1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "net/cert/cert_verify_proc.h" 6 7 #include <vector> 8 9 #include "base/callback_helpers.h" 10 #include "base/files/file_path.h" 11 #include "base/logging.h" 12 #include "base/sha1.h" 13 #include "base/strings/string_number_conversions.h" 14 #include "crypto/sha2.h" 15 #include "net/base/net_errors.h" 16 #include "net/base/test_data_directory.h" 17 #include "net/cert/asn1_util.h" 18 #include "net/cert/cert_status_flags.h" 19 #include "net/cert/cert_verifier.h" 20 #include "net/cert/cert_verify_result.h" 21 #include "net/cert/crl_set.h" 22 #include "net/cert/test_root_certs.h" 23 #include "net/cert/x509_certificate.h" 24 #include "net/test/cert_test_util.h" 25 #include "net/test/test_certificate_data.h" 26 #include "testing/gtest/include/gtest/gtest.h" 27 28 #if defined(OS_WIN) 29 #include "base/win/windows_version.h" 30 #elif defined(OS_MACOSX) && !defined(OS_IOS) 31 #include "base/mac/mac_util.h" 32 #elif defined(OS_ANDROID) 33 #include "base/android/build_info.h" 34 #endif 35 36 using base::HexEncode; 37 38 namespace net { 39 40 namespace { 41 42 // A certificate for www.paypal.com with a NULL byte in the common name. 43 // From http://www.gossamer-threads.com/lists/fulldisc/full-disclosure/70363 44 unsigned char paypal_null_fingerprint[] = { 45 0x4c, 0x88, 0x9e, 0x28, 0xd7, 0x7a, 0x44, 0x1e, 0x13, 0xf2, 0x6a, 0xba, 46 0x1f, 0xe8, 0x1b, 0xd6, 0xab, 0x7b, 0xe8, 0xd7 47 }; 48 49 // Mock CertVerifyProc that will set |verify_result->is_issued_by_known_root| 50 // for all certificates that are Verified. 51 class WellKnownCaCertVerifyProc : public CertVerifyProc { 52 public: 53 // Initialize a CertVerifyProc that will set 54 // |verify_result->is_issued_by_known_root| to |is_well_known|. 55 explicit WellKnownCaCertVerifyProc(bool is_well_known) 56 : is_well_known_(is_well_known) {} 57 58 // CertVerifyProc implementation: 59 virtual bool SupportsAdditionalTrustAnchors() const OVERRIDE { return false; } 60 61 protected: 62 virtual ~WellKnownCaCertVerifyProc() {} 63 64 private: 65 virtual int VerifyInternal(X509Certificate* cert, 66 const std::string& hostname, 67 int flags, 68 CRLSet* crl_set, 69 const CertificateList& additional_trust_anchors, 70 CertVerifyResult* verify_result) OVERRIDE; 71 72 const bool is_well_known_; 73 74 DISALLOW_COPY_AND_ASSIGN(WellKnownCaCertVerifyProc); 75 }; 76 77 int WellKnownCaCertVerifyProc::VerifyInternal( 78 X509Certificate* cert, 79 const std::string& hostname, 80 int flags, 81 CRLSet* crl_set, 82 const CertificateList& additional_trust_anchors, 83 CertVerifyResult* verify_result) { 84 verify_result->is_issued_by_known_root = is_well_known_; 85 return OK; 86 } 87 88 bool SupportsReturningVerifiedChain() { 89 #if defined(OS_ANDROID) 90 // Before API level 17, Android does not expose the APIs necessary to get at 91 // the verified certificate chain. 92 if (base::android::BuildInfo::GetInstance()->sdk_int() < 17) 93 return false; 94 #endif 95 return true; 96 } 97 98 bool SupportsDetectingKnownRoots() { 99 #if defined(OS_ANDROID) 100 // Before API level 17, Android does not expose the APIs necessary to get at 101 // the verified certificate chain and detect known roots. 102 if (base::android::BuildInfo::GetInstance()->sdk_int() < 17) 103 return false; 104 #endif 105 return true; 106 } 107 108 } // namespace 109 110 class CertVerifyProcTest : public testing::Test { 111 public: 112 CertVerifyProcTest() 113 : verify_proc_(CertVerifyProc::CreateDefault()) { 114 } 115 virtual ~CertVerifyProcTest() {} 116 117 protected: 118 bool SupportsAdditionalTrustAnchors() { 119 return verify_proc_->SupportsAdditionalTrustAnchors(); 120 } 121 122 int Verify(X509Certificate* cert, 123 const std::string& hostname, 124 int flags, 125 CRLSet* crl_set, 126 const CertificateList& additional_trust_anchors, 127 CertVerifyResult* verify_result) { 128 return verify_proc_->Verify(cert, hostname, flags, crl_set, 129 additional_trust_anchors, verify_result); 130 } 131 132 const CertificateList empty_cert_list_; 133 scoped_refptr<CertVerifyProc> verify_proc_; 134 }; 135 136 TEST_F(CertVerifyProcTest, DISABLED_WithoutRevocationChecking) { 137 // Check that verification without revocation checking works. 138 CertificateList certs = CreateCertificateListFromFile( 139 GetTestCertsDirectory(), 140 "googlenew.chain.pem", 141 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); 142 143 X509Certificate::OSCertHandles intermediates; 144 intermediates.push_back(certs[1]->os_cert_handle()); 145 146 scoped_refptr<X509Certificate> google_full_chain = 147 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 148 intermediates); 149 150 CertVerifyResult verify_result; 151 EXPECT_EQ(OK, 152 Verify(google_full_chain.get(), 153 "www.google.com", 154 0 /* flags */, 155 NULL, 156 empty_cert_list_, 157 &verify_result)); 158 } 159 160 #if defined(OS_ANDROID) || defined(USE_OPENSSL_CERTS) 161 // TODO(jnd): http://crbug.com/117478 - EV verification is not yet supported. 162 #define MAYBE_EVVerification DISABLED_EVVerification 163 #else 164 #define MAYBE_EVVerification EVVerification 165 #endif 166 TEST_F(CertVerifyProcTest, MAYBE_EVVerification) { 167 CertificateList certs = CreateCertificateListFromFile( 168 GetTestCertsDirectory(), 169 "comodo.chain.pem", 170 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); 171 ASSERT_EQ(3U, certs.size()); 172 173 X509Certificate::OSCertHandles intermediates; 174 intermediates.push_back(certs[1]->os_cert_handle()); 175 intermediates.push_back(certs[2]->os_cert_handle()); 176 177 scoped_refptr<X509Certificate> comodo_chain = 178 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 179 intermediates); 180 181 scoped_refptr<CRLSet> crl_set(CRLSet::ForTesting(false, NULL, "")); 182 CertVerifyResult verify_result; 183 int flags = CertVerifier::VERIFY_EV_CERT; 184 int error = Verify(comodo_chain.get(), 185 "comodo.com", 186 flags, 187 crl_set.get(), 188 empty_cert_list_, 189 &verify_result); 190 EXPECT_EQ(OK, error); 191 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_IS_EV); 192 } 193 194 TEST_F(CertVerifyProcTest, PaypalNullCertParsing) { 195 scoped_refptr<X509Certificate> paypal_null_cert( 196 X509Certificate::CreateFromBytes( 197 reinterpret_cast<const char*>(paypal_null_der), 198 sizeof(paypal_null_der))); 199 200 ASSERT_NE(static_cast<X509Certificate*>(NULL), paypal_null_cert); 201 202 const SHA1HashValue& fingerprint = 203 paypal_null_cert->fingerprint(); 204 for (size_t i = 0; i < 20; ++i) 205 EXPECT_EQ(paypal_null_fingerprint[i], fingerprint.data[i]); 206 207 int flags = 0; 208 CertVerifyResult verify_result; 209 int error = Verify(paypal_null_cert.get(), 210 "www.paypal.com", 211 flags, 212 NULL, 213 empty_cert_list_, 214 &verify_result); 215 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_ANDROID) 216 EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error); 217 #else 218 // TOOD(bulach): investigate why macosx and win aren't returning 219 // ERR_CERT_INVALID or ERR_CERT_COMMON_NAME_INVALID. 220 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 221 #endif 222 // Either the system crypto library should correctly report a certificate 223 // name mismatch, or our certificate blacklist should cause us to report an 224 // invalid certificate. 225 #if defined(USE_NSS) || defined(OS_WIN) || defined(OS_IOS) 226 EXPECT_TRUE(verify_result.cert_status & 227 (CERT_STATUS_COMMON_NAME_INVALID | CERT_STATUS_INVALID)); 228 #endif 229 } 230 231 // A regression test for http://crbug.com/31497. 232 #if defined(OS_ANDROID) 233 // Disabled on Android, as the Android verification libraries require an 234 // explicit policy to be specified, even when anyPolicy is permitted. 235 #define MAYBE_IntermediateCARequireExplicitPolicy \ 236 DISABLED_IntermediateCARequireExplicitPolicy 237 #else 238 #define MAYBE_IntermediateCARequireExplicitPolicy \ 239 IntermediateCARequireExplicitPolicy 240 #endif 241 TEST_F(CertVerifyProcTest, MAYBE_IntermediateCARequireExplicitPolicy) { 242 base::FilePath certs_dir = GetTestCertsDirectory(); 243 244 CertificateList certs = CreateCertificateListFromFile( 245 certs_dir, "explicit-policy-chain.pem", 246 X509Certificate::FORMAT_AUTO); 247 ASSERT_EQ(3U, certs.size()); 248 249 X509Certificate::OSCertHandles intermediates; 250 intermediates.push_back(certs[1]->os_cert_handle()); 251 252 scoped_refptr<X509Certificate> cert = 253 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 254 intermediates); 255 ASSERT_TRUE(cert.get()); 256 257 ScopedTestRoot scoped_root(certs[2].get()); 258 259 int flags = 0; 260 CertVerifyResult verify_result; 261 int error = Verify(cert.get(), 262 "policy_test.example", 263 flags, 264 NULL, 265 empty_cert_list_, 266 &verify_result); 267 EXPECT_EQ(OK, error); 268 EXPECT_EQ(0u, verify_result.cert_status); 269 } 270 271 // Test for bug 58437. 272 // This certificate will expire on 2011-12-21. The test will still 273 // pass if error == ERR_CERT_DATE_INVALID. 274 // This test is DISABLED because it appears that we cannot do 275 // certificate revocation checking when running all of the net unit tests. 276 // This test passes when run individually, but when run with all of the net 277 // unit tests, the call to PKIXVerifyCert returns the NSS error -8180, which is 278 // SEC_ERROR_REVOKED_CERTIFICATE. This indicates a lack of revocation 279 // status, i.e. that the revocation check is failing for some reason. 280 TEST_F(CertVerifyProcTest, DISABLED_GlobalSignR3EVTest) { 281 base::FilePath certs_dir = GetTestCertsDirectory(); 282 283 scoped_refptr<X509Certificate> server_cert = 284 ImportCertFromFile(certs_dir, "2029_globalsign_com_cert.pem"); 285 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert); 286 287 scoped_refptr<X509Certificate> intermediate_cert = 288 ImportCertFromFile(certs_dir, "globalsign_ev_sha256_ca_cert.pem"); 289 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert); 290 291 X509Certificate::OSCertHandles intermediates; 292 intermediates.push_back(intermediate_cert->os_cert_handle()); 293 scoped_refptr<X509Certificate> cert_chain = 294 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 295 intermediates); 296 297 CertVerifyResult verify_result; 298 int flags = CertVerifier::VERIFY_REV_CHECKING_ENABLED | 299 CertVerifier::VERIFY_EV_CERT; 300 int error = Verify(cert_chain.get(), 301 "2029.globalsign.com", 302 flags, 303 NULL, 304 empty_cert_list_, 305 &verify_result); 306 if (error == OK) 307 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_IS_EV); 308 else 309 EXPECT_EQ(ERR_CERT_DATE_INVALID, error); 310 } 311 312 // Test that verifying an ECDSA certificate doesn't crash on XP. (See 313 // crbug.com/144466). 314 TEST_F(CertVerifyProcTest, ECDSA_RSA) { 315 base::FilePath certs_dir = GetTestCertsDirectory(); 316 317 scoped_refptr<X509Certificate> cert = 318 ImportCertFromFile(certs_dir, 319 "prime256v1-ecdsa-ee-by-1024-rsa-intermediate.pem"); 320 321 CertVerifyResult verify_result; 322 Verify(cert.get(), "127.0.0.1", 0, NULL, empty_cert_list_, &verify_result); 323 324 // We don't check verify_result because the certificate is signed by an 325 // unknown CA and will be considered invalid on XP because of the ECDSA 326 // public key. 327 } 328 329 // Currently, only RSA and DSA keys are checked for weakness, and our example 330 // weak size is 768. These could change in the future. 331 // 332 // Note that this means there may be false negatives: keys for other 333 // algorithms and which are weak will pass this test. 334 static bool IsWeakKeyType(const std::string& key_type) { 335 size_t pos = key_type.find("-"); 336 std::string size = key_type.substr(0, pos); 337 std::string type = key_type.substr(pos + 1); 338 339 if (type == "rsa" || type == "dsa") 340 return size == "768"; 341 342 return false; 343 } 344 345 TEST_F(CertVerifyProcTest, RejectWeakKeys) { 346 base::FilePath certs_dir = GetTestCertsDirectory(); 347 typedef std::vector<std::string> Strings; 348 Strings key_types; 349 350 // generate-weak-test-chains.sh currently has: 351 // key_types="768-rsa 1024-rsa 2048-rsa prime256v1-ecdsa" 352 // We must use the same key types here. The filenames generated look like: 353 // 2048-rsa-ee-by-768-rsa-intermediate.pem 354 key_types.push_back("768-rsa"); 355 key_types.push_back("1024-rsa"); 356 key_types.push_back("2048-rsa"); 357 358 bool use_ecdsa = true; 359 #if defined(OS_WIN) 360 use_ecdsa = base::win::GetVersion() > base::win::VERSION_XP; 361 #endif 362 363 if (use_ecdsa) 364 key_types.push_back("prime256v1-ecdsa"); 365 366 // Add the root that signed the intermediates for this test. 367 scoped_refptr<X509Certificate> root_cert = 368 ImportCertFromFile(certs_dir, "2048-rsa-root.pem"); 369 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert); 370 ScopedTestRoot scoped_root(root_cert.get()); 371 372 // Now test each chain. 373 for (Strings::const_iterator ee_type = key_types.begin(); 374 ee_type != key_types.end(); ++ee_type) { 375 for (Strings::const_iterator signer_type = key_types.begin(); 376 signer_type != key_types.end(); ++signer_type) { 377 std::string basename = *ee_type + "-ee-by-" + *signer_type + 378 "-intermediate.pem"; 379 SCOPED_TRACE(basename); 380 scoped_refptr<X509Certificate> ee_cert = 381 ImportCertFromFile(certs_dir, basename); 382 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_cert); 383 384 basename = *signer_type + "-intermediate.pem"; 385 scoped_refptr<X509Certificate> intermediate = 386 ImportCertFromFile(certs_dir, basename); 387 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate); 388 389 X509Certificate::OSCertHandles intermediates; 390 intermediates.push_back(intermediate->os_cert_handle()); 391 scoped_refptr<X509Certificate> cert_chain = 392 X509Certificate::CreateFromHandle(ee_cert->os_cert_handle(), 393 intermediates); 394 395 CertVerifyResult verify_result; 396 int error = Verify(cert_chain.get(), 397 "127.0.0.1", 398 0, 399 NULL, 400 empty_cert_list_, 401 &verify_result); 402 403 if (IsWeakKeyType(*ee_type) || IsWeakKeyType(*signer_type)) { 404 EXPECT_NE(OK, error); 405 EXPECT_EQ(CERT_STATUS_WEAK_KEY, 406 verify_result.cert_status & CERT_STATUS_WEAK_KEY); 407 EXPECT_NE(CERT_STATUS_INVALID, 408 verify_result.cert_status & CERT_STATUS_INVALID); 409 } else { 410 EXPECT_EQ(OK, error); 411 EXPECT_EQ(0U, verify_result.cert_status & CERT_STATUS_WEAK_KEY); 412 } 413 } 414 } 415 } 416 417 // Regression test for http://crbug.com/108514. 418 #if defined(OS_MACOSX) && !defined(OS_IOS) 419 // Disabled on OS X - Security.framework doesn't ignore superflous certificates 420 // provided by servers. See CertVerifyProcTest.CybertrustGTERoot for further 421 // details. 422 #define MAYBE_ExtraneousMD5RootCert DISABLED_ExtraneousMD5RootCert 423 #else 424 #define MAYBE_ExtraneousMD5RootCert ExtraneousMD5RootCert 425 #endif 426 TEST_F(CertVerifyProcTest, MAYBE_ExtraneousMD5RootCert) { 427 if (!SupportsReturningVerifiedChain()) { 428 LOG(INFO) << "Skipping this test in this platform."; 429 return; 430 } 431 432 base::FilePath certs_dir = GetTestCertsDirectory(); 433 434 scoped_refptr<X509Certificate> server_cert = 435 ImportCertFromFile(certs_dir, "cross-signed-leaf.pem"); 436 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); 437 438 scoped_refptr<X509Certificate> extra_cert = 439 ImportCertFromFile(certs_dir, "cross-signed-root-md5.pem"); 440 ASSERT_NE(static_cast<X509Certificate*>(NULL), extra_cert.get()); 441 442 scoped_refptr<X509Certificate> root_cert = 443 ImportCertFromFile(certs_dir, "cross-signed-root-sha1.pem"); 444 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); 445 446 ScopedTestRoot scoped_root(root_cert.get()); 447 448 X509Certificate::OSCertHandles intermediates; 449 intermediates.push_back(extra_cert->os_cert_handle()); 450 scoped_refptr<X509Certificate> cert_chain = 451 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 452 intermediates); 453 454 CertVerifyResult verify_result; 455 int flags = 0; 456 int error = Verify(cert_chain.get(), 457 "127.0.0.1", 458 flags, 459 NULL, 460 empty_cert_list_, 461 &verify_result); 462 EXPECT_EQ(OK, error); 463 464 // The extra MD5 root should be discarded 465 ASSERT_TRUE(verify_result.verified_cert.get()); 466 ASSERT_EQ(1u, 467 verify_result.verified_cert->GetIntermediateCertificates().size()); 468 EXPECT_TRUE(X509Certificate::IsSameOSCert( 469 verify_result.verified_cert->GetIntermediateCertificates().front(), 470 root_cert->os_cert_handle())); 471 472 EXPECT_FALSE(verify_result.has_md5); 473 } 474 475 // Test for bug 94673. 476 TEST_F(CertVerifyProcTest, GoogleDigiNotarTest) { 477 base::FilePath certs_dir = GetTestCertsDirectory(); 478 479 scoped_refptr<X509Certificate> server_cert = 480 ImportCertFromFile(certs_dir, "google_diginotar.pem"); 481 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert); 482 483 scoped_refptr<X509Certificate> intermediate_cert = 484 ImportCertFromFile(certs_dir, "diginotar_public_ca_2025.pem"); 485 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert); 486 487 X509Certificate::OSCertHandles intermediates; 488 intermediates.push_back(intermediate_cert->os_cert_handle()); 489 scoped_refptr<X509Certificate> cert_chain = 490 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 491 intermediates); 492 493 CertVerifyResult verify_result; 494 int flags = CertVerifier::VERIFY_REV_CHECKING_ENABLED; 495 int error = Verify(cert_chain.get(), 496 "mail.google.com", 497 flags, 498 NULL, 499 empty_cert_list_, 500 &verify_result); 501 EXPECT_NE(OK, error); 502 503 // Now turn off revocation checking. Certificate verification should still 504 // fail. 505 flags = 0; 506 error = Verify(cert_chain.get(), 507 "mail.google.com", 508 flags, 509 NULL, 510 empty_cert_list_, 511 &verify_result); 512 EXPECT_NE(OK, error); 513 } 514 515 TEST_F(CertVerifyProcTest, DigiNotarCerts) { 516 static const char* const kDigiNotarFilenames[] = { 517 "diginotar_root_ca.pem", 518 "diginotar_cyber_ca.pem", 519 "diginotar_services_1024_ca.pem", 520 "diginotar_pkioverheid.pem", 521 "diginotar_pkioverheid_g2.pem", 522 NULL, 523 }; 524 525 base::FilePath certs_dir = GetTestCertsDirectory(); 526 527 for (size_t i = 0; kDigiNotarFilenames[i]; i++) { 528 scoped_refptr<X509Certificate> diginotar_cert = 529 ImportCertFromFile(certs_dir, kDigiNotarFilenames[i]); 530 std::string der_bytes; 531 ASSERT_TRUE(X509Certificate::GetDEREncoded( 532 diginotar_cert->os_cert_handle(), &der_bytes)); 533 534 base::StringPiece spki; 535 ASSERT_TRUE(asn1::ExtractSPKIFromDERCert(der_bytes, &spki)); 536 537 std::string spki_sha1 = base::SHA1HashString(spki.as_string()); 538 539 HashValueVector public_keys; 540 HashValue hash(HASH_VALUE_SHA1); 541 ASSERT_EQ(hash.size(), spki_sha1.size()); 542 memcpy(hash.data(), spki_sha1.data(), spki_sha1.size()); 543 public_keys.push_back(hash); 544 545 EXPECT_TRUE(CertVerifyProc::IsPublicKeyBlacklisted(public_keys)) << 546 "Public key not blocked for " << kDigiNotarFilenames[i]; 547 } 548 } 549 550 TEST_F(CertVerifyProcTest, NameConstraintsOk) { 551 CertificateList ca_cert_list = 552 CreateCertificateListFromFile(GetTestCertsDirectory(), 553 "root_ca_cert.pem", 554 X509Certificate::FORMAT_AUTO); 555 ASSERT_EQ(1U, ca_cert_list.size()); 556 ScopedTestRoot test_root(ca_cert_list[0]); 557 558 CertificateList cert_list = CreateCertificateListFromFile( 559 GetTestCertsDirectory(), "name_constraint_ok.crt", 560 X509Certificate::FORMAT_AUTO); 561 ASSERT_EQ(1U, cert_list.size()); 562 563 X509Certificate::OSCertHandles intermediates; 564 scoped_refptr<X509Certificate> leaf = 565 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), 566 intermediates); 567 568 int flags = 0; 569 CertVerifyResult verify_result; 570 int error = Verify(leaf.get(), 571 "test.example.com", 572 flags, 573 NULL, 574 empty_cert_list_, 575 &verify_result); 576 EXPECT_EQ(OK, error); 577 EXPECT_EQ(0U, verify_result.cert_status); 578 } 579 580 TEST_F(CertVerifyProcTest, NameConstraintsFailure) { 581 if (!SupportsReturningVerifiedChain()) { 582 LOG(INFO) << "Skipping this test in this platform."; 583 return; 584 } 585 586 CertificateList ca_cert_list = 587 CreateCertificateListFromFile(GetTestCertsDirectory(), 588 "root_ca_cert.pem", 589 X509Certificate::FORMAT_AUTO); 590 ASSERT_EQ(1U, ca_cert_list.size()); 591 ScopedTestRoot test_root(ca_cert_list[0]); 592 593 CertificateList cert_list = CreateCertificateListFromFile( 594 GetTestCertsDirectory(), "name_constraint_bad.crt", 595 X509Certificate::FORMAT_AUTO); 596 ASSERT_EQ(1U, cert_list.size()); 597 598 X509Certificate::OSCertHandles intermediates; 599 scoped_refptr<X509Certificate> leaf = 600 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), 601 intermediates); 602 603 int flags = 0; 604 CertVerifyResult verify_result; 605 int error = Verify(leaf.get(), 606 "test.example.com", 607 flags, 608 NULL, 609 empty_cert_list_, 610 &verify_result); 611 EXPECT_EQ(ERR_CERT_NAME_CONSTRAINT_VIOLATION, error); 612 EXPECT_EQ(CERT_STATUS_NAME_CONSTRAINT_VIOLATION, 613 verify_result.cert_status & CERT_STATUS_NAME_CONSTRAINT_VIOLATION); 614 } 615 616 TEST_F(CertVerifyProcTest, TestKnownRoot) { 617 if (!SupportsDetectingKnownRoots()) { 618 LOG(INFO) << "Skipping this test in this platform."; 619 return; 620 } 621 622 base::FilePath certs_dir = GetTestCertsDirectory(); 623 CertificateList certs = CreateCertificateListFromFile( 624 certs_dir, "satveda.pem", X509Certificate::FORMAT_AUTO); 625 ASSERT_EQ(2U, certs.size()); 626 627 X509Certificate::OSCertHandles intermediates; 628 intermediates.push_back(certs[1]->os_cert_handle()); 629 630 scoped_refptr<X509Certificate> cert_chain = 631 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 632 intermediates); 633 634 int flags = 0; 635 CertVerifyResult verify_result; 636 // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug 637 // against agl. See also PublicKeyHashes. 638 int error = Verify(cert_chain.get(), 639 "satveda.com", 640 flags, 641 NULL, 642 empty_cert_list_, 643 &verify_result); 644 EXPECT_EQ(OK, error); 645 EXPECT_EQ(0U, verify_result.cert_status); 646 EXPECT_TRUE(verify_result.is_issued_by_known_root); 647 } 648 649 // The certse.pem certificate has been revoked. crbug.com/259723. 650 TEST_F(CertVerifyProcTest, PublicKeyHashes) { 651 if (!SupportsReturningVerifiedChain()) { 652 LOG(INFO) << "Skipping this test in this platform."; 653 return; 654 } 655 656 base::FilePath certs_dir = GetTestCertsDirectory(); 657 CertificateList certs = CreateCertificateListFromFile( 658 certs_dir, "satveda.pem", X509Certificate::FORMAT_AUTO); 659 ASSERT_EQ(2U, certs.size()); 660 661 X509Certificate::OSCertHandles intermediates; 662 intermediates.push_back(certs[1]->os_cert_handle()); 663 664 scoped_refptr<X509Certificate> cert_chain = 665 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 666 intermediates); 667 int flags = 0; 668 CertVerifyResult verify_result; 669 670 // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug 671 // against agl. See also TestKnownRoot. 672 int error = Verify(cert_chain.get(), 673 "satveda.com", 674 flags, 675 NULL, 676 empty_cert_list_, 677 &verify_result); 678 EXPECT_EQ(OK, error); 679 EXPECT_EQ(0U, verify_result.cert_status); 680 ASSERT_LE(2U, verify_result.public_key_hashes.size()); 681 682 HashValueVector sha1_hashes; 683 for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) { 684 if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA1) 685 continue; 686 sha1_hashes.push_back(verify_result.public_key_hashes[i]); 687 } 688 ASSERT_LE(2u, sha1_hashes.size()); 689 690 for (size_t i = 0; i < 2; ++i) { 691 EXPECT_EQ(HexEncode(kSatvedaSPKIs[i], base::kSHA1Length), 692 HexEncode(sha1_hashes[i].data(), base::kSHA1Length)); 693 } 694 695 HashValueVector sha256_hashes; 696 for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) { 697 if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA256) 698 continue; 699 sha256_hashes.push_back(verify_result.public_key_hashes[i]); 700 } 701 ASSERT_LE(2u, sha256_hashes.size()); 702 703 for (size_t i = 0; i < 2; ++i) { 704 EXPECT_EQ(HexEncode(kSatvedaSPKIsSHA256[i], crypto::kSHA256Length), 705 HexEncode(sha256_hashes[i].data(), crypto::kSHA256Length)); 706 } 707 } 708 709 // A regression test for http://crbug.com/70293. 710 // The Key Usage extension in this RSA SSL server certificate does not have 711 // the keyEncipherment bit. 712 TEST_F(CertVerifyProcTest, InvalidKeyUsage) { 713 base::FilePath certs_dir = GetTestCertsDirectory(); 714 715 scoped_refptr<X509Certificate> server_cert = 716 ImportCertFromFile(certs_dir, "invalid_key_usage_cert.der"); 717 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert); 718 719 int flags = 0; 720 CertVerifyResult verify_result; 721 int error = Verify(server_cert.get(), 722 "jira.aquameta.com", 723 flags, 724 NULL, 725 empty_cert_list_, 726 &verify_result); 727 #if defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID) 728 // This certificate has two errors: "invalid key usage" and "untrusted CA". 729 // However, OpenSSL returns only one (the latter), and we can't detect 730 // the other errors. 731 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 732 #else 733 EXPECT_EQ(ERR_CERT_INVALID, error); 734 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_INVALID); 735 #endif 736 // TODO(wtc): fix http://crbug.com/75520 to get all the certificate errors 737 // from NSS. 738 #if !defined(USE_NSS) && !defined(OS_IOS) && !defined(OS_ANDROID) 739 // The certificate is issued by an unknown CA. 740 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID); 741 #endif 742 } 743 744 // Basic test for returning the chain in CertVerifyResult. Note that the 745 // returned chain may just be a reflection of the originally supplied chain; 746 // that is, if any errors occur, the default chain returned is an exact copy 747 // of the certificate to be verified. The remaining VerifyReturn* tests are 748 // used to ensure that the actual, verified chain is being returned by 749 // Verify(). 750 TEST_F(CertVerifyProcTest, VerifyReturnChainBasic) { 751 if (!SupportsReturningVerifiedChain()) { 752 LOG(INFO) << "Skipping this test in this platform."; 753 return; 754 } 755 756 base::FilePath certs_dir = GetTestCertsDirectory(); 757 CertificateList certs = CreateCertificateListFromFile( 758 certs_dir, "x509_verify_results.chain.pem", 759 X509Certificate::FORMAT_AUTO); 760 ASSERT_EQ(3U, certs.size()); 761 762 X509Certificate::OSCertHandles intermediates; 763 intermediates.push_back(certs[1]->os_cert_handle()); 764 intermediates.push_back(certs[2]->os_cert_handle()); 765 766 ScopedTestRoot scoped_root(certs[2].get()); 767 768 scoped_refptr<X509Certificate> google_full_chain = 769 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 770 intermediates); 771 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain); 772 ASSERT_EQ(2U, google_full_chain->GetIntermediateCertificates().size()); 773 774 CertVerifyResult verify_result; 775 EXPECT_EQ(static_cast<X509Certificate*>(NULL), verify_result.verified_cert); 776 int error = Verify(google_full_chain.get(), 777 "127.0.0.1", 778 0, 779 NULL, 780 empty_cert_list_, 781 &verify_result); 782 EXPECT_EQ(OK, error); 783 ASSERT_NE(static_cast<X509Certificate*>(NULL), verify_result.verified_cert); 784 785 EXPECT_NE(google_full_chain, verify_result.verified_cert); 786 EXPECT_TRUE(X509Certificate::IsSameOSCert( 787 google_full_chain->os_cert_handle(), 788 verify_result.verified_cert->os_cert_handle())); 789 const X509Certificate::OSCertHandles& return_intermediates = 790 verify_result.verified_cert->GetIntermediateCertificates(); 791 ASSERT_EQ(2U, return_intermediates.size()); 792 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], 793 certs[1]->os_cert_handle())); 794 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], 795 certs[2]->os_cert_handle())); 796 } 797 798 // Test that certificates issued for 'intranet' names (that is, containing no 799 // known public registry controlled domain information) issued by well-known 800 // CAs are flagged appropriately, while certificates that are issued by 801 // internal CAs are not flagged. 802 TEST_F(CertVerifyProcTest, IntranetHostsRejected) { 803 if (!SupportsDetectingKnownRoots()) { 804 LOG(INFO) << "Skipping this test in this platform."; 805 return; 806 } 807 808 CertificateList cert_list = CreateCertificateListFromFile( 809 GetTestCertsDirectory(), "ok_cert.pem", 810 X509Certificate::FORMAT_AUTO); 811 ASSERT_EQ(1U, cert_list.size()); 812 scoped_refptr<X509Certificate> cert(cert_list[0]); 813 814 CertVerifyResult verify_result; 815 int error = 0; 816 817 // Intranet names for public CAs should be flagged: 818 verify_proc_ = new WellKnownCaCertVerifyProc(true); 819 error = 820 Verify(cert.get(), "intranet", 0, NULL, empty_cert_list_, &verify_result); 821 EXPECT_EQ(OK, error); 822 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_NON_UNIQUE_NAME); 823 824 // However, if the CA is not well known, these should not be flagged: 825 verify_proc_ = new WellKnownCaCertVerifyProc(false); 826 error = 827 Verify(cert.get(), "intranet", 0, NULL, empty_cert_list_, &verify_result); 828 EXPECT_EQ(OK, error); 829 EXPECT_FALSE(verify_result.cert_status & CERT_STATUS_NON_UNIQUE_NAME); 830 } 831 832 // Test that the certificate returned in CertVerifyResult is able to reorder 833 // certificates that are not ordered from end-entity to root. While this is 834 // a protocol violation if sent during a TLS handshake, if multiple sources 835 // of intermediate certificates are combined, it's possible that order may 836 // not be maintained. 837 TEST_F(CertVerifyProcTest, VerifyReturnChainProperlyOrdered) { 838 if (!SupportsReturningVerifiedChain()) { 839 LOG(INFO) << "Skipping this test in this platform."; 840 return; 841 } 842 843 base::FilePath certs_dir = GetTestCertsDirectory(); 844 CertificateList certs = CreateCertificateListFromFile( 845 certs_dir, "x509_verify_results.chain.pem", 846 X509Certificate::FORMAT_AUTO); 847 ASSERT_EQ(3U, certs.size()); 848 849 // Construct the chain out of order. 850 X509Certificate::OSCertHandles intermediates; 851 intermediates.push_back(certs[2]->os_cert_handle()); 852 intermediates.push_back(certs[1]->os_cert_handle()); 853 854 ScopedTestRoot scoped_root(certs[2].get()); 855 856 scoped_refptr<X509Certificate> google_full_chain = 857 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 858 intermediates); 859 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain); 860 ASSERT_EQ(2U, google_full_chain->GetIntermediateCertificates().size()); 861 862 CertVerifyResult verify_result; 863 EXPECT_EQ(static_cast<X509Certificate*>(NULL), verify_result.verified_cert); 864 int error = Verify(google_full_chain.get(), 865 "127.0.0.1", 866 0, 867 NULL, 868 empty_cert_list_, 869 &verify_result); 870 EXPECT_EQ(OK, error); 871 ASSERT_NE(static_cast<X509Certificate*>(NULL), verify_result.verified_cert); 872 873 EXPECT_NE(google_full_chain, verify_result.verified_cert); 874 EXPECT_TRUE(X509Certificate::IsSameOSCert( 875 google_full_chain->os_cert_handle(), 876 verify_result.verified_cert->os_cert_handle())); 877 const X509Certificate::OSCertHandles& return_intermediates = 878 verify_result.verified_cert->GetIntermediateCertificates(); 879 ASSERT_EQ(2U, return_intermediates.size()); 880 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], 881 certs[1]->os_cert_handle())); 882 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], 883 certs[2]->os_cert_handle())); 884 } 885 886 // Test that Verify() filters out certificates which are not related to 887 // or part of the certificate chain being verified. 888 TEST_F(CertVerifyProcTest, VerifyReturnChainFiltersUnrelatedCerts) { 889 if (!SupportsReturningVerifiedChain()) { 890 LOG(INFO) << "Skipping this test in this platform."; 891 return; 892 } 893 894 base::FilePath certs_dir = GetTestCertsDirectory(); 895 CertificateList certs = CreateCertificateListFromFile( 896 certs_dir, "x509_verify_results.chain.pem", 897 X509Certificate::FORMAT_AUTO); 898 ASSERT_EQ(3U, certs.size()); 899 ScopedTestRoot scoped_root(certs[2].get()); 900 901 scoped_refptr<X509Certificate> unrelated_certificate = 902 ImportCertFromFile(certs_dir, "duplicate_cn_1.pem"); 903 scoped_refptr<X509Certificate> unrelated_certificate2 = 904 ImportCertFromFile(certs_dir, "aia-cert.pem"); 905 ASSERT_NE(static_cast<X509Certificate*>(NULL), unrelated_certificate); 906 ASSERT_NE(static_cast<X509Certificate*>(NULL), unrelated_certificate2); 907 908 // Interject unrelated certificates into the list of intermediates. 909 X509Certificate::OSCertHandles intermediates; 910 intermediates.push_back(unrelated_certificate->os_cert_handle()); 911 intermediates.push_back(certs[1]->os_cert_handle()); 912 intermediates.push_back(unrelated_certificate2->os_cert_handle()); 913 intermediates.push_back(certs[2]->os_cert_handle()); 914 915 scoped_refptr<X509Certificate> google_full_chain = 916 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 917 intermediates); 918 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain); 919 ASSERT_EQ(4U, google_full_chain->GetIntermediateCertificates().size()); 920 921 CertVerifyResult verify_result; 922 EXPECT_EQ(static_cast<X509Certificate*>(NULL), verify_result.verified_cert); 923 int error = Verify(google_full_chain.get(), 924 "127.0.0.1", 925 0, 926 NULL, 927 empty_cert_list_, 928 &verify_result); 929 EXPECT_EQ(OK, error); 930 ASSERT_NE(static_cast<X509Certificate*>(NULL), verify_result.verified_cert); 931 932 EXPECT_NE(google_full_chain, verify_result.verified_cert); 933 EXPECT_TRUE(X509Certificate::IsSameOSCert( 934 google_full_chain->os_cert_handle(), 935 verify_result.verified_cert->os_cert_handle())); 936 const X509Certificate::OSCertHandles& return_intermediates = 937 verify_result.verified_cert->GetIntermediateCertificates(); 938 ASSERT_EQ(2U, return_intermediates.size()); 939 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], 940 certs[1]->os_cert_handle())); 941 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], 942 certs[2]->os_cert_handle())); 943 } 944 945 TEST_F(CertVerifyProcTest, AdditionalTrustAnchors) { 946 if (!SupportsAdditionalTrustAnchors()) { 947 LOG(INFO) << "Skipping this test in this platform."; 948 return; 949 } 950 951 // |ca_cert| is the issuer of |cert|. 952 CertificateList ca_cert_list = CreateCertificateListFromFile( 953 GetTestCertsDirectory(), "root_ca_cert.pem", 954 X509Certificate::FORMAT_AUTO); 955 ASSERT_EQ(1U, ca_cert_list.size()); 956 scoped_refptr<X509Certificate> ca_cert(ca_cert_list[0]); 957 958 CertificateList cert_list = CreateCertificateListFromFile( 959 GetTestCertsDirectory(), "ok_cert.pem", 960 X509Certificate::FORMAT_AUTO); 961 ASSERT_EQ(1U, cert_list.size()); 962 scoped_refptr<X509Certificate> cert(cert_list[0]); 963 964 // Verification of |cert| fails when |ca_cert| is not in the trust anchors 965 // list. 966 int flags = 0; 967 CertVerifyResult verify_result; 968 int error = Verify( 969 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); 970 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 971 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); 972 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); 973 974 // Now add the |ca_cert| to the |trust_anchors|, and verification should pass. 975 CertificateList trust_anchors; 976 trust_anchors.push_back(ca_cert); 977 error = Verify( 978 cert.get(), "127.0.0.1", flags, NULL, trust_anchors, &verify_result); 979 EXPECT_EQ(OK, error); 980 EXPECT_EQ(0U, verify_result.cert_status); 981 EXPECT_TRUE(verify_result.is_issued_by_additional_trust_anchor); 982 983 // Clearing the |trust_anchors| makes verification fail again (the cache 984 // should be skipped). 985 error = Verify( 986 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); 987 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 988 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); 989 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); 990 } 991 992 // Tests that certificates issued by user-supplied roots are not flagged as 993 // issued by a known root. This should pass whether or not the platform supports 994 // detecting known roots. 995 TEST_F(CertVerifyProcTest, IsIssuedByKnownRootIgnoresTestRoots) { 996 // Load root_ca_cert.pem into the test root store. 997 TestRootCerts* root_certs = TestRootCerts::GetInstance(); 998 root_certs->AddFromFile( 999 GetTestCertsDirectory().AppendASCII("root_ca_cert.pem")); 1000 1001 CertificateList cert_list = CreateCertificateListFromFile( 1002 GetTestCertsDirectory(), "ok_cert.pem", 1003 X509Certificate::FORMAT_AUTO); 1004 ASSERT_EQ(1U, cert_list.size()); 1005 scoped_refptr<X509Certificate> cert(cert_list[0]); 1006 1007 // Verification should pass. 1008 int flags = 0; 1009 CertVerifyResult verify_result; 1010 int error = Verify( 1011 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); 1012 EXPECT_EQ(OK, error); 1013 EXPECT_EQ(0U, verify_result.cert_status); 1014 // But should not be marked as a known root. 1015 EXPECT_FALSE(verify_result.is_issued_by_known_root); 1016 1017 root_certs->Clear(); 1018 EXPECT_TRUE(root_certs->IsEmpty()); 1019 } 1020 1021 #if defined(OS_MACOSX) && !defined(OS_IOS) 1022 // Tests that, on OS X, issues with a cross-certified Baltimore CyberTrust 1023 // Root can be successfully worked around once Apple completes removing the 1024 // older GTE CyberTrust Root from its trusted root store. 1025 // 1026 // The issue is caused by servers supplying the cross-certified intermediate 1027 // (necessary for certain mobile platforms), which OS X does not recognize 1028 // as already existing within its trust store. 1029 TEST_F(CertVerifyProcTest, CybertrustGTERoot) { 1030 CertificateList certs = CreateCertificateListFromFile( 1031 GetTestCertsDirectory(), 1032 "cybertrust_omniroot_chain.pem", 1033 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); 1034 ASSERT_EQ(2U, certs.size()); 1035 1036 X509Certificate::OSCertHandles intermediates; 1037 intermediates.push_back(certs[1]->os_cert_handle()); 1038 1039 scoped_refptr<X509Certificate> cybertrust_basic = 1040 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 1041 intermediates); 1042 ASSERT_TRUE(cybertrust_basic.get()); 1043 1044 scoped_refptr<X509Certificate> baltimore_root = 1045 ImportCertFromFile(GetTestCertsDirectory(), 1046 "cybertrust_baltimore_root.pem"); 1047 ASSERT_TRUE(baltimore_root.get()); 1048 1049 ScopedTestRoot scoped_root(baltimore_root.get()); 1050 1051 // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This 1052 // simulates Keychain removing support for the GTE CyberTrust Root. 1053 TestRootCerts::GetInstance()->SetAllowSystemTrust(false); 1054 base::ScopedClosureRunner reset_system_trust( 1055 base::Bind(&TestRootCerts::SetAllowSystemTrust, 1056 base::Unretained(TestRootCerts::GetInstance()), 1057 true)); 1058 1059 // First, make sure a simple certificate chain from 1060 // EE -> Public SureServer SV -> Baltimore CyberTrust 1061 // works. Only the first two certificates are included in the chain. 1062 int flags = 0; 1063 CertVerifyResult verify_result; 1064 int error = Verify(cybertrust_basic.get(), 1065 "cacert.omniroot.com", 1066 flags, 1067 NULL, 1068 empty_cert_list_, 1069 &verify_result); 1070 EXPECT_EQ(OK, error); 1071 EXPECT_EQ(0U, verify_result.cert_status); 1072 1073 // Attempt to verify with the first known cross-certified intermediate 1074 // provided. 1075 scoped_refptr<X509Certificate> baltimore_intermediate_1 = 1076 ImportCertFromFile(GetTestCertsDirectory(), 1077 "cybertrust_baltimore_cross_certified_1.pem"); 1078 ASSERT_TRUE(baltimore_intermediate_1.get()); 1079 1080 X509Certificate::OSCertHandles intermediate_chain_1 = 1081 cybertrust_basic->GetIntermediateCertificates(); 1082 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); 1083 1084 scoped_refptr<X509Certificate> baltimore_chain_1 = 1085 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), 1086 intermediate_chain_1); 1087 error = Verify(baltimore_chain_1.get(), 1088 "cacert.omniroot.com", 1089 flags, 1090 NULL, 1091 empty_cert_list_, 1092 &verify_result); 1093 EXPECT_EQ(OK, error); 1094 EXPECT_EQ(0U, verify_result.cert_status); 1095 1096 // Attempt to verify with the second known cross-certified intermediate 1097 // provided. 1098 scoped_refptr<X509Certificate> baltimore_intermediate_2 = 1099 ImportCertFromFile(GetTestCertsDirectory(), 1100 "cybertrust_baltimore_cross_certified_2.pem"); 1101 ASSERT_TRUE(baltimore_intermediate_2.get()); 1102 1103 X509Certificate::OSCertHandles intermediate_chain_2 = 1104 cybertrust_basic->GetIntermediateCertificates(); 1105 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); 1106 1107 scoped_refptr<X509Certificate> baltimore_chain_2 = 1108 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), 1109 intermediate_chain_2); 1110 error = Verify(baltimore_chain_2.get(), 1111 "cacert.omniroot.com", 1112 flags, 1113 NULL, 1114 empty_cert_list_, 1115 &verify_result); 1116 EXPECT_EQ(OK, error); 1117 EXPECT_EQ(0U, verify_result.cert_status); 1118 1119 // Attempt to verify when both a cross-certified intermediate AND 1120 // the legacy GTE root are provided. 1121 scoped_refptr<X509Certificate> cybertrust_root = 1122 ImportCertFromFile(GetTestCertsDirectory(), 1123 "cybertrust_gte_root.pem"); 1124 ASSERT_TRUE(cybertrust_root.get()); 1125 1126 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); 1127 scoped_refptr<X509Certificate> baltimore_chain_with_root = 1128 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), 1129 intermediate_chain_2); 1130 error = Verify(baltimore_chain_with_root.get(), 1131 "cacert.omniroot.com", 1132 flags, 1133 NULL, 1134 empty_cert_list_, 1135 &verify_result); 1136 EXPECT_EQ(OK, error); 1137 EXPECT_EQ(0U, verify_result.cert_status); 1138 1139 TestRootCerts::GetInstance()->Clear(); 1140 EXPECT_TRUE(TestRootCerts::GetInstance()->IsEmpty()); 1141 } 1142 #endif 1143 1144 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) 1145 static const uint8 kCRLSetLeafSPKIBlocked[] = { 1146 0x8e, 0x00, 0x7b, 0x22, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x3a, 1147 0x30, 0x2c, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 1148 0x65, 0x22, 0x3a, 0x22, 0x43, 0x52, 0x4c, 0x53, 0x65, 0x74, 0x22, 0x2c, 0x22, 1149 0x53, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63, 0x65, 0x22, 0x3a, 0x30, 0x2c, 0x22, 1150 0x44, 0x65, 0x6c, 0x74, 0x61, 0x46, 0x72, 0x6f, 0x6d, 0x22, 0x3a, 0x30, 0x2c, 1151 0x22, 0x4e, 0x75, 0x6d, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x3a, 1152 0x30, 0x2c, 0x22, 0x42, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x53, 0x50, 0x4b, 1153 0x49, 0x73, 0x22, 0x3a, 0x5b, 0x22, 0x43, 0x38, 0x4d, 0x4a, 0x46, 0x55, 0x55, 1154 0x5a, 0x38, 0x43, 0x79, 0x54, 0x2b, 0x4e, 0x57, 0x64, 0x68, 0x69, 0x7a, 0x51, 1155 0x68, 0x54, 0x49, 0x65, 0x46, 0x49, 0x37, 0x76, 0x41, 0x77, 0x7a, 0x64, 0x54, 1156 0x79, 0x52, 0x59, 0x45, 0x6e, 0x78, 0x6c, 0x33, 0x62, 0x67, 0x3d, 0x22, 0x5d, 1157 0x7d, 1158 }; 1159 1160 static const uint8 kCRLSetLeafSerialBlocked[] = { 1161 0x60, 0x00, 0x7b, 0x22, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x3a, 1162 0x30, 0x2c, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 1163 0x65, 0x22, 0x3a, 0x22, 0x43, 0x52, 0x4c, 0x53, 0x65, 0x74, 0x22, 0x2c, 0x22, 1164 0x53, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63, 0x65, 0x22, 0x3a, 0x30, 0x2c, 0x22, 1165 0x44, 0x65, 0x6c, 0x74, 0x61, 0x46, 0x72, 0x6f, 0x6d, 0x22, 0x3a, 0x30, 0x2c, 1166 0x22, 0x4e, 0x75, 0x6d, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x3a, 1167 0x31, 0x2c, 0x22, 0x42, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x53, 0x50, 0x4b, 1168 0x49, 0x73, 0x22, 0x3a, 0x5b, 0x5d, 0x7d, 0x0f, 0x87, 0xe4, 0xc7, 0x75, 0xea, 1169 0x46, 0x7e, 0xf3, 0xfd, 0x82, 0xb7, 0x46, 0x7b, 0x10, 0xda, 0xc5, 0xbf, 0xd8, 1170 0xd1, 0x29, 0xb2, 0xc6, 0xac, 0x7f, 0x51, 0x42, 0x15, 0x28, 0x51, 0x06, 0x7f, 1171 0x01, 0x00, 0x00, 0x00, // number of serials 1172 0x01, 0xed, // serial 0xed 1173 }; 1174 1175 static const uint8 kCRLSetQUICSerialBlocked[] = { 1176 0x60, 0x00, 0x7b, 0x22, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x3a, 1177 0x30, 0x2c, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 1178 0x65, 0x22, 0x3a, 0x22, 0x43, 0x52, 0x4c, 0x53, 0x65, 0x74, 0x22, 0x2c, 0x22, 1179 0x53, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63, 0x65, 0x22, 0x3a, 0x30, 0x2c, 0x22, 1180 0x44, 0x65, 0x6c, 0x74, 0x61, 0x46, 0x72, 0x6f, 0x6d, 0x22, 0x3a, 0x30, 0x2c, 1181 0x22, 0x4e, 0x75, 0x6d, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x3a, 1182 0x31, 0x2c, 0x22, 0x42, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x53, 0x50, 0x4b, 1183 0x49, 0x73, 0x22, 0x3a, 0x5b, 0x5d, 0x7d, 1184 // Issuer SPKI SHA-256 hash: 1185 0xe4, 0x3a, 0xa3, 0xdb, 0x98, 0x31, 0x61, 0x05, 0xdd, 0x57, 0x6d, 0xc6, 0x2f, 1186 0x71, 0x26, 0xba, 0xdd, 0xf4, 0x98, 0x3e, 0x62, 0x22, 0xf8, 0xf9, 0xe4, 0x18, 1187 0x62, 0x77, 0x79, 0xdb, 0x9b, 0x31, 1188 0x01, 0x00, 0x00, 0x00, // number of serials 1189 0x01, 0x03, // serial 3 1190 }; 1191 1192 // Test that CRLSets are effective in making a certificate appear to be 1193 // revoked. 1194 TEST_F(CertVerifyProcTest, CRLSet) { 1195 CertificateList ca_cert_list = 1196 CreateCertificateListFromFile(GetTestCertsDirectory(), 1197 "root_ca_cert.pem", 1198 X509Certificate::FORMAT_AUTO); 1199 ASSERT_EQ(1U, ca_cert_list.size()); 1200 ScopedTestRoot test_root(ca_cert_list[0]); 1201 1202 CertificateList cert_list = CreateCertificateListFromFile( 1203 GetTestCertsDirectory(), "ok_cert.pem", X509Certificate::FORMAT_AUTO); 1204 ASSERT_EQ(1U, cert_list.size()); 1205 scoped_refptr<X509Certificate> cert(cert_list[0]); 1206 1207 int flags = 0; 1208 CertVerifyResult verify_result; 1209 int error = Verify( 1210 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); 1211 EXPECT_EQ(OK, error); 1212 EXPECT_EQ(0U, verify_result.cert_status); 1213 1214 // First test blocking by SPKI. 1215 base::StringPiece crl_set_bytes( 1216 reinterpret_cast<const char*>(kCRLSetLeafSPKIBlocked), 1217 sizeof(kCRLSetLeafSPKIBlocked)); 1218 scoped_refptr<CRLSet> crl_set; 1219 ASSERT_TRUE(CRLSet::Parse(crl_set_bytes, &crl_set)); 1220 1221 error = Verify(cert.get(), 1222 "127.0.0.1", 1223 flags, 1224 crl_set.get(), 1225 empty_cert_list_, 1226 &verify_result); 1227 EXPECT_EQ(ERR_CERT_REVOKED, error); 1228 1229 // Second, test revocation by serial number of a cert directly under the 1230 // root. 1231 crl_set_bytes = 1232 base::StringPiece(reinterpret_cast<const char*>(kCRLSetLeafSerialBlocked), 1233 sizeof(kCRLSetLeafSerialBlocked)); 1234 ASSERT_TRUE(CRLSet::Parse(crl_set_bytes, &crl_set)); 1235 1236 error = Verify(cert.get(), 1237 "127.0.0.1", 1238 flags, 1239 crl_set.get(), 1240 empty_cert_list_, 1241 &verify_result); 1242 EXPECT_EQ(ERR_CERT_REVOKED, error); 1243 } 1244 1245 TEST_F(CertVerifyProcTest, CRLSetLeafSerial) { 1246 CertificateList ca_cert_list = 1247 CreateCertificateListFromFile(GetTestCertsDirectory(), 1248 "quic_root.crt", 1249 X509Certificate::FORMAT_AUTO); 1250 ASSERT_EQ(1U, ca_cert_list.size()); 1251 ScopedTestRoot test_root(ca_cert_list[0]); 1252 1253 CertificateList intermediate_cert_list = 1254 CreateCertificateListFromFile(GetTestCertsDirectory(), 1255 "quic_intermediate.crt", 1256 X509Certificate::FORMAT_AUTO); 1257 ASSERT_EQ(1U, intermediate_cert_list.size()); 1258 X509Certificate::OSCertHandles intermediates; 1259 intermediates.push_back(intermediate_cert_list[0]->os_cert_handle()); 1260 1261 CertificateList cert_list = CreateCertificateListFromFile( 1262 GetTestCertsDirectory(), "quic_test.example.com.crt", 1263 X509Certificate::FORMAT_AUTO); 1264 ASSERT_EQ(1U, cert_list.size()); 1265 1266 scoped_refptr<X509Certificate> leaf = 1267 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), 1268 intermediates); 1269 1270 int flags = 0; 1271 CertVerifyResult verify_result; 1272 int error = Verify(leaf.get(), 1273 "test.example.com", 1274 flags, 1275 NULL, 1276 empty_cert_list_, 1277 &verify_result); 1278 EXPECT_EQ(OK, error); 1279 EXPECT_EQ(0U, verify_result.cert_status); 1280 1281 // Test revocation by serial number of a certificate not under the root. 1282 scoped_refptr<CRLSet> crl_set; 1283 base::StringPiece crl_set_bytes = 1284 base::StringPiece(reinterpret_cast<const char*>(kCRLSetQUICSerialBlocked), 1285 sizeof(kCRLSetQUICSerialBlocked)); 1286 ASSERT_TRUE(CRLSet::Parse(crl_set_bytes, &crl_set)); 1287 1288 error = Verify(leaf.get(), 1289 "test.example.com", 1290 flags, 1291 crl_set.get(), 1292 empty_cert_list_, 1293 &verify_result); 1294 EXPECT_EQ(ERR_CERT_REVOKED, error); 1295 } 1296 #endif 1297 1298 struct WeakDigestTestData { 1299 const char* root_cert_filename; 1300 const char* intermediate_cert_filename; 1301 const char* ee_cert_filename; 1302 bool expected_has_md5; 1303 bool expected_has_md4; 1304 bool expected_has_md2; 1305 }; 1306 1307 // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how 1308 // to output the parameter that was passed. Without this, it will simply 1309 // attempt to print out the first twenty bytes of the object, which depending 1310 // on platform and alignment, may result in an invalid read. 1311 void PrintTo(const WeakDigestTestData& data, std::ostream* os) { 1312 *os << "root: " 1313 << (data.root_cert_filename ? data.root_cert_filename : "none") 1314 << "; intermediate: " << data.intermediate_cert_filename 1315 << "; end-entity: " << data.ee_cert_filename; 1316 } 1317 1318 class CertVerifyProcWeakDigestTest 1319 : public CertVerifyProcTest, 1320 public testing::WithParamInterface<WeakDigestTestData> { 1321 public: 1322 CertVerifyProcWeakDigestTest() {} 1323 virtual ~CertVerifyProcWeakDigestTest() {} 1324 }; 1325 1326 TEST_P(CertVerifyProcWeakDigestTest, Verify) { 1327 WeakDigestTestData data = GetParam(); 1328 base::FilePath certs_dir = GetTestCertsDirectory(); 1329 1330 ScopedTestRoot test_root; 1331 if (data.root_cert_filename) { 1332 scoped_refptr<X509Certificate> root_cert = 1333 ImportCertFromFile(certs_dir, data.root_cert_filename); 1334 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert); 1335 test_root.Reset(root_cert.get()); 1336 } 1337 1338 scoped_refptr<X509Certificate> intermediate_cert = 1339 ImportCertFromFile(certs_dir, data.intermediate_cert_filename); 1340 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert); 1341 scoped_refptr<X509Certificate> ee_cert = 1342 ImportCertFromFile(certs_dir, data.ee_cert_filename); 1343 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_cert); 1344 1345 X509Certificate::OSCertHandles intermediates; 1346 intermediates.push_back(intermediate_cert->os_cert_handle()); 1347 1348 scoped_refptr<X509Certificate> ee_chain = 1349 X509Certificate::CreateFromHandle(ee_cert->os_cert_handle(), 1350 intermediates); 1351 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_chain); 1352 1353 int flags = 0; 1354 CertVerifyResult verify_result; 1355 int rv = Verify(ee_chain.get(), 1356 "127.0.0.1", 1357 flags, 1358 NULL, 1359 empty_cert_list_, 1360 &verify_result); 1361 EXPECT_EQ(data.expected_has_md5, verify_result.has_md5); 1362 EXPECT_EQ(data.expected_has_md4, verify_result.has_md4); 1363 EXPECT_EQ(data.expected_has_md2, verify_result.has_md2); 1364 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); 1365 1366 // Ensure that MD4 and MD2 are tagged as invalid. 1367 if (data.expected_has_md4 || data.expected_has_md2) { 1368 EXPECT_EQ(CERT_STATUS_INVALID, 1369 verify_result.cert_status & CERT_STATUS_INVALID); 1370 } 1371 1372 // Ensure that MD5 is flagged as weak. 1373 if (data.expected_has_md5) { 1374 EXPECT_EQ( 1375 CERT_STATUS_WEAK_SIGNATURE_ALGORITHM, 1376 verify_result.cert_status & CERT_STATUS_WEAK_SIGNATURE_ALGORITHM); 1377 } 1378 1379 // If a root cert is present, then check that the chain was rejected if any 1380 // weak algorithms are present. This is only checked when a root cert is 1381 // present because the error reported for incomplete chains with weak 1382 // algorithms depends on which implementation was used to validate (NSS, 1383 // OpenSSL, CryptoAPI, Security.framework) and upon which weak algorithm 1384 // present (MD2, MD4, MD5). 1385 if (data.root_cert_filename) { 1386 if (data.expected_has_md4 || data.expected_has_md2) { 1387 EXPECT_EQ(ERR_CERT_INVALID, rv); 1388 } else if (data.expected_has_md5) { 1389 EXPECT_EQ(ERR_CERT_WEAK_SIGNATURE_ALGORITHM, rv); 1390 } else { 1391 EXPECT_EQ(OK, rv); 1392 } 1393 } 1394 } 1395 1396 // Unlike TEST/TEST_F, which are macros that expand to further macros, 1397 // INSTANTIATE_TEST_CASE_P is a macro that expands directly to code that 1398 // stringizes the arguments. As a result, macros passed as parameters (such as 1399 // prefix or test_case_name) will not be expanded by the preprocessor. To work 1400 // around this, indirect the macro for INSTANTIATE_TEST_CASE_P, so that the 1401 // pre-processor will expand macros such as MAYBE_test_name before 1402 // instantiating the test. 1403 #define WRAPPED_INSTANTIATE_TEST_CASE_P(prefix, test_case_name, generator) \ 1404 INSTANTIATE_TEST_CASE_P(prefix, test_case_name, generator) 1405 1406 // The signature algorithm of the root CA should not matter. 1407 const WeakDigestTestData kVerifyRootCATestData[] = { 1408 { "weak_digest_md5_root.pem", "weak_digest_sha1_intermediate.pem", 1409 "weak_digest_sha1_ee.pem", false, false, false }, 1410 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1411 // MD4 is not supported by OS X / NSS 1412 { "weak_digest_md4_root.pem", "weak_digest_sha1_intermediate.pem", 1413 "weak_digest_sha1_ee.pem", false, false, false }, 1414 #endif 1415 { "weak_digest_md2_root.pem", "weak_digest_sha1_intermediate.pem", 1416 "weak_digest_sha1_ee.pem", false, false, false }, 1417 }; 1418 INSTANTIATE_TEST_CASE_P(VerifyRoot, CertVerifyProcWeakDigestTest, 1419 testing::ValuesIn(kVerifyRootCATestData)); 1420 1421 // The signature algorithm of intermediates should be properly detected. 1422 const WeakDigestTestData kVerifyIntermediateCATestData[] = { 1423 { "weak_digest_sha1_root.pem", "weak_digest_md5_intermediate.pem", 1424 "weak_digest_sha1_ee.pem", true, false, false }, 1425 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1426 // MD4 is not supported by OS X / NSS 1427 { "weak_digest_sha1_root.pem", "weak_digest_md4_intermediate.pem", 1428 "weak_digest_sha1_ee.pem", false, true, false }, 1429 #endif 1430 { "weak_digest_sha1_root.pem", "weak_digest_md2_intermediate.pem", 1431 "weak_digest_sha1_ee.pem", false, false, true }, 1432 }; 1433 // Disabled on NSS - MD4 is not supported, and MD2 and MD5 are disabled. 1434 #if defined(USE_NSS) || defined(OS_IOS) 1435 #define MAYBE_VerifyIntermediate DISABLED_VerifyIntermediate 1436 #else 1437 #define MAYBE_VerifyIntermediate VerifyIntermediate 1438 #endif 1439 WRAPPED_INSTANTIATE_TEST_CASE_P( 1440 MAYBE_VerifyIntermediate, 1441 CertVerifyProcWeakDigestTest, 1442 testing::ValuesIn(kVerifyIntermediateCATestData)); 1443 1444 // The signature algorithm of end-entity should be properly detected. 1445 const WeakDigestTestData kVerifyEndEntityTestData[] = { 1446 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", 1447 "weak_digest_md5_ee.pem", true, false, false }, 1448 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1449 // MD4 is not supported by OS X / NSS 1450 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", 1451 "weak_digest_md4_ee.pem", false, true, false }, 1452 #endif 1453 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", 1454 "weak_digest_md2_ee.pem", false, false, true }, 1455 }; 1456 // Disabled on NSS - NSS caches chains/signatures in such a way that cannot 1457 // be cleared until NSS is cleanly shutdown, which is not presently supported 1458 // in Chromium. 1459 #if defined(USE_NSS) || defined(OS_IOS) 1460 #define MAYBE_VerifyEndEntity DISABLED_VerifyEndEntity 1461 #else 1462 #define MAYBE_VerifyEndEntity VerifyEndEntity 1463 #endif 1464 WRAPPED_INSTANTIATE_TEST_CASE_P(MAYBE_VerifyEndEntity, 1465 CertVerifyProcWeakDigestTest, 1466 testing::ValuesIn(kVerifyEndEntityTestData)); 1467 1468 // Incomplete chains should still report the status of the intermediate. 1469 const WeakDigestTestData kVerifyIncompleteIntermediateTestData[] = { 1470 { NULL, "weak_digest_md5_intermediate.pem", "weak_digest_sha1_ee.pem", 1471 true, false, false }, 1472 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1473 // MD4 is not supported by OS X / NSS 1474 { NULL, "weak_digest_md4_intermediate.pem", "weak_digest_sha1_ee.pem", 1475 false, true, false }, 1476 #endif 1477 { NULL, "weak_digest_md2_intermediate.pem", "weak_digest_sha1_ee.pem", 1478 false, false, true }, 1479 }; 1480 // Disabled on NSS - libpkix does not return constructed chains on error, 1481 // preventing us from detecting/inspecting the verified chain. 1482 #if defined(USE_NSS) || defined(OS_IOS) 1483 #define MAYBE_VerifyIncompleteIntermediate \ 1484 DISABLED_VerifyIncompleteIntermediate 1485 #else 1486 #define MAYBE_VerifyIncompleteIntermediate VerifyIncompleteIntermediate 1487 #endif 1488 WRAPPED_INSTANTIATE_TEST_CASE_P( 1489 MAYBE_VerifyIncompleteIntermediate, 1490 CertVerifyProcWeakDigestTest, 1491 testing::ValuesIn(kVerifyIncompleteIntermediateTestData)); 1492 1493 // Incomplete chains should still report the status of the end-entity. 1494 const WeakDigestTestData kVerifyIncompleteEETestData[] = { 1495 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md5_ee.pem", 1496 true, false, false }, 1497 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1498 // MD4 is not supported by OS X / NSS 1499 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md4_ee.pem", 1500 false, true, false }, 1501 #endif 1502 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md2_ee.pem", 1503 false, false, true }, 1504 }; 1505 // Disabled on NSS - libpkix does not return constructed chains on error, 1506 // preventing us from detecting/inspecting the verified chain. 1507 #if defined(USE_NSS) || defined(OS_IOS) 1508 #define MAYBE_VerifyIncompleteEndEntity DISABLED_VerifyIncompleteEndEntity 1509 #else 1510 #define MAYBE_VerifyIncompleteEndEntity VerifyIncompleteEndEntity 1511 #endif 1512 WRAPPED_INSTANTIATE_TEST_CASE_P( 1513 MAYBE_VerifyIncompleteEndEntity, 1514 CertVerifyProcWeakDigestTest, 1515 testing::ValuesIn(kVerifyIncompleteEETestData)); 1516 1517 // Differing algorithms between the intermediate and the EE should still be 1518 // reported. 1519 const WeakDigestTestData kVerifyMixedTestData[] = { 1520 { "weak_digest_sha1_root.pem", "weak_digest_md5_intermediate.pem", 1521 "weak_digest_md2_ee.pem", true, false, true }, 1522 { "weak_digest_sha1_root.pem", "weak_digest_md2_intermediate.pem", 1523 "weak_digest_md5_ee.pem", true, false, true }, 1524 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1525 // MD4 is not supported by OS X / NSS 1526 { "weak_digest_sha1_root.pem", "weak_digest_md4_intermediate.pem", 1527 "weak_digest_md2_ee.pem", false, true, true }, 1528 #endif 1529 }; 1530 // NSS does not support MD4 and does not enable MD2 by default, making all 1531 // permutations invalid. 1532 #if defined(USE_NSS) || defined(OS_IOS) 1533 #define MAYBE_VerifyMixed DISABLED_VerifyMixed 1534 #else 1535 #define MAYBE_VerifyMixed VerifyMixed 1536 #endif 1537 WRAPPED_INSTANTIATE_TEST_CASE_P( 1538 MAYBE_VerifyMixed, 1539 CertVerifyProcWeakDigestTest, 1540 testing::ValuesIn(kVerifyMixedTestData)); 1541 1542 // For the list of valid hostnames, see 1543 // net/cert/data/ssl/certificates/subjectAltName_sanity_check.pem 1544 static const struct CertVerifyProcNameData { 1545 const char* hostname; 1546 bool valid; // Whether or not |hostname| matches a subjectAltName. 1547 } kVerifyNameData[] = { 1548 { "127.0.0.1", false }, // Don't match the common name 1549 { "127.0.0.2", true }, // Matches the iPAddress SAN (IPv4) 1550 { "FE80:0:0:0:0:0:0:1", true }, // Matches the iPAddress SAN (IPv6) 1551 { "[FE80:0:0:0:0:0:0:1]", false }, // Should not match the iPAddress SAN 1552 { "FE80::1", true }, // Compressed form matches the iPAddress SAN (IPv6) 1553 { "::127.0.0.2", false }, // IPv6 mapped form should NOT match iPAddress SAN 1554 { "test.example", true }, // Matches the dNSName SAN 1555 { "test.example.", true }, // Matches the dNSName SAN (trailing . ignored) 1556 { "www.test.example", false }, // Should not match the dNSName SAN 1557 { "test..example", false }, // Should not match the dNSName SAN 1558 { "test.example..", false }, // Should not match the dNSName SAN 1559 { ".test.example.", false }, // Should not match the dNSName SAN 1560 { ".test.example", false }, // Should not match the dNSName SAN 1561 }; 1562 1563 // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how 1564 // to output the parameter that was passed. Without this, it will simply 1565 // attempt to print out the first twenty bytes of the object, which depending 1566 // on platform and alignment, may result in an invalid read. 1567 void PrintTo(const CertVerifyProcNameData& data, std::ostream* os) { 1568 *os << "Hostname: " << data.hostname << "; valid=" << data.valid; 1569 } 1570 1571 class CertVerifyProcNameTest 1572 : public CertVerifyProcTest, 1573 public testing::WithParamInterface<CertVerifyProcNameData> { 1574 public: 1575 CertVerifyProcNameTest() {} 1576 virtual ~CertVerifyProcNameTest() {} 1577 }; 1578 1579 TEST_P(CertVerifyProcNameTest, VerifyCertName) { 1580 CertVerifyProcNameData data = GetParam(); 1581 1582 CertificateList cert_list = CreateCertificateListFromFile( 1583 GetTestCertsDirectory(), "subjectAltName_sanity_check.pem", 1584 X509Certificate::FORMAT_AUTO); 1585 ASSERT_EQ(1U, cert_list.size()); 1586 scoped_refptr<X509Certificate> cert(cert_list[0]); 1587 1588 ScopedTestRoot scoped_root(cert.get()); 1589 1590 CertVerifyResult verify_result; 1591 int error = Verify(cert.get(), data.hostname, 0, NULL, empty_cert_list_, 1592 &verify_result); 1593 if (data.valid) { 1594 EXPECT_EQ(OK, error); 1595 EXPECT_FALSE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID); 1596 } else { 1597 EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error); 1598 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID); 1599 } 1600 } 1601 1602 WRAPPED_INSTANTIATE_TEST_CASE_P( 1603 VerifyName, 1604 CertVerifyProcNameTest, 1605 testing::ValuesIn(kVerifyNameData)); 1606 1607 } // namespace net 1608
