Add initial CertVerifyProcBuiltin.

net/cert/cert_verify_proc_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include <vector>
 
 #include "base/callback_helpers.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/sha1.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/test/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "crypto/sha2.h"
 #include "net/base/net_errors.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
+#include "net/cert/cert_verify_proc_builtin.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/crl_set.h"
 #include "net/cert/crl_set_storage.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/cert/test_root_certs.h"
 #include "net/cert/x509_certificate.h"
 #include "net/der/input.h"
 #include "net/der/parser.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/gtest_util.h"
@@ skipping 72 matching lines @@
 //
 // The type is erased by CertVerifyProc::CreateDefault(), however
 // needs to be known for some of the test expectations.
 enum CertVerifyProcType {
   CERT_VERIFY_PROC_NSS,
   CERT_VERIFY_PROC_OPENSSL,
   CERT_VERIFY_PROC_ANDROID,
   CERT_VERIFY_PROC_IOS,
   CERT_VERIFY_PROC_MAC,
   CERT_VERIFY_PROC_WIN,
+  CERT_VERIFY_PROC_BUILTIN,
 };
 
 // Returns the CertVerifyProcType corresponding to what
 // CertVerifyProc::CreateDefault() returns. This needs to be kept in sync with
 // CreateDefault().
 CertVerifyProcType GetDefaultCertVerifyProcType() {
 #if defined(USE_NSS_CERTS)
   return CERT_VERIFY_PROC_NSS;
 #elif defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID)
   return CERT_VERIFY_PROC_OPENSSL;
@@ skipping 29 matching lines @@
     case CERT_VERIFY_PROC_OPENSSL:
       return "CertVerifyProcOpenSSL";
     case CERT_VERIFY_PROC_ANDROID:
       return "CertVerifyProcAndroid";
     case CERT_VERIFY_PROC_IOS:
       return "CertVerifyProcIOS";
     case CERT_VERIFY_PROC_MAC:
       return "CertVerifyProcMac";
     case CERT_VERIFY_PROC_WIN:
       return "CertVerifyProcWin";
+    case CERT_VERIFY_PROC_BUILTIN:
+      return "CertVerifyProcBuiltin";
   }
 
   return nullptr;
 }
 
 // The set of all CertVerifyProcTypes that tests should be
 // parameterized on.
 const std::vector<CertVerifyProcType> kAllCertVerifiers = {
-    GetDefaultCertVerifyProcType()};
+    GetDefaultCertVerifyProcType()
+
+// TODO(crbug.com/649017): Enable this everywhere. Right now this is
+// gated on having CertVerifyProcBuiltin understand the roots added
+// via TestRootCerts.
+#if defined(USE_NSS_CERTS)
+        ,
+    CERT_VERIFY_PROC_BUILTIN
+#endif
+};
 
 }  // namespace
 
 // This fixture is for tests that apply to concrete implementations of
-// CertVerifyProc. It will be run for all of the concrete
-// CertVerifyProc types.
+// CertVerifyProc. It will be run for all of the concrete CertVerifyProc types.
 //
 // It is called "Internal" as it tests the internal methods like
 // "VerifyInternal()".
 class CertVerifyProcInternalTest
     : public testing::TestWithParam<CertVerifyProcType> {
  protected:
   void SetUp() override {
-    EXPECT_EQ(verify_proc_type(), GetDefaultCertVerifyProcType());
-    verify_proc_ = CertVerifyProc::CreateDefault();
+    CertVerifyProcType type = verify_proc_type();
+    if (type == CERT_VERIFY_PROC_BUILTIN) {
+      verify_proc_ = CreateCertVerifyProcBuiltin();
+    } else if (type == GetDefaultCertVerifyProcType()) {
+      verify_proc_ = CertVerifyProc::CreateDefault();
+    } else {
+      ADD_FAILURE() << "Unhandled CertVerifyProcType";
+    }
   }
 
   int Verify(X509Certificate* cert,
              const std::string& hostname,
              int flags,
              CRLSet* crl_set,
              const CertificateList& additional_trust_anchors,
              CertVerifyResult* verify_result) {
     return verify_proc_->Verify(cert, hostname, std::string(), flags, crl_set,
                                 additional_trust_anchors, verify_result);
@@ skipping 37 matching lines @@
     // (recoverable) invalid certificate errors.
     if (verify_proc_type() == CERT_VERIFY_PROC_MAC &&
         base::mac::IsAtLeastOS10_12()) {
       return true;
     }
 #endif
     return false;
   }
 
   bool SupportsCRLSet() const {
+    // TODO(crbug.com/649017): Return true for CERT_VERIFY_PROC_BUILTIN.
     return verify_proc_type() == CERT_VERIFY_PROC_NSS ||
            verify_proc_type() == CERT_VERIFY_PROC_WIN ||
            verify_proc_type() == CERT_VERIFY_PROC_MAC;
   }
 
   bool SupportsCRLSetsInPathBuilding() const {
+    // TODO(crbug.com/649017): Return true for CERT_VERIFY_PROC_BUILTIN.
     return verify_proc_type() == CERT_VERIFY_PROC_WIN ||
            verify_proc_type() == CERT_VERIFY_PROC_NSS;
   }
 
   CertVerifyProc* verify_proc() const { return verify_proc_.get(); }
 
  private:
   scoped_refptr<CertVerifyProc> verify_proc_;
 };
 
@@ skipping 860 matching lines @@
 
   // |public_key_hashes| does not have an ordering guarantee.
   EXPECT_THAT(expected_public_key_hashes,
               testing::UnorderedElementsAreArray(public_key_hash_strings));
 }
 
 // A regression test for http://crbug.com/70293.
 // The Key Usage extension in this RSA SSL server certificate does not have
 // the keyEncipherment bit.
 TEST_P(CertVerifyProcInternalTest, InvalidKeyUsage) {
+  if (verify_proc_type() == CERT_VERIFY_PROC_BUILTIN) {
+    LOG(INFO) << "TODO(crbug.com/649017): Skipping test as not yet implemented "
+                 "in builting verifier";
+    return;
+  }
   base::FilePath certs_dir = GetTestCertsDirectory();
 
   scoped_refptr<X509Certificate> server_cert =
       ImportCertFromFile(certs_dir, "invalid_key_usage_cert.der");
   ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get());
 
   int flags = 0;
   CertVerifyResult verify_result;
   int error = Verify(server_cert.get(), "jira.aquameta.com", flags, NULL,
                      CertificateList(), &verify_result);
@@ skipping 1168 matching lines @@
   int flags = 0;
   CertVerifyResult verify_result;
   int error = verify_proc->Verify(cert.get(), "127.0.0.1", std::string(), flags,
                                   NULL, CertificateList(), &verify_result);
   EXPECT_EQ(OK, error);
   histograms.ExpectTotalCount(kTLSFeatureExtensionHistogram, 0);
   histograms.ExpectTotalCount(kTLSFeatureExtensionOCSPHistogram, 0);
 }
 
 }  // namespace net