Improvements to the net/cert/internal error handling.

net/cert/internal/path_builder_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/path_builder.h"
 
 #include "base/base_paths.h"
 #include "base/files/file_util.h"
 #include "base/path_service.h"
 #include "net/cert/internal/cert_issuer_source_static.h"
@@ skipping 200 matching lines @@
   CertPathBuilder::Result result;
   CertPathBuilder path_builder(b_by_c_, &trust_store, &signature_policy_,
                                expired_time, &result);
   path_builder.AddCertIssuerSource(&sync_certs);
 
   path_builder.Run();
 
   EXPECT_FALSE(result.HasValidPath());
   ASSERT_EQ(2U, result.paths.size());
 
-  EXPECT_FALSE(result.paths[0]->valid);
+  EXPECT_FALSE(result.paths[0]->IsValid());
   const auto& path0 = result.paths[0]->path;
   ASSERT_EQ(2U, path0.certs.size());
   EXPECT_EQ(b_by_c_, path0.certs[0]);
   EXPECT_EQ(c_by_d_, path0.certs[1]);
   EXPECT_EQ(d_by_d_, path0.trust_anchor->cert());
 
   const auto& path1 = result.paths[1]->path;
   ASSERT_EQ(3U, path1.certs.size());
   EXPECT_EQ(b_by_c_, path1.certs[0]);
   EXPECT_EQ(c_by_d_, path1.certs[1]);
@@ skipping 272 matching lines @@
   path_builder.AddCertIssuerSource(&sync_certs);
 
   path_builder.Run();
 
   EXPECT_TRUE(result.HasValidPath());
 
   // Path builder will first attempt: target <- newintermediate <- oldroot
   // but it will fail since newintermediate is signed by newroot.
   ASSERT_EQ(2U, result.paths.size());
   const auto& path0 = result.paths[0]->path;
-  EXPECT_FALSE(result.paths[0]->valid);
+  EXPECT_FALSE(result.paths[0]->IsValid());
   ASSERT_EQ(2U, path0.certs.size());
   EXPECT_EQ(target_, path0.certs[0]);
   EXPECT_EQ(newintermediate_, path0.certs[1]);
   EXPECT_EQ(oldroot_, path0.trust_anchor);
 
   // Path builder will next attempt:
   // target <- newintermediate <- newrootrollover <- oldroot
   // which will succeed.
   const auto& path1 = result.paths[1]->path;
   EXPECT_EQ(1U, result.best_result_index);
-  EXPECT_TRUE(result.paths[1]->valid);
+  EXPECT_TRUE(result.paths[1]->IsValid());
   ASSERT_EQ(3U, path1.certs.size());
   EXPECT_EQ(target_, path1.certs[0]);
   EXPECT_EQ(newintermediate_, path1.certs[1]);
   EXPECT_EQ(newrootrollover_, path1.certs[2]);
   EXPECT_EQ(oldroot_, path1.trust_anchor);
 }
 
 // Tests that if both old and new roots are trusted it can build a path through
 // either.
 // TODO(mattm): Once prioritization is implemented, it should test that it
@@ skipping 18 matching lines @@
   path_builder.Run();
 
   EXPECT_TRUE(result.HasValidPath());
 
   // Path builder willattempt one of:
   // target <- oldintermediate <- oldroot
   // target <- newintermediate <- newroot
   // either will succeed.
   ASSERT_EQ(1U, result.paths.size());
   const auto& path = result.paths[0]->path;
-  EXPECT_TRUE(result.paths[0]->valid);
+  EXPECT_TRUE(result.paths[0]->IsValid());
   ASSERT_EQ(2U, path.certs.size());
   EXPECT_EQ(target_, path.certs[0]);
   if (path.certs[1] != newintermediate_) {
     DVLOG(1) << "USED OLD";
     EXPECT_EQ(oldintermediate_, path.certs[1]);
     EXPECT_EQ(oldroot_, path.trust_anchor);
   } else {
     DVLOG(1) << "USED NEW";
     EXPECT_EQ(newintermediate_, path.certs[1]);
     EXPECT_EQ(newroot_, path.trust_anchor->cert());
@@ skipping 45 matching lines @@
   path_builder.AddCertIssuerSource(&sync_certs);
 
   path_builder.Run();
 
   EXPECT_TRUE(result.HasValidPath());
   ASSERT_EQ(2U, result.paths.size());
 
   {
     // Path builder may first attempt: target <- oldintermediate <- newroot
     // but it will fail since oldintermediate is signed by oldroot.
-    EXPECT_FALSE(result.paths[0]->valid);
+    EXPECT_FALSE(result.paths[0]->IsValid());
     const auto& path = result.paths[0]->path;
     ASSERT_EQ(2U, path.certs.size());
     EXPECT_EQ(target_, path.certs[0]);
     EXPECT_EQ(oldintermediate_, path.certs[1]);
     EXPECT_EQ(newroot_, path.trust_anchor->cert());
   }
 
   {
     // Path builder will next attempt:
     // target <- old intermediate <- oldroot
     // which should succeed.
-    EXPECT_TRUE(result.paths[result.best_result_index]->valid);
+    EXPECT_TRUE(result.paths[result.best_result_index]->IsValid());
     const auto& path = result.paths[result.best_result_index]->path;
     ASSERT_EQ(2U, path.certs.size());
     EXPECT_EQ(target_, path.certs[0]);
     EXPECT_EQ(oldintermediate_, path.certs[1]);
     EXPECT_EQ(oldroot_, path.trust_anchor);
   }
 }
 
 // Tests that the path builder doesn't build longer than necessary paths.
 TEST_F(PathBuilderKeyRolloverTest, TestRolloverLongChain) {
@@ skipping 17 matching lines @@
   path_builder.AddCertIssuerSource(&sync_certs);
   path_builder.AddCertIssuerSource(&async_certs);
 
   path_builder.Run();
 
   EXPECT_TRUE(result.HasValidPath());
   ASSERT_EQ(3U, result.paths.size());
 
   // Path builder will first attempt: target <- newintermediate <- oldroot
   // but it will fail since newintermediate is signed by newroot.
-  EXPECT_FALSE(result.paths[0]->valid);
+  EXPECT_FALSE(result.paths[0]->IsValid());
   const auto& path0 = result.paths[0]->path;
   ASSERT_EQ(2U, path0.certs.size());
   EXPECT_EQ(target_, path0.certs[0]);
   EXPECT_EQ(newintermediate_, path0.certs[1]);
   EXPECT_EQ(oldroot_, path0.trust_anchor);
 
   // Path builder will next attempt:
   // target <- newintermediate <- newroot <- oldroot
   // but it will fail since newroot is self-signed.
-  EXPECT_FALSE(result.paths[1]->valid);
+  EXPECT_FALSE(result.paths[1]->IsValid());
   const auto& path1 = result.paths[1]->path;
   ASSERT_EQ(3U, path1.certs.size());
   EXPECT_EQ(target_, path1.certs[0]);
   EXPECT_EQ(newintermediate_, path1.certs[1]);
   EXPECT_EQ(newroot_, path1.certs[2]);
   EXPECT_EQ(oldroot_, path1.trust_anchor);
 
   // Path builder will skip:
   // target <- newintermediate <- newroot <- newrootrollover <- ...
   // Since newroot and newrootrollover have the same Name+SAN+SPKI.
 
   // Finally path builder will use:
   // target <- newintermediate <- newrootrollover <- oldroot
   EXPECT_EQ(2U, result.best_result_index);
-  EXPECT_TRUE(result.paths[2]->valid);
+  EXPECT_TRUE(result.paths[2]->IsValid());
   const auto& path2 = result.paths[2]->path;
   ASSERT_EQ(3U, path2.certs.size());
   EXPECT_EQ(target_, path2.certs[0]);
   EXPECT_EQ(newintermediate_, path2.certs[1]);
   EXPECT_EQ(newrootrollover_, path2.certs[2]);
   EXPECT_EQ(oldroot_, path2.trust_anchor);
 }
 
 // If the target cert is a trust anchor, however is not itself *signed* by a
 // trust anchor, then it is not considered valid (the SPKI and name of the
@@ skipping 55 matching lines @@
                                time_, &result);
 
   path_builder.Run();
 
   ASSERT_TRUE(result.HasValidPath());
 
   const CertPathBuilder::ResultPath* best_result = result.GetBestValidPath();
 
   // Newroot has same name+SPKI as newrootrollover, thus the path is valid and
   // only contains newroot.
-  EXPECT_TRUE(best_result->valid);
+  EXPECT_TRUE(best_result->IsValid());
   ASSERT_EQ(1U, best_result->path.certs.size());
   EXPECT_EQ(newroot_, best_result->path.certs[0]);
   EXPECT_EQ(newrootrollover_, best_result->path.trust_anchor->cert());
 }
 
 // Test that PathBuilder will not try the same path twice if multiple
 // CertIssuerSources provide the same certificate.
 TEST_F(PathBuilderKeyRolloverTest, TestDuplicateIntermediates) {
   // Create a separate copy of oldintermediate.
   scoped_refptr<ParsedCertificate> oldintermediate_dupe(
@@ skipping 29 matching lines @@
   path_builder.AddCertIssuerSource(&sync_certs2);
   path_builder.AddCertIssuerSource(&async_certs);
 
   path_builder.Run();
 
   EXPECT_TRUE(result.HasValidPath());
   ASSERT_EQ(2U, result.paths.size());
 
   // Path builder will first attempt: target <- oldintermediate <- newroot
   // but it will fail since oldintermediate is signed by oldroot.
-  EXPECT_FALSE(result.paths[0]->valid);
+  EXPECT_FALSE(result.paths[0]->IsValid());
   const auto& path0 = result.paths[0]->path;
 
   ASSERT_EQ(2U, path0.certs.size());
   EXPECT_EQ(target_, path0.certs[0]);
   // Compare the DER instead of ParsedCertificate pointer, don't care which copy
   // of oldintermediate was used in the path.
   EXPECT_EQ(oldintermediate_->der_cert(), path0.certs[1]->der_cert());
   EXPECT_EQ(newroot_, path0.trust_anchor->cert());
 
   // Path builder will next attempt: target <- newintermediate <- newroot
   // which will succeed.
   EXPECT_EQ(1U, result.best_result_index);
-  EXPECT_TRUE(result.paths[1]->valid);
+  EXPECT_TRUE(result.paths[1]->IsValid());
   const auto& path1 = result.paths[1]->path;
   ASSERT_EQ(2U, path1.certs.size());
   EXPECT_EQ(target_, path1.certs[0]);
   EXPECT_EQ(newintermediate_, path1.certs[1]);
   EXPECT_EQ(newroot_, path1.trust_anchor->cert());
 }
 
 // Test when PathBuilder is given a cert CertIssuerSources that has the same
 // SPKI as a TrustAnchor.
 TEST_F(PathBuilderKeyRolloverTest, TestDuplicateIntermediateAndRoot) {
@@ skipping 19 matching lines @@
   path_builder.AddCertIssuerSource(&sync_certs);
 
   path_builder.Run();
 
   EXPECT_FALSE(result.HasValidPath());
   ASSERT_EQ(2U, result.paths.size());
   // TODO(eroman): Is this right?
 
   // Path builder attempt: target <- oldintermediate <- newroot
   // but it will fail since oldintermediate is signed by oldroot.
-  EXPECT_FALSE(result.paths[0]->valid);
+  EXPECT_FALSE(result.paths[0]->IsValid());
   const auto& path = result.paths[0]->path;
   ASSERT_EQ(2U, path.certs.size());
   EXPECT_EQ(target_, path.certs[0]);
   EXPECT_EQ(oldintermediate_, path.certs[1]);
   // Compare the DER instead of ParsedCertificate pointer, don't care which copy
   // of newroot was used in the path.
   EXPECT_EQ(newroot_->der_cert(), path.trust_anchor->cert()->der_cert());
 }
 
 class MockCertIssuerSourceRequest : public CertIssuerSource::Request {
@@ skipping 94 matching lines @@
   // Note that VerifyAndClearExpectations(target_issuers_req) is not called
   // here. PathBuilder could have destroyed it already, so just let the
   // expectations get checked by the destructor.
   ::testing::Mock::VerifyAndClearExpectations(&cert_issuer_source);
 
   EXPECT_TRUE(result.HasValidPath());
   ASSERT_EQ(2U, result.paths.size());
 
   // Path builder first attempts: target <- oldintermediate <- newroot
   // but it will fail since oldintermediate is signed by oldroot.
-  EXPECT_FALSE(result.paths[0]->valid);
+  EXPECT_FALSE(result.paths[0]->IsValid());
   const auto& path0 = result.paths[0]->path;
   ASSERT_EQ(2U, path0.certs.size());
   EXPECT_EQ(target_, path0.certs[0]);
   EXPECT_EQ(oldintermediate_, path0.certs[1]);
   EXPECT_EQ(newroot_, path0.trust_anchor->cert());
 
   // After the second batch of async results, path builder will attempt:
   // target <- newintermediate <- newroot which will succeed.
-  EXPECT_TRUE(result.paths[1]->valid);
+  EXPECT_TRUE(result.paths[1]->IsValid());
   const auto& path1 = result.paths[1]->path;
   ASSERT_EQ(2U, path1.certs.size());
   EXPECT_EQ(target_, path1.certs[0]);
   EXPECT_EQ(newintermediate_, path1.certs[1]);
   EXPECT_EQ(newroot_, path1.trust_anchor->cert());
 }
 
 // Test that PathBuilder will not try the same path twice if CertIssuerSources
 // asynchronously provide the same certificate multiple times.
 TEST_F(PathBuilderKeyRolloverTest, TestDuplicateAsyncIntermediates) {
@@ skipping 56 matching lines @@
   // Ensure pathbuilder finished and filled result.
   path_builder.Run();
 
   ::testing::Mock::VerifyAndClearExpectations(&cert_issuer_source);
 
   EXPECT_TRUE(result.HasValidPath());
   ASSERT_EQ(2U, result.paths.size());
 
   // Path builder first attempts: target <- oldintermediate <- newroot
   // but it will fail since oldintermediate is signed by oldroot.
-  EXPECT_FALSE(result.paths[0]->valid);
+  EXPECT_FALSE(result.paths[0]->IsValid());
   const auto& path0 = result.paths[0]->path;
   ASSERT_EQ(2U, path0.certs.size());
   EXPECT_EQ(target_, path0.certs[0]);
   EXPECT_EQ(oldintermediate_, path0.certs[1]);
   EXPECT_EQ(newroot_, path0.trust_anchor->cert());
 
   // The second async result does not generate any path.
 
   // After the third batch of async results, path builder will attempt:
   // target <- newintermediate <- newroot which will succeed.
-  EXPECT_TRUE(result.paths[1]->valid);
+  EXPECT_TRUE(result.paths[1]->IsValid());
   const auto& path1 = result.paths[1]->path;
   ASSERT_EQ(2U, path1.certs.size());
   EXPECT_EQ(target_, path1.certs[0]);
   EXPECT_EQ(newintermediate_, path1.certs[1]);
   EXPECT_EQ(newroot_, path1.trust_anchor->cert());
 }
 
 }  // namespace
 
 }  // namespace net