net: add ability to distinguish user-added root CAs.

net/base/x509_certificate_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/crypto/rsa_private_key.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/pickle.h"
 #include "base/string_split.h"
@@ skipping 463 matching lines @@
                                         intermediates);
 
   int flags = 0;
   CertVerifyResult verify_result;
   int error = cert_chain->Verify("www.us.army.mil", flags, &verify_result);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0, verify_result.cert_status);
   root_certs->Clear();
 }
 
+TEST(X509CertificateTest, TestKnownRoot) {
+  FilePath certs_dir = GetTestCertsDirectory();
+  scoped_refptr<X509Certificate> cert =
+      ImportCertFromFile(certs_dir, "nist.der");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), cert);
+
+  int flags = 0;
+  CertVerifyResult verify_result;
+  cert->Verify("www.nist.gov", flags, &verify_result);
+  // We don't check the error because the certificate will expire eventually.
+  EXPECT_TRUE(verify_result.is_issued_by_known_root);

[wtc, 2011/04/07 05:01:54]

BUG (FUTURE): cert->Verify() sets
verify_result.is_issued_by_known_root only if the certificate
is good.  So when this certificate expires,
verify_result.is_issued_by_known_root will be false.

[agl, 2011/04/07 15:02:49]

I've moved the code which sets |is_issued_by_known_root| down in each case so
that it's only set in the event of a valid certificate. Now, expiry is a problem
here but I can't find a way around it :( The test will blow up in the future.

[wtc, 2011/04/08 00:39:17]

Yes.  The X509CertificateTest unit tests that use real
certificates all have this problem.  We should at least
document when the certificate will expire so that build
sheriffs will know they can disable the test safely when
the test blows up.

+}
+
 // A regression test for http://crbug.com/70293.
 // The Key Usage extension in this RSA SSL server certificate does not have
 // the keyEncipherment bit.
 TEST(X509CertificateTest, InvalidKeyUsage) {
   FilePath certs_dir = GetTestCertsDirectory();
 
   scoped_refptr<X509Certificate> server_cert =
       ImportCertFromFile(certs_dir, "invalid_key_usage_cert.der");
   ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert);
 
@@ skipping 499 matching lines @@
   EXPECT_EQ(test_data.expected,
             X509Certificate::VerifyHostname(test_data.hostname, cert_names))
       << "Host [" << test_data.hostname
       << "], cert name [" << test_data.cert_names << "]";
 }
 
 INSTANTIATE_TEST_CASE_P(, X509CertificateNameVerifyTest,
                         testing::ValuesIn(kNameVerifyTestData));
 
 }  // namespace net