Adds CreateSelfSignedCertEC to x509_util.h in preparation of persistent DTLS identity store for Web…

net/cert/x509_util_nss_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_util.h"
 #include "net/cert/x509_util_nss.h"
 
 #include <cert.h>
 #include <secoid.h>
 
@@ skipping 121 matching lines @@
 
   // Compare expected and actual extension values.
   PRBool result = SECITEM_ItemsAreEqual(expected, &actual);
   ASSERT_TRUE(result);
 
   // Do Cleanup.
   SECITEM_FreeItem(&actual, PR_FALSE);
   PORT_FreeArena(arena, PR_FALSE);
 }
 
+void VerifySelfSignedCert(const std::string& common_name,
+                          const std::string& der_cert) {
+  // This test is run on Mac and Win where X509Certificate::os_cert_handle isn't
+  // an NSS type, so we have to manually create a NSS certificate object so we
+  // can use CERT_FindCertExtension.  We also check the subject and validity
+  // times using NSS since X509Certificate will fail with EC certs on OSX 10.5
+  // (http://crbug.com/101231).
+  CERTCertificate* nss_cert = CreateNSSCertHandleFromBytes(
+      der_cert.data(), der_cert.size());
+
+  char* actual = CERT_GetCommonName(&nss_cert->subject);
+  ASSERT_TRUE(actual);
+  EXPECT_STREQ(common_name.data(), actual);
+  PORT_Free(actual);
+  EXPECT_EQ(SECSuccess, CERT_CertTimesValid(nss_cert));
+
+  CERT_DestroyCertificate(nss_cert);
+}
+
 }  // namespace
 
 // This test creates a domain-bound cert from an EC private key and
 // then verifies the content of the certificate.
 TEST(X509UtilNSSTest, CreateDomainBoundCertEC) {
   // Create a sample ASCII weborigin.
   std::string domain = "weborigin.com";
   base::Time now = base::Time::Now();
 
   scoped_ptr<crypto::ECPrivateKey> private_key(
       crypto::ECPrivateKey::Create());
   std::string der_cert;
   ASSERT_TRUE(x509_util::CreateDomainBoundCertEC(
       private_key.get(),
       domain, 1,
       now,
       now + base::TimeDelta::FromDays(1),
       &der_cert));
 
   VerifyDomainBoundCert(domain, der_cert);
 
 #if !defined(OS_WIN) && !defined(OS_MACOSX)
   // signature_verifier_win and signature_verifier_mac can't handle EC certs.
   std::vector<uint8> spki;
   ASSERT_TRUE(private_key->ExportPublicKey(&spki));
   VerifyCertificateSignature(der_cert, spki);
 #endif
 }
 
+// This test creates a self-signed cert from an EC private key pair and
+// then verifies the content of the certificate.
+TEST(X509UtilNSSTest, CreateSelfSignedertEC) {
+  // Create a sample ASCII weborigin.

[Ryan Sleevi, 2013/06/06 23:26:15]

I find this comment very confusing. There's nothing relevant to "weborigin" in
this code.

Seems like the comment itself is entirely unnecessary.

[jiayl, 2013/06/06 23:45:37]

Done.

+  std::string common_name = "webrtc";
+  base::Time now = base::Time::Now();
+
+  scoped_ptr<crypto::ECPrivateKey> key(crypto::ECPrivateKey::Create());

[Ryan Sleevi, 2013/06/06 23:26:15]

ASSERT_TRUE(key);

Your test will explode otherwise.

[jiayl, 2013/06/06 23:45:37]

Done.

+  std::string der_cert;
+  ASSERT_TRUE(x509_util::CreateSelfSignedCertEC(
+      key.get(),
+      "CN=" + common_name, 1,
+      now,
+      now + base::TimeDelta::FromDays(1),
+      &der_cert));
+
+  VerifySelfSignedCert(common_name, der_cert);
+
+#if !defined(OS_WIN) && !defined(OS_MACOSX)
+  // signature_verifier_win and signature_verifier_mac can't handle EC certs.
+  std::vector<uint8> spki;
+  ASSERT_TRUE(key->ExportPublicKey(&spki));
+  VerifyCertificateSignature(der_cert, spki);
+#endif
+}
+
 }  // namespace net