| /* |
| * |
| * Copyright (c) 2013-2017 Nest Labs, Inc. |
| * All rights reserved. |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| /** |
| * @file |
| * Unit tests for Weave certificate functionality. |
| * |
| */ |
| |
| #include "ToolCommon.h" |
| #include <Weave/Core/WeaveCore.h> |
| #include <Weave/Core/WeaveTLV.h> |
| #include <Weave/Profiles/security/WeaveSecurity.h> |
| #include <Weave/Profiles/security/WeaveCert.h> |
| |
| #include "TestWeaveCertData.h" |
| |
| using namespace nl::Weave::TLV; |
| using namespace nl::Weave::Profiles::Security; |
| using namespace nl::Weave::ASN1; |
| |
| using namespace nl::TestCerts; |
| |
| #define VerifyOrFail(TST, MSG, ...) \ |
| do { \ |
| if (!(TST)) \ |
| { \ |
| fprintf(stderr, "%s FAILED: ", __FUNCTION__); \ |
| fprintf(stderr, MSG, ## __VA_ARGS__); \ |
| fputs("\n", stderr); \ |
| exit(-1); \ |
| } \ |
| } while (0) |
| |
| |
| #define SuccessOrFail(ERR, MSG, ...) \ |
| do { \ |
| if ((ERR) != WEAVE_NO_ERROR) \ |
| { \ |
| fprintf(stderr, "%s FAILED: ", __FUNCTION__); \ |
| fprintf(stderr, MSG, ## __VA_ARGS__); \ |
| fputs(": ", stderr); \ |
| fputs(ErrorStr(ERR), stderr); \ |
| fputs("\n", stderr); \ |
| exit(-1); \ |
| } \ |
| } while (0) |
| |
| |
| enum { |
| kStandardCertsCount = 3 |
| }; |
| |
| static void LoadStandardCerts(WeaveCertificateSet& certSet) |
| { |
| LoadTestCert(certSet, kTestCert_Root | kDecodeFlag_IsTrusted); |
| LoadTestCert(certSet, kTestCert_CA | kDecodeFlag_GenerateTBSHash); |
| LoadTestCert(certSet, kTestCert_Dev | kDecodeFlag_GenerateTBSHash); |
| } |
| |
| void SetEffectiveTime(ValidationContext& validContext, uint16_t year, uint8_t mon, uint8_t day, uint8_t hour = 0, uint8_t min = 0, uint8_t sec = 0) |
| { |
| WEAVE_ERROR err; |
| ASN1UniversalTime effectiveTime; |
| |
| effectiveTime.Year = year; |
| effectiveTime.Month = mon; |
| effectiveTime.Day = day; |
| effectiveTime.Hour = hour; |
| effectiveTime.Minute = min; |
| effectiveTime.Second = sec; |
| err = PackCertTime(effectiveTime, validContext.EffectiveTime); |
| SuccessOrFail(err, "PackCertTime() returned error"); |
| } |
| |
| void WeaveCertTest_WeaveToX509() |
| { |
| WEAVE_ERROR err; |
| const uint8_t *inCert; |
| size_t inCertLen; |
| const uint8_t *expectedOutCert; |
| size_t expectedOutCertLen; |
| uint8_t outCertBuf[kTestCertBufSize]; |
| uint32_t outCertLen; |
| |
| for (size_t i = 0; i < gNumTestCerts; i++) |
| { |
| int certSelector = gTestCerts[i]; |
| |
| GetTestCert(certSelector, inCert, inCertLen); |
| GetTestCert(certSelector | kTestCertLoadFlag_DERForm, expectedOutCert, expectedOutCertLen); |
| |
| err = ConvertWeaveCertToX509Cert(inCert, inCertLen, outCertBuf, sizeof(outCertBuf), outCertLen); |
| SuccessOrFail(err, "%s Certificate: ConvertWeaveCertToX509Cert() returned error", GetTestCertName(certSelector)); |
| VerifyOrFail(outCertLen == expectedOutCertLen, "%s Certificate: ConvertWeaveCertToX509Cert() returned incorrect length", GetTestCertName(certSelector)); |
| VerifyOrFail(memcmp(outCertBuf, expectedOutCert, outCertLen) == 0, "%s Certificate: ConvertWeaveCertToX509Cert() returned incorrect certificate data", GetTestCertName(certSelector)); |
| } |
| |
| printf("%s passed\n", __FUNCTION__); |
| } |
| |
| void WeaveCertTest_X509ToWeave() |
| { |
| WEAVE_ERROR err; |
| const uint8_t *inCert; |
| size_t inCertLen; |
| const uint8_t *expectedOutCert; |
| size_t expectedOutCertLen; |
| uint8_t outCertBuf[kTestCertBufSize]; |
| uint32_t outCertLen; |
| |
| for (size_t i = 0; i < gNumTestCerts; i++) |
| { |
| int certSelector = gTestCerts[i]; |
| |
| GetTestCert(certSelector | kTestCertLoadFlag_DERForm, inCert, inCertLen); |
| GetTestCert(certSelector, expectedOutCert, expectedOutCertLen); |
| |
| err = ConvertX509CertToWeaveCert(inCert, inCertLen, outCertBuf, sizeof(outCertBuf), outCertLen); |
| SuccessOrFail(err, "Certificate Type %d: ConvertX509CertToWeaveCert() returned error", certSelector); |
| VerifyOrFail(outCertLen == expectedOutCertLen, "Certificate Type %d: ConvertX509CertToWeaveCert() returned incorrect length", certSelector); |
| VerifyOrFail(memcmp(outCertBuf, expectedOutCert, outCertLen) == 0, "Certificate Type %d: ConvertX509CertToWeaveCert() returned incorrect certificate data", certSelector); |
| } |
| |
| printf("%s passed\n", __FUNCTION__); |
| } |
| |
| void WeaveCertTest_CertValidation() |
| { |
| WEAVE_ERROR err; |
| WeaveCertificateSet certSet; |
| ValidationContext validContext; |
| enum { kMaxCertsPerTestCase = 10 }; |
| |
| struct ValidationTestCase |
| { |
| int SubjectCertIndex; |
| uint16_t ValidateFlags; |
| uint8_t RequiredCertType; |
| WEAVE_ERROR ExpectedResult; |
| int ExpectedCertIndex; |
| int ExpectedTrustAnchorIndex; |
| int InputCerts[kMaxCertsPerTestCase]; |
| }; |
| |
| enum |
| { |
| // Short-hand names to make the test cases table more concise. |
| Root = kTestCert_Root, |
| RootKey = kTestCert_RootKey, |
| RootSHA256 = kTestCert_Root_SHA256, |
| CA = kTestCert_CA, |
| CASHA256 = kTestCert_CA_SHA256, |
| Dev = kTestCert_Dev, |
| DevSHA256 = kTestCert_Dev_SHA256, |
| SelfSigned = kTestCert_SelfSigned, |
| SelfSigned256 = kTestCert_SelfSigned_SHA256, |
| ReqSHA256 = kValidateFlag_RequireSHA256, |
| IsTrusted = kDecodeFlag_IsTrusted, |
| GenTBSHash = kDecodeFlag_GenerateTBSHash, |
| SupIsCA = kTestCertLoadFlag_SuppressIsCA, |
| SupKeyUsage = kTestCertLoadFlag_SuppressKeyUsage, |
| SupKeyCertSign = kTestCertLoadFlag_SuppressKeyCertSign, |
| SetPathLenZero = kTestCertLoadFlag_SetPathLenConstZero, |
| SetAppDefinedCertType = kTestCertLoadFlag_SetAppDefinedCertType, |
| CTNS = kCertType_NotSpecified, |
| CTGen = kCertType_General, |
| CTDev = kCertType_Device, |
| CTSE = kCertType_ServiceEndpoint, |
| CTAT = kCertType_AccessToken, |
| CTCA = kCertType_CA, |
| CTAD = kCertType_AppDefinedBase, |
| }; |
| |
| static const ValidationTestCase sValidationTestCases[] = |
| { |
| // Reqd |
| // Subject Valid Cert Expected Expected Input |
| // Index Flags Type Expected Result Cert Index TA Index Input Certs Cert Flags |
| // ============================================================================================================== |
| |
| // Basic validation of leaf certificate with different load orders. |
| { 2, 0, CTNS, WEAVE_NO_ERROR, 2, 0, { Root | IsTrusted, |
| CA | GenTBSHash, |
| Dev | GenTBSHash } }, |
| { 1, 0, CTNS, WEAVE_NO_ERROR, 1, 0, { Root | IsTrusted, |
| Dev | GenTBSHash, |
| CA | GenTBSHash } }, |
| { 0, 0, CTNS, WEAVE_NO_ERROR, 0, 2, { Dev | GenTBSHash, |
| CA | GenTBSHash, |
| Root | IsTrusted } }, |
| |
| // Validation of leaf certificate with root key only. |
| { 1, 0, CTNS, WEAVE_NO_ERROR, 1, 0, { RootKey, |
| Dev | GenTBSHash, |
| CA | GenTBSHash } }, |
| |
| // Validation of trusted self-signed certificate. |
| { 0, 0, CTNS, WEAVE_NO_ERROR, 0, 0, { SelfSigned | IsTrusted | GenTBSHash } }, |
| |
| // Validation of trusted self-signed certificate in presence of trusted root and CA. |
| { 2, 0, CTNS, WEAVE_NO_ERROR, 2, 2, { Root | IsTrusted, |
| CA | GenTBSHash, |
| SelfSigned | IsTrusted | GenTBSHash } }, |
| |
| // Validation of self-signed certificate in presence of trusted copy of same certificate and |
| // an unrelated trusted root certificate. |
| { 1, 0, CTNS, WEAVE_NO_ERROR, 2, 2, { Root | IsTrusted, |
| SelfSigned | GenTBSHash, |
| SelfSigned | IsTrusted | GenTBSHash } }, |
| |
| // Validation with two copies of root certificate, one trusted, one untrusted. |
| { 2, 0, CTNS, WEAVE_NO_ERROR, 2, 1, { Root, |
| Root | IsTrusted, |
| Dev | GenTBSHash, |
| CA | GenTBSHash } }, |
| |
| // Validation with trusted root key and trusted root certificate. |
| { 2, 0, CTNS, WEAVE_NO_ERROR, 2, 0, { RootKey, |
| Root | IsTrusted, |
| Dev | GenTBSHash, |
| CA | GenTBSHash } }, |
| |
| // Validation with trusted root key and untrusted root certificate. |
| { 3, 0, CTNS, WEAVE_NO_ERROR, 3, 1, { Root, |
| RootKey, |
| CA | GenTBSHash, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to missing CA certificate. |
| { 1, 0, CTNS, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { Root | IsTrusted, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to missing root certificate. |
| { 1, 0, CTNS, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { CA | GenTBSHash, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to lack of TBS hash. |
| { 1, 0, CTNS, WEAVE_ERROR_INVALID_ARGUMENT, -1, -1, { Root | IsTrusted, |
| Dev, |
| CA | GenTBSHash } }, |
| |
| // Failure due to untrusted root. |
| { 1, 0, CTNS, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { Root, |
| Dev | GenTBSHash, |
| CA | GenTBSHash } }, |
| |
| // Failure of untrusted self-signed certificate. |
| { 0, 0, CTNS, WEAVE_ERROR_CERT_NOT_TRUSTED, -1, -1, { SelfSigned | GenTBSHash } }, |
| |
| // Failure of untrusted self-signed certificate in presence of trusted root and CA. |
| { 2, 0, CTNS, WEAVE_ERROR_CERT_NOT_TRUSTED, -1, -1, { Root | IsTrusted, |
| CA | GenTBSHash, |
| SelfSigned | GenTBSHash } }, |
| |
| // Failure due to intermediate cert with isCA flag = false |
| { 2, 0, CTNS, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { Root | IsTrusted, |
| CA | GenTBSHash | SupIsCA, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to CA cert with no key usage. |
| { 2, 0, CTNS, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { Root | IsTrusted, |
| CA | GenTBSHash | SupKeyUsage, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to CA cert with no cert sign key usage. |
| { 2, 0, CTNS, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { Root | IsTrusted, |
| CA | GenTBSHash | SupKeyCertSign, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to 3-level deep cert chain and root cert with path constraint == 0 |
| { 2, 0, CTNS, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { Root | IsTrusted | SetPathLenZero, |
| CA | GenTBSHash, |
| Dev | GenTBSHash } }, |
| |
| // Basic validation of SHA-256 certificates. |
| { 2, 0, CTNS, WEAVE_NO_ERROR, 2, 0, { RootSHA256 | IsTrusted, |
| CASHA256 | GenTBSHash, |
| DevSHA256 | GenTBSHash } }, |
| { 1, 0, CTNS, WEAVE_NO_ERROR, 1, 0, { RootSHA256 | IsTrusted, |
| DevSHA256 | GenTBSHash, |
| CASHA256 | GenTBSHash } }, |
| { 0, 0, CTNS, WEAVE_NO_ERROR, 0, 2, { DevSHA256 | GenTBSHash, |
| CASHA256 | GenTBSHash, |
| RootSHA256 | IsTrusted } }, |
| |
| // Validation of trusted self-signed SHA-256 certificate. |
| { 0, 0, CTNS, WEAVE_NO_ERROR, 0, 0, { SelfSigned256 | IsTrusted | GenTBSHash } }, |
| |
| // Validation of SHA-256 certificates with root key only. |
| { 1, 0, CTNS, WEAVE_NO_ERROR, 1, 0, { RootKey, |
| DevSHA256 | GenTBSHash, |
| CASHA256 | GenTBSHash } }, |
| |
| // Validation of SHA-256 CA and leaf certificates with SHA-1 root. |
| { 2, 0, CTNS, WEAVE_NO_ERROR, 2, 0, { Root | IsTrusted, |
| CASHA256 | GenTBSHash, |
| DevSHA256 | GenTBSHash } }, |
| |
| // Validation of SHA-1 leaf certificate with SHA-256 CA and root. |
| { 2, 0, CTNS, WEAVE_NO_ERROR, 2, 0, { RootSHA256 | IsTrusted, |
| CASHA256 | GenTBSHash, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to lack of SHA-256 CA certificate with SHA-256 leaf certificate. |
| { 2, 0, CTNS, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { RootSHA256 | IsTrusted, |
| CA | GenTBSHash, |
| DevSHA256 | GenTBSHash } }, |
| |
| // Validation of SHA-256 leaf certificate in presence of SHA-1 and SHA-256 CA certificates. |
| { 1, 0, CTNS, WEAVE_NO_ERROR, 1, 0, { RootSHA256 | IsTrusted, |
| DevSHA256 | GenTBSHash, |
| CASHA256 | GenTBSHash, |
| CA | GenTBSHash } }, |
| |
| // Validation of SHA-1 leaf certificate in presence of SHA-1 and SHA-256 CA certificates. |
| { 0, 0, CTNS, WEAVE_NO_ERROR, 0, 1, { Dev | GenTBSHash, |
| RootSHA256 | IsTrusted, |
| CASHA256 | GenTBSHash, |
| CA | GenTBSHash } }, |
| |
| // Validation of self-signed SHA-256 certificate in presence of trusted copy of SHA-1 version of |
| // the same certificate and an unrelated trusted root certificate. |
| { 1, 0, CTNS, WEAVE_NO_ERROR, 2, 2, { Root | IsTrusted, |
| SelfSigned256 | GenTBSHash, |
| SelfSigned | IsTrusted | GenTBSHash } }, |
| |
| // Failure due to RequireSHA256 flag set and only SHA-1 leaf certificate present. |
| { 2, ReqSHA256, CTNS, WEAVE_ERROR_WRONG_CERT_SIGNATURE_ALGORITHM, |
| -1, -1, { RootSHA256 | IsTrusted, |
| CASHA256 | GenTBSHash, |
| Dev | GenTBSHash } }, |
| |
| // Require a specific certificate type. |
| { 2, 0, CTDev, WEAVE_NO_ERROR, 2, 0, { Root | IsTrusted, |
| CA | GenTBSHash, |
| Dev | GenTBSHash } }, |
| |
| // Require a certificate with an application-defined type. |
| { 2, 0, CTAD, WEAVE_NO_ERROR, 2, 0, { Root | IsTrusted, |
| CA | GenTBSHash, |
| Dev | GenTBSHash | SetAppDefinedCertType } }, |
| |
| // Select between two identical certificates with different types. |
| { 2, 0, CTAD, WEAVE_NO_ERROR, 3, 0, { Root | IsTrusted, |
| CA | GenTBSHash, |
| Dev | GenTBSHash, |
| Dev | GenTBSHash | SetAppDefinedCertType } }, |
| |
| // Failure due to required certificate type not found. |
| { 2, 0, CTSE, WEAVE_ERROR_WRONG_CERT_TYPE, -1, -1, { Root | IsTrusted, |
| CA | GenTBSHash, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to CA certificate having wrong type. |
| { 2, 0, CTDev, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { Root | IsTrusted, |
| CA | GenTBSHash | SetAppDefinedCertType, |
| Dev | GenTBSHash } }, |
| |
| // Failure due to root certificate having wrong type. |
| { 2, 0, CTDev, WEAVE_ERROR_CA_CERT_NOT_FOUND, -1, -1, { Root | IsTrusted | SetAppDefinedCertType, |
| CA | GenTBSHash, |
| Dev | GenTBSHash } }, |
| }; |
| static const size_t sNumValidationTestCases = sizeof(sValidationTestCases) / sizeof(sValidationTestCases[0]); |
| |
| for (unsigned i = 0; i < sNumValidationTestCases; i++) |
| { |
| WeaveCertificateData *resultCert = NULL; |
| const ValidationTestCase& testCase = sValidationTestCases[i]; |
| |
| // Initialize the certificate set and load the specified test certificates. |
| certSet.Init(kMaxCertsPerTestCase, kTestCertBufSize); |
| for (size_t i2 = 0; i2 < kMaxCertsPerTestCase; i2++) |
| if (testCase.InputCerts[i2] != 0) |
| LoadTestCert(certSet, testCase.InputCerts[i2]); |
| |
| // Make sure the test case is valid. |
| VerifyOrFail(testCase.SubjectCertIndex >= 0 && testCase.SubjectCertIndex < certSet.CertCount, |
| "INVALID TEST CASE: SubjectCertIndex value out of range in test case %u", i); |
| if (testCase.ExpectedResult == WEAVE_NO_ERROR) |
| { |
| VerifyOrFail(testCase.ExpectedCertIndex >= 0 && testCase.ExpectedCertIndex < certSet.CertCount, |
| "INVALID TEST CASE: ExpectedCertIndex value out of range in test case %u", i); |
| VerifyOrFail(testCase.ExpectedTrustAnchorIndex >= 0 && testCase.ExpectedTrustAnchorIndex < certSet.CertCount, |
| "INVALID TEST CASE: ExpectedTrustAnchorIndex value out of range in test case %u", i); |
| } |
| |
| // Initialize the validation context. |
| memset(&validContext, 0, sizeof(validContext)); |
| SetEffectiveTime(validContext, 2016, 5, 3); |
| validContext.ValidateFlags = testCase.ValidateFlags; |
| validContext.RequiredKeyUsages = kKeyUsageFlag_DigitalSignature; |
| validContext.RequiredKeyPurposes = kKeyPurposeFlag_ServerAuth; |
| validContext.RequiredCertType = testCase.RequiredCertType; |
| |
| // Locate the subject DN and key id that will be used as input the FindValidCert() method. |
| const WeaveDN& subjectDN = certSet.Certs[testCase.SubjectCertIndex].SubjectDN; |
| const CertificateKeyId& subjectKeyId = certSet.Certs[testCase.SubjectCertIndex].SubjectKeyId; |
| |
| // Invoke the FindValidCert() method (the method being tested). |
| err = certSet.FindValidCert(subjectDN, subjectKeyId, validContext, resultCert); |
| VerifyOrFail(err == testCase.ExpectedResult, "Test Case %u: Unexpected return value from FindValidCert(): err = %d", i, err); |
| |
| // If the test case is expected to be successful... |
| if (err == WEAVE_NO_ERROR) |
| { |
| // Verify that the method found the correct certificate. |
| VerifyOrFail(resultCert == &certSet.Certs[testCase.ExpectedCertIndex], "Test Case %u: Unexpected certificate returned from FindValidCert()", i); |
| |
| // Verify that the method selected the correct trust anchor. |
| VerifyOrFail(validContext.TrustAnchor == &certSet.Certs[testCase.ExpectedTrustAnchorIndex], "Test Case %u: Unexpected TrustAnchor returned from FindValidCert()", i); |
| } |
| |
| // Clear the certificate set. |
| certSet.Release(); |
| } |
| |
| printf("%s passed\n", __FUNCTION__); |
| } |
| |
| void WeaveCertTest_CertValidTime() |
| { |
| WEAVE_ERROR err; |
| WeaveCertificateSet certSet; |
| ValidationContext validContext; |
| |
| certSet.Init(kStandardCertsCount, kTestCertBufSize); |
| |
| LoadStandardCerts(certSet); |
| |
| memset(&validContext, 0, sizeof(validContext)); |
| validContext.RequiredKeyUsages = kKeyUsageFlag_DigitalSignature; |
| validContext.RequiredKeyPurposes = kKeyPurposeFlag_ServerAuth; |
| |
| // Before certificate validity period. |
| SetEffectiveTime(validContext, 2010, 1, 3); |
| err = certSet.ValidateCert(certSet.Certs[certSet.CertCount - 1], validContext); |
| VerifyOrFail(err == WEAVE_ERROR_CERT_NOT_VALID_YET, "Unexpected result from ValidateCert()"); |
| |
| // 1 second before validity period. |
| SetEffectiveTime(validContext, 2016, 4, 23, 23, 59, 59); |
| err = certSet.ValidateCert(certSet.Certs[certSet.CertCount - 1], validContext); |
| VerifyOrFail(err == WEAVE_ERROR_CERT_NOT_VALID_YET, "Unexpected result from ValidateCert()"); |
| |
| // 1st second of 1st day of validity period. |
| // NOTE: the given time is technically outside the stated certificate validity period, which starts mid-day. |
| // However for simplicity's sake, the Weave cert validation algorithm rounds the validity period to whole days. |
| SetEffectiveTime(validContext, 2016, 4, 24, 0, 0, 0); |
| err = certSet.ValidateCert(certSet.Certs[certSet.CertCount - 1], validContext); |
| VerifyOrFail(err == WEAVE_NO_ERROR, "Unexpected result from ValidateCert()"); |
| |
| // Last second of last day of validity period. |
| // As above, this time is considered valid because of rounding to whole days. |
| SetEffectiveTime(validContext, 2016, 5, 24, 23, 59, 59); |
| err = certSet.ValidateCert(certSet.Certs[certSet.CertCount - 1], validContext); |
| VerifyOrFail(err == WEAVE_NO_ERROR, "Unexpected result from ValidateCert()"); |
| |
| // 1 second after end of certificate validity period. |
| SetEffectiveTime(validContext, 2016, 5, 25, 0, 0, 0); |
| err = certSet.ValidateCert(certSet.Certs[certSet.CertCount - 1], validContext); |
| VerifyOrFail(err == WEAVE_ERROR_CERT_EXPIRED, "Unexpected result from ValidateCert()"); |
| |
| // After end of certificate validity period. |
| SetEffectiveTime(validContext, 2018, 4, 25, 0, 0, 0); |
| err = certSet.ValidateCert(certSet.Certs[certSet.CertCount - 1], validContext); |
| VerifyOrFail(err == WEAVE_ERROR_CERT_EXPIRED, "Unexpected result from ValidateCert()"); |
| |
| // Ignore 'not before' time. |
| validContext.ValidateFlags = kValidateFlag_IgnoreNotBefore; |
| SetEffectiveTime(validContext, 2016, 4, 23, 23, 59, 59); |
| err = certSet.ValidateCert(certSet.Certs[certSet.CertCount - 1], validContext); |
| VerifyOrFail(err == WEAVE_NO_ERROR, "Unexpected result from ValidateCert()"); |
| |
| // Ignore 'not after' time. |
| validContext.ValidateFlags = kValidateFlag_IgnoreNotAfter; |
| SetEffectiveTime(validContext, 2016, 5, 25, 0, 0, 0); |
| err = certSet.ValidateCert(certSet.Certs[certSet.CertCount - 1], validContext); |
| VerifyOrFail(err == WEAVE_NO_ERROR, "Unexpected result from ValidateCert()"); |
| |
| certSet.Release(); |
| |
| printf("%s passed\n", __FUNCTION__); |
| } |
| |
| void WeaveCertTest_CertUsage() |
| { |
| WEAVE_ERROR err; |
| WeaveCertificateSet certSet; |
| ValidationContext validContext; |
| |
| struct UsageTestCase |
| { |
| uint8_t CertIndex; |
| uint16_t RequiredKeyUsages; |
| uint16_t RequiredKeyPurposes; |
| WEAVE_ERROR ExpectedResult; |
| }; |
| |
| enum |
| { |
| // Short-hand names to make the test cases table more concise. |
| SA = kKeyPurposeFlag_ServerAuth, |
| CA = kKeyPurposeFlag_ClientAuth, |
| CS = kKeyPurposeFlag_CodeSigning, |
| EP = kKeyPurposeFlag_EmailProtection, |
| TS = kKeyPurposeFlag_TimeStamping, |
| OS = kKeyPurposeFlag_OCSPSigning, |
| DS = kKeyUsageFlag_DigitalSignature, |
| NR = kKeyUsageFlag_NonRepudiation, |
| KE = kKeyUsageFlag_KeyEncipherment, |
| DE = kKeyUsageFlag_DataEncipherment, |
| KA = kKeyUsageFlag_KeyAgreement, |
| KC = kKeyUsageFlag_KeyCertSign, |
| CR = kKeyUsageFlag_CRLSign, |
| EO = kKeyUsageFlag_EncipherOnly, |
| DO = kKeyUsageFlag_DecipherOnly, |
| }; |
| |
| static UsageTestCase sUsageTestCases[] = |
| { |
| // CertIndex KeyUsages KeyPurposes ExpectedResult |
| // ================================================================================= |
| |
| // ----- Key Usages for leaf Certificate ----- |
| { 2, DS, 0, WEAVE_NO_ERROR }, |
| { 2, NR, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, KE, 0, WEAVE_NO_ERROR }, |
| { 2, DE, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, KA, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, KC, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, CR, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, EO, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DO, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|NR, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|KE, 0, WEAVE_NO_ERROR }, |
| { 2, DS|DE, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|KA, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|KC, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|CR, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|EO, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|DO, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| |
| // ----- Key Usages for CA Certificate ----- |
| { 1, DS, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, NR, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KE, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, DE, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KA, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KC, 0, WEAVE_NO_ERROR }, |
| { 1, CR, 0, WEAVE_NO_ERROR }, |
| { 1, EO, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, DO, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KC|DS, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KC|NR, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KC|KE, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KC|DE, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KC|KA, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KC|CR, 0, WEAVE_NO_ERROR }, |
| { 1, KC|EO, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, KC|DO, 0, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| |
| // ----- Key Purposes for leaf Certificate ----- |
| { 2, 0, SA, WEAVE_NO_ERROR }, |
| { 2, 0, CA, WEAVE_NO_ERROR }, |
| { 2, 0, CS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, 0, EP, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, 0, TS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, 0, SA|CA, WEAVE_NO_ERROR }, |
| { 2, 0, SA|CS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, 0, SA|EP, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, 0, SA|TS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| |
| // ----- Key Purposes for CA Certificate ----- |
| { 1, 0, SA, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, 0, CA, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, 0, CS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, 0, EP, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, 0, TS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, 0, SA|CA, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, 0, SA|CS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, 0, SA|EP, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 1, 0, SA|TS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| |
| // ----- Combinations ----- |
| { 2, DS|NR, SA|CA, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|KE, SA|CS, WEAVE_ERROR_CERT_USAGE_NOT_ALLOWED }, |
| { 2, DS|KE, SA|CA, WEAVE_NO_ERROR }, |
| }; |
| size_t sNumUsageTestCases = sizeof(sUsageTestCases) / sizeof(sUsageTestCases[0]); |
| |
| certSet.Init(kStandardCertsCount, kTestCertBufSize); |
| |
| LoadStandardCerts(certSet); |
| |
| for (size_t i = 0; i < sNumUsageTestCases; i++) |
| { |
| memset(&validContext, 0, sizeof(validContext)); |
| SetEffectiveTime(validContext, 2016, 5, 4); |
| validContext.RequiredKeyUsages = sUsageTestCases[i].RequiredKeyUsages; |
| validContext.RequiredKeyPurposes = sUsageTestCases[i].RequiredKeyPurposes; |
| err = certSet.ValidateCert(certSet.Certs[sUsageTestCases[i].CertIndex], validContext); |
| if (err != sUsageTestCases[i].ExpectedResult) |
| printf("i = %d, err = %d\n", (int)i, err); |
| VerifyOrFail(err == sUsageTestCases[i].ExpectedResult, "Unexpected result from ValidateCert()"); |
| } |
| |
| certSet.Release(); |
| |
| printf("%s passed\n", __FUNCTION__); |
| } |
| |
| void WeaveCertTest_CertType() |
| { |
| WeaveCertificateSet certSet; |
| |
| struct TestCase |
| { |
| int Cert; |
| uint8_t ExpectedCertType; |
| }; |
| |
| enum |
| { |
| // Short-hand names to make the test cases table more concise. |
| Root = kTestCert_Root, |
| RootKey = kTestCert_RootKey, |
| Root256 = kTestCert_Root_SHA256, |
| CA = kTestCert_CA, |
| CA256 = kTestCert_CA_SHA256, |
| Dev = kTestCert_Dev, |
| Dev256 = kTestCert_Dev_SHA256, |
| SelfSigned = kTestCert_SelfSigned, |
| SelfSigned256 = kTestCert_SelfSigned_SHA256, |
| ServiceEndpoint = kTestCert_ServiceEndpoint, |
| ServiceEndpoint256 = kTestCert_ServiceEndpoint_SHA256, |
| FirmwareSigning = kTestCert_FirmwareSigning, |
| FirmwareSigning256 = kTestCert_FirmwareSigning_SHA256, |
| }; |
| |
| static TestCase sTestCases[] = |
| { |
| // Cert ExpectedCertType |
| // ================================================ |
| { Root, kCertType_CA }, |
| { RootKey, kCertType_CA }, |
| { Root256, kCertType_CA }, |
| { CA, kCertType_CA }, |
| { CA256, kCertType_CA }, |
| { Dev, kCertType_Device }, |
| { Dev256, kCertType_Device }, |
| { SelfSigned, kCertType_General }, |
| { SelfSigned256, kCertType_General }, |
| { ServiceEndpoint, kCertType_ServiceEndpoint }, |
| { ServiceEndpoint256, kCertType_ServiceEndpoint }, |
| { FirmwareSigning, kCertType_FirmwareSigning }, |
| { FirmwareSigning256, kCertType_FirmwareSigning }, |
| }; |
| static const size_t sNumTestCases = sizeof(sTestCases) / sizeof(sTestCases[0]); |
| |
| for (unsigned i = 0; i < sNumTestCases; i++) |
| { |
| const TestCase& testCase = sTestCases[i]; |
| |
| // Initialize the certificate set and load the test certificate. |
| certSet.Init(1, kTestCertBufSize); |
| LoadTestCert(certSet, testCase.Cert); |
| |
| VerifyOrFail(certSet.Certs[0].CertType == testCase.ExpectedCertType, "Test Case %u: Unexpected certificate type", i); |
| } |
| |
| printf("%s passed\n", __FUNCTION__); |
| } |
| |
| int main(int argc, char *argv[]) |
| { |
| WeaveCertTest_WeaveToX509(); |
| WeaveCertTest_X509ToWeave(); |
| WeaveCertTest_CertValidation(); |
| WeaveCertTest_CertValidTime(); |
| WeaveCertTest_CertUsage(); |
| WeaveCertTest_CertType(); |
| printf("All tests passed.\n"); |
| } |
