const char **rejects)
{
CK_ATTRIBUTE *attrs = NULL;
+ CK_ATTRIBUTE *match = NULL;
CK_TRUST allow;
CK_RV rv;
CK_OBJECT_CLASS klassv = CKO_NSS_TRUST;
CK_BYTE sha1v[P11_CHECKSUM_SHA1_LENGTH];
CK_BYTE md5v[P11_CHECKSUM_MD5_LENGTH];
- CK_BBOOL generated = CK_FALSE;
+ CK_BBOOL generatedv = CK_FALSE;
CK_BBOOL falsev = CK_FALSE;
- CK_BBOOL truev = CK_TRUE;
CK_ATTRIBUTE klass = { CKA_CLASS, &klassv, sizeof (klassv) };
CK_ATTRIBUTE modifiable = { CKA_MODIFIABLE, &falsev, sizeof (falsev) };
- CK_ATTRIBUTE autogen = { CKA_X_GENERATED, &truev, sizeof (truev) };
+ CK_ATTRIBUTE generated = { CKA_X_GENERATED, &generatedv, sizeof (generatedv) };
CK_ATTRIBUTE invalid = { CKA_INVALID, };
CK_ATTRIBUTE md5_hash = { CKA_CERT_MD5_HASH, md5v, sizeof (md5v) };
CK_ATTRIBUTE_PTR issuer;
CK_ATTRIBUTE_PTR serial_number;
- void *der;
- size_t der_len;
-
- CK_ATTRIBUTE match[] = {
- { CKA_CERT_SHA1_HASH, sha1v, sizeof (sha1v) },
- { CKA_CLASS, &klassv, sizeof (klassv) },
- { CKA_X_GENERATED, &generated, sizeof (generated) },
- { CKA_INVALID }
- };
+ void *value;
+ size_t length;
- /* Setup the hashes of the DER certificate value */
- der = p11_attrs_find_value (cert, CKA_VALUE, &der_len);
- return_if_fail (der != NULL);
- p11_checksum_md5 (md5v, der, der_len, NULL);
- p11_checksum_sha1 (sha1v, der, der_len, NULL);
+ issuer = p11_attrs_find_valid (cert, CKA_ISSUER);
+ serial_number = p11_attrs_find_valid (cert, CKA_SERIAL_NUMBER);
+ value = p11_attrs_find_value (cert, CKA_VALUE, &length);
- /* If there is a non-auto-generated NSS trust object, then step away */
- generated = CK_FALSE;
- if (p11_index_find (index, match))
+ if (!issuer && !serial_number && !value) {
+ p11_debug ("can't generate nss trust object for certificate without issuer+serial or value");
return;
+ }
- /* Copy all of the following attributes from certificate */
- id = p11_attrs_find_valid (cert, CKA_ID);
- return_if_fail (id != NULL);
- subject = p11_attrs_find_valid (cert, CKA_SUBJECT);
- if (subject == NULL)
- subject = &invalid;
- issuer = p11_attrs_find_valid (cert, CKA_ISSUER);
- if (issuer == NULL)
+ if (value == NULL) {
+ md5_hash.type = CKA_INVALID;
+ sha1_hash.type = CKA_INVALID;
+ } else {
+ p11_checksum_md5 (md5v, value, length, NULL);
+ p11_checksum_sha1 (sha1v, value, length, NULL);
+ }
+ if (!issuer)
issuer = &invalid;
- serial_number = p11_attrs_find_valid (cert, CKA_SERIAL_NUMBER);
- if (serial_number == NULL)
+ if (!serial_number)
serial_number = &invalid;
- /* Try to use the same label */
- label = p11_attrs_find_valid (cert, CKA_LABEL);
- if (label == NULL)
- label = &invalid;
+ match = p11_attrs_build (NULL, issuer, serial_number, sha1_hash,
+ &generated, &klass, NULL);
+ return_if_fail (match != NULL);
- attrs = p11_attrs_build (NULL, &klass, &modifiable, id, label,
- subject, issuer, serial_number, &md5_hash, &sha1_hash,
- &step_up_approved, &autogen, NULL);
- return_if_fail (attrs != NULL);
+ /* If we find a non-generated object, then don't generate */
+ if (p11_index_find (index, match)) {
+ p11_debug ("not generating nss trust object because one already exists");
+ attrs = NULL;
- /* Calculate the default allow trust */
- if (distrust)
- allow = CKT_NSS_NOT_TRUSTED;
- else if (trust && authority)
- allow = CKT_NSS_TRUSTED_DELEGATOR;
- else if (trust)
- allow = CKT_NSS_TRUSTED;
- else
- allow = CKT_NSS_TRUST_UNKNOWN;
+ } else {
+ generatedv = CK_TRUE;
+ match = p11_attrs_build (match, &generated, NULL);
+ return_if_fail (match != NULL);
+
+ /* Copy all of the following attributes from certificate */
+ id = p11_attrs_find_valid (cert, CKA_ID);
+ if (id == NULL)
+ id = &invalid;
+ subject = p11_attrs_find_valid (cert, CKA_SUBJECT);
+ if (subject == NULL)
+ subject = &invalid;
+ label = p11_attrs_find_valid (cert, CKA_LABEL);
+ if (label == NULL)
+ label = &invalid;
+
+ attrs = p11_attrs_dup (match);
+ return_if_fail (attrs != NULL);
- attrs = build_trust_object_ku (builder, index, cert, attrs, allow);
- return_if_fail (attrs != NULL);
+ attrs = p11_attrs_build (attrs, &klass, &modifiable, id, label,
+ subject, issuer, serial_number,
+ &md5_hash, &sha1_hash, &step_up_approved, NULL);
+ return_if_fail (attrs != NULL);
- attrs = build_trust_object_eku (attrs, allow, purposes, rejects);
- return_if_fail (attrs != NULL);
+ /* Calculate the default allow trust */
+ if (distrust)
+ allow = CKT_NSS_NOT_TRUSTED;
+ else if (trust && authority)
+ allow = CKT_NSS_TRUSTED_DELEGATOR;
+ else if (trust)
+ allow = CKT_NSS_TRUSTED;
+ else
+ allow = CKT_NSS_TRUST_UNKNOWN;
+
+ attrs = build_trust_object_ku (builder, index, cert, attrs, allow);
+ return_if_fail (attrs != NULL);
+
+ attrs = build_trust_object_eku (attrs, allow, purposes, rejects);
+ return_if_fail (attrs != NULL);
+ }
- /* Replace related generated objects with this new one */
- generated = CK_TRUE;
- rv = p11_index_replace (index, match, CKA_CERT_MD5_HASH, attrs);
+ /* Replace related generated object with this new one */
+ rv = p11_index_replace (index, match, CKA_INVALID, attrs);
return_if_fail (rv == CKR_OK);
}
CK_ATTRIBUTE *attrs;
int i;
- label = p11_attrs_find_valid (cert, CKA_LABEL);
- if (label == NULL)
- label = &invalid;
+ if (type == CKT_X_DISTRUSTED_CERTIFICATE) {
+ value = &invalid;
+ issuer = p11_attrs_find_valid (cert, CKA_ISSUER);
+ serial = p11_attrs_find_valid (cert, CKA_SERIAL_NUMBER);
- id = p11_attrs_find_valid (cert, CKA_ID);
- issuer = p11_attrs_find_valid (cert, CKA_ISSUER);
- serial = p11_attrs_find_valid (cert, CKA_SERIAL_NUMBER);
- value = p11_attrs_find_valid (cert, CKA_VALUE);
+ if (!issuer || !serial) {
+ p11_debug ("not building negative trust assertion for certificate without serial or issuer");
+ return;
+ }
- return_if_fail (id != NULL && issuer != NULL && serial != NULL && value != NULL);
+ } else {
+ issuer = &invalid;
+ serial = &invalid;
+ value = p11_attrs_find_valid (cert, CKA_VALUE);
+
+ if (value == NULL) {
+ p11_debug ("not building positive trust assertion for certificate without value");
+ return;
+ }
+ }
+
+ label = p11_attrs_find (cert, CKA_LABEL);
+ if (label == NULL)
+ label = &invalid;
+ id = p11_attrs_find (cert, CKA_ID);
+ if (id == NULL)
+ id = &invalid;
for (i = 0; oids[i] != NULL; i++) {
purpose.pValue = (void *)oids[i];
}
static void
-build_trust_assertions (p11_array *built,
+build_trust_assertions (p11_array *positives,
+ p11_array *negatives,
CK_ATTRIBUTE *cert,
CK_BBOOL trust,
CK_BBOOL distrust,
};
/* Build assertions for anything that's explicitly rejected */
- if (rejects) {
- build_assertions (built, cert, CKT_X_DISTRUSTED_CERTIFICATE, rejects);
+ if (rejects && negatives) {
+ build_assertions (negatives, cert, CKT_X_DISTRUSTED_CERTIFICATE, rejects);
}
- if (distrust) {
+ if (distrust && negatives) {
/*
* Trust assertions are defficient in that they don't blacklist a certificate
* for any purposes. So we just have to go wild and write out a bunch of
* assertions for all our known purposes.
*/
- build_assertions (built, cert, CKT_X_DISTRUSTED_CERTIFICATE, all_purposes);
+ build_assertions (negatives, cert, CKT_X_DISTRUSTED_CERTIFICATE, all_purposes);
}
/*
* certificates where not an authority.
*/
- if (trust && authority) {
+ if (trust && authority && positives) {
if (purposes) {
/* If purposes explicitly set, then anchor for those purposes */
- build_assertions (built, cert, CKT_X_ANCHORED_CERTIFICATE, purposes);
+ build_assertions (positives, cert, CKT_X_ANCHORED_CERTIFICATE, purposes);
} else {
/* If purposes not-explicitly set, then anchor for all known */
- build_assertions (built, cert, CKT_X_ANCHORED_CERTIFICATE, all_purposes);
+ build_assertions (positives, cert, CKT_X_ANCHORED_CERTIFICATE, all_purposes);
}
}
}
const char **rejects)
{
CK_OBJECT_CLASS assertion = CKO_X_TRUST_ASSERTION;
- CK_BBOOL generated = CK_FALSE;
+ CK_BBOOL generated = CK_TRUE;
+ p11_array *positives = NULL;
+ p11_array *negatives = NULL;
CK_ATTRIBUTE *value;
- p11_array *built;
+ CK_ATTRIBUTE *issuer;
+ CK_ATTRIBUTE *serial;
CK_RV rv;
- CK_ATTRIBUTE match[] = {
+ CK_ATTRIBUTE match_positive[] = {
{ CKA_VALUE, },
{ CKA_CLASS, &assertion, sizeof (assertion) },
{ CKA_X_GENERATED, &generated, sizeof (generated) },
{ CKA_INVALID }
};
+ CK_ATTRIBUTE match_negative[] = {
+ { CKA_ISSUER, },
+ { CKA_SERIAL_NUMBER, },
+ { CKA_CLASS, &assertion, sizeof (assertion) },
+ { CKA_X_GENERATED, &generated, sizeof (generated) },
+ { CKA_INVALID }
+ };
+
value = p11_attrs_find_valid (cert, CKA_VALUE);
- return_if_fail (value != NULL);
+ if (value) {
+ positives = p11_array_new (NULL);
+ memcpy (match_positive, value, sizeof (CK_ATTRIBUTE));
+ }
- built = p11_array_new (NULL);
- build_trust_assertions (built, cert, trust, distrust, authority, purposes, rejects);
+ issuer = p11_attrs_find_valid (cert, CKA_ISSUER);
+ serial = p11_attrs_find_valid (cert, CKA_SERIAL_NUMBER);
+ if (issuer && serial) {
+ negatives = p11_array_new (NULL);
+ memcpy (match_negative + 0, issuer, sizeof (CK_ATTRIBUTE));
+ memcpy (match_negative + 1, serial, sizeof (CK_ATTRIBUTE));
+ }
- generated = CK_TRUE;
- match[0].pValue = value->pValue;
- match[0].ulValueLen = value->ulValueLen;
- rv = p11_index_replace_all (index, match, CKA_X_PURPOSE, built);
- return_if_fail (rv == CKR_OK);
+ build_trust_assertions (positives, negatives, cert, trust, distrust,
+ authority, purposes, rejects);
+
+ if (positives) {
+ rv = p11_index_replace_all (index, match_positive, CKA_X_PURPOSE, positives);
+ return_if_fail (rv == CKR_OK);
+ p11_array_free (positives);
+ }
- p11_array_free (built);
+ if (negatives) {
+ rv = p11_index_replace_all (index, match_negative, CKA_X_PURPOSE, negatives);
+ return_if_fail (rv == CKR_OK);
+ p11_array_free (negatives);
+ }
}
static void
p11_index *index,
CK_ATTRIBUTE *attrs)
{
- CK_BBOOL truev = CK_TRUE;
- CK_ATTRIBUTE *id;
- p11_array *array;
- CK_RV rv;
-
- CK_ATTRIBUTE match[] = {
- { CKA_ID, },
- { CKA_X_GENERATED, &truev, sizeof (truev) },
- { CKA_INVALID }
- };
-
- id = p11_attrs_find_valid (attrs, CKA_ID);
- return_if_fail (id != NULL);
-
- /* An empty array of replacements */
- array = p11_array_new (NULL);
-
- /* Remove all related NSS trust objects */
- match[0].pValue = id->pValue;
- match[0].ulValueLen = id->ulValueLen;
- rv = p11_index_replace_all (index, match, CKA_INVALID, array);
- return_if_fail (rv == CKR_OK);
-
- p11_array_free (array);
+ replace_nss_trust_object (builder, index, attrs,
+ CK_FALSE, CK_FALSE, CK_FALSE,
+ NULL, NULL);
+ replace_trust_assertions (builder, index, attrs,
+ CK_FALSE, CK_FALSE, CK_FALSE,
+ NULL, NULL);
}
static void
{
static CK_OBJECT_CLASS certificate = CKO_CERTIFICATE;
static CK_CERTIFICATE_TYPE x509 = CKC_X_509;
-
CK_ATTRIBUTE *value;
- CK_ATTRIBUTE *id;
CK_ATTRIBUTE match[] = {
{ CKA_VALUE, },
{ CKA_INVALID }
};
- value = p11_attrs_find_valid (attrs, CKA_VALUE);
- id = p11_attrs_find_valid (attrs, CKA_ID);
- if (value == NULL || id == NULL)
- return;
-
/*
* If this certificate is going away, then find duplicate. In this
* case all the trust assertions are recalculated with this new
* certificate in mind.
*/
if (handle == 0) {
- match[0].pValue = value->pValue;
- match[0].ulValueLen = value->ulValueLen;
- handle = p11_index_find (index, match);
+ value = p11_attrs_find_valid (attrs, CKA_VALUE);
+ if (value != NULL) {
+ match[0].pValue = value->pValue;
+ match[0].ulValueLen = value->ulValueLen;
+ handle = p11_index_find (index, match);
+ }
if (handle != 0)
attrs = p11_index_lookup (index, handle);
}
teardown (cu);
}
+static CK_ATTRIBUTE cacert3_assert_distrust_server[] = {
+ { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
+ { CKA_X_PURPOSE, (void *)P11_OID_SERVER_AUTH_STR, sizeof (P11_OID_SERVER_AUTH_STR) - 1 },
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
+ { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID },
+};
+
+static CK_ATTRIBUTE cacert3_assert_distrust_client[] = {
+ { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
+ { CKA_X_PURPOSE, (void *)P11_OID_CLIENT_AUTH_STR, sizeof (P11_OID_CLIENT_AUTH_STR) - 1},
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
+ { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID },
+};
+
+static CK_ATTRIBUTE cacert3_assert_distrust_code[] = {
+ { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
+ { CKA_X_PURPOSE, (void *)P11_OID_CODE_SIGNING_STR, sizeof (P11_OID_CODE_SIGNING_STR) - 1},
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
+ { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID },
+};
+
+static CK_ATTRIBUTE cacert3_assert_distrust_email[] = {
+ { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
+ { CKA_X_PURPOSE, (void *)P11_OID_EMAIL_PROTECTION_STR, sizeof (P11_OID_EMAIL_PROTECTION_STR) - 1},
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
+ { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID },
+};
+
+static CK_ATTRIBUTE cacert3_assert_distrust_system[] = {
+ { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
+ { CKA_X_PURPOSE, (void *)P11_OID_IPSEC_END_SYSTEM_STR, sizeof (P11_OID_IPSEC_END_SYSTEM_STR) - 1},
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
+ { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID },
+};
+
+static CK_ATTRIBUTE cacert3_assert_distrust_tunnel[] = {
+ { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
+ { CKA_X_PURPOSE, (void *)P11_OID_IPSEC_TUNNEL_STR, sizeof (P11_OID_IPSEC_TUNNEL_STR) - 1},
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
+ { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID },
+};
+
+static CK_ATTRIBUTE cacert3_assert_distrust_user[] = {
+ { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
+ { CKA_X_PURPOSE, (void *)P11_OID_IPSEC_USER_STR, sizeof (P11_OID_IPSEC_USER_STR) - 1},
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
+ { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID },
+};
+
+static CK_ATTRIBUTE cacert3_assert_distrust_time[] = {
+ { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
+ { CKA_X_PURPOSE, (void *)P11_OID_TIME_STAMPING_STR, sizeof (P11_OID_TIME_STAMPING_STR) - 1},
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
+ { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID },
+};
+
static void
test_changed_trusted_certificate (CuTest *cu)
{
{ CKA_INVALID },
};
- static CK_ATTRIBUTE email_distrust_assertion[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_EMAIL_PROTECTION_STR, sizeof (P11_OID_EMAIL_PROTECTION_STR) - 1 },
- { CKA_LABEL, "Custom Label", 12 },
- { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
- { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "cacert3", 7 },
- { CKA_INVALID },
- };
-
/*
* We should get an NSS trust object and various assertions here.
* The first two attributes of each object are enough to look it up,
CK_ATTRIBUTE *expected[] = {
nss_trust_server_and_client_distrust_email,
- email_distrust_assertion,
+ cacert3_assert_distrust_email,
server_anchor_assertion,
client_anchor_assertion,
NULL,
}
static void
-test_changed_distrusted (CuTest *cu)
+test_changed_distrust_value (CuTest *cu)
{
CK_ATTRIBUTE distrust_cert[] = {
{ CKA_CLASS, &certificate, sizeof (certificate), },
{ CKA_TRUSTED, &falsev, sizeof (falsev) },
{ CKA_X_DISTRUSTED, &truev, sizeof (truev) },
{ CKA_VALUE, (void *)test_cacert3_ca_der, sizeof (test_cacert3_ca_der) },
- { CKA_ID, "the id", 6 },
+ { CKA_ID, "cacert3", 7 },
{ CKA_INVALID },
};
{ CKA_OBJECT_ID, (void *)P11_OID_EXTENDED_KEY_USAGE, sizeof (P11_OID_EXTENDED_KEY_USAGE) },
{ CKA_X_CRITICAL, &truev, sizeof (truev) },
{ CKA_VALUE, "\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x99\x77\x06\x0a\x10", 14 },
- { CKA_ID, "the id", 6 },
+ { CKA_ID, "cacert3", 7 },
{ CKA_INVALID },
};
{ CKA_OBJECT_ID, (void *)P11_OID_OPENSSL_REJECT, sizeof (P11_OID_OPENSSL_REJECT) },
{ CKA_X_CRITICAL, &falsev, sizeof (falsev) },
{ CKA_VALUE, "\x30\x0a\x06\x08\x2b\x06\x01\x05\x05\x07\x03\x02", 12 },
- { CKA_ID, "the id", 6 },
+ { CKA_ID, "cacert3", 7 },
{ CKA_INVALID },
};
CK_ATTRIBUTE nss_trust_nothing[] = {
{ CKA_CLASS, &nss_trust, sizeof (nss_trust), },
- { CKA_ID, "the id", 6 },
+ { CKA_ID, "cacert3", 7 },
{ CKA_CERT_SHA1_HASH, "\xad\x7c\x3f\x64\xfc\x44\x39\xfe\xf4\xe9\x0b\xe8\xf4\x7c\x6c\xfa\x8a\xad\xfd\xce", 20 },
{ CKA_CERT_MD5_HASH, "\xf7\x25\x12\x82\x4e\x67\xb5\xd0\x8d\x92\xb7\x7c\x0b\x86\x7a\x42", 16 },
{ CKA_SUBJECT, (void *)test_cacert3_ca_subject, sizeof (test_cacert3_ca_subject) },
{ CKA_INVALID, }
};
- CK_ATTRIBUTE server_distrust[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_SERVER_AUTH_STR, strlen (P11_OID_SERVER_AUTH_STR) },
- { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
- { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "the id", 6 },
- { CKA_INVALID },
- };
+ /*
+ * We should get an NSS trust object and various assertions here.
+ * The first two attributes of each object are enough to look it up,
+ * and then we check the rest of the attributes match.
+ */
- CK_ATTRIBUTE client_distrust[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_CLIENT_AUTH_STR, strlen (P11_OID_CLIENT_AUTH_STR) },
- { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
- { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "the id", 6 },
- { CKA_INVALID },
+ CK_ATTRIBUTE *expected[] = {
+ nss_trust_nothing,
+ cacert3_assert_distrust_server,
+ cacert3_assert_distrust_client,
+ cacert3_assert_distrust_code,
+ cacert3_assert_distrust_email,
+ cacert3_assert_distrust_system,
+ cacert3_assert_distrust_tunnel,
+ cacert3_assert_distrust_user,
+ cacert3_assert_distrust_time,
+ NULL
};
- CK_ATTRIBUTE code_distrust[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_CODE_SIGNING_STR, strlen (P11_OID_CODE_SIGNING_STR) },
- { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
- { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "the id", 6 },
- { CKA_INVALID },
- };
+ CK_OBJECT_HANDLE handle;
+ CK_ATTRIBUTE *attrs;
+ CK_RV rv;
+ int i;
- CK_ATTRIBUTE email_distrust[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_EMAIL_PROTECTION_STR, strlen (P11_OID_EMAIL_PROTECTION_STR) },
- { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
- { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "the id", 6 },
- { CKA_INVALID },
- };
+ setup (cu);
- CK_ATTRIBUTE ipsec_system_distrust[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_IPSEC_END_SYSTEM_STR, strlen (P11_OID_IPSEC_END_SYSTEM_STR) },
- { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
- { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "the id", 6 },
- { CKA_INVALID },
- };
+ /*
+ * A distrusted certificate with a value, plus some extra
+ * extensions (which should be ignored).
+ */
+ p11_index_batch (test.index);
+ rv = p11_index_take (test.index, p11_attrs_dup (distrust_cert), NULL);
+ CuAssertIntEquals (cu, CKR_OK, rv);
+ rv = p11_index_take (test.index, p11_attrs_dup (eku_extension), NULL);
+ CuAssertIntEquals (cu, CKR_OK, rv);
+ rv = p11_index_take (test.index, p11_attrs_dup (reject_extension), NULL);
+ CuAssertIntEquals (cu, CKR_OK, rv);
+ p11_index_finish (test.index);
- CK_ATTRIBUTE ipsec_tunnel_distrust[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_IPSEC_TUNNEL_STR, strlen (P11_OID_IPSEC_TUNNEL_STR) },
- { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
- { CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "the id", 6 },
- { CKA_INVALID },
- };
+ /* The other objects */
+ for (i = 0; expected[i]; i++) {
+ handle = p11_index_findn (test.index, expected[i], 2);
+ CuAssertTrue (cu, handle != 0);
- CK_ATTRIBUTE ipsec_user_distrust[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_IPSEC_USER_STR, strlen (P11_OID_IPSEC_USER_STR) },
- { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ attrs = p11_index_lookup (test.index, handle);
+ CuAssertPtrNotNull (cu, attrs);
+
+ test_check_attrs (cu, expected[i], attrs);
+ }
+
+ teardown (cu);
+}
+
+static void
+test_changed_distrust_serial (CuTest *cu)
+{
+ CK_ATTRIBUTE distrust_cert[] = {
+ { CKA_CLASS, &certificate, sizeof (certificate), },
{ CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "the id", 6 },
+ { CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
+ { CKA_CERTIFICATE_TYPE, &x509, sizeof (x509) },
+ { CKA_TRUSTED, &falsev, sizeof (falsev) },
+ { CKA_X_DISTRUSTED, &truev, sizeof (truev) },
+ { CKA_ID, "cacert3", 7 },
{ CKA_INVALID },
};
- CK_ATTRIBUTE stamping_distrust[] = {
- { CKA_CLASS, &trust_assertion, sizeof (trust_assertion) },
- { CKA_X_PURPOSE, (void *)P11_OID_TIME_STAMPING_STR, strlen (P11_OID_TIME_STAMPING_STR) },
+ CK_ATTRIBUTE nss_trust_distrust[] = {
+ { CKA_CLASS, &nss_trust, sizeof (nss_trust), },
+ { CKA_ID, "cacert3", 7 },
{ CKA_ISSUER, (void *)test_cacert3_ca_issuer, sizeof (test_cacert3_ca_issuer) },
{ CKA_SERIAL_NUMBER, (void *)test_cacert3_ca_serial, sizeof (test_cacert3_ca_serial) },
- { CKA_X_ASSERTION_TYPE, &distrusted_certificate, sizeof (distrusted_certificate) },
- { CKA_ID, "the id", 6 },
- { CKA_INVALID },
+ { CKA_TRUST_SERVER_AUTH, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_CLIENT_AUTH, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_EMAIL_PROTECTION, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_CODE_SIGNING, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_IPSEC_END_SYSTEM, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_IPSEC_TUNNEL, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_IPSEC_USER, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_TIME_STAMPING, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_DIGITAL_SIGNATURE, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_NON_REPUDIATION, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_KEY_ENCIPHERMENT, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_DATA_ENCIPHERMENT, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_KEY_AGREEMENT, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_KEY_CERT_SIGN, ¬_trusted, sizeof (not_trusted) },
+ { CKA_TRUST_CRL_SIGN, ¬_trusted, sizeof (not_trusted) },
+ { CKA_INVALID, }
};
/*
*/
CK_ATTRIBUTE *expected[] = {
- nss_trust_nothing,
- server_distrust,
- client_distrust,
- code_distrust,
- email_distrust,
- ipsec_system_distrust,
- ipsec_tunnel_distrust,
- ipsec_user_distrust,
- stamping_distrust,
+ nss_trust_distrust,
+ cacert3_assert_distrust_server,
+ cacert3_assert_distrust_client,
+ cacert3_assert_distrust_code,
+ cacert3_assert_distrust_email,
+ cacert3_assert_distrust_system,
+ cacert3_assert_distrust_tunnel,
+ cacert3_assert_distrust_user,
+ cacert3_assert_distrust_time,
NULL
};
setup (cu);
/*
- * A trusted cetrificate, trusted for server and client purposes,
- * and explicitly rejects the email and timestamping purposes.
+ * A distrusted certificate without a value.
*/
p11_index_batch (test.index);
rv = p11_index_take (test.index, p11_attrs_dup (distrust_cert), NULL);
CuAssertIntEquals (cu, CKR_OK, rv);
- rv = p11_index_take (test.index, p11_attrs_dup (eku_extension), NULL);
- CuAssertIntEquals (cu, CKR_OK, rv);
- rv = p11_index_take (test.index, p11_attrs_dup (reject_extension), NULL);
- CuAssertIntEquals (cu, CKR_OK, rv);
p11_index_finish (test.index);
- /* The other objects */
for (i = 0; expected[i]; i++) {
handle = p11_index_findn (test.index, expected[i], 2);
CuAssertTrue (cu, handle != 0);
-
attrs = p11_index_lookup (test.index, handle);
CuAssertPtrNotNull (cu, attrs);
-
test_check_attrs (cu, expected[i], attrs);
}
{ CKA_INVALID, }
};
+ static CK_ATTRIBUTE unknown_nss[] = {
+ { CKA_CLASS, &nss_trust, sizeof (nss_trust), },
+ { CKA_CERT_SHA1_HASH, "\xad\x7c\x3f\x64\xfc\x44\x39\xfe\xf4\xe9\x0b\xe8\xf4\x7c\x6c\xfa\x8a\xad\xfd\xce", 20 },
+ { CKA_TRUST_SERVER_AUTH, &trust_unknown, sizeof (trust_unknown) },
+ { CKA_ID, "cacert3", 7 },
+ { CKA_INVALID, }
+ };
+
static CK_ATTRIBUTE match_nss[] = {
{ CKA_CLASS, &nss_trust, sizeof (nss_trust), },
{ CKA_ID, "cacert3", 7 },
handle = p11_index_find (test.index, distrust_assertion);
CuAssertTrue (cu, handle == 0);
- /* Now remove the original certificate, no more nss/assertions */
+ /* Now remove the original certificate, unknown nss and no assertions */
rv = p11_index_remove (test.index, handle1);
CuAssertIntEquals (cu, CKR_OK, rv);
- handle = p11_index_find (test.index, match_nss);
- CuAssertTrue (cu, handle == 0);
+ handle = p11_index_find (test.index, unknown_nss);
+ CuAssertTrue (cu, handle != 0);
handle = p11_index_find (test.index, match_assertion);
CuAssertTrue (cu, handle == 0);
};
/*
- * A cetrificate without a CKA_ID that's created should not
- * automatically create any compat objects.
+ * A cetrificate without a CKA_ID that's created should still
+ * automatically create compat objects.
*/
CK_OBJECT_HANDLE handle;
klass = CKO_NSS_TRUST;
handle = p11_index_find (test.index, match);
- CuAssertIntEquals (cu, 0, handle);
+ CuAssertTrue (cu, handle != 0);
klass = CKO_X_TRUST_ASSERTION;
handle = p11_index_find (test.index, match);
- CuAssertIntEquals (cu, 0, handle);
+ CuAssertTrue (cu, handle != 0);
teardown (cu);
}
SUITE_ADD_TEST (suite, test_modify_not_modifiable);
SUITE_ADD_TEST (suite, test_changed_trusted_certificate);
- SUITE_ADD_TEST (suite, test_changed_distrusted);
+ SUITE_ADD_TEST (suite, test_changed_distrust_value);
+ SUITE_ADD_TEST (suite, test_changed_distrust_serial);
SUITE_ADD_TEST (suite, test_changed_without_id);
SUITE_ADD_TEST (suite, test_changed_staple_ca);
SUITE_ADD_TEST (suite, test_changed_staple_ku);
projects / p11-kit / commitdiff