OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/chromeos/policy/policy_cert_verifier.h" | 5 #include "chrome/browser/chromeos/policy/policy_cert_verifier.h" |
6 | 6 |
7 #include "base/bind.h" | 7 #include "base/bind.h" |
8 #include "base/bind_helpers.h" | 8 #include "base/bind_helpers.h" |
9 #include "base/callback.h" | 9 #include "base/callback.h" |
10 #include "base/memory/ref_counted.h" | 10 #include "base/memory/ref_counted.h" |
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
59 test_ca_cert_list_.push_back(test_ca_cert_); | 59 test_ca_cert_list_.push_back(test_ca_cert_); |
60 } | 60 } |
61 | 61 |
62 void TearDown() override { | 62 void TearDown() override { |
63 // Destroy |cert_verifier_| before destroying the ThreadBundle, otherwise | 63 // Destroy |cert_verifier_| before destroying the ThreadBundle, otherwise |
64 // BrowserThread::CurrentlyOn checks fail. | 64 // BrowserThread::CurrentlyOn checks fail. |
65 cert_verifier_.reset(); | 65 cert_verifier_.reset(); |
66 } | 66 } |
67 | 67 |
68 protected: | 68 protected: |
69 int VerifyTestServerCert( | 69 int VerifyTestServerCert(const net::TestCompletionCallback& test_callback, |
70 const net::TestCompletionCallback& test_callback, | 70 net::CertVerifyResult* verify_result, |
71 net::CertVerifyResult* verify_result, | 71 scoped_ptr<net::CertVerifier::Request>* request) { |
72 scoped_ptr<net::CertVerifier::Request>* request_handle) { | 72 return cert_verifier_->Verify( |
73 return cert_verifier_->Verify(test_server_cert_.get(), "127.0.0.1", | 73 test_server_cert_.get(), "127.0.0.1", std::string(), 0, NULL, |
74 std::string(), 0, NULL, verify_result, | 74 verify_result, test_callback.callback(), request, net::BoundNetLog()); |
75 test_callback.callback(), request_handle, | |
76 net::BoundNetLog()); | |
77 } | 75 } |
78 | 76 |
79 bool SupportsAdditionalTrustAnchors() { | 77 bool SupportsAdditionalTrustAnchors() { |
80 scoped_refptr<net::CertVerifyProc> proc = | 78 scoped_refptr<net::CertVerifyProc> proc = |
81 net::CertVerifyProc::CreateDefault(); | 79 net::CertVerifyProc::CreateDefault(); |
82 return proc->SupportsAdditionalTrustAnchors(); | 80 return proc->SupportsAdditionalTrustAnchors(); |
83 } | 81 } |
84 | 82 |
85 // Returns whether |cert_verifier| signalled usage of one of the additional | 83 // Returns whether |cert_verifier| signalled usage of one of the additional |
86 // trust anchors (i.e. of |test_ca_cert_|) for the first time or since the | 84 // trust anchors (i.e. of |test_ca_cert_|) for the first time or since the |
(...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
120 bool trust_anchor_used_; | 118 bool trust_anchor_used_; |
121 crypto::ScopedTestNSSChromeOSUser test_nss_user_; | 119 crypto::ScopedTestNSSChromeOSUser test_nss_user_; |
122 content::TestBrowserThreadBundle thread_bundle_; | 120 content::TestBrowserThreadBundle thread_bundle_; |
123 }; | 121 }; |
124 | 122 |
125 TEST_F(PolicyCertVerifierTest, VerifyUntrustedCert) { | 123 TEST_F(PolicyCertVerifierTest, VerifyUntrustedCert) { |
126 // |test_server_cert_| is untrusted, so Verify() fails. | 124 // |test_server_cert_| is untrusted, so Verify() fails. |
127 { | 125 { |
128 net::CertVerifyResult verify_result; | 126 net::CertVerifyResult verify_result; |
129 net::TestCompletionCallback callback; | 127 net::TestCompletionCallback callback; |
130 scoped_ptr<net::CertVerifier::Request> request_handle; | 128 scoped_ptr<net::CertVerifier::Request> request; |
131 int error = VerifyTestServerCert(callback, &verify_result, &request_handle); | 129 int error = VerifyTestServerCert(callback, &verify_result, &request); |
132 ASSERT_EQ(net::ERR_IO_PENDING, error); | 130 ASSERT_EQ(net::ERR_IO_PENDING, error); |
133 EXPECT_TRUE(request_handle); | 131 EXPECT_TRUE(request); |
134 error = callback.WaitForResult(); | 132 error = callback.WaitForResult(); |
135 EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error); | 133 EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error); |
136 } | 134 } |
137 | 135 |
138 // Issuing the same request again hits the cache. This tests the synchronous | 136 // Issuing the same request again hits the cache. This tests the synchronous |
139 // path. | 137 // path. |
140 { | 138 { |
141 net::CertVerifyResult verify_result; | 139 net::CertVerifyResult verify_result; |
142 net::TestCompletionCallback callback; | 140 net::TestCompletionCallback callback; |
143 scoped_ptr<net::CertVerifier::Request> request_handle; | 141 scoped_ptr<net::CertVerifier::Request> request; |
144 int error = VerifyTestServerCert(callback, &verify_result, &request_handle); | 142 int error = VerifyTestServerCert(callback, &verify_result, &request); |
145 EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error); | 143 EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error); |
146 } | 144 } |
147 | 145 |
148 EXPECT_FALSE(WasTrustAnchorUsedAndReset()); | 146 EXPECT_FALSE(WasTrustAnchorUsedAndReset()); |
149 } | 147 } |
150 | 148 |
151 TEST_F(PolicyCertVerifierTest, VerifyTrustedCert) { | 149 TEST_F(PolicyCertVerifierTest, VerifyTrustedCert) { |
152 // Make the database trust |test_ca_cert_|. | 150 // Make the database trust |test_ca_cert_|. |
153 net::NSSCertDatabase::ImportCertFailureList failure_list; | 151 net::NSSCertDatabase::ImportCertFailureList failure_list; |
154 ASSERT_TRUE(test_cert_db_->ImportCACerts( | 152 ASSERT_TRUE(test_cert_db_->ImportCACerts( |
155 test_ca_cert_list_, net::NSSCertDatabase::TRUSTED_SSL, &failure_list)); | 153 test_ca_cert_list_, net::NSSCertDatabase::TRUSTED_SSL, &failure_list)); |
156 ASSERT_TRUE(failure_list.empty()); | 154 ASSERT_TRUE(failure_list.empty()); |
157 | 155 |
158 // Verify that it is now trusted. | 156 // Verify that it is now trusted. |
159 net::NSSCertDatabase::TrustBits trust = | 157 net::NSSCertDatabase::TrustBits trust = |
160 test_cert_db_->GetCertTrust(test_ca_cert_.get(), net::CA_CERT); | 158 test_cert_db_->GetCertTrust(test_ca_cert_.get(), net::CA_CERT); |
161 EXPECT_EQ(net::NSSCertDatabase::TRUSTED_SSL, trust); | 159 EXPECT_EQ(net::NSSCertDatabase::TRUSTED_SSL, trust); |
162 | 160 |
163 // Verify() successfully verifies |test_server_cert_| after it was imported. | 161 // Verify() successfully verifies |test_server_cert_| after it was imported. |
164 net::CertVerifyResult verify_result; | 162 net::CertVerifyResult verify_result; |
165 net::TestCompletionCallback callback; | 163 net::TestCompletionCallback callback; |
166 scoped_ptr<net::CertVerifier::Request> request_handle; | 164 scoped_ptr<net::CertVerifier::Request> request; |
167 int error = VerifyTestServerCert(callback, &verify_result, &request_handle); | 165 int error = VerifyTestServerCert(callback, &verify_result, &request); |
168 ASSERT_EQ(net::ERR_IO_PENDING, error); | 166 ASSERT_EQ(net::ERR_IO_PENDING, error); |
169 EXPECT_TRUE(request_handle); | 167 EXPECT_TRUE(request); |
170 error = callback.WaitForResult(); | 168 error = callback.WaitForResult(); |
171 EXPECT_EQ(net::OK, error); | 169 EXPECT_EQ(net::OK, error); |
172 | 170 |
173 // The additional trust anchors were not used, since the certificate is | 171 // The additional trust anchors were not used, since the certificate is |
174 // trusted from the database. | 172 // trusted from the database. |
175 EXPECT_FALSE(WasTrustAnchorUsedAndReset()); | 173 EXPECT_FALSE(WasTrustAnchorUsedAndReset()); |
176 } | 174 } |
177 | 175 |
178 TEST_F(PolicyCertVerifierTest, VerifyUsingAdditionalTrustAnchor) { | 176 TEST_F(PolicyCertVerifierTest, VerifyUsingAdditionalTrustAnchor) { |
179 ASSERT_TRUE(SupportsAdditionalTrustAnchors()); | 177 ASSERT_TRUE(SupportsAdditionalTrustAnchors()); |
180 | 178 |
181 // |test_server_cert_| is untrusted, so Verify() fails. | 179 // |test_server_cert_| is untrusted, so Verify() fails. |
182 { | 180 { |
183 net::CertVerifyResult verify_result; | 181 net::CertVerifyResult verify_result; |
184 net::TestCompletionCallback callback; | 182 net::TestCompletionCallback callback; |
185 scoped_ptr<net::CertVerifier::Request> request_handle; | 183 scoped_ptr<net::CertVerifier::Request> request; |
186 int error = VerifyTestServerCert(callback, &verify_result, &request_handle); | 184 int error = VerifyTestServerCert(callback, &verify_result, &request); |
187 ASSERT_EQ(net::ERR_IO_PENDING, error); | 185 ASSERT_EQ(net::ERR_IO_PENDING, error); |
188 EXPECT_TRUE(request_handle); | 186 EXPECT_TRUE(request); |
189 error = callback.WaitForResult(); | 187 error = callback.WaitForResult(); |
190 EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error); | 188 EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error); |
191 } | 189 } |
192 EXPECT_FALSE(WasTrustAnchorUsedAndReset()); | 190 EXPECT_FALSE(WasTrustAnchorUsedAndReset()); |
193 | 191 |
194 // Verify() again with the additional trust anchors. | 192 // Verify() again with the additional trust anchors. |
195 cert_verifier_->SetTrustAnchors(test_ca_cert_list_); | 193 cert_verifier_->SetTrustAnchors(test_ca_cert_list_); |
196 { | 194 { |
197 net::CertVerifyResult verify_result; | 195 net::CertVerifyResult verify_result; |
198 net::TestCompletionCallback callback; | 196 net::TestCompletionCallback callback; |
199 scoped_ptr<net::CertVerifier::Request> request_handle; | 197 scoped_ptr<net::CertVerifier::Request> request; |
200 int error = VerifyTestServerCert(callback, &verify_result, &request_handle); | 198 int error = VerifyTestServerCert(callback, &verify_result, &request); |
201 ASSERT_EQ(net::ERR_IO_PENDING, error); | 199 ASSERT_EQ(net::ERR_IO_PENDING, error); |
202 EXPECT_TRUE(request_handle); | 200 EXPECT_TRUE(request); |
203 error = callback.WaitForResult(); | 201 error = callback.WaitForResult(); |
204 EXPECT_EQ(net::OK, error); | 202 EXPECT_EQ(net::OK, error); |
205 } | 203 } |
206 EXPECT_TRUE(WasTrustAnchorUsedAndReset()); | 204 EXPECT_TRUE(WasTrustAnchorUsedAndReset()); |
207 | 205 |
208 // Verify() again with the additional trust anchors will hit the cache. | 206 // Verify() again with the additional trust anchors will hit the cache. |
209 cert_verifier_->SetTrustAnchors(test_ca_cert_list_); | 207 cert_verifier_->SetTrustAnchors(test_ca_cert_list_); |
210 { | 208 { |
211 net::CertVerifyResult verify_result; | 209 net::CertVerifyResult verify_result; |
212 net::TestCompletionCallback callback; | 210 net::TestCompletionCallback callback; |
213 scoped_ptr<net::CertVerifier::Request> request_handle; | 211 scoped_ptr<net::CertVerifier::Request> request; |
214 int error = VerifyTestServerCert(callback, &verify_result, &request_handle); | 212 int error = VerifyTestServerCert(callback, &verify_result, &request); |
215 EXPECT_EQ(net::OK, error); | 213 EXPECT_EQ(net::OK, error); |
216 } | 214 } |
217 EXPECT_TRUE(WasTrustAnchorUsedAndReset()); | 215 EXPECT_TRUE(WasTrustAnchorUsedAndReset()); |
218 | 216 |
219 // Verifying after removing the trust anchors should now fail. | 217 // Verifying after removing the trust anchors should now fail. |
220 cert_verifier_->SetTrustAnchors(net::CertificateList()); | 218 cert_verifier_->SetTrustAnchors(net::CertificateList()); |
221 { | 219 { |
222 net::CertVerifyResult verify_result; | 220 net::CertVerifyResult verify_result; |
223 net::TestCompletionCallback callback; | 221 net::TestCompletionCallback callback; |
224 scoped_ptr<net::CertVerifier::Request> request_handle; | 222 scoped_ptr<net::CertVerifier::Request> request; |
225 int error = VerifyTestServerCert(callback, &verify_result, &request_handle); | 223 int error = VerifyTestServerCert(callback, &verify_result, &request); |
226 // Note: this hits the cached result from the first Verify() in this test. | 224 // Note: this hits the cached result from the first Verify() in this test. |
227 EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error); | 225 EXPECT_EQ(net::ERR_CERT_AUTHORITY_INVALID, error); |
228 } | 226 } |
229 // The additional trust anchors were reset, thus |cert_verifier_| should not | 227 // The additional trust anchors were reset, thus |cert_verifier_| should not |
230 // signal it's usage anymore. | 228 // signal it's usage anymore. |
231 EXPECT_FALSE(WasTrustAnchorUsedAndReset()); | 229 EXPECT_FALSE(WasTrustAnchorUsedAndReset()); |
232 } | 230 } |
233 | 231 |
234 } // namespace policy | 232 } // namespace policy |
OLD | NEW |