security/manager/ssl/tests/unit/test_intermediate_basic_usage_constraints.js

   1 "use strict";
   2
   3 do_get_profile(); // must be called before getting nsIX509CertDB
   4 const certdb = Cc["@mozilla.org/security/x509certdb;1"].getService(
   5   Ci.nsIX509CertDB
   6 );
   7
   8 function load_cert(name, trust) {
   9   let filename = "test_intermediate_basic_usage_constraints/" + name + ".pem";
  10   addCertFromFile(certdb, filename, trust);
  11 }
  12
  13 function test_cert_for_usages(certChainNicks, expected_usages) {
  14   let certs = [];
  15   for (let i in certChainNicks) {
  16     let certNick = certChainNicks[i];
  17     let certPEM = readFile(
  18       do_get_file(
  19         "test_intermediate_basic_usage_constraints/" + certNick + ".pem"
  20       ),
  21       false
  22     );
  23     certs.push(certdb.constructX509FromBase64(pemToBase64(certPEM)));
  24   }
  25
  26   let cert = certs[0];
  27   return asyncTestCertificateUsages(certdb, cert, expected_usages);
  28 }
  29
  30 add_task(async function () {
  31   let ee_usages = [
  32     certificateUsageSSLClient,
  33     certificateUsageSSLServer,
  34     certificateUsageEmailSigner,
  35     certificateUsageEmailRecipient,
  36   ];
  37   let ca_usages = [certificateUsageSSLCA];
  38   let eku_usages = [certificateUsageSSLClient, certificateUsageSSLServer];
  39
  40   // Load the ca into mem
  41   let ca_name = "ca";
  42   load_cert(ca_name, "CTu,CTu,CTu");
  43   await test_cert_for_usages([ca_name], ca_usages);
  44
  45   // A certificate with no basicConstraints extension is considered an EE.
  46   await test_cert_for_usages(["int-no-extensions"], ee_usages);
  47
  48   // int-no-extensions is an EE (see previous case), so no certs can chain to
  49   // it.
  50   await test_cert_for_usages(["ee-int-no-extensions", "int-no-extensions"], []);
  51
  52   // a certificate with basicConstraints.cA==false is considered an EE.
  53   await test_cert_for_usages(["int-not-a-ca"], ee_usages);
  54
  55   // int-not-a-ca is an EE (see previous case), so no certs can chain to it.
  56   await test_cert_for_usages(["ee-int-not-a-ca", "int-not-a-ca"], []);
  57
  58   // a certificate with basicConstraints.cA==false but with the keyCertSign
  59   // key usage may not act as a CA (it can act like an end-entity).
  60   await test_cert_for_usages(["int-cA-FALSE-asserts-keyCertSign"], ee_usages);
  61   await test_cert_for_usages(
  62     ["ee-int-cA-FALSE-asserts-keyCertSign", "int-cA-FALSE-asserts-keyCertSign"],
  63     []
  64   );
  65
  66   // int-limited-depth has cA==true and a path length constraint of zero.
  67   await test_cert_for_usages(["int-limited-depth"], ca_usages);
  68
  69   // path length constraints do not affect the ability of a non-CA cert to
  70   // chain to to the CA cert.
  71   await test_cert_for_usages(
  72     ["ee-int-limited-depth", "int-limited-depth"],
  73     ee_usages
  74   );
  75
  76   // ca
  77   //   int-limited-depth (cA==true, pathLenConstraint==0)
  78   //      int-limited-depth-invalid (cA==true)
  79   //
  80   await test_cert_for_usages(
  81     ["int-limited-depth-invalid", "int-limited-depth"],
  82     []
  83   );
  84   await test_cert_for_usages(
  85     [
  86       "ee-int-limited-depth-invalid",
  87       "int-limited-depth-invalid",
  88       "int-limited-depth",
  89     ],
  90     []
  91   );
  92
  93   // int-valid-ku-no-eku has keyCertSign
  94   await test_cert_for_usages(["int-valid-ku-no-eku"], ca_usages);
  95   await test_cert_for_usages(
  96     ["ee-int-valid-ku-no-eku", "int-valid-ku-no-eku"],
  97     ee_usages
  98   );
  99
 100   // int-bad-ku-no-eku has basicConstraints.cA==true and has a KU extension
 101   // but the KU extension is missing keyCertSign. Note that mozilla::pkix
 102   // doesn't validate certificates with basicConstraints.Ca==true for non-CA
 103   // uses.
 104   await test_cert_for_usages(["int-bad-ku-no-eku"], []);
 105   await test_cert_for_usages(["ee-int-bad-ku-no-eku", "int-bad-ku-no-eku"], []);
 106
 107   // int-no-ku-no-eku has basicConstraints.cA==true and no KU extension.
 108   // We treat a missing KU as "any key usage is OK".
 109   await test_cert_for_usages(["int-no-ku-no-eku"], ca_usages);
 110   await test_cert_for_usages(
 111     ["ee-int-no-ku-no-eku", "int-no-ku-no-eku"],
 112     ee_usages
 113   );
 114
 115   // int-valid-ku-server-eku has basicConstraints.cA==true, keyCertSign in KU,
 116   // and EKU=={id-kp-serverAuth,id-kp-clientAuth}.
 117   await test_cert_for_usages(["int-valid-ku-server-eku"], ca_usages);
 118   await test_cert_for_usages(
 119     ["ee-int-valid-ku-server-eku", "int-valid-ku-server-eku"],
 120     eku_usages
 121   );
 122
 123   // int-bad-ku-server-eku has basicConstraints.cA==true, a KU without
 124   // keyCertSign, and EKU=={id-kp-serverAuth,id-kp-clientAuth}.
 125   await test_cert_for_usages(["int-bad-ku-server-eku"], []);
 126   await test_cert_for_usages(
 127     ["ee-int-bad-ku-server-eku", "int-bad-ku-server-eku"],
 128     []
 129   );
 130
 131   // int-bad-ku-server-eku has basicConstraints.cA==true, no KU, and
 132   // EKU=={id-kp-serverAuth,id-kp-clientAuth}.
 133   await test_cert_for_usages(["int-no-ku-server-eku"], ca_usages);
 134   await test_cert_for_usages(
 135     ["ee-int-no-ku-server-eku", "int-no-ku-server-eku"],
 136     eku_usages
 137   );
 138 });