security/manager/ssl/tests/unit/test_getchain.js@b8a032363ba2 (annotated)
security/manager/ssl/tests/unit/test_getchain.js
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | // -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- |
| michael@0 | 2 | // This Source Code Form is subject to the terms of the Mozilla Public |
| michael@0 | 3 | // License, v. 2.0. If a copy of the MPL was not distributed with this |
| michael@0 | 4 | // file, You can obtain one at http://mozilla.org/MPL/2.0/. |
| michael@0 | 5 | |
| michael@0 | 6 | "use strict"; |
| michael@0 | 7 | |
| michael@0 | 8 | do_get_profile(); // must be called before getting nsIX509CertDB |
| michael@0 | 9 | const certdb = Cc["@mozilla.org/security/x509certdb;1"] |
| michael@0 | 10 | .getService(Ci.nsIX509CertDB); |
| michael@0 | 11 | const certdb2 = Cc["@mozilla.org/security/x509certdb;1"] |
| michael@0 | 12 | .getService(Ci.nsIX509CertDB2); |
| michael@0 | 13 | |
| michael@0 | 14 | // This is the list of certificates needed for the test |
| michael@0 | 15 | // The certificates prefixed by 'int-' are intermediates |
| michael@0 | 16 | let certList = [ |
| michael@0 | 17 | 'ee', |
| michael@0 | 18 | 'ca-1', |
| michael@0 | 19 | 'ca-2', |
| michael@0 | 20 | ] |
| michael@0 | 21 | |
| michael@0 | 22 | function load_cert(cert_name, trust_string) { |
| michael@0 | 23 | var cert_filename = cert_name + ".der"; |
| michael@0 | 24 | addCertFromFile(certdb, "test_getchain/" + cert_filename, trust_string); |
| michael@0 | 25 | } |
| michael@0 | 26 | |
| michael@0 | 27 | // Since all the ca's are identical expect for the serial number |
| michael@0 | 28 | // I have to grab them by enumerating all the certs and then finding |
| michael@0 | 29 | // the ones that I am interested in. |
| michael@0 | 30 | function get_ca_array() { |
| michael@0 | 31 | let ret_array = new Array(); |
| michael@0 | 32 | let allCerts = certdb2.getCerts(); |
| michael@0 | 33 | let enumerator = allCerts.getEnumerator(); |
| michael@0 | 34 | while (enumerator.hasMoreElements()) { |
| michael@0 | 35 | let cert = enumerator.getNext().QueryInterface(Ci.nsIX509Cert); |
| michael@0 | 36 | if (cert.commonName == 'ca') { |
| michael@0 | 37 | ret_array[parseInt(cert.serialNumber)] = cert; |
| michael@0 | 38 | } |
| michael@0 | 39 | } |
| michael@0 | 40 | return ret_array; |
| michael@0 | 41 | } |
| michael@0 | 42 | |
| michael@0 | 43 | |
| michael@0 | 44 | function check_matching_issuer_and_getchain(expected_issuer_serial, cert) { |
| michael@0 | 45 | const nsIX509Cert = Components.interfaces.nsIX509Cert; |
| michael@0 | 46 | |
| michael@0 | 47 | do_check_eq(expected_issuer_serial, cert.issuer.serialNumber); |
| michael@0 | 48 | let chain = cert.getChain(); |
| michael@0 | 49 | let issuer_via_getchain = chain.queryElementAt(1, nsIX509Cert); |
| michael@0 | 50 | // The issuer returned by cert.issuer or cert.getchain should be consistent. |
| michael@0 | 51 | do_check_eq(cert.issuer.serialNumber, issuer_via_getchain.serialNumber); |
| michael@0 | 52 | } |
| michael@0 | 53 | |
| michael@0 | 54 | function check_getchain(ee_cert, ssl_ca, email_ca){ |
| michael@0 | 55 | // A certificate should first build a chain/issuer to |
| michael@0 | 56 | // a SSL trust domain, then an EMAIL trust domain and then |
| michael@0 | 57 | // and object signer trust domain |
| michael@0 | 58 | |
| michael@0 | 59 | const nsIX509Cert = Components.interfaces.nsIX509Cert; |
| michael@0 | 60 | certdb.setCertTrust(ssl_ca, nsIX509Cert.CA_CERT, |
| michael@0 | 61 | Ci.nsIX509CertDB.TRUSTED_SSL); |
| michael@0 | 62 | certdb.setCertTrust(email_ca, nsIX509Cert.CA_CERT, |
| michael@0 | 63 | Ci.nsIX509CertDB.TRUSTED_EMAIL); |
| michael@0 | 64 | check_matching_issuer_and_getchain(ssl_ca.serialNumber, ee_cert); |
| michael@0 | 65 | certdb.setCertTrust(ssl_ca, nsIX509Cert.CA_CERT, 0); |
| michael@0 | 66 | check_matching_issuer_and_getchain(email_ca.serialNumber, ee_cert); |
| michael@0 | 67 | certdb.setCertTrust(email_ca, nsIX509Cert.CA_CERT, 0); |
| michael@0 | 68 | // Do a final test on the case of no trust. The results must |
| michael@0 | 69 | // be cosistent (the actual value is non-deterministic). |
| michael@0 | 70 | check_matching_issuer_and_getchain(ee_cert.issuer.serialNumber, ee_cert); |
| michael@0 | 71 | } |
| michael@0 | 72 | |
| michael@0 | 73 | function run_test_in_mode(useMozillaPKIX) { |
| michael@0 | 74 | Services.prefs.setBoolPref("security.use_mozillapkix_verification", useMozillaPKIX); |
| michael@0 | 75 | clearOCSPCache(); |
| michael@0 | 76 | clearSessionCache(); |
| michael@0 | 77 | |
| michael@0 | 78 | for (let i = 0 ; i < certList.length; i++) { |
| michael@0 | 79 | load_cert(certList[i], ',,'); |
| michael@0 | 80 | } |
| michael@0 | 81 | |
| michael@0 | 82 | let ee_cert = certdb.findCertByNickname(null, 'ee'); |
| michael@0 | 83 | do_check_false(!ee_cert); |
| michael@0 | 84 | |
| michael@0 | 85 | let ca = get_ca_array(); |
| michael@0 | 86 | |
| michael@0 | 87 | check_getchain(ee_cert, ca[1], ca[2]); |
| michael@0 | 88 | // Swap ca certs to deal alternate trust settings. |
| michael@0 | 89 | check_getchain(ee_cert, ca[2], ca[1]); |
| michael@0 | 90 | } |
| michael@0 | 91 | |
| michael@0 | 92 | function run_test() { |
| michael@0 | 93 | run_test_in_mode(true); |
| michael@0 | 94 | run_test_in_mode(false); |
| michael@0 | 95 | } |
