| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/cert/cert_verify_proc.h" | |
| 6 | |
| 7 #include <vector> | |
| 8 | |
| 9 #include "base/callback_helpers.h" | |
| 10 #include "base/files/file_path.h" | |
| 11 #include "base/files/file_util.h" | |
| 12 #include "base/logging.h" | |
| 13 #include "base/sha1.h" | |
| 14 #include "base/strings/string_number_conversions.h" | |
| 15 #include "crypto/sha2.h" | |
| 16 #include "net/base/net_errors.h" | |
| 17 #include "net/base/test_data_directory.h" | |
| 18 #include "net/cert/asn1_util.h" | |
| 19 #include "net/cert/cert_status_flags.h" | |
| 20 #include "net/cert/cert_verifier.h" | |
| 21 #include "net/cert/cert_verify_result.h" | |
| 22 #include "net/cert/crl_set.h" | |
| 23 #include "net/cert/crl_set_storage.h" | |
| 24 #include "net/cert/test_root_certs.h" | |
| 25 #include "net/cert/x509_certificate.h" | |
| 26 #include "net/test/cert_test_util.h" | |
| 27 #include "net/test/test_certificate_data.h" | |
| 28 #include "testing/gtest/include/gtest/gtest.h" | |
| 29 | |
| 30 #if defined(OS_WIN) | |
| 31 #include "base/win/windows_version.h" | |
| 32 #elif defined(OS_ANDROID) | |
| 33 #include "base/android/build_info.h" | |
| 34 #endif | |
| 35 | |
| 36 using base::HexEncode; | |
| 37 | |
| 38 namespace net { | |
| 39 | |
| 40 namespace { | |
| 41 | |
| 42 // A certificate for www.paypal.com with a NULL byte in the common name. | |
| 43 // From http://www.gossamer-threads.com/lists/fulldisc/full-disclosure/70363 | |
| 44 unsigned char paypal_null_fingerprint[] = { | |
| 45 0x4c, 0x88, 0x9e, 0x28, 0xd7, 0x7a, 0x44, 0x1e, 0x13, 0xf2, 0x6a, 0xba, | |
| 46 0x1f, 0xe8, 0x1b, 0xd6, 0xab, 0x7b, 0xe8, 0xd7 | |
| 47 }; | |
| 48 | |
| 49 // Mock CertVerifyProc that will set |verify_result->is_issued_by_known_root| | |
| 50 // for all certificates that are Verified. | |
| 51 class WellKnownCaCertVerifyProc : public CertVerifyProc { | |
| 52 public: | |
| 53 // Initialize a CertVerifyProc that will set | |
| 54 // |verify_result->is_issued_by_known_root| to |is_well_known|. | |
| 55 explicit WellKnownCaCertVerifyProc(bool is_well_known) | |
| 56 : is_well_known_(is_well_known) {} | |
| 57 | |
| 58 // CertVerifyProc implementation: | |
| 59 bool SupportsAdditionalTrustAnchors() const override { return false; } | |
| 60 | |
| 61 protected: | |
| 62 ~WellKnownCaCertVerifyProc() override {} | |
| 63 | |
| 64 private: | |
| 65 int VerifyInternal(X509Certificate* cert, | |
| 66 const std::string& hostname, | |
| 67 int flags, | |
| 68 CRLSet* crl_set, | |
| 69 const CertificateList& additional_trust_anchors, | |
| 70 CertVerifyResult* verify_result) override; | |
| 71 | |
| 72 const bool is_well_known_; | |
| 73 | |
| 74 DISALLOW_COPY_AND_ASSIGN(WellKnownCaCertVerifyProc); | |
| 75 }; | |
| 76 | |
| 77 int WellKnownCaCertVerifyProc::VerifyInternal( | |
| 78 X509Certificate* cert, | |
| 79 const std::string& hostname, | |
| 80 int flags, | |
| 81 CRLSet* crl_set, | |
| 82 const CertificateList& additional_trust_anchors, | |
| 83 CertVerifyResult* verify_result) { | |
| 84 verify_result->is_issued_by_known_root = is_well_known_; | |
| 85 return OK; | |
| 86 } | |
| 87 | |
| 88 bool SupportsReturningVerifiedChain() { | |
| 89 #if defined(OS_ANDROID) | |
| 90 // Before API level 17, Android does not expose the APIs necessary to get at | |
| 91 // the verified certificate chain. | |
| 92 if (base::android::BuildInfo::GetInstance()->sdk_int() < 17) | |
| 93 return false; | |
| 94 #endif | |
| 95 return true; | |
| 96 } | |
| 97 | |
| 98 bool SupportsDetectingKnownRoots() { | |
| 99 #if defined(OS_ANDROID) | |
| 100 // Before API level 17, Android does not expose the APIs necessary to get at | |
| 101 // the verified certificate chain and detect known roots. | |
| 102 if (base::android::BuildInfo::GetInstance()->sdk_int() < 17) | |
| 103 return false; | |
| 104 #endif | |
| 105 return true; | |
| 106 } | |
| 107 | |
| 108 } // namespace | |
| 109 | |
| 110 class CertVerifyProcTest : public testing::Test { | |
| 111 public: | |
| 112 CertVerifyProcTest() | |
| 113 : verify_proc_(CertVerifyProc::CreateDefault()) { | |
| 114 } | |
| 115 ~CertVerifyProcTest() override {} | |
| 116 | |
| 117 protected: | |
| 118 bool SupportsAdditionalTrustAnchors() { | |
| 119 return verify_proc_->SupportsAdditionalTrustAnchors(); | |
| 120 } | |
| 121 | |
| 122 int Verify(X509Certificate* cert, | |
| 123 const std::string& hostname, | |
| 124 int flags, | |
| 125 CRLSet* crl_set, | |
| 126 const CertificateList& additional_trust_anchors, | |
| 127 CertVerifyResult* verify_result) { | |
| 128 return verify_proc_->Verify(cert, hostname, flags, crl_set, | |
| 129 additional_trust_anchors, verify_result); | |
| 130 } | |
| 131 | |
| 132 const CertificateList empty_cert_list_; | |
| 133 scoped_refptr<CertVerifyProc> verify_proc_; | |
| 134 }; | |
| 135 | |
| 136 TEST_F(CertVerifyProcTest, DISABLED_WithoutRevocationChecking) { | |
| 137 // Check that verification without revocation checking works. | |
| 138 CertificateList certs = CreateCertificateListFromFile( | |
| 139 GetTestCertsDirectory(), | |
| 140 "googlenew.chain.pem", | |
| 141 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); | |
| 142 | |
| 143 X509Certificate::OSCertHandles intermediates; | |
| 144 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 145 | |
| 146 scoped_refptr<X509Certificate> google_full_chain = | |
| 147 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 148 intermediates); | |
| 149 | |
| 150 CertVerifyResult verify_result; | |
| 151 EXPECT_EQ(OK, | |
| 152 Verify(google_full_chain.get(), | |
| 153 "www.google.com", | |
| 154 0 /* flags */, | |
| 155 NULL, | |
| 156 empty_cert_list_, | |
| 157 &verify_result)); | |
| 158 } | |
| 159 | |
| 160 #if defined(OS_ANDROID) || defined(USE_OPENSSL_CERTS) | |
| 161 // TODO(jnd): http://crbug.com/117478 - EV verification is not yet supported. | |
| 162 #define MAYBE_EVVerification DISABLED_EVVerification | |
| 163 #else | |
| 164 #define MAYBE_EVVerification EVVerification | |
| 165 #endif | |
| 166 TEST_F(CertVerifyProcTest, MAYBE_EVVerification) { | |
| 167 CertificateList certs = CreateCertificateListFromFile( | |
| 168 GetTestCertsDirectory(), | |
| 169 "comodo.chain.pem", | |
| 170 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); | |
| 171 ASSERT_EQ(3U, certs.size()); | |
| 172 | |
| 173 X509Certificate::OSCertHandles intermediates; | |
| 174 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 175 intermediates.push_back(certs[2]->os_cert_handle()); | |
| 176 | |
| 177 scoped_refptr<X509Certificate> comodo_chain = | |
| 178 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 179 intermediates); | |
| 180 | |
| 181 scoped_refptr<CRLSet> crl_set(CRLSet::ForTesting(false, NULL, "")); | |
| 182 CertVerifyResult verify_result; | |
| 183 int flags = CertVerifier::VERIFY_EV_CERT; | |
| 184 int error = Verify(comodo_chain.get(), | |
| 185 "comodo.com", | |
| 186 flags, | |
| 187 crl_set.get(), | |
| 188 empty_cert_list_, | |
| 189 &verify_result); | |
| 190 EXPECT_EQ(OK, error); | |
| 191 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_IS_EV); | |
| 192 } | |
| 193 | |
| 194 TEST_F(CertVerifyProcTest, PaypalNullCertParsing) { | |
| 195 scoped_refptr<X509Certificate> paypal_null_cert( | |
| 196 X509Certificate::CreateFromBytes( | |
| 197 reinterpret_cast<const char*>(paypal_null_der), | |
| 198 sizeof(paypal_null_der))); | |
| 199 | |
| 200 ASSERT_NE(static_cast<X509Certificate*>(NULL), paypal_null_cert.get()); | |
| 201 | |
| 202 const SHA1HashValue& fingerprint = | |
| 203 paypal_null_cert->fingerprint(); | |
| 204 for (size_t i = 0; i < 20; ++i) | |
| 205 EXPECT_EQ(paypal_null_fingerprint[i], fingerprint.data[i]); | |
| 206 | |
| 207 int flags = 0; | |
| 208 CertVerifyResult verify_result; | |
| 209 int error = Verify(paypal_null_cert.get(), | |
| 210 "www.paypal.com", | |
| 211 flags, | |
| 212 NULL, | |
| 213 empty_cert_list_, | |
| 214 &verify_result); | |
| 215 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_ANDROID) | |
| 216 EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error); | |
| 217 #else | |
| 218 // TOOD(bulach): investigate why macosx and win aren't returning | |
| 219 // ERR_CERT_INVALID or ERR_CERT_COMMON_NAME_INVALID. | |
| 220 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); | |
| 221 #endif | |
| 222 // Either the system crypto library should correctly report a certificate | |
| 223 // name mismatch, or our certificate blacklist should cause us to report an | |
| 224 // invalid certificate. | |
| 225 #if defined(USE_NSS) || defined(OS_WIN) || defined(OS_IOS) | |
| 226 EXPECT_TRUE(verify_result.cert_status & | |
| 227 (CERT_STATUS_COMMON_NAME_INVALID | CERT_STATUS_INVALID)); | |
| 228 #endif | |
| 229 } | |
| 230 | |
| 231 // A regression test for http://crbug.com/31497. | |
| 232 #if defined(OS_ANDROID) | |
| 233 // Disabled on Android, as the Android verification libraries require an | |
| 234 // explicit policy to be specified, even when anyPolicy is permitted. | |
| 235 #define MAYBE_IntermediateCARequireExplicitPolicy \ | |
| 236 DISABLED_IntermediateCARequireExplicitPolicy | |
| 237 #else | |
| 238 #define MAYBE_IntermediateCARequireExplicitPolicy \ | |
| 239 IntermediateCARequireExplicitPolicy | |
| 240 #endif | |
| 241 TEST_F(CertVerifyProcTest, MAYBE_IntermediateCARequireExplicitPolicy) { | |
| 242 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 243 | |
| 244 CertificateList certs = CreateCertificateListFromFile( | |
| 245 certs_dir, "explicit-policy-chain.pem", | |
| 246 X509Certificate::FORMAT_AUTO); | |
| 247 ASSERT_EQ(3U, certs.size()); | |
| 248 | |
| 249 X509Certificate::OSCertHandles intermediates; | |
| 250 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 251 | |
| 252 scoped_refptr<X509Certificate> cert = | |
| 253 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 254 intermediates); | |
| 255 ASSERT_TRUE(cert.get()); | |
| 256 | |
| 257 ScopedTestRoot scoped_root(certs[2].get()); | |
| 258 | |
| 259 int flags = 0; | |
| 260 CertVerifyResult verify_result; | |
| 261 int error = Verify(cert.get(), | |
| 262 "policy_test.example", | |
| 263 flags, | |
| 264 NULL, | |
| 265 empty_cert_list_, | |
| 266 &verify_result); | |
| 267 EXPECT_EQ(OK, error); | |
| 268 EXPECT_EQ(0u, verify_result.cert_status); | |
| 269 } | |
| 270 | |
| 271 // Test for bug 58437. | |
| 272 // This certificate will expire on 2011-12-21. The test will still | |
| 273 // pass if error == ERR_CERT_DATE_INVALID. | |
| 274 // This test is DISABLED because it appears that we cannot do | |
| 275 // certificate revocation checking when running all of the net unit tests. | |
| 276 // This test passes when run individually, but when run with all of the net | |
| 277 // unit tests, the call to PKIXVerifyCert returns the NSS error -8180, which is | |
| 278 // SEC_ERROR_REVOKED_CERTIFICATE. This indicates a lack of revocation | |
| 279 // status, i.e. that the revocation check is failing for some reason. | |
| 280 TEST_F(CertVerifyProcTest, DISABLED_GlobalSignR3EVTest) { | |
| 281 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 282 | |
| 283 scoped_refptr<X509Certificate> server_cert = | |
| 284 ImportCertFromFile(certs_dir, "2029_globalsign_com_cert.pem"); | |
| 285 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); | |
| 286 | |
| 287 scoped_refptr<X509Certificate> intermediate_cert = | |
| 288 ImportCertFromFile(certs_dir, "globalsign_ev_sha256_ca_cert.pem"); | |
| 289 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert.get()); | |
| 290 | |
| 291 X509Certificate::OSCertHandles intermediates; | |
| 292 intermediates.push_back(intermediate_cert->os_cert_handle()); | |
| 293 scoped_refptr<X509Certificate> cert_chain = | |
| 294 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), | |
| 295 intermediates); | |
| 296 | |
| 297 CertVerifyResult verify_result; | |
| 298 int flags = CertVerifier::VERIFY_REV_CHECKING_ENABLED | | |
| 299 CertVerifier::VERIFY_EV_CERT; | |
| 300 int error = Verify(cert_chain.get(), | |
| 301 "2029.globalsign.com", | |
| 302 flags, | |
| 303 NULL, | |
| 304 empty_cert_list_, | |
| 305 &verify_result); | |
| 306 if (error == OK) | |
| 307 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_IS_EV); | |
| 308 else | |
| 309 EXPECT_EQ(ERR_CERT_DATE_INVALID, error); | |
| 310 } | |
| 311 | |
| 312 // Test that verifying an ECDSA certificate doesn't crash on XP. (See | |
| 313 // crbug.com/144466). | |
| 314 TEST_F(CertVerifyProcTest, ECDSA_RSA) { | |
| 315 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 316 | |
| 317 scoped_refptr<X509Certificate> cert = | |
| 318 ImportCertFromFile(certs_dir, | |
| 319 "prime256v1-ecdsa-ee-by-1024-rsa-intermediate.pem"); | |
| 320 | |
| 321 CertVerifyResult verify_result; | |
| 322 Verify(cert.get(), "127.0.0.1", 0, NULL, empty_cert_list_, &verify_result); | |
| 323 | |
| 324 // We don't check verify_result because the certificate is signed by an | |
| 325 // unknown CA and will be considered invalid on XP because of the ECDSA | |
| 326 // public key. | |
| 327 } | |
| 328 | |
| 329 // Currently, only RSA and DSA keys are checked for weakness, and our example | |
| 330 // weak size is 768. These could change in the future. | |
| 331 // | |
| 332 // Note that this means there may be false negatives: keys for other | |
| 333 // algorithms and which are weak will pass this test. | |
| 334 static bool IsWeakKeyType(const std::string& key_type) { | |
| 335 size_t pos = key_type.find("-"); | |
| 336 std::string size = key_type.substr(0, pos); | |
| 337 std::string type = key_type.substr(pos + 1); | |
| 338 | |
| 339 if (type == "rsa" || type == "dsa") | |
| 340 return size == "768"; | |
| 341 | |
| 342 return false; | |
| 343 } | |
| 344 | |
| 345 TEST_F(CertVerifyProcTest, RejectWeakKeys) { | |
| 346 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 347 typedef std::vector<std::string> Strings; | |
| 348 Strings key_types; | |
| 349 | |
| 350 // generate-weak-test-chains.sh currently has: | |
| 351 // key_types="768-rsa 1024-rsa 2048-rsa prime256v1-ecdsa" | |
| 352 // We must use the same key types here. The filenames generated look like: | |
| 353 // 2048-rsa-ee-by-768-rsa-intermediate.pem | |
| 354 key_types.push_back("768-rsa"); | |
| 355 key_types.push_back("1024-rsa"); | |
| 356 key_types.push_back("2048-rsa"); | |
| 357 | |
| 358 bool use_ecdsa = true; | |
| 359 #if defined(OS_WIN) | |
| 360 use_ecdsa = base::win::GetVersion() > base::win::VERSION_XP; | |
| 361 #endif | |
| 362 | |
| 363 if (use_ecdsa) | |
| 364 key_types.push_back("prime256v1-ecdsa"); | |
| 365 | |
| 366 // Add the root that signed the intermediates for this test. | |
| 367 scoped_refptr<X509Certificate> root_cert = | |
| 368 ImportCertFromFile(certs_dir, "2048-rsa-root.pem"); | |
| 369 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); | |
| 370 ScopedTestRoot scoped_root(root_cert.get()); | |
| 371 | |
| 372 // Now test each chain. | |
| 373 for (Strings::const_iterator ee_type = key_types.begin(); | |
| 374 ee_type != key_types.end(); ++ee_type) { | |
| 375 for (Strings::const_iterator signer_type = key_types.begin(); | |
| 376 signer_type != key_types.end(); ++signer_type) { | |
| 377 std::string basename = *ee_type + "-ee-by-" + *signer_type + | |
| 378 "-intermediate.pem"; | |
| 379 SCOPED_TRACE(basename); | |
| 380 scoped_refptr<X509Certificate> ee_cert = | |
| 381 ImportCertFromFile(certs_dir, basename); | |
| 382 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_cert.get()); | |
| 383 | |
| 384 basename = *signer_type + "-intermediate.pem"; | |
| 385 scoped_refptr<X509Certificate> intermediate = | |
| 386 ImportCertFromFile(certs_dir, basename); | |
| 387 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate.get()); | |
| 388 | |
| 389 X509Certificate::OSCertHandles intermediates; | |
| 390 intermediates.push_back(intermediate->os_cert_handle()); | |
| 391 scoped_refptr<X509Certificate> cert_chain = | |
| 392 X509Certificate::CreateFromHandle(ee_cert->os_cert_handle(), | |
| 393 intermediates); | |
| 394 | |
| 395 CertVerifyResult verify_result; | |
| 396 int error = Verify(cert_chain.get(), | |
| 397 "127.0.0.1", | |
| 398 0, | |
| 399 NULL, | |
| 400 empty_cert_list_, | |
| 401 &verify_result); | |
| 402 | |
| 403 if (IsWeakKeyType(*ee_type) || IsWeakKeyType(*signer_type)) { | |
| 404 EXPECT_NE(OK, error); | |
| 405 EXPECT_EQ(CERT_STATUS_WEAK_KEY, | |
| 406 verify_result.cert_status & CERT_STATUS_WEAK_KEY); | |
| 407 EXPECT_NE(CERT_STATUS_INVALID, | |
| 408 verify_result.cert_status & CERT_STATUS_INVALID); | |
| 409 } else { | |
| 410 EXPECT_EQ(OK, error); | |
| 411 EXPECT_EQ(0U, verify_result.cert_status & CERT_STATUS_WEAK_KEY); | |
| 412 } | |
| 413 } | |
| 414 } | |
| 415 } | |
| 416 | |
| 417 // Regression test for http://crbug.com/108514. | |
| 418 #if defined(OS_MACOSX) && !defined(OS_IOS) | |
| 419 // Disabled on OS X - Security.framework doesn't ignore superflous certificates | |
| 420 // provided by servers. See CertVerifyProcTest.CybertrustGTERoot for further | |
| 421 // details. | |
| 422 #define MAYBE_ExtraneousMD5RootCert DISABLED_ExtraneousMD5RootCert | |
| 423 #else | |
| 424 #define MAYBE_ExtraneousMD5RootCert ExtraneousMD5RootCert | |
| 425 #endif | |
| 426 TEST_F(CertVerifyProcTest, MAYBE_ExtraneousMD5RootCert) { | |
| 427 if (!SupportsReturningVerifiedChain()) { | |
| 428 LOG(INFO) << "Skipping this test in this platform."; | |
| 429 return; | |
| 430 } | |
| 431 | |
| 432 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 433 | |
| 434 scoped_refptr<X509Certificate> server_cert = | |
| 435 ImportCertFromFile(certs_dir, "cross-signed-leaf.pem"); | |
| 436 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); | |
| 437 | |
| 438 scoped_refptr<X509Certificate> extra_cert = | |
| 439 ImportCertFromFile(certs_dir, "cross-signed-root-md5.pem"); | |
| 440 ASSERT_NE(static_cast<X509Certificate*>(NULL), extra_cert.get()); | |
| 441 | |
| 442 scoped_refptr<X509Certificate> root_cert = | |
| 443 ImportCertFromFile(certs_dir, "cross-signed-root-sha1.pem"); | |
| 444 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); | |
| 445 | |
| 446 ScopedTestRoot scoped_root(root_cert.get()); | |
| 447 | |
| 448 X509Certificate::OSCertHandles intermediates; | |
| 449 intermediates.push_back(extra_cert->os_cert_handle()); | |
| 450 scoped_refptr<X509Certificate> cert_chain = | |
| 451 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), | |
| 452 intermediates); | |
| 453 | |
| 454 CertVerifyResult verify_result; | |
| 455 int flags = 0; | |
| 456 int error = Verify(cert_chain.get(), | |
| 457 "127.0.0.1", | |
| 458 flags, | |
| 459 NULL, | |
| 460 empty_cert_list_, | |
| 461 &verify_result); | |
| 462 EXPECT_EQ(OK, error); | |
| 463 | |
| 464 // The extra MD5 root should be discarded | |
| 465 ASSERT_TRUE(verify_result.verified_cert.get()); | |
| 466 ASSERT_EQ(1u, | |
| 467 verify_result.verified_cert->GetIntermediateCertificates().size()); | |
| 468 EXPECT_TRUE(X509Certificate::IsSameOSCert( | |
| 469 verify_result.verified_cert->GetIntermediateCertificates().front(), | |
| 470 root_cert->os_cert_handle())); | |
| 471 | |
| 472 EXPECT_FALSE(verify_result.has_md5); | |
| 473 } | |
| 474 | |
| 475 // Test for bug 94673. | |
| 476 TEST_F(CertVerifyProcTest, GoogleDigiNotarTest) { | |
| 477 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 478 | |
| 479 scoped_refptr<X509Certificate> server_cert = | |
| 480 ImportCertFromFile(certs_dir, "google_diginotar.pem"); | |
| 481 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); | |
| 482 | |
| 483 scoped_refptr<X509Certificate> intermediate_cert = | |
| 484 ImportCertFromFile(certs_dir, "diginotar_public_ca_2025.pem"); | |
| 485 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert.get()); | |
| 486 | |
| 487 X509Certificate::OSCertHandles intermediates; | |
| 488 intermediates.push_back(intermediate_cert->os_cert_handle()); | |
| 489 scoped_refptr<X509Certificate> cert_chain = | |
| 490 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), | |
| 491 intermediates); | |
| 492 | |
| 493 CertVerifyResult verify_result; | |
| 494 int flags = CertVerifier::VERIFY_REV_CHECKING_ENABLED; | |
| 495 int error = Verify(cert_chain.get(), | |
| 496 "mail.google.com", | |
| 497 flags, | |
| 498 NULL, | |
| 499 empty_cert_list_, | |
| 500 &verify_result); | |
| 501 EXPECT_NE(OK, error); | |
| 502 | |
| 503 // Now turn off revocation checking. Certificate verification should still | |
| 504 // fail. | |
| 505 flags = 0; | |
| 506 error = Verify(cert_chain.get(), | |
| 507 "mail.google.com", | |
| 508 flags, | |
| 509 NULL, | |
| 510 empty_cert_list_, | |
| 511 &verify_result); | |
| 512 EXPECT_NE(OK, error); | |
| 513 } | |
| 514 | |
| 515 TEST_F(CertVerifyProcTest, DigiNotarCerts) { | |
| 516 static const char* const kDigiNotarFilenames[] = { | |
| 517 "diginotar_root_ca.pem", | |
| 518 "diginotar_cyber_ca.pem", | |
| 519 "diginotar_services_1024_ca.pem", | |
| 520 "diginotar_pkioverheid.pem", | |
| 521 "diginotar_pkioverheid_g2.pem", | |
| 522 NULL, | |
| 523 }; | |
| 524 | |
| 525 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 526 | |
| 527 for (size_t i = 0; kDigiNotarFilenames[i]; i++) { | |
| 528 scoped_refptr<X509Certificate> diginotar_cert = | |
| 529 ImportCertFromFile(certs_dir, kDigiNotarFilenames[i]); | |
| 530 std::string der_bytes; | |
| 531 ASSERT_TRUE(X509Certificate::GetDEREncoded( | |
| 532 diginotar_cert->os_cert_handle(), &der_bytes)); | |
| 533 | |
| 534 base::StringPiece spki; | |
| 535 ASSERT_TRUE(asn1::ExtractSPKIFromDERCert(der_bytes, &spki)); | |
| 536 | |
| 537 std::string spki_sha1 = base::SHA1HashString(spki.as_string()); | |
| 538 | |
| 539 HashValueVector public_keys; | |
| 540 HashValue hash(HASH_VALUE_SHA1); | |
| 541 ASSERT_EQ(hash.size(), spki_sha1.size()); | |
| 542 memcpy(hash.data(), spki_sha1.data(), spki_sha1.size()); | |
| 543 public_keys.push_back(hash); | |
| 544 | |
| 545 EXPECT_TRUE(CertVerifyProc::IsPublicKeyBlacklisted(public_keys)) << | |
| 546 "Public key not blocked for " << kDigiNotarFilenames[i]; | |
| 547 } | |
| 548 } | |
| 549 | |
| 550 TEST_F(CertVerifyProcTest, NameConstraintsOk) { | |
| 551 CertificateList ca_cert_list = | |
| 552 CreateCertificateListFromFile(GetTestCertsDirectory(), | |
| 553 "root_ca_cert.pem", | |
| 554 X509Certificate::FORMAT_AUTO); | |
| 555 ASSERT_EQ(1U, ca_cert_list.size()); | |
| 556 ScopedTestRoot test_root(ca_cert_list[0].get()); | |
| 557 | |
| 558 CertificateList cert_list = CreateCertificateListFromFile( | |
| 559 GetTestCertsDirectory(), "name_constraint_good.pem", | |
| 560 X509Certificate::FORMAT_AUTO); | |
| 561 ASSERT_EQ(1U, cert_list.size()); | |
| 562 | |
| 563 X509Certificate::OSCertHandles intermediates; | |
| 564 scoped_refptr<X509Certificate> leaf = | |
| 565 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), | |
| 566 intermediates); | |
| 567 | |
| 568 int flags = 0; | |
| 569 CertVerifyResult verify_result; | |
| 570 int error = Verify(leaf.get(), | |
| 571 "test.example.com", | |
| 572 flags, | |
| 573 NULL, | |
| 574 empty_cert_list_, | |
| 575 &verify_result); | |
| 576 EXPECT_EQ(OK, error); | |
| 577 EXPECT_EQ(0U, verify_result.cert_status); | |
| 578 } | |
| 579 | |
| 580 TEST_F(CertVerifyProcTest, NameConstraintsFailure) { | |
| 581 if (!SupportsReturningVerifiedChain()) { | |
| 582 LOG(INFO) << "Skipping this test in this platform."; | |
| 583 return; | |
| 584 } | |
| 585 | |
| 586 CertificateList ca_cert_list = | |
| 587 CreateCertificateListFromFile(GetTestCertsDirectory(), | |
| 588 "root_ca_cert.pem", | |
| 589 X509Certificate::FORMAT_AUTO); | |
| 590 ASSERT_EQ(1U, ca_cert_list.size()); | |
| 591 ScopedTestRoot test_root(ca_cert_list[0].get()); | |
| 592 | |
| 593 CertificateList cert_list = CreateCertificateListFromFile( | |
| 594 GetTestCertsDirectory(), "name_constraint_bad.pem", | |
| 595 X509Certificate::FORMAT_AUTO); | |
| 596 ASSERT_EQ(1U, cert_list.size()); | |
| 597 | |
| 598 X509Certificate::OSCertHandles intermediates; | |
| 599 scoped_refptr<X509Certificate> leaf = | |
| 600 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), | |
| 601 intermediates); | |
| 602 | |
| 603 int flags = 0; | |
| 604 CertVerifyResult verify_result; | |
| 605 int error = Verify(leaf.get(), | |
| 606 "test.example.com", | |
| 607 flags, | |
| 608 NULL, | |
| 609 empty_cert_list_, | |
| 610 &verify_result); | |
| 611 EXPECT_EQ(ERR_CERT_NAME_CONSTRAINT_VIOLATION, error); | |
| 612 EXPECT_EQ(CERT_STATUS_NAME_CONSTRAINT_VIOLATION, | |
| 613 verify_result.cert_status & CERT_STATUS_NAME_CONSTRAINT_VIOLATION); | |
| 614 } | |
| 615 | |
| 616 TEST_F(CertVerifyProcTest, TestHasTooLongValidity) { | |
| 617 struct { | |
| 618 const char* const file; | |
| 619 bool is_valid_too_long; | |
| 620 } tests[] = { | |
| 621 {"twitter-chain.pem", false}, | |
| 622 {"start_after_expiry.pem", true}, | |
| 623 {"pre_br_validity_ok.pem", false}, | |
| 624 {"pre_br_validity_bad_121.pem", true}, | |
| 625 {"pre_br_validity_bad_2020.pem", true}, | |
| 626 {"10_year_validity.pem", false}, | |
| 627 {"11_year_validity.pem", true}, | |
| 628 {"39_months_after_2015_04.pem", false}, | |
| 629 {"40_months_after_2015_04.pem", true}, | |
| 630 {"60_months_after_2012_07.pem", false}, | |
| 631 {"61_months_after_2012_07.pem", true}, | |
| 632 }; | |
| 633 | |
| 634 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 635 | |
| 636 for (size_t i = 0; i < arraysize(tests); ++i) { | |
| 637 scoped_refptr<X509Certificate> certificate = | |
| 638 ImportCertFromFile(certs_dir, tests[i].file); | |
| 639 SCOPED_TRACE(tests[i].file); | |
| 640 ASSERT_TRUE(certificate); | |
| 641 EXPECT_EQ(tests[i].is_valid_too_long, | |
| 642 CertVerifyProc::HasTooLongValidity(*certificate)); | |
| 643 } | |
| 644 } | |
| 645 | |
| 646 TEST_F(CertVerifyProcTest, TestKnownRoot) { | |
| 647 if (!SupportsDetectingKnownRoots()) { | |
| 648 LOG(INFO) << "Skipping this test on this platform."; | |
| 649 return; | |
| 650 } | |
| 651 | |
| 652 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 653 CertificateList certs = CreateCertificateListFromFile( | |
| 654 certs_dir, "twitter-chain.pem", X509Certificate::FORMAT_AUTO); | |
| 655 ASSERT_EQ(3U, certs.size()); | |
| 656 | |
| 657 X509Certificate::OSCertHandles intermediates; | |
| 658 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 659 | |
| 660 scoped_refptr<X509Certificate> cert_chain = | |
| 661 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 662 intermediates); | |
| 663 | |
| 664 int flags = 0; | |
| 665 CertVerifyResult verify_result; | |
| 666 // This will blow up, May 9th, 2016. Sorry! Please disable and file a bug | |
| 667 // against agl. See also PublicKeyHashes. | |
| 668 int error = Verify(cert_chain.get(), "twitter.com", flags, NULL, | |
| 669 empty_cert_list_, &verify_result); | |
| 670 EXPECT_EQ(OK, error); | |
| 671 EXPECT_TRUE(verify_result.is_issued_by_known_root); | |
| 672 } | |
| 673 | |
| 674 TEST_F(CertVerifyProcTest, PublicKeyHashes) { | |
| 675 if (!SupportsReturningVerifiedChain()) { | |
| 676 LOG(INFO) << "Skipping this test in this platform."; | |
| 677 return; | |
| 678 } | |
| 679 | |
| 680 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 681 CertificateList certs = CreateCertificateListFromFile( | |
| 682 certs_dir, "twitter-chain.pem", X509Certificate::FORMAT_AUTO); | |
| 683 ASSERT_EQ(3U, certs.size()); | |
| 684 | |
| 685 X509Certificate::OSCertHandles intermediates; | |
| 686 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 687 | |
| 688 scoped_refptr<X509Certificate> cert_chain = | |
| 689 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 690 intermediates); | |
| 691 int flags = 0; | |
| 692 CertVerifyResult verify_result; | |
| 693 | |
| 694 // This will blow up, May 9th, 2016. Sorry! Please disable and file a bug | |
| 695 // against agl. See also TestKnownRoot. | |
| 696 int error = Verify(cert_chain.get(), "twitter.com", flags, NULL, | |
| 697 empty_cert_list_, &verify_result); | |
| 698 EXPECT_EQ(OK, error); | |
| 699 ASSERT_LE(3U, verify_result.public_key_hashes.size()); | |
| 700 | |
| 701 HashValueVector sha1_hashes; | |
| 702 for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) { | |
| 703 if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA1) | |
| 704 continue; | |
| 705 sha1_hashes.push_back(verify_result.public_key_hashes[i]); | |
| 706 } | |
| 707 ASSERT_LE(3u, sha1_hashes.size()); | |
| 708 | |
| 709 for (size_t i = 0; i < 3; ++i) { | |
| 710 EXPECT_EQ(HexEncode(kTwitterSPKIs[i], base::kSHA1Length), | |
| 711 HexEncode(sha1_hashes[i].data(), base::kSHA1Length)); | |
| 712 } | |
| 713 | |
| 714 HashValueVector sha256_hashes; | |
| 715 for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) { | |
| 716 if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA256) | |
| 717 continue; | |
| 718 sha256_hashes.push_back(verify_result.public_key_hashes[i]); | |
| 719 } | |
| 720 ASSERT_LE(3u, sha256_hashes.size()); | |
| 721 | |
| 722 for (size_t i = 0; i < 3; ++i) { | |
| 723 EXPECT_EQ(HexEncode(kTwitterSPKIsSHA256[i], crypto::kSHA256Length), | |
| 724 HexEncode(sha256_hashes[i].data(), crypto::kSHA256Length)); | |
| 725 } | |
| 726 } | |
| 727 | |
| 728 // A regression test for http://crbug.com/70293. | |
| 729 // The Key Usage extension in this RSA SSL server certificate does not have | |
| 730 // the keyEncipherment bit. | |
| 731 TEST_F(CertVerifyProcTest, InvalidKeyUsage) { | |
| 732 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 733 | |
| 734 scoped_refptr<X509Certificate> server_cert = | |
| 735 ImportCertFromFile(certs_dir, "invalid_key_usage_cert.der"); | |
| 736 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); | |
| 737 | |
| 738 int flags = 0; | |
| 739 CertVerifyResult verify_result; | |
| 740 int error = Verify(server_cert.get(), | |
| 741 "jira.aquameta.com", | |
| 742 flags, | |
| 743 NULL, | |
| 744 empty_cert_list_, | |
| 745 &verify_result); | |
| 746 #if defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID) | |
| 747 // This certificate has two errors: "invalid key usage" and "untrusted CA". | |
| 748 // However, OpenSSL returns only one (the latter), and we can't detect | |
| 749 // the other errors. | |
| 750 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); | |
| 751 #else | |
| 752 EXPECT_EQ(ERR_CERT_INVALID, error); | |
| 753 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_INVALID); | |
| 754 #endif | |
| 755 // TODO(wtc): fix http://crbug.com/75520 to get all the certificate errors | |
| 756 // from NSS. | |
| 757 #if !defined(USE_NSS) && !defined(OS_IOS) && !defined(OS_ANDROID) | |
| 758 // The certificate is issued by an unknown CA. | |
| 759 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID); | |
| 760 #endif | |
| 761 } | |
| 762 | |
| 763 // Basic test for returning the chain in CertVerifyResult. Note that the | |
| 764 // returned chain may just be a reflection of the originally supplied chain; | |
| 765 // that is, if any errors occur, the default chain returned is an exact copy | |
| 766 // of the certificate to be verified. The remaining VerifyReturn* tests are | |
| 767 // used to ensure that the actual, verified chain is being returned by | |
| 768 // Verify(). | |
| 769 TEST_F(CertVerifyProcTest, VerifyReturnChainBasic) { | |
| 770 if (!SupportsReturningVerifiedChain()) { | |
| 771 LOG(INFO) << "Skipping this test in this platform."; | |
| 772 return; | |
| 773 } | |
| 774 | |
| 775 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 776 CertificateList certs = CreateCertificateListFromFile( | |
| 777 certs_dir, "x509_verify_results.chain.pem", | |
| 778 X509Certificate::FORMAT_AUTO); | |
| 779 ASSERT_EQ(3U, certs.size()); | |
| 780 | |
| 781 X509Certificate::OSCertHandles intermediates; | |
| 782 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 783 intermediates.push_back(certs[2]->os_cert_handle()); | |
| 784 | |
| 785 ScopedTestRoot scoped_root(certs[2].get()); | |
| 786 | |
| 787 scoped_refptr<X509Certificate> google_full_chain = | |
| 788 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 789 intermediates); | |
| 790 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain.get()); | |
| 791 ASSERT_EQ(2U, google_full_chain->GetIntermediateCertificates().size()); | |
| 792 | |
| 793 CertVerifyResult verify_result; | |
| 794 EXPECT_EQ(static_cast<X509Certificate*>(NULL), | |
| 795 verify_result.verified_cert.get()); | |
| 796 int error = Verify(google_full_chain.get(), | |
| 797 "127.0.0.1", | |
| 798 0, | |
| 799 NULL, | |
| 800 empty_cert_list_, | |
| 801 &verify_result); | |
| 802 EXPECT_EQ(OK, error); | |
| 803 ASSERT_NE(static_cast<X509Certificate*>(NULL), | |
| 804 verify_result.verified_cert.get()); | |
| 805 | |
| 806 EXPECT_NE(google_full_chain, verify_result.verified_cert); | |
| 807 EXPECT_TRUE(X509Certificate::IsSameOSCert( | |
| 808 google_full_chain->os_cert_handle(), | |
| 809 verify_result.verified_cert->os_cert_handle())); | |
| 810 const X509Certificate::OSCertHandles& return_intermediates = | |
| 811 verify_result.verified_cert->GetIntermediateCertificates(); | |
| 812 ASSERT_EQ(2U, return_intermediates.size()); | |
| 813 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], | |
| 814 certs[1]->os_cert_handle())); | |
| 815 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], | |
| 816 certs[2]->os_cert_handle())); | |
| 817 } | |
| 818 | |
| 819 // Test that certificates issued for 'intranet' names (that is, containing no | |
| 820 // known public registry controlled domain information) issued by well-known | |
| 821 // CAs are flagged appropriately, while certificates that are issued by | |
| 822 // internal CAs are not flagged. | |
| 823 TEST_F(CertVerifyProcTest, IntranetHostsRejected) { | |
| 824 if (!SupportsDetectingKnownRoots()) { | |
| 825 LOG(INFO) << "Skipping this test in this platform."; | |
| 826 return; | |
| 827 } | |
| 828 | |
| 829 CertificateList cert_list = CreateCertificateListFromFile( | |
| 830 GetTestCertsDirectory(), "reject_intranet_hosts.pem", | |
| 831 X509Certificate::FORMAT_AUTO); | |
| 832 ASSERT_EQ(1U, cert_list.size()); | |
| 833 scoped_refptr<X509Certificate> cert(cert_list[0]); | |
| 834 | |
| 835 CertVerifyResult verify_result; | |
| 836 int error = 0; | |
| 837 | |
| 838 // Intranet names for public CAs should be flagged: | |
| 839 verify_proc_ = new WellKnownCaCertVerifyProc(true); | |
| 840 error = | |
| 841 Verify(cert.get(), "intranet", 0, NULL, empty_cert_list_, &verify_result); | |
| 842 EXPECT_EQ(OK, error); | |
| 843 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_NON_UNIQUE_NAME); | |
| 844 | |
| 845 // However, if the CA is not well known, these should not be flagged: | |
| 846 verify_proc_ = new WellKnownCaCertVerifyProc(false); | |
| 847 error = | |
| 848 Verify(cert.get(), "intranet", 0, NULL, empty_cert_list_, &verify_result); | |
| 849 EXPECT_EQ(OK, error); | |
| 850 EXPECT_FALSE(verify_result.cert_status & CERT_STATUS_NON_UNIQUE_NAME); | |
| 851 } | |
| 852 | |
| 853 // Test that the certificate returned in CertVerifyResult is able to reorder | |
| 854 // certificates that are not ordered from end-entity to root. While this is | |
| 855 // a protocol violation if sent during a TLS handshake, if multiple sources | |
| 856 // of intermediate certificates are combined, it's possible that order may | |
| 857 // not be maintained. | |
| 858 TEST_F(CertVerifyProcTest, VerifyReturnChainProperlyOrdered) { | |
| 859 if (!SupportsReturningVerifiedChain()) { | |
| 860 LOG(INFO) << "Skipping this test in this platform."; | |
| 861 return; | |
| 862 } | |
| 863 | |
| 864 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 865 CertificateList certs = CreateCertificateListFromFile( | |
| 866 certs_dir, "x509_verify_results.chain.pem", | |
| 867 X509Certificate::FORMAT_AUTO); | |
| 868 ASSERT_EQ(3U, certs.size()); | |
| 869 | |
| 870 // Construct the chain out of order. | |
| 871 X509Certificate::OSCertHandles intermediates; | |
| 872 intermediates.push_back(certs[2]->os_cert_handle()); | |
| 873 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 874 | |
| 875 ScopedTestRoot scoped_root(certs[2].get()); | |
| 876 | |
| 877 scoped_refptr<X509Certificate> google_full_chain = | |
| 878 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 879 intermediates); | |
| 880 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain.get()); | |
| 881 ASSERT_EQ(2U, google_full_chain->GetIntermediateCertificates().size()); | |
| 882 | |
| 883 CertVerifyResult verify_result; | |
| 884 EXPECT_EQ(static_cast<X509Certificate*>(NULL), | |
| 885 verify_result.verified_cert.get()); | |
| 886 int error = Verify(google_full_chain.get(), | |
| 887 "127.0.0.1", | |
| 888 0, | |
| 889 NULL, | |
| 890 empty_cert_list_, | |
| 891 &verify_result); | |
| 892 EXPECT_EQ(OK, error); | |
| 893 ASSERT_NE(static_cast<X509Certificate*>(NULL), | |
| 894 verify_result.verified_cert.get()); | |
| 895 | |
| 896 EXPECT_NE(google_full_chain, verify_result.verified_cert); | |
| 897 EXPECT_TRUE(X509Certificate::IsSameOSCert( | |
| 898 google_full_chain->os_cert_handle(), | |
| 899 verify_result.verified_cert->os_cert_handle())); | |
| 900 const X509Certificate::OSCertHandles& return_intermediates = | |
| 901 verify_result.verified_cert->GetIntermediateCertificates(); | |
| 902 ASSERT_EQ(2U, return_intermediates.size()); | |
| 903 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], | |
| 904 certs[1]->os_cert_handle())); | |
| 905 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], | |
| 906 certs[2]->os_cert_handle())); | |
| 907 } | |
| 908 | |
| 909 // Test that Verify() filters out certificates which are not related to | |
| 910 // or part of the certificate chain being verified. | |
| 911 TEST_F(CertVerifyProcTest, VerifyReturnChainFiltersUnrelatedCerts) { | |
| 912 if (!SupportsReturningVerifiedChain()) { | |
| 913 LOG(INFO) << "Skipping this test in this platform."; | |
| 914 return; | |
| 915 } | |
| 916 | |
| 917 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 918 CertificateList certs = CreateCertificateListFromFile( | |
| 919 certs_dir, "x509_verify_results.chain.pem", | |
| 920 X509Certificate::FORMAT_AUTO); | |
| 921 ASSERT_EQ(3U, certs.size()); | |
| 922 ScopedTestRoot scoped_root(certs[2].get()); | |
| 923 | |
| 924 scoped_refptr<X509Certificate> unrelated_certificate = | |
| 925 ImportCertFromFile(certs_dir, "duplicate_cn_1.pem"); | |
| 926 scoped_refptr<X509Certificate> unrelated_certificate2 = | |
| 927 ImportCertFromFile(certs_dir, "aia-cert.pem"); | |
| 928 ASSERT_NE(static_cast<X509Certificate*>(NULL), unrelated_certificate.get()); | |
| 929 ASSERT_NE(static_cast<X509Certificate*>(NULL), unrelated_certificate2.get()); | |
| 930 | |
| 931 // Interject unrelated certificates into the list of intermediates. | |
| 932 X509Certificate::OSCertHandles intermediates; | |
| 933 intermediates.push_back(unrelated_certificate->os_cert_handle()); | |
| 934 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 935 intermediates.push_back(unrelated_certificate2->os_cert_handle()); | |
| 936 intermediates.push_back(certs[2]->os_cert_handle()); | |
| 937 | |
| 938 scoped_refptr<X509Certificate> google_full_chain = | |
| 939 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 940 intermediates); | |
| 941 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain.get()); | |
| 942 ASSERT_EQ(4U, google_full_chain->GetIntermediateCertificates().size()); | |
| 943 | |
| 944 CertVerifyResult verify_result; | |
| 945 EXPECT_EQ(static_cast<X509Certificate*>(NULL), | |
| 946 verify_result.verified_cert.get()); | |
| 947 int error = Verify(google_full_chain.get(), | |
| 948 "127.0.0.1", | |
| 949 0, | |
| 950 NULL, | |
| 951 empty_cert_list_, | |
| 952 &verify_result); | |
| 953 EXPECT_EQ(OK, error); | |
| 954 ASSERT_NE(static_cast<X509Certificate*>(NULL), | |
| 955 verify_result.verified_cert.get()); | |
| 956 | |
| 957 EXPECT_NE(google_full_chain, verify_result.verified_cert); | |
| 958 EXPECT_TRUE(X509Certificate::IsSameOSCert( | |
| 959 google_full_chain->os_cert_handle(), | |
| 960 verify_result.verified_cert->os_cert_handle())); | |
| 961 const X509Certificate::OSCertHandles& return_intermediates = | |
| 962 verify_result.verified_cert->GetIntermediateCertificates(); | |
| 963 ASSERT_EQ(2U, return_intermediates.size()); | |
| 964 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], | |
| 965 certs[1]->os_cert_handle())); | |
| 966 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], | |
| 967 certs[2]->os_cert_handle())); | |
| 968 } | |
| 969 | |
| 970 TEST_F(CertVerifyProcTest, AdditionalTrustAnchors) { | |
| 971 if (!SupportsAdditionalTrustAnchors()) { | |
| 972 LOG(INFO) << "Skipping this test in this platform."; | |
| 973 return; | |
| 974 } | |
| 975 | |
| 976 // |ca_cert| is the issuer of |cert|. | |
| 977 CertificateList ca_cert_list = CreateCertificateListFromFile( | |
| 978 GetTestCertsDirectory(), "root_ca_cert.pem", | |
| 979 X509Certificate::FORMAT_AUTO); | |
| 980 ASSERT_EQ(1U, ca_cert_list.size()); | |
| 981 scoped_refptr<X509Certificate> ca_cert(ca_cert_list[0]); | |
| 982 | |
| 983 CertificateList cert_list = CreateCertificateListFromFile( | |
| 984 GetTestCertsDirectory(), "ok_cert.pem", | |
| 985 X509Certificate::FORMAT_AUTO); | |
| 986 ASSERT_EQ(1U, cert_list.size()); | |
| 987 scoped_refptr<X509Certificate> cert(cert_list[0]); | |
| 988 | |
| 989 // Verification of |cert| fails when |ca_cert| is not in the trust anchors | |
| 990 // list. | |
| 991 int flags = 0; | |
| 992 CertVerifyResult verify_result; | |
| 993 int error = Verify( | |
| 994 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); | |
| 995 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); | |
| 996 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); | |
| 997 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); | |
| 998 | |
| 999 // Now add the |ca_cert| to the |trust_anchors|, and verification should pass. | |
| 1000 CertificateList trust_anchors; | |
| 1001 trust_anchors.push_back(ca_cert); | |
| 1002 error = Verify( | |
| 1003 cert.get(), "127.0.0.1", flags, NULL, trust_anchors, &verify_result); | |
| 1004 EXPECT_EQ(OK, error); | |
| 1005 EXPECT_EQ(0U, verify_result.cert_status); | |
| 1006 EXPECT_TRUE(verify_result.is_issued_by_additional_trust_anchor); | |
| 1007 | |
| 1008 // Clearing the |trust_anchors| makes verification fail again (the cache | |
| 1009 // should be skipped). | |
| 1010 error = Verify( | |
| 1011 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); | |
| 1012 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); | |
| 1013 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); | |
| 1014 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); | |
| 1015 } | |
| 1016 | |
| 1017 // Tests that certificates issued by user-supplied roots are not flagged as | |
| 1018 // issued by a known root. This should pass whether or not the platform supports | |
| 1019 // detecting known roots. | |
| 1020 TEST_F(CertVerifyProcTest, IsIssuedByKnownRootIgnoresTestRoots) { | |
| 1021 // Load root_ca_cert.pem into the test root store. | |
| 1022 TestRootCerts* root_certs = TestRootCerts::GetInstance(); | |
| 1023 root_certs->AddFromFile( | |
| 1024 GetTestCertsDirectory().AppendASCII("root_ca_cert.pem")); | |
| 1025 | |
| 1026 CertificateList cert_list = CreateCertificateListFromFile( | |
| 1027 GetTestCertsDirectory(), "ok_cert.pem", | |
| 1028 X509Certificate::FORMAT_AUTO); | |
| 1029 ASSERT_EQ(1U, cert_list.size()); | |
| 1030 scoped_refptr<X509Certificate> cert(cert_list[0]); | |
| 1031 | |
| 1032 // Verification should pass. | |
| 1033 int flags = 0; | |
| 1034 CertVerifyResult verify_result; | |
| 1035 int error = Verify( | |
| 1036 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); | |
| 1037 EXPECT_EQ(OK, error); | |
| 1038 EXPECT_EQ(0U, verify_result.cert_status); | |
| 1039 // But should not be marked as a known root. | |
| 1040 EXPECT_FALSE(verify_result.is_issued_by_known_root); | |
| 1041 | |
| 1042 root_certs->Clear(); | |
| 1043 EXPECT_TRUE(root_certs->IsEmpty()); | |
| 1044 } | |
| 1045 | |
| 1046 #if defined(OS_MACOSX) && !defined(OS_IOS) | |
| 1047 // Tests that, on OS X, issues with a cross-certified Baltimore CyberTrust | |
| 1048 // Root can be successfully worked around once Apple completes removing the | |
| 1049 // older GTE CyberTrust Root from its trusted root store. | |
| 1050 // | |
| 1051 // The issue is caused by servers supplying the cross-certified intermediate | |
| 1052 // (necessary for certain mobile platforms), which OS X does not recognize | |
| 1053 // as already existing within its trust store. | |
| 1054 TEST_F(CertVerifyProcTest, CybertrustGTERoot) { | |
| 1055 CertificateList certs = CreateCertificateListFromFile( | |
| 1056 GetTestCertsDirectory(), | |
| 1057 "cybertrust_omniroot_chain.pem", | |
| 1058 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); | |
| 1059 ASSERT_EQ(2U, certs.size()); | |
| 1060 | |
| 1061 X509Certificate::OSCertHandles intermediates; | |
| 1062 intermediates.push_back(certs[1]->os_cert_handle()); | |
| 1063 | |
| 1064 scoped_refptr<X509Certificate> cybertrust_basic = | |
| 1065 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), | |
| 1066 intermediates); | |
| 1067 ASSERT_TRUE(cybertrust_basic.get()); | |
| 1068 | |
| 1069 scoped_refptr<X509Certificate> baltimore_root = | |
| 1070 ImportCertFromFile(GetTestCertsDirectory(), | |
| 1071 "cybertrust_baltimore_root.pem"); | |
| 1072 ASSERT_TRUE(baltimore_root.get()); | |
| 1073 | |
| 1074 ScopedTestRoot scoped_root(baltimore_root.get()); | |
| 1075 | |
| 1076 // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This | |
| 1077 // simulates Keychain removing support for the GTE CyberTrust Root. | |
| 1078 TestRootCerts::GetInstance()->SetAllowSystemTrust(false); | |
| 1079 base::ScopedClosureRunner reset_system_trust( | |
| 1080 base::Bind(&TestRootCerts::SetAllowSystemTrust, | |
| 1081 base::Unretained(TestRootCerts::GetInstance()), | |
| 1082 true)); | |
| 1083 | |
| 1084 // First, make sure a simple certificate chain from | |
| 1085 // EE -> Public SureServer SV -> Baltimore CyberTrust | |
| 1086 // works. Only the first two certificates are included in the chain. | |
| 1087 int flags = 0; | |
| 1088 CertVerifyResult verify_result; | |
| 1089 int error = Verify(cybertrust_basic.get(), | |
| 1090 "cacert.omniroot.com", | |
| 1091 flags, | |
| 1092 NULL, | |
| 1093 empty_cert_list_, | |
| 1094 &verify_result); | |
| 1095 EXPECT_EQ(OK, error); | |
| 1096 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); | |
| 1097 | |
| 1098 // Attempt to verify with the first known cross-certified intermediate | |
| 1099 // provided. | |
| 1100 scoped_refptr<X509Certificate> baltimore_intermediate_1 = | |
| 1101 ImportCertFromFile(GetTestCertsDirectory(), | |
| 1102 "cybertrust_baltimore_cross_certified_1.pem"); | |
| 1103 ASSERT_TRUE(baltimore_intermediate_1.get()); | |
| 1104 | |
| 1105 X509Certificate::OSCertHandles intermediate_chain_1 = | |
| 1106 cybertrust_basic->GetIntermediateCertificates(); | |
| 1107 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); | |
| 1108 | |
| 1109 scoped_refptr<X509Certificate> baltimore_chain_1 = | |
| 1110 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | |
| 1111 intermediate_chain_1); | |
| 1112 error = Verify(baltimore_chain_1.get(), | |
| 1113 "cacert.omniroot.com", | |
| 1114 flags, | |
| 1115 NULL, | |
| 1116 empty_cert_list_, | |
| 1117 &verify_result); | |
| 1118 EXPECT_EQ(OK, error); | |
| 1119 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); | |
| 1120 | |
| 1121 // Attempt to verify with the second known cross-certified intermediate | |
| 1122 // provided. | |
| 1123 scoped_refptr<X509Certificate> baltimore_intermediate_2 = | |
| 1124 ImportCertFromFile(GetTestCertsDirectory(), | |
| 1125 "cybertrust_baltimore_cross_certified_2.pem"); | |
| 1126 ASSERT_TRUE(baltimore_intermediate_2.get()); | |
| 1127 | |
| 1128 X509Certificate::OSCertHandles intermediate_chain_2 = | |
| 1129 cybertrust_basic->GetIntermediateCertificates(); | |
| 1130 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); | |
| 1131 | |
| 1132 scoped_refptr<X509Certificate> baltimore_chain_2 = | |
| 1133 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | |
| 1134 intermediate_chain_2); | |
| 1135 error = Verify(baltimore_chain_2.get(), | |
| 1136 "cacert.omniroot.com", | |
| 1137 flags, | |
| 1138 NULL, | |
| 1139 empty_cert_list_, | |
| 1140 &verify_result); | |
| 1141 EXPECT_EQ(OK, error); | |
| 1142 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); | |
| 1143 | |
| 1144 // Attempt to verify when both a cross-certified intermediate AND | |
| 1145 // the legacy GTE root are provided. | |
| 1146 scoped_refptr<X509Certificate> cybertrust_root = | |
| 1147 ImportCertFromFile(GetTestCertsDirectory(), | |
| 1148 "cybertrust_gte_root.pem"); | |
| 1149 ASSERT_TRUE(cybertrust_root.get()); | |
| 1150 | |
| 1151 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); | |
| 1152 scoped_refptr<X509Certificate> baltimore_chain_with_root = | |
| 1153 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), | |
| 1154 intermediate_chain_2); | |
| 1155 error = Verify(baltimore_chain_with_root.get(), | |
| 1156 "cacert.omniroot.com", | |
| 1157 flags, | |
| 1158 NULL, | |
| 1159 empty_cert_list_, | |
| 1160 &verify_result); | |
| 1161 EXPECT_EQ(OK, error); | |
| 1162 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); | |
| 1163 | |
| 1164 TestRootCerts::GetInstance()->Clear(); | |
| 1165 EXPECT_TRUE(TestRootCerts::GetInstance()->IsEmpty()); | |
| 1166 } | |
| 1167 #endif | |
| 1168 | |
| 1169 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) | |
| 1170 // Test that CRLSets are effective in making a certificate appear to be | |
| 1171 // revoked. | |
| 1172 TEST_F(CertVerifyProcTest, CRLSet) { | |
| 1173 CertificateList ca_cert_list = | |
| 1174 CreateCertificateListFromFile(GetTestCertsDirectory(), | |
| 1175 "root_ca_cert.pem", | |
| 1176 X509Certificate::FORMAT_AUTO); | |
| 1177 ASSERT_EQ(1U, ca_cert_list.size()); | |
| 1178 ScopedTestRoot test_root(ca_cert_list[0].get()); | |
| 1179 | |
| 1180 CertificateList cert_list = CreateCertificateListFromFile( | |
| 1181 GetTestCertsDirectory(), "ok_cert.pem", X509Certificate::FORMAT_AUTO); | |
| 1182 ASSERT_EQ(1U, cert_list.size()); | |
| 1183 scoped_refptr<X509Certificate> cert(cert_list[0]); | |
| 1184 | |
| 1185 int flags = 0; | |
| 1186 CertVerifyResult verify_result; | |
| 1187 int error = Verify( | |
| 1188 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); | |
| 1189 EXPECT_EQ(OK, error); | |
| 1190 EXPECT_EQ(0U, verify_result.cert_status); | |
| 1191 | |
| 1192 scoped_refptr<CRLSet> crl_set; | |
| 1193 std::string crl_set_bytes; | |
| 1194 | |
| 1195 // First test blocking by SPKI. | |
| 1196 EXPECT_TRUE(base::ReadFileToString( | |
| 1197 GetTestCertsDirectory().AppendASCII("crlset_by_leaf_spki.raw"), | |
| 1198 &crl_set_bytes)); | |
| 1199 ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set)); | |
| 1200 | |
| 1201 error = Verify(cert.get(), | |
| 1202 "127.0.0.1", | |
| 1203 flags, | |
| 1204 crl_set.get(), | |
| 1205 empty_cert_list_, | |
| 1206 &verify_result); | |
| 1207 EXPECT_EQ(ERR_CERT_REVOKED, error); | |
| 1208 | |
| 1209 // Second, test revocation by serial number of a cert directly under the | |
| 1210 // root. | |
| 1211 crl_set_bytes.clear(); | |
| 1212 EXPECT_TRUE(base::ReadFileToString( | |
| 1213 GetTestCertsDirectory().AppendASCII("crlset_by_root_serial.raw"), | |
| 1214 &crl_set_bytes)); | |
| 1215 ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set)); | |
| 1216 | |
| 1217 error = Verify(cert.get(), | |
| 1218 "127.0.0.1", | |
| 1219 flags, | |
| 1220 crl_set.get(), | |
| 1221 empty_cert_list_, | |
| 1222 &verify_result); | |
| 1223 EXPECT_EQ(ERR_CERT_REVOKED, error); | |
| 1224 } | |
| 1225 | |
| 1226 TEST_F(CertVerifyProcTest, CRLSetLeafSerial) { | |
| 1227 CertificateList ca_cert_list = | |
| 1228 CreateCertificateListFromFile(GetTestCertsDirectory(), | |
| 1229 "quic_root.crt", | |
| 1230 X509Certificate::FORMAT_AUTO); | |
| 1231 ASSERT_EQ(1U, ca_cert_list.size()); | |
| 1232 ScopedTestRoot test_root(ca_cert_list[0].get()); | |
| 1233 | |
| 1234 CertificateList intermediate_cert_list = | |
| 1235 CreateCertificateListFromFile(GetTestCertsDirectory(), | |
| 1236 "quic_intermediate.crt", | |
| 1237 X509Certificate::FORMAT_AUTO); | |
| 1238 ASSERT_EQ(1U, intermediate_cert_list.size()); | |
| 1239 X509Certificate::OSCertHandles intermediates; | |
| 1240 intermediates.push_back(intermediate_cert_list[0]->os_cert_handle()); | |
| 1241 | |
| 1242 CertificateList cert_list = CreateCertificateListFromFile( | |
| 1243 GetTestCertsDirectory(), "quic_test.example.com.crt", | |
| 1244 X509Certificate::FORMAT_AUTO); | |
| 1245 ASSERT_EQ(1U, cert_list.size()); | |
| 1246 | |
| 1247 scoped_refptr<X509Certificate> leaf = | |
| 1248 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), | |
| 1249 intermediates); | |
| 1250 | |
| 1251 int flags = 0; | |
| 1252 CertVerifyResult verify_result; | |
| 1253 int error = Verify(leaf.get(), | |
| 1254 "test.example.com", | |
| 1255 flags, | |
| 1256 NULL, | |
| 1257 empty_cert_list_, | |
| 1258 &verify_result); | |
| 1259 EXPECT_EQ(OK, error); | |
| 1260 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); | |
| 1261 | |
| 1262 // Test revocation by serial number of a certificate not under the root. | |
| 1263 scoped_refptr<CRLSet> crl_set; | |
| 1264 std::string crl_set_bytes; | |
| 1265 ASSERT_TRUE(base::ReadFileToString( | |
| 1266 GetTestCertsDirectory().AppendASCII("crlset_by_intermediate_serial.raw"), | |
| 1267 &crl_set_bytes)); | |
| 1268 ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set)); | |
| 1269 | |
| 1270 error = Verify(leaf.get(), | |
| 1271 "test.example.com", | |
| 1272 flags, | |
| 1273 crl_set.get(), | |
| 1274 empty_cert_list_, | |
| 1275 &verify_result); | |
| 1276 EXPECT_EQ(ERR_CERT_REVOKED, error); | |
| 1277 } | |
| 1278 #endif | |
| 1279 | |
| 1280 enum ExpectedAlgorithms { | |
| 1281 EXPECT_MD2 = 1 << 0, | |
| 1282 EXPECT_MD4 = 1 << 1, | |
| 1283 EXPECT_MD5 = 1 << 2, | |
| 1284 EXPECT_SHA1 = 1 << 3 | |
| 1285 }; | |
| 1286 | |
| 1287 struct WeakDigestTestData { | |
| 1288 const char* root_cert_filename; | |
| 1289 const char* intermediate_cert_filename; | |
| 1290 const char* ee_cert_filename; | |
| 1291 int expected_algorithms; | |
| 1292 }; | |
| 1293 | |
| 1294 // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how | |
| 1295 // to output the parameter that was passed. Without this, it will simply | |
| 1296 // attempt to print out the first twenty bytes of the object, which depending | |
| 1297 // on platform and alignment, may result in an invalid read. | |
| 1298 void PrintTo(const WeakDigestTestData& data, std::ostream* os) { | |
| 1299 *os << "root: " | |
| 1300 << (data.root_cert_filename ? data.root_cert_filename : "none") | |
| 1301 << "; intermediate: " << data.intermediate_cert_filename | |
| 1302 << "; end-entity: " << data.ee_cert_filename; | |
| 1303 } | |
| 1304 | |
| 1305 class CertVerifyProcWeakDigestTest | |
| 1306 : public CertVerifyProcTest, | |
| 1307 public testing::WithParamInterface<WeakDigestTestData> { | |
| 1308 public: | |
| 1309 CertVerifyProcWeakDigestTest() {} | |
| 1310 virtual ~CertVerifyProcWeakDigestTest() {} | |
| 1311 }; | |
| 1312 | |
| 1313 TEST_P(CertVerifyProcWeakDigestTest, Verify) { | |
| 1314 WeakDigestTestData data = GetParam(); | |
| 1315 base::FilePath certs_dir = GetTestCertsDirectory(); | |
| 1316 | |
| 1317 ScopedTestRoot test_root; | |
| 1318 if (data.root_cert_filename) { | |
| 1319 scoped_refptr<X509Certificate> root_cert = | |
| 1320 ImportCertFromFile(certs_dir, data.root_cert_filename); | |
| 1321 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); | |
| 1322 test_root.Reset(root_cert.get()); | |
| 1323 } | |
| 1324 | |
| 1325 scoped_refptr<X509Certificate> intermediate_cert = | |
| 1326 ImportCertFromFile(certs_dir, data.intermediate_cert_filename); | |
| 1327 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert.get()); | |
| 1328 scoped_refptr<X509Certificate> ee_cert = | |
| 1329 ImportCertFromFile(certs_dir, data.ee_cert_filename); | |
| 1330 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_cert.get()); | |
| 1331 | |
| 1332 X509Certificate::OSCertHandles intermediates; | |
| 1333 intermediates.push_back(intermediate_cert->os_cert_handle()); | |
| 1334 | |
| 1335 scoped_refptr<X509Certificate> ee_chain = | |
| 1336 X509Certificate::CreateFromHandle(ee_cert->os_cert_handle(), | |
| 1337 intermediates); | |
| 1338 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_chain.get()); | |
| 1339 | |
| 1340 int flags = 0; | |
| 1341 CertVerifyResult verify_result; | |
| 1342 int rv = Verify(ee_chain.get(), | |
| 1343 "127.0.0.1", | |
| 1344 flags, | |
| 1345 NULL, | |
| 1346 empty_cert_list_, | |
| 1347 &verify_result); | |
| 1348 EXPECT_EQ(!!(data.expected_algorithms & EXPECT_MD2), verify_result.has_md2); | |
| 1349 EXPECT_EQ(!!(data.expected_algorithms & EXPECT_MD4), verify_result.has_md4); | |
| 1350 EXPECT_EQ(!!(data.expected_algorithms & EXPECT_MD5), verify_result.has_md5); | |
| 1351 EXPECT_EQ(!!(data.expected_algorithms & EXPECT_SHA1), verify_result.has_sha1); | |
| 1352 | |
| 1353 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); | |
| 1354 | |
| 1355 // Ensure that MD4 and MD2 are tagged as invalid. | |
| 1356 if (data.expected_algorithms & (EXPECT_MD2 | EXPECT_MD4)) { | |
| 1357 EXPECT_EQ(CERT_STATUS_INVALID, | |
| 1358 verify_result.cert_status & CERT_STATUS_INVALID); | |
| 1359 } | |
| 1360 | |
| 1361 // Ensure that MD5 is flagged as weak. | |
| 1362 if (data.expected_algorithms & EXPECT_MD5) { | |
| 1363 EXPECT_EQ( | |
| 1364 CERT_STATUS_WEAK_SIGNATURE_ALGORITHM, | |
| 1365 verify_result.cert_status & CERT_STATUS_WEAK_SIGNATURE_ALGORITHM); | |
| 1366 } | |
| 1367 | |
| 1368 // If a root cert is present, then check that the chain was rejected if any | |
| 1369 // weak algorithms are present. This is only checked when a root cert is | |
| 1370 // present because the error reported for incomplete chains with weak | |
| 1371 // algorithms depends on which implementation was used to validate (NSS, | |
| 1372 // OpenSSL, CryptoAPI, Security.framework) and upon which weak algorithm | |
| 1373 // present (MD2, MD4, MD5). | |
| 1374 if (data.root_cert_filename) { | |
| 1375 if (data.expected_algorithms & (EXPECT_MD2 | EXPECT_MD4)) { | |
| 1376 EXPECT_EQ(ERR_CERT_INVALID, rv); | |
| 1377 } else if (data.expected_algorithms & EXPECT_MD5) { | |
| 1378 EXPECT_EQ(ERR_CERT_WEAK_SIGNATURE_ALGORITHM, rv); | |
| 1379 } else { | |
| 1380 EXPECT_EQ(OK, rv); | |
| 1381 } | |
| 1382 } | |
| 1383 } | |
| 1384 | |
| 1385 // Unlike TEST/TEST_F, which are macros that expand to further macros, | |
| 1386 // INSTANTIATE_TEST_CASE_P is a macro that expands directly to code that | |
| 1387 // stringizes the arguments. As a result, macros passed as parameters (such as | |
| 1388 // prefix or test_case_name) will not be expanded by the preprocessor. To work | |
| 1389 // around this, indirect the macro for INSTANTIATE_TEST_CASE_P, so that the | |
| 1390 // pre-processor will expand macros such as MAYBE_test_name before | |
| 1391 // instantiating the test. | |
| 1392 #define WRAPPED_INSTANTIATE_TEST_CASE_P(prefix, test_case_name, generator) \ | |
| 1393 INSTANTIATE_TEST_CASE_P(prefix, test_case_name, generator) | |
| 1394 | |
| 1395 // The signature algorithm of the root CA should not matter. | |
| 1396 const WeakDigestTestData kVerifyRootCATestData[] = { | |
| 1397 { "weak_digest_md5_root.pem", "weak_digest_sha1_intermediate.pem", | |
| 1398 "weak_digest_sha1_ee.pem", EXPECT_SHA1 }, | |
| 1399 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) | |
| 1400 // MD4 is not supported by OS X / NSS | |
| 1401 { "weak_digest_md4_root.pem", "weak_digest_sha1_intermediate.pem", | |
| 1402 "weak_digest_sha1_ee.pem", EXPECT_SHA1 }, | |
| 1403 #endif | |
| 1404 { "weak_digest_md2_root.pem", "weak_digest_sha1_intermediate.pem", | |
| 1405 "weak_digest_sha1_ee.pem", EXPECT_SHA1 }, | |
| 1406 }; | |
| 1407 INSTANTIATE_TEST_CASE_P(VerifyRoot, CertVerifyProcWeakDigestTest, | |
| 1408 testing::ValuesIn(kVerifyRootCATestData)); | |
| 1409 | |
| 1410 // The signature algorithm of intermediates should be properly detected. | |
| 1411 const WeakDigestTestData kVerifyIntermediateCATestData[] = { | |
| 1412 { "weak_digest_sha1_root.pem", "weak_digest_md5_intermediate.pem", | |
| 1413 "weak_digest_sha1_ee.pem", EXPECT_MD5 | EXPECT_SHA1 }, | |
| 1414 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) | |
| 1415 // MD4 is not supported by OS X / NSS | |
| 1416 { "weak_digest_sha1_root.pem", "weak_digest_md4_intermediate.pem", | |
| 1417 "weak_digest_sha1_ee.pem", EXPECT_MD4 | EXPECT_SHA1 }, | |
| 1418 #endif | |
| 1419 { "weak_digest_sha1_root.pem", "weak_digest_md2_intermediate.pem", | |
| 1420 "weak_digest_sha1_ee.pem", EXPECT_MD2 | EXPECT_SHA1 }, | |
| 1421 }; | |
| 1422 // Disabled on NSS - MD4 is not supported, and MD2 and MD5 are disabled. | |
| 1423 #if defined(USE_NSS) || defined(OS_IOS) | |
| 1424 #define MAYBE_VerifyIntermediate DISABLED_VerifyIntermediate | |
| 1425 #else | |
| 1426 #define MAYBE_VerifyIntermediate VerifyIntermediate | |
| 1427 #endif | |
| 1428 WRAPPED_INSTANTIATE_TEST_CASE_P( | |
| 1429 MAYBE_VerifyIntermediate, | |
| 1430 CertVerifyProcWeakDigestTest, | |
| 1431 testing::ValuesIn(kVerifyIntermediateCATestData)); | |
| 1432 | |
| 1433 // The signature algorithm of end-entity should be properly detected. | |
| 1434 const WeakDigestTestData kVerifyEndEntityTestData[] = { | |
| 1435 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", | |
| 1436 "weak_digest_md5_ee.pem", EXPECT_MD5 | EXPECT_SHA1 }, | |
| 1437 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) | |
| 1438 // MD4 is not supported by OS X / NSS | |
| 1439 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", | |
| 1440 "weak_digest_md4_ee.pem", EXPECT_MD4 | EXPECT_SHA1 }, | |
| 1441 #endif | |
| 1442 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", | |
| 1443 "weak_digest_md2_ee.pem", EXPECT_MD2 | EXPECT_SHA1 }, | |
| 1444 }; | |
| 1445 // Disabled on NSS - NSS caches chains/signatures in such a way that cannot | |
| 1446 // be cleared until NSS is cleanly shutdown, which is not presently supported | |
| 1447 // in Chromium. | |
| 1448 #if defined(USE_NSS) || defined(OS_IOS) | |
| 1449 #define MAYBE_VerifyEndEntity DISABLED_VerifyEndEntity | |
| 1450 #else | |
| 1451 #define MAYBE_VerifyEndEntity VerifyEndEntity | |
| 1452 #endif | |
| 1453 WRAPPED_INSTANTIATE_TEST_CASE_P(MAYBE_VerifyEndEntity, | |
| 1454 CertVerifyProcWeakDigestTest, | |
| 1455 testing::ValuesIn(kVerifyEndEntityTestData)); | |
| 1456 | |
| 1457 // Incomplete chains should still report the status of the intermediate. | |
| 1458 const WeakDigestTestData kVerifyIncompleteIntermediateTestData[] = { | |
| 1459 { NULL, "weak_digest_md5_intermediate.pem", "weak_digest_sha1_ee.pem", | |
| 1460 EXPECT_MD5 | EXPECT_SHA1 }, | |
| 1461 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) | |
| 1462 // MD4 is not supported by OS X / NSS | |
| 1463 { NULL, "weak_digest_md4_intermediate.pem", "weak_digest_sha1_ee.pem", | |
| 1464 EXPECT_MD4 | EXPECT_SHA1 }, | |
| 1465 #endif | |
| 1466 { NULL, "weak_digest_md2_intermediate.pem", "weak_digest_sha1_ee.pem", | |
| 1467 EXPECT_MD2 | EXPECT_SHA1 }, | |
| 1468 }; | |
| 1469 // Disabled on NSS - libpkix does not return constructed chains on error, | |
| 1470 // preventing us from detecting/inspecting the verified chain. | |
| 1471 #if defined(USE_NSS) || defined(OS_IOS) | |
| 1472 #define MAYBE_VerifyIncompleteIntermediate \ | |
| 1473 DISABLED_VerifyIncompleteIntermediate | |
| 1474 #else | |
| 1475 #define MAYBE_VerifyIncompleteIntermediate VerifyIncompleteIntermediate | |
| 1476 #endif | |
| 1477 WRAPPED_INSTANTIATE_TEST_CASE_P( | |
| 1478 MAYBE_VerifyIncompleteIntermediate, | |
| 1479 CertVerifyProcWeakDigestTest, | |
| 1480 testing::ValuesIn(kVerifyIncompleteIntermediateTestData)); | |
| 1481 | |
| 1482 // Incomplete chains should still report the status of the end-entity. | |
| 1483 const WeakDigestTestData kVerifyIncompleteEETestData[] = { | |
| 1484 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md5_ee.pem", | |
| 1485 EXPECT_MD5 | EXPECT_SHA1 }, | |
| 1486 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) | |
| 1487 // MD4 is not supported by OS X / NSS | |
| 1488 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md4_ee.pem", | |
| 1489 EXPECT_MD4 | EXPECT_SHA1 }, | |
| 1490 #endif | |
| 1491 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md2_ee.pem", | |
| 1492 EXPECT_MD2 | EXPECT_SHA1 }, | |
| 1493 }; | |
| 1494 // Disabled on NSS - libpkix does not return constructed chains on error, | |
| 1495 // preventing us from detecting/inspecting the verified chain. | |
| 1496 #if defined(USE_NSS) || defined(OS_IOS) | |
| 1497 #define MAYBE_VerifyIncompleteEndEntity DISABLED_VerifyIncompleteEndEntity | |
| 1498 #else | |
| 1499 #define MAYBE_VerifyIncompleteEndEntity VerifyIncompleteEndEntity | |
| 1500 #endif | |
| 1501 WRAPPED_INSTANTIATE_TEST_CASE_P( | |
| 1502 MAYBE_VerifyIncompleteEndEntity, | |
| 1503 CertVerifyProcWeakDigestTest, | |
| 1504 testing::ValuesIn(kVerifyIncompleteEETestData)); | |
| 1505 | |
| 1506 // Differing algorithms between the intermediate and the EE should still be | |
| 1507 // reported. | |
| 1508 const WeakDigestTestData kVerifyMixedTestData[] = { | |
| 1509 { "weak_digest_sha1_root.pem", "weak_digest_md5_intermediate.pem", | |
| 1510 "weak_digest_md2_ee.pem", EXPECT_MD2 | EXPECT_MD5 }, | |
| 1511 { "weak_digest_sha1_root.pem", "weak_digest_md2_intermediate.pem", | |
| 1512 "weak_digest_md5_ee.pem", EXPECT_MD2 | EXPECT_MD5 }, | |
| 1513 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) | |
| 1514 // MD4 is not supported by OS X / NSS | |
| 1515 { "weak_digest_sha1_root.pem", "weak_digest_md4_intermediate.pem", | |
| 1516 "weak_digest_md2_ee.pem", EXPECT_MD2 | EXPECT_MD4 }, | |
| 1517 #endif | |
| 1518 }; | |
| 1519 // NSS does not support MD4 and does not enable MD2 by default, making all | |
| 1520 // permutations invalid. | |
| 1521 #if defined(USE_NSS) || defined(OS_IOS) | |
| 1522 #define MAYBE_VerifyMixed DISABLED_VerifyMixed | |
| 1523 #else | |
| 1524 #define MAYBE_VerifyMixed VerifyMixed | |
| 1525 #endif | |
| 1526 WRAPPED_INSTANTIATE_TEST_CASE_P( | |
| 1527 MAYBE_VerifyMixed, | |
| 1528 CertVerifyProcWeakDigestTest, | |
| 1529 testing::ValuesIn(kVerifyMixedTestData)); | |
| 1530 | |
| 1531 // For the list of valid hostnames, see | |
| 1532 // net/cert/data/ssl/certificates/subjectAltName_sanity_check.pem | |
| 1533 static const struct CertVerifyProcNameData { | |
| 1534 const char* hostname; | |
| 1535 bool valid; // Whether or not |hostname| matches a subjectAltName. | |
| 1536 } kVerifyNameData[] = { | |
| 1537 { "127.0.0.1", false }, // Don't match the common name | |
| 1538 { "127.0.0.2", true }, // Matches the iPAddress SAN (IPv4) | |
| 1539 { "FE80:0:0:0:0:0:0:1", true }, // Matches the iPAddress SAN (IPv6) | |
| 1540 { "[FE80:0:0:0:0:0:0:1]", false }, // Should not match the iPAddress SAN | |
| 1541 { "FE80::1", true }, // Compressed form matches the iPAddress SAN (IPv6) | |
| 1542 { "::127.0.0.2", false }, // IPv6 mapped form should NOT match iPAddress SAN | |
| 1543 { "test.example", true }, // Matches the dNSName SAN | |
| 1544 { "test.example.", true }, // Matches the dNSName SAN (trailing . ignored) | |
| 1545 { "www.test.example", false }, // Should not match the dNSName SAN | |
| 1546 { "test..example", false }, // Should not match the dNSName SAN | |
| 1547 { "test.example..", false }, // Should not match the dNSName SAN | |
| 1548 { ".test.example.", false }, // Should not match the dNSName SAN | |
| 1549 { ".test.example", false }, // Should not match the dNSName SAN | |
| 1550 }; | |
| 1551 | |
| 1552 // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how | |
| 1553 // to output the parameter that was passed. Without this, it will simply | |
| 1554 // attempt to print out the first twenty bytes of the object, which depending | |
| 1555 // on platform and alignment, may result in an invalid read. | |
| 1556 void PrintTo(const CertVerifyProcNameData& data, std::ostream* os) { | |
| 1557 *os << "Hostname: " << data.hostname << "; valid=" << data.valid; | |
| 1558 } | |
| 1559 | |
| 1560 class CertVerifyProcNameTest | |
| 1561 : public CertVerifyProcTest, | |
| 1562 public testing::WithParamInterface<CertVerifyProcNameData> { | |
| 1563 public: | |
| 1564 CertVerifyProcNameTest() {} | |
| 1565 virtual ~CertVerifyProcNameTest() {} | |
| 1566 }; | |
| 1567 | |
| 1568 TEST_P(CertVerifyProcNameTest, VerifyCertName) { | |
| 1569 CertVerifyProcNameData data = GetParam(); | |
| 1570 | |
| 1571 CertificateList cert_list = CreateCertificateListFromFile( | |
| 1572 GetTestCertsDirectory(), "subjectAltName_sanity_check.pem", | |
| 1573 X509Certificate::FORMAT_AUTO); | |
| 1574 ASSERT_EQ(1U, cert_list.size()); | |
| 1575 scoped_refptr<X509Certificate> cert(cert_list[0]); | |
| 1576 | |
| 1577 ScopedTestRoot scoped_root(cert.get()); | |
| 1578 | |
| 1579 CertVerifyResult verify_result; | |
| 1580 int error = Verify(cert.get(), data.hostname, 0, NULL, empty_cert_list_, | |
| 1581 &verify_result); | |
| 1582 if (data.valid) { | |
| 1583 EXPECT_EQ(OK, error); | |
| 1584 EXPECT_FALSE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID); | |
| 1585 } else { | |
| 1586 EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error); | |
| 1587 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID); | |
| 1588 } | |
| 1589 } | |
| 1590 | |
| 1591 WRAPPED_INSTANTIATE_TEST_CASE_P( | |
| 1592 VerifyName, | |
| 1593 CertVerifyProcNameTest, | |
| 1594 testing::ValuesIn(kVerifyNameData)); | |
| 1595 | |
| 1596 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master