Home | History | Annotate | Download | only in cert 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef NET_CERT_TEST_ROOT_CERTS_H_
      6 #define NET_CERT_TEST_ROOT_CERTS_H_
      7 
      8 #include "base/lazy_instance.h"
      9 #include "base/memory/ref_counted.h"
     10 #include "build/build_config.h"
     11 #include "net/base/net_export.h"
     12 
     13 #if defined(USE_NSS) || defined(OS_IOS)
     14 #include <list>
     15 #elif defined(OS_WIN)
     16 #include <windows.h>
     17 #include <wincrypt.h>
     18 #elif defined(OS_MACOSX)
     19 #include <CoreFoundation/CFArray.h>
     20 #include <Security/SecTrust.h>
     21 #include "base/mac/scoped_cftyperef.h"
     22 #endif
     23 
     24 namespace base {
     25 class FilePath;
     26 }
     27 
     28 namespace net {
     29 
     30 class X509Certificate;
     31 
     32 // TestRootCerts is a helper class for unit tests that is used to
     33 // artificially mark a certificate as trusted, independent of the local
     34 // machine configuration.
     35 class NET_EXPORT_PRIVATE TestRootCerts {
     36  public:
     37   // Obtains the Singleton instance to the trusted certificates.
     38   static TestRootCerts* GetInstance();
     39 
     40   // Returns true if an instance exists, without forcing an initialization.
     41   static bool HasInstance();
     42 
     43   // Marks |certificate| as trusted for X509Certificate::Verify(). Returns
     44   // false if the certificate could not be marked trusted.
     45   bool Add(X509Certificate* certificate);
     46 
     47   // Reads a single certificate from |file| and marks it as trusted. Returns
     48   // false if an error is encountered, such as being unable to read |file|
     49   // or more than one certificate existing in |file|.
     50   bool AddFromFile(const base::FilePath& file);
     51 
     52   // Clears the trusted status of any certificates that were previously
     53   // marked trusted via Add().
     54   void Clear();
     55 
     56   // Returns true if there are no certificates that have been marked trusted.
     57   bool IsEmpty() const;
     58 
     59 #if defined(OS_MACOSX) && !defined(OS_IOS)
     60   CFArrayRef temporary_roots() const { return temporary_roots_; }
     61 
     62   // Modifies the root certificates of |trust_ref| to include the
     63   // certificates stored in |temporary_roots_|. If IsEmpty() is true, this
     64   // does not modify |trust_ref|.
     65   OSStatus FixupSecTrustRef(SecTrustRef trust_ref) const;
     66 
     67   // Configures whether or not the default/system root store should also
     68   // be trusted. By default, this is true, indicating that the TestRootCerts
     69   // are used in addition to OS trust store.
     70   void SetAllowSystemTrust(bool allow_system_trust);
     71 
     72 #elif defined(OS_WIN)
     73   HCERTSTORE temporary_roots() const { return temporary_roots_; }
     74 
     75   // Returns an HCERTCHAINENGINE suitable to be used for certificate
     76   // validation routines, or NULL to indicate that the default system chain
     77   // engine is appropriate. The caller is responsible for freeing the
     78   // returned HCERTCHAINENGINE.
     79   HCERTCHAINENGINE GetChainEngine() const;
     80 #endif
     81 
     82  private:
     83   friend struct base::DefaultLazyInstanceTraits<TestRootCerts>;
     84 
     85   TestRootCerts();
     86   ~TestRootCerts();
     87 
     88   // Performs platform-dependent initialization.
     89   void Init();
     90 
     91 #if defined(USE_NSS) || defined(OS_IOS)
     92   // It is necessary to maintain a cache of the original certificate trust
     93   // settings, in order to restore them when Clear() is called.
     94   class TrustEntry;
     95   std::list<TrustEntry*> trust_cache_;
     96 #elif defined(OS_WIN)
     97   HCERTSTORE temporary_roots_;
     98 #elif defined(OS_MACOSX)
     99   base::ScopedCFTypeRef<CFMutableArrayRef> temporary_roots_;
    100   bool allow_system_trust_;
    101 #endif
    102 
    103 #if defined(OS_WIN) || defined(USE_OPENSSL)
    104   // True if there are no temporarily trusted root certificates.
    105   bool empty_;
    106 #endif
    107 
    108   DISALLOW_COPY_AND_ASSIGN(TestRootCerts);
    109 };
    110 
    111 // Scoped helper for unittests to handle safely managing trusted roots.
    112 class NET_EXPORT_PRIVATE ScopedTestRoot {
    113  public:
    114   ScopedTestRoot();
    115   // Creates a ScopedTestRoot that will adds|cert| to the TestRootCerts store.
    116   explicit ScopedTestRoot(X509Certificate* cert);
    117   ~ScopedTestRoot();
    118 
    119   // Assigns |cert| to be the new test root cert. If |cert| is NULL, undoes
    120   // any work the ScopedTestRoot may have previously done.
    121   // If |cert_| contains a certificate (due to a prior call to Reset or due to
    122   // a cert being passed at construction), the existing TestRootCerts store is
    123   // cleared.
    124   void Reset(X509Certificate* cert);
    125 
    126  private:
    127   scoped_refptr<X509Certificate> cert_;
    128 
    129   DISALLOW_COPY_AND_ASSIGN(ScopedTestRoot);
    130 };
    131 
    132 }  // namespace net
    133 
    134 #endif  // NET_CERT_TEST_ROOT_CERTS_H_
    135