| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/x509_certificate.h" | 5 #include "net/cert/x509_certificate.h" |
| 6 | 6 |
| 7 #include "base/basictypes.h" | 7 #include <stdint.h> |
| 8 |
| 8 #include "base/files/file_path.h" | 9 #include "base/files/file_path.h" |
| 9 #include "base/memory/scoped_ptr.h" | 10 #include "base/memory/scoped_ptr.h" |
| 10 #include "base/pickle.h" | 11 #include "base/pickle.h" |
| 11 #include "base/sha1.h" | 12 #include "base/sha1.h" |
| 12 #include "base/strings/string_number_conversions.h" | 13 #include "base/strings/string_number_conversions.h" |
| 13 #include "base/strings/string_split.h" | 14 #include "base/strings/string_split.h" |
| 14 #include "base/strings/string_util.h" | 15 #include "base/strings/string_util.h" |
| 15 #include "crypto/rsa_private_key.h" | 16 #include "crypto/rsa_private_key.h" |
| 16 #include "net/base/net_errors.h" | 17 #include "net/base/net_errors.h" |
| 17 #include "net/base/test_data_directory.h" | 18 #include "net/base/test_data_directory.h" |
| (...skipping 22 matching lines...) Expand all Loading... |
| 40 // | 41 // |
| 41 // For fingerprint | 42 // For fingerprint |
| 42 // $ openssl x509 -inform DER -fingerprint -noout < /tmp/host.der | 43 // $ openssl x509 -inform DER -fingerprint -noout < /tmp/host.der |
| 43 | 44 |
| 44 // For valid_start, valid_expiry | 45 // For valid_start, valid_expiry |
| 45 // $ openssl x509 -inform DER -text -noout < /tmp/host.der | | 46 // $ openssl x509 -inform DER -text -noout < /tmp/host.der | |
| 46 // grep -A 2 Validity | 47 // grep -A 2 Validity |
| 47 // $ date +%s -d '<date str>' | 48 // $ date +%s -d '<date str>' |
| 48 | 49 |
| 49 // Google's cert. | 50 // Google's cert. |
| 50 uint8 google_fingerprint[] = { | 51 uint8_t google_fingerprint[] = { |
| 51 0xab, 0xbe, 0x5e, 0xb4, 0x93, 0x88, 0x4e, 0xe4, 0x60, 0xc6, 0xef, 0xf8, | 52 0xab, 0xbe, 0x5e, 0xb4, 0x93, 0x88, 0x4e, 0xe4, 0x60, 0xc6, 0xef, 0xf8, |
| 52 0xea, 0xd4, 0xb1, 0x55, 0x4b, 0xc9, 0x59, 0x3c | 53 0xea, 0xd4, 0xb1, 0x55, 0x4b, 0xc9, 0x59, 0x3c |
| 53 }; | 54 }; |
| 54 | 55 |
| 55 // webkit.org's cert. | 56 // webkit.org's cert. |
| 56 uint8 webkit_fingerprint[] = { | 57 uint8_t webkit_fingerprint[] = { |
| 57 0xa1, 0x4a, 0x94, 0x46, 0x22, 0x8e, 0x70, 0x66, 0x2b, 0x94, 0xf9, 0xf8, | 58 0xa1, 0x4a, 0x94, 0x46, 0x22, 0x8e, 0x70, 0x66, 0x2b, 0x94, 0xf9, 0xf8, |
| 58 0x57, 0x83, 0x2d, 0xa2, 0xff, 0xbc, 0x84, 0xc2 | 59 0x57, 0x83, 0x2d, 0xa2, 0xff, 0xbc, 0x84, 0xc2 |
| 59 }; | 60 }; |
| 60 | 61 |
| 61 // thawte.com's cert (it's EV-licious!). | 62 // thawte.com's cert (it's EV-licious!). |
| 62 uint8 thawte_fingerprint[] = { | 63 uint8_t thawte_fingerprint[] = { |
| 63 0x85, 0x04, 0x2d, 0xfd, 0x2b, 0x0e, 0xc6, 0xc8, 0xaf, 0x2d, 0x77, 0xd6, | 64 0x85, 0x04, 0x2d, 0xfd, 0x2b, 0x0e, 0xc6, 0xc8, 0xaf, 0x2d, 0x77, 0xd6, |
| 64 0xa1, 0x3a, 0x64, 0x04, 0x27, 0x90, 0x97, 0x37 | 65 0xa1, 0x3a, 0x64, 0x04, 0x27, 0x90, 0x97, 0x37 |
| 65 }; | 66 }; |
| 66 | 67 |
| 67 // A certificate for https://www.unosoft.hu/, whose AIA extension contains | 68 // A certificate for https://www.unosoft.hu/, whose AIA extension contains |
| 68 // an LDAP URL without a host name. | 69 // an LDAP URL without a host name. |
| 69 uint8 unosoft_hu_fingerprint[] = { | 70 uint8_t unosoft_hu_fingerprint[] = { |
| 70 0x32, 0xff, 0xe3, 0xbe, 0x2c, 0x3b, 0xc7, 0xca, 0xbf, 0x2d, 0x64, 0xbd, | 71 0x32, 0xff, 0xe3, 0xbe, 0x2c, 0x3b, 0xc7, 0xca, 0xbf, 0x2d, 0x64, 0xbd, |
| 71 0x25, 0x66, 0xf2, 0xec, 0x8b, 0x0f, 0xbf, 0xd8 | 72 0x25, 0x66, 0xf2, 0xec, 0x8b, 0x0f, 0xbf, 0xd8 |
| 72 }; | 73 }; |
| 73 | 74 |
| 74 // The fingerprint of the Google certificate used in the parsing tests, | 75 // The fingerprint of the Google certificate used in the parsing tests, |
| 75 // which is newer than the one included in the x509_certificate_data.h | 76 // which is newer than the one included in the x509_certificate_data.h |
| 76 uint8 google_parse_fingerprint[] = { | 77 uint8_t google_parse_fingerprint[] = { |
| 77 0x40, 0x50, 0x62, 0xe5, 0xbe, 0xfd, 0xe4, 0xaf, 0x97, 0xe9, 0x38, 0x2a, | 78 0x40, 0x50, 0x62, 0xe5, 0xbe, 0xfd, 0xe4, 0xaf, 0x97, 0xe9, 0x38, 0x2a, |
| 78 0xf1, 0x6c, 0xc8, 0x7c, 0x8f, 0xb7, 0xc4, 0xe2 | 79 0xf1, 0x6c, 0xc8, 0x7c, 0x8f, 0xb7, 0xc4, 0xe2 |
| 79 }; | 80 }; |
| 80 | 81 |
| 81 // The fingerprint for the Thawte SGC certificate | 82 // The fingerprint for the Thawte SGC certificate |
| 82 uint8 thawte_parse_fingerprint[] = { | 83 uint8_t thawte_parse_fingerprint[] = { |
| 83 0xec, 0x07, 0x10, 0x03, 0xd8, 0xf5, 0xa3, 0x7f, 0x42, 0xc4, 0x55, 0x7f, | 84 0xec, 0x07, 0x10, 0x03, 0xd8, 0xf5, 0xa3, 0x7f, 0x42, 0xc4, 0x55, 0x7f, |
| 84 0x65, 0x6a, 0xae, 0x86, 0x65, 0xfa, 0x4b, 0x02 | 85 0x65, 0x6a, 0xae, 0x86, 0x65, 0xfa, 0x4b, 0x02 |
| 85 }; | 86 }; |
| 86 | 87 |
| 87 // Dec 18 00:00:00 2009 GMT | 88 // Dec 18 00:00:00 2009 GMT |
| 88 const double kGoogleParseValidFrom = 1261094400; | 89 const double kGoogleParseValidFrom = 1261094400; |
| 89 // Dec 18 23:59:59 2011 GMT | 90 // Dec 18 23:59:59 2011 GMT |
| 90 const double kGoogleParseValidTo = 1324252799; | 91 const double kGoogleParseValidTo = 1324252799; |
| 91 | 92 |
| 92 void CheckGoogleCert(const scoped_refptr<X509Certificate>& google_cert, | 93 void CheckGoogleCert(const scoped_refptr<X509Certificate>& google_cert, |
| 93 uint8* expected_fingerprint, | 94 uint8_t* expected_fingerprint, |
| 94 double valid_from, double valid_to) { | 95 double valid_from, double valid_to) { |
| 95 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_cert.get()); | 96 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_cert.get()); |
| 96 | 97 |
| 97 const CertPrincipal& subject = google_cert->subject(); | 98 const CertPrincipal& subject = google_cert->subject(); |
| 98 EXPECT_EQ("www.google.com", subject.common_name); | 99 EXPECT_EQ("www.google.com", subject.common_name); |
| 99 EXPECT_EQ("Mountain View", subject.locality_name); | 100 EXPECT_EQ("Mountain View", subject.locality_name); |
| 100 EXPECT_EQ("California", subject.state_or_province_name); | 101 EXPECT_EQ("California", subject.state_or_province_name); |
| 101 EXPECT_EQ("US", subject.country_name); | 102 EXPECT_EQ("US", subject.country_name); |
| 102 EXPECT_EQ(0U, subject.street_addresses.size()); | 103 EXPECT_EQ(0U, subject.street_addresses.size()); |
| 103 ASSERT_EQ(1U, subject.organization_names.size()); | 104 ASSERT_EQ(1U, subject.organization_names.size()); |
| (...skipping 190 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 294 EXPECT_EQ("net_unittests", subject.organization_unit_names[0]); | 295 EXPECT_EQ("net_unittests", subject.organization_unit_names[0]); |
| 295 EXPECT_EQ("Chromium", subject.organization_unit_names[1]); | 296 EXPECT_EQ("Chromium", subject.organization_unit_names[1]); |
| 296 EXPECT_EQ(0U, subject.domain_components.size()); | 297 EXPECT_EQ(0U, subject.domain_components.size()); |
| 297 } | 298 } |
| 298 | 299 |
| 299 TEST(X509CertificateTest, SerialNumbers) { | 300 TEST(X509CertificateTest, SerialNumbers) { |
| 300 scoped_refptr<X509Certificate> google_cert( | 301 scoped_refptr<X509Certificate> google_cert( |
| 301 X509Certificate::CreateFromBytes( | 302 X509Certificate::CreateFromBytes( |
| 302 reinterpret_cast<const char*>(google_der), sizeof(google_der))); | 303 reinterpret_cast<const char*>(google_der), sizeof(google_der))); |
| 303 | 304 |
| 304 static const uint8 google_serial[16] = { | 305 static const uint8_t google_serial[16] = { |
| 305 0x01,0x2a,0x39,0x76,0x0d,0x3f,0x4f,0xc9, | 306 0x01,0x2a,0x39,0x76,0x0d,0x3f,0x4f,0xc9, |
| 306 0x0b,0xe7,0xbd,0x2b,0xcf,0x95,0x2e,0x7a, | 307 0x0b,0xe7,0xbd,0x2b,0xcf,0x95,0x2e,0x7a, |
| 307 }; | 308 }; |
| 308 | 309 |
| 309 ASSERT_EQ(sizeof(google_serial), google_cert->serial_number().size()); | 310 ASSERT_EQ(sizeof(google_serial), google_cert->serial_number().size()); |
| 310 EXPECT_TRUE(memcmp(google_cert->serial_number().data(), google_serial, | 311 EXPECT_TRUE(memcmp(google_cert->serial_number().data(), google_serial, |
| 311 sizeof(google_serial)) == 0); | 312 sizeof(google_serial)) == 0); |
| 312 | 313 |
| 313 // We also want to check a serial number where the first byte is >= 0x80 in | 314 // We also want to check a serial number where the first byte is >= 0x80 in |
| 314 // case the underlying library tries to pad it. | 315 // case the underlying library tries to pad it. |
| 315 scoped_refptr<X509Certificate> paypal_null_cert( | 316 scoped_refptr<X509Certificate> paypal_null_cert( |
| 316 X509Certificate::CreateFromBytes( | 317 X509Certificate::CreateFromBytes( |
| 317 reinterpret_cast<const char*>(paypal_null_der), | 318 reinterpret_cast<const char*>(paypal_null_der), |
| 318 sizeof(paypal_null_der))); | 319 sizeof(paypal_null_der))); |
| 319 | 320 |
| 320 static const uint8 paypal_null_serial[3] = {0x00, 0xf0, 0x9b}; | 321 static const uint8_t paypal_null_serial[3] = {0x00, 0xf0, 0x9b}; |
| 321 ASSERT_EQ(sizeof(paypal_null_serial), | 322 ASSERT_EQ(sizeof(paypal_null_serial), |
| 322 paypal_null_cert->serial_number().size()); | 323 paypal_null_cert->serial_number().size()); |
| 323 EXPECT_TRUE(memcmp(paypal_null_cert->serial_number().data(), | 324 EXPECT_TRUE(memcmp(paypal_null_cert->serial_number().data(), |
| 324 paypal_null_serial, sizeof(paypal_null_serial)) == 0); | 325 paypal_null_serial, sizeof(paypal_null_serial)) == 0); |
| 325 } | 326 } |
| 326 | 327 |
| 327 TEST(X509CertificateTest, SHA256FingerprintsCorrectly) { | 328 TEST(X509CertificateTest, SHA256FingerprintsCorrectly) { |
| 328 scoped_refptr<X509Certificate> google_cert(X509Certificate::CreateFromBytes( | 329 scoped_refptr<X509Certificate> google_cert(X509Certificate::CreateFromBytes( |
| 329 reinterpret_cast<const char*>(google_der), sizeof(google_der))); | 330 reinterpret_cast<const char*>(google_der), sizeof(google_der))); |
| 330 | 331 |
| 331 static const uint8 google_sha256_fingerprint[32] = { | 332 static const uint8_t google_sha256_fingerprint[32] = { |
| 332 0x21, 0xaf, 0x58, 0x74, 0xea, 0x6b, 0xad, 0xbd, 0xe4, 0xb3, 0xb1, | 333 0x21, 0xaf, 0x58, 0x74, 0xea, 0x6b, 0xad, 0xbd, 0xe4, 0xb3, 0xb1, |
| 333 0xaa, 0x53, 0x32, 0x80, 0x8f, 0xbf, 0x8a, 0x24, 0x7d, 0x98, 0xec, | 334 0xaa, 0x53, 0x32, 0x80, 0x8f, 0xbf, 0x8a, 0x24, 0x7d, 0x98, 0xec, |
| 334 0x7f, 0x77, 0x49, 0x38, 0x42, 0x81, 0x26, 0x7f, 0xed, 0x38}; | 335 0x7f, 0x77, 0x49, 0x38, 0x42, 0x81, 0x26, 0x7f, 0xed, 0x38}; |
| 335 | 336 |
| 336 SHA256HashValue fingerprint = | 337 SHA256HashValue fingerprint = |
| 337 X509Certificate::CalculateFingerprint256(google_cert->os_cert_handle()); | 338 X509Certificate::CalculateFingerprint256(google_cert->os_cert_handle()); |
| 338 | 339 |
| 339 for (size_t i = 0; i < 32; ++i) | 340 for (size_t i = 0; i < 32; ++i) |
| 340 EXPECT_EQ(google_sha256_fingerprint[i], fingerprint.data[i]); | 341 EXPECT_EQ(google_sha256_fingerprint[i], fingerprint.data[i]); |
| 341 } | 342 } |
| (...skipping 24 matching lines...) Expand all Loading... |
| 366 scoped_refptr<X509Certificate> cert_chain2 = | 367 scoped_refptr<X509Certificate> cert_chain2 = |
| 367 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), | 368 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), |
| 368 intermediates); | 369 intermediates); |
| 369 | 370 |
| 370 // No intermediate CA certicates. | 371 // No intermediate CA certicates. |
| 371 intermediates.clear(); | 372 intermediates.clear(); |
| 372 scoped_refptr<X509Certificate> cert_chain3 = | 373 scoped_refptr<X509Certificate> cert_chain3 = |
| 373 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), | 374 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), |
| 374 intermediates); | 375 intermediates); |
| 375 | 376 |
| 376 static const uint8 cert_chain1_ca_fingerprint[20] = { | 377 static const uint8_t cert_chain1_ca_fingerprint[20] = { |
| 377 0xc2, 0xf0, 0x08, 0x7d, 0x01, 0xe6, 0x86, 0x05, 0x3a, 0x4d, | 378 0xc2, 0xf0, 0x08, 0x7d, 0x01, 0xe6, 0x86, 0x05, 0x3a, 0x4d, |
| 378 0x63, 0x3e, 0x7e, 0x70, 0xd4, 0xef, 0x65, 0xc2, 0xcc, 0x4f | 379 0x63, 0x3e, 0x7e, 0x70, 0xd4, 0xef, 0x65, 0xc2, 0xcc, 0x4f |
| 379 }; | 380 }; |
| 380 static const uint8 cert_chain2_ca_fingerprint[20] = { | 381 static const uint8_t cert_chain2_ca_fingerprint[20] = { |
| 381 0xd5, 0x59, 0xa5, 0x86, 0x66, 0x9b, 0x08, 0xf4, 0x6a, 0x30, | 382 0xd5, 0x59, 0xa5, 0x86, 0x66, 0x9b, 0x08, 0xf4, 0x6a, 0x30, |
| 382 0xa1, 0x33, 0xf8, 0xa9, 0xed, 0x3d, 0x03, 0x8e, 0x2e, 0xa8 | 383 0xa1, 0x33, 0xf8, 0xa9, 0xed, 0x3d, 0x03, 0x8e, 0x2e, 0xa8 |
| 383 }; | 384 }; |
| 384 // The SHA-1 hash of nothing. | 385 // The SHA-1 hash of nothing. |
| 385 static const uint8 cert_chain3_ca_fingerprint[20] = { | 386 static const uint8_t cert_chain3_ca_fingerprint[20] = { |
| 386 0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b, 0x0d, 0x32, 0x55, | 387 0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b, 0x0d, 0x32, 0x55, |
| 387 0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07, 0x09 | 388 0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07, 0x09 |
| 388 }; | 389 }; |
| 389 EXPECT_TRUE(memcmp(cert_chain1->ca_fingerprint().data, | 390 EXPECT_TRUE(memcmp(cert_chain1->ca_fingerprint().data, |
| 390 cert_chain1_ca_fingerprint, 20) == 0); | 391 cert_chain1_ca_fingerprint, 20) == 0); |
| 391 EXPECT_TRUE(memcmp(cert_chain2->ca_fingerprint().data, | 392 EXPECT_TRUE(memcmp(cert_chain2->ca_fingerprint().data, |
| 392 cert_chain2_ca_fingerprint, 20) == 0); | 393 cert_chain2_ca_fingerprint, 20) == 0); |
| 393 EXPECT_TRUE(memcmp(cert_chain3->ca_fingerprint().data, | 394 EXPECT_TRUE(memcmp(cert_chain3->ca_fingerprint().data, |
| 394 cert_chain3_ca_fingerprint, 20) == 0); | 395 cert_chain3_ca_fingerprint, 20) == 0); |
| 395 | 396 |
| 396 // Test the SHA-256 hash calculation functions explicitly since they are not | 397 // Test the SHA-256 hash calculation functions explicitly since they are not |
| 397 // used by X509Certificate internally. | 398 // used by X509Certificate internally. |
| 398 static const uint8 cert_chain1_ca_fingerprint_256[32] = { | 399 static const uint8_t cert_chain1_ca_fingerprint_256[32] = { |
| 399 0x51, 0x15, 0x30, 0x49, 0x97, 0x54, 0xf8, 0xb4, 0x17, 0x41, | 400 0x51, 0x15, 0x30, 0x49, 0x97, 0x54, 0xf8, 0xb4, 0x17, 0x41, |
| 400 0x6b, 0x58, 0x78, 0xb0, 0x89, 0xd2, 0xc3, 0xae, 0x66, 0xc1, | 401 0x6b, 0x58, 0x78, 0xb0, 0x89, 0xd2, 0xc3, 0xae, 0x66, 0xc1, |
| 401 0x16, 0x80, 0xa0, 0x78, 0xe7, 0x53, 0x45, 0xa2, 0xfb, 0x80, | 402 0x16, 0x80, 0xa0, 0x78, 0xe7, 0x53, 0x45, 0xa2, 0xfb, 0x80, |
| 402 0xe1, 0x07 | 403 0xe1, 0x07 |
| 403 }; | 404 }; |
| 404 static const uint8 cert_chain2_ca_fingerprint_256[32] = { | 405 static const uint8_t cert_chain2_ca_fingerprint_256[32] = { |
| 405 0x00, 0xbd, 0x2b, 0x0e, 0xdd, 0x83, 0x40, 0xb1, 0x74, 0x6c, | 406 0x00, 0xbd, 0x2b, 0x0e, 0xdd, 0x83, 0x40, 0xb1, 0x74, 0x6c, |
| 406 0xc3, 0x95, 0xc0, 0xe3, 0x55, 0xb2, 0x16, 0x58, 0x53, 0xfd, | 407 0xc3, 0x95, 0xc0, 0xe3, 0x55, 0xb2, 0x16, 0x58, 0x53, 0xfd, |
| 407 0xb9, 0x3c, 0x52, 0xda, 0xdd, 0xa8, 0x22, 0x8b, 0x07, 0x00, | 408 0xb9, 0x3c, 0x52, 0xda, 0xdd, 0xa8, 0x22, 0x8b, 0x07, 0x00, |
| 408 0x2d, 0xce | 409 0x2d, 0xce |
| 409 }; | 410 }; |
| 410 // The SHA-256 hash of nothing. | 411 // The SHA-256 hash of nothing. |
| 411 static const uint8 cert_chain3_ca_fingerprint_256[32] = { | 412 static const uint8_t cert_chain3_ca_fingerprint_256[32] = { |
| 412 0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, | 413 0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, |
| 413 0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, | 414 0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, |
| 414 0x64, 0x9b, 0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, | 415 0x64, 0x9b, 0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, |
| 415 0xb8, 0x55 | 416 0xb8, 0x55 |
| 416 }; | 417 }; |
| 417 SHA256HashValue ca_fingerprint_256_1 = | 418 SHA256HashValue ca_fingerprint_256_1 = |
| 418 X509Certificate::CalculateCAFingerprint256( | 419 X509Certificate::CalculateCAFingerprint256( |
| 419 cert_chain1->GetIntermediateCertificates()); | 420 cert_chain1->GetIntermediateCertificates()); |
| 420 SHA256HashValue ca_fingerprint_256_2 = | 421 SHA256HashValue ca_fingerprint_256_2 = |
| 421 X509Certificate::CalculateCAFingerprint256( | 422 X509Certificate::CalculateCAFingerprint256( |
| 422 cert_chain2->GetIntermediateCertificates()); | 423 cert_chain2->GetIntermediateCertificates()); |
| 423 SHA256HashValue ca_fingerprint_256_3 = | 424 SHA256HashValue ca_fingerprint_256_3 = |
| 424 X509Certificate::CalculateCAFingerprint256( | 425 X509Certificate::CalculateCAFingerprint256( |
| 425 cert_chain3->GetIntermediateCertificates()); | 426 cert_chain3->GetIntermediateCertificates()); |
| 426 EXPECT_TRUE(memcmp(ca_fingerprint_256_1.data, | 427 EXPECT_TRUE(memcmp(ca_fingerprint_256_1.data, |
| 427 cert_chain1_ca_fingerprint_256, 32) == 0); | 428 cert_chain1_ca_fingerprint_256, 32) == 0); |
| 428 EXPECT_TRUE(memcmp(ca_fingerprint_256_2.data, | 429 EXPECT_TRUE(memcmp(ca_fingerprint_256_2.data, |
| 429 cert_chain2_ca_fingerprint_256, 32) == 0); | 430 cert_chain2_ca_fingerprint_256, 32) == 0); |
| 430 EXPECT_TRUE(memcmp(ca_fingerprint_256_3.data, | 431 EXPECT_TRUE(memcmp(ca_fingerprint_256_3.data, |
| 431 cert_chain3_ca_fingerprint_256, 32) == 0); | 432 cert_chain3_ca_fingerprint_256, 32) == 0); |
| 432 | 433 |
| 433 static const uint8 cert_chain1_chain_fingerprint_256[32] = { | 434 static const uint8_t cert_chain1_chain_fingerprint_256[32] = { |
| 434 0xac, 0xff, 0xcc, 0x63, 0x0d, 0xd0, 0xa7, 0x19, 0x78, 0xb5, | 435 0xac, 0xff, 0xcc, 0x63, 0x0d, 0xd0, 0xa7, 0x19, 0x78, 0xb5, |
| 435 0x8a, 0x47, 0x8b, 0x67, 0x97, 0xcb, 0x8d, 0xe1, 0x6a, 0x8a, | 436 0x8a, 0x47, 0x8b, 0x67, 0x97, 0xcb, 0x8d, 0xe1, 0x6a, 0x8a, |
| 436 0x57, 0x70, 0xda, 0x9a, 0x53, 0x72, 0xe2, 0xa0, 0x08, 0xab, | 437 0x57, 0x70, 0xda, 0x9a, 0x53, 0x72, 0xe2, 0xa0, 0x08, 0xab, |
| 437 0xcc, 0x8f | 438 0xcc, 0x8f |
| 438 }; | 439 }; |
| 439 static const uint8 cert_chain2_chain_fingerprint_256[32] = { | 440 static const uint8_t cert_chain2_chain_fingerprint_256[32] = { |
| 440 0x67, 0x3a, 0x11, 0x20, 0xd6, 0x94, 0x14, 0xe4, 0x16, 0x9f, | 441 0x67, 0x3a, 0x11, 0x20, 0xd6, 0x94, 0x14, 0xe4, 0x16, 0x9f, |
| 441 0x58, 0xe2, 0x8b, 0xf7, 0x27, 0xed, 0xbb, 0xe8, 0xa7, 0xff, | 442 0x58, 0xe2, 0x8b, 0xf7, 0x27, 0xed, 0xbb, 0xe8, 0xa7, 0xff, |
| 442 0x1c, 0x8c, 0x0f, 0x21, 0x38, 0x16, 0x7c, 0xad, 0x1f, 0x22, | 443 0x1c, 0x8c, 0x0f, 0x21, 0x38, 0x16, 0x7c, 0xad, 0x1f, 0x22, |
| 443 0x6f, 0x9b | 444 0x6f, 0x9b |
| 444 }; | 445 }; |
| 445 static const uint8 cert_chain3_chain_fingerprint_256[32] = { | 446 static const uint8_t cert_chain3_chain_fingerprint_256[32] = { |
| 446 0x16, 0x7a, 0xbd, 0xb4, 0x57, 0x04, 0x65, 0x3c, 0x3b, 0xef, | 447 0x16, 0x7a, 0xbd, 0xb4, 0x57, 0x04, 0x65, 0x3c, 0x3b, 0xef, |
| 447 0x6e, 0x6a, 0xa6, 0x02, 0x73, 0x30, 0x3e, 0x34, 0x1b, 0x43, | 448 0x6e, 0x6a, 0xa6, 0x02, 0x73, 0x30, 0x3e, 0x34, 0x1b, 0x43, |
| 448 0xc2, 0x7c, 0x98, 0x52, 0x9f, 0x34, 0x7f, 0x55, 0x97, 0xe9, | 449 0xc2, 0x7c, 0x98, 0x52, 0x9f, 0x34, 0x7f, 0x55, 0x97, 0xe9, |
| 449 0x1a, 0x10 | 450 0x1a, 0x10 |
| 450 }; | 451 }; |
| 451 SHA256HashValue chain_fingerprint_256_1 = | 452 SHA256HashValue chain_fingerprint_256_1 = |
| 452 X509Certificate::CalculateChainFingerprint256( | 453 X509Certificate::CalculateChainFingerprint256( |
| 453 cert_chain1->os_cert_handle(), | 454 cert_chain1->os_cert_handle(), |
| 454 cert_chain1->GetIntermediateCertificates()); | 455 cert_chain1->GetIntermediateCertificates()); |
| 455 SHA256HashValue chain_fingerprint_256_2 = | 456 SHA256HashValue chain_fingerprint_256_2 = |
| (...skipping 23 matching lines...) Expand all Loading... |
| 479 std::vector<std::string> ip_addresses; | 480 std::vector<std::string> ip_addresses; |
| 480 san_cert->GetSubjectAltName(&dns_names, &ip_addresses); | 481 san_cert->GetSubjectAltName(&dns_names, &ip_addresses); |
| 481 | 482 |
| 482 // Ensure that DNS names are correctly parsed. | 483 // Ensure that DNS names are correctly parsed. |
| 483 ASSERT_EQ(1U, dns_names.size()); | 484 ASSERT_EQ(1U, dns_names.size()); |
| 484 EXPECT_EQ("test.example", dns_names[0]); | 485 EXPECT_EQ("test.example", dns_names[0]); |
| 485 | 486 |
| 486 // Ensure that both IPv4 and IPv6 addresses are correctly parsed. | 487 // Ensure that both IPv4 and IPv6 addresses are correctly parsed. |
| 487 ASSERT_EQ(2U, ip_addresses.size()); | 488 ASSERT_EQ(2U, ip_addresses.size()); |
| 488 | 489 |
| 489 static const uint8 kIPv4Address[] = { | 490 static const uint8_t kIPv4Address[] = { |
| 490 0x7F, 0x00, 0x00, 0x02 | 491 0x7F, 0x00, 0x00, 0x02 |
| 491 }; | 492 }; |
| 492 ASSERT_EQ(arraysize(kIPv4Address), ip_addresses[0].size()); | 493 ASSERT_EQ(arraysize(kIPv4Address), ip_addresses[0].size()); |
| 493 EXPECT_EQ(0, memcmp(ip_addresses[0].data(), kIPv4Address, | 494 EXPECT_EQ(0, memcmp(ip_addresses[0].data(), kIPv4Address, |
| 494 arraysize(kIPv4Address))); | 495 arraysize(kIPv4Address))); |
| 495 | 496 |
| 496 static const uint8 kIPv6Address[] = { | 497 static const uint8_t kIPv6Address[] = { |
| 497 0xFE, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, | 498 0xFE, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, |
| 498 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 | 499 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 |
| 499 }; | 500 }; |
| 500 ASSERT_EQ(arraysize(kIPv6Address), ip_addresses[1].size()); | 501 ASSERT_EQ(arraysize(kIPv6Address), ip_addresses[1].size()); |
| 501 EXPECT_EQ(0, memcmp(ip_addresses[1].data(), kIPv6Address, | 502 EXPECT_EQ(0, memcmp(ip_addresses[1].data(), kIPv6Address, |
| 502 arraysize(kIPv6Address))); | 503 arraysize(kIPv6Address))); |
| 503 | 504 |
| 504 // Ensure the subjectAltName dirName has not influenced the handling of | 505 // Ensure the subjectAltName dirName has not influenced the handling of |
| 505 // the subject commonName. | 506 // the subject commonName. |
| 506 EXPECT_EQ("127.0.0.1", san_cert->subject().common_name); | 507 EXPECT_EQ("127.0.0.1", san_cert->subject().common_name); |
| 507 } | 508 } |
| 508 | 509 |
| 509 TEST(X509CertificateTest, ExtractSPKIFromDERCert) { | 510 TEST(X509CertificateTest, ExtractSPKIFromDERCert) { |
| 510 base::FilePath certs_dir = GetTestCertsDirectory(); | 511 base::FilePath certs_dir = GetTestCertsDirectory(); |
| 511 scoped_refptr<X509Certificate> cert = | 512 scoped_refptr<X509Certificate> cert = |
| 512 ImportCertFromFile(certs_dir, "nist.der"); | 513 ImportCertFromFile(certs_dir, "nist.der"); |
| 513 ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get()); | 514 ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get()); |
| 514 | 515 |
| 515 std::string derBytes; | 516 std::string derBytes; |
| 516 EXPECT_TRUE(X509Certificate::GetDEREncoded(cert->os_cert_handle(), | 517 EXPECT_TRUE(X509Certificate::GetDEREncoded(cert->os_cert_handle(), |
| 517 &derBytes)); | 518 &derBytes)); |
| 518 | 519 |
| 519 base::StringPiece spkiBytes; | 520 base::StringPiece spkiBytes; |
| 520 EXPECT_TRUE(asn1::ExtractSPKIFromDERCert(derBytes, &spkiBytes)); | 521 EXPECT_TRUE(asn1::ExtractSPKIFromDERCert(derBytes, &spkiBytes)); |
| 521 | 522 |
| 522 uint8 hash[base::kSHA1Length]; | 523 uint8_t hash[base::kSHA1Length]; |
| 523 base::SHA1HashBytes(reinterpret_cast<const uint8*>(spkiBytes.data()), | 524 base::SHA1HashBytes(reinterpret_cast<const uint8_t*>(spkiBytes.data()), |
| 524 spkiBytes.size(), hash); | 525 spkiBytes.size(), hash); |
| 525 | 526 |
| 526 EXPECT_EQ(0, memcmp(hash, kNistSPKIHash, sizeof(hash))); | 527 EXPECT_EQ(0, memcmp(hash, kNistSPKIHash, sizeof(hash))); |
| 527 } | 528 } |
| 528 | 529 |
| 529 TEST(X509CertificateTest, ExtractCRLURLsFromDERCert) { | 530 TEST(X509CertificateTest, ExtractCRLURLsFromDERCert) { |
| 530 base::FilePath certs_dir = GetTestCertsDirectory(); | 531 base::FilePath certs_dir = GetTestCertsDirectory(); |
| 531 scoped_refptr<X509Certificate> cert = | 532 scoped_refptr<X509Certificate> cert = |
| 532 ImportCertFromFile(certs_dir, "nist.der"); | 533 ImportCertFromFile(certs_dir, "nist.der"); |
| 533 ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get()); | 534 ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get()); |
| (...skipping 272 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 806 | 807 |
| 807 std::string nickname = test_cert->GetDefaultNickname(USER_CERT); | 808 std::string nickname = test_cert->GetDefaultNickname(USER_CERT); |
| 808 EXPECT_EQ("wtc@google.com's COMODO Client Authentication and " | 809 EXPECT_EQ("wtc@google.com's COMODO Client Authentication and " |
| 809 "Secure Email CA ID", nickname); | 810 "Secure Email CA ID", nickname); |
| 810 } | 811 } |
| 811 #endif | 812 #endif |
| 812 | 813 |
| 813 const struct CertificateFormatTestData { | 814 const struct CertificateFormatTestData { |
| 814 const char* file_name; | 815 const char* file_name; |
| 815 X509Certificate::Format format; | 816 X509Certificate::Format format; |
| 816 uint8* chain_fingerprints[3]; | 817 uint8_t* chain_fingerprints[3]; |
| 817 } kFormatTestData[] = { | 818 } kFormatTestData[] = { |
| 818 // DER Parsing - single certificate, DER encoded | 819 // DER Parsing - single certificate, DER encoded |
| 819 { "google.single.der", X509Certificate::FORMAT_SINGLE_CERTIFICATE, | 820 { "google.single.der", X509Certificate::FORMAT_SINGLE_CERTIFICATE, |
| 820 { google_parse_fingerprint, | 821 { google_parse_fingerprint, |
| 821 NULL, } }, | 822 NULL, } }, |
| 822 // DER parsing - single certificate, PEM encoded | 823 // DER parsing - single certificate, PEM encoded |
| 823 { "google.single.pem", X509Certificate::FORMAT_SINGLE_CERTIFICATE, | 824 { "google.single.pem", X509Certificate::FORMAT_SINGLE_CERTIFICATE, |
| 824 { google_parse_fingerprint, | 825 { google_parse_fingerprint, |
| 825 NULL, } }, | 826 NULL, } }, |
| 826 // PEM parsing - single certificate, PEM encoded with a PEB of | 827 // PEM parsing - single certificate, PEM encoded with a PEB of |
| (...skipping 79 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 906 break; | 907 break; |
| 907 } | 908 } |
| 908 | 909 |
| 909 // A cert is expected - make sure that one was parsed. | 910 // A cert is expected - make sure that one was parsed. |
| 910 ASSERT_LT(i, certs.size()); | 911 ASSERT_LT(i, certs.size()); |
| 911 | 912 |
| 912 // Compare the parsed certificate with the expected certificate, by | 913 // Compare the parsed certificate with the expected certificate, by |
| 913 // comparing fingerprints. | 914 // comparing fingerprints. |
| 914 const X509Certificate* cert = certs[i].get(); | 915 const X509Certificate* cert = certs[i].get(); |
| 915 const SHA1HashValue& actual_fingerprint = cert->fingerprint(); | 916 const SHA1HashValue& actual_fingerprint = cert->fingerprint(); |
| 916 uint8* expected_fingerprint = test_data_.chain_fingerprints[i]; | 917 uint8_t* expected_fingerprint = test_data_.chain_fingerprints[i]; |
| 917 | 918 |
| 918 for (size_t j = 0; j < 20; ++j) | 919 for (size_t j = 0; j < 20; ++j) |
| 919 EXPECT_EQ(expected_fingerprint[j], actual_fingerprint.data[j]); | 920 EXPECT_EQ(expected_fingerprint[j], actual_fingerprint.data[j]); |
| 920 } | 921 } |
| 921 } | 922 } |
| 922 | 923 |
| 923 INSTANTIATE_TEST_CASE_P(, X509CertificateParseTest, | 924 INSTANTIATE_TEST_CASE_P(, X509CertificateParseTest, |
| 924 testing::ValuesIn(kFormatTestData)); | 925 testing::ValuesIn(kFormatTestData)); |
| 925 | 926 |
| 926 struct CertificateNameVerifyTestData { | 927 struct CertificateNameVerifyTestData { |
| (...skipping 187 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1114 if (test_data.ip_addrs) { | 1115 if (test_data.ip_addrs) { |
| 1115 // Build up the certificate IP address list. | 1116 // Build up the certificate IP address list. |
| 1116 std::string ip_addrs_line(test_data.ip_addrs); | 1117 std::string ip_addrs_line(test_data.ip_addrs); |
| 1117 std::vector<std::string> ip_addressses_ascii; | 1118 std::vector<std::string> ip_addressses_ascii; |
| 1118 base::SplitString(ip_addrs_line, ',', &ip_addressses_ascii); | 1119 base::SplitString(ip_addrs_line, ',', &ip_addressses_ascii); |
| 1119 for (size_t i = 0; i < ip_addressses_ascii.size(); ++i) { | 1120 for (size_t i = 0; i < ip_addressses_ascii.size(); ++i) { |
| 1120 std::string& addr_ascii = ip_addressses_ascii[i]; | 1121 std::string& addr_ascii = ip_addressses_ascii[i]; |
| 1121 ASSERT_NE(0U, addr_ascii.length()); | 1122 ASSERT_NE(0U, addr_ascii.length()); |
| 1122 if (addr_ascii[0] == 'x') { // Hex encoded address | 1123 if (addr_ascii[0] == 'x') { // Hex encoded address |
| 1123 addr_ascii.erase(0, 1); | 1124 addr_ascii.erase(0, 1); |
| 1124 std::vector<uint8> bytes; | 1125 std::vector<uint8_t> bytes; |
| 1125 EXPECT_TRUE(base::HexStringToBytes(addr_ascii, &bytes)) | 1126 EXPECT_TRUE(base::HexStringToBytes(addr_ascii, &bytes)) |
| 1126 << "Could not parse hex address " << addr_ascii << " i = " << i; | 1127 << "Could not parse hex address " << addr_ascii << " i = " << i; |
| 1127 ip_addressses.push_back(std::string(reinterpret_cast<char*>(&bytes[0]), | 1128 ip_addressses.push_back(std::string(reinterpret_cast<char*>(&bytes[0]), |
| 1128 bytes.size())); | 1129 bytes.size())); |
| 1129 ASSERT_EQ(16U, ip_addressses.back().size()) << i; | 1130 ASSERT_EQ(16U, ip_addressses.back().size()) << i; |
| 1130 } else { // Decimal groups | 1131 } else { // Decimal groups |
| 1131 std::vector<std::string> decimals_ascii; | 1132 std::vector<std::string> decimals_ascii; |
| 1132 base::SplitString(addr_ascii, '.', &decimals_ascii); | 1133 base::SplitString(addr_ascii, '.', &decimals_ascii); |
| 1133 EXPECT_EQ(4U, decimals_ascii.size()) << i; | 1134 EXPECT_EQ(4U, decimals_ascii.size()) << i; |
| 1134 std::string addr_bytes; | 1135 std::string addr_bytes; |
| (...skipping 69 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1204 &actual_type); | 1205 &actual_type); |
| 1205 | 1206 |
| 1206 EXPECT_EQ(data.expected_bits, actual_bits); | 1207 EXPECT_EQ(data.expected_bits, actual_bits); |
| 1207 EXPECT_EQ(data.expected_type, actual_type); | 1208 EXPECT_EQ(data.expected_type, actual_type); |
| 1208 } | 1209 } |
| 1209 | 1210 |
| 1210 INSTANTIATE_TEST_CASE_P(, X509CertificatePublicKeyInfoTest, | 1211 INSTANTIATE_TEST_CASE_P(, X509CertificatePublicKeyInfoTest, |
| 1211 testing::ValuesIn(kPublicKeyInfoTestData)); | 1212 testing::ValuesIn(kPublicKeyInfoTestData)); |
| 1212 | 1213 |
| 1213 } // namespace net | 1214 } // namespace net |
| OLD | NEW |