mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-24 17:37:30 +09:00
124 lines
4.4 KiB
C++
124 lines
4.4 KiB
C++
#include "cert.h"
|
|
#include "certdb.h"
|
|
#include "nspr.h"
|
|
#include "nss.h"
|
|
#include "pk11pub.h"
|
|
#include "secerr.h"
|
|
|
|
#include "nss_scoped_ptrs.h"
|
|
#include "util.h"
|
|
|
|
#define GTEST_HAS_RTTI 0
|
|
#include "gtest/gtest.h"
|
|
|
|
namespace nss_test {
|
|
|
|
class SoftokenBuiltinsTest : public ::testing::Test {
|
|
protected:
|
|
SoftokenBuiltinsTest() : nss_db_dir_("SoftokenBuiltinsTest.d-") {}
|
|
SoftokenBuiltinsTest(const std::string &prefix) : nss_db_dir_(prefix) {}
|
|
|
|
virtual void SetUp() {
|
|
std::string nss_init_arg("sql:");
|
|
nss_init_arg.append(nss_db_dir_.GetUTF8Path());
|
|
ASSERT_EQ(SECSuccess, NSS_Initialize(nss_init_arg.c_str(), "", "",
|
|
SECMOD_DB, NSS_INIT_NOROOTINIT));
|
|
}
|
|
|
|
virtual void TearDown() {
|
|
ASSERT_EQ(SECSuccess, NSS_Shutdown());
|
|
const std::string &nss_db_dir_path = nss_db_dir_.GetPath();
|
|
ASSERT_EQ(0, unlink((nss_db_dir_path + "/cert9.db").c_str()));
|
|
ASSERT_EQ(0, unlink((nss_db_dir_path + "/key4.db").c_str()));
|
|
ASSERT_EQ(0, unlink((nss_db_dir_path + "/pkcs11.txt").c_str()));
|
|
}
|
|
|
|
virtual void LoadModule() {
|
|
ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
|
|
ASSERT_TRUE(slot);
|
|
EXPECT_EQ(SECSuccess, PK11_InitPin(slot.get(), nullptr, nullptr));
|
|
SECStatus result = SECMOD_AddNewModule(
|
|
"Builtins-testlib", DLL_PREFIX "nssckbi-testlib." DLL_SUFFIX, 0, 0);
|
|
ASSERT_EQ(result, SECSuccess);
|
|
}
|
|
|
|
ScopedUniqueDirectory nss_db_dir_;
|
|
};
|
|
|
|
// The next tests in this class are used to test the Distrust Fields.
|
|
// More details about these fields in lib/ckfw/builtins/README.
|
|
TEST_F(SoftokenBuiltinsTest, CheckNoDistrustFields) {
|
|
const char *kCertNickname =
|
|
"Builtin Object Token:Distrust Fields Test - no_distrust";
|
|
LoadModule();
|
|
|
|
CERTCertDBHandle *cert_handle = CERT_GetDefaultCertDB();
|
|
ASSERT_TRUE(cert_handle);
|
|
ScopedCERTCertificate cert(
|
|
CERT_FindCertByNickname(cert_handle, kCertNickname));
|
|
ASSERT_TRUE(cert);
|
|
|
|
EXPECT_EQ(PR_FALSE,
|
|
PK11_HasAttributeSet(cert->slot, cert->pkcs11ID,
|
|
CKA_NSS_SERVER_DISTRUST_AFTER, PR_FALSE));
|
|
EXPECT_EQ(PR_FALSE,
|
|
PK11_HasAttributeSet(cert->slot, cert->pkcs11ID,
|
|
CKA_NSS_EMAIL_DISTRUST_AFTER, PR_FALSE));
|
|
ASSERT_FALSE(cert->distrust);
|
|
}
|
|
|
|
TEST_F(SoftokenBuiltinsTest, CheckOkDistrustFields) {
|
|
const char *kCertNickname =
|
|
"Builtin Object Token:Distrust Fields Test - ok_distrust";
|
|
LoadModule();
|
|
|
|
CERTCertDBHandle *cert_handle = CERT_GetDefaultCertDB();
|
|
ASSERT_TRUE(cert_handle);
|
|
ScopedCERTCertificate cert(
|
|
CERT_FindCertByNickname(cert_handle, kCertNickname));
|
|
ASSERT_TRUE(cert);
|
|
|
|
const char *kExpectedDERValueServer = "200617000000Z";
|
|
const char *kExpectedDERValueEmail = "071014085320Z";
|
|
// When a valid timestamp is encoded, the result length is exactly 13.
|
|
const unsigned int kDistrustFieldSize = 13;
|
|
|
|
ASSERT_TRUE(cert->distrust);
|
|
ASSERT_EQ(kDistrustFieldSize, cert->distrust->serverDistrustAfter.len);
|
|
ASSERT_NE(nullptr, cert->distrust->serverDistrustAfter.data);
|
|
EXPECT_TRUE(!memcmp(kExpectedDERValueServer,
|
|
cert->distrust->serverDistrustAfter.data,
|
|
kDistrustFieldSize));
|
|
|
|
ASSERT_EQ(kDistrustFieldSize, cert->distrust->emailDistrustAfter.len);
|
|
ASSERT_NE(nullptr, cert->distrust->emailDistrustAfter.data);
|
|
EXPECT_TRUE(!memcmp(kExpectedDERValueEmail,
|
|
cert->distrust->emailDistrustAfter.data,
|
|
kDistrustFieldSize));
|
|
}
|
|
|
|
TEST_F(SoftokenBuiltinsTest, CheckInvalidDistrustFields) {
|
|
const char *kCertNickname =
|
|
"Builtin Object Token:Distrust Fields Test - err_distrust";
|
|
LoadModule();
|
|
|
|
CERTCertDBHandle *cert_handle = CERT_GetDefaultCertDB();
|
|
ASSERT_TRUE(cert_handle);
|
|
ScopedCERTCertificate cert(
|
|
CERT_FindCertByNickname(cert_handle, kCertNickname));
|
|
ASSERT_TRUE(cert);
|
|
|
|
// The field should never be set to TRUE in production, we are just
|
|
// testing if this field is readable, even if set to TRUE.
|
|
EXPECT_EQ(PR_TRUE,
|
|
PK11_HasAttributeSet(cert->slot, cert->pkcs11ID,
|
|
CKA_NSS_SERVER_DISTRUST_AFTER, PR_FALSE));
|
|
// If something other than CK_BBOOL CK_TRUE, it will be considered FALSE
|
|
// Here, there is an OCTAL value, but with unexpected content (1 digit less).
|
|
EXPECT_EQ(PR_FALSE,
|
|
PK11_HasAttributeSet(cert->slot, cert->pkcs11ID,
|
|
CKA_NSS_EMAIL_DISTRUST_AFTER, PR_FALSE));
|
|
ASSERT_FALSE(cert->distrust);
|
|
}
|
|
|
|
} // namespace nss_test
|