/* This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ /* * test_certselector.c * * Test Cert Selector * */ #include "testutil.h" #include "testutil_nss.h" #define PKIX_TEST_CERTSELECTOR_KEYUSAGE_NUM_CERTS 5 #define PKIX_TEST_CERTSELECTOR_EXTKEYUSAGE_NUM_CERTS 2 #define PKIX_TEST_CERTSELECTOR_CERTVALID_NUM_CERTS 2 #define PKIX_TEST_CERTSELECTOR_ISSUER_NUM_CERTS 4 #define PKIX_TEST_CERTSELECTOR_SERIALNUMBER_NUM_CERTS 1 static void *plContext = NULL; /* * The first three certs are used to obtain policies to test * policy matching. Changing the table could break tests. */ static char *certList[] = { #define POLICY1CERT 0 "GoodCACert.crt", #define ANYPOLICYCERT 1 "anyPolicyCACert.crt", #define POLICY2CERT 2 "PoliciesP12CACert.crt", #define SUBJECTCERT 3 "PoliciesP3CACert.crt", "PoliciesP1234CACert.crt", "pathLenConstraint0CACert.crt", "pathLenConstraint1CACert.crt", "pathLenConstraint6CACert.crt", "TrustAnchorRootCertificate.crt", "GoodsubCACert.crt", "AnyPolicyTest14EE.crt", "UserNoticeQualifierTest16EE.crt" }; #define NUMCERTS (sizeof(certList) / sizeof(certList[0])) /* * Following are Certs values for NameConstraints tests * * Cert0:nameConstraintsDN1subCA1Cert.crt: * Subject:CN=nameConstraints DN1 subCA1,OU=permittedSubtree1, * O=Test Certificates,C=US * Permitted Name:(OU=permittedSubtree2,OU=permittedSubtree1, * O=Test Certificates,C=US) * Excluded Name: (EMPTY) * Cert1:nameConstraintsDN3subCA2Cert.crt: * Subject:CN=nameConstraints DN3 subCA2,O=Test Certificates,C=US * Permitted Name:(O=Test Certificates,C=US) * Excluded Name:(EMPTY) * Cert2:nameConstraintsDN2CACert.crt * Subject:CN=nameConstraints DN2 CA,O=Test Certificates,C=US * Permitted Name:(OU=permittedSubtree1,O=Test Certificates,C=US, * OU=permittedSubtree2,O=Test Certificates,C=US) * Excluded Name:(EMPTY) * Cert3:nameConstraintsDN3subCA1Cert.crt * Subject:CN=nameConstraints DN3 subCA1,O=Test Certificates,C=US * Permitted Name:(EMPTY) * Excluded Name:(OU=excludedSubtree2,O=Test Certificates,C=US) * Cert4:nameConstraintsDN4CACert.crt * Subject:CN=nameConstraints DN4 CA,O=Test Certificates,C=US * Permitted Name:(EMPTY) * Excluded Name:(OU=excludedSubtree1,O=Test Certificates,C=US, * OU=excludedSubtree2,O=Test Certificates,C=US) * Cert5:nameConstraintsDN5CACert.crt * Subject:CN=nameConstraints DN5 CA,O=Test Certificates,C=US * Permitted Name:(OU=permittedSubtree1,O=Test Certificates,C=US) * Excluded Name:(OU=excludedSubtree1,OU=permittedSubtree1, * O=Test Certificates,C=US) * Cert6:ValidDNnameConstraintsTest1EE.crt * Subject:CN=Valid DN nameConstraints EE Certificate Test1, * OU=permittedSubtree1,O=Test Certificates,C=US * */ static char *ncCertList[] = { "nameConstraintsDN1subCA1Cert.crt", "nameConstraintsDN3subCA2Cert.crt", "nameConstraintsDN2CACert.crt", "nameConstraintsDN3subCA1Cert.crt", "nameConstraintsDN4CACert.crt", "nameConstraintsDN5CACert.crt", "ValidDNnameConstraintsTest1EE.crt" }; #define NUMNCCERTS (sizeof(ncCertList) / sizeof(ncCertList[0])) static char *sanCertList[] = { "InvalidDNnameConstraintsTest3EE.crt", "InvalidDNSnameConstraintsTest38EE.crt" }; #define NUMSANCERTS (sizeof(sanCertList) / sizeof(sanCertList[0])) /* * This function calls the CertSelector pointed to by "selector" for each * cert in the List pointed to by "certs", and compares the results against * the bit array given by the UInt32 "expectedResults". If the first cert is * expected to pass, the lower-order bit of "expectedResults" should be 1. * If the second cert is expected to pass, the second bit of "expectedResults" * should be 1, and so on. If more than 32 certs are provided, only the first * 32 will be checked. It is not an error to provide more bits than needed. * (For example, if you expect every cert to pass, "expectedResult" can be * set to 0xFFFFFFFF, even if the chain has fewer than 32 certs.) */ static void testSelector( PKIX_CertSelector *selector, PKIX_List *certs, PKIX_UInt32 expectedResults) { PKIX_UInt32 i = 0; PKIX_UInt32 numCerts = 0; PKIX_PL_Cert *cert = NULL; PKIX_CertSelector_MatchCallback callback = NULL; PKIX_Error *errReturn = NULL; PKIX_Boolean result = PKIX_TRUE; PKIX_TEST_STD_VARS(); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetMatchCallback(selector, &callback, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certs, &numCerts, plContext)); if (numCerts > 32) { numCerts = 32; } for (i = 0; i < numCerts; i++) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, i, (PKIX_PL_Object **)&cert, plContext)); errReturn = callback(selector, cert, &result, plContext); if (errReturn || result == PKIX_FALSE) { if ((expectedResults & 1) == 1) { testError("selector unexpectedly failed"); (void)printf(" processing cert:\t%d\n", i); } } else { if ((expectedResults & 1) == 0) { testError("selector unexpectedly passed"); (void)printf(" processing cert:\t%d\n", i); } } expectedResults = expectedResults >> 1; PKIX_TEST_DECREF_BC(cert); PKIX_TEST_DECREF_BC(errReturn); } cleanup: PKIX_TEST_DECREF_AC(cert); PKIX_TEST_DECREF_AC(errReturn); PKIX_TEST_RETURN(); } /* * This function gets a policy from the Cert pointed to by "cert", according * to the index provided by "index", creates an immutable List containing the * OID of that policy, and stores the result at "pPolicyList". */ static void testGetPolicyFromCert( PKIX_PL_Cert *cert, PKIX_UInt32 index, PKIX_List **pPolicyList) { PKIX_List *policyInfo = NULL; PKIX_PL_CertPolicyInfo *firstPolicy = NULL; PKIX_PL_OID *policyOID = NULL; PKIX_List *list = NULL; PKIX_TEST_STD_VARS(); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetPolicyInformation(cert, &policyInfo, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(policyInfo, index, (PKIX_PL_Object **)&firstPolicy, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CertPolicyInfo_GetPolicyId(firstPolicy, &policyOID, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&list, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(list, (PKIX_PL_Object *)policyOID, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_SetImmutable(list, plContext)); *pPolicyList = list; cleanup: PKIX_TEST_DECREF_AC(policyInfo); PKIX_TEST_DECREF_AC(firstPolicy); PKIX_TEST_DECREF_AC(policyOID); PKIX_TEST_RETURN(); } /* * This custom matchCallback will pass any Certificate which has no * CertificatePolicies extension and any Certificate whose Policies * extension include a CertPolicyQualifier. */ static PKIX_Error * custom_CertSelector_MatchCallback( PKIX_CertSelector *selector, PKIX_PL_Cert *cert, PKIX_Boolean *pResult, void *plContext) { PKIX_UInt32 i = 0; PKIX_UInt32 numPolicies = 0; PKIX_List *certPolicies = NULL; PKIX_List *quals = NULL; PKIX_PL_CertPolicyInfo *policy = NULL; PKIX_Error *error = NULL; PKIX_TEST_STD_VARS(); *pResult = PKIX_TRUE; PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetPolicyInformation(cert, &certPolicies, plContext)); if (certPolicies) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certPolicies, &numPolicies, plContext)); for (i = 0; i < numPolicies; i++) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certPolicies, i, (PKIX_PL_Object **)&policy, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CertPolicyInfo_GetPolQualifiers(policy, &quals, plContext)); if (quals) { goto cleanup; } PKIX_TEST_DECREF_BC(policy); } PKIX_TEST_DECREF_BC(certPolicies); *pResult = PKIX_FALSE; PKIX_TEST_EXPECT_NO_ERROR(PKIX_Error_Create(PKIX_CERTSELECTOR_ERROR, NULL, NULL, PKIX_TESTPOLICYEXTWITHNOPOLICYQUALIFIERS, &error, plContext)); } cleanup: PKIX_TEST_DECREF_AC(certPolicies); PKIX_TEST_DECREF_AC(policy); PKIX_TEST_DECREF_AC(quals); return (error); } /* * This custom matchCallback will pass any Certificate whose * CertificatePolicies extension asserts the Policy specified by * the OID in the CertSelectorContext object. */ static PKIX_Error * custom_CertSelector_MatchOIDCallback( PKIX_CertSelector *selector, PKIX_PL_Cert *cert, PKIX_Boolean *pResult, void *plContext) { PKIX_UInt32 i = 0; PKIX_UInt32 numPolicies = 0; PKIX_Boolean match = PKIX_FALSE; PKIX_PL_Object *certSelectorContext = NULL; PKIX_PL_OID *constraintOID = NULL; PKIX_List *certPolicies = NULL; PKIX_PL_CertPolicyInfo *policy = NULL; PKIX_PL_OID *policyOID = NULL; PKIX_PL_String *errorDesc = NULL; PKIX_Error *error = NULL; PKIX_TEST_STD_VARS(); *pResult = PKIX_TRUE; PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetCertSelectorContext(selector, &certSelectorContext, plContext)); PKIX_TEST_EXPECT_NO_ERROR(pkix_CheckType(certSelectorContext, PKIX_OID_TYPE, plContext)); constraintOID = (PKIX_PL_OID *)certSelectorContext; PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetPolicyInformation(cert, &certPolicies, plContext)); if (certPolicies) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certPolicies, &numPolicies, plContext)); for (i = 0; i < numPolicies; i++) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certPolicies, i, (PKIX_PL_Object **)&policy, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CertPolicyInfo_GetPolicyId(policy, &policyOID, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_Equals((PKIX_PL_Object *)policyOID, (PKIX_PL_Object *)constraintOID, &match, plContext)); if (match) { goto cleanup; } PKIX_TEST_DECREF_BC(policy); PKIX_TEST_DECREF_BC(policyOID); } } PKIX_TEST_DECREF_BC(certSelectorContext); PKIX_TEST_DECREF_BC(certPolicies); PKIX_TEST_EXPECT_NO_ERROR(PKIX_Error_Create(PKIX_CERTSELECTOR_ERROR, NULL, NULL, PKIX_TESTNOMATCHINGPOLICY, &error, plContext)); cleanup: PKIX_TEST_DECREF_AC(certSelectorContext); PKIX_TEST_DECREF_AC(certPolicies); PKIX_TEST_DECREF_AC(policy); PKIX_TEST_DECREF_AC(policyOID); PKIX_TEST_DECREF_AC(errorDesc); return (error); } static void testSubjectMatch( PKIX_List *certs, PKIX_PL_Cert *certNameToMatch) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *subjParams = NULL; PKIX_PL_X500Name *subjectName = NULL; PKIX_TEST_STD_VARS(); subTest("Subject name match"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&subjParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubject(certNameToMatch, &subjectName, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubject(subjParams, subjectName, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, subjParams, plContext)); testSelector(selector, certs, 0x008); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(subjParams); PKIX_TEST_DECREF_AC(subjectName); PKIX_TEST_RETURN(); } static void testBasicConstraintsMatch( PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *bcParams = NULL; PKIX_TEST_STD_VARS(); subTest("Basic Constraints match"); subTest(" pathLenContraint = -2: pass only EE's"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&bcParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(bcParams, -2, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, bcParams, plContext)); testSelector(selector, certs, 0xC00); subTest(" pathLenContraint = -1: pass all certs"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(bcParams, -1, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, bcParams, plContext)); testSelector(selector, certs, 0xFFF); subTest(" pathLenContraint = 1: pass only certs with pathLen >= 1"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(bcParams, 1, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, bcParams, plContext)); testSelector(selector, certs, 0x3DF); subTest(" pathLenContraint = 2: pass only certs with pathLen >= 2"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(bcParams, 2, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, bcParams, plContext)); testSelector(selector, certs, 0x39F); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(bcParams); PKIX_TEST_RETURN(); } static void testPolicyMatch( PKIX_List *certs, PKIX_PL_Cert *NIST1Cert, /* a source for policy NIST1 */ PKIX_PL_Cert *NIST2Cert, /* a source for policy NIST2 */ PKIX_PL_Cert *anyPolicyCert) /* a source for policy anyPolicy */ { PKIX_CertSelector *selector = NULL; PKIX_List *emptyList = NULL; /* no members */ PKIX_List *policy1List = NULL; /* OIDs */ PKIX_List *policy2List = NULL; /* OIDs */ PKIX_List *anyPolicyList = NULL; /* OIDs */ PKIX_ComCertSelParams *polParams = NULL; PKIX_TEST_STD_VARS(); subTest("Policy match"); testGetPolicyFromCert(NIST1Cert, 0, &policy1List); testGetPolicyFromCert(NIST2Cert, 1, &policy2List); testGetPolicyFromCert(anyPolicyCert, 0, &anyPolicyList); subTest(" Pass certs with any CertificatePolicies extension"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&emptyList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&polParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPolicy(polParams, emptyList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, polParams, plContext)); testSelector(selector, certs, 0xEFF); PKIX_TEST_DECREF_BC(polParams); subTest(" Pass only certs with policy NIST1"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&polParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPolicy(polParams, policy1List, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, polParams, plContext)); testSelector(selector, certs, 0xEF5); PKIX_TEST_DECREF_BC(polParams); subTest(" Pass only certs with policy NIST2"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&polParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPolicy(polParams, policy2List, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, polParams, plContext)); testSelector(selector, certs, 0x814); PKIX_TEST_DECREF_BC(polParams); subTest(" Pass only certs with policy anyPolicy"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&polParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPolicy(polParams, anyPolicyList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, polParams, plContext)); testSelector(selector, certs, 0x002); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(emptyList); PKIX_TEST_DECREF_AC(policy1List); PKIX_TEST_DECREF_AC(policy2List); PKIX_TEST_DECREF_AC(anyPolicyList); PKIX_TEST_DECREF_AC(polParams); PKIX_TEST_RETURN(); } static void testCertificateMatch( PKIX_List *certs, PKIX_PL_Cert *certToMatch) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_TEST_STD_VARS(); subTest("Certificate match"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetCertificate(params, certToMatch, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); testSelector(selector, certs, 0x008); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(params); PKIX_TEST_RETURN(); } static void testNameConstraintsMatch(PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_PL_Cert *cert = NULL; PKIX_PL_CertNameConstraints *permitNameConstraints1 = NULL; PKIX_PL_CertNameConstraints *permitNameConstraints2 = NULL; PKIX_PL_CertNameConstraints *permitNameConstraints3 = NULL; PKIX_PL_CertNameConstraints *excludeNameConstraints1 = NULL; PKIX_PL_CertNameConstraints *excludeNameConstraints2 = NULL; PKIX_PL_CertNameConstraints *excludeNameConstraints3 = NULL; PKIX_UInt32 numCerts = 0; PKIX_TEST_STD_VARS(); subTest("test NameConstraints Cert Selector"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certs, &numCerts, plContext)); subTest(" PKIX_PL_Cert_GetNameConstraints "); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 0, (PKIX_PL_Object **)&cert, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &permitNameConstraints1, plContext)); PKIX_TEST_DECREF_BC(cert); subTest(" PKIX_PL_Cert_GetNameConstraints "); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 1, (PKIX_PL_Object **)&cert, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &permitNameConstraints2, plContext)); PKIX_TEST_DECREF_BC(cert); subTest(" PKIX_PL_Cert_GetNameConstraints "); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 2, (PKIX_PL_Object **)&cert, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &permitNameConstraints3, plContext)); PKIX_TEST_DECREF_BC(cert); subTest(" PKIX_PL_Cert_GetNameConstraints "); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 3, (PKIX_PL_Object **)&cert, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &excludeNameConstraints1, plContext)); PKIX_TEST_DECREF_BC(cert); subTest(" PKIX_PL_Cert_GetNameConstraints "); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 4, (PKIX_PL_Object **)&cert, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &excludeNameConstraints2, plContext)); PKIX_TEST_DECREF_BC(cert); subTest(" PKIX_PL_Cert_GetNameConstraints "); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, 5, (PKIX_PL_Object **)&cert, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetNameConstraints(cert, &excludeNameConstraints3, plContext)); PKIX_TEST_DECREF_BC(cert); subTest(" Create Selector and ComCertSelParams"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" CertNameConstraints testing permitted NONE"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, permitNameConstraints1, plContext)); testSelector(selector, certs, 0x0); subTest(" PKIX_ComCertSelParams_SetNameConstraint Reset"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, NULL, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" CertNameConstraints testing permitted ALL"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, permitNameConstraints2, plContext)); testSelector(selector, certs, 0x07F); subTest(" CertNameConstraints testing permitted TWO"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, permitNameConstraints3, plContext)); testSelector(selector, certs, 0x0041); subTest(" PKIX_ComCertSelParams_SetNameConstraint Reset"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, NULL, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" CertNameConstraints testing excluded"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, excludeNameConstraints1, plContext)); testSelector(selector, certs, 0x07F); subTest(" CertNameConstraints testing excluded"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, excludeNameConstraints2, plContext)); testSelector(selector, certs, 0x07F); subTest(" CertNameConstraints testing excluded"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetNameConstraints(params, excludeNameConstraints3, plContext)); testSelector(selector, certs, 0x41); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(params); PKIX_TEST_DECREF_AC(permitNameConstraints1); PKIX_TEST_DECREF_AC(permitNameConstraints2); PKIX_TEST_DECREF_AC(permitNameConstraints3); PKIX_TEST_DECREF_AC(excludeNameConstraints1); PKIX_TEST_DECREF_AC(excludeNameConstraints2); PKIX_TEST_DECREF_AC(excludeNameConstraints3); PKIX_TEST_RETURN(); } static void testPathToNamesMatch(PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_List *nameList = NULL; PKIX_PL_GeneralName *name = NULL; PKIX_TEST_STD_VARS(); subTest("test PathToName Cert Selector"); subTest(" PKIX_PL_GeneralName List create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&nameList, plContext)); subTest(" Add directory name "); name = createGeneralName(PKIX_DIRECTORY_NAME, "O=NotATest Certificates,C=US", plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); subTest(" Create Selector and ComCertSelParams"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" PKIX_ComCertSelParams_SetPathToNames"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); subTest(" Permitting THREE"); testSelector(selector, certs, 0x58); subTest(" Remove directory name "); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_DeleteItem(nameList, 0, plContext)); PKIX_TEST_DECREF_BC(name); subTest(" PKIX_ComCertSelParams_SetPathToNames Reset"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, NULL, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" Add directory name "); name = createGeneralName(PKIX_DIRECTORY_NAME, "OU=permittedSubtree1,O=Test Certificates,C=US", plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); subTest(" PKIX_ComCertSelParams_SetPathToNames"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); subTest(" Permitting SIX"); testSelector(selector, certs, 0x5F); subTest(" Remove directory name "); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_DeleteItem(nameList, 0, plContext)); PKIX_TEST_DECREF_BC(name); subTest(" PKIX_ComCertSelParams_SetNameConstraint Reset"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, NULL, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" Add directory name "); name = createGeneralName(PKIX_DIRECTORY_NAME, "O=Test Certificates,C=US", plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); PKIX_TEST_DECREF_BC(name); subTest(" PKIX_ComCertSelParams_SetPathToNames"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); subTest(" Permitting FOUR"); testSelector(selector, certs, 0x47); subTest(" Only directory name "); name = createGeneralName(PKIX_DIRECTORY_NAME, "OU=permittedSubtree1,O=Test Certificates,C=US", plContext); subTest(" PKIX_ComCertSelParams_AddPathToName"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_AddPathToName(params, name, plContext)); PKIX_TEST_DECREF_BC(name); subTest(" Permitting FOUR"); testSelector(selector, certs, 0x47); subTest(" PKIX_ComCertSelParams_SetNameConstraint Reset"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, NULL, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); PKIX_TEST_DECREF_BC(nameList); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&nameList, plContext)); subTest(" Add directory name "); name = createGeneralName(PKIX_DIRECTORY_NAME, "CN=Valid DN nameConstraints EE " "Certificate Test1,OU=permittedSubtree1," "O=Test Certificates,C=US", plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); PKIX_TEST_DECREF_BC(name); subTest(" PKIX_ComCertSelParams_SetPathToNames"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); subTest(" Permitting SIX"); testSelector(selector, certs, 0x7e); subTest(" Add directory name "); name = createGeneralName(PKIX_DIRECTORY_NAME, "OU=permittedSubtree1,O=Test", plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); PKIX_TEST_DECREF_BC(name); subTest(" PKIX_ComCertSelParams_SetPathToNames"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, nameList, plContext)); subTest(" Permitting SIX"); testSelector(selector, certs, 0x58); subTest(" Add directory name "); name = createGeneralName(PKIX_DIRECTORY_NAME, "O=Test Certificates,C=US", plContext); subTest(" PKIX_ComCertSelParams_SetPathToNames Reset"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetPathToNames(params, NULL, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_AddPathToName(params, name, plContext)); PKIX_TEST_DECREF_BC(name); subTest(" Permitting FOUR"); testSelector(selector, certs, 0x47); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(params); PKIX_TEST_DECREF_AC(nameList); PKIX_TEST_RETURN(); } static void testSubjAltNamesMatch(PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_List *nameList = NULL; PKIX_PL_GeneralName *name = NULL; PKIX_TEST_STD_VARS(); subTest("test SubjAltNames Cert Selector"); subTest(" PKIX_PL_GeneralName List create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&nameList, plContext)); subTest(" Create Selector and ComCertSelParams"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" Add directory name "); name = createGeneralName(PKIX_DIRECTORY_NAME, "CN=Invalid DN nameConstraints EE Certificate Test3," "OU=excludedSubtree1,O=Test Certificates,C=US", plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameList, (PKIX_PL_Object *)name, plContext)); subTest(" PKIX_ComCertSelParams_SetSubjAltNames"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubjAltNames(params, nameList, plContext)); PKIX_TEST_DECREF_BC(name); PKIX_TEST_DECREF_BC(nameList); subTest(" Permitting ONE"); testSelector(selector, certs, 0x1); subTest(" Add DNS name "); name = createGeneralName(PKIX_DNS_NAME, "mytestcertificates.gov", plContext); subTest(" PKIX_ComCertSelParams_AddSubjAltName"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_AddSubjAltName(params, name, plContext)); PKIX_TEST_DECREF_BC(name); subTest(" Permitting NONE"); testSelector(selector, certs, 0x0); subTest(" PKIX_ComCertSelParams_SetMatchAllSubjAltNames to FALSE"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetMatchAllSubjAltNames(params, PKIX_FALSE, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" Permitting TWO"); testSelector(selector, certs, 0x3); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(params); PKIX_TEST_DECREF_AC(name); PKIX_TEST_DECREF_AC(nameList); PKIX_TEST_RETURN(); } static void testCertificateValidMatch( PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_PL_String *stringRep = NULL; PKIX_PL_Date *testDate = NULL; char *asciiRep = "050501000000Z"; PKIX_TEST_STD_VARS(); subTest("CertificateValid match"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, asciiRep, 0, &stringRep, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Date_Create_UTCTime(stringRep, &testDate, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetCertificateValid(params, testDate, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); testSelector(selector, certs, 0xFFFFFFFF); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(params); PKIX_TEST_DECREF_AC(stringRep); PKIX_TEST_DECREF_AC(testDate); PKIX_TEST_RETURN(); } static void test_customCallback1(PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_TEST_STD_VARS(); subTest("custom matchCallback"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(custom_CertSelector_MatchCallback, NULL, &selector, plContext)); testSelector(selector, certs, 0x900); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_RETURN(); } static void test_customCallback2(PKIX_List *certs, PKIX_PL_Cert *anyPolicyCert) /* a source for policy anyPolicy */ { PKIX_CertSelector *selector = NULL; PKIX_List *anyPolicyList = NULL; /* OIDs */ PKIX_PL_OID *policyOID = NULL; PKIX_TEST_STD_VARS(); subTest("custom matchCallback with CertSelectorContext"); testGetPolicyFromCert(anyPolicyCert, 0, &anyPolicyList); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(anyPolicyList, 0, (PKIX_PL_Object **)&policyOID, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(custom_CertSelector_MatchOIDCallback, (PKIX_PL_Object *)policyOID, &selector, plContext)); testSelector(selector, certs, (1 << ANYPOLICYCERT)); cleanup: PKIX_TEST_DECREF_AC(selector); PKIX_TEST_DECREF_AC(anyPolicyList); PKIX_TEST_DECREF_AC(policyOID); PKIX_TEST_RETURN(); } static void testExtendedKeyUsageMatch(char *certDir) { PKIX_ComCertSelParams *goodParams = NULL; PKIX_PL_OID *ekuOid = NULL; PKIX_List *ekuOidList = NULL; PKIX_PL_String *dirString = NULL; PKIX_CertStore_CertCallback certCallback; PKIX_CertStore *certStore = NULL; PKIX_CertSelector *certSelector = NULL; PKIX_List *certList = NULL; PKIX_UInt32 numCert = 0; void *nbioContext = NULL; PKIX_TEST_STD_VARS(); subTest("test Extended KeyUsage Cert Selector"); subTest(" PKIX_ComCertSelParams_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); subTest(" Create Extended Key Usage OID List"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&ekuOidList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_OID_Create("1.3.6.1.5.5.7.3.2", &ekuOid, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(ekuOidList, (PKIX_PL_Object *)ekuOid, plContext)); PKIX_TEST_DECREF_BC(ekuOid); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_OID_Create("1.3.6.1.5.5.7.3.3", &ekuOid, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(ekuOidList, (PKIX_PL_Object *)ekuOid, plContext)); PKIX_TEST_DECREF_BC(ekuOid); subTest(" PKIX_ComCertSelParams_SetExtendedKeyUsage"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetExtendedKeyUsage(goodParams, ekuOidList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); subTest(" PKIX_PL_CollectionCertStoreContext_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); subTest(" PKIX_CertSelector_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); subTest(" PKIX_CertStore_GetCertCallback"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); subTest(" Getting data from Cert Callback"); PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); if (numCert != PKIX_TEST_CERTSELECTOR_EXTKEYUSAGE_NUM_CERTS) { pkixTestErrorMsg = "unexpected Cert number mismatch"; } cleanup: PKIX_TEST_DECREF_AC(ekuOid); PKIX_TEST_DECREF_AC(ekuOidList); PKIX_TEST_DECREF_AC(goodParams); PKIX_TEST_DECREF_AC(dirString); PKIX_TEST_DECREF_AC(certList); PKIX_TEST_DECREF_AC(certSelector); PKIX_TEST_DECREF_AC(certStore); PKIX_TEST_RETURN(); } static void testKeyUsageMatch(char *certDir) { PKIX_ComCertSelParams *goodParams = NULL; PKIX_PL_String *dirString = NULL; PKIX_CertStore_CertCallback certCallback; PKIX_CertStore *certStore = NULL; PKIX_CertSelector *certSelector = NULL; PKIX_List *certList = NULL; PKIX_UInt32 numCert = 0; void *nbioContext = NULL; PKIX_TEST_STD_VARS(); subTest("test KeyUsage Cert Selector"); subTest(" PKIX_ComCertSelParams_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); subTest(" PKIX_ComCertSelParams_SetKeyUsage"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetKeyUsage(goodParams, PKIX_CRL_SIGN, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); subTest(" PKIX_PL_CollectionCertStoreContext_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); subTest(" PKIX_CertSelector_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); subTest(" PKIX_CertStore_GetCertCallback"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); subTest(" Getting data from Cert Callback"); PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); if (numCert != PKIX_TEST_CERTSELECTOR_KEYUSAGE_NUM_CERTS) { pkixTestErrorMsg = "unexpected Cert number mismatch"; } cleanup: PKIX_TEST_DECREF_AC(goodParams); PKIX_TEST_DECREF_AC(dirString); PKIX_TEST_DECREF_AC(certList); PKIX_TEST_DECREF_AC(certSelector); PKIX_TEST_DECREF_AC(certStore); PKIX_TEST_RETURN(); } static void testCertValidMatch(char *certDir) { PKIX_ComCertSelParams *goodParams = NULL; PKIX_PL_Date *validDate = NULL; PKIX_PL_String *dirString = NULL; PKIX_CertStore_CertCallback certCallback; PKIX_CertStore *certStore = NULL; PKIX_CertSelector *certSelector = NULL; PKIX_List *certList = NULL; PKIX_UInt32 numCert = 0; void *nbioContext = NULL; PKIX_TEST_STD_VARS(); subTest("test CertValid Cert Selector"); subTest(" PKIX_ComCertSelParams_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); validDate = createDate("050601000000Z", plContext); subTest(" PKIX_ComCertSelParams_SetCertificateValid"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetCertificateValid(goodParams, validDate, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); subTest(" PKIX_PL_CollectionCertStoreContext_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); subTest(" PKIX_CertSelector_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); subTest(" PKIX_CertStore_GetCertCallback"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); subTest(" Getting data from Cert Callback"); PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); if (numCert != PKIX_TEST_CERTSELECTOR_CERTVALID_NUM_CERTS) { pkixTestErrorMsg = "unexpected Cert number mismatch"; } cleanup: PKIX_TEST_DECREF_AC(goodParams); PKIX_TEST_DECREF_AC(validDate); PKIX_TEST_DECREF_AC(dirString); PKIX_TEST_DECREF_AC(certList); PKIX_TEST_DECREF_AC(certSelector); PKIX_TEST_DECREF_AC(certStore); PKIX_TEST_RETURN(); } static void testIssuerMatch(char *certDir) { PKIX_ComCertSelParams *goodParams = NULL; PKIX_PL_X500Name *issuer = NULL; PKIX_PL_String *issuerStr = NULL; PKIX_PL_String *dirString = NULL; PKIX_CertStore_CertCallback certCallback; PKIX_CertStore *certStore = NULL; PKIX_CertSelector *certSelector = NULL; PKIX_List *certList = NULL; char *issuerName = "CN=science,O=mit,C=US"; PKIX_UInt32 numCert = 0; void *nbioContext = NULL; PKIX_TEST_STD_VARS(); subTest("test Issuer Cert Selector"); subTest(" PKIX_ComCertSelParams_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, issuerName, 0, &issuerStr, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_X500Name_Create(issuerStr, &issuer, plContext)); subTest(" PKIX_ComCertSelParams_SetIssuer"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetIssuer(goodParams, issuer, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); subTest(" PKIX_PL_CollectionCertStoreContext_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); subTest(" PKIX_CertSelector_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); subTest(" PKIX_CertStore_GetCertCallback"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); subTest(" Getting data from Cert Callback"); PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); if (numCert != PKIX_TEST_CERTSELECTOR_ISSUER_NUM_CERTS) { pkixTestErrorMsg = "unexpected Cert number mismatch"; } cleanup: PKIX_TEST_DECREF_AC(goodParams); PKIX_TEST_DECREF_AC(issuer); PKIX_TEST_DECREF_AC(issuerStr); PKIX_TEST_DECREF_AC(dirString); PKIX_TEST_DECREF_AC(certList); PKIX_TEST_DECREF_AC(certSelector); PKIX_TEST_DECREF_AC(certStore); PKIX_TEST_RETURN(); } static void testSerialNumberVersionMatch(char *certDir) { PKIX_ComCertSelParams *goodParams = NULL; PKIX_PL_BigInt *serialNumber = NULL; PKIX_PL_String *serialNumberStr = NULL; PKIX_PL_String *dirString = NULL; PKIX_CertStore_CertCallback certCallback; PKIX_CertStore *certStore = NULL; PKIX_CertSelector *certSelector = NULL; PKIX_List *certList = NULL; PKIX_UInt32 numCert = 0; void *nbioContext = NULL; PKIX_TEST_STD_VARS(); subTest("test Serial Number Cert Selector"); subTest(" PKIX_ComCertSelParams_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&goodParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, "01", 0, &serialNumberStr, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_BigInt_Create(serialNumberStr, &serialNumber, plContext)); subTest(" PKIX_ComCertSelParams_SetSerialNumber"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSerialNumber(goodParams, serialNumber, plContext)); subTest(" PKIX_ComCertSelParams_SetVersion"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetVersion(goodParams, 0, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, certDir, 0, &dirString, plContext)); subTest(" PKIX_PL_CollectionCertStoreContext_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); subTest(" PKIX_CertSelector_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, goodParams, plContext)); subTest(" PKIX_CertStore_GetCertCallback"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCertCallback(certStore, &certCallback, NULL)); subTest(" Getting data from Cert Callback"); PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); PKIX_TEST_DECREF_BC(certList); if (numCert != 0) { pkixTestErrorMsg = "unexpected Version mismatch"; } subTest(" PKIX_ComCertSelParams_SetVersion"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetVersion(goodParams, 2, plContext)); subTest(" Getting data from Cert Callback"); PKIX_TEST_EXPECT_NO_ERROR(certCallback(certStore, certSelector, &nbioContext, &certList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(certList, &numCert, plContext)); if (numCert != PKIX_TEST_CERTSELECTOR_SERIALNUMBER_NUM_CERTS) { pkixTestErrorMsg = "unexpected Serial Number mismatch"; } cleanup: PKIX_TEST_DECREF_AC(goodParams); PKIX_TEST_DECREF_AC(serialNumber); PKIX_TEST_DECREF_AC(serialNumberStr); PKIX_TEST_DECREF_AC(dirString); PKIX_TEST_DECREF_AC(certList); PKIX_TEST_DECREF_AC(certSelector); PKIX_TEST_DECREF_AC(certStore); PKIX_TEST_RETURN(); } static void testSubjKeyIdMatch(PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_PL_Cert *cert = NULL; PKIX_PL_ByteArray *selSubjKeyId = NULL; PKIX_UInt32 item = 0; PKIX_TEST_STD_VARS(); subTest("test Subject Key Id Cert Selector"); item = 2; PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, item, (PKIX_PL_Object **)&cert, plContext)); subTest(" PKIX_PL_Cert_GetSubjectKeyIdentifier"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubjectKeyIdentifier(cert, &selSubjKeyId, plContext)); subTest(" Create Selector and ComCertSelParams"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" PKIX_ComCertSelParams_SetSubjKeyIdentifier"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubjKeyIdentifier(params, selSubjKeyId, plContext)); subTest(" Select One"); testSelector(selector, certs, 1 << item); cleanup: PKIX_TEST_DECREF_AC(selSubjKeyId); PKIX_TEST_DECREF_AC(cert); PKIX_TEST_DECREF_AC(params); PKIX_TEST_DECREF_AC(selector); PKIX_TEST_RETURN(); } static void testAuthKeyIdMatch(PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_PL_Cert *cert = NULL; PKIX_PL_ByteArray *selAuthKeyId = NULL; PKIX_UInt32 item = 0; PKIX_TEST_STD_VARS(); subTest("test Auth Key Id Cert Selector"); item = 3; PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, item, (PKIX_PL_Object **)&cert, plContext)); subTest(" PKIX_PL_Cert_GetAuthorityKeyIdentifier"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetAuthorityKeyIdentifier(cert, &selAuthKeyId, plContext)); subTest(" Create Selector and ComCertSelParams"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" PKIX_ComCertSelParams_SetAuthorityKeyIdentifier"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetAuthorityKeyIdentifier(params, selAuthKeyId, plContext)); subTest(" Select TWO"); testSelector(selector, certs, (1 << item) | (1 << 1)); cleanup: PKIX_TEST_DECREF_AC(selAuthKeyId); PKIX_TEST_DECREF_AC(cert); PKIX_TEST_DECREF_AC(params); PKIX_TEST_DECREF_AC(selector); PKIX_TEST_RETURN(); } static void testSubjPKAlgIdMatch(PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_PL_Cert *cert = NULL; PKIX_PL_OID *selAlgId = NULL; PKIX_UInt32 item = 0; PKIX_TEST_STD_VARS(); subTest("test Subject Public Key Algorithm Id Cert Selector"); item = 0; PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, item, (PKIX_PL_Object **)&cert, plContext)); subTest(" PKIX_PL_Cert_GetSubjectPublicKeyAlgId"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubjectPublicKeyAlgId(cert, &selAlgId, plContext)); subTest(" Create Selector and ComCertSelParams"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" PKIX_ComCertSelParams_SetSubjPKAlgId"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubjPKAlgId(params, selAlgId, plContext)); subTest(" Select All"); testSelector(selector, certs, 0x7F); cleanup: PKIX_TEST_DECREF_AC(selAlgId); PKIX_TEST_DECREF_AC(cert); PKIX_TEST_DECREF_AC(params); PKIX_TEST_DECREF_AC(selector); PKIX_TEST_RETURN(); } static void testSubjPublicKeyMatch(PKIX_List *certs) { PKIX_CertSelector *selector = NULL; PKIX_ComCertSelParams *params = NULL; PKIX_PL_Cert *cert = NULL; PKIX_PL_PublicKey *selPublicKey = NULL; PKIX_UInt32 item = 0; PKIX_TEST_STD_VARS(); subTest("test Subject Public Key Cert Selector"); item = 5; PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetItem(certs, item, (PKIX_PL_Object **)&cert, plContext)); subTest(" PKIX_PL_Cert_GetSubjectPublicKey"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Cert_GetSubjectPublicKey(cert, &selPublicKey, plContext)); subTest(" Create Selector and ComCertSelParams"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(¶ms, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(selector, params, plContext)); subTest(" PKIX_ComCertSelParams_SetSubjPubKey"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetSubjPubKey(params, selPublicKey, plContext)); subTest(" Select ONE"); testSelector(selector, certs, 1 << item); cleanup: PKIX_TEST_DECREF_AC(selPublicKey); PKIX_TEST_DECREF_AC(cert); PKIX_TEST_DECREF_AC(params); PKIX_TEST_DECREF_AC(selector); PKIX_TEST_RETURN(); } static void test_CertSelector_Duplicate(PKIX_CertSelector *selector) { PKIX_Int32 goodBasicConstraints = 0; PKIX_Int32 equalBasicConstraints = 0; PKIX_CertSelector *dupSelector = NULL; PKIX_ComCertSelParams *goodParams = NULL; PKIX_ComCertSelParams *equalParams = NULL; PKIX_CertSelector_MatchCallback goodCallback = NULL; PKIX_CertSelector_MatchCallback equalCallback = NULL; PKIX_PL_X500Name *goodSubject = NULL; PKIX_PL_X500Name *equalSubject = NULL; PKIX_List *goodPolicy = NULL; PKIX_List *equalPolicy = NULL; PKIX_PL_Cert *goodCert = NULL; PKIX_PL_Cert *equalCert = NULL; PKIX_PL_Date *goodDate = NULL; PKIX_PL_Date *equalDate = NULL; PKIX_TEST_STD_VARS(); subTest("test_CertSelector_Duplicate"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_Duplicate((PKIX_PL_Object *)selector, (PKIX_PL_Object **)&dupSelector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetCommonCertSelectorParams(selector, &goodParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetCommonCertSelectorParams(dupSelector, &equalParams, plContext)); /* There is no equals function, so look at components separately. */ PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetSubject(goodParams, &goodSubject, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetSubject(equalParams, &equalSubject, plContext)); if (goodSubject && equalSubject) { testEqualsHelper((PKIX_PL_Object *)goodSubject, (PKIX_PL_Object *)equalSubject, PKIX_TRUE, plContext); } else { if PKIX_EXACTLY_ONE_NULL(goodSubject, equalSubject) { pkixTestErrorMsg = "Subject Names are not equal!"; goto cleanup; } } PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetPolicy(goodParams, &goodPolicy, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetPolicy(equalParams, &equalPolicy, plContext)); if (goodPolicy && equalPolicy) { testEqualsHelper((PKIX_PL_Object *)goodPolicy, (PKIX_PL_Object *)equalPolicy, PKIX_TRUE, plContext); } else { if PKIX_EXACTLY_ONE_NULL(goodPolicy, equalPolicy) { pkixTestErrorMsg = "Policy Lists are not equal!"; goto cleanup; } } PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetCertificate(goodParams, &goodCert, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetCertificate(equalParams, &equalCert, plContext)); if (goodCert && equalCert) { testEqualsHelper((PKIX_PL_Object *)goodCert, (PKIX_PL_Object *)equalCert, PKIX_TRUE, plContext); } else { if PKIX_EXACTLY_ONE_NULL(goodCert, equalCert) { pkixTestErrorMsg = "Cert Lists are not equal!"; goto cleanup; } } PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetCertificateValid(goodParams, &goodDate, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetCertificateValid(equalParams, &equalDate, plContext)); if (goodCert && equalCert) { testEqualsHelper((PKIX_PL_Object *)goodDate, (PKIX_PL_Object *)equalDate, PKIX_TRUE, plContext); } else { if PKIX_EXACTLY_ONE_NULL(goodDate, equalDate) { pkixTestErrorMsg = "Date Lists are not equal!"; goto cleanup; } } PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetBasicConstraints(goodParams, &goodBasicConstraints, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_GetBasicConstraints(equalParams, &equalBasicConstraints, plContext)); if (goodBasicConstraints != equalBasicConstraints) { pkixTestErrorMsg = "BasicConstraints are not equal!"; goto cleanup; } PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetMatchCallback(selector, &goodCallback, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_GetMatchCallback(dupSelector, &equalCallback, plContext)); if (goodCallback != equalCallback) { pkixTestErrorMsg = "MatchCallbacks are not equal!"; } cleanup: PKIX_TEST_DECREF_AC(dupSelector); PKIX_TEST_DECREF_AC(goodParams); PKIX_TEST_DECREF_AC(equalParams); PKIX_TEST_DECREF_AC(goodSubject); PKIX_TEST_DECREF_AC(equalSubject); PKIX_TEST_DECREF_AC(goodPolicy); PKIX_TEST_DECREF_AC(equalPolicy); PKIX_TEST_DECREF_AC(goodCert); PKIX_TEST_DECREF_AC(equalCert); PKIX_TEST_DECREF_AC(goodDate); PKIX_TEST_DECREF_AC(equalDate); PKIX_TEST_RETURN(); } static void printUsage(void) { (void)printf("\nUSAGE:\ttest_certselector \n\n"); } int test_certselector(int argc, char *argv[]) { PKIX_UInt32 i = 0; PKIX_UInt32 j = 0; PKIX_UInt32 actualMinorVersion; PKIX_CertSelector *emptySelector = NULL; PKIX_List *certs = NULL; PKIX_List *nameConstraintsCerts = NULL; PKIX_List *subjAltNamesCerts = NULL; PKIX_PL_Cert *cert = NULL; PKIX_PL_Cert *policy1Cert = NULL; PKIX_PL_Cert *policy2Cert = NULL; PKIX_PL_Cert *anyPolicyCert = NULL; PKIX_PL_Cert *subjectCert = NULL; PKIX_ComCertSelParams *selParams = NULL; char *certDir = NULL; char *dirName = NULL; PKIX_TEST_STD_VARS(); startTests("CertSelector"); PKIX_TEST_EXPECT_NO_ERROR( PKIX_PL_NssContext_Create(0, PKIX_FALSE, NULL, &plContext)); if (argc < 3) { printUsage(); return (0); } dirName = argv[j + 1]; certDir = argv[j + 3]; /* Create a List of certs to use in testing the selector */ PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&certs, plContext)); for (i = 0; i < NUMCERTS; i++) { cert = createCert(dirName, certList[i], plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(certs, (PKIX_PL_Object *)cert, plContext)); if (i == POLICY1CERT) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)cert, plContext)); policy1Cert = cert; } if (i == ANYPOLICYCERT) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)cert, plContext)); anyPolicyCert = cert; } if (i == POLICY2CERT) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)cert, plContext)); policy2Cert = cert; } if (i == SUBJECTCERT) { PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_Object_IncRef((PKIX_PL_Object *)cert, plContext)); subjectCert = cert; } PKIX_TEST_DECREF_BC(cert); } PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&nameConstraintsCerts, plContext)); for (i = 0; i < NUMNCCERTS; i++) { cert = createCert(dirName, ncCertList[i], plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(nameConstraintsCerts, (PKIX_PL_Object *)cert, plContext)); PKIX_TEST_DECREF_BC(cert); } PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&subjAltNamesCerts, plContext)); for (i = 0; i < NUMSANCERTS; i++) { cert = createCert(dirName, sanCertList[i], plContext); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(subjAltNamesCerts, (PKIX_PL_Object *)cert, plContext)); PKIX_TEST_DECREF_BC(cert); } subTest("test_CertSelector_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_Create(NULL, NULL, &emptySelector, plContext)); subTest("Default Match, no parameters set"); testSelector(emptySelector, certs, 0xFFFFFFFF); testSubjectMatch(certs, subjectCert); testBasicConstraintsMatch(certs); testPolicyMatch(certs, policy1Cert, policy2Cert, anyPolicyCert); testCertificateMatch(certs, subjectCert); testCertificateValidMatch(certs); subTest("Combination: pass only EE certs that assert some policy"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_Create(&selParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCertSelParams_SetBasicConstraints(selParams, -2, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertSelector_SetCommonCertSelectorParams(emptySelector, selParams, plContext)); testSelector(emptySelector, certs, 0xC00); testNameConstraintsMatch(nameConstraintsCerts); testPathToNamesMatch(nameConstraintsCerts); testSubjAltNamesMatch(subjAltNamesCerts); testExtendedKeyUsageMatch(certDir); testKeyUsageMatch(certDir); testIssuerMatch(certDir); testSerialNumberVersionMatch(certDir); testCertValidMatch(certDir); testSubjKeyIdMatch(nameConstraintsCerts); testAuthKeyIdMatch(nameConstraintsCerts); testSubjPKAlgIdMatch(nameConstraintsCerts); testSubjPublicKeyMatch(nameConstraintsCerts); test_CertSelector_Duplicate(emptySelector); test_customCallback1(certs); test_customCallback2(certs, anyPolicyCert); subTest("test_CertSelector_Destroy"); PKIX_TEST_DECREF_BC(emptySelector); cleanup: PKIX_TEST_DECREF_AC(emptySelector); PKIX_TEST_DECREF_AC(certs); PKIX_TEST_DECREF_AC(cert); PKIX_TEST_DECREF_AC(policy1Cert); PKIX_TEST_DECREF_AC(policy2Cert); PKIX_TEST_DECREF_AC(anyPolicyCert); PKIX_TEST_DECREF_AC(subjectCert); PKIX_TEST_DECREF_AC(selParams); PKIX_TEST_DECREF_AC(nameConstraintsCerts); PKIX_TEST_DECREF_AC(subjAltNamesCerts); PKIX_Shutdown(plContext); PKIX_TEST_RETURN(); endTests("CertSelector"); return (0); }