From 7d664ec788acdc378506a7ff8b1120cea24a6770 Mon Sep 17 00:00:00 2001
From: Michael Stahl <michael.stahl@allotropia.de>
Date: Fri, 15 Oct 2021 16:58:07 +0200
Subject: xmlsecurity: fix new tests on WNT

Tests added in commit 40d70d427edddb589eda64fafc2e56536953d274 don't
actually run on WNT but that wasn't obvious because commit
149df1fec6472e30582162e17e04c75aee91d26a prevented running them in
Jenkins on master, they failed only in the libreoffice-7-1 backport.

  xmlsecurity/qa/unit/signing/signing.cxx(631) : error : Assertion
  Test name: testODFDoubleX509Certificate::TestBody
  assertion failed
  - Expression: (nActual == SignatureState::NOTVALIDATED || nActual == SignatureState::OK)
  - 2

This is an oddity where NSS claims the signature in the document is
valid but CryptoAPI claims it is invalid; the hashes passed into the
validation functions are the same.  Just allow BROKEN as an additional
result value on WNT.

  xmlsecurity/qa/unit/signing/signing.cxx(550) : error : Assertion
  Test name: testODFX509CertificateChain::TestBody
  equality assertion failed
  - Expected: 0
  - Actual  : 1

The problem here is that with NSS the tests use a custom NSS database
in test/signing-keys so we need to make these certificates available for
CryptoAPI too.

The following one-liner converts the NSS database to a PKCS#7 that can
be loaded by CrytpAPI:

> openssl crl2pkcs7 -nocrl -certfile <(certutil -d sql:test/signing-keys -L | awk '/^[^ ].*,[^ ]*,/ { printf "%s", $1; for (i = 2; i < NF; i++) { printf " %s", $i; } printf "\n"; }' | while read name; do certutil -L -d sql:test/signing-keys -a -n "${name}" ; done) > test/signing-keys/test.p7b

Then one might naively assume that something like this would allow these
certificates to be added temporarily as trusted CAs:

+                HCERTSTORE hRoot = CertOpenSystemStoreW( 0, L"Root" ) ;
+                HCERTSTORE const hExtra = CertOpenStore(
+                        CERT_STORE_PROV_FILENAME_A,
+                        PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
+                        NULL,
+                        CERT_STORE_OPEN_EXISTING_FLAG | CERT_STORE_READONLY_FLAG,
+                        path);
+                if (hExtra != NULL && hRoot != NULL)
+                {
+                    BOOL ret = CertAddStoreToCollection(
+                        hRoot,
+                        hExtra,
+                        CERT_PHYSICAL_STORE_ADD_ENABLE_FLAG,
+                        0);
+                    SAL_DEBUG("XXX hExtra done " << ret);
+                }

There is no error from this, but it doesn't work.

Instead, check if CertGetCertificateChain() sets the
CERT_TRUST_IS_UNTRUSTED_ROOT flag and then look up the certificate
manually in the extra PKCS#7 store.

Change-Id: Ic9865e0b5783211c2128ce0327c4583b7784ff62
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123667
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
---
 unotest/source/cpp/macros_test.cxx | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'unotest/source')

diff --git a/unotest/source/cpp/macros_test.cxx b/unotest/source/cpp/macros_test.cxx
index 44dcb07f87d6..ab15518e4c9c 100644
--- a/unotest/source/cpp/macros_test.cxx
+++ b/unotest/source/cpp/macros_test.cxx
@@ -105,7 +105,12 @@ void MacrosTest::setUpNssGpg(const test::Directories& rDirectories, const OUStri
     OUString aTargetPath;
     osl::FileBase::getSystemPathFromFileURL(aTargetDir, aTargetPath);
 
-#ifndef _WIN32
+#ifdef _WIN32
+    // CryptoAPI test certificates
+    osl::File::copy(aSourceDir + "test.p7b", aTargetDir + "/test.p7b");
+    OUString caVar("LIBO_TEST_CRYPTOAPI_PKCS7");
+    osl_setEnvironment(caVar.pData, aTargetPath.pData);
+#else
     OUString mozCertVar("MOZILLA_CERTIFICATE_FOLDER");
     osl_setEnvironment(mozCertVar.pData, aTargetPath.pData);
 #endif
-- 
cgit