1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "chrome/common/net/x509_certificate_model.h" 6 7 #include "base/files/file_path.h" 8 #include "base/path_service.h" 9 #include "net/base/test_data_directory.h" 10 #include "net/cert/nss_cert_database.h" 11 #include "net/test/cert_test_util.h" 12 #include "testing/gtest/include/gtest/gtest.h" 13 14 TEST(X509CertificateModelTest, GetTypeCA) { 15 scoped_refptr<net::X509Certificate> cert( 16 net::ImportCertFromFile(net::GetTestCertsDirectory(), 17 "root_ca_cert.pem")); 18 ASSERT_TRUE(cert.get()); 19 20 #if defined(USE_OPENSSL) 21 // Remove this when OpenSSL build implements the necessary functions. 22 EXPECT_EQ(net::UNKNOWN_CERT, 23 x509_certificate_model::GetType(cert->os_cert_handle())); 24 #else 25 EXPECT_EQ(net::CA_CERT, 26 x509_certificate_model::GetType(cert->os_cert_handle())); 27 28 // Test that explicitly distrusted CA certs are still returned as CA_CERT 29 // type. See http://crbug.com/96654. 30 EXPECT_TRUE(net::NSSCertDatabase::GetInstance()->SetCertTrust( 31 cert.get(), net::CA_CERT, net::NSSCertDatabase::DISTRUSTED_SSL)); 32 33 EXPECT_EQ(net::CA_CERT, 34 x509_certificate_model::GetType(cert->os_cert_handle())); 35 #endif 36 } 37 38 TEST(X509CertificateModelTest, GetTypeServer) { 39 scoped_refptr<net::X509Certificate> cert( 40 net::ImportCertFromFile(net::GetTestCertsDirectory(), 41 "google.single.der")); 42 ASSERT_TRUE(cert.get()); 43 44 #if defined(USE_OPENSSL) 45 // Remove this when OpenSSL build implements the necessary functions. 46 EXPECT_EQ(net::UNKNOWN_CERT, 47 x509_certificate_model::GetType(cert->os_cert_handle())); 48 #else 49 // Test mozilla_security_manager::GetCertType with server certs and default 50 // trust. Currently this doesn't work. 51 // TODO(mattm): make mozilla_security_manager::GetCertType smarter so we can 52 // tell server certs even if they have no trust bits set. 53 EXPECT_EQ(net::UNKNOWN_CERT, 54 x509_certificate_model::GetType(cert->os_cert_handle())); 55 56 net::NSSCertDatabase* cert_db = net::NSSCertDatabase::GetInstance(); 57 // Test GetCertType with server certs and explicit trust. 58 EXPECT_TRUE(cert_db->SetCertTrust( 59 cert.get(), net::SERVER_CERT, net::NSSCertDatabase::TRUSTED_SSL)); 60 61 EXPECT_EQ(net::SERVER_CERT, 62 x509_certificate_model::GetType(cert->os_cert_handle())); 63 64 // Test GetCertType with server certs and explicit distrust. 65 EXPECT_TRUE(cert_db->SetCertTrust( 66 cert.get(), net::SERVER_CERT, net::NSSCertDatabase::DISTRUSTED_SSL)); 67 68 EXPECT_EQ(net::SERVER_CERT, 69 x509_certificate_model::GetType(cert->os_cert_handle())); 70 #endif 71 } 72 73 // An X.509 v1 certificate with the version field omitted should get 74 // the default value v1. 75 TEST(X509CertificateModelTest, GetVersionOmitted) { 76 scoped_refptr<net::X509Certificate> cert( 77 net::ImportCertFromFile(net::GetTestCertsDirectory(), 78 "ndn.ca.crt")); 79 ASSERT_TRUE(cert.get()); 80 81 EXPECT_EQ("1", x509_certificate_model::GetVersion(cert->os_cert_handle())); 82 } 83
