OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/cert_verify_proc.h" | 5 #include "net/cert/cert_verify_proc.h" |
6 | 6 |
7 #include <vector> | 7 #include <vector> |
8 | 8 |
9 #include "base/files/file_path.h" | 9 #include "base/files/file_path.h" |
10 #include "base/logging.h" | 10 #include "base/logging.h" |
(...skipping 884 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
895 scoped_refptr<X509Certificate> cybertrust_basic = | 895 scoped_refptr<X509Certificate> cybertrust_basic = |
896 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | 896 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), |
897 intermediates); | 897 intermediates); |
898 ASSERT_TRUE(cybertrust_basic.get()); | 898 ASSERT_TRUE(cybertrust_basic.get()); |
899 | 899 |
900 scoped_refptr<X509Certificate> baltimore_root = | 900 scoped_refptr<X509Certificate> baltimore_root = |
901 ImportCertFromFile(GetTestCertsDirectory(), | 901 ImportCertFromFile(GetTestCertsDirectory(), |
902 "cybertrust_baltimore_root.pem"); | 902 "cybertrust_baltimore_root.pem"); |
903 ASSERT_TRUE(baltimore_root.get()); | 903 ASSERT_TRUE(baltimore_root.get()); |
904 | 904 |
905 ScopedTestRoot scoped_root(baltimore_root); | 905 ScopedTestRoot scoped_root(baltimore_root.get()); |
906 | 906 |
907 // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This | 907 // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This |
908 // simulates Keychain removing support for the GTE CyberTrust Root. | 908 // simulates Keychain removing support for the GTE CyberTrust Root. |
909 TestRootCerts::GetInstance()->SetAllowSystemTrust(false); | 909 TestRootCerts::GetInstance()->SetAllowSystemTrust(false); |
910 base::ScopedClosureRunner reset_system_trust( | 910 base::ScopedClosureRunner reset_system_trust( |
911 base::Bind(&TestRootCerts::SetAllowSystemTrust, | 911 base::Bind(&TestRootCerts::SetAllowSystemTrust, |
912 base::Unretained(TestRootCerts::GetInstance()), | 912 base::Unretained(TestRootCerts::GetInstance()), |
913 true)); | 913 true)); |
914 | 914 |
915 // First, make sure a simple certificate chain from | 915 // First, make sure a simple certificate chain from |
916 // EE -> Public SureServer SV -> Baltimore CyberTrust | 916 // EE -> Public SureServer SV -> Baltimore CyberTrust |
917 // works. Only the first two certificates are included in the chain. | 917 // works. Only the first two certificates are included in the chain. |
918 int flags = 0; | 918 int flags = 0; |
919 CertVerifyResult verify_result; | 919 CertVerifyResult verify_result; |
920 int error = Verify(cybertrust_basic, "cacert.omniroot.com", flags, NULL, | 920 int error = Verify(cybertrust_basic.get(), |
921 empty_cert_list_, &verify_result); | 921 "cacert.omniroot.com", |
| 922 flags, |
| 923 NULL, |
| 924 empty_cert_list_, |
| 925 &verify_result); |
922 EXPECT_EQ(OK, error); | 926 EXPECT_EQ(OK, error); |
923 EXPECT_EQ(0U, verify_result.cert_status); | 927 EXPECT_EQ(0U, verify_result.cert_status); |
924 | 928 |
925 // Attempt to verify with the first known cross-certified intermediate | 929 // Attempt to verify with the first known cross-certified intermediate |
926 // provided. | 930 // provided. |
927 scoped_refptr<X509Certificate> baltimore_intermediate_1 = | 931 scoped_refptr<X509Certificate> baltimore_intermediate_1 = |
928 ImportCertFromFile(GetTestCertsDirectory(), | 932 ImportCertFromFile(GetTestCertsDirectory(), |
929 "cybertrust_baltimore_cross_certified_1.pem"); | 933 "cybertrust_baltimore_cross_certified_1.pem"); |
930 ASSERT_TRUE(baltimore_intermediate_1.get()); | 934 ASSERT_TRUE(baltimore_intermediate_1.get()); |
931 | 935 |
932 X509Certificate::OSCertHandles intermediate_chain_1 = | 936 X509Certificate::OSCertHandles intermediate_chain_1 = |
933 cybertrust_basic->GetIntermediateCertificates(); | 937 cybertrust_basic->GetIntermediateCertificates(); |
934 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); | 938 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); |
935 | 939 |
936 scoped_refptr<X509Certificate> baltimore_chain_1 = | 940 scoped_refptr<X509Certificate> baltimore_chain_1 = |
937 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 941 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
938 intermediate_chain_1); | 942 intermediate_chain_1); |
939 error = Verify(baltimore_chain_1, "cacert.omniroot.com", flags, NULL, | 943 error = Verify(baltimore_chain_1.get(), |
940 empty_cert_list_, &verify_result); | 944 "cacert.omniroot.com", |
| 945 flags, |
| 946 NULL, |
| 947 empty_cert_list_, |
| 948 &verify_result); |
941 EXPECT_EQ(OK, error); | 949 EXPECT_EQ(OK, error); |
942 EXPECT_EQ(0U, verify_result.cert_status); | 950 EXPECT_EQ(0U, verify_result.cert_status); |
943 | 951 |
944 // Attempt to verify with the second known cross-certified intermediate | 952 // Attempt to verify with the second known cross-certified intermediate |
945 // provided. | 953 // provided. |
946 scoped_refptr<X509Certificate> baltimore_intermediate_2 = | 954 scoped_refptr<X509Certificate> baltimore_intermediate_2 = |
947 ImportCertFromFile(GetTestCertsDirectory(), | 955 ImportCertFromFile(GetTestCertsDirectory(), |
948 "cybertrust_baltimore_cross_certified_2.pem"); | 956 "cybertrust_baltimore_cross_certified_2.pem"); |
949 ASSERT_TRUE(baltimore_intermediate_2.get()); | 957 ASSERT_TRUE(baltimore_intermediate_2.get()); |
950 | 958 |
951 X509Certificate::OSCertHandles intermediate_chain_2 = | 959 X509Certificate::OSCertHandles intermediate_chain_2 = |
952 cybertrust_basic->GetIntermediateCertificates(); | 960 cybertrust_basic->GetIntermediateCertificates(); |
953 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); | 961 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); |
954 | 962 |
955 scoped_refptr<X509Certificate> baltimore_chain_2 = | 963 scoped_refptr<X509Certificate> baltimore_chain_2 = |
956 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 964 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
957 intermediate_chain_2); | 965 intermediate_chain_2); |
958 error = Verify(baltimore_chain_2, "cacert.omniroot.com", flags, NULL, | 966 error = Verify(baltimore_chain_2.get(), |
959 empty_cert_list_, &verify_result); | 967 "cacert.omniroot.com", |
| 968 flags, |
| 969 NULL, |
| 970 empty_cert_list_, |
| 971 &verify_result); |
960 EXPECT_EQ(OK, error); | 972 EXPECT_EQ(OK, error); |
961 EXPECT_EQ(0U, verify_result.cert_status); | 973 EXPECT_EQ(0U, verify_result.cert_status); |
962 | 974 |
963 // Attempt to verify when both a cross-certified intermediate AND | 975 // Attempt to verify when both a cross-certified intermediate AND |
964 // the legacy GTE root are provided. | 976 // the legacy GTE root are provided. |
965 scoped_refptr<X509Certificate> cybertrust_root = | 977 scoped_refptr<X509Certificate> cybertrust_root = |
966 ImportCertFromFile(GetTestCertsDirectory(), | 978 ImportCertFromFile(GetTestCertsDirectory(), |
967 "cybertrust_gte_root.pem"); | 979 "cybertrust_gte_root.pem"); |
968 ASSERT_TRUE(cybertrust_root.get()); | 980 ASSERT_TRUE(cybertrust_root.get()); |
969 | 981 |
970 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); | 982 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); |
971 scoped_refptr<X509Certificate> baltimore_chain_with_root = | 983 scoped_refptr<X509Certificate> baltimore_chain_with_root = |
972 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 984 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
973 intermediate_chain_2); | 985 intermediate_chain_2); |
974 error = Verify(baltimore_chain_with_root, "cacert.omniroot.com", flags, | 986 error = Verify(baltimore_chain_with_root.get(), |
975 NULL, empty_cert_list_, &verify_result); | 987 "cacert.omniroot.com", |
| 988 flags, |
| 989 NULL, |
| 990 empty_cert_list_, |
| 991 &verify_result); |
976 EXPECT_EQ(OK, error); | 992 EXPECT_EQ(OK, error); |
977 EXPECT_EQ(0U, verify_result.cert_status); | 993 EXPECT_EQ(0U, verify_result.cert_status); |
978 | 994 |
979 } | 995 } |
980 #endif | 996 #endif |
981 | 997 |
982 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) | 998 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) |
983 static const uint8 kCRLSetThawteSPKIBlocked[] = { | 999 static const uint8 kCRLSetThawteSPKIBlocked[] = { |
984 0x8e, 0x00, 0x7b, 0x22, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x3a, | 1000 0x8e, 0x00, 0x7b, 0x22, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x3a, |
985 0x30, 0x2c, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, | 1001 0x30, 0x2c, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, |
(...skipping 419 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1405 TEST_P(CertVerifyProcNonUniqueNameTest, IsHostnameNonUnique) { | 1421 TEST_P(CertVerifyProcNonUniqueNameTest, IsHostnameNonUnique) { |
1406 const NonUniqueNameTestData& test_data = GetParam(); | 1422 const NonUniqueNameTestData& test_data = GetParam(); |
1407 | 1423 |
1408 EXPECT_EQ(test_data.is_unique, IsUnique(test_data.hostname)); | 1424 EXPECT_EQ(test_data.is_unique, IsUnique(test_data.hostname)); |
1409 } | 1425 } |
1410 | 1426 |
1411 INSTANTIATE_TEST_CASE_P(, CertVerifyProcNonUniqueNameTest, | 1427 INSTANTIATE_TEST_CASE_P(, CertVerifyProcNonUniqueNameTest, |
1412 testing::ValuesIn(kNonUniqueNameTestData)); | 1428 testing::ValuesIn(kNonUniqueNameTestData)); |
1413 | 1429 |
1414 } // namespace net | 1430 } // namespace net |
OLD | NEW |