BUG 816853: Add support for trusting the union of explicit trust anchors and

the trust DB.
r=rrelyea


git-svn-id: svn://10.0.0.236/trunk@264625 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/security/nss/tests/chains/chains.sh

@@ -790,6 +790,7 @@ revoke_cert()
 # FETCH - fetch flag (used with AIA extension)
 # POLICY - list of policies
 # TRUST - trust anchor
+# TRUST_AND_DB - Examine both trust anchors and the cert db for trust
 # VERIFY - list of certificates to use as vfychain parameters
 # EXP_RESULT - expected result
 # REV_OPTS - revocation options
@@ -806,6 +807,7 @@ verify_cert()
     TRUST_OPT=
     VFY_CERTS=
     VFY_LIST=
+    TRUST_AND_DB_OPT=
 
     if [ -n "${DB}" ]; then
         DB_OPT="-d ${DB}"
@@ -819,6 +821,10 @@ verify_cert()
         fi
     fi
 
+    if [ -n "${TRUST_AND_DB}" ]; then
+        TRUST_AND_DB_OPT="-T"
+    fi
+
     for ITEM in ${POLICY}; do
         POLICY_OPT="${POLICY_OPT} -o ${ITEM}"
     done
@@ -851,8 +857,8 @@ verify_cert()
         fi
     done
 
-    VFY_OPTS_TNAME="${REV_OPTS} ${DB_OPT} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${TRUST_OPT}"
-    VFY_OPTS_ALL="${DB_OPT} -pp -vv ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}"
+    VFY_OPTS_TNAME="${TRUST_AND_DB_OPT} ${REV_OPTS} ${DB_OPT} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${TRUST_OPT}"
+    VFY_OPTS_ALL="${DB_OPT} -pp -vv ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}"
 
     TESTNAME="Verifying certificate(s) ${VFY_LIST} with flags ${VFY_OPTS_TNAME}"
     echo "${SCRIPTNAME}: ${TESTNAME}"
@@ -1045,6 +1051,7 @@ parse_config()
         "verify")
             VERIFY="${VALUE}"
             TRUST=
+            TRUST_AND_DB=
             POLICY=
             FETCH=
             EXP_RESULT=
@@ -1064,6 +1071,9 @@ parse_config()
         "trust")
             TRUST="${TRUST} ${VALUE}"
             ;;
+        "trust_and_db")
+            TRUST_AND_DB=1
+            ;;
         "fetch")
             FETCH=1
             ;;

mozilla/security/nss/tests/chains/scenarios/scenarios

@@ -19,6 +19,7 @@
 #
 # Contributor(s):
 #   Slavomir Katuscak <slavomir.katuscak@sun.com>, Sun Microsystems
+#   Ryan Sleevi <ryan.sleevi@gmail.com>, Google
 #
 # Alternatively, the contents of this file may be used under the terms of
 # either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -51,3 +52,4 @@ dsa.cfg
 revoc.cfg
 ocsp.cfg
 crldp.cfg
+trustanchors.cfg

mozilla/security/nss/tests/chains/scenarios/trustanchors.cfg

@@ -0,0 +1,114 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+scenario TrustAnchors
+
+entity RootCA
+  type Root
+
+entity CA1
+  type Intermediate
+  issuer RootCA
+
+entity CA2
+  type Intermediate
+  issuer CA1
+
+entity EE1
+  type EE
+  issuer CA2
+
+entity OtherRoot
+  type Root
+
+entity OtherIntermediate
+  type Intermediate
+  issuer OtherRoot
+
+entity EE2
+  type EE
+  issuer OtherIntermediate
+
+# Scenarios where trust only comes from the DB
+db DBOnly
+
+import RootCA::CT,C,C
+import CA1:RootCA:
+
+# Simple chaining - no trust anchors
+verify EE1:CA2
+  cert CA2:CA1
+  result pass
+
+# Simple trust anchors - ignore the Cert DB
+verify EE1:CA2
+  trust CA2:CA1
+  result pass
+
+# Redundant trust - trust anchor and DB
+verify EE1:CA2
+  cert CA2:CA1
+  trust RootCA
+  result pass
+
+
+# Scenarios where trust only comes from trust anchors
+db TrustOnly
+
+# Simple checking - direct trust anchor
+verify EE1:CA2
+  cert CA2:CA1
+  cert CA1:RootCA:
+  trust RootCA:
+  result pass
+
+# Partial chain (not self-signed), with a trust anchor
+verify EE1:CA2
+  trust CA2:CA1
+  result pass
+
+
+# Scenarios where trust comes from both trust anchors and the DB
+db TrustAndDB
+
+import RootCA::CT,C,C
+import CA1:RootCA:
+
+# Check that trust in the DB works
+verify EE1:CA2
+  cert CA2:CA1
+  result pass
+
+# Check that trust anchors work
+verify EE2:OtherIntermediate
+  cert OtherIntermediate:OtherRoot
+  trust OtherRoot:
+  result pass
+
+# Check that specifying a trust anchor still allows searching the cert DB
+verify EE1:CA2
+  trust_and_db
+  cert CA2:CA1
+  trust OtherIntermediate:OtherRoot
+  trust OtherRoot:
+  result pass
+
+# Scenarios where the trust DB has explicitly distrusted one or more certs,
+# even when the trust anchors indicate trust
+db ExplicitDistrust
+
+import RootCA::CT,C,C
+import CA1:RootCA:p,p,p
+import OtherRoot::p,p,p
+
+# Verify that a distrusted intermediate, but trusted root, is rejected.
+verify EE1:CA2
+  cert CA2:CA1
+  trust CA1:RootCA
+  result fail
+
+# Verify that a trusted intermediate, but distrusted root, is accepted.
+verify EE2:OtherIntermediate
+  trust OtherIntermediate:OtherRoot
+  result pass