OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/cert_verify_proc.h" | 5 #include "net/cert/cert_verify_proc.h" |
6 | 6 |
7 #include <vector> | 7 #include <vector> |
8 | 8 |
9 #include "base/callback_helpers.h" | 9 #include "base/callback_helpers.h" |
10 #include "base/files/file_path.h" | 10 #include "base/files/file_path.h" |
(...skipping 626 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
637 CertVerifyResult verify_result; | 637 CertVerifyResult verify_result; |
638 // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug | 638 // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug |
639 // against agl. See also PublicKeyHashes. | 639 // against agl. See also PublicKeyHashes. |
640 int error = Verify(cert_chain.get(), | 640 int error = Verify(cert_chain.get(), |
641 "satveda.com", | 641 "satveda.com", |
642 flags, | 642 flags, |
643 NULL, | 643 NULL, |
644 empty_cert_list_, | 644 empty_cert_list_, |
645 &verify_result); | 645 &verify_result); |
646 EXPECT_EQ(OK, error); | 646 EXPECT_EQ(OK, error); |
647 EXPECT_EQ(0U, verify_result.cert_status); | 647 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); |
648 EXPECT_TRUE(verify_result.is_issued_by_known_root); | 648 EXPECT_TRUE(verify_result.is_issued_by_known_root); |
649 } | 649 } |
650 | 650 |
651 // The certse.pem certificate has been revoked. crbug.com/259723. | 651 // The certse.pem certificate has been revoked. crbug.com/259723. |
652 TEST_F(CertVerifyProcTest, PublicKeyHashes) { | 652 TEST_F(CertVerifyProcTest, PublicKeyHashes) { |
653 if (!SupportsReturningVerifiedChain()) { | 653 if (!SupportsReturningVerifiedChain()) { |
654 LOG(INFO) << "Skipping this test in this platform."; | 654 LOG(INFO) << "Skipping this test in this platform."; |
655 return; | 655 return; |
656 } | 656 } |
657 | 657 |
(...skipping 13 matching lines...) Expand all Loading... |
671 | 671 |
672 // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug | 672 // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug |
673 // against agl. See also TestKnownRoot. | 673 // against agl. See also TestKnownRoot. |
674 int error = Verify(cert_chain.get(), | 674 int error = Verify(cert_chain.get(), |
675 "satveda.com", | 675 "satveda.com", |
676 flags, | 676 flags, |
677 NULL, | 677 NULL, |
678 empty_cert_list_, | 678 empty_cert_list_, |
679 &verify_result); | 679 &verify_result); |
680 EXPECT_EQ(OK, error); | 680 EXPECT_EQ(OK, error); |
681 EXPECT_EQ(0U, verify_result.cert_status); | 681 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); |
682 ASSERT_LE(2U, verify_result.public_key_hashes.size()); | 682 ASSERT_LE(2U, verify_result.public_key_hashes.size()); |
683 | 683 |
684 HashValueVector sha1_hashes; | 684 HashValueVector sha1_hashes; |
685 for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) { | 685 for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) { |
686 if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA1) | 686 if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA1) |
687 continue; | 687 continue; |
688 sha1_hashes.push_back(verify_result.public_key_hashes[i]); | 688 sha1_hashes.push_back(verify_result.public_key_hashes[i]); |
689 } | 689 } |
690 ASSERT_LE(2u, sha1_hashes.size()); | 690 ASSERT_LE(2u, sha1_hashes.size()); |
691 | 691 |
(...skipping 377 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1069 // works. Only the first two certificates are included in the chain. | 1069 // works. Only the first two certificates are included in the chain. |
1070 int flags = 0; | 1070 int flags = 0; |
1071 CertVerifyResult verify_result; | 1071 CertVerifyResult verify_result; |
1072 int error = Verify(cybertrust_basic.get(), | 1072 int error = Verify(cybertrust_basic.get(), |
1073 "cacert.omniroot.com", | 1073 "cacert.omniroot.com", |
1074 flags, | 1074 flags, |
1075 NULL, | 1075 NULL, |
1076 empty_cert_list_, | 1076 empty_cert_list_, |
1077 &verify_result); | 1077 &verify_result); |
1078 EXPECT_EQ(OK, error); | 1078 EXPECT_EQ(OK, error); |
1079 EXPECT_EQ(0U, verify_result.cert_status); | 1079 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); |
1080 | 1080 |
1081 // Attempt to verify with the first known cross-certified intermediate | 1081 // Attempt to verify with the first known cross-certified intermediate |
1082 // provided. | 1082 // provided. |
1083 scoped_refptr<X509Certificate> baltimore_intermediate_1 = | 1083 scoped_refptr<X509Certificate> baltimore_intermediate_1 = |
1084 ImportCertFromFile(GetTestCertsDirectory(), | 1084 ImportCertFromFile(GetTestCertsDirectory(), |
1085 "cybertrust_baltimore_cross_certified_1.pem"); | 1085 "cybertrust_baltimore_cross_certified_1.pem"); |
1086 ASSERT_TRUE(baltimore_intermediate_1.get()); | 1086 ASSERT_TRUE(baltimore_intermediate_1.get()); |
1087 | 1087 |
1088 X509Certificate::OSCertHandles intermediate_chain_1 = | 1088 X509Certificate::OSCertHandles intermediate_chain_1 = |
1089 cybertrust_basic->GetIntermediateCertificates(); | 1089 cybertrust_basic->GetIntermediateCertificates(); |
1090 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); | 1090 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); |
1091 | 1091 |
1092 scoped_refptr<X509Certificate> baltimore_chain_1 = | 1092 scoped_refptr<X509Certificate> baltimore_chain_1 = |
1093 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 1093 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
1094 intermediate_chain_1); | 1094 intermediate_chain_1); |
1095 error = Verify(baltimore_chain_1.get(), | 1095 error = Verify(baltimore_chain_1.get(), |
1096 "cacert.omniroot.com", | 1096 "cacert.omniroot.com", |
1097 flags, | 1097 flags, |
1098 NULL, | 1098 NULL, |
1099 empty_cert_list_, | 1099 empty_cert_list_, |
1100 &verify_result); | 1100 &verify_result); |
1101 EXPECT_EQ(OK, error); | 1101 EXPECT_EQ(OK, error); |
1102 EXPECT_EQ(0U, verify_result.cert_status); | 1102 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); |
1103 | 1103 |
1104 // Attempt to verify with the second known cross-certified intermediate | 1104 // Attempt to verify with the second known cross-certified intermediate |
1105 // provided. | 1105 // provided. |
1106 scoped_refptr<X509Certificate> baltimore_intermediate_2 = | 1106 scoped_refptr<X509Certificate> baltimore_intermediate_2 = |
1107 ImportCertFromFile(GetTestCertsDirectory(), | 1107 ImportCertFromFile(GetTestCertsDirectory(), |
1108 "cybertrust_baltimore_cross_certified_2.pem"); | 1108 "cybertrust_baltimore_cross_certified_2.pem"); |
1109 ASSERT_TRUE(baltimore_intermediate_2.get()); | 1109 ASSERT_TRUE(baltimore_intermediate_2.get()); |
1110 | 1110 |
1111 X509Certificate::OSCertHandles intermediate_chain_2 = | 1111 X509Certificate::OSCertHandles intermediate_chain_2 = |
1112 cybertrust_basic->GetIntermediateCertificates(); | 1112 cybertrust_basic->GetIntermediateCertificates(); |
1113 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); | 1113 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); |
1114 | 1114 |
1115 scoped_refptr<X509Certificate> baltimore_chain_2 = | 1115 scoped_refptr<X509Certificate> baltimore_chain_2 = |
1116 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 1116 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
1117 intermediate_chain_2); | 1117 intermediate_chain_2); |
1118 error = Verify(baltimore_chain_2.get(), | 1118 error = Verify(baltimore_chain_2.get(), |
1119 "cacert.omniroot.com", | 1119 "cacert.omniroot.com", |
1120 flags, | 1120 flags, |
1121 NULL, | 1121 NULL, |
1122 empty_cert_list_, | 1122 empty_cert_list_, |
1123 &verify_result); | 1123 &verify_result); |
1124 EXPECT_EQ(OK, error); | 1124 EXPECT_EQ(OK, error); |
1125 EXPECT_EQ(0U, verify_result.cert_status); | 1125 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); |
1126 | 1126 |
1127 // Attempt to verify when both a cross-certified intermediate AND | 1127 // Attempt to verify when both a cross-certified intermediate AND |
1128 // the legacy GTE root are provided. | 1128 // the legacy GTE root are provided. |
1129 scoped_refptr<X509Certificate> cybertrust_root = | 1129 scoped_refptr<X509Certificate> cybertrust_root = |
1130 ImportCertFromFile(GetTestCertsDirectory(), | 1130 ImportCertFromFile(GetTestCertsDirectory(), |
1131 "cybertrust_gte_root.pem"); | 1131 "cybertrust_gte_root.pem"); |
1132 ASSERT_TRUE(cybertrust_root.get()); | 1132 ASSERT_TRUE(cybertrust_root.get()); |
1133 | 1133 |
1134 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); | 1134 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); |
1135 scoped_refptr<X509Certificate> baltimore_chain_with_root = | 1135 scoped_refptr<X509Certificate> baltimore_chain_with_root = |
1136 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | 1136 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), |
1137 intermediate_chain_2); | 1137 intermediate_chain_2); |
1138 error = Verify(baltimore_chain_with_root.get(), | 1138 error = Verify(baltimore_chain_with_root.get(), |
1139 "cacert.omniroot.com", | 1139 "cacert.omniroot.com", |
1140 flags, | 1140 flags, |
1141 NULL, | 1141 NULL, |
1142 empty_cert_list_, | 1142 empty_cert_list_, |
1143 &verify_result); | 1143 &verify_result); |
1144 EXPECT_EQ(OK, error); | 1144 EXPECT_EQ(OK, error); |
1145 EXPECT_EQ(0U, verify_result.cert_status); | 1145 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); |
1146 | 1146 |
1147 TestRootCerts::GetInstance()->Clear(); | 1147 TestRootCerts::GetInstance()->Clear(); |
1148 EXPECT_TRUE(TestRootCerts::GetInstance()->IsEmpty()); | 1148 EXPECT_TRUE(TestRootCerts::GetInstance()->IsEmpty()); |
1149 } | 1149 } |
1150 #endif | 1150 #endif |
1151 | 1151 |
1152 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) | 1152 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) |
1153 // Test that CRLSets are effective in making a certificate appear to be | 1153 // Test that CRLSets are effective in making a certificate appear to be |
1154 // revoked. | 1154 // revoked. |
1155 TEST_F(CertVerifyProcTest, CRLSet) { | 1155 TEST_F(CertVerifyProcTest, CRLSet) { |
(...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1233 | 1233 |
1234 int flags = 0; | 1234 int flags = 0; |
1235 CertVerifyResult verify_result; | 1235 CertVerifyResult verify_result; |
1236 int error = Verify(leaf.get(), | 1236 int error = Verify(leaf.get(), |
1237 "test.example.com", | 1237 "test.example.com", |
1238 flags, | 1238 flags, |
1239 NULL, | 1239 NULL, |
1240 empty_cert_list_, | 1240 empty_cert_list_, |
1241 &verify_result); | 1241 &verify_result); |
1242 EXPECT_EQ(OK, error); | 1242 EXPECT_EQ(OK, error); |
1243 EXPECT_EQ(0U, verify_result.cert_status); | 1243 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); |
1244 | 1244 |
1245 // Test revocation by serial number of a certificate not under the root. | 1245 // Test revocation by serial number of a certificate not under the root. |
1246 scoped_refptr<CRLSet> crl_set; | 1246 scoped_refptr<CRLSet> crl_set; |
1247 std::string crl_set_bytes; | 1247 std::string crl_set_bytes; |
1248 ASSERT_TRUE(base::ReadFileToString( | 1248 ASSERT_TRUE(base::ReadFileToString( |
1249 GetTestCertsDirectory().AppendASCII("crlset_by_intermediate_serial.raw"), | 1249 GetTestCertsDirectory().AppendASCII("crlset_by_intermediate_serial.raw"), |
1250 &crl_set_bytes)); | 1250 &crl_set_bytes)); |
1251 ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set)); | 1251 ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set)); |
1252 | 1252 |
1253 error = Verify(leaf.get(), | 1253 error = Verify(leaf.get(), |
(...skipping 316 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1570 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID); | 1570 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID); |
1571 } | 1571 } |
1572 } | 1572 } |
1573 | 1573 |
1574 WRAPPED_INSTANTIATE_TEST_CASE_P( | 1574 WRAPPED_INSTANTIATE_TEST_CASE_P( |
1575 VerifyName, | 1575 VerifyName, |
1576 CertVerifyProcNameTest, | 1576 CertVerifyProcNameTest, |
1577 testing::ValuesIn(kVerifyNameData)); | 1577 testing::ValuesIn(kVerifyNameData)); |
1578 | 1578 |
1579 } // namespace net | 1579 } // namespace net |
OLD | NEW |