/*
* Copyright (c) 2011, Collabora Ltd.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above
* copyright notice, this list of conditions and the
* following disclaimer.
* * Redistributions in binary form must reproduce the
* above copyright notice, this list of conditions and
* the following disclaimer in the documentation and/or
* other materials provided with the distribution.
* * The names of contributors to this software may not be
* used to endorse or promote products derived from this
* software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
* THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
* DAMAGE.
*
* Author: Stef Walter <stefw@collabora.co.uk>
*/
#define P11_KIT_DISABLE_DEPRECATED
#include "config.h"
#include "test-trust.h"
#include "attrs.h"
#include "compat.h"
#include "debug.h"
#include "dict.h"
#include "extract.h"
#include "message.h"
#include "mock.h"
#include "pkcs11.h"
#include "pkcs11x.h"
#include "oid.h"
#include "test.h"
#include <stdlib.h>
#include <string.h>
static void
test_file_name_for_label (void)
{
CK_ATTRIBUTE label = { CKA_LABEL, "The Label!", 10 };
p11_enumerate ex;
char *name;
p11_enumerate_init (&ex);
ex.flags |= P11_ENUMERATE_CORRELATE;
ex.attrs = p11_attrs_build (NULL, &label, NULL);
name = p11_enumerate_filename (&ex);
assert_str_eq ("The_Label_", name);
free (name);
p11_enumerate_cleanup (&ex);
}
static void
test_file_name_for_class (void)
{
p11_enumerate ex;
char *name;
p11_enumerate_init (&ex);
ex.flags |= P11_ENUMERATE_CORRELATE;
ex.klass = CKO_CERTIFICATE;
name = p11_enumerate_filename (&ex);
assert_str_eq ("certificate", name);
free (name);
ex.klass = CKO_DATA;
name = p11_enumerate_filename (&ex);
assert_str_eq ("unknown", name);
free (name);
p11_enumerate_cleanup (&ex);
}
static void
test_comment_for_label (void)
{
CK_ATTRIBUTE label = { CKA_LABEL, "The Label!", 10 };
p11_enumerate ex;
char *comment;
p11_enumerate_init (&ex);
ex.flags = P11_EXTRACT_COMMENT | P11_ENUMERATE_CORRELATE;
ex.attrs = p11_attrs_build (NULL, &label, NULL);
comment = p11_enumerate_comment (&ex, true);
assert_str_eq ("# The Label!\n", comment);
free (comment);
comment = p11_enumerate_comment (&ex, false);
assert_str_eq ("\n# The Label!\n", comment);
free (comment);
p11_enumerate_cleanup (&ex);
}
static void
test_comment_not_enabled (void)
{
CK_ATTRIBUTE label = { CKA_LABEL, "The Label!", 10 };
p11_enumerate ex;
char *comment;
p11_enumerate_init (&ex);
ex.flags |= P11_ENUMERATE_CORRELATE;
ex.attrs = p11_attrs_build (NULL, &label, NULL);
comment = p11_enumerate_comment (&ex, true);
assert_ptr_eq (NULL, comment);
comment = p11_enumerate_comment (&ex, false);
assert_ptr_eq (NULL, comment);
p11_enumerate_cleanup (&ex);
}
struct {
CK_FUNCTION_LIST module;
CK_FUNCTION_LIST_PTR modules[2];
p11_enumerate ex;
} test;
static void
setup (void *unused)
{
CK_RV rv;
mock_module_reset ();
memcpy (&test.module, &mock_module, sizeof (CK_FUNCTION_LIST));
rv = test.module.C_Initialize (NULL);
assert_num_eq (CKR_OK, rv);
p11_enumerate_init (&test.ex);
test.ex.flags |= P11_ENUMERATE_CORRELATE;
/* Prefill the modules */
test.modules[0] = &test.module;
test.modules[1] = NULL;
test.ex.modules = test.modules;
}
static void
teardown (void *unused)
{
CK_RV rv;
/* Don't free the modules */
test.ex.modules = NULL;
p11_enumerate_cleanup (&test.ex);
rv = test.module.C_Finalize (NULL);
assert_num_eq (CKR_OK, rv);
}
static CK_OBJECT_CLASS certificate_class = CKO_CERTIFICATE;
static CK_OBJECT_CLASS public_key_class = CKO_PUBLIC_KEY;
static CK_OBJECT_CLASS extension_class = CKO_X_CERTIFICATE_EXTENSION;
static CK_CERTIFICATE_TYPE x509_type = CKC_X_509;
static CK_BBOOL truev = CK_TRUE;
static CK_ATTRIBUTE cacert3_trusted[] = {
{ CKA_VALUE, (void *)test_cacert3_ca_der, sizeof (test_cacert3_ca_der) },
{ CKA_CLASS, &certificate_class, sizeof (certificate_class) },
{ CKA_CERTIFICATE_TYPE, &x509_type, sizeof (x509_type) },
{ CKA_LABEL, "Cacert3 Here", 11 },
{ CKA_SUBJECT, (void *)test_cacert3_ca_subject, sizeof (test_cacert3_ca_subject) },
{ CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
{ CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
{ CKA_PUBLIC_KEY_INFO, (void *)test_cacert3_ca_public_key, sizeof (test_cacert3_ca_public_key) },
{ CKA_TRUSTED, &truev, sizeof (truev) },
{ CKA_ID, "ID1", 3 },
{ CKA_INVALID },
};
static CK_ATTRIBUTE cacert3_distrusted[] = {
{ CKA_VALUE, (void *)test_cacert3_ca_der, sizeof (test_cacert3_ca_der) },
{ CKA_CLASS, &certificate_class, sizeof (certificate_class) },
{ CKA_CERTIFICATE_TYPE, &x509_type, sizeof (x509_type) },
{ CKA_LABEL, "Another CaCert", 11 },
{ CKA_SUBJECT, (void *)test_cacert3_ca_subject, sizeof (test_cacert3_ca_subject) },
{ CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
{ CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
{ CKA_X_DISTRUSTED, &truev, sizeof (truev) },
{ CKA_INVALID },
};
static CK_ATTRIBUTE cacert3_distrusted_by_key[] = {
{ CKA_CLASS, &public_key_class, sizeof (public_key_class) },
{ CKA_PUBLIC_KEY_INFO, (void *)test_cacert3_ca_public_key, sizeof (test_cacert3_ca_public_key) },
{ CKA_X_DISTRUSTED, &truev, sizeof (truev) },
{ CKA_INVALID },
};
static CK_ATTRIBUTE certificate_filter[] = {
{ CKA_CLASS, &certificate_class, sizeof (certificate_class) },
{ CKA_INVALID },
};
static CK_ATTRIBUTE extension_eku_server_client[] = {
{ CKA_CLASS, &extension_class, sizeof (extension_class) },
{ CKA_ID, "ID1", 3 },
{ CKA_OBJECT_ID, (void *)P11_OID_EXTENDED_KEY_USAGE, sizeof (P11_OID_EXTENDED_KEY_USAGE) },
{ CKA_VALUE, "\x30\x1d\x06\x03\x55\x1d\x25\x04\x16\x30\x14\x06\x08\x2b\x06\x01\x05\x05\x07\x03\x01\x06\x08\x2b\x06\x01\x05\x05\x07\x03\x02", 31 },
{ CKA_PUBLIC_KEY_INFO, (void *)test_cacert3_ca_public_key, sizeof (test_cacert3_ca_public_key) },
{ CKA_INVALID },
};
static CK_ATTRIBUTE extension_eku_invalid[] = {
{ CKA_CLASS, &extension_class, sizeof (extension_class) },
{ CKA_ID, "ID1", 3 },
{ CKA_OBJECT_ID, (void *)P11_OID_EXTENDED_KEY_USAGE, sizeof (P11_OID_EXTENDED_KEY_USAGE) },
{ CKA_PUBLIC_KEY_INFO, (void *)test_cacert3_ca_public_key, sizeof (test_cacert3_ca_public_key) },
{ CKA_VALUE, "\x30\x0e\x06\x03\x55\x1d\x25\x04\x07\x69\x6e\x76\x61\x6c\x69\x64", 16 },
{ CKA_INVALID },
};
static CK_ATTRIBUTE extension_eku_any[] = {
{ CKA_CLASS, &extension_class, sizeof (extension_class) },
{ CKA_ID, "ID1", 3 },
{ CKA_OBJECT_ID, (void *)P11_OID_EXTENDED_KEY_USAGE, sizeof (P11_OID_EXTENDED_KEY_USAGE) },
{ CKA_PUBLIC_KEY_INFO, (void *)test_cacert3_ca_public_key, sizeof (test_cacert3_ca_public_key) },
/* anyExtendedKeyUsage ('2 5 29 37 0') and
* Microsoft Smart Card Logon ('1 3 6 1 4 1 311 20 2 2') */
{ CKA_VALUE, "\x30\x1b\x06\x03\x55\x1d\x25\x04\x14\x30\x12\x06\x04\x55\x1d\x25\x00\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x14\x02\x02", 29 },
{ CKA_INVALID },
};
static void
test_info_simple_certificate (void)
{
void *value;
size_t length;
CK_RV rv;
assert_ptr_not_null (test.ex.asn1_defs);
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, extension_eku_server_client);
p11_kit_iter_add_filter (test.ex.iter, certificate_filter, 1);
p11_enumerate_ready (&test.ex, NULL);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
assert_num_eq (CKO_CERTIFICATE, test.ex.klass);
assert_ptr_not_null (test.ex.attrs);
value = p11_attrs_find_value (test.ex.attrs, CKA_VALUE, &length);
assert_ptr_not_null (value);
assert (memcmp (value, test_cacert3_ca_der, length) == 0);
assert_ptr_not_null (test.ex.cert_der);
assert (memcmp (test.ex.cert_der, test_cacert3_ca_der, test.ex.cert_len) == 0);
assert_ptr_not_null (test.ex.cert_asn);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
}
static void
test_info_limit_purposes (void)
{
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, extension_eku_server_client);
/* This should not match the above, with the attached certificate ext */
assert_ptr_eq (NULL, test.ex.limit_to_purposes);
p11_enumerate_opt_purpose (&test.ex, "1.1.1");
assert_ptr_not_null (test.ex.limit_to_purposes);
p11_kit_iter_add_filter (test.ex.iter, certificate_filter, 1);
p11_enumerate_ready (&test.ex, NULL);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
}
static void
test_info_invalid_purposes (void)
{
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, extension_eku_invalid);
p11_kit_iter_add_filter (test.ex.iter, certificate_filter, 1);
p11_enumerate_ready (&test.ex, NULL);
p11_kit_be_quiet ();
/* No results due to invalid purpose on certificate */
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
p11_kit_be_loud ();
}
static void
test_info_skip_non_certificate (void)
{
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
p11_enumerate_ready (&test.ex, NULL);
p11_message_quiet ();
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
assert_num_eq (CKO_CERTIFICATE, test.ex.klass);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
p11_message_loud ();
}
static void
test_limit_to_purpose_match (void)
{
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, extension_eku_server_client);
p11_enumerate_opt_purpose (&test.ex, P11_OID_SERVER_AUTH_STR);
p11_enumerate_ready (&test.ex, NULL);
p11_message_quiet ();
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
p11_message_loud ();
}
static void
test_limit_to_purpose_no_match (void)
{
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, extension_eku_server_client);
p11_enumerate_opt_purpose (&test.ex, "3.3.3.3");
p11_enumerate_ready (&test.ex, NULL);
p11_message_quiet ();
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
p11_message_loud ();
}
static void
test_limit_to_purpose_match_any (void)
{
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, extension_eku_any);
p11_enumerate_opt_purpose (&test.ex, P11_OID_SERVER_AUTH_STR);
p11_enumerate_ready (&test.ex, NULL);
p11_message_quiet ();
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
p11_message_loud ();
}
static void
test_duplicate_extract (void)
{
CK_ATTRIBUTE certificate = { CKA_CLASS, &certificate_class, sizeof (certificate_class) };
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_distrusted);
p11_kit_iter_add_filter (test.ex.iter, &certificate, 1);
p11_enumerate_ready (&test.ex, NULL);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
}
static void
test_duplicate_distrusted (void)
{
CK_ATTRIBUTE certificate = { CKA_CLASS, &certificate_class, sizeof (certificate_class) };
CK_ATTRIBUTE attrs[] = {
{ CKA_X_DISTRUSTED, NULL, 0 },
};
CK_BBOOL val;
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_distrusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
test.ex.flags = P11_ENUMERATE_COLLAPSE | P11_ENUMERATE_CORRELATE;
p11_kit_iter_add_filter (test.ex.iter, &certificate, 1);
p11_enumerate_ready (&test.ex, NULL);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
rv = p11_kit_iter_load_attributes (test.ex.iter, attrs, 1);
assert_num_eq (CKR_OK, rv);
assert (p11_attrs_findn_bool (attrs, 1, CKA_X_DISTRUSTED, &val));
assert_num_eq (val, CK_TRUE);
free (attrs[0].pValue);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
}
static void
test_trusted_match (void)
{
CK_ATTRIBUTE certificate = { CKA_CLASS, &certificate_class, sizeof (certificate_class) };
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_distrusted);
test.ex.flags = P11_ENUMERATE_ANCHORS | P11_ENUMERATE_CORRELATE;
p11_kit_iter_add_filter (test.ex.iter, &certificate, 1);
p11_enumerate_ready (&test.ex, NULL);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
}
static void
test_distrust_match (void)
{
CK_ATTRIBUTE certificate = { CKA_CLASS, &certificate_class, sizeof (certificate_class) };
CK_BBOOL boolv;
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_distrusted);
test.ex.flags = P11_ENUMERATE_BLACKLIST | P11_ENUMERATE_CORRELATE;
p11_kit_iter_add_filter (test.ex.iter, &certificate, 1);
p11_enumerate_ready (&test.ex, NULL);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
if (!p11_attrs_find_bool (test.ex.attrs, CKA_X_DISTRUSTED, &boolv))
boolv = CK_FALSE;
assert_num_eq (CK_TRUE, boolv);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
}
static void
test_override_by_issuer_serial (void)
{
CK_ATTRIBUTE certificate = { CKA_CLASS, &certificate_class, sizeof (certificate_class) };
CK_BBOOL distrusted = CK_FALSE;
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_distrusted);
test.ex.flags = P11_ENUMERATE_ANCHORS | P11_ENUMERATE_BLACKLIST | P11_ENUMERATE_CORRELATE;
p11_kit_iter_add_filter (test.ex.iter, &certificate, 1);
p11_enumerate_ready (&test.ex, NULL);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_OK, rv);
assert (p11_attrs_find_bool (test.ex.attrs, CKA_X_DISTRUSTED, &distrusted));
assert_num_eq (CK_TRUE, distrusted);
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
}
static void
test_override_by_public_key (void)
{
CK_ATTRIBUTE certificate = { CKA_CLASS, &certificate_class, sizeof (certificate_class) };
CK_RV rv;
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_distrusted_by_key);
test.ex.flags = P11_ENUMERATE_ANCHORS | P11_ENUMERATE_BLACKLIST | P11_ENUMERATE_CORRELATE;
p11_kit_iter_add_filter (test.ex.iter, &certificate, 1);
p11_enumerate_ready (&test.ex, NULL);
/* No results returned, because distrust is not a cert */
rv = p11_kit_iter_next (test.ex.iter);
assert_num_eq (CKR_CANCEL, rv);
}
int
main (int argc,
char *argv[])
{
mock_module_init ();
p11_test (test_file_name_for_label, "/extract/test_file_name_for_label");
p11_test (test_file_name_for_class, "/extract/test_file_name_for_class");
p11_test (test_comment_for_label, "/extract/test_comment_for_label");
p11_test (test_comment_not_enabled, "/extract/test_comment_not_enabled");
p11_fixture (setup, teardown);
p11_test (test_info_simple_certificate, "/extract/test_info_simple_certificate");
p11_test (test_info_limit_purposes, "/extract/test_info_limit_purposes");
p11_test (test_info_invalid_purposes, "/extract/test_info_invalid_purposes");
p11_test (test_info_skip_non_certificate, "/extract/test_info_skip_non_certificate");
p11_test (test_limit_to_purpose_match, "/extract/test_limit_to_purpose_match");
p11_test (test_limit_to_purpose_no_match, "/extract/test_limit_to_purpose_no_match");
p11_test (test_limit_to_purpose_match_any, "/extract/test_limit_to_purpose_no_match_any");
p11_test (test_duplicate_extract, "/extract/test_duplicate_extract");
p11_test (test_duplicate_distrusted, "/extract/test-duplicate-distrusted");
p11_test (test_trusted_match, "/extract/test_trusted_match");
p11_test (test_distrust_match, "/extract/test_distrust_match");
p11_test (test_override_by_issuer_serial, "/extract/override-by-issuer-and-serial");
p11_test (test_override_by_public_key, "/extract/override-by-public-key");
return p11_test_run (argc, argv);
}
#include "enumerate.c"