• file
• revisions
• annotate
• diff
• comparison
• raw

security/manager/ssl/tests/unit/test_cert_trust.js@b8a032363ba2 (annotated)

security/manager/ssl/tests/unit/test_cert_trust.js

Thu, 22 Jan 2015 13:21:57 +0100

author

Michael Schloh von Bennewitz <michael@schloh.com>

date

Thu, 22 Jan 2015 13:21:57 +0100

branch

TOR_BUG_9701

changeset 15

b8a032363ba2

permissions

-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0	1	// -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
michael@0	2	// This Source Code Form is subject to the terms of the Mozilla Public
michael@0	3	// License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0	4	// file, You can obtain one at http://mozilla.org/MPL/2.0/.
michael@0	5
michael@0	6	"use strict";
michael@0	7
michael@0	8	do_get_profile(); // must be called before getting nsIX509CertDB
michael@0	9	const certdb = Cc["@mozilla.org/security/x509certdb;1"]
michael@0	10	.getService(Ci.nsIX509CertDB);
michael@0	11
michael@0	12	let certList = [
michael@0	13	'ee',
michael@0	14	'int',
michael@0	15	'ca',
michael@0	16	]
michael@0	17
michael@0	18	function load_cert(cert_name, trust_string) {
michael@0	19	let cert_filename = cert_name + ".der";
michael@0	20	addCertFromFile(certdb, "test_cert_trust/" + cert_filename, trust_string);
michael@0	21	}
michael@0	22
michael@0	23	function setup_basic_trusts(ca_cert, int_cert) {
michael@0	24	certdb.setCertTrust(ca_cert, Ci.nsIX509Cert.CA_CERT,
michael@0	25	Ci.nsIX509CertDB.TRUSTED_SSL |
michael@0	26	Ci.nsIX509CertDB.TRUSTED_EMAIL |
michael@0	27	Ci.nsIX509CertDB.TRUSTED_OBJSIGN);
michael@0	28
michael@0	29	certdb.setCertTrust(int_cert, Ci.nsIX509Cert.CA_CERT, 0);
michael@0	30	}
michael@0	31
michael@0	32	function check_cert_err_generic(cert, expected_error, usage) {
michael@0	33	do_print("cert cn=" + cert.commonName);
michael@0	34	do_print("cert issuer cn=" + cert.issuerCommonName);
michael@0	35	let hasEVPolicy = {};
michael@0	36	let verifiedChain = {};
michael@0	37	let error = certdb.verifyCertNow(cert, usage,
michael@0	38	NO_FLAGS, verifiedChain, hasEVPolicy);
michael@0	39	do_check_eq(error, expected_error);
michael@0	40	};
michael@0	41
michael@0	42	function test_ca_distrust(ee_cert, cert_to_modify_trust, isRootCA, useMozillaPKIX) {
michael@0	43	// On reset most usages are successful
michael@0	44	check_cert_err_generic(ee_cert, 0, certificateUsageSSLServer);
michael@0	45	check_cert_err_generic(ee_cert, 0, certificateUsageSSLClient);
michael@0	46	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	47	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	48	certificateUsageSSLCA); // expected no bc
michael@0	49	check_cert_err_generic(ee_cert, 0, certificateUsageEmailSigner);
michael@0	50	check_cert_err_generic(ee_cert, 0, certificateUsageEmailRecipient);
michael@0	51	check_cert_err_generic(ee_cert, useMozillaPKIX ? 0
michael@0	52	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	53	certificateUsageObjectSigner); // expected
michael@0	54	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	55	: 0,
michael@0	56	certificateUsageVerifyCA);
michael@0	57	// mozilla::pkix enforces that certificase must have a basic constraints
michael@0	58	// extension with cA:true to be a CA certificate, whereas classic does not
michael@0	59	check_cert_err_generic(ee_cert, SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	60	certificateUsageStatusResponder); //expected
michael@0	61
michael@0	62
michael@0	63	// Test of active distrust. No usage should pass.
michael@0	64	setCertTrust(cert_to_modify_trust, 'p,p,p');
michael@0	65	check_cert_err_generic(ee_cert, SEC_ERROR_UNTRUSTED_ISSUER,
michael@0	66	certificateUsageSSLServer);
michael@0	67	check_cert_err_generic(ee_cert, SEC_ERROR_UNTRUSTED_ISSUER,
michael@0	68	certificateUsageSSLClient);
michael@0	69	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	70	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	71	certificateUsageSSLCA);
michael@0	72	check_cert_err_generic(ee_cert, SEC_ERROR_UNTRUSTED_ISSUER,
michael@0	73	certificateUsageEmailSigner);
michael@0	74	check_cert_err_generic(ee_cert, SEC_ERROR_UNTRUSTED_ISSUER,
michael@0	75	certificateUsageEmailRecipient);
michael@0	76	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_UNTRUSTED_ISSUER
michael@0	77	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	78	certificateUsageObjectSigner);
michael@0	79	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	80	: 0,
michael@0	81	certificateUsageVerifyCA);
michael@0	82	// In mozilla::pkix (but not classic verification), certificate chain
michael@0	83	// properties are checked before the end-entity. Thus, if we're using
michael@0	84	// mozilla::pkix and the root certificate has been distrusted, the error
michael@0	85	// will be "untrusted issuer" and not "inadequate cert type".
michael@0	86	check_cert_err_generic(ee_cert, (!isRootCA && useMozillaPKIX)
michael@0	87	? SEC_ERROR_UNTRUSTED_ISSUER
michael@0	88	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	89	certificateUsageStatusResponder);
michael@0	90
michael@0	91
michael@0	92	// Trust set to T - trusted CA to issue client certs, where client cert is
michael@0	93	// usageSSLClient.
michael@0	94	setCertTrust(cert_to_modify_trust, 'T,T,T');
michael@0	95	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER
michael@0	96	: SEC_ERROR_UNTRUSTED_ISSUER
michael@0	97	: 0,
michael@0	98	certificateUsageSSLServer);
michael@0	99
michael@0	100	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER //XXX Bug 982340
michael@0	101	: 0
michael@0	102	: 0,
michael@0	103	certificateUsageSSLClient);
michael@0	104	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	105	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	106	certificateUsageSSLCA);
michael@0	107
michael@0	108	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER
michael@0	109	: SEC_ERROR_UNTRUSTED_ISSUER
michael@0	110	: 0,
michael@0	111	certificateUsageEmailSigner);
michael@0	112	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER
michael@0	113	: SEC_ERROR_UNTRUSTED_ISSUER
michael@0	114	: 0,
michael@0	115	certificateUsageEmailRecipient);
michael@0	116	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER
michael@0	117	: SEC_ERROR_INADEQUATE_CERT_TYPE
michael@0	118	: useMozillaPKIX ? 0
michael@0	119	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	120	certificateUsageObjectSigner);
michael@0	121	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	122	: 0,
michael@0	123	certificateUsageVerifyCA);
michael@0	124	check_cert_err_generic(ee_cert, SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	125	certificateUsageStatusResponder);
michael@0	126
michael@0	127
michael@0	128	// Now tests on the SSL trust bit
michael@0	129	setCertTrust(cert_to_modify_trust, 'p,C,C');
michael@0	130	check_cert_err_generic(ee_cert, SEC_ERROR_UNTRUSTED_ISSUER,
michael@0	131	certificateUsageSSLServer);
michael@0	132	check_cert_err_generic(ee_cert, useMozillaPKIX ? 0 //XXX Bug 982340
michael@0	133	: SEC_ERROR_UNTRUSTED_ISSUER,
michael@0	134	certificateUsageSSLClient);
michael@0	135	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	136	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	137	certificateUsageSSLCA);
michael@0	138	check_cert_err_generic(ee_cert, 0, certificateUsageEmailSigner);
michael@0	139	check_cert_err_generic(ee_cert, 0, certificateUsageEmailRecipient);
michael@0	140	check_cert_err_generic(ee_cert, useMozillaPKIX ? 0
michael@0	141	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	142	certificateUsageObjectSigner);
michael@0	143	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	144	: 0,
michael@0	145	certificateUsageVerifyCA);
michael@0	146	// In mozilla::pkix (but not classic verification), certificate chain
michael@0	147	// properties are checked before the end-entity. Thus, if we're using
michael@0	148	// mozilla::pkix and the root certificate has been distrusted, the error
michael@0	149	// will be "untrusted issuer" and not "inadequate cert type".
michael@0	150	check_cert_err_generic(ee_cert, (!isRootCA && useMozillaPKIX)
michael@0	151	? SEC_ERROR_UNTRUSTED_ISSUER
michael@0	152	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	153	certificateUsageStatusResponder);
michael@0	154
michael@0	155	// Inherited trust SSL
michael@0	156	setCertTrust(cert_to_modify_trust, ',C,C');
michael@0	157	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER
michael@0	158	: SEC_ERROR_UNTRUSTED_ISSUER
michael@0	159	: 0,
michael@0	160	certificateUsageSSLServer);
michael@0	161	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? 0 // XXX Bug 982340
michael@0	162	: SEC_ERROR_UNTRUSTED_ISSUER
michael@0	163	: 0,
michael@0	164	certificateUsageSSLClient);
michael@0	165	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	166	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	167	certificateUsageSSLCA);
michael@0	168	check_cert_err_generic(ee_cert, 0, certificateUsageEmailSigner);
michael@0	169	check_cert_err_generic(ee_cert, 0, certificateUsageEmailRecipient);
michael@0	170	check_cert_err_generic(ee_cert, useMozillaPKIX ? 0
michael@0	171	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	172	certificateUsageObjectSigner);
michael@0	173	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	174	: 0,
michael@0	175	certificateUsageVerifyCA);
michael@0	176	check_cert_err_generic(ee_cert, SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	177	certificateUsageStatusResponder);
michael@0	178
michael@0	179	// Now tests on the EMAIL trust bit
michael@0	180	setCertTrust(cert_to_modify_trust, 'C,p,C');
michael@0	181	check_cert_err_generic(ee_cert, 0, certificateUsageSSLServer);
michael@0	182	check_cert_err_generic(ee_cert, isRootCA ? SEC_ERROR_UNTRUSTED_ISSUER
michael@0	183	: useMozillaPKIX ? SEC_ERROR_UNTRUSTED_ISSUER
michael@0	184	: 0, // mozilla::pkix is OK, NSS bug
michael@0	185	certificateUsageSSLClient);
michael@0	186	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	187	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	188	certificateUsageSSLCA);
michael@0	189	check_cert_err_generic(ee_cert, SEC_ERROR_UNTRUSTED_ISSUER,
michael@0	190	certificateUsageEmailSigner);
michael@0	191	check_cert_err_generic(ee_cert, SEC_ERROR_UNTRUSTED_ISSUER,
michael@0	192	certificateUsageEmailRecipient);
michael@0	193	check_cert_err_generic(ee_cert, useMozillaPKIX ? 0
michael@0	194	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	195	certificateUsageObjectSigner);
michael@0	196	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	197	: 0,
michael@0	198	certificateUsageVerifyCA);
michael@0	199	check_cert_err_generic(ee_cert, SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	200	certificateUsageStatusResponder);
michael@0	201
michael@0	202
michael@0	203	//inherited EMAIL Trust
michael@0	204	setCertTrust(cert_to_modify_trust, 'C,,C');
michael@0	205	check_cert_err_generic(ee_cert, 0, certificateUsageSSLServer);
michael@0	206	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER
michael@0	207	: SEC_ERROR_UNTRUSTED_ISSUER
michael@0	208	: 0,
michael@0	209	certificateUsageSSLClient);
michael@0	210	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	211	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	212	certificateUsageSSLCA);
michael@0	213	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER
michael@0	214	: SEC_ERROR_UNTRUSTED_ISSUER
michael@0	215	: 0,
michael@0	216	certificateUsageEmailSigner);
michael@0	217	check_cert_err_generic(ee_cert, isRootCA ? useMozillaPKIX ? SEC_ERROR_UNKNOWN_ISSUER
michael@0	218	: SEC_ERROR_UNTRUSTED_ISSUER
michael@0	219	: 0,
michael@0	220	certificateUsageEmailRecipient);
michael@0	221	check_cert_err_generic(ee_cert, useMozillaPKIX ? 0
michael@0	222	: SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	223	certificateUsageObjectSigner);
michael@0	224	check_cert_err_generic(ee_cert, useMozillaPKIX ? SEC_ERROR_CA_CERT_INVALID
michael@0	225	: 0,
michael@0	226	certificateUsageVerifyCA);
michael@0	227	check_cert_err_generic(ee_cert, SEC_ERROR_INADEQUATE_CERT_TYPE,
michael@0	228	certificateUsageStatusResponder);
michael@0	229	}
michael@0	230
michael@0	231
michael@0	232	function run_test_in_mode(useMozillaPKIX) {
michael@0	233	Services.prefs.setBoolPref("security.use_mozillapkix_verification", useMozillaPKIX);
michael@0	234
michael@0	235	let ca_cert = certdb.findCertByNickname(null, 'ca');
michael@0	236	do_check_false(!ca_cert)
michael@0	237	let int_cert = certdb.findCertByNickname(null, 'int');
michael@0	238	do_check_false(!int_cert)
michael@0	239	let ee_cert = certdb.findCertByNickname(null, 'ee');
michael@0	240	do_check_false(!ee_cert);
michael@0	241
michael@0	242	setup_basic_trusts(ca_cert, int_cert);
michael@0	243	test_ca_distrust(ee_cert, ca_cert, true, useMozillaPKIX);
michael@0	244
michael@0	245	setup_basic_trusts(ca_cert, int_cert);
michael@0	246	test_ca_distrust(ee_cert, int_cert, false, useMozillaPKIX);
michael@0	247	}
michael@0	248
michael@0	249	function run_test() {
michael@0	250	for (let i = 0 ; i < certList.length; i++) {
michael@0	251	load_cert(certList[i], ',,');
michael@0	252	}
michael@0	253
michael@0	254	run_test_in_mode(true);
michael@0	255	run_test_in_mode(false);
michael@0	256	}