Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(11)

Side by Side Diff: net/cert/internal/trust_store_nss_unittest.cc

Issue 2453093004: Remove dependence on a message loop for net::PathBuilder. (Closed)
Patch Set: Created 4 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2016 The Chromium Authors. All rights reserved. 1 // Copyright 2016 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/cert/internal/trust_store_nss.h" 5 #include "net/cert/internal/trust_store_nss.h"
6 6
7 #include <cert.h> 7 #include <cert.h>
8 #include <certdb.h> 8 #include <certdb.h>
9 9
10 #include "base/bind.h"
11 #include "base/memory/ptr_util.h" 10 #include "base/memory/ptr_util.h"
12 #include "base/run_loop.h"
13 #include "base/strings/string_number_conversions.h" 11 #include "base/strings/string_number_conversions.h"
14 #include "base/threading/thread_task_runner_handle.h"
15 #include "crypto/scoped_test_nss_db.h" 12 #include "crypto/scoped_test_nss_db.h"
16 #include "net/cert/internal/test_helpers.h" 13 #include "net/cert/internal/test_helpers.h"
17 #include "net/cert/internal/trust_store_test_helpers.h"
18 #include "net/cert/scoped_nss_types.h" 14 #include "net/cert/scoped_nss_types.h"
19 #include "net/cert/x509_certificate.h" 15 #include "net/cert/x509_certificate.h"
20 #include "testing/gtest/include/gtest/gtest.h" 16 #include "testing/gtest/include/gtest/gtest.h"
21 17
22 namespace net { 18 namespace net {
23 19
24 namespace { 20 namespace {
25 21
26 void NotCalled(TrustAnchors anchors) {
27 ADD_FAILURE() << "NotCalled was called";
28 }
29
30 class TrustStoreNSSTest : public testing::Test { 22 class TrustStoreNSSTest : public testing::Test {
31 public: 23 public:
32 void SetUp() override { 24 void SetUp() override {
33 ASSERT_TRUE(test_nssdb_.is_open()); 25 ASSERT_TRUE(test_nssdb_.is_open());
34 26
35 ParsedCertificateList chain; 27 ParsedCertificateList chain;
36 bool unused_verify_result; 28 bool unused_verify_result;
37 der::GeneralizedTime unused_time; 29 der::GeneralizedTime unused_time;
38 std::string unused_errors; 30 std::string unused_errors;
39 31
(...skipping 14 matching lines...) Expand all
54 &chain, &unused_root, &unused_time, &unused_verify_result, 46 &chain, &unused_root, &unused_time, &unused_verify_result,
55 &unused_errors); 47 &unused_errors);
56 ASSERT_EQ(4U, chain.size()); 48 ASSERT_EQ(4U, chain.size());
57 newintermediate_ = chain[1]; 49 newintermediate_ = chain[1];
58 newroot_ = TrustAnchor::CreateFromCertificateNoConstraints(chain[2]); 50 newroot_ = TrustAnchor::CreateFromCertificateNoConstraints(chain[2]);
59 newrootrollover_ = chain[3]; 51 newrootrollover_ = chain[3];
60 ASSERT_TRUE(newintermediate_); 52 ASSERT_TRUE(newintermediate_);
61 ASSERT_TRUE(newroot_); 53 ASSERT_TRUE(newroot_);
62 ASSERT_TRUE(newrootrollover_); 54 ASSERT_TRUE(newrootrollover_);
63 55
64 trust_store_nss_.reset( 56 trust_store_nss_.reset(new TrustStoreNSS(trustSSL));
65 new TrustStoreNSS(trustSSL, base::ThreadTaskRunnerHandle::Get()));
66 } 57 }
67 58
68 std::string GetUniqueNickname() { 59 std::string GetUniqueNickname() {
69 return "trust_store_nss_unittest" + base::UintToString(nickname_counter_++); 60 return "trust_store_nss_unittest" + base::UintToString(nickname_counter_++);
70 } 61 }
71 62
72 void AddCertToNSS(const ParsedCertificate* cert) { 63 void AddCertToNSS(const ParsedCertificate* cert) {
73 std::string nickname = GetUniqueNickname(); 64 std::string nickname = GetUniqueNickname();
74 ScopedCERTCertificate nss_cert( 65 ScopedCERTCertificate nss_cert(
75 X509Certificate::CreateOSCertHandleFromBytesWithNickname( 66 X509Certificate::CreateOSCertHandleFromBytesWithNickname(
(...skipping 29 matching lines...) Expand all
105 96
106 CERTCertTrust trust = {0}; 97 CERTCertTrust trust = {0};
107 trust.sslFlags = 98 trust.sslFlags =
108 CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA | CERTDB_VALID_CA; 99 CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA | CERTDB_VALID_CA;
109 SECStatus srv = 100 SECStatus srv =
110 CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), nss_cert.get(), &trust); 101 CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), nss_cert.get(), &trust);
111 ASSERT_EQ(SECSuccess, srv); 102 ASSERT_EQ(SECSuccess, srv);
112 } 103 }
113 104
114 protected: 105 protected:
115 void ExpectTrustStoreContains(tracked_objects::Location loc, 106 void ExpectTrustStoreContains(scoped_refptr<ParsedCertificate> cert,
116 scoped_refptr<ParsedCertificate> cert, 107 TrustAnchors expected_matches) {
117 TrustAnchors expected_async_matches) { 108 TrustAnchors matches;
118 SCOPED_TRACE(loc.ToString()); 109 trust_store_nss_->FindTrustAnchorsForCert(cert, &matches);
mattm 2016/10/28 02:11:55 this was so you could tell which ExpectTrustStoreC
119 110
120 TrustAnchors sync_matches;
121 TrustAnchorResultRecorder anchor_results;
122 std::unique_ptr<TrustStore::Request> req;
123 trust_store_nss_->FindTrustAnchorsForCert(cert, anchor_results.Callback(),
124 &sync_matches, &req);
125 ASSERT_TRUE(req);
126 EXPECT_TRUE(sync_matches.empty());
127
128 anchor_results.Run();
129 std::vector<der::Input> der_result_matches; 111 std::vector<der::Input> der_result_matches;
130 for (const auto& it : anchor_results.matches()) 112 for (const auto& it : matches)
131 der_result_matches.push_back(it->cert()->der_cert()); 113 der_result_matches.push_back(it->cert()->der_cert());
132 std::sort(der_result_matches.begin(), der_result_matches.end()); 114 std::sort(der_result_matches.begin(), der_result_matches.end());
133 115
134 std::vector<der::Input> der_expected_matches; 116 std::vector<der::Input> der_expected_matches;
135 for (const auto& it : expected_async_matches) 117 for (const auto& it : expected_matches)
136 der_expected_matches.push_back(it->cert()->der_cert()); 118 der_expected_matches.push_back(it->cert()->der_cert());
137 std::sort(der_expected_matches.begin(), der_expected_matches.end()); 119 std::sort(der_expected_matches.begin(), der_expected_matches.end());
138 120
139 EXPECT_EQ(der_expected_matches, der_result_matches); 121 EXPECT_EQ(der_expected_matches, der_result_matches);
140 } 122 }
141 123
142 scoped_refptr<TrustAnchor> oldroot_; 124 scoped_refptr<TrustAnchor> oldroot_;
143 scoped_refptr<TrustAnchor> newroot_; 125 scoped_refptr<TrustAnchor> newroot_;
144 126
145 scoped_refptr<ParsedCertificate> target_; 127 scoped_refptr<ParsedCertificate> target_;
146 scoped_refptr<ParsedCertificate> oldintermediate_; 128 scoped_refptr<ParsedCertificate> oldintermediate_;
147 scoped_refptr<ParsedCertificate> newintermediate_; 129 scoped_refptr<ParsedCertificate> newintermediate_;
148 scoped_refptr<ParsedCertificate> newrootrollover_; 130 scoped_refptr<ParsedCertificate> newrootrollover_;
149 crypto::ScopedTestNSSDB test_nssdb_; 131 crypto::ScopedTestNSSDB test_nssdb_;
150 std::unique_ptr<TrustStoreNSS> trust_store_nss_; 132 std::unique_ptr<TrustStoreNSS> trust_store_nss_;
151 unsigned nickname_counter_ = 0; 133 unsigned nickname_counter_ = 0;
152 }; 134 };
153 135
154 // Without adding any certs to the NSS DB, should get no anchor results for any 136 // Without adding any certs to the NSS DB, should get no anchor results for any
155 // of the test certs. 137 // of the test certs.
156 TEST_F(TrustStoreNSSTest, CertsNotPresent) { 138 TEST_F(TrustStoreNSSTest, CertsNotPresent) {
157 ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors()); 139 ExpectTrustStoreContains(target_, TrustAnchors());
158 ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors()); 140 ExpectTrustStoreContains(newintermediate_, TrustAnchors());
159 ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors()); 141 ExpectTrustStoreContains(newroot_->cert(), TrustAnchors());
160 } 142 }
161 143
162 // If certs are present in NSS DB but aren't marked as trusted, should get no 144 // If certs are present in NSS DB but aren't marked as trusted, should get no
163 // anchor results for any of the test certs. 145 // anchor results for any of the test certs.
164 TEST_F(TrustStoreNSSTest, CertsPresentButNotTrusted) { 146 TEST_F(TrustStoreNSSTest, CertsPresentButNotTrusted) {
165 AddCertsToNSS(); 147 AddCertsToNSS();
166 ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors()); 148 ExpectTrustStoreContains(newintermediate_, TrustAnchors());
167 ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors()); 149 ExpectTrustStoreContains(target_, TrustAnchors());
168 ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors()); 150 ExpectTrustStoreContains(newintermediate_, TrustAnchors());
169 ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors()); 151 ExpectTrustStoreContains(newroot_->cert(), TrustAnchors());
170 } 152 }
171 153
172 // A self-signed CA certificate is trusted. FindTrustAnchorsForCert should 154 // A self-signed CA certificate is trusted. FindTrustAnchorsForCert should
173 // return the cert on any intermediates with a matching issuer, and on any 155 // return the cert on any intermediates with a matching issuer, and on any
174 // matching self-signed/self-issued CA certs. 156 // matching self-signed/self-issued CA certs.
175 TEST_F(TrustStoreNSSTest, TrustedCA) { 157 TEST_F(TrustStoreNSSTest, TrustedCA) {
176 AddCertsToNSS(); 158 AddCertsToNSS();
177 TrustCert(newroot_.get()); 159 TrustCert(newroot_.get());
178 ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors()); 160 ExpectTrustStoreContains(target_, TrustAnchors());
179 ExpectTrustStoreContains(FROM_HERE, newintermediate_, {newroot_}); 161 ExpectTrustStoreContains(newintermediate_, {newroot_});
180 ExpectTrustStoreContains(FROM_HERE, oldintermediate_, {newroot_}); 162 ExpectTrustStoreContains(oldintermediate_, {newroot_});
181 ExpectTrustStoreContains(FROM_HERE, newrootrollover_, {newroot_}); 163 ExpectTrustStoreContains(newrootrollover_, {newroot_});
182 ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), {newroot_}); 164 ExpectTrustStoreContains(oldroot_->cert(), {newroot_});
183 ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), {newroot_}); 165 ExpectTrustStoreContains(newroot_->cert(), {newroot_});
184 } 166 }
185 167
186 // When an intermediate certificate is trusted, FindTrustAnchorsForCert should 168 // When an intermediate certificate is trusted, FindTrustAnchorsForCert should
187 // return that cert on any certs issued by the intermediate, but not for the 169 // return that cert on any certs issued by the intermediate, but not for the
188 // intermediate itself (or the CAs). 170 // intermediate itself (or the CAs).
189 TEST_F(TrustStoreNSSTest, TrustedIntermediate) { 171 TEST_F(TrustStoreNSSTest, TrustedIntermediate) {
190 AddCertsToNSS(); 172 AddCertsToNSS();
191 TrustCert(newintermediate_.get()); 173 TrustCert(newintermediate_.get());
192 ExpectTrustStoreContains( 174 ExpectTrustStoreContains(
193 FROM_HERE, target_, 175 target_,
194 {TrustAnchor::CreateFromCertificateNoConstraints(newintermediate_)}); 176 {TrustAnchor::CreateFromCertificateNoConstraints(newintermediate_)});
195 ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors()); 177 ExpectTrustStoreContains(newintermediate_, TrustAnchors());
196 ExpectTrustStoreContains(FROM_HERE, oldintermediate_, TrustAnchors()); 178 ExpectTrustStoreContains(oldintermediate_, TrustAnchors());
197 ExpectTrustStoreContains(FROM_HERE, newrootrollover_, TrustAnchors()); 179 ExpectTrustStoreContains(newrootrollover_, TrustAnchors());
198 ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), TrustAnchors()); 180 ExpectTrustStoreContains(oldroot_->cert(), TrustAnchors());
199 ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors()); 181 ExpectTrustStoreContains(newroot_->cert(), TrustAnchors());
200 } 182 }
201 183
202 // Multiple self-signed CA certificates with the same name are trusted. 184 // Multiple self-signed CA certificates with the same name are trusted.
203 // FindTrustAnchorsForCert should return all these certs on any intermediates 185 // FindTrustAnchorsForCert should return all these certs on any intermediates
204 // with a matching issuer, and on any matching self-signed/self-issued CA certs. 186 // with a matching issuer, and on any matching self-signed/self-issued CA certs.
205 TEST_F(TrustStoreNSSTest, MultipleTrustedCAWithSameSubject) { 187 TEST_F(TrustStoreNSSTest, MultipleTrustedCAWithSameSubject) {
206 AddCertsToNSS(); 188 AddCertsToNSS();
207 TrustCert(oldroot_.get()); 189 TrustCert(oldroot_.get());
208 TrustCert(newroot_.get()); 190 TrustCert(newroot_.get());
209 ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors()); 191 ExpectTrustStoreContains(target_, TrustAnchors());
210 ExpectTrustStoreContains(FROM_HERE, newintermediate_, {newroot_, oldroot_}); 192 ExpectTrustStoreContains(newintermediate_, {newroot_, oldroot_});
211 ExpectTrustStoreContains(FROM_HERE, oldintermediate_, {newroot_, oldroot_}); 193 ExpectTrustStoreContains(oldintermediate_, {newroot_, oldroot_});
212 ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), {newroot_, oldroot_}); 194 ExpectTrustStoreContains(oldroot_->cert(), {newroot_, oldroot_});
213 }
214
215 // Cancel a FindTrustAnchorsForCert request before it has returned any results.
216 // Callback should not be called.
217 TEST_F(TrustStoreNSSTest, CancelRequest) {
218 std::unique_ptr<TrustStore::Request> req;
219 TrustAnchors sync_matches;
220 trust_store_nss_->FindTrustAnchorsForCert(target_, base::Bind(&NotCalled),
221 &sync_matches, &req);
222 ASSERT_TRUE(req);
223 req.reset();
224 base::RunLoop().RunUntilIdle();
225 }
226
227 // Cancel a FindTrustAnchorsForCert request during the callback. Should not
228 // crash.
229 TEST_F(TrustStoreNSSTest, CancelRequestDuringCallback) {
230 AddCertsToNSS();
231 TrustCert(newroot_.get());
232
233 base::RunLoop run_loop;
234 std::unique_ptr<TrustStore::Request> req;
235 TrustAnchors sync_matches;
236 trust_store_nss_->FindTrustAnchorsForCert(
237 newintermediate_,
238 base::Bind(&TrustStoreRequestDeleter, &req, run_loop.QuitClosure()),
239 &sync_matches, &req);
240 ASSERT_TRUE(req);
241 run_loop.Run();
242 ASSERT_FALSE(req);
243 base::RunLoop().RunUntilIdle();
244 } 195 }
245 196
246 } // namespace 197 } // namespace
247 198
248 } // namespace net 199 } // namespace net
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698