Mac: Look for issuer in a certificate chain instead of subject

net/base/x509_certificate_unittest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/pickle.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_test_util.h"
@@ skipping 615 matching lines @@
       google_handle, X509Certificate::SOURCE_FROM_NETWORK, intermediates3);
 
   // The cache should have returned cert2 'cause it has more intermediates:
   EXPECT_EQ(cert3, cert2);
 
   // Cleanup
   X509Certificate::FreeOSCertHandle(google_handle);
 }
 #endif
 
+#if defined(OS_MACOSX)

[wtc, 2010/08/03 01:26:58]

Is this unit test ifdef'd with OS_MACOSX because
the IsIssuedBy method is defined for OS_MACOSX only?

+TEST(X509CertificateTest, IsIssuedBy) {
+  FilePath certs_dir = GetTestCertsDirectory();
+
+  // Test a client certificate from MIT.
+  scoped_refptr<X509Certificate> mit_davidben_cert =
+      ImportCertFromFile(certs_dir, "mit.davidben.der");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), mit_davidben_cert);
+
+  CertPrincipal mit_principal;

[wtc, 2010/08/03 01:26:58]

Nit: mit_principal => mit_issuer
     foaf_principal => foaf_issuer
Or you can use "name" instead of "issuer".

I don't lke the CertPrincipal type name.
It probably should be renamed CertName.
In ASN.1, this type is called "Name".

+  mit_principal.country_name = "US";
+  mit_principal.state_or_province_name = "Massachusetts";
+  mit_principal.organization_names.push_back(
+      "Massachusetts Institute of Technology");
+  mit_principal.organization_unit_names.push_back("Client CA v1");
+
+  // IsIssuedBy should return true even if it cannot build a chain
+  // with that principal.
+  std::vector<CertPrincipal> mit_issuers(1, mit_principal);
+  EXPECT_TRUE(mit_davidben_cert->IsIssuedBy(mit_issuers));
+
+  // Test a client certificate from FOAF.ME.
+  scoped_refptr<X509Certificate> foaf_me_chromium_test_cert =
+      ImportCertFromFile(certs_dir, "foaf.me.chromium-test-cert.der");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), foaf_me_chromium_test_cert);
+
+  CertPrincipal foaf_principal;
+  foaf_principal.common_name = "FOAF.ME";
+  foaf_principal.locality_name = "Wimbledon";
+  foaf_principal.state_or_province_name = "LONDON";
+  foaf_principal.country_name = "GB";
+  foaf_principal.organization_names.push_back("FOAF.ME");
+
+  std::vector<CertPrincipal> foaf_issuers(1, foaf_principal);
+  EXPECT_TRUE(foaf_me_chromium_test_cert->IsIssuedBy(foaf_issuers));
+
+  // And test some combinations and mismatches.
+  std::vector<CertPrincipal> both_issuers;
+  both_issuers.push_back(mit_principal);
+  both_issuers.push_back(foaf_principal);
+  EXPECT_TRUE(foaf_me_chromium_test_cert->IsIssuedBy(both_issuers));
+  EXPECT_TRUE(mit_davidben_cert->IsIssuedBy(both_issuers));
+  EXPECT_FALSE(foaf_me_chromium_test_cert->IsIssuedBy(mit_issuers));
+  EXPECT_FALSE(mit_davidben_cert->IsIssuedBy(foaf_issuers));
+}
+#endif  // defined(OS_MACOSX)
+
 class X509CertificateParseTest
     : public testing::TestWithParam<CertificateFormatTestData> {
  public:
   virtual ~X509CertificateParseTest() {}
   virtual void SetUp() {
     test_data_ = GetParam();
   }
   virtual void TearDown() {}
 
  protected:
@@ skipping 18 matching lines @@
 
     for (size_t j = 0; j < 20; ++j)
       EXPECT_EQ(expected_fingerprint[j], actual_fingerprint.data[j]);
   }
 }
 
 INSTANTIATE_TEST_CASE_P(, X509CertificateParseTest,
                         testing::ValuesIn(FormatTestData));
 
 }  // namespace net