| OLD | NEW |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <cert.h> | 5 #include <cert.h> |
| 6 #include <pk11pub.h> | 6 #include <pk11pub.h> |
| 7 | 7 |
| 8 #include <algorithm> | 8 #include <algorithm> |
| 9 | 9 |
| 10 #include "base/file_path.h" | 10 #include "base/file_path.h" |
| (...skipping 265 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 276 EXPECT_TRUE(cert_db_.ImportCACerts(certs, CertDatabase::TRUSTED_SSL, | 276 EXPECT_TRUE(cert_db_.ImportCACerts(certs, CertDatabase::TRUSTED_SSL, |
| 277 &failed)); | 277 &failed)); |
| 278 | 278 |
| 279 EXPECT_EQ(0U, failed.size()); | 279 EXPECT_EQ(0U, failed.size()); |
| 280 | 280 |
| 281 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); | 281 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); |
| 282 ASSERT_EQ(1U, cert_list.size()); | 282 ASSERT_EQ(1U, cert_list.size()); |
| 283 scoped_refptr<X509Certificate> cert(cert_list[0]); | 283 scoped_refptr<X509Certificate> cert(cert_list[0]); |
| 284 EXPECT_EQ("Test CA", cert->subject().common_name); | 284 EXPECT_EQ("Test CA", cert->subject().common_name); |
| 285 | 285 |
| 286 EXPECT_EQ(CertDatabase::TRUSTED_SSL, | 286 EXPECT_EQ(static_cast<unsigned int>(CertDatabase::TRUSTED_SSL), |
| 287 cert_db_.GetCertTrust(cert.get(), CA_CERT)); | 287 cert_db_.GetCertTrust(cert.get(), CA_CERT)); |
| 288 | 288 |
| 289 psm::nsNSSCertTrust trust(cert->os_cert_handle()->trust); | 289 psm::nsNSSCertTrust trust(cert->os_cert_handle()->trust); |
| 290 EXPECT_TRUE(trust.HasTrustedCA(PR_TRUE, PR_FALSE, PR_FALSE)); | 290 EXPECT_TRUE(trust.HasTrustedCA(PR_TRUE, PR_FALSE, PR_FALSE)); |
| 291 EXPECT_FALSE(trust.HasTrustedCA(PR_FALSE, PR_TRUE, PR_FALSE)); | 291 EXPECT_FALSE(trust.HasTrustedCA(PR_FALSE, PR_TRUE, PR_FALSE)); |
| 292 EXPECT_FALSE(trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE)); | 292 EXPECT_FALSE(trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE)); |
| 293 EXPECT_FALSE(trust.HasTrustedCA(PR_TRUE, PR_TRUE, PR_TRUE)); | 293 EXPECT_FALSE(trust.HasTrustedCA(PR_TRUE, PR_TRUE, PR_TRUE)); |
| 294 EXPECT_TRUE(trust.HasCA(PR_TRUE, PR_TRUE, PR_TRUE)); | 294 EXPECT_TRUE(trust.HasCA(PR_TRUE, PR_TRUE, PR_TRUE)); |
| 295 } | 295 } |
| 296 | 296 |
| (...skipping 11 matching lines...) Expand all Loading... |
| 308 EXPECT_TRUE(cert_db_.ImportCACerts(certs, CertDatabase::TRUSTED_EMAIL, | 308 EXPECT_TRUE(cert_db_.ImportCACerts(certs, CertDatabase::TRUSTED_EMAIL, |
| 309 &failed)); | 309 &failed)); |
| 310 | 310 |
| 311 EXPECT_EQ(0U, failed.size()); | 311 EXPECT_EQ(0U, failed.size()); |
| 312 | 312 |
| 313 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); | 313 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); |
| 314 ASSERT_EQ(1U, cert_list.size()); | 314 ASSERT_EQ(1U, cert_list.size()); |
| 315 scoped_refptr<X509Certificate> cert(cert_list[0]); | 315 scoped_refptr<X509Certificate> cert(cert_list[0]); |
| 316 EXPECT_EQ("Test CA", cert->subject().common_name); | 316 EXPECT_EQ("Test CA", cert->subject().common_name); |
| 317 | 317 |
| 318 EXPECT_EQ(CertDatabase::TRUSTED_EMAIL, | 318 EXPECT_EQ(static_cast<unsigned int>(CertDatabase::TRUSTED_EMAIL), |
| 319 cert_db_.GetCertTrust(cert.get(), CA_CERT)); | 319 cert_db_.GetCertTrust(cert.get(), CA_CERT)); |
| 320 | 320 |
| 321 psm::nsNSSCertTrust trust(cert->os_cert_handle()->trust); | 321 psm::nsNSSCertTrust trust(cert->os_cert_handle()->trust); |
| 322 EXPECT_FALSE(trust.HasTrustedCA(PR_TRUE, PR_FALSE, PR_FALSE)); | 322 EXPECT_FALSE(trust.HasTrustedCA(PR_TRUE, PR_FALSE, PR_FALSE)); |
| 323 EXPECT_TRUE(trust.HasTrustedCA(PR_FALSE, PR_TRUE, PR_FALSE)); | 323 EXPECT_TRUE(trust.HasTrustedCA(PR_FALSE, PR_TRUE, PR_FALSE)); |
| 324 EXPECT_FALSE(trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE)); | 324 EXPECT_FALSE(trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE)); |
| 325 EXPECT_TRUE(trust.HasCA(PR_TRUE, PR_TRUE, PR_TRUE)); | 325 EXPECT_TRUE(trust.HasCA(PR_TRUE, PR_TRUE, PR_TRUE)); |
| 326 } | 326 } |
| 327 | 327 |
| 328 TEST_F(CertDatabaseNSSTest, ImportCACert_ObjSignTrust) { | 328 TEST_F(CertDatabaseNSSTest, ImportCACert_ObjSignTrust) { |
| (...skipping 10 matching lines...) Expand all Loading... |
| 339 EXPECT_TRUE(cert_db_.ImportCACerts(certs, CertDatabase::TRUSTED_OBJ_SIGN, | 339 EXPECT_TRUE(cert_db_.ImportCACerts(certs, CertDatabase::TRUSTED_OBJ_SIGN, |
| 340 &failed)); | 340 &failed)); |
| 341 | 341 |
| 342 EXPECT_EQ(0U, failed.size()); | 342 EXPECT_EQ(0U, failed.size()); |
| 343 | 343 |
| 344 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); | 344 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); |
| 345 ASSERT_EQ(1U, cert_list.size()); | 345 ASSERT_EQ(1U, cert_list.size()); |
| 346 scoped_refptr<X509Certificate> cert(cert_list[0]); | 346 scoped_refptr<X509Certificate> cert(cert_list[0]); |
| 347 EXPECT_EQ("Test CA", cert->subject().common_name); | 347 EXPECT_EQ("Test CA", cert->subject().common_name); |
| 348 | 348 |
| 349 EXPECT_EQ(CertDatabase::TRUSTED_OBJ_SIGN, | 349 EXPECT_EQ(static_cast<unsigned int>(CertDatabase::TRUSTED_OBJ_SIGN), |
| 350 cert_db_.GetCertTrust(cert.get(), CA_CERT)); | 350 cert_db_.GetCertTrust(cert.get(), CA_CERT)); |
| 351 | 351 |
| 352 psm::nsNSSCertTrust trust(cert->os_cert_handle()->trust); | 352 psm::nsNSSCertTrust trust(cert->os_cert_handle()->trust); |
| 353 EXPECT_FALSE(trust.HasTrustedCA(PR_TRUE, PR_FALSE, PR_FALSE)); | 353 EXPECT_FALSE(trust.HasTrustedCA(PR_TRUE, PR_FALSE, PR_FALSE)); |
| 354 EXPECT_FALSE(trust.HasTrustedCA(PR_FALSE, PR_TRUE, PR_FALSE)); | 354 EXPECT_FALSE(trust.HasTrustedCA(PR_FALSE, PR_TRUE, PR_FALSE)); |
| 355 EXPECT_TRUE(trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE)); | 355 EXPECT_TRUE(trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE)); |
| 356 EXPECT_TRUE(trust.HasCA(PR_TRUE, PR_TRUE, PR_TRUE)); | 356 EXPECT_TRUE(trust.HasCA(PR_TRUE, PR_TRUE, PR_TRUE)); |
| 357 } | 357 } |
| 358 | 358 |
| 359 TEST_F(CertDatabaseNSSTest, ImportCA_NotCACert) { | 359 TEST_F(CertDatabaseNSSTest, ImportCA_NotCACert) { |
| (...skipping 166 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 526 | 526 |
| 527 EXPECT_EQ(0U, failed.size()); | 527 EXPECT_EQ(0U, failed.size()); |
| 528 | 528 |
| 529 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); | 529 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); |
| 530 ASSERT_EQ(2U, cert_list.size()); | 530 ASSERT_EQ(2U, cert_list.size()); |
| 531 scoped_refptr<X509Certificate> goog_cert(cert_list[0]); | 531 scoped_refptr<X509Certificate> goog_cert(cert_list[0]); |
| 532 scoped_refptr<X509Certificate> thawte_cert(cert_list[1]); | 532 scoped_refptr<X509Certificate> thawte_cert(cert_list[1]); |
| 533 EXPECT_EQ("www.google.com", goog_cert->subject().common_name); | 533 EXPECT_EQ("www.google.com", goog_cert->subject().common_name); |
| 534 EXPECT_EQ("Thawte SGC CA", thawte_cert->subject().common_name); | 534 EXPECT_EQ("Thawte SGC CA", thawte_cert->subject().common_name); |
| 535 | 535 |
| 536 EXPECT_EQ(CertDatabase::UNTRUSTED, | 536 EXPECT_EQ(static_cast<unsigned int>(CertDatabase::UNTRUSTED), |
| 537 cert_db_.GetCertTrust(goog_cert.get(), SERVER_CERT)); | 537 cert_db_.GetCertTrust(goog_cert.get(), SERVER_CERT)); |
| 538 psm::nsNSSCertTrust goog_trust(goog_cert->os_cert_handle()->trust); | 538 psm::nsNSSCertTrust goog_trust(goog_cert->os_cert_handle()->trust); |
| 539 EXPECT_TRUE(goog_trust.HasPeer(PR_TRUE, PR_TRUE, PR_TRUE)); | 539 EXPECT_TRUE(goog_trust.HasPeer(PR_TRUE, PR_TRUE, PR_TRUE)); |
| 540 | 540 |
| 541 int flags = 0; | 541 int flags = 0; |
| 542 CertVerifyResult verify_result; | 542 CertVerifyResult verify_result; |
| 543 int error = goog_cert->Verify("www.google.com", flags, &verify_result); | 543 int error = goog_cert->Verify("www.google.com", flags, &verify_result); |
| 544 EXPECT_EQ(OK, error); | 544 EXPECT_EQ(OK, error); |
| 545 EXPECT_EQ(0, verify_result.cert_status); | 545 EXPECT_EQ(0, verify_result.cert_status); |
| 546 } | 546 } |
| 547 | 547 |
| 548 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned) { | 548 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned) { |
| 549 CertificateList certs; | 549 CertificateList certs; |
| 550 ASSERT_TRUE(ReadCertIntoList("punycodetest.der", &certs)); | 550 ASSERT_TRUE(ReadCertIntoList("punycodetest.der", &certs)); |
| 551 | 551 |
| 552 CertDatabase::ImportCertFailureList failed; | 552 CertDatabase::ImportCertFailureList failed; |
| 553 EXPECT_TRUE(cert_db_.ImportServerCert(certs, &failed)); | 553 EXPECT_TRUE(cert_db_.ImportServerCert(certs, &failed)); |
| 554 | 554 |
| 555 EXPECT_EQ(0U, failed.size()); | 555 EXPECT_EQ(0U, failed.size()); |
| 556 | 556 |
| 557 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); | 557 CertificateList cert_list = ListCertsInSlot(slot_->os_module_handle()); |
| 558 ASSERT_EQ(1U, cert_list.size()); | 558 ASSERT_EQ(1U, cert_list.size()); |
| 559 scoped_refptr<X509Certificate> puny_cert(cert_list[0]); | 559 scoped_refptr<X509Certificate> puny_cert(cert_list[0]); |
| 560 | 560 |
| 561 EXPECT_EQ(CertDatabase::UNTRUSTED, | 561 EXPECT_EQ(static_cast<unsigned int>(CertDatabase::UNTRUSTED), |
| 562 cert_db_.GetCertTrust(puny_cert.get(), SERVER_CERT)); | 562 cert_db_.GetCertTrust(puny_cert.get(), SERVER_CERT)); |
| 563 psm::nsNSSCertTrust puny_trust(puny_cert->os_cert_handle()->trust); | 563 psm::nsNSSCertTrust puny_trust(puny_cert->os_cert_handle()->trust); |
| 564 EXPECT_TRUE(puny_trust.HasPeer(PR_TRUE, PR_TRUE, PR_TRUE)); | 564 EXPECT_TRUE(puny_trust.HasPeer(PR_TRUE, PR_TRUE, PR_TRUE)); |
| 565 | 565 |
| 566 int flags = 0; | 566 int flags = 0; |
| 567 CertVerifyResult verify_result; | 567 CertVerifyResult verify_result; |
| 568 int error = puny_cert->Verify("xn--wgv71a119e.com", flags, &verify_result); | 568 int error = puny_cert->Verify("xn--wgv71a119e.com", flags, &verify_result); |
| 569 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); | 569 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); |
| 570 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); | 570 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); |
| 571 | 571 |
| 572 // TODO(mattm): this should be SERVER_CERT, not CA_CERT, but that does not | 572 // TODO(mattm): this should be SERVER_CERT, not CA_CERT, but that does not |
| 573 // work due to NSS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=531160 | 573 // work due to NSS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=531160 |
| 574 EXPECT_TRUE(cert_db_.SetCertTrust( | 574 EXPECT_TRUE(cert_db_.SetCertTrust( |
| 575 puny_cert.get(), CA_CERT, | 575 puny_cert.get(), CA_CERT, |
| 576 CertDatabase::TRUSTED_SSL | CertDatabase::TRUSTED_EMAIL)); | 576 CertDatabase::TRUSTED_SSL | CertDatabase::TRUSTED_EMAIL)); |
| 577 | 577 |
| 578 verify_result.Reset(); | 578 verify_result.Reset(); |
| 579 error = puny_cert->Verify("xn--wgv71a119e.com", flags, &verify_result); | 579 error = puny_cert->Verify("xn--wgv71a119e.com", flags, &verify_result); |
| 580 EXPECT_EQ(OK, error); | 580 EXPECT_EQ(OK, error); |
| 581 EXPECT_EQ(0, verify_result.cert_status); | 581 EXPECT_EQ(0, verify_result.cert_status); |
| 582 } | 582 } |
| 583 | 583 |
| 584 } // namespace net | 584 } // namespace net |
| OLD | NEW |