1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "net/cert/x509_certificate.h" 6 7 #include "base/basictypes.h" 8 #include "base/files/file_path.h" 9 #include "base/memory/scoped_ptr.h" 10 #include "base/pickle.h" 11 #include "base/sha1.h" 12 #include "base/strings/string_number_conversions.h" 13 #include "base/strings/string_split.h" 14 #include "crypto/rsa_private_key.h" 15 #include "net/base/net_errors.h" 16 #include "net/base/test_data_directory.h" 17 #include "net/cert/asn1_util.h" 18 #include "net/test/cert_test_util.h" 19 #include "net/test/test_certificate_data.h" 20 #include "testing/gtest/include/gtest/gtest.h" 21 22 #if defined(USE_NSS) 23 #include <cert.h> 24 #endif 25 26 #if defined(OS_WIN) 27 #include "base/win/windows_version.h" 28 #endif 29 30 using base::HexEncode; 31 using base::Time; 32 33 namespace net { 34 35 // Certificates for test data. They're obtained with: 36 // 37 // $ openssl s_client -connect [host]:443 -showcerts > /tmp/host.pem < /dev/null 38 // $ openssl x509 -inform PEM -outform DER < /tmp/host.pem > /tmp/host.der 39 // 40 // For fingerprint 41 // $ openssl x509 -inform DER -fingerprint -noout < /tmp/host.der 42 43 // For valid_start, valid_expiry 44 // $ openssl x509 -inform DER -text -noout < /tmp/host.der | 45 // grep -A 2 Validity 46 // $ date +%s -d '<date str>' 47 48 // Google's cert. 49 uint8 google_fingerprint[] = { 50 0xab, 0xbe, 0x5e, 0xb4, 0x93, 0x88, 0x4e, 0xe4, 0x60, 0xc6, 0xef, 0xf8, 51 0xea, 0xd4, 0xb1, 0x55, 0x4b, 0xc9, 0x59, 0x3c 52 }; 53 54 // webkit.org's cert. 55 uint8 webkit_fingerprint[] = { 56 0xa1, 0x4a, 0x94, 0x46, 0x22, 0x8e, 0x70, 0x66, 0x2b, 0x94, 0xf9, 0xf8, 57 0x57, 0x83, 0x2d, 0xa2, 0xff, 0xbc, 0x84, 0xc2 58 }; 59 60 // thawte.com's cert (it's EV-licious!). 61 uint8 thawte_fingerprint[] = { 62 0x85, 0x04, 0x2d, 0xfd, 0x2b, 0x0e, 0xc6, 0xc8, 0xaf, 0x2d, 0x77, 0xd6, 63 0xa1, 0x3a, 0x64, 0x04, 0x27, 0x90, 0x97, 0x37 64 }; 65 66 // A certificate for https://www.unosoft.hu/, whose AIA extension contains 67 // an LDAP URL without a host name. 68 uint8 unosoft_hu_fingerprint[] = { 69 0x32, 0xff, 0xe3, 0xbe, 0x2c, 0x3b, 0xc7, 0xca, 0xbf, 0x2d, 0x64, 0xbd, 70 0x25, 0x66, 0xf2, 0xec, 0x8b, 0x0f, 0xbf, 0xd8 71 }; 72 73 // The fingerprint of the Google certificate used in the parsing tests, 74 // which is newer than the one included in the x509_certificate_data.h 75 uint8 google_parse_fingerprint[] = { 76 0x40, 0x50, 0x62, 0xe5, 0xbe, 0xfd, 0xe4, 0xaf, 0x97, 0xe9, 0x38, 0x2a, 77 0xf1, 0x6c, 0xc8, 0x7c, 0x8f, 0xb7, 0xc4, 0xe2 78 }; 79 80 // The fingerprint for the Thawte SGC certificate 81 uint8 thawte_parse_fingerprint[] = { 82 0xec, 0x07, 0x10, 0x03, 0xd8, 0xf5, 0xa3, 0x7f, 0x42, 0xc4, 0x55, 0x7f, 83 0x65, 0x6a, 0xae, 0x86, 0x65, 0xfa, 0x4b, 0x02 84 }; 85 86 // Dec 18 00:00:00 2009 GMT 87 const double kGoogleParseValidFrom = 1261094400; 88 // Dec 18 23:59:59 2011 GMT 89 const double kGoogleParseValidTo = 1324252799; 90 91 void CheckGoogleCert(const scoped_refptr<X509Certificate>& google_cert, 92 uint8* expected_fingerprint, 93 double valid_from, double valid_to) { 94 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_cert); 95 96 const CertPrincipal& subject = google_cert->subject(); 97 EXPECT_EQ("www.google.com", subject.common_name); 98 EXPECT_EQ("Mountain View", subject.locality_name); 99 EXPECT_EQ("California", subject.state_or_province_name); 100 EXPECT_EQ("US", subject.country_name); 101 EXPECT_EQ(0U, subject.street_addresses.size()); 102 ASSERT_EQ(1U, subject.organization_names.size()); 103 EXPECT_EQ("Google Inc", subject.organization_names[0]); 104 EXPECT_EQ(0U, subject.organization_unit_names.size()); 105 EXPECT_EQ(0U, subject.domain_components.size()); 106 107 const CertPrincipal& issuer = google_cert->issuer(); 108 EXPECT_EQ("Thawte SGC CA", issuer.common_name); 109 EXPECT_EQ("", issuer.locality_name); 110 EXPECT_EQ("", issuer.state_or_province_name); 111 EXPECT_EQ("ZA", issuer.country_name); 112 EXPECT_EQ(0U, issuer.street_addresses.size()); 113 ASSERT_EQ(1U, issuer.organization_names.size()); 114 EXPECT_EQ("Thawte Consulting (Pty) Ltd.", issuer.organization_names[0]); 115 EXPECT_EQ(0U, issuer.organization_unit_names.size()); 116 EXPECT_EQ(0U, issuer.domain_components.size()); 117 118 // Use DoubleT because its epoch is the same on all platforms 119 const Time& valid_start = google_cert->valid_start(); 120 EXPECT_EQ(valid_from, valid_start.ToDoubleT()); 121 122 const Time& valid_expiry = google_cert->valid_expiry(); 123 EXPECT_EQ(valid_to, valid_expiry.ToDoubleT()); 124 125 const SHA1HashValue& fingerprint = google_cert->fingerprint(); 126 for (size_t i = 0; i < 20; ++i) 127 EXPECT_EQ(expected_fingerprint[i], fingerprint.data[i]); 128 129 std::vector<std::string> dns_names; 130 google_cert->GetDNSNames(&dns_names); 131 ASSERT_EQ(1U, dns_names.size()); 132 EXPECT_EQ("www.google.com", dns_names[0]); 133 } 134 135 TEST(X509CertificateTest, GoogleCertParsing) { 136 scoped_refptr<X509Certificate> google_cert( 137 X509Certificate::CreateFromBytes( 138 reinterpret_cast<const char*>(google_der), sizeof(google_der))); 139 140 CheckGoogleCert(google_cert, google_fingerprint, 141 1238192407, // Mar 27 22:20:07 2009 GMT 142 1269728407); // Mar 27 22:20:07 2010 GMT 143 } 144 145 TEST(X509CertificateTest, WebkitCertParsing) { 146 scoped_refptr<X509Certificate> webkit_cert(X509Certificate::CreateFromBytes( 147 reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der))); 148 149 ASSERT_NE(static_cast<X509Certificate*>(NULL), webkit_cert); 150 151 const CertPrincipal& subject = webkit_cert->subject(); 152 EXPECT_EQ("Cupertino", subject.locality_name); 153 EXPECT_EQ("California", subject.state_or_province_name); 154 EXPECT_EQ("US", subject.country_name); 155 EXPECT_EQ(0U, subject.street_addresses.size()); 156 ASSERT_EQ(1U, subject.organization_names.size()); 157 EXPECT_EQ("Apple Inc.", subject.organization_names[0]); 158 ASSERT_EQ(1U, subject.organization_unit_names.size()); 159 EXPECT_EQ("Mac OS Forge", subject.organization_unit_names[0]); 160 EXPECT_EQ(0U, subject.domain_components.size()); 161 162 const CertPrincipal& issuer = webkit_cert->issuer(); 163 EXPECT_EQ("Go Daddy Secure Certification Authority", issuer.common_name); 164 EXPECT_EQ("Scottsdale", issuer.locality_name); 165 EXPECT_EQ("Arizona", issuer.state_or_province_name); 166 EXPECT_EQ("US", issuer.country_name); 167 EXPECT_EQ(0U, issuer.street_addresses.size()); 168 ASSERT_EQ(1U, issuer.organization_names.size()); 169 EXPECT_EQ("GoDaddy.com, Inc.", issuer.organization_names[0]); 170 ASSERT_EQ(1U, issuer.organization_unit_names.size()); 171 EXPECT_EQ("http://certificates.godaddy.com/repository", 172 issuer.organization_unit_names[0]); 173 EXPECT_EQ(0U, issuer.domain_components.size()); 174 175 // Use DoubleT because its epoch is the same on all platforms 176 const Time& valid_start = webkit_cert->valid_start(); 177 EXPECT_EQ(1205883319, valid_start.ToDoubleT()); // Mar 18 23:35:19 2008 GMT 178 179 const Time& valid_expiry = webkit_cert->valid_expiry(); 180 EXPECT_EQ(1300491319, valid_expiry.ToDoubleT()); // Mar 18 23:35:19 2011 GMT 181 182 const SHA1HashValue& fingerprint = webkit_cert->fingerprint(); 183 for (size_t i = 0; i < 20; ++i) 184 EXPECT_EQ(webkit_fingerprint[i], fingerprint.data[i]); 185 186 std::vector<std::string> dns_names; 187 webkit_cert->GetDNSNames(&dns_names); 188 ASSERT_EQ(2U, dns_names.size()); 189 EXPECT_EQ("*.webkit.org", dns_names[0]); 190 EXPECT_EQ("webkit.org", dns_names[1]); 191 192 // Test that the wildcard cert matches properly. 193 bool unused = false; 194 EXPECT_TRUE(webkit_cert->VerifyNameMatch("www.webkit.org", &unused)); 195 EXPECT_TRUE(webkit_cert->VerifyNameMatch("foo.webkit.org", &unused)); 196 EXPECT_TRUE(webkit_cert->VerifyNameMatch("webkit.org", &unused)); 197 EXPECT_FALSE(webkit_cert->VerifyNameMatch("www.webkit.com", &unused)); 198 EXPECT_FALSE(webkit_cert->VerifyNameMatch("www.foo.webkit.com", &unused)); 199 } 200 201 TEST(X509CertificateTest, ThawteCertParsing) { 202 scoped_refptr<X509Certificate> thawte_cert(X509Certificate::CreateFromBytes( 203 reinterpret_cast<const char*>(thawte_der), sizeof(thawte_der))); 204 205 ASSERT_NE(static_cast<X509Certificate*>(NULL), thawte_cert); 206 207 const CertPrincipal& subject = thawte_cert->subject(); 208 EXPECT_EQ("www.thawte.com", subject.common_name); 209 EXPECT_EQ("Mountain View", subject.locality_name); 210 EXPECT_EQ("California", subject.state_or_province_name); 211 EXPECT_EQ("US", subject.country_name); 212 EXPECT_EQ(0U, subject.street_addresses.size()); 213 ASSERT_EQ(1U, subject.organization_names.size()); 214 EXPECT_EQ("Thawte Inc", subject.organization_names[0]); 215 EXPECT_EQ(0U, subject.organization_unit_names.size()); 216 EXPECT_EQ(0U, subject.domain_components.size()); 217 218 const CertPrincipal& issuer = thawte_cert->issuer(); 219 EXPECT_EQ("thawte Extended Validation SSL CA", issuer.common_name); 220 EXPECT_EQ("", issuer.locality_name); 221 EXPECT_EQ("", issuer.state_or_province_name); 222 EXPECT_EQ("US", issuer.country_name); 223 EXPECT_EQ(0U, issuer.street_addresses.size()); 224 ASSERT_EQ(1U, issuer.organization_names.size()); 225 EXPECT_EQ("thawte, Inc.", issuer.organization_names[0]); 226 ASSERT_EQ(1U, issuer.organization_unit_names.size()); 227 EXPECT_EQ("Terms of use at https://www.thawte.com/cps (c)06", 228 issuer.organization_unit_names[0]); 229 EXPECT_EQ(0U, issuer.domain_components.size()); 230 231 // Use DoubleT because its epoch is the same on all platforms 232 const Time& valid_start = thawte_cert->valid_start(); 233 EXPECT_EQ(1227052800, valid_start.ToDoubleT()); // Nov 19 00:00:00 2008 GMT 234 235 const Time& valid_expiry = thawte_cert->valid_expiry(); 236 EXPECT_EQ(1263772799, valid_expiry.ToDoubleT()); // Jan 17 23:59:59 2010 GMT 237 238 const SHA1HashValue& fingerprint = thawte_cert->fingerprint(); 239 for (size_t i = 0; i < 20; ++i) 240 EXPECT_EQ(thawte_fingerprint[i], fingerprint.data[i]); 241 242 std::vector<std::string> dns_names; 243 thawte_cert->GetDNSNames(&dns_names); 244 ASSERT_EQ(1U, dns_names.size()); 245 EXPECT_EQ("www.thawte.com", dns_names[0]); 246 } 247 248 // Test that all desired AttributeAndValue pairs can be extracted when only 249 // a single RelativeDistinguishedName is present. "Normally" there is only 250 // one AVA per RDN, but some CAs place all AVAs within a single RDN. 251 // This is a regression test for http://crbug.com/101009 252 TEST(X509CertificateTest, MultivalueRDN) { 253 base::FilePath certs_dir = GetTestCertsDirectory(); 254 255 scoped_refptr<X509Certificate> multivalue_rdn_cert = 256 ImportCertFromFile(certs_dir, "multivalue_rdn.pem"); 257 ASSERT_NE(static_cast<X509Certificate*>(NULL), multivalue_rdn_cert); 258 259 const CertPrincipal& subject = multivalue_rdn_cert->subject(); 260 EXPECT_EQ("Multivalue RDN Test", subject.common_name); 261 EXPECT_EQ("", subject.locality_name); 262 EXPECT_EQ("", subject.state_or_province_name); 263 EXPECT_EQ("US", subject.country_name); 264 EXPECT_EQ(0U, subject.street_addresses.size()); 265 ASSERT_EQ(1U, subject.organization_names.size()); 266 EXPECT_EQ("Chromium", subject.organization_names[0]); 267 ASSERT_EQ(1U, subject.organization_unit_names.size()); 268 EXPECT_EQ("Chromium net_unittests", subject.organization_unit_names[0]); 269 ASSERT_EQ(1U, subject.domain_components.size()); 270 EXPECT_EQ("Chromium", subject.domain_components[0]); 271 } 272 273 // Test that characters which would normally be escaped in the string form, 274 // such as '=' or '"', are not escaped when parsed as individual components. 275 // This is a regression test for http://crbug.com/102839 276 TEST(X509CertificateTest, UnescapedSpecialCharacters) { 277 base::FilePath certs_dir = GetTestCertsDirectory(); 278 279 scoped_refptr<X509Certificate> unescaped_cert = 280 ImportCertFromFile(certs_dir, "unescaped.pem"); 281 ASSERT_NE(static_cast<X509Certificate*>(NULL), unescaped_cert); 282 283 const CertPrincipal& subject = unescaped_cert->subject(); 284 EXPECT_EQ("127.0.0.1", subject.common_name); 285 EXPECT_EQ("Mountain View", subject.locality_name); 286 EXPECT_EQ("California", subject.state_or_province_name); 287 EXPECT_EQ("US", subject.country_name); 288 ASSERT_EQ(1U, subject.street_addresses.size()); 289 EXPECT_EQ("1600 Amphitheatre Parkway", subject.street_addresses[0]); 290 ASSERT_EQ(1U, subject.organization_names.size()); 291 EXPECT_EQ("Chromium = \"net_unittests\"", subject.organization_names[0]); 292 ASSERT_EQ(2U, subject.organization_unit_names.size()); 293 EXPECT_EQ("net_unittests", subject.organization_unit_names[0]); 294 EXPECT_EQ("Chromium", subject.organization_unit_names[1]); 295 EXPECT_EQ(0U, subject.domain_components.size()); 296 } 297 298 TEST(X509CertificateTest, SerialNumbers) { 299 scoped_refptr<X509Certificate> google_cert( 300 X509Certificate::CreateFromBytes( 301 reinterpret_cast<const char*>(google_der), sizeof(google_der))); 302 303 static const uint8 google_serial[16] = { 304 0x01,0x2a,0x39,0x76,0x0d,0x3f,0x4f,0xc9, 305 0x0b,0xe7,0xbd,0x2b,0xcf,0x95,0x2e,0x7a, 306 }; 307 308 ASSERT_EQ(sizeof(google_serial), google_cert->serial_number().size()); 309 EXPECT_TRUE(memcmp(google_cert->serial_number().data(), google_serial, 310 sizeof(google_serial)) == 0); 311 312 // We also want to check a serial number where the first byte is >= 0x80 in 313 // case the underlying library tries to pad it. 314 scoped_refptr<X509Certificate> paypal_null_cert( 315 X509Certificate::CreateFromBytes( 316 reinterpret_cast<const char*>(paypal_null_der), 317 sizeof(paypal_null_der))); 318 319 static const uint8 paypal_null_serial[3] = {0x00, 0xf0, 0x9b}; 320 ASSERT_EQ(sizeof(paypal_null_serial), 321 paypal_null_cert->serial_number().size()); 322 EXPECT_TRUE(memcmp(paypal_null_cert->serial_number().data(), 323 paypal_null_serial, sizeof(paypal_null_serial)) == 0); 324 } 325 326 TEST(X509CertificateTest, CAFingerprints) { 327 base::FilePath certs_dir = GetTestCertsDirectory(); 328 329 scoped_refptr<X509Certificate> server_cert = 330 ImportCertFromFile(certs_dir, "salesforce_com_test.pem"); 331 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert); 332 333 scoped_refptr<X509Certificate> intermediate_cert1 = 334 ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2011.pem"); 335 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert1); 336 337 scoped_refptr<X509Certificate> intermediate_cert2 = 338 ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2016.pem"); 339 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert2); 340 341 X509Certificate::OSCertHandles intermediates; 342 intermediates.push_back(intermediate_cert1->os_cert_handle()); 343 scoped_refptr<X509Certificate> cert_chain1 = 344 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 345 intermediates); 346 347 intermediates.clear(); 348 intermediates.push_back(intermediate_cert2->os_cert_handle()); 349 scoped_refptr<X509Certificate> cert_chain2 = 350 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 351 intermediates); 352 353 // No intermediate CA certicates. 354 intermediates.clear(); 355 scoped_refptr<X509Certificate> cert_chain3 = 356 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 357 intermediates); 358 359 static const uint8 cert_chain1_ca_fingerprint[20] = { 360 0xc2, 0xf0, 0x08, 0x7d, 0x01, 0xe6, 0x86, 0x05, 0x3a, 0x4d, 361 0x63, 0x3e, 0x7e, 0x70, 0xd4, 0xef, 0x65, 0xc2, 0xcc, 0x4f 362 }; 363 static const uint8 cert_chain2_ca_fingerprint[20] = { 364 0xd5, 0x59, 0xa5, 0x86, 0x66, 0x9b, 0x08, 0xf4, 0x6a, 0x30, 365 0xa1, 0x33, 0xf8, 0xa9, 0xed, 0x3d, 0x03, 0x8e, 0x2e, 0xa8 366 }; 367 // The SHA-1 hash of nothing. 368 static const uint8 cert_chain3_ca_fingerprint[20] = { 369 0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b, 0x0d, 0x32, 0x55, 370 0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07, 0x09 371 }; 372 EXPECT_TRUE(memcmp(cert_chain1->ca_fingerprint().data, 373 cert_chain1_ca_fingerprint, 20) == 0); 374 EXPECT_TRUE(memcmp(cert_chain2->ca_fingerprint().data, 375 cert_chain2_ca_fingerprint, 20) == 0); 376 EXPECT_TRUE(memcmp(cert_chain3->ca_fingerprint().data, 377 cert_chain3_ca_fingerprint, 20) == 0); 378 } 379 380 TEST(X509CertificateTest, ParseSubjectAltNames) { 381 base::FilePath certs_dir = GetTestCertsDirectory(); 382 383 scoped_refptr<X509Certificate> san_cert = 384 ImportCertFromFile(certs_dir, "subjectAltName_sanity_check.pem"); 385 ASSERT_NE(static_cast<X509Certificate*>(NULL), san_cert); 386 387 std::vector<std::string> dns_names; 388 std::vector<std::string> ip_addresses; 389 san_cert->GetSubjectAltName(&dns_names, &ip_addresses); 390 391 // Ensure that DNS names are correctly parsed. 392 ASSERT_EQ(1U, dns_names.size()); 393 EXPECT_EQ("test.example", dns_names[0]); 394 395 // Ensure that both IPv4 and IPv6 addresses are correctly parsed. 396 ASSERT_EQ(2U, ip_addresses.size()); 397 398 static const uint8 kIPv4Address[] = { 399 0x7F, 0x00, 0x00, 0x02 400 }; 401 ASSERT_EQ(arraysize(kIPv4Address), ip_addresses[0].size()); 402 EXPECT_EQ(0, memcmp(ip_addresses[0].data(), kIPv4Address, 403 arraysize(kIPv4Address))); 404 405 static const uint8 kIPv6Address[] = { 406 0xFE, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 407 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 408 }; 409 ASSERT_EQ(arraysize(kIPv6Address), ip_addresses[1].size()); 410 EXPECT_EQ(0, memcmp(ip_addresses[1].data(), kIPv6Address, 411 arraysize(kIPv6Address))); 412 413 // Ensure the subjectAltName dirName has not influenced the handling of 414 // the subject commonName. 415 EXPECT_EQ("127.0.0.1", san_cert->subject().common_name); 416 } 417 418 TEST(X509CertificateTest, ExtractSPKIFromDERCert) { 419 base::FilePath certs_dir = GetTestCertsDirectory(); 420 scoped_refptr<X509Certificate> cert = 421 ImportCertFromFile(certs_dir, "nist.der"); 422 ASSERT_NE(static_cast<X509Certificate*>(NULL), cert); 423 424 std::string derBytes; 425 EXPECT_TRUE(X509Certificate::GetDEREncoded(cert->os_cert_handle(), 426 &derBytes)); 427 428 base::StringPiece spkiBytes; 429 EXPECT_TRUE(asn1::ExtractSPKIFromDERCert(derBytes, &spkiBytes)); 430 431 uint8 hash[base::kSHA1Length]; 432 base::SHA1HashBytes(reinterpret_cast<const uint8*>(spkiBytes.data()), 433 spkiBytes.size(), hash); 434 435 EXPECT_EQ(0, memcmp(hash, kNistSPKIHash, sizeof(hash))); 436 } 437 438 TEST(X509CertificateTest, ExtractCRLURLsFromDERCert) { 439 base::FilePath certs_dir = GetTestCertsDirectory(); 440 scoped_refptr<X509Certificate> cert = 441 ImportCertFromFile(certs_dir, "nist.der"); 442 ASSERT_NE(static_cast<X509Certificate*>(NULL), cert); 443 444 std::string derBytes; 445 EXPECT_TRUE(X509Certificate::GetDEREncoded(cert->os_cert_handle(), 446 &derBytes)); 447 448 std::vector<base::StringPiece> crl_urls; 449 EXPECT_TRUE(asn1::ExtractCRLURLsFromDERCert(derBytes, &crl_urls)); 450 451 EXPECT_EQ(1u, crl_urls.size()); 452 if (crl_urls.size() > 0) { 453 EXPECT_EQ("http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl", 454 crl_urls[0].as_string()); 455 } 456 } 457 458 // Tests X509CertificateCache via X509Certificate::CreateFromHandle. We 459 // call X509Certificate::CreateFromHandle several times and observe whether 460 // it returns a cached or new OSCertHandle. 461 TEST(X509CertificateTest, Cache) { 462 X509Certificate::OSCertHandle google_cert_handle; 463 X509Certificate::OSCertHandle thawte_cert_handle; 464 465 // Add a single certificate to the certificate cache. 466 google_cert_handle = X509Certificate::CreateOSCertHandleFromBytes( 467 reinterpret_cast<const char*>(google_der), sizeof(google_der)); 468 scoped_refptr<X509Certificate> cert1(X509Certificate::CreateFromHandle( 469 google_cert_handle, X509Certificate::OSCertHandles())); 470 X509Certificate::FreeOSCertHandle(google_cert_handle); 471 472 // Add the same certificate, but as a new handle. 473 google_cert_handle = X509Certificate::CreateOSCertHandleFromBytes( 474 reinterpret_cast<const char*>(google_der), sizeof(google_der)); 475 scoped_refptr<X509Certificate> cert2(X509Certificate::CreateFromHandle( 476 google_cert_handle, X509Certificate::OSCertHandles())); 477 X509Certificate::FreeOSCertHandle(google_cert_handle); 478 479 // A new X509Certificate should be returned. 480 EXPECT_NE(cert1.get(), cert2.get()); 481 // But both instances should share the underlying OS certificate handle. 482 EXPECT_EQ(cert1->os_cert_handle(), cert2->os_cert_handle()); 483 EXPECT_EQ(0u, cert1->GetIntermediateCertificates().size()); 484 EXPECT_EQ(0u, cert2->GetIntermediateCertificates().size()); 485 486 // Add the same certificate, but this time with an intermediate. This 487 // should result in the intermediate being cached. Note that this is not 488 // a legitimate chain, but is suitable for testing. 489 google_cert_handle = X509Certificate::CreateOSCertHandleFromBytes( 490 reinterpret_cast<const char*>(google_der), sizeof(google_der)); 491 thawte_cert_handle = X509Certificate::CreateOSCertHandleFromBytes( 492 reinterpret_cast<const char*>(thawte_der), sizeof(thawte_der)); 493 X509Certificate::OSCertHandles intermediates; 494 intermediates.push_back(thawte_cert_handle); 495 scoped_refptr<X509Certificate> cert3(X509Certificate::CreateFromHandle( 496 google_cert_handle, intermediates)); 497 X509Certificate::FreeOSCertHandle(google_cert_handle); 498 X509Certificate::FreeOSCertHandle(thawte_cert_handle); 499 500 // Test that the new certificate, even with intermediates, results in the 501 // same underlying handle being used. 502 EXPECT_EQ(cert1->os_cert_handle(), cert3->os_cert_handle()); 503 // Though they use the same OS handle, the intermediates should be different. 504 EXPECT_NE(cert1->GetIntermediateCertificates().size(), 505 cert3->GetIntermediateCertificates().size()); 506 } 507 508 TEST(X509CertificateTest, Pickle) { 509 X509Certificate::OSCertHandle google_cert_handle = 510 X509Certificate::CreateOSCertHandleFromBytes( 511 reinterpret_cast<const char*>(google_der), sizeof(google_der)); 512 X509Certificate::OSCertHandle thawte_cert_handle = 513 X509Certificate::CreateOSCertHandleFromBytes( 514 reinterpret_cast<const char*>(thawte_der), sizeof(thawte_der)); 515 516 X509Certificate::OSCertHandles intermediates; 517 intermediates.push_back(thawte_cert_handle); 518 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( 519 google_cert_handle, intermediates); 520 ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get()); 521 522 X509Certificate::FreeOSCertHandle(google_cert_handle); 523 X509Certificate::FreeOSCertHandle(thawte_cert_handle); 524 525 Pickle pickle; 526 cert->Persist(&pickle); 527 528 PickleIterator iter(pickle); 529 scoped_refptr<X509Certificate> cert_from_pickle = 530 X509Certificate::CreateFromPickle( 531 pickle, &iter, X509Certificate::PICKLETYPE_CERTIFICATE_CHAIN_V3); 532 ASSERT_NE(static_cast<X509Certificate*>(NULL), cert_from_pickle); 533 EXPECT_TRUE(X509Certificate::IsSameOSCert( 534 cert->os_cert_handle(), cert_from_pickle->os_cert_handle())); 535 const X509Certificate::OSCertHandles& cert_intermediates = 536 cert->GetIntermediateCertificates(); 537 const X509Certificate::OSCertHandles& pickle_intermediates = 538 cert_from_pickle->GetIntermediateCertificates(); 539 ASSERT_EQ(cert_intermediates.size(), pickle_intermediates.size()); 540 for (size_t i = 0; i < cert_intermediates.size(); ++i) { 541 EXPECT_TRUE(X509Certificate::IsSameOSCert(cert_intermediates[i], 542 pickle_intermediates[i])); 543 } 544 } 545 546 TEST(X509CertificateTest, Policy) { 547 scoped_refptr<X509Certificate> google_cert(X509Certificate::CreateFromBytes( 548 reinterpret_cast<const char*>(google_der), sizeof(google_der))); 549 550 scoped_refptr<X509Certificate> webkit_cert(X509Certificate::CreateFromBytes( 551 reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der))); 552 553 CertPolicy policy; 554 555 // To begin with, everything should be unknown. 556 EXPECT_EQ(CertPolicy::UNKNOWN, 557 policy.Check(google_cert.get(), CERT_STATUS_DATE_INVALID)); 558 EXPECT_EQ(CertPolicy::UNKNOWN, 559 policy.Check(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 560 EXPECT_FALSE(policy.HasAllowedCert()); 561 EXPECT_FALSE(policy.HasDeniedCert()); 562 563 // Test adding one certificate with one error. 564 policy.Allow(google_cert.get(), CERT_STATUS_DATE_INVALID); 565 EXPECT_EQ(CertPolicy::ALLOWED, 566 policy.Check(google_cert.get(), CERT_STATUS_DATE_INVALID)); 567 EXPECT_EQ(CertPolicy::UNKNOWN, 568 policy.Check(google_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 569 EXPECT_EQ(CertPolicy::UNKNOWN, 570 policy.Check(google_cert.get(), 571 CERT_STATUS_DATE_INVALID | CERT_STATUS_COMMON_NAME_INVALID)); 572 EXPECT_EQ(CertPolicy::UNKNOWN, 573 policy.Check(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 574 EXPECT_TRUE(policy.HasAllowedCert()); 575 EXPECT_FALSE(policy.HasDeniedCert()); 576 577 // Test saving the same certificate with a new error. 578 policy.Allow(google_cert.get(), CERT_STATUS_AUTHORITY_INVALID); 579 EXPECT_EQ(CertPolicy::UNKNOWN, 580 policy.Check(google_cert.get(), CERT_STATUS_DATE_INVALID)); 581 EXPECT_EQ(CertPolicy::ALLOWED, 582 policy.Check(google_cert.get(), CERT_STATUS_AUTHORITY_INVALID)); 583 EXPECT_EQ(CertPolicy::UNKNOWN, 584 policy.Check(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 585 EXPECT_TRUE(policy.HasAllowedCert()); 586 EXPECT_FALSE(policy.HasDeniedCert()); 587 588 // Test adding one certificate with two errors. 589 policy.Allow(google_cert.get(), 590 CERT_STATUS_DATE_INVALID | CERT_STATUS_AUTHORITY_INVALID); 591 EXPECT_EQ(CertPolicy::ALLOWED, 592 policy.Check(google_cert.get(), CERT_STATUS_DATE_INVALID)); 593 EXPECT_EQ(CertPolicy::ALLOWED, 594 policy.Check(google_cert.get(), CERT_STATUS_AUTHORITY_INVALID)); 595 EXPECT_EQ(CertPolicy::UNKNOWN, 596 policy.Check(google_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 597 EXPECT_EQ(CertPolicy::UNKNOWN, 598 policy.Check(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 599 EXPECT_TRUE(policy.HasAllowedCert()); 600 EXPECT_FALSE(policy.HasDeniedCert()); 601 602 // Test removing a certificate that was previously allowed. 603 policy.Deny(google_cert.get(), CERT_STATUS_DATE_INVALID); 604 EXPECT_EQ(CertPolicy::DENIED, 605 policy.Check(google_cert.get(), CERT_STATUS_DATE_INVALID)); 606 EXPECT_EQ(CertPolicy::UNKNOWN, 607 policy.Check(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 608 EXPECT_FALSE(policy.HasAllowedCert()); 609 EXPECT_TRUE(policy.HasDeniedCert()); 610 611 // Test removing a certificate that was previously unknown. 612 policy.Deny(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID); 613 EXPECT_EQ(CertPolicy::DENIED, 614 policy.Check(google_cert.get(), CERT_STATUS_DATE_INVALID)); 615 EXPECT_EQ(CertPolicy::DENIED, 616 policy.Check(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 617 EXPECT_FALSE(policy.HasAllowedCert()); 618 EXPECT_TRUE(policy.HasDeniedCert()); 619 620 // Test saving a certificate that was previously denied. 621 policy.Allow(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID); 622 EXPECT_EQ(CertPolicy::DENIED, 623 policy.Check(google_cert.get(), CERT_STATUS_DATE_INVALID)); 624 EXPECT_EQ(CertPolicy::ALLOWED, 625 policy.Check(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 626 EXPECT_TRUE(policy.HasAllowedCert()); 627 EXPECT_TRUE(policy.HasDeniedCert()); 628 629 // Test denying an overlapping certificate. 630 policy.Allow(google_cert.get(), 631 CERT_STATUS_COMMON_NAME_INVALID | CERT_STATUS_DATE_INVALID); 632 policy.Deny(google_cert.get(), CERT_STATUS_DATE_INVALID); 633 EXPECT_EQ(CertPolicy::DENIED, 634 policy.Check(google_cert.get(), CERT_STATUS_DATE_INVALID)); 635 EXPECT_EQ(CertPolicy::UNKNOWN, 636 policy.Check(google_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 637 EXPECT_EQ(CertPolicy::DENIED, 638 policy.Check(google_cert.get(), 639 CERT_STATUS_COMMON_NAME_INVALID | CERT_STATUS_DATE_INVALID)); 640 641 // Test denying an overlapping certificate (other direction). 642 policy.Allow(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID); 643 policy.Deny(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID); 644 policy.Deny(webkit_cert.get(), CERT_STATUS_DATE_INVALID); 645 EXPECT_EQ(CertPolicy::DENIED, 646 policy.Check(webkit_cert.get(), CERT_STATUS_COMMON_NAME_INVALID)); 647 EXPECT_EQ(CertPolicy::DENIED, 648 policy.Check(webkit_cert.get(), CERT_STATUS_DATE_INVALID)); 649 } 650 651 TEST(X509CertificateTest, IntermediateCertificates) { 652 scoped_refptr<X509Certificate> webkit_cert( 653 X509Certificate::CreateFromBytes( 654 reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der))); 655 656 scoped_refptr<X509Certificate> thawte_cert( 657 X509Certificate::CreateFromBytes( 658 reinterpret_cast<const char*>(thawte_der), sizeof(thawte_der))); 659 660 X509Certificate::OSCertHandle google_handle; 661 // Create object with no intermediates: 662 google_handle = X509Certificate::CreateOSCertHandleFromBytes( 663 reinterpret_cast<const char*>(google_der), sizeof(google_der)); 664 X509Certificate::OSCertHandles intermediates1; 665 scoped_refptr<X509Certificate> cert1; 666 cert1 = X509Certificate::CreateFromHandle(google_handle, intermediates1); 667 EXPECT_EQ(0u, cert1->GetIntermediateCertificates().size()); 668 669 // Create object with 2 intermediates: 670 X509Certificate::OSCertHandles intermediates2; 671 intermediates2.push_back(webkit_cert->os_cert_handle()); 672 intermediates2.push_back(thawte_cert->os_cert_handle()); 673 scoped_refptr<X509Certificate> cert2; 674 cert2 = X509Certificate::CreateFromHandle(google_handle, intermediates2); 675 676 // Verify it has all the intermediates: 677 const X509Certificate::OSCertHandles& cert2_intermediates = 678 cert2->GetIntermediateCertificates(); 679 ASSERT_EQ(2u, cert2_intermediates.size()); 680 EXPECT_TRUE(X509Certificate::IsSameOSCert(cert2_intermediates[0], 681 webkit_cert->os_cert_handle())); 682 EXPECT_TRUE(X509Certificate::IsSameOSCert(cert2_intermediates[1], 683 thawte_cert->os_cert_handle())); 684 685 // Cleanup 686 X509Certificate::FreeOSCertHandle(google_handle); 687 } 688 689 TEST(X509CertificateTest, IsIssuedByEncoded) { 690 base::FilePath certs_dir = GetTestCertsDirectory(); 691 692 // Test a client certificate from MIT. 693 scoped_refptr<X509Certificate> mit_davidben_cert( 694 ImportCertFromFile(certs_dir, "mit.davidben.der")); 695 ASSERT_NE(static_cast<X509Certificate*>(NULL), mit_davidben_cert); 696 697 std::string mit_issuer(reinterpret_cast<const char*>(MITDN), 698 sizeof(MITDN)); 699 700 // Test a certificate from Google, issued by Thawte 701 scoped_refptr<X509Certificate> google_cert( 702 ImportCertFromFile(certs_dir, "google.single.der")); 703 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_cert); 704 705 std::string thawte_issuer(reinterpret_cast<const char*>(ThawteDN), 706 sizeof(ThawteDN)); 707 708 // Check that the David Ben certificate is issued by MIT, but not 709 // by Thawte. 710 std::vector<std::string> issuers; 711 issuers.clear(); 712 issuers.push_back(mit_issuer); 713 EXPECT_TRUE(mit_davidben_cert->IsIssuedByEncoded(issuers)); 714 EXPECT_FALSE(google_cert->IsIssuedByEncoded(issuers)); 715 716 // Check that the Google certificate is issued by Thawte and not 717 // by MIT. 718 issuers.clear(); 719 issuers.push_back(thawte_issuer); 720 EXPECT_FALSE(mit_davidben_cert->IsIssuedByEncoded(issuers)); 721 EXPECT_TRUE(google_cert->IsIssuedByEncoded(issuers)); 722 723 // Check that they both pass when given a list of the two issuers. 724 issuers.clear(); 725 issuers.push_back(mit_issuer); 726 issuers.push_back(thawte_issuer); 727 EXPECT_TRUE(mit_davidben_cert->IsIssuedByEncoded(issuers)); 728 EXPECT_TRUE(google_cert->IsIssuedByEncoded(issuers)); 729 } 730 731 TEST(X509CertificateTest, IsIssuedByEncodedWithIntermediates) { 732 static const unsigned char kPolicyRootDN[] = { 733 0x30, 0x1e, 0x31, 0x1c, 0x30, 0x1a, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 734 0x13, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x20, 0x54, 0x65, 0x73, 0x74, 735 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41 736 }; 737 static const unsigned char kPolicyIntermediateDN[] = { 738 0x30, 0x26, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 739 0x1b, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x20, 0x54, 0x65, 0x73, 0x74, 740 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x74, 741 0x65, 0x20, 0x43, 0x41 742 }; 743 744 base::FilePath certs_dir = GetTestCertsDirectory(); 745 746 CertificateList policy_chain = CreateCertificateListFromFile( 747 certs_dir, "explicit-policy-chain.pem", X509Certificate::FORMAT_AUTO); 748 ASSERT_EQ(3u, policy_chain.size()); 749 750 // The intermediate CA certificate's policyConstraints extension has a 751 // requireExplicitPolicy field with SkipCerts=0. 752 std::string policy_intermediate_dn( 753 reinterpret_cast<const char*>(kPolicyIntermediateDN), 754 sizeof(kPolicyIntermediateDN)); 755 std::string policy_root_dn(reinterpret_cast<const char*>(kPolicyRootDN), 756 sizeof(kPolicyRootDN)); 757 758 X509Certificate::OSCertHandles intermediates; 759 intermediates.push_back(policy_chain[1]->os_cert_handle()); 760 scoped_refptr<X509Certificate> cert_chain = 761 X509Certificate::CreateFromHandle(policy_chain[0]->os_cert_handle(), 762 intermediates); 763 764 std::vector<std::string> issuers; 765 766 // Check that the chain is issued by the intermediate. 767 issuers.clear(); 768 issuers.push_back(policy_intermediate_dn); 769 EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers)); 770 771 // Check that the chain is also issued by the root. 772 issuers.clear(); 773 issuers.push_back(policy_root_dn); 774 EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers)); 775 776 // Check that the chain is issued by either the intermediate or the root. 777 issuers.clear(); 778 issuers.push_back(policy_intermediate_dn); 779 issuers.push_back(policy_root_dn); 780 EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers)); 781 782 // Check that an empty issuers list returns false. 783 issuers.clear(); 784 EXPECT_FALSE(cert_chain->IsIssuedByEncoded(issuers)); 785 786 // Check that the chain is not issued by Verisign 787 std::string mit_issuer(reinterpret_cast<const char*>(VerisignDN), 788 sizeof(VerisignDN)); 789 issuers.clear(); 790 issuers.push_back(mit_issuer); 791 EXPECT_FALSE(cert_chain->IsIssuedByEncoded(issuers)); 792 } 793 794 #if defined(USE_NSS) 795 TEST(X509CertificateTest, GetDefaultNickname) { 796 base::FilePath certs_dir = GetTestCertsDirectory(); 797 798 scoped_refptr<X509Certificate> test_cert( 799 ImportCertFromFile(certs_dir, "no_subject_common_name_cert.pem")); 800 ASSERT_NE(static_cast<X509Certificate*>(NULL), test_cert); 801 802 std::string nickname = test_cert->GetDefaultNickname(USER_CERT); 803 EXPECT_EQ("wtc (at) google.com's COMODO Client Authentication and " 804 "Secure Email CA ID", nickname); 805 } 806 #endif 807 808 const struct CertificateFormatTestData { 809 const char* file_name; 810 X509Certificate::Format format; 811 uint8* chain_fingerprints[3]; 812 } kFormatTestData[] = { 813 // DER Parsing - single certificate, DER encoded 814 { "google.single.der", X509Certificate::FORMAT_SINGLE_CERTIFICATE, 815 { google_parse_fingerprint, 816 NULL, } }, 817 // DER parsing - single certificate, PEM encoded 818 { "google.single.pem", X509Certificate::FORMAT_SINGLE_CERTIFICATE, 819 { google_parse_fingerprint, 820 NULL, } }, 821 // PEM parsing - single certificate, PEM encoded with a PEB of 822 // "CERTIFICATE" 823 { "google.single.pem", X509Certificate::FORMAT_PEM_CERT_SEQUENCE, 824 { google_parse_fingerprint, 825 NULL, } }, 826 // PEM parsing - sequence of certificates, PEM encoded with a PEB of 827 // "CERTIFICATE" 828 { "google.chain.pem", X509Certificate::FORMAT_PEM_CERT_SEQUENCE, 829 { google_parse_fingerprint, 830 thawte_parse_fingerprint, 831 NULL, } }, 832 // PKCS#7 parsing - "degenerate" SignedData collection of certificates, DER 833 // encoding 834 { "google.binary.p7b", X509Certificate::FORMAT_PKCS7, 835 { google_parse_fingerprint, 836 thawte_parse_fingerprint, 837 NULL, } }, 838 // PKCS#7 parsing - "degenerate" SignedData collection of certificates, PEM 839 // encoded with a PEM PEB of "CERTIFICATE" 840 { "google.pem_cert.p7b", X509Certificate::FORMAT_PKCS7, 841 { google_parse_fingerprint, 842 thawte_parse_fingerprint, 843 NULL, } }, 844 // PKCS#7 parsing - "degenerate" SignedData collection of certificates, PEM 845 // encoded with a PEM PEB of "PKCS7" 846 { "google.pem_pkcs7.p7b", X509Certificate::FORMAT_PKCS7, 847 { google_parse_fingerprint, 848 thawte_parse_fingerprint, 849 NULL, } }, 850 // All of the above, this time using auto-detection 851 { "google.single.der", X509Certificate::FORMAT_AUTO, 852 { google_parse_fingerprint, 853 NULL, } }, 854 { "google.single.pem", X509Certificate::FORMAT_AUTO, 855 { google_parse_fingerprint, 856 NULL, } }, 857 { "google.chain.pem", X509Certificate::FORMAT_AUTO, 858 { google_parse_fingerprint, 859 thawte_parse_fingerprint, 860 NULL, } }, 861 { "google.binary.p7b", X509Certificate::FORMAT_AUTO, 862 { google_parse_fingerprint, 863 thawte_parse_fingerprint, 864 NULL, } }, 865 { "google.pem_cert.p7b", X509Certificate::FORMAT_AUTO, 866 { google_parse_fingerprint, 867 thawte_parse_fingerprint, 868 NULL, } }, 869 { "google.pem_pkcs7.p7b", X509Certificate::FORMAT_AUTO, 870 { google_parse_fingerprint, 871 thawte_parse_fingerprint, 872 NULL, } }, 873 }; 874 875 class X509CertificateParseTest 876 : public testing::TestWithParam<CertificateFormatTestData> { 877 public: 878 virtual ~X509CertificateParseTest() {} 879 virtual void SetUp() { 880 test_data_ = GetParam(); 881 } 882 virtual void TearDown() {} 883 884 protected: 885 CertificateFormatTestData test_data_; 886 }; 887 888 TEST_P(X509CertificateParseTest, CanParseFormat) { 889 base::FilePath certs_dir = GetTestCertsDirectory(); 890 CertificateList certs = CreateCertificateListFromFile( 891 certs_dir, test_data_.file_name, test_data_.format); 892 ASSERT_FALSE(certs.empty()); 893 ASSERT_LE(certs.size(), arraysize(test_data_.chain_fingerprints)); 894 CheckGoogleCert(certs.front(), google_parse_fingerprint, 895 kGoogleParseValidFrom, kGoogleParseValidTo); 896 897 size_t i; 898 for (i = 0; i < arraysize(test_data_.chain_fingerprints); ++i) { 899 if (test_data_.chain_fingerprints[i] == NULL) { 900 // No more test certificates expected - make sure no more were 901 // returned before marking this test a success. 902 EXPECT_EQ(i, certs.size()); 903 break; 904 } 905 906 // A cert is expected - make sure that one was parsed. 907 ASSERT_LT(i, certs.size()); 908 909 // Compare the parsed certificate with the expected certificate, by 910 // comparing fingerprints. 911 const X509Certificate* cert = certs[i].get(); 912 const SHA1HashValue& actual_fingerprint = cert->fingerprint(); 913 uint8* expected_fingerprint = test_data_.chain_fingerprints[i]; 914 915 for (size_t j = 0; j < 20; ++j) 916 EXPECT_EQ(expected_fingerprint[j], actual_fingerprint.data[j]); 917 } 918 } 919 920 INSTANTIATE_TEST_CASE_P(, X509CertificateParseTest, 921 testing::ValuesIn(kFormatTestData)); 922 923 struct CertificateNameVerifyTestData { 924 // true iff we expect hostname to match an entry in cert_names. 925 bool expected; 926 // The hostname to match. 927 const char* hostname; 928 // Common name, may be used if |dns_names| or |ip_addrs| are empty. 929 const char* common_name; 930 // Comma separated list of certificate names to match against. Any occurrence 931 // of '#' will be replaced with a null character before processing. 932 const char* dns_names; 933 // Comma separated list of certificate IP Addresses to match against. Each 934 // address is x prefixed 16 byte hex code for v6 or dotted-decimals for v4. 935 const char* ip_addrs; 936 }; 937 938 // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how 939 // to output the parameter that was passed. Without this, it will simply 940 // attempt to print out the first twenty bytes of the object, which depending 941 // on platform and alignment, may result in an invalid read. 942 void PrintTo(const CertificateNameVerifyTestData& data, std::ostream* os) { 943 ASSERT_TRUE(data.hostname && data.common_name); 944 // Using StringPiece to allow for optional fields being NULL. 945 *os << " expected: " << data.expected 946 << "; hostname: " << data.hostname 947 << "; common_name: " << data.common_name 948 << "; dns_names: " << base::StringPiece(data.dns_names) 949 << "; ip_addrs: " << base::StringPiece(data.ip_addrs); 950 } 951 952 const CertificateNameVerifyTestData kNameVerifyTestData[] = { 953 { true, "foo.com", "foo.com" }, 954 { true, "f", "f" }, 955 { false, "h", "i" }, 956 { true, "bar.foo.com", "*.foo.com" }, 957 { true, "www.test.fr", "common.name", 958 "*.test.com,*.test.co.uk,*.test.de,*.test.fr" }, 959 { true, "wwW.tESt.fr", "common.name", 960 ",*.*,*.test.de,*.test.FR,www" }, 961 { false, "f.uk", ".uk" }, 962 { false, "w.bar.foo.com", "?.bar.foo.com" }, 963 { false, "www.foo.com", "(www|ftp).foo.com" }, 964 { false, "www.foo.com", "www.foo.com#" }, // # = null char. 965 { false, "www.foo.com", "", "www.foo.com#*.foo.com,#,#" }, 966 { false, "www.house.example", "ww.house.example" }, 967 { false, "test.org", "", "www.test.org,*.test.org,*.org" }, 968 { false, "w.bar.foo.com", "w*.bar.foo.com" }, 969 { false, "www.bar.foo.com", "ww*ww.bar.foo.com" }, 970 { false, "wwww.bar.foo.com", "ww*ww.bar.foo.com" }, 971 { true, "wwww.bar.foo.com", "w*w.bar.foo.com" }, 972 { false, "wwww.bar.foo.com", "w*w.bar.foo.c0m" }, 973 { true, "WALLY.bar.foo.com", "wa*.bar.foo.com" }, 974 { true, "wally.bar.foo.com", "*Ly.bar.foo.com" }, 975 { true, "ww%57.foo.com", "", "www.foo.com" }, 976 { true, "www&.foo.com", "www%26.foo.com" }, 977 // Common name must not be used if subject alternative name was provided. 978 { false, "www.test.co.jp", "www.test.co.jp", 979 "*.test.de,*.jp,www.test.co.uk,www.*.co.jp" }, 980 { false, "www.bar.foo.com", "www.bar.foo.com", 981 "*.foo.com,*.*.foo.com,*.*.bar.foo.com,*..bar.foo.com," }, 982 { false, "www.bath.org", "www.bath.org", "", "20.30.40.50" }, 983 { false, "66.77.88.99", "www.bath.org", "www.bath.org" }, 984 // IDN tests 985 { true, "xn--poema-9qae5a.com.br", "xn--poema-9qae5a.com.br" }, 986 { true, "www.xn--poema-9qae5a.com.br", "*.xn--poema-9qae5a.com.br" }, 987 { false, "xn--poema-9qae5a.com.br", "", "*.xn--poema-9qae5a.com.br," 988 "xn--poema-*.com.br," 989 "xn--*-9qae5a.com.br," 990 "*--poema-9qae5a.com.br" }, 991 // The following are adapted from the examples quoted from 992 // http://tools.ietf.org/html/rfc6125#section-6.4.3 993 // (e.g., *.example.com would match foo.example.com but 994 // not bar.foo.example.com or example.com). 995 { true, "foo.example.com", "*.example.com" }, 996 { false, "bar.foo.example.com", "*.example.com" }, 997 { false, "example.com", "*.example.com" }, 998 // (e.g., baz*.example.net and *baz.example.net and b*z.example.net would 999 // be taken to match baz1.example.net and foobaz.example.net and 1000 // buzz.example.net, respectively 1001 { true, "baz1.example.net", "baz*.example.net" }, 1002 { true, "foobaz.example.net", "*baz.example.net" }, 1003 { true, "buzz.example.net", "b*z.example.net" }, 1004 // Wildcards should not be valid for public registry controlled domains, 1005 // and unknown/unrecognized domains, at least three domain components must 1006 // be present. 1007 { true, "www.test.example", "*.test.example" }, 1008 { true, "test.example.co.uk", "*.example.co.uk" }, 1009 { false, "test.example", "*.exmaple" }, 1010 { false, "example.co.uk", "*.co.uk" }, 1011 { false, "foo.com", "*.com" }, 1012 { false, "foo.us", "*.us" }, 1013 { false, "foo", "*" }, 1014 // IDN variants of wildcards and registry controlled domains. 1015 { true, "www.xn--poema-9qae5a.com.br", "*.xn--poema-9qae5a.com.br" }, 1016 { true, "test.example.xn--mgbaam7a8h", "*.example.xn--mgbaam7a8h" }, 1017 { false, "xn--poema-9qae5a.com.br", "*.com.br" }, 1018 { false, "example.xn--mgbaam7a8h", "*.xn--mgbaam7a8h" }, 1019 // Wildcards should be permissible for 'private' registry controlled 1020 // domains. 1021 { true, "www.appspot.com", "*.appspot.com" }, 1022 { true, "foo.s3.amazonaws.com", "*.s3.amazonaws.com" }, 1023 // Multiple wildcards are not valid. 1024 { false, "foo.example.com", "*.*.com" }, 1025 { false, "foo.bar.example.com", "*.bar.*.com" }, 1026 // Absolute vs relative DNS name tests. Although not explicitly specified 1027 // in RFC 6125, absolute reference names (those ending in a .) should 1028 // match either absolute or relative presented names. 1029 { true, "foo.com", "foo.com." }, 1030 { true, "foo.com.", "foo.com" }, 1031 { true, "foo.com.", "foo.com." }, 1032 { true, "f", "f." }, 1033 { true, "f.", "f" }, 1034 { true, "f.", "f." }, 1035 { true, "www-3.bar.foo.com", "*.bar.foo.com." }, 1036 { true, "www-3.bar.foo.com.", "*.bar.foo.com" }, 1037 { true, "www-3.bar.foo.com.", "*.bar.foo.com." }, 1038 { false, ".", "." }, 1039 { false, "example.com", "*.com." }, 1040 { false, "example.com.", "*.com" }, 1041 { false, "example.com.", "*.com." }, 1042 { false, "foo.", "*." }, 1043 { false, "foo", "*." }, 1044 { false, "foo.co.uk", "*.co.uk." }, 1045 { false, "foo.co.uk.", "*.co.uk." }, 1046 // IP addresses in common name; IPv4 only. 1047 { true, "127.0.0.1", "127.0.0.1" }, 1048 { true, "192.168.1.1", "192.168.1.1" }, 1049 { true, "676768", "0.10.83.160" }, 1050 { true, "1.2.3", "1.2.0.3" }, 1051 { false, "192.169.1.1", "192.168.1.1" }, 1052 { false, "12.19.1.1", "12.19.1.1/255.255.255.0" }, 1053 { false, "FEDC:ba98:7654:3210:FEDC:BA98:7654:3210", 1054 "FEDC:BA98:7654:3210:FEDC:ba98:7654:3210" }, 1055 { false, "1111:2222:3333:4444:5555:6666:7777:8888", 1056 "1111:2222:3333:4444:5555:6666:7777:8888" }, 1057 { false, "::192.9.5.5", "[::192.9.5.5]" }, 1058 // No wildcard matching in valid IP addresses 1059 { false, "::192.9.5.5", "*.9.5.5" }, 1060 { false, "2010:836B:4179::836B:4179", "*:836B:4179::836B:4179" }, 1061 { false, "192.168.1.11", "*.168.1.11" }, 1062 { false, "FEDC:BA98:7654:3210:FEDC:BA98:7654:3210", "*.]" }, 1063 // IP addresses in subject alternative name (common name ignored) 1064 { true, "10.1.2.3", "", "", "10.1.2.3" }, 1065 { true, "14.15", "", "", "14.0.0.15" }, 1066 { false, "10.1.2.7", "10.1.2.7", "", "10.1.2.6,10.1.2.8" }, 1067 { false, "10.1.2.8", "10.20.2.8", "foo" }, 1068 { true, "::4.5.6.7", "", "", "x00000000000000000000000004050607" }, 1069 { false, "::6.7.8.9", "::6.7.8.9", "::6.7.8.9", 1070 "x00000000000000000000000006070808,x0000000000000000000000000607080a," 1071 "xff000000000000000000000006070809,6.7.8.9" }, 1072 { true, "FE80::200:f8ff:fe21:67cf", "no.common.name", "", 1073 "x00000000000000000000000006070808,xfe800000000000000200f8fffe2167cf," 1074 "xff0000000000000000000000060708ff,10.0.0.1" }, 1075 // Numeric only hostnames (none of these are considered valid IP addresses). 1076 { false, "12345.6", "12345.6" }, 1077 { false, "121.2.3.512", "", "1*1.2.3.512,*1.2.3.512,1*.2.3.512,*.2.3.512", 1078 "121.2.3.0"}, 1079 { false, "1.2.3.4.5.6", "*.2.3.4.5.6" }, 1080 { true, "1.2.3.4.5", "", "1.2.3.4.5" }, 1081 // Invalid host names. 1082 { false, "junk)()$*!@~#", "junk)()$*!@~#" }, 1083 { false, "www.*.com", "www.*.com" }, 1084 { false, "w$w.f.com", "w$w.f.com" }, 1085 { false, "nocolonallowed:example", "", "nocolonallowed:example" }, 1086 { false, "www-1.[::FFFF:129.144.52.38]", "*.[::FFFF:129.144.52.38]" }, 1087 { false, "[::4.5.6.9]", "", "", "x00000000000000000000000004050609" }, 1088 }; 1089 1090 class X509CertificateNameVerifyTest 1091 : public testing::TestWithParam<CertificateNameVerifyTestData> { 1092 }; 1093 1094 TEST_P(X509CertificateNameVerifyTest, VerifyHostname) { 1095 CertificateNameVerifyTestData test_data = GetParam(); 1096 1097 std::string common_name(test_data.common_name); 1098 ASSERT_EQ(std::string::npos, common_name.find(',')); 1099 std::replace(common_name.begin(), common_name.end(), '#', '\0'); 1100 1101 std::vector<std::string> dns_names, ip_addressses; 1102 if (test_data.dns_names) { 1103 // Build up the certificate DNS names list. 1104 std::string dns_name_line(test_data.dns_names); 1105 std::replace(dns_name_line.begin(), dns_name_line.end(), '#', '\0'); 1106 base::SplitString(dns_name_line, ',', &dns_names); 1107 } 1108 1109 if (test_data.ip_addrs) { 1110 // Build up the certificate IP address list. 1111 std::string ip_addrs_line(test_data.ip_addrs); 1112 std::vector<std::string> ip_addressses_ascii; 1113 base::SplitString(ip_addrs_line, ',', &ip_addressses_ascii); 1114 for (size_t i = 0; i < ip_addressses_ascii.size(); ++i) { 1115 std::string& addr_ascii = ip_addressses_ascii[i]; 1116 ASSERT_NE(0U, addr_ascii.length()); 1117 if (addr_ascii[0] == 'x') { // Hex encoded address 1118 addr_ascii.erase(0, 1); 1119 std::vector<uint8> bytes; 1120 EXPECT_TRUE(base::HexStringToBytes(addr_ascii, &bytes)) 1121 << "Could not parse hex address " << addr_ascii << " i = " << i; 1122 ip_addressses.push_back(std::string(reinterpret_cast<char*>(&bytes[0]), 1123 bytes.size())); 1124 ASSERT_EQ(16U, ip_addressses.back().size()) << i; 1125 } else { // Decimal groups 1126 std::vector<std::string> decimals_ascii; 1127 base::SplitString(addr_ascii, '.', &decimals_ascii); 1128 EXPECT_EQ(4U, decimals_ascii.size()) << i; 1129 std::string addr_bytes; 1130 for (size_t j = 0; j < decimals_ascii.size(); ++j) { 1131 int decimal_value; 1132 EXPECT_TRUE(base::StringToInt(decimals_ascii[j], &decimal_value)); 1133 EXPECT_GE(decimal_value, 0); 1134 EXPECT_LE(decimal_value, 255); 1135 addr_bytes.push_back(static_cast<char>(decimal_value)); 1136 } 1137 ip_addressses.push_back(addr_bytes); 1138 ASSERT_EQ(4U, ip_addressses.back().size()) << i; 1139 } 1140 } 1141 } 1142 1143 bool unused = false; 1144 EXPECT_EQ(test_data.expected, X509Certificate::VerifyHostname( 1145 test_data.hostname, common_name, dns_names, ip_addressses, &unused)); 1146 } 1147 1148 INSTANTIATE_TEST_CASE_P(, X509CertificateNameVerifyTest, 1149 testing::ValuesIn(kNameVerifyTestData)); 1150 1151 const struct PublicKeyInfoTestData { 1152 const char* cert_file; 1153 size_t expected_bits; 1154 X509Certificate::PublicKeyType expected_type; 1155 } kPublicKeyInfoTestData[] = { 1156 { "768-rsa-ee-by-768-rsa-intermediate.pem", 768, 1157 X509Certificate::kPublicKeyTypeRSA }, 1158 { "1024-rsa-ee-by-768-rsa-intermediate.pem", 1024, 1159 X509Certificate::kPublicKeyTypeRSA }, 1160 { "prime256v1-ecdsa-ee-by-1024-rsa-intermediate.pem", 256, 1161 X509Certificate::kPublicKeyTypeECDSA }, 1162 }; 1163 1164 class X509CertificatePublicKeyInfoTest 1165 : public testing::TestWithParam<PublicKeyInfoTestData> { 1166 }; 1167 1168 TEST_P(X509CertificatePublicKeyInfoTest, GetPublicKeyInfo) { 1169 PublicKeyInfoTestData data = GetParam(); 1170 1171 #if defined(OS_WIN) 1172 if (base::win::GetVersion() < base::win::VERSION_VISTA && 1173 data.expected_type == X509Certificate::kPublicKeyTypeECDSA) { 1174 // ECC is only supported on Vista+. Skip the test. 1175 return; 1176 } 1177 #endif 1178 1179 scoped_refptr<X509Certificate> cert( 1180 ImportCertFromFile(GetTestCertsDirectory(), data.cert_file)); 1181 ASSERT_TRUE(cert.get()); 1182 1183 size_t actual_bits = 0; 1184 X509Certificate::PublicKeyType actual_type = 1185 X509Certificate::kPublicKeyTypeUnknown; 1186 1187 X509Certificate::GetPublicKeyInfo(cert->os_cert_handle(), &actual_bits, 1188 &actual_type); 1189 1190 EXPECT_EQ(data.expected_bits, actual_bits); 1191 EXPECT_EQ(data.expected_type, actual_type); 1192 } 1193 1194 INSTANTIATE_TEST_CASE_P(, X509CertificatePublicKeyInfoTest, 1195 testing::ValuesIn(kPublicKeyInfoTestData)); 1196 1197 } // namespace net 1198
