| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/cert_verify_proc.h" | 5 #include "net/cert/cert_verify_proc.h" |
| 6 | 6 |
| 7 #include <vector> | 7 #include <vector> |
| 8 | 8 |
| 9 #include "base/files/file_path.h" | 9 #include "base/files/file_path.h" |
| 10 #include "base/logging.h" | 10 #include "base/logging.h" |
| (...skipping 884 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 895 scoped_refptr<X509Certificate> cybertrust_basic = | 895 scoped_refptr<X509Certificate> cybertrust_basic = |
| 896 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | 896 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), |
| 897 intermediates); | 897 intermediates); |
| 898 ASSERT_TRUE(cybertrust_basic.get()); | 898 ASSERT_TRUE(cybertrust_basic.get()); |
| 899 | 899 |
| 900 scoped_refptr<X509Certificate> baltimore_root = | 900 scoped_refptr<X509Certificate> baltimore_root = |
| 901 ImportCertFromFile(GetTestCertsDirectory(), | 901 ImportCertFromFile(GetTestCertsDirectory(), |
| 902 "cybertrust_baltimore_root.pem"); | 902 "cybertrust_baltimore_root.pem"); |
| 903 ASSERT_TRUE(baltimore_root.get()); | 903 ASSERT_TRUE(baltimore_root.get()); |
| 904 | 904 |
| 905 ScopedTestRoot scoped_root(baltimore_root); | 905 ScopedTestRoot scoped_root(baltimore_root.get()); |
| 906 | 906 |
| 907 // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This | 907 // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This |
| 908 // simulates Keychain removing support for the GTE CyberTrust Root. | 908 // simulates Keychain removing support for the GTE CyberTrust Root. |
| 909 TestRootCerts::GetInstance()->SetAllowSystemTrust(false); | 909 TestRootCerts::GetInstance()->SetAllowSystemTrust(false); |
| 910 base::ScopedClosureRunner reset_system_trust( | 910 base::ScopedClosureRunner reset_system_trust( |
| 911 base::Bind(&TestRootCerts::SetAllowSystemTrust, | 911 base::Bind(&TestRootCerts::SetAllowSystemTrust, |
| 912 base::Unretained(TestRootCerts::GetInstance()), | 912 base::Unretained(TestRootCerts::GetInstance()), |
| 913 true)); | 913 true)); |
| 914 | 914 |
| 915 // First, make sure a simple certificate chain from | 915 // First, make sure a simple certificate chain from |
| 916 // EE -> Public SureServer SV -> Baltimore CyberTrust | 916 // EE -> Public SureServer SV -> Baltimore CyberTrust |
| 917 // works. Only the first two certificates are included in the chain. | 917 // works. Only the first two certificates are included in the chain. |
| 918 int flags = 0; | 918 int flags = 0; |
| 919 CertVerifyResult verify_result; | 919 CertVerifyResult verify_result; |
| 920 int error = Verify(cybertrust_basic, "cacert.omniroot.com", flags, NULL, | 920 int error = Verify(cybertrust_basic.get(), |
| 921 empty_cert_list_, &verify_result); | 921 "cacert.omniroot.com", |
| 922 flags, |
| 923 NULL, |
| 924 empty_cert_list_, |
| 925 &verify_result); |
| 922 EXPECT_EQ(OK, error); | 926 EXPECT_EQ(OK, error); |
| 923 EXPECT_EQ(0U, verify_result.cert_status); | 927 EXPECT_EQ(0U, verify_result.cert_status); |
| 924 | 928 |
| 925 // Attempt to verify with the first known cross-certified intermediate | 929 // Attempt to verify with the first known cross-certified intermediate |
| 926 // provided. | 930 // provided. |
| 927 scoped_refptr<X509Certificate> baltimore_intermediate_1 = | 931 scoped_refptr<X509Certificate> baltimore_intermediate_1 = |
| 928 ImportCertFromFile(GetTestCertsDirectory(), | 932 ImportCertFromFile(GetTestCertsDirectory(), |
| 929 "cybertrust_baltimore_cross_certified_1.pem"); | 933 "cybertrust_baltimore_cross_certified_1.pem"); |
| 930 ASSERT_TRUE(baltimore_intermediate_1.get()); | 934 ASSERT_TRUE(baltimore_intermediate_1.get()); |
| 931 | 935 |
| 932 X509Certificate::OSCertHandles intermediate_chain_1 = | 936 X509Certificate::OSCertHandles intermediate_chain_1 = |
| 933 cybertrust_basic->GetIntermediateCertificates(); | 937 cybertrust_basic->GetIntermediateCertificates(); |
| 934 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); | 938 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); |
| 935 | 939 |
| 936 scoped_refptr<X509Certificate> baltimore_chain_1 = | 940 scoped_refptr<X509Certificate> baltimore_chain_1 = |
| 937 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 941 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
| 938 intermediate_chain_1); | 942 intermediate_chain_1); |
| 939 error = Verify(baltimore_chain_1, "cacert.omniroot.com", flags, NULL, | 943 error = Verify(baltimore_chain_1.get(), |
| 940 empty_cert_list_, &verify_result); | 944 "cacert.omniroot.com", |
| 945 flags, |
| 946 NULL, |
| 947 empty_cert_list_, |
| 948 &verify_result); |
| 941 EXPECT_EQ(OK, error); | 949 EXPECT_EQ(OK, error); |
| 942 EXPECT_EQ(0U, verify_result.cert_status); | 950 EXPECT_EQ(0U, verify_result.cert_status); |
| 943 | 951 |
| 944 // Attempt to verify with the second known cross-certified intermediate | 952 // Attempt to verify with the second known cross-certified intermediate |
| 945 // provided. | 953 // provided. |
| 946 scoped_refptr<X509Certificate> baltimore_intermediate_2 = | 954 scoped_refptr<X509Certificate> baltimore_intermediate_2 = |
| 947 ImportCertFromFile(GetTestCertsDirectory(), | 955 ImportCertFromFile(GetTestCertsDirectory(), |
| 948 "cybertrust_baltimore_cross_certified_2.pem"); | 956 "cybertrust_baltimore_cross_certified_2.pem"); |
| 949 ASSERT_TRUE(baltimore_intermediate_2.get()); | 957 ASSERT_TRUE(baltimore_intermediate_2.get()); |
| 950 | 958 |
| 951 X509Certificate::OSCertHandles intermediate_chain_2 = | 959 X509Certificate::OSCertHandles intermediate_chain_2 = |
| 952 cybertrust_basic->GetIntermediateCertificates(); | 960 cybertrust_basic->GetIntermediateCertificates(); |
| 953 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); | 961 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); |
| 954 | 962 |
| 955 scoped_refptr<X509Certificate> baltimore_chain_2 = | 963 scoped_refptr<X509Certificate> baltimore_chain_2 = |
| 956 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 964 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
| 957 intermediate_chain_2); | 965 intermediate_chain_2); |
| 958 error = Verify(baltimore_chain_2, "cacert.omniroot.com", flags, NULL, | 966 error = Verify(baltimore_chain_2.get(), |
| 959 empty_cert_list_, &verify_result); | 967 "cacert.omniroot.com", |
| 968 flags, |
| 969 NULL, |
| 970 empty_cert_list_, |
| 971 &verify_result); |
| 960 EXPECT_EQ(OK, error); | 972 EXPECT_EQ(OK, error); |
| 961 EXPECT_EQ(0U, verify_result.cert_status); | 973 EXPECT_EQ(0U, verify_result.cert_status); |
| 962 | 974 |
| 963 // Attempt to verify when both a cross-certified intermediate AND | 975 // Attempt to verify when both a cross-certified intermediate AND |
| 964 // the legacy GTE root are provided. | 976 // the legacy GTE root are provided. |
| 965 scoped_refptr<X509Certificate> cybertrust_root = | 977 scoped_refptr<X509Certificate> cybertrust_root = |
| 966 ImportCertFromFile(GetTestCertsDirectory(), | 978 ImportCertFromFile(GetTestCertsDirectory(), |
| 967 "cybertrust_gte_root.pem"); | 979 "cybertrust_gte_root.pem"); |
| 968 ASSERT_TRUE(cybertrust_root.get()); | 980 ASSERT_TRUE(cybertrust_root.get()); |
| 969 | 981 |
| 970 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); | 982 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); |
| 971 scoped_refptr<X509Certificate> baltimore_chain_with_root = | 983 scoped_refptr<X509Certificate> baltimore_chain_with_root = |
| 972 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 984 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
| 973 intermediate_chain_2); | 985 intermediate_chain_2); |
| 974 error = Verify(baltimore_chain_with_root, "cacert.omniroot.com", flags, | 986 error = Verify(baltimore_chain_with_root.get(), |
| 975 NULL, empty_cert_list_, &verify_result); | 987 "cacert.omniroot.com", |
| 988 flags, |
| 989 NULL, |
| 990 empty_cert_list_, |
| 991 &verify_result); |
| 976 EXPECT_EQ(OK, error); | 992 EXPECT_EQ(OK, error); |
| 977 EXPECT_EQ(0U, verify_result.cert_status); | 993 EXPECT_EQ(0U, verify_result.cert_status); |
| 978 | 994 |
| 979 } | 995 } |
| 980 #endif | 996 #endif |
| 981 | 997 |
| 982 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) | 998 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) |
| 983 static const uint8 kCRLSetThawteSPKIBlocked[] = { | 999 static const uint8 kCRLSetThawteSPKIBlocked[] = { |
| 984 0x8e, 0x00, 0x7b, 0x22, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x3a, | 1000 0x8e, 0x00, 0x7b, 0x22, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x3a, |
| 985 0x30, 0x2c, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, | 1001 0x30, 0x2c, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, |
| (...skipping 419 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1405 TEST_P(CertVerifyProcNonUniqueNameTest, IsHostnameNonUnique) { | 1421 TEST_P(CertVerifyProcNonUniqueNameTest, IsHostnameNonUnique) { |
| 1406 const NonUniqueNameTestData& test_data = GetParam(); | 1422 const NonUniqueNameTestData& test_data = GetParam(); |
| 1407 | 1423 |
| 1408 EXPECT_EQ(test_data.is_unique, IsUnique(test_data.hostname)); | 1424 EXPECT_EQ(test_data.is_unique, IsUnique(test_data.hostname)); |
| 1409 } | 1425 } |
| 1410 | 1426 |
| 1411 INSTANTIATE_TEST_CASE_P(, CertVerifyProcNonUniqueNameTest, | 1427 INSTANTIATE_TEST_CASE_P(, CertVerifyProcNonUniqueNameTest, |
| 1412 testing::ValuesIn(kNonUniqueNameTestData)); | 1428 testing::ValuesIn(kNonUniqueNameTestData)); |
| 1413 | 1429 |
| 1414 } // namespace net | 1430 } // namespace net |
| OLD | NEW |