Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <cert.h> | 5 #include <cert.h> |
| 6 #include <certdb.h> | 6 #include <certdb.h> |
| 7 #include <pk11pub.h> | 7 #include <pk11pub.h> |
| 8 | 8 |
| 9 #include <algorithm> | 9 #include <algorithm> |
| 10 | 10 |
| (...skipping 574 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 585 empty_cert_list_, | 585 empty_cert_list_, |
| 586 &verify_result); | 586 &verify_result); |
| 587 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); | 587 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); |
| 588 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); | 588 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); |
| 589 } | 589 } |
| 590 | 590 |
| 591 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned_Trusted) { | 591 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned_Trusted) { |
| 592 // When using CERT_PKIXVerifyCert (which we do), server trust only works from | 592 // When using CERT_PKIXVerifyCert (which we do), server trust only works from |
| 593 // 3.13.4 onwards. See https://bugzilla.mozilla.org/show_bug.cgi?id=647364. | 593 // 3.13.4 onwards. See https://bugzilla.mozilla.org/show_bug.cgi?id=647364. |
| 594 if (!NSS_VersionCheck("3.13.4")) { | 594 if (!NSS_VersionCheck("3.13.4")) { |
| 595 LOG(INFO) << "test skipped on NSS < 3.13.4"; | 595 VLOG(0) << "test skipped on NSS < 3.13.4"; |
| 596 return; | 596 return; |
| 597 } | 597 } |
| 598 | 598 |
| 599 CertificateList certs; | 599 CertificateList certs; |
| 600 ASSERT_TRUE(ReadCertIntoList("punycodetest.der", &certs)); | 600 ASSERT_TRUE(ReadCertIntoList("punycodetest.der", &certs)); |
| 601 | 601 |
| 602 NSSCertDatabase::ImportCertFailureList failed; | 602 NSSCertDatabase::ImportCertFailureList failed; |
| 603 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUSTED_SSL, | 603 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUSTED_SSL, |
| 604 &failed)); | 604 &failed)); |
| 605 | 605 |
| (...skipping 53 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 659 NULL, | 659 NULL, |
| 660 empty_cert_list_, | 660 empty_cert_list_, |
| 661 &verify_result); | 661 &verify_result); |
| 662 EXPECT_EQ(OK, error); | 662 EXPECT_EQ(OK, error); |
| 663 EXPECT_EQ(0U, verify_result.cert_status); | 663 EXPECT_EQ(0U, verify_result.cert_status); |
| 664 } | 664 } |
| 665 | 665 |
| 666 TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert_DistrustServer) { | 666 TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert_DistrustServer) { |
| 667 // Explicit distrust only works starting in NSS 3.13. | 667 // Explicit distrust only works starting in NSS 3.13. |
| 668 if (!NSS_VersionCheck("3.13")) { | 668 if (!NSS_VersionCheck("3.13")) { |
| 669 LOG(INFO) << "test skipped on NSS < 3.13"; | 669 VLOG(0) << "test skipped on NSS < 3.13"; |
| 670 return; | 670 return; |
| 671 } | 671 } |
| 672 | 672 |
| 673 CertificateList ca_certs = CreateCertificateListFromFile( | 673 CertificateList ca_certs = CreateCertificateListFromFile( |
| 674 GetTestCertsDirectory(), "root_ca_cert.pem", | 674 GetTestCertsDirectory(), "root_ca_cert.pem", |
| 675 X509Certificate::FORMAT_AUTO); | 675 X509Certificate::FORMAT_AUTO); |
| 676 ASSERT_EQ(1U, ca_certs.size()); | 676 ASSERT_EQ(1U, ca_certs.size()); |
| 677 | 677 |
| 678 // Import CA cert and trust it. | 678 // Import CA cert and trust it. |
| 679 NSSCertDatabase::ImportCertFailureList failed; | 679 NSSCertDatabase::ImportCertFailureList failed; |
| (...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 753 "127.0.0.1", | 753 "127.0.0.1", |
| 754 flags, | 754 flags, |
| 755 NULL, | 755 NULL, |
| 756 empty_cert_list_, | 756 empty_cert_list_, |
| 757 &verify_result); | 757 &verify_result); |
| 758 EXPECT_EQ(OK, error); | 758 EXPECT_EQ(OK, error); |
| 759 EXPECT_EQ(0U, verify_result.cert_status); | 759 EXPECT_EQ(0U, verify_result.cert_status); |
| 760 | 760 |
| 761 // Explicit distrust only works starting in NSS 3.13. | 761 // Explicit distrust only works starting in NSS 3.13. |
| 762 if (!NSS_VersionCheck("3.13")) { | 762 if (!NSS_VersionCheck("3.13")) { |
| 763 LOG(INFO) << "test partially skipped on NSS < 3.13"; | 763 VLOG(0) << "test partially skipped on NSS < 3.13"; |
| 764 return; | 764 return; |
| 765 } | 765 } |
| 766 | 766 |
| 767 // Trust the root cert and distrust the intermediate. | 767 // Trust the root cert and distrust the intermediate. |
| 768 EXPECT_TRUE(cert_db_->SetCertTrust( | 768 EXPECT_TRUE(cert_db_->SetCertTrust( |
| 769 ca_certs[0].get(), CA_CERT, NSSCertDatabase::TRUSTED_SSL)); | 769 ca_certs[0].get(), CA_CERT, NSSCertDatabase::TRUSTED_SSL)); |
| 770 EXPECT_TRUE(cert_db_->SetCertTrust( | 770 EXPECT_TRUE(cert_db_->SetCertTrust( |
| 771 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::DISTRUSTED_SSL)); | 771 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::DISTRUSTED_SSL)); |
| 772 EXPECT_EQ( | 772 EXPECT_EQ( |
| 773 unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA), | 773 unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA), |
| (...skipping 18 matching lines...) Expand all Loading... | |
| 792 NULL, | 792 NULL, |
| 793 empty_cert_list_, | 793 empty_cert_list_, |
| 794 &verify_result2); | 794 &verify_result2); |
| 795 EXPECT_EQ(ERR_CERT_REVOKED, error); | 795 EXPECT_EQ(ERR_CERT_REVOKED, error); |
| 796 EXPECT_EQ(CERT_STATUS_REVOKED, verify_result2.cert_status); | 796 EXPECT_EQ(CERT_STATUS_REVOKED, verify_result2.cert_status); |
| 797 } | 797 } |
| 798 | 798 |
| 799 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa2) { | 799 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa2) { |
| 800 if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) { | 800 if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) { |
| 801 // See http://bugzil.la/863947 for details. | 801 // See http://bugzil.la/863947 for details. |
| 802 LOG(INFO) << "Skipping test for NSS 3.14.2 - NSS 3.15"; | 802 VLOG(0) << "Skipping test for NSS 3.14.2 - NSS 3.15"; |
| 803 return; | 803 return; |
| 804 } | 804 } |
| 805 | 805 |
| 806 NSSCertDatabase::ImportCertFailureList failed; | 806 NSSCertDatabase::ImportCertFailureList failed; |
| 807 | 807 |
| 808 CertificateList intermediate_certs = CreateCertificateListFromFile( | 808 CertificateList intermediate_certs = CreateCertificateListFromFile( |
| 809 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", | 809 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", |
| 810 X509Certificate::FORMAT_AUTO); | 810 X509Certificate::FORMAT_AUTO); |
| 811 ASSERT_EQ(1U, intermediate_certs.size()); | 811 ASSERT_EQ(1U, intermediate_certs.size()); |
| 812 | 812 |
| (...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 852 NULL, | 852 NULL, |
| 853 empty_cert_list_, | 853 empty_cert_list_, |
| 854 &verify_result2); | 854 &verify_result2); |
| 855 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); | 855 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); |
| 856 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status); | 856 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status); |
| 857 } | 857 } |
| 858 | 858 |
| 859 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa3) { | 859 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa3) { |
| 860 if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) { | 860 if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) { |
| 861 // See http://bugzil.la/863947 for details. | 861 // See http://bugzil.la/863947 for details. |
| 862 LOG(INFO) << "Skipping test for NSS 3.14.2 - NSS 3.15"; | 862 VLOG(0) << "Skipping test for NSS 3.14.2 - NSS 3.15"; |
| 863 return; | 863 return; |
| 864 } | 864 } |
| 865 | 865 |
| 866 NSSCertDatabase::ImportCertFailureList failed; | 866 NSSCertDatabase::ImportCertFailureList failed; |
| 867 | 867 |
| 868 CertificateList ca_certs = CreateCertificateListFromFile( | 868 CertificateList ca_certs = CreateCertificateListFromFile( |
| 869 GetTestCertsDirectory(), "2048-rsa-root.pem", | 869 GetTestCertsDirectory(), "2048-rsa-root.pem", |
| 870 X509Certificate::FORMAT_AUTO); | 870 X509Certificate::FORMAT_AUTO); |
| 871 ASSERT_EQ(1U, ca_certs.size()); | 871 ASSERT_EQ(1U, ca_certs.size()); |
| 872 | 872 |
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 922 NULL, | 922 NULL, |
| 923 empty_cert_list_, | 923 empty_cert_list_, |
| 924 &verify_result2); | 924 &verify_result2); |
| 925 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); | 925 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); |
| 926 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status); | 926 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status); |
| 927 } | 927 } |
| 928 | 928 |
| 929 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa4) { | 929 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa4) { |
| 930 // Explicit distrust only works starting in NSS 3.13. | 930 // Explicit distrust only works starting in NSS 3.13. |
| 931 if (!NSS_VersionCheck("3.13")) { | 931 if (!NSS_VersionCheck("3.13")) { |
| 932 LOG(INFO) << "test skipped on NSS < 3.13"; | 932 VLOG(0) << "test skipped on NSS < 3.13"; |
|
Ryan Sleevi
2013/11/25 01:08:32
and these
scottmg
2013/11/25 17:12:38
Done.
| |
| 933 return; | 933 return; |
| 934 } | 934 } |
| 935 | 935 |
| 936 NSSCertDatabase::ImportCertFailureList failed; | 936 NSSCertDatabase::ImportCertFailureList failed; |
| 937 | 937 |
| 938 CertificateList ca_certs = CreateCertificateListFromFile( | 938 CertificateList ca_certs = CreateCertificateListFromFile( |
| 939 GetTestCertsDirectory(), "2048-rsa-root.pem", | 939 GetTestCertsDirectory(), "2048-rsa-root.pem", |
| 940 X509Certificate::FORMAT_AUTO); | 940 X509Certificate::FORMAT_AUTO); |
| 941 ASSERT_EQ(1U, ca_certs.size()); | 941 ASSERT_EQ(1U, ca_certs.size()); |
| 942 | 942 |
| (...skipping 90 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1033 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, | 1033 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, |
| 1034 cert_db_->GetCertTrust(certs2[0].get(), SERVER_CERT)); | 1034 cert_db_->GetCertTrust(certs2[0].get(), SERVER_CERT)); |
| 1035 | 1035 |
| 1036 new_certs = ListCertsInSlot(slot_->os_module_handle()); | 1036 new_certs = ListCertsInSlot(slot_->os_module_handle()); |
| 1037 ASSERT_EQ(2U, new_certs.size()); | 1037 ASSERT_EQ(2U, new_certs.size()); |
| 1038 EXPECT_STRNE(new_certs[0]->os_cert_handle()->nickname, | 1038 EXPECT_STRNE(new_certs[0]->os_cert_handle()->nickname, |
| 1039 new_certs[1]->os_cert_handle()->nickname); | 1039 new_certs[1]->os_cert_handle()->nickname); |
| 1040 } | 1040 } |
| 1041 | 1041 |
| 1042 } // namespace net | 1042 } // namespace net |
| OLD | NEW |