• file
• revisions
• annotate
• diff
• comparison
• raw

security/manager/ssl/tests/unit/test_ocsp_url.js@b8a032363ba2 (annotated)

security/manager/ssl/tests/unit/test_ocsp_url.js

Thu, 22 Jan 2015 13:21:57 +0100

author

Michael Schloh von Bennewitz <michael@schloh.com>

date

Thu, 22 Jan 2015 13:21:57 +0100

branch

TOR_BUG_9701

changeset 15

b8a032363ba2

permissions

-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0	1	// -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
michael@0	2	// This Source Code Form is subject to the terms of the Mozilla Public
michael@0	3	// License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0	4	// file, You can obtain one at http://mozilla.org/MPL/2.0/.
michael@0	5
michael@0	6	"use strict";
michael@0	7
michael@0	8	// In which we try to validate several ocsp responses, checking in particular
michael@0	9	// if the ocsp url is valid and the path expressed is correctly passed to
michael@0	10	// the caller.
michael@0	11
michael@0	12	do_get_profile(); // must be called before getting nsIX509CertDB
michael@0	13	const certdb = Cc["@mozilla.org/security/x509certdb;1"]
michael@0	14	.getService(Ci.nsIX509CertDB);
michael@0	15
michael@0	16	const SERVER_PORT = 8888;
michael@0	17
michael@0	18	function failingOCSPResponder() {
michael@0	19	return getFailingHttpServer(SERVER_PORT, ["www.example.com"]);
michael@0	20	}
michael@0	21
michael@0	22	function start_ocsp_responder(expectedCertNames, expectedPaths) {
michael@0	23	return startOCSPResponder(SERVER_PORT, "www.example.com", [],
michael@0	24	"test_ocsp_url", expectedCertNames, expectedPaths);
michael@0	25	}
michael@0	26
michael@0	27	function check_cert_err(cert_name, expected_error) {
michael@0	28	let cert = constructCertFromFile("test_ocsp_url/" + cert_name + ".der");
michael@0	29	return checkCertErrorGeneric(certdb, cert, expected_error,
michael@0	30	certificateUsageSSLServer);
michael@0	31	}
michael@0	32
michael@0	33	function run_test() {
michael@0	34	addCertFromFile(certdb, "test_ocsp_url/ca.der", 'CTu,CTu,CTu');
michael@0	35	addCertFromFile(certdb, "test_ocsp_url/int.der", ',,');
michael@0	36
michael@0	37	// Enabled so that we can force ocsp failure responses.
michael@0	38	Services.prefs.setBoolPref("security.OCSP.require", true);
michael@0	39
michael@0	40	Services.prefs.setCharPref("network.dns.localDomains",
michael@0	41	"www.example.com");
michael@0	42
michael@0	43	add_tests_in_mode(true);
michael@0	44	add_tests_in_mode(false);
michael@0	45	run_next_test();
michael@0	46	}
michael@0	47
michael@0	48	function add_tests_in_mode(useMozillaPKIX)
michael@0	49	{
michael@0	50	add_test(function() {
michael@0	51	Services.prefs.setBoolPref("security.use_mozillapkix_verification",
michael@0	52	useMozillaPKIX);
michael@0	53	run_next_test();
michael@0	54	});
michael@0	55
michael@0	56	add_test(function() {
michael@0	57	clearOCSPCache();
michael@0	58	let ocspResponder = failingOCSPResponder();
michael@0	59	check_cert_err("bad-scheme",
michael@0	60	useMozillaPKIX ? SEC_ERROR_CERT_BAD_ACCESS_LOCATION
michael@0	61	: SEC_ERROR_OCSP_MALFORMED_REQUEST);
michael@0	62	ocspResponder.stop(run_next_test);
michael@0	63	});
michael@0	64
michael@0	65	add_test(function() {
michael@0	66	clearOCSPCache();
michael@0	67	let ocspResponder = failingOCSPResponder();
michael@0	68	check_cert_err("empty-scheme-url",
michael@0	69	useMozillaPKIX ? SEC_ERROR_CERT_BAD_ACCESS_LOCATION
michael@0	70	: SEC_ERROR_OCSP_MALFORMED_REQUEST);
michael@0	71	ocspResponder.stop(run_next_test);
michael@0	72	});
michael@0	73
michael@0	74	add_test(function() {
michael@0	75	clearOCSPCache();
michael@0	76	let ocspResponder = failingOCSPResponder();
michael@0	77	check_cert_err("https-url",
michael@0	78	useMozillaPKIX ? SEC_ERROR_CERT_BAD_ACCESS_LOCATION
michael@0	79	: SEC_ERROR_OCSP_MALFORMED_REQUEST);
michael@0	80	ocspResponder.stop(run_next_test);
michael@0	81	});
michael@0	82
michael@0	83	add_test(function() {
michael@0	84	clearOCSPCache();
michael@0	85	let ocspResponder = start_ocsp_responder(["hTTp-url"], ["hTTp-url"]);
michael@0	86	check_cert_err("hTTp-url", 0);
michael@0	87	ocspResponder.stop(run_next_test);
michael@0	88	});
michael@0	89
michael@0	90	add_test(function() {
michael@0	91	clearOCSPCache();
michael@0	92	let ocspResponder = failingOCSPResponder();
michael@0	93	check_cert_err("negative-port",
michael@0	94	useMozillaPKIX ? SEC_ERROR_CERT_BAD_ACCESS_LOCATION
michael@0	95	: SEC_ERROR_OCSP_MALFORMED_REQUEST);
michael@0	96	ocspResponder.stop(run_next_test);
michael@0	97	});
michael@0	98
michael@0	99	add_test(function() {
michael@0	100	clearOCSPCache();
michael@0	101	let ocspResponder = failingOCSPResponder();
michael@0	102	// XXX Bug 1013615 parser accepts ":8888" as hostname
michael@0	103	check_cert_err("no-host-url", SEC_ERROR_OCSP_SERVER_ERROR);
michael@0	104	ocspResponder.stop(run_next_test);
michael@0	105	});
michael@0	106
michael@0	107	add_test(function() {
michael@0	108	clearOCSPCache();
michael@0	109	let ocspResponder = start_ocsp_responder(["no-path-url"], ['']);
michael@0	110	check_cert_err("no-path-url", 0);
michael@0	111	ocspResponder.stop(run_next_test);
michael@0	112	});
michael@0	113
michael@0	114	add_test(function() {
michael@0	115	clearOCSPCache();
michael@0	116	let ocspResponder = failingOCSPResponder();
michael@0	117	check_cert_err("no-scheme-host-port",
michael@0	118	useMozillaPKIX ? SEC_ERROR_CERT_BAD_ACCESS_LOCATION
michael@0	119	: SEC_ERROR_OCSP_MALFORMED_REQUEST);
michael@0	120	ocspResponder.stop(run_next_test);
michael@0	121	});
michael@0	122
michael@0	123	add_test(function() {
michael@0	124	clearOCSPCache();
michael@0	125	let ocspResponder = failingOCSPResponder();
michael@0	126	check_cert_err("no-scheme-url",
michael@0	127	useMozillaPKIX ? SEC_ERROR_CERT_BAD_ACCESS_LOCATION
michael@0	128	: SEC_ERROR_OCSP_MALFORMED_REQUEST);
michael@0	129	ocspResponder.stop(run_next_test);
michael@0	130	});
michael@0	131
michael@0	132	add_test(function() {
michael@0	133	clearOCSPCache();
michael@0	134	let ocspResponder = failingOCSPResponder();
michael@0	135	check_cert_err("unknown-scheme",
michael@0	136	useMozillaPKIX ? SEC_ERROR_CERT_BAD_ACCESS_LOCATION
michael@0	137	: SEC_ERROR_OCSP_MALFORMED_REQUEST);
michael@0	138	ocspResponder.stop(run_next_test);
michael@0	139	});
michael@0	140
michael@0	141	}