From 5f38306a9ae408112e2183701e42b7a281919e6e Mon Sep 17 00:00:00 2001
From: cketti <cketti@gmail.com>
Date: Mon, 2 Dec 2013 16:42:33 +0100
Subject: [PATCH] Add more unit tests for TrustManagerFactory

---
 tests/assets/cacert.der                       | Bin 0 -> 881 bytes
 tests/assets/cert3.der                        | Bin 0 -> 912 bytes
 tests/assets/digicert.der                     | Bin 0 -> 1770 bytes
 tests/assets/github.der                       | Bin 0 -> 1854 bytes
 .../mail/store/TrustManagerFactoryTest.java   |  64 +++++++++++++++---
 5 files changed, 55 insertions(+), 9 deletions(-)
 create mode 100644 tests/assets/cacert.der
 create mode 100644 tests/assets/cert3.der
 create mode 100644 tests/assets/digicert.der
 create mode 100644 tests/assets/github.der

diff --git a/tests/assets/cacert.der b/tests/assets/cacert.der
new file mode 100644
index 0000000000000000000000000000000000000000..08a6268dbf24c79928901d44d51f72ad9917fe62
GIT binary patch
literal 881
zcmXqLV$L;aVhUZr%*4pV#K~}BuJeNp^EK=Yc-c6$+C196^D;8BvN9O>8gd(OvN4CU
zun99cdl(8E2!c2qJY2!~xv9FrC5a`ehCBvbAVDr3W^Y|fLums^5RaKhs3f(xL^nB6
zFWWLVF*8RmzbM^6PMp`!*wDzp$k52tz|<m2oY%<M(9qZb%B8k-O^iy&9%5u=U~XdM
zXE11D<YH=KWMr5>Lytdh?#Gm;&u+btJ-wCZitxro?%5toSr(ls)|I#Xqv?5(PjLhH
z(R8n;O_p^J<5f)TS8V%X8W<wR$N1oo$uW1UwTW(vtX{}|cUp9Rg5*hthI@L;Urpm!
zAa}Oz|G#@#tPU^d{z-|tcjsfCR?%J)9id-5zirmoFKc4^6XyRb+Gm=NzCDkH_mQ5d
zeG_8~zkGkPf5&+#=>=C<ZTEhB#Sm+DNuYg}nGB=s<a=wYR-L^sz{AAyMKIjUqn?#x
zszAVb4`HFQRO0|{;hT$X7M*-MXX%XRA9u5_HQ06gKySkoJ?_9)AyqvMx1|f2WCPy#
zrqtPS*0smnJK>UOKBMjG_j6meGBGnUFfI--@H3DF#+fW1ix`WDWJr?Au_>?jo@xI0
zk+=Nl$;0|nG!5iI(#k9n24W4^74U!*2(z#nFf%g#M-FpfA_9gvBg4EE+>3W9uPWKc
zVDWo<{Ar=-@B50Ue?Rr2)jj-U-}{-}z2QZNeMLMs9+TmmX*^+9h0@gUv(NsD@0?Qp
zCq?4U@2YDh2`&9RQx1K&7xd?4!NT$be<FCD`&KI1&6^u@%x=}|rzf7WemLnoJL>AD
z!-0KEcDLH@Nk9GNscZI=5A5eMHt;r=D(-1Hn{wPouElJ_+;>J>>^REz`>rfA@=@a2
zCj348dtz$TW{wtSsjOo)dY+XxPA<w^abON}bRmm{_~%CdQYD^8uj`zmLvLCZUW#&m
zT%Nz}g299jbshU|im$mcN&oEXX<a97v0Lo7@nM*E{m`p3Z{G4J-mI7KIA7g<i}l$`
FF97XGRpbBw

literal 0
HcmV?d00001

diff --git a/tests/assets/cert3.der b/tests/assets/cert3.der
new file mode 100644
index 0000000000000000000000000000000000000000..6d623665827a1a8160208c59a991f813af43dbe5
GIT binary patch
literal 912
zcmXqLV(u|$Vk%j{%*4pV#K>sC%f_kI=F#?@mywZ`mBGN*klTQhjX9KsO_<5q!%)~j
z5X9l&;R?>rP1Ox9Ni0b<<T2m^33Bl;d+S;nN*hRmc+5OPC8@<Fy2*)p*_OG9nK^p-
zMd=1|;=G2&hDHWPK+@dMC`z2y$k@=(*Z|5k@FdwfaRX6^b$r>DdZ`tOxdl0?ddc~@
z22G4g$ev+jWngY%<Yxeib1^kBGBWJ<+neoOG;el!FMF0=!^;E9RAtof<;eKRvpkMy
zabl4>wx+)RN+8=4rCaAsCjY*^`iRJlv=36sPgq3H1XM5b&pW-T<IjY{%jGA8S1h^}
zVbQbfb5`xkx4{PC9?e}ZyY~j&47qUTz|NlVte3CjT6Xfjc%5(e<Iex0=o5wSCh(g2
z3e=vot8%G!ZoX#5ep{sK`QB5~=N=ZTK3(uxKFQZwRHAMA7gnF1qpAw4AGSQ5JoU&)
znKf5l@7A=~^FjU+=RK(nW!Va8@0|Z9NKWm{6!UACR%K`={^?u(<j28(eyKJmC}kY`
z{=IyKs$W>C$X@<4U*cjPDD2|tytbyYVSZ@q|JSTbnV1<F7#CL?RD$DIR+xp!fWbhA
zjWeOmgR$+06C*E+yqK(iL26!bu#bX!YF=s)Fs@S+oKuTRGSf1XfgA%_V93kzv52vV
z{M_5R<#t`VdY}2ZbKB?qwR*o%FVa9BB(2OMVIbBZA{mmTa%{@$y=R&~e&j7bdh)RT
z6iwvl0j4!z^e{3g>}}ED@KjZ~dho#RX-kz2Ik~PL*<>1bOz_-dolC9?#`FE!8Tb!g
znfTLD?_`OML(&GXyRrX2JSmg8z{7IgLrf;5>g%g^37h2Dzrh)Aq(r#>ELmR8BwxBQ
zvCCl>>up_sL6$ie4k%kcRl2YxeA}hvCv?1SuS@DPyR33o{K3m=Z{1^kVX_YQ)|PXu
zYTnNs>EEUCd?BaRPsYiXPJ694s_t7OVxM_XxOGW$jrBaH`?YV=Eq?eI|7gB*``#&e
zhIt~Fy5${M?@gQ(o8od*Vz$UjBOc!4KmX)Qr@n2TyZWHxXYT7vmgSp6BK(;m_g8uy
Z(ibf<Svk>UK}%h>K<M<_d*40l0|0AcSwH{)

literal 0
HcmV?d00001

diff --git a/tests/assets/digicert.der b/tests/assets/digicert.der
new file mode 100644
index 0000000000000000000000000000000000000000..13c23150129cb29d3fe95fc8f2ea4de56d621de3
GIT binary patch
literal 1770
zcmbtU3s6*57(VCT%ZeaEE&?i#n~JU)yJuI_L|fe!5=>fV5n9oj#mmZWExYSJ1Rp88
z;)<h%X7(5#F@i)I6llKCG)0q0%Ouf}(l8&)XrTD4Y3M&9J8Dx+)1A5J{{Q!X|9`&o
zxIgiTE)$R6iBguq3=_hR+arlzq_3zxQdRTxl4tcKNYs0zH`#kP2xC7#M9lI)(p$u4
za3V32kuL8~#MB88_enJ6n$!lnlTWb-@&P2A!hzzD{QP`r4uk{<Nd;@3d=wc$L#%kP
zFC*EMYvff9hs&OA5e$4%Ca<+xoxEB_qQis8IJumRmn#T7S>ZtnIXu*cCySW=uNny%
z)~zPyAJnK-adP6pgCE@s?1xwn4n}|nFdmFi=ex7dxGV#@CdDsG(a0AEaW8$~Zr#2t
zV-2Y}_^GY#naV2>TPGFVU2W8Qaq)Yt6GVp9TlX909lG{K$josCOZBd#qx+p(cYau&
zfYZY3$D8)t(6oEL{JL}Mxo<Y5X;LSbC9J;UowKh)IZra}q^oe#Yhyyku$#{HS#?NK
zl~#M=&YH5rTLN?`cU+0)z4uSFZA)M-q;`JNy5NF-u-`<_DQ#=#hAH<ZoT+_rZRXSi
zwr$Eb<FTj`UDU|bSBF1W6);1V^%Ot(tdTRu-8xtl7%-^d{Plslmfuxbd9UBR9{KAm
z#m-sRnk!gE#nqp7NrulTF6>%ZwL<qpbZGg_&umSl%8wWpBV6WTmk|%^CVgR7qk=K+
z;yAchUNV9Dv0OY+i2O&1;3oBAvCm?B7VEP(pXCo*Tu;+^&V%c~*#+-*QE$CB8GHXQ
zGZ@@*lF-9vaG2ESblMVRvM2AJ%;7M{2{uQZ-C(miOirtPK2Y-@KgXBNfR`EV!CIt3
z7BnC6$b}rp0ADMb1EUiekqHnUsR6ZvZvxze1e6Un<q5#F0E0%HkWEp_&xVKqwhfSM
zU{L$fs?<w_oLqQ&YV#-wWdg27X(;_c4GYSFFI7SLS{Tis(ggK#!B2zAR1?*$0>ln+
z1ImNf0w|C2AE*~#<RQ-l5vsA<&PKDrqiA<N)kx=}73o}b4!SlwtbmT)>!l2;g>oo^
zhbnY->d$$Icdu1S`q5Jq(@Wt`MDSrSBJQO<TaPi9Ph4bZk58~S;^9GB1&8giE<#d$
zEXJ$)yW>`?XhU+ydVX!%XMAlYDU&uCwMr`3oy1*2rNwaW<-}b?CYLHpCwdbemKE&g
z(T`33ul3A-tq}iTD@0L2eYr3$begU)wnL@S-jW=1tJhalmR^4Q5{aSVAzTCrD-5ks
z9yYP}4otyK?++X3&$J6UqYgjXs-SH{tHNm7g7D>%SHkzzDjWxnOK<DsQ5`jNr*AmD
zK6mXo8LJGlMzam+MP-@#=z@0!ZLYMIm9NyUY5sB6y1Mqy!&2I|Jg<qrIi;)Gy+k~H
z7hiAd-{=l-H#%Q#*>HYn`G`Id9g)9O_ZofeMv5}yTZ<-W`odEUSNkV79jR*>6PcgX
zD>-S|{^rH$yAOt)U3Yxtn{PDeH77T(zxW+Fy~8o~^7r@I+Kc74FYQ)xDQK^>Vyb<q
zedFE0RUfaovb{Mc=JZ8<BU|56+_o_mqq&XjjuHCUlKU^5TsXJ-czVB?MQ<Gn{_6VL
k0cRV2E78TzQ^=}+P7BR$s??PoBjO?LM`KrwEr~4r6Rol>C;$Ke

literal 0
HcmV?d00001

diff --git a/tests/assets/github.der b/tests/assets/github.der
new file mode 100644
index 0000000000000000000000000000000000000000..ae7bae658cc83fd0c6421e4001931b5a01fecdee
GIT binary patch
literal 1854
zcmaJ?3rrM87~a|2J3QXFz<DaLC?JR&vv4OILX-1E9!fzdM5R8K<+$4f?r?7btq^q4
zqncV<T9c|Z5NWN}SWPvkHPu$IzCx{9O*BF4vpx|NwW5X2fDmYtUb3_EfB!fC|IN(5
z|3TR;3CgNTO$ri_q%T!_R5#}uvF5^=zivJ1E1wU&RO+d&bk|ES0F+7s3akfIs}%W^
ziYD{(*Z@dl!=3h=C0GTsMU<EfJI`vN2E!h-Z&g*5t{Ay^<kInuGBy%MV3&dp8D5bt
zSZ$2S>8ubrJ8xl93mCI0hK0czFE$=dXW`&)Au<in2;<l|3@n7JyVxK&0SEK(^v@B6
zN=~vc*`k%R3m<Tj;IOka^iz36s{jS$gk%yZ1|(x`BS4ZKGs{xSRdJ$)^@ZLzoRW4k
zu!aPK0kRqxfDtwAZO|t&ddbG*NutFfvEI-VJN#&+QP0AJ(Wip*BIg*|-OQB=B@WRp
zaBLv-$DkYSmB-nc*?6yllXr|b!ZbljuPB;^Pf$0Y9nlrEyH${E6-D^)pbRFBybz!y
z6f*E35bjRO01%Hau4`RXE~=l!XO9=9D=iB*<s7kbjW1t^Xm4Dl*u4SO<7;0z_XgcD
zM;EAxR3Y<TTjBNNRk`!Dh3BKM7%kJA;<OV@&ew6@r!;=?NG|k9C^k+z=vybYcRdK3
z(|hG}UF+Ha<F2F^A71U5vTnzw>^0jH-mMN_o^-mdjMQveUX!*nzpj%$r5(RNxqC_9
z4D!a>*M23t)r%VEn!8ShEshc+fBn6}mK`QWeP@h(bA3a0R-IGwbog!krlaUu|ILS*
zyZxTWeu`mdTwbvKX-9o#`pU9+KmRO!V_f2kQ`&9aEh#5vKbhyT{+Ia2>0DcoX2Orv
zE!O+Sb6@AKa_@Q2PAUKanq|d%P*&u?5Om%_lc{kqaFzeu`DeqsOxd|Tk*8Lhx9-^4
zbhqIS48jC&Dv<K8Kfh6Hzg_Rh`>5(ux18(E$MVw{7>?b3R4|+<kGKTc8`t!ROTjf0
z<O4uIMJY&S(_qwa3g7n_RD4RMn*t2aNXTP)2=zXy;OM5PrYWv)n<SMd#m4etY5b^f
zCDu~Ob8L(?PKR9oCF}o(EQ2<jhM{C|1XagD^z2uum%7q{>+ez$AoDAjG$e`yfx5RE
z{{6YeI-R94e7Q45w3IuXg5(faASy1z;^EaKvI>G_kV}{dJF$Xbhzi0<SkT)+l%P=}
zY=nRihA<;kM7Dr%f#3-a%`uNhOgmy=kAzlZ6!SUc;nBPtAsk}h`N*i)nuXR_(K8eq
zXUQRA2gbaC7<Qr<y|D_+&qZS?QYoN#R%GX($XFBBZ9<5M{1&1NJ$8gLMAd+L9*qoI
zCm;{jI5_8sB4lB7a6Q(DbK!_M7tVqACZZkSad5wwfwf=`W-urU&W`PpxA@>*b+BgW
zlmVcYK?e*QvLSGddwXXN-dR4X6kysgi*(HxsxA(<VCN`e>`)8F9eB6_rxxJ$i)v09
z=y5?bE^QJLBRdcJD?ptG5K98etgT6xny&?ZnHnE)Ddlvaq(4)iKEeN!vgf<gT!)_@
zx&=}#w$5E+D;g^!p7>SQB%bSdnW<HGGh)NOtSLX-t6g+Jb34ftk#SPuY_Y236O9?k
zAFn*>@l3bzom%j;WZR{!y~a?v%{0HE`TiYaxNrBWfNwk3i>>`D_f+OiZFpq{TillQ
zG`IRp7ymfEz{6Hpld0MGoAG8*R`=O8iEs9Gv_Fmfb8263a<pOTVdc$?3xz-TZU{Y)
z()8IoJiOJeYk39t7$z6Amvj+<Gq>DkqcbUE#Kp~rmgOvds88wdEv-3na$J93r(*17
XPPa64^Gt^(<idhUQK6^ZYHI!g2rDhs

literal 0
HcmV?d00001

diff --git a/tests/src/com/fsck/k9/mail/store/TrustManagerFactoryTest.java b/tests/src/com/fsck/k9/mail/store/TrustManagerFactoryTest.java
index ba2511bc2..c58eaf7fd 100644
--- a/tests/src/com/fsck/k9/mail/store/TrustManagerFactoryTest.java
+++ b/tests/src/com/fsck/k9/mail/store/TrustManagerFactoryTest.java
@@ -27,6 +27,10 @@ public class TrustManagerFactoryTest extends AndroidTestCase {
     private Context mTestContext;
     private X509Certificate mCert1;
     private X509Certificate mCert2;
+    private X509Certificate mCaCert;
+    private X509Certificate mCert3;
+    private X509Certificate mDigiCert;
+    private X509Certificate mGithubCert;
 
 
     @Override
@@ -53,6 +57,12 @@ public class TrustManagerFactoryTest extends AndroidTestCase {
         CertificateFactory certFactory = CertificateFactory.getInstance("X509");
         mCert1 = (X509Certificate) certFactory.generateCertificate(assets.open("cert1.der"));
         mCert2 = (X509Certificate) certFactory.generateCertificate(assets.open("cert2.der"));
+
+        mCaCert = (X509Certificate) certFactory.generateCertificate(assets.open("cacert.der"));
+        mCert3 = (X509Certificate) certFactory.generateCertificate(assets.open("cert3.der"));
+
+        mDigiCert = (X509Certificate) certFactory.generateCertificate(assets.open("digicert.der"));
+        mGithubCert = (X509Certificate) certFactory.generateCertificate(assets.open("github.der"));
     }
 
     private void waitForAppInitialization() throws InterruptedException {
@@ -105,14 +115,7 @@ public class TrustManagerFactoryTest extends AndroidTestCase {
     public void testWrongCertificate() throws Exception {
         TrustManagerFactory.addCertificate(MATCHING_HOST, PORT1, mCert1);
         X509TrustManager trustManager = TrustManagerFactory.get(MATCHING_HOST, PORT1, true);
-        boolean certificateValid;
-        try {
-            trustManager.checkServerTrusted(new X509Certificate[] { mCert2 }, "authType");
-            certificateValid = true;
-        } catch (CertificateException e) {
-            certificateValid = false;
-        }
-        assertFalse("The certificate should have been rejected but wasn't", certificateValid);
+        assertCertificateRejection(trustManager, new X509Certificate[] { mCert2 });
     }
 
     public void testCertificateOfOtherHost() throws Exception {
@@ -120,9 +123,52 @@ public class TrustManagerFactoryTest extends AndroidTestCase {
         TrustManagerFactory.addCertificate(MATCHING_HOST, PORT2, mCert2);
 
         X509TrustManager trustManager = TrustManagerFactory.get(MATCHING_HOST, PORT1, true);
+        assertCertificateRejection(trustManager, new X509Certificate[] { mCert2 });
+    }
+
+    public void testUntrustedCertificateChain() throws Exception {
+        X509TrustManager trustManager = TrustManagerFactory.get(MATCHING_HOST, PORT1, true);
+        assertCertificateRejection(trustManager, new X509Certificate[] { mCert3, mCaCert });
+    }
+
+    public void testLocallyTrustedCertificateChain() throws Exception {
+        TrustManagerFactory.addCertificate(MATCHING_HOST, PORT1, mCert3);
+
+        X509TrustManager trustManager = TrustManagerFactory.get(MATCHING_HOST, PORT1, true);
+        trustManager.checkServerTrusted(new X509Certificate[] { mCert3, mCaCert }, "authType");
+    }
+
+    public void testLocallyTrustedCertificateChainNotMatchingHost() throws Exception {
+        TrustManagerFactory.addCertificate(NOT_MATCHING_HOST, PORT1, mCert3);
+
+        X509TrustManager trustManager = TrustManagerFactory.get(NOT_MATCHING_HOST, PORT1, true);
+        trustManager.checkServerTrusted(new X509Certificate[] { mCert3, mCaCert }, "authType");
+    }
+
+    public void testGloballyTrustedCertificateChain() throws Exception {
+        X509TrustManager trustManager = TrustManagerFactory.get("github.com", PORT1, true);
+        X509Certificate[] certificates = new X509Certificate[] { mGithubCert, mDigiCert };
+        trustManager.checkServerTrusted(certificates, "authType");
+    }
+
+    public void testGloballyTrustedCertificateNotMatchingHost() throws Exception {
+        X509TrustManager trustManager = TrustManagerFactory.get(NOT_MATCHING_HOST, PORT1, true);
+        assertCertificateRejection(trustManager, new X509Certificate[] { mGithubCert, mDigiCert});
+    }
+
+    public void testGloballyTrustedCertificateNotMatchingHostOverride() throws Exception {
+        TrustManagerFactory.addCertificate(MATCHING_HOST, PORT1, mGithubCert);
+
+        X509TrustManager trustManager = TrustManagerFactory.get(MATCHING_HOST, PORT1, true);
+        X509Certificate[] certificates = new X509Certificate[] { mGithubCert, mDigiCert };
+        trustManager.checkServerTrusted(certificates, "authType");
+    }
+
+    private void assertCertificateRejection(X509TrustManager trustManager,
+            X509Certificate[] certificates) {
         boolean certificateValid;
         try {
-            trustManager.checkServerTrusted(new X509Certificate[] { mCert2 }, "authType");
+            trustManager.checkServerTrusted(certificates, "authType");
             certificateValid = true;
         } catch (CertificateException e) {
             certificateValid = false;