Remove the EV Certs Whitelist

net/quic/chromium/crypto/proof_verifier_chromium_test.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/chromium/crypto/proof_verifier_chromium.h"
 
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_status_flags.h"
@@ skipping 32 matching lines @@
              CRLSet* crl_set,
              CertVerifyResult* verify_result,
              const CompletionCallback& callback,
              std::unique_ptr<Request>* out_req,
              const NetLogWithSource& net_log) override {
     ADD_FAILURE() << "CertVerifier::Verify() should not be called";
     return ERR_FAILED;
   }
 };
 
-// CTPolicyEnforcer that will fail the test if it is ever called.
-class FailsTestCTPolicyEnforcer : public CTPolicyEnforcer {
- public:
-  FailsTestCTPolicyEnforcer() {}
-  ~FailsTestCTPolicyEnforcer() override {}
-
-  ct::EVPolicyCompliance DoesConformToCTEVPolicy(
-      X509Certificate* cert,
-      const ct::EVCertsWhitelist* ev_whitelist,
-      const ct::SCTList& verified_scts,
-      const NetLogWithSource& net_log) override {
-    ADD_FAILURE() << "CTPolicyEnforcer::DoesConformToCTEVPolicy() should "
-                  << "not be called";
-    return ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY;
-  }
-};
-
 // A mock CTPolicyEnforcer that returns a custom verification result.
 class MockCTPolicyEnforcer : public CTPolicyEnforcer {
  public:
   MOCK_METHOD3(DoesConformToCertPolicy,
                ct::CertPolicyCompliance(X509Certificate* cert,
                                         const ct::SCTList&,
                                         const NetLogWithSource&));
-  MOCK_METHOD4(DoesConformToCTEVPolicy,
-               ct::EVPolicyCompliance(X509Certificate* cert,
-                                      const ct::EVCertsWhitelist*,
-                                      const ct::SCTList&,
-                                      const NetLogWithSource&));
 };
 
 class MockRequireCTDelegate : public TransportSecurityState::RequireCTDelegate {
  public:
   MOCK_METHOD1(IsCTRequiredForHost,
                CTRequirementLevel(const std::string& host));
 };
 
 // Proof source callback which saves the signature into |signature|.
 class SignatureSaver : public ProofSource::Callback {
@@ skipping 35 matching lines @@
 class ProofVerifierChromiumTest : public ::testing::Test {
  public:
   ProofVerifierChromiumTest()
       : verify_context_(new ProofVerifyContextChromium(0 /*cert_verify_flags*/,
                                                        NetLogWithSource())) {}
 
   void SetUp() override {
     EXPECT_CALL(ct_policy_enforcer_, DoesConformToCertPolicy(_, _, _))
         .WillRepeatedly(
             Return(ct::CertPolicyCompliance::CERT_POLICY_NOT_ENOUGH_SCTS));
-    EXPECT_CALL(ct_policy_enforcer_, DoesConformToCTEVPolicy(_, _, _, _))
-        .WillRepeatedly(
-            Return(ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY));
 
     scoped_refptr<const CTLogVerifier> log(
         CTLogVerifier::Create(ct::GetTestPublicKey(), kLogDescription,
                               "https://test.example.com", "dns.example.com"));
     ASSERT_TRUE(log);
     log_verifiers_.push_back(log);
 
     ct_verifier_.reset(new MultiLogCTVerifier());
     ct_verifier_->AddLogs(log_verifiers_);
 
@@ skipping 154 matching lines @@
   scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate();
   ASSERT_TRUE(test_cert);
 
   CertVerifyResult dummy_result;
   dummy_result.verified_cert = test_cert;
   dummy_result.cert_status = CERT_STATUS_IS_EV;
 
   MockCertVerifier dummy_verifier;
   dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK);
 
-  EXPECT_CALL(ct_policy_enforcer_, DoesConformToCTEVPolicy(_, _, _, _))
+  EXPECT_CALL(ct_policy_enforcer_, DoesConformToCertPolicy(_, _, _))
       .WillRepeatedly(
-          Return(ct::EVPolicyCompliance::EV_POLICY_COMPLIES_VIA_SCTS));
+          Return(ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS));
 
   ProofVerifierChromium proof_verifier(&dummy_verifier, &ct_policy_enforcer_,
                                        &transport_security_state_,
                                        ct_verifier_.get());
 
   std::unique_ptr<DummyProofVerifierCallback> callback(
       new DummyProofVerifierCallback);
   QuicAsyncStatus status = proof_verifier.VerifyProof(
       kTestHostname, kTestPort, kTestConfig, QUIC_VERSION_35, kTestChloHash,
       certs_, kTestEmptySCT, GetTestSignature(), verify_context_.get(),
@@ skipping 13 matching lines @@
   scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate();
   ASSERT_TRUE(test_cert);
 
   CertVerifyResult dummy_result;
   dummy_result.verified_cert = test_cert;
   dummy_result.cert_status = CERT_STATUS_IS_EV;
 
   MockCertVerifier dummy_verifier;
   dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK);
 
-  EXPECT_CALL(ct_policy_enforcer_, DoesConformToCTEVPolicy(_, _, _, _))
+  EXPECT_CALL(ct_policy_enforcer_, DoesConformToCertPolicy(_, _, _))
       .WillRepeatedly(
-          Return(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS));
+          Return(ct::CertPolicyCompliance::CERT_POLICY_NOT_ENOUGH_SCTS));
 
   ProofVerifierChromium proof_verifier(&dummy_verifier, &ct_policy_enforcer_,
                                        &transport_security_state_,
                                        ct_verifier_.get());
 
   std::unique_ptr<DummyProofVerifierCallback> callback(
       new DummyProofVerifierCallback);
   QuicAsyncStatus status = proof_verifier.VerifyProof(
       kTestHostname, kTestPort, kTestConfig, QUIC_VERSION_35, kTestChloHash,
       certs_, kTestEmptySCT, GetTestSignature(), verify_context_.get(),
       &error_details_, &details_, std::move(callback));
   ASSERT_EQ(QUIC_SUCCESS, status);
 
   ASSERT_TRUE(details_.get());
   ProofVerifyDetailsChromium* verify_details =
       static_cast<ProofVerifyDetailsChromium*>(details_.get());
   EXPECT_EQ(CERT_STATUS_CT_COMPLIANCE_FAILED,
             verify_details->cert_verify_result.cert_status &
                 (CERT_STATUS_CT_COMPLIANCE_FAILED | CERT_STATUS_IS_EV));
 }
 
-// Tests that the certificate policy enforcer is not consulted if
-// the certificate is not EV.
-TEST_F(ProofVerifierChromiumTest, IgnoresPolicyEnforcerIfNotEV) {
-  scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate();
-  ASSERT_TRUE(test_cert);
-
-  CertVerifyResult dummy_result;
-  dummy_result.verified_cert = test_cert;
-  dummy_result.cert_status = 0;
-
-  MockCertVerifier dummy_verifier;
-  dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK);
-
-  FailsTestCTPolicyEnforcer policy_enforcer;
-
-  ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer,
-                                       &transport_security_state_,
-                                       ct_verifier_.get());
-
-  std::unique_ptr<DummyProofVerifierCallback> callback(
-      new DummyProofVerifierCallback);
-  QuicAsyncStatus status = proof_verifier.VerifyProof(
-      kTestHostname, kTestPort, kTestConfig, QUIC_VERSION_35, kTestChloHash,
-      certs_, kTestEmptySCT, GetTestSignature(), verify_context_.get(),
-      &error_details_, &details_, std::move(callback));
-  ASSERT_EQ(QUIC_SUCCESS, status);
-
-  ASSERT_TRUE(details_.get());
-  ProofVerifyDetailsChromium* verify_details =
-      static_cast<ProofVerifyDetailsChromium*>(details_.get());
-  EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status);
-}
-
 HashValueVector MakeHashValueVector(uint8_t tag) {
   HashValue hash(HASH_VALUE_SHA256);
   memset(hash.data(), tag, hash.size());
   HashValueVector hashes;
   hashes.push_back(hash);
   return hashes;
 }
 
 // Test that PKP is enforced for certificates that chain up to known roots.
 TEST_F(ProofVerifierChromiumTest, PKPEnforced) {
@@ skipping 198 matching lines @@
   ASSERT_EQ(QUIC_SUCCESS, status);
 
   ASSERT_TRUE(details_.get());
   ProofVerifyDetailsChromium* verify_details =
       static_cast<ProofVerifyDetailsChromium*>(details_.get());
   EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status);
 }
 
 }  // namespace test
 }  // namespace net