| #!/usr/bin/env python |
| |
| import argparse |
| import json |
| import os |
| import subprocess |
| import sys |
| import typing |
| import cryptography.x509 |
| import os.path |
| import glob |
| from binascii import hexlify, unhexlify |
| from enum import Enum |
| from dacs import copyrightNotice, bytes_from_hex, make_c_array, make_array_header, open_outfile |
| |
| |
| class CertType(Enum): |
| NOC = 1 |
| ICAC = 2 |
| RCAC = 3 |
| |
| |
| class CertFormat(Enum): |
| DER = 1 |
| CHIP = 2 |
| |
| |
| # |
| # Generate operational certificates (NOC, ICAC, RCAC) test vectors in DER format. |
| # All these certificates are expected to fail when converted to CHIP TLV form |
| # using ConvertX509CertToChipCert() function. |
| # |
| # Note that not all malformed DER certificates are expected to fail when converted |
| # to CHIP TLV format, however, they are expected to fail later at the validation process. |
| # |
| DER_CERT_ERROR_TEST_CASES = [ |
| { |
| "description": "Certificate size exceeds its muximum supported limit", |
| "test_name": 'Oversized', |
| "error_flag": 'cert-oversized', |
| }, |
| { |
| "description": 'Invalid certificate version field set to v2(1)', |
| "test_name": 'Cert-Version-V2', |
| "error_flag": 'cert-version', |
| }, |
| { |
| "description": 'Invalid certificate signature algorithm ECDSA_WITH_SHA1', |
| "test_name": 'Sig-Algo-ECDSA-With-SHA1', |
| "error_flag": 'sig-algo', |
| }, |
| { |
| "description": "Certificate doesn't include Validity not-before field", |
| "test_name": 'Validity-Not-Before-Missing', |
| "error_flag": 'validity-not-before-missing', |
| }, |
| { |
| "description": "Certificate doesn't include Validity not-after field", |
| "test_name": 'Validity-Not-After-Missing', |
| "error_flag": 'validity-not-after-missing', |
| }, |
| { |
| "description": "Certificate Validity fields are invalid (values are switched)", |
| "test_name": 'Validity-Wrong', |
| "error_flag": 'validity-wrong', |
| }, |
| { |
| "description": "Subject's NodeId value is invalid", |
| "test_name": 'Subject-NodeId-Invalid', |
| "error_flag": 'subject-node-id-invalid', |
| }, |
| { |
| "description": "Subject's FabricId value is invalid", |
| "test_name": 'Subject-FabricId-Invalid', |
| "error_flag": 'subject-fabric-id-invalid', |
| }, |
| { |
| "description": "Subject's CAT value is invalid", |
| "test_name": 'Subject-CAT-Invalid', |
| "error_flag": 'subject-cat-invalid', |
| }, |
| { |
| "description": "Invalid certificate public key curve secp256k1", |
| "test_name": 'Sig-Curve-Secp256k1', |
| "error_flag": 'sig-curve', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension critical field is missing", |
| "test_name": 'Ext-Basic-Critical-Missing', |
| "error_flag": 'ext-basic-critical-missing', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension critical field is set as 'non-critical'", |
| "test_name": 'Ext-Basic-Critical-Wrong', |
| "error_flag": 'ext-basic-critical-wrong', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension CA field is missing", |
| "test_name": 'Ext-Basic-CA-Missing', |
| "error_flag": 'ext-basic-ca-missing', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field presence is wrong (present for NOC)", |
| "test_name": 'Ext-Basic-PathLen-Presence-Wrong', |
| "error_flag": 'ext-basic-pathlen-presence-wrong', |
| }, |
| { |
| "description": "Certificate Key Usage extension critical field is missing", |
| "test_name": 'Ext-KeyUsage-Critical-Missing', |
| "error_flag": 'ext-key-usage-critical-missing', |
| }, |
| { |
| "description": "Certificate Key Usage extension critical field is set as 'non-critical'", |
| "test_name": 'Ext-KeyUsage-Critical-Wrong', |
| "error_flag": 'ext-key-usage-critical-wrong', |
| }, |
| { |
| "description": "Authority Key ID (AKID) extension length is 19 bytes instead of required 20", |
| "test_name": 'Ext-AKID-Length-Invalid', |
| "error_flag": 'ext-akid-len-invalid', |
| }, |
| { |
| "description": "Subject Key ID (SKID) extension length is 19 bytes instead of required 20", |
| "test_name": 'Ext-SKID-Length-Invalid', |
| "error_flag": 'ext-skid-len-invalid', |
| }, |
| ] |
| |
| CHIP_TLV_CERT_ERROR_TEST_CASES = [ |
| { |
| "description": "Certificate size exceeds its muximum supported limit", |
| "test_name": 'Oversized', |
| "error_flag": 'cert-oversized', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": 'Invalid certificate version field set to v2(1)', |
| "test_name": 'Cert-Version-V2', |
| "error_flag": 'cert-version', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Serial Number field", |
| "test_name": 'Serial-Number-Missing', |
| "error_flag": 'serial-number-missing', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": 'Invalid certificate signature algorithm ECDSA_WITH_SHA1', |
| "test_name": 'Sig-Algo-ECDSA-With-SHA1', |
| "error_flag": 'sig-algo', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Issuer field", |
| "test_name": 'Issuer-Missing', |
| "error_flag": 'issuer-missing', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Validity not-before field", |
| "test_name": 'Validity-Not-Before-Missing', |
| "error_flag": 'validity-not-before-missing', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Validity not-after field", |
| "test_name": 'Validity-Not-After-Missing', |
| "error_flag": 'validity-not-after-missing', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Validity fields are invalid (values are switched)", |
| "test_name": 'Validity-Wrong', |
| "error_flag": 'validity-wrong', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Subject field", |
| "test_name": 'Subject-Missing', |
| "error_flag": 'subject-missing', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Subject doesn't have MatterId attribute", |
| "test_name": 'Subject-MatterId-Missing', |
| "error_flag": 'subject-matter-id-missing', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": True, |
| }, |
| { |
| "description": "Subject's NodeId value is invalid", |
| "test_name": 'Subject-NodeId-Invalid', |
| "error_flag": 'subject-node-id-invalid', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Subject includes two MatterId attributes", |
| "test_name": 'Subject-MatterId-Twice', |
| "error_flag": 'subject-matter-id-twice', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": True, |
| }, |
| { |
| "description": "Subject doesn't have FabricId field", |
| "test_name": 'Subject-FabricId-Missing', |
| "error_flag": 'subject-fabric-id-missing', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": True, |
| }, |
| { |
| "description": "Subject's FabricId value is invalid", |
| "test_name": 'Subject-FabricId-Invalid', |
| "error_flag": 'subject-fabric-id-invalid', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Subject includes two FabricId attributes", |
| "test_name": 'Subject-FabricId-Twice', |
| "error_flag": 'subject-fabric-id-twice', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": True, |
| }, |
| { |
| "description": "Subject's FabricId doesn't match Issuer's FabricId value", |
| "test_name": 'Subject-FabricId-Mismatch', |
| "error_flag": 'subject-fabric-id-mismatch', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Subject's CAT value is invalid", |
| "test_name": 'Subject-CAT-Invalid', |
| "error_flag": 'subject-cat-invalid', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Subject includes two CAT attributes with the same CAT Values but different Versions", |
| "test_name": 'Subject-CAT-Twice', |
| "error_flag": 'subject-cat-twice', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": True, |
| }, |
| { |
| "description": "Invalid certificate public key curve secp256k1", |
| "test_name": 'Sig-Curve-Secp256k1', |
| "error_flag": 'sig-curve', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Error injected into one of the bytes of the public key", |
| "test_name": 'PublicKey-Wrong', |
| "error_flag": 'publickey', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Basic Constraint extension", |
| "test_name": 'Ext-Basic-Missing', |
| "error_flag": 'ext-basic-missing', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Basic Constraint extension CA field is missing", |
| "test_name": 'Ext-Basic-CA-Missing', |
| "error_flag": 'ext-basic-ca-missing', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Basic Constraint extension CA field is wrong (TRUE for NOC and FALSE for ICAC/RCAC)", |
| "test_name": 'Ext-Basic-CA-Wrong', |
| "error_flag": 'ext-basic-ca-wrong', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field presence is wrong (present for NOC)", |
| "test_name": 'Ext-Basic-PathLen-Presence-Wrong', |
| "error_flag": 'ext-basic-pathlen-presence-wrong', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field set to 0", |
| "test_name": 'Ext-Basic-PathLen0', |
| "error_flag": 'ext-basic-pathlen0', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field set to 1", |
| "test_name": 'Ext-Basic-PathLen1', |
| "error_flag": 'ext-basic-pathlen1', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field set to 2", |
| "test_name": 'Ext-Basic-PathLen2', |
| "error_flag": 'ext-basic-pathlen2', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Key Usage extension", |
| "test_name": 'Ext-KeyUsage-Missing', |
| "error_flag": 'ext-key-usage-missing', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Key Usage extension diginalSignature field is wrong (not present for NOC and present for ICAC/RCAC)", |
| "test_name": 'Ext-KeyUsage-DigSig-Wrong', |
| "error_flag": 'ext-key-usage-dig-sig', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Key Usage extension keyCertSign field is wrong (present for NOC and not present for ICAC/RCAC)", |
| "test_name": 'Ext-KeyUsage-KeyCertSign-Wrong', |
| "error_flag": 'ext-key-usage-key-cert-sign', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate Key Usage extension cRLSign field is wrong (present for NOC and not present for ICAC/RCAC)", |
| "test_name": 'Ext-KeyUsage-CRLSign-Wrong', |
| "error_flag": 'ext-key-usage-crl-sign', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Authority Key ID (AKID) extension", |
| "test_name": 'Ext-AKID-Missing', |
| "error_flag": 'ext-akid-missing', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Authority Key ID (AKID) extension length is 19 bytes instead of required 20", |
| "test_name": 'Ext-AKID-Length-Invalid', |
| "error_flag": 'ext-akid-len-invalid', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate doesn't include Subject Key ID (SKID) extension", |
| "test_name": 'Ext-SKID-Missing', |
| "error_flag": 'ext-skid-missing', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Subject Key ID (SKID) extension length is 19 bytes instead of required 20", |
| "test_name": 'Ext-SKID-Length-Invalid', |
| "error_flag": 'ext-skid-len-invalid', |
| "is_chip_to_x509_expected_to_fail": True, |
| "is_chip_cert_load_expected_to_fail": True, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Certificate includes optional Extended Key Usage extension", |
| "test_name": 'Ext-ExtendedKeyUsage-Missing', |
| "error_flag": 'ext-extended-key-usage-missing', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": False, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| { |
| "description": "Error injected into one of the bytes of the signature", |
| "test_name": 'Signature-Wrong', |
| "error_flag": 'signature', |
| "is_chip_to_x509_expected_to_fail": False, |
| "is_chip_cert_load_expected_to_fail": False, |
| "is_validate_chip_rcac_expected_to_fail": True, |
| "is_get_cert_type_expected_to_fail": False, |
| }, |
| ] |
| |
| |
| def cert_type_as_str(cert_type: CertType) -> str: |
| type_strs = {CertType.NOC: 'NOC', |
| CertType.ICAC: 'ICAC', |
| CertType.RCAC: 'RCAC'} |
| return type_strs[cert_type] |
| |
| |
| def headers(filepath: str) -> tuple[str, str]: |
| """Returns strings with the headers for the output C-formated (.h and .cpp) files""" |
| filename = filepath.split("/")[-1] |
| namespaces = 'namespace chip {\nnamespace TestCerts {\n\n' |
| h_top = copyrightNotice + '\n#pragma once\n\n#include <lib/support/Span.h>\n\n' + namespaces |
| c_top = copyrightNotice + '\n#include "' + filename + '.h"\n\n' + namespaces |
| return [h_top, c_top] |
| |
| |
| def footer() -> str: |
| """Returns a string with the footer for the output C-formated (.h and .cpp) files""" |
| return '\n} // namespace TestCerts\n} // namespace chip\n' |
| |
| |
| def full_cert_arrays(cert_file: str, array_name: str) -> tuple[str, str]: |
| """Returns the certificate byte arrays and declarations""" |
| with open(cert_file, "rb") as infile: |
| b = infile.read() |
| cert = make_c_array(b, array_name, 21) |
| header = make_array_header(b, array_name) |
| return [header, cert] |
| |
| |
| def start_test_cases_array(array_name: str, array_size: int) -> tuple[str, str]: |
| """Returns strings with the headers for the test cases array""" |
| h = 'extern const ByteSpan %s[%d];\n\n' % (array_name, array_size) |
| c = 'const ByteSpan %s[%d] = {\n' % (array_name, array_size) |
| return [h, c] |
| |
| |
| class Names: |
| def __init__(self, cert_type: CertType, cert_form: CertFormat, test_case_out_dir: str, test_name: str): |
| files_path_prefix = test_case_out_dir + '/Chip-Test-' + cert_type_as_str(cert_type) + '-' + test_name |
| cert_array_name_prefix = 'sChipTest_' + cert_type_as_str(cert_type) + '_' + test_name.replace("-", "_") + '_Cert' |
| |
| if cert_form == CertFormat.DER: |
| self.cert_file_name = files_path_prefix + '-Cert.der' |
| self.key_file_name = files_path_prefix + '-Key.der' |
| self.cert_array_name = cert_array_name_prefix + '_DER' |
| else: |
| self.cert_file_name = files_path_prefix + '-Cert.chip' |
| self.key_file_name = files_path_prefix + '-Key.chip' |
| self.cert_array_name = cert_array_name_prefix + '_CHIP' |
| |
| |
| class OpCertBuilder: |
| def __init__(self, cert_type: CertType, cert_form: CertFormat, signer_cert: str, signer_key: str, error_type: str, test_name: str, test_case_out_dir: str, chip_cert: str): |
| self.cert_type = cert_type |
| self.cert_form = cert_form |
| self.error_type = error_type |
| self.chipcert = chip_cert |
| self.signer_cert = signer_cert |
| self.signer_key = signer_key |
| self.own = Names(cert_type, cert_form, test_case_out_dir, test_name) |
| |
| def make_certs_and_keys(self) -> None: |
| """Creates the PEM and DER certs and keyfiles""" |
| error_type_flag = ' -I -E ' + self.error_type |
| validity_flags = ' -V "2020-10-15 14:23:43" -l 7305 ' |
| |
| if self.cert_type == CertType.NOC: |
| type_flag = ' -t n ' |
| suject_id_flags = ' -i DEDEDEDE00010001 -f FAB000000000001D ' |
| signer_key_and_cert = ' -K ' + self.signer_key + ' -C ' + self.signer_cert |
| elif self.cert_type == CertType.ICAC: |
| type_flag = ' -t c ' |
| suject_id_flags = ' -i CACACACA00000003 -f FAB000000000001D ' |
| signer_key_and_cert = ' -K ' + self.signer_key + ' -C ' + self.signer_cert |
| else: |
| type_flag = ' -t r ' |
| suject_id_flags = ' -i CACACACA00000001 ' |
| if self.error_type == 'subject-fabric-id-invalid' or self.error_type == 'subject-fabric-id-twice': |
| suject_id_flags = ' -f FAB000000000001D ' |
| signer_key_and_cert = ' ' |
| |
| if self.cert_form == CertFormat.DER: |
| format_flag = ' -F x509-der ' |
| else: |
| format_flag = ' -F chip ' |
| |
| cmd = 'echo ' + self.own.cert_file_name |
| subprocess.run(cmd, shell=True) |
| |
| # Generate privatkey/certificate in DER or CHIP TLV format |
| cmd = self.chipcert + ' gen-cert ' + type_flag + error_type_flag + suject_id_flags + signer_key_and_cert \ |
| + validity_flags + format_flag + ' -o ' + self.own.cert_file_name + ' -O ' + self.own.key_file_name |
| subprocess.run(cmd, shell=True) |
| |
| def full_arrays(self) -> tuple[str, str]: |
| """Returns DER and CHIP TLV certificate byte arrays and declarations""" |
| return full_cert_arrays(self.own.cert_file_name, self.own.cert_array_name) |
| |
| def add_cert_to_error_cases(self) -> str: |
| """Returns a string with the new entry to the test cases array""" |
| return ' ByteSpan(' + self.own.cert_array_name + '),\n' |
| |
| |
| def main(): |
| argparser = argparse.ArgumentParser() |
| argparser.add_argument('-t', '--test_dir', dest='testdir', |
| default='credentials/test/operational-certificates-error-cases', |
| help='Output directory for all generated test vectors') |
| argparser.add_argument('-o', '--out_dir', dest='outfile', |
| default='src/credentials/tests/CHIPCert_error_test_vectors', |
| help='Output file for all C-Style arrays') |
| argparser.add_argument('-r', '--rcac', dest='rcacpath', |
| default='credentials/test/operational-certificates/Chip-Test-Root01-', |
| help='Valid RCAC to generate invalid ICACs') |
| argparser.add_argument('-i', '--icac', dest='icacpath', |
| default='credentials/test/operational-certificates/Chip-Test-ICA02-', |
| help='Valid ICAC to generate invalid NOCs') |
| argparser.add_argument('-c', '--chip-cert-dir', dest='chipcertdir', |
| default='out/debug/linux_x64_clang/', help='Directory where chip-cert tool is located') |
| |
| args = argparser.parse_args() |
| |
| chipcert = args.chipcertdir + 'chip-cert' |
| rcac_cert = args.rcacpath + 'Cert.pem' |
| rcac_key = args.rcacpath + 'Key.pem' |
| icac_cert = args.icacpath + 'Cert.pem' |
| icac_key = args.icacpath + 'Key.pem' |
| |
| if not os.path.exists(args.testdir): |
| os.mkdir(args.testdir) |
| |
| if not os.path.exists(chipcert): |
| raise Exception('Path not found: %s' % chipcert) |
| |
| if not os.path.exists(rcac_cert): |
| raise Exception('Path not found: %s' % rcac_cert) |
| |
| if not os.path.exists(rcac_key): |
| raise Exception('Path not found: %s' % rcac_key) |
| |
| if not os.path.exists(icac_cert): |
| raise Exception('Path not found: %s' % icac_cert) |
| |
| if not os.path.exists(icac_key): |
| raise Exception('Path not found: %s' % icac_key) |
| |
| with open(args.outfile + '.h', "w") as hfile: |
| with open(args.outfile + '.cpp', "w") as cfile: |
| h_cert_arrays_declarations = '' |
| c_cert_arrays_definitions = '' |
| |
| c_x509_to_chip_error_cases = '' |
| x509_to_chip_error_cases_count = 0 |
| for test_case in DER_CERT_ERROR_TEST_CASES: |
| for cert_type in [CertType.NOC, CertType.ICAC, CertType.RCAC]: |
| # The following error cases are applicable only for NOC |
| if (test_case["error_flag"] == 'subject-node-id-invalid' or test_case["error_flag"] == 'ext-basic-pathlen-presence-wrong') and cert_type != CertType.NOC: |
| break |
| |
| if cert_type == CertType.NOC: |
| signer_cert = icac_cert |
| signer_key = icac_key |
| elif cert_type == CertType.ICAC: |
| signer_cert = rcac_cert |
| signer_key = rcac_key |
| else: |
| signer_cert = "" |
| signer_key = "" |
| |
| # Generate Cert/Key |
| builder = OpCertBuilder(cert_type, CertFormat.DER, signer_cert, signer_key, |
| test_case["error_flag"], test_case["test_name"], args.testdir, chipcert) |
| builder.make_certs_and_keys() |
| |
| c_x509_to_chip_error_cases += builder.add_cert_to_error_cases() |
| |
| [h, c] = builder.full_arrays() |
| h_cert_arrays_declarations += h |
| c_cert_arrays_definitions += c |
| x509_to_chip_error_cases_count += 1 |
| |
| c_chip_to_x509_error_cases = '' |
| c_chip_cert_load_error_cases = '' |
| c_validate_chip_rcac_error_cases = '' |
| c_get_cert_type_error_cases = '' |
| chip_to_x509_error_cases_count = 0 |
| chip_cert_load_error_cases_count = 0 |
| validate_chip_rcac_error_cases_count = 0 |
| get_cert_type_error_cases_count = 0 |
| for test_case in CHIP_TLV_CERT_ERROR_TEST_CASES: |
| for cert_type in [CertType.NOC, CertType.ICAC, CertType.RCAC]: |
| if not (test_case["is_chip_to_x509_expected_to_fail"] or |
| test_case["is_chip_cert_load_expected_to_fail"] or |
| test_case["is_validate_chip_rcac_expected_to_fail"] or |
| test_case["is_get_cert_type_expected_to_fail"]): |
| break |
| |
| # The following error cases are applicable only for NOC |
| if (test_case["error_flag"] == 'subject-node-id-invalid' or test_case["error_flag"] == 'subject-fabric-id-missing') and cert_type != CertType.NOC: |
| break |
| |
| if cert_type == CertType.NOC: |
| signer_cert = icac_cert |
| signer_key = icac_key |
| elif cert_type == CertType.ICAC: |
| signer_cert = rcac_cert |
| signer_key = rcac_key |
| else: |
| signer_cert = "" |
| signer_key = "" |
| |
| # Generate Cert/Key |
| builder = OpCertBuilder(cert_type, CertFormat.CHIP, signer_cert, signer_key, |
| test_case["error_flag"], test_case["test_name"], args.testdir, chipcert) |
| builder.make_certs_and_keys() |
| |
| if test_case["is_chip_to_x509_expected_to_fail"]: |
| c_chip_to_x509_error_cases += builder.add_cert_to_error_cases() |
| chip_to_x509_error_cases_count += 1 |
| if test_case["is_chip_cert_load_expected_to_fail"]: |
| c_chip_cert_load_error_cases += builder.add_cert_to_error_cases() |
| chip_cert_load_error_cases_count += 1 |
| if test_case["is_validate_chip_rcac_expected_to_fail"]: |
| c_validate_chip_rcac_error_cases += builder.add_cert_to_error_cases() |
| validate_chip_rcac_error_cases_count += 1 |
| if test_case["is_get_cert_type_expected_to_fail"] and not (test_case["error_flag"] == 'subject-cat-twice' and cert_type == CertType.NOC): |
| c_get_cert_type_error_cases += builder.add_cert_to_error_cases() |
| get_cert_type_error_cases_count += 1 |
| |
| [h, c] = builder.full_arrays() |
| h_cert_arrays_declarations += h |
| c_cert_arrays_definitions += c |
| |
| [h_top, c_top] = headers(args.outfile) |
| [h_x509_to_chip_error_cases, c_x509_to_chip_error_cases_head] = start_test_cases_array( |
| 'gTestCert_X509ToChip_ErrorCases', x509_to_chip_error_cases_count) |
| [h_chip_to_x509_error_cases, c_chip_to_x509_error_cases_head] = start_test_cases_array( |
| 'gTestCert_ChipToX509_ErrorCases', chip_to_x509_error_cases_count) |
| [h_chip_cert_load_error_cases, c_chip_cert_load_error_cases_head] = start_test_cases_array( |
| 'gTestCert_ChipCertLoad_ErrorCases', chip_cert_load_error_cases_count) |
| [h_validate_chip_rcac_error_cases, c_validate_chip_rcac_error_cases_head] = start_test_cases_array( |
| 'gTestCert_ValidateChipRCAC_ErrorCases', validate_chip_rcac_error_cases_count) |
| [h_get_cert_type_error_cases, c_get_cert_type_error_cases_head] = start_test_cases_array( |
| 'gTestCert_GetCertType_ErrorCases', get_cert_type_error_cases_count) |
| foot = footer() |
| |
| hfile.write(h_top) |
| hfile.write(h_x509_to_chip_error_cases) |
| hfile.write(h_chip_to_x509_error_cases) |
| hfile.write(h_chip_cert_load_error_cases) |
| hfile.write(h_validate_chip_rcac_error_cases) |
| hfile.write(h_get_cert_type_error_cases) |
| hfile.write(h_cert_arrays_declarations) |
| hfile.write(foot) |
| |
| cfile.write(c_top) |
| cfile.write(c_x509_to_chip_error_cases_head + c_x509_to_chip_error_cases + '};\n\n') |
| cfile.write(c_chip_to_x509_error_cases_head + c_chip_to_x509_error_cases + '};\n\n') |
| cfile.write(c_chip_cert_load_error_cases_head + c_chip_cert_load_error_cases + '};\n\n') |
| cfile.write(c_validate_chip_rcac_error_cases_head + c_validate_chip_rcac_error_cases + '};\n\n') |
| cfile.write(c_get_cert_type_error_cases_head + c_get_cert_type_error_cases + '};\n\n') |
| cfile.write(c_cert_arrays_definitions) |
| cfile.write(foot) |
| |
| |
| if __name__ == '__main__': |
| sys.exit(main()) |
