Add TrustStoreNSS and TrustStoreCollection

net/cert/internal/trust_store_nss_unittest.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/cert/internal/trust_store_nss.h"
+
+#include <cert.h>
+#include <certdb.h>
+
+#include "base/bind.h"
+#include "base/memory/ptr_util.h"
+#include "base/run_loop.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "crypto/scoped_test_nss_db.h"
+#include "net/cert/internal/test_helpers.h"
+#include "net/cert/internal/trust_store_test_helpers.h"
+#include "net/cert/scoped_nss_types.h"
+#include "net/cert/x509_certificate.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace net {
+
+namespace {
+
+void NotCalled(TrustAnchors anchors) {
+  ADD_FAILURE() << "NotCalled was called";
+}
+
+class TrustStoreNSSTest : public testing::Test {
+ public:
+  void SetUp() override {
+    ASSERT_TRUE(test_nssdb_.is_open());
+
+    ParsedCertificateList chain;
+    bool unused_verify_result;
+    der::GeneralizedTime unused_time;
+    std::string unused_errors;
+
+    ReadVerifyCertChainTestFromFile("key-rollover-oldchain.pem", &chain,
+                                    &oldroot_, &unused_time,
+                                    &unused_verify_result, &unused_errors);
+    ASSERT_EQ(2U, chain.size());
+    target_ = chain[0];
+    oldintermediate_ = chain[1];
+    ASSERT_TRUE(target_);
+    ASSERT_TRUE(oldintermediate_);
+    ASSERT_TRUE(oldroot_);
+
+    scoped_refptr<TrustAnchor> unused_root;
+    ReadVerifyCertChainTestFromFile("key-rollover-longrolloverchain.pem",
+                                    &chain, &unused_root, &unused_time,
+                                    &unused_verify_result, &unused_errors);
+    ASSERT_EQ(4U, chain.size());
+    newintermediate_ = chain[1];
+    newroot_ = TrustAnchor::CreateFromCertificateNoConstraints(chain[2]);
+    newrootrollover_ = chain[3];
+    ASSERT_TRUE(newintermediate_);
+    ASSERT_TRUE(newroot_);
+    ASSERT_TRUE(newrootrollover_);
+
+    trust_store_nss_.reset(
+        new TrustStoreNSS(trustSSL, base::ThreadTaskRunnerHandle::Get()));
+  }
+
+  std::string GetUniqueNickname() {
+    return "trust_store_nss_unittest" + base::UintToString(nickname_counter_++);
+  }
+
+  void AddCertToNSS(const ParsedCertificate* cert) {
+    std::string nickname = GetUniqueNickname();
+    ScopedCERTCertificate nss_cert(
+        X509Certificate::CreateOSCertHandleFromBytesWithNickname(
+            cert->der_cert().AsStringPiece().data(), cert->der_cert().Length(),
+            nickname.c_str()));
+    ASSERT_TRUE(nss_cert);
+    SECStatus srv =
+        PK11_ImportCert(test_nssdb_.slot(), nss_cert.get(), CK_INVALID_HANDLE,
+                        nickname.c_str(), PR_FALSE /* includeTrust (unused) */);
+    ASSERT_EQ(SECSuccess, srv);
+  }
+
+  void AddCertsToNSS() {
+    AddCertToNSS(target_.get());
+    AddCertToNSS(oldintermediate_.get());
+    AddCertToNSS(newintermediate_.get());
+    AddCertToNSS(oldroot_->cert().get());
+    AddCertToNSS(newroot_->cert().get());
+    AddCertToNSS(newrootrollover_.get());
+  }
+
+  // Trusts |cert|. Assumes the cert was already imported into NSS.
+  void TrustCert(const TrustAnchor* anchor) { TrustCert(anchor->cert().get()); }
+  void TrustCert(const ParsedCertificate* cert) {
+    SECItem der_cert;
+    der_cert.data = const_cast<uint8_t*>(cert->der_cert().UnsafeData());
+    der_cert.len = base::checked_cast<unsigned>(cert->der_cert().Length());
+    der_cert.type = siDERCertBuffer;
+
+    ScopedCERTCertificate nss_cert(
+        CERT_FindCertByDERCert(CERT_GetDefaultCertDB(), &der_cert));
+    ASSERT_TRUE(nss_cert);
+
+    CERTCertTrust trust = {0};
+    trust.sslFlags =
+        CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA | CERTDB_VALID_CA;
+    SECStatus srv =
+        CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), nss_cert.get(), &trust);
+    ASSERT_EQ(SECSuccess, srv);
+  }
+
+ protected:
+  void ExpectTrustStoreContains(tracked_objects::Location loc,
+                                scoped_refptr<ParsedCertificate> cert,
+                                TrustAnchors expected_async_matches) {
+    SCOPED_TRACE(loc.ToString());
+
+    TrustAnchors sync_matches;
+    TrustAnchorResultRecorder anchor_results;
+    std::unique_ptr<TrustStore::Request> req;
+    trust_store_nss_->FindTrustAnchorsForCert(cert, anchor_results.Callback(),
+                                              &sync_matches, &req);
+    ASSERT_TRUE(req);
+    EXPECT_TRUE(sync_matches.empty());
+
+    anchor_results.Run();
+    std::vector<der::Input> der_result_matches;
+    for (const auto& it : anchor_results.matches())
+      der_result_matches.push_back(it->cert()->der_cert());
+    std::sort(der_result_matches.begin(), der_result_matches.end());
+
+    std::vector<der::Input> der_expected_matches;
+    for (const auto& it : expected_async_matches)
+      der_expected_matches.push_back(it->cert()->der_cert());
+    std::sort(der_expected_matches.begin(), der_expected_matches.end());
+
+    EXPECT_EQ(der_expected_matches, der_result_matches);
+  }
+
+  scoped_refptr<TrustAnchor> oldroot_;
+  scoped_refptr<TrustAnchor> newroot_;
+
+  scoped_refptr<ParsedCertificate> target_;
+  scoped_refptr<ParsedCertificate> oldintermediate_;
+  scoped_refptr<ParsedCertificate> newintermediate_;
+  scoped_refptr<ParsedCertificate> newrootrollover_;
+  crypto::ScopedTestNSSDB test_nssdb_;
+  std::unique_ptr<TrustStoreNSS> trust_store_nss_;
+  unsigned nickname_counter_ = 0;
+};
+
+// Without adding any certs to the NSS DB, should get no anchor results for any
+// of the test certs.
+TEST_F(TrustStoreNSSTest, CertsNotPresent) {
+  ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors());
+}
+
+// If certs are present in NSS DB but aren't marked as trusted, should get no
+// anchor results for any of the test certs.
+TEST_F(TrustStoreNSSTest, CertsPresentButNotTrusted) {
+  AddCertsToNSS();
+  ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors());
+}
+
+// A self-signed CA certificate is trusted. FindTrustAnchorsForCert should
+// return the cert on any intermediates with a matching issuer, and on any
+// matching self-signed/self-issued CA certs.
+TEST_F(TrustStoreNSSTest, TrustedCA) {
+  AddCertsToNSS();
+  TrustCert(newroot_.get());
+  ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, newintermediate_, {newroot_});
+  ExpectTrustStoreContains(FROM_HERE, oldintermediate_, {newroot_});
+  ExpectTrustStoreContains(FROM_HERE, newrootrollover_, {newroot_});
+  ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), {newroot_});
+  ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), {newroot_});
+}
+
+// When an intermediate certificate is trusted, FindTrustAnchorsForCert should
+// return that cert on any certs issued by the intermediate, but not for the
+// intermediate itself (or the CAs).
+TEST_F(TrustStoreNSSTest, TrustedIntermediate) {
+  AddCertsToNSS();
+  TrustCert(newintermediate_.get());
+  ExpectTrustStoreContains(
+      FROM_HERE, target_,
+      {TrustAnchor::CreateFromCertificateNoConstraints(newintermediate_)});
+  ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, oldintermediate_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, newrootrollover_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors());
+}
+
+// Multiple self-signed CA certificates with the same name are trusted.
+// FindTrustAnchorsForCert should return all these certs on any intermediates
+// with a matching issuer, and on any matching self-signed/self-issued CA certs.
+TEST_F(TrustStoreNSSTest, MultipleTrustedCAWithSameSubject) {
+  AddCertsToNSS();
+  TrustCert(oldroot_.get());
+  TrustCert(newroot_.get());
+  ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors());
+  ExpectTrustStoreContains(FROM_HERE, newintermediate_, {newroot_, oldroot_});
+  ExpectTrustStoreContains(FROM_HERE, oldintermediate_, {newroot_, oldroot_});
+  ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), {newroot_, oldroot_});
+}
+
+// Cancel a FindTrustAnchorsForCert request before it has returned any results.
+// Callback should not be called.
+TEST_F(TrustStoreNSSTest, CancelRequest) {
+  std::unique_ptr<TrustStore::Request> req;
+  TrustAnchors sync_matches;
+  trust_store_nss_->FindTrustAnchorsForCert(target_, base::Bind(&NotCalled),
+                                            &sync_matches, &req);
+  ASSERT_TRUE(req);
+  req.reset();
+  base::RunLoop().RunUntilIdle();
+}
+
+// Cancel a FindTrustAnchorsForCert request during the callback. Should not
+// crash.
+TEST_F(TrustStoreNSSTest, CancelRequestDuringCallback) {
+  AddCertsToNSS();
+  TrustCert(newroot_.get());
+
+  base::RunLoop run_loop;
+  std::unique_ptr<TrustStore::Request> req;
+  TrustAnchors sync_matches;
+  trust_store_nss_->FindTrustAnchorsForCert(
+      newintermediate_,
+      base::Bind(&TrustStoreRequestDeleter, &req, run_loop.QuitClosure()),
+      &sync_matches, &req);
+  ASSERT_TRUE(req);
+  run_loop.Run();
+  ASSERT_FALSE(req);
+  base::RunLoop().RunUntilIdle();
+}
+
+}  // namespace
+
+}  // namespace net