Enable client certificate patterns in device ONC policy

chromeos/cert_loader_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/cert_loader.h"
 
 #include <stddef.h>
 
 #include <memory>
 #include <utility>
@@ skipping 62 matching lines @@
 
  protected:
   void StartCertLoaderWithPrimaryDB() {
     CreateCertDatabase(&primary_db_, &primary_certdb_);
     cert_loader_->StartWithNSSDB(primary_certdb_.get());
 
     base::RunLoop().RunUntilIdle();
     GetAndResetCertificatesLoadedEventsCount();
   }
 
+  void StartCertLoaderWithPrimaryDBAndSystemToken() {
+    CreateCertDatabase(&primary_db_, &primary_certdb_);
+    AddSystemToken(primary_certdb_.get());
+    cert_loader_->StartWithNSSDB(primary_certdb_.get());
+
+    base::RunLoop().RunUntilIdle();
+    GetAndResetCertificatesLoadedEventsCount();
+  }
+
   // CertLoader::Observer:
   // The test keeps count of times the observer method was called.
   void OnCertificatesLoaded(const net::CertificateList& cert_list,
                             bool initial_load) override {
     EXPECT_TRUE(certificates_loaded_events_count_ == 0 || !initial_load);
     certificates_loaded_events_count_++;
   }
 
   // Returns the number of |OnCertificatesLoaded| calls observed since the
   // last call to this method equals |value|.
   size_t GetAndResetCertificatesLoadedEventsCount() {
     size_t result = certificates_loaded_events_count_;
     certificates_loaded_events_count_ = 0;
     return result;
   }
 
   void CreateCertDatabase(crypto::ScopedTestNSSDB* db,
                           std::unique_ptr<TestNSSCertDatabase>* certdb) {
     ASSERT_TRUE(db->is_open());
 
     certdb->reset(new TestNSSCertDatabase(
         crypto::ScopedPK11Slot(PK11_ReferenceSlot(db->slot())),
         crypto::ScopedPK11Slot(PK11_ReferenceSlot(db->slot()))));
     (*certdb)->SetSlowTaskRunnerForTest(message_loop_.task_runner());
   }
 
+  void AddSystemToken(TestNSSCertDatabase* certdb) {

[emaxx, 2017/04/20 20:10:39]

nit: As this method is not going to be used from the tests themselves, better
move it to private.

[pmarko, 2017/04/24 14:49:56]

Done.

+    ASSERT_TRUE(system_db_.is_open());
+    certdb->SetSystemSlot(
+        crypto::ScopedPK11Slot(PK11_ReferenceSlot(system_db_.slot())));
+  }
+
   void ImportCACert(const std::string& cert_file,
                     net::NSSCertDatabase* database,
                     net::CertificateList* imported_certs) {
     ASSERT_TRUE(database);
     ASSERT_TRUE(imported_certs);
 
     *imported_certs = net::CreateCertificateListFromFile(
         net::GetTestCertsDirectory(),
         cert_file,
         net::X509Certificate::FORMAT_AUTO);
     ASSERT_EQ(1U, imported_certs->size());
 
     net::NSSCertDatabase::ImportCertFailureList failed;
     ASSERT_TRUE(database->ImportCACerts(*imported_certs,
                                         net::NSSCertDatabase::TRUST_DEFAULT,
                                         &failed));
     ASSERT_TRUE(failed.empty());
   }
 
+  // Import a client cert and key into a PKCS 11 slot. Then notify

[emaxx, 2017/04/20 20:10:39]

nit: s/PKCS 11/PKCS11/

[pmarko, 2017/04/24 14:49:55]

Done.

+  // |database_to_notify| (which is presumably using that slot) that new
+  // certificates are available.
   scoped_refptr<net::X509Certificate> ImportClientCertAndKey(
-      TestNSSCertDatabase* database) {
+      TestNSSCertDatabase* database_to_notify,
+      PK11SlotInfo* slot_to_use) {
     // Import a client cert signed by that CA.
     scoped_refptr<net::X509Certificate> client_cert(
         net::ImportClientCertAndKeyFromFile(net::GetTestCertsDirectory(),
                                             "client_1.pem", "client_1.pk8",
-                                            database->GetPrivateSlot().get()));
-    database->NotifyOfCertAdded(client_cert.get());
+                                            slot_to_use));
+    database_to_notify->NotifyOfCertAdded(client_cert.get());

[emaxx, 2017/04/20 20:10:39]

Looks like this parameter is actually unused, so proposing to do a small clean
up (remove this parameter from NotifyOfCertAdded, maybe rename the method,
etc.).

[pmarko, 2017/04/24 14:49:55]

Done.

     return client_cert;
   }
 
+  // Import a client cert into |database|'s private slot.
+  scoped_refptr<net::X509Certificate> ImportClientCertAndKey(
+      TestNSSCertDatabase* database) {
+    return ImportClientCertAndKey(database, database->GetPrivateSlot().get());
+  }
+
   CertLoader* cert_loader_;
 
   // The user is primary as the one whose certificates CertLoader handles, it
   // has nothing to do with crypto::InitializeNSSForChromeOSUser is_primary_user
   // parameter (which is irrelevant for these tests).
   crypto::ScopedTestNSSDB primary_db_;
   std::unique_ptr<TestNSSCertDatabase> primary_certdb_;
 
+  // Additional NSS DB simulating the system token.
+  crypto::ScopedTestNSSDB system_db_;
+
   base::MessageLoop message_loop_;
 
  private:
   size_t certificates_loaded_events_count_;
 };
 
 }  // namespace
 
 TEST_F(CertLoaderTest, Basic) {
   EXPECT_FALSE(cert_loader_->CertificatesLoading());
@@ skipping 61 matching lines @@
   scoped_refptr<net::X509Certificate> cert(
       ImportClientCertAndKey(primary_certdb_.get()));
 
   ASSERT_EQ(0U, GetAndResetCertificatesLoadedEventsCount());
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(1U, GetAndResetCertificatesLoadedEventsCount());
 
   EXPECT_TRUE(IsCertInCertificateList(cert.get(), cert_loader_->cert_list()));
 }
 
+TEST_F(CertLoaderTest, ClientLoaderUpdateOnNewClientCertInSystemToken) {
+  StartCertLoaderWithPrimaryDBAndSystemToken();
+
+  EXPECT_TRUE(cert_loader_->system_cert_list().empty());
+  scoped_refptr<net::X509Certificate> cert(ImportClientCertAndKey(
+      primary_certdb_.get(), primary_certdb_->GetSystemSlot().get()));
+
+  ASSERT_EQ(0U, GetAndResetCertificatesLoadedEventsCount());
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(1U, GetAndResetCertificatesLoadedEventsCount());
+
+  EXPECT_TRUE(IsCertInCertificateList(cert.get(), cert_loader_->cert_list()));
+  EXPECT_EQ(1U, cert_loader_->system_cert_list().size());
+  EXPECT_TRUE(
+      IsCertInCertificateList(cert.get(), cert_loader_->system_cert_list()));
+}
+
 TEST_F(CertLoaderTest, CertLoaderNoUpdateOnNewClientCertInSecondaryDb) {
   crypto::ScopedTestNSSDB secondary_db;
   std::unique_ptr<TestNSSCertDatabase> secondary_certdb;
 
   StartCertLoaderWithPrimaryDB();
   CreateCertDatabase(&secondary_db, &secondary_certdb);
 
   scoped_refptr<net::X509Certificate> cert(
       ImportClientCertAndKey(secondary_certdb.get()));
 
@@ skipping 39 matching lines @@
   ASSERT_TRUE(primary_certdb_->SetCertTrust(certs[0].get(), net::CA_CERT,
                                             net::NSSCertDatabase::TRUSTED_SSL));
 
   // Cert trust change should trigger certificate reload in cert_loader_.
   ASSERT_EQ(0U, GetAndResetCertificatesLoadedEventsCount());
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(1U, GetAndResetCertificatesLoadedEventsCount());
 }
 
 }  // namespace chromeos