Added CreateOriginBound method to x509_certificate.h.

net/base/x509_certificate_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <cert.h>
+#include <secoid.h>
+
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/pickle.h"
 #include "base/sha1.h"
 #include "base/string_number_conversions.h"
 #include "base/string_split.h"
 #include "crypto/rsa_private_key.h"
 #include "net/base/asn1_util.h"
 #include "net/base/cert_status_flags.h"
@@ skipping 994 matching lines @@
   private_key.reset(crypto::RSAPrivateKey::CreateFromPrivateKeyInfo(input));
   ASSERT_TRUE(private_key.get());
 
   cert = X509Certificate::CreateSelfSigned(
       private_key.get(), "CN=subject", 1, base::TimeDelta::FromDays(1));
 
   EXPECT_EQ("subject", cert->subject().GetDisplayName());
   EXPECT_FALSE(cert->HasExpired());
 }
 
+// This test creates an origin-bound cert from a private key and
+// then verifies the content of the certificate.
+TEST(X509CertificateTest, CreateOriginBound) {
+  SECItem ob_cert_oid = {siDEROID, NULL, 0};

[wtc, 2011/08/04 00:37:53]

Add a space after '{' and before '}'.

[mdietz, 2011/08/18 00:02:45]

Done.

+  SECItem* expected;
+  SECItem actual = {siBuffer, NULL, 0};
+  SECOidTag ob_cert_oid_tag;
+  SECStatus ok;
+  PRBool res;

[wtc, 2011/08/04 00:37:53]

res => result
    or equal

The Style Guide recommends against using uncommon abbreviations
as variable names:
http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml#General_Naming...

[mdietz, 2011/08/18 00:02:45]

Done.

+
+  // Origin Bound Cert OID
+  std::string oid_string = "1.3.6.1.4.1.11129.2.1.6";

[wtc, 2011/08/04 00:37:53]

Use a C string because this is passed to NSS:
  static const char oid_string[] = "1.3.6.1.4.1.11129.2.1.6";

[mdietz, 2011/08/18 00:02:45]

Done.

+
+  // Sample ASCII weborigin
+  std::string origin = "http://weborigin.com:443";
+
+  // Create object neccissary for extension lookup call
+  SECItem tmp = {siAsciiString,

[wtc, 2011/08/04 00:37:53]

Use a more descriptive name than "tmp".

[mdietz, 2011/08/18 00:02:45]

Done.

+                 (unsigned char*)origin.c_str(),
+                 origin.size()+1};
+
+  scoped_ptr<crypto::RSAPrivateKey> private_key(
+      crypto::RSAPrivateKey::Create(1024));
+  scoped_refptr<X509Certificate> cert =
+      X509Certificate::CreateOriginBound(private_key.get(),
+                                         "CN=subject",
+                                         origin, 1,
+                                         base::TimeDelta::FromDays(1));
+
+  EXPECT_EQ("subject", cert->subject().GetDisplayName());
+  EXPECT_FALSE(cert->HasExpired());
+
+  // IA5Encode and arena allocate SECItem
+  expected = SEC_ASN1EncodeItem(cert->os_cert_handle()->arena, NULL, &tmp,
+                                SEC_ASN1_GET(SEC_IA5StringTemplate));
+
+  ASSERT_NE(expected, static_cast<SECItem*>(NULL));

[wtc, 2011/08/04 00:37:53]

In these ASSERT_xx and EXPECT_xx macros, the expected
value should go first, and the actual value (usually a
variable) should go second.

[mdietz, 2011/08/18 00:02:45]

Done.

+
+  // Create OID SECItem
+  ok = SEC_StringToOID(cert->os_cert_handle()->arena, &ob_cert_oid,
+                       oid_string.c_str(), NULL);

[wtc, 2011/08/04 00:37:53]

You should create an arena:
  PLArenaPool* arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
  ...
  PORT_FreeArena(arena, PR_FALSE);

[mdietz, 2011/08/18 00:02:45]

Done.

+  ASSERT_EQ(ok, SECSuccess);
+
+  ob_cert_oid_tag = SECOID_FindOIDTag(&ob_cert_oid);
+
+  ASSERT_NE(ob_cert_oid_tag, SEC_OID_UNKNOWN);
+
+  // Lookup Origin Bound Cert extension in generated cert
+  ok = CERT_FindCertExtension(cert->os_cert_handle(),
+                                   ob_cert_oid_tag,
+                                   &actual);

[wtc, 2011/08/04 00:37:53]

Align these function arguments.

[mdietz, 2011/08/18 00:02:45]

Done.

+  ASSERT_EQ(ok, SECSuccess);
+
+  // Compare expected and actual extension values
+  res = SECITEM_ItemsAreEqual(expected, &actual);
+  ASSERT_EQ(res, PR_TRUE);

[wtc, 2011/08/04 00:37:53]

You can use ASSERT_TRUE(res).

[mdietz, 2011/08/18 00:02:45]

Done.

+
+  const uint8 private_key_info[] = {

[wtc, 2011/08/04 00:37:53]

Add 'static'.

[mdietz, 2011/08/18 00:02:45]

Done.

+    0x30, 0x82, 0x02, 0x78, 0x02, 0x01, 0x00, 0x30,
+    0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+    0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82,
+    0x02, 0x62, 0x30, 0x82, 0x02, 0x5e, 0x02, 0x01,
+    0x00, 0x02, 0x81, 0x81, 0x00, 0xb8, 0x7f, 0x2b,
+    0x20, 0xdc, 0x7c, 0x9b, 0x0c, 0xdc, 0x51, 0x61,
+    0x99, 0x0d, 0x36, 0x0f, 0xd4, 0x66, 0x88, 0x08,
+    0x55, 0x84, 0xd5, 0x3a, 0xbf, 0x2b, 0xa4, 0x64,
+    0x85, 0x7b, 0x0c, 0x04, 0x13, 0x3f, 0x8d, 0xf4,
+    0xbc, 0x38, 0x0d, 0x49, 0xfe, 0x6b, 0xc4, 0x5a,
+    0xb0, 0x40, 0x53, 0x3a, 0xd7, 0x66, 0x09, 0x0f,
+    0x9e, 0x36, 0x74, 0x30, 0xda, 0x8a, 0x31, 0x4f,
+    0x1f, 0x14, 0x50, 0xd7, 0xc7, 0x20, 0x94, 0x17,
+    0xde, 0x4e, 0xb9, 0x57, 0x5e, 0x7e, 0x0a, 0xe5,
+    0xb2, 0x65, 0x7a, 0x89, 0x4e, 0xb6, 0x47, 0xff,
+    0x1c, 0xbd, 0xb7, 0x38, 0x13, 0xaf, 0x47, 0x85,
+    0x84, 0x32, 0x33, 0xf3, 0x17, 0x49, 0xbf, 0xe9,
+    0x96, 0xd0, 0xd6, 0x14, 0x6f, 0x13, 0x8d, 0xc5,
+    0xfc, 0x2c, 0x72, 0xba, 0xac, 0xea, 0x7e, 0x18,
+    0x53, 0x56, 0xa6, 0x83, 0xa2, 0xce, 0x93, 0x93,
+    0xe7, 0x1f, 0x0f, 0xe6, 0x0f, 0x02, 0x03, 0x01,
+    0x00, 0x01, 0x02, 0x81, 0x80, 0x03, 0x61, 0x89,
+    0x37, 0xcb, 0xf2, 0x98, 0xa0, 0xce, 0xb4, 0xcb,
+    0x16, 0x13, 0xf0, 0xe6, 0xaf, 0x5c, 0xc5, 0xa7,
+    0x69, 0x71, 0xca, 0xba, 0x8d, 0xe0, 0x4d, 0xdd,
+    0xed, 0xb8, 0x48, 0x8b, 0x16, 0x93, 0x36, 0x95,
+    0xc2, 0x91, 0x40, 0x65, 0x17, 0xbd, 0x7f, 0xd6,
+    0xad, 0x9e, 0x30, 0x28, 0x46, 0xe4, 0x3e, 0xcc,
+    0x43, 0x78, 0xf9, 0xfe, 0x1f, 0x33, 0x23, 0x1e,
+    0x31, 0x12, 0x9d, 0x3c, 0xa7, 0x08, 0x82, 0x7b,
+    0x7d, 0x25, 0x4e, 0x5e, 0x19, 0xa8, 0x9b, 0xed,
+    0x86, 0xb2, 0xcb, 0x3c, 0xfe, 0x4e, 0xa1, 0xfa,
+    0x62, 0x87, 0x3a, 0x17, 0xf7, 0x60, 0xec, 0x38,
+    0x29, 0xe8, 0x4f, 0x34, 0x9f, 0x76, 0x9d, 0xee,
+    0xa3, 0xf6, 0x85, 0x6b, 0x84, 0x43, 0xc9, 0x1e,
+    0x01, 0xff, 0xfd, 0xd0, 0x29, 0x4c, 0xfa, 0x8e,
+    0x57, 0x0c, 0xc0, 0x71, 0xa5, 0xbb, 0x88, 0x46,
+    0x29, 0x5c, 0xc0, 0x4f, 0x01, 0x02, 0x41, 0x00,
+    0xf5, 0x83, 0xa4, 0x64, 0x4a, 0xf2, 0xdd, 0x8c,
+    0x2c, 0xed, 0xa8, 0xd5, 0x60, 0x5a, 0xe4, 0xc7,
+    0xcc, 0x61, 0xcd, 0x38, 0x42, 0x20, 0xd3, 0x82,
+    0x18, 0xf2, 0x35, 0x00, 0x72, 0x2d, 0xf7, 0x89,
+    0x80, 0x67, 0xb5, 0x93, 0x05, 0x5f, 0xdd, 0x42,
+    0xba, 0x16, 0x1a, 0xea, 0x15, 0xc6, 0xf0, 0xb8,
+    0x8c, 0xbc, 0xbf, 0x54, 0x9e, 0xf1, 0xc1, 0xb2,
+    0xb3, 0x8b, 0xb6, 0x26, 0x02, 0x30, 0xc4, 0x81,
+    0x02, 0x41, 0x00, 0xc0, 0x60, 0x62, 0x80, 0xe1,
+    0x22, 0x78, 0xf6, 0x9d, 0x83, 0x18, 0xeb, 0x72,
+    0x45, 0xd7, 0xc8, 0x01, 0x7f, 0xa9, 0xca, 0x8f,
+    0x7d, 0xd6, 0xb8, 0x31, 0x2b, 0x84, 0x7f, 0x62,
+    0xd9, 0xa9, 0x22, 0x17, 0x7d, 0x06, 0x35, 0x6c,
+    0xf3, 0xc1, 0x94, 0x17, 0x85, 0x5a, 0xaf, 0x9c,
+    0x5c, 0x09, 0x3c, 0xcf, 0x2f, 0x44, 0x9d, 0xb6,
+    0x52, 0x68, 0x5f, 0xf9, 0x59, 0xc8, 0x84, 0x2b,
+    0x39, 0x22, 0x8f, 0x02, 0x41, 0x00, 0xb2, 0x04,
+    0xe2, 0x0e, 0x56, 0xca, 0x03, 0x1a, 0xc0, 0xf9,
+    0x12, 0x92, 0xa5, 0x6b, 0x42, 0xb8, 0x1c, 0xda,
+    0x4d, 0x93, 0x9d, 0x5f, 0x6f, 0xfd, 0xc5, 0x58,
+    0xda, 0x55, 0x98, 0x74, 0xfc, 0x28, 0x17, 0x93,
+    0x1b, 0x75, 0x9f, 0x50, 0x03, 0x7f, 0x7e, 0xae,
+    0xc8, 0x95, 0x33, 0x75, 0x2c, 0xd6, 0xa4, 0x35,
+    0xb8, 0x06, 0x03, 0xba, 0x08, 0x59, 0x2b, 0x17,
+    0x02, 0xdc, 0x4c, 0x7a, 0x50, 0x01, 0x02, 0x41,
+    0x00, 0x9d, 0xdb, 0x39, 0x59, 0x09, 0xe4, 0x30,
+    0xa0, 0x24, 0xf5, 0xdb, 0x2f, 0xf0, 0x2f, 0xf1,
+    0x75, 0x74, 0x0d, 0x5e, 0xb5, 0x11, 0x73, 0xb0,
+    0x0a, 0xaa, 0x86, 0x4c, 0x0d, 0xff, 0x7e, 0x1d,
+    0xb4, 0x14, 0xd4, 0x09, 0x91, 0x33, 0x5a, 0xfd,
+    0xa0, 0x58, 0x80, 0x9b, 0xbe, 0x78, 0x2e, 0x69,
+    0x82, 0x15, 0x7c, 0x72, 0xf0, 0x7b, 0x18, 0x39,
+    0xff, 0x6e, 0xeb, 0xc6, 0x86, 0xf5, 0xb4, 0xc7,
+    0x6f, 0x02, 0x41, 0x00, 0x8d, 0x1a, 0x37, 0x0f,
+    0x76, 0xc4, 0x82, 0xfa, 0x5c, 0xc3, 0x79, 0x35,
+    0x3e, 0x70, 0x8a, 0xbf, 0x27, 0x49, 0xb0, 0x99,
+    0x63, 0xcb, 0x77, 0x5f, 0xa8, 0x82, 0x65, 0xf6,
+    0x03, 0x52, 0x51, 0xf1, 0xae, 0x2e, 0x05, 0xb3,
+    0xc6, 0xa4, 0x92, 0xd1, 0xce, 0x6c, 0x72, 0xfb,
+    0x21, 0xb3, 0x02, 0x87, 0xe4, 0xfd, 0x61, 0xca,
+    0x00, 0x42, 0x19, 0xf0, 0xda, 0x5a, 0x53, 0xe3,
+    0xb1, 0xc5, 0x15, 0xf3
+  };
+
+  std::vector<uint8> input;
+  input.resize(sizeof(private_key_info));
+  memcpy(&input.front(), private_key_info, sizeof(private_key_info));
+
+  private_key.reset(crypto::RSAPrivateKey::CreateFromPrivateKeyInfo(input));

[wtc, 2011/08/04 00:37:53]

I don't know why we're repeating the test.  The only difference
is how the private key is created.  (I know you copied this
from the CreateSelfSigned test.)

[mdietz, 2011/08/18 00:02:45]

Agreed, removed.

+  ASSERT_TRUE(private_key.get());
+
+  // Reset cert and actual values
+  cert = NULL;
+  actual.type = siBuffer;
+  actual.data = NULL;
+  actual.len = 0;

[wtc, 2011/08/04 00:37:53]

Call
  SECITEM_FreeItem(&actual, PR_FALSE);

before resetting actual.data to NULL to avoid a memory leak.

[mdietz, 2011/08/18 00:02:45]

No longer an issue since I've removed this code.

+
+  cert = X509Certificate::CreateOriginBound(private_key.get(),
+                                            "CN=subject",
+                                            origin, 1,
+                                            base::TimeDelta::FromDays(1));
+
+  EXPECT_EQ("subject", cert->subject().GetDisplayName());
+  EXPECT_FALSE(cert->HasExpired());
+
+  // Lookup Origin Bound Cert extension in generated cert
+  ok = CERT_FindCertExtension(cert->os_cert_handle(),
+                              ob_cert_oid_tag,
+                              &actual);
+  ASSERT_EQ(ok, SECSuccess);
+
+  // Compare expected and actual extension values
+  res = SECITEM_ItemsAreEqual(expected, &actual);
+  ASSERT_EQ(res, PR_TRUE);
+}
+
 TEST(X509CertificateTest, GetDEREncoded) {
   scoped_ptr<crypto::RSAPrivateKey> private_key(
       crypto::RSAPrivateKey::Create(1024));
   scoped_refptr<X509Certificate> cert =
       X509Certificate::CreateSelfSigned(
           private_key.get(), "CN=subject", 0, base::TimeDelta::FromDays(1));
 
   std::string der_cert;
   EXPECT_TRUE(cert->GetDEREncoded(&der_cert));
   EXPECT_FALSE(der_cert.empty());
@@ skipping 241 matching lines @@
   }
 
   EXPECT_EQ(test_data.expected, X509Certificate::VerifyHostname(
       test_data.hostname, common_name, dns_names, ip_addressses));
 }
 
 INSTANTIATE_TEST_CASE_P(, X509CertificateNameVerifyTest,
                         testing::ValuesIn(kNameVerifyTestData));
 
 }  // namespace net