Add tests for PathBuilder when certificates are distrusted.

net/cert/internal/path_builder_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/path_builder.h"
 
 #include "base/base_paths.h"
 #include "base/files/file_util.h"
 #include "base/path_service.h"
 #include "net/cert/internal/cert_issuer_source_static.h"
@@ skipping 415 matching lines @@
 }
 
 class PathBuilderKeyRolloverTest : public ::testing::Test {
  public:
   PathBuilderKeyRolloverTest() : signature_policy_(1024) {}
 
   void SetUp() override {
     ParsedCertificateList path;
 
     VerifyCertChainTest test;
-    ReadVerifyCertChainTestFromFile(
+    ASSERT_TRUE(ReadVerifyCertChainTestFromFile(
         "net/data/verify_certificate_chain_unittest/key-rollover/oldchain.test",
-        &test);
+        &test));
     path = test.chain;
     ASSERT_EQ(3U, path.size());
     target_ = path[0];
     oldintermediate_ = path[1];
     oldroot_ = path[2];
     time_ = test.time;
 
     ASSERT_TRUE(target_);
     ASSERT_TRUE(oldintermediate_);
 
-    ReadVerifyCertChainTestFromFile(
+    ASSERT_TRUE(ReadVerifyCertChainTestFromFile(
         "net/data/verify_certificate_chain_unittest/"
         "key-rollover/longrolloverchain.test",
-        &test);
+        &test));
     path = test.chain;
 
     ASSERT_EQ(5U, path.size());
     newintermediate_ = path[1];
     newroot_ = path[2];
     newrootrollover_ = path[3];
     ASSERT_TRUE(newintermediate_);
     ASSERT_TRUE(newroot_);
     ASSERT_TRUE(newrootrollover_);
   }
@@ skipping 627 matching lines @@
   // After the third batch of async results, path builder will attempt:
   // target <- newintermediate <- newroot which will succeed.
   EXPECT_TRUE(result.paths[1]->IsValid());
   const auto& path1 = result.paths[1]->path;
   ASSERT_EQ(3U, path1.certs.size());
   EXPECT_EQ(target_, path1.certs[0]);
   EXPECT_EQ(newintermediate_, path1.certs[1]);
   EXPECT_EQ(newroot_, path1.certs[2]);
 }
 
+// Test fixture for running the path builder over a simple chain, while varying
+// the trustedness of certain certificates.
+class PathBuilderDistrustTest : public ::testing::Test {
+ public:
+  PathBuilderDistrustTest() {}
+
+ protected:
+  void SetUp() override {
+    // Read a simple test chain comprised of a target, intermediate, and root.
+    ASSERT_TRUE(ReadVerifyCertChainTestFromFile(
+        "net/data/verify_certificate_chain_unittest/target-and-intermediate/"
+        "main.test",
+        &test_));
+    ASSERT_EQ(3u, test_.chain.size());
+  }
+
+  // Runs the path builder for the target certificate while |distrusted_cert| is
+  // blacklisted.
+  void RunPathBuilder(const scoped_refptr<ParsedCertificate>& distrusted_cert,

[mattm, 2017/05/04 02:30:01]

tests might read more naturally if this was named something like
RunPathBuilderWithDistrustedCert

[eroman, 2017/05/04 16:34:52]

Done.

+                      CertPathBuilder::Result* result) {
+    ASSERT_EQ(3u, test_.chain.size());
+
+    // Set up the trust store such that |distrusted_cert| is blacklisted, and
+    // the root is trusted (except if it was |distrusted_cert|).
+    TrustStoreInMemory trust_store;
+    if (distrusted_cert != test_.chain.back())
+      trust_store.AddTrustAnchor(test_.chain.back());
+    if (distrusted_cert)
+      trust_store.AddDistrustedCertificateForTest(distrusted_cert);
+
+    // Add the single intermediate.
+    CertIssuerSourceStatic intermediates;
+    intermediates.AddCert(test_.chain[1]);
+
+    SimpleSignaturePolicy signature_policy(1024);
+
+    CertPathBuilder path_builder(test_.chain.front(), &trust_store,
+                                 &signature_policy, test_.time,
+                                 KeyPurpose::ANY_EKU, result);
+    path_builder.AddCertIssuerSource(&intermediates);
+    path_builder.Run();
+  }
+
+ protected:
+  VerifyCertChainTest test_;
+};
+
+// Tests that path building fails when the target, intermediate, or root are
+// distrusted (but the path is otherwise valid).
+TEST_F(PathBuilderDistrustTest, TargetIntermediateRoot) {
+  CertPathBuilder::Result result;
+  // First do a control test -- path building without any blacklisted
+  // certificates should work.
+  RunPathBuilder(nullptr, &result);
+  EXPECT_TRUE(result.HasValidPath());
+  {
+    // The built path should be identical the the one read from disk.
+    const auto& path = result.GetBestValidPath()->path;
+    ASSERT_EQ(test_.chain.size(), path.certs.size());
+    for (size_t i = 0; i < test_.chain.size(); ++i)
+      EXPECT_EQ(test_.chain[i], path.certs[i]);
+  }
+
+  // Try path building when only the target is blacklisted - should fail.
+  RunPathBuilder(test_.chain[0], &result);
+  {
+    EXPECT_FALSE(result.HasValidPath());
+    ASSERT_LT(result.best_result_index, result.paths.size());
+    const auto& best_path = result.paths[result.best_result_index];
+
+    // The built chain has length 1 since path building stopped once
+    // it encountered the blacklisted certificate (target).
+    ASSERT_EQ(1u, best_path->path.certs.size());
+    EXPECT_EQ(best_path->path.certs[0], test_.chain[0]);
+    EXPECT_TRUE(best_path->errors.ContainsHighSeverityErrors());
+    best_path->errors.ContainsError(kCertIsDistrusted);
+  }
+
+  // Try path building when only the intermediate is blacklisted - should fail.
+  RunPathBuilder(test_.chain[1], &result);
+  {
+    EXPECT_FALSE(result.HasValidPath());
+    ASSERT_LT(result.best_result_index, result.paths.size());
+    const auto& best_path = result.paths[result.best_result_index];
+
+    // The built chain has length 2 since path building stopped once
+    // it encountered the blacklisted certificate (intermediate).
+    ASSERT_EQ(2u, best_path->path.certs.size());
+    EXPECT_EQ(best_path->path.certs[0], test_.chain[0]);
+    EXPECT_EQ(best_path->path.certs[1], test_.chain[1]);
+    EXPECT_TRUE(best_path->errors.ContainsHighSeverityErrors());
+    best_path->errors.ContainsError(kCertIsDistrusted);
+  }
+
+  // Try path building when only the root is blacklisted - should fail.
+  RunPathBuilder(test_.chain[2], &result);
+  {
+    EXPECT_FALSE(result.HasValidPath());
+    ASSERT_LT(result.best_result_index, result.paths.size());
+    const auto& best_path = result.paths[result.best_result_index];
+
+    // The built chain has length 3 since path building stopped once
+    // it encountered the blacklisted certificate (root).
+    ASSERT_EQ(3u, best_path->path.certs.size());
+    EXPECT_EQ(best_path->path.certs[0], test_.chain[0]);
+    EXPECT_EQ(best_path->path.certs[1], test_.chain[1]);
+    EXPECT_EQ(best_path->path.certs[2], test_.chain[2]);
+    EXPECT_TRUE(best_path->errors.ContainsHighSeverityErrors());
+    best_path->errors.ContainsError(kCertIsDistrusted);
+  }
+}
+
 }  // namespace
 
 }  // namespace net