mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Backed out 2 changesets (bug 1793841) for causing Gtest failures CLOSED TREE 

Backed out changeset 4d39c423b92e (bug 1793841)
Backed out changeset 5cfb5f595add (bug 1793841)
This commit is contained in:
Noemi Erli 2022-10-18 04:29:44 +03:00
Родитель 556a172274
Коммит 5a21645f73
12 изменённых файлов: 689 добавлений и 583 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

17
browser/base/content/browser.js
Просмотреть файл

@ -294,6 +294,10 @@ XPCOMUtils.defineLazyServiceGetters(this, {
],
Favicons: ["@mozilla.org/browser/favicon-service;1", "nsIFaviconService"],
gDNSService: ["@mozilla.org/network/dns-service;1", "nsIDNSService"],
gSerializationHelper: [
"@mozilla.org/network/serialization-helper;1",
"nsISerializationHelper",
],
WindowsUIUtils: ["@mozilla.org/windows-ui-utils;1", "nsIWindowsUIUtils"],
BrowserHandler: ["@mozilla.org/browser/clh;1", "nsIBrowserHandler"],
});
@ -3639,6 +3643,19 @@ function BrowserReloadWithFlags(reloadFlags) {
}
}
function getSecurityInfo(securityInfoAsString) {
if (!securityInfoAsString) {
return null;
}
let securityInfo = gSerializationHelper.deserializeObject(
securityInfoAsString
);
securityInfo.QueryInterface(Ci.nsITransportSecurityInfo);
return securityInfo;
}
// TODO: can we pull getPEMString in from pippki.js instead of
// duplicating them here?
function getPEMString(cert) {

15
browser/base/content/test/about/browser_aboutCertError_exception.js
Просмотреть файл

@ -52,14 +52,20 @@ add_task(async function checkPermanentExceptionPref() {
let browser = tab.linkedBrowser;
let loaded = BrowserTestUtils.browserLoaded(browser, false, BAD_CERT);
info("Clicking the exceptionDialogButton in advanced panel");
let serverCertBytes = await SpecialPowers.spawn(
let securityInfoAsString = await SpecialPowers.spawn(
browser,
[],
async function() {
let doc = content.document;
let exceptionButton = doc.getElementById("exceptionDialogButton");
exceptionButton.click();
return content.docShell.failedChannel.securityInfo.serverCert.getRawDER();
let serhelper = Cc[
"@mozilla.org/network/serialization-helper;1"
].getService(Ci.nsISerializationHelper);
let serializable = content.docShell.failedChannel.securityInfo.QueryInterface(
Ci.nsISerializable
);
return serhelper.serializeToString(serializable);
}
);
@ -79,10 +85,7 @@ add_task(async function checkPermanentExceptionPref() {
].getService(Ci.nsICertOverrideService);
let isTemporary = {};
let certdb = Cc["@mozilla.org/security/x509certdb;1"].getService(
Ci.nsIX509CertDB
);
let cert = certdb.constructX509(serverCertBytes);
let cert = getSecurityInfo(securityInfoAsString).serverCert;
let hasException = certOverrideService.hasMatchingOverride(
"expired.example.com",
-1,

16
dom/cache/DBSchema.cpp поставляемый
Просмотреть файл

@ -26,7 +26,6 @@
#include "mozilla/dom/cache/Types.h"
#include "mozilla/dom/quota/ResultExtensions.h"
#include "mozilla/net/MozURL.h"
#include "mozilla/psm/TransportSecurityInfo.h"
#include "nsCOMPtr.h"
#include "nsCharSeparatedTokenizer.h"
#include "nsComponentManagerUtils.h"
@ -35,6 +34,7 @@
#include "nsICryptoHash.h"
#include "nsNetCID.h"
#include "nsPrintfCString.h"
#include "nsSerializationHelper.h"
#include "nsTArray.h"
namespace mozilla::dom::cache::db {
@ -1456,11 +1456,13 @@ Result<int32_t, nsresult> InsertSecurityInfo(
mozIStorageConnection& aConn, nsICryptoHash& aCrypto,
nsITransportSecurityInfo* aSecurityInfo) {
MOZ_DIAGNOSTIC_ASSERT(aSecurityInfo);
if (!aSecurityInfo) {
nsCOMPtr<nsISerializable> serializableSecurityInfo(
do_QueryInterface(aSecurityInfo));
if (!serializableSecurityInfo) {
return Err(NS_ERROR_FAILURE);
}
nsCString data;
nsresult rv = aSecurityInfo->ToString(data);
nsresult rv = NS_SerializeToString(serializableSecurityInfo, data);
if (NS_FAILED(rv)) {
return Err(rv);
}
@ -1999,12 +2001,14 @@ Result<SavedResponse, nsresult> ReadResponse(mozIStorageConnection& aConn,
nsCString data;
QM_TRY(MOZ_TO_RESULT(state->GetBlobAsUTF8String(7, data)));
if (!data.IsEmpty()) {
nsCOMPtr<nsITransportSecurityInfo> securityInfo;
nsresult rv = mozilla::psm::TransportSecurityInfo::Read(
data, getter_AddRefs(securityInfo));
nsCOMPtr<nsISupports> securityInfoSupports;
nsresult rv =
NS_DeserializeObject(data, getter_AddRefs(securityInfoSupports));
if (NS_FAILED(rv)) {
return Err(rv);
}
nsCOMPtr<nsITransportSecurityInfo> securityInfo(
do_QueryInterface(securityInfoSupports));
if (!securityInfo) {
return Err(NS_ERROR_FAILURE);
}

6
ipc/glue/TransportSecurityInfoUtils.cpp
Просмотреть файл

@ -33,11 +33,13 @@ bool ParamTraits<nsITransportSecurityInfo*>::Read(
return true;
}
if (!mozilla::psm::TransportSecurityInfo::DeserializeFromIPC(aReader,
aResult)) {
RefPtr<nsITransportSecurityInfo> info =
new mozilla::psm::TransportSecurityInfo();
if (!info->DeserializeFromIPC(aReader)) {
return false;
}
*aResult = std::move(info);
return true;
}

6
ipc/glue/TransportSecurityInfoUtils.h
Просмотреть файл

@ -5,12 +5,8 @@
#ifndef mozilla_ipc_TransportSecurityInfoUtils_h
#define mozilla_ipc_TransportSecurityInfoUtils_h
#include "mozilla/RefPtr.h"
#include "nsCOMPtr.h"
#include "nsITransportSecurityInfo.h"
#include "nsIX509Cert.h"
class MessageReader;
class MessageWriter;
namespace IPC {

11
netwerk/base/FuzzySecurityInfo.cpp
Просмотреть файл

@ -230,12 +230,6 @@ FuzzySecurityInfo::GetFailedVerification(bool* arg) {
return NS_OK;
}
NS_IMETHODIMP
FuzzySecurityInfo::ToString(nsACString& aResult) {
MOZ_CRASH("Unused");
return NS_OK;
}
NS_IMETHODIMP
FuzzySecurityInfo::GetNegotiatedNPN(nsACString& aNegotiatedNPN) {
aNegotiatedNPN = "h2";
@ -323,6 +317,11 @@ void FuzzySecurityInfo::SerializeToIPC(IPC::MessageWriter* aWriter) {
MOZ_CRASH("Unused");
}
bool FuzzySecurityInfo::DeserializeFromIPC(IPC::MessageReader* aReader) {
MOZ_CRASH("Unused");
return false;
}
NS_IMETHODIMP
FuzzySecurityInfo::GetPeerId(nsACString& aResult) {
aResult.Assign(""_ns);

55
netwerk/cache2/CacheEntry.cpp
Просмотреть файл

@ -2,32 +2,33 @@
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include <algorithm>
#include <math.h>
#include "CacheLog.h"
#include "CacheEntry.h"
#include "CacheStorageService.h"
#include "CacheObserver.h"
#include "CacheFileUtils.h"
#include "CacheIndex.h"
#include "CacheLog.h"
#include "CacheObserver.h"
#include "CacheStorageService.h"
#include "mozilla/IntegerPrintfMacros.h"
#include "mozilla/Telemetry.h"
#include "mozilla/psm/TransportSecurityInfo.h"
#include "nsComponentManagerUtils.h"
#include "nsIAsyncOutputStream.h"
#include "nsICacheEntryOpenCallback.h"
#include "nsICacheStorage.h"
#include "nsIInputStream.h"
#include "nsIOutputStream.h"
#include "nsISeekableStream.h"
#include "nsISizeOf.h"
#include "nsIURI.h"
#include "nsProxyRelease.h"
#include "nsICacheEntryOpenCallback.h"
#include "nsICacheStorage.h"
#include "nsISerializable.h"
#include "nsISizeOf.h"
#include "nsComponentManagerUtils.h"
#include "nsServiceManagerUtils.h"
#include "nsString.h"
#include "nsProxyRelease.h"
#include "nsSerializationHelper.h"
#include "nsThreadUtils.h"
#include "mozilla/Telemetry.h"
#include "mozilla/IntegerPrintfMacros.h"
#include <math.h>
#include <algorithm>
namespace mozilla::net {
@ -1342,22 +1343,27 @@ nsresult CacheEntry::GetSecurityInfo(nsITransportSecurityInfo** aSecurityInfo) {
NS_ENSURE_SUCCESS(mFileStatus, NS_ERROR_NOT_AVAILABLE);
nsCString info;
nsresult rv = mFile->GetElement("security-info", getter_Copies(info));
nsCOMPtr<nsISupports> secInfoSupports;
nsresult rv;
rv = mFile->GetElement("security-info", getter_Copies(info));
NS_ENSURE_SUCCESS(rv, rv);
nsCOMPtr<nsITransportSecurityInfo> securityInfo;
if (!info.IsVoid()) {
rv = mozilla::psm::TransportSecurityInfo::Read(
info, getter_AddRefs(securityInfo));
rv = NS_DeserializeObject(info, getter_AddRefs(secInfoSupports));
NS_ENSURE_SUCCESS(rv, rv);
}
if (!securityInfo) {
nsCOMPtr<nsITransportSecurityInfo> secInfo =
do_QueryInterface(secInfoSupports);
if (!secInfo) {
return NS_ERROR_NOT_AVAILABLE;
}
{
mozilla::MutexAutoLock lock(mLock);
mSecurityInfo.swap(securityInfo);
mSecurityInfo.swap(secInfo);
mSecurityInfoLoaded = true;
*aSecurityInfo = do_AddRef(mSecurityInfo).take();
@ -1378,9 +1384,12 @@ nsresult CacheEntry::SetSecurityInfo(nsITransportSecurityInfo* aSecurityInfo) {
mSecurityInfoLoaded = true;
}
nsCOMPtr<nsISerializable> serializable = do_QueryInterface(aSecurityInfo);
if (aSecurityInfo && !serializable) return NS_ERROR_UNEXPECTED;
nsCString info;
if (aSecurityInfo) {
rv = aSecurityInfo->ToString(info);
if (serializable) {
rv = NS_SerializeToString(serializable, info);
NS_ENSURE_SUCCESS(rv, rv);
}

11
netwerk/socket/nsITransportSecurityInfo.idl
Просмотреть файл

@ -6,16 +6,17 @@
#include "nsISupports.idl"
interface nsIObjectOutputStream;
interface nsIX509Cert;
%{ C++
namespace IPC {
class MessageWriter;
class MessageReader;
}
%}
[ptr] native IpcMessageWriterPtr(IPC::MessageWriter);
[ptr] native IpcMessageReaderPtr(IPC::MessageReader);
[builtinclass, scriptable, uuid(216112d3-28bc-4671-b057-f98cc09ba1ea)]
interface nsITransportSecurityInfo : nsISupports {
@ -102,12 +103,8 @@ interface nsITransportSecurityInfo : nsISupports {
[notxpcom, noscript]
void SerializeToIPC(in IpcMessageWriterPtr aWriter);
/**
* Serializes the data represented in this interface to a base64-encoded
* string that can be deserialized using TransportSecurityInfo::Read.
*/
[must_use]
ACString toString();
[notxpcom, noscript]
bool DeserializeFromIPC(in IpcMessageReaderPtr aReader);
/* negotiatedNPN is '' if no NPN list was provided by the client,
* or if the server did not select any protocol choice from that

408
security/manager/ssl/TransportSecurityInfo.cpp
Просмотреть файл

@ -8,10 +8,7 @@
#include "PSMRunnable.h"
#include "ipc/IPCMessageUtils.h"
#include "mozilla/Base64.h"
#include "mozilla/Casting.h"
#include "mozpkix/pkixtypes.h"
#include "nsBase64Encoder.h"
#include "nsComponentManagerUtils.h"
#include "nsICertOverrideService.h"
#include "nsIObjectInputStream.h"
@ -23,8 +20,8 @@
#include "nsNSSHelper.h"
#include "nsReadableUtils.h"
#include "nsServiceManagerUtils.h"
#include "nsStringStream.h"
#include "nsXULAppAPI.h"
#include "mozpkix/pkixtypes.h"
#include "secerr.h"
#include "ssl.h"
@ -67,7 +64,7 @@ TransportSecurityInfo::TransportSecurityInfo()
mPort(0) {}
NS_IMPL_ISUPPORTS(TransportSecurityInfo, nsITransportSecurityInfo,
nsIInterfaceRequestor)
nsIInterfaceRequestor, nsISerializable, nsIClassInfo)
void TransportSecurityInfo::SetPreliminaryHandshakeInfo(
const SSLChannelInfo& channelInfo, const SSLCipherSuiteInfo& cipherInfo) {
@ -165,15 +162,6 @@ TransportSecurityInfo::GetInterface(const nsIID& uuid, void** result) {
return rv;
}
// 16786594-0296-4471-8096-8f84497ca428
#define TRANSPORTSECURITYINFO_CID \
{ \
0x16786594, 0x0296, 0x4471, { \
0x80, 0x96, 0x8f, 0x84, 0x49, 0x7c, 0xa4, 0x28 \
} \
}
static NS_DEFINE_CID(kTransportSecurityInfoCID, TRANSPORTSECURITYINFO_CID);
// This is a new magic value. However, it re-uses the first 4 bytes
// of the previous value. This is so when older versions attempt to
// read a newer serialized TransportSecurityInfo, they will actually
@ -189,40 +177,29 @@ static NS_DEFINE_CID(kTransportSecurityInfoMagic, TRANSPORTSECURITYINFOMAGIC);
// NB: Any updates (except disk-only fields) must be kept in sync with
// |SerializeToIPC|.
NS_IMETHODIMP
TransportSecurityInfo::ToString(nsACString& aResult) {
RefPtr<nsBase64Encoder> stream(new nsBase64Encoder());
nsCOMPtr<nsIObjectOutputStream> objStream(NS_NewObjectOutputStream(stream));
nsresult rv = objStream->WriteID(kTransportSecurityInfoCID);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteID(NS_ISUPPORTS_IID);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteID(kTransportSecurityInfoMagic);
TransportSecurityInfo::Write(nsIObjectOutputStream* aStream) {
nsresult rv = aStream->WriteID(kTransportSecurityInfoMagic);
if (NS_FAILED(rv)) {
return rv;
}
MutexAutoLock lock(mMutex);
rv = objStream->Write32(mSecurityState);
rv = aStream->Write32(mSecurityState);
if (NS_FAILED(rv)) {
return rv;
}
// mSubRequestsBrokenSecurity was removed in bug 748809
rv = objStream->Write32(0);
rv = aStream->Write32(0);
if (NS_FAILED(rv)) {
return rv;
}
// mSubRequestsNoSecurity was removed in bug 748809
rv = objStream->Write32(0);
rv = aStream->Write32(0);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->Write32(static_cast<uint32_t>(mErrorCode));
rv = aStream->Write32(static_cast<uint32_t>(mErrorCode));
if (NS_FAILED(rv)) {
return rv;
}
@ -230,104 +207,99 @@ TransportSecurityInfo::ToString(nsACString& aResult) {
// Re-purpose mErrorMessageCached to represent serialization version
// If string doesn't match exact version it will be treated as older
// serialization.
rv = objStream->WriteWStringZ(NS_ConvertUTF8toUTF16("9").get());
rv = aStream->WriteWStringZ(NS_ConvertUTF8toUTF16("9").get());
if (NS_FAILED(rv)) {
return rv;
}
// moved from nsISSLStatus
rv = NS_WriteOptionalCompoundObject(objStream, mServerCert,
rv = NS_WriteOptionalCompoundObject(aStream, mServerCert,
NS_GET_IID(nsIX509Cert), true);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->Write16(mCipherSuite);
rv = aStream->Write16(mCipherSuite);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->Write16(mProtocolVersion);
rv = aStream->Write16(mProtocolVersion);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->Write32(mOverridableErrorCategory);
rv = aStream->Write32(mOverridableErrorCategory);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->WriteBoolean(mIsEV);
rv = aStream->WriteBoolean(mIsEV);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->WriteBoolean(mHasIsEVStatus);
rv = aStream->WriteBoolean(mHasIsEVStatus);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->WriteBoolean(mHaveCipherSuiteAndProtocol);
rv = aStream->WriteBoolean(mHaveCipherSuiteAndProtocol);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->WriteBoolean(mHaveCertErrorBits);
rv = aStream->WriteBoolean(mHaveCertErrorBits);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->Write16(mCertificateTransparencyStatus);
rv = aStream->Write16(mCertificateTransparencyStatus);
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->WriteStringZ(mKeaGroup.get());
rv = aStream->WriteStringZ(mKeaGroup.get());
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->WriteStringZ(mSignatureSchemeName.get());
rv = aStream->WriteStringZ(mSignatureSchemeName.get());
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->Write16(mSucceededCertChain.Length());
rv = aStream->Write16(mSucceededCertChain.Length());
NS_ENSURE_SUCCESS(rv, rv);
for (const auto& cert : mSucceededCertChain) {
rv = objStream->WriteCompoundObject(cert, NS_GET_IID(nsIX509Cert), true);
rv = aStream->WriteCompoundObject(cert, NS_GET_IID(nsIX509Cert), true);
NS_ENSURE_SUCCESS(rv, rv);
}
// END moved from nsISSLStatus
rv = objStream->Write16(mFailedCertChain.Length());
rv = aStream->Write16(mFailedCertChain.Length());
NS_ENSURE_SUCCESS(rv, rv);
for (const auto& cert : mFailedCertChain) {
rv = objStream->WriteCompoundObject(cert, NS_GET_IID(nsIX509Cert), true);
rv = aStream->WriteCompoundObject(cert, NS_GET_IID(nsIX509Cert), true);
NS_ENSURE_SUCCESS(rv, rv);
}
rv = objStream->WriteBoolean(mIsDelegatedCredential);
rv = aStream->WriteBoolean(mIsDelegatedCredential);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteBoolean(mNPNCompleted);
rv = aStream->WriteBoolean(mNPNCompleted);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteStringZ(mNegotiatedNPN.get());
rv = aStream->WriteStringZ(mNegotiatedNPN.get());
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteBoolean(mResumed);
rv = aStream->WriteBoolean(mResumed);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteBoolean(mIsBuiltCertChainRootBuiltInRoot);
rv = aStream->WriteBoolean(mIsBuiltCertChainRootBuiltInRoot);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteBoolean(mIsAcceptedEch);
rv = aStream->WriteBoolean(mIsAcceptedEch);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteStringZ(mPeerId.get());
rv = aStream->WriteStringZ(mPeerId.get());
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteBoolean(mMadeOCSPRequests);
rv = aStream->WriteBoolean(mMadeOCSPRequests);
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->WriteBoolean(mUsedPrivateDNS);
if (NS_FAILED(rv)) {
return rv;
}
rv = stream->Finish(aResult);
rv = aStream->WriteBoolean(mUsedPrivateDNS);
if (NS_FAILED(rv)) {
return rv;
}
@ -341,8 +313,9 @@ TransportSecurityInfo::ToString(nsACString& aResult) {
}
nsresult TransportSecurityInfo::ReadOldOverridableErrorBits(
nsIObjectInputStream* aStream,
OverridableErrorCategory& aOverridableErrorCategory) {
nsIObjectInputStream* aStream, MutexAutoLock& aProofOfLock) {
mMutex.AssertCurrentThreadOwns();
bool isDomainMismatch;
nsresult rv = aStream->ReadBoolean(&isDomainMismatch);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
@ -356,16 +329,16 @@ nsresult TransportSecurityInfo::ReadOldOverridableErrorBits(
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
if (isUntrusted) {
aOverridableErrorCategory =
mOverridableErrorCategory =
nsITransportSecurityInfo::OverridableErrorCategory::ERROR_TRUST;
} else if (isDomainMismatch) {
aOverridableErrorCategory =
mOverridableErrorCategory =
nsITransportSecurityInfo::OverridableErrorCategory::ERROR_DOMAIN;
} else if (isNotValidAtThisTime) {
aOverridableErrorCategory =
mOverridableErrorCategory =
nsITransportSecurityInfo::OverridableErrorCategory::ERROR_TIME;
} else {
aOverridableErrorCategory =
mOverridableErrorCategory =
nsITransportSecurityInfo::OverridableErrorCategory::ERROR_UNSET;
}
@ -374,14 +347,10 @@ nsresult TransportSecurityInfo::ReadOldOverridableErrorBits(
// This is for backward compatibility to be able to read nsISSLStatus
// serialized object.
nsresult TransportSecurityInfo::ReadSSLStatus(
nsIObjectInputStream* aStream, nsCOMPtr<nsIX509Cert>& aServerCert,
uint16_t& aCipherSuite, uint16_t& aProtocolVersion,
OverridableErrorCategory& aOverridableErrorCategory, bool& aIsEV,
bool& aHasIsEVStatus, bool& aHaveCipherSuiteAndProtocol,
bool& aHaveCertErrorBits, uint16_t& aCertificateTransparencyStatus,
nsCString& aKeaGroup, nsCString& aSignatureSchemeName,
nsTArray<RefPtr<nsIX509Cert>>& aSucceededCertChain) {
nsresult TransportSecurityInfo::ReadSSLStatus(nsIObjectInputStream* aStream,
MutexAutoLock& aProofOfLock) {
mMutex.AssertCurrentThreadOwns();
bool nsISSLStatusPresent;
nsresult rv = aStream->ReadBoolean(&nsISSLStatusPresent);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
@ -416,14 +385,14 @@ nsresult TransportSecurityInfo::ReadSSLStatus(
NS_ENSURE_SUCCESS(rv, rv);
if (cert) {
aServerCert = do_QueryInterface(cert);
if (!aServerCert) {
mServerCert = do_QueryInterface(cert);
if (!mServerCert) {
CHILD_DIAGNOSTIC_ASSERT(false, "Deserialization should not fail");
return NS_NOINTERFACE;
}
}
rv = aStream->Read16(&aCipherSuite);
rv = aStream->Read16(&mCipherSuite);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
@ -437,29 +406,29 @@ nsresult TransportSecurityInfo::ReadSSLStatus(
rv = aStream->Read16(&protocolVersionAndStreamFormatVersion);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
aProtocolVersion = protocolVersionAndStreamFormatVersion & 0xFF;
mProtocolVersion = protocolVersionAndStreamFormatVersion & 0xFF;
const uint8_t streamFormatVersion =
(protocolVersionAndStreamFormatVersion >> 8) & 0xFF;
rv = ReadOldOverridableErrorBits(aStream, aOverridableErrorCategory);
rv = ReadOldOverridableErrorBits(aStream, aProofOfLock);
NS_ENSURE_SUCCESS(rv, rv);
rv = aStream->ReadBoolean(&aIsEV);
rv = ReadBoolAndSetAtomicFieldHelper(aStream, mIsEV);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = aStream->ReadBoolean(&aHasIsEVStatus);
rv = ReadBoolAndSetAtomicFieldHelper(aStream, mHasIsEVStatus);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = aStream->ReadBoolean(&aHaveCipherSuiteAndProtocol);
rv = ReadBoolAndSetAtomicFieldHelper(aStream, mHaveCipherSuiteAndProtocol);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = aStream->ReadBoolean(&aHaveCertErrorBits);
rv = ReadBoolAndSetAtomicFieldHelper(aStream, mHaveCertErrorBits);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
// Added in version 1 (see bug 1305289).
if (streamFormatVersion >= 1) {
rv = aStream->Read16(&aCertificateTransparencyStatus);
rv = aStream->Read16(&mCertificateTransparencyStatus);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
@ -467,12 +436,12 @@ nsresult TransportSecurityInfo::ReadSSLStatus(
// Added in version 2 (see bug 1304923).
if (streamFormatVersion >= 2) {
rv = aStream->ReadCString(aKeaGroup);
rv = aStream->ReadCString(mKeaGroup);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = aStream->ReadCString(aSignatureSchemeName);
rv = aStream->ReadCString(mSignatureSchemeName);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
@ -480,7 +449,7 @@ nsresult TransportSecurityInfo::ReadSSLStatus(
// Added in version 3 (see bug 1406856).
if (streamFormatVersion >= 3) {
rv = ReadCertList(aStream, aSucceededCertChain);
rv = ReadCertList(aStream, mSucceededCertChain, aProofOfLock);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
@ -489,7 +458,7 @@ nsresult TransportSecurityInfo::ReadSSLStatus(
// Read only to consume bytes from the stream.
nsTArray<RefPtr<nsIX509Cert>> failedCertChain;
rv = ReadCertList(aStream, failedCertChain);
rv = ReadCertList(aStream, failedCertChain, aProofOfLock);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
@ -502,7 +471,8 @@ nsresult TransportSecurityInfo::ReadSSLStatus(
// This is for backward compatability to be able to read nsIX509CertList
// serialized object.
nsresult TransportSecurityInfo::ReadCertList(
nsIObjectInputStream* aStream, nsTArray<RefPtr<nsIX509Cert>>& aCertList) {
nsIObjectInputStream* aStream, nsTArray<RefPtr<nsIX509Cert>>& aCertList,
MutexAutoLock& aProofOfLock) {
bool nsIX509CertListPresent;
nsresult rv = aStream->ReadBoolean(&nsIX509CertListPresent);
@ -538,12 +508,13 @@ nsresult TransportSecurityInfo::ReadCertList(
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
return ReadCertificatesFromStream(aStream, certListSize, aCertList);
return ReadCertificatesFromStream(aStream, certListSize, aCertList,
aProofOfLock);
}
nsresult TransportSecurityInfo::ReadCertificatesFromStream(
nsIObjectInputStream* aStream, uint32_t aSize,
nsTArray<RefPtr<nsIX509Cert>>& aCertList) {
nsTArray<RefPtr<nsIX509Cert>>& aCertList, MutexAutoLock& aProofOfLock) {
nsresult rv;
for (uint32_t i = 0; i < aSize; ++i) {
nsCOMPtr<nsISupports> support;
@ -581,46 +552,10 @@ IntToOverridableErrorCategory(uint32_t intVal) {
// NB: Any updates (except disk-only fields) must be kept in sync with
// |DeserializeFromIPC|.
nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
nsITransportSecurityInfo** aResult) {
*aResult = nullptr;
nsCString decodedSecurityInfo;
nsresult rv = Base64Decode(aSerializedSecurityInfo, decodedSecurityInfo);
if (NS_FAILED(rv)) {
return rv;
}
nsCOMPtr<nsIInputStream> inputStream;
rv = NS_NewCStringInputStream(getter_AddRefs(inputStream),
std::move(decodedSecurityInfo));
if (NS_FAILED(rv)) {
return rv;
}
nsCOMPtr<nsIObjectInputStream> objStream(
NS_NewObjectInputStream(inputStream));
if (!objStream) {
return rv;
}
nsCID cid;
rv = objStream->ReadID(&cid);
if (NS_FAILED(rv)) {
return rv;
}
if (!cid.Equals(kTransportSecurityInfoCID)) {
return NS_ERROR_UNEXPECTED;
}
nsIID iid;
rv = objStream->ReadID(&iid);
if (NS_FAILED(rv)) {
return rv;
}
if (!iid.Equals(NS_ISUPPORTS_IID)) {
return rv;
}
NS_IMETHODIMP
TransportSecurityInfo::Read(nsIObjectInputStream* aStream) {
nsID id;
rv = objStream->ReadID(&id);
nsresult rv = aStream->ReadID(&id);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
@ -630,47 +565,46 @@ nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
return NS_ERROR_UNEXPECTED;
}
RefPtr<TransportSecurityInfo> securityInfo(new TransportSecurityInfo());
MutexAutoLock guard(securityInfo->mMutex);
rv = ReadUint32AndSetAtomicFieldHelper(objStream,
securityInfo->mSecurityState);
MutexAutoLock lock(mMutex);
rv = ReadUint32AndSetAtomicFieldHelper(aStream, mSecurityState);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
}
// mSubRequestsBrokenSecurity was removed in bug 748809
uint32_t unusedSubRequestsBrokenSecurity;
rv = objStream->Read32(&unusedSubRequestsBrokenSecurity);
rv = aStream->Read32(&unusedSubRequestsBrokenSecurity);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
}
// mSubRequestsNoSecurity was removed in bug 748809
uint32_t unusedSubRequestsNoSecurity;
rv = objStream->Read32(&unusedSubRequestsNoSecurity);
rv = aStream->Read32(&unusedSubRequestsNoSecurity);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
}
uint32_t errorCode;
rv = objStream->Read32(&errorCode);
rv = aStream->Read32(&errorCode);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
}
// PRErrorCode will be a negative value
securityInfo->mErrorCode = static_cast<PRErrorCode>(errorCode);
mErrorCode = static_cast<PRErrorCode>(errorCode);
// If mErrorCode is non-zero, SetCanceled was called on the
// TransportSecurityInfo that was serialized.
if (securityInfo->mErrorCode != 0) {
securityInfo->mCanceled = true;
if (mErrorCode != 0) {
mCanceled = true;
}
// Re-purpose mErrorMessageCached to represent serialization version
// If string doesn't match exact version it will be treated as older
// serialization.
nsAutoString serVersion;
rv = objStream->ReadString(serVersion);
rv = aStream->ReadString(serVersion);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv), "Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
@ -694,140 +628,119 @@ nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
// moved from nsISSLStatus
if (serVersionParsedToInt < 1) {
// nsISSLStatus may be present
OverridableErrorCategory overridableErrorCategory;
bool isEV;
bool hasIsEVStatus;
bool haveCipherSuiteAndProtocol;
bool haveCertErrorBits;
rv = ReadSSLStatus(
objStream, securityInfo->mServerCert, securityInfo->mCipherSuite,
securityInfo->mProtocolVersion, overridableErrorCategory, isEV,
hasIsEVStatus, haveCipherSuiteAndProtocol, haveCertErrorBits,
securityInfo->mCertificateTransparencyStatus, securityInfo->mKeaGroup,
securityInfo->mSignatureSchemeName, securityInfo->mSucceededCertChain);
rv = ReadSSLStatus(aStream, lock);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
securityInfo->mOverridableErrorCategory = overridableErrorCategory;
securityInfo->mIsEV = isEV;
securityInfo->mHasIsEVStatus = hasIsEVStatus;
securityInfo->mHaveCipherSuiteAndProtocol = haveCipherSuiteAndProtocol;
securityInfo->mHaveCertErrorBits = haveCertErrorBits;
} else {
nsCOMPtr<nsISupports> cert;
rv = NS_ReadOptionalObject(objStream, true, getter_AddRefs(cert));
rv = NS_ReadOptionalObject(aStream, true, getter_AddRefs(cert));
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
if (cert != nullptr) {
securityInfo->mServerCert = do_QueryInterface(cert);
if (!securityInfo->mServerCert) {
mServerCert = do_QueryInterface(cert);
if (!mServerCert) {
CHILD_DIAGNOSTIC_ASSERT(false, "Deserialization should not fail");
return NS_NOINTERFACE;
}
}
rv = objStream->Read16(&securityInfo->mCipherSuite);
rv = aStream->Read16(&mCipherSuite);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->Read16(&securityInfo->mProtocolVersion);
rv = aStream->Read16(&mProtocolVersion);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
if (serVersionParsedToInt < 8) {
OverridableErrorCategory overridableErrorCategory;
rv = ReadOldOverridableErrorBits(objStream, overridableErrorCategory);
rv = ReadOldOverridableErrorBits(aStream, lock);
NS_ENSURE_SUCCESS(rv, rv);
securityInfo->mOverridableErrorCategory = overridableErrorCategory;
} else {
uint32_t overridableErrorCategory;
rv = objStream->Read32(&overridableErrorCategory);
rv = aStream->Read32(&overridableErrorCategory);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
securityInfo->mOverridableErrorCategory =
mOverridableErrorCategory =
IntToOverridableErrorCategory(overridableErrorCategory);
}
rv = ReadBoolAndSetAtomicFieldHelper(objStream, securityInfo->mIsEV);
rv = ReadBoolAndSetAtomicFieldHelper(aStream, mIsEV);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = ReadBoolAndSetAtomicFieldHelper(objStream,
securityInfo->mHasIsEVStatus);
rv = ReadBoolAndSetAtomicFieldHelper(aStream, mHasIsEVStatus);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = ReadBoolAndSetAtomicFieldHelper(
objStream, securityInfo->mHaveCipherSuiteAndProtocol);
rv = ReadBoolAndSetAtomicFieldHelper(aStream, mHaveCipherSuiteAndProtocol);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = ReadBoolAndSetAtomicFieldHelper(objStream,
securityInfo->mHaveCertErrorBits);
rv = ReadBoolAndSetAtomicFieldHelper(aStream, mHaveCertErrorBits);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->Read16(&securityInfo->mCertificateTransparencyStatus);
rv = aStream->Read16(&mCertificateTransparencyStatus);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->ReadCString(securityInfo->mKeaGroup);
rv = aStream->ReadCString(mKeaGroup);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = objStream->ReadCString(securityInfo->mSignatureSchemeName);
rv = aStream->ReadCString(mSignatureSchemeName);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
if (serVersionParsedToInt < 3) {
// The old data structure of certList(nsIX509CertList) presents
rv = ReadCertList(objStream, securityInfo->mSucceededCertChain);
rv = ReadCertList(aStream, mSucceededCertChain, lock);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
} else {
uint16_t certCount;
rv = objStream->Read16(&certCount);
rv = aStream->Read16(&certCount);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = ReadCertificatesFromStream(objStream, certCount,
securityInfo->mSucceededCertChain);
rv = ReadCertificatesFromStream(aStream, certCount, mSucceededCertChain,
lock);
NS_ENSURE_SUCCESS(rv, rv);
}
}
// END moved from nsISSLStatus
if (serVersionParsedToInt < 3) {
// The old data structure of certList(nsIX509CertList) presents
rv = ReadCertList(objStream, securityInfo->mFailedCertChain);
rv = ReadCertList(aStream, mFailedCertChain, lock);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
} else {
uint16_t certCount;
rv = objStream->Read16(&certCount);
rv = aStream->Read16(&certCount);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
NS_ENSURE_SUCCESS(rv, rv);
rv = ReadCertificatesFromStream(objStream, certCount,
securityInfo->mFailedCertChain);
rv = ReadCertificatesFromStream(aStream, certCount, mFailedCertChain, lock);
NS_ENSURE_SUCCESS(rv, rv);
}
// mIsDelegatedCredential added in bug 1562773
if (serVersionParsedToInt >= 2) {
rv = objStream->ReadBoolean(&securityInfo->mIsDelegatedCredential);
rv = aStream->ReadBoolean(&mIsDelegatedCredential);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
@ -837,21 +750,21 @@ nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
// mNPNCompleted, mNegotiatedNPN, mResumed added in bug 1584104
if (serVersionParsedToInt >= 4) {
rv = objStream->ReadBoolean(&securityInfo->mNPNCompleted);
rv = aStream->ReadBoolean(&mNPNCompleted);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->ReadCString(securityInfo->mNegotiatedNPN);
rv = aStream->ReadCString(mNegotiatedNPN);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->ReadBoolean(&securityInfo->mResumed);
rv = aStream->ReadBoolean(&mResumed);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
@ -861,8 +774,7 @@ nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
// mIsBuiltCertChainRootBuiltInRoot added in bug 1485652
if (serVersionParsedToInt >= 5) {
rv =
objStream->ReadBoolean(&securityInfo->mIsBuiltCertChainRootBuiltInRoot);
rv = aStream->ReadBoolean(&mIsBuiltCertChainRootBuiltInRoot);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
@ -872,7 +784,7 @@ nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
// mIsAcceptedEch added in bug 1678079
if (serVersionParsedToInt >= 6) {
rv = objStream->ReadBoolean(&securityInfo->mIsAcceptedEch);
rv = aStream->ReadBoolean(&mIsAcceptedEch);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
@ -882,7 +794,7 @@ nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
// mPeerId added in bug 1738664
if (serVersionParsedToInt >= 7) {
rv = objStream->ReadCString(securityInfo->mPeerId);
rv = aStream->ReadCString(mPeerId);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
@ -891,14 +803,14 @@ nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
}
if (serVersionParsedToInt >= 9) {
rv = objStream->ReadBoolean(&securityInfo->mMadeOCSPRequests);
rv = aStream->ReadBoolean(&mMadeOCSPRequests);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
return rv;
}
rv = objStream->ReadBoolean(&securityInfo->mUsedPrivateDNS);
rv = aStream->ReadBoolean(&mUsedPrivateDNS);
CHILD_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv),
"Deserialization should not fail");
if (NS_FAILED(rv)) {
@ -906,7 +818,6 @@ nsresult TransportSecurityInfo::Read(const nsCString& aSerializedSecurityInfo,
};
}
securityInfo.forget(aResult);
return NS_OK;
}
@ -943,53 +854,90 @@ void TransportSecurityInfo::SerializeToIPC(IPC::MessageWriter* aWriter) {
WriteParam(aWriter, mUsedPrivateDNS);
}
bool TransportSecurityInfo::DeserializeFromIPC(
IPC::MessageReader* aReader, RefPtr<nsITransportSecurityInfo>* aResult) {
RefPtr<TransportSecurityInfo> securityInfo(new TransportSecurityInfo());
MutexAutoLock guard(securityInfo->mMutex);
bool TransportSecurityInfo::DeserializeFromIPC(IPC::MessageReader* aReader) {
MutexAutoLock guard(mMutex);
int32_t errorCode = 0;
uint32_t overridableErrorCategory;
if (!ReadParamAtomicHelper(aReader, securityInfo->mSecurityState) ||
!ReadParam(aReader, &errorCode) ||
!ReadParam(aReader, &securityInfo->mServerCert) ||
!ReadParam(aReader, &securityInfo->mCipherSuite) ||
!ReadParam(aReader, &securityInfo->mProtocolVersion) ||
if (!ReadParamAtomicHelper(aReader, mSecurityState) ||
!ReadParam(aReader, &errorCode) || !ReadParam(aReader, &mServerCert) ||
!ReadParam(aReader, &mCipherSuite) ||
!ReadParam(aReader, &mProtocolVersion) ||
!ReadParam(aReader, &overridableErrorCategory) ||
!ReadParamAtomicHelper(aReader, securityInfo->mIsEV) ||
!ReadParamAtomicHelper(aReader, securityInfo->mHasIsEVStatus) ||
!ReadParamAtomicHelper(aReader,
securityInfo->mHaveCipherSuiteAndProtocol) ||
!ReadParamAtomicHelper(aReader, securityInfo->mHaveCertErrorBits) ||
!ReadParam(aReader, &securityInfo->mCertificateTransparencyStatus) ||
!ReadParam(aReader, &securityInfo->mKeaGroup) ||
!ReadParam(aReader, &securityInfo->mSignatureSchemeName) ||
!ReadParam(aReader, &securityInfo->mSucceededCertChain) ||
!ReadParam(aReader, &securityInfo->mFailedCertChain) ||
!ReadParam(aReader, &securityInfo->mIsDelegatedCredential) ||
!ReadParam(aReader, &securityInfo->mNPNCompleted) ||
!ReadParam(aReader, &securityInfo->mNegotiatedNPN) ||
!ReadParam(aReader, &securityInfo->mResumed) ||
!ReadParam(aReader, &securityInfo->mIsBuiltCertChainRootBuiltInRoot) ||
!ReadParam(aReader, &securityInfo->mIsAcceptedEch) ||
!ReadParam(aReader, &securityInfo->mPeerId) ||
!ReadParam(aReader, &securityInfo->mMadeOCSPRequests) ||
!ReadParam(aReader, &securityInfo->mUsedPrivateDNS)) {
!ReadParamAtomicHelper(aReader, mIsEV) ||
!ReadParamAtomicHelper(aReader, mHasIsEVStatus) ||
!ReadParamAtomicHelper(aReader, mHaveCipherSuiteAndProtocol) ||
!ReadParamAtomicHelper(aReader, mHaveCertErrorBits) ||
!ReadParam(aReader, &mCertificateTransparencyStatus) ||
!ReadParam(aReader, &mKeaGroup) ||
!ReadParam(aReader, &mSignatureSchemeName) ||
!ReadParam(aReader, &mSucceededCertChain) ||
!ReadParam(aReader, &mFailedCertChain) ||
!ReadParam(aReader, &mIsDelegatedCredential) ||
!ReadParam(aReader, &mNPNCompleted) ||
!ReadParam(aReader, &mNegotiatedNPN) || !ReadParam(aReader, &mResumed) ||
!ReadParam(aReader, &mIsBuiltCertChainRootBuiltInRoot) ||
!ReadParam(aReader, &mIsAcceptedEch) || !ReadParam(aReader, &mPeerId) ||
!ReadParam(aReader, &mMadeOCSPRequests) ||
!ReadParam(aReader, &mUsedPrivateDNS)) {
return false;
}
securityInfo->mErrorCode = static_cast<PRErrorCode>(errorCode);
if (securityInfo->mErrorCode != 0) {
securityInfo->mCanceled = true;
mErrorCode = static_cast<PRErrorCode>(errorCode);
if (mErrorCode != 0) {
mCanceled = true;
}
securityInfo->mOverridableErrorCategory =
mOverridableErrorCategory =
IntToOverridableErrorCategory(overridableErrorCategory);
*aResult = std::move(securityInfo);
return true;
}
NS_IMETHODIMP
TransportSecurityInfo::GetInterfaces(nsTArray<nsIID>& array) {
array.Clear();
return NS_OK;
}
NS_IMETHODIMP
TransportSecurityInfo::GetScriptableHelper(nsIXPCScriptable** _retval) {
*_retval = nullptr;
return NS_OK;
}
NS_IMETHODIMP
TransportSecurityInfo::GetContractID(nsACString& aContractID) {
aContractID.SetIsVoid(true);
return NS_OK;
}
NS_IMETHODIMP
TransportSecurityInfo::GetClassDescription(nsACString& aClassDescription) {
aClassDescription.SetIsVoid(true);
return NS_OK;
}
NS_IMETHODIMP
TransportSecurityInfo::GetClassID(nsCID** aClassID) {
*aClassID = (nsCID*)moz_xmalloc(sizeof(nsCID));
return GetClassIDNoAlloc(*aClassID);
}
NS_IMETHODIMP
TransportSecurityInfo::GetFlags(uint32_t* aFlags) {
*aFlags = 0;
return NS_OK;
}
static NS_DEFINE_CID(kNSSSocketInfoCID, TRANSPORTSECURITYINFO_CID);
NS_IMETHODIMP
TransportSecurityInfo::GetClassIDNoAlloc(nsCID* aClassIDNoAlloc) {
*aClassIDNoAlloc = kNSSSocketInfoCID;
return NS_OK;
}
void TransportSecurityInfo::SetStatusErrorBits(
const nsCOMPtr<nsIX509Cert>& cert,
OverridableErrorCategory overridableErrorCategory) {

47
security/manager/ssl/TransportSecurityInfo.h
Просмотреть файл

@ -16,6 +16,7 @@
#include "mozilla/RefPtr.h"
#include "mozilla/ipc/TransportSecurityInfoUtils.h"
#include "mozpkix/pkixtypes.h"
#include "nsIClassInfo.h"
#include "nsIObjectInputStream.h"
#include "nsIInterfaceRequestor.h"
#include "nsITransportSecurityInfo.h"
@ -26,7 +27,9 @@ namespace mozilla {
namespace psm {
class TransportSecurityInfo : public nsITransportSecurityInfo,
public nsIInterfaceRequestor {
public nsIInterfaceRequestor,
public nsISerializable,
public nsIClassInfo {
protected:
virtual ~TransportSecurityInfo() = default;
@ -36,11 +39,8 @@ class TransportSecurityInfo : public nsITransportSecurityInfo,
NS_DECL_THREADSAFE_ISUPPORTS
NS_DECL_NSITRANSPORTSECURITYINFO
NS_DECL_NSIINTERFACEREQUESTOR
static bool DeserializeFromIPC(IPC::MessageReader* aReader,
RefPtr<nsITransportSecurityInfo>* aResult);
static nsresult Read(const nsCString& aSerializedSecurityInfo,
nsITransportSecurityInfo** aResult);
NS_DECL_NSISERIALIZABLE
NS_DECL_NSICLASSINFO
void SetPreliminaryHandshakeInfo(const SSLChannelInfo& channelInfo,
const SSLCipherSuiteInfo& cipherInfo);
@ -202,28 +202,31 @@ class TransportSecurityInfo : public nsITransportSecurityInfo,
/* Peer cert chain for failed connections (for error reporting) */
nsTArray<RefPtr<nsIX509Cert>> mFailedCertChain MOZ_GUARDED_BY(mMutex);
static nsresult ReadOldOverridableErrorBits(
nsIObjectInputStream* aStream,
OverridableErrorCategory& aOverridableErrorCategory);
static nsresult ReadSSLStatus(
nsIObjectInputStream* aStream, nsCOMPtr<nsIX509Cert>& aServerCert,
uint16_t& aCipherSuite, uint16_t& aProtocolVersion,
OverridableErrorCategory& aOverridableErrorCategory, bool& aIsEV,
bool& aHasIsEVStatus, bool& aHaveCipherSuiteAndProtocol,
bool& aHaveCertErrorBits, uint16_t& aCertificateTransparencyStatus,
nsCString& aKeaGroup, nsCString& aSignatureSchemeName,
nsTArray<RefPtr<nsIX509Cert>>& aSucceededCertChain);
nsresult ReadOldOverridableErrorBits(nsIObjectInputStream* aStream,
MutexAutoLock& aProofOfLock);
nsresult ReadSSLStatus(nsIObjectInputStream* aStream,
MutexAutoLock& aProofOfLock);
// This function is used to read the binary that are serialized
// by using nsIX509CertList
static nsresult ReadCertList(nsIObjectInputStream* aStream,
nsTArray<RefPtr<nsIX509Cert>>& aCertList);
static nsresult ReadCertificatesFromStream(
nsIObjectInputStream* aStream, uint32_t aSize,
nsTArray<RefPtr<nsIX509Cert>>& aCertList);
nsresult ReadCertList(nsIObjectInputStream* aStream,
nsTArray<RefPtr<nsIX509Cert>>& aCertList,
MutexAutoLock& aProofOfLock);
nsresult ReadCertificatesFromStream(nsIObjectInputStream* aStream,
uint32_t aSize,
nsTArray<RefPtr<nsIX509Cert>>& aCertList,
MutexAutoLock& aProofOfLock);
};
} // namespace psm
} // namespace mozilla
// 16786594-0296-4471-8096-8f84497ca428
#define TRANSPORTSECURITYINFO_CID \
{ \
0x16786594, 0x0296, 0x4471, { \
0x80, 0x96, 0x8f, 0x84, 0x49, 0x7c, 0xa4, 0x28 \
} \
}
#endif // TransportSecurityInfo_h

292
security/manager/ssl/tests/gtest/DeserializeCertTest.cpp
Просмотреть файл

@ -5,16 +5,12 @@
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "gtest/gtest.h"
#include "TransportSecurityInfo.h"
#include "nsCOMPtr.h"
#include "nsISimpleEnumerator.h"
#include "nsITransportSecurityInfo.h"
#include "nsIX509Cert.h"
#include "nsSerializationHelper.h"
#include "nsString.h"
#include "mozilla/Maybe.h"
using namespace mozilla;
using namespace mozilla::psm;
// nsITransportSecurityInfo de-serializatin tests
//
@ -32,12 +28,15 @@ using namespace mozilla::psm;
// We would like to move away from this binary compatibility requirement
// in service workers. See bug 1248628.
void deserializeAndVerify(const nsCString& serializedSecInfo,
Maybe<size_t> failedCertChainLength = Nothing(),
Maybe<size_t> succeededCertChainLength = Nothing()) {
nsCOMPtr<nsITransportSecurityInfo> securityInfo;
nsresult rv = TransportSecurityInfo::Read(serializedSecInfo,
getter_AddRefs(securityInfo));
bool hasFailedCertChain,
size_t failedCertChainLength = 0) {
nsCOMPtr<nsISupports> secInfo;
nsresult rv =
NS_DeserializeObject(serializedSecInfo, getter_AddRefs(secInfo));
ASSERT_EQ(NS_OK, rv);
ASSERT_TRUE(secInfo);
nsCOMPtr<nsITransportSecurityInfo> securityInfo = do_QueryInterface(secInfo);
ASSERT_TRUE(securityInfo);
nsCOMPtr<nsIX509Cert> cert;
@ -49,29 +48,15 @@ void deserializeAndVerify(const nsCString& serializedSecInfo,
rv = securityInfo->GetFailedCertChain(failedCertArray);
ASSERT_EQ(NS_OK, rv);
if (failedCertChainLength) {
if (hasFailedCertChain) {
ASSERT_FALSE(failedCertArray.IsEmpty());
for (const auto& cert : failedCertArray) {
ASSERT_TRUE(cert);
}
ASSERT_EQ(*failedCertChainLength, failedCertArray.Length());
ASSERT_EQ(failedCertChainLength, failedCertArray.Length());
} else {
ASSERT_TRUE(failedCertArray.IsEmpty());
}
nsTArray<RefPtr<nsIX509Cert>> succeededCertArray;
rv = securityInfo->GetSucceededCertChain(succeededCertArray);
ASSERT_EQ(NS_OK, rv);
if (succeededCertChainLength) {
ASSERT_FALSE(succeededCertArray.IsEmpty());
for (const auto& cert : succeededCertArray) {
ASSERT_TRUE(cert);
}
ASSERT_EQ(*succeededCertChainLength, succeededCertArray.Length());
} else {
ASSERT_TRUE(succeededCertArray.IsEmpty());
}
}
TEST(psm_DeserializeCert, gecko33)
@ -106,7 +91,7 @@ TEST(psm_DeserializeCert, gecko33)
"QYTJm0VUZMEVFhtALq46cx92Zu4vFwC8AAwAAAAABAQAA");
// clang-format on
deserializeAndVerify(base64Serialization);
deserializeAndVerify(base64Serialization, false);
}
TEST(psm_DeserializeCert, gecko46)
@ -141,7 +126,7 @@ TEST(psm_DeserializeCert, gecko46)
"idlvOj/7QyyX5m8up/1US8z1fRW4yoCSOt6V2bwuH6cAvAAMAAAAAAQEAAA==");
// clang-format on
deserializeAndVerify(base64Serialization);
deserializeAndVerify(base64Serialization, false);
}
TEST(psm_DeserializeCert, preSSLStatusConsolidation)
@ -190,7 +175,7 @@ TEST(psm_DeserializeCert, preSSLStatusConsolidation)
"bEw7P6+V9zz5cAzaaq7EB0mCE+jJckSzSETBN+7lyVD8gwmHYxxZfPnUM/yvPbMU9L3xWD/z6HHwO6r+9m7BT+2pHjBCAAA=");
// clang-format on
deserializeAndVerify(base64Serialization, Nothing(), Some(2));
deserializeAndVerify(base64Serialization, false);
}
TEST(psm_DeserializeCert, preSSLStatusConsolidationFailedCertChain)
@ -258,250 +243,5 @@ TEST(psm_DeserializeCert, preSSLStatusConsolidationFailedCertChain)
"E+jJckSzSETBN+7lyVD8gwmHYxxZfPnUM/yvPbMU9L3xWD/z6HHwO6r+9m7BT+2pHjBC");
// clang-format on
deserializeAndVerify(base64Serialization, Some(2));
}
TEST(psm_DeserializeCert, preNsIX509CertListReplacement)
{
// This was the serialized output of test
// "good.include-subdomains.pinning.example.com" // in
// security/manager/ssl/tests/unit/test_cert_chains.js The serialized output
// was generated before we replace nsIX509CertList with Array<nsIX509Cert>, so
// it had the old version of transportSecurityInfo.
nsCString base64Serialization(
"FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgA"
"AAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA"
"AAAAONMIIDiTCCAnGgAwIBAgIUDUo/9G0rz7fJiWTw0hY6TIyPRSIwDQYJKoZIhvcNAQELB"
"QAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDE3MTEyNzAwMDAwMFoYDzIwMjAwMjA1MDAw"
"MDAwWjAaMRgwFgYDVQQDDA9UZXN0IEVuZC1lbnRpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4I"
"BDwAwggEKAoIBAQC6iFGoRI4W1kH9braIBjYQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZ"
"wGm24ahvJr4q9adWtqZHEIeqVap0WH9xzVJJwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tF"
"YIP8X6taRqx0wI6iypB7qdw4A8Njf1mCyuwJJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8n"
"FthVt2Zaqn4CkC86exCABiTMHGyXrZZhW7filhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN"
"7LyJvaeO0ipVhHe4m1iWdq5EITjbLHCQELL8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe"
"2NAgMBAAGjgcowgccwgZAGA1UdEQSBiDCBhYIJbG9jYWxob3N0gg0qLmV4YW1wbGUuY29tg"
"hUqLnBpbm5pbmcuZXhhbXBsZS5jb22CKCouaW5jbHVkZS1zdWJkb21haW5zLnBpbm5pbmcu"
"ZXhhbXBsZS5jb22CKCouZXhjbHVkZS1zdWJkb21haW5zLnBpbm5pbmcuZXhhbXBsZS5jb20"
"wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vbG9jYWxob3N0Ojg4ODgvMA"
"0GCSqGSIb3DQEBCwUAA4IBAQCkguNhMyVCYhyYXfE22wNvlaobK2YRb4OGMxySIKuQ80N0X"
"lO+xpLJTs9YzFVY1+JTHNez1QfwP9KJeZznTzVzLh4sv0swx/+oUxCfLb0VIl/kdUqLkbGY"
"rAmtjeOKZLaqVtRH0BnmbPowLak1pi6nQYOU+aL9QOuvT/j3rXoimcdo6X3TK1SN2/64fGM"
"yG/pwas+JXehbReUf4n1ewk84ADtb+ew8tRAKf/uxzKUj5t/UgqDsnTWq5wUc5IJKwoHT41"
"sQnNqPg12x4+WGWiAsWCpR/hKYHFGr7rb4JTGEPAJpWcv9WtZYAvwT78a2xpHp5XNglj16I"
"jWEukvJuU1WwC8AAwAAAAABAQAAAAAAAAZ4MjU1MTkAAAAOUlNBLVBTUy1TSEEyNTYBlZ+x"
"ZWUXSH+rm9iRO+Uxl650zaXNL0c/lvXwt//2LGgAAAACZgoyJpFcT/u7IImFpjLfBb3Dl5p"
"UIkzVhYlpa26W6oMAAAAAAAADjTCCA4kwggJxoAMCAQICFA1KP/RtK8+3yYlk8NIWOkyMj0"
"UiMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNVBAMMB1Rlc3QgQ0EwIhgPMjAxNzExMjcwMDAwM"
"DBaGA8yMDIwMDIwNTAwMDAwMFowGjEYMBYGA1UEAwwPVGVzdCBFbmQtZW50aXR5MIIBIjAN"
"BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz"
"1aFdsJHvBxyWo4NgfvbGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/weadA4IC"
"mTqyDDSeTbuUzCa2wO7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSSpH25iGF5kLFXk"
"D3SO8XguEgfqDfTiEPvJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62WYVu34pYSwHUxowyR3bTK"
"9/ytHSXTCe+5Fw6naOGzey8ib2njtIqVYR3uJtYlnauRCE42yxwkBCy/Fosv5fGPmRcxuLP"
"+SSP6clHEMdUDrNoYCjXtjQIDAQABo4HKMIHHMIGQBgNVHREEgYgwgYWCCWxvY2FsaG9zdI"
"INKi5leGFtcGxlLmNvbYIVKi5waW5uaW5nLmV4YW1wbGUuY29tgigqLmluY2x1ZGUtc3ViZ"
"G9tYWlucy5waW5uaW5nLmV4YW1wbGUuY29tgigqLmV4Y2x1ZGUtc3ViZG9tYWlucy5waW5u"
"aW5nLmV4YW1wbGUuY29tMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL2x"
"vY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0BAQsFAAOCAQEApILjYTMlQmIcmF3xNtsDb5WqGy"
"tmEW+DhjMckiCrkPNDdF5TvsaSyU7PWMxVWNfiUxzXs9UH8D/SiXmc5081cy4eLL9LMMf/q"
"FMQny29FSJf5HVKi5GxmKwJrY3jimS2qlbUR9AZ5mz6MC2pNaYup0GDlPmi/UDrr0/49616"
"IpnHaOl90ytUjdv+uHxjMhv6cGrPiV3oW0XlH+J9XsJPOAA7W/nsPLUQCn/7scylI+bf1IK"
"g7J01qucFHOSCSsKB0+NbEJzaj4NdsePlhlogLFgqUf4SmBxRq+62+CUxhDwCaVnL/VrWWA"
"L8E+/GtsaR6eVzYJY9eiI1hLpLyblNVmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtul"
"uqDAAAAAAAAAtcwggLTMIIBu6ADAgECAhQpoXAjALAddSApG46EBfimNiyZuDANBgkqhkiG"
"9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0IENBMCIYDzIwMTcxMTI3MDAwMDAwWhgPMjAyMDA"
"yMDUwMDAwMDBaMBIxEDAOBgNVBAMMB1Rlc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDw"
"AwggEKAoIBAQC6iFGoRI4W1kH9braIBjYQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZwGm"
"24ahvJr4q9adWtqZHEIeqVap0WH9xzVJJwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tFYIP"
"8X6taRqx0wI6iypB7qdw4A8Njf1mCyuwJJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8nFth"
"Vt2Zaqn4CkC86exCABiTMHGyXrZZhW7filhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN7Ly"
"JvaeO0ipVhHe4m1iWdq5EITjbLHCQELL8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe2NA"
"gMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IB"
"AQAgyCfLAcVs/MkERxunH9pZA4ja1QWWjsxSg9KgAIfOgj8c5RPHbl4oeWk0raNKWMu5+FR"
"3/94IJeD45C3h/Y3+1HDyC6ZuzdgMXv63dk0a36JDFlPA3swqwYhnL7pHnbdcfDyWnMVfmL"
"NeAhL7QA+Vf5fJmTsxEJwFaHo9JpKoQ469RdWno6aHeK3TfiQFaebzT1MRabCJXDeyw8Oal"
"QICt0M0wx29B6HNof3px2NxKyC6qlf01wwNSaaIbsctDaLL5ZLN6T1LjpJsooMvDwRt69+S"
"Xo8SmD4YO6Wr4Q9drI3cCwVeQXwxoUuB96muQQ2M3WDiMz5ZLI3oMLu8KSPsAA==");
deserializeAndVerify(base64Serialization, Nothing(), Some(2));
}
TEST(psm_DeserializeCert, preNsIX509CertListReplacementV2)
{
// Same as the above test, however, this is the v2 version of the
// serialization.
nsCString base64Serialization(
"FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgA"
"AAAAAAAAAAAAAAAAAAAEAMgFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA"
"AAAAONMIIDiTCCAnGgAwIBAgIUDUo/9G0rz7fJiWTw0hY6TIyPRSIwDQYJKoZIhvcNAQELB"
"QAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDE3MTEyNzAwMDAwMFoYDzIwMjAwMjA1MDAw"
"MDAwWjAaMRgwFgYDVQQDDA9UZXN0IEVuZC1lbnRpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4I"
"BDwAwggEKAoIBAQC6iFGoRI4W1kH9braIBjYQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZ"
"wGm24ahvJr4q9adWtqZHEIeqVap0WH9xzVJJwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tF"
"YIP8X6taRqx0wI6iypB7qdw4A8Njf1mCyuwJJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8n"
"FthVt2Zaqn4CkC86exCABiTMHGyXrZZhW7filhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN"
"7LyJvaeO0ipVhHe4m1iWdq5EITjbLHCQELL8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe"
"2NAgMBAAGjgcowgccwgZAGA1UdEQSBiDCBhYIJbG9jYWxob3N0gg0qLmV4YW1wbGUuY29tg"
"hUqLnBpbm5pbmcuZXhhbXBsZS5jb22CKCouaW5jbHVkZS1zdWJkb21haW5zLnBpbm5pbmcu"
"ZXhhbXBsZS5jb22CKCouZXhjbHVkZS1zdWJkb21haW5zLnBpbm5pbmcuZXhhbXBsZS5jb20"
"wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vbG9jYWxob3N0Ojg4ODgvMA"
"0GCSqGSIb3DQEBCwUAA4IBAQCkguNhMyVCYhyYXfE22wNvlaobK2YRb4OGMxySIKuQ80N0X"
"lO+xpLJTs9YzFVY1+JTHNez1QfwP9KJeZznTzVzLh4sv0swx/+oUxCfLb0VIl/kdUqLkbGY"
"rAmtjeOKZLaqVtRH0BnmbPowLak1pi6nQYOU+aL9QOuvT/j3rXoimcdo6X3TK1SN2/64fGM"
"yG/pwas+JXehbReUf4n1ewk84ADtb+ew8tRAKf/uxzKUj5t/UgqDsnTWq5wUc5IJKwoHT41"
"sQnNqPg12x4+WGWiAsWCpR/hKYHFGr7rb4JTGEPAJpWcv9WtZYAvwT78a2xpHp5XNglj16I"
"jWEukvJuU1WEwEABAAAAAABAQAAAAAAAAZ4MjU1MTkAAAAOUlNBLVBTUy1TSEEyNTYBlZ+x"
"ZWUXSH+rm9iRO+Uxl650zaXNL0c/lvXwt//2LGgAAAACZgoyJpFcT/u7IImFpjLfBb3Dl5p"
"UIkzVhYlpa26W6oMAAAAAAAADjTCCA4kwggJxoAMCAQICFA1KP/RtK8+3yYlk8NIWOkyMj0"
"UiMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNVBAMMB1Rlc3QgQ0EwIhgPMjAxNzExMjcwMDAwM"
"DBaGA8yMDIwMDIwNTAwMDAwMFowGjEYMBYGA1UEAwwPVGVzdCBFbmQtZW50aXR5MIIBIjAN"
"BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz"
"1aFdsJHvBxyWo4NgfvbGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/weadA4IC"
"mTqyDDSeTbuUzCa2wO7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSSpH25iGF5kLFXk"
"D3SO8XguEgfqDfTiEPvJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62WYVu34pYSwHUxowyR3bTK"
"9/ytHSXTCe+5Fw6naOGzey8ib2njtIqVYR3uJtYlnauRCE42yxwkBCy/Fosv5fGPmRcxuLP"
"+SSP6clHEMdUDrNoYCjXtjQIDAQABo4HKMIHHMIGQBgNVHREEgYgwgYWCCWxvY2FsaG9zdI"
"INKi5leGFtcGxlLmNvbYIVKi5waW5uaW5nLmV4YW1wbGUuY29tgigqLmluY2x1ZGUtc3ViZ"
"G9tYWlucy5waW5uaW5nLmV4YW1wbGUuY29tgigqLmV4Y2x1ZGUtc3ViZG9tYWlucy5waW5u"
"aW5nLmV4YW1wbGUuY29tMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL2x"
"vY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0BAQsFAAOCAQEApILjYTMlQmIcmF3xNtsDb5WqGy"
"tmEW+DhjMckiCrkPNDdF5TvsaSyU7PWMxVWNfiUxzXs9UH8D/SiXmc5081cy4eLL9LMMf/q"
"FMQny29FSJf5HVKi5GxmKwJrY3jimS2qlbUR9AZ5mz6MC2pNaYup0GDlPmi/UDrr0/49616"
"IpnHaOl90ytUjdv+uHxjMhv6cGrPiV3oW0XlH+J9XsJPOAA7W/nsPLUQCn/7scylI+bf1IK"
"g7J01qucFHOSCSsKB0+NbEJzaj4NdsePlhlogLFgqUf4SmBxRq+62+CUxhDwCaVnL/VrWWA"
"L8E+/GtsaR6eVzYJY9eiI1hLpLyblNVmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtul"
"uqDAAAAAAAAAtcwggLTMIIBu6ADAgECAhQpoXAjALAddSApG46EBfimNiyZuDANBgkqhkiG"
"9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0IENBMCIYDzIwMTcxMTI3MDAwMDAwWhgPMjAyMDA"
"yMDUwMDAwMDBaMBIxEDAOBgNVBAMMB1Rlc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDw"
"AwggEKAoIBAQC6iFGoRI4W1kH9braIBjYQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZwGm"
"24ahvJr4q9adWtqZHEIeqVap0WH9xzVJJwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tFYIP"
"8X6taRqx0wI6iypB7qdw4A8Njf1mCyuwJJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8nFth"
"Vt2Zaqn4CkC86exCABiTMHGyXrZZhW7filhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN7Ly"
"JvaeO0ipVhHe4m1iWdq5EITjbLHCQELL8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe2NA"
"gMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IB"
"AQAgyCfLAcVs/MkERxunH9pZA4ja1QWWjsxSg9KgAIfOgj8c5RPHbl4oeWk0raNKWMu5+FR"
"3/94IJeD45C3h/Y3+1HDyC6ZuzdgMXv63dk0a36JDFlPA3swqwYhnL7pHnbdcfDyWnMVfmL"
"NeAhL7QA+Vf5fJmTsxEJwFaHo9JpKoQ469RdWno6aHeK3TfiQFaebzT1MRabCJXDeyw8Oal"
"QICt0M0wx29B6HNof3px2NxKyC6qlf01wwNSaaIbsctDaLL5ZLN6T1LjpJsooMvDwRt69+S"
"Xo8SmD4YO6Wr4Q9drI3cCwVeQXwxoUuB96muQQ2M3WDiMz5ZLI3oMLu8KSPsAAA=");
deserializeAndVerify(base64Serialization, Nothing(), Some(2));
}
TEST(psm_DeserializeCert, preNsIX509CertListReplacementWithFailedChain)
{
// This was the serialized output of test "expired.example.com"
// in security/manager/ssl/tests/unit/test_cert_chains.js
// The serialized output was generated before we replace nsIX509CertList with
// Array<nsIX509Cert>, so it had the old version of transportSecurityInfo.
nsCString base64Serialization(
"FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAABAA"
"AAAAAAAAA///gCwAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA"
"AAAAMgMIIDHDCCAgSgAwIBAgIUY9ERAIKj0js/YbhJoMrcLnj++uowDQYJKoZIhvcNAQELB"
"QAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDEzMDEwMTAwMDAwMFoYDzIwMTQwMTAxMDAw"
"MDAwWjAiMSAwHgYDVQQDDBdFeHBpcmVkIFRlc3QgRW5kLWVudGl0eTCCASIwDQYJKoZIhvc"
"NAQEBBQADggEPADCCAQoCggEBALqIUahEjhbWQf1utogGNhA9PBPZ6uQ1SrTs9WhXbCR7wc"
"clqODYH72xnAabbhqG8mvir1p1a2pkcQh6pVqnRYf3HNUknAJ+zUP8HmnQOCApk6sgw0nk2"
"7lMwmtsDu0Vgg/xfq1pGrHTAjqLKkHup3DgDw2N/WYLK7AkkqR9uYhheZCxV5A90jvF4LhI"
"H6g304hD7ycW2FW3ZlqqfgKQLzp7EIAGJMwcbJetlmFbt+KWEsB1MaMMkd20yvf8rR0l0wn"
"vuRcOp2jhs3svIm9p47SKlWEd7ibWJZ2rkQhONsscJAQsvxaLL+Xxj5kXMbiz/kkj+nJRxD"
"HVA6zaGAo17Y0CAwEAAaNWMFQwHgYDVR0RBBcwFYITZXhwaXJlZC5leGFtcGxlLmNvbTAyB"
"ggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9sb2NhbGhvc3Q6ODg4OC8wDQYJ"
"KoZIhvcNAQELBQADggEBAImiFuy275T6b+Ud6gl/El6qpgWHUXeYiv2sp7d+HVzfT+ow5WV"
"sxI/GMKhdA43JaKT9gfMsbnP1qiI2zel3U+F7IAMO1CEr5FVdCOVTma5hmu/81rkJLmZ8RQ"
"DWWOhZKyn/7aD7TH1C1e768yCt5E2DDl8mHil9zR8BPsoXwuS3L9zJ2JqNc60+hB8l297Za"
"Sl0nbKffb47ukvn5kSJ7tI9n/fSXdj1JrukwjZP+74VkQyNobaFzDZ+Zr3QmfbejEsY2EYn"
"q8XuENgIO4DuYrm80/p6bMO6laB0Uv5W6uXZgBZdRTe1WMdYWGhmvnFFQmf+naeOOl6ryFw"
"WwtnoK7IAAAAAAAEAAAEAAQAAAAAAAAAAAAAAAZWfsWVlF0h/q5vYkTvlMZeudM2lzS9HP5"
"b18Lf/9ixoAAAAAmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAAyAwg"
"gMcMIICBKADAgECAhRj0REAgqPSOz9huEmgytwueP766jANBgkqhkiG9w0BAQsFADASMRAw"
"DgYDVQQDDAdUZXN0IENBMCIYDzIwMTMwMTAxMDAwMDAwWhgPMjAxNDAxMDEwMDAwMDBaMCI"
"xIDAeBgNVBAMMF0V4cGlyZWQgVGVzdCBFbmQtZW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAA"
"OCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz1aFdsJHvBxyWo4Ngfv"
"bGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/weadA4ICmTqyDDSeTbuUzCa2wO"
"7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSSpH25iGF5kLFXkD3SO8XguEgfqDfTiEP"
"vJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62WYVu34pYSwHUxowyR3bTK9/ytHSXTCe+5Fw6naO"
"Gzey8ib2njtIqVYR3uJtYlnauRCE42yxwkBCy/Fosv5fGPmRcxuLP+SSP6clHEMdUDrNoYC"
"jXtjQIDAQABo1YwVDAeBgNVHREEFzAVghNleHBpcmVkLmV4YW1wbGUuY29tMDIGCCsGAQUF"
"BwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL2xvY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0"
"BAQsFAAOCAQEAiaIW7LbvlPpv5R3qCX8SXqqmBYdRd5iK/aynt34dXN9P6jDlZWzEj8YwqF"
"0DjclopP2B8yxuc/WqIjbN6XdT4XsgAw7UISvkVV0I5VOZrmGa7/zWuQkuZnxFANZY6FkrK"
"f/toPtMfULV7vrzIK3kTYMOXyYeKX3NHwE+yhfC5Lcv3MnYmo1zrT6EHyXb3tlpKXSdsp99"
"vju6S+fmRInu0j2f99Jd2PUmu6TCNk/7vhWRDI2htoXMNn5mvdCZ9t6MSxjYRierxe4Q2Ag"
"7gO5iubzT+npsw7qVoHRS/lbq5dmAFl1FN7VYx1hYaGa+cUVCZ/6dp446XqvIXBbC2egrsm"
"YKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAAtcwggLTMIIBu6ADAgECA"
"hQpoXAjALAddSApG46EBfimNiyZuDANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0"
"IENBMCIYDzIwMTcxMTI3MDAwMDAwWhgPMjAyMDAyMDUwMDAwMDBaMBIxEDAOBgNVBAMMB1R"
"lc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6iFGoRI4W1kH9braIBj"
"YQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZwGm24ahvJr4q9adWtqZHEIeqVap0WH9xzVJ"
"JwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tFYIP8X6taRqx0wI6iypB7qdw4A8Njf1mCyuw"
"JJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8nFthVt2Zaqn4CkC86exCABiTMHGyXrZZhW7f"
"ilhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN7LyJvaeO0ipVhHe4m1iWdq5EITjbLHCQELL"
"8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe2NAgMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wC"
"wYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAgyCfLAcVs/MkERxunH9pZA4ja1QWW"
"jsxSg9KgAIfOgj8c5RPHbl4oeWk0raNKWMu5+FR3/94IJeD45C3h/Y3+1HDyC6ZuzdgMXv6"
"3dk0a36JDFlPA3swqwYhnL7pHnbdcfDyWnMVfmLNeAhL7QA+Vf5fJmTsxEJwFaHo9JpKoQ4"
"69RdWno6aHeK3TfiQFaebzT1MRabCJXDeyw8OalQICt0M0wx29B6HNof3px2NxKyC6qlf01"
"wwNSaaIbsctDaLL5ZLN6T1LjpJsooMvDwRt69+SXo8SmD4YO6Wr4Q9drI3cCwVeQXwxoUuB"
"96muQQ2M3WDiMz5ZLI3oMLu8KSPs");
deserializeAndVerify(base64Serialization, Some(2));
}
TEST(psm_DeserializeCert, preNsIX509CertListReplacementWithFailedChainV2)
{
// Same as the above test, however, this is the v2 version of the
// serialization.
nsCString base64Serialization(
"FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAABAA"
"AAAAAAAAA///gCwAAAAEAMgFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA"
"AAAAMgMIIDHDCCAgSgAwIBAgIUY9ERAIKj0js/YbhJoMrcLnj++uowDQYJKoZIhvcNAQELB"
"QAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDEzMDEwMTAwMDAwMFoYDzIwMTQwMTAxMDAw"
"MDAwWjAiMSAwHgYDVQQDDBdFeHBpcmVkIFRlc3QgRW5kLWVudGl0eTCCASIwDQYJKoZIhvc"
"NAQEBBQADggEPADCCAQoCggEBALqIUahEjhbWQf1utogGNhA9PBPZ6uQ1SrTs9WhXbCR7wc"
"clqODYH72xnAabbhqG8mvir1p1a2pkcQh6pVqnRYf3HNUknAJ+zUP8HmnQOCApk6sgw0nk2"
"7lMwmtsDu0Vgg/xfq1pGrHTAjqLKkHup3DgDw2N/WYLK7AkkqR9uYhheZCxV5A90jvF4LhI"
"H6g304hD7ycW2FW3ZlqqfgKQLzp7EIAGJMwcbJetlmFbt+KWEsB1MaMMkd20yvf8rR0l0wn"
"vuRcOp2jhs3svIm9p47SKlWEd7ibWJZ2rkQhONsscJAQsvxaLL+Xxj5kXMbiz/kkj+nJRxD"
"HVA6zaGAo17Y0CAwEAAaNWMFQwHgYDVR0RBBcwFYITZXhwaXJlZC5leGFtcGxlLmNvbTAyB"
"ggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9sb2NhbGhvc3Q6ODg4OC8wDQYJ"
"KoZIhvcNAQELBQADggEBAImiFuy275T6b+Ud6gl/El6qpgWHUXeYiv2sp7d+HVzfT+ow5WV"
"sxI/GMKhdA43JaKT9gfMsbnP1qiI2zel3U+F7IAMO1CEr5FVdCOVTma5hmu/81rkJLmZ8RQ"
"DWWOhZKyn/7aD7TH1C1e768yCt5E2DDl8mHil9zR8BPsoXwuS3L9zJ2JqNc60+hB8l297Za"
"Sl0nbKffb47ukvn5kSJ7tI9n/fSXdj1JrukwjZP+74VkQyNobaFzDZ+Zr3QmfbejEsY2EYn"
"q8XuENgIO4DuYrm80/p6bMO6laB0Uv5W6uXZgBZdRTe1WMdYWGhmvnFFQmf+naeOOl6ryFw"
"WwtnoK7IAAAAAAAEAAAEAAQAAAAAAAAAAAAAAAZWfsWVlF0h/q5vYkTvlMZeudM2lzS9HP5"
"b18Lf/9ixoAAAAAmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAAyAwg"
"gMcMIICBKADAgECAhRj0REAgqPSOz9huEmgytwueP766jANBgkqhkiG9w0BAQsFADASMRAw"
"DgYDVQQDDAdUZXN0IENBMCIYDzIwMTMwMTAxMDAwMDAwWhgPMjAxNDAxMDEwMDAwMDBaMCI"
"xIDAeBgNVBAMMF0V4cGlyZWQgVGVzdCBFbmQtZW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAA"
"OCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz1aFdsJHvBxyWo4Ngfv"
"bGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/weadA4ICmTqyDDSeTbuUzCa2wO"
"7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSSpH25iGF5kLFXkD3SO8XguEgfqDfTiEP"
"vJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62WYVu34pYSwHUxowyR3bTK9/ytHSXTCe+5Fw6naO"
"Gzey8ib2njtIqVYR3uJtYlnauRCE42yxwkBCy/Fosv5fGPmRcxuLP+SSP6clHEMdUDrNoYC"
"jXtjQIDAQABo1YwVDAeBgNVHREEFzAVghNleHBpcmVkLmV4YW1wbGUuY29tMDIGCCsGAQUF"
"BwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL2xvY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0"
"BAQsFAAOCAQEAiaIW7LbvlPpv5R3qCX8SXqqmBYdRd5iK/aynt34dXN9P6jDlZWzEj8YwqF"
"0DjclopP2B8yxuc/WqIjbN6XdT4XsgAw7UISvkVV0I5VOZrmGa7/zWuQkuZnxFANZY6FkrK"
"f/toPtMfULV7vrzIK3kTYMOXyYeKX3NHwE+yhfC5Lcv3MnYmo1zrT6EHyXb3tlpKXSdsp99"
"vju6S+fmRInu0j2f99Jd2PUmu6TCNk/7vhWRDI2htoXMNn5mvdCZ9t6MSxjYRierxe4Q2Ag"
"7gO5iubzT+npsw7qVoHRS/lbq5dmAFl1FN7VYx1hYaGa+cUVCZ/6dp446XqvIXBbC2egrsm"
"YKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAAtcwggLTMIIBu6ADAgECA"
"hQpoXAjALAddSApG46EBfimNiyZuDANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0"
"IENBMCIYDzIwMTcxMTI3MDAwMDAwWhgPMjAyMDAyMDUwMDAwMDBaMBIxEDAOBgNVBAMMB1R"
"lc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6iFGoRI4W1kH9braIBj"
"YQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZwGm24ahvJr4q9adWtqZHEIeqVap0WH9xzVJ"
"JwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tFYIP8X6taRqx0wI6iypB7qdw4A8Njf1mCyuw"
"JJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8nFthVt2Zaqn4CkC86exCABiTMHGyXrZZhW7f"
"ilhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN7LyJvaeO0ipVhHe4m1iWdq5EITjbLHCQELL"
"8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe2NAgMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wC"
"wYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAgyCfLAcVs/MkERxunH9pZA4ja1QWW"
"jsxSg9KgAIfOgj8c5RPHbl4oeWk0raNKWMu5+FR3/94IJeD45C3h/Y3+1HDyC6ZuzdgMXv6"
"3dk0a36JDFlPA3swqwYhnL7pHnbdcfDyWnMVfmLNeAhL7QA+Vf5fJmTsxEJwFaHo9JpKoQ4"
"69RdWno6aHeK3TfiQFaebzT1MRabCJXDeyw8OalQICt0M0wx29B6HNof3px2NxKyC6qlf01"
"wwNSaaIbsctDaLL5ZLN6T1LjpJsooMvDwRt69+SXo8SmD4YO6Wr4Q9drI3cCwVeQXwxoUuB"
"96muQQ2M3WDiMz5ZLI3oMLu8KSPsAA==");
deserializeAndVerify(base64Serialization, Some(2));
deserializeAndVerify(base64Serialization, true, 2);
}

388
security/manager/ssl/tests/unit/test_cert_chains.js
Просмотреть файл

@ -31,6 +31,26 @@ v0swx/+oUxCfLb0VIl/kdUqLkbGYrAmtjeOKZLaqVtRH0BnmbPowLak1pi6nQYOU
/hKYHFGr7rb4JTGEPAJpWcv9WtZYAvwT78a2xpHp5XNglj16IjWEukvJuU1W
-----END CERTIFICATE-----`;
const gExpiredEEPEM = `-----BEGIN CERTIFICATE-----
MIIDHDCCAgSgAwIBAgIUY9ERAIKj0js/YbhJoMrcLnj++uowDQYJKoZIhvcNAQEL
BQAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDEzMDEwMTAwMDAwMFoYDzIwMTQw
MTAxMDAwMDAwWjAiMSAwHgYDVQQDDBdFeHBpcmVkIFRlc3QgRW5kLWVudGl0eTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALqIUahEjhbWQf1utogGNhA9
PBPZ6uQ1SrTs9WhXbCR7wcclqODYH72xnAabbhqG8mvir1p1a2pkcQh6pVqnRYf3
HNUknAJ+zUP8HmnQOCApk6sgw0nk27lMwmtsDu0Vgg/xfq1pGrHTAjqLKkHup3Dg
Dw2N/WYLK7AkkqR9uYhheZCxV5A90jvF4LhIH6g304hD7ycW2FW3ZlqqfgKQLzp7
EIAGJMwcbJetlmFbt+KWEsB1MaMMkd20yvf8rR0l0wnvuRcOp2jhs3svIm9p47SK
lWEd7ibWJZ2rkQhONsscJAQsvxaLL+Xxj5kXMbiz/kkj+nJRxDHVA6zaGAo17Y0C
AwEAAaNWMFQwHgYDVR0RBBcwFYITZXhwaXJlZC5leGFtcGxlLmNvbTAyBggrBgEF
BQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9sb2NhbGhvc3Q6ODg4OC8wDQYJ
KoZIhvcNAQELBQADggEBAImiFuy275T6b+Ud6gl/El6qpgWHUXeYiv2sp7d+HVzf
T+ow5WVsxI/GMKhdA43JaKT9gfMsbnP1qiI2zel3U+F7IAMO1CEr5FVdCOVTma5h
mu/81rkJLmZ8RQDWWOhZKyn/7aD7TH1C1e768yCt5E2DDl8mHil9zR8BPsoXwuS3
L9zJ2JqNc60+hB8l297ZaSl0nbKffb47ukvn5kSJ7tI9n/fSXdj1JrukwjZP+74V
kQyNobaFzDZ+Zr3QmfbejEsY2EYnq8XuENgIO4DuYrm80/p6bMO6laB0Uv5W6uXZ
gBZdRTe1WMdYWGhmvnFFQmf+naeOOl6ryFwWwtnoK7I=
-----END CERTIFICATE-----`;
const gTestCAPEM = `-----BEGIN CERTIFICATE-----
MIIC0zCCAbugAwIBAgIUKaFwIwCwHXUgKRuOhAX4pjYsmbgwDQYJKoZIhvcNAQEL
BQAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDE3MTEyNzAwMDAwMFoYDzIwMjAw
@ -295,6 +315,344 @@ function test_cert_pkcs7_empty_array() {
);
}
function test_security_info_serialization(securityInfo, expectedErrorCode) {
// Serialize the securityInfo to a string
let serHelper = Cc["@mozilla.org/network/serialization-helper;1"].getService(
Ci.nsISerializationHelper
);
let serialized = serHelper.serializeToString(securityInfo);
// Deserialize from the string and compare to the original object
let deserialized = serHelper.deserializeObject(serialized);
deserialized.QueryInterface(Ci.nsITransportSecurityInfo);
equal(
securityInfo.securityState,
deserialized.securityState,
"Original and deserialized security state should match"
);
equal(
securityInfo.errorMessage,
deserialized.errorMessage,
"Original and deserialized error message should match"
);
equal(
securityInfo.errorCode,
expectedErrorCode,
"Original and expected error code should match"
);
equal(
deserialized.errorCode,
expectedErrorCode,
"Deserialized and expected error code should match"
);
}
// In Bug 1580315, nsNSSCertList/nsIX509CertList was replaced by
// Array<nsIX509Cert>, so the serialization of the certList changed. This
// test is used to make sure we can still deserialize the transportSecurityInfo
// binary string which has the old certList binary.
function test_old_succeeded_certlist_deseralization_v1() {
// This was the serialized output of test "good.include-subdomains.pinning.example.com"
// in security/manager/ssl/tests/unit/test_cert_chains.js
// The serialized output was generated before we replace nsIX509CertList with
// Array<nsIX509Cert>, so it had the old version of transportSecurityInfo.
const serialized =
"FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgA" +
"AAAAAAAAAAAAAAAAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA" +
"AAAAONMIIDiTCCAnGgAwIBAgIUDUo/9G0rz7fJiWTw0hY6TIyPRSIwDQYJKoZIhvcNAQELB" +
"QAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDE3MTEyNzAwMDAwMFoYDzIwMjAwMjA1MDAw" +
"MDAwWjAaMRgwFgYDVQQDDA9UZXN0IEVuZC1lbnRpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4I" +
"BDwAwggEKAoIBAQC6iFGoRI4W1kH9braIBjYQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZ" +
"wGm24ahvJr4q9adWtqZHEIeqVap0WH9xzVJJwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tF" +
"YIP8X6taRqx0wI6iypB7qdw4A8Njf1mCyuwJJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8n" +
"FthVt2Zaqn4CkC86exCABiTMHGyXrZZhW7filhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN" +
"7LyJvaeO0ipVhHe4m1iWdq5EITjbLHCQELL8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe" +
"2NAgMBAAGjgcowgccwgZAGA1UdEQSBiDCBhYIJbG9jYWxob3N0gg0qLmV4YW1wbGUuY29tg" +
"hUqLnBpbm5pbmcuZXhhbXBsZS5jb22CKCouaW5jbHVkZS1zdWJkb21haW5zLnBpbm5pbmcu" +
"ZXhhbXBsZS5jb22CKCouZXhjbHVkZS1zdWJkb21haW5zLnBpbm5pbmcuZXhhbXBsZS5jb20" +
"wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vbG9jYWxob3N0Ojg4ODgvMA" +
"0GCSqGSIb3DQEBCwUAA4IBAQCkguNhMyVCYhyYXfE22wNvlaobK2YRb4OGMxySIKuQ80N0X" +
"lO+xpLJTs9YzFVY1+JTHNez1QfwP9KJeZznTzVzLh4sv0swx/+oUxCfLb0VIl/kdUqLkbGY" +
"rAmtjeOKZLaqVtRH0BnmbPowLak1pi6nQYOU+aL9QOuvT/j3rXoimcdo6X3TK1SN2/64fGM" +
"yG/pwas+JXehbReUf4n1ewk84ADtb+ew8tRAKf/uxzKUj5t/UgqDsnTWq5wUc5IJKwoHT41" +
"sQnNqPg12x4+WGWiAsWCpR/hKYHFGr7rb4JTGEPAJpWcv9WtZYAvwT78a2xpHp5XNglj16I" +
"jWEukvJuU1WwC8AAwAAAAABAQAAAAAAAAZ4MjU1MTkAAAAOUlNBLVBTUy1TSEEyNTYBlZ+x" +
"ZWUXSH+rm9iRO+Uxl650zaXNL0c/lvXwt//2LGgAAAACZgoyJpFcT/u7IImFpjLfBb3Dl5p" +
"UIkzVhYlpa26W6oMAAAAAAAADjTCCA4kwggJxoAMCAQICFA1KP/RtK8+3yYlk8NIWOkyMj0" +
"UiMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNVBAMMB1Rlc3QgQ0EwIhgPMjAxNzExMjcwMDAwM" +
"DBaGA8yMDIwMDIwNTAwMDAwMFowGjEYMBYGA1UEAwwPVGVzdCBFbmQtZW50aXR5MIIBIjAN" +
"BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz" +
"1aFdsJHvBxyWo4NgfvbGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/weadA4IC" +
"mTqyDDSeTbuUzCa2wO7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSSpH25iGF5kLFXk" +
"D3SO8XguEgfqDfTiEPvJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62WYVu34pYSwHUxowyR3bTK" +
"9/ytHSXTCe+5Fw6naOGzey8ib2njtIqVYR3uJtYlnauRCE42yxwkBCy/Fosv5fGPmRcxuLP" +
"+SSP6clHEMdUDrNoYCjXtjQIDAQABo4HKMIHHMIGQBgNVHREEgYgwgYWCCWxvY2FsaG9zdI" +
"INKi5leGFtcGxlLmNvbYIVKi5waW5uaW5nLmV4YW1wbGUuY29tgigqLmluY2x1ZGUtc3ViZ" +
"G9tYWlucy5waW5uaW5nLmV4YW1wbGUuY29tgigqLmV4Y2x1ZGUtc3ViZG9tYWlucy5waW5u" +
"aW5nLmV4YW1wbGUuY29tMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL2x" +
"vY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0BAQsFAAOCAQEApILjYTMlQmIcmF3xNtsDb5WqGy" +
"tmEW+DhjMckiCrkPNDdF5TvsaSyU7PWMxVWNfiUxzXs9UH8D/SiXmc5081cy4eLL9LMMf/q" +
"FMQny29FSJf5HVKi5GxmKwJrY3jimS2qlbUR9AZ5mz6MC2pNaYup0GDlPmi/UDrr0/49616" +
"IpnHaOl90ytUjdv+uHxjMhv6cGrPiV3oW0XlH+J9XsJPOAA7W/nsPLUQCn/7scylI+bf1IK" +
"g7J01qucFHOSCSsKB0+NbEJzaj4NdsePlhlogLFgqUf4SmBxRq+62+CUxhDwCaVnL/VrWWA" +
"L8E+/GtsaR6eVzYJY9eiI1hLpLyblNVmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtul" +
"uqDAAAAAAAAAtcwggLTMIIBu6ADAgECAhQpoXAjALAddSApG46EBfimNiyZuDANBgkqhkiG" +
"9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0IENBMCIYDzIwMTcxMTI3MDAwMDAwWhgPMjAyMDA" +
"yMDUwMDAwMDBaMBIxEDAOBgNVBAMMB1Rlc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDw" +
"AwggEKAoIBAQC6iFGoRI4W1kH9braIBjYQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZwGm" +
"24ahvJr4q9adWtqZHEIeqVap0WH9xzVJJwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tFYIP" +
"8X6taRqx0wI6iypB7qdw4A8Njf1mCyuwJJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8nFth" +
"Vt2Zaqn4CkC86exCABiTMHGyXrZZhW7filhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN7Ly" +
"JvaeO0ipVhHe4m1iWdq5EITjbLHCQELL8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe2NA" +
"gMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IB" +
"AQAgyCfLAcVs/MkERxunH9pZA4ja1QWWjsxSg9KgAIfOgj8c5RPHbl4oeWk0raNKWMu5+FR" +
"3/94IJeD45C3h/Y3+1HDyC6ZuzdgMXv63dk0a36JDFlPA3swqwYhnL7pHnbdcfDyWnMVfmL" +
"NeAhL7QA+Vf5fJmTsxEJwFaHo9JpKoQ469RdWno6aHeK3TfiQFaebzT1MRabCJXDeyw8Oal" +
"QICt0M0wx29B6HNof3px2NxKyC6qlf01wwNSaaIbsctDaLL5ZLN6T1LjpJsooMvDwRt69+S" +
"Xo8SmD4YO6Wr4Q9drI3cCwVeQXwxoUuB96muQQ2M3WDiMz5ZLI3oMLu8KSPsAA==";
let serHelper = Cc["@mozilla.org/network/serialization-helper;1"].getService(
Ci.nsISerializationHelper
);
// deserialize from the string and compare to the original object
let deserialized = serHelper.deserializeObject(serialized);
deserialized.QueryInterface(Ci.nsITransportSecurityInfo);
equal(
deserialized.failedCertChain.length,
0,
"failedCertChain for a successful connection should be empty"
);
let certChain = build_cert_list_from_pem_list([gDefaultEEPEM, gTestCAPEM]);
ok(
areCertArraysEqual(certChain, deserialized.succeededCertChain),
"succeededCertChain should be deserialized correctly"
);
}
// Same as the above test, however, this is the v2 version of the
// serialization.
function test_old_succeeded_certlist_deseralization_v2() {
const serialized =
"FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgA" +
"AAAAAAAAAAAAAAAAAAAEAMgFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA" +
"AAAAONMIIDiTCCAnGgAwIBAgIUDUo/9G0rz7fJiWTw0hY6TIyPRSIwDQYJKoZIhvcNAQELB" +
"QAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDE3MTEyNzAwMDAwMFoYDzIwMjAwMjA1MDAw" +
"MDAwWjAaMRgwFgYDVQQDDA9UZXN0IEVuZC1lbnRpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4I" +
"BDwAwggEKAoIBAQC6iFGoRI4W1kH9braIBjYQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZ" +
"wGm24ahvJr4q9adWtqZHEIeqVap0WH9xzVJJwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tF" +
"YIP8X6taRqx0wI6iypB7qdw4A8Njf1mCyuwJJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8n" +
"FthVt2Zaqn4CkC86exCABiTMHGyXrZZhW7filhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN" +
"7LyJvaeO0ipVhHe4m1iWdq5EITjbLHCQELL8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe" +
"2NAgMBAAGjgcowgccwgZAGA1UdEQSBiDCBhYIJbG9jYWxob3N0gg0qLmV4YW1wbGUuY29tg" +
"hUqLnBpbm5pbmcuZXhhbXBsZS5jb22CKCouaW5jbHVkZS1zdWJkb21haW5zLnBpbm5pbmcu" +
"ZXhhbXBsZS5jb22CKCouZXhjbHVkZS1zdWJkb21haW5zLnBpbm5pbmcuZXhhbXBsZS5jb20" +
"wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vbG9jYWxob3N0Ojg4ODgvMA" +
"0GCSqGSIb3DQEBCwUAA4IBAQCkguNhMyVCYhyYXfE22wNvlaobK2YRb4OGMxySIKuQ80N0X" +
"lO+xpLJTs9YzFVY1+JTHNez1QfwP9KJeZznTzVzLh4sv0swx/+oUxCfLb0VIl/kdUqLkbGY" +
"rAmtjeOKZLaqVtRH0BnmbPowLak1pi6nQYOU+aL9QOuvT/j3rXoimcdo6X3TK1SN2/64fGM" +
"yG/pwas+JXehbReUf4n1ewk84ADtb+ew8tRAKf/uxzKUj5t/UgqDsnTWq5wUc5IJKwoHT41" +
"sQnNqPg12x4+WGWiAsWCpR/hKYHFGr7rb4JTGEPAJpWcv9WtZYAvwT78a2xpHp5XNglj16I" +
"jWEukvJuU1WEwEABAAAAAABAQAAAAAAAAZ4MjU1MTkAAAAOUlNBLVBTUy1TSEEyNTYBlZ+x" +
"ZWUXSH+rm9iRO+Uxl650zaXNL0c/lvXwt//2LGgAAAACZgoyJpFcT/u7IImFpjLfBb3Dl5p" +
"UIkzVhYlpa26W6oMAAAAAAAADjTCCA4kwggJxoAMCAQICFA1KP/RtK8+3yYlk8NIWOkyMj0" +
"UiMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNVBAMMB1Rlc3QgQ0EwIhgPMjAxNzExMjcwMDAwM" +
"DBaGA8yMDIwMDIwNTAwMDAwMFowGjEYMBYGA1UEAwwPVGVzdCBFbmQtZW50aXR5MIIBIjAN" +
"BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz" +
"1aFdsJHvBxyWo4NgfvbGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/weadA4IC" +
"mTqyDDSeTbuUzCa2wO7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSSpH25iGF5kLFXk" +
"D3SO8XguEgfqDfTiEPvJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62WYVu34pYSwHUxowyR3bTK" +
"9/ytHSXTCe+5Fw6naOGzey8ib2njtIqVYR3uJtYlnauRCE42yxwkBCy/Fosv5fGPmRcxuLP" +
"+SSP6clHEMdUDrNoYCjXtjQIDAQABo4HKMIHHMIGQBgNVHREEgYgwgYWCCWxvY2FsaG9zdI" +
"INKi5leGFtcGxlLmNvbYIVKi5waW5uaW5nLmV4YW1wbGUuY29tgigqLmluY2x1ZGUtc3ViZ" +
"G9tYWlucy5waW5uaW5nLmV4YW1wbGUuY29tgigqLmV4Y2x1ZGUtc3ViZG9tYWlucy5waW5u" +
"aW5nLmV4YW1wbGUuY29tMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL2x" +
"vY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0BAQsFAAOCAQEApILjYTMlQmIcmF3xNtsDb5WqGy" +
"tmEW+DhjMckiCrkPNDdF5TvsaSyU7PWMxVWNfiUxzXs9UH8D/SiXmc5081cy4eLL9LMMf/q" +
"FMQny29FSJf5HVKi5GxmKwJrY3jimS2qlbUR9AZ5mz6MC2pNaYup0GDlPmi/UDrr0/49616" +
"IpnHaOl90ytUjdv+uHxjMhv6cGrPiV3oW0XlH+J9XsJPOAA7W/nsPLUQCn/7scylI+bf1IK" +
"g7J01qucFHOSCSsKB0+NbEJzaj4NdsePlhlogLFgqUf4SmBxRq+62+CUxhDwCaVnL/VrWWA" +
"L8E+/GtsaR6eVzYJY9eiI1hLpLyblNVmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtul" +
"uqDAAAAAAAAAtcwggLTMIIBu6ADAgECAhQpoXAjALAddSApG46EBfimNiyZuDANBgkqhkiG" +
"9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0IENBMCIYDzIwMTcxMTI3MDAwMDAwWhgPMjAyMDA" +
"yMDUwMDAwMDBaMBIxEDAOBgNVBAMMB1Rlc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDw" +
"AwggEKAoIBAQC6iFGoRI4W1kH9braIBjYQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZwGm" +
"24ahvJr4q9adWtqZHEIeqVap0WH9xzVJJwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tFYIP" +
"8X6taRqx0wI6iypB7qdw4A8Njf1mCyuwJJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8nFth" +
"Vt2Zaqn4CkC86exCABiTMHGyXrZZhW7filhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN7Ly" +
"JvaeO0ipVhHe4m1iWdq5EITjbLHCQELL8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe2NA" +
"gMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IB" +
"AQAgyCfLAcVs/MkERxunH9pZA4ja1QWWjsxSg9KgAIfOgj8c5RPHbl4oeWk0raNKWMu5+FR" +
"3/94IJeD45C3h/Y3+1HDyC6ZuzdgMXv63dk0a36JDFlPA3swqwYhnL7pHnbdcfDyWnMVfmL" +
"NeAhL7QA+Vf5fJmTsxEJwFaHo9JpKoQ469RdWno6aHeK3TfiQFaebzT1MRabCJXDeyw8Oal" +
"QICt0M0wx29B6HNof3px2NxKyC6qlf01wwNSaaIbsctDaLL5ZLN6T1LjpJsooMvDwRt69+S" +
"Xo8SmD4YO6Wr4Q9drI3cCwVeQXwxoUuB96muQQ2M3WDiMz5ZLI3oMLu8KSPsAAA=";
let serHelper = Cc["@mozilla.org/network/serialization-helper;1"].getService(
Ci.nsISerializationHelper
);
// deserialize from the string and compare to the original object
let deserialized = serHelper.deserializeObject(serialized);
deserialized.QueryInterface(Ci.nsITransportSecurityInfo);
equal(
deserialized.failedCertChain.length,
[],
"failedCertChain for a successful connection should be empty"
);
let certChain = build_cert_list_from_pem_list([gDefaultEEPEM, gTestCAPEM]);
ok(
areCertArraysEqual(certChain, deserialized.succeededCertChain),
"succeededCertChain should be deserialized correctly"
);
}
// In Bug 1580315, nsNSSCertList/nsIX509CertList was replaced by
// Array<nsIX509Cert>, so the serialization of the certList changed. This
// test is used to make sure we can still deserialize the TransportSecurityInfo
// binary string which has the old certList binary.
function test_old_failed_certlist_deseralization_v1() {
// This was the serialized output of test "expired.example.com"
// in security/manager/ssl/tests/unit/test_cert_chains.js
// The serialized output was generated before we replace nsIX509CertList with
// Array<nsIX509Cert>, so it had the old version of transportSecurityInfo.
const serialized =
"FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAABAA" +
"AAAAAAAAA///gCwAAAAEAMQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA" +
"AAAAMgMIIDHDCCAgSgAwIBAgIUY9ERAIKj0js/YbhJoMrcLnj++uowDQYJKoZIhvcNAQELB" +
"QAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDEzMDEwMTAwMDAwMFoYDzIwMTQwMTAxMDAw" +
"MDAwWjAiMSAwHgYDVQQDDBdFeHBpcmVkIFRlc3QgRW5kLWVudGl0eTCCASIwDQYJKoZIhvc" +
"NAQEBBQADggEPADCCAQoCggEBALqIUahEjhbWQf1utogGNhA9PBPZ6uQ1SrTs9WhXbCR7wc" +
"clqODYH72xnAabbhqG8mvir1p1a2pkcQh6pVqnRYf3HNUknAJ+zUP8HmnQOCApk6sgw0nk2" +
"7lMwmtsDu0Vgg/xfq1pGrHTAjqLKkHup3DgDw2N/WYLK7AkkqR9uYhheZCxV5A90jvF4LhI" +
"H6g304hD7ycW2FW3ZlqqfgKQLzp7EIAGJMwcbJetlmFbt+KWEsB1MaMMkd20yvf8rR0l0wn" +
"vuRcOp2jhs3svIm9p47SKlWEd7ibWJZ2rkQhONsscJAQsvxaLL+Xxj5kXMbiz/kkj+nJRxD" +
"HVA6zaGAo17Y0CAwEAAaNWMFQwHgYDVR0RBBcwFYITZXhwaXJlZC5leGFtcGxlLmNvbTAyB" +
"ggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9sb2NhbGhvc3Q6ODg4OC8wDQYJ" +
"KoZIhvcNAQELBQADggEBAImiFuy275T6b+Ud6gl/El6qpgWHUXeYiv2sp7d+HVzfT+ow5WV" +
"sxI/GMKhdA43JaKT9gfMsbnP1qiI2zel3U+F7IAMO1CEr5FVdCOVTma5hmu/81rkJLmZ8RQ" +
"DWWOhZKyn/7aD7TH1C1e768yCt5E2DDl8mHil9zR8BPsoXwuS3L9zJ2JqNc60+hB8l297Za" +
"Sl0nbKffb47ukvn5kSJ7tI9n/fSXdj1JrukwjZP+74VkQyNobaFzDZ+Zr3QmfbejEsY2EYn" +
"q8XuENgIO4DuYrm80/p6bMO6laB0Uv5W6uXZgBZdRTe1WMdYWGhmvnFFQmf+naeOOl6ryFw" +
"WwtnoK7IAAAAAAAEAAAEAAQAAAAAAAAAAAAAAAZWfsWVlF0h/q5vYkTvlMZeudM2lzS9HP5" +
"b18Lf/9ixoAAAAAmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAAyAwg" +
"gMcMIICBKADAgECAhRj0REAgqPSOz9huEmgytwueP766jANBgkqhkiG9w0BAQsFADASMRAw" +
"DgYDVQQDDAdUZXN0IENBMCIYDzIwMTMwMTAxMDAwMDAwWhgPMjAxNDAxMDEwMDAwMDBaMCI" +
"xIDAeBgNVBAMMF0V4cGlyZWQgVGVzdCBFbmQtZW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAA" +
"OCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz1aFdsJHvBxyWo4Ngfv" +
"bGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/weadA4ICmTqyDDSeTbuUzCa2wO" +
"7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSSpH25iGF5kLFXkD3SO8XguEgfqDfTiEP" +
"vJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62WYVu34pYSwHUxowyR3bTK9/ytHSXTCe+5Fw6naO" +
"Gzey8ib2njtIqVYR3uJtYlnauRCE42yxwkBCy/Fosv5fGPmRcxuLP+SSP6clHEMdUDrNoYC" +
"jXtjQIDAQABo1YwVDAeBgNVHREEFzAVghNleHBpcmVkLmV4YW1wbGUuY29tMDIGCCsGAQUF" +
"BwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL2xvY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0" +
"BAQsFAAOCAQEAiaIW7LbvlPpv5R3qCX8SXqqmBYdRd5iK/aynt34dXN9P6jDlZWzEj8YwqF" +
"0DjclopP2B8yxuc/WqIjbN6XdT4XsgAw7UISvkVV0I5VOZrmGa7/zWuQkuZnxFANZY6FkrK" +
"f/toPtMfULV7vrzIK3kTYMOXyYeKX3NHwE+yhfC5Lcv3MnYmo1zrT6EHyXb3tlpKXSdsp99" +
"vju6S+fmRInu0j2f99Jd2PUmu6TCNk/7vhWRDI2htoXMNn5mvdCZ9t6MSxjYRierxe4Q2Ag" +
"7gO5iubzT+npsw7qVoHRS/lbq5dmAFl1FN7VYx1hYaGa+cUVCZ/6dp446XqvIXBbC2egrsm" +
"YKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAAtcwggLTMIIBu6ADAgECA" +
"hQpoXAjALAddSApG46EBfimNiyZuDANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0" +
"IENBMCIYDzIwMTcxMTI3MDAwMDAwWhgPMjAyMDAyMDUwMDAwMDBaMBIxEDAOBgNVBAMMB1R" +
"lc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6iFGoRI4W1kH9braIBj" +
"YQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZwGm24ahvJr4q9adWtqZHEIeqVap0WH9xzVJ" +
"JwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tFYIP8X6taRqx0wI6iypB7qdw4A8Njf1mCyuw" +
"JJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8nFthVt2Zaqn4CkC86exCABiTMHGyXrZZhW7f" +
"ilhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN7LyJvaeO0ipVhHe4m1iWdq5EITjbLHCQELL" +
"8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe2NAgMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wC" +
"wYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAgyCfLAcVs/MkERxunH9pZA4ja1QWW" +
"jsxSg9KgAIfOgj8c5RPHbl4oeWk0raNKWMu5+FR3/94IJeD45C3h/Y3+1HDyC6ZuzdgMXv6" +
"3dk0a36JDFlPA3swqwYhnL7pHnbdcfDyWnMVfmLNeAhL7QA+Vf5fJmTsxEJwFaHo9JpKoQ4" +
"69RdWno6aHeK3TfiQFaebzT1MRabCJXDeyw8OalQICt0M0wx29B6HNof3px2NxKyC6qlf01" +
"wwNSaaIbsctDaLL5ZLN6T1LjpJsooMvDwRt69+SXo8SmD4YO6Wr4Q9drI3cCwVeQXwxoUuB" +
"96muQQ2M3WDiMz5ZLI3oMLu8KSPs";
let serHelper = Cc["@mozilla.org/network/serialization-helper;1"].getService(
Ci.nsISerializationHelper
);
// Deserialize from the string and compare to the original object
let deserialized = serHelper.deserializeObject(serialized);
deserialized.QueryInterface(Ci.nsITransportSecurityInfo);
equal(
deserialized.succeededCertChain.length,
0,
"succeededCertChain should be empty"
);
let certChain = build_cert_list_from_pem_list([gExpiredEEPEM, gTestCAPEM]);
ok(
areCertArraysEqual(certChain, deserialized.failedCertChain),
"failedCertChain should be deserialized correctly"
);
}
// Same as the above test, however, this is the v2 version of the
// serialization.
function test_old_failed_certlist_deseralization_v2() {
const serialized =
"FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAABAA" +
"AAAAAAAAA///gCwAAAAEAMgFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA" +
"AAAAMgMIIDHDCCAgSgAwIBAgIUY9ERAIKj0js/YbhJoMrcLnj++uowDQYJKoZIhvcNAQELB" +
"QAwEjEQMA4GA1UEAwwHVGVzdCBDQTAiGA8yMDEzMDEwMTAwMDAwMFoYDzIwMTQwMTAxMDAw" +
"MDAwWjAiMSAwHgYDVQQDDBdFeHBpcmVkIFRlc3QgRW5kLWVudGl0eTCCASIwDQYJKoZIhvc" +
"NAQEBBQADggEPADCCAQoCggEBALqIUahEjhbWQf1utogGNhA9PBPZ6uQ1SrTs9WhXbCR7wc" +
"clqODYH72xnAabbhqG8mvir1p1a2pkcQh6pVqnRYf3HNUknAJ+zUP8HmnQOCApk6sgw0nk2" +
"7lMwmtsDu0Vgg/xfq1pGrHTAjqLKkHup3DgDw2N/WYLK7AkkqR9uYhheZCxV5A90jvF4LhI" +
"H6g304hD7ycW2FW3ZlqqfgKQLzp7EIAGJMwcbJetlmFbt+KWEsB1MaMMkd20yvf8rR0l0wn" +
"vuRcOp2jhs3svIm9p47SKlWEd7ibWJZ2rkQhONsscJAQsvxaLL+Xxj5kXMbiz/kkj+nJRxD" +
"HVA6zaGAo17Y0CAwEAAaNWMFQwHgYDVR0RBBcwFYITZXhwaXJlZC5leGFtcGxlLmNvbTAyB" +
"ggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9sb2NhbGhvc3Q6ODg4OC8wDQYJ" +
"KoZIhvcNAQELBQADggEBAImiFuy275T6b+Ud6gl/El6qpgWHUXeYiv2sp7d+HVzfT+ow5WV" +
"sxI/GMKhdA43JaKT9gfMsbnP1qiI2zel3U+F7IAMO1CEr5FVdCOVTma5hmu/81rkJLmZ8RQ" +
"DWWOhZKyn/7aD7TH1C1e768yCt5E2DDl8mHil9zR8BPsoXwuS3L9zJ2JqNc60+hB8l297Za" +
"Sl0nbKffb47ukvn5kSJ7tI9n/fSXdj1JrukwjZP+74VkQyNobaFzDZ+Zr3QmfbejEsY2EYn" +
"q8XuENgIO4DuYrm80/p6bMO6laB0Uv5W6uXZgBZdRTe1WMdYWGhmvnFFQmf+naeOOl6ryFw" +
"WwtnoK7IAAAAAAAEAAAEAAQAAAAAAAAAAAAAAAZWfsWVlF0h/q5vYkTvlMZeudM2lzS9HP5" +
"b18Lf/9ixoAAAAAmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAAyAwg" +
"gMcMIICBKADAgECAhRj0REAgqPSOz9huEmgytwueP766jANBgkqhkiG9w0BAQsFADASMRAw" +
"DgYDVQQDDAdUZXN0IENBMCIYDzIwMTMwMTAxMDAwMDAwWhgPMjAxNDAxMDEwMDAwMDBaMCI" +
"xIDAeBgNVBAMMF0V4cGlyZWQgVGVzdCBFbmQtZW50aXR5MIIBIjANBgkqhkiG9w0BAQEFAA" +
"OCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz1aFdsJHvBxyWo4Ngfv" +
"bGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/weadA4ICmTqyDDSeTbuUzCa2wO" +
"7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSSpH25iGF5kLFXkD3SO8XguEgfqDfTiEP" +
"vJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62WYVu34pYSwHUxowyR3bTK9/ytHSXTCe+5Fw6naO" +
"Gzey8ib2njtIqVYR3uJtYlnauRCE42yxwkBCy/Fosv5fGPmRcxuLP+SSP6clHEMdUDrNoYC" +
"jXtjQIDAQABo1YwVDAeBgNVHREEFzAVghNleHBpcmVkLmV4YW1wbGUuY29tMDIGCCsGAQUF" +
"BwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL2xvY2FsaG9zdDo4ODg4LzANBgkqhkiG9w0" +
"BAQsFAAOCAQEAiaIW7LbvlPpv5R3qCX8SXqqmBYdRd5iK/aynt34dXN9P6jDlZWzEj8YwqF" +
"0DjclopP2B8yxuc/WqIjbN6XdT4XsgAw7UISvkVV0I5VOZrmGa7/zWuQkuZnxFANZY6FkrK" +
"f/toPtMfULV7vrzIK3kTYMOXyYeKX3NHwE+yhfC5Lcv3MnYmo1zrT6EHyXb3tlpKXSdsp99" +
"vju6S+fmRInu0j2f99Jd2PUmu6TCNk/7vhWRDI2htoXMNn5mvdCZ9t6MSxjYRierxe4Q2Ag" +
"7gO5iubzT+npsw7qVoHRS/lbq5dmAFl1FN7VYx1hYaGa+cUVCZ/6dp446XqvIXBbC2egrsm" +
"YKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAAAtcwggLTMIIBu6ADAgECA" +
"hQpoXAjALAddSApG46EBfimNiyZuDANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdUZXN0" +
"IENBMCIYDzIwMTcxMTI3MDAwMDAwWhgPMjAyMDAyMDUwMDAwMDBaMBIxEDAOBgNVBAMMB1R" +
"lc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6iFGoRI4W1kH9braIBj" +
"YQPTwT2erkNUq07PVoV2wke8HHJajg2B+9sZwGm24ahvJr4q9adWtqZHEIeqVap0WH9xzVJ" +
"JwCfs1D/B5p0DggKZOrIMNJ5Nu5TMJrbA7tFYIP8X6taRqx0wI6iypB7qdw4A8Njf1mCyuw" +
"JJKkfbmIYXmQsVeQPdI7xeC4SB+oN9OIQ+8nFthVt2Zaqn4CkC86exCABiTMHGyXrZZhW7f" +
"ilhLAdTGjDJHdtMr3/K0dJdMJ77kXDqdo4bN7LyJvaeO0ipVhHe4m1iWdq5EITjbLHCQELL" +
"8Wiy/l8Y+ZFzG4s/5JI/pyUcQx1QOs2hgKNe2NAgMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wC" +
"wYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAgyCfLAcVs/MkERxunH9pZA4ja1QWW" +
"jsxSg9KgAIfOgj8c5RPHbl4oeWk0raNKWMu5+FR3/94IJeD45C3h/Y3+1HDyC6ZuzdgMXv6" +
"3dk0a36JDFlPA3swqwYhnL7pHnbdcfDyWnMVfmLNeAhL7QA+Vf5fJmTsxEJwFaHo9JpKoQ4" +
"69RdWno6aHeK3TfiQFaebzT1MRabCJXDeyw8OalQICt0M0wx29B6HNof3px2NxKyC6qlf01" +
"wwNSaaIbsctDaLL5ZLN6T1LjpJsooMvDwRt69+SXo8SmD4YO6Wr4Q9drI3cCwVeQXwxoUuB" +
"96muQQ2M3WDiMz5ZLI3oMLu8KSPsAA==";
let serHelper = Cc["@mozilla.org/network/serialization-helper;1"].getService(
Ci.nsISerializationHelper
);
// Deserialize from the string and compare to the original object
let deserialized = serHelper.deserializeObject(serialized);
deserialized.QueryInterface(Ci.nsITransportSecurityInfo);
let certChain = build_cert_list_from_pem_list([gExpiredEEPEM, gTestCAPEM]);
ok(
areCertArraysEqual(certChain, deserialized.failedCertChain),
"failedCertChain should be deserialized correctly"
);
}
function run_test() {
do_get_profile();
add_tls_server_setup("BadCertAndPinningServer", "bad_certs");
@ -309,6 +667,26 @@ function run_test() {
run_next_test();
});
add_test(function() {
test_old_succeeded_certlist_deseralization_v2();
run_next_test();
});
add_test(function() {
test_old_failed_certlist_deseralization_v2();
run_next_test();
});
add_test(function() {
test_old_succeeded_certlist_deseralization_v1();
run_next_test();
});
add_test(function() {
test_old_failed_certlist_deseralization_v1();
run_next_test();
});
// Test successful connection (failedCertChain should be null)
add_connection_test(
// re-use pinning certs (keeler)
@ -316,6 +694,7 @@ function run_test() {
PRErrorCodeSuccess,
null,
function withSecurityInfo(aTransportSecurityInfo) {
test_security_info_serialization(aTransportSecurityInfo, 0);
equal(
aTransportSecurityInfo.failedCertChain.length,
0,
@ -330,6 +709,10 @@ function run_test() {
SEC_ERROR_EXPIRED_CERTIFICATE,
null,
function withSecurityInfo(securityInfo) {
test_security_info_serialization(
securityInfo,
SEC_ERROR_EXPIRED_CERTIFICATE
);
notEqual(
securityInfo.failedCertChain,
null,
@ -351,6 +734,7 @@ function run_test() {
SEC_ERROR_UNKNOWN_ISSUER,
null,
function withSecurityInfo(securityInfo) {
test_security_info_serialization(securityInfo, SEC_ERROR_UNKNOWN_ISSUER);
notEqual(
securityInfo.failedCertChain,
null,
@ -372,6 +756,10 @@ function run_test() {
SEC_ERROR_INADEQUATE_KEY_USAGE,
null,
function withSecurityInfo(securityInfo) {
test_security_info_serialization(
securityInfo,
SEC_ERROR_INADEQUATE_KEY_USAGE
);
notEqual(
securityInfo.failedCertChain,
null,