Make Cast certificate verification enforce constraints specified in the trusted root certificate.

net/cert/internal/verify_certificate_chain_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
 #include "base/base_paths.h"
 #include "base/files/file_util.h"
 #include "base/path_service.h"
 #include "base/strings/string_split.h"
@@ skipping 21 matching lines @@
   // Read the full contents of the file.
   std::string file_data;
   if (!base::ReadFileToString(filepath, &file_data)) {
     ADD_FAILURE() << "Couldn't read file: " << filepath.value();
     return std::string();
   }
 
   return file_data;
 }
 
-// Adds the certificate |cert_der| as a trust anchor to |trust_store|.
-void AddCertificateToTrustStore(const std::string& cert_der,
-                                TrustStore* trust_store) {
-  ParsedCertificate cert;
-  ASSERT_TRUE(ParseCertificate(der::Input(&cert_der), &cert));
-
-  ParsedTbsCertificate tbs;
-  ASSERT_TRUE(ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs));
-  TrustAnchor anchor = {tbs.spki_tlv.AsString(), tbs.subject_tlv.AsString()};
-  trust_store->anchors.push_back(anchor);
-}
-
 // Reads a test case from |file_name|. Test cases are comprised of a
 // certificate chain, trust store, a timestamp to validate at, and the
 // expected result of verification.
 void ReadTestFromFile(const std::string& file_name,
                       std::vector<std::string>* chain,
                       TrustStore* trust_store,
                       der::GeneralizedTime* time,
                       bool* verify_result) {
   chain->clear();
-  *trust_store = TrustStore();
+  trust_store->Clear();
 
   std::string file_data = ReadTestFileToString(file_name);
 
   std::vector<std::string> pem_headers;
 
   const char kCertificateHeader[] = "CERTIFICATE";
   const char kTrustedCertificateHeader[] = "TRUSTED_CERTIFICATE";
   const char kTimeHeader[] = "TIME";
   const char kResultHeader[] = "VERIFY_RESULT";
 
   pem_headers.push_back(kCertificateHeader);
   pem_headers.push_back(kTrustedCertificateHeader);
   pem_headers.push_back(kTimeHeader);
   pem_headers.push_back(kResultHeader);
 
   bool has_time = false;
   bool has_result = false;
 
   PEMTokenizer pem_tokenizer(file_data, pem_headers);
   while (pem_tokenizer.GetNext()) {
     const std::string& block_type = pem_tokenizer.block_type();
     const std::string& block_data = pem_tokenizer.data();
 
     if (block_type == kCertificateHeader) {
       chain->push_back(block_data);
     } else if (block_type == kTrustedCertificateHeader) {
-      AddCertificateToTrustStore(block_data, trust_store);
+      ASSERT_TRUE(trust_store->AddTrustedCertificate(block_data));
     } else if (block_type == kTimeHeader) {
       ASSERT_FALSE(has_time) << "Duplicate " << kTimeHeader;
       has_time = true;
       ASSERT_TRUE(der::ParseUTCTime(der::Input(&block_data), time));
     } else if (block_type == kResultHeader) {
       ASSERT_FALSE(has_result) << "Duplicate " << kResultHeader;
       ASSERT_TRUE(block_data == "SUCCESS" || block_data == "FAIL")
           << "Unrecognized result: " << block_data;
       has_result = true;
       *verify_result = block_data == "SUCCESS";
@@ skipping 89 matching lines @@
 }
 
 TEST(VerifyCertificateChainTest, ExpiredTarget) {
   RunTest("expired-target.pem");
 }
 
 TEST(VerifyCertificateChainTest, ExpiredTargetNotBefore) {
   RunTest("expired-target-notBefore.pem");
 }
 
+TEST(VerifyCertificateChainTest, ExpiredRoot) {
+  RunTest("expired-root.pem");
+}
+
 TEST(VerifyCertificateChainTest, TargetNotEndEntity) {
   RunTest("target-not-end-entity.pem");
 }
 
 TEST(VerifyCertificateChainTest, TargetHasKeyCertSignButNotCa) {
   RunTest("target-has-keycertsign-but-not-ca.pem");
 }
 
 TEST(VerifyCertificateChainTest, TargetHasPathlenButNotCa) {
   RunTest("target-has-pathlen-but-not-ca.pem");
 }
 
 TEST(VerifyCertificateChainTest, TargetUnknownCriticalExtension) {
   RunTest("target-unknown-critical-extension.pem");
 }
 
 TEST(VerifyCertificateChainTest, IssuerAndSubjectNotByteForByteEqual) {
   RunTest("issuer-and-subject-not-byte-for-byte-equal.pem");
 }
 
 TEST(VerifyCertificateChainTest, IssuerAndSubjectNotByteForByteEqualAnchor) {
   RunTest("issuer-and-subject-not-byte-for-byte-equal-anchor.pem");
 }
 
+TEST(VerifyCertificateChainTest, ViolatesPathlen1Root) {
+  RunTest("violates-pathlen-1-root.pem");
+}
+
+TEST(VerifyCertificateChainTest, NonSelfSignedRoot) {
+  RunTest("non-self-signed-root.pem");
+}
+
 // Tests that verifying a chain with no certificates fails.
 TEST(VerifyCertificateChainTest, EmptyChainIsInvalid) {
   TrustStore trust_store;
   der::GeneralizedTime time;
   std::vector<der::Input> chain;
   SimpleSignaturePolicy signature_policy(2048);
 
   ASSERT_FALSE(
       VerifyCertificateChain(chain, trust_store, &signature_policy, time));
 }
 
 // TODO(eroman): Add test that invalidate validity dates where the day or month
 // ordinal not in range, like "March 39, 2016" are rejected.
 
 }  // namespace
 
 }  // namespace net