From 34fed15cd0144e9d3d7f497609429be6501eca02 Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Fri, 5 Nov 2021 12:36:49 -0600
Subject: [PATCH] adjustments to provider tests from Android IDE project update

---
 .../jsse/test/WolfSSLServerSocketTest.java    |  8 ++--
 .../provider/jsse/test/WolfSSLX509Test.java   | 38 ++++++++++++-------
 2 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/src/test/com/wolfssl/provider/jsse/test/WolfSSLServerSocketTest.java b/src/test/com/wolfssl/provider/jsse/test/WolfSSLServerSocketTest.java
index ca05e7b..8f8dcb0 100644
--- a/src/test/com/wolfssl/provider/jsse/test/WolfSSLServerSocketTest.java
+++ b/src/test/com/wolfssl/provider/jsse/test/WolfSSLServerSocketTest.java
@@ -485,11 +485,11 @@ public class WolfSSLServerSocketTest {
         serverFuture.get();
         ss.close();
 
-        /* fail case, incorrect root CA loaded to verify server cert.
-         * serverJKS doesn't verify serverJKS */
+        /* fail case, incorrect root CA loaded to verify client cert.
+         * caJKS does not verify clientJKS (client cert is self-signed) */
         this.ctx = tf.createSSLContext("TLSv1.2", ctxProvider,
-                tf.createTrustManager("SunX509", tf.serverJKS, ctxProvider),
-                tf.createKeyManager("SunX509", tf.serverJKS, ctxProvider));
+                tf.createTrustManager("SunX509", tf.caJKS, ctxProvider),
+                tf.createKeyManager("SunX509", tf.clientJKS, ctxProvider));
 
         ss = (SSLServerSocket)ctx.getServerSocketFactory()
             .createServerSocket(0);
diff --git a/src/test/com/wolfssl/provider/jsse/test/WolfSSLX509Test.java b/src/test/com/wolfssl/provider/jsse/test/WolfSSLX509Test.java
index c17007a..6f46c3b 100644
--- a/src/test/com/wolfssl/provider/jsse/test/WolfSSLX509Test.java
+++ b/src/test/com/wolfssl/provider/jsse/test/WolfSSLX509Test.java
@@ -417,10 +417,11 @@ public class WolfSSLX509Test {
         }
 
         try {
-            X509Certificate x509;
-            javax.security.cert.X509Certificate peer;
-            X509Certificate local[];
+            java.security.cert.X509Certificate x509 = null;
+            javax.security.cert.X509Certificate peer = null;
+            java.security.cert.Certificate local[];
 
+            /* getPeerCertificateChain() returns array of javax.security.cert.X509Certificate */
             certs = client.getSession().getPeerCertificateChain();
             if (certs == null) {
                 error("\t\t... failed");
@@ -430,6 +431,7 @@ public class WolfSSLX509Test {
             peer = certs[0];
 
 
+            /* getLocalCertificates() returns array of java.security.cert.Certificate */
             local = (X509Certificate[]) server.getSession().getLocalCertificates();
             if (local == null) {
                 error("\t\t... failed");
@@ -437,7 +439,14 @@ public class WolfSSLX509Test {
                 return;
             }
             /* @TODO local.length != 2 test */
-            x509 = local[0];
+
+            /* check that getLocalCertificates() returned type X509Certificate */
+            if (local[0].getType().equals("X.509")) {
+                x509 = (X509Certificate)local[0];
+            } else {
+                error("\t\t... failed");
+                fail("getLocalCertificates() did not return X509Certificate type");
+            }
 
             if (x509.getVersion() != 3 || peer.getVersion() != 2) {
                 error("\t\t... failed");
@@ -469,16 +478,19 @@ public class WolfSSLX509Test {
                fail("failed date not after");
            }
 
-           if (!x509.getSubjectDN().getName().equals(
-                   peer.getSubjectDN().getName())) {
-               error("\t\t... failed");
-               fail("subject DN does not match");
-           }
+           /* Android KeyStore formats x509 getName() differently than peer getName() */
+           if (!tf.isAndroid()) {
+               if (!x509.getSubjectDN().getName().equals(
+                       peer.getSubjectDN().getName())) {
+                   error("\t\t... failed");
+                   fail("subject DN does not match");
+               }
 
-           if (!x509.getIssuerDN().getName().equals(
-                   peer.getIssuerDN().getName())) {
-               error("\t\t... failed");
-               fail("issuer DN does not match");
+               if (!x509.getIssuerDN().getName().equals(
+                       peer.getIssuerDN().getName())) {
+                   error("\t\t... failed");
+                   fail("issuer DN does not match");
+               }
            }
 
            if (peer.toString() == null || x509.toString() == null) {