path: root/nss/cmd/libpkix/pkix_pl/module/test_pk11certstore.c

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
 * test_pk11certstore.c
 *
 * Test Pk11CertStore Type
 *
 */

#include "testutil.h"
#include "testutil_nss.h"

static void *plContext = NULL;

/*
 * This function creates a certSelector with ComCertSelParams set up to
 * select entries whose Subject Name matches that in the given Cert and
 * whose validity window includes the Date specified by "validityDate".
 */
static void
test_makeSubjectCertSelector(
    PKIX_PL_Cert *certNameToMatch,
    PKIX_PL_Date *validityDate,
    PKIX_CertSelector **pSelector,
    void *plContext)
{
    PKIX_CertSelector *selector = NULL;
    PKIX_ComCertSelParams *subjParams = NULL;
    PKIX_PL_X500Name *subjectName = NULL;

    PKIX_TEST_STD_VARS();

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&subjParams, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubject(certNameToMatch, &subjectName, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubject(subjParams, subjectName, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetCertificateValid(subjParams, validityDate, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, subjParams, plContext));
    *pSelector = selector;

cleanup:

    PKIX_TEST_DECREF_AC(subjParams);
    PKIX_TEST_DECREF_AC(subjectName);

    PKIX_TEST_RETURN();
}

/*
 * This function creates a certSelector with ComCertSelParams set up to
 * select entries containing a Basic Constraints extension with a path
 * length of at least the specified "minPathLength".
 */
static void
test_makePathCertSelector(
    PKIX_Int32 minPathLength,
    PKIX_CertSelector **pSelector,
    void *plContext)
{
    PKIX_CertSelector *selector = NULL;
    PKIX_ComCertSelParams *pathParams = NULL;

    PKIX_TEST_STD_VARS();

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&pathParams, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(pathParams, minPathLength, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, pathParams, plContext));
    *pSelector = selector;

cleanup:

    PKIX_TEST_DECREF_AC(pathParams);

    PKIX_TEST_RETURN();
}

/*
 * This function reads a directory-file cert specified by "desiredSubjectCert",
 * and decodes the SubjectName. It uses that name to set up the CertSelector
 * for a Subject Name match, and then queries the database for matching entries.
 * It is intended to test a "smart" database query.
 */
static void
testMatchCertSubject(
    char *crlDir,
    char *desiredSubjectCert,
    char *expectedAscii,
    PKIX_PL_Date *validityDate,
    void *plContext)
{
    PKIX_UInt32 numCert = 0;
    PKIX_PL_Cert *certWithDesiredSubject = NULL;
    PKIX_CertStore *certStore = NULL;
    PKIX_CertSelector *certSelector = NULL;
    PKIX_List *certList = NULL;
    PKIX_CertStore_CertCallback getCert = NULL;
    void *nbioContext = NULL;

    PKIX_TEST_STD_VARS();

    certWithDesiredSubject = createCert(crlDir, desiredSubjectCert, plContext);

    test_makeSubjectCertSelector(certWithDesiredSubject,
                                 validityDate,
                                 &certSelector,
                                 plContext);

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Pk11CertStore_Create(&certStore, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &getCert, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(getCert(certStore,
                                      certSelector,
                                      &nbioContext,
                                      &certList,
                                      plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext));

    if (numCert > 0) {
        /* List should be immutable */
        PKIX_TEST_EXPECT_ERROR(PKIX_List_DeleteItem(certList, 0, plContext));
    }

    if (expectedAscii) {
        testToStringHelper((PKIX_PL_Object *)certList, expectedAscii, plContext);
    }

cleanup:

    PKIX_TEST_DECREF_AC(certWithDesiredSubject);
    PKIX_TEST_DECREF_AC(certStore);
    PKIX_TEST_DECREF_AC(certSelector);
    PKIX_TEST_DECREF_AC(certList);

    PKIX_TEST_RETURN();
}

/*
 * This function uses the minimum path length specified by "minPath" to set up
 * a CertSelector for a BasicConstraints match, and then queries the database
 * for matching entries. It is intended to test the case where there
 * is no "smart" database query, so the database will be asked for all
 * available certs and the filtering will be done by the interaction of the
 * certstore and the selector.
 */
static void
testMatchCertMinPath(
    PKIX_Int32 minPath,
    char *expectedAscii,
    void *plContext)
{
    PKIX_CertStore *certStore = NULL;
    PKIX_CertSelector *certSelector = NULL;
    PKIX_List *certList = NULL;
    PKIX_CertStore_CertCallback getCert = NULL;
    void *nbioContext = NULL;

    PKIX_TEST_STD_VARS();

    subTest("Searching Certs for minPath");

    test_makePathCertSelector(minPath, &certSelector, plContext);

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Pk11CertStore_Create(&certStore, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &getCert, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(getCert(certStore,
                                      certSelector,
                                      &nbioContext,
                                      &certList,
                                      plContext));

    if (expectedAscii) {
        testToStringHelper((PKIX_PL_Object *)certList, expectedAscii, plContext);
    }

cleanup:

    PKIX_TEST_DECREF_AC(certStore);
    PKIX_TEST_DECREF_AC(certSelector);
    PKIX_TEST_DECREF_AC(certList);

    PKIX_TEST_RETURN();
}

/*
 * This function creates a crlSelector with ComCrlSelParams set up to
 * select entries whose Issuer Name matches that in the given Crl.
 */
static void
test_makeIssuerCRLSelector(
    PKIX_PL_CRL *crlNameToMatch,
    PKIX_CRLSelector **pSelector,
    void *plContext)
{
    PKIX_CRLSelector *selector = NULL;
    PKIX_ComCRLSelParams *issuerParams = NULL;
    PKIX_PL_X500Name *issuerName = NULL;
    PKIX_List *names = NULL;

    PKIX_TEST_STD_VARS();

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create(NULL, NULL, &selector, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_Create(&issuerParams, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CRL_GetIssuer(crlNameToMatch, &issuerName, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&names, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(names, (PKIX_PL_Object *)issuerName, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_SetIssuerNames(issuerParams, names, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_SetCommonCRLSelectorParams(selector, issuerParams, plContext));
    *pSelector = selector;

cleanup:

    PKIX_TEST_DECREF_AC(issuerParams);
    PKIX_TEST_DECREF_AC(issuerName);
    PKIX_TEST_DECREF_AC(names);

    PKIX_TEST_RETURN();
}

/*
 * This function creates a crlSelector with ComCrlSelParams set up to
 * select entries that would be valid at the Date specified by the Date
 * criterion.
 */
static void
test_makeDateCRLSelector(
    PKIX_PL_Date *dateToMatch,
    PKIX_CRLSelector **pSelector,
    void *plContext)
{
    PKIX_CRLSelector *selector = NULL;
    PKIX_ComCRLSelParams *dateParams = NULL;

    PKIX_TEST_STD_VARS();

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create(NULL, NULL, &selector, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_Create(&dateParams, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_SetDateAndTime(dateParams, dateToMatch, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_SetCommonCRLSelectorParams(selector, dateParams, plContext));
    *pSelector = selector;

cleanup:
    PKIX_TEST_DECREF_AC(dateParams);

    PKIX_TEST_RETURN();
}

/*
 * This function reads a directory-file crl specified by "desiredIssuerCrl",
 * and decodes the IssuerName. It uses that name to set up the CrlSelector
 * for a Issuer Name match, and then queries the database for matching entries.
 * It is intended to test the case of a "smart" database query.
 */
static void
testMatchCrlIssuer(
    char *crlDir,
    char *desiredIssuerCrl,
    char *expectedAscii,
    void *plContext)
{
    PKIX_UInt32 numCrl = 0;
    PKIX_PL_CRL *crlWithDesiredIssuer = NULL;
    PKIX_CertStore *crlStore = NULL;
    PKIX_CRLSelector *crlSelector = NULL;
    PKIX_List *crlList = NULL;
    PKIX_CertStore_CRLCallback getCrl = NULL;
    void *nbioContext = NULL;

    PKIX_TEST_STD_VARS();

    subTest("Searching CRLs for matching Issuer");

    crlWithDesiredIssuer = createCRL(crlDir, desiredIssuerCrl, plContext);

    test_makeIssuerCRLSelector(crlWithDesiredIssuer, &crlSelector, plContext);

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Pk11CertStore_Create(&crlStore, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCRLCallback(crlStore, &getCrl, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(getCrl(crlStore,
                                     crlSelector,
                                     &nbioContext,
                                     &crlList,
                                     plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(crlList, &numCrl, plContext));

    if (numCrl > 0) {
        /* List should be immutable */
        PKIX_TEST_EXPECT_ERROR(PKIX_List_DeleteItem(crlList, 0, plContext));
    }

    if (expectedAscii) {
        testToStringHelper((PKIX_PL_Object *)crlList, expectedAscii, plContext);
    }

cleanup:

    PKIX_TEST_DECREF_AC(crlWithDesiredIssuer);
    PKIX_TEST_DECREF_AC(crlStore);
    PKIX_TEST_DECREF_AC(crlSelector);
    PKIX_TEST_DECREF_AC(crlList);

    PKIX_TEST_RETURN();
}

/*
 * This function uses the date specified by "matchDate" to set up the
 * CrlSelector for a Date match. It is intended to test the case where there
 * is no "smart" database query, so the CertStore should throw an error
 * rather than ask the database for all available CRLs and then filter the
 * results using the selector.
 */
static void
testMatchCrlDate(
    char *dateMatch,
    char *expectedAscii,
    void *plContext)
{
    PKIX_PL_Date *dateCriterion = NULL;
    PKIX_CertStore *crlStore = NULL;
    PKIX_CRLSelector *crlSelector = NULL;
    PKIX_List *crlList = NULL;
    PKIX_CertStore_CRLCallback getCrl = NULL;

    PKIX_TEST_STD_VARS();

    subTest("Searching CRLs for matching Date");

    dateCriterion = createDate(dateMatch, plContext);
    test_makeDateCRLSelector(dateCriterion, &crlSelector, plContext);

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Pk11CertStore_Create(&crlStore, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCRLCallback(crlStore, &getCrl, plContext));

    PKIX_TEST_EXPECT_ERROR(getCrl(crlStore, crlSelector, NULL, &crlList, plContext));

cleanup:

    PKIX_TEST_DECREF_AC(dateCriterion);
    PKIX_TEST_DECREF_AC(crlStore);
    PKIX_TEST_DECREF_AC(crlSelector);
    PKIX_TEST_DECREF_AC(crlList);

    PKIX_TEST_RETURN();
}

static void
printUsage(char *pName)
{
    printf("\nUSAGE: %s <-d data-dir> <database-dir>\n\n", pName);
}

/* Functional tests for Pk11CertStore public functions */

int
test_pk11certstore(int argc, char *argv[])
{

    PKIX_UInt32 j = 0;
    PKIX_UInt32 actualMinorVersion;
    PKIX_PL_Date *validityDate = NULL;
    PKIX_PL_Date *betweenDate = NULL;
    char *crlDir = NULL;
    char *expectedProfAscii = "([\n"
                              "\tVersion:         v3\n"
                              "\tSerialNumber:    00ca\n"
                              "\tIssuer:          CN=chemistry,O=mit,C=us\n"
                              "\tSubject:         CN=prof noall,O=mit,C=us\n"
                              "\tValidity: [From: Fri Feb 11 14:14:06 2005\n"
                              "\t           To:   Mon Jan 18, 2105]\n"
                              "\tSubjectAltNames: (null)\n"
                              "\tAuthorityKeyId:  (null)\n"
                              "\tSubjectKeyId:    (null)\n"
                              "\tSubjPubKeyAlgId: ANSI X9.57 DSA Signature\n"
                              "\tCritExtOIDs:     (2.5.29.15, 2.5.29.19)\n"
                              "\tExtKeyUsages:    (null)\n"
                              "\tBasicConstraint: CA(6)\n"
                              "\tCertPolicyInfo:  (null)\n"
                              "\tPolicyMappings:  (null)\n"
                              "\tExplicitPolicy:  -1\n"
                              "\tInhibitMapping:  -1\n"
                              "\tInhibitAnyPolicy:-1\n"
                              "\tNameConstraints: (null)\n"
                              "]\n"
                              ", [\n"
                              "\tVersion:         v3\n"
                              "\tSerialNumber:    03\n"
                              "\tIssuer:          CN=physics,O=mit,C=us\n"
                              "\tSubject:         CN=prof noall,O=mit,C=us\n"
                              "\tValidity: [From: Fri Feb 11 12:52:26 2005\n"
                              "\t           To:   Mon Jan 18, 2105]\n"
                              "\tSubjectAltNames: (null)\n"
                              "\tAuthorityKeyId:  (null)\n"
                              "\tSubjectKeyId:    (null)\n"
                              "\tSubjPubKeyAlgId: ANSI X9.57 DSA Signature\n"
                              "\tCritExtOIDs:     (2.5.29.15, 2.5.29.19)\n"
                              "\tExtKeyUsages:    (null)\n"
                              "\tBasicConstraint: CA(0)\n"
                              "\tCertPolicyInfo:  (null)\n"
                              "\tPolicyMappings:  (null)\n"
                              "\tExplicitPolicy:  -1\n"
                              "\tInhibitMapping:  -1\n"
                              "\tInhibitAnyPolicy:-1\n"
                              "\tNameConstraints: (null)\n"
                              "]\n"
                              ")";
    char *expectedValidityAscii = "([\n"
                                  "\tVersion:         v3\n"
                                  "\tSerialNumber:    03\n"
                                  "\tIssuer:          CN=physics,O=mit,C=us\n"
                                  "\tSubject:         CN=prof noall,O=mit,C=us\n"
                                  "\tValidity: [From: Fri Feb 11 12:52:26 2005\n"
                                  "\t           To:   Mon Jan 18, 2105]\n"
                                  "\tSubjectAltNames: (null)\n"
                                  "\tAuthorityKeyId:  (null)\n"
                                  "\tSubjectKeyId:    (null)\n"
                                  "\tSubjPubKeyAlgId: ANSI X9.57 DSA Signature\n"
                                  "\tCritExtOIDs:     (2.5.29.15, 2.5.29.19)\n"
                                  "\tExtKeyUsages:    (null)\n"
                                  "\tBasicConstraint: CA(0)\n"
                                  "\tCertPolicyInfo:  (null)\n"
                                  "\tPolicyMappings:  (null)\n"
                                  "\tExplicitPolicy:  -1\n"
                                  "\tInhibitMapping:  -1\n"
                                  "\tInhibitAnyPolicy:-1\n"
                                  "\tNameConstraints: (null)\n"
                                  "]\n"
                                  ")";
    char *expectedMinPathAscii = "([\n"
                                 "\tVersion:         v3\n"
                                 "\tSerialNumber:    01\n"
                                 "\tIssuer:          CN=science,O=mit,C=us\n"
                                 "\tSubject:         CN=science,O=mit,C=us\n"
                                 "\tValidity: [From: Fri Feb 11 12:47:58 2005\n"
                                 "\t           To:   Mon Jan 18, 2105]\n"
                                 "\tSubjectAltNames: (null)\n"
                                 "\tAuthorityKeyId:  (null)\n"
                                 "\tSubjectKeyId:    (null)\n"
                                 "\tSubjPubKeyAlgId: ANSI X9.57 DSA Signature\n"
                                 "\tCritExtOIDs:     (2.5.29.15, 2.5.29.19)\n"
                                 "\tExtKeyUsages:    (null)\n"
                                 "\tBasicConstraint: CA(10)\n"
                                 "\tCertPolicyInfo:  (null)\n"
                                 "\tPolicyMappings:  (null)\n"
                                 "\tExplicitPolicy:  -1\n"
                                 "\tInhibitMapping:  -1\n"
                                 "\tInhibitAnyPolicy:-1\n"
                                 "\tNameConstraints: (null)\n"
                                 "]\n"
                                 ")";
    char *expectedIssuerAscii = "([\n"
                                "\tVersion:         v2\n"
                                "\tIssuer:          CN=physics,O=mit,C=us\n"
                                "\tUpdate:   [Last: Fri Feb 11 13:51:38 2005\n"
                                "\t           Next: Mon Jan 18, 2105]\n"
                                "\tSignatureAlgId:  1.2.840.10040.4.3\n"
                                "\tCRL Number     : (null)\n"
                                "\n"
                                "\tEntry List:      (\n"
                                "\t[\n"
                                "\tSerialNumber:    67\n"
                                "\tReasonCode:      257\n"
                                "\tRevocationDate:  Fri Feb 11 13:51:38 2005\n"
                                "\tCritExtOIDs:     (EMPTY)\n"
                                "\t]\n"
                                "\t)\n"
                                "\n"
                                "\tCritExtOIDs:     (EMPTY)\n"
                                "]\n"
                                ")";
    char *expectedDateAscii = "([\n"
                              "\tVersion:         v2\n"
                              "\tIssuer:          CN=science,O=mit,C=us\n"
                              "\tUpdate:   [Last: Fri Feb 11 13:34:40 2005\n"
                              "\t           Next: Mon Jan 18, 2105]\n"
                              "\tSignatureAlgId:  1.2.840.10040.4.3\n"
                              "\tCRL Number     : (null)\n"
                              "\n"
                              "\tEntry List:      (\n"
                              "\t[\n"
                              "\tSerialNumber:    65\n"
                              "\tReasonCode:      260\n"
                              "\tRevocationDate:  Fri Feb 11 13:34:40 2005\n"
                              "\tCritExtOIDs:     (EMPTY)\n"
                              "\t]\n"
                              "\t)\n"
                              "\n"
                              "\tCritExtOIDs:     (EMPTY)\n"
                              "]\n"
                              ", [\n"
                              "\tVersion:         v2\n"
                              "\tIssuer:          CN=testing CRL,O=test,C=us\n"
                              "\tUpdate:   [Last: Fri Feb 11 13:14:38 2005\n"
                              "\t           Next: Mon Jan 18, 2105]\n"
                              "\tSignatureAlgId:  1.2.840.10040.4.3\n"
                              "\tCRL Number     : (null)\n"
                              "\n"
                              "\tEntry List:      (\n"
                              "\t[\n"
                              "\tSerialNumber:    67\n"
                              "\tReasonCode:      258\n"
                              "\tRevocationDate:  Fri Feb 11 13:14:38 2005\n"
                              "\tCritExtOIDs:     (EMPTY)\n"
                              "\t]\n"
                              "\t)\n"
                              "\n"
                              "\tCritExtOIDs:     (EMPTY)\n"
                              "]\n"
                              ")";

    PKIX_TEST_STD_VARS();

    startTests("Pk11CertStore");

    if (argc < 3) {
        printUsage(argv[0]);
        return (0);
    }

    PKIX_TEST_EXPECT_NO_ERROR(
        PKIX_PL_NssContext_Create(0, PKIX_FALSE, NULL, &plContext));

    crlDir = argv[j + 2];

    /* Two certs for prof should be valid now */
    PKIX_TEST_EXPECT_NO_ERROR(pkix_pl_Date_CreateFromPRTime(PR_Now(), &validityDate, plContext));

    subTest("Searching Certs for Subject");

    testMatchCertSubject(crlDir,
                         "phy2prof.crt",
                         NULL, /* expectedProfAscii, */
                         validityDate,
                         plContext);

    /* One of the certs was not yet valid at this time. */
    betweenDate = createDate("050210184000Z", plContext);

    subTest("Searching Certs for Subject and Validity");

    testMatchCertSubject(crlDir,
                         "phy2prof.crt",
                         NULL, /* expectedValidityAscii, */
                         betweenDate,
                         plContext);

    testMatchCertMinPath(9,
                         NULL, /* expectedMinPathAscii, */
                         plContext);

    testMatchCrlIssuer(crlDir,
                       "phys.crl",
                       NULL, /* expectedIssuerAscii, */
                       plContext);

    testMatchCrlDate("050211184000Z",
                     NULL, /* expectedDateAscii, */
                     plContext);

cleanup:

    PKIX_TEST_DECREF_AC(validityDate);
    PKIX_TEST_DECREF_AC(betweenDate);

    PKIX_TEST_RETURN();

    endTests("Pk11CertStore");

    return (0);
}