| /* This Source Code Form is subject to the terms of the Mozilla Public |
| * License, v. 2.0. If a copy of the MPL was not distributed with this |
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| /* |
| * test_certselector.c |
| * |
| * Test Cert Selector |
| * |
| */ |
| |
| #include "testutil.h" |
| #include "testutil_nss.h" |
| |
| #define PKIX_TEST_CERTSELECTOR_KEYUSAGE_NUM_CERTS 5 |
| #define PKIX_TEST_CERTSELECTOR_EXTKEYUSAGE_NUM_CERTS 2 |
| #define PKIX_TEST_CERTSELECTOR_CERTVALID_NUM_CERTS 2 |
| #define PKIX_TEST_CERTSELECTOR_ISSUER_NUM_CERTS 4 |
| #define PKIX_TEST_CERTSELECTOR_SERIALNUMBER_NUM_CERTS 1 |
| |
| static void *plContext = NULL; |
| |
| /* |
| * The first three certs are used to obtain policies to test |
| * policy matching. Changing the table could break tests. |
| */ |
| static char *certList[] = { |
| #define POLICY1CERT 0 |
| "GoodCACert.crt", |
| #define ANYPOLICYCERT 1 |
| "anyPolicyCACert.crt", |
| #define POLICY2CERT 2 |
| "PoliciesP12CACert.crt", |
| #define SUBJECTCERT 3 |
| "PoliciesP3CACert.crt", |
| "PoliciesP1234CACert.crt", |
| "pathLenConstraint0CACert.crt", |
| "pathLenConstraint1CACert.crt", |
| "pathLenConstraint6CACert.crt", |
| "TrustAnchorRootCertificate.crt", |
| "GoodsubCACert.crt", |
| "AnyPolicyTest14EE.crt", |
| "UserNoticeQualifierTest16EE.crt" |
| }; |
| #define NUMCERTS (sizeof(certList) / sizeof(certList[0])) |
| |
| /* |
| * Following are Certs values for NameConstraints tests |
| * |
| * Cert0:nameConstraintsDN1subCA1Cert.crt: |
| * Subject:CN=nameConstraints DN1 subCA1,OU=permittedSubtree1, |
| * O=Test Certificates,C=US |
| * Permitted Name:(OU=permittedSubtree2,OU=permittedSubtree1, |
| * O=Test Certificates,C=US) |
| * Excluded Name: (EMPTY) |
| * Cert1:nameConstraintsDN3subCA2Cert.crt: |
| * Subject:CN=nameConstraints DN3 subCA2,O=Test Certificates,C=US |
| * Permitted Name:(O=Test Certificates,C=US) |
| * Excluded Name:(EMPTY) |
| * Cert2:nameConstraintsDN2CACert.crt |
| * Subject:CN=nameConstraints DN2 CA,O=Test Certificates,C=US |
| * Permitted Name:(OU=permittedSubtree1,O=Test Certificates,C=US, |
| * OU=permittedSubtree2,O=Test Certificates,C=US) |
| * Excluded Name:(EMPTY) |
| * Cert3:nameConstraintsDN3subCA1Cert.crt |
| * Subject:CN=nameConstraints DN3 subCA1,O=Test Certificates,C=US |
| * Permitted Name:(EMPTY) |
| * Excluded Name:(OU=excludedSubtree2,O=Test Certificates,C=US) |
| * Cert4:nameConstraintsDN4CACert.crt |
| * Subject:CN=nameConstraints DN4 CA,O=Test Certificates,C=US |
| * Permitted Name:(EMPTY) |
| * Excluded Name:(OU=excludedSubtree1,O=Test Certificates,C=US, |
| * OU=excludedSubtree2,O=Test Certificates,C=US) |
| * Cert5:nameConstraintsDN5CACert.crt |
| * Subject:CN=nameConstraints DN5 CA,O=Test Certificates,C=US |
| * Permitted Name:(OU=permittedSubtree1,O=Test Certificates,C=US) |
| * Excluded Name:(OU=excludedSubtree1,OU=permittedSubtree1, |
| * O=Test Certificates,C=US) |
| * Cert6:ValidDNnameConstraintsTest1EE.crt |
| * Subject:CN=Valid DN nameConstraints EE Certificate Test1, |
| * OU=permittedSubtree1,O=Test Certificates,C=US |
| * |
| */ |
| static char *ncCertList[] = { |
| "nameConstraintsDN1subCA1Cert.crt", |
| "nameConstraintsDN3subCA2Cert.crt", |
| "nameConstraintsDN2CACert.crt", |
| "nameConstraintsDN3subCA1Cert.crt", |
| "nameConstraintsDN4CACert.crt", |
| "nameConstraintsDN5CACert.crt", |
| "ValidDNnameConstraintsTest1EE.crt" |
| }; |
| #define NUMNCCERTS (sizeof(ncCertList) / sizeof(ncCertList[0])) |
| |
| static char *sanCertList[] = { |
| "InvalidDNnameConstraintsTest3EE.crt", |
| "InvalidDNSnameConstraintsTest38EE.crt" |
| }; |
| #define NUMSANCERTS (sizeof(sanCertList) / sizeof(sanCertList[0])) |
| |
| /* |
| * This function calls the CertSelector pointed to by "selector" for each |
| * cert in the List pointed to by "certs", and compares the results against |
| * the bit array given by the UInt32 "expectedResults". If the first cert is |
| * expected to pass, the lower-order bit of "expectedResults" should be 1. |
| * If the second cert is expected to pass, the second bit of "expectedResults" |
| * should be 1, and so on. If more than 32 certs are provided, only the first |
| * 32 will be checked. It is not an error to provide more bits than needed. |
| * (For example, if you expect every cert to pass, "expectedResult" can be |
| * set to 0xFFFFFFFF, even if the chain has fewer than 32 certs.) |
| */ |
| static void |
| testSelector( |
| PKIX_CertSelector *selector, |
| PKIX_List *certs, |
| PKIX_UInt32 expectedResults) |
| { |
| PKIX_UInt32 i = 0; |
| PKIX_UInt32 numCerts = 0; |
| PKIX_PL_Cert *cert = NULL; |
| PKIX_CertSelector_MatchCallback callback = NULL; |
| PKIX_Error *errReturn = NULL; |
| PKIX_Boolean result = PKIX_TRUE; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetMatchCallback(selector, &callback, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certs, &numCerts, plContext)); |
| if (numCerts > 32) { |
| numCerts = 32; |
| } |
| |
| for (i = 0; i < numCerts; i++) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, i, (PKIX_PL_Object **)&cert, plContext)); |
| errReturn = callback(selector, cert, &result, plContext); |
| |
| if (errReturn || result == PKIX_FALSE) { |
| if ((expectedResults & 1) == 1) { |
| testError("selector unexpectedly failed"); |
| (void)printf(" processing cert:\t%d\n", i); |
| } |
| } else { |
| if ((expectedResults & 1) == 0) { |
| testError("selector unexpectedly passed"); |
| (void)printf(" processing cert:\t%d\n", i); |
| } |
| } |
| |
| expectedResults = expectedResults >> 1; |
| PKIX_TEST_DECREF_BC(cert); |
| PKIX_TEST_DECREF_BC(errReturn); |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(cert); |
| PKIX_TEST_DECREF_AC(errReturn); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| /* |
| * This function gets a policy from the Cert pointed to by "cert", according |
| * to the index provided by "index", creates an immutable List containing the |
| * OID of that policy, and stores the result at "pPolicyList". |
| */ |
| static void |
| testGetPolicyFromCert( |
| PKIX_PL_Cert *cert, |
| PKIX_UInt32 index, |
| PKIX_List **pPolicyList) |
| { |
| PKIX_List *policyInfo = NULL; |
| PKIX_PL_CertPolicyInfo *firstPolicy = NULL; |
| PKIX_PL_OID *policyOID = NULL; |
| PKIX_List *list = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetPolicyInformation(cert, &policyInfo, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(policyInfo, |
| index, |
| (PKIX_PL_Object **)&firstPolicy, |
| plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CertPolicyInfo_GetPolicyId(firstPolicy, &policyOID, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&list, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(list, (PKIX_PL_Object *)policyOID, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_SetImmutable(list, plContext)); |
| |
| *pPolicyList = list; |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(policyInfo); |
| PKIX_TEST_DECREF_AC(firstPolicy); |
| PKIX_TEST_DECREF_AC(policyOID); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| /* |
| * This custom matchCallback will pass any Certificate which has no |
| * CertificatePolicies extension and any Certificate whose Policies |
| * extension include a CertPolicyQualifier. |
| */ |
| static PKIX_Error * |
| custom_CertSelector_MatchCallback( |
| PKIX_CertSelector *selector, |
| PKIX_PL_Cert *cert, |
| PKIX_Boolean *pResult, |
| void *plContext) |
| { |
| PKIX_UInt32 i = 0; |
| PKIX_UInt32 numPolicies = 0; |
| PKIX_List *certPolicies = NULL; |
| PKIX_List *quals = NULL; |
| PKIX_PL_CertPolicyInfo *policy = NULL; |
| PKIX_Error *error = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| *pResult = PKIX_TRUE; |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetPolicyInformation(cert, &certPolicies, plContext)); |
| |
| if (certPolicies) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certPolicies, &numPolicies, plContext)); |
| |
| for (i = 0; i < numPolicies; i++) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certPolicies, |
| i, |
| (PKIX_PL_Object **)&policy, |
| plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CertPolicyInfo_GetPolQualifiers(policy, &quals, plContext)); |
| if (quals) { |
| goto cleanup; |
| } |
| PKIX_TEST_DECREF_BC(policy); |
| } |
| PKIX_TEST_DECREF_BC(certPolicies); |
| *pResult = PKIX_FALSE; |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_Error_Create(PKIX_CERTSELECTOR_ERROR, |
| NULL, |
| NULL, |
| PKIX_TESTPOLICYEXTWITHNOPOLICYQUALIFIERS, |
| &error, |
| plContext)); |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(certPolicies); |
| PKIX_TEST_DECREF_AC(policy); |
| PKIX_TEST_DECREF_AC(quals); |
| |
| return (error); |
| } |
| |
| /* |
| * This custom matchCallback will pass any Certificate whose |
| * CertificatePolicies extension asserts the Policy specified by |
| * the OID in the CertSelectorContext object. |
| */ |
| static PKIX_Error * |
| custom_CertSelector_MatchOIDCallback( |
| PKIX_CertSelector *selector, |
| PKIX_PL_Cert *cert, |
| PKIX_Boolean *pResult, |
| void *plContext) |
| { |
| PKIX_UInt32 i = 0; |
| PKIX_UInt32 numPolicies = 0; |
| PKIX_Boolean match = PKIX_FALSE; |
| PKIX_PL_Object *certSelectorContext = NULL; |
| PKIX_PL_OID *constraintOID = NULL; |
| PKIX_List *certPolicies = NULL; |
| PKIX_PL_CertPolicyInfo *policy = NULL; |
| PKIX_PL_OID *policyOID = NULL; |
| PKIX_PL_String *errorDesc = NULL; |
| PKIX_Error *error = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| *pResult = PKIX_TRUE; |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetCertSelectorContext(selector, &certSelectorContext, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(pkix_CheckType(certSelectorContext, PKIX_OID_TYPE, plContext)); |
| |
| constraintOID = (PKIX_PL_OID *)certSelectorContext; |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetPolicyInformation(cert, &certPolicies, plContext)); |
| |
| if (certPolicies) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certPolicies, &numPolicies, plContext)); |
| |
| for (i = 0; i < numPolicies; i++) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certPolicies, |
| i, |
| (PKIX_PL_Object **)&policy, |
| plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CertPolicyInfo_GetPolicyId(policy, &policyOID, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_Equals((PKIX_PL_Object *)policyOID, |
| (PKIX_PL_Object *)constraintOID, |
| &match, |
| plContext)); |
| |
| if (match) { |
| goto cleanup; |
| } |
| PKIX_TEST_DECREF_BC(policy); |
| PKIX_TEST_DECREF_BC(policyOID); |
| } |
| } |
| |
| PKIX_TEST_DECREF_BC(certSelectorContext); |
| PKIX_TEST_DECREF_BC(certPolicies); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_Error_Create(PKIX_CERTSELECTOR_ERROR, |
| NULL, |
| NULL, |
| PKIX_TESTNOMATCHINGPOLICY, |
| &error, |
| plContext)); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(certSelectorContext); |
| PKIX_TEST_DECREF_AC(certPolicies); |
| PKIX_TEST_DECREF_AC(policy); |
| PKIX_TEST_DECREF_AC(policyOID); |
| PKIX_TEST_DECREF_AC(errorDesc); |
| |
| return (error); |
| } |
| |
| static void |
| testSubjectMatch( |
| PKIX_List *certs, |
| PKIX_PL_Cert *certNameToMatch) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *subjParams = NULL; |
| PKIX_PL_X500Name *subjectName = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("Subject name match"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&subjParams, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubject(certNameToMatch, &subjectName, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubject(subjParams, subjectName, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, subjParams, plContext)); |
| testSelector(selector, certs, 0x008); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(subjParams); |
| PKIX_TEST_DECREF_AC(subjectName); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testBasicConstraintsMatch( |
| PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *bcParams = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("Basic Constraints match"); |
| subTest(" pathLenContraint = -2: pass only EE's"); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&bcParams, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(bcParams, -2, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, bcParams, plContext)); |
| testSelector(selector, certs, 0xC00); |
| |
| subTest(" pathLenContraint = -1: pass all certs"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(bcParams, -1, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, bcParams, plContext)); |
| testSelector(selector, certs, 0xFFF); |
| |
| subTest(" pathLenContraint = 1: pass only certs with pathLen >= 1"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(bcParams, 1, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, bcParams, plContext)); |
| testSelector(selector, certs, 0x3DF); |
| |
| subTest(" pathLenContraint = 2: pass only certs with pathLen >= 2"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(bcParams, 2, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, bcParams, plContext)); |
| testSelector(selector, certs, 0x39F); |
| |
| cleanup: |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(bcParams); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void testPolicyMatch( |
| PKIX_List *certs, |
| PKIX_PL_Cert *NIST1Cert, /* a source for policy NIST1 */ |
| PKIX_PL_Cert *NIST2Cert, /* a source for policy NIST2 */ |
| PKIX_PL_Cert *anyPolicyCert) /* a source for policy anyPolicy */ |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_List *emptyList = NULL; /* no members */ |
| PKIX_List *policy1List = NULL; /* OIDs */ |
| PKIX_List *policy2List = NULL; /* OIDs */ |
| PKIX_List *anyPolicyList = NULL; /* OIDs */ |
| PKIX_ComCertSelParams *polParams = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("Policy match"); |
| testGetPolicyFromCert(NIST1Cert, 0, &policy1List); |
| testGetPolicyFromCert(NIST2Cert, 1, &policy2List); |
| testGetPolicyFromCert(anyPolicyCert, 0, &anyPolicyList); |
| |
| subTest(" Pass certs with any CertificatePolicies extension"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&emptyList, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&polParams, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPolicy(polParams, emptyList, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, polParams, plContext)); |
| testSelector(selector, certs, 0xEFF); |
| PKIX_TEST_DECREF_BC(polParams); |
| |
| subTest(" Pass only certs with policy NIST1"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&polParams, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPolicy(polParams, policy1List, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, polParams, plContext)); |
| testSelector(selector, certs, 0xEF5); |
| PKIX_TEST_DECREF_BC(polParams); |
| |
| subTest(" Pass only certs with policy NIST2"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&polParams, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPolicy(polParams, policy2List, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, polParams, plContext)); |
| testSelector(selector, certs, 0x814); |
| PKIX_TEST_DECREF_BC(polParams); |
| |
| subTest(" Pass only certs with policy anyPolicy"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&polParams, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPolicy(polParams, anyPolicyList, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, polParams, plContext)); |
| testSelector(selector, certs, 0x002); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(emptyList); |
| PKIX_TEST_DECREF_AC(policy1List); |
| PKIX_TEST_DECREF_AC(policy2List); |
| PKIX_TEST_DECREF_AC(anyPolicyList); |
| PKIX_TEST_DECREF_AC(polParams); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testCertificateMatch( |
| PKIX_List *certs, |
| PKIX_PL_Cert *certToMatch) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("Certificate match"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetCertificate(params, certToMatch, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| testSelector(selector, certs, 0x008); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(params); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testNameConstraintsMatch(PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| PKIX_PL_Cert *cert = NULL; |
| PKIX_PL_CertNameConstraints *permitNameConstraints1 = NULL; |
| PKIX_PL_CertNameConstraints *permitNameConstraints2 = NULL; |
| PKIX_PL_CertNameConstraints *permitNameConstraints3 = NULL; |
| PKIX_PL_CertNameConstraints *excludeNameConstraints1 = NULL; |
| PKIX_PL_CertNameConstraints *excludeNameConstraints2 = NULL; |
| PKIX_PL_CertNameConstraints *excludeNameConstraints3 = NULL; |
| PKIX_UInt32 numCerts = 0; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test NameConstraints Cert Selector"); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certs, &numCerts, plContext)); |
| |
| subTest(" PKIX_PL_Cert_GetNameConstraints <cert0-permitted>"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 0, (PKIX_PL_Object **)&cert, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &permitNameConstraints1, plContext)); |
| PKIX_TEST_DECREF_BC(cert); |
| |
| subTest(" PKIX_PL_Cert_GetNameConstraints <cert1-permitted>"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 1, (PKIX_PL_Object **)&cert, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &permitNameConstraints2, plContext)); |
| PKIX_TEST_DECREF_BC(cert); |
| |
| subTest(" PKIX_PL_Cert_GetNameConstraints <cert2-permitted>"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 2, (PKIX_PL_Object **)&cert, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &permitNameConstraints3, plContext)); |
| PKIX_TEST_DECREF_BC(cert); |
| |
| subTest(" PKIX_PL_Cert_GetNameConstraints <cert3-excluded>"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 3, (PKIX_PL_Object **)&cert, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &excludeNameConstraints1, plContext)); |
| PKIX_TEST_DECREF_BC(cert); |
| |
| subTest(" PKIX_PL_Cert_GetNameConstraints <cert4-excluded>"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 4, (PKIX_PL_Object **)&cert, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &excludeNameConstraints2, plContext)); |
| PKIX_TEST_DECREF_BC(cert); |
| |
| subTest(" PKIX_PL_Cert_GetNameConstraints <cert5-excluded>"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 5, (PKIX_PL_Object **)&cert, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &excludeNameConstraints3, plContext)); |
| PKIX_TEST_DECREF_BC(cert); |
| |
| subTest(" Create Selector and ComCertSelParams"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" CertNameConstraints testing permitted NONE"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, permitNameConstraints1, plContext)); |
| testSelector(selector, certs, 0x0); |
| |
| subTest(" PKIX_ComCertSelParams_SetNameConstraint Reset"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, NULL, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" CertNameConstraints testing permitted ALL"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, permitNameConstraints2, plContext)); |
| testSelector(selector, certs, 0x07F); |
| |
| subTest(" CertNameConstraints testing permitted TWO"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, permitNameConstraints3, plContext)); |
| testSelector(selector, certs, 0x0041); |
| |
| subTest(" PKIX_ComCertSelParams_SetNameConstraint Reset"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, NULL, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" CertNameConstraints testing excluded"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, excludeNameConstraints1, plContext)); |
| testSelector(selector, certs, 0x07F); |
| |
| subTest(" CertNameConstraints testing excluded"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, excludeNameConstraints2, plContext)); |
| testSelector(selector, certs, 0x07F); |
| |
| subTest(" CertNameConstraints testing excluded"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, excludeNameConstraints3, plContext)); |
| testSelector(selector, certs, 0x41); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(params); |
| PKIX_TEST_DECREF_AC(permitNameConstraints1); |
| PKIX_TEST_DECREF_AC(permitNameConstraints2); |
| PKIX_TEST_DECREF_AC(permitNameConstraints3); |
| PKIX_TEST_DECREF_AC(excludeNameConstraints1); |
| PKIX_TEST_DECREF_AC(excludeNameConstraints2); |
| PKIX_TEST_DECREF_AC(excludeNameConstraints3); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testPathToNamesMatch(PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| PKIX_List *nameList = NULL; |
| PKIX_PL_GeneralName *name = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test PathToName Cert Selector"); |
| |
| subTest(" PKIX_PL_GeneralName List create"); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&nameList, plContext)); |
| |
| subTest(" Add directory name <O=NotATest Certificates,C=US>"); |
| name = createGeneralName(PKIX_DIRECTORY_NAME, |
| "O=NotATest Certificates,C=US", |
| plContext); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); |
| |
| subTest(" Create Selector and ComCertSelParams"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetPathToNames"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); |
| |
| subTest(" Permitting THREE"); |
| testSelector(selector, certs, 0x58); |
| |
| subTest(" Remove directory name <O=NotATest Certificates,C=US...>"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_DeleteItem(nameList, 0, plContext)); |
| PKIX_TEST_DECREF_BC(name); |
| |
| subTest(" PKIX_ComCertSelParams_SetPathToNames Reset"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, NULL, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" Add directory name <OU=permittedSubtree1,O=Test...>"); |
| name = createGeneralName(PKIX_DIRECTORY_NAME, |
| "OU=permittedSubtree1,O=Test Certificates,C=US", |
| plContext); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetPathToNames"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); |
| |
| subTest(" Permitting SIX"); |
| testSelector(selector, certs, 0x5F); |
| |
| subTest(" Remove directory name <OU=permittedSubtree1,O=Test...>"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_DeleteItem(nameList, 0, plContext)); |
| PKIX_TEST_DECREF_BC(name); |
| |
| subTest(" PKIX_ComCertSelParams_SetNameConstraint Reset"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, NULL, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" Add directory name <O=Test Certificates,C=US...>"); |
| name = createGeneralName(PKIX_DIRECTORY_NAME, |
| "O=Test Certificates,C=US", |
| plContext); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); |
| PKIX_TEST_DECREF_BC(name); |
| |
| subTest(" PKIX_ComCertSelParams_SetPathToNames"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); |
| |
| subTest(" Permitting FOUR"); |
| testSelector(selector, certs, 0x47); |
| |
| subTest(" Only directory name <OU=permittedSubtree1,O=Test ...>"); |
| name = createGeneralName(PKIX_DIRECTORY_NAME, |
| "OU=permittedSubtree1,O=Test Certificates,C=US", |
| plContext); |
| |
| subTest(" PKIX_ComCertSelParams_AddPathToName"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_AddPathToName(params, name, plContext)); |
| PKIX_TEST_DECREF_BC(name); |
| |
| subTest(" Permitting FOUR"); |
| testSelector(selector, certs, 0x47); |
| |
| subTest(" PKIX_ComCertSelParams_SetNameConstraint Reset"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, NULL, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| PKIX_TEST_DECREF_BC(nameList); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&nameList, plContext)); |
| |
| subTest(" Add directory name <CN=Valid DN nameConstraints EE...>"); |
| name = createGeneralName(PKIX_DIRECTORY_NAME, "CN=Valid DN nameConstraints EE " |
| "Certificate Test1,OU=permittedSubtree1," |
| "O=Test Certificates,C=US", |
| plContext); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); |
| PKIX_TEST_DECREF_BC(name); |
| |
| subTest(" PKIX_ComCertSelParams_SetPathToNames"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); |
| |
| subTest(" Permitting SIX"); |
| testSelector(selector, certs, 0x7e); |
| |
| subTest(" Add directory name <OU=permittedSubtree1,O=Test>"); |
| name = createGeneralName(PKIX_DIRECTORY_NAME, |
| "OU=permittedSubtree1,O=Test", |
| plContext); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); |
| PKIX_TEST_DECREF_BC(name); |
| |
| subTest(" PKIX_ComCertSelParams_SetPathToNames"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); |
| |
| subTest(" Permitting SIX"); |
| testSelector(selector, certs, 0x58); |
| |
| subTest(" Add directory name <O=Test Certificates,C=US>"); |
| name = createGeneralName(PKIX_DIRECTORY_NAME, "O=Test Certificates,C=US", plContext); |
| |
| subTest(" PKIX_ComCertSelParams_SetPathToNames Reset"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, NULL, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_AddPathToName(params, name, plContext)); |
| PKIX_TEST_DECREF_BC(name); |
| |
| subTest(" Permitting FOUR"); |
| testSelector(selector, certs, 0x47); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(params); |
| PKIX_TEST_DECREF_AC(nameList); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testSubjAltNamesMatch(PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| PKIX_List *nameList = NULL; |
| PKIX_PL_GeneralName *name = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test SubjAltNames Cert Selector"); |
| |
| subTest(" PKIX_PL_GeneralName List create"); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&nameList, plContext)); |
| |
| subTest(" Create Selector and ComCertSelParams"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" Add directory name <CN=Invalid DN nameConstraints EE...>"); |
| name = createGeneralName(PKIX_DIRECTORY_NAME, |
| "CN=Invalid DN nameConstraints EE Certificate Test3," |
| "OU=excludedSubtree1,O=Test Certificates,C=US", |
| plContext); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetSubjAltNames"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubjAltNames(params, nameList, plContext)); |
| |
| PKIX_TEST_DECREF_BC(name); |
| PKIX_TEST_DECREF_BC(nameList); |
| |
| subTest(" Permitting ONE"); |
| testSelector(selector, certs, 0x1); |
| |
| subTest(" Add DNS name <mytestcertificates.gov>"); |
| name = createGeneralName(PKIX_DNS_NAME, |
| "mytestcertificates.gov", |
| plContext); |
| |
| subTest(" PKIX_ComCertSelParams_AddSubjAltName"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_AddSubjAltName(params, name, plContext)); |
| PKIX_TEST_DECREF_BC(name); |
| |
| subTest(" Permitting NONE"); |
| testSelector(selector, certs, 0x0); |
| |
| subTest(" PKIX_ComCertSelParams_SetMatchAllSubjAltNames to FALSE"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetMatchAllSubjAltNames(params, PKIX_FALSE, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" Permitting TWO"); |
| testSelector(selector, certs, 0x3); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(params); |
| PKIX_TEST_DECREF_AC(name); |
| PKIX_TEST_DECREF_AC(nameList); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testCertificateValidMatch( |
| PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| PKIX_PL_String *stringRep = NULL; |
| PKIX_PL_Date *testDate = NULL; |
| char *asciiRep = "050501000000Z"; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("CertificateValid match"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, asciiRep, 0, &stringRep, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Date_Create_UTCTime(stringRep, &testDate, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetCertificateValid(params, testDate, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| testSelector(selector, certs, 0xFFFFFFFF); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(params); |
| PKIX_TEST_DECREF_AC(stringRep); |
| PKIX_TEST_DECREF_AC(testDate); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| test_customCallback1(PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("custom matchCallback"); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(custom_CertSelector_MatchCallback, |
| NULL, |
| &selector, |
| plContext)); |
| |
| testSelector(selector, certs, 0x900); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void test_customCallback2(PKIX_List *certs, |
| PKIX_PL_Cert *anyPolicyCert) /* a source for policy anyPolicy */ |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_List *anyPolicyList = NULL; /* OIDs */ |
| PKIX_PL_OID *policyOID = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("custom matchCallback with CertSelectorContext"); |
| |
| testGetPolicyFromCert(anyPolicyCert, 0, &anyPolicyList); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(anyPolicyList, 0, (PKIX_PL_Object **)&policyOID, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(custom_CertSelector_MatchOIDCallback, |
| (PKIX_PL_Object *)policyOID, |
| &selector, |
| plContext)); |
| |
| testSelector(selector, certs, (1 << ANYPOLICYCERT)); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selector); |
| PKIX_TEST_DECREF_AC(anyPolicyList); |
| PKIX_TEST_DECREF_AC(policyOID); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testExtendedKeyUsageMatch(char *certDir) |
| { |
| PKIX_ComCertSelParams *goodParams = NULL; |
| PKIX_PL_OID *ekuOid = NULL; |
| PKIX_List *ekuOidList = NULL; |
| PKIX_PL_String *dirString = NULL; |
| PKIX_CertStore_CertCallback certCallback; |
| PKIX_CertStore *certStore = NULL; |
| PKIX_CertSelector *certSelector = NULL; |
| PKIX_List *certList = NULL; |
| PKIX_UInt32 numCert = 0; |
| void *nbioContext = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test Extended KeyUsage Cert Selector"); |
| |
| subTest(" PKIX_ComCertSelParams_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); |
| |
| subTest(" Create Extended Key Usage OID List"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&ekuOidList, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_OID_Create("1.3.6.1.5.5.7.3.2", &ekuOid, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(ekuOidList, (PKIX_PL_Object *)ekuOid, plContext)); |
| |
| PKIX_TEST_DECREF_BC(ekuOid); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_OID_Create("1.3.6.1.5.5.7.3.3", &ekuOid, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(ekuOidList, (PKIX_PL_Object *)ekuOid, plContext)); |
| |
| PKIX_TEST_DECREF_BC(ekuOid); |
| |
| subTest(" PKIX_ComCertSelParams_SetExtendedKeyUsage"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetExtendedKeyUsage(goodParams, ekuOidList, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); |
| |
| subTest(" PKIX_PL_CollectionCertStoreContext_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); |
| |
| subTest(" PKIX_CertSelector_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); |
| |
| subTest(" PKIX_CertStore_GetCertCallback"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); |
| |
| subTest(" Getting data from Cert Callback"); |
| PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); |
| |
| if (numCert != PKIX_TEST_CERTSELECTOR_EXTKEYUSAGE_NUM_CERTS) { |
| pkixTestErrorMsg = "unexpected Cert number mismatch"; |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(ekuOid); |
| PKIX_TEST_DECREF_AC(ekuOidList); |
| PKIX_TEST_DECREF_AC(goodParams); |
| PKIX_TEST_DECREF_AC(dirString); |
| PKIX_TEST_DECREF_AC(certList); |
| PKIX_TEST_DECREF_AC(certSelector); |
| PKIX_TEST_DECREF_AC(certStore); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testKeyUsageMatch(char *certDir) |
| { |
| PKIX_ComCertSelParams *goodParams = NULL; |
| PKIX_PL_String *dirString = NULL; |
| PKIX_CertStore_CertCallback certCallback; |
| PKIX_CertStore *certStore = NULL; |
| PKIX_CertSelector *certSelector = NULL; |
| PKIX_List *certList = NULL; |
| PKIX_UInt32 numCert = 0; |
| void *nbioContext = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test KeyUsage Cert Selector"); |
| |
| subTest(" PKIX_ComCertSelParams_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetKeyUsage"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetKeyUsage(goodParams, PKIX_CRL_SIGN, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); |
| |
| subTest(" PKIX_PL_CollectionCertStoreContext_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); |
| |
| subTest(" PKIX_CertSelector_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); |
| |
| subTest(" PKIX_CertStore_GetCertCallback"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); |
| |
| subTest(" Getting data from Cert Callback"); |
| PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); |
| |
| if (numCert != PKIX_TEST_CERTSELECTOR_KEYUSAGE_NUM_CERTS) { |
| pkixTestErrorMsg = "unexpected Cert number mismatch"; |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(goodParams); |
| PKIX_TEST_DECREF_AC(dirString); |
| PKIX_TEST_DECREF_AC(certList); |
| PKIX_TEST_DECREF_AC(certSelector); |
| PKIX_TEST_DECREF_AC(certStore); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testCertValidMatch(char *certDir) |
| { |
| PKIX_ComCertSelParams *goodParams = NULL; |
| PKIX_PL_Date *validDate = NULL; |
| PKIX_PL_String *dirString = NULL; |
| PKIX_CertStore_CertCallback certCallback; |
| PKIX_CertStore *certStore = NULL; |
| PKIX_CertSelector *certSelector = NULL; |
| PKIX_List *certList = NULL; |
| PKIX_UInt32 numCert = 0; |
| void *nbioContext = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test CertValid Cert Selector"); |
| |
| subTest(" PKIX_ComCertSelParams_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); |
| |
| validDate = createDate("050601000000Z", plContext); |
| |
| subTest(" PKIX_ComCertSelParams_SetCertificateValid"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetCertificateValid(goodParams, validDate, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); |
| |
| subTest(" PKIX_PL_CollectionCertStoreContext_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); |
| |
| subTest(" PKIX_CertSelector_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); |
| |
| subTest(" PKIX_CertStore_GetCertCallback"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); |
| |
| subTest(" Getting data from Cert Callback"); |
| PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); |
| |
| if (numCert != PKIX_TEST_CERTSELECTOR_CERTVALID_NUM_CERTS) { |
| pkixTestErrorMsg = "unexpected Cert number mismatch"; |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(goodParams); |
| PKIX_TEST_DECREF_AC(validDate); |
| PKIX_TEST_DECREF_AC(dirString); |
| PKIX_TEST_DECREF_AC(certList); |
| PKIX_TEST_DECREF_AC(certSelector); |
| PKIX_TEST_DECREF_AC(certStore); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testIssuerMatch(char *certDir) |
| { |
| PKIX_ComCertSelParams *goodParams = NULL; |
| PKIX_PL_X500Name *issuer = NULL; |
| PKIX_PL_String *issuerStr = NULL; |
| PKIX_PL_String *dirString = NULL; |
| PKIX_CertStore_CertCallback certCallback; |
| PKIX_CertStore *certStore = NULL; |
| PKIX_CertSelector *certSelector = NULL; |
| PKIX_List *certList = NULL; |
| char *issuerName = "CN=science,O=mit,C=US"; |
| PKIX_UInt32 numCert = 0; |
| void *nbioContext = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test Issuer Cert Selector"); |
| |
| subTest(" PKIX_ComCertSelParams_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, issuerName, 0, &issuerStr, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_X500Name_Create(issuerStr, &issuer, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetIssuer"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetIssuer(goodParams, issuer, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); |
| |
| subTest(" PKIX_PL_CollectionCertStoreContext_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); |
| |
| subTest(" PKIX_CertSelector_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); |
| |
| subTest(" PKIX_CertStore_GetCertCallback"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); |
| |
| subTest(" Getting data from Cert Callback"); |
| PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); |
| |
| if (numCert != PKIX_TEST_CERTSELECTOR_ISSUER_NUM_CERTS) { |
| pkixTestErrorMsg = "unexpected Cert number mismatch"; |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(goodParams); |
| PKIX_TEST_DECREF_AC(issuer); |
| PKIX_TEST_DECREF_AC(issuerStr); |
| PKIX_TEST_DECREF_AC(dirString); |
| PKIX_TEST_DECREF_AC(certList); |
| PKIX_TEST_DECREF_AC(certSelector); |
| PKIX_TEST_DECREF_AC(certStore); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testSerialNumberVersionMatch(char *certDir) |
| { |
| PKIX_ComCertSelParams *goodParams = NULL; |
| PKIX_PL_BigInt *serialNumber = NULL; |
| PKIX_PL_String *serialNumberStr = NULL; |
| PKIX_PL_String *dirString = NULL; |
| PKIX_CertStore_CertCallback certCallback; |
| PKIX_CertStore *certStore = NULL; |
| PKIX_CertSelector *certSelector = NULL; |
| PKIX_List *certList = NULL; |
| PKIX_UInt32 numCert = 0; |
| void *nbioContext = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test Serial Number Cert Selector"); |
| |
| subTest(" PKIX_ComCertSelParams_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, "01", 0, &serialNumberStr, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_BigInt_Create(serialNumberStr, &serialNumber, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetSerialNumber"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSerialNumber(goodParams, serialNumber, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetVersion"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetVersion(goodParams, 0, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); |
| |
| subTest(" PKIX_PL_CollectionCertStoreContext_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); |
| |
| subTest(" PKIX_CertSelector_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); |
| |
| subTest(" PKIX_CertStore_GetCertCallback"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); |
| |
| subTest(" Getting data from Cert Callback"); |
| PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); |
| |
| PKIX_TEST_DECREF_BC(certList); |
| |
| if (numCert != 0) { |
| pkixTestErrorMsg = "unexpected Version mismatch"; |
| } |
| |
| subTest(" PKIX_ComCertSelParams_SetVersion"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetVersion(goodParams, 2, plContext)); |
| |
| subTest(" Getting data from Cert Callback"); |
| PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); |
| |
| if (numCert != PKIX_TEST_CERTSELECTOR_SERIALNUMBER_NUM_CERTS) { |
| pkixTestErrorMsg = "unexpected Serial Number mismatch"; |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(goodParams); |
| PKIX_TEST_DECREF_AC(serialNumber); |
| PKIX_TEST_DECREF_AC(serialNumberStr); |
| PKIX_TEST_DECREF_AC(dirString); |
| PKIX_TEST_DECREF_AC(certList); |
| PKIX_TEST_DECREF_AC(certSelector); |
| PKIX_TEST_DECREF_AC(certStore); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testSubjKeyIdMatch(PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| PKIX_PL_Cert *cert = NULL; |
| PKIX_PL_ByteArray *selSubjKeyId = NULL; |
| PKIX_UInt32 item = 0; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test Subject Key Id Cert Selector"); |
| |
| item = 2; |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, item, (PKIX_PL_Object **)&cert, plContext)); |
| |
| subTest(" PKIX_PL_Cert_GetSubjectKeyIdentifier"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubjectKeyIdentifier(cert, &selSubjKeyId, plContext)); |
| |
| subTest(" Create Selector and ComCertSelParams"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetSubjKeyIdentifier"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubjKeyIdentifier(params, selSubjKeyId, plContext)); |
| |
| subTest(" Select One"); |
| testSelector(selector, certs, 1 << item); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selSubjKeyId); |
| PKIX_TEST_DECREF_AC(cert); |
| PKIX_TEST_DECREF_AC(params); |
| PKIX_TEST_DECREF_AC(selector); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testAuthKeyIdMatch(PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| PKIX_PL_Cert *cert = NULL; |
| PKIX_PL_ByteArray *selAuthKeyId = NULL; |
| PKIX_UInt32 item = 0; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test Auth Key Id Cert Selector"); |
| |
| item = 3; |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, item, (PKIX_PL_Object **)&cert, plContext)); |
| |
| subTest(" PKIX_PL_Cert_GetAuthorityKeyIdentifier"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetAuthorityKeyIdentifier(cert, &selAuthKeyId, plContext)); |
| |
| subTest(" Create Selector and ComCertSelParams"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetAuthorityKeyIdentifier"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetAuthorityKeyIdentifier(params, selAuthKeyId, plContext)); |
| |
| subTest(" Select TWO"); |
| testSelector(selector, certs, (1 << item) | (1 << 1)); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selAuthKeyId); |
| PKIX_TEST_DECREF_AC(cert); |
| PKIX_TEST_DECREF_AC(params); |
| PKIX_TEST_DECREF_AC(selector); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testSubjPKAlgIdMatch(PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| PKIX_PL_Cert *cert = NULL; |
| PKIX_PL_OID *selAlgId = NULL; |
| PKIX_UInt32 item = 0; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test Subject Public Key Algorithm Id Cert Selector"); |
| |
| item = 0; |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, item, (PKIX_PL_Object **)&cert, plContext)); |
| |
| subTest(" PKIX_PL_Cert_GetSubjectPublicKeyAlgId"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubjectPublicKeyAlgId(cert, &selAlgId, plContext)); |
| |
| subTest(" Create Selector and ComCertSelParams"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetSubjPKAlgId"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubjPKAlgId(params, selAlgId, plContext)); |
| |
| subTest(" Select All"); |
| testSelector(selector, certs, 0x7F); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selAlgId); |
| PKIX_TEST_DECREF_AC(cert); |
| PKIX_TEST_DECREF_AC(params); |
| PKIX_TEST_DECREF_AC(selector); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| testSubjPublicKeyMatch(PKIX_List *certs) |
| { |
| PKIX_CertSelector *selector = NULL; |
| PKIX_ComCertSelParams *params = NULL; |
| PKIX_PL_Cert *cert = NULL; |
| PKIX_PL_PublicKey *selPublicKey = NULL; |
| PKIX_UInt32 item = 0; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test Subject Public Key Cert Selector"); |
| |
| item = 5; |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, item, (PKIX_PL_Object **)&cert, plContext)); |
| |
| subTest(" PKIX_PL_Cert_GetSubjectPublicKey"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubjectPublicKey(cert, &selPublicKey, plContext)); |
| |
| subTest(" Create Selector and ComCertSelParams"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); |
| |
| subTest(" PKIX_ComCertSelParams_SetSubjPubKey"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubjPubKey(params, selPublicKey, plContext)); |
| |
| subTest(" Select ONE"); |
| testSelector(selector, certs, 1 << item); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(selPublicKey); |
| PKIX_TEST_DECREF_AC(cert); |
| PKIX_TEST_DECREF_AC(params); |
| PKIX_TEST_DECREF_AC(selector); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| test_CertSelector_Duplicate(PKIX_CertSelector *selector) |
| { |
| PKIX_Int32 goodBasicConstraints = 0; |
| PKIX_Int32 equalBasicConstraints = 0; |
| PKIX_CertSelector *dupSelector = NULL; |
| PKIX_ComCertSelParams *goodParams = NULL; |
| PKIX_ComCertSelParams *equalParams = NULL; |
| PKIX_CertSelector_MatchCallback goodCallback = NULL; |
| PKIX_CertSelector_MatchCallback equalCallback = NULL; |
| PKIX_PL_X500Name *goodSubject = NULL; |
| PKIX_PL_X500Name *equalSubject = NULL; |
| PKIX_List *goodPolicy = NULL; |
| PKIX_List *equalPolicy = NULL; |
| PKIX_PL_Cert *goodCert = NULL; |
| PKIX_PL_Cert *equalCert = NULL; |
| PKIX_PL_Date *goodDate = NULL; |
| PKIX_PL_Date *equalDate = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("test_CertSelector_Duplicate"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_Duplicate((PKIX_PL_Object *)selector, |
| (PKIX_PL_Object **)&dupSelector, |
| plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetCommonCertSelectorParams(selector, &goodParams, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetCommonCertSelectorParams(dupSelector, &equalParams, plContext)); |
| /* There is no equals function, so look at components separately. */ |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetSubject(goodParams, &goodSubject, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetSubject(equalParams, &equalSubject, plContext)); |
| if (goodSubject && equalSubject) { |
| testEqualsHelper((PKIX_PL_Object *)goodSubject, |
| (PKIX_PL_Object *)equalSubject, |
| PKIX_TRUE, |
| plContext); |
| } else { |
| if |
| PKIX_EXACTLY_ONE_NULL(goodSubject, equalSubject) |
| { |
| pkixTestErrorMsg = "Subject Names are not equal!"; |
| goto cleanup; |
| } |
| } |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetPolicy(goodParams, &goodPolicy, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetPolicy(equalParams, &equalPolicy, plContext)); |
| if (goodPolicy && equalPolicy) { |
| testEqualsHelper((PKIX_PL_Object *)goodPolicy, |
| (PKIX_PL_Object *)equalPolicy, |
| PKIX_TRUE, |
| plContext); |
| } else { |
| if |
| PKIX_EXACTLY_ONE_NULL(goodPolicy, equalPolicy) |
| { |
| pkixTestErrorMsg = "Policy Lists are not equal!"; |
| goto cleanup; |
| } |
| } |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetCertificate(goodParams, &goodCert, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetCertificate(equalParams, &equalCert, plContext)); |
| if (goodCert && equalCert) { |
| testEqualsHelper((PKIX_PL_Object *)goodCert, |
| (PKIX_PL_Object *)equalCert, |
| PKIX_TRUE, |
| plContext); |
| } else { |
| if |
| PKIX_EXACTLY_ONE_NULL(goodCert, equalCert) |
| { |
| pkixTestErrorMsg = "Cert Lists are not equal!"; |
| goto cleanup; |
| } |
| } |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetCertificateValid(goodParams, &goodDate, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetCertificateValid(equalParams, &equalDate, plContext)); |
| if (goodCert && equalCert) { |
| testEqualsHelper((PKIX_PL_Object *)goodDate, |
| (PKIX_PL_Object *)equalDate, |
| PKIX_TRUE, |
| plContext); |
| } else { |
| if |
| PKIX_EXACTLY_ONE_NULL(goodDate, equalDate) |
| { |
| pkixTestErrorMsg = "Date Lists are not equal!"; |
| goto cleanup; |
| } |
| } |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetBasicConstraints(goodParams, &goodBasicConstraints, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetBasicConstraints(equalParams, &equalBasicConstraints, plContext)); |
| if (goodBasicConstraints != equalBasicConstraints) { |
| pkixTestErrorMsg = "BasicConstraints are not equal!"; |
| goto cleanup; |
| } |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetMatchCallback(selector, &goodCallback, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetMatchCallback(dupSelector, &equalCallback, plContext)); |
| if (goodCallback != equalCallback) { |
| pkixTestErrorMsg = "MatchCallbacks are not equal!"; |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(dupSelector); |
| PKIX_TEST_DECREF_AC(goodParams); |
| PKIX_TEST_DECREF_AC(equalParams); |
| PKIX_TEST_DECREF_AC(goodSubject); |
| PKIX_TEST_DECREF_AC(equalSubject); |
| PKIX_TEST_DECREF_AC(goodPolicy); |
| PKIX_TEST_DECREF_AC(equalPolicy); |
| PKIX_TEST_DECREF_AC(goodCert); |
| PKIX_TEST_DECREF_AC(equalCert); |
| PKIX_TEST_DECREF_AC(goodDate); |
| PKIX_TEST_DECREF_AC(equalDate); |
| |
| PKIX_TEST_RETURN(); |
| } |
| |
| static void |
| printUsage(void) |
| { |
| (void)printf("\nUSAGE:\ttest_certselector <NIST_FILES_DIR> <cert-dir>\n\n"); |
| } |
| |
| int |
| test_certselector(int argc, char *argv[]) |
| { |
| |
| PKIX_UInt32 i = 0; |
| PKIX_UInt32 j = 0; |
| PKIX_UInt32 actualMinorVersion; |
| |
| PKIX_CertSelector *emptySelector = NULL; |
| PKIX_List *certs = NULL; |
| PKIX_List *nameConstraintsCerts = NULL; |
| PKIX_List *subjAltNamesCerts = NULL; |
| PKIX_PL_Cert *cert = NULL; |
| PKIX_PL_Cert *policy1Cert = NULL; |
| PKIX_PL_Cert *policy2Cert = NULL; |
| PKIX_PL_Cert *anyPolicyCert = NULL; |
| PKIX_PL_Cert *subjectCert = NULL; |
| PKIX_ComCertSelParams *selParams = NULL; |
| char *certDir = NULL; |
| char *dirName = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| startTests("CertSelector"); |
| |
| PKIX_TEST_EXPECT_NO_ERROR( |
| PKIX_PL_NssContext_Create(0, PKIX_FALSE, NULL, &plContext)); |
| |
| if (argc < 3) { |
| printUsage(); |
| return (0); |
| } |
| |
| dirName = argv[j + 1]; |
| certDir = argv[j + 3]; |
| |
| /* Create a List of certs to use in testing the selector */ |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&certs, plContext)); |
| |
| for (i = 0; i < NUMCERTS; i++) { |
| |
| cert = createCert(dirName, certList[i], plContext); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(certs, (PKIX_PL_Object *)cert, plContext)); |
| if (i == POLICY1CERT) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)cert, plContext)); |
| policy1Cert = cert; |
| } |
| if (i == ANYPOLICYCERT) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)cert, plContext)); |
| anyPolicyCert = cert; |
| } |
| if (i == POLICY2CERT) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)cert, plContext)); |
| policy2Cert = cert; |
| } |
| if (i == SUBJECTCERT) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)cert, plContext)); |
| subjectCert = cert; |
| } |
| PKIX_TEST_DECREF_BC(cert); |
| } |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&nameConstraintsCerts, plContext)); |
| |
| for (i = 0; i < NUMNCCERTS; i++) { |
| |
| cert = createCert(dirName, ncCertList[i], plContext); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameConstraintsCerts, |
| (PKIX_PL_Object *)cert, |
| plContext)); |
| |
| PKIX_TEST_DECREF_BC(cert); |
| } |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&subjAltNamesCerts, plContext)); |
| |
| for (i = 0; i < NUMSANCERTS; i++) { |
| |
| cert = createCert(dirName, sanCertList[i], plContext); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(subjAltNamesCerts, |
| (PKIX_PL_Object *)cert, |
| plContext)); |
| |
| PKIX_TEST_DECREF_BC(cert); |
| } |
| |
| subTest("test_CertSelector_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &emptySelector, plContext)); |
| |
| subTest("Default Match, no parameters set"); |
| testSelector(emptySelector, certs, 0xFFFFFFFF); |
| |
| testSubjectMatch(certs, subjectCert); |
| |
| testBasicConstraintsMatch(certs); |
| |
| testPolicyMatch(certs, policy1Cert, policy2Cert, anyPolicyCert); |
| |
| testCertificateMatch(certs, subjectCert); |
| |
| testCertificateValidMatch(certs); |
| |
| subTest("Combination: pass only EE certs that assert some policy"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&selParams, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(selParams, -2, plContext)); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(emptySelector, selParams, plContext)); |
| testSelector(emptySelector, certs, 0xC00); |
| |
| testNameConstraintsMatch(nameConstraintsCerts); |
| |
| testPathToNamesMatch(nameConstraintsCerts); |
| |
| testSubjAltNamesMatch(subjAltNamesCerts); |
| |
| testExtendedKeyUsageMatch(certDir); |
| |
| testKeyUsageMatch(certDir); |
| |
| testIssuerMatch(certDir); |
| |
| testSerialNumberVersionMatch(certDir); |
| |
| testCertValidMatch(certDir); |
| |
| testSubjKeyIdMatch(nameConstraintsCerts); |
| |
| testAuthKeyIdMatch(nameConstraintsCerts); |
| |
| testSubjPKAlgIdMatch(nameConstraintsCerts); |
| |
| testSubjPublicKeyMatch(nameConstraintsCerts); |
| |
| test_CertSelector_Duplicate(emptySelector); |
| |
| test_customCallback1(certs); |
| |
| test_customCallback2(certs, anyPolicyCert); |
| |
| subTest("test_CertSelector_Destroy"); |
| |
| PKIX_TEST_DECREF_BC(emptySelector); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(emptySelector); |
| PKIX_TEST_DECREF_AC(certs); |
| PKIX_TEST_DECREF_AC(cert); |
| PKIX_TEST_DECREF_AC(policy1Cert); |
| PKIX_TEST_DECREF_AC(policy2Cert); |
| PKIX_TEST_DECREF_AC(anyPolicyCert); |
| PKIX_TEST_DECREF_AC(subjectCert); |
| PKIX_TEST_DECREF_AC(selParams); |
| PKIX_TEST_DECREF_AC(nameConstraintsCerts); |
| PKIX_TEST_DECREF_AC(subjAltNamesCerts); |
| |
| PKIX_Shutdown(plContext); |
| |
| PKIX_TEST_RETURN(); |
| |
| endTests("CertSelector"); |
| |
| return (0); |
| } |
