mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-25 18:07:31 +09:00
327 lines
12 KiB
C
327 lines
12 KiB
C
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
/*
|
|
* test_buildchain_uchecker.c
|
|
*
|
|
* Test BuildChain User Checker function
|
|
*
|
|
*/
|
|
|
|
#include "testutil.h"
|
|
#include "testutil_nss.h"
|
|
|
|
static void *plContext = NULL;
|
|
static PKIX_UInt32 numUserCheckerCalled = 0;
|
|
|
|
static void
|
|
printUsage(void)
|
|
{
|
|
(void)printf("\nUSAGE:\ttest_buildchain_uchecker [ENE|EE] "
|
|
"[-|[F]<userOID>] "
|
|
"<trustedCert> <targetCert> <certStoreDirectory>\n\n");
|
|
(void)printf("Builds a chain of certificates between "
|
|
"<trustedCert> and <targetCert>\n"
|
|
"using the certs and CRLs in <certStoreDirectory>.\n"
|
|
"If <userOID> is not an empty string, its value is used as\n"
|
|
"user defined checker's critical extension OID.\n"
|
|
"A - for <userOID> is no OID and F is for supportingForward.\n"
|
|
"If ENE is specified, then an Error is Not Expected.\n"
|
|
"If EE is specified, an Error is Expected.\n");
|
|
}
|
|
|
|
static PKIX_Error *
|
|
testUserChecker(
|
|
PKIX_CertChainChecker *checker,
|
|
PKIX_PL_Cert *cert,
|
|
PKIX_List *unresExtOIDs,
|
|
void **pNBIOContext,
|
|
void *plContext)
|
|
{
|
|
numUserCheckerCalled++;
|
|
return (0);
|
|
}
|
|
|
|
int
|
|
test_buildchain_uchecker(int argc, char *argv[])
|
|
{
|
|
PKIX_BuildResult *buildResult = NULL;
|
|
PKIX_ComCertSelParams *certSelParams = NULL;
|
|
PKIX_CertSelector *certSelector = NULL;
|
|
PKIX_TrustAnchor *anchor = NULL;
|
|
PKIX_List *anchors = NULL;
|
|
PKIX_List *certs = NULL;
|
|
PKIX_PL_Cert *cert = NULL;
|
|
PKIX_ProcessingParams *procParams = NULL;
|
|
PKIX_CertChainChecker *checker = NULL;
|
|
char *dirName = NULL;
|
|
PKIX_PL_String *dirNameString = NULL;
|
|
PKIX_PL_Cert *trustedCert = NULL;
|
|
PKIX_PL_Cert *targetCert = NULL;
|
|
PKIX_UInt32 numCerts = 0;
|
|
PKIX_UInt32 i = 0;
|
|
PKIX_UInt32 j = 0;
|
|
PKIX_UInt32 k = 0;
|
|
PKIX_UInt32 chainLength = 0;
|
|
PKIX_CertStore *certStore = NULL;
|
|
PKIX_List *certStores = NULL;
|
|
char *asciiResult = NULL;
|
|
PKIX_Boolean result;
|
|
PKIX_Boolean testValid = PKIX_TRUE;
|
|
PKIX_Boolean supportForward = PKIX_FALSE;
|
|
PKIX_List *expectedCerts = NULL;
|
|
PKIX_List *userOIDs = NULL;
|
|
PKIX_PL_OID *oid = NULL;
|
|
PKIX_PL_Cert *dirCert = NULL;
|
|
PKIX_PL_String *actualCertsString = NULL;
|
|
PKIX_PL_String *expectedCertsString = NULL;
|
|
char *actualCertsAscii = NULL;
|
|
char *expectedCertsAscii = NULL;
|
|
char *oidString = NULL;
|
|
void *buildState = NULL; /* needed by pkix_build for non-blocking I/O */
|
|
void *nbioContext = NULL; /* needed by pkix_build for non-blocking I/O */
|
|
|
|
PKIX_TEST_STD_VARS();
|
|
|
|
if (argc < 5) {
|
|
printUsage();
|
|
return (0);
|
|
}
|
|
|
|
startTests("BuildChain_UserChecker");
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(
|
|
PKIX_PL_NssContext_Create(0, PKIX_FALSE, NULL, &plContext));
|
|
|
|
/* ENE = expect no error; EE = expect error */
|
|
if (PORT_Strcmp(argv[2 + j], "ENE") == 0) {
|
|
testValid = PKIX_TRUE;
|
|
} else if (PORT_Strcmp(argv[2 + j], "EE") == 0) {
|
|
testValid = PKIX_FALSE;
|
|
} else {
|
|
printUsage();
|
|
return (0);
|
|
}
|
|
|
|
/* OID specified at argv[3+j] */
|
|
|
|
if (*argv[3 + j] != '-') {
|
|
|
|
if (*argv[3 + j] == 'F') {
|
|
supportForward = PKIX_TRUE;
|
|
oidString = argv[3 + j] + 1;
|
|
} else {
|
|
oidString = argv[3 + j];
|
|
}
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&userOIDs, plContext));
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_OID_Create(oidString, &oid, plContext));
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(userOIDs, (PKIX_PL_Object *)oid, plContext));
|
|
PKIX_TEST_DECREF_BC(oid);
|
|
}
|
|
|
|
subTest(argv[1 + j]);
|
|
|
|
dirName = argv[4 + j];
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&expectedCerts, plContext));
|
|
|
|
chainLength = argc - j - 5;
|
|
|
|
for (k = 0; k < chainLength; k++) {
|
|
|
|
dirCert = createCert(dirName, argv[5 + k + j], plContext);
|
|
|
|
if (k == (chainLength - 1)) {
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)dirCert, plContext));
|
|
trustedCert = dirCert;
|
|
} else {
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(expectedCerts,
|
|
(PKIX_PL_Object *)dirCert,
|
|
plContext));
|
|
|
|
if (k == 0) {
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)dirCert,
|
|
plContext));
|
|
targetCert = dirCert;
|
|
}
|
|
}
|
|
|
|
PKIX_TEST_DECREF_BC(dirCert);
|
|
}
|
|
|
|
/* create processing params with list of trust anchors */
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_TrustAnchor_CreateWithCert(trustedCert, &anchor, plContext));
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&anchors, plContext));
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(anchors, (PKIX_PL_Object *)anchor, plContext));
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_Create(anchors, &procParams, plContext));
|
|
|
|
/* create CertSelector with target certificate in params */
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&certSelParams, plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetCertificate(certSelParams, targetCert, plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, certSelParams, plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_SetTargetCertConstraints(procParams, certSelector, plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertChainChecker_Create(testUserChecker,
|
|
supportForward,
|
|
PKIX_FALSE,
|
|
userOIDs,
|
|
NULL,
|
|
&checker,
|
|
plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_AddCertChainChecker(procParams, checker, plContext));
|
|
|
|
/* create CertStores */
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII,
|
|
dirName,
|
|
0,
|
|
&dirNameString,
|
|
plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirNameString, &certStore, plContext));
|
|
|
|
#if 0
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Pk11CertStore_Create
|
|
(&certStore, plContext));
|
|
#endif
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&certStores, plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(certStores, (PKIX_PL_Object *)certStore, plContext));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_SetCertStores(procParams, certStores, plContext));
|
|
|
|
/* build cert chain using processing params and return buildResult */
|
|
|
|
pkixTestErrorResult = PKIX_BuildChain(procParams,
|
|
&nbioContext,
|
|
&buildState,
|
|
&buildResult,
|
|
NULL,
|
|
plContext);
|
|
|
|
if (testValid == PKIX_TRUE) { /* ENE */
|
|
if (pkixTestErrorResult) {
|
|
(void)printf("UNEXPECTED RESULT RECEIVED!\n");
|
|
} else {
|
|
(void)printf("EXPECTED RESULT RECEIVED!\n");
|
|
PKIX_TEST_DECREF_BC(pkixTestErrorResult);
|
|
}
|
|
} else { /* EE */
|
|
if (pkixTestErrorResult) {
|
|
(void)printf("EXPECTED RESULT RECEIVED!\n");
|
|
PKIX_TEST_DECREF_BC(pkixTestErrorResult);
|
|
} else {
|
|
testError("UNEXPECTED RESULT RECEIVED");
|
|
}
|
|
}
|
|
|
|
if (buildResult) {
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_BuildResult_GetCertChain(buildResult, &certs, NULL));
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certs, &numCerts, plContext));
|
|
|
|
printf("\n");
|
|
|
|
for (i = 0; i < numCerts; i++) {
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs,
|
|
i,
|
|
(PKIX_PL_Object **)&cert,
|
|
plContext));
|
|
|
|
asciiResult = PKIX_Cert2ASCII(cert);
|
|
|
|
printf("CERT[%d]:\n%s\n", i, asciiResult);
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Free(asciiResult, plContext));
|
|
asciiResult = NULL;
|
|
|
|
PKIX_TEST_DECREF_BC(cert);
|
|
}
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_Equals((PKIX_PL_Object *)certs,
|
|
(PKIX_PL_Object *)expectedCerts,
|
|
&result,
|
|
plContext));
|
|
|
|
if (!result) {
|
|
testError("BUILT CERTCHAIN IS "
|
|
"NOT THE ONE THAT WAS EXPECTED");
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_ToString((PKIX_PL_Object *)certs,
|
|
&actualCertsString,
|
|
plContext));
|
|
|
|
actualCertsAscii = PKIX_String2ASCII(actualCertsString, plContext);
|
|
if (actualCertsAscii == NULL) {
|
|
pkixTestErrorMsg = "PKIX_String2ASCII Failed";
|
|
goto cleanup;
|
|
}
|
|
|
|
PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_ToString((PKIX_PL_Object *)expectedCerts,
|
|
&expectedCertsString,
|
|
plContext));
|
|
|
|
expectedCertsAscii = PKIX_String2ASCII(expectedCertsString, plContext);
|
|
if (expectedCertsAscii == NULL) {
|
|
pkixTestErrorMsg = "PKIX_String2ASCII Failed";
|
|
goto cleanup;
|
|
}
|
|
|
|
(void)printf("Actual value:\t%s\n", actualCertsAscii);
|
|
(void)printf("Expected value:\t%s\n",
|
|
expectedCertsAscii);
|
|
|
|
if (chainLength - 1 != numUserCheckerCalled) {
|
|
pkixTestErrorMsg =
|
|
"PKIX user defined checker not called";
|
|
}
|
|
|
|
goto cleanup;
|
|
}
|
|
}
|
|
|
|
cleanup:
|
|
PKIX_PL_Free(asciiResult, plContext);
|
|
PKIX_PL_Free(actualCertsAscii, plContext);
|
|
PKIX_PL_Free(expectedCertsAscii, plContext);
|
|
|
|
PKIX_TEST_DECREF_AC(actualCertsString);
|
|
PKIX_TEST_DECREF_AC(expectedCertsString);
|
|
PKIX_TEST_DECREF_AC(expectedCerts);
|
|
PKIX_TEST_DECREF_AC(certs);
|
|
PKIX_TEST_DECREF_AC(cert);
|
|
PKIX_TEST_DECREF_AC(certStore);
|
|
PKIX_TEST_DECREF_AC(certStores);
|
|
PKIX_TEST_DECREF_AC(dirNameString);
|
|
PKIX_TEST_DECREF_AC(trustedCert);
|
|
PKIX_TEST_DECREF_AC(targetCert);
|
|
PKIX_TEST_DECREF_AC(anchor);
|
|
PKIX_TEST_DECREF_AC(anchors);
|
|
PKIX_TEST_DECREF_AC(procParams);
|
|
PKIX_TEST_DECREF_AC(certSelParams);
|
|
PKIX_TEST_DECREF_AC(certSelector);
|
|
PKIX_TEST_DECREF_AC(buildResult);
|
|
PKIX_TEST_DECREF_AC(procParams);
|
|
PKIX_TEST_DECREF_AC(userOIDs);
|
|
PKIX_TEST_DECREF_AC(checker);
|
|
|
|
PKIX_TEST_RETURN();
|
|
|
|
PKIX_Shutdown(plContext);
|
|
|
|
endTests("BuildChain_UserChecker");
|
|
|
|
return (0);
|
|
}
|