Mac: Look for issuer in a certificate chain instead of subject

net/base/x509_certificate_unittest.cc

Index: net/base/x509_certificate_unittest.cc
diff --git a/net/base/x509_certificate_unittest.cc b/net/base/x509_certificate_unittest.cc
index ab2f7a800059d0712ee022c305368d8839289675..c349661f0ba5957f3e51d50a16d07788eec8e3cf 100644
--- a/net/base/x509_certificate_unittest.cc
+++ b/net/base/x509_certificate_unittest.cc
@@ -633,6 +633,53 @@ TEST(X509CertificateTest, IntermediateCertificates) {
 }
 #endif
 
+#if defined(OS_MACOSX)

[wtc, 2010/08/03 01:26:58]

Is this unit test ifdef'd with OS_MACOSX because
the IsIssuedBy method is defined for OS_MACOSX only?

+TEST(X509CertificateTest, IsIssuedBy) {
+  FilePath certs_dir = GetTestCertsDirectory();
+
+  // Test a client certificate from MIT.
+  scoped_refptr<X509Certificate> mit_davidben_cert =
+      ImportCertFromFile(certs_dir, "mit.davidben.der");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), mit_davidben_cert);
+
+  CertPrincipal mit_principal;

[wtc, 2010/08/03 01:26:58]

Nit: mit_principal => mit_issuer
     foaf_principal => foaf_issuer
Or you can use "name" instead of "issuer".

I don't lke the CertPrincipal type name.
It probably should be renamed CertName.
In ASN.1, this type is called "Name".

+  mit_principal.country_name = "US";
+  mit_principal.state_or_province_name = "Massachusetts";
+  mit_principal.organization_names.push_back(
+      "Massachusetts Institute of Technology");
+  mit_principal.organization_unit_names.push_back("Client CA v1");
+
+  // IsIssuedBy should return true even if it cannot build a chain
+  // with that principal.
+  std::vector<CertPrincipal> mit_issuers(1, mit_principal);
+  EXPECT_TRUE(mit_davidben_cert->IsIssuedBy(mit_issuers));
+
+  // Test a client certificate from FOAF.ME.
+  scoped_refptr<X509Certificate> foaf_me_chromium_test_cert =
+      ImportCertFromFile(certs_dir, "foaf.me.chromium-test-cert.der");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), foaf_me_chromium_test_cert);
+
+  CertPrincipal foaf_principal;
+  foaf_principal.common_name = "FOAF.ME";
+  foaf_principal.locality_name = "Wimbledon";
+  foaf_principal.state_or_province_name = "LONDON";
+  foaf_principal.country_name = "GB";
+  foaf_principal.organization_names.push_back("FOAF.ME");
+
+  std::vector<CertPrincipal> foaf_issuers(1, foaf_principal);
+  EXPECT_TRUE(foaf_me_chromium_test_cert->IsIssuedBy(foaf_issuers));
+
+  // And test some combinations and mismatches.
+  std::vector<CertPrincipal> both_issuers;
+  both_issuers.push_back(mit_principal);
+  both_issuers.push_back(foaf_principal);
+  EXPECT_TRUE(foaf_me_chromium_test_cert->IsIssuedBy(both_issuers));
+  EXPECT_TRUE(mit_davidben_cert->IsIssuedBy(both_issuers));
+  EXPECT_FALSE(foaf_me_chromium_test_cert->IsIssuedBy(mit_issuers));
+  EXPECT_FALSE(mit_davidben_cert->IsIssuedBy(foaf_issuers));
+}
+#endif  // defined(OS_MACOSX)
+
 class X509CertificateParseTest
     : public testing::TestWithParam<CertificateFormatTestData> {
  public: