// -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
"use strict";

// Test that when an override exists for a (host, certificate) pair,
// connections will succeed only if the set of error bits in the override
// contains each bit in the set of encountered error bits.
// Strangely, it is possible to store an override with an empty set of error
// bits, so this tests that too.

do_get_profile();

function add_override_bits_mismatch_test(
  host,
  certPath,
  expectedBits,
  expectedError
) {
  const MAX_BITS =
    Ci.nsICertOverrideService.ERROR_UNTRUSTED |
    Ci.nsICertOverrideService.ERROR_MISMATCH |
    Ci.nsICertOverrideService.ERROR_TIME;
  let cert = constructCertFromFile(certPath);
  let certOverrideService = Cc[
    "@mozilla.org/security/certoverride;1"
  ].getService(Ci.nsICertOverrideService);
  for (let overrideBits = 0; overrideBits <= MAX_BITS; overrideBits++) {
    add_test(function() {
      certOverrideService.clearValidityOverride(host, 8443);
      certOverrideService.rememberValidityOverride(
        host,
        8443,
        cert,
        overrideBits,
        true
      );
      run_next_test();
    });
    // The override will succeed only if the set of error bits in the override
    // contains each bit in the set of expected error bits.
    let successExpected = (overrideBits | expectedBits) == overrideBits;
    add_connection_test(
      host,
      successExpected ? PRErrorCodeSuccess : expectedError
    );
  }
}

function run_test() {
  Services.prefs.setIntPref("security.OCSP.enabled", 1);
  add_tls_server_setup("BadCertAndPinningServer", "bad_certs");

  let fakeOCSPResponder = new HttpServer();
  fakeOCSPResponder.registerPrefixHandler("/", function(request, response) {
    response.setStatusLine(request.httpVersion, 500, "Internal Server Error");
  });
  fakeOCSPResponder.start(8888);

  add_override_bits_mismatch_test(
    "unknownissuer.example.com",
    "bad_certs/unknownissuer.pem",
    Ci.nsICertOverrideService.ERROR_UNTRUSTED,
    SEC_ERROR_UNKNOWN_ISSUER
  );
  add_override_bits_mismatch_test(
    "mismatch.example.com",
    "bad_certs/mismatch.pem",
    Ci.nsICertOverrideService.ERROR_MISMATCH,
    SSL_ERROR_BAD_CERT_DOMAIN
  );
  add_override_bits_mismatch_test(
    "expired.example.com",
    "bad_certs/expired-ee.pem",
    Ci.nsICertOverrideService.ERROR_TIME,
    SEC_ERROR_EXPIRED_CERTIFICATE
  );

  add_override_bits_mismatch_test(
    "mismatch-untrusted.example.com",
    "bad_certs/mismatch-untrusted.pem",
    Ci.nsICertOverrideService.ERROR_UNTRUSTED |
      Ci.nsICertOverrideService.ERROR_MISMATCH,
    SEC_ERROR_UNKNOWN_ISSUER
  );
  add_override_bits_mismatch_test(
    "untrusted-expired.example.com",
    "bad_certs/untrusted-expired.pem",
    Ci.nsICertOverrideService.ERROR_UNTRUSTED |
      Ci.nsICertOverrideService.ERROR_TIME,
    SEC_ERROR_UNKNOWN_ISSUER
  );
  add_override_bits_mismatch_test(
    "mismatch-expired.example.com",
    "bad_certs/mismatch-expired.pem",
    Ci.nsICertOverrideService.ERROR_MISMATCH |
      Ci.nsICertOverrideService.ERROR_TIME,
    SSL_ERROR_BAD_CERT_DOMAIN
  );

  add_override_bits_mismatch_test(
    "mismatch-untrusted-expired.example.com",
    "bad_certs/mismatch-untrusted-expired.pem",
    Ci.nsICertOverrideService.ERROR_UNTRUSTED |
      Ci.nsICertOverrideService.ERROR_MISMATCH |
      Ci.nsICertOverrideService.ERROR_TIME,
    SEC_ERROR_UNKNOWN_ISSUER
  );

  add_test(function() {
    fakeOCSPResponder.stop(run_next_test);
  });

  run_next_test();
}
