Fixed selftest error handling.

The selftest has been modified to throw an exception and provide
more specific error message if a test fails in order to help
troubleshoot the problem.

https://fedorahosted.org/pki/ticket/1328

3 files changed, 104 insertions, 103 deletions

diff --git a/base/server/cmscore/src/com/netscape/cmscore/apps/CMSEngine.java b/base/server/cmscore/src/com/netscape/cmscore/apps/CMSEngine.java
index 77f913636..1e1f844cd 100644
--- a/base/server/cmscore/src/com/netscape/cmscore/apps/CMSEngine.java
+++ b/base/server/cmscore/src/com/netscape/cmscore/apps/CMSEngine.java
@@ -24,7 +24,6 @@ import java.io.FileReader;
 import java.io.IOException;
 import java.math.BigInteger;
 import java.security.NoSuchAlgorithmException;
-import java.security.PublicKey;
 import java.security.SignatureException;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
@@ -44,32 +43,15 @@ import java.util.Vector;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 
-import netscape.ldap.LDAPConnection;
-import netscape.ldap.LDAPException;
-import netscape.ldap.LDAPSSLSocketFactoryExt;
-import netscape.security.extensions.CertInfo;
-import netscape.security.pkcs.ContentInfo;
-import netscape.security.pkcs.PKCS7;
-import netscape.security.pkcs.SignerInfo;
-import netscape.security.util.ObjectIdentifier;
-import netscape.security.x509.AlgorithmId;
-import netscape.security.x509.CertificateChain;
-import netscape.security.x509.Extension;
-import netscape.security.x509.GeneralName;
-import netscape.security.x509.X509CRLImpl;
-import netscape.security.x509.X509CertImpl;
-import netscape.security.x509.X509CertInfo;
-
 import org.apache.commons.lang.StringUtils;
 import org.apache.xerces.parsers.DOMParser;
 import org.mozilla.jss.CryptoManager;
 import org.mozilla.jss.CryptoManager.CertificateUsage;
-import org.mozilla.jss.util.PasswordCallback;
+import org.mozilla.jss.crypto.CryptoToken;
 import org.mozilla.jss.crypto.PrivateKey;
 import org.mozilla.jss.crypto.Signature;
 import org.mozilla.jss.crypto.SignatureAlgorithm;
-import org.mozilla.jss.crypto.CryptoToken;
-
+import org.mozilla.jss.util.PasswordCallback;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
 
@@ -184,8 +166,24 @@ import com.netscape.cmscore.util.Debug;
 import com.netscape.cmsutil.net.ISocketFactory;
 import com.netscape.cmsutil.password.IPasswordStore;
 import com.netscape.cmsutil.password.NuxwdogPasswordStore;
-import com.netscape.cmsutil.util.Utils;
 import com.netscape.cmsutil.util.Cert;
+import com.netscape.cmsutil.util.Utils;
+
+import netscape.ldap.LDAPConnection;
+import netscape.ldap.LDAPException;
+import netscape.ldap.LDAPSSLSocketFactoryExt;
+import netscape.security.extensions.CertInfo;
+import netscape.security.pkcs.ContentInfo;
+import netscape.security.pkcs.PKCS7;
+import netscape.security.pkcs.SignerInfo;
+import netscape.security.util.ObjectIdentifier;
+import netscape.security.x509.AlgorithmId;
+import netscape.security.x509.CertificateChain;
+import netscape.security.x509.Extension;
+import netscape.security.x509.GeneralName;
+import netscape.security.x509.X509CRLImpl;
+import netscape.security.x509.X509CertImpl;
+import netscape.security.x509.X509CertInfo;
 
 public class CMSEngine implements ICMSEngine {
     private static final String ID = "MAIN";
@@ -1259,7 +1257,7 @@ public class CMSEngine implements ICMSEngine {
                 return;
             }
             CMS.debug(method + "autoShutdown allowed");
-            CryptoToken token = 
+            CryptoToken token =
                 ((org.mozilla.jss.pkcs11.PK11PrivKey) mSigningKey).getOwningToken();
             SignatureAlgorithm signAlg = Cert.mapAlgorithmToJss("SHA256withRSA");
             Signature signer = token.getSignatureContext(signAlg);
@@ -1731,17 +1729,16 @@ public class CMSEngine implements ICMSEngine {
         }
     }
 
-    public boolean verifySystemCerts() {
-        return CertUtils.verifySystemCerts();
+    public void verifySystemCerts() throws Exception {
+        CertUtils.verifySystemCerts();
     }
 
-    public boolean verifySystemCertByTag(String tag) {
-        return CertUtils.verifySystemCertByTag(tag);
+    public void verifySystemCertByTag(String tag) throws Exception {
+        CertUtils.verifySystemCertByTag(tag);
     }
 
-    public boolean verifySystemCertByNickname(String nickname, String certificateUsage) {
-        CMS.debug("CMSEngine: verifySystemCertByNickname(" + nickname + ", " + certificateUsage + ")");
-        return CertUtils.verifySystemCertByNickname(nickname, certificateUsage);
+    public void verifySystemCertByNickname(String nickname, String certificateUsage) throws Exception {
+        CertUtils.verifySystemCertByNickname(nickname, certificateUsage);
     }
 
     public CertificateUsage getCertificateUsage(String certusage) {
@@ -1995,7 +1992,7 @@ public class CMSEngine implements ICMSEngine {
                 crumb.createNewFile();
             } catch (IOException e) {
                 CMS.debug(method + " create autoShutdown crumb file failed on " +
-                    mAutoSD_CrumbFile + "; nothing to do...keep shutting down:" + e.toString()); 
+                    mAutoSD_CrumbFile + "; nothing to do...keep shutting down:" + e);
                 e.printStackTrace();
             }
         }
diff --git a/base/server/cmscore/src/com/netscape/cmscore/cert/CertUtils.java b/base/server/cmscore/src/com/netscape/cmscore/cert/CertUtils.java
index 244c36dc7..8c5c2ccc1 100644
--- a/base/server/cmscore/src/com/netscape/cmscore/cert/CertUtils.java
+++ b/base/server/cmscore/src/com/netscape/cmscore/cert/CertUtils.java
@@ -35,6 +35,15 @@ import java.util.Arrays;
 import java.util.Date;
 import java.util.StringTokenizer;
 
+import org.mozilla.jss.CryptoManager;
+import org.mozilla.jss.CryptoManager.CertificateUsage;
+
+import com.netscape.certsrv.apps.CMS;
+import com.netscape.certsrv.base.EBaseException;
+import com.netscape.certsrv.base.IConfigStore;
+import com.netscape.certsrv.logging.ILogger;
+import com.netscape.cmsutil.util.Utils;
+
 import netscape.security.extensions.NSCertTypeExtension;
 import netscape.security.pkcs.PKCS10;
 import netscape.security.pkcs.PKCS7;
@@ -54,15 +63,6 @@ import netscape.security.x509.X509CertImpl;
 import netscape.security.x509.X509CertInfo;
 import netscape.security.x509.X509Key;
 
-import org.mozilla.jss.CryptoManager;
-import org.mozilla.jss.CryptoManager.CertificateUsage;
-
-import com.netscape.certsrv.apps.CMS;
-import com.netscape.certsrv.base.EBaseException;
-import com.netscape.certsrv.base.IConfigStore;
-import com.netscape.certsrv.logging.ILogger;
-import com.netscape.cmsutil.util.Utils;
-
 /**
  * Utility class with assorted methods to check for
  * smime pairs, determining the type of cert - signature
@@ -828,43 +828,42 @@ public class CertUtils {
 
     /*
      * verify a certificate by its nickname
-     * returns true if it verifies; false if any not
+     * @throws Exception if something is wrong
      */
-    public static boolean verifySystemCertByNickname(String nickname, String certusage) {
-        CMS.debug("CertUtils: verifySystemCertByNickname(" + nickname + "," + certusage + ")");
-        boolean r = true;
-        CertificateUsage cu = null;
-        cu = getCertificateUsage(certusage);
+    public static void verifySystemCertByNickname(String nickname, String certusage) throws Exception {
+        CMS.debug("CertUtils: verifySystemCertByNickname(" + nickname + ", " + certusage + ")");
+        CertificateUsage cu = getCertificateUsage(certusage);
         int ccu = 0;
 
         if (cu == null) {
             CMS.debug("CertUtils: verifySystemCertByNickname() failed: " +
                     nickname + " with unsupported certusage =" + certusage);
-            return false;
+            throw new Exception("Unsupported certificate usage " + certusage + " in certificate " + nickname);
         }
 
         if (certusage == null || certusage.equals(""))
             CMS.debug("CertUtils: verifySystemCertByNickname(): required certusage not defined, getting current certusage");
+
         CMS.debug("CertUtils: verifySystemCertByNickname(): calling isCertValid()");
         try {
             CryptoManager cm = CryptoManager.getInstance();
             if (cu.getUsage() != CryptoManager.CertificateUsage.CheckAllUsages.getUsage()) {
                 if (cm.isCertValid(nickname, true, cu)) {
-                    r = true;
                     CMS.debug("CertUtils: verifySystemCertByNickname() passed: " + nickname);
                 } else {
                     CMS.debug("CertUtils: verifySystemCertByNickname() failed: " + nickname);
-                    r = false;
+                    throw new Exception("Invalid certificate " + nickname);
                 }
+
             } else {
                 // find out about current cert usage
                 ccu = cm.isCertValid(nickname, true);
                 if (ccu == CertificateUsage.basicCertificateUsages) {
                     /* cert is good for nothing */
-                    r = false;
                     CMS.debug("CertUtils: verifySystemCertByNickname() failed: cert is good for nothing:" + nickname);
+                    throw new Exception("Unusable certificate " + nickname);
+
                 } else {
-                    r = true;
                     CMS.debug("CertUtils: verifySystemCertByNickname() passed: " + nickname);
 
                     if ((ccu & CryptoManager.CertificateUsage.SSLServer.getUsage()) != 0)
@@ -893,31 +892,31 @@ public class CertUtils {
                         CMS.debug("CertUtils: verifySystemCertByNickname(): cert is AnyCA");
                 }
             }
+
         } catch (Exception e) {
-            CMS.debug("CertUtils: verifySystemCertByNickname() failed: " +
-                    e.toString());
-            r = false;
+            CMS.debug("CertUtils: verifySystemCertByNickname() failed: " + e);
+            throw e;
         }
-        return r;
     }
 
     /*
      * verify a certificate by its tag name
-     * returns true if it verifies; false if any not
+     * @throws Exception if something is wrong
      */
-    public static boolean verifySystemCertByTag(String tag) {
+    public static void verifySystemCertByTag(String tag) throws Exception {
 
         CMS.debug("CertUtils: verifySystemCertByTag(" + tag + ")");
 
         String auditMessage = null;
         IConfigStore config = CMS.getConfigStore();
-        boolean r = true;
+
         try {
             String subsysType = config.getString("cs.type", "");
             if (subsysType.equals("")) {
                 CMS.debug("CertUtils: verifySystemCertByTag() cs.type not defined in CS.cfg. System certificates verification not done");
-                r = false;
+                throw new Exception("Missing cs.type in CS.cfg");
             }
+
             subsysType = toLowerCaseSubsystemType(subsysType);
             if (subsysType == null) {
                 CMS.debug("CertUtils: verifySystemCerts() invalid cs.type in CS.cfg. System certificates verification not done");
@@ -928,39 +927,32 @@ public class CertUtils {
                             "");
 
                 audit(auditMessage);
-                r = false;
-                return r;
+                throw new Exception("Invalid cs.type in CS.cfg");
             }
+
             String nickname = config.getString(subsysType + ".cert." + tag + ".nickname", "");
             if (nickname.equals("")) {
                 CMS.debug("CertUtils: verifySystemCertByTag() nickname for cert tag " + tag + " undefined in CS.cfg");
-                r = false;
+                throw new Exception("Missing nickname for " + tag + " certificate");
             }
+
             String certusage = config.getString(subsysType + ".cert." + tag + ".certusage", "");
             if (certusage.equals("")) {
                 CMS.debug("CertUtils: verifySystemCertByTag() certusage for cert tag "
                         + tag + " undefined in CS.cfg, getting current certificate usage");
+                // throw new Exception("Missing certificate usage for " + tag + " certificate"); ?
             }
-            r = verifySystemCertByNickname(nickname, certusage);
-            if (r == true) {
-                // audit here
-                auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_CIMC_CERT_VERIFICATION,
-                        ILogger.SYSTEM_UID,
-                        ILogger.SUCCESS,
-                            nickname);
 
-                audit(auditMessage);
-            } else {
-                // audit here
-                auditMessage = CMS.getLogMessage(
-                            LOGGING_SIGNED_AUDIT_CIMC_CERT_VERIFICATION,
-                            ILogger.SYSTEM_UID,
-                            ILogger.FAILURE,
-                            nickname);
+            verifySystemCertByNickname(nickname, certusage);
+
+            auditMessage = CMS.getLogMessage(
+                    LOGGING_SIGNED_AUDIT_CIMC_CERT_VERIFICATION,
+                    ILogger.SYSTEM_UID,
+                    ILogger.SUCCESS,
+                        nickname);
+
+            audit(auditMessage);
 
-                audit(auditMessage);
-            }
         } catch (Exception e) {
             CMS.debug("CertUtils: verifySystemCertsByTag() failed: " +
                     e.toString());
@@ -971,10 +963,8 @@ public class CertUtils {
                         "");
 
             audit(auditMessage);
-            r = false;
+            throw e;
         }
-
-        return r;
     }
 
     /*
@@ -1015,13 +1005,13 @@ public class CertUtils {
     /*
      * goes through all system certs and check to see if they are good
      * and audit the result
-     * returns true if all verifies; false if any not
+     * @throws Exception if something is wrong
      */
-    public static boolean verifySystemCerts() {
+    public static void verifySystemCerts() throws Exception {
+
         String auditMessage = null;
         IConfigStore config = CMS.getConfigStore();
-        boolean verifyResult = true;
-        boolean r = true; /* the final return value */
+
         try {
             String subsysType = config.getString("cs.type", "");
             if (subsysType.equals("")) {
@@ -1033,8 +1023,9 @@ public class CertUtils {
                             "");
 
                 audit(auditMessage);
-                return false;
+                throw new Exception("Missing cs.type in CS.cfg");
             }
+
             subsysType = toLowerCaseSubsystemType(subsysType);
             if (subsysType == null) {
                 CMS.debug("CertUtils: verifySystemCerts() invalid cs.type in CS.cfg. System certificates verification not done");
@@ -1045,8 +1036,9 @@ public class CertUtils {
                             "");
 
                 audit(auditMessage);
-                return false;
+                throw new Exception("Invalid cs.type in CS.cfg");
             }
+
             String certlist = config.getString(subsysType + ".cert.list", "");
             if (certlist.equals("")) {
                 CMS.debug("CertUtils: verifySystemCerts() "
@@ -1058,17 +1050,17 @@ public class CertUtils {
                             "");
 
                 audit(auditMessage);
-                return false;
+                throw new Exception("Missing " + subsysType + ".cert.list in CS.cfg");
             }
+
             StringTokenizer tokenizer = new StringTokenizer(certlist, ",");
             while (tokenizer.hasMoreTokens()) {
                 String tag = tokenizer.nextToken();
                 tag = tag.trim();
                 CMS.debug("CertUtils: verifySystemCerts() cert tag=" + tag);
-                verifyResult = verifySystemCertByTag(tag);
-                if (verifyResult == false)
-                    r = false; //r captures the value for final return
+                verifySystemCertByTag(tag);
             }
+
         } catch (Exception e) {
             // audit here
             auditMessage = CMS.getLogMessage(
@@ -1078,10 +1070,8 @@ public class CertUtils {
                         "");
 
             audit(auditMessage);
-            r = false;
-            CMS.debug("CertUtils: verifySystemCerts():" + e.toString());
+            throw e;
         }
-        return r;
     }
 
     public static String toLowerCaseSubsystemType(String s) {
diff --git a/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java b/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java
index d060f8180..14fab26e4 100644
--- a/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java
+++ b/base/server/cmscore/src/com/netscape/cmscore/selftests/SelfTestSubsystem.java
@@ -1328,13 +1328,24 @@ public class SelfTestSubsystem
                                     loggerFullName,
                                     loggerValue));
 
-                    throw new EInvalidSelfTestException(loggerFullName,
-                            loggerValue);
+                    throw new EInvalidSelfTestException(
+                        "The self test plugin named " +
+                        loggerFullName + " contains a value " +
+                        loggerValue + " which is not an instance of ILogEventListener.");
                 }
 
                 // initialize the self tests logger
                 mLogger = (ILogEventListener) o;
                 mLogger.init(this, loggerConfig);
+
+            } catch (EMissingSelfTestException e) {
+                // already logged
+                throw e;
+
+            } catch (EInvalidSelfTestException e) {
+                // already logged
+                throw e;
+
             } catch (EBaseException e) {
                 // self test property name EBaseException
 
@@ -1351,8 +1362,8 @@ public class SelfTestSubsystem
                                 loggerFullName,
                                 loggerValue));
 
-                throw new EInvalidSelfTestException(loggerFullName,
-                        loggerValue);
+                throw e;
+
             } catch (Exception e) {
                 // NOTE:  These messages can only be logged to the
                 //        "transactions" log, since the "selftests.log"
@@ -1369,8 +1380,7 @@ public class SelfTestSubsystem
 
                 CMS.debugStackTrace();
 
-                throw new EInvalidSelfTestException(loggerFullName,
-                        loggerValue);
+                throw new EBaseException(e);
             }
         }
 
@@ -1481,6 +1491,11 @@ public class SelfTestSubsystem
                     throw new EMissingSelfTestException(instanceFullName,
                             instanceValue);
                 }
+
+            } catch (EMissingSelfTestException e) {
+                // already logged
+                throw e;
+
             } catch (EBaseException e) {
                 // self test property name EBaseException
                 log(mLogger,
@@ -1489,8 +1504,7 @@ public class SelfTestSubsystem
                                 instanceFullName,
                                 instanceValue));
 
-                throw new EInvalidSelfTestException(instanceFullName,
-                        instanceValue);
+                throw e;
             }
 
             // verify that the associated class is a valid instance of ISelfTest