net: add ability to distinguish user-added root CAs.

net/base/x509_certificate_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/crypto/rsa_private_key.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/pickle.h"
 #include "base/string_split.h"
@@ skipping 463 matching lines @@
                                         intermediates);
 
   int flags = 0;
   CertVerifyResult verify_result;
   int error = cert_chain->Verify("www.us.army.mil", flags, &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0, verify_result.cert_status);
   root_certs->Clear();
 }
 
+TEST(X509CertificateTest, TestProbablyMITMCert) {

[wtc, 2011/04/06 04:28:38]

Please document when this certificate will expire.  (See
examples on lines 401 and 451.)  This lets people know it's
fine to disable this test when it starts to fail.

Alternatively, allow the cert->Verify() call to fail with the
ERR_CERT_DATE_VALID error (CERT_STATUS_DATE_VALID).  You
are only interested in the value of verify_result.is_probably_mitm_cert
anyway.

[agl, 2011/04/06 19:02:02]

Done.

+  FilePath certs_dir = GetTestCertsDirectory();
+  scoped_refptr<X509Certificate> cert =
+      ImportCertFromFile(certs_dir, "nist.der");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), cert);
+
+  int flags = 0;
+  CertVerifyResult verify_result;
+  int error = cert->Verify("www.nist.gov", flags, &verify_result);
+  EXPECT_EQ(OK, error);
+  EXPECT_EQ(0, verify_result.cert_status);
+  EXPECT_FALSE(verify_result.is_probably_mitm_cert);
+}
+
 // A regression test for http://crbug.com/70293.
 // The Key Usage extension in this RSA SSL server certificate does not have
 // the keyEncipherment bit.
 TEST(X509CertificateTest, InvalidKeyUsage) {
   FilePath certs_dir = GetTestCertsDirectory();
 
   scoped_refptr<X509Certificate> server_cert =
       ImportCertFromFile(certs_dir, "invalid_key_usage_cert.der");
   ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert);
 
@@ skipping 499 matching lines @@
   EXPECT_EQ(test_data.expected,
             X509Certificate::VerifyHostname(test_data.hostname, cert_names))
       << "Host [" << test_data.hostname
       << "], cert name [" << test_data.cert_names << "]";
 }
 
 INSTANTIATE_TEST_CASE_P(, X509CertificateNameVerifyTest,
                         testing::ValuesIn(kNameVerifyTestData));
 
 }  // namespace net