| /* This Source Code Form is subject to the terms of the Mozilla Public |
| * License, v. 2.0. If a copy of the MPL was not distributed with this |
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| /* |
| * test_customcrlchecker.c |
| * |
| * Test Custom CRL Checking |
| * |
| */ |
| |
| #include "testutil.h" |
| #include "testutil_nss.h" |
| |
| #define PKIX_TEST_MAX_CERTS 10 |
| #define PKIX_TEST_COLLECTIONCERTSTORE_NUM_CRLS 5 |
| |
| static void *plContext = NULL; |
| char *dirName = NULL; /* also used in callback */ |
| |
| static void |
| printUsage1(char *pName) |
| { |
| printf("\nUSAGE: %s test-purpose [ENE|EE] ", pName); |
| printf("cert [certs].\n"); |
| } |
| |
| static void |
| printUsageMax(PKIX_UInt32 numCerts) |
| { |
| printf("\nUSAGE ERROR: number of certs %d exceed maximum %d\n", |
| numCerts, PKIX_TEST_MAX_CERTS); |
| } |
| |
| static PKIX_Error * |
| getCRLCallback( |
| PKIX_CertStore *store, |
| PKIX_CRLSelector *crlSelector, |
| void **pNBIOContext, |
| PKIX_List **pCrlList, |
| void *plContext) |
| { |
| char *crlFileNames[] = { "chem.crl", |
| "phys.crl", |
| "prof.crl", |
| "sci.crl", |
| "test.crl", |
| 0 }; |
| PKIX_PL_CRL *crl = NULL; |
| PKIX_List *crlList = NULL; |
| PKIX_UInt32 i = 0; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&crlList, plContext)); |
| |
| while (crlFileNames[i]) { |
| |
| crl = createCRL(dirName, crlFileNames[i++], plContext); |
| |
| if (crl != NULL) { |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(crlList, (PKIX_PL_Object *)crl, plContext)); |
| |
| PKIX_TEST_DECREF_BC(crl); |
| } |
| } |
| |
| *pCrlList = crlList; |
| |
| cleanup: |
| |
| PKIX_TEST_RETURN(); |
| |
| return (0); /* this function is called by libpkix */ |
| } |
| |
| static PKIX_Error * |
| getCRLContinue( |
| PKIX_CertStore *store, |
| PKIX_CRLSelector *crlSelector, |
| void **pNBIOContext, |
| PKIX_List **pCrlList, |
| void *plContext) |
| { |
| return (NULL); |
| } |
| |
| static PKIX_Error * |
| getCertCallback( |
| PKIX_CertStore *store, |
| PKIX_CertSelector *certSelector, |
| void **pNBIOContext, |
| PKIX_List **pCerts, |
| void *plContext) |
| { |
| return (NULL); |
| } |
| |
| static PKIX_Error * |
| getCertContinue( |
| PKIX_CertStore *store, |
| PKIX_CertSelector *certSelector, |
| void **pNBIOContext, |
| PKIX_List **pCerts, |
| void *plContext) |
| { |
| return (NULL); |
| } |
| |
| static PKIX_Error * |
| testCRLSelectorMatchCallback( |
| PKIX_CRLSelector *selector, |
| PKIX_PL_CRL *crl, |
| void *plContext) |
| { |
| PKIX_ComCRLSelParams *comCrlSelParams = NULL; |
| PKIX_List *issuerList = NULL; |
| PKIX_PL_X500Name *issuer = NULL; |
| PKIX_PL_X500Name *crlIssuer = NULL; |
| PKIX_UInt32 numIssuers = 0; |
| PKIX_UInt32 i = 0; |
| PKIX_Boolean result = PKIX_FALSE; |
| PKIX_Error *error = NULL; |
| char *errorText = "Not an error, CRL Select mismatch"; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("Custom_Selector_MatchCallback"); |
| |
| if (selector != NULL) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_GetCommonCRLSelectorParams(selector, &comCrlSelParams, plContext)); |
| } |
| |
| if (crl != NULL) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CRL_GetIssuer(crl, &crlIssuer, plContext)); |
| } |
| |
| if (comCrlSelParams != NULL) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_GetIssuerNames(comCrlSelParams, &issuerList, plContext)); |
| } |
| |
| if (issuerList != NULL) { |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(issuerList, &numIssuers, plContext)); |
| |
| for (i = 0; i < numIssuers; i++) { |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(issuerList, |
| i, (PKIX_PL_Object **)&issuer, |
| plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_Equals((PKIX_PL_Object *)crlIssuer, |
| (PKIX_PL_Object *)issuer, |
| &result, |
| plContext)); |
| |
| if (result != PKIX_TRUE) { |
| break; |
| } |
| |
| if (i == numIssuers - 1) { |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_Error_Create(0, |
| NULL, |
| NULL, |
| PKIX_TESTNOTANERRORCRLSELECTMISMATCH, |
| &error, |
| plContext)); |
| |
| PKIX_TEST_DECREF_AC(issuer); |
| issuer = NULL; |
| break; |
| } |
| |
| PKIX_TEST_DECREF_AC(issuer); |
| } |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(comCrlSelParams); |
| PKIX_TEST_DECREF_AC(crlIssuer); |
| PKIX_TEST_DECREF_AC(issuer); |
| PKIX_TEST_DECREF_AC(issuerList); |
| |
| PKIX_TEST_RETURN(); |
| |
| return (error); |
| } |
| |
| static PKIX_Error * |
| testAddIssuerName(PKIX_ComCRLSelParams *comCrlSelParams, char *issuerName) |
| { |
| PKIX_PL_String *issuerString = NULL; |
| PKIX_PL_X500Name *issuer = NULL; |
| PKIX_UInt32 length = 0; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("PKIX_ComCRLSelParams_AddIssuerName"); |
| |
| length = PL_strlen(issuerName); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_UTF8, |
| issuerName, |
| length, |
| &issuerString, |
| plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_X500Name_Create(issuerString, |
| &issuer, |
| plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_AddIssuerName(comCrlSelParams, issuer, plContext)); |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(issuerString); |
| PKIX_TEST_DECREF_AC(issuer); |
| |
| PKIX_TEST_RETURN(); |
| |
| return (0); |
| } |
| |
| static PKIX_Error * |
| testCustomCertStore(PKIX_ValidateParams *valParams) |
| { |
| PKIX_CertStore_CRLCallback crlCallback; |
| PKIX_CertStore *certStore = NULL; |
| PKIX_ProcessingParams *procParams = NULL; |
| char *issuerName1 = "cn=science,o=mit,c=us"; |
| char *issuerName2 = "cn=physics,o=mit,c=us"; |
| char *issuerName3 = "cn=prof noall,o=mit,c=us"; |
| char *issuerName4 = "cn=testing CRL,o=test,c=us"; |
| PKIX_ComCRLSelParams *comCrlSelParams = NULL; |
| PKIX_CRLSelector *crlSelector = NULL; |
| PKIX_List *crlList = NULL; |
| PKIX_UInt32 numCrl = 0; |
| void *nbioContext = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| subTest("PKIX_PL_CollectionCertStore_Create"); |
| |
| /* Create CRLSelector, link in CollectionCertStore */ |
| |
| subTest("PKIX_ComCRLSelParams_AddIssuerNames"); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_Create(&comCrlSelParams, plContext)); |
| |
| testAddIssuerName(comCrlSelParams, issuerName1); |
| testAddIssuerName(comCrlSelParams, issuerName2); |
| testAddIssuerName(comCrlSelParams, issuerName3); |
| testAddIssuerName(comCrlSelParams, issuerName4); |
| |
| subTest("PKIX_CRLSelector_SetCommonCRLSelectorParams"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create(testCRLSelectorMatchCallback, |
| NULL, |
| &crlSelector, |
| plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_SetCommonCRLSelectorParams(crlSelector, comCrlSelParams, plContext)); |
| |
| /* Create CertStore, link in CRLSelector */ |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ValidateParams_GetProcessingParams(valParams, &procParams, plContext)); |
| |
| subTest("PKIX_CertStore_Create"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_Create(getCertCallback, |
| getCRLCallback, |
| getCertContinue, |
| getCRLContinue, |
| NULL, /* trustCallback */ |
| (PKIX_PL_Object *)crlSelector, /* fake */ |
| PKIX_FALSE, /* cacheFlag */ |
| PKIX_TRUE, /* localFlag */ |
| &certStore, |
| plContext)); |
| |
| subTest("PKIX_ProcessingParams_AddCertStore"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_AddCertStore(procParams, certStore, plContext)); |
| |
| subTest("PKIX_ProcessingParams_SetRevocationEnabled"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_SetRevocationEnabled(procParams, PKIX_TRUE, plContext)); |
| |
| subTest("PKIX_CertStore_GetCRLCallback"); |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCRLCallback(certStore, |
| &crlCallback, |
| NULL)); |
| |
| subTest("Getting CRL by CRL Callback"); |
| PKIX_TEST_EXPECT_NO_ERROR(crlCallback(certStore, |
| crlSelector, |
| &nbioContext, |
| &crlList, |
| plContext)); |
| |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(crlList, |
| &numCrl, |
| plContext)); |
| |
| if (numCrl != PKIX_TEST_COLLECTIONCERTSTORE_NUM_CRLS) { |
| pkixTestErrorMsg = "unexpected CRL number mismatch"; |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(crlList); |
| PKIX_TEST_DECREF_AC(comCrlSelParams); |
| PKIX_TEST_DECREF_AC(crlSelector); |
| PKIX_TEST_DECREF_AC(procParams); |
| PKIX_TEST_DECREF_AC(certStore); |
| |
| PKIX_TEST_RETURN(); |
| |
| return (0); |
| } |
| |
| /* |
| * Validate Certificate Chain with Certificate Revocation List |
| * Certificate Chain is built based on input certs' sequence. |
| * CRL is fetched from the directory specified in CollectionCertStore. |
| * while CollectionCertStore is linked in CertStore Object which then |
| * linked in ProcessParam. During validation, CRLChecker will invoke |
| * the crlCallback (this test uses PKIX_PL_CollectionCertStore_GetCRL) |
| * to get CRL data for revocation check. |
| * This test set criteria in CRLSelector which is linked in |
| * CommonCRLSelectorParam. When CRL data is fetched into cache for |
| * revocation check, CRL's are filtered based on the criteria set. |
| */ |
| |
| int |
| test_customcrlchecker(int argc, char *argv[]) |
| { |
| |
| PKIX_List *chain = NULL; |
| PKIX_ValidateParams *valParams = NULL; |
| PKIX_ValidateResult *valResult = NULL; |
| PKIX_UInt32 actualMinorVersion; |
| char *certNames[PKIX_TEST_MAX_CERTS]; |
| PKIX_PL_Cert *certs[PKIX_TEST_MAX_CERTS]; |
| PKIX_VerifyNode *verifyTree = NULL; |
| PKIX_PL_String *verifyString = NULL; |
| PKIX_UInt32 chainLength = 0; |
| PKIX_UInt32 i = 0; |
| PKIX_UInt32 j = 0; |
| PKIX_Boolean testValid = PKIX_TRUE; |
| char *anchorName = NULL; |
| |
| PKIX_TEST_STD_VARS(); |
| |
| if (argc < 5) { |
| printUsage1(argv[0]); |
| return (0); |
| } |
| |
| startTests("CRL Checker"); |
| |
| PKIX_TEST_EXPECT_NO_ERROR( |
| PKIX_PL_NssContext_Create(0, PKIX_FALSE, NULL, &plContext)); |
| |
| /* ENE = expect no error; EE = expect error */ |
| if (PORT_Strcmp(argv[2 + j], "ENE") == 0) { |
| testValid = PKIX_TRUE; |
| } else if (PORT_Strcmp(argv[2 + j], "EE") == 0) { |
| testValid = PKIX_FALSE; |
| } else { |
| printUsage1(argv[0]); |
| return (0); |
| } |
| |
| chainLength = (argc - j) - 5; |
| if (chainLength > PKIX_TEST_MAX_CERTS) { |
| printUsageMax(chainLength); |
| } |
| |
| for (i = 0; i < chainLength; i++) { |
| |
| certNames[i] = argv[(5 + j) + i]; |
| certs[i] = NULL; |
| } |
| |
| dirName = argv[3 + j]; |
| |
| subTest(argv[1 + j]); |
| |
| subTest("Custom-CRL-Checker - Create Cert Chain"); |
| |
| chain = createCertChainPlus(dirName, certNames, certs, chainLength, plContext); |
| |
| subTest("Custom-CRL-Checker - Create Params"); |
| |
| anchorName = argv[4 + j]; |
| |
| valParams = createValidateParams(dirName, |
| anchorName, |
| NULL, |
| NULL, |
| NULL, |
| PKIX_FALSE, |
| PKIX_FALSE, |
| PKIX_FALSE, |
| PKIX_FALSE, |
| chain, |
| plContext); |
| |
| subTest("Custom-CRL-Checker - Set Processing Params for CertStore"); |
| |
| testCustomCertStore(valParams); |
| |
| subTest("Custom-CRL-Checker - Validate Chain"); |
| |
| if (testValid == PKIX_TRUE) { |
| PKIX_TEST_EXPECT_NO_ERROR(PKIX_ValidateChain(valParams, &valResult, &verifyTree, plContext)); |
| } else { |
| PKIX_TEST_EXPECT_ERROR(PKIX_ValidateChain(valParams, &valResult, &verifyTree, plContext)); |
| } |
| |
| cleanup: |
| |
| PKIX_TEST_DECREF_AC(verifyString); |
| PKIX_TEST_DECREF_AC(verifyTree); |
| PKIX_TEST_DECREF_AC(chain); |
| PKIX_TEST_DECREF_AC(valParams); |
| PKIX_TEST_DECREF_AC(valResult); |
| |
| PKIX_Shutdown(plContext); |
| |
| PKIX_TEST_RETURN(); |
| |
| endTests("CRL Checker"); |
| |
| return (0); |
| } |
