OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/cert_verify_proc.h" | 5 #include "net/cert/cert_verify_proc.h" |
6 | 6 |
7 #include <vector> | 7 #include <vector> |
8 | 8 |
9 #include "base/callback_helpers.h" | 9 #include "base/callback_helpers.h" |
10 #include "base/files/file_path.h" | 10 #include "base/files/file_path.h" |
(...skipping 11 matching lines...) Expand all Loading... |
22 #include "net/cert/cert_verifier.h" | 22 #include "net/cert/cert_verifier.h" |
23 #include "net/cert/cert_verify_result.h" | 23 #include "net/cert/cert_verify_result.h" |
24 #include "net/cert/crl_set.h" | 24 #include "net/cert/crl_set.h" |
25 #include "net/cert/crl_set_storage.h" | 25 #include "net/cert/crl_set_storage.h" |
26 #include "net/cert/test_root_certs.h" | 26 #include "net/cert/test_root_certs.h" |
27 #include "net/cert/x509_certificate.h" | 27 #include "net/cert/x509_certificate.h" |
28 #include "net/test/cert_test_util.h" | 28 #include "net/test/cert_test_util.h" |
29 #include "net/test/test_certificate_data.h" | 29 #include "net/test/test_certificate_data.h" |
30 #include "testing/gtest/include/gtest/gtest.h" | 30 #include "testing/gtest/include/gtest/gtest.h" |
31 | 31 |
32 #if defined(OS_WIN) | 32 #if defined(OS_ANDROID) |
33 #include "base/win/windows_version.h" | |
34 #elif defined(OS_ANDROID) | |
35 #include "base/android/build_info.h" | 33 #include "base/android/build_info.h" |
36 #endif | 34 #endif |
37 | 35 |
38 using base::HexEncode; | 36 using base::HexEncode; |
39 | 37 |
40 namespace net { | 38 namespace net { |
41 | 39 |
42 namespace { | 40 namespace { |
43 | 41 |
44 // A certificate for www.paypal.com with a NULL byte in the common name. | 42 // A certificate for www.paypal.com with a NULL byte in the common name. |
(...skipping 260 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
305 certs[0]->os_cert_handle(), intermediates); | 303 certs[0]->os_cert_handle(), intermediates); |
306 | 304 |
307 int flags = 0; | 305 int flags = 0; |
308 CertVerifyResult verify_result; | 306 CertVerifyResult verify_result; |
309 int error = Verify(cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, | 307 int error = Verify(cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, |
310 &verify_result); | 308 &verify_result); |
311 EXPECT_EQ(ERR_CERT_DATE_INVALID, error); | 309 EXPECT_EQ(ERR_CERT_DATE_INVALID, error); |
312 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_DATE_INVALID); | 310 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_DATE_INVALID); |
313 } | 311 } |
314 | 312 |
315 // Test that verifying an ECDSA certificate doesn't crash on XP. (See | |
316 // crbug.com/144466). | |
317 TEST_F(CertVerifyProcTest, ECDSA_RSA) { | |
318 base::FilePath certs_dir = GetTestCertsDirectory(); | |
319 | |
320 scoped_refptr<X509Certificate> cert = | |
321 ImportCertFromFile(certs_dir, | |
322 "prime256v1-ecdsa-ee-by-1024-rsa-intermediate.pem"); | |
323 | |
324 CertVerifyResult verify_result; | |
325 Verify(cert.get(), "127.0.0.1", 0, NULL, empty_cert_list_, &verify_result); | |
326 | |
327 // We don't check verify_result because the certificate is signed by an | |
328 // unknown CA and will be considered invalid on XP because of the ECDSA | |
329 // public key. | |
330 } | |
331 | |
332 // Currently, only RSA and DSA keys are checked for weakness, and our example | 313 // Currently, only RSA and DSA keys are checked for weakness, and our example |
333 // weak size is 768. These could change in the future. | 314 // weak size is 768. These could change in the future. |
334 // | 315 // |
335 // Note that this means there may be false negatives: keys for other | 316 // Note that this means there may be false negatives: keys for other |
336 // algorithms and which are weak will pass this test. | 317 // algorithms and which are weak will pass this test. |
337 static bool IsWeakKeyType(const std::string& key_type) { | 318 static bool IsWeakKeyType(const std::string& key_type) { |
338 size_t pos = key_type.find("-"); | 319 size_t pos = key_type.find("-"); |
339 std::string size = key_type.substr(0, pos); | 320 std::string size = key_type.substr(0, pos); |
340 std::string type = key_type.substr(pos + 1); | 321 std::string type = key_type.substr(pos + 1); |
341 | 322 |
342 if (type == "rsa" || type == "dsa") | 323 if (type == "rsa" || type == "dsa") |
343 return size == "768"; | 324 return size == "768"; |
344 | 325 |
345 return false; | 326 return false; |
346 } | 327 } |
347 | 328 |
348 TEST_F(CertVerifyProcTest, RejectWeakKeys) { | 329 TEST_F(CertVerifyProcTest, RejectWeakKeys) { |
349 base::FilePath certs_dir = GetTestCertsDirectory(); | 330 base::FilePath certs_dir = GetTestCertsDirectory(); |
350 typedef std::vector<std::string> Strings; | 331 typedef std::vector<std::string> Strings; |
351 Strings key_types; | 332 Strings key_types; |
352 | 333 |
353 // generate-weak-test-chains.sh currently has: | 334 // generate-weak-test-chains.sh currently has: |
354 // key_types="768-rsa 1024-rsa 2048-rsa prime256v1-ecdsa" | 335 // key_types="768-rsa 1024-rsa 2048-rsa prime256v1-ecdsa" |
355 // We must use the same key types here. The filenames generated look like: | 336 // We must use the same key types here. The filenames generated look like: |
356 // 2048-rsa-ee-by-768-rsa-intermediate.pem | 337 // 2048-rsa-ee-by-768-rsa-intermediate.pem |
357 key_types.push_back("768-rsa"); | 338 key_types.push_back("768-rsa"); |
358 key_types.push_back("1024-rsa"); | 339 key_types.push_back("1024-rsa"); |
359 key_types.push_back("2048-rsa"); | 340 key_types.push_back("2048-rsa"); |
360 | 341 key_types.push_back("prime256v1-ecdsa"); |
361 bool use_ecdsa = true; | |
362 #if defined(OS_WIN) | |
363 use_ecdsa = base::win::GetVersion() > base::win::VERSION_XP; | |
364 #endif | |
365 | |
366 if (use_ecdsa) | |
367 key_types.push_back("prime256v1-ecdsa"); | |
368 | 342 |
369 // Add the root that signed the intermediates for this test. | 343 // Add the root that signed the intermediates for this test. |
370 scoped_refptr<X509Certificate> root_cert = | 344 scoped_refptr<X509Certificate> root_cert = |
371 ImportCertFromFile(certs_dir, "2048-rsa-root.pem"); | 345 ImportCertFromFile(certs_dir, "2048-rsa-root.pem"); |
372 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); | 346 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); |
373 ScopedTestRoot scoped_root(root_cert.get()); | 347 ScopedTestRoot scoped_root(root_cert.get()); |
374 | 348 |
375 // Now test each chain. | 349 // Now test each chain. |
376 for (Strings::const_iterator ee_type = key_types.begin(); | 350 for (Strings::const_iterator ee_type = key_types.begin(); |
377 ee_type != key_types.end(); ++ee_type) { | 351 ee_type != key_types.end(); ++ee_type) { |
(...skipping 1331 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1709 int flags = 0; | 1683 int flags = 0; |
1710 CertVerifyResult verify_result; | 1684 CertVerifyResult verify_result; |
1711 int error = Verify(cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, | 1685 int error = Verify(cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, |
1712 &verify_result); | 1686 &verify_result); |
1713 EXPECT_EQ(ERR_CERT_INVALID, error); | 1687 EXPECT_EQ(ERR_CERT_INVALID, error); |
1714 EXPECT_EQ(CERT_STATUS_INVALID, verify_result.cert_status); | 1688 EXPECT_EQ(CERT_STATUS_INVALID, verify_result.cert_status); |
1715 } | 1689 } |
1716 #endif // defined(OS_MACOSX) && !defined(OS_IOS) | 1690 #endif // defined(OS_MACOSX) && !defined(OS_IOS) |
1717 | 1691 |
1718 } // namespace net | 1692 } // namespace net |
OLD | NEW |