970470 - Clarify and expand (if needed) certificate EKU processing tests

Status: RESOLVED DUPLICATE of bug 982292

(Core :: Security: PSM, defect, P3)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

keeler noted that the EKU processing in insanity::pkix, CheckExtendedKeyUsage, is subtle and that we should make sure we have good test coverage.

We actually have "pretty good" test coverage for this with test_certificate_usages.js, test_intermediate_basic_usage_constraints.js, etc. Those tests have helped me find multiple bugs and incompatibilities when doing the initial insanity::pkix implementation.

However, it is difficult to map those tests to the implementation and to the spec, and that means it is unclear what exactly the test coverage is. Since the time those tests were written, we've increased our testing framework and testing style substantially. We should redo the EKU testing to make it clearer that we have "complete" test coverage.

Comment 1

[Camilo Viecco (:cviecco)]

98% addresses on landing of tests for https://bugzilla.mozilla.org/show_bug.cgi?id=982314. Consider solved?

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Camilo Viecco (:cviecco) from comment #1)
> 98% addresses on landing of tests for
> https://bugzilla.mozilla.org/show_bug.cgi?id=982314. Consider solved?

I think you meant to reference a different bug than bug 982314.

It would be good to hear from keeler about whether he is satisfied with the test coverage for EKU processing, since I originally filed this bug based on his concern that not enough was being tested.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

As I understand them, the tests added in bug 982292 test the functionality I was concerned about here.