Remove CertVerifyProcTest.CybertrustGTERoot unit test

net/cert/cert_verify_proc_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include <vector>
 
 #include "base/callback_helpers.h"
 #include "base/files/file_path.h"
@@ skipping 1109 matching lines @@
   int flags = 0;
   CertVerifyResult verify_result;
   int error = Verify(
       cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result.cert_status);
   // But should not be marked as a known root.
   EXPECT_FALSE(verify_result.is_issued_by_known_root);
 }
 
-#if defined(OS_MACOSX) && !defined(OS_IOS)
-// Tests that, on OS X, issues with a cross-certified Baltimore CyberTrust
-// Root can be successfully worked around once Apple completes removing the
-// older GTE CyberTrust Root from its trusted root store.
-//
-// The issue is caused by servers supplying the cross-certified intermediate
-// (necessary for certain mobile platforms), which OS X does not recognize
-// as already existing within its trust store.
-TEST_F(CertVerifyProcTest, CybertrustGTERoot) {
-  CertificateList certs = CreateCertificateListFromFile(
-      GetTestCertsDirectory(),
-      "cybertrust_omniroot_chain.pem",
-      X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
-  ASSERT_EQ(2U, certs.size());
-
-  X509Certificate::OSCertHandles intermediates;
-  intermediates.push_back(certs[1]->os_cert_handle());
-
-  scoped_refptr<X509Certificate> cybertrust_basic =
-      X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(),
-                                        intermediates);
-  ASSERT_TRUE(cybertrust_basic.get());
-
-  scoped_refptr<X509Certificate> baltimore_root =
-      ImportCertFromFile(GetTestCertsDirectory(),
-                         "cybertrust_baltimore_root.pem");
-  ASSERT_TRUE(baltimore_root.get());
-
-  ScopedTestRoot scoped_root(baltimore_root.get());
-
-  // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This
-  // simulates Keychain removing support for the GTE CyberTrust Root.
-  TestRootCerts::GetInstance()->SetAllowSystemTrust(false);
-  base::ScopedClosureRunner reset_system_trust(
-      base::Bind(&TestRootCerts::SetAllowSystemTrust,
-                 base::Unretained(TestRootCerts::GetInstance()),
-                 true));
-
-  // First, make sure a simple certificate chain from
-  //   EE -> Public SureServer SV -> Baltimore CyberTrust
-  // works. Only the first two certificates are included in the chain.
-  int flags = 0;
-  CertVerifyResult verify_result;
-  int error = Verify(cybertrust_basic.get(),
-                     "cacert.omniroot.com",
-                     flags,
-                     NULL,
-                     empty_cert_list_,
-                     &verify_result);
-  EXPECT_EQ(OK, error);
-  EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status);
-
-  // Attempt to verify with the first known cross-certified intermediate
-  // provided.
-  scoped_refptr<X509Certificate> baltimore_intermediate_1 =
-      ImportCertFromFile(GetTestCertsDirectory(),
-                         "cybertrust_baltimore_cross_certified_1.pem");
-  ASSERT_TRUE(baltimore_intermediate_1.get());
-
-  X509Certificate::OSCertHandles intermediate_chain_1 =
-      cybertrust_basic->GetIntermediateCertificates();
-  intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle());
-
-  scoped_refptr<X509Certificate> baltimore_chain_1 =
-      X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
-                                        intermediate_chain_1);
-  error = Verify(baltimore_chain_1.get(),
-                 "cacert.omniroot.com",
-                 flags,
-                 NULL,
-                 empty_cert_list_,
-                 &verify_result);
-  EXPECT_EQ(OK, error);
-  EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status);
-
-  // Attempt to verify with the second known cross-certified intermediate
-  // provided.
-  scoped_refptr<X509Certificate> baltimore_intermediate_2 =
-      ImportCertFromFile(GetTestCertsDirectory(),
-                         "cybertrust_baltimore_cross_certified_2.pem");
-  ASSERT_TRUE(baltimore_intermediate_2.get());
-
-  X509Certificate::OSCertHandles intermediate_chain_2 =
-      cybertrust_basic->GetIntermediateCertificates();
-  intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle());
-
-  scoped_refptr<X509Certificate> baltimore_chain_2 =
-      X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
-                                        intermediate_chain_2);
-  error = Verify(baltimore_chain_2.get(),
-                 "cacert.omniroot.com",
-                 flags,
-                 NULL,
-                 empty_cert_list_,
-                 &verify_result);
-  EXPECT_EQ(OK, error);
-  EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status);
-
-  // Attempt to verify when both a cross-certified intermediate AND
-  // the legacy GTE root are provided.
-  scoped_refptr<X509Certificate> cybertrust_root =
-      ImportCertFromFile(GetTestCertsDirectory(),
-                         "cybertrust_gte_root.pem");
-  ASSERT_TRUE(cybertrust_root.get());
-
-  intermediate_chain_2.push_back(cybertrust_root->os_cert_handle());
-  scoped_refptr<X509Certificate> baltimore_chain_with_root =
-      X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
-                                        intermediate_chain_2);
-  error = Verify(baltimore_chain_with_root.get(),
-                 "cacert.omniroot.com",
-                 flags,
-                 NULL,
-                 empty_cert_list_,
-                 &verify_result);
-  EXPECT_EQ(OK, error);
-  EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status);
-
-  TestRootCerts::GetInstance()->Clear();
-  EXPECT_TRUE(TestRootCerts::GetInstance()->IsEmpty());
-}
-#endif
-
 #if defined(USE_NSS_CERTS) || defined(OS_IOS) || defined(OS_WIN) || \
     defined(OS_MACOSX)
 // Test that CRLSets are effective in making a certificate appear to be
 // revoked.
 TEST_F(CertVerifyProcTest, CRLSet) {
   CertificateList ca_cert_list =
       CreateCertificateListFromFile(GetTestCertsDirectory(),
                                     "root_ca_cert.pem",
                                     X509Certificate::FORMAT_AUTO);
   ASSERT_EQ(1U, ca_cert_list.size());
@@ skipping 442 matching lines @@
   int flags = 0;
   CertVerifyResult verify_result;
   int error = Verify(cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_,
                      &verify_result);
   EXPECT_EQ(ERR_CERT_INVALID, error);
   EXPECT_EQ(CERT_STATUS_INVALID, verify_result.cert_status);
 }
 #endif  // defined(OS_MACOSX) && !defined(OS_IOS)
 
 }  // namespace net