {
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_Error_Create(0,
|
||||
NULL,
|
||||
NULL,
|
||||
PKIX_TESTNOTANERRORCRLSELECTMISMATCH,
|
||||
&error,
|
||||
plContext));
|
||||
|
||||
PKIX_TEST_DECREF_AC(issuer);
|
||||
issuer = NULL;
|
||||
break;
|
||||
}
|
||||
|
||||
PKIX_TEST_DECREF_AC(issuer);
|
||||
}
|
||||
}
|
||||
|
||||
cleanup:
|
||||
|
||||
PKIX_TEST_DECREF_AC(comCrlSelParams);
|
||||
PKIX_TEST_DECREF_AC(crlIssuer);
|
||||
PKIX_TEST_DECREF_AC(issuer);
|
||||
PKIX_TEST_DECREF_AC(issuerList);
|
||||
|
||||
PKIX_TEST_RETURN();
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
||||
static PKIX_Error *
|
||||
testAddIssuerName(PKIX_ComCRLSelParams *comCrlSelParams, char *issuerName)
|
||||
{
|
||||
PKIX_PL_String *issuerString = NULL;
|
||||
PKIX_PL_X500Name *issuer = NULL;
|
||||
PKIX_UInt32 length = 0;
|
||||
|
||||
PKIX_TEST_STD_VARS();
|
||||
|
||||
subTest("PKIX_ComCRLSelParams_AddIssuerName");
|
||||
|
||||
length = PL_strlen(issuerName);
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_UTF8,
|
||||
issuerName,
|
||||
length,
|
||||
&issuerString,
|
||||
plContext));
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_X500Name_Create(issuerString,
|
||||
&issuer,
|
||||
plContext));
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_AddIssuerName(comCrlSelParams, issuer, plContext));
|
||||
|
||||
cleanup:
|
||||
|
||||
PKIX_TEST_DECREF_AC(issuerString);
|
||||
PKIX_TEST_DECREF_AC(issuer);
|
||||
|
||||
PKIX_TEST_RETURN();
|
||||
|
||||
return (0);
|
||||
}
|
||||
|
||||
static PKIX_Error *
|
||||
testCustomCertStore(PKIX_ValidateParams *valParams)
|
||||
{
|
||||
PKIX_CertStore_CRLCallback crlCallback;
|
||||
PKIX_CertStore *certStore = NULL;
|
||||
PKIX_ProcessingParams *procParams = NULL;
|
||||
char *issuerName1 = "cn=science,o=mit,c=us";
|
||||
char *issuerName2 = "cn=physics,o=mit,c=us";
|
||||
char *issuerName3 = "cn=prof noall,o=mit,c=us";
|
||||
char *issuerName4 = "cn=testing CRL,o=test,c=us";
|
||||
PKIX_ComCRLSelParams *comCrlSelParams = NULL;
|
||||
PKIX_CRLSelector *crlSelector = NULL;
|
||||
PKIX_List *crlList = NULL;
|
||||
PKIX_UInt32 numCrl = 0;
|
||||
void *nbioContext = NULL;
|
||||
|
||||
PKIX_TEST_STD_VARS();
|
||||
|
||||
subTest("PKIX_PL_CollectionCertStore_Create");
|
||||
|
||||
/* Create CRLSelector, link in CollectionCertStore */
|
||||
|
||||
subTest("PKIX_ComCRLSelParams_AddIssuerNames");
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_Create(&comCrlSelParams, plContext));
|
||||
|
||||
testAddIssuerName(comCrlSelParams, issuerName1);
|
||||
testAddIssuerName(comCrlSelParams, issuerName2);
|
||||
testAddIssuerName(comCrlSelParams, issuerName3);
|
||||
testAddIssuerName(comCrlSelParams, issuerName4);
|
||||
|
||||
subTest("PKIX_CRLSelector_SetCommonCRLSelectorParams");
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create(testCRLSelectorMatchCallback,
|
||||
NULL,
|
||||
&crlSelector,
|
||||
plContext));
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_SetCommonCRLSelectorParams(crlSelector, comCrlSelParams, plContext));
|
||||
|
||||
/* Create CertStore, link in CRLSelector */
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ValidateParams_GetProcessingParams(valParams, &procParams, plContext));
|
||||
|
||||
subTest("PKIX_CertStore_Create");
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_Create(getCertCallback,
|
||||
getCRLCallback,
|
||||
getCertContinue,
|
||||
getCRLContinue,
|
||||
NULL, /* trustCallback */
|
||||
(PKIX_PL_Object *)crlSelector, /* fake */
|
||||
PKIX_FALSE, /* cacheFlag */
|
||||
PKIX_TRUE, /* localFlag */
|
||||
&certStore,
|
||||
plContext));
|
||||
|
||||
subTest("PKIX_ProcessingParams_AddCertStore");
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_AddCertStore(procParams, certStore, plContext));
|
||||
|
||||
subTest("PKIX_ProcessingParams_SetRevocationEnabled");
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_SetRevocationEnabled(procParams, PKIX_TRUE, plContext));
|
||||
|
||||
subTest("PKIX_CertStore_GetCRLCallback");
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCRLCallback(certStore,
|
||||
&crlCallback,
|
||||
NULL));
|
||||
|
||||
subTest("Getting CRL by CRL Callback");
|
||||
PKIX_TEST_EXPECT_NO_ERROR(crlCallback(certStore,
|
||||
crlSelector,
|
||||
&nbioContext,
|
||||
&crlList,
|
||||
plContext));
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(crlList,
|
||||
&numCrl,
|
||||
plContext));
|
||||
|
||||
if (numCrl != PKIX_TEST_COLLECTIONCERTSTORE_NUM_CRLS) {
|
||||
pkixTestErrorMsg = "unexpected CRL number mismatch";
|
||||
}
|
||||
|
||||
cleanup:
|
||||
|
||||
PKIX_TEST_DECREF_AC(crlList);
|
||||
PKIX_TEST_DECREF_AC(comCrlSelParams);
|
||||
PKIX_TEST_DECREF_AC(crlSelector);
|
||||
PKIX_TEST_DECREF_AC(procParams);
|
||||
PKIX_TEST_DECREF_AC(certStore);
|
||||
|
||||
PKIX_TEST_RETURN();
|
||||
|
||||
return (0);
|
||||
}
|
||||
|
||||
/*
|
||||
* Validate Certificate Chain with Certificate Revocation List
|
||||
* Certificate Chain is built based on input certs' sequence.
|
||||
* CRL is fetched from the directory specified in CollectionCertStore.
|
||||
* while CollectionCertStore is linked in CertStore Object which then
|
||||
* linked in ProcessParam. During validation, CRLChecker will invoke
|
||||
* the crlCallback (this test uses PKIX_PL_CollectionCertStore_GetCRL)
|
||||
* to get CRL data for revocation check.
|
||||
* This test set criteria in CRLSelector which is linked in
|
||||
* CommonCRLSelectorParam. When CRL data is fetched into cache for
|
||||
* revocation check, CRL's are filtered based on the criteria set.
|
||||
*/
|
||||
|
||||
int
|
||||
test_customcrlchecker(int argc, char *argv[])
|
||||
{
|
||||
|
||||
PKIX_List *chain = NULL;
|
||||
PKIX_ValidateParams *valParams = NULL;
|
||||
PKIX_ValidateResult *valResult = NULL;
|
||||
PKIX_UInt32 actualMinorVersion;
|
||||
char *certNames[PKIX_TEST_MAX_CERTS];
|
||||
PKIX_PL_Cert *certs[PKIX_TEST_MAX_CERTS];
|
||||
PKIX_VerifyNode *verifyTree = NULL;
|
||||
PKIX_PL_String *verifyString = NULL;
|
||||
PKIX_UInt32 chainLength = 0;
|
||||
PKIX_UInt32 i = 0;
|
||||
PKIX_UInt32 j = 0;
|
||||
PKIX_Boolean testValid = PKIX_TRUE;
|
||||
char *anchorName = NULL;
|
||||
|
||||
PKIX_TEST_STD_VARS();
|
||||
|
||||
if (argc < 5) {
|
||||
printUsage1(argv[0]);
|
||||
return (0);
|
||||
}
|
||||
|
||||
startTests("CRL Checker");
|
||||
|
||||
PKIX_TEST_EXPECT_NO_ERROR(
|
||||
PKIX_PL_NssContext_Create(0, PKIX_FALSE, NULL, &plContext));
|
||||
|
||||
/* ENE = expect no error; EE = expect error */
|
||||
if (PORT_Strcmp(argv[2 + j], "ENE") == 0) {
|
||||
testValid = PKIX_TRUE;
|
||||
} else if (PORT_Strcmp(argv[2 + j], "EE") == 0) {
|
||||
testValid = PKIX_FALSE;
|
||||
} else {
|
||||
printUsage1(argv[0]);
|
||||
return (0);
|
||||
}
|
||||
|
||||
chainLength = (argc - j) - 5;
|
||||
if (chainLength > PKIX_TEST_MAX_CERTS) {
|
||||
printUsageMax(chainLength);
|
||||
}
|
||||
|
||||
for (i = 0; i < chainLength; i++) {
|
||||
|
||||
certNames[i] = argv[(5 + j) + i];
|
||||
certs[i] = NULL;
|
||||
}
|
||||
|
||||
dirName = argv[3 + j];
|
||||
|
||||
subTest(argv[1 + j]);
|
||||
|
||||
subTest("Custom-CRL-Checker - Create Cert Chain");
|
||||
|
||||
chain = createCertChainPlus(dirName, certNames, certs, chainLength, plContext);
|
||||
|
||||
subTest("Custom-CRL-Checker - Create Params");
|
||||
|
||||
anchorName = argv[4 + j];
|
||||
|
||||
valParams = createValidateParams(dirName,
|
||||
anchorName,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
PKIX_FALSE,
|
||||
PKIX_FALSE,
|
||||
PKIX_FALSE,
|
||||
PKIX_FALSE,
|
||||
chain,
|
||||
plContext);
|
||||
|
||||
subTest("Custom-CRL-Checker - Set Processing Params for CertStore");
|
||||
|
||||
testCustomCertStore(valParams);
|
||||
|
||||
subTest("Custom-CRL-Checker - Validate Chain");
|
||||
|
||||
if (testValid == PKIX_TRUE) {
|
||||
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ValidateChain(valParams, &valResult, &verifyTree, plContext));
|
||||
} else {
|
||||
PKIX_TEST_EXPECT_ERROR(PKIX_ValidateChain(valParams, &valResult, &verifyTree, plContext));
|
||||
}
|
||||
|
||||
cleanup:
|
||||
|
||||
PKIX_TEST_DECREF_AC(verifyString);
|
||||
PKIX_TEST_DECREF_AC(verifyTree);
|
||||
PKIX_TEST_DECREF_AC(chain);
|
||||
PKIX_TEST_DECREF_AC(valParams);
|
||||
PKIX_TEST_DECREF_AC(valResult);
|
||||
|
||||
PKIX_Shutdown(plContext);
|
||||
|
||||
PKIX_TEST_RETURN();
|
||||
|
||||
endTests("CRL Checker");
|
||||
|
||||
return (0);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue