diff options
Diffstat (limited to 'security/manager/ssl/tests')
33 files changed, 361 insertions, 164 deletions
diff --git a/security/manager/ssl/tests/mochitest/browser/browser_add_exception_dialog.js b/security/manager/ssl/tests/mochitest/browser/browser_add_exception_dialog.js index 0916ac5ce4..fa8a887753 100644 --- a/security/manager/ssl/tests/mochitest/browser/browser_add_exception_dialog.js +++ b/security/manager/ssl/tests/mochitest/browser/browser_add_exception_dialog.js @@ -20,7 +20,7 @@ function test() { function testAddCertificate() { win.removeEventListener("load", testAddCertificate); - Services.obs.addObserver(async function onCertUI(aSubject, aTopic, aData) { + Services.obs.addObserver(async function onCertUI() { Services.obs.removeObserver(onCertUI, "cert-exception-ui-ready"); ok(win.gCert, "The certificate information should be available now"); diff --git a/security/manager/ssl/tests/mochitest/browser/browser_deleteCert_ui.js b/security/manager/ssl/tests/mochitest/browser/browser_deleteCert_ui.js index a8ff7cc8fb..7e8fa034ff 100644 --- a/security/manager/ssl/tests/mochitest/browser/browser_deleteCert_ui.js +++ b/security/manager/ssl/tests/mochitest/browser/browser_deleteCert_ui.js @@ -92,7 +92,7 @@ function openDeleteCertConfirmDialog(tabID) { gCertArray, retVals ); - return new Promise((resolve, reject) => { + return new Promise(resolve => { win.addEventListener( "load", function () { diff --git a/security/manager/ssl/tests/mochitest/browser/browser_downloadCert_ui.js b/security/manager/ssl/tests/mochitest/browser/browser_downloadCert_ui.js index 51715b1352..c01ed84122 100644 --- a/security/manager/ssl/tests/mochitest/browser/browser_downloadCert_ui.js +++ b/security/manager/ssl/tests/mochitest/browser/browser_downloadCert_ui.js @@ -56,7 +56,7 @@ function openCertDownloadDialog(cert) { cert, returnVals ); - return new Promise((resolve, reject) => { + return new Promise(resolve => { win.addEventListener( "load", function () { diff --git a/security/manager/ssl/tests/mochitest/browser/browser_editCACertTrust.js b/security/manager/ssl/tests/mochitest/browser/browser_editCACertTrust.js index 9a36eca7bf..5743e01f6f 100644 --- a/security/manager/ssl/tests/mochitest/browser/browser_editCACertTrust.js +++ b/security/manager/ssl/tests/mochitest/browser/browser_editCACertTrust.js @@ -31,7 +31,7 @@ function openEditCertTrustDialog() { "", gCert ); - return new Promise((resolve, reject) => { + return new Promise(resolve => { win.addEventListener( "load", function () { diff --git a/security/manager/ssl/tests/mochitest/browser/browser_exportP12_passwordUI.js b/security/manager/ssl/tests/mochitest/browser/browser_exportP12_passwordUI.js index 8e6af27cbb..dc3b754531 100644 --- a/security/manager/ssl/tests/mochitest/browser/browser_exportP12_passwordUI.js +++ b/security/manager/ssl/tests/mochitest/browser/browser_exportP12_passwordUI.js @@ -73,7 +73,7 @@ function openSetP12PasswordDialog() { "", returnVals ); - return new Promise((resolve, reject) => { + return new Promise(resolve => { win.addEventListener( "load", function () { diff --git a/security/manager/ssl/tests/mochitest/browser/browser_loadPKCS11Module_ui.js b/security/manager/ssl/tests/mochitest/browser/browser_loadPKCS11Module_ui.js index 9e4e244123..4b7b78df8d 100644 --- a/security/manager/ssl/tests/mochitest/browser/browser_loadPKCS11Module_ui.js +++ b/security/manager/ssl/tests/mochitest/browser/browser_loadPKCS11Module_ui.js @@ -38,7 +38,7 @@ const gMockPKCS11ModuleDB = { } }, - deleteModule(moduleName) { + deleteModule() { Assert.ok(false, `deleteModule: should not be called`); }, @@ -102,7 +102,7 @@ var gMockPromptServiceCID = MockRegistrar.register( ); var gMockFilePicker = SpecialPowers.MockFilePicker; -gMockFilePicker.init(window); +gMockFilePicker.init(window.browsingContext); var gTempFile = Services.dirsvc.get("TmpD", Ci.nsIFile); gTempFile.append("browser_loadPKCS11Module_ui-fakeModule"); diff --git a/security/manager/ssl/tests/mochitest/browser/head.js b/security/manager/ssl/tests/mochitest/browser/head.js index 1ae951d7a5..f64e2afc6e 100644 --- a/security/manager/ssl/tests/mochitest/browser/head.js +++ b/security/manager/ssl/tests/mochitest/browser/head.js @@ -70,7 +70,7 @@ function readCertificate(filename, trustString) { */ async function openCertManager() { let win = window.openDialog("chrome://pippki/content/certManager.xhtml"); - return new Promise((resolve, reject) => { + return new Promise(resolve => { win.addEventListener( "load", function () { diff --git a/security/manager/ssl/tests/mochitest/mixedcontent/mochitest.toml b/security/manager/ssl/tests/mochitest/mixedcontent/mochitest.toml index 1a37ba6f38..4935021410 100644 --- a/security/manager/ssl/tests/mochitest/mixedcontent/mochitest.toml +++ b/security/manager/ssl/tests/mochitest/mixedcontent/mochitest.toml @@ -7,6 +7,7 @@ skip-if = [ prefs = [ "security.mixed_content.upgrade_display_content=false", "dom.security.https_first=false", + "dom.block_download_insecure=false", ] support-files = [ "alloworigin.sjs", diff --git a/security/manager/ssl/tests/unit/head_psm.js b/security/manager/ssl/tests/unit/head_psm.js index d34c7fdc1d..5667d2e020 100644 --- a/security/manager/ssl/tests/unit/head_psm.js +++ b/security/manager/ssl/tests/unit/head_psm.js @@ -300,7 +300,7 @@ function checkCertErrorGenericAtTime( /* optional */ hostname, /* optional */ flags = NO_FLAGS ) { - return new Promise((resolve, reject) => { + return new Promise(resolve => { let result = new CertVerificationExpectedErrorResult( cert.commonName, expectedError, @@ -570,7 +570,7 @@ async function asyncConnectTo( Connection.prototype = { // nsITransportEventSink - onTransportStatus(aTransport, aStatus, aProgress, aProgressMax) { + onTransportStatus(aTransport, aStatus) { if ( !this.connected && aStatus == Ci.nsISocketTransport.STATUS_CONNECTED_TO @@ -596,7 +596,7 @@ async function asyncConnectTo( }, // nsIOutputStreamCallback - onOutputStreamReady(aStream) { + onOutputStreamReady() { if (aAfterStreamOpen) { aAfterStreamOpen(this.transport); } @@ -774,7 +774,7 @@ function generateOCSPResponses(ocspRespArray, nssDBlocation) { // serverIdentities. function getFailingHttpServer(serverPort, serverIdentities) { let httpServer = new HttpServer(); - httpServer.registerPrefixHandler("/", function (request, response) { + httpServer.registerPrefixHandler("/", function () { Assert.ok(false, "HTTP responder should not have been queried"); }); httpServer.identity.setPrimary("http", serverIdentities.shift(), serverPort); @@ -902,7 +902,7 @@ function startOCSPResponder( // Given an OCSP responder (see startOCSPResponder), returns a promise that // resolves when the responder has successfully stopped. function stopOCSPResponder(responder) { - return new Promise((resolve, reject) => { + return new Promise(resolve => { responder.stop(resolve); }); } @@ -977,7 +977,7 @@ class CertVerificationResult { this.resolve = resolve; } - verifyCertFinished(aPRErrorCode, aVerifiedChain, aHasEVPolicy) { + verifyCertFinished(aPRErrorCode) { if (this.successExpected) { equal( aPRErrorCode, @@ -1017,7 +1017,7 @@ function asyncTestCertificateUsages(certdb, cert, expectedUsages) { let now = new Date().getTime() / 1000; let promises = []; Object.keys(allCertificateUsages).forEach(usageString => { - let promise = new Promise((resolve, reject) => { + let promise = new Promise(resolve => { let usage = allCertificateUsages[usageString]; let successExpected = expectedUsages.includes(usage); let result = new CertVerificationResult( diff --git a/security/manager/ssl/tests/unit/test_certDB_export_pkcs12_with_primary_password.js b/security/manager/ssl/tests/unit/test_certDB_export_pkcs12_with_primary_password.js index 25f4ab58bf..471330302f 100644 --- a/security/manager/ssl/tests/unit/test_certDB_export_pkcs12_with_primary_password.js +++ b/security/manager/ssl/tests/unit/test_certDB_export_pkcs12_with_primary_password.js @@ -30,7 +30,7 @@ var gPrompt = { ok(false, "not expecting alert() to be called"); }, - promptPassword(dialogTitle, text, password, checkMsg, checkValue) { + promptPassword(dialogTitle, text, password, checkMsg) { equal( text, "Please enter your Primary Password.", @@ -44,7 +44,7 @@ var gPrompt = { const gPromptFactory = { QueryInterface: ChromeUtils.generateQI(["nsIPromptFactory"]), - getPrompt: (aWindow, aIID) => gPrompt, + getPrompt: () => gPrompt, }; function findCertByCommonName(commonName) { diff --git a/security/manager/ssl/tests/unit/test_certDB_import.js b/security/manager/ssl/tests/unit/test_certDB_import.js index 86c66f4989..f91a7b750f 100644 --- a/security/manager/ssl/tests/unit/test_certDB_import.js +++ b/security/manager/ssl/tests/unit/test_certDB_import.js @@ -28,11 +28,11 @@ const gCertificateDialogs = { trust.value = Ci.nsIX509CertDB.TRUSTED_EMAIL; return true; }, - setPKCS12FilePassword: (ctx, password) => { + setPKCS12FilePassword: () => { // This is only relevant to exporting. ok(false, "setPKCS12FilePassword() should not have been called"); }, - getPKCS12FilePassword: (ctx, password) => { + getPKCS12FilePassword: () => { // We don't test anything that calls this method yet. ok(false, "getPKCS12FilePassword() should not have been called"); }, diff --git a/security/manager/ssl/tests/unit/test_certDB_import_with_primary_password.js b/security/manager/ssl/tests/unit/test_certDB_import_with_primary_password.js index ab1ad36fd2..07e360fffd 100644 --- a/security/manager/ssl/tests/unit/test_certDB_import_with_primary_password.js +++ b/security/manager/ssl/tests/unit/test_certDB_import_with_primary_password.js @@ -28,11 +28,11 @@ const gCertificateDialogs = { trust.value = Ci.nsIX509CertDB.TRUSTED_EMAIL; return true; }, - setPKCS12FilePassword: (ctx, password) => { + setPKCS12FilePassword: () => { // This is only relevant to exporting. ok(false, "setPKCS12FilePassword() should not have been called"); }, - getPKCS12FilePassword: (ctx, password) => { + getPKCS12FilePassword: () => { // We don't test anything that calls this method yet. ok(false, "getPKCS12FilePassword() should not have been called"); }, @@ -47,7 +47,7 @@ var gMockPrompter = { // This intentionally does not use arrow function syntax to avoid an issue // where in the context of the arrow function, |this != gMockPrompter| due to // how objects get wrapped when going across xpcom boundaries. - promptPassword(dialogTitle, text, password, checkMsg, checkValue) { + promptPassword(dialogTitle, text, password, checkMsg) { this.numPrompts++; if (this.numPrompts > 1) { // don't keep retrying a bad password diff --git a/security/manager/ssl/tests/unit/test_cert_dbKey.js b/security/manager/ssl/tests/unit/test_cert_dbKey.js index 3ff36f905c..4f729b037e 100644 --- a/security/manager/ssl/tests/unit/test_cert_dbKey.js +++ b/security/manager/ssl/tests/unit/test_cert_dbKey.js @@ -34,8 +34,9 @@ function encodeCommonNameAsBytes(commonName) { // SEQUENCE must be 127. Everything not in the contents of the common name // will take up 11 bytes, so the value of the common name itself can be at // most 116 bytes. - ok( - commonName.length <= 116, + Assert.lessOrEqual( + commonName.length, + 116, "test assumption: common name can't be longer than 116 bytes (makes " + "DER encoding easier)" ); @@ -88,13 +89,15 @@ function run_test() { "consists only of a common name" ); let issuerBytes = encodeCommonNameAsBytes(cert.issuerCommonName); - ok( - issuerBytes.length < 256, + Assert.less( + issuerBytes.length, + 256, "test assumption: length of encoded issuer is less than 256 bytes" ); let serialNumberBytes = hexStringToBytes(cert.serialNumber); - ok( - serialNumberBytes.length < 256, + Assert.less( + serialNumberBytes.length, + 256, "test assumption: length of encoded serial number is less than 256 bytes" ); let dbKeyHeader = [ @@ -129,13 +132,15 @@ function run_test() { "nsIX509CertDB.findCertByDBKey should find the right certificate" ); - ok( - expectedDbKey.length > 64, + Assert.greater( + expectedDbKey.length, + 64, "test assumption: dbKey should be longer than 64 characters" ); let expectedDbKeyWithCRLF = expectedDbKey.replace(/(.{64})/, "$1\r\n"); - ok( - expectedDbKeyWithCRLF.indexOf("\r\n") == 64, + Assert.equal( + expectedDbKeyWithCRLF.indexOf("\r\n"), + 64, "test self-check: adding CRLF to dbKey should succeed" ); certFromDbKey = certDB.findCertByDBKey(expectedDbKeyWithCRLF); @@ -145,8 +150,9 @@ function run_test() { ); let expectedDbKeyWithSpaces = expectedDbKey.replace(/(.{64})/, "$1 "); - ok( - expectedDbKeyWithSpaces.indexOf(" ") == 64, + Assert.equal( + expectedDbKeyWithSpaces.indexOf(" "), + 64, "test self-check: adding spaces to dbKey should succeed" ); certFromDbKey = certDB.findCertByDBKey(expectedDbKeyWithSpaces); diff --git a/security/manager/ssl/tests/unit/test_cert_utf8.js b/security/manager/ssl/tests/unit/test_cert_utf8.js index caeddd8158..82677237a3 100644 --- a/security/manager/ssl/tests/unit/test_cert_utf8.js +++ b/security/manager/ssl/tests/unit/test_cert_utf8.js @@ -60,8 +60,9 @@ function testUTF8InField(field, replacementPrefix, certificateBytesToAlter) { let uniqueIssuerReplacement = "ALWAYS MAKE ME UNIQU" + String.fromCharCode(gUniqueIssuerCounter); bytes = bytes.replace("ALWAYS MAKE ME UNIQUE", uniqueIssuerReplacement); - ok( - gUniqueIssuerCounter < 127, + Assert.less( + gUniqueIssuerCounter, + 127, "should have enough ASCII replacements to make a unique issuer DN" ); gUniqueIssuerCounter++; diff --git a/security/manager/ssl/tests/unit/test_ev_certs.js b/security/manager/ssl/tests/unit/test_ev_certs.js index f163623919..99b5bda0f0 100644 --- a/security/manager/ssl/tests/unit/test_ev_certs.js +++ b/security/manager/ssl/tests/unit/test_ev_certs.js @@ -84,7 +84,7 @@ function asyncTestEV( ocspResponseTypes = undefined ) { let now = Date.now() / 1000; - return new Promise((resolve, reject) => { + return new Promise(resolve => { let ocspResponder = expectedOCSPRequestPaths.length ? startOCSPResponder( SERVER_PORT, @@ -157,7 +157,7 @@ function verifyWithFlags_LOCAL_ONLY_and_MUST_BE_EV(testcase, expectSuccess) { if (expectSuccess && gEVExpected) { expectedErrorCode = PRErrorCodeSuccess; } - return new Promise((resolve, reject) => { + return new Promise(resolve => { let ocspResponder = failingOCSPResponder(); let result = new EVCertVerificationResult( cert.subjectName, diff --git a/security/manager/ssl/tests/unit/test_faulty_server.js b/security/manager/ssl/tests/unit/test_faulty_server.js index 7536a91104..f617908e28 100644 --- a/security/manager/ssl/tests/unit/test_faulty_server.js +++ b/security/manager/ssl/tests/unit/test_faulty_server.js @@ -13,7 +13,7 @@ var httpServer = null; let handlerCallbacks = {}; -function listenHandler(metadata, response) { +function listenHandler(metadata) { info(metadata.path); handlerCallbacks[metadata.path] = (handlerCallbacks[metadata.path] || 0) + 1; } diff --git a/security/manager/ssl/tests/unit/test_logoutAndTeardown.js b/security/manager/ssl/tests/unit/test_logoutAndTeardown.js index 1582978398..531b1acb22 100644 --- a/security/manager/ssl/tests/unit/test_logoutAndTeardown.js +++ b/security/manager/ssl/tests/unit/test_logoutAndTeardown.js @@ -163,7 +163,7 @@ function storeCertOverride(port, cert) { function startClient(port) { let req = new XMLHttpRequest(); req.open("GET", `https://${hostname}:${port}`); - return new Promise((resolve, reject) => { + return new Promise(resolve => { req.onload = () => { ok(false, "should not have gotten load event"); resolve(); diff --git a/security/manager/ssl/tests/unit/test_ocsp_private_caching.js b/security/manager/ssl/tests/unit/test_ocsp_private_caching.js index 47b976cf71..3a56118bdf 100644 --- a/security/manager/ssl/tests/unit/test_ocsp_private_caching.js +++ b/security/manager/ssl/tests/unit/test_ocsp_private_caching.js @@ -74,16 +74,7 @@ function add_ocsp_necko_cache_test(loadContext) { let foundEntry = false; let visitor = { onCacheStorageInfo() {}, - onCacheEntryInfo( - aURI, - aIdEnhance, - aDataSize, - aFetchCount, - aLastModifiedTime, - aExpirationTime, - aPinned, - aInfo - ) { + onCacheEntryInfo(aURI) { Assert.equal( aURI.spec, "http://localhost:8888/", diff --git a/security/manager/ssl/tests/unit/test_ocsp_timeout.js b/security/manager/ssl/tests/unit/test_ocsp_timeout.js index 8d606bc028..5d3487bfe7 100644 --- a/security/manager/ssl/tests/unit/test_ocsp_timeout.js +++ b/security/manager/ssl/tests/unit/test_ocsp_timeout.js @@ -21,7 +21,7 @@ var gSocketListener = { socketTransport.setTimeout(Ci.nsISocketTransport.TIMEOUT_READ_WRITE, 30); }, - onStopListening(serverSocket, status) {}, + onStopListening() {}, }; function run_test() { @@ -77,8 +77,9 @@ function add_one_test(useHardFail, timeoutPrefName, timeoutMilliseconds) { // prevent intermittent failures (this only appeared to be a problem on // Windows XP). See Bug 1121117. const FUZZ_MS = 300; - ok( - timeDifference + FUZZ_MS > timeoutMilliseconds, + Assert.greater( + timeDifference + FUZZ_MS, + timeoutMilliseconds, `OCSP timeout should be ~${timeoutMilliseconds}s for ` + `${useHardFail ? "hard" : "soft"}-fail` ); @@ -86,8 +87,9 @@ function add_one_test(useHardFail, timeoutPrefName, timeoutMilliseconds) { // (Unfortunately, we probably can't have a tight upper bound on // how long is too long for this test, because we might be running // on slow hardware.) - ok( - timeDifference < 60000, + Assert.less( + timeDifference, + 60000, "Automatic OCSP timeout shouldn't be more than 60s" ); diff --git a/security/manager/ssl/tests/unit/test_oskeystore.js b/security/manager/ssl/tests/unit/test_oskeystore.js index fcc9de6c59..9efcaa69a6 100644 --- a/security/manager/ssl/tests/unit/test_oskeystore.js +++ b/security/manager/ssl/tests/unit/test_oskeystore.js @@ -51,8 +51,9 @@ async function encrypt_decrypt_test() { // Decrypting should give us the plaintext bytes again. try { let plaintext = await keystore.asyncDecryptBytes(LABELS[0], ciphertext); - ok( - plaintext.toString() == text.toString(), + Assert.equal( + plaintext.toString(), + text.toString(), "Decrypted plaintext should be the same as text." ); } catch (e) { @@ -102,8 +103,9 @@ add_task(async function () { await keystore.asyncRecoverSecret(LABELS[0], recoveryPhrase); let plaintext = await keystore.asyncDecryptBytes(LABELS[0], ciphertext); - ok( - plaintext.toString() == text.toString(), + Assert.equal( + plaintext.toString(), + text.toString(), "Decrypted plaintext should be the same as text." ); @@ -166,8 +168,9 @@ add_task(async function () { await keystore.asyncRecoverSecret(LABELS[0], recoveryPhrase); let plaintext = await keystore.asyncDecryptBytes(LABELS[0], ciphertext); - ok( - plaintext.toString() == text.toString(), + Assert.equal( + plaintext.toString(), + text.toString(), "Decrypted plaintext should be the same as text (once we have the original key again)." ); @@ -204,8 +207,9 @@ add_task(async function () { await keystore.asyncRecoverSecret(LABELS[0], newRecoveryPhrase); let plaintext = await keystore.asyncDecryptBytes(LABELS[0], ciphertext); - ok( - plaintext.toString() == text.toString(), + Assert.equal( + plaintext.toString(), + text.toString(), "Decrypted plaintext should be the same as text (once we have the new key again)." ); diff --git a/security/manager/ssl/tests/unit/test_osreauthenticator.js b/security/manager/ssl/tests/unit/test_osreauthenticator.js index 01784a5fef..55d9710c0d 100644 --- a/security/manager/ssl/tests/unit/test_osreauthenticator.js +++ b/security/manager/ssl/tests/unit/test_osreauthenticator.js @@ -13,14 +13,15 @@ add_task(async function test_asyncReauthenticateUser() { ].getService(Ci.nsIOSReauthenticator); ok(reauthenticator, "nsIOSReauthenticator should be available"); const EXPECTED = false; // Change this variable to suit your needs while testing. - ok( + Assert.equal( ( await reauthenticator.asyncReauthenticateUser( "this is the prompt string", "this is the caption string", null ) - )[0] == EXPECTED, + )[0], + EXPECTED, "nsIOSReauthenticator.asyncReauthenticateUser should return a boolean array with the first item being the authentication result of: " + EXPECTED ); diff --git a/security/manager/ssl/tests/unit/test_password_prompt.js b/security/manager/ssl/tests/unit/test_password_prompt.js index cf4c6db7bf..a88dd67703 100644 --- a/security/manager/ssl/tests/unit/test_password_prompt.js +++ b/security/manager/ssl/tests/unit/test_password_prompt.js @@ -16,7 +16,7 @@ var gMockPrompter = { // This intentionally does not use arrow function syntax to avoid an issue // where in the context of the arrow function, |this != gMockPrompter| due to // how objects get wrapped when going across xpcom boundaries. - promptPassword(dialogTitle, text, password, checkMsg, checkValue) { + promptPassword(dialogTitle, text, password, checkMsg) { this.numPrompts++; if (this.numPrompts > 1) { // don't keep retrying a bad password diff --git a/security/manager/ssl/tests/unit/test_pkcs11_slot.js b/security/manager/ssl/tests/unit/test_pkcs11_slot.js index dba2a4d3a1..f04c296f9b 100644 --- a/security/manager/ssl/tests/unit/test_pkcs11_slot.js +++ b/security/manager/ssl/tests/unit/test_pkcs11_slot.js @@ -44,7 +44,7 @@ var gPrompt = { const gPromptFactory = { QueryInterface: ChromeUtils.generateQI(["nsIPromptFactory"]), - getPrompt: (aWindow, aIID) => gPrompt, + getPrompt: () => gPrompt, }; function run_test() { diff --git a/security/manager/ssl/tests/unit/test_sdr.js b/security/manager/ssl/tests/unit/test_sdr.js index e9e477efc5..73c2219fc6 100644 --- a/security/manager/ssl/tests/unit/test_sdr.js +++ b/security/manager/ssl/tests/unit/test_sdr.js @@ -22,7 +22,7 @@ const gTokenPasswordDialogs = { }; let gMockPrompter = { - promptPassword(dialogTitle, text, password, checkMsg, checkValue) { + promptPassword() { // Returning false simulates the user canceling the password prompt. return false; }, diff --git a/security/manager/ssl/tests/unit/test_sdr_preexisting_with_password.js b/security/manager/ssl/tests/unit/test_sdr_preexisting_with_password.js index 5c1b2bb653..fa2b536036 100644 --- a/security/manager/ssl/tests/unit/test_sdr_preexisting_with_password.js +++ b/security/manager/ssl/tests/unit/test_sdr_preexisting_with_password.js @@ -17,7 +17,7 @@ var gMockPrompter = { // This intentionally does not use arrow function syntax to avoid an issue // where in the context of the arrow function, |this != gMockPrompter| due to // how objects get wrapped when going across xpcom boundaries. - promptPassword(dialogTitle, text, password, checkMsg, checkValue) { + promptPassword(dialogTitle, text, password, checkMsg) { this.numPrompts++; if (this.numPrompts > 1) { // don't keep retrying a bad password diff --git a/security/manager/ssl/tests/unit/test_self_signed_certs.js b/security/manager/ssl/tests/unit/test_self_signed_certs.js index ef0a38f9bc..2500ea38a5 100644 --- a/security/manager/ssl/tests/unit/test_self_signed_certs.js +++ b/security/manager/ssl/tests/unit/test_self_signed_certs.js @@ -65,7 +65,7 @@ add_task(async function test_no_overlong_path_building() { } let timeAfter = Date.now(); let secondsElapsed = (timeAfter - timeBefore) / 1000; - ok(secondsElapsed < 120, "verifications shouldn't take too long"); + Assert.less(secondsElapsed, 120, "verifications shouldn't take too long"); }); add_task(async function test_no_bad_signature() { diff --git a/security/manager/ssl/tests/unit/test_signed_apps.js b/security/manager/ssl/tests/unit/test_signed_apps.js index 4893bfd714..3ec35a8608 100644 --- a/security/manager/ssl/tests/unit/test_signed_apps.js +++ b/security/manager/ssl/tests/unit/test_signed_apps.js @@ -96,7 +96,7 @@ function tamper(inFilePath, outFilePath, modifications, newEntries) { } } -function removeEntry(entry, entryInput) { +function removeEntry() { return [null, null]; } @@ -116,8 +116,8 @@ function truncateEntry(entry, entryInput) { return [entry, content]; } -function check_open_result(name, expectedRv) { - return function openSignedAppFileCallback(rv, aZipReader, aSignerCert) { +function check_open_result(name, expectedRv, expectedSignatureAlgorithms) { + return function openSignedAppFileCallback(rv, aZipReader, aSignatureInfos) { info("openSignedAppFileCallback called for " + name); equal(rv, expectedRv, "Actual and expected return value should match"); equal( @@ -126,10 +126,17 @@ function check_open_result(name, expectedRv) { "ZIP reader should be null only if the return value denotes failure" ); equal( - aSignerCert != null, - Components.isSuccessCode(expectedRv), - "Signer cert should be null only if the return value denotes failure" + aSignatureInfos.length, + expectedSignatureAlgorithms.length, + "Should have the same number of expected signature infos" ); + for (let i = 0; i < expectedSignatureAlgorithms.length; i++) { + equal( + aSignatureInfos[i].signatureAlgorithm, + expectedSignatureAlgorithms[i], + "Should have expected signature algorithm" + ); + } run_next_test(); }; } @@ -149,89 +156,152 @@ function tampered_app_path(test_name) { var hashTestcases = [ // SHA-256 in PKCS#7 + SHA-256 present elsewhere => OK - { name: "app_mf-1-256_sf-1-256_p7-1-256", expectedResult: Cr.NS_OK }, - { name: "app_mf-1-256_sf-1-256_p7-256", expectedResult: Cr.NS_OK }, - { name: "app_mf-1-256_sf-256_p7-1-256", expectedResult: Cr.NS_OK }, - { name: "app_mf-1-256_sf-256_p7-256", expectedResult: Cr.NS_OK }, - { name: "app_mf-256_sf-1-256_p7-1-256", expectedResult: Cr.NS_OK }, - { name: "app_mf-256_sf-1-256_p7-256", expectedResult: Cr.NS_OK }, - { name: "app_mf-256_sf-256_p7-1-256", expectedResult: Cr.NS_OK }, - { name: "app_mf-256_sf-256_p7-256", expectedResult: Cr.NS_OK }, + { + name: "app_mf-1-256_sf-1-256_p7-1-256", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256], + }, + { + name: "app_mf-1-256_sf-1-256_p7-256", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256], + }, + { + name: "app_mf-1-256_sf-256_p7-1-256", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256], + }, + { + name: "app_mf-1-256_sf-256_p7-256", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256], + }, + { + name: "app_mf-256_sf-1-256_p7-1-256", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256], + }, + { + name: "app_mf-256_sf-1-256_p7-256", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256], + }, + { + name: "app_mf-256_sf-256_p7-1-256", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256], + }, + { + name: "app_mf-256_sf-256_p7-256", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256], + }, // SHA-1 in PKCS#7 + SHA-1 present elsewhere => OK - { name: "app_mf-1-256_sf-1-256_p7-1", expectedResult: Cr.NS_OK }, - { name: "app_mf-1-256_sf-1_p7-1", expectedResult: Cr.NS_OK }, - { name: "app_mf-1_sf-1-256_p7-1", expectedResult: Cr.NS_OK }, - { name: "app_mf-1_sf-1_p7-1", expectedResult: Cr.NS_OK }, + { + name: "app_mf-1-256_sf-1-256_p7-1", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1], + }, + { + name: "app_mf-1-256_sf-1_p7-1", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1], + }, + { + name: "app_mf-1_sf-1-256_p7-1", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1], + }, + { + name: "app_mf-1_sf-1_p7-1", + expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1], + }, // SHA-256 in PKCS#7 + SHA-256 not present elsewhere => INVALID { name: "app_mf-1-256_sf-1_p7-1-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-1-256_sf-1_p7-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-1_sf-1-256_p7-1-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-1_sf-1-256_p7-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-1_sf-1_p7-1-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-1_sf-1_p7-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-1_sf-256_p7-1-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-1_sf-256_p7-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-256_sf-1_p7-1-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-256_sf-1_p7-256", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, // SHA-1 in PKCS#7 + SHA-1 not present elsewhere => INVALID { name: "app_mf-1-256_sf-256_p7-1", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-1_sf-256_p7-1", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-256_sf-1-256_p7-1", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-256_sf-1_p7-1", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, { name: "app_mf-256_sf-256_p7-1", expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], }, ]; // Policy values for the preference "security.signed_app_signatures.policy" const PKCS7WithSHA1OrSHA256 = 0b0; -const PKCS7WithSHA256 = 0b1; +const PKCS7_WITH_SHA256 = 0b1; const COSEAndPKCS7WithSHA1OrSHA256 = 0b10; const COSEAndPKCS7WithSHA256 = 0b11; const COSERequiredAndPKCS7WithSHA1OrSHA256 = 0b100; @@ -254,7 +324,11 @@ for (let testcase of hashTestcases) { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path(testcase.name), - check_open_result(testcase.name, testcase.expectedResult) + check_open_result( + testcase.name, + testcase.expectedResult, + testcase.expectedSignatureAlgorithms + ) ); }); } @@ -265,7 +339,8 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { original_app_path("empty_signerInfos"), check_open_result( "the signerInfos in the PKCS#7 signature is empty", - Cr.NS_ERROR_CMS_VERIFY_NOT_SIGNED + Cr.NS_ERROR_CMS_VERIFY_NOT_SIGNED, + [] ) ); }); @@ -274,7 +349,7 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("unsigned_app"), - check_open_result("unsigned", Cr.NS_ERROR_SIGNED_JAR_NOT_SIGNED) + check_open_result("unsigned", Cr.NS_ERROR_SIGNED_JAR_NOT_SIGNED, []) ); }); @@ -284,7 +359,8 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { original_app_path("unknown_issuer_app"), check_open_result( "unknown_issuer", - getXPCOMStatusFromNSS(SEC_ERROR_UNKNOWN_ISSUER) + getXPCOMStatusFromNSS(SEC_ERROR_UNKNOWN_ISSUER), + [] ) ); }); @@ -293,7 +369,10 @@ add_signature_test(COSEAndPKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("cose_signed_with_pkcs7"), - check_open_result("cose_signed_with_pkcs7", Cr.NS_OK) + check_open_result("cose_signed_with_pkcs7", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256, + ]) ); }); @@ -301,7 +380,9 @@ add_signature_test(COSEAndPKCS7WithSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("app_mf-256_sf-256_p7-256"), - check_open_result("no COSE but correct PK#7", Cr.NS_OK) + check_open_result("no COSE but correct PK#7", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256, + ]) ); }); @@ -311,7 +392,8 @@ add_signature_test(COSEAndPKCS7WithSHA256, function () { original_app_path("app_mf-1_sf-256_p7-256"), check_open_result( "no COSE and wrong PK#7 hash", - Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID + Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + [] ) ); }); @@ -322,7 +404,8 @@ add_signature_test(COSERequiredAndPKCS7WithSHA1OrSHA256, function () { original_app_path("app_mf-256_sf-256_p7-256"), check_open_result( "COSE signature missing (SHA1 or 256)", - Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE + Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE, + [] ) ); }); @@ -333,7 +416,8 @@ add_signature_test(COSERequiredAndPKCS7WithSHA256, function () { original_app_path("app_mf-256_sf-256_p7-256"), check_open_result( "COSE signature missing (SHA256)", - Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE + Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE, + [] ) ); }); @@ -344,7 +428,8 @@ add_signature_test(COSERequiredAndPKCS7WithSHA256, function () { original_app_path("only_cose_signed"), check_open_result( "COSE signature only (PK#7 allowed, not present)", - Cr.NS_OK + Cr.NS_OK, + [Ci.nsIAppSignatureInfo.COSE_WITH_SHA256] ) ); }); @@ -355,7 +440,8 @@ add_signature_test(COSERequiredAndPKCS7WithSHA1OrSHA256, function () { original_app_path("only_cose_signed"), check_open_result( "COSE signature only (PK#7 allowed, not present)", - Cr.NS_OK + Cr.NS_OK, + [Ci.nsIAppSignatureInfo.COSE_WITH_SHA256] ) ); }); @@ -364,7 +450,10 @@ add_signature_test(COSEAndPKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("cose_multiple_signed_with_pkcs7"), - check_open_result("cose_multiple_signed_with_pkcs7", Cr.NS_OK) + check_open_result("cose_multiple_signed_with_pkcs7", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256, + ]) ); }); @@ -372,7 +461,10 @@ add_signature_test(COSEAndPKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("cose_int_signed_with_pkcs7"), - check_open_result("COSE signed with an intermediate", Cr.NS_OK) + check_open_result("COSE signed with an intermediate", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256, + ]) ); }); @@ -382,7 +474,8 @@ add_signature_test(COSEAndPKCS7WithSHA1OrSHA256, function () { original_app_path("only_cose_signed"), check_open_result( "PK7 signature missing", - Cr.NS_ERROR_SIGNED_JAR_NOT_SIGNED + Cr.NS_ERROR_SIGNED_JAR_NOT_SIGNED, + [] ) ); }); @@ -393,7 +486,8 @@ add_signature_test(COSEOnly, function () { original_app_path("cose_multiple_signed_with_pkcs7"), check_open_result( "Expected only COSE signature", - Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY, + [] ) ); }); @@ -402,7 +496,9 @@ add_signature_test(COSEOnly, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("only_cose_multiple_signed"), - check_open_result("only Multiple COSE signatures", Cr.NS_OK) + check_open_result("only Multiple COSE signatures", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + ]) ); }); @@ -410,7 +506,9 @@ add_signature_test(COSEOnly, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("only_cose_signed"), - check_open_result("only_cose_signed", Cr.NS_OK) + check_open_result("only_cose_signed", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + ]) ); }); @@ -418,7 +516,9 @@ add_signature_test(COSEOnlyAgain, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("only_cose_signed"), - check_open_result("only_cose_signed (again)", Cr.NS_OK) + check_open_result("only_cose_signed (again)", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + ]) ); }); @@ -428,7 +528,8 @@ add_signature_test(COSEOnly, function () { original_app_path("cose_signed_with_pkcs7"), check_open_result( "COSE only expected but also PK#7 signed", - Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY, + [] ) ); }); @@ -440,7 +541,9 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("app_mf-1_sf-1_p7-1"), - check_open_result("identity_tampering", Cr.NS_OK) + check_open_result("identity_tampering", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1, + ]) ); }); @@ -455,7 +558,7 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("missing_rsa", Cr.NS_ERROR_SIGNED_JAR_NOT_SIGNED) + check_open_result("missing_rsa", Cr.NS_ERROR_SIGNED_JAR_NOT_SIGNED, []) ); }); @@ -470,7 +573,7 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("missing_sf", Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID) + check_open_result("missing_sf", Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, []) ); }); @@ -487,7 +590,8 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { tampered, check_open_result( "missing_manifest_mf", - Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID + Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + [] ) ); }); @@ -503,7 +607,7 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("missing_entry", Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING) + check_open_result("missing_entry", Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING, []) ); }); @@ -518,7 +622,11 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("truncated_entry", Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY) + check_open_result( + "truncated_entry", + Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY, + [] + ) ); }); @@ -535,7 +643,8 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { tampered, check_open_result( "truncated_manifestFile", - Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID + Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + [] ) ); }); @@ -553,7 +662,8 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { tampered, check_open_result( "truncated_signatureFile", - getXPCOMStatusFromNSS(SEC_ERROR_PKCS7_BAD_SIGNATURE) + getXPCOMStatusFromNSS(SEC_ERROR_PKCS7_BAD_SIGNATURE), + [] ) ); }); @@ -569,7 +679,11 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("truncated_pkcs7File", Cr.NS_ERROR_CMS_VERIFY_NOT_SIGNED) + check_open_result( + "truncated_pkcs7File", + Cr.NS_ERROR_CMS_VERIFY_NOT_SIGNED, + [] + ) ); }); @@ -581,7 +695,11 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("unsigned_entry", Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY) + check_open_result( + "unsigned_entry", + Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY, + [] + ) ); }); @@ -595,35 +713,41 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { tampered, check_open_result( "unsigned_metainf_entry", - Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY, + [] ) ); }); -add_signature_test(PKCS7WithSHA256, function testSHA1Disabled() { +add_signature_test(PKCS7_WITH_SHA256, function testSHA1Disabled() { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("app_mf-1_sf-1_p7-1"), check_open_result( "SHA-1 should not be accepted if disabled by policy", - Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE + Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE, + [] ) ); }); -add_signature_test(PKCS7WithSHA256, function testSHA256WorksWithSHA1Disabled() { - certdb.openSignedAppFileAsync( - Ci.nsIX509CertDB.AppXPCShellRoot, - original_app_path("app_mf-256_sf-256_p7-256"), - check_open_result( - "SHA-256 should work if SHA-1 is disabled by policy", - Cr.NS_OK - ) - ); -}); +add_signature_test( + PKCS7_WITH_SHA256, + function testSHA256WorksWithSHA1Disabled() { + certdb.openSignedAppFileAsync( + Ci.nsIX509CertDB.AppXPCShellRoot, + original_app_path("app_mf-256_sf-256_p7-256"), + check_open_result( + "SHA-256 should work if SHA-1 is disabled by policy", + Cr.NS_OK, + [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256] + ) + ); + } +); add_signature_test( - PKCS7WithSHA256, + PKCS7_WITH_SHA256, function testMultipleSignaturesWorkWithSHA1Disabled() { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, @@ -631,7 +755,8 @@ add_signature_test( check_open_result( "Multiple signatures should work if SHA-1 is " + "disabled by policy (if SHA-256 signature verifies)", - Cr.NS_OK + Cr.NS_OK, + [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256] ) ); } @@ -642,26 +767,43 @@ var cosePolicies = [ COSERequiredAndPKCS7WithSHA1OrSHA256, ]; -// PS256 is not yet supported. +// NOTE: The zip files referenced in coseTestcasesStage and coseTestcasesProd +// were originally generated with +// https://github.com/mozilla-services/autograph/blob/c890e14de5b04dcff9be0d07fdea4ae6bbb58557/tools/autograph-client/build_test_xpis.sh +// Since then, the mechanism to sign these packages have changed, see +// https://bugzilla.mozilla.org/show_bug.cgi?id=1885457 for details. + var coseTestcasesStage = [ { - name: "autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256-ES384", + name: "addons-stage-tomato-clock-sha1-es256-es384", expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1, + ], root: Ci.nsIX509CertDB.AddonsStageRoot, }, { - name: "autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256-PS256", + name: "addons-stage-tomato-clock-sha1-es256-ps256", + // PS256 is not yet supported. expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], root: Ci.nsIX509CertDB.AddonsStageRoot, }, { - name: "autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256", + name: "addons-stage-tomato-clock-sha1-es256", expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1, + ], root: Ci.nsIX509CertDB.AddonsStageRoot, }, { - name: "autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-PS256", + name: "addons-stage-tomato-clock-sha1-ps256", + // PS256 is not yet supported. expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], root: Ci.nsIX509CertDB.AddonsStageRoot, }, ]; @@ -670,21 +812,33 @@ var coseTestcasesProd = [ { name: "autograph-714ba248-prod-tomato-clock-PKCS7-SHA1-ES256-ES384", expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1, + ], root: Ci.nsIX509CertDB.AddonsPublicRoot, }, { name: "autograph-714ba248-prod-tomato-clock-PKCS7-SHA1-ES256-PS256", + // PS256 is not yet supported. expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], root: Ci.nsIX509CertDB.AddonsPublicRoot, }, { name: "autograph-714ba248-prod-tomato-clock-PKCS7-SHA1-ES256", expectedResult: Cr.NS_OK, + expectedSignatureAlgorithms: [ + Ci.nsIAppSignatureInfo.COSE_WITH_SHA256, + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1, + ], root: Ci.nsIX509CertDB.AddonsPublicRoot, }, { name: "autograph-714ba248-prod-tomato-clock-PKCS7-SHA1-PS256", + // PS256 is not yet supported. expectedResult: Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + expectedSignatureAlgorithms: [], root: Ci.nsIX509CertDB.AddonsPublicRoot, }, ]; @@ -695,7 +849,11 @@ for (let policy of cosePolicies) { certdb.openSignedAppFileAsync( testcase.root, original_app_path(testcase.name), - check_open_result(testcase.name, testcase.expectedResult) + check_open_result( + testcase.name, + testcase.expectedResult, + testcase.expectedSignatureAlgorithms + ) ); }); } @@ -714,7 +872,8 @@ add_signature_test(COSEAndPKCS7WithSHA256, function testCOSESigTampered() { tampered, check_open_result( "cose_sig_tampered", - Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY, + [] ) ); }); @@ -732,7 +891,11 @@ add_signature_test(COSEAndPKCS7WithSHA256, function testCOSESigRemoved() { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("cose_sig_removed", Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING) + check_open_result( + "cose_sig_removed", + Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING, + [] + ) ); }); @@ -749,7 +912,8 @@ add_signature_test(COSEAndPKCS7WithSHA256, function testCOSEManifestTampered() { tampered, check_open_result( "cose_manifest_tampered", - Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY, + [] ) ); }); @@ -767,7 +931,8 @@ add_signature_test(COSEAndPKCS7WithSHA256, function testCOSEManifestRemoved() { tampered, check_open_result( "cose_manifest_removed", - Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING + Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING, + [] ) ); }); @@ -780,7 +945,11 @@ add_signature_test(COSEAndPKCS7WithSHA256, function testCOSEFileAdded() { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("cose_file_added", Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY) + check_open_result( + "cose_file_added", + Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY, + [] + ) ); }); @@ -795,7 +964,11 @@ add_signature_test(COSEAndPKCS7WithSHA256, function testCOSEFileRemoved() { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, tampered, - check_open_result("cose_file_removed", Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING) + check_open_result( + "cose_file_removed", + Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING, + [] + ) ); }); @@ -812,7 +985,8 @@ add_signature_test(COSEAndPKCS7WithSHA256, function testCOSEFileTampered() { tampered, check_open_result( "cose_file_tampered", - Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY, + [] ) ); }); @@ -830,7 +1004,8 @@ add_signature_test(COSEOnly, function testOnlyCOSESigTampered() { tampered, check_open_result( "only_cose_sig_tampered", - Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID + Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + [] ) ); }); @@ -848,7 +1023,8 @@ add_signature_test(COSEOnly, function testOnlyCOSESigRemoved() { tampered, check_open_result( "only_cose_sig_removed", - Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE + Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE, + [] ) ); }); @@ -866,7 +1042,8 @@ add_signature_test(COSEOnly, function testOnlyCOSEManifestTampered() { tampered, check_open_result( "only_cose_manifest_tampered", - Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID + Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID, + [] ) ); }); @@ -884,7 +1061,8 @@ add_signature_test(COSEOnly, function testOnlyCOSEManifestRemoved() { tampered, check_open_result( "only_cose_manifest_removed", - Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE + Cr.NS_ERROR_SIGNED_JAR_WRONG_SIGNATURE, + [] ) ); }); @@ -899,7 +1077,8 @@ add_signature_test(COSEOnly, function testOnlyCOSEFileAdded() { tampered, check_open_result( "only_cose_file_added", - Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY, + [] ) ); }); @@ -917,7 +1096,8 @@ add_signature_test(COSEOnly, function testOnlyCOSEFileRemoved() { tampered, check_open_result( "only_cose_file_removed", - Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING + Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING, + [] ) ); }); @@ -935,7 +1115,8 @@ add_signature_test(COSEOnly, function testOnlyCOSEFileTampered() { tampered, check_open_result( "only_cose_file_tampered", - Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY, + [] ) ); }); @@ -951,7 +1132,8 @@ add_signature_test(COSEAndPKCS7WithSHA1OrSHA256, function () { check_open_result( "tampered COSE with good PKCS7 signature should fail " + "when COSE and PKCS7 is processed", - Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY, + [] ) ); }); @@ -963,7 +1145,8 @@ add_signature_test(COSEOnly, function () { check_open_result( "tampered COSE with good PKCS7 signature should fail " + "when only COSE is processed", - Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY + Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY, + [] ) ); }); @@ -974,9 +1157,10 @@ add_signature_test(PKCS7WithSHA1OrSHA256, function () { Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("cose_tampered_good_pkcs7"), check_open_result( - "tampered COSE with good PKCS7 signature should succeed" + + "tampered COSE with good PKCS7 signature should succeed " + "when COSE is not processed", - Cr.NS_OK + Cr.NS_OK, + [Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA1] ) ); }); @@ -985,7 +1169,7 @@ add_test(function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("bug_1411458"), - check_open_result("bug 1411458", Cr.NS_ERROR_CMS_VERIFY_NO_CONTENT_INFO) + check_open_result("bug 1411458", Cr.NS_ERROR_CMS_VERIFY_NO_CONTENT_INFO, []) ); }); @@ -994,7 +1178,9 @@ add_test(function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("big_manifest"), - check_open_result("add-on with big manifest file", Cr.NS_OK) + check_open_result("add-on with big manifest file", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256, + ]) ); }); @@ -1006,7 +1192,8 @@ add_test(function () { original_app_path("huge_manifest"), check_open_result( "add-on with huge manifest file", - Cr.NS_ERROR_SIGNED_JAR_ENTRY_INVALID + Cr.NS_ERROR_SIGNED_JAR_ENTRY_INVALID, + [] ) ); }); @@ -1017,7 +1204,9 @@ add_test(function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("validity_not_yet_valid"), - check_open_result("validity_not_yet_valid", Cr.NS_OK) + check_open_result("validity_not_yet_valid", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256, + ]) ); }); @@ -1027,7 +1216,9 @@ add_test(function () { certdb.openSignedAppFileAsync( Ci.nsIX509CertDB.AppXPCShellRoot, original_app_path("validity_expired"), - check_open_result("validity_expired", Cr.NS_OK) + check_open_result("validity_expired", Cr.NS_OK, [ + Ci.nsIAppSignatureInfo.PKCS7_WITH_SHA256, + ]) ); }); diff --git a/security/manager/ssl/tests/unit/test_signed_apps/autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256.zip b/security/manager/ssl/tests/unit/test_signed_apps/addons-stage-tomato-clock-sha1-es256-es384.zip Binary files differindex b1d1999551..cb6767385c 100644 --- a/security/manager/ssl/tests/unit/test_signed_apps/autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256.zip +++ b/security/manager/ssl/tests/unit/test_signed_apps/addons-stage-tomato-clock-sha1-es256-es384.zip diff --git a/security/manager/ssl/tests/unit/test_signed_apps/autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256-ES384.zip b/security/manager/ssl/tests/unit/test_signed_apps/addons-stage-tomato-clock-sha1-es256-ps256.zip Binary files differindex b74e087620..d67b405ff7 100644 --- a/security/manager/ssl/tests/unit/test_signed_apps/autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256-ES384.zip +++ b/security/manager/ssl/tests/unit/test_signed_apps/addons-stage-tomato-clock-sha1-es256-ps256.zip diff --git a/security/manager/ssl/tests/unit/test_signed_apps/autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-PS256.zip b/security/manager/ssl/tests/unit/test_signed_apps/addons-stage-tomato-clock-sha1-es256.zip Binary files differindex 0ce563680d..146bc0caf9 100644 --- a/security/manager/ssl/tests/unit/test_signed_apps/autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-PS256.zip +++ b/security/manager/ssl/tests/unit/test_signed_apps/addons-stage-tomato-clock-sha1-es256.zip diff --git a/security/manager/ssl/tests/unit/test_signed_apps/autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256-PS256.zip b/security/manager/ssl/tests/unit/test_signed_apps/addons-stage-tomato-clock-sha1-ps256.zip Binary files differindex 772c42e494..6f16f2c4f7 100644 --- a/security/manager/ssl/tests/unit/test_signed_apps/autograph-714ba248-stage-tomato-clock-PKCS7-SHA1-ES256-PS256.zip +++ b/security/manager/ssl/tests/unit/test_signed_apps/addons-stage-tomato-clock-sha1-ps256.zip diff --git a/security/manager/ssl/tests/unit/test_sts_preloadlist_perwindowpb.js b/security/manager/ssl/tests/unit/test_sts_preloadlist_perwindowpb.js index 6b1b4a5ba6..f5f4a4ace7 100644 --- a/security/manager/ssl/tests/unit/test_sts_preloadlist_perwindowpb.js +++ b/security/manager/ssl/tests/unit/test_sts_preloadlist_perwindowpb.js @@ -6,7 +6,7 @@ var gSSService = Cc["@mozilla.org/ssservice;1"].getService( function Observer() {} Observer.prototype = { - observe(subject, topic, data) { + observe(subject, topic) { if (topic == "last-pb-context-exited") { run_next_test(); } diff --git a/security/manager/ssl/tests/unit/tlsserver/cmd/FaultyServer.cpp b/security/manager/ssl/tests/unit/tlsserver/cmd/FaultyServer.cpp index 38bfa87e1a..4764ed921d 100644 --- a/security/manager/ssl/tests/unit/tlsserver/cmd/FaultyServer.cpp +++ b/security/manager/ssl/tests/unit/tlsserver/cmd/FaultyServer.cpp @@ -157,7 +157,7 @@ void SecretCallbackFailZeroRtt(PRFileDesc* fd, PRUint16 epoch, } else if (!strcmp(host->mHostName, kHostZeroRttAlertVersion)) { SSL3_SendAlert(ss, alert_fatal, protocol_version); } else if (!strcmp(host->mHostName, kHostZeroRttAlertUnexpected)) { - SSL3_SendAlert(ss, alert_fatal, no_alert); + SSL3_SendAlert(ss, alert_fatal, unexpected_message); } } } |