1415 lines
72 KiB
C++
1415 lines
72 KiB
C++
/**
|
|
* @file llsechandler_basic_test.cpp
|
|
* @author Roxie
|
|
* @date 2009-02-10
|
|
* @brief Test the 'basic' sec handler functions
|
|
*
|
|
* $LicenseInfo:firstyear=2005&license=viewerlgpl$
|
|
* Second Life Viewer Source Code
|
|
* Copyright (C) 2010, Linden Research, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation;
|
|
* version 2.1 of the License only.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*
|
|
* Linden Research, Inc., 945 Battery Street, San Francisco, CA 94111 USA
|
|
* $/LicenseInfo$
|
|
*/
|
|
#include "../llviewerprecompiledheaders.h"
|
|
#include "../test/lltut.h"
|
|
#include "../llsecapi.h"
|
|
#include "../llsechandler_basic.h"
|
|
#include "../../llxml/llcontrol.h"
|
|
#include "../llviewernetwork.h"
|
|
#include "lluuid.h"
|
|
#include "lldate.h"
|
|
#include "llxorcipher.h"
|
|
#include "apr_base64.h"
|
|
#include <vector>
|
|
#include <ios>
|
|
#include <llsdserialize.h>
|
|
#include <openssl/pem.h>
|
|
#include <openssl/err.h>
|
|
#include <openssl/evp.h>
|
|
#include "llxorcipher.h"
|
|
#include <openssl/ossl_typ.h>
|
|
#include <openssl/x509.h>
|
|
#include <openssl/x509v3.h>
|
|
#include <openssl/pem.h>
|
|
#include <openssl/asn1.h>
|
|
#include <openssl/rand.h>
|
|
#include <openssl/err.h>
|
|
#include "../llmachineid.h"
|
|
|
|
#define ensure_throws(str, exc_type, cert, func, ...) \
|
|
try \
|
|
{ \
|
|
func(__VA_ARGS__); \
|
|
fail("throws, " str); \
|
|
} \
|
|
catch(exc_type& except) \
|
|
{ \
|
|
LLSD cert_data; \
|
|
cert->getLLSD(cert_data); \
|
|
ensure("Exception cert is incorrect for " str, valueCompareLLSD(except.getCertData(), cert_data)); \
|
|
}
|
|
|
|
extern bool _cert_hostname_wildcard_match(const std::string& hostname, const std::string& wildcard_string);
|
|
|
|
//----------------------------------------------------------------------------
|
|
// Mock objects for the dependencies of the code we're testing
|
|
|
|
std::string gFirstName;
|
|
std::string gLastName;
|
|
LLControlGroup::LLControlGroup(const std::string& name)
|
|
: LLInstanceTracker<LLControlGroup, std::string>(name) {}
|
|
LLControlGroup::~LLControlGroup() {}
|
|
LLControlVariable* LLControlGroup::declareString(const std::string& name,
|
|
const std::string& initial_val,
|
|
const std::string& comment,
|
|
LLControlVariable::ePersist persist) {return NULL;}
|
|
void LLControlGroup::setString(const std::string& name, const std::string& val){}
|
|
std::string LLControlGroup::getString(const std::string& name)
|
|
{
|
|
|
|
if (name == "FirstName")
|
|
return gFirstName;
|
|
else if (name == "LastName")
|
|
return gLastName;
|
|
return "";
|
|
}
|
|
|
|
// Stub for --no-verify-ssl-cert
|
|
BOOL LLControlGroup::getBOOL(const std::string& name) { return FALSE; }
|
|
|
|
LLSD LLCredential::getLoginParams()
|
|
{
|
|
LLSD result = LLSD::emptyMap();
|
|
|
|
// legacy credential
|
|
result["passwd"] = "$1$testpasssd";
|
|
result["first"] = "myfirst";
|
|
result["last"] ="mylast";
|
|
return result;
|
|
}
|
|
|
|
void LLCredential::identifierType(std::string &idType)
|
|
{
|
|
}
|
|
|
|
void LLCredential::authenticatorType(std::string &idType)
|
|
{
|
|
}
|
|
|
|
|
|
LLControlGroup gSavedSettings("test");
|
|
unsigned char gMACAddress[MAC_ADDRESS_BYTES] = {77,21,46,31,89,2};
|
|
|
|
|
|
S32 LLMachineID::getUniqueID(unsigned char *unique_id, size_t len)
|
|
{
|
|
memcpy(unique_id, gMACAddress, len);
|
|
return 1;
|
|
}
|
|
S32 LLMachineID::init() { return 1; }
|
|
|
|
|
|
LLCertException::LLCertException(const LLSD& cert_data, const std::string& msg)
|
|
: LLException(msg),
|
|
mCertData(cert_data)
|
|
{
|
|
LL_WARNS("SECAPI") << "Certificate Error: " << msg << LL_ENDL;
|
|
}
|
|
|
|
|
|
// -------------------------------------------------------------------------------------------
|
|
// TUT
|
|
// -------------------------------------------------------------------------------------------
|
|
namespace tut
|
|
{
|
|
const std::string mPemTestCert(
|
|
"Certificate:\n"
|
|
" Data:\n"
|
|
" Version: 3 (0x2)\n"
|
|
" Serial Number:\n"
|
|
" 04:00:00:00:00:01:15:4b:5a:c3:94\n"
|
|
" Signature Algorithm: sha1WithRSAEncryption\n"
|
|
" Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA\n"
|
|
" Validity\n"
|
|
" Not Before: Sep 1 12:00:00 1998 GMT\n"
|
|
" Not After : Jan 28 12:00:00 2028 GMT\n"
|
|
" Subject: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA\n"
|
|
" Subject Public Key Info:\n"
|
|
" Public Key Algorithm: rsaEncryption\n"
|
|
" Public-Key: (2048 bit)\n"
|
|
" Modulus:\n"
|
|
" 00:da:0e:e6:99:8d:ce:a3:e3:4f:8a:7e:fb:f1:8b:\n"
|
|
" 83:25:6b:ea:48:1f:f1:2a:b0:b9:95:11:04:bd:f0:\n"
|
|
" 63:d1:e2:67:66:cf:1c:dd:cf:1b:48:2b:ee:8d:89:\n"
|
|
" 8e:9a:af:29:80:65:ab:e9:c7:2d:12:cb:ab:1c:4c:\n"
|
|
" 70:07:a1:3d:0a:30:cd:15:8d:4f:f8:dd:d4:8c:50:\n"
|
|
" 15:1c:ef:50:ee:c4:2e:f7:fc:e9:52:f2:91:7d:e0:\n"
|
|
" 6d:d5:35:30:8e:5e:43:73:f2:41:e9:d5:6a:e3:b2:\n"
|
|
" 89:3a:56:39:38:6f:06:3c:88:69:5b:2a:4d:c5:a7:\n"
|
|
" 54:b8:6c:89:cc:9b:f9:3c:ca:e5:fd:89:f5:12:3c:\n"
|
|
" 92:78:96:d6:dc:74:6e:93:44:61:d1:8d:c7:46:b2:\n"
|
|
" 75:0e:86:e8:19:8a:d5:6d:6c:d5:78:16:95:a2:e9:\n"
|
|
" c8:0a:38:eb:f2:24:13:4f:73:54:93:13:85:3a:1b:\n"
|
|
" bc:1e:34:b5:8b:05:8c:b9:77:8b:b1:db:1f:20:91:\n"
|
|
" ab:09:53:6e:90:ce:7b:37:74:b9:70:47:91:22:51:\n"
|
|
" 63:16:79:ae:b1:ae:41:26:08:c8:19:2b:d1:46:aa:\n"
|
|
" 48:d6:64:2a:d7:83:34:ff:2c:2a:c1:6c:19:43:4a:\n"
|
|
" 07:85:e7:d3:7c:f6:21:68:ef:ea:f2:52:9f:7f:93:\n"
|
|
" 90:cf\n"
|
|
" Exponent: 65537 (0x10001)\n"
|
|
" X509v3 extensions:\n"
|
|
" X509v3 Key Usage: critical\n"
|
|
" Certificate Sign, CRL Sign\n"
|
|
" X509v3 Basic Constraints: critical\n"
|
|
" CA:TRUE\n"
|
|
" X509v3 Subject Key Identifier: \n"
|
|
" 60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B\n"
|
|
" Signature Algorithm: sha1WithRSAEncryption\n"
|
|
" d6:73:e7:7c:4f:76:d0:8d:bf:ec:ba:a2:be:34:c5:28:32:b5:\n"
|
|
" 7c:fc:6c:9c:2c:2b:bd:09:9e:53:bf:6b:5e:aa:11:48:b6:e5:\n"
|
|
" 08:a3:b3:ca:3d:61:4d:d3:46:09:b3:3e:c3:a0:e3:63:55:1b:\n"
|
|
" f2:ba:ef:ad:39:e1:43:b9:38:a3:e6:2f:8a:26:3b:ef:a0:50:\n"
|
|
" 56:f9:c6:0a:fd:38:cd:c4:0b:70:51:94:97:98:04:df:c3:5f:\n"
|
|
" 94:d5:15:c9:14:41:9c:c4:5d:75:64:15:0d:ff:55:30:ec:86:\n"
|
|
" 8f:ff:0d:ef:2c:b9:63:46:f6:aa:fc:df:bc:69:fd:2e:12:48:\n"
|
|
" 64:9a:e0:95:f0:a6:ef:29:8f:01:b1:15:b5:0c:1d:a5:fe:69:\n"
|
|
" 2c:69:24:78:1e:b3:a7:1c:71:62:ee:ca:c8:97:ac:17:5d:8a:\n"
|
|
" c2:f8:47:86:6e:2a:c4:56:31:95:d0:67:89:85:2b:f9:6c:a6:\n"
|
|
" 5d:46:9d:0c:aa:82:e4:99:51:dd:70:b7:db:56:3d:61:e4:6a:\n"
|
|
" e1:5c:d6:f6:fe:3d:de:41:cc:07:ae:63:52:bf:53:53:f4:2b:\n"
|
|
" e9:c7:fd:b6:f7:82:5f:85:d2:41:18:db:81:b3:04:1c:c5:1f:\n"
|
|
" a4:80:6f:15:20:c9:de:0c:88:0a:1d:d6:66:55:e2:fc:48:c9:\n"
|
|
" 29:26:69:e0\n"
|
|
"-----BEGIN CERTIFICATE-----\n"
|
|
"MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG\n"
|
|
"A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv\n"
|
|
"b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw\n"
|
|
"MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i\n"
|
|
"YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT\n"
|
|
"aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ\n"
|
|
"jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp\n"
|
|
"xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp\n"
|
|
"1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\n"
|
|
"snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\n"
|
|
"U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n"
|
|
"9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E\n"
|
|
"BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B\n"
|
|
"AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz\n"
|
|
"yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE\n"
|
|
"38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP\n"
|
|
"AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad\n"
|
|
"DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME\n"
|
|
"HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==\n"
|
|
"-----END CERTIFICATE-----\n"
|
|
);
|
|
|
|
/*
|
|
* The following certificates were generated using the instructions at
|
|
* https://jamielinux.com/docs/openssl-certificate-authority/sign-server-and-client-certificates.html
|
|
* with the exception that the server certificate has a longer expiration time, and the full text
|
|
* expansion was included in the certificates.
|
|
*/
|
|
const std::string mPemRootCert(
|
|
"Certificate:\n"
|
|
" Data:\n"
|
|
" Version: 3 (0x2)\n"
|
|
" Serial Number:\n"
|
|
" 82:2f:8f:eb:8d:06:24:b0\n"
|
|
" Signature Algorithm: sha256WithRSAEncryption\n"
|
|
" Issuer: C=US, ST=California, L=San Francisco, O=Linden Lab, OU=Second Life Engineering, CN=Integration Test Root CA/emailAddress=noreply@lindenlab.com\n"
|
|
" Validity\n"
|
|
" Not Before: May 22 22:19:45 2018 GMT\n"
|
|
" Not After : May 17 22:19:45 2038 GMT\n"
|
|
" Subject: C=US, ST=California, L=San Francisco, O=Linden Lab, OU=Second Life Engineering, CN=Integration Test Root CA/emailAddress=noreply@lindenlab.com\n"
|
|
" Subject Public Key Info:\n"
|
|
" Public Key Algorithm: rsaEncryption\n"
|
|
" Public-Key: (4096 bit)\n"
|
|
" Modulus:\n"
|
|
" 00:bd:e0:79:dd:3b:a6:ac:87:d0:39:f0:58:c7:a4:\n"
|
|
" 42:42:f6:5f:93:b0:36:04:b5:e2:d5:f7:2a:c0:6c:\n"
|
|
" a0:13:d2:1e:02:81:57:02:50:4c:57:b7:ef:27:9e:\n"
|
|
" f6:f1:f1:30:30:72:1e:57:34:e5:3f:82:3c:21:c4:\n"
|
|
" 66:d2:73:63:6c:91:e6:dd:49:9e:9c:b1:34:6a:81:\n"
|
|
" 45:a1:6e:c4:50:28:f2:d8:e3:fe:80:2f:83:aa:28:\n"
|
|
" 91:b4:8c:57:c9:f1:16:d9:0c:87:3c:25:80:a0:81:\n"
|
|
" 8d:71:f2:96:e2:16:f1:97:c4:b0:d8:53:bb:13:6c:\n"
|
|
" 73:54:2f:29:94:85:cf:86:6e:75:71:ad:39:e3:fc:\n"
|
|
" 39:12:53:93:1c:ce:39:e0:33:da:49:b7:3d:af:b0:\n"
|
|
" 37:ce:77:09:03:27:32:70:c0:9c:7f:9c:89:ce:90:\n"
|
|
" 45:b0:7d:94:8b:ff:13:27:ba:88:7f:ae:c4:aa:73:\n"
|
|
" d5:47:b8:87:69:89:80:0c:c1:22:18:78:c2:0d:47:\n"
|
|
" d9:10:ff:80:79:0d:46:71:ec:d9:ba:c9:f3:77:fd:\n"
|
|
" 92:6d:1f:0f:d9:54:18:6d:f6:72:24:5c:5c:3d:43:\n"
|
|
" 49:35:3e:1c:28:de:7e:44:dc:29:c3:9f:62:04:46:\n"
|
|
" aa:c4:e6:69:6a:15:f8:e3:74:1c:14:e9:f4:97:7c:\n"
|
|
" 30:6c:d4:28:fc:2a:0e:1d:6d:39:2e:1d:f9:17:43:\n"
|
|
" 35:5d:23:e7:ba:e3:a8:e9:97:6b:3c:3e:23:ef:d8:\n"
|
|
" bc:fb:7a:57:37:39:93:59:03:fc:78:ca:b1:31:ef:\n"
|
|
" 26:19:ed:56:e1:63:c3:ad:99:80:5b:47:b5:03:35:\n"
|
|
" 5f:fe:6a:a6:21:63:ec:50:fb:4e:c9:f9:ae:a5:66:\n"
|
|
" d0:55:33:8d:e6:c5:50:5a:c6:8f:5c:34:45:a7:72:\n"
|
|
" da:50:f6:66:4c:19:f5:d1:e4:fb:11:8b:a1:b5:4e:\n"
|
|
" 09:43:81:3d:39:28:86:3b:fe:07:28:97:02:b5:3a:\n"
|
|
" 07:5f:4a:20:80:1a:7d:a4:8c:f7:6c:f6:c5:9b:f6:\n"
|
|
" 61:e5:c7:b0:c3:d5:58:38:7b:bb:47:1e:34:d6:16:\n"
|
|
" 55:c5:d2:6c:b0:93:77:b1:90:69:06:b1:53:cb:1b:\n"
|
|
" 84:71:cf:b8:87:1b:1e:44:35:b4:2b:bb:04:59:58:\n"
|
|
" 0b:e8:93:d8:ae:21:9b:b1:1c:89:30:ae:11:80:77:\n"
|
|
" cc:16:f3:d6:35:ed:a1:b3:70:b3:4f:cd:a1:56:99:\n"
|
|
" ee:0e:c0:00:a4:09:70:c3:5b:0b:be:a1:07:18:dd:\n"
|
|
" c6:f4:6d:8b:58:bc:f9:bb:4b:01:2c:f6:cc:2c:9b:\n"
|
|
" 87:0e:b1:4f:9c:10:be:fc:45:e2:a4:ec:7e:fc:ff:\n"
|
|
" 45:b8:53\n"
|
|
" Exponent: 65537 (0x10001)\n"
|
|
" X509v3 extensions:\n"
|
|
" X509v3 Subject Key Identifier: \n"
|
|
" 8A:22:C6:9C:2E:11:F3:40:0C:CE:82:0C:22:59:FF:F8:7F:D0:B9:13\n"
|
|
" X509v3 Authority Key Identifier: \n"
|
|
" keyid:8A:22:C6:9C:2E:11:F3:40:0C:CE:82:0C:22:59:FF:F8:7F:D0:B9:13\n"
|
|
"\n"
|
|
" X509v3 Basic Constraints: critical\n"
|
|
" CA:TRUE\n"
|
|
" X509v3 Key Usage: critical\n"
|
|
" Digital Signature, Certificate Sign, CRL Sign\n"
|
|
" Signature Algorithm: sha256WithRSAEncryption\n"
|
|
" b3:cb:33:eb:0e:02:64:f4:55:9a:3d:03:9a:cf:6a:4c:18:43:\n"
|
|
" f7:42:cb:65:dc:61:52:e5:9f:2f:42:97:3c:93:16:22:d4:af:\n"
|
|
" ae:b2:0f:c3:9b:ef:e0:cc:ee:b6:b1:69:a3:d8:da:26:c3:ad:\n"
|
|
" 3b:c5:64:dc:9f:d4:c2:53:4b:91:6d:c4:92:09:0b:ac:f0:99:\n"
|
|
" be:6f:b9:3c:03:4a:6d:9f:01:5d:ec:5a:9a:f3:a7:e5:3b:2c:\n"
|
|
" 99:57:7d:7e:25:15:68:20:12:30:96:16:86:f5:db:74:90:60:\n"
|
|
" fe:8b:df:99:f6:f7:62:49:9f:bc:8d:45:23:0a:c8:73:b8:79:\n"
|
|
" 80:3c:b9:e5:72:85:4b:b3:81:66:74:a2:72:92:4c:44:fd:7b:\n"
|
|
" 46:2e:21:a2:a9:81:a2:f3:26:4d:e3:89:7d:78:b0:c6:6f:b5:\n"
|
|
" 87:cb:ee:25:ed:27:1f:75:13:fa:6d:e9:37:73:ad:07:bb:af:\n"
|
|
" d3:6c:87:ea:02:01:70:bd:53:aa:ce:39:2c:d4:66:39:33:aa:\n"
|
|
" d1:9c:ee:67:e3:a9:45:d2:7b:2e:54:09:af:70:5f:3f:5a:67:\n"
|
|
" 2e:6c:72:ef:e0:9d:92:28:4a:df:ba:0b:b7:23:ca:5b:04:11:\n"
|
|
" 45:d1:51:e9:ea:c9:ec:54:fa:34:46:ae:fc:dc:6c:f8:1e:2c:\n"
|
|
" 9e:f4:71:51:8d:b5:a1:26:9a:13:30:be:1e:41:25:59:58:05:\n"
|
|
" 2c:64:c8:f9:5e:38:ae:dc:93:b0:8a:d6:38:74:02:cb:ce:ce:\n"
|
|
" 95:31:76:f6:7c:bf:a4:a1:8e:27:fd:ca:74:82:d1:e1:4d:b6:\n"
|
|
" 48:51:fa:c5:17:59:22:a3:84:be:82:c8:83:ec:61:a0:f4:ee:\n"
|
|
" 2c:e3:a3:ea:e5:51:c9:d3:4f:db:85:bd:ba:7a:52:14:b6:03:\n"
|
|
" ed:43:17:d8:d7:1c:22:5e:c9:56:d9:d6:81:96:11:e3:5e:01:\n"
|
|
" 40:91:30:09:da:a3:5f:d3:27:60:e5:9d:6c:da:d0:f0:39:01:\n"
|
|
" 23:4a:a6:15:7a:4a:82:eb:ec:72:4a:1d:36:dc:6f:83:c4:85:\n"
|
|
" 84:b5:8d:cd:09:e5:12:63:f3:21:56:c8:64:6b:db:b8:cf:d4:\n"
|
|
" df:ca:a8:24:8e:df:8d:63:a5:96:84:bf:ff:8b:7e:46:7a:f0:\n"
|
|
" c7:73:7c:70:8a:f5:17:d0:ac:c8:89:1e:d7:89:42:0f:4d:66:\n"
|
|
" c4:d8:bb:36:a8:ae:ca:e1:cf:e2:88:f6:cf:b0:44:4a:5f:81:\n"
|
|
" 50:4b:d6:28:81:cd:6c:f0:ec:e6:09:08:f2:59:91:a2:69:ac:\n"
|
|
" c7:81:fa:ab:61:3e:db:6f:f6:7f:db:1a:9e:b9:5d:cc:cc:33:\n"
|
|
" fa:95:c6:f7:8d:4b:30:f3\n"
|
|
"-----BEGIN CERTIFICATE-----\n"
|
|
"MIIGXDCCBESgAwIBAgIJAIIvj+uNBiSwMA0GCSqGSIb3DQEBCwUAMIG6MQswCQYD\n"
|
|
"VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5j\n"
|
|
"aXNjbzETMBEGA1UECgwKTGluZGVuIExhYjEgMB4GA1UECwwXU2Vjb25kIExpZmUg\n"
|
|
"RW5naW5lZXJpbmcxITAfBgNVBAMMGEludGVncmF0aW9uIFRlc3QgUm9vdCBDQTEk\n"
|
|
"MCIGCSqGSIb3DQEJARYVbm9yZXBseUBsaW5kZW5sYWIuY29tMB4XDTE4MDUyMjIy\n"
|
|
"MTk0NVoXDTM4MDUxNzIyMTk0NVowgboxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApD\n"
|
|
"YWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRMwEQYDVQQKDApMaW5k\n"
|
|
"ZW4gTGFiMSAwHgYDVQQLDBdTZWNvbmQgTGlmZSBFbmdpbmVlcmluZzEhMB8GA1UE\n"
|
|
"AwwYSW50ZWdyYXRpb24gVGVzdCBSb290IENBMSQwIgYJKoZIhvcNAQkBFhVub3Jl\n"
|
|
"cGx5QGxpbmRlbmxhYi5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC\n"
|
|
"AQC94HndO6ash9A58FjHpEJC9l+TsDYEteLV9yrAbKAT0h4CgVcCUExXt+8nnvbx\n"
|
|
"8TAwch5XNOU/gjwhxGbSc2NskebdSZ6csTRqgUWhbsRQKPLY4/6AL4OqKJG0jFfJ\n"
|
|
"8RbZDIc8JYCggY1x8pbiFvGXxLDYU7sTbHNULymUhc+GbnVxrTnj/DkSU5Mczjng\n"
|
|
"M9pJtz2vsDfOdwkDJzJwwJx/nInOkEWwfZSL/xMnuoh/rsSqc9VHuIdpiYAMwSIY\n"
|
|
"eMINR9kQ/4B5DUZx7Nm6yfN3/ZJtHw/ZVBht9nIkXFw9Q0k1Phwo3n5E3CnDn2IE\n"
|
|
"RqrE5mlqFfjjdBwU6fSXfDBs1Cj8Kg4dbTkuHfkXQzVdI+e646jpl2s8PiPv2Lz7\n"
|
|
"elc3OZNZA/x4yrEx7yYZ7VbhY8OtmYBbR7UDNV/+aqYhY+xQ+07J+a6lZtBVM43m\n"
|
|
"xVBaxo9cNEWnctpQ9mZMGfXR5PsRi6G1TglDgT05KIY7/gcolwK1OgdfSiCAGn2k\n"
|
|
"jPds9sWb9mHlx7DD1Vg4e7tHHjTWFlXF0mywk3exkGkGsVPLG4Rxz7iHGx5ENbQr\n"
|
|
"uwRZWAvok9iuIZuxHIkwrhGAd8wW89Y17aGzcLNPzaFWme4OwACkCXDDWwu+oQcY\n"
|
|
"3cb0bYtYvPm7SwEs9swsm4cOsU+cEL78ReKk7H78/0W4UwIDAQABo2MwYTAdBgNV\n"
|
|
"HQ4EFgQUiiLGnC4R80AMzoIMIln/+H/QuRMwHwYDVR0jBBgwFoAUiiLGnC4R80AM\n"
|
|
"zoIMIln/+H/QuRMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJ\n"
|
|
"KoZIhvcNAQELBQADggIBALPLM+sOAmT0VZo9A5rPakwYQ/dCy2XcYVLlny9ClzyT\n"
|
|
"FiLUr66yD8Ob7+DM7raxaaPY2ibDrTvFZNyf1MJTS5FtxJIJC6zwmb5vuTwDSm2f\n"
|
|
"AV3sWprzp+U7LJlXfX4lFWggEjCWFob123SQYP6L35n292JJn7yNRSMKyHO4eYA8\n"
|
|
"ueVyhUuzgWZ0onKSTET9e0YuIaKpgaLzJk3jiX14sMZvtYfL7iXtJx91E/pt6Tdz\n"
|
|
"rQe7r9Nsh+oCAXC9U6rOOSzUZjkzqtGc7mfjqUXSey5UCa9wXz9aZy5scu/gnZIo\n"
|
|
"St+6C7cjylsEEUXRUenqyexU+jRGrvzcbPgeLJ70cVGNtaEmmhMwvh5BJVlYBSxk\n"
|
|
"yPleOK7ck7CK1jh0AsvOzpUxdvZ8v6Shjif9ynSC0eFNtkhR+sUXWSKjhL6CyIPs\n"
|
|
"YaD07izjo+rlUcnTT9uFvbp6UhS2A+1DF9jXHCJeyVbZ1oGWEeNeAUCRMAnao1/T\n"
|
|
"J2DlnWza0PA5ASNKphV6SoLr7HJKHTbcb4PEhYS1jc0J5RJj8yFWyGRr27jP1N/K\n"
|
|
"qCSO341jpZaEv/+LfkZ68MdzfHCK9RfQrMiJHteJQg9NZsTYuzaorsrhz+KI9s+w\n"
|
|
"REpfgVBL1iiBzWzw7OYJCPJZkaJprMeB+qthPttv9n/bGp65XczMM/qVxveNSzDz\n"
|
|
"-----END CERTIFICATE-----\n"
|
|
);
|
|
|
|
const std::string mPemIntermediateCert(
|
|
"Certificate:\n"
|
|
" Data:\n"
|
|
" Version: 3 (0x2)\n"
|
|
" Serial Number: 4096 (0x1000)\n"
|
|
" Signature Algorithm: sha256WithRSAEncryption\n"
|
|
" Issuer: C=US, ST=California, L=San Francisco, O=Linden Lab, OU=Second Life Engineering, CN=Integration Test Root CA/emailAddress=noreply@lindenlab.com\n"
|
|
" Validity\n"
|
|
" Not Before: May 22 22:39:08 2018 GMT\n"
|
|
" Not After : May 19 22:39:08 2028 GMT\n"
|
|
" Subject: C=US, ST=California, O=Linden Lab, OU=Second Life Engineering, CN=Integration Test Intermediate CA/emailAddress=noreply@lindenlab.com\n"
|
|
" Subject Public Key Info:\n"
|
|
" Public Key Algorithm: rsaEncryption\n"
|
|
" Public-Key: (4096 bit)\n"
|
|
" Modulus:\n"
|
|
" 00:ce:a3:70:e2:c4:fb:4b:97:90:a1:30:bb:c1:1b:\n"
|
|
" 13:b9:aa:7e:46:17:a3:26:8d:69:3f:5e:73:95:e8:\n"
|
|
" 6a:b1:0a:b4:8f:50:65:e3:c6:5c:39:24:34:df:0b:\n"
|
|
" b7:cc:ce:62:0c:36:5a:12:2c:fe:35:4c:e9:1c:ac:\n"
|
|
" 80:5e:24:99:d7:aa:bd:be:48:c0:62:64:77:36:88:\n"
|
|
" 66:ce:f4:a8:dd:d2:76:24:62:90:55:41:fc:1d:13:\n"
|
|
" 4e:a7:4e:57:bc:a8:a4:59:4b:2c:5a:1c:d8:cc:16:\n"
|
|
" de:e8:88:30:c9:95:df:2f:a6:14:28:0f:eb:34:46:\n"
|
|
" 12:58:ba:da:0e:e6:de:9c:15:f6:f4:e3:9f:74:aa:\n"
|
|
" 70:89:79:8b:e9:5a:7b:18:54:15:94:3a:23:0a:65:\n"
|
|
" 78:05:d9:33:90:2a:ce:15:18:0d:52:fc:5c:31:65:\n"
|
|
" 20:d0:12:37:8c:11:80:ba:d4:b0:82:73:00:4b:49:\n"
|
|
" be:cb:d6:bc:e7:cd:61:f3:00:98:99:74:5a:37:81:\n"
|
|
" 49:96:7e:14:01:1b:86:d2:d0:06:94:40:63:63:46:\n"
|
|
" 11:fc:33:5c:bd:3a:5e:d4:e5:44:47:64:50:bd:a6:\n"
|
|
" 97:55:70:64:9b:26:cc:de:20:82:90:6a:83:41:9c:\n"
|
|
" 6f:71:47:14:be:cb:68:7c:85:be:ef:2e:76:12:19:\n"
|
|
" d3:c9:87:32:b4:ac:60:20:16:28:2d:af:bc:e8:01:\n"
|
|
" c6:7f:fb:d8:11:d5:f4:b7:14:bd:27:08:5b:72:be:\n"
|
|
" 09:e0:91:c8:9c:7b:b4:b3:12:ef:32:36:be:b1:b9:\n"
|
|
" a2:b7:e3:69:47:30:76:ba:9c:9b:19:99:4d:53:dd:\n"
|
|
" 5c:e8:2c:f1:b2:64:69:cf:15:bd:f8:bb:58:95:73:\n"
|
|
" 58:38:95:b4:7a:cf:84:29:a6:c2:db:f0:bd:ef:97:\n"
|
|
" 26:d4:99:ac:d7:c7:be:b0:0d:11:f4:26:86:2d:77:\n"
|
|
" 42:52:25:d7:56:c7:e3:97:b1:36:5c:97:71:d0:9b:\n"
|
|
" f5:b5:50:8d:f9:ff:fb:10:77:3c:b5:53:6d:a1:43:\n"
|
|
" 35:a9:03:32:05:ab:d7:f5:d1:19:bd:5f:92:a3:00:\n"
|
|
" 2a:79:37:a4:76:4f:e9:32:0d:e4:86:bb:ea:c3:1a:\n"
|
|
" c5:33:e8:16:d4:a5:d8:e0:e8:bb:c2:f0:22:15:e2:\n"
|
|
" d9:8c:ae:ac:7d:2b:bf:eb:a3:4c:3b:29:1d:94:ac:\n"
|
|
" a3:bb:6d:ba:6d:03:91:03:cf:46:12:c4:66:21:c5:\n"
|
|
" c6:67:d8:11:19:79:01:0e:6e:84:1c:76:6f:11:3d:\n"
|
|
" eb:94:89:c5:6a:26:1f:cd:e0:11:8b:51:ee:99:35:\n"
|
|
" 69:e5:7f:0b:77:2a:94:e4:4b:64:b9:83:04:30:05:\n"
|
|
" e4:a2:e3\n"
|
|
" Exponent: 65537 (0x10001)\n"
|
|
" X509v3 extensions:\n"
|
|
" X509v3 Subject Key Identifier: \n"
|
|
" 83:21:DE:EC:C0:79:03:6D:1E:83:F3:E5:97:29:D5:5A:C0:96:40:FA\n"
|
|
" X509v3 Authority Key Identifier: \n"
|
|
" keyid:8A:22:C6:9C:2E:11:F3:40:0C:CE:82:0C:22:59:FF:F8:7F:D0:B9:13\n"
|
|
"\n"
|
|
" X509v3 Basic Constraints: critical\n"
|
|
" CA:TRUE, pathlen:0\n"
|
|
" X509v3 Key Usage: critical\n"
|
|
" Digital Signature, Certificate Sign, CRL Sign\n"
|
|
" Signature Algorithm: sha256WithRSAEncryption\n"
|
|
" a3:6c:85:9a:2e:4e:7e:5d:83:63:0f:f5:4f:a9:7d:ec:0e:6f:\n"
|
|
" ae:d7:ba:df:64:e0:46:0e:3d:da:18:15:2c:f3:73:ca:81:b1:\n"
|
|
" 10:d9:53:14:21:7d:72:5c:94:88:a5:9d:ad:ab:45:42:c6:64:\n"
|
|
" a9:d9:2e:4e:29:47:2c:b1:95:07:b7:62:48:68:1f:68:13:1c:\n"
|
|
" d2:a0:fb:5e:38:24:4a:82:0a:87:c9:93:20:43:7e:e9:f9:79:\n"
|
|
" ef:03:a2:bd:9e:24:6b:0a:01:5e:4a:36:c5:7d:7a:fe:d6:aa:\n"
|
|
" 2f:c2:8c:38:8a:99:3c:b0:6a:e5:60:be:56:d6:eb:60:03:55:\n"
|
|
" 24:42:a0:1a:fa:91:24:a3:53:15:75:5d:c8:eb:7c:1e:68:5a:\n"
|
|
" 7e:13:34:e3:85:37:1c:76:3f:77:67:1b:ed:1b:52:17:fc:4a:\n"
|
|
" a3:e2:74:84:80:2c:69:fc:dd:7d:26:97:c4:2a:69:7d:9c:dc:\n"
|
|
" 61:97:70:29:a7:3f:2b:5b:2b:22:51:fd:fe:6a:5d:f9:e7:14:\n"
|
|
" 48:b7:2d:c8:33:58:fc:f2:5f:27:f7:26:16:be:be:b5:aa:a2:\n"
|
|
" 64:53:3c:69:e8:b5:61:eb:ab:91:a5:b4:09:9b:f6:98:b8:5c:\n"
|
|
" 5b:24:2f:93:f5:2b:9c:8c:58:fb:26:3f:67:53:d7:42:64:e8:\n"
|
|
" 79:77:73:41:4e:e3:02:39:0b:b6:68:97:8b:84:e8:1d:83:a8:\n"
|
|
" 15:f1:06:46:47:80:42:5e:14:e2:61:8a:76:84:d5:d4:71:7f:\n"
|
|
" 4e:ff:d9:74:87:ff:32:c5:87:20:0a:d4:59:40:3e:d8:17:ef:\n"
|
|
" da:65:e9:0a:51:fe:1e:c3:46:91:d2:ee:e4:23:57:97:87:d4:\n"
|
|
" a6:a5:eb:ef:81:6a:d8:8c:d6:1f:8e:b1:18:4c:6b:89:32:55:\n"
|
|
" 53:68:26:9e:bb:03:be:2c:e9:8b:ff:97:9c:1c:ac:28:c3:9f:\n"
|
|
" 0b:b7:93:23:24:31:63:e4:19:13:f2:bb:08:71:b7:c5:c5:c4:\n"
|
|
" 10:ff:dc:fc:33:54:a4:5e:ec:a3:fe:0a:80:ca:9c:bc:95:6f:\n"
|
|
" 5f:39:91:3b:61:69:16:94:0f:57:4b:fc:4b:b1:be:72:98:5d:\n"
|
|
" 10:f9:08:a7:d6:e0:e8:3d:5d:54:7d:fa:4b:6a:dd:98:41:ed:\n"
|
|
" 84:a1:39:67:5c:6c:7f:0c:b0:e1:98:c1:14:ed:fe:1e:e8:05:\n"
|
|
" 8d:7f:6a:24:cb:1b:05:42:0d:7f:13:ba:ca:b5:91:db:a5:f0:\n"
|
|
" 40:2b:70:7a:2a:a5:5d:ed:56:0c:f0:c2:72:ee:63:dd:cb:5d:\n"
|
|
" 76:f6:08:e6:e6:30:ef:3a:b2:16:34:41:a4:e1:30:14:bc:c7:\n"
|
|
" f9:23:3a:1a:70:df:b8:cc\n"
|
|
"-----BEGIN CERTIFICATE-----\n"
|
|
"MIIGSDCCBDCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgboxCzAJBgNVBAYTAlVT\n"
|
|
"MRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRMw\n"
|
|
"EQYDVQQKDApMaW5kZW4gTGFiMSAwHgYDVQQLDBdTZWNvbmQgTGlmZSBFbmdpbmVl\n"
|
|
"cmluZzEhMB8GA1UEAwwYSW50ZWdyYXRpb24gVGVzdCBSb290IENBMSQwIgYJKoZI\n"
|
|
"hvcNAQkBFhVub3JlcGx5QGxpbmRlbmxhYi5jb20wHhcNMTgwNTIyMjIzOTA4WhcN\n"
|
|
"MjgwNTE5MjIzOTA4WjCBqjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3Ju\n"
|
|
"aWExEzARBgNVBAoMCkxpbmRlbiBMYWIxIDAeBgNVBAsMF1NlY29uZCBMaWZlIEVu\n"
|
|
"Z2luZWVyaW5nMSkwJwYDVQQDDCBJbnRlZ3JhdGlvbiBUZXN0IEludGVybWVkaWF0\n"
|
|
"ZSBDQTEkMCIGCSqGSIb3DQEJARYVbm9yZXBseUBsaW5kZW5sYWIuY29tMIICIjAN\n"
|
|
"BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAzqNw4sT7S5eQoTC7wRsTuap+Rhej\n"
|
|
"Jo1pP15zlehqsQq0j1Bl48ZcOSQ03wu3zM5iDDZaEiz+NUzpHKyAXiSZ16q9vkjA\n"
|
|
"YmR3NohmzvSo3dJ2JGKQVUH8HRNOp05XvKikWUssWhzYzBbe6IgwyZXfL6YUKA/r\n"
|
|
"NEYSWLraDubenBX29OOfdKpwiXmL6Vp7GFQVlDojCmV4BdkzkCrOFRgNUvxcMWUg\n"
|
|
"0BI3jBGAutSwgnMAS0m+y9a8581h8wCYmXRaN4FJln4UARuG0tAGlEBjY0YR/DNc\n"
|
|
"vTpe1OVER2RQvaaXVXBkmybM3iCCkGqDQZxvcUcUvstofIW+7y52EhnTyYcytKxg\n"
|
|
"IBYoLa+86AHGf/vYEdX0txS9Jwhbcr4J4JHInHu0sxLvMja+sbmit+NpRzB2upyb\n"
|
|
"GZlNU91c6CzxsmRpzxW9+LtYlXNYOJW0es+EKabC2/C975cm1Jms18e+sA0R9CaG\n"
|
|
"LXdCUiXXVsfjl7E2XJdx0Jv1tVCN+f/7EHc8tVNtoUM1qQMyBavX9dEZvV+SowAq\n"
|
|
"eTekdk/pMg3khrvqwxrFM+gW1KXY4Oi7wvAiFeLZjK6sfSu/66NMOykdlKyju226\n"
|
|
"bQORA89GEsRmIcXGZ9gRGXkBDm6EHHZvET3rlInFaiYfzeARi1HumTVp5X8LdyqU\n"
|
|
"5EtkuYMEMAXkouMCAwEAAaNmMGQwHQYDVR0OBBYEFIMh3uzAeQNtHoPz5Zcp1VrA\n"
|
|
"lkD6MB8GA1UdIwQYMBaAFIoixpwuEfNADM6CDCJZ//h/0LkTMBIGA1UdEwEB/wQI\n"
|
|
"MAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQCjbIWa\n"
|
|
"Lk5+XYNjD/VPqX3sDm+u17rfZOBGDj3aGBUs83PKgbEQ2VMUIX1yXJSIpZ2tq0VC\n"
|
|
"xmSp2S5OKUcssZUHt2JIaB9oExzSoPteOCRKggqHyZMgQ37p+XnvA6K9niRrCgFe\n"
|
|
"SjbFfXr+1qovwow4ipk8sGrlYL5W1utgA1UkQqAa+pEko1MVdV3I63weaFp+EzTj\n"
|
|
"hTccdj93ZxvtG1IX/Eqj4nSEgCxp/N19JpfEKml9nNxhl3Appz8rWysiUf3+al35\n"
|
|
"5xRIty3IM1j88l8n9yYWvr61qqJkUzxp6LVh66uRpbQJm/aYuFxbJC+T9SucjFj7\n"
|
|
"Jj9nU9dCZOh5d3NBTuMCOQu2aJeLhOgdg6gV8QZGR4BCXhTiYYp2hNXUcX9O/9l0\n"
|
|
"h/8yxYcgCtRZQD7YF+/aZekKUf4ew0aR0u7kI1eXh9SmpevvgWrYjNYfjrEYTGuJ\n"
|
|
"MlVTaCaeuwO+LOmL/5ecHKwow58Lt5MjJDFj5BkT8rsIcbfFxcQQ/9z8M1SkXuyj\n"
|
|
"/gqAypy8lW9fOZE7YWkWlA9XS/xLsb5ymF0Q+Qin1uDoPV1UffpLat2YQe2EoTln\n"
|
|
"XGx/DLDhmMEU7f4e6AWNf2okyxsFQg1/E7rKtZHbpfBAK3B6KqVd7VYM8MJy7mPd\n"
|
|
"y1129gjm5jDvOrIWNEGk4TAUvMf5IzoacN+4zA==\n"
|
|
"-----END CERTIFICATE-----\n"
|
|
);
|
|
|
|
const std::string mPemChildCert(
|
|
"Certificate:\n"
|
|
" Data:\n"
|
|
" Version: 3 (0x2)\n"
|
|
" Serial Number: 4096 (0x1000)\n"
|
|
" Signature Algorithm: sha256WithRSAEncryption\n"
|
|
" Issuer: C=US, ST=California, O=Linden Lab, OU=Second Life Engineering, CN=Integration Test Intermediate CA/emailAddress=noreply@lindenlab.com\n"
|
|
" Validity\n"
|
|
" Not Before: May 22 22:58:15 2018 GMT\n"
|
|
" Not After : Jul 19 22:58:15 2024 GMT\n"
|
|
" Subject: C=US, ST=California, L=San Francisco, O=Linden Lab, OU=Second Life Engineering, CN=Integration Test Server Cert/emailAddress=noreply@lindenlab.com\n"
|
|
" Subject Public Key Info:\n"
|
|
" Public Key Algorithm: rsaEncryption\n"
|
|
" Public-Key: (2048 bit)\n"
|
|
" Modulus:\n"
|
|
" 00:bf:a1:1c:76:82:4a:10:1d:25:0e:02:e2:7a:64:\n"
|
|
" 54:c7:94:c5:c0:98:d5:35:f3:cb:cb:30:ba:31:9c:\n"
|
|
" bd:4c:2f:4a:4e:24:03:4b:87:5c:c1:5c:fe:d9:89:\n"
|
|
" 3b:cb:01:bc:eb:a5:b7:78:dc:b3:58:e5:78:a7:15:\n"
|
|
" 34:50:30:aa:16:3a:b2:94:17:6d:1e:7f:b2:70:1e:\n"
|
|
" 96:41:bb:1d:e3:22:80:fa:dc:00:6a:fb:34:3e:67:\n"
|
|
" e7:c2:21:2f:1b:d3:af:04:49:91:eb:bb:60:e0:26:\n"
|
|
" 52:75:28:8a:08:5b:91:56:4e:51:50:40:51:70:af:\n"
|
|
" cb:80:66:c8:59:e9:e2:48:a8:62:d0:26:67:80:0a:\n"
|
|
" 12:16:d1:f6:15:9e:1f:f5:92:37:f3:c9:2f:03:9e:\n"
|
|
" 22:f6:60:5a:76:45:8c:01:2c:99:54:72:19:db:b7:\n"
|
|
" 72:e6:5a:69:f3:e9:31:65:5d:0f:c7:5c:9c:17:29:\n"
|
|
" 71:14:7f:db:47:c9:1e:65:a2:41:b0:2f:14:17:ec:\n"
|
|
" 4b:25:f2:43:8f:b4:a3:8d:37:1a:07:34:b3:29:bb:\n"
|
|
" 8a:44:8e:84:08:a2:1b:76:7a:cb:c2:39:2f:6e:e3:\n"
|
|
" fc:d6:91:b5:1f:ce:58:91:57:70:35:6e:25:a9:48:\n"
|
|
" 0e:07:cf:4e:dd:16:42:65:cf:8a:42:b3:27:e6:fe:\n"
|
|
" 6a:e3\n"
|
|
" Exponent: 65537 (0x10001)\n"
|
|
" X509v3 extensions:\n"
|
|
" X509v3 Basic Constraints: \n"
|
|
" CA:FALSE\n"
|
|
" Netscape Cert Type: \n"
|
|
" SSL Server\n"
|
|
" Netscape Comment: \n"
|
|
" OpenSSL Generated Server Certificate\n"
|
|
" X509v3 Subject Key Identifier: \n"
|
|
" BB:59:9F:DE:6B:51:A7:6C:B3:6D:5B:8B:42:F7:B1:65:77:17:A4:E4\n"
|
|
" X509v3 Authority Key Identifier: \n"
|
|
" keyid:83:21:DE:EC:C0:79:03:6D:1E:83:F3:E5:97:29:D5:5A:C0:96:40:FA\n"
|
|
" DirName:/C=US/ST=California/L=San Francisco/O=Linden Lab/OU=Second Life Engineering/CN=Integration Test Root CA/emailAddress=noreply@lindenlab.com\n"
|
|
" serial:10:00\n"
|
|
"\n"
|
|
" X509v3 Key Usage: critical\n"
|
|
" Digital Signature, Key Encipherment\n"
|
|
" X509v3 Extended Key Usage: \n"
|
|
" TLS Web Server Authentication\n"
|
|
" Signature Algorithm: sha256WithRSAEncryption\n"
|
|
" 18:a6:58:55:9b:d4:af:7d:8a:27:d3:28:3a:4c:4b:42:4e:f0:\n"
|
|
" 30:d6:d9:95:11:48:12:0a:96:40:d9:2b:21:39:c5:d4:8d:e5:\n"
|
|
" 10:bc:68:78:69:0b:9f:15:4a:0b:f1:ab:99:45:0c:20:5f:27:\n"
|
|
" df:e7:14:2d:4a:30:f2:c2:8d:37:73:36:1a:27:55:5a:08:5f:\n"
|
|
" 71:a1:5e:05:83:b2:59:fe:02:5e:d7:4a:30:15:23:58:04:cf:\n"
|
|
" 48:cc:b0:71:88:9c:6b:57:f0:04:0a:d3:a0:64:6b:ee:f3:5f:\n"
|
|
" ea:ac:e1:2b:b9:7f:79:b8:db:ce:72:48:72:db:c8:5c:38:72:\n"
|
|
" 31:55:d0:ff:6b:bd:73:23:a7:30:18:5d:ed:47:18:0a:67:8e:\n"
|
|
" 53:32:0e:99:9b:96:72:45:7f:c6:00:2c:5d:1a:97:53:75:3a:\n"
|
|
" 0b:49:3d:3a:00:37:14:67:0c:28:97:34:87:aa:c5:32:e4:ae:\n"
|
|
" 34:83:12:4a:10:f7:0e:74:d4:5f:73:bd:ef:0c:b7:d8:0a:7d:\n"
|
|
" 8e:8d:5a:48:bd:f4:8e:7b:f9:4a:15:3b:61:c9:5e:40:59:6e:\n"
|
|
" c7:a8:a4:02:28:72:c5:54:8c:77:f4:55:a7:86:c0:38:a0:68:\n"
|
|
" 19:da:0f:72:5a:a9:7e:69:9f:9c:3a:d6:66:aa:e1:f4:fd:f9:\n"
|
|
" b8:4b:6c:71:9e:f0:38:02:c7:6a:9e:dc:e6:fb:ef:23:59:4f:\n"
|
|
" 5c:84:0a:df:ea:86:1f:fd:0e:5c:fa:c4:e5:50:1c:10:cf:89:\n"
|
|
" 4e:08:0e:4c:4b:61:1a:49:12:f7:e9:4b:17:71:43:7b:6d:b6:\n"
|
|
" b5:9f:d4:3b:c7:88:53:48:63:b6:00:80:8f:49:0a:c5:7e:58:\n"
|
|
" ac:78:d8:b9:06:b0:bc:86:e2:2e:48:5b:c3:24:fa:aa:72:d8:\n"
|
|
" ec:f6:c7:91:9f:0f:c8:b5:fd:2b:b2:a7:bc:2f:40:20:2b:47:\n"
|
|
" e0:d1:1d:94:52:6f:6b:be:12:b6:8c:dc:11:db:71:e6:19:ef:\n"
|
|
" a8:71:8b:ad:d3:32:c0:1c:a4:3f:b3:0f:af:e5:50:e1:ff:41:\n"
|
|
" a4:b7:6f:57:71:af:fd:16:4c:e8:24:b3:99:1b:cf:12:8f:43:\n"
|
|
" 05:80:ba:18:19:0a:a5:ec:49:81:41:4c:7e:28:b2:21:f2:59:\n"
|
|
" 6e:4a:ed:de:f9:fa:99:85:60:1f:e6:c2:42:5c:08:00:3c:84:\n"
|
|
" 06:a9:24:d4:cf:7b:6e:1b:59:1d:f4:70:16:03:a1:e0:0b:00:\n"
|
|
" 95:5c:39:03:fc:9d:1c:8e:f7:59:0c:61:47:f6:7f:07:22:48:\n"
|
|
" 83:40:ac:e1:98:5f:c7:be:05:d5:29:2b:bf:0d:03:0e:e9:5e:\n"
|
|
" 2b:dd:09:18:fe:5e:30:61\n"
|
|
"-----BEGIN CERTIFICATE-----\n"
|
|
"MIIGbjCCBFagAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgaoxCzAJBgNVBAYTAlVT\n"
|
|
"MRMwEQYDVQQIDApDYWxpZm9ybmlhMRMwEQYDVQQKDApMaW5kZW4gTGFiMSAwHgYD\n"
|
|
"VQQLDBdTZWNvbmQgTGlmZSBFbmdpbmVlcmluZzEpMCcGA1UEAwwgSW50ZWdyYXRp\n"
|
|
"b24gVGVzdCBJbnRlcm1lZGlhdGUgQ0ExJDAiBgkqhkiG9w0BCQEWFW5vcmVwbHlA\n"
|
|
"bGluZGVubGFiLmNvbTAeFw0xODA1MjIyMjU4MTVaFw0yNDA3MTkyMjU4MTVaMIG+\n"
|
|
"MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2Fu\n"
|
|
"IEZyYW5jaXNjbzETMBEGA1UECgwKTGluZGVuIExhYjEgMB4GA1UECwwXU2Vjb25k\n"
|
|
"IExpZmUgRW5naW5lZXJpbmcxJTAjBgNVBAMMHEludGVncmF0aW9uIFRlc3QgU2Vy\n"
|
|
"dmVyIENlcnQxJDAiBgkqhkiG9w0BCQEWFW5vcmVwbHlAbGluZGVubGFiLmNvbTCC\n"
|
|
"ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL+hHHaCShAdJQ4C4npkVMeU\n"
|
|
"xcCY1TXzy8swujGcvUwvSk4kA0uHXMFc/tmJO8sBvOult3jcs1jleKcVNFAwqhY6\n"
|
|
"spQXbR5/snAelkG7HeMigPrcAGr7ND5n58IhLxvTrwRJkeu7YOAmUnUoighbkVZO\n"
|
|
"UVBAUXCvy4BmyFnp4kioYtAmZ4AKEhbR9hWeH/WSN/PJLwOeIvZgWnZFjAEsmVRy\n"
|
|
"Gdu3cuZaafPpMWVdD8dcnBcpcRR/20fJHmWiQbAvFBfsSyXyQ4+0o403Ggc0sym7\n"
|
|
"ikSOhAiiG3Z6y8I5L27j/NaRtR/OWJFXcDVuJalIDgfPTt0WQmXPikKzJ+b+auMC\n"
|
|
"AwEAAaOCAYYwggGCMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCG\n"
|
|
"SAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUw\n"
|
|
"HQYDVR0OBBYEFLtZn95rUadss21bi0L3sWV3F6TkMIHoBgNVHSMEgeAwgd2AFIMh\n"
|
|
"3uzAeQNtHoPz5Zcp1VrAlkD6oYHApIG9MIG6MQswCQYDVQQGEwJVUzETMBEGA1UE\n"
|
|
"CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwK\n"
|
|
"TGluZGVuIExhYjEgMB4GA1UECwwXU2Vjb25kIExpZmUgRW5naW5lZXJpbmcxITAf\n"
|
|
"BgNVBAMMGEludGVncmF0aW9uIFRlc3QgUm9vdCBDQTEkMCIGCSqGSIb3DQEJARYV\n"
|
|
"bm9yZXBseUBsaW5kZW5sYWIuY29tggIQADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0l\n"
|
|
"BAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBABimWFWb1K99iifTKDpM\n"
|
|
"S0JO8DDW2ZURSBIKlkDZKyE5xdSN5RC8aHhpC58VSgvxq5lFDCBfJ9/nFC1KMPLC\n"
|
|
"jTdzNhonVVoIX3GhXgWDsln+Al7XSjAVI1gEz0jMsHGInGtX8AQK06Bka+7zX+qs\n"
|
|
"4Su5f3m4285ySHLbyFw4cjFV0P9rvXMjpzAYXe1HGApnjlMyDpmblnJFf8YALF0a\n"
|
|
"l1N1OgtJPToANxRnDCiXNIeqxTLkrjSDEkoQ9w501F9zve8Mt9gKfY6NWki99I57\n"
|
|
"+UoVO2HJXkBZbseopAIocsVUjHf0VaeGwDigaBnaD3JaqX5pn5w61maq4fT9+bhL\n"
|
|
"bHGe8DgCx2qe3Ob77yNZT1yECt/qhh/9Dlz6xOVQHBDPiU4IDkxLYRpJEvfpSxdx\n"
|
|
"Q3tttrWf1DvHiFNIY7YAgI9JCsV+WKx42LkGsLyG4i5IW8Mk+qpy2Oz2x5GfD8i1\n"
|
|
"/Suyp7wvQCArR+DRHZRSb2u+EraM3BHbceYZ76hxi63TMsAcpD+zD6/lUOH/QaS3\n"
|
|
"b1dxr/0WTOgks5kbzxKPQwWAuhgZCqXsSYFBTH4osiHyWW5K7d75+pmFYB/mwkJc\n"
|
|
"CAA8hAapJNTPe24bWR30cBYDoeALAJVcOQP8nRyO91kMYUf2fwciSINArOGYX8e+\n"
|
|
"BdUpK78NAw7pXivdCRj+XjBh\n"
|
|
"-----END CERTIFICATE-----\n"
|
|
);
|
|
|
|
// Test wrapper declaration : wrapping nothing for the moment
|
|
struct sechandler_basic_test
|
|
{
|
|
X509 *mX509TestCert, *mX509RootCert, *mX509IntermediateCert, *mX509ChildCert;
|
|
LLSD mValidationDate;
|
|
|
|
sechandler_basic_test()
|
|
{
|
|
LLMachineID::init();
|
|
OpenSSL_add_all_algorithms();
|
|
OpenSSL_add_all_ciphers();
|
|
OpenSSL_add_all_digests();
|
|
ERR_load_crypto_strings();
|
|
gFirstName = "";
|
|
gLastName = "";
|
|
mValidationDate[CERT_VALIDATION_DATE] = LLDate("2017-04-11T00:00:00.00Z");
|
|
LLFile::remove("test_password.dat");
|
|
LLFile::remove("sechandler_settings.tmp");
|
|
|
|
mX509TestCert = NULL;
|
|
mX509RootCert = NULL;
|
|
mX509IntermediateCert = NULL;
|
|
mX509ChildCert = NULL;
|
|
|
|
// Read each of the 4 Pem certs and store in mX509*Cert pointers
|
|
BIO * validation_bio;
|
|
validation_bio = BIO_new_mem_buf((void*)mPemTestCert.c_str(), mPemTestCert.length());
|
|
PEM_read_bio_X509(validation_bio, &mX509TestCert, 0, NULL);
|
|
BIO_free(validation_bio);
|
|
|
|
validation_bio = BIO_new_mem_buf((void*)mPemRootCert.c_str(), mPemRootCert.length());
|
|
PEM_read_bio_X509(validation_bio, &mX509RootCert, 0, NULL);
|
|
BIO_free(validation_bio);
|
|
|
|
validation_bio = BIO_new_mem_buf((void*)mPemIntermediateCert.c_str(), mPemIntermediateCert.length());
|
|
PEM_read_bio_X509(validation_bio, &mX509IntermediateCert, 0, NULL);
|
|
BIO_free(validation_bio);
|
|
|
|
validation_bio = BIO_new_mem_buf((void*)mPemChildCert.c_str(), mPemChildCert.length());
|
|
PEM_read_bio_X509(validation_bio, &mX509ChildCert, 0, NULL);
|
|
BIO_free(validation_bio);
|
|
}
|
|
~sechandler_basic_test()
|
|
{
|
|
LLFile::remove("test_password.dat");
|
|
LLFile::remove("sechandler_settings.tmp");
|
|
LLFile::remove("mycertstore.pem");
|
|
X509_free(mX509TestCert);
|
|
X509_free(mX509RootCert);
|
|
X509_free(mX509IntermediateCert);
|
|
X509_free(mX509ChildCert);
|
|
}
|
|
};
|
|
|
|
// Tut templating thingamagic: test group, object and test instance
|
|
typedef test_group<sechandler_basic_test> sechandler_basic_test_factory;
|
|
typedef sechandler_basic_test_factory::object sechandler_basic_test_object;
|
|
tut::sechandler_basic_test_factory tut_test("LLSecHandler");
|
|
|
|
// ---------------------------------------------------------------------------------------
|
|
// Test functions
|
|
// ---------------------------------------------------------------------------------------
|
|
// test cert data retrieval
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<1>()
|
|
{
|
|
try
|
|
{
|
|
LLPointer<LLBasicCertificate> test_cert(new LLBasicCertificate(mPemTestCert, &mValidationDate));
|
|
LL_INFOS() << "ok" << LL_ENDL;
|
|
}
|
|
catch (LLCertException& cert_exception)
|
|
{
|
|
LL_INFOS() << "cert ex: " << cert_exception.getCertData() << LL_ENDL;
|
|
fail("cert exception");
|
|
}
|
|
catch (...)
|
|
{
|
|
LOG_UNHANDLED_EXCEPTION("test 1");
|
|
fail("other exception");
|
|
}
|
|
}
|
|
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<2>()
|
|
{
|
|
LLPointer<LLCertificate> test_cert(new LLBasicCertificate(mPemChildCert, &mValidationDate));
|
|
|
|
LLSD llsd_cert;
|
|
test_cert->getLLSD(llsd_cert);
|
|
//std::ostringstream llsd_value;
|
|
//llsd_value << LLSDOStreamer<LLSDNotationFormatter>(llsd_cert) << std::endl;
|
|
LL_DEBUGS() << "test 1 cert " << llsd_cert << LL_ENDL;
|
|
|
|
ensure_equals("Issuer Name/commonName", (std::string)llsd_cert["issuer_name"]["commonName"], "Integration Test Intermediate CA");
|
|
ensure_equals("Issuer Name/countryName", (std::string)llsd_cert["issuer_name"]["countryName"], "US");
|
|
ensure_equals("Issuer Name/state", (std::string)llsd_cert["issuer_name"]["stateOrProvinceName"], "California");
|
|
ensure_equals("Issuer Name/org name", (std::string)llsd_cert["issuer_name"]["organizationName"], "Linden Lab");
|
|
ensure_equals("Issuer Name/org unit", (std::string)llsd_cert["issuer_name"]["organizationalUnitName"], "Second Life Engineering");
|
|
ensure_equals("Issuer name string", (std::string)llsd_cert["issuer_name_string"],
|
|
"emailAddress=noreply@lindenlab.com,CN=Integration Test Intermediate CA,OU=Second Life Engineering,O=Linden Lab,ST=California,C=US");
|
|
ensure_equals("subject Name/commonName", (std::string)llsd_cert["subject_name"]["commonName"],
|
|
"Integration Test Server Cert");
|
|
ensure_equals("subject Name/countryName", (std::string)llsd_cert["subject_name"]["countryName"], "US");
|
|
ensure_equals("subject Name/state", (std::string)llsd_cert["subject_name"]["stateOrProvinceName"], "California");
|
|
ensure_equals("subject Name/localityName", (std::string)llsd_cert["subject_name"]["localityName"], "San Francisco");
|
|
ensure_equals("subject Name/org name", (std::string)llsd_cert["subject_name"]["organizationName"], "Linden Lab");
|
|
ensure_equals("subjectName/org unit",
|
|
(std::string)llsd_cert["subject_name"]["organizationalUnitName"], "Second Life Engineering");
|
|
|
|
ensure_equals("subject name string",
|
|
(std::string)llsd_cert["subject_name_string"],
|
|
"emailAddress=noreply@lindenlab.com,CN=Integration Test Server Cert,OU=Second Life Engineering,O=Linden Lab,L=San Francisco,ST=California,C=US");
|
|
ensure_equals("serial number", (std::string)llsd_cert["serial_number"], "1000");
|
|
ensure_equals("valid from", (std::string)llsd_cert["valid_from"], "2018-05-22T22:58:15Z");
|
|
ensure_equals("valid to", (std::string)llsd_cert["valid_to"], "2024-07-19T22:58:15Z");
|
|
LLSD expectedKeyUsage = LLSD::emptyArray();
|
|
expectedKeyUsage.append(LLSD((std::string)"digitalSignature"));
|
|
expectedKeyUsage.append(LLSD((std::string)"keyEncipherment"));
|
|
ensure("key usage", valueCompareLLSD(llsd_cert["keyUsage"], expectedKeyUsage));
|
|
ensure_equals("basic constraints", llsd_cert["basicConstraints"]["CA"].asInteger(), 0);
|
|
|
|
ensure("x509 is equal", !X509_cmp(mX509ChildCert, test_cert->getOpenSSLX509()));
|
|
}
|
|
|
|
|
|
// test protected data
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<3>()
|
|
{
|
|
std::string protected_data = "sUSh3wj77NG9oAMyt3XIhaej3KLZhLZWFZvI6rIGmwUUOmmelrRg0NI9rkOj8ZDpTPxpwToaBT5u"
|
|
"GQhakdaGLJznr9bHr4/6HIC1bouKj4n2rs4TL6j2WSjto114QdlNfLsE8cbbE+ghww58g8SeyLQO"
|
|
"nyzXoz+/PBz0HD5SMFDuObccoPW24gmqYySz8YoEWhSwO0pUtEEqOjVRsAJgF5wLAtJZDeuilGsq"
|
|
"4ZT9Y4wZ9Rh8nnF3fDUL6IGamHe1ClXM1jgBu10F6UMhZbnH4C3aJ2E9+LiOntU+l3iCb2MpkEpr"
|
|
"82r2ZAMwIrpnirL/xoYoyz7MJQYwUuMvBPToZJrxNSsjI+S2Z+I3iEJAELMAAA==";
|
|
|
|
std::vector<U8> binary_data(apr_base64_decode_len(protected_data.c_str()));
|
|
apr_base64_decode_binary(&binary_data[0], protected_data.c_str());
|
|
|
|
LLXORCipher cipher(gMACAddress, MAC_ADDRESS_BYTES);
|
|
cipher.decrypt(&binary_data[0], 16);
|
|
unsigned char unique_id[MAC_ADDRESS_BYTES];
|
|
LLMachineID::getUniqueID(unique_id, sizeof(unique_id));
|
|
LLXORCipher cipher2(unique_id, sizeof(unique_id));
|
|
cipher2.encrypt(&binary_data[0], 16);
|
|
std::ofstream temp_file("sechandler_settings.tmp", std::ofstream::binary);
|
|
temp_file.write((const char *)&binary_data[0], binary_data.size());
|
|
temp_file.close();
|
|
|
|
LLPointer<LLSecAPIBasicHandler> handler = new LLSecAPIBasicHandler("sechandler_settings.tmp",
|
|
"test_password.dat");
|
|
handler->init();
|
|
// data retrieval for existing data
|
|
LLSD data = handler->getProtectedData("test_data_type", "test_data_id");
|
|
|
|
|
|
ensure_equals("retrieve existing data1", (std::string)data["data1"], "test_data_1");
|
|
ensure_equals("retrieve existing data2", (std::string)data["data2"], "test_data_2");
|
|
ensure_equals("retrieve existing data3", (std::string)data["data3"]["elem1"], "test element1");
|
|
|
|
// data storage
|
|
LLSD store_data = LLSD::emptyMap();
|
|
store_data["store_data1"] = "test_store_data1";
|
|
store_data["store_data2"] = 27;
|
|
store_data["store_data3"] = LLSD::emptyMap();
|
|
store_data["store_data3"]["subelem1"] = "test_subelem1";
|
|
|
|
handler->setProtectedData("test_data_type", "test_data_id1", store_data);
|
|
data = handler->getProtectedData("test_data_type", "test_data_id");
|
|
|
|
data = handler->getProtectedData("test_data_type", "test_data_id");
|
|
// verify no overwrite of existing data
|
|
ensure_equals("verify no overwrite 1", (std::string)data["data1"], "test_data_1");
|
|
ensure_equals("verify no overwrite 2", (std::string)data["data2"], "test_data_2");
|
|
ensure_equals("verify no overwrite 3", (std::string)data["data3"]["elem1"], "test element1");
|
|
|
|
// verify written data is good
|
|
data = handler->getProtectedData("test_data_type", "test_data_id1");
|
|
ensure_equals("verify stored data1", (std::string)data["store_data1"], "test_store_data1");
|
|
ensure_equals("verify stored data2", (int)data["store_data2"], 27);
|
|
ensure_equals("verify stored data3", (std::string)data["store_data3"]["subelem1"], "test_subelem1");
|
|
|
|
// verify overwrite works
|
|
handler->setProtectedData("test_data_type", "test_data_id", store_data);
|
|
data = handler->getProtectedData("test_data_type", "test_data_id");
|
|
ensure_equals("verify overwrite stored data1", (std::string)data["store_data1"], "test_store_data1");
|
|
ensure_equals("verify overwrite stored data2", (int)data["store_data2"], 27);
|
|
ensure_equals("verify overwrite stored data3", (std::string)data["store_data3"]["subelem1"], "test_subelem1");
|
|
|
|
// verify other datatype doesn't conflict
|
|
store_data["store_data3"] = "test_store_data3";
|
|
store_data["store_data4"] = 28;
|
|
store_data["store_data5"] = LLSD::emptyMap();
|
|
store_data["store_data5"]["subelem2"] = "test_subelem2";
|
|
|
|
handler->setProtectedData("test_data_type1", "test_data_id", store_data);
|
|
data = handler->getProtectedData("test_data_type1", "test_data_id");
|
|
ensure_equals("verify datatype stored data3", (std::string)data["store_data3"], "test_store_data3");
|
|
ensure_equals("verify datatype stored data4", (int)data["store_data4"], 28);
|
|
ensure_equals("verify datatype stored data5", (std::string)data["store_data5"]["subelem2"], "test_subelem2");
|
|
|
|
// test data not found
|
|
|
|
data = handler->getProtectedData("test_data_type1", "test_data_not_found");
|
|
ensure("not found", data.isUndefined());
|
|
|
|
// cause a 'write' by using 'LLPointer' to delete then instantiate a handler
|
|
handler = NULL;
|
|
handler = new LLSecAPIBasicHandler("sechandler_settings.tmp", "test_password.dat");
|
|
handler->init();
|
|
|
|
data = handler->getProtectedData("test_data_type1", "test_data_id");
|
|
ensure_equals("verify datatype stored data3a", (std::string)data["store_data3"], "test_store_data3");
|
|
ensure_equals("verify datatype stored data4a", (int)data["store_data4"], 28);
|
|
ensure_equals("verify datatype stored data5a", (std::string)data["store_data5"]["subelem2"], "test_subelem2");
|
|
|
|
// rewrite the initial file to verify reloads
|
|
handler = NULL;
|
|
std::ofstream temp_file2("sechandler_settings.tmp", std::ofstream::binary);
|
|
temp_file2.write((const char *)&binary_data[0], binary_data.size());
|
|
temp_file2.close();
|
|
|
|
// cause a 'write'
|
|
handler = new LLSecAPIBasicHandler("sechandler_settings.tmp", "test_password.dat");
|
|
handler->init();
|
|
data = handler->getProtectedData("test_data_type1", "test_data_id");
|
|
ensure("not found", data.isUndefined());
|
|
|
|
handler->deleteProtectedData("test_data_type", "test_data_id");
|
|
ensure("Deleted data not found", handler->getProtectedData("test_data_type", "test_data_id").isUndefined());
|
|
|
|
LLFile::remove("sechandler_settings.tmp");
|
|
handler = new LLSecAPIBasicHandler("sechandler_settings.tmp", "test_password.dat");
|
|
handler->init();
|
|
data = handler->getProtectedData("test_data_type1", "test_data_id");
|
|
ensure("not found", data.isUndefined());
|
|
handler = NULL;
|
|
|
|
ensure(LLFile::isfile("sechandler_settings.tmp"));
|
|
}
|
|
|
|
// test credenitals
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<4>()
|
|
{
|
|
LLPointer<LLSecAPIBasicHandler> handler = new LLSecAPIBasicHandler("sechandler_settings.tmp", "test_password.dat");
|
|
handler->init();
|
|
|
|
LLSD my_id = LLSD::emptyMap();
|
|
LLSD my_authenticator = LLSD::emptyMap();
|
|
my_id["type"] = "test_type";
|
|
my_id["username"] = "testuser@lindenlab.com";
|
|
my_authenticator["type"] = "test_auth";
|
|
my_authenticator["creds"] = "12345";
|
|
|
|
// test creation of credentials
|
|
LLPointer<LLCredential> my_cred = handler->createCredential("my_grid", my_id, my_authenticator);
|
|
|
|
// test retrieval of credential components
|
|
ensure_equals("basic credential creation: identifier", my_id, my_cred->getIdentifier());
|
|
ensure_equals("basic credential creation: authenticator", my_authenticator, my_cred->getAuthenticator());
|
|
ensure_equals("basic credential creation: grid", "my_grid", my_cred->getGrid());
|
|
|
|
// test setting/overwriting of credential components
|
|
my_id["first_name"] = "firstname";
|
|
my_id.erase("username");
|
|
my_authenticator.erase("creds");
|
|
my_authenticator["hash"] = "6563245";
|
|
|
|
my_cred->setCredentialData(my_id, my_authenticator);
|
|
ensure_equals("set credential data: identifier", my_id, my_cred->getIdentifier());
|
|
ensure_equals("set credential data: authenticator", my_authenticator, my_cred->getAuthenticator());
|
|
ensure_equals("set credential data: grid", "my_grid", my_cred->getGrid());
|
|
|
|
// test loading of a credential, that hasn't been saved, without
|
|
// any legacy saved credential data
|
|
LLPointer<LLCredential> my_new_cred = handler->loadCredential("my_grid2");
|
|
ensure("unknown credential load test", my_new_cred->getIdentifier().isMap());
|
|
ensure("unknown credential load test", !my_new_cred->getIdentifier().has("type"));
|
|
ensure("unknown credential load test", my_new_cred->getAuthenticator().isMap());
|
|
ensure("unknown credential load test", !my_new_cred->getAuthenticator().has("type"));
|
|
// test saving of a credential
|
|
handler->saveCredential(my_cred, true);
|
|
|
|
// test loading of a known credential
|
|
my_new_cred = handler->loadCredential("my_grid");
|
|
ensure_equals("load a known credential: identifier", my_id, my_new_cred->getIdentifier());
|
|
ensure_equals("load a known credential: authenticator",my_authenticator, my_new_cred->getAuthenticator());
|
|
ensure_equals("load a known credential: grid", "my_grid", my_cred->getGrid());
|
|
|
|
// test deletion of a credential
|
|
handler->deleteCredential(my_new_cred);
|
|
|
|
ensure("delete credential: identifier", my_new_cred->getIdentifier().isUndefined());
|
|
ensure("delete credentialt: authenticator", my_new_cred->getIdentifier().isUndefined());
|
|
ensure_equals("delete credential: grid", "my_grid", my_cred->getGrid());
|
|
// load unknown cred
|
|
|
|
my_new_cred = handler->loadCredential("my_grid");
|
|
ensure("deleted credential load test", my_new_cred->getIdentifier().isMap());
|
|
ensure("deleted credential load test", !my_new_cred->getIdentifier().has("type"));
|
|
ensure("deleted credential load test", my_new_cred->getAuthenticator().isMap());
|
|
ensure("deleted credential load test", !my_new_cred->getAuthenticator().has("type"));
|
|
|
|
// test loading of an unknown credential with legacy saved username, but without
|
|
// saved password
|
|
gFirstName = "myfirstname";
|
|
gLastName = "mylastname";
|
|
my_new_cred = handler->loadCredential("my_legacy_grid");
|
|
ensure_equals("legacy credential with no password: type",
|
|
(const std::string)my_new_cred->getIdentifier()["type"], "agent");
|
|
ensure_equals("legacy credential with no password: first_name",
|
|
(const std::string)my_new_cred->getIdentifier()["first_name"], "myfirstname");
|
|
ensure_equals("legacy credential with no password: last_name",
|
|
(const std::string)my_new_cred->getIdentifier()["last_name"], "mylastname");
|
|
|
|
ensure("legacy credential with no password: no authenticator", my_new_cred->getAuthenticator().isUndefined());
|
|
|
|
// test loading of an unknown credential with legacy saved password and username
|
|
|
|
std::string hashed_password = "fSQcLG03eyIWJmkzfyYaKm81dSweLmsxeSAYKGE7fSQ=";
|
|
int length = apr_base64_decode_len(hashed_password.c_str());
|
|
std::vector<char> decoded_password(length);
|
|
apr_base64_decode(&decoded_password[0], hashed_password.c_str());
|
|
LLXORCipher cipher(gMACAddress, MAC_ADDRESS_BYTES);
|
|
cipher.decrypt((U8*)&decoded_password[0], length);
|
|
unsigned char unique_id[MAC_ADDRESS_BYTES];
|
|
LLMachineID::getUniqueID(unique_id, sizeof(unique_id));
|
|
LLXORCipher cipher2(unique_id, sizeof(unique_id));
|
|
cipher2.encrypt((U8*)&decoded_password[0], length);
|
|
llofstream password_file("test_password.dat", std::ofstream::binary);
|
|
password_file.write(&decoded_password[0], length);
|
|
password_file.close();
|
|
|
|
my_new_cred = handler->loadCredential("my_legacy_grid2");
|
|
ensure_equals("legacy credential with password: type",
|
|
(const std::string)my_new_cred->getIdentifier()["type"], "agent");
|
|
ensure_equals("legacy credential with password: first_name",
|
|
(const std::string)my_new_cred->getIdentifier()["first_name"], "myfirstname");
|
|
ensure_equals("legacy credential with password: last_name",
|
|
(const std::string)my_new_cred->getIdentifier()["last_name"], "mylastname");
|
|
|
|
LLSD legacy_authenticator = my_new_cred->getAuthenticator();
|
|
ensure_equals("legacy credential with password: type",
|
|
(std::string)legacy_authenticator["type"],
|
|
"hash");
|
|
ensure_equals("legacy credential with password: algorithm",
|
|
(std::string)legacy_authenticator["algorithm"],
|
|
"md5");
|
|
ensure_equals("legacy credential with password: algorithm",
|
|
(std::string)legacy_authenticator["secret"],
|
|
"01234567890123456789012345678901");
|
|
|
|
// test creation of credentials
|
|
my_cred = handler->createCredential("mysavedgrid", my_id, my_authenticator);
|
|
// test save without saving authenticator.
|
|
handler->saveCredential(my_cred, FALSE);
|
|
my_new_cred = handler->loadCredential("mysavedgrid");
|
|
ensure_equals("saved credential without auth",
|
|
(const std::string)my_new_cred->getIdentifier()["type"], "test_type");
|
|
ensure("no authenticator values were saved", my_new_cred->getAuthenticator().isUndefined());
|
|
}
|
|
|
|
// test cert vector
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<5>()
|
|
{
|
|
// validate create from empty vector
|
|
LLPointer<LLBasicCertificateVector> test_vector = new LLBasicCertificateVector();
|
|
ensure_equals("when loading with nothing, we should result in no certs in vector", test_vector->size(), 0);
|
|
|
|
test_vector->add(new LLBasicCertificate(mPemTestCert, &mValidationDate));
|
|
ensure_equals("one element in vector", test_vector->size(), 1);
|
|
test_vector->add(new LLBasicCertificate(mPemChildCert, &mValidationDate));
|
|
ensure_equals("two elements in vector after add", test_vector->size(), 2);
|
|
|
|
// add duplicate; should be a no-op (and log at DEBUG level)
|
|
test_vector->add(new LLBasicCertificate(mPemChildCert, &mValidationDate));
|
|
ensure_equals("two elements in vector after re-add", test_vector->size(), 2);
|
|
|
|
// validate order
|
|
X509* test_cert = (*test_vector)[0]->getOpenSSLX509();
|
|
ensure("first cert added remains first cert", !X509_cmp(test_cert, mX509TestCert));
|
|
X509_free(test_cert);
|
|
|
|
test_cert = (*test_vector)[1]->getOpenSSLX509();
|
|
ensure("second cert is second cert", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
|
|
//
|
|
// validate iterator
|
|
//
|
|
LLBasicCertificateVector::iterator current_cert = test_vector->begin();
|
|
LLBasicCertificateVector::iterator copy_current_cert = current_cert;
|
|
// operator++(int)
|
|
ensure("validate iterator++ element in vector is expected cert", *current_cert++ == (*test_vector)[0]);
|
|
ensure("validate 2nd iterator++ element in vector is expected cert", *current_cert++ == (*test_vector)[1]);
|
|
ensure("validate end iterator++", current_cert == test_vector->end());
|
|
|
|
// copy
|
|
ensure("validate copy iterator element in vector is expected cert", *copy_current_cert == (*test_vector)[0]);
|
|
|
|
// operator--(int)
|
|
current_cert--;
|
|
ensure("validate iterator-- element in vector is expected cert", *current_cert-- == (*test_vector)[1]);
|
|
ensure("validate iterator-- element in vector is expected cert", *current_cert == (*test_vector)[0]);
|
|
|
|
ensure("begin iterator is equal", current_cert == test_vector->begin());
|
|
|
|
// operator++
|
|
ensure("validate ++iterator element in vector is expected cert", *++current_cert == (*test_vector)[1]);
|
|
ensure("end of cert vector after ++iterator", ++current_cert == test_vector->end());
|
|
// operator--
|
|
ensure("validate --iterator element in vector is expected cert", *--current_cert == (*test_vector)[1]);
|
|
ensure("validate 2nd --iterator element in vector is expected cert", *--current_cert == (*test_vector)[0]);
|
|
|
|
test_vector->erase(test_vector->begin());
|
|
ensure_equals("one element in store after remove", test_vector->size(), 1);
|
|
test_cert = (*test_vector)[0]->getOpenSSLX509();
|
|
ensure("Child cert remains", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
|
|
// validate insert
|
|
test_vector->insert(test_vector->begin(), new LLBasicCertificate(mPemIntermediateCert, &mValidationDate));
|
|
test_cert = (*test_vector)[0]->getOpenSSLX509();
|
|
ensure_equals("two elements in store after insert", test_vector->size(), 2);
|
|
ensure("validate intermediate cert was inserted at first position", !X509_cmp(test_cert, mX509IntermediateCert));
|
|
X509_free(test_cert);
|
|
test_cert = (*test_vector)[1]->getOpenSSLX509();
|
|
ensure("validate child cert still there", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
|
|
//validate find
|
|
LLSD find_info = LLSD::emptyMap();
|
|
find_info["subjectKeyIdentifier"] = "bb:59:9f:de:6b:51:a7:6c:b3:6d:5b:8b:42:f7:b1:65:77:17:a4:e4";
|
|
LLBasicCertificateVector::iterator found_cert = test_vector->find(find_info);
|
|
ensure("found some cert", found_cert != test_vector->end());
|
|
X509* found_x509 = (*found_cert).get()->getOpenSSLX509();
|
|
ensure("child cert was found", !X509_cmp(found_x509, mX509ChildCert));
|
|
X509_free(found_x509);
|
|
|
|
find_info["subjectKeyIdentifier"] = "00:00:00:00"; // bogus
|
|
current_cert =test_vector->find(find_info);
|
|
ensure("didn't find cert", current_cert == test_vector->end());
|
|
}
|
|
|
|
// test cert store
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<6>()
|
|
{
|
|
// validate load with nothing
|
|
LLFile::remove("mycertstore.pem");
|
|
LLPointer<LLBasicCertificateStore> test_store = new LLBasicCertificateStore("mycertstore.pem");
|
|
ensure_equals("when loading with nothing, we should result in no certs in store", test_store->size(), 0);
|
|
|
|
// validate load with empty file
|
|
test_store->save();
|
|
test_store = NULL;
|
|
test_store = new LLBasicCertificateStore("mycertstore.pem");
|
|
ensure_equals("when loading with nothing, we should result in no certs in store", test_store->size(), 0);
|
|
test_store=NULL;
|
|
|
|
// instantiate a cert store from a file
|
|
llofstream certstorefile("mycertstore.pem", std::ios::out);
|
|
certstorefile << mPemChildCert << std::endl << mPemTestCert << std::endl;
|
|
certstorefile.close();
|
|
// validate loaded certs
|
|
test_store = new LLBasicCertificateStore("mycertstore.pem");
|
|
ensure_equals("two elements in store", test_store->size(), 2);
|
|
|
|
// operator[]
|
|
X509* test_cert = (*test_store)[0]->getOpenSSLX509();
|
|
|
|
ensure("validate first element in store is expected cert", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
test_cert = (*test_store)[1]->getOpenSSLX509();
|
|
ensure("validate second element in store is expected cert", !X509_cmp(test_cert, mX509TestCert));
|
|
X509_free(test_cert);
|
|
|
|
|
|
// validate save
|
|
LLFile::remove("mycertstore.pem");
|
|
test_store->save();
|
|
test_store = NULL;
|
|
test_store = new LLBasicCertificateStore("mycertstore.pem");
|
|
ensure_equals("two elements in store after save", test_store->size(), 2);
|
|
LLCertificateStore::iterator current_cert = test_store->begin();
|
|
test_cert = (*current_cert)->getOpenSSLX509();
|
|
ensure("validate first element in store is expected cert", !X509_cmp(test_cert, mX509ChildCert));
|
|
current_cert++;
|
|
X509_free(test_cert);
|
|
test_cert = (*current_cert)->getOpenSSLX509();
|
|
ensure("validate second element in store is expected cert", !X509_cmp(test_cert, mX509TestCert));
|
|
X509_free(test_cert);
|
|
current_cert++;
|
|
ensure("end of cert store", current_cert == test_store->end());
|
|
|
|
}
|
|
|
|
// cert name wildcard matching
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<7>()
|
|
{
|
|
ensure("simple name match",
|
|
_cert_hostname_wildcard_match("foo", "foo"));
|
|
|
|
ensure("simple name match, with end period",
|
|
_cert_hostname_wildcard_match("foo.", "foo."));
|
|
|
|
ensure("simple name match, with begin period",
|
|
_cert_hostname_wildcard_match(".foo", ".foo"));
|
|
|
|
ensure("simple name match, with mismatched period cn",
|
|
_cert_hostname_wildcard_match("foo.", "foo"));
|
|
|
|
ensure("simple name match, with mismatched period hostname",
|
|
_cert_hostname_wildcard_match("foo", "foo."));
|
|
|
|
ensure("simple name match, with subdomain",
|
|
_cert_hostname_wildcard_match("foo.bar", "foo.bar"));
|
|
|
|
ensure("stutter name match",
|
|
_cert_hostname_wildcard_match("foobbbbfoo", "foo*bbbfoo"));
|
|
|
|
ensure("simple name match, with beginning wildcard",
|
|
_cert_hostname_wildcard_match("foobar", "*bar"));
|
|
|
|
ensure("simple name match, with ending wildcard",
|
|
_cert_hostname_wildcard_match("foobar", "foo*"));
|
|
|
|
ensure("simple name match, with beginning null wildcard",
|
|
_cert_hostname_wildcard_match("foobar", "*foobar"));
|
|
|
|
ensure("simple name match, with ending null wildcard",
|
|
_cert_hostname_wildcard_match("foobar", "foobar*"));
|
|
|
|
ensure("simple name match, with embedded wildcard",
|
|
_cert_hostname_wildcard_match("foobar", "f*r"));
|
|
|
|
ensure("simple name match, with embedded null wildcard",
|
|
_cert_hostname_wildcard_match("foobar", "foo*bar"));
|
|
|
|
ensure("simple name match, with dual embedded wildcard",
|
|
_cert_hostname_wildcard_match("foobar", "f*o*ar"));
|
|
|
|
ensure("simple name mismatch",
|
|
!_cert_hostname_wildcard_match("bar", "foo"));
|
|
|
|
ensure("simple name mismatch, with end period",
|
|
!_cert_hostname_wildcard_match("foobar.", "foo."));
|
|
|
|
ensure("simple name mismatch, with begin period",
|
|
!_cert_hostname_wildcard_match(".foobar", ".foo"));
|
|
|
|
ensure("simple name mismatch, with subdomain",
|
|
!_cert_hostname_wildcard_match("foobar.bar", "foo.bar"));
|
|
|
|
ensure("simple name mismatch, with beginning wildcard",
|
|
!_cert_hostname_wildcard_match("foobara", "*bar"));
|
|
|
|
ensure("simple name mismatch, with ending wildcard",
|
|
!_cert_hostname_wildcard_match("oobar", "foo*"));
|
|
|
|
ensure("simple name mismatch, with embedded wildcard",
|
|
!_cert_hostname_wildcard_match("oobar", "f*r"));
|
|
|
|
ensure("simple name mismatch, with dual embedded wildcard",
|
|
!_cert_hostname_wildcard_match("foobar", "f*d*ar"));
|
|
|
|
ensure("simple wildcard",
|
|
_cert_hostname_wildcard_match("foobar", "*"));
|
|
|
|
ensure("long domain",
|
|
_cert_hostname_wildcard_match("foo.bar.com", "foo.bar.com"));
|
|
|
|
ensure("long domain with multiple wildcards",
|
|
_cert_hostname_wildcard_match("foo.bar.com", "*.b*r.com"));
|
|
|
|
ensure("end periods",
|
|
_cert_hostname_wildcard_match("foo.bar.com.", "*.b*r.com."));
|
|
|
|
ensure("match end period",
|
|
_cert_hostname_wildcard_match("foo.bar.com.", "*.b*r.com"));
|
|
|
|
ensure("match end period2",
|
|
_cert_hostname_wildcard_match("foo.bar.com", "*.b*r.com."));
|
|
|
|
ensure("wildcard mismatch",
|
|
!_cert_hostname_wildcard_match("bar.com", "*.bar.com"));
|
|
|
|
ensure("wildcard match",
|
|
_cert_hostname_wildcard_match("foo.bar.com", "*.bar.com"));
|
|
|
|
ensure("wildcard match",
|
|
_cert_hostname_wildcard_match("foo.foo.bar.com", "*.bar.com"));
|
|
|
|
ensure("wildcard match",
|
|
_cert_hostname_wildcard_match("foo.foo.bar.com", "*.*.com"));
|
|
|
|
ensure("wildcard mismatch",
|
|
!_cert_hostname_wildcard_match("foo.foo.bar.com", "*.foo.com"));
|
|
}
|
|
|
|
// test cert chain
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<8>()
|
|
{
|
|
// validate create from empty chain
|
|
LLPointer<LLBasicCertificateChain> test_chain = new LLBasicCertificateChain(NULL);
|
|
ensure_equals("when loading with nothing, we should result in no certs in chain", test_chain->size(), 0);
|
|
|
|
// Single cert in the chain.
|
|
X509_STORE_CTX *test_store = X509_STORE_CTX_new();
|
|
test_store->cert = mX509ChildCert;
|
|
test_store->untrusted = NULL;
|
|
test_chain = new LLBasicCertificateChain(test_store);
|
|
X509_STORE_CTX_free(test_store);
|
|
ensure_equals("two elements in store", test_chain->size(), 1);
|
|
X509* test_cert = (*test_chain)[0]->getOpenSSLX509();
|
|
ensure("validate first element in store is expected cert", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
|
|
// cert + CA
|
|
|
|
test_store = X509_STORE_CTX_new();
|
|
test_store->cert = mX509ChildCert;
|
|
test_store->untrusted = sk_X509_new_null();
|
|
sk_X509_push(test_store->untrusted, mX509IntermediateCert);
|
|
test_chain = new LLBasicCertificateChain(test_store);
|
|
X509_STORE_CTX_free(test_store);
|
|
ensure_equals("two elements in store", test_chain->size(), 2);
|
|
test_cert = (*test_chain)[0]->getOpenSSLX509();
|
|
ensure("validate first element in store is expected cert", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
test_cert = (*test_chain)[1]->getOpenSSLX509();
|
|
ensure("validate second element in store is expected cert", !X509_cmp(test_cert, mX509IntermediateCert));
|
|
X509_free(test_cert);
|
|
|
|
// cert + nonrelated
|
|
|
|
test_store = X509_STORE_CTX_new();
|
|
test_store->cert = mX509ChildCert;
|
|
test_store->untrusted = sk_X509_new_null();
|
|
sk_X509_push(test_store->untrusted, mX509TestCert);
|
|
test_chain = new LLBasicCertificateChain(test_store);
|
|
X509_STORE_CTX_free(test_store);
|
|
ensure_equals("two elements in store", test_chain->size(), 1);
|
|
test_cert = (*test_chain)[0]->getOpenSSLX509();
|
|
ensure("validate first element in store is expected cert", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
|
|
// cert + CA + nonrelated
|
|
test_store = X509_STORE_CTX_new();
|
|
test_store->cert = mX509ChildCert;
|
|
test_store->untrusted = sk_X509_new_null();
|
|
sk_X509_push(test_store->untrusted, mX509IntermediateCert);
|
|
sk_X509_push(test_store->untrusted, mX509TestCert);
|
|
test_chain = new LLBasicCertificateChain(test_store);
|
|
X509_STORE_CTX_free(test_store);
|
|
ensure_equals("two elements in store", test_chain->size(), 2);
|
|
test_cert = (*test_chain)[0]->getOpenSSLX509();
|
|
ensure("validate first element in store is expected cert", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
test_cert = (*test_chain)[1]->getOpenSSLX509();
|
|
ensure("validate second element in store is expected cert", !X509_cmp(test_cert, mX509IntermediateCert));
|
|
X509_free(test_cert);
|
|
|
|
// cert + intermediate + CA
|
|
test_store = X509_STORE_CTX_new();
|
|
test_store->cert = mX509ChildCert;
|
|
test_store->untrusted = sk_X509_new_null();
|
|
sk_X509_push(test_store->untrusted, mX509IntermediateCert);
|
|
sk_X509_push(test_store->untrusted, mX509RootCert);
|
|
test_chain = new LLBasicCertificateChain(test_store);
|
|
X509_STORE_CTX_free(test_store);
|
|
ensure_equals("three elements in store", test_chain->size(), 3);
|
|
test_cert = (*test_chain)[0]->getOpenSSLX509();
|
|
ensure("validate first element in store is expected cert", !X509_cmp(test_cert, mX509ChildCert));
|
|
X509_free(test_cert);
|
|
test_cert = (*test_chain)[1]->getOpenSSLX509();
|
|
ensure("validate second element in store is expected cert", !X509_cmp(test_cert, mX509IntermediateCert));
|
|
X509_free(test_cert);
|
|
|
|
test_cert = (*test_chain)[2]->getOpenSSLX509();
|
|
ensure("validate second element in store is expected cert", !X509_cmp(test_cert, mX509RootCert));
|
|
X509_free(test_cert);
|
|
}
|
|
|
|
// test cert validation
|
|
template<> template<>
|
|
void sechandler_basic_test_object::test<9>()
|
|
{
|
|
// start with a trusted store with our known root cert
|
|
LLFile::remove("mycertstore.pem");
|
|
LLPointer<LLBasicCertificateStore> test_store = new LLBasicCertificateStore("mycertstore.pem");
|
|
test_store->add(new LLBasicCertificate(mX509RootCert, &mValidationDate));
|
|
LLSD validation_params;
|
|
|
|
// validate basic trust for a chain containing only the intermediate cert. (1 deep)
|
|
LLPointer<LLBasicCertificateChain> test_chain = new LLBasicCertificateChain(NULL);
|
|
|
|
test_chain->add(new LLBasicCertificate(mX509IntermediateCert, &mValidationDate));
|
|
|
|
test_store->validate(0, test_chain, validation_params);
|
|
|
|
// add the root certificate to the chain and revalidate
|
|
test_chain->add(new LLBasicCertificate(mX509RootCert, &mValidationDate));
|
|
test_store->validate(0, test_chain, validation_params);
|
|
|
|
// add the child cert at the head of the chain, and revalidate (3 deep chain)
|
|
test_chain->insert(test_chain->begin(), new LLBasicCertificate(mX509ChildCert, &mValidationDate));
|
|
test_store->validate(0, test_chain, validation_params);
|
|
|
|
// basic failure cases
|
|
test_chain = new LLBasicCertificateChain(NULL);
|
|
//validate with only the child cert in chain, but child cert was previously
|
|
// trusted
|
|
test_chain->add(new LLBasicCertificate(mX509ChildCert, &mValidationDate));
|
|
|
|
// validate without the trust flag.
|
|
test_store->validate(VALIDATION_POLICY_TRUSTED, test_chain, validation_params);
|
|
|
|
// Validate with child cert but no parent, and no parent in CA store
|
|
test_store = new LLBasicCertificateStore("mycertstore.pem");
|
|
ensure_throws("no CA, with only a child cert",
|
|
LLCertValidationTrustException,
|
|
(*test_chain)[0],
|
|
test_store->validate,
|
|
VALIDATION_POLICY_TRUSTED,
|
|
test_chain,
|
|
validation_params);
|
|
|
|
|
|
// validate without the trust flag.
|
|
test_store->validate(0, test_chain, validation_params);
|
|
|
|
// clear out the store
|
|
test_store = new LLBasicCertificateStore("mycertstore.pem");
|
|
// append the intermediate cert
|
|
test_chain->add(new LLBasicCertificate(mX509IntermediateCert, &mValidationDate));
|
|
ensure_throws("no CA, with child and intermediate certs",
|
|
LLCertValidationTrustException,
|
|
(*test_chain)[1],
|
|
test_store->validate,
|
|
VALIDATION_POLICY_TRUSTED | VALIDATION_POLICY_TRUSTED,
|
|
test_chain,
|
|
validation_params);
|
|
// validate without the trust flag
|
|
test_store->validate(0, test_chain, validation_params);
|
|
|
|
// Test time validity
|
|
LLSD child_info;
|
|
((*test_chain)[0])->getLLSD(child_info);
|
|
validation_params = LLSD::emptyMap();
|
|
validation_params[CERT_VALIDATION_DATE] = LLDate(child_info[CERT_VALID_FROM].asDate().secondsSinceEpoch() + 1.0);
|
|
test_store->validate(VALIDATION_POLICY_TIME | VALIDATION_POLICY_TRUSTED,
|
|
test_chain, validation_params);
|
|
|
|
validation_params = LLSD::emptyMap();
|
|
validation_params[CERT_VALIDATION_DATE] = child_info[CERT_VALID_FROM].asDate();
|
|
|
|
validation_params[CERT_VALIDATION_DATE] = LLDate(child_info[CERT_VALID_FROM].asDate().secondsSinceEpoch() - 1.0);
|
|
|
|
// test not yet valid
|
|
ensure_throws("Child cert not yet valid" ,
|
|
LLCertValidationExpirationException,
|
|
(*test_chain)[0],
|
|
test_store->validate,
|
|
VALIDATION_POLICY_TIME | VALIDATION_POLICY_TRUSTED,
|
|
test_chain,
|
|
validation_params);
|
|
validation_params = LLSD::emptyMap();
|
|
validation_params[CERT_VALIDATION_DATE] = LLDate(child_info[CERT_VALID_TO].asDate().secondsSinceEpoch() + 1.0);
|
|
|
|
// test cert expired
|
|
ensure_throws("Child cert expired",
|
|
LLCertValidationExpirationException,
|
|
(*test_chain)[0],
|
|
test_store->validate,
|
|
VALIDATION_POLICY_TIME | VALIDATION_POLICY_TRUSTED,
|
|
test_chain,
|
|
validation_params);
|
|
|
|
// test SSL KU
|
|
// validate basic trust for a chain containing child and intermediate.
|
|
test_chain = new LLBasicCertificateChain(NULL);
|
|
test_chain->add(new LLBasicCertificate(mX509ChildCert, &mValidationDate));
|
|
test_chain->add(new LLBasicCertificate(mX509IntermediateCert, &mValidationDate));
|
|
test_store->validate(VALIDATION_POLICY_SSL_KU | VALIDATION_POLICY_TRUSTED,
|
|
test_chain, validation_params);
|
|
|
|
test_chain = new LLBasicCertificateChain(NULL);
|
|
test_chain->add(new LLBasicCertificate(mX509TestCert, &mValidationDate));
|
|
|
|
test_store = new LLBasicCertificateStore("mycertstore.pem");
|
|
ensure_throws("Cert doesn't have ku",
|
|
LLCertKeyUsageValidationException,
|
|
(*test_chain)[0],
|
|
test_store->validate,
|
|
VALIDATION_POLICY_SSL_KU | VALIDATION_POLICY_TRUSTED,
|
|
test_chain,
|
|
validation_params);
|
|
|
|
test_store->validate(0, test_chain, validation_params);
|
|
}
|
|
|
|
};
|
|
|