Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chromeos/network/onc/onc_certificate_importer_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_certificate_importer.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ skipping 72 matching lines @@
     scoped_ptr<base::DictionaryValue> onc =
         test_utils::ReadTestDictionary(filename);
     base::ListValue* certificates = NULL;
     onc->GetListWithoutPathExpansion(toplevel_config::kCertificates,
                                      &certificates);
 
     base::DictionaryValue* certificate = NULL;
     certificates->GetDictionary(0, &certificate);
     certificate->GetStringWithoutPathExpansion(certificate::kGUID, guid);
 
+    web_trust_certificates_.clear();
     CertificateImporter importer(true /* allow web trust */);
     EXPECT_EQ(CertificateImporter::IMPORT_OK,
-              importer.ParseAndStoreCertificates(*certificates));
+              importer.ParseAndStoreCertificates(*certificates,
+                                                 &web_trust_certificates_));
 
-    net::CertificateList result_list;
-    CertificateImporter::ListCertsWithNickname(*guid, &result_list);
-    ASSERT_EQ(1ul, result_list.size());
-    EXPECT_EQ(expected_type, GetCertType(result_list[0]->os_cert_handle()));
+    result_list_.clear();
+    CertificateImporter::ListCertsWithNickname(*guid, &result_list_);
+    ASSERT_EQ(1ul, result_list_.size());
+    EXPECT_EQ(expected_type, GetCertType(result_list_[0]->os_cert_handle()));
   }
 
   scoped_refptr<net::CryptoModule> slot_;
+  net::CertificateList result_list_;
+  net::CertificateList web_trust_certificates_;
 
  private:
   net::CertificateList ListCertsInSlot(PK11SlotInfo* slot) {
     net::CertificateList result;
     CERTCertList* cert_list = PK11_ListCertsInSlot(slot);
     for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list);
          !CERT_LIST_END(node, cert_list);
          node = CERT_LIST_NEXT(node)) {
       result.push_back(net::X509Certificate::CreateFromHandle(
           node->cert, net::X509Certificate::OSCertHandles()));
@@ skipping 14 matching lines @@
     }
     return ok;
   }
 
   crypto::ScopedTestNSSDB test_nssdb_;
 };
 
 TEST_F(ONCCertificateImporterTest, AddClientCertificate) {
   std::string guid;
   AddCertificateFromFile("certificate-client.onc", net::USER_CERT, &guid);
+  EXPECT_TRUE(web_trust_certificates_.empty());
 
   SECKEYPrivateKeyList* privkey_list =
       PK11_ListPrivKeysInSlot(slot_->os_module_handle(), NULL, NULL);
   EXPECT_TRUE(privkey_list);
   if (privkey_list) {
     SECKEYPrivateKeyListNode* node = PRIVKEY_LIST_HEAD(privkey_list);
     int count = 0;
     while (!PRIVKEY_LIST_END(node, privkey_list)) {
       char* name = PK11_GetPrivateKeyNickname(node->key);
       EXPECT_STREQ(guid.c_str(), name);
@@ skipping 24 matching lines @@
   std::string guid;
   AddCertificateFromFile("certificate-server.onc", net::SERVER_CERT, &guid);
 
   SECKEYPrivateKeyList* privkey_list =
       PK11_ListPrivKeysInSlot(slot_->os_module_handle(), NULL, NULL);
   EXPECT_FALSE(privkey_list);
 
   SECKEYPublicKeyList* pubkey_list =
       PK11_ListPublicKeysInSlot(slot_->os_module_handle(), NULL);
   EXPECT_FALSE(pubkey_list);
+
+  ASSERT_EQ(1u, web_trust_certificates_.size());
+  ASSERT_EQ(1u, result_list_.size());

[pneubeck (no reviews), 2013/03/26 11:04:50]

remove this here or in AddCertificateFromFile

[Joao da Silva, 2013/03/31 19:22:14]

This must stay in both places, because the first element is indexed in the next
line. If |result_list| is empty then that line would crash the unit tests; the
assertion makes only this test fail.

A different ONC file is imported in each test too, so it's not guaranteed that
the result would be the same. Additionally, the order of execution of the tests
is not guaranteed either (the swarm bots run in completely random order, for
example).

+  EXPECT_TRUE(CERT_CompareCerts(result_list_[0]->os_cert_handle(),
+                                web_trust_certificates_[0]->os_cert_handle()));
 }
 
 TEST_F(ONCCertificateImporterTest, AddWebAuthorityCertificate) {
   std::string guid;
   AddCertificateFromFile("certificate-web-authority.onc", net::CA_CERT, &guid);
 
   SECKEYPrivateKeyList* privkey_list =
       PK11_ListPrivKeysInSlot(slot_->os_module_handle(), NULL, NULL);
   EXPECT_FALSE(privkey_list);
 
   SECKEYPublicKeyList* pubkey_list =
       PK11_ListPublicKeysInSlot(slot_->os_module_handle(), NULL);
   EXPECT_FALSE(pubkey_list);
+
+  ASSERT_EQ(1u, web_trust_certificates_.size());
+  ASSERT_EQ(1u, result_list_.size());

[pneubeck (no reviews), 2013/03/26 11:04:50]

ditto

[Joao da Silva, 2013/03/31 19:22:14]

See above

+  EXPECT_TRUE(CERT_CompareCerts(result_list_[0]->os_cert_handle(),
+                                web_trust_certificates_[0]->os_cert_handle()));
+}
+
+TEST_F(ONCCertificateImporterTest, AddAuthorityCertificateWithoutWebTrust) {
+  std::string guid;
+  AddCertificateFromFile("certificate-authority.onc", net::CA_CERT, &guid);
+  EXPECT_TRUE(web_trust_certificates_.empty());
+
+  SECKEYPrivateKeyList* privkey_list =
+      PK11_ListPrivKeysInSlot(slot_->os_module_handle(), NULL, NULL);
+  EXPECT_FALSE(privkey_list);
+
+  SECKEYPublicKeyList* pubkey_list =
+      PK11_ListPublicKeysInSlot(slot_->os_module_handle(), NULL);
+  EXPECT_FALSE(pubkey_list);
 }
 
 class ONCCertificateImporterTestWithParam :
       public ONCCertificateImporterTest,
       public testing::WithParamInterface<
           std::pair<net::CertType, std::pair<const char*, const char*> > > {
  protected:
   net::CertType GetCertTypeParam() {
     return GetParam().first;
   }
@@ skipping 47 matching lines @@
         std::make_pair(net::SERVER_CERT,
                        std::make_pair("certificate-server.onc",
                                       "certificate-server-update.onc")),
         std::make_pair(
             net::CA_CERT,
             std::make_pair("certificate-web-authority.onc",
                            "certificate-web-authority-update.onc"))));
 
 }  // namespace onc
 }  // namespace chromeos