OLD | NEW |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/internal/verify_certificate_chain.h" | 5 #include "net/cert/internal/path_builder.h" |
6 | 6 |
| 7 #include "net/base/net_errors.h" |
| 8 #include "net/cert/internal/cert_issuer_source_static.h" |
| 9 #include "net/cert/internal/parse_certificate.h" |
7 #include "net/cert/internal/parsed_certificate.h" | 10 #include "net/cert/internal/parsed_certificate.h" |
8 #include "net/cert/internal/signature_policy.h" | 11 #include "net/cert/internal/signature_policy.h" |
9 #include "net/cert/internal/trust_store.h" | 12 #include "net/cert/internal/trust_store.h" |
| 13 #include "net/cert/internal/verify_certificate_chain.h" |
10 #include "net/der/input.h" | 14 #include "net/der/input.h" |
11 | 15 |
12 // Disable tests that require DSA signatures (DSA signatures are intentionally | 16 // Disable tests that require DSA signatures (DSA signatures are intentionally |
13 // unsupported). Custom versions of the DSA tests are defined below which expect | 17 // unsupported). Custom versions of the DSA tests are defined below which expect |
14 // verification to fail. | 18 // verification to fail. |
15 #define Section1ValidDSASignaturesTest4 DISABLED_Section1ValidDSASignaturesTest4 | 19 #define Section1ValidDSASignaturesTest4 DISABLED_Section1ValidDSASignaturesTest4 |
16 #define Section1ValidDSAParameterInheritanceTest5 \ | 20 #define Section1ValidDSAParameterInheritanceTest5 \ |
17 DISABLED_Section1ValidDSAParameterInheritanceTest5 | 21 DISABLED_Section1ValidDSAParameterInheritanceTest5 |
18 | 22 |
19 // Disable tests that require name constraints with name types that are | 23 // Disable tests that require name constraints with name types that are |
(...skipping 17 matching lines...) Expand all Loading... |
37 DISABLED_Section7InvalidkeyUsageCriticalcRLSignFalseTest4 | 41 DISABLED_Section7InvalidkeyUsageCriticalcRLSignFalseTest4 |
38 #define Section7InvalidkeyUsageNotCriticalcRLSignFalseTest5 \ | 42 #define Section7InvalidkeyUsageNotCriticalcRLSignFalseTest5 \ |
39 DISABLED_Section7InvalidkeyUsageNotCriticalcRLSignFalseTest5 | 43 DISABLED_Section7InvalidkeyUsageNotCriticalcRLSignFalseTest5 |
40 | 44 |
41 #include "net/cert/internal/nist_pkits_unittest.h" | 45 #include "net/cert/internal/nist_pkits_unittest.h" |
42 | 46 |
43 namespace net { | 47 namespace net { |
44 | 48 |
45 namespace { | 49 namespace { |
46 | 50 |
47 class VerifyCertificateChainPkitsTestDelegate { | 51 class PathBuilderPkitsTestDelegate { |
48 public: | 52 public: |
49 static bool Verify(std::vector<std::string> cert_ders, | 53 static bool Verify(std::vector<std::string> cert_ders, |
50 std::vector<std::string> crl_ders) { | 54 std::vector<std::string> crl_ders) { |
51 if (cert_ders.empty()) { | 55 if (cert_ders.empty()) { |
52 ADD_FAILURE() << "cert_ders is empty"; | 56 ADD_FAILURE() << "cert_ders is empty"; |
53 return false; | 57 return false; |
54 } | 58 } |
55 // First entry in the PKITS chain is the trust anchor. | 59 ParsedCertificateList certs; |
56 TrustStore trust_store; | 60 for (const std::string& der : cert_ders) { |
57 scoped_refptr<ParsedCertificate> anchor( | 61 certs.push_back(ParsedCertificate::CreateFromCertificateCopy(der, {})); |
58 ParsedCertificate::CreateFromCertificateCopy(cert_ders[0], {})); | 62 if (!certs.back()) { |
59 EXPECT_TRUE(anchor); | 63 ADD_FAILURE() << "ParsedCertificate::CreateFromCertificateCopy failed"; |
60 if (anchor) | |
61 trust_store.AddTrustedCertificate(std::move(anchor)); | |
62 | |
63 // PKITS lists chains from trust anchor to target, VerifyCertificateChain | |
64 // takes them starting with the target and not including the trust anchor. | |
65 std::vector<scoped_refptr<net::ParsedCertificate>> input_chain; | |
66 for (size_t i = cert_ders.size() - 1; i > 0; --i) { | |
67 if (!net::ParsedCertificate::CreateAndAddToVector( | |
68 reinterpret_cast<const uint8_t*>(cert_ders[i].data()), | |
69 cert_ders[i].size(), | |
70 net::ParsedCertificate::DataSource::EXTERNAL_REFERENCE, {}, | |
71 &input_chain)) { | |
72 ADD_FAILURE() << "cert " << i << " failed to parse"; | |
73 return false; | 64 return false; |
74 } | 65 } |
75 } | 66 } |
| 67 // First entry in the PKITS chain is the trust anchor. |
| 68 // TODO(mattm): test with all possible trust anchors in the trust store? |
| 69 TrustStore trust_store; |
| 70 trust_store.AddTrustedCertificate(certs[0]); |
| 71 |
| 72 // TODO(mattm): test with other irrelevant certs in cert_issuer_sources? |
| 73 CertIssuerSourceStatic cert_issuer_source; |
| 74 for (size_t i = 1; i < cert_ders.size() - 1; ++i) |
| 75 cert_issuer_source.AddCert(certs[i]); |
| 76 |
| 77 scoped_refptr<ParsedCertificate> target_cert(certs.back()); |
76 | 78 |
77 SimpleSignaturePolicy signature_policy(1024); | 79 SimpleSignaturePolicy signature_policy(1024); |
78 | 80 |
79 // Run all tests at the time the PKITS was published. | 81 // Run all tests at the time the PKITS was published. |
80 der::GeneralizedTime time = {2011, 4, 15, 0, 0, 0}; | 82 der::GeneralizedTime time = {2011, 4, 15, 0, 0, 0}; |
81 | 83 |
82 return VerifyCertificateChain(input_chain, trust_store, &signature_policy, | 84 CertPathBuilder::Result result; |
83 time, nullptr); | 85 CertPathBuilder path_builder(std::move(target_cert), &trust_store, |
| 86 &signature_policy, time, &result); |
| 87 path_builder.AddCertIssuerSource(&cert_issuer_source); |
| 88 |
| 89 CompletionStatus rv = path_builder.Run(base::Closure()); |
| 90 EXPECT_EQ(CompletionStatus::SYNC, rv); |
| 91 |
| 92 return result.is_success(); |
84 } | 93 } |
85 }; | 94 }; |
86 | 95 |
87 } // namespace | 96 } // namespace |
88 | 97 |
89 class PkitsTest01SignatureVerificationCustom | 98 class PkitsTest01SignatureVerificationCustomPathBuilderFoo |
90 : public PkitsTest<VerifyCertificateChainPkitsTestDelegate> {}; | 99 : public PkitsTest<PathBuilderPkitsTestDelegate> {}; |
91 | 100 |
92 // Modified version of 4.1.4 Valid DSA Signatures Test4 | 101 // Modified version of 4.1.4 Valid DSA Signatures Test4 |
93 TEST_F(PkitsTest01SignatureVerificationCustom, | 102 TEST_F(PkitsTest01SignatureVerificationCustomPathBuilderFoo, |
94 Section1ValidDSASignaturesTest4Custom) { | 103 Section1ValidDSASignaturesTest4Custom) { |
95 const char* const certs[] = {"TrustAnchorRootCertificate", "DSACACert", | 104 const char* const certs[] = {"TrustAnchorRootCertificate", "DSACACert", |
96 "ValidDSASignaturesTest4EE"}; | 105 "ValidDSASignaturesTest4EE"}; |
97 const char* const crls[] = {"TrustAnchorRootCRL", "DSACACRL"}; | 106 const char* const crls[] = {"TrustAnchorRootCRL", "DSACACRL"}; |
98 // DSA signatures are intentionally unsupported. | 107 // DSA signatures are intentionally unsupported. |
99 ASSERT_FALSE(this->Verify(certs, crls)); | 108 ASSERT_FALSE(this->Verify(certs, crls)); |
100 } | 109 } |
101 | 110 |
102 // Modified version of 4.1.5 Valid DSA Parameter Inheritance Test5 | 111 // Modified version of 4.1.5 Valid DSA Parameter Inheritance Test5 |
103 TEST_F(PkitsTest01SignatureVerificationCustom, | 112 TEST_F(PkitsTest01SignatureVerificationCustomPathBuilderFoo, |
104 Section1ValidDSAParameterInheritanceTest5Custom) { | 113 Section1ValidDSAParameterInheritanceTest5Custom) { |
105 const char* const certs[] = {"TrustAnchorRootCertificate", "DSACACert", | 114 const char* const certs[] = {"TrustAnchorRootCertificate", "DSACACert", |
106 "DSAParametersInheritedCACert", | 115 "DSAParametersInheritedCACert", |
107 "ValidDSAParameterInheritanceTest5EE"}; | 116 "ValidDSAParameterInheritanceTest5EE"}; |
108 const char* const crls[] = {"TrustAnchorRootCRL", "DSACACRL", | 117 const char* const crls[] = {"TrustAnchorRootCRL", "DSACACRL", |
109 "DSAParametersInheritedCACRL"}; | 118 "DSAParametersInheritedCACRL"}; |
110 // DSA signatures are intentionally unsupported. | 119 // DSA signatures are intentionally unsupported. |
111 ASSERT_FALSE(this->Verify(certs, crls)); | 120 ASSERT_FALSE(this->Verify(certs, crls)); |
112 } | 121 } |
113 | 122 |
114 class PkitsTest13SignatureVerificationCustom | 123 class PkitsTest13SignatureVerificationCustomPathBuilderFoo |
115 : public PkitsTest<VerifyCertificateChainPkitsTestDelegate> {}; | 124 : public PkitsTest<PathBuilderPkitsTestDelegate> {}; |
116 | 125 |
117 // Modified version of 4.13.21 Valid RFC822 nameConstraints Test21 | 126 // Modified version of 4.13.21 Valid RFC822 nameConstraints Test21 |
118 TEST_F(PkitsTest13SignatureVerificationCustom, | 127 TEST_F(PkitsTest13SignatureVerificationCustomPathBuilderFoo, |
119 Section13ValidRFC822nameConstraintsTest21Custom) { | 128 Section13ValidRFC822nameConstraintsTest21Custom) { |
120 const char* const certs[] = {"TrustAnchorRootCertificate", | 129 const char* const certs[] = {"TrustAnchorRootCertificate", |
121 "nameConstraintsRFC822CA1Cert", | 130 "nameConstraintsRFC822CA1Cert", |
122 "ValidRFC822nameConstraintsTest21EE"}; | 131 "ValidRFC822nameConstraintsTest21EE"}; |
123 const char* const crls[] = {"TrustAnchorRootCRL", | 132 const char* const crls[] = {"TrustAnchorRootCRL", |
124 "nameConstraintsRFC822CA1CRL"}; | 133 "nameConstraintsRFC822CA1CRL"}; |
125 // Name constraints on rfc822Names are not supported. | 134 // Name constraints on rfc822Names are not supported. |
126 ASSERT_FALSE(this->Verify(certs, crls)); | 135 ASSERT_FALSE(this->Verify(certs, crls)); |
127 } | 136 } |
128 | 137 |
129 // Modified version of 4.13.23 Valid RFC822 nameConstraints Test23 | 138 // Modified version of 4.13.23 Valid RFC822 nameConstraints Test23 |
130 TEST_F(PkitsTest13SignatureVerificationCustom, | 139 TEST_F(PkitsTest13SignatureVerificationCustomPathBuilderFoo, |
131 Section13ValidRFC822nameConstraintsTest23Custom) { | 140 Section13ValidRFC822nameConstraintsTest23Custom) { |
132 const char* const certs[] = {"TrustAnchorRootCertificate", | 141 const char* const certs[] = {"TrustAnchorRootCertificate", |
133 "nameConstraintsRFC822CA2Cert", | 142 "nameConstraintsRFC822CA2Cert", |
134 "ValidRFC822nameConstraintsTest23EE"}; | 143 "ValidRFC822nameConstraintsTest23EE"}; |
135 const char* const crls[] = {"TrustAnchorRootCRL", | 144 const char* const crls[] = {"TrustAnchorRootCRL", |
136 "nameConstraintsRFC822CA2CRL"}; | 145 "nameConstraintsRFC822CA2CRL"}; |
137 // Name constraints on rfc822Names are not supported. | 146 // Name constraints on rfc822Names are not supported. |
138 ASSERT_FALSE(this->Verify(certs, crls)); | 147 ASSERT_FALSE(this->Verify(certs, crls)); |
139 } | 148 } |
140 | 149 |
141 // Modified version of 4.13.25 Valid RFC822 nameConstraints Test25 | 150 // Modified version of 4.13.25 Valid RFC822 nameConstraints Test25 |
142 TEST_F(PkitsTest13SignatureVerificationCustom, | 151 TEST_F(PkitsTest13SignatureVerificationCustomPathBuilderFoo, |
143 Section13ValidRFC822nameConstraintsTest25Custom) { | 152 Section13ValidRFC822nameConstraintsTest25Custom) { |
144 const char* const certs[] = {"TrustAnchorRootCertificate", | 153 const char* const certs[] = {"TrustAnchorRootCertificate", |
145 "nameConstraintsRFC822CA3Cert", | 154 "nameConstraintsRFC822CA3Cert", |
146 "ValidRFC822nameConstraintsTest25EE"}; | 155 "ValidRFC822nameConstraintsTest25EE"}; |
147 const char* const crls[] = {"TrustAnchorRootCRL", | 156 const char* const crls[] = {"TrustAnchorRootCRL", |
148 "nameConstraintsRFC822CA3CRL"}; | 157 "nameConstraintsRFC822CA3CRL"}; |
149 // Name constraints on rfc822Names are not supported. | 158 // Name constraints on rfc822Names are not supported. |
150 ASSERT_FALSE(this->Verify(certs, crls)); | 159 ASSERT_FALSE(this->Verify(certs, crls)); |
151 } | 160 } |
152 | 161 |
153 // Modified version of 4.13.27 Valid DN and RFC822 nameConstraints Test27 | 162 // Modified version of 4.13.27 Valid DN and RFC822 nameConstraints Test27 |
154 TEST_F(PkitsTest13SignatureVerificationCustom, | 163 TEST_F(PkitsTest13SignatureVerificationCustomPathBuilderFoo, |
155 Section13ValidDNandRFC822nameConstraintsTest27Custom) { | 164 Section13ValidDNandRFC822nameConstraintsTest27Custom) { |
156 const char* const certs[] = {"TrustAnchorRootCertificate", | 165 const char* const certs[] = {"TrustAnchorRootCertificate", |
157 "nameConstraintsDN1CACert", | 166 "nameConstraintsDN1CACert", |
158 "nameConstraintsDN1subCA3Cert", | 167 "nameConstraintsDN1subCA3Cert", |
159 "ValidDNandRFC822nameConstraintsTest27EE"}; | 168 "ValidDNandRFC822nameConstraintsTest27EE"}; |
160 const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsDN1CACRL", | 169 const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsDN1CACRL", |
161 "nameConstraintsDN1subCA3CRL"}; | 170 "nameConstraintsDN1subCA3CRL"}; |
162 // Name constraints on rfc822Names are not supported. | 171 // Name constraints on rfc822Names are not supported. |
163 ASSERT_FALSE(this->Verify(certs, crls)); | 172 ASSERT_FALSE(this->Verify(certs, crls)); |
164 } | 173 } |
165 | 174 |
166 // Modified version of 4.13.34 Valid URI nameConstraints Test34 | 175 // Modified version of 4.13.34 Valid URI nameConstraints Test34 |
167 TEST_F(PkitsTest13SignatureVerificationCustom, | 176 TEST_F(PkitsTest13SignatureVerificationCustomPathBuilderFoo, |
168 Section13ValidURInameConstraintsTest34Custom) { | 177 Section13ValidURInameConstraintsTest34Custom) { |
169 const char* const certs[] = {"TrustAnchorRootCertificate", | 178 const char* const certs[] = {"TrustAnchorRootCertificate", |
170 "nameConstraintsURI1CACert", | 179 "nameConstraintsURI1CACert", |
171 "ValidURInameConstraintsTest34EE"}; | 180 "ValidURInameConstraintsTest34EE"}; |
172 const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsURI1CACRL"}; | 181 const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsURI1CACRL"}; |
173 // Name constraints on uniformResourceIdentifiers are not supported. | 182 // Name constraints on uniformResourceIdentifiers are not supported. |
174 ASSERT_FALSE(this->Verify(certs, crls)); | 183 ASSERT_FALSE(this->Verify(certs, crls)); |
175 } | 184 } |
176 | 185 |
177 // Modified version of 4.13.36 Valid URI nameConstraints Test36 | 186 // Modified version of 4.13.36 Valid URI nameConstraints Test36 |
178 TEST_F(PkitsTest13SignatureVerificationCustom, | 187 TEST_F(PkitsTest13SignatureVerificationCustomPathBuilderFoo, |
179 Section13ValidURInameConstraintsTest36Custom) { | 188 Section13ValidURInameConstraintsTest36Custom) { |
180 const char* const certs[] = {"TrustAnchorRootCertificate", | 189 const char* const certs[] = {"TrustAnchorRootCertificate", |
181 "nameConstraintsURI2CACert", | 190 "nameConstraintsURI2CACert", |
182 "ValidURInameConstraintsTest36EE"}; | 191 "ValidURInameConstraintsTest36EE"}; |
183 const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsURI2CACRL"}; | 192 const char* const crls[] = {"TrustAnchorRootCRL", "nameConstraintsURI2CACRL"}; |
184 // Name constraints on uniformResourceIdentifiers are not supported. | 193 // Name constraints on uniformResourceIdentifiers are not supported. |
185 ASSERT_FALSE(this->Verify(certs, crls)); | 194 ASSERT_FALSE(this->Verify(certs, crls)); |
186 } | 195 } |
187 | 196 |
188 INSTANTIATE_TYPED_TEST_CASE_P(VerifyCertificateChain, | 197 INSTANTIATE_TYPED_TEST_CASE_P(PathBuilder, |
189 PkitsTest01SignatureVerification, | 198 PkitsTest01SignatureVerification, |
190 VerifyCertificateChainPkitsTestDelegate); | 199 PathBuilderPkitsTestDelegate); |
191 INSTANTIATE_TYPED_TEST_CASE_P(VerifyCertificateChain, | 200 INSTANTIATE_TYPED_TEST_CASE_P(PathBuilder, |
192 PkitsTest02ValidityPeriods, | 201 PkitsTest02ValidityPeriods, |
193 VerifyCertificateChainPkitsTestDelegate); | 202 PathBuilderPkitsTestDelegate); |
194 INSTANTIATE_TYPED_TEST_CASE_P(VerifyCertificateChain, | 203 INSTANTIATE_TYPED_TEST_CASE_P(PathBuilder, |
195 PkitsTest03VerifyingNameChaining, | 204 PkitsTest03VerifyingNameChaining, |
196 VerifyCertificateChainPkitsTestDelegate); | 205 PathBuilderPkitsTestDelegate); |
197 INSTANTIATE_TYPED_TEST_CASE_P(VerifyCertificateChain, | 206 INSTANTIATE_TYPED_TEST_CASE_P(PathBuilder, |
198 PkitsTest06VerifyingBasicConstraints, | 207 PkitsTest06VerifyingBasicConstraints, |
199 VerifyCertificateChainPkitsTestDelegate); | 208 PathBuilderPkitsTestDelegate); |
200 INSTANTIATE_TYPED_TEST_CASE_P(VerifyCertificateChain, | 209 INSTANTIATE_TYPED_TEST_CASE_P(PathBuilder, |
201 PkitsTest07KeyUsage, | 210 PkitsTest07KeyUsage, |
202 VerifyCertificateChainPkitsTestDelegate); | 211 PathBuilderPkitsTestDelegate); |
203 INSTANTIATE_TYPED_TEST_CASE_P(VerifyCertificateChain, | 212 INSTANTIATE_TYPED_TEST_CASE_P(PathBuilder, |
204 PkitsTest13NameConstraints, | 213 PkitsTest13NameConstraints, |
205 VerifyCertificateChainPkitsTestDelegate); | 214 PathBuilderPkitsTestDelegate); |
206 INSTANTIATE_TYPED_TEST_CASE_P(VerifyCertificateChain, | 215 INSTANTIATE_TYPED_TEST_CASE_P(PathBuilder, |
207 PkitsTest16PrivateCertificateExtensions, | 216 PkitsTest16PrivateCertificateExtensions, |
208 VerifyCertificateChainPkitsTestDelegate); | 217 PathBuilderPkitsTestDelegate); |
209 | 218 |
210 // TODO(mattm): CRL support: PkitsTest04BasicCertificateRevocationTests, | 219 // TODO(mattm): CRL support: PkitsTest04BasicCertificateRevocationTests, |
211 // PkitsTest05VerifyingPathswithSelfIssuedCertificates, | 220 // PkitsTest05VerifyingPathswithSelfIssuedCertificates, |
212 // PkitsTest14DistributionPoints, PkitsTest15DeltaCRLs | 221 // PkitsTest14DistributionPoints, PkitsTest15DeltaCRLs |
213 | 222 |
214 // TODO(mattm): Certificate Policies support: PkitsTest08CertificatePolicies, | 223 // TODO(mattm): Certificate Policies support: PkitsTest08CertificatePolicies, |
215 // PkitsTest09RequireExplicitPolicy PkitsTest10PolicyMappings, | 224 // PkitsTest09RequireExplicitPolicy PkitsTest10PolicyMappings, |
216 // PkitsTest11InhibitPolicyMapping, PkitsTest12InhibitAnyPolicy | 225 // PkitsTest11InhibitPolicyMapping, PkitsTest12InhibitAnyPolicy |
217 | 226 |
218 } // namespace net | 227 } // namespace net |
OLD | NEW |