• file
• revisions
• annotate
• diff
• comparison
• raw

security/nss/cmd/libpkix/sample_apps/validate_chain.c@6474c204b198 (annotated)

security/nss/cmd/libpkix/sample_apps/validate_chain.c

Wed, 31 Dec 2014 06:09:35 +0100

author

Michael Schloh von Bennewitz <michael@schloh.com>

date

Wed, 31 Dec 2014 06:09:35 +0100

changeset 0

6474c204b198

permissions

-rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

michael@0	1	/* This Source Code Form is subject to the terms of the Mozilla Public
michael@0	2	* License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0	3	* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0	4	/*
michael@0	5	* validateChain.c
michael@0	6	*
michael@0	7	* Tests Cert Chain Validation
michael@0	8	*
michael@0	9	*/
michael@0	10
michael@0	11	#include <stdio.h>
michael@0	12	#include <string.h>
michael@0	13	#include <stddef.h>
michael@0	14
michael@0	15	#include "pkix_pl_generalname.h"
michael@0	16	#include "pkix_pl_cert.h"
michael@0	17	#include "pkix.h"
michael@0	18	#include "testutil.h"
michael@0	19	#include "prlong.h"
michael@0	20	#include "plstr.h"
michael@0	21	#include "prthread.h"
michael@0	22	#include "nspr.h"
michael@0	23	#include "prtypes.h"
michael@0	24	#include "prtime.h"
michael@0	25	#include "pk11func.h"
michael@0	26	#include "secasn1.h"
michael@0	27	#include "cert.h"
michael@0	28	#include "cryptohi.h"
michael@0	29	#include "secoid.h"
michael@0	30	#include "certdb.h"
michael@0	31	#include "secitem.h"
michael@0	32	#include "keythi.h"
michael@0	33	#include "nss.h"
michael@0	34
michael@0	35	static void *plContext = NULL;
michael@0	36
michael@0	37	static
michael@0	38	void printUsage(void){
michael@0	39	(void) printf("\nUSAGE:\tvalidateChain <trustedCert> "
michael@0	40	"<cert_1> <cert_2> ... <cert_n>\n");
michael@0	41	(void) printf("\tValidates a chain of n certificates "
michael@0	42	"using the given trust anchor.\n");
michael@0	43
michael@0	44	}
michael@0	45
michael@0	46	static PKIX_PL_Cert *
michael@0	47	createCert(char *inFileName)
michael@0	48	{
michael@0	49	PKIX_PL_ByteArray *byteArray = NULL;
michael@0	50	void *buf = NULL;
michael@0	51	PRFileDesc *inFile = NULL;
michael@0	52	PKIX_UInt32 len;
michael@0	53	SECItem certDER;
michael@0	54	SECStatus rv;
michael@0	55	/* default: NULL cert (failure case) */
michael@0	56	PKIX_PL_Cert *cert = NULL;
michael@0	57
michael@0	58	PKIX_TEST_STD_VARS();
michael@0	59
michael@0	60	certDER.data = NULL;
michael@0	61
michael@0	62	inFile = PR_Open(inFileName, PR_RDONLY, 0);
michael@0	63
michael@0	64	if (!inFile){
michael@0	65	pkixTestErrorMsg = "Unable to open cert file";
michael@0	66	goto cleanup;
michael@0	67	} else {
michael@0	68	rv = SECU_ReadDERFromFile(&certDER, inFile, PR_FALSE, PR_FALSE);
michael@0	69	if (!rv){
michael@0	70	buf = (void *)certDER.data;
michael@0	71	len = certDER.len;
michael@0	72
michael@0	73	PKIX_TEST_EXPECT_NO_ERROR
michael@0	74	(PKIX_PL_ByteArray_Create
michael@0	75	(buf, len, &byteArray, plContext));
michael@0	76
michael@0	77	PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_Create
michael@0	78	(byteArray, &cert, plContext));
michael@0	79
michael@0	80	SECITEM_FreeItem(&certDER, PR_FALSE);
michael@0	81	} else {
michael@0	82	pkixTestErrorMsg = "Unable to read DER from cert file";
michael@0	83	goto cleanup;
michael@0	84	}
michael@0	85	}
michael@0	86
michael@0	87	cleanup:
michael@0	88
michael@0	89	if (inFile){
michael@0	90	PR_Close(inFile);
michael@0	91	}
michael@0	92
michael@0	93	if (PKIX_TEST_ERROR_RECEIVED){
michael@0	94	SECITEM_FreeItem(&certDER, PR_FALSE);
michael@0	95	}
michael@0	96
michael@0	97	PKIX_TEST_DECREF_AC(byteArray);
michael@0	98
michael@0	99	PKIX_TEST_RETURN();
michael@0	100
michael@0	101	return (cert);
michael@0	102	}
michael@0	103
michael@0	104	int validate_chain(int argc, char *argv[])
michael@0	105	{
michael@0	106	PKIX_TrustAnchor *anchor = NULL;
michael@0	107	PKIX_List *anchors = NULL;
michael@0	108	PKIX_List *certs = NULL;
michael@0	109	PKIX_ProcessingParams *procParams = NULL;
michael@0	110	PKIX_ValidateParams *valParams = NULL;
michael@0	111	PKIX_ValidateResult *valResult = NULL;
michael@0	112	PKIX_PL_X500Name *subject = NULL;
michael@0	113	PKIX_ComCertSelParams *certSelParams = NULL;
michael@0	114	PKIX_CertSelector *certSelector = NULL;
michael@0	115	PKIX_VerifyNode *verifyTree = NULL;
michael@0	116	PKIX_PL_String *verifyString = NULL;
michael@0	117
michael@0	118	char *trustedCertFile = NULL;
michael@0	119	char *chainCertFile = NULL;
michael@0	120	PKIX_PL_Cert *trustedCert = NULL;
michael@0	121	PKIX_PL_Cert *chainCert = NULL;
michael@0	122	PKIX_UInt32 chainLength = 0;
michael@0	123	PKIX_UInt32 i = 0;
michael@0	124	PKIX_UInt32 j = 0;
michael@0	125	PKIX_UInt32 actualMinorVersion;
michael@0	126
michael@0	127	PKIX_TEST_STD_VARS();
michael@0	128
michael@0	129	if (argc < 3){
michael@0	130	printUsage();
michael@0	131	return (0);
michael@0	132	}
michael@0	133
michael@0	134	PKIX_TEST_EXPECT_NO_ERROR(
michael@0	135	PKIX_PL_NssContext_Create(0, PKIX_FALSE, NULL, &plContext));
michael@0	136
michael@0	137	chainLength = (argc - j) - 2;
michael@0	138
michael@0	139	/* create processing params with list of trust anchors */
michael@0	140	trustedCertFile = argv[1+j];
michael@0	141	trustedCert = createCert(trustedCertFile);
michael@0	142
michael@0	143	PKIX_TEST_EXPECT_NO_ERROR
michael@0	144	(PKIX_PL_Cert_GetSubject(trustedCert, &subject, plContext));
michael@0	145
michael@0	146	PKIX_TEST_EXPECT_NO_ERROR
michael@0	147	(PKIX_ComCertSelParams_Create(&certSelParams, plContext));
michael@0	148
michael@0	149	#if 0
michael@0	150	PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubject
michael@0	151	(certSelParams, subject, plContext));
michael@0	152	#endif
michael@0	153
michael@0	154	PKIX_TEST_EXPECT_NO_ERROR
michael@0	155	(PKIX_CertSelector_Create
michael@0	156	(NULL, NULL, &certSelector, plContext));
michael@0	157
michael@0	158	PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams
michael@0	159	(certSelector, certSelParams, plContext));
michael@0	160
michael@0	161	PKIX_TEST_DECREF_BC(subject);
michael@0	162	PKIX_TEST_DECREF_BC(certSelParams);
michael@0	163
michael@0	164	PKIX_TEST_EXPECT_NO_ERROR(PKIX_TrustAnchor_CreateWithCert
michael@0	165	(trustedCert, &anchor, plContext));
michael@0	166
michael@0	167	PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&anchors, plContext));
michael@0	168	PKIX_TEST_EXPECT_NO_ERROR
michael@0	169	(PKIX_List_AppendItem
michael@0	170	(anchors, (PKIX_PL_Object *)anchor, plContext));
michael@0	171	PKIX_TEST_EXPECT_NO_ERROR(PKIX_ProcessingParams_Create
michael@0	172	(anchors, &procParams, plContext));
michael@0	173
michael@0	174	PKIX_TEST_EXPECT_NO_ERROR
michael@0	175	(PKIX_ProcessingParams_SetTargetCertConstraints
michael@0	176	(procParams, certSelector, plContext));
michael@0	177
michael@0	178	PKIX_TEST_DECREF_BC(certSelector);
michael@0	179
michael@0	180	/* create cert chain */
michael@0	181	PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&certs, plContext));
michael@0	182	for (i = 0; i < chainLength; i++){
michael@0	183	chainCertFile = argv[(i + j) + 2];
michael@0	184	chainCert = createCert(chainCertFile);
michael@0	185
michael@0	186	PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem
michael@0	187	(certs,
michael@0	188	(PKIX_PL_Object *)chainCert,
michael@0	189	plContext));
michael@0	190
michael@0	191	PKIX_TEST_DECREF_BC(chainCert);
michael@0	192	chainCert = NULL;
michael@0	193	}
michael@0	194	/* create validate params with processing params and cert chain */
michael@0	195	PKIX_TEST_EXPECT_NO_ERROR(PKIX_ValidateParams_Create
michael@0	196	(procParams, certs, &valParams, plContext));
michael@0	197
michael@0	198	PKIX_TEST_DECREF_BC(trustedCert); trustedCert = NULL;
michael@0	199	PKIX_TEST_DECREF_BC(anchor); anchor = NULL;
michael@0	200	PKIX_TEST_DECREF_BC(anchors); anchors = NULL;
michael@0	201	PKIX_TEST_DECREF_BC(certs); certs = NULL;
michael@0	202	PKIX_TEST_DECREF_BC(procParams); procParams = NULL;
michael@0	203
michael@0	204	/* validate cert chain using processing params and return valResult */
michael@0	205
michael@0	206	PKIX_TEST_EXPECT_NO_ERROR
michael@0	207	(PKIX_ValidateChain(valParams, &valResult, &verifyTree, plContext));
michael@0	208
michael@0	209	if (valResult != NULL){
michael@0	210	(void) printf("SUCCESSFULLY VALIDATED\n");
michael@0	211	}
michael@0	212
michael@0	213	cleanup:
michael@0	214
michael@0	215	if (PKIX_TEST_ERROR_RECEIVED){
michael@0	216	(void) printf("FAILED TO VALIDATE\n");
michael@0	217	(void) PKIX_PL_Object_ToString
michael@0	218	((PKIX_PL_Object*)verifyTree, &verifyString, plContext);
michael@0	219	(void) printf("verifyTree is\n%s\n", verifyString->escAsciiString);
michael@0	220	PKIX_TEST_DECREF_AC(verifyString);
michael@0	221
michael@0	222	}
michael@0	223
michael@0	224	PKIX_TEST_DECREF_AC(verifyTree);
michael@0	225	PKIX_TEST_DECREF_AC(valResult);
michael@0	226	PKIX_TEST_DECREF_AC(valParams);
michael@0	227
michael@0	228	PKIX_TEST_RETURN();
michael@0	229
michael@0	230	PKIX_Shutdown(plContext);
michael@0	231
michael@0	232	return (0);
michael@0	233
michael@0	234	}