[java-xmltooling COMMIT] in /branches/REL_1/src/test: java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluatorT...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Feb 22 23:21:28 2013
New Revision: 794

URL: http://svn.shibboleth.net/view/java-xmltooling?rev=794&view=rev
Log:
JXT-98: PKIX policy checking unit tests

Added:
    branches/REL_1/src/test/resources/data/org/opensaml/xml/security/x509/mdt-ica.1.crt.pem
    branches/REL_1/src/test/resources/data/org/opensaml/xml/security/x509/mdt-ica.2.crt.pem
    branches/REL_1/src/test/resources/data/org/opensaml/xml/security/x509/mdt-ica.3.crt.pem
    branches/REL_1/src/test/resources/data/org/opensaml/xml/security/x509/mdt-root.crt.pem
    branches/REL_1/src/test/resources/data/org/opensaml/xml/security/x509/mdt-signer.crt.pem
Modified:
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluatorTest.java

Modified: branches/REL_1/src/test/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluatorTest.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/test/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluatorTest.java?rev=794&r1=793&r2=794&view=diff
==============================================================================
--- branches/REL_1/src/test/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluatorTest.java (original)
+++ branches/REL_1/src/test/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluatorTest.java Fri Feb 22 23:21:28 2013
@@ -21,6 +21,7 @@
 import java.security.cert.X509CRL;
 import java.security.cert.X509Certificate;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -46,6 +47,11 @@
     
     private X509Credential cred;
 
+    private CertPathPKIXValidationOptions opts;
+
+    private static Set testPolicy1 = Collections.singleton("1.3.6.1.4.1.32473.2011.6.20");
+    private static Set testPolicy2 = Collections.singleton("1.3.6.1.4.1.32473.2011.6.21");
+
     /** {@inheritDoc} */
     protected void setUp() throws Exception {
         super.setUp();
@@ -53,6 +59,7 @@
         pkixEvaluator = new CertPathPKIXTrustEvaluator();
         info = null;
         cred = null;
+        opts = null;
     }
     
     public void testGood() {
@@ -283,6 +290,58 @@
         
         testValidateFailure("Valid path was specified, but depth exceeded max path depth", info, cred);
     }
+
+    public void testAnyPolicy() {
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.1.crt.pem");
+        info = getPKIXInfoSet(
+                getCertificates("mdt-root.crt.pem"),
+                EMPTY_CRLS,
+                2 );
+        opts = getPKIXOptions(testPolicy1, false, false);
+
+        testValidateSuccess("Intermediate CA with anyPolicy (2.5.29.32.0) entry permitted", info, cred, opts);
+    }
+
+    public void testExplicitPolicy() {
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.1.crt.pem");
+        info = getPKIXInfoSet(
+                getCertificates("mdt-root.crt.pem"),
+                EMPTY_CRLS,
+                2 );
+        opts = getPKIXOptions(testPolicy1, false, true);
+
+        testValidateFailure("Intermediate CA with anyPolicy (2.5.29.32.0), but anyPolicy is inhibited", info, cred, opts);
+
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.2.crt.pem");
+
+        testValidateSuccess("Intermediate CA with explicit policy " + testPolicy1, info, cred, opts);
+
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.3.crt.pem");
+
+        testValidateSuccess("Intermediate CA with explicit policies " + testPolicy1 + ", " + testPolicy2, info, cred, opts);
+    }
+
+    public void testExplicitPolicyMap() {
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.3.crt.pem");
+        info = getPKIXInfoSet(
+                getCertificates("mdt-root.crt.pem"),
+                EMPTY_CRLS,
+                2 );
+        opts = getPKIXOptions(testPolicy2, false, true);
+
+        testValidateSuccess("Intermediate CA with policy mapping, and mapping is permitted", info, cred, opts);
+    }
+
+    public void testExplicitPolicyNoMap() {
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.3.crt.pem");
+        info = getPKIXInfoSet(
+                getCertificates("mdt-root.crt.pem"),
+                EMPTY_CRLS,
+                2 );
+        opts = getPKIXOptions(testPolicy2, true, true);
+
+        testValidateFailure("Intermediate CA with policy mapping, but mapping is inhibited", info, cred, opts);
+    }
     
     
     /********************
@@ -293,6 +352,30 @@
         try {
             if ( !pkixEvaluator.validate(info, cred) ) {
                 fail("Evaluation of X509Credential failed, success was expected: " + message);
+            }
+        } catch (SecurityException e) {
+            fail("Evaluation failed due to processing exception: " + e.getMessage());
+        }
+    }
+    
+    private void testValidateSuccess(String message, PKIXValidationInformation info, X509Credential cred,
+                CertPathPKIXValidationOptions opts) {
+        try {
+            PKIXTrustEvaluator pkixEvaluator = new CertPathPKIXTrustEvaluator(opts);

[... 42 lines stripped ...]