generate_tests.py 54 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238
  1. # Copyright 2016 The Chromium Authors. All rights reserved.
  2. # Use of this source code is governed by a BSD-style license that can be
  3. # found in the LICENSE file.
  4. '''Generates a test suite from NIST PKITS test descriptions.
  5. The output is a set of Type Parameterized Tests which are included by
  6. pkits_unittest.h. See pkits_unittest.h for information on using the tests.
  7. GoogleTest has a limit of 50 tests per type parameterized testcase, so the tests
  8. are split up by section number (this also makes it possible to easily skip
  9. sections that pertain to non-implemented features).
  10. Usage:
  11. generate_tests.py <PKITS.pdf> <output.h>
  12. '''
  13. import os
  14. import re
  15. import subprocess
  16. import sys
  17. import tempfile
  18. def sanitize_name(s):
  19. return s.translate(None, ' -')
  20. def finalize_test_case(test_case_name, sanitized_test_names, output):
  21. output.write('\nWRAPPED_REGISTER_TYPED_TEST_SUITE_P(%s' % test_case_name)
  22. for name in sanitized_test_names:
  23. output.write(',\n %s' % name)
  24. output.write(');\n')
  25. def bool_to_str(b):
  26. return "true" if b else "false"
  27. def make_policies_string(policies):
  28. return '"' + ','.join(policies) + '"'
  29. def output_test(test_case_name, test_number, raw_test_name, subpart_number,
  30. info, certs, crls, sanitized_test_names, output):
  31. '''Writes a test case to |output|, and appends the test name to
  32. |sanitized_test_names|.'''
  33. sanitized_test_name = 'Section%s%s' % (test_number.split('.')[1],
  34. sanitize_name(raw_test_name))
  35. subpart_comment = ''
  36. if subpart_number is not None:
  37. sanitized_test_name += "Subpart%d" % (subpart_number)
  38. subpart_comment = ' (Subpart %d)' % (subpart_number)
  39. sanitized_test_names.append(sanitized_test_name)
  40. certs_formatted = ', '.join('"%s"' % n for n in certs)
  41. crls_formatted = ', '.join('"%s"' % n for n in crls)
  42. output.write('''
  43. // %(test_number)s %(raw_test_name)s%(subpart_comment)s
  44. WRAPPED_TYPED_TEST_P(%(test_case_name)s, %(sanitized_test_name)s) {
  45. const char* const certs[] = {
  46. %(certs_formatted)s
  47. };
  48. const char* const crls[] = {
  49. %(crls_formatted)s
  50. };
  51. ''' % vars())
  52. default_info = TestInfo(None)
  53. output.write('''PkitsTestInfo info;
  54. info.test_number = "%s";
  55. info.should_validate = %s;
  56. ''' % (test_number, bool_to_str(info.should_validate)))
  57. # Output any non-default inputs/outputs. Only properties that differ from
  58. # the defaults are written, so as to keep the generated file more readable.
  59. if info.initial_policy_set != default_info.initial_policy_set:
  60. output.write(''' info.SetInitialPolicySet(%s);
  61. ''' % make_policies_string(info.initial_policy_set))
  62. if info.initial_explicit_policy != default_info.initial_explicit_policy:
  63. output.write(''' info.SetInitialExplicitPolicy(%s);
  64. ''' % bool_to_str(info.initial_explicit_policy))
  65. if (info.initial_policy_mapping_inhibit !=
  66. default_info.initial_policy_mapping_inhibit):
  67. output.write(''' info.SetInitialPolicyMappingInhibit(%s);
  68. ''' % bool_to_str(info.initial_policy_mapping_inhibit))
  69. if (info.initial_inhibit_any_policy !=
  70. default_info.initial_inhibit_any_policy):
  71. output.write(''' info.SetInitialInhibitAnyPolicy(%s);
  72. ''' % bool_to_str(info.initial_inhibit_any_policy))
  73. if (info.user_constrained_policy_set !=
  74. default_info.user_constrained_policy_set):
  75. output.write(''' info.SetUserConstrainedPolicySet(%s);
  76. ''' % make_policies_string(info.user_constrained_policy_set))
  77. output.write('''
  78. this->RunTest(certs, crls, info);
  79. }
  80. ''' % vars())
  81. # Matches a section header, ex: "4.1 Signature Verification"
  82. SECTION_MATCHER = re.compile('^\s*(\d+\.\d+)\s+(.+)\s*$')
  83. # Matches a test header, ex: "4.1.1 Valid Signatures Test1"
  84. TEST_MATCHER = re.compile('^\s*(\d+\.\d+.\d+)\s+(.+)\s*$')
  85. # Matches the various headers in a test specification.
  86. EXPECTED_HEADER_MATCHER = re.compile('^\s*Expected Result:')
  87. PROCEDURE_HEADER_MATCHER = re.compile('^\s*Procedure:')
  88. PATH_HEADER_MATCHER = re.compile('^\s*Certification Path:')
  89. # Matches the Procedure text if using default settings.
  90. USING_DEFAULT_SETTINGS_MATCHER = re.compile(
  91. '^.*using the \s*default settings.*')
  92. # Matches the description text if using custom settings.
  93. CUSTOM_SETTINGS_MATCHER = re.compile(
  94. '.*this\s+test\s+be\s+validated\s+using\s+the\s+following\s+inputs:.*')
  95. # Match an expected test result. Note that some results in the PDF have a typo
  96. # "path not should validate" instead of "path should not validate".
  97. TEST_RESULT_MATCHER = re.compile(
  98. '^.*path (should validate|should not validate|not should validate)')
  99. # Matches a line in the certification path, ex:
  100. # "\u2022 Good CA Cert, Good CA CRL"
  101. PATH_MATCHER = re.compile('^\s*\xe2\x80\xa2\s*(.+)\s*$')
  102. # Matches a page number. These may appear in the middle of multi-line fields and
  103. # thus need to be ignored.
  104. PAGE_NUMBER_MATCHER = re.compile('^\s*\d+\s*$')
  105. # Matches if an entry in a certification path refers to a CRL, ex:
  106. # "onlySomeReasons CA2 CRL1".
  107. CRL_MATCHER = re.compile('^.*CRL\d*$')
  108. class TestSections(object):
  109. def __init__(self):
  110. self.description_lines = []
  111. self.procedure_lines = []
  112. self.expected_result_lines = []
  113. self.cert_path_lines = []
  114. def parse_main_test_sections(lines, i):
  115. result = TestSections()
  116. # Read the description lines (text after test name up until
  117. # "Procedure:").
  118. result.description_lines = []
  119. while i < len(lines):
  120. if PROCEDURE_HEADER_MATCHER.match(lines[i]):
  121. break
  122. result.description_lines.append(lines[i])
  123. i += 1
  124. # Read the procedure lines (text starting at "Procedure:" and up until
  125. # "Expected Result:".
  126. result.procedure_lines = []
  127. while i < len(lines):
  128. if EXPECTED_HEADER_MATCHER.match(lines[i]):
  129. break
  130. result.procedure_lines.append(lines[i])
  131. i += 1
  132. # Read the expected result lines (text starting at "Expected Result:" and up
  133. # until "Certification Path:".
  134. result.expected_result_lines = []
  135. while i < len(lines):
  136. if PATH_HEADER_MATCHER.match(lines[i]):
  137. break
  138. result.expected_result_lines.append(lines[i])
  139. i += 1
  140. # Read the certification path lines (text starting at "Certification Path:"
  141. # and up until the next test title.
  142. result.cert_path_lines = []
  143. while i < len(lines):
  144. if TEST_MATCHER.match(lines[i]) or SECTION_MATCHER.match(lines[i]):
  145. break
  146. result.cert_path_lines.append(lines[i])
  147. i += 1
  148. return i, result
  149. def parse_cert_path_lines(lines):
  150. path_lines = []
  151. crls = []
  152. certs = []
  153. for line in lines[1:]:
  154. line = line.strip()
  155. if "is composed of the following objects:" in line:
  156. continue
  157. if "See the introduction to Section 4.4 for more information." in line:
  158. continue
  159. if not line or PAGE_NUMBER_MATCHER.match(line):
  160. continue
  161. path_match = PATH_MATCHER.match(line)
  162. if path_match:
  163. path_lines.append(path_match.group(1))
  164. continue
  165. # Continuation of previous path line.
  166. path_lines[-1] += ' ' + line
  167. for path_line in path_lines:
  168. for path in path_line.split(','):
  169. path = sanitize_name(path.strip())
  170. if CRL_MATCHER.match(path):
  171. crls.append(path)
  172. else:
  173. certs.append(path)
  174. return certs, crls
  175. ANY_POLICY = 'anyPolicy'
  176. TEST_POLICY_1 = 'NIST-test-policy-1'
  177. TEST_POLICY_2 = 'NIST-test-policy-2'
  178. TEST_POLICY_3 = 'NIST-test-policy-3'
  179. TEST_POLICY_6 = 'NIST-test-policy-6'
  180. # Note: This omits some outputs from PKITS:
  181. #
  182. # * authorities-constrained-policy-set
  183. # * explicit-policy-indicator
  184. class TestInfo(object):
  185. """This structure describes a test inputs and outputs"""
  186. def __init__(self, should_validate,
  187. # These defaults come from section 3 of PKITS.pdf
  188. initial_policy_set = [ANY_POLICY],
  189. initial_explicit_policy = False,
  190. initial_policy_mapping_inhibit = False,
  191. initial_inhibit_any_policy = False,
  192. # In all of the tests that are not related to policy processing,
  193. # each certificate in the path asserts the certificate policy
  194. # 2.16.840.1.101.3.2.1.48.1
  195. user_constrained_policy_set = [TEST_POLICY_1]):
  196. self.should_validate = should_validate
  197. self.initial_policy_set = initial_policy_set
  198. self.initial_explicit_policy = initial_explicit_policy
  199. self.initial_policy_mapping_inhibit = initial_policy_mapping_inhibit
  200. self.initial_inhibit_any_policy = initial_inhibit_any_policy
  201. self.user_constrained_policy_set = user_constrained_policy_set
  202. TEST_OVERRIDES = {
  203. '4.8.1': [ # All Certificates Same Policy Test1
  204. # 1. default settings, but with initial-explicit-policy set. The path
  205. # should validate successfully
  206. TestInfo(True, initial_explicit_policy=True,
  207. user_constrained_policy_set=[TEST_POLICY_1]),
  208. # 2. default settings, but with initial-explicit-policy set and
  209. # initial-policy-set = {NIST-test-policy-1}. The path should validate
  210. # successfully.
  211. TestInfo(True, initial_explicit_policy=True,
  212. initial_policy_set=[TEST_POLICY_1],
  213. user_constrained_policy_set=[TEST_POLICY_1]),
  214. # 3. default settings, but with initial-explicit-policy set and
  215. # initial-policy-set = {NIST-test-policy-2}. The path should not validate
  216. # successfully.
  217. TestInfo(False, initial_explicit_policy=True,
  218. initial_policy_set=[TEST_POLICY_2],
  219. user_constrained_policy_set=[]),
  220. # 4. default settings, but with initial-explicit-policy set and
  221. # initial-policy-set = {NIST-test-policy-1, NIST-test-policy-2}. The path
  222. # should validate successfully.
  223. TestInfo(True, initial_explicit_policy=True,
  224. initial_policy_set=[TEST_POLICY_1, TEST_POLICY_2],
  225. user_constrained_policy_set=[TEST_POLICY_1]),
  226. ],
  227. '4.8.2': [ # All Certificates No Policies Test2
  228. # 1. default settings. The path should validate successfully.
  229. TestInfo(True, user_constrained_policy_set=[]),
  230. # 2. default settings, but with initial-explicit-policy set. The path
  231. # should not validate successfully
  232. TestInfo(False, initial_explicit_policy=True,
  233. user_constrained_policy_set=[]),
  234. ],
  235. '4.8.3': [ # Different Policies Test3
  236. # 1. default settings. The path should validate successfully.
  237. TestInfo(True, user_constrained_policy_set=[]),
  238. # 2. default settings, but with initial-explicit-policy set. The path
  239. # should not validate successfully.
  240. TestInfo(False, initial_explicit_policy=True, user_constrained_policy_set=[]),
  241. # 3. default settings, but with initial-explicit-policy set and
  242. # initial-policy-set = {NIST-test-policy-1, NIST-test-policy-2}. The path
  243. # should not validate successfully.
  244. TestInfo(False, initial_explicit_policy=True,
  245. initial_policy_set=[TEST_POLICY_1, TEST_POLICY_2],
  246. user_constrained_policy_set=[]),
  247. ],
  248. '4.8.4': [ # Different Policies Test4
  249. # Procedure: Validate Different Policies Test4 EE using the default
  250. # settings or open and verify Signed Test Message 6.2.2.69 using the
  251. # default settings.
  252. #
  253. # Expected Result: The authorities-constrained-policy-set and the
  254. # user-constrained-policy-set will be empty. The explicit-policy-indicator
  255. # will be set if the application can process the policyConstraints
  256. # extension. If the application can process the policyConstraints extension
  257. # then the path should not validate successfully. If the application can
  258. # not process the policyConstraints extension, then the path should
  259. # validate successfully.
  260. TestInfo(False, user_constrained_policy_set=[]),
  261. ],
  262. '4.8.5': [ # 4.8.5 Different Policies Test5
  263. # Procedure: Validate Different Policies Test5 EE using the default
  264. # settings or open and verify Signed Test Message 6.2.2.70 using the
  265. # default settings.
  266. #
  267. # Expected Result: The authorities-constrained-policy-set and the
  268. # user-constrained-policy-set will be empty. The explicit-policy-indicator
  269. # will be set if the application can process the policyConstraints
  270. # extension. If the application can process the policyConstraints extension
  271. # then the path should not validate successfully. If the application can
  272. # not process the policyConstraints extension, then the path should
  273. # validate successfully
  274. TestInfo(False, user_constrained_policy_set=[]),
  275. ],
  276. '4.8.6': [ # Overlapping Policies Test6
  277. # 1. default settings. The path should validate successfully.
  278. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  279. # 2. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  280. # The path should validate successfully.
  281. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  282. user_constrained_policy_set=[TEST_POLICY_1]),
  283. # 3. default settings, but with initial-policy-set = {NIST-test-policy-2}.
  284. # The path should not validate successfully.
  285. TestInfo(False, initial_policy_set=[TEST_POLICY_2],
  286. user_constrained_policy_set=[]),
  287. ],
  288. '4.8.7': [ # Different Policies Test7
  289. # Procedure: Validate Different Policies Test7 EE using the default
  290. # settings or open and verify Signed Test Message 6.2.2.72 using the
  291. # default settings.
  292. #
  293. # Expected Result: The authorities-constrained-policy-set and the
  294. # user-constrained-policy-set will be empty. If the
  295. # explicit-policy-indicator will be set if the application can process the
  296. # policyConstraints extension. If the application can process the
  297. # policyConstraints extension, then the path should not validate
  298. # successfully. If the application can not process the policyConstraints
  299. # extension, then the path should validate successfully.
  300. TestInfo(False, user_constrained_policy_set=[]),
  301. ],
  302. '4.8.8': [ # Different Policies Test8
  303. # Procedure: Validate Different Policies Test8 EE using the default
  304. # settings or open and verify Signed Test Message 6.2.2.73 using the
  305. # default settings.
  306. #
  307. # Expected Result: The authorities-constrained-policy-set and the
  308. # user-constrained-policy-set will be empty. The explicit-policy-indicator
  309. # will be set if the application can process the policyConstraints
  310. # extension. If the application can process the policyConstraints extension
  311. # then the path should not validate successfully. If the application can
  312. # not process the policyConstraints extension, then the path should
  313. # validate successfully.
  314. TestInfo(False, user_constrained_policy_set=[]),
  315. ],
  316. '4.8.9': [ # Different Policies Test9
  317. # Procedure: Validate Different Policies Test9 EE using the default
  318. # settings or open and verify Signed Test Message 6.2.2.74 using the
  319. # default settings.
  320. #
  321. # Expected Result: The authorities-constrained-policy-set and the
  322. # user-constrained-policy-set will be empty. The explicit-policy-indicator
  323. # will be set if the application can process the policyConstraints
  324. # extension. If the application can process the policyConstraints
  325. # extension, then the path should not validate successfully. If the
  326. # application can not process the policyConstraints extension, then the
  327. # path should validate successfully.
  328. TestInfo(False, user_constrained_policy_set=[]),
  329. ],
  330. '4.8.10': [ # All Certificates Same Policies Test10
  331. # 1. default settings. The path should validate successfully.
  332. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1, TEST_POLICY_2]),
  333. # 2. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  334. # The path should validate successfully.
  335. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  336. user_constrained_policy_set=[TEST_POLICY_1]),
  337. # 3. default settings, but with initial-policy-set = {NIST-test-policy-2}.
  338. # The path should validate successfully.
  339. TestInfo(True, initial_policy_set=[TEST_POLICY_2],
  340. user_constrained_policy_set=[TEST_POLICY_2]),
  341. ],
  342. '4.8.11': [ # All Certificates AnyPolicy Test11
  343. # 1. default settings. The path should validate successfully.
  344. TestInfo(True, user_constrained_policy_set=[ANY_POLICY]),
  345. # 2. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  346. # The path should validate successfully.
  347. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  348. user_constrained_policy_set=[TEST_POLICY_1]),
  349. ],
  350. '4.8.12': [ # Different Policies Test12
  351. # Procedure: Validate Different Policies Test12 EE using the default
  352. # settings or open and verify Signed Test Message 6.2.2.77 using the
  353. # default settings.
  354. #
  355. # Expected Result: The authorities-constrained-policy-set and the
  356. # user-constrained-policy-set will be empty. The explicit-policy-indicator
  357. # will be set if the application can process the policyConstraints
  358. # extension. If the application can process the policyConstraints
  359. # extension, then the path should not validate successfully. If the
  360. # application can not process the policyConstraints extension, then the
  361. # path should validate successfully.
  362. TestInfo(False, user_constrained_policy_set=[]),
  363. ],
  364. '4.8.13': [ # All Certificates Same Policies Test13
  365. # 1. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  366. # The path should validate successfully.
  367. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  368. user_constrained_policy_set=[TEST_POLICY_1]),
  369. # 2. default settings, but with initial-policy-set = {NIST-test-policy-2}.
  370. # The path should validate successfully.
  371. TestInfo(True, initial_policy_set=[TEST_POLICY_2],
  372. user_constrained_policy_set=[TEST_POLICY_2]),
  373. # 3. default settings, but with initial-policy-set = {NIST-test-policy-3}.
  374. # The path should validate successfully.
  375. TestInfo(True, initial_policy_set=[TEST_POLICY_3],
  376. user_constrained_policy_set=[TEST_POLICY_3]),
  377. ],
  378. '4.8.14': [ # AnyPolicy Test14
  379. # 1. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  380. # The path should validate successfully.
  381. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  382. user_constrained_policy_set=[TEST_POLICY_1]),
  383. # 2. default settings, but with initial-policy-set = {NIST-test-policy-2}.
  384. # The path should not validate successfully.
  385. TestInfo(False, initial_policy_set=[TEST_POLICY_2],
  386. user_constrained_policy_set=[]),
  387. ],
  388. '4.8.15': [ # User Notice Qualifier Test15
  389. # Procedure: Validate User Notice Qualifier Test15 EE using the default
  390. # settings or open and verify Signed Test Message 6.2.2.80 using the
  391. # default settings.
  392. #
  393. # Expected Result: The authorities-constrained-policy-set will be
  394. # {NIST-test-policy-1} and the explicit-policy-indicator will be the same
  395. # as the initial-explicit-policy indicator. If the initial-policy-set is
  396. # any-policy or otherwise includes NIST-test-policy-1, then the
  397. # user-constrained-policy-set will be {NIST-test-policy-1}. If not, the
  398. # user-constrained-policy-set will be empty. If the initial-explicit-policy
  399. # indicator is set and the initial-policy-set does not include
  400. # NIST-test-policy-1, then the path should be rejected, otherwise it should
  401. # validate successfully. If the path validates successfully, then the
  402. # application should display the user notice.
  403. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  404. ],
  405. '4.8.16': [ # User Notice Qualifier Test16
  406. # Procedure: Validate User Notice Qualifier Test16 EE using the default
  407. # settings or open and verify Signed Test Message 6.2.2.81 using the
  408. # default settings.
  409. #
  410. # Expected Result: The authorities-constrained-policy-set will be
  411. # {NIST-test-policy-1} and the explicit-policy-indicator will be the same
  412. # as the initial-explicit-policy indicator. If the initial-policy-set is
  413. # any-policy or otherwise includes NIST-test-policy-1, then the
  414. # user-constrained-policy-set will be {NIST-test-policy-1}. If not, the
  415. # user-constrained-policy-set will be empty. If the initial-explicit-policy
  416. # indicator is set and the initial-policy-set does not include
  417. # NIST-test-policy-1, then the path should be rejected, otherwise it should
  418. # validate successfully. If the path validates successfully, then the
  419. # application should display the user notice associated with
  420. # NIST-test-policy-1. The user notice associated with NIST-test-policy-2
  421. # should not be displayed.
  422. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  423. ],
  424. '4.8.17': [ # User Notice Qualifier Test17
  425. # Procedure: Validate User Notice Qualifier Test17 EE using the default
  426. # settings or open and verify Signed Test Message 6.2.2.82 using the
  427. # default settings.
  428. #
  429. # Expected Result: The authorities-constrained-policy-set will be
  430. # {NIST-test-policy-1} and the explicit-policy-indicator will be the same
  431. # as the initial-explicit-policy indicator. If the initial-policy-set is
  432. # any-policy or otherwise includes NIST-test-policy-1, then the
  433. # user-constrained-policy-set will be {NIST-test-policy-1}. If not, the
  434. # user-constrained-policy-set will be empty. If the initial-explicit-policy
  435. # indicator is set and the initial-policy-set does not include
  436. # NIST-test-policy-1, then the path should be rejected, otherwise it should
  437. # validate successfully. If the path validates successfully, then the
  438. # application should display the user notice associated with anyPolicy.
  439. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  440. ],
  441. '4.8.18': [ # User Notice Qualifier Test18
  442. # 1. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  443. # The path should validate successfully and the qualifier associated with
  444. # NIST-test-policy-1 in the end entity certificate should be displayed.
  445. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  446. user_constrained_policy_set=[TEST_POLICY_1]),
  447. # 2. default settings, but with initial-policy-set = {NIST-test-policy-2}.
  448. # The path should validate successfully and the qualifier associated with
  449. # anyPolicy in the end entity certificate should be displayed.
  450. TestInfo(True, initial_policy_set=[TEST_POLICY_2],
  451. user_constrained_policy_set=[TEST_POLICY_2]),
  452. ],
  453. '4.8.19': [ # User Notice Qualifier Test19
  454. # Procedure: Validate User Notice Qualifier Test19 EE using the default
  455. # settings or open and verify Signed Test Message 6.2.2.84 using the
  456. # default settings.
  457. #
  458. # Expected Result: The authorities-constrained-policy-set will be
  459. # {NIST-test-policy-1} and the explicit-policy-indicator will be the same
  460. # as the initial-explicit-policy indicator. If the initial-policy-set is
  461. # any-policy or otherwise includes NIST-test-policy-1, then the
  462. # user-constrained-policy-set will be {NIST-test-policy-1}. If not, the
  463. # user-constrained-policy-set will be empty. If the initial-explicit-policy
  464. # indicator is set and the initial-policy-set does not include
  465. # NIST-test-policy-1, then the path should be rejected, otherwise it should
  466. # validate successfully. Since the explicitText exceeds the maximum size
  467. # of 200 characters, the application may choose to reject the certificate.
  468. # If the application accepts the certificate, display of the user notice is
  469. # optional.
  470. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  471. ],
  472. '4.8.20': [ # CPS Pointer Qualifier Test20
  473. # Procedure: Validate CPS Pointer Qualifier Test20 EE using the default
  474. # settings or open and verify Signed Test Message 6.2.2.85 using the
  475. # default settings. (If possible, it is recommended that this test be run
  476. # with the initial-explicit-policy indicator set. If this can not be done,
  477. # manually check that the authorities-constrained-policy-set and
  478. # user-constrained-policy-set are correct.)
  479. #
  480. # Expected Result: The authorities-constrained-policy-set will be
  481. # {NIST-test-policy-1} and the explicit-policy-indicator will be the same
  482. # as the initial-explicit-policy indicator. If the initial-policy-set is
  483. # any-policy or otherwise includes NIST-test-policy-1, then the
  484. # user-constrained-policy-set will be {NIST-test-policy-1}. If not, the
  485. # user-constrained-policy-set will be empty. If the initial-explicit-policy
  486. # indicator is set and the initial-policy-set does not include
  487. # NIST-test-policy-1, then the path should be rejected, otherwise it should
  488. # validate successfully. The CPS pointer in the qualifier should be
  489. # associated with NIST-testpolicy-1 in the
  490. # authorities-constrained-policy-set (and in the user-constrained-policy-set
  491. # if NIST-test-policy-1 is in that set). There are no processing
  492. # requirements associated with the CPS pointer qualifier.
  493. TestInfo(True, initial_explicit_policy=True,
  494. initial_policy_set=[TEST_POLICY_1],
  495. user_constrained_policy_set=[TEST_POLICY_1]),
  496. ],
  497. '4.9.1': [ # Valid RequireExplicitPolicy Test1
  498. # Procedure: Validate Valid requireExplicitPolicy Test1 EE using the
  499. # default settings or open and verify Signed Test Message 6.2.2.86 using
  500. # the default settings.
  501. #
  502. # Expected Result: The path should validate successfully since the
  503. # explicit-policy-indicator is not set.
  504. TestInfo(True, user_constrained_policy_set=[]),
  505. ],
  506. '4.9.2': [ # Valid RequireExplicitPolicy Test2
  507. # Procedure: Validate Valid requireExplicitPolicy Test2 EE using the
  508. # default settings or open and verify Signed Test Message 6.2.2.87 using
  509. # the default settings.
  510. #
  511. # Expected Result: The path should validate successfully since the
  512. # explicit-policy-indicator is not set
  513. TestInfo(True, user_constrained_policy_set=[]),
  514. ],
  515. '4.9.6': [ # Valid Self-Issued requireExplicitPolicy Test6
  516. # Procedure: Validate Valid Self-Issued requireExplicitPolicy Test6 EE using
  517. # the default settings or open and verify Signed Test Message 6.2.2.91 using
  518. # the default settings.
  519. #
  520. # Expected Result: The path should validate successfully since the
  521. # explicit-policy-indicator is not set.
  522. TestInfo(True, user_constrained_policy_set=[]),
  523. ],
  524. '4.10.1': [ # Valid Policy Mapping Test1
  525. # 1. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  526. # The path should validate successfully.
  527. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  528. user_constrained_policy_set=[TEST_POLICY_1]),
  529. # 2. default settings, but with initial-policy-set = {NIST-test-policy-2}.
  530. # The path should not validate successfully.
  531. TestInfo(False, initial_policy_set=[TEST_POLICY_2],
  532. user_constrained_policy_set=[]),
  533. # 3. default settings, but with initial-policy-mapping-inhibit set. The
  534. # path should not validate successfully.
  535. TestInfo(False, initial_policy_mapping_inhibit=True,
  536. user_constrained_policy_set=[]),
  537. ],
  538. '4.10.2': [ # Invalid Policy Mapping Test2
  539. # 1. default settings. The path should not validate successfully.
  540. TestInfo(False, user_constrained_policy_set=[]),
  541. # 2. default settings, but with initial-policy-mapping-inhibit set. The
  542. # path should not validate successfully.
  543. TestInfo(False, initial_policy_mapping_inhibit=True,
  544. user_constrained_policy_set=[]),
  545. ],
  546. '4.10.3': [ # Valid Policy Mapping Test3
  547. # 1. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  548. # The path should not validate successfully.
  549. TestInfo(False, initial_policy_set=[TEST_POLICY_1],
  550. user_constrained_policy_set=[]),
  551. # 2. default settings, but with initial-policy-set = {NIST-test-policy-2}.
  552. # The path should validate successfully.
  553. TestInfo(True, initial_policy_set=[TEST_POLICY_2],
  554. user_constrained_policy_set=[TEST_POLICY_2]),
  555. ],
  556. '4.10.4': [ # Invalid Policy Mapping Test4
  557. # Procedure: Validate Invalid Policy Mapping Test4 EE using the default
  558. # settings or open and verify Signed Test Message 6.2.2.97 using the
  559. # default settings.
  560. #
  561. # Expected Result: The authorities-constrained-policy-set and the
  562. # user-constrained-policy-set will be empty and the
  563. # explicit-policy-indicator will be set (if the application can process the
  564. # policyConstraints extension). If the application can process the
  565. # policyConstraints extension, then the path should be rejected, otherwise
  566. # it should validate successfully.
  567. TestInfo(False, user_constrained_policy_set=[]),
  568. ],
  569. '4.10.5': [ # Valid Policy Mapping Test5
  570. # 1. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  571. # The path should validate successfully.
  572. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  573. user_constrained_policy_set=[TEST_POLICY_1]),
  574. # 2. default settings, but with initial-policy-set = {NIST-test-policy-6}.
  575. # The path should not validate successfully.
  576. TestInfo(False, initial_policy_set=[TEST_POLICY_6],
  577. user_constrained_policy_set=[]),
  578. ],
  579. '4.10.6': [ # Valid Policy Mapping Test6
  580. # 1. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  581. # The path should validate successfully.
  582. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  583. user_constrained_policy_set=[TEST_POLICY_1]),
  584. # 2. default settings, but with initial-policy-set = {NIST-test-policy-6}.
  585. # The path should not validate successfully.
  586. TestInfo(False, initial_policy_set=[TEST_POLICY_6],
  587. user_constrained_policy_set=[]),
  588. ],
  589. '4.10.7': [ # Invalid Mapping From anyPolicy Test7
  590. # Procedure: Validate Invalid Mapping From anyPolicy Test7 EE using the
  591. # default settings or open and verify Signed Test Message 6.2.2.100 using
  592. # the default settings.
  593. #
  594. # Expected Result: The path should not validate successfully since the
  595. # intermediate certificate includes a policy mapping extension in which
  596. # anyPolicy appears as an issuerDomainPolicy.
  597. TestInfo(False, user_constrained_policy_set=[]),
  598. ],
  599. '4.10.8': [ # Invalid Mapping To anyPolicy Test8
  600. # Procedure: Validate Invalid Mapping To anyPolicy Test8 EE using the
  601. # default settings or open and verify Signed Test Message 6.2.2.101 using
  602. # the default settings.
  603. #
  604. # Expected Result: The path should not validate successfully since the
  605. # intermediate certificate includes a policy mapping extension in which
  606. # anyPolicy appears as an subjectDomainPolicy.
  607. TestInfo(False, user_constrained_policy_set=[]),
  608. ],
  609. '4.10.9': [ # Valid Policy Mapping Test9
  610. # Procedure: Validate Valid Policy Mapping Test9 EE using the default
  611. # settings or open and verify Signed Test Message 6.2.2.102 using the
  612. # default settings.
  613. #
  614. # Expected Result: The authorities-constrained-policy-set will be
  615. # {NIST-test-policy-1} and the explicit-policy-indicator will be set (if
  616. # the application can process the policyConstraints extension). If the
  617. # initial-policy-set is any-policy or otherwise includes
  618. # NIST-test-policy-1, then the user-constrained-policy-set will be
  619. # {NIST-test-policy-1}. If not, the user-constrained-policy-set will be
  620. # empty. If the initial-policy-set does not include NIST-test-policy-1 (and
  621. # the application can process the policyConstraints extension), then the
  622. # path should be rejected, otherwise it should validate successfully.
  623. TestInfo(True),
  624. ],
  625. '4.10.10': [ # Invalid Policy Mapping Test10
  626. # Procedure: Validate Invalid Policy Mapping Test10 EE using the default
  627. # settings or open and verify Signed Test Message 6.2.2.103 using the
  628. # default settings.
  629. #
  630. # Expected Result: The authorities-constrained-policy-set and the
  631. # user-constrained-policy-set will be empty and the
  632. # explicit-policy-indicator will be set (if the application can process the
  633. # policyConstraints extension). If the application can process the
  634. # policyConstraints extension, then the path should be rejected, otherwise
  635. # it should validate successfully.
  636. TestInfo(False, user_constrained_policy_set=[]),
  637. ],
  638. '4.10.11': [ # Valid Policy Mapping Test11
  639. # Procedure: Validate Valid Policy Mapping Test11 EE using the default
  640. # settings or open and verify Signed Test Message 6.2.2.104 using the
  641. # default settings.
  642. #
  643. # Expected Result: The authorities-constrained-policy-set will be
  644. # {NIST-test-policy-1} and the explicit-policy-indicator will be set (if
  645. # the application can process the policyConstraints extension). If the
  646. # initial-policy-set is any-policy or otherwise includes
  647. # NIST-test-policy-1, then the user-constrained-policy-set will be
  648. # {NIST-test-policy-1}. If not, the user-constrained-policy-set will be
  649. # empty. If the initial-policy-set does not include NIST-test-policy-1 (and
  650. # the application can process the policyConstraints extension), then the
  651. # path should be rejected, otherwise it should validate successfully.
  652. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  653. ],
  654. '4.10.12': [ # Valid Policy Mapping Test12
  655. # 1. default settings, but with initial-policy-set = {NIST-test-policy-1}.
  656. # The path should validate successfully and the application should display
  657. # the user notice associated with NIST-test-policy-3 in the end entity
  658. # certificate.
  659. TestInfo(True, initial_policy_set=[TEST_POLICY_1],
  660. user_constrained_policy_set=[TEST_POLICY_1]),
  661. # 2. default settings, but with initial-policy-set = {NIST-test-policy-2}.
  662. # The path should validate successfully and the application should display
  663. # the user notice associated with anyPolicy in the end entity certificate.
  664. TestInfo(True, initial_policy_set=[TEST_POLICY_2],
  665. user_constrained_policy_set=[TEST_POLICY_2]),
  666. ],
  667. '4.10.13': [ # Valid Policy Mapping Test13
  668. # Procedure: Validate Valid Policy Mapping Test13 EE using the default
  669. # settings or open and verify Signed Test Message 6.2.2.106 using the
  670. # default settings.
  671. #
  672. # Expected Result: The authorities-constrained-policy-set will be
  673. # {NIST-test-policy-1} and the explicit-policy-indicator will be set (if
  674. # the application can process the policyConstraints extension). If the
  675. # initial-policy-set is any-policy or otherwise includes
  676. # NIST-test-policy-1, then the user-constrained-policy-set will be
  677. # {NIST-test-policy-1}. If not, the user-constrained-policy-set will be
  678. # empty. If the initial-policy-set does not include NIST-test-policy-1 (and
  679. # the application can process the policyConstraints extension), then the
  680. # path should be rejected, otherwise it should validate successfully. If
  681. # the path is accepted, the application should display the user notice
  682. # associated with NIST-testpolicy-1 in the intermediate certificate.
  683. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  684. ],
  685. '4.10.14': [ # Valid Policy Mapping Test14
  686. # Procedure: Validate Valid Policy Mapping Test14 EE using the default
  687. # settings or open and verify Signed Test Message 6.2.2.107 using the
  688. # default settings.
  689. #
  690. # Expected Result: The authorities-constrained-policy-set will be
  691. # {NIST-test-policy-1} and the explicit-policy-indicator will be set (if
  692. # the application can process the policyConstraints extension). If the
  693. # initial-policy-set is any-policy or otherwise includes
  694. # NIST-test-policy-1, then the user-constrained-policy-set will be
  695. # {NIST-test-policy-1}. If not, the user-constrained-policy-set will be
  696. # empty. If the initial-policy-set does not include NIST-test-policy-1 (and
  697. # the application can process the policyConstraints extension), then the
  698. # path should be rejected, otherwise it should validate successfully. If
  699. # the path is accepted, the application should display the user notice
  700. # associated with anyPolicy in the intermediate certificate
  701. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  702. ],
  703. '4.11.1': [ # Invalid inhibitPolicyMapping Test1
  704. # Procedure: Validate Invalid inhibitPolicyMapping Test1 EE using the
  705. # default settings or open and verify Signed Test Message 6.2.2.108 using
  706. # the default settings.
  707. #
  708. # Expected Result: The authorities-constrained-policy-set and the
  709. # user-constrained-policy-set will be empty. The explicit-policy-indicator
  710. # will be set. The path should not validate successfully.
  711. TestInfo(False, user_constrained_policy_set=[]),
  712. ],
  713. '4.11.2': [ # Valid inhibitPolicyMapping Test2
  714. # Procedure: Validate Valid inhibitPolicyMapping Test2 EE using the default
  715. # settings or open and verify Signed Test Message 6.2.2.109 using the
  716. # default settings.
  717. #
  718. # Expected Result: The authorities-constrained-policy-set will be
  719. # {NIST-test-policy-1} and the explicit-policy-indicator will be set. If
  720. # the initial-policy-set is any-policy or otherwise includes
  721. # NIST-test-policy-1, then the path should validate successfully.
  722. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  723. ],
  724. '4.11.3': [ # Invalid inhibitPolicyMapping Test3
  725. # Procedure: Validate Invalid inhibitPolicyMapping Test3 EE using the
  726. # default settings or open and verify Signed Test Message 6.2.2.110 using
  727. # the default settings.
  728. #
  729. # Expected Result: The authorities-constrained-policy-set and the
  730. # user-constrained-policy-set will be empty and the
  731. # explicit-policy-indicator will be set. The path should not validate
  732. # successfully.
  733. TestInfo(False, user_constrained_policy_set=[]),
  734. ],
  735. '4.11.4': [ # Valid inhibitPolicyMapping Test4
  736. # Procedure: Validate Valid inhibitPolicyMapping Test4 EE using the default
  737. # settings or open and verify Signed Test Message 6.2.2.111 using the
  738. # default settings.
  739. #
  740. # Expected Result: The authorities-constrained-policy-set will be
  741. # {NIST-test-policy-2} and the explicit-policy-indicator will be set. If
  742. # the initial-policy-set is any-policy or otherwise includes
  743. # NIST-test-policy-2, then the path should validate successfully.
  744. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_2]),
  745. ],
  746. '4.11.5': [ # Invalid inhibitPolicyMapping Test5
  747. # Procedure: Validate Invalid inhibitPolicyMapping Test5 EE using the
  748. # default settings or open and verify Signed Test Message 6.2.2.112 using
  749. # the default settings.
  750. #
  751. # Expected Result: The authorities-constrained-policy-set and the
  752. # user-constrained-policy-set will be empty and the
  753. # explicit-policy-indicator will be set. The path should not validate
  754. # successfully.
  755. TestInfo(False, user_constrained_policy_set=[]),
  756. ],
  757. '4.11.6': [ # Invalid inhibitPolicyMapping Test6
  758. # Procedure: Validate Invalid inhibitPolicyMapping Test6 EE using the
  759. # default settings or open and verify Signed Test Message 6.2.2.113 using
  760. # the default settings.
  761. #
  762. # Expected Result: The authorities-constrained-policy-set and the
  763. # user-constrained-policy-set will be empty and the
  764. # explicit-policy-indicator will be set. The path should not validate
  765. # successfully.
  766. TestInfo(False, user_constrained_policy_set=[]),
  767. ],
  768. '4.11.7': [ # Valid Self-Issued inhibitPolicyMapping Test7
  769. # Procedure: Validate Valid Self-Issued inhibitPolicyMapping Test7 EE using
  770. # the default settings or open and verify Signed Test Message 6.2.2.114
  771. # using the default settings.
  772. #
  773. # Expected Result: The authorities-constrained-policy-set will be
  774. # {NIST-test-policy-1} and the explicit-policy-indicator will be set. If
  775. # the initial-policy-set is any-policy or otherwise includes
  776. # NIST-test-policy-1, then the path should validate successfully.
  777. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  778. ],
  779. '4.11.8': [ # Invalid Self-Issued inhibitPolicyMapping Test8
  780. # Procedure: Validate Invalid Self-Issued inhibitPolicyMapping Test8 EE
  781. # using the default settings or open and verify Signed Test Message
  782. # 6.2.2.115 using the default settings.
  783. #
  784. # Expected Result: The authorities-constrained-policy-set and
  785. # user-constrained-policy-set will be empty and the
  786. # explicit-policy-indicator will be set. The path should not validate
  787. # successfully.
  788. TestInfo(False, user_constrained_policy_set=[]),
  789. ],
  790. '4.11.9': [ # Invalid Self-Issued inhibitPolicyMapping Test9
  791. # Procedure: Validate Invalid Self-Issued inhibitPolicyMapping Test9 EE
  792. # using the default settings or open and verify Signed Test Message
  793. # 6.2.2.116 using the default settings.
  794. #
  795. # Expected Result: The authorities-constrained-policy-set and
  796. # user-constrained-policy-set will be empty and the
  797. # explicit-policy-indicator will be set. The path should not validate
  798. # successfully.
  799. TestInfo(False, user_constrained_policy_set=[]),
  800. ],
  801. '4.11.10': [ # Invalid Self-Issued inhibitPolicyMapping Test10
  802. # Procedure: Validate Invalid Self-Issued inhibitPolicyMapping Test10 EE
  803. # using the default settings or open and verify Signed Test Message
  804. # 6.2.2.117 using the default settings.
  805. #
  806. # Expected Result: The authorities-constrained-policy-set and
  807. # user-constrained-policy-set will be empty and the
  808. # explicit-policy-indicator will be set. The path should not validate
  809. # successfully.
  810. TestInfo(False, user_constrained_policy_set=[]),
  811. ],
  812. '4.11.11': [ # Invalid Self-Issued inhibitPolicyMapping Test11
  813. # Procedure: Validate Invalid Self-Issued inhibitPolicyMapping Test11 EE
  814. # using the default settings or open and verify Signed Test Message
  815. # 6.2.2.118 using the default settings.
  816. #
  817. # Expected Result: The authorities-constrained-policy-set and
  818. # user-constrained-policy-set will be empty and the
  819. # explicit-policy-indicator will be set. The path should not validate
  820. # successfully.
  821. TestInfo(False, user_constrained_policy_set=[]),
  822. ],
  823. '4.12.1': [ # Invalid inhibitAnyPolicy Test1
  824. # Procedure: Validate Invalid inhibitAnyPolicy Test1 EE using the default
  825. # settings or open and verify Signed Test Message 6.2.2.119 using the
  826. # default settings.
  827. #
  828. # Expected Result: The authorities-constrained-policy-set and
  829. # user-constrained-policy-set will be empty and the
  830. # explicit-policy-indicator will be set (if the application can process the
  831. # policyConstraints extension). If the application can process the
  832. # policyConstraints extension, then the path should not validate
  833. # successfully.
  834. TestInfo(False, user_constrained_policy_set=[]),
  835. ],
  836. '4.12.2': [ # Valid inhibitAnyPolicy Test2
  837. # Procedure: Validate Valid inhibitAnyPolicy Test2 EE using the default
  838. # settings or open and verify Signed Test Message 6.2.2.120 using the
  839. # default settings.
  840. #
  841. # Expected Result: The authorities-constrained-policy-set will be
  842. # {NIST-test-policy-1} and the explicit-policy-indicator will be set (if
  843. # the application can process the policyConstraints extension). If the
  844. # initial-policy-set is any-policy or otherwise includes
  845. # NIST-test-policy-1, then the user-constrained-policy-set will be
  846. # {NIST-test-policy-1} and the path should validate successfully. If not,
  847. # then the user-constrained-policy-set will be empty. If the
  848. # user-constrained-policy-set is empty and the application can process the
  849. # policyConstraints extension, then the path should not validate
  850. # successfully.
  851. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  852. ],
  853. '4.12.3': [ # inhibitAnyPolicy Test3
  854. # 1. default settings. The path should validate successfully.
  855. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  856. # 2. default settings, but with initial-inhibit-any-policy set. The path
  857. # should not validate successfully.
  858. TestInfo(False, initial_inhibit_any_policy=True,
  859. user_constrained_policy_set=[]),
  860. ],
  861. '4.12.4': [ # Invalid inhibitAnyPolicy Test4
  862. # Procedure: Validate Invalid inhibitAnyPolicy Test4 EE using the default
  863. # settings or open and verify Signed Test Message 6.2.2.122 using the
  864. # default settings.
  865. #
  866. # Expected Result: The authorities-constrained-policy-set and
  867. # user-constrained-policy-set will be empty and the
  868. # explicit-policy-indicator will be set (if the application can process the
  869. # policyConstraints extension). If the application can process the
  870. # policyConstraints extension, then the path should not validate
  871. # successfully.
  872. TestInfo(False, user_constrained_policy_set=[]),
  873. ],
  874. '4.12.5': [ # Invalid inhibitAnyPolicy Test5
  875. # Procedure: Validate Invalid inhibitAnyPolicy Test5 EE using the default
  876. # settings or open and verify Signed Test Message 6.2.2.123 using the
  877. # default settings.
  878. #
  879. # Expected Result: The authorities-constrained-policy-set and
  880. # user-constrained-policy-set will be empty and the
  881. # explicit-policy-indicator will be set (if the application can process the
  882. # policyConstraints extension). If the application can process the
  883. # policyConstraints extension, then the path should not validate
  884. # successfully.
  885. TestInfo(False, user_constrained_policy_set=[]),
  886. ],
  887. '4.12.6': [ # Invalid inhibitAnyPolicy Test6
  888. # Procedure: Validate Invalid inhibitAnyPolicy Test6 EE using the default
  889. # settings or open and verify Signed Test Message 6.2.2.124 using the
  890. # default settings.
  891. #
  892. # Expected Result: The authorities-constrained-policy-set and
  893. # user-constrained-policy-set will be empty and the
  894. # explicit-policy-indicator will be set (if the application can process the
  895. # policyConstraints extension). If the application can process the
  896. # policyConstraints extension, then the path should not validate
  897. # successfully.
  898. TestInfo(False, user_constrained_policy_set=[]),
  899. ],
  900. '4.12.7': [ # Valid Self-Issued inhibitAnyPolicy Test7
  901. # Procedure: Validate Valid Self-Issued inhibitAnyPolicy Test7 EE using the
  902. # default settings or open and verify Signed Test Message 6.2.2.125 using
  903. # the default settings.
  904. #
  905. # Expected Result: The authorities-constrained-policy-set will be
  906. # {NIST-test-policy-1} and the explicit-policy-indicator will be set (if
  907. # the application can process the policyConstraints extension). If the
  908. # initial-policy-set is any-policy or otherwise includes
  909. # NIST-test-policy-1, then the user-constrained-policy-set will be
  910. # {NIST-test-policy-1} and the path should validate successfully. If not,
  911. # then the user-constrained-policy-set will be empty. If the
  912. # user-constrained-policy-set is empty and the application can process the
  913. # policyConstraints extension, then the path should not validate
  914. # successfully.
  915. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  916. ],
  917. '4.12.8': [ # Invalid Self-Issued inhibitAnyPolicy Test8
  918. # Procedure: Validate Invalid Self-Issued inhibitAnyPolicy Test8 EE using
  919. # the default settings or open and verify Signed Test Message 6.2.2.126
  920. # using the default settings.
  921. #
  922. # Expected Result: The authorities-constrained-policy-set and
  923. # user-constrained-policy-set will be empty and the
  924. # explicit-policy-indicator will be set (if the application can process the
  925. # policyConstraints extension). If the application can process the
  926. # policyConstraints extension, then the path should not validate
  927. # successfully.
  928. TestInfo(False, user_constrained_policy_set=[]),
  929. ],
  930. '4.12.9': [ # Valid Self-Issued inhibitAnyPolicy Test9
  931. # Procedure: Validate Valid Self-Issued inhibitAnyPolicy Test9 EE using the
  932. # default settings or open and verify Signed Test Message 6.2.2.127 using
  933. # the default settings.
  934. #
  935. # Expected Result: The authorities-constrained-policy-set will be
  936. # {NIST-test-policy-1} and the explicit-policy-indicator will be set (if
  937. # the application can process the policyConstraints extension). If the
  938. # initial-policy-set is any-policy or otherwise includes
  939. # NIST-test-policy-1, then the user-constrained-policy-set will be
  940. # {NIST-test-policy-1} and the path should validate successfully. If not,
  941. # then the user-constrained-policy-set will be empty. If the
  942. # user-constrained-policy-set is empty and the application can process the
  943. # policyConstraints extension, then the path should not validate
  944. # successfully.
  945. TestInfo(True, user_constrained_policy_set=[TEST_POLICY_1]),
  946. ],
  947. '4.12.10': [ # Invalid Self-Issued inhibitAnyPolicy Test10
  948. # Procedure: Validate Invalid Self-Issued inhibitAnyPolicy Test10 EE using
  949. # the default settings or open and verify Signed Test Message 6.2.2.128
  950. # using the default settings.
  951. #
  952. # Expected Result: The authorities-constrained-policy-set and
  953. # user-constrained-policy-set will be empty and the
  954. # explicit-policy-indicator will be set (if the application can process the
  955. # policyConstraints extension). If the application can process the
  956. # policyConstraints extension, then the path should not validate
  957. # successfully.
  958. TestInfo(False, user_constrained_policy_set=[]),
  959. ],
  960. }
  961. def parse_test(lines, i, test_case_name, test_number, test_name,
  962. sanitized_test_names, output):
  963. # Start by doing a coarse level of parsing that separates out the lines for
  964. # the main sections.
  965. i, test_sections = parse_main_test_sections(lines, i)
  966. certs, crls = parse_cert_path_lines(test_sections.cert_path_lines)
  967. # Most tests have a formulaic specification: they use the default
  968. # settings, and have one expectation. These are easily parsed and are handled
  969. # programmatically. In contrast, many of the policies tests have a more
  970. # complicated specification which involves multiple subtests having various
  971. # settings, as well as expectations described in terms of supported
  972. # extensions. Rather than try to handle all the nuanced language, these are
  973. # handled manually via "overrides".
  974. overrides = TEST_OVERRIDES.get(test_number, None)
  975. if overrides is None:
  976. # Verify that the test description doesn't include numbered subparts (those
  977. # are not handled here).
  978. if CUSTOM_SETTINGS_MATCHER.match(" ".join(test_sections.description_lines)):
  979. sys.stderr.write('Unexpected custom settings for %s\n' % test_number)
  980. sys.exit(1)
  981. # Verify that the test is using only default settings.
  982. if not USING_DEFAULT_SETTINGS_MATCHER.match(
  983. " ".join(test_sections.procedure_lines)):
  984. sys.stderr.write('Unexpected procedure for %s: %s\n' %
  985. (test_number, " ".join(test_section.procedure_lines)))
  986. sys.exit(1)
  987. # Check whether expected result is validation success or failure.
  988. result_match = TEST_RESULT_MATCHER.match(
  989. test_sections.expected_result_lines[0])
  990. if not result_match:
  991. sys.stderr.write('Unknown expectation for %s:\n%s\n' % (
  992. test_number, " ".join(test_sections.expected_result_lines)))
  993. sys.exit(1)
  994. # Initializes with default settings.
  995. info = TestInfo(result_match.group(1) == 'should validate')
  996. # Special case the 4.9 test failures (require explicit policy) to set
  997. # user_constrained_policy_set to empty. This is only done for the 4.9
  998. # tests, because the other policy tests are special cased as overrides and
  999. # hence set this manually on a per-test basis.
  1000. #
  1001. # user_constrained_policy_set enumerates the subset of the initial policy
  1002. # set (anyPolicy in the default case) that were valid for the path. For
  1003. # non-policy tests the expectation for user_constrained_policy_set is
  1004. # [TEST_POLICY_1] since each policy asserts that. However for these tests,
  1005. # the expectation is an empty user_constrained_policy_set since there was
  1006. # no valid policy for the path (in fact, that is why the path validation is
  1007. # expected to fail).
  1008. if test_number.startswith('4.9.') and not info.should_validate:
  1009. info.user_constrained_policy_set = []
  1010. output_test(test_case_name, test_number, test_name, None, info, certs,
  1011. crls, sanitized_test_names, output)
  1012. else:
  1013. # The overrides may have a series of inputs (settings) and outputs
  1014. # (success/failure) for this test. Output each as a separate test case.
  1015. for subpart_i in range(len(overrides)):
  1016. info = overrides[subpart_i]
  1017. # If the test has only 1 subpart, don't number it.
  1018. subpart_number = subpart_i + 1 if len(overrides) > 1 else None
  1019. output_test(test_case_name, test_number, test_name, subpart_number, info,
  1020. certs, crls, sanitized_test_names, output)
  1021. return i
  1022. def main():
  1023. pkits_pdf_path, output_path = sys.argv[1:]
  1024. pkits_txt_file = tempfile.NamedTemporaryFile()
  1025. subprocess.check_call(['pdftotext', '-layout', '-nopgbrk', '-eol', 'unix',
  1026. pkits_pdf_path, pkits_txt_file.name])
  1027. test_descriptions = pkits_txt_file.read()
  1028. # Extract section 4 of the text, which is the part that contains the tests.
  1029. test_descriptions = test_descriptions.split(
  1030. '4 Certification Path Validation Tests')[-1]
  1031. test_descriptions = test_descriptions.split(
  1032. '5 Relationship to Previous Test Suite', 1)[0]
  1033. output = open(output_path, 'w')
  1034. output.write('// Autogenerated by %s, do not edit\n\n' % sys.argv[0])
  1035. output.write("""
  1036. // This file intentionally does not have header guards, it's intended to
  1037. // be inlined in another header file. The following line silences a
  1038. // presubmit warning that would otherwise be triggered by this:
  1039. // no-include-guard-because-multiply-included
  1040. // NOLINT(build/header_guard)\n\n""")
  1041. output.write('// Hack to allow disabling type parameterized test cases.\n'
  1042. '// See https://github.com/google/googletest/issues/389\n')
  1043. output.write('#define WRAPPED_TYPED_TEST_P(CaseName, TestName) '
  1044. 'TYPED_TEST_P(CaseName, TestName)\n')
  1045. output.write('#define WRAPPED_REGISTER_TYPED_TEST_SUITE_P(CaseName, ...) '
  1046. 'REGISTER_TYPED_TEST_SUITE_P(CaseName, __VA_ARGS__)\n\n')
  1047. test_case_name = None
  1048. sanitized_test_names = []
  1049. lines = test_descriptions.splitlines()
  1050. i = 0
  1051. while i < len(lines):
  1052. section_match = SECTION_MATCHER.match(lines[i])
  1053. match = TEST_MATCHER.match(lines[i])
  1054. i += 1
  1055. if section_match:
  1056. if test_case_name:
  1057. finalize_test_case(test_case_name, sanitized_test_names, output)
  1058. sanitized_test_names = []
  1059. test_case_name = 'PkitsTest%02d%s' % (
  1060. int(section_match.group(1).split('.')[-1]),
  1061. sanitize_name(section_match.group(2)))
  1062. output.write('\ntemplate <typename PkitsTestDelegate>\n')
  1063. output.write('class %s : public PkitsTest<PkitsTestDelegate> {};\n' %
  1064. test_case_name)
  1065. output.write('TYPED_TEST_SUITE_P(%s);\n' % test_case_name)
  1066. if match:
  1067. test_number = match.group(1)
  1068. test_name = match.group(2)
  1069. if not test_case_name:
  1070. output.write('// Skipped %s %s\n' % (test_number, test_name))
  1071. continue
  1072. i, parse_test(lines, i, test_case_name, test_number,
  1073. test_name, sanitized_test_names, output)
  1074. if test_case_name:
  1075. finalize_test_case(test_case_name, sanitized_test_names, output)
  1076. if __name__ == '__main__':
  1077. main()