Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/internal/trust_store_nss.h" | 5 #include "net/cert/internal/trust_store_nss.h" |
| 6 | 6 |
| 7 #include <cert.h> | 7 #include <cert.h> |
| 8 #include <certdb.h> | 8 #include <certdb.h> |
| 9 | 9 |
| 10 #include "base/bind.h" | |
| 11 #include "base/memory/ptr_util.h" | 10 #include "base/memory/ptr_util.h" |
| 12 #include "base/run_loop.h" | |
| 13 #include "base/strings/string_number_conversions.h" | 11 #include "base/strings/string_number_conversions.h" |
| 14 #include "base/threading/thread_task_runner_handle.h" | |
| 15 #include "crypto/scoped_test_nss_db.h" | 12 #include "crypto/scoped_test_nss_db.h" |
| 16 #include "net/cert/internal/test_helpers.h" | 13 #include "net/cert/internal/test_helpers.h" |
| 17 #include "net/cert/internal/trust_store_test_helpers.h" | |
| 18 #include "net/cert/scoped_nss_types.h" | 14 #include "net/cert/scoped_nss_types.h" |
| 19 #include "net/cert/x509_certificate.h" | 15 #include "net/cert/x509_certificate.h" |
| 20 #include "testing/gtest/include/gtest/gtest.h" | 16 #include "testing/gtest/include/gtest/gtest.h" |
| 21 | 17 |
| 22 namespace net { | 18 namespace net { |
| 23 | 19 |
| 24 namespace { | 20 namespace { |
| 25 | 21 |
| 26 void NotCalled(TrustAnchors anchors) { | |
| 27 ADD_FAILURE() << "NotCalled was called"; | |
| 28 } | |
| 29 | |
| 30 class TrustStoreNSSTest : public testing::Test { | 22 class TrustStoreNSSTest : public testing::Test { |
| 31 public: | 23 public: |
| 32 void SetUp() override { | 24 void SetUp() override { |
| 33 ASSERT_TRUE(test_nssdb_.is_open()); | 25 ASSERT_TRUE(test_nssdb_.is_open()); |
| 34 | 26 |
| 35 ParsedCertificateList chain; | 27 ParsedCertificateList chain; |
| 36 bool unused_verify_result; | 28 bool unused_verify_result; |
| 37 der::GeneralizedTime unused_time; | 29 der::GeneralizedTime unused_time; |
| 38 std::string unused_errors; | 30 std::string unused_errors; |
| 39 | 31 |
| (...skipping 14 matching lines...) Expand all Loading... | |
| 54 &chain, &unused_root, &unused_time, &unused_verify_result, | 46 &chain, &unused_root, &unused_time, &unused_verify_result, |
| 55 &unused_errors); | 47 &unused_errors); |
| 56 ASSERT_EQ(4U, chain.size()); | 48 ASSERT_EQ(4U, chain.size()); |
| 57 newintermediate_ = chain[1]; | 49 newintermediate_ = chain[1]; |
| 58 newroot_ = TrustAnchor::CreateFromCertificateNoConstraints(chain[2]); | 50 newroot_ = TrustAnchor::CreateFromCertificateNoConstraints(chain[2]); |
| 59 newrootrollover_ = chain[3]; | 51 newrootrollover_ = chain[3]; |
| 60 ASSERT_TRUE(newintermediate_); | 52 ASSERT_TRUE(newintermediate_); |
| 61 ASSERT_TRUE(newroot_); | 53 ASSERT_TRUE(newroot_); |
| 62 ASSERT_TRUE(newrootrollover_); | 54 ASSERT_TRUE(newrootrollover_); |
| 63 | 55 |
| 64 trust_store_nss_.reset( | 56 trust_store_nss_.reset(new TrustStoreNSS(trustSSL)); |
| 65 new TrustStoreNSS(trustSSL, base::ThreadTaskRunnerHandle::Get())); | |
| 66 } | 57 } |
| 67 | 58 |
| 68 std::string GetUniqueNickname() { | 59 std::string GetUniqueNickname() { |
| 69 return "trust_store_nss_unittest" + base::UintToString(nickname_counter_++); | 60 return "trust_store_nss_unittest" + base::UintToString(nickname_counter_++); |
| 70 } | 61 } |
| 71 | 62 |
| 72 void AddCertToNSS(const ParsedCertificate* cert) { | 63 void AddCertToNSS(const ParsedCertificate* cert) { |
| 73 std::string nickname = GetUniqueNickname(); | 64 std::string nickname = GetUniqueNickname(); |
| 74 ScopedCERTCertificate nss_cert( | 65 ScopedCERTCertificate nss_cert( |
| 75 X509Certificate::CreateOSCertHandleFromBytesWithNickname( | 66 X509Certificate::CreateOSCertHandleFromBytesWithNickname( |
| (...skipping 29 matching lines...) Expand all Loading... | |
| 105 | 96 |
| 106 CERTCertTrust trust = {0}; | 97 CERTCertTrust trust = {0}; |
| 107 trust.sslFlags = | 98 trust.sslFlags = |
| 108 CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA | CERTDB_VALID_CA; | 99 CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA | CERTDB_VALID_CA; |
| 109 SECStatus srv = | 100 SECStatus srv = |
| 110 CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), nss_cert.get(), &trust); | 101 CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), nss_cert.get(), &trust); |
| 111 ASSERT_EQ(SECSuccess, srv); | 102 ASSERT_EQ(SECSuccess, srv); |
| 112 } | 103 } |
| 113 | 104 |
| 114 protected: | 105 protected: |
| 115 void ExpectTrustStoreContains(tracked_objects::Location loc, | 106 void ExpectTrustStoreContains(scoped_refptr<ParsedCertificate> cert, |
| 116 scoped_refptr<ParsedCertificate> cert, | 107 TrustAnchors expected_matches) { |
| 117 TrustAnchors expected_async_matches) { | 108 TrustAnchors matches; |
| 118 SCOPED_TRACE(loc.ToString()); | 109 trust_store_nss_->FindTrustAnchorsForCert(cert, &matches); |
|
mattm
2016/10/28 02:11:55
this was so you could tell which ExpectTrustStoreC
| |
| 119 | 110 |
| 120 TrustAnchors sync_matches; | |
| 121 TrustAnchorResultRecorder anchor_results; | |
| 122 std::unique_ptr<TrustStore::Request> req; | |
| 123 trust_store_nss_->FindTrustAnchorsForCert(cert, anchor_results.Callback(), | |
| 124 &sync_matches, &req); | |
| 125 ASSERT_TRUE(req); | |
| 126 EXPECT_TRUE(sync_matches.empty()); | |
| 127 | |
| 128 anchor_results.Run(); | |
| 129 std::vector<der::Input> der_result_matches; | 111 std::vector<der::Input> der_result_matches; |
| 130 for (const auto& it : anchor_results.matches()) | 112 for (const auto& it : matches) |
| 131 der_result_matches.push_back(it->cert()->der_cert()); | 113 der_result_matches.push_back(it->cert()->der_cert()); |
| 132 std::sort(der_result_matches.begin(), der_result_matches.end()); | 114 std::sort(der_result_matches.begin(), der_result_matches.end()); |
| 133 | 115 |
| 134 std::vector<der::Input> der_expected_matches; | 116 std::vector<der::Input> der_expected_matches; |
| 135 for (const auto& it : expected_async_matches) | 117 for (const auto& it : expected_matches) |
| 136 der_expected_matches.push_back(it->cert()->der_cert()); | 118 der_expected_matches.push_back(it->cert()->der_cert()); |
| 137 std::sort(der_expected_matches.begin(), der_expected_matches.end()); | 119 std::sort(der_expected_matches.begin(), der_expected_matches.end()); |
| 138 | 120 |
| 139 EXPECT_EQ(der_expected_matches, der_result_matches); | 121 EXPECT_EQ(der_expected_matches, der_result_matches); |
| 140 } | 122 } |
| 141 | 123 |
| 142 scoped_refptr<TrustAnchor> oldroot_; | 124 scoped_refptr<TrustAnchor> oldroot_; |
| 143 scoped_refptr<TrustAnchor> newroot_; | 125 scoped_refptr<TrustAnchor> newroot_; |
| 144 | 126 |
| 145 scoped_refptr<ParsedCertificate> target_; | 127 scoped_refptr<ParsedCertificate> target_; |
| 146 scoped_refptr<ParsedCertificate> oldintermediate_; | 128 scoped_refptr<ParsedCertificate> oldintermediate_; |
| 147 scoped_refptr<ParsedCertificate> newintermediate_; | 129 scoped_refptr<ParsedCertificate> newintermediate_; |
| 148 scoped_refptr<ParsedCertificate> newrootrollover_; | 130 scoped_refptr<ParsedCertificate> newrootrollover_; |
| 149 crypto::ScopedTestNSSDB test_nssdb_; | 131 crypto::ScopedTestNSSDB test_nssdb_; |
| 150 std::unique_ptr<TrustStoreNSS> trust_store_nss_; | 132 std::unique_ptr<TrustStoreNSS> trust_store_nss_; |
| 151 unsigned nickname_counter_ = 0; | 133 unsigned nickname_counter_ = 0; |
| 152 }; | 134 }; |
| 153 | 135 |
| 154 // Without adding any certs to the NSS DB, should get no anchor results for any | 136 // Without adding any certs to the NSS DB, should get no anchor results for any |
| 155 // of the test certs. | 137 // of the test certs. |
| 156 TEST_F(TrustStoreNSSTest, CertsNotPresent) { | 138 TEST_F(TrustStoreNSSTest, CertsNotPresent) { |
| 157 ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors()); | 139 ExpectTrustStoreContains(target_, TrustAnchors()); |
| 158 ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors()); | 140 ExpectTrustStoreContains(newintermediate_, TrustAnchors()); |
| 159 ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors()); | 141 ExpectTrustStoreContains(newroot_->cert(), TrustAnchors()); |
| 160 } | 142 } |
| 161 | 143 |
| 162 // If certs are present in NSS DB but aren't marked as trusted, should get no | 144 // If certs are present in NSS DB but aren't marked as trusted, should get no |
| 163 // anchor results for any of the test certs. | 145 // anchor results for any of the test certs. |
| 164 TEST_F(TrustStoreNSSTest, CertsPresentButNotTrusted) { | 146 TEST_F(TrustStoreNSSTest, CertsPresentButNotTrusted) { |
| 165 AddCertsToNSS(); | 147 AddCertsToNSS(); |
| 166 ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors()); | 148 ExpectTrustStoreContains(newintermediate_, TrustAnchors()); |
| 167 ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors()); | 149 ExpectTrustStoreContains(target_, TrustAnchors()); |
| 168 ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors()); | 150 ExpectTrustStoreContains(newintermediate_, TrustAnchors()); |
| 169 ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors()); | 151 ExpectTrustStoreContains(newroot_->cert(), TrustAnchors()); |
| 170 } | 152 } |
| 171 | 153 |
| 172 // A self-signed CA certificate is trusted. FindTrustAnchorsForCert should | 154 // A self-signed CA certificate is trusted. FindTrustAnchorsForCert should |
| 173 // return the cert on any intermediates with a matching issuer, and on any | 155 // return the cert on any intermediates with a matching issuer, and on any |
| 174 // matching self-signed/self-issued CA certs. | 156 // matching self-signed/self-issued CA certs. |
| 175 TEST_F(TrustStoreNSSTest, TrustedCA) { | 157 TEST_F(TrustStoreNSSTest, TrustedCA) { |
| 176 AddCertsToNSS(); | 158 AddCertsToNSS(); |
| 177 TrustCert(newroot_.get()); | 159 TrustCert(newroot_.get()); |
| 178 ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors()); | 160 ExpectTrustStoreContains(target_, TrustAnchors()); |
| 179 ExpectTrustStoreContains(FROM_HERE, newintermediate_, {newroot_}); | 161 ExpectTrustStoreContains(newintermediate_, {newroot_}); |
| 180 ExpectTrustStoreContains(FROM_HERE, oldintermediate_, {newroot_}); | 162 ExpectTrustStoreContains(oldintermediate_, {newroot_}); |
| 181 ExpectTrustStoreContains(FROM_HERE, newrootrollover_, {newroot_}); | 163 ExpectTrustStoreContains(newrootrollover_, {newroot_}); |
| 182 ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), {newroot_}); | 164 ExpectTrustStoreContains(oldroot_->cert(), {newroot_}); |
| 183 ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), {newroot_}); | 165 ExpectTrustStoreContains(newroot_->cert(), {newroot_}); |
| 184 } | 166 } |
| 185 | 167 |
| 186 // When an intermediate certificate is trusted, FindTrustAnchorsForCert should | 168 // When an intermediate certificate is trusted, FindTrustAnchorsForCert should |
| 187 // return that cert on any certs issued by the intermediate, but not for the | 169 // return that cert on any certs issued by the intermediate, but not for the |
| 188 // intermediate itself (or the CAs). | 170 // intermediate itself (or the CAs). |
| 189 TEST_F(TrustStoreNSSTest, TrustedIntermediate) { | 171 TEST_F(TrustStoreNSSTest, TrustedIntermediate) { |
| 190 AddCertsToNSS(); | 172 AddCertsToNSS(); |
| 191 TrustCert(newintermediate_.get()); | 173 TrustCert(newintermediate_.get()); |
| 192 ExpectTrustStoreContains( | 174 ExpectTrustStoreContains( |
| 193 FROM_HERE, target_, | 175 target_, |
| 194 {TrustAnchor::CreateFromCertificateNoConstraints(newintermediate_)}); | 176 {TrustAnchor::CreateFromCertificateNoConstraints(newintermediate_)}); |
| 195 ExpectTrustStoreContains(FROM_HERE, newintermediate_, TrustAnchors()); | 177 ExpectTrustStoreContains(newintermediate_, TrustAnchors()); |
| 196 ExpectTrustStoreContains(FROM_HERE, oldintermediate_, TrustAnchors()); | 178 ExpectTrustStoreContains(oldintermediate_, TrustAnchors()); |
| 197 ExpectTrustStoreContains(FROM_HERE, newrootrollover_, TrustAnchors()); | 179 ExpectTrustStoreContains(newrootrollover_, TrustAnchors()); |
| 198 ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), TrustAnchors()); | 180 ExpectTrustStoreContains(oldroot_->cert(), TrustAnchors()); |
| 199 ExpectTrustStoreContains(FROM_HERE, newroot_->cert(), TrustAnchors()); | 181 ExpectTrustStoreContains(newroot_->cert(), TrustAnchors()); |
| 200 } | 182 } |
| 201 | 183 |
| 202 // Multiple self-signed CA certificates with the same name are trusted. | 184 // Multiple self-signed CA certificates with the same name are trusted. |
| 203 // FindTrustAnchorsForCert should return all these certs on any intermediates | 185 // FindTrustAnchorsForCert should return all these certs on any intermediates |
| 204 // with a matching issuer, and on any matching self-signed/self-issued CA certs. | 186 // with a matching issuer, and on any matching self-signed/self-issued CA certs. |
| 205 TEST_F(TrustStoreNSSTest, MultipleTrustedCAWithSameSubject) { | 187 TEST_F(TrustStoreNSSTest, MultipleTrustedCAWithSameSubject) { |
| 206 AddCertsToNSS(); | 188 AddCertsToNSS(); |
| 207 TrustCert(oldroot_.get()); | 189 TrustCert(oldroot_.get()); |
| 208 TrustCert(newroot_.get()); | 190 TrustCert(newroot_.get()); |
| 209 ExpectTrustStoreContains(FROM_HERE, target_, TrustAnchors()); | 191 ExpectTrustStoreContains(target_, TrustAnchors()); |
| 210 ExpectTrustStoreContains(FROM_HERE, newintermediate_, {newroot_, oldroot_}); | 192 ExpectTrustStoreContains(newintermediate_, {newroot_, oldroot_}); |
| 211 ExpectTrustStoreContains(FROM_HERE, oldintermediate_, {newroot_, oldroot_}); | 193 ExpectTrustStoreContains(oldintermediate_, {newroot_, oldroot_}); |
| 212 ExpectTrustStoreContains(FROM_HERE, oldroot_->cert(), {newroot_, oldroot_}); | 194 ExpectTrustStoreContains(oldroot_->cert(), {newroot_, oldroot_}); |
| 213 } | |
| 214 | |
| 215 // Cancel a FindTrustAnchorsForCert request before it has returned any results. | |
| 216 // Callback should not be called. | |
| 217 TEST_F(TrustStoreNSSTest, CancelRequest) { | |
| 218 std::unique_ptr<TrustStore::Request> req; | |
| 219 TrustAnchors sync_matches; | |
| 220 trust_store_nss_->FindTrustAnchorsForCert(target_, base::Bind(&NotCalled), | |
| 221 &sync_matches, &req); | |
| 222 ASSERT_TRUE(req); | |
| 223 req.reset(); | |
| 224 base::RunLoop().RunUntilIdle(); | |
| 225 } | |
| 226 | |
| 227 // Cancel a FindTrustAnchorsForCert request during the callback. Should not | |
| 228 // crash. | |
| 229 TEST_F(TrustStoreNSSTest, CancelRequestDuringCallback) { | |
| 230 AddCertsToNSS(); | |
| 231 TrustCert(newroot_.get()); | |
| 232 | |
| 233 base::RunLoop run_loop; | |
| 234 std::unique_ptr<TrustStore::Request> req; | |
| 235 TrustAnchors sync_matches; | |
| 236 trust_store_nss_->FindTrustAnchorsForCert( | |
| 237 newintermediate_, | |
| 238 base::Bind(&TrustStoreRequestDeleter, &req, run_loop.QuitClosure()), | |
| 239 &sync_matches, &req); | |
| 240 ASSERT_TRUE(req); | |
| 241 run_loop.Run(); | |
| 242 ASSERT_FALSE(req); | |
| 243 base::RunLoop().RunUntilIdle(); | |
| 244 } | 195 } |
| 245 | 196 |
| 246 } // namespace | 197 } // namespace |
| 247 | 198 |
| 248 } // namespace net | 199 } // namespace net |
| OLD | NEW |