1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "net/cert/cert_verify_proc.h" 6 7 #include <vector> 8 9 #include "base/callback_helpers.h" 10 #include "base/files/file_path.h" 11 #include "base/files/file_util.h" 12 #include "base/logging.h" 13 #include "base/sha1.h" 14 #include "base/strings/string_number_conversions.h" 15 #include "crypto/sha2.h" 16 #include "net/base/net_errors.h" 17 #include "net/base/test_data_directory.h" 18 #include "net/cert/asn1_util.h" 19 #include "net/cert/cert_status_flags.h" 20 #include "net/cert/cert_verifier.h" 21 #include "net/cert/cert_verify_result.h" 22 #include "net/cert/crl_set.h" 23 #include "net/cert/crl_set_storage.h" 24 #include "net/cert/test_root_certs.h" 25 #include "net/cert/x509_certificate.h" 26 #include "net/test/cert_test_util.h" 27 #include "net/test/test_certificate_data.h" 28 #include "testing/gtest/include/gtest/gtest.h" 29 30 #if defined(OS_WIN) 31 #include "base/win/windows_version.h" 32 #elif defined(OS_MACOSX) && !defined(OS_IOS) 33 #include "base/mac/mac_util.h" 34 #elif defined(OS_ANDROID) 35 #include "base/android/build_info.h" 36 #endif 37 38 using base::HexEncode; 39 40 namespace net { 41 42 namespace { 43 44 // A certificate for www.paypal.com with a NULL byte in the common name. 45 // From http://www.gossamer-threads.com/lists/fulldisc/full-disclosure/70363 46 unsigned char paypal_null_fingerprint[] = { 47 0x4c, 0x88, 0x9e, 0x28, 0xd7, 0x7a, 0x44, 0x1e, 0x13, 0xf2, 0x6a, 0xba, 48 0x1f, 0xe8, 0x1b, 0xd6, 0xab, 0x7b, 0xe8, 0xd7 49 }; 50 51 // Mock CertVerifyProc that will set |verify_result->is_issued_by_known_root| 52 // for all certificates that are Verified. 53 class WellKnownCaCertVerifyProc : public CertVerifyProc { 54 public: 55 // Initialize a CertVerifyProc that will set 56 // |verify_result->is_issued_by_known_root| to |is_well_known|. 57 explicit WellKnownCaCertVerifyProc(bool is_well_known) 58 : is_well_known_(is_well_known) {} 59 60 // CertVerifyProc implementation: 61 virtual bool SupportsAdditionalTrustAnchors() const OVERRIDE { return false; } 62 63 protected: 64 virtual ~WellKnownCaCertVerifyProc() {} 65 66 private: 67 virtual int VerifyInternal(X509Certificate* cert, 68 const std::string& hostname, 69 int flags, 70 CRLSet* crl_set, 71 const CertificateList& additional_trust_anchors, 72 CertVerifyResult* verify_result) OVERRIDE; 73 74 const bool is_well_known_; 75 76 DISALLOW_COPY_AND_ASSIGN(WellKnownCaCertVerifyProc); 77 }; 78 79 int WellKnownCaCertVerifyProc::VerifyInternal( 80 X509Certificate* cert, 81 const std::string& hostname, 82 int flags, 83 CRLSet* crl_set, 84 const CertificateList& additional_trust_anchors, 85 CertVerifyResult* verify_result) { 86 verify_result->is_issued_by_known_root = is_well_known_; 87 return OK; 88 } 89 90 bool SupportsReturningVerifiedChain() { 91 #if defined(OS_ANDROID) 92 // Before API level 17, Android does not expose the APIs necessary to get at 93 // the verified certificate chain. 94 if (base::android::BuildInfo::GetInstance()->sdk_int() < 17) 95 return false; 96 #endif 97 return true; 98 } 99 100 bool SupportsDetectingKnownRoots() { 101 #if defined(OS_ANDROID) 102 // Before API level 17, Android does not expose the APIs necessary to get at 103 // the verified certificate chain and detect known roots. 104 if (base::android::BuildInfo::GetInstance()->sdk_int() < 17) 105 return false; 106 #endif 107 return true; 108 } 109 110 } // namespace 111 112 class CertVerifyProcTest : public testing::Test { 113 public: 114 CertVerifyProcTest() 115 : verify_proc_(CertVerifyProc::CreateDefault()) { 116 } 117 virtual ~CertVerifyProcTest() {} 118 119 protected: 120 bool SupportsAdditionalTrustAnchors() { 121 return verify_proc_->SupportsAdditionalTrustAnchors(); 122 } 123 124 int Verify(X509Certificate* cert, 125 const std::string& hostname, 126 int flags, 127 CRLSet* crl_set, 128 const CertificateList& additional_trust_anchors, 129 CertVerifyResult* verify_result) { 130 return verify_proc_->Verify(cert, hostname, flags, crl_set, 131 additional_trust_anchors, verify_result); 132 } 133 134 const CertificateList empty_cert_list_; 135 scoped_refptr<CertVerifyProc> verify_proc_; 136 }; 137 138 TEST_F(CertVerifyProcTest, DISABLED_WithoutRevocationChecking) { 139 // Check that verification without revocation checking works. 140 CertificateList certs = CreateCertificateListFromFile( 141 GetTestCertsDirectory(), 142 "googlenew.chain.pem", 143 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); 144 145 X509Certificate::OSCertHandles intermediates; 146 intermediates.push_back(certs[1]->os_cert_handle()); 147 148 scoped_refptr<X509Certificate> google_full_chain = 149 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 150 intermediates); 151 152 CertVerifyResult verify_result; 153 EXPECT_EQ(OK, 154 Verify(google_full_chain.get(), 155 "www.google.com", 156 0 /* flags */, 157 NULL, 158 empty_cert_list_, 159 &verify_result)); 160 } 161 162 #if defined(OS_ANDROID) || defined(USE_OPENSSL_CERTS) 163 // TODO(jnd): http://crbug.com/117478 - EV verification is not yet supported. 164 #define MAYBE_EVVerification DISABLED_EVVerification 165 #else 166 #define MAYBE_EVVerification EVVerification 167 #endif 168 TEST_F(CertVerifyProcTest, MAYBE_EVVerification) { 169 CertificateList certs = CreateCertificateListFromFile( 170 GetTestCertsDirectory(), 171 "comodo.chain.pem", 172 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); 173 ASSERT_EQ(3U, certs.size()); 174 175 X509Certificate::OSCertHandles intermediates; 176 intermediates.push_back(certs[1]->os_cert_handle()); 177 intermediates.push_back(certs[2]->os_cert_handle()); 178 179 scoped_refptr<X509Certificate> comodo_chain = 180 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 181 intermediates); 182 183 scoped_refptr<CRLSet> crl_set(CRLSet::ForTesting(false, NULL, "")); 184 CertVerifyResult verify_result; 185 int flags = CertVerifier::VERIFY_EV_CERT; 186 int error = Verify(comodo_chain.get(), 187 "comodo.com", 188 flags, 189 crl_set.get(), 190 empty_cert_list_, 191 &verify_result); 192 EXPECT_EQ(OK, error); 193 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_IS_EV); 194 } 195 196 TEST_F(CertVerifyProcTest, PaypalNullCertParsing) { 197 scoped_refptr<X509Certificate> paypal_null_cert( 198 X509Certificate::CreateFromBytes( 199 reinterpret_cast<const char*>(paypal_null_der), 200 sizeof(paypal_null_der))); 201 202 ASSERT_NE(static_cast<X509Certificate*>(NULL), paypal_null_cert.get()); 203 204 const SHA1HashValue& fingerprint = 205 paypal_null_cert->fingerprint(); 206 for (size_t i = 0; i < 20; ++i) 207 EXPECT_EQ(paypal_null_fingerprint[i], fingerprint.data[i]); 208 209 int flags = 0; 210 CertVerifyResult verify_result; 211 int error = Verify(paypal_null_cert.get(), 212 "www.paypal.com", 213 flags, 214 NULL, 215 empty_cert_list_, 216 &verify_result); 217 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_ANDROID) 218 EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error); 219 #else 220 // TOOD(bulach): investigate why macosx and win aren't returning 221 // ERR_CERT_INVALID or ERR_CERT_COMMON_NAME_INVALID. 222 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 223 #endif 224 // Either the system crypto library should correctly report a certificate 225 // name mismatch, or our certificate blacklist should cause us to report an 226 // invalid certificate. 227 #if defined(USE_NSS) || defined(OS_WIN) || defined(OS_IOS) 228 EXPECT_TRUE(verify_result.cert_status & 229 (CERT_STATUS_COMMON_NAME_INVALID | CERT_STATUS_INVALID)); 230 #endif 231 } 232 233 // A regression test for http://crbug.com/31497. 234 #if defined(OS_ANDROID) 235 // Disabled on Android, as the Android verification libraries require an 236 // explicit policy to be specified, even when anyPolicy is permitted. 237 #define MAYBE_IntermediateCARequireExplicitPolicy \ 238 DISABLED_IntermediateCARequireExplicitPolicy 239 #else 240 #define MAYBE_IntermediateCARequireExplicitPolicy \ 241 IntermediateCARequireExplicitPolicy 242 #endif 243 TEST_F(CertVerifyProcTest, MAYBE_IntermediateCARequireExplicitPolicy) { 244 base::FilePath certs_dir = GetTestCertsDirectory(); 245 246 CertificateList certs = CreateCertificateListFromFile( 247 certs_dir, "explicit-policy-chain.pem", 248 X509Certificate::FORMAT_AUTO); 249 ASSERT_EQ(3U, certs.size()); 250 251 X509Certificate::OSCertHandles intermediates; 252 intermediates.push_back(certs[1]->os_cert_handle()); 253 254 scoped_refptr<X509Certificate> cert = 255 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 256 intermediates); 257 ASSERT_TRUE(cert.get()); 258 259 ScopedTestRoot scoped_root(certs[2].get()); 260 261 int flags = 0; 262 CertVerifyResult verify_result; 263 int error = Verify(cert.get(), 264 "policy_test.example", 265 flags, 266 NULL, 267 empty_cert_list_, 268 &verify_result); 269 EXPECT_EQ(OK, error); 270 EXPECT_EQ(0u, verify_result.cert_status); 271 } 272 273 // Test for bug 58437. 274 // This certificate will expire on 2011-12-21. The test will still 275 // pass if error == ERR_CERT_DATE_INVALID. 276 // This test is DISABLED because it appears that we cannot do 277 // certificate revocation checking when running all of the net unit tests. 278 // This test passes when run individually, but when run with all of the net 279 // unit tests, the call to PKIXVerifyCert returns the NSS error -8180, which is 280 // SEC_ERROR_REVOKED_CERTIFICATE. This indicates a lack of revocation 281 // status, i.e. that the revocation check is failing for some reason. 282 TEST_F(CertVerifyProcTest, DISABLED_GlobalSignR3EVTest) { 283 base::FilePath certs_dir = GetTestCertsDirectory(); 284 285 scoped_refptr<X509Certificate> server_cert = 286 ImportCertFromFile(certs_dir, "2029_globalsign_com_cert.pem"); 287 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); 288 289 scoped_refptr<X509Certificate> intermediate_cert = 290 ImportCertFromFile(certs_dir, "globalsign_ev_sha256_ca_cert.pem"); 291 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert.get()); 292 293 X509Certificate::OSCertHandles intermediates; 294 intermediates.push_back(intermediate_cert->os_cert_handle()); 295 scoped_refptr<X509Certificate> cert_chain = 296 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 297 intermediates); 298 299 CertVerifyResult verify_result; 300 int flags = CertVerifier::VERIFY_REV_CHECKING_ENABLED | 301 CertVerifier::VERIFY_EV_CERT; 302 int error = Verify(cert_chain.get(), 303 "2029.globalsign.com", 304 flags, 305 NULL, 306 empty_cert_list_, 307 &verify_result); 308 if (error == OK) 309 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_IS_EV); 310 else 311 EXPECT_EQ(ERR_CERT_DATE_INVALID, error); 312 } 313 314 // Test that verifying an ECDSA certificate doesn't crash on XP. (See 315 // crbug.com/144466). 316 TEST_F(CertVerifyProcTest, ECDSA_RSA) { 317 base::FilePath certs_dir = GetTestCertsDirectory(); 318 319 scoped_refptr<X509Certificate> cert = 320 ImportCertFromFile(certs_dir, 321 "prime256v1-ecdsa-ee-by-1024-rsa-intermediate.pem"); 322 323 CertVerifyResult verify_result; 324 Verify(cert.get(), "127.0.0.1", 0, NULL, empty_cert_list_, &verify_result); 325 326 // We don't check verify_result because the certificate is signed by an 327 // unknown CA and will be considered invalid on XP because of the ECDSA 328 // public key. 329 } 330 331 // Currently, only RSA and DSA keys are checked for weakness, and our example 332 // weak size is 768. These could change in the future. 333 // 334 // Note that this means there may be false negatives: keys for other 335 // algorithms and which are weak will pass this test. 336 static bool IsWeakKeyType(const std::string& key_type) { 337 size_t pos = key_type.find("-"); 338 std::string size = key_type.substr(0, pos); 339 std::string type = key_type.substr(pos + 1); 340 341 if (type == "rsa" || type == "dsa") 342 return size == "768"; 343 344 return false; 345 } 346 347 TEST_F(CertVerifyProcTest, RejectWeakKeys) { 348 base::FilePath certs_dir = GetTestCertsDirectory(); 349 typedef std::vector<std::string> Strings; 350 Strings key_types; 351 352 // generate-weak-test-chains.sh currently has: 353 // key_types="768-rsa 1024-rsa 2048-rsa prime256v1-ecdsa" 354 // We must use the same key types here. The filenames generated look like: 355 // 2048-rsa-ee-by-768-rsa-intermediate.pem 356 key_types.push_back("768-rsa"); 357 key_types.push_back("1024-rsa"); 358 key_types.push_back("2048-rsa"); 359 360 bool use_ecdsa = true; 361 #if defined(OS_WIN) 362 use_ecdsa = base::win::GetVersion() > base::win::VERSION_XP; 363 #endif 364 365 if (use_ecdsa) 366 key_types.push_back("prime256v1-ecdsa"); 367 368 // Add the root that signed the intermediates for this test. 369 scoped_refptr<X509Certificate> root_cert = 370 ImportCertFromFile(certs_dir, "2048-rsa-root.pem"); 371 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); 372 ScopedTestRoot scoped_root(root_cert.get()); 373 374 // Now test each chain. 375 for (Strings::const_iterator ee_type = key_types.begin(); 376 ee_type != key_types.end(); ++ee_type) { 377 for (Strings::const_iterator signer_type = key_types.begin(); 378 signer_type != key_types.end(); ++signer_type) { 379 std::string basename = *ee_type + "-ee-by-" + *signer_type + 380 "-intermediate.pem"; 381 SCOPED_TRACE(basename); 382 scoped_refptr<X509Certificate> ee_cert = 383 ImportCertFromFile(certs_dir, basename); 384 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_cert.get()); 385 386 basename = *signer_type + "-intermediate.pem"; 387 scoped_refptr<X509Certificate> intermediate = 388 ImportCertFromFile(certs_dir, basename); 389 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate.get()); 390 391 X509Certificate::OSCertHandles intermediates; 392 intermediates.push_back(intermediate->os_cert_handle()); 393 scoped_refptr<X509Certificate> cert_chain = 394 X509Certificate::CreateFromHandle(ee_cert->os_cert_handle(), 395 intermediates); 396 397 CertVerifyResult verify_result; 398 int error = Verify(cert_chain.get(), 399 "127.0.0.1", 400 0, 401 NULL, 402 empty_cert_list_, 403 &verify_result); 404 405 if (IsWeakKeyType(*ee_type) || IsWeakKeyType(*signer_type)) { 406 EXPECT_NE(OK, error); 407 EXPECT_EQ(CERT_STATUS_WEAK_KEY, 408 verify_result.cert_status & CERT_STATUS_WEAK_KEY); 409 EXPECT_NE(CERT_STATUS_INVALID, 410 verify_result.cert_status & CERT_STATUS_INVALID); 411 } else { 412 EXPECT_EQ(OK, error); 413 EXPECT_EQ(0U, verify_result.cert_status & CERT_STATUS_WEAK_KEY); 414 } 415 } 416 } 417 } 418 419 // Regression test for http://crbug.com/108514. 420 #if defined(OS_MACOSX) && !defined(OS_IOS) 421 // Disabled on OS X - Security.framework doesn't ignore superflous certificates 422 // provided by servers. See CertVerifyProcTest.CybertrustGTERoot for further 423 // details. 424 #define MAYBE_ExtraneousMD5RootCert DISABLED_ExtraneousMD5RootCert 425 #else 426 #define MAYBE_ExtraneousMD5RootCert ExtraneousMD5RootCert 427 #endif 428 TEST_F(CertVerifyProcTest, MAYBE_ExtraneousMD5RootCert) { 429 if (!SupportsReturningVerifiedChain()) { 430 LOG(INFO) << "Skipping this test in this platform."; 431 return; 432 } 433 434 base::FilePath certs_dir = GetTestCertsDirectory(); 435 436 scoped_refptr<X509Certificate> server_cert = 437 ImportCertFromFile(certs_dir, "cross-signed-leaf.pem"); 438 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); 439 440 scoped_refptr<X509Certificate> extra_cert = 441 ImportCertFromFile(certs_dir, "cross-signed-root-md5.pem"); 442 ASSERT_NE(static_cast<X509Certificate*>(NULL), extra_cert.get()); 443 444 scoped_refptr<X509Certificate> root_cert = 445 ImportCertFromFile(certs_dir, "cross-signed-root-sha1.pem"); 446 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); 447 448 ScopedTestRoot scoped_root(root_cert.get()); 449 450 X509Certificate::OSCertHandles intermediates; 451 intermediates.push_back(extra_cert->os_cert_handle()); 452 scoped_refptr<X509Certificate> cert_chain = 453 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 454 intermediates); 455 456 CertVerifyResult verify_result; 457 int flags = 0; 458 int error = Verify(cert_chain.get(), 459 "127.0.0.1", 460 flags, 461 NULL, 462 empty_cert_list_, 463 &verify_result); 464 EXPECT_EQ(OK, error); 465 466 // The extra MD5 root should be discarded 467 ASSERT_TRUE(verify_result.verified_cert.get()); 468 ASSERT_EQ(1u, 469 verify_result.verified_cert->GetIntermediateCertificates().size()); 470 EXPECT_TRUE(X509Certificate::IsSameOSCert( 471 verify_result.verified_cert->GetIntermediateCertificates().front(), 472 root_cert->os_cert_handle())); 473 474 EXPECT_FALSE(verify_result.has_md5); 475 } 476 477 // Test for bug 94673. 478 TEST_F(CertVerifyProcTest, GoogleDigiNotarTest) { 479 base::FilePath certs_dir = GetTestCertsDirectory(); 480 481 scoped_refptr<X509Certificate> server_cert = 482 ImportCertFromFile(certs_dir, "google_diginotar.pem"); 483 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); 484 485 scoped_refptr<X509Certificate> intermediate_cert = 486 ImportCertFromFile(certs_dir, "diginotar_public_ca_2025.pem"); 487 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert.get()); 488 489 X509Certificate::OSCertHandles intermediates; 490 intermediates.push_back(intermediate_cert->os_cert_handle()); 491 scoped_refptr<X509Certificate> cert_chain = 492 X509Certificate::CreateFromHandle(server_cert->os_cert_handle(), 493 intermediates); 494 495 CertVerifyResult verify_result; 496 int flags = CertVerifier::VERIFY_REV_CHECKING_ENABLED; 497 int error = Verify(cert_chain.get(), 498 "mail.google.com", 499 flags, 500 NULL, 501 empty_cert_list_, 502 &verify_result); 503 EXPECT_NE(OK, error); 504 505 // Now turn off revocation checking. Certificate verification should still 506 // fail. 507 flags = 0; 508 error = Verify(cert_chain.get(), 509 "mail.google.com", 510 flags, 511 NULL, 512 empty_cert_list_, 513 &verify_result); 514 EXPECT_NE(OK, error); 515 } 516 517 TEST_F(CertVerifyProcTest, DigiNotarCerts) { 518 static const char* const kDigiNotarFilenames[] = { 519 "diginotar_root_ca.pem", 520 "diginotar_cyber_ca.pem", 521 "diginotar_services_1024_ca.pem", 522 "diginotar_pkioverheid.pem", 523 "diginotar_pkioverheid_g2.pem", 524 NULL, 525 }; 526 527 base::FilePath certs_dir = GetTestCertsDirectory(); 528 529 for (size_t i = 0; kDigiNotarFilenames[i]; i++) { 530 scoped_refptr<X509Certificate> diginotar_cert = 531 ImportCertFromFile(certs_dir, kDigiNotarFilenames[i]); 532 std::string der_bytes; 533 ASSERT_TRUE(X509Certificate::GetDEREncoded( 534 diginotar_cert->os_cert_handle(), &der_bytes)); 535 536 base::StringPiece spki; 537 ASSERT_TRUE(asn1::ExtractSPKIFromDERCert(der_bytes, &spki)); 538 539 std::string spki_sha1 = base::SHA1HashString(spki.as_string()); 540 541 HashValueVector public_keys; 542 HashValue hash(HASH_VALUE_SHA1); 543 ASSERT_EQ(hash.size(), spki_sha1.size()); 544 memcpy(hash.data(), spki_sha1.data(), spki_sha1.size()); 545 public_keys.push_back(hash); 546 547 EXPECT_TRUE(CertVerifyProc::IsPublicKeyBlacklisted(public_keys)) << 548 "Public key not blocked for " << kDigiNotarFilenames[i]; 549 } 550 } 551 552 TEST_F(CertVerifyProcTest, NameConstraintsOk) { 553 CertificateList ca_cert_list = 554 CreateCertificateListFromFile(GetTestCertsDirectory(), 555 "root_ca_cert.pem", 556 X509Certificate::FORMAT_AUTO); 557 ASSERT_EQ(1U, ca_cert_list.size()); 558 ScopedTestRoot test_root(ca_cert_list[0].get()); 559 560 CertificateList cert_list = CreateCertificateListFromFile( 561 GetTestCertsDirectory(), "name_constraint_good.pem", 562 X509Certificate::FORMAT_AUTO); 563 ASSERT_EQ(1U, cert_list.size()); 564 565 X509Certificate::OSCertHandles intermediates; 566 scoped_refptr<X509Certificate> leaf = 567 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), 568 intermediates); 569 570 int flags = 0; 571 CertVerifyResult verify_result; 572 int error = Verify(leaf.get(), 573 "test.example.com", 574 flags, 575 NULL, 576 empty_cert_list_, 577 &verify_result); 578 EXPECT_EQ(OK, error); 579 EXPECT_EQ(0U, verify_result.cert_status); 580 } 581 582 TEST_F(CertVerifyProcTest, NameConstraintsFailure) { 583 if (!SupportsReturningVerifiedChain()) { 584 LOG(INFO) << "Skipping this test in this platform."; 585 return; 586 } 587 588 CertificateList ca_cert_list = 589 CreateCertificateListFromFile(GetTestCertsDirectory(), 590 "root_ca_cert.pem", 591 X509Certificate::FORMAT_AUTO); 592 ASSERT_EQ(1U, ca_cert_list.size()); 593 ScopedTestRoot test_root(ca_cert_list[0].get()); 594 595 CertificateList cert_list = CreateCertificateListFromFile( 596 GetTestCertsDirectory(), "name_constraint_bad.pem", 597 X509Certificate::FORMAT_AUTO); 598 ASSERT_EQ(1U, cert_list.size()); 599 600 X509Certificate::OSCertHandles intermediates; 601 scoped_refptr<X509Certificate> leaf = 602 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), 603 intermediates); 604 605 int flags = 0; 606 CertVerifyResult verify_result; 607 int error = Verify(leaf.get(), 608 "test.example.com", 609 flags, 610 NULL, 611 empty_cert_list_, 612 &verify_result); 613 EXPECT_EQ(ERR_CERT_NAME_CONSTRAINT_VIOLATION, error); 614 EXPECT_EQ(CERT_STATUS_NAME_CONSTRAINT_VIOLATION, 615 verify_result.cert_status & CERT_STATUS_NAME_CONSTRAINT_VIOLATION); 616 } 617 618 TEST_F(CertVerifyProcTest, TestKnownRoot) { 619 if (!SupportsDetectingKnownRoots()) { 620 LOG(INFO) << "Skipping this test in this platform."; 621 return; 622 } 623 624 base::FilePath certs_dir = GetTestCertsDirectory(); 625 CertificateList certs = CreateCertificateListFromFile( 626 certs_dir, "satveda.pem", X509Certificate::FORMAT_AUTO); 627 ASSERT_EQ(2U, certs.size()); 628 629 X509Certificate::OSCertHandles intermediates; 630 intermediates.push_back(certs[1]->os_cert_handle()); 631 632 scoped_refptr<X509Certificate> cert_chain = 633 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 634 intermediates); 635 636 int flags = 0; 637 CertVerifyResult verify_result; 638 // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug 639 // against agl. See also PublicKeyHashes. 640 int error = Verify(cert_chain.get(), 641 "satveda.com", 642 flags, 643 NULL, 644 empty_cert_list_, 645 &verify_result); 646 EXPECT_EQ(OK, error); 647 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); 648 EXPECT_TRUE(verify_result.is_issued_by_known_root); 649 } 650 651 // The certse.pem certificate has been revoked. crbug.com/259723. 652 TEST_F(CertVerifyProcTest, PublicKeyHashes) { 653 if (!SupportsReturningVerifiedChain()) { 654 LOG(INFO) << "Skipping this test in this platform."; 655 return; 656 } 657 658 base::FilePath certs_dir = GetTestCertsDirectory(); 659 CertificateList certs = CreateCertificateListFromFile( 660 certs_dir, "satveda.pem", X509Certificate::FORMAT_AUTO); 661 ASSERT_EQ(2U, certs.size()); 662 663 X509Certificate::OSCertHandles intermediates; 664 intermediates.push_back(certs[1]->os_cert_handle()); 665 666 scoped_refptr<X509Certificate> cert_chain = 667 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 668 intermediates); 669 int flags = 0; 670 CertVerifyResult verify_result; 671 672 // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug 673 // against agl. See also TestKnownRoot. 674 int error = Verify(cert_chain.get(), 675 "satveda.com", 676 flags, 677 NULL, 678 empty_cert_list_, 679 &verify_result); 680 EXPECT_EQ(OK, error); 681 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); 682 ASSERT_LE(2U, verify_result.public_key_hashes.size()); 683 684 HashValueVector sha1_hashes; 685 for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) { 686 if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA1) 687 continue; 688 sha1_hashes.push_back(verify_result.public_key_hashes[i]); 689 } 690 ASSERT_LE(2u, sha1_hashes.size()); 691 692 for (size_t i = 0; i < 2; ++i) { 693 EXPECT_EQ(HexEncode(kSatvedaSPKIs[i], base::kSHA1Length), 694 HexEncode(sha1_hashes[i].data(), base::kSHA1Length)); 695 } 696 697 HashValueVector sha256_hashes; 698 for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) { 699 if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA256) 700 continue; 701 sha256_hashes.push_back(verify_result.public_key_hashes[i]); 702 } 703 ASSERT_LE(2u, sha256_hashes.size()); 704 705 for (size_t i = 0; i < 2; ++i) { 706 EXPECT_EQ(HexEncode(kSatvedaSPKIsSHA256[i], crypto::kSHA256Length), 707 HexEncode(sha256_hashes[i].data(), crypto::kSHA256Length)); 708 } 709 } 710 711 // A regression test for http://crbug.com/70293. 712 // The Key Usage extension in this RSA SSL server certificate does not have 713 // the keyEncipherment bit. 714 TEST_F(CertVerifyProcTest, InvalidKeyUsage) { 715 base::FilePath certs_dir = GetTestCertsDirectory(); 716 717 scoped_refptr<X509Certificate> server_cert = 718 ImportCertFromFile(certs_dir, "invalid_key_usage_cert.der"); 719 ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get()); 720 721 int flags = 0; 722 CertVerifyResult verify_result; 723 int error = Verify(server_cert.get(), 724 "jira.aquameta.com", 725 flags, 726 NULL, 727 empty_cert_list_, 728 &verify_result); 729 #if defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID) 730 // This certificate has two errors: "invalid key usage" and "untrusted CA". 731 // However, OpenSSL returns only one (the latter), and we can't detect 732 // the other errors. 733 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 734 #else 735 EXPECT_EQ(ERR_CERT_INVALID, error); 736 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_INVALID); 737 #endif 738 // TODO(wtc): fix http://crbug.com/75520 to get all the certificate errors 739 // from NSS. 740 #if !defined(USE_NSS) && !defined(OS_IOS) && !defined(OS_ANDROID) 741 // The certificate is issued by an unknown CA. 742 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID); 743 #endif 744 } 745 746 // Basic test for returning the chain in CertVerifyResult. Note that the 747 // returned chain may just be a reflection of the originally supplied chain; 748 // that is, if any errors occur, the default chain returned is an exact copy 749 // of the certificate to be verified. The remaining VerifyReturn* tests are 750 // used to ensure that the actual, verified chain is being returned by 751 // Verify(). 752 TEST_F(CertVerifyProcTest, VerifyReturnChainBasic) { 753 if (!SupportsReturningVerifiedChain()) { 754 LOG(INFO) << "Skipping this test in this platform."; 755 return; 756 } 757 758 base::FilePath certs_dir = GetTestCertsDirectory(); 759 CertificateList certs = CreateCertificateListFromFile( 760 certs_dir, "x509_verify_results.chain.pem", 761 X509Certificate::FORMAT_AUTO); 762 ASSERT_EQ(3U, certs.size()); 763 764 X509Certificate::OSCertHandles intermediates; 765 intermediates.push_back(certs[1]->os_cert_handle()); 766 intermediates.push_back(certs[2]->os_cert_handle()); 767 768 ScopedTestRoot scoped_root(certs[2].get()); 769 770 scoped_refptr<X509Certificate> google_full_chain = 771 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 772 intermediates); 773 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain.get()); 774 ASSERT_EQ(2U, google_full_chain->GetIntermediateCertificates().size()); 775 776 CertVerifyResult verify_result; 777 EXPECT_EQ(static_cast<X509Certificate*>(NULL), 778 verify_result.verified_cert.get()); 779 int error = Verify(google_full_chain.get(), 780 "127.0.0.1", 781 0, 782 NULL, 783 empty_cert_list_, 784 &verify_result); 785 EXPECT_EQ(OK, error); 786 ASSERT_NE(static_cast<X509Certificate*>(NULL), 787 verify_result.verified_cert.get()); 788 789 EXPECT_NE(google_full_chain, verify_result.verified_cert); 790 EXPECT_TRUE(X509Certificate::IsSameOSCert( 791 google_full_chain->os_cert_handle(), 792 verify_result.verified_cert->os_cert_handle())); 793 const X509Certificate::OSCertHandles& return_intermediates = 794 verify_result.verified_cert->GetIntermediateCertificates(); 795 ASSERT_EQ(2U, return_intermediates.size()); 796 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], 797 certs[1]->os_cert_handle())); 798 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], 799 certs[2]->os_cert_handle())); 800 } 801 802 // Test that certificates issued for 'intranet' names (that is, containing no 803 // known public registry controlled domain information) issued by well-known 804 // CAs are flagged appropriately, while certificates that are issued by 805 // internal CAs are not flagged. 806 TEST_F(CertVerifyProcTest, IntranetHostsRejected) { 807 if (!SupportsDetectingKnownRoots()) { 808 LOG(INFO) << "Skipping this test in this platform."; 809 return; 810 } 811 812 CertificateList cert_list = CreateCertificateListFromFile( 813 GetTestCertsDirectory(), "ok_cert.pem", 814 X509Certificate::FORMAT_AUTO); 815 ASSERT_EQ(1U, cert_list.size()); 816 scoped_refptr<X509Certificate> cert(cert_list[0]); 817 818 CertVerifyResult verify_result; 819 int error = 0; 820 821 // Intranet names for public CAs should be flagged: 822 verify_proc_ = new WellKnownCaCertVerifyProc(true); 823 error = 824 Verify(cert.get(), "intranet", 0, NULL, empty_cert_list_, &verify_result); 825 EXPECT_EQ(OK, error); 826 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_NON_UNIQUE_NAME); 827 828 // However, if the CA is not well known, these should not be flagged: 829 verify_proc_ = new WellKnownCaCertVerifyProc(false); 830 error = 831 Verify(cert.get(), "intranet", 0, NULL, empty_cert_list_, &verify_result); 832 EXPECT_EQ(OK, error); 833 EXPECT_FALSE(verify_result.cert_status & CERT_STATUS_NON_UNIQUE_NAME); 834 } 835 836 // Test that the certificate returned in CertVerifyResult is able to reorder 837 // certificates that are not ordered from end-entity to root. While this is 838 // a protocol violation if sent during a TLS handshake, if multiple sources 839 // of intermediate certificates are combined, it's possible that order may 840 // not be maintained. 841 TEST_F(CertVerifyProcTest, VerifyReturnChainProperlyOrdered) { 842 if (!SupportsReturningVerifiedChain()) { 843 LOG(INFO) << "Skipping this test in this platform."; 844 return; 845 } 846 847 base::FilePath certs_dir = GetTestCertsDirectory(); 848 CertificateList certs = CreateCertificateListFromFile( 849 certs_dir, "x509_verify_results.chain.pem", 850 X509Certificate::FORMAT_AUTO); 851 ASSERT_EQ(3U, certs.size()); 852 853 // Construct the chain out of order. 854 X509Certificate::OSCertHandles intermediates; 855 intermediates.push_back(certs[2]->os_cert_handle()); 856 intermediates.push_back(certs[1]->os_cert_handle()); 857 858 ScopedTestRoot scoped_root(certs[2].get()); 859 860 scoped_refptr<X509Certificate> google_full_chain = 861 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 862 intermediates); 863 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain.get()); 864 ASSERT_EQ(2U, google_full_chain->GetIntermediateCertificates().size()); 865 866 CertVerifyResult verify_result; 867 EXPECT_EQ(static_cast<X509Certificate*>(NULL), 868 verify_result.verified_cert.get()); 869 int error = Verify(google_full_chain.get(), 870 "127.0.0.1", 871 0, 872 NULL, 873 empty_cert_list_, 874 &verify_result); 875 EXPECT_EQ(OK, error); 876 ASSERT_NE(static_cast<X509Certificate*>(NULL), 877 verify_result.verified_cert.get()); 878 879 EXPECT_NE(google_full_chain, verify_result.verified_cert); 880 EXPECT_TRUE(X509Certificate::IsSameOSCert( 881 google_full_chain->os_cert_handle(), 882 verify_result.verified_cert->os_cert_handle())); 883 const X509Certificate::OSCertHandles& return_intermediates = 884 verify_result.verified_cert->GetIntermediateCertificates(); 885 ASSERT_EQ(2U, return_intermediates.size()); 886 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], 887 certs[1]->os_cert_handle())); 888 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], 889 certs[2]->os_cert_handle())); 890 } 891 892 // Test that Verify() filters out certificates which are not related to 893 // or part of the certificate chain being verified. 894 TEST_F(CertVerifyProcTest, VerifyReturnChainFiltersUnrelatedCerts) { 895 if (!SupportsReturningVerifiedChain()) { 896 LOG(INFO) << "Skipping this test in this platform."; 897 return; 898 } 899 900 base::FilePath certs_dir = GetTestCertsDirectory(); 901 CertificateList certs = CreateCertificateListFromFile( 902 certs_dir, "x509_verify_results.chain.pem", 903 X509Certificate::FORMAT_AUTO); 904 ASSERT_EQ(3U, certs.size()); 905 ScopedTestRoot scoped_root(certs[2].get()); 906 907 scoped_refptr<X509Certificate> unrelated_certificate = 908 ImportCertFromFile(certs_dir, "duplicate_cn_1.pem"); 909 scoped_refptr<X509Certificate> unrelated_certificate2 = 910 ImportCertFromFile(certs_dir, "aia-cert.pem"); 911 ASSERT_NE(static_cast<X509Certificate*>(NULL), unrelated_certificate.get()); 912 ASSERT_NE(static_cast<X509Certificate*>(NULL), unrelated_certificate2.get()); 913 914 // Interject unrelated certificates into the list of intermediates. 915 X509Certificate::OSCertHandles intermediates; 916 intermediates.push_back(unrelated_certificate->os_cert_handle()); 917 intermediates.push_back(certs[1]->os_cert_handle()); 918 intermediates.push_back(unrelated_certificate2->os_cert_handle()); 919 intermediates.push_back(certs[2]->os_cert_handle()); 920 921 scoped_refptr<X509Certificate> google_full_chain = 922 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 923 intermediates); 924 ASSERT_NE(static_cast<X509Certificate*>(NULL), google_full_chain.get()); 925 ASSERT_EQ(4U, google_full_chain->GetIntermediateCertificates().size()); 926 927 CertVerifyResult verify_result; 928 EXPECT_EQ(static_cast<X509Certificate*>(NULL), 929 verify_result.verified_cert.get()); 930 int error = Verify(google_full_chain.get(), 931 "127.0.0.1", 932 0, 933 NULL, 934 empty_cert_list_, 935 &verify_result); 936 EXPECT_EQ(OK, error); 937 ASSERT_NE(static_cast<X509Certificate*>(NULL), 938 verify_result.verified_cert.get()); 939 940 EXPECT_NE(google_full_chain, verify_result.verified_cert); 941 EXPECT_TRUE(X509Certificate::IsSameOSCert( 942 google_full_chain->os_cert_handle(), 943 verify_result.verified_cert->os_cert_handle())); 944 const X509Certificate::OSCertHandles& return_intermediates = 945 verify_result.verified_cert->GetIntermediateCertificates(); 946 ASSERT_EQ(2U, return_intermediates.size()); 947 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[0], 948 certs[1]->os_cert_handle())); 949 EXPECT_TRUE(X509Certificate::IsSameOSCert(return_intermediates[1], 950 certs[2]->os_cert_handle())); 951 } 952 953 TEST_F(CertVerifyProcTest, AdditionalTrustAnchors) { 954 if (!SupportsAdditionalTrustAnchors()) { 955 LOG(INFO) << "Skipping this test in this platform."; 956 return; 957 } 958 959 // |ca_cert| is the issuer of |cert|. 960 CertificateList ca_cert_list = CreateCertificateListFromFile( 961 GetTestCertsDirectory(), "root_ca_cert.pem", 962 X509Certificate::FORMAT_AUTO); 963 ASSERT_EQ(1U, ca_cert_list.size()); 964 scoped_refptr<X509Certificate> ca_cert(ca_cert_list[0]); 965 966 CertificateList cert_list = CreateCertificateListFromFile( 967 GetTestCertsDirectory(), "ok_cert.pem", 968 X509Certificate::FORMAT_AUTO); 969 ASSERT_EQ(1U, cert_list.size()); 970 scoped_refptr<X509Certificate> cert(cert_list[0]); 971 972 // Verification of |cert| fails when |ca_cert| is not in the trust anchors 973 // list. 974 int flags = 0; 975 CertVerifyResult verify_result; 976 int error = Verify( 977 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); 978 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 979 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); 980 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); 981 982 // Now add the |ca_cert| to the |trust_anchors|, and verification should pass. 983 CertificateList trust_anchors; 984 trust_anchors.push_back(ca_cert); 985 error = Verify( 986 cert.get(), "127.0.0.1", flags, NULL, trust_anchors, &verify_result); 987 EXPECT_EQ(OK, error); 988 EXPECT_EQ(0U, verify_result.cert_status); 989 EXPECT_TRUE(verify_result.is_issued_by_additional_trust_anchor); 990 991 // Clearing the |trust_anchors| makes verification fail again (the cache 992 // should be skipped). 993 error = Verify( 994 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); 995 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 996 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); 997 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); 998 } 999 1000 // Tests that certificates issued by user-supplied roots are not flagged as 1001 // issued by a known root. This should pass whether or not the platform supports 1002 // detecting known roots. 1003 TEST_F(CertVerifyProcTest, IsIssuedByKnownRootIgnoresTestRoots) { 1004 // Load root_ca_cert.pem into the test root store. 1005 TestRootCerts* root_certs = TestRootCerts::GetInstance(); 1006 root_certs->AddFromFile( 1007 GetTestCertsDirectory().AppendASCII("root_ca_cert.pem")); 1008 1009 CertificateList cert_list = CreateCertificateListFromFile( 1010 GetTestCertsDirectory(), "ok_cert.pem", 1011 X509Certificate::FORMAT_AUTO); 1012 ASSERT_EQ(1U, cert_list.size()); 1013 scoped_refptr<X509Certificate> cert(cert_list[0]); 1014 1015 // Verification should pass. 1016 int flags = 0; 1017 CertVerifyResult verify_result; 1018 int error = Verify( 1019 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); 1020 EXPECT_EQ(OK, error); 1021 EXPECT_EQ(0U, verify_result.cert_status); 1022 // But should not be marked as a known root. 1023 EXPECT_FALSE(verify_result.is_issued_by_known_root); 1024 1025 root_certs->Clear(); 1026 EXPECT_TRUE(root_certs->IsEmpty()); 1027 } 1028 1029 #if defined(OS_MACOSX) && !defined(OS_IOS) 1030 // Tests that, on OS X, issues with a cross-certified Baltimore CyberTrust 1031 // Root can be successfully worked around once Apple completes removing the 1032 // older GTE CyberTrust Root from its trusted root store. 1033 // 1034 // The issue is caused by servers supplying the cross-certified intermediate 1035 // (necessary for certain mobile platforms), which OS X does not recognize 1036 // as already existing within its trust store. 1037 TEST_F(CertVerifyProcTest, CybertrustGTERoot) { 1038 CertificateList certs = CreateCertificateListFromFile( 1039 GetTestCertsDirectory(), 1040 "cybertrust_omniroot_chain.pem", 1041 X509Certificate::FORMAT_PEM_CERT_SEQUENCE); 1042 ASSERT_EQ(2U, certs.size()); 1043 1044 X509Certificate::OSCertHandles intermediates; 1045 intermediates.push_back(certs[1]->os_cert_handle()); 1046 1047 scoped_refptr<X509Certificate> cybertrust_basic = 1048 X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(), 1049 intermediates); 1050 ASSERT_TRUE(cybertrust_basic.get()); 1051 1052 scoped_refptr<X509Certificate> baltimore_root = 1053 ImportCertFromFile(GetTestCertsDirectory(), 1054 "cybertrust_baltimore_root.pem"); 1055 ASSERT_TRUE(baltimore_root.get()); 1056 1057 ScopedTestRoot scoped_root(baltimore_root.get()); 1058 1059 // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This 1060 // simulates Keychain removing support for the GTE CyberTrust Root. 1061 TestRootCerts::GetInstance()->SetAllowSystemTrust(false); 1062 base::ScopedClosureRunner reset_system_trust( 1063 base::Bind(&TestRootCerts::SetAllowSystemTrust, 1064 base::Unretained(TestRootCerts::GetInstance()), 1065 true)); 1066 1067 // First, make sure a simple certificate chain from 1068 // EE -> Public SureServer SV -> Baltimore CyberTrust 1069 // works. Only the first two certificates are included in the chain. 1070 int flags = 0; 1071 CertVerifyResult verify_result; 1072 int error = Verify(cybertrust_basic.get(), 1073 "cacert.omniroot.com", 1074 flags, 1075 NULL, 1076 empty_cert_list_, 1077 &verify_result); 1078 EXPECT_EQ(OK, error); 1079 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); 1080 1081 // Attempt to verify with the first known cross-certified intermediate 1082 // provided. 1083 scoped_refptr<X509Certificate> baltimore_intermediate_1 = 1084 ImportCertFromFile(GetTestCertsDirectory(), 1085 "cybertrust_baltimore_cross_certified_1.pem"); 1086 ASSERT_TRUE(baltimore_intermediate_1.get()); 1087 1088 X509Certificate::OSCertHandles intermediate_chain_1 = 1089 cybertrust_basic->GetIntermediateCertificates(); 1090 intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle()); 1091 1092 scoped_refptr<X509Certificate> baltimore_chain_1 = 1093 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), 1094 intermediate_chain_1); 1095 error = Verify(baltimore_chain_1.get(), 1096 "cacert.omniroot.com", 1097 flags, 1098 NULL, 1099 empty_cert_list_, 1100 &verify_result); 1101 EXPECT_EQ(OK, error); 1102 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); 1103 1104 // Attempt to verify with the second known cross-certified intermediate 1105 // provided. 1106 scoped_refptr<X509Certificate> baltimore_intermediate_2 = 1107 ImportCertFromFile(GetTestCertsDirectory(), 1108 "cybertrust_baltimore_cross_certified_2.pem"); 1109 ASSERT_TRUE(baltimore_intermediate_2.get()); 1110 1111 X509Certificate::OSCertHandles intermediate_chain_2 = 1112 cybertrust_basic->GetIntermediateCertificates(); 1113 intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle()); 1114 1115 scoped_refptr<X509Certificate> baltimore_chain_2 = 1116 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), 1117 intermediate_chain_2); 1118 error = Verify(baltimore_chain_2.get(), 1119 "cacert.omniroot.com", 1120 flags, 1121 NULL, 1122 empty_cert_list_, 1123 &verify_result); 1124 EXPECT_EQ(OK, error); 1125 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); 1126 1127 // Attempt to verify when both a cross-certified intermediate AND 1128 // the legacy GTE root are provided. 1129 scoped_refptr<X509Certificate> cybertrust_root = 1130 ImportCertFromFile(GetTestCertsDirectory(), 1131 "cybertrust_gte_root.pem"); 1132 ASSERT_TRUE(cybertrust_root.get()); 1133 1134 intermediate_chain_2.push_back(cybertrust_root->os_cert_handle()); 1135 scoped_refptr<X509Certificate> baltimore_chain_with_root = 1136 X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(), 1137 intermediate_chain_2); 1138 error = Verify(baltimore_chain_with_root.get(), 1139 "cacert.omniroot.com", 1140 flags, 1141 NULL, 1142 empty_cert_list_, 1143 &verify_result); 1144 EXPECT_EQ(OK, error); 1145 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); 1146 1147 TestRootCerts::GetInstance()->Clear(); 1148 EXPECT_TRUE(TestRootCerts::GetInstance()->IsEmpty()); 1149 } 1150 #endif 1151 1152 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX) 1153 // Test that CRLSets are effective in making a certificate appear to be 1154 // revoked. 1155 TEST_F(CertVerifyProcTest, CRLSet) { 1156 CertificateList ca_cert_list = 1157 CreateCertificateListFromFile(GetTestCertsDirectory(), 1158 "root_ca_cert.pem", 1159 X509Certificate::FORMAT_AUTO); 1160 ASSERT_EQ(1U, ca_cert_list.size()); 1161 ScopedTestRoot test_root(ca_cert_list[0].get()); 1162 1163 CertificateList cert_list = CreateCertificateListFromFile( 1164 GetTestCertsDirectory(), "ok_cert.pem", X509Certificate::FORMAT_AUTO); 1165 ASSERT_EQ(1U, cert_list.size()); 1166 scoped_refptr<X509Certificate> cert(cert_list[0]); 1167 1168 int flags = 0; 1169 CertVerifyResult verify_result; 1170 int error = Verify( 1171 cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result); 1172 EXPECT_EQ(OK, error); 1173 EXPECT_EQ(0U, verify_result.cert_status); 1174 1175 scoped_refptr<CRLSet> crl_set; 1176 std::string crl_set_bytes; 1177 1178 // First test blocking by SPKI. 1179 EXPECT_TRUE(base::ReadFileToString( 1180 GetTestCertsDirectory().AppendASCII("crlset_by_leaf_spki.raw"), 1181 &crl_set_bytes)); 1182 ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set)); 1183 1184 error = Verify(cert.get(), 1185 "127.0.0.1", 1186 flags, 1187 crl_set.get(), 1188 empty_cert_list_, 1189 &verify_result); 1190 EXPECT_EQ(ERR_CERT_REVOKED, error); 1191 1192 // Second, test revocation by serial number of a cert directly under the 1193 // root. 1194 crl_set_bytes.clear(); 1195 EXPECT_TRUE(base::ReadFileToString( 1196 GetTestCertsDirectory().AppendASCII("crlset_by_root_serial.raw"), 1197 &crl_set_bytes)); 1198 ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set)); 1199 1200 error = Verify(cert.get(), 1201 "127.0.0.1", 1202 flags, 1203 crl_set.get(), 1204 empty_cert_list_, 1205 &verify_result); 1206 EXPECT_EQ(ERR_CERT_REVOKED, error); 1207 } 1208 1209 TEST_F(CertVerifyProcTest, CRLSetLeafSerial) { 1210 CertificateList ca_cert_list = 1211 CreateCertificateListFromFile(GetTestCertsDirectory(), 1212 "quic_root.crt", 1213 X509Certificate::FORMAT_AUTO); 1214 ASSERT_EQ(1U, ca_cert_list.size()); 1215 ScopedTestRoot test_root(ca_cert_list[0].get()); 1216 1217 CertificateList intermediate_cert_list = 1218 CreateCertificateListFromFile(GetTestCertsDirectory(), 1219 "quic_intermediate.crt", 1220 X509Certificate::FORMAT_AUTO); 1221 ASSERT_EQ(1U, intermediate_cert_list.size()); 1222 X509Certificate::OSCertHandles intermediates; 1223 intermediates.push_back(intermediate_cert_list[0]->os_cert_handle()); 1224 1225 CertificateList cert_list = CreateCertificateListFromFile( 1226 GetTestCertsDirectory(), "quic_test.example.com.crt", 1227 X509Certificate::FORMAT_AUTO); 1228 ASSERT_EQ(1U, cert_list.size()); 1229 1230 scoped_refptr<X509Certificate> leaf = 1231 X509Certificate::CreateFromHandle(cert_list[0]->os_cert_handle(), 1232 intermediates); 1233 1234 int flags = 0; 1235 CertVerifyResult verify_result; 1236 int error = Verify(leaf.get(), 1237 "test.example.com", 1238 flags, 1239 NULL, 1240 empty_cert_list_, 1241 &verify_result); 1242 EXPECT_EQ(OK, error); 1243 EXPECT_EQ(CERT_STATUS_SHA1_SIGNATURE_PRESENT, verify_result.cert_status); 1244 1245 // Test revocation by serial number of a certificate not under the root. 1246 scoped_refptr<CRLSet> crl_set; 1247 std::string crl_set_bytes; 1248 ASSERT_TRUE(base::ReadFileToString( 1249 GetTestCertsDirectory().AppendASCII("crlset_by_intermediate_serial.raw"), 1250 &crl_set_bytes)); 1251 ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set)); 1252 1253 error = Verify(leaf.get(), 1254 "test.example.com", 1255 flags, 1256 crl_set.get(), 1257 empty_cert_list_, 1258 &verify_result); 1259 EXPECT_EQ(ERR_CERT_REVOKED, error); 1260 } 1261 #endif 1262 1263 enum ExpectedAlgorithms { 1264 EXPECT_MD2 = 1 << 0, 1265 EXPECT_MD4 = 1 << 1, 1266 EXPECT_MD5 = 1 << 2, 1267 EXPECT_SHA1 = 1 << 3 1268 }; 1269 1270 struct WeakDigestTestData { 1271 const char* root_cert_filename; 1272 const char* intermediate_cert_filename; 1273 const char* ee_cert_filename; 1274 int expected_algorithms; 1275 }; 1276 1277 // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how 1278 // to output the parameter that was passed. Without this, it will simply 1279 // attempt to print out the first twenty bytes of the object, which depending 1280 // on platform and alignment, may result in an invalid read. 1281 void PrintTo(const WeakDigestTestData& data, std::ostream* os) { 1282 *os << "root: " 1283 << (data.root_cert_filename ? data.root_cert_filename : "none") 1284 << "; intermediate: " << data.intermediate_cert_filename 1285 << "; end-entity: " << data.ee_cert_filename; 1286 } 1287 1288 class CertVerifyProcWeakDigestTest 1289 : public CertVerifyProcTest, 1290 public testing::WithParamInterface<WeakDigestTestData> { 1291 public: 1292 CertVerifyProcWeakDigestTest() {} 1293 virtual ~CertVerifyProcWeakDigestTest() {} 1294 }; 1295 1296 TEST_P(CertVerifyProcWeakDigestTest, Verify) { 1297 WeakDigestTestData data = GetParam(); 1298 base::FilePath certs_dir = GetTestCertsDirectory(); 1299 1300 ScopedTestRoot test_root; 1301 if (data.root_cert_filename) { 1302 scoped_refptr<X509Certificate> root_cert = 1303 ImportCertFromFile(certs_dir, data.root_cert_filename); 1304 ASSERT_NE(static_cast<X509Certificate*>(NULL), root_cert.get()); 1305 test_root.Reset(root_cert.get()); 1306 } 1307 1308 scoped_refptr<X509Certificate> intermediate_cert = 1309 ImportCertFromFile(certs_dir, data.intermediate_cert_filename); 1310 ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert.get()); 1311 scoped_refptr<X509Certificate> ee_cert = 1312 ImportCertFromFile(certs_dir, data.ee_cert_filename); 1313 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_cert.get()); 1314 1315 X509Certificate::OSCertHandles intermediates; 1316 intermediates.push_back(intermediate_cert->os_cert_handle()); 1317 1318 scoped_refptr<X509Certificate> ee_chain = 1319 X509Certificate::CreateFromHandle(ee_cert->os_cert_handle(), 1320 intermediates); 1321 ASSERT_NE(static_cast<X509Certificate*>(NULL), ee_chain.get()); 1322 1323 int flags = 0; 1324 CertVerifyResult verify_result; 1325 int rv = Verify(ee_chain.get(), 1326 "127.0.0.1", 1327 flags, 1328 NULL, 1329 empty_cert_list_, 1330 &verify_result); 1331 EXPECT_EQ(!!(data.expected_algorithms & EXPECT_MD2), verify_result.has_md2); 1332 EXPECT_EQ(!!(data.expected_algorithms & EXPECT_MD4), verify_result.has_md4); 1333 EXPECT_EQ(!!(data.expected_algorithms & EXPECT_MD5), verify_result.has_md5); 1334 EXPECT_EQ(!!(data.expected_algorithms & EXPECT_SHA1), verify_result.has_sha1); 1335 1336 EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor); 1337 1338 // Ensure that MD4 and MD2 are tagged as invalid. 1339 if (data.expected_algorithms & (EXPECT_MD2 | EXPECT_MD4)) { 1340 EXPECT_EQ(CERT_STATUS_INVALID, 1341 verify_result.cert_status & CERT_STATUS_INVALID); 1342 } 1343 1344 // Ensure that MD5 is flagged as weak. 1345 if (data.expected_algorithms & EXPECT_MD5) { 1346 EXPECT_EQ( 1347 CERT_STATUS_WEAK_SIGNATURE_ALGORITHM, 1348 verify_result.cert_status & CERT_STATUS_WEAK_SIGNATURE_ALGORITHM); 1349 } 1350 1351 // If a root cert is present, then check that the chain was rejected if any 1352 // weak algorithms are present. This is only checked when a root cert is 1353 // present because the error reported for incomplete chains with weak 1354 // algorithms depends on which implementation was used to validate (NSS, 1355 // OpenSSL, CryptoAPI, Security.framework) and upon which weak algorithm 1356 // present (MD2, MD4, MD5). 1357 if (data.root_cert_filename) { 1358 if (data.expected_algorithms & (EXPECT_MD2 | EXPECT_MD4)) { 1359 EXPECT_EQ(ERR_CERT_INVALID, rv); 1360 } else if (data.expected_algorithms & EXPECT_MD5) { 1361 EXPECT_EQ(ERR_CERT_WEAK_SIGNATURE_ALGORITHM, rv); 1362 } else { 1363 EXPECT_EQ(OK, rv); 1364 } 1365 } 1366 } 1367 1368 // Unlike TEST/TEST_F, which are macros that expand to further macros, 1369 // INSTANTIATE_TEST_CASE_P is a macro that expands directly to code that 1370 // stringizes the arguments. As a result, macros passed as parameters (such as 1371 // prefix or test_case_name) will not be expanded by the preprocessor. To work 1372 // around this, indirect the macro for INSTANTIATE_TEST_CASE_P, so that the 1373 // pre-processor will expand macros such as MAYBE_test_name before 1374 // instantiating the test. 1375 #define WRAPPED_INSTANTIATE_TEST_CASE_P(prefix, test_case_name, generator) \ 1376 INSTANTIATE_TEST_CASE_P(prefix, test_case_name, generator) 1377 1378 // The signature algorithm of the root CA should not matter. 1379 const WeakDigestTestData kVerifyRootCATestData[] = { 1380 { "weak_digest_md5_root.pem", "weak_digest_sha1_intermediate.pem", 1381 "weak_digest_sha1_ee.pem", EXPECT_SHA1 }, 1382 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1383 // MD4 is not supported by OS X / NSS 1384 { "weak_digest_md4_root.pem", "weak_digest_sha1_intermediate.pem", 1385 "weak_digest_sha1_ee.pem", EXPECT_SHA1 }, 1386 #endif 1387 { "weak_digest_md2_root.pem", "weak_digest_sha1_intermediate.pem", 1388 "weak_digest_sha1_ee.pem", EXPECT_SHA1 }, 1389 }; 1390 INSTANTIATE_TEST_CASE_P(VerifyRoot, CertVerifyProcWeakDigestTest, 1391 testing::ValuesIn(kVerifyRootCATestData)); 1392 1393 // The signature algorithm of intermediates should be properly detected. 1394 const WeakDigestTestData kVerifyIntermediateCATestData[] = { 1395 { "weak_digest_sha1_root.pem", "weak_digest_md5_intermediate.pem", 1396 "weak_digest_sha1_ee.pem", EXPECT_MD5 | EXPECT_SHA1 }, 1397 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1398 // MD4 is not supported by OS X / NSS 1399 { "weak_digest_sha1_root.pem", "weak_digest_md4_intermediate.pem", 1400 "weak_digest_sha1_ee.pem", EXPECT_MD4 | EXPECT_SHA1 }, 1401 #endif 1402 { "weak_digest_sha1_root.pem", "weak_digest_md2_intermediate.pem", 1403 "weak_digest_sha1_ee.pem", EXPECT_MD2 | EXPECT_SHA1 }, 1404 }; 1405 // Disabled on NSS - MD4 is not supported, and MD2 and MD5 are disabled. 1406 #if defined(USE_NSS) || defined(OS_IOS) 1407 #define MAYBE_VerifyIntermediate DISABLED_VerifyIntermediate 1408 #else 1409 #define MAYBE_VerifyIntermediate VerifyIntermediate 1410 #endif 1411 WRAPPED_INSTANTIATE_TEST_CASE_P( 1412 MAYBE_VerifyIntermediate, 1413 CertVerifyProcWeakDigestTest, 1414 testing::ValuesIn(kVerifyIntermediateCATestData)); 1415 1416 // The signature algorithm of end-entity should be properly detected. 1417 const WeakDigestTestData kVerifyEndEntityTestData[] = { 1418 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", 1419 "weak_digest_md5_ee.pem", EXPECT_MD5 | EXPECT_SHA1 }, 1420 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1421 // MD4 is not supported by OS X / NSS 1422 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", 1423 "weak_digest_md4_ee.pem", EXPECT_MD4 | EXPECT_SHA1 }, 1424 #endif 1425 { "weak_digest_sha1_root.pem", "weak_digest_sha1_intermediate.pem", 1426 "weak_digest_md2_ee.pem", EXPECT_MD2 | EXPECT_SHA1 }, 1427 }; 1428 // Disabled on NSS - NSS caches chains/signatures in such a way that cannot 1429 // be cleared until NSS is cleanly shutdown, which is not presently supported 1430 // in Chromium. 1431 #if defined(USE_NSS) || defined(OS_IOS) 1432 #define MAYBE_VerifyEndEntity DISABLED_VerifyEndEntity 1433 #else 1434 #define MAYBE_VerifyEndEntity VerifyEndEntity 1435 #endif 1436 WRAPPED_INSTANTIATE_TEST_CASE_P(MAYBE_VerifyEndEntity, 1437 CertVerifyProcWeakDigestTest, 1438 testing::ValuesIn(kVerifyEndEntityTestData)); 1439 1440 // Incomplete chains should still report the status of the intermediate. 1441 const WeakDigestTestData kVerifyIncompleteIntermediateTestData[] = { 1442 { NULL, "weak_digest_md5_intermediate.pem", "weak_digest_sha1_ee.pem", 1443 EXPECT_MD5 | EXPECT_SHA1 }, 1444 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1445 // MD4 is not supported by OS X / NSS 1446 { NULL, "weak_digest_md4_intermediate.pem", "weak_digest_sha1_ee.pem", 1447 EXPECT_MD4 | EXPECT_SHA1 }, 1448 #endif 1449 { NULL, "weak_digest_md2_intermediate.pem", "weak_digest_sha1_ee.pem", 1450 EXPECT_MD2 | EXPECT_SHA1 }, 1451 }; 1452 // Disabled on NSS - libpkix does not return constructed chains on error, 1453 // preventing us from detecting/inspecting the verified chain. 1454 #if defined(USE_NSS) || defined(OS_IOS) 1455 #define MAYBE_VerifyIncompleteIntermediate \ 1456 DISABLED_VerifyIncompleteIntermediate 1457 #else 1458 #define MAYBE_VerifyIncompleteIntermediate VerifyIncompleteIntermediate 1459 #endif 1460 WRAPPED_INSTANTIATE_TEST_CASE_P( 1461 MAYBE_VerifyIncompleteIntermediate, 1462 CertVerifyProcWeakDigestTest, 1463 testing::ValuesIn(kVerifyIncompleteIntermediateTestData)); 1464 1465 // Incomplete chains should still report the status of the end-entity. 1466 const WeakDigestTestData kVerifyIncompleteEETestData[] = { 1467 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md5_ee.pem", 1468 EXPECT_MD5 | EXPECT_SHA1 }, 1469 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1470 // MD4 is not supported by OS X / NSS 1471 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md4_ee.pem", 1472 EXPECT_MD4 | EXPECT_SHA1 }, 1473 #endif 1474 { NULL, "weak_digest_sha1_intermediate.pem", "weak_digest_md2_ee.pem", 1475 EXPECT_MD2 | EXPECT_SHA1 }, 1476 }; 1477 // Disabled on NSS - libpkix does not return constructed chains on error, 1478 // preventing us from detecting/inspecting the verified chain. 1479 #if defined(USE_NSS) || defined(OS_IOS) 1480 #define MAYBE_VerifyIncompleteEndEntity DISABLED_VerifyIncompleteEndEntity 1481 #else 1482 #define MAYBE_VerifyIncompleteEndEntity VerifyIncompleteEndEntity 1483 #endif 1484 WRAPPED_INSTANTIATE_TEST_CASE_P( 1485 MAYBE_VerifyIncompleteEndEntity, 1486 CertVerifyProcWeakDigestTest, 1487 testing::ValuesIn(kVerifyIncompleteEETestData)); 1488 1489 // Differing algorithms between the intermediate and the EE should still be 1490 // reported. 1491 const WeakDigestTestData kVerifyMixedTestData[] = { 1492 { "weak_digest_sha1_root.pem", "weak_digest_md5_intermediate.pem", 1493 "weak_digest_md2_ee.pem", EXPECT_MD2 | EXPECT_MD5 }, 1494 { "weak_digest_sha1_root.pem", "weak_digest_md2_intermediate.pem", 1495 "weak_digest_md5_ee.pem", EXPECT_MD2 | EXPECT_MD5 }, 1496 #if defined(USE_OPENSSL_CERTS) || defined(OS_WIN) 1497 // MD4 is not supported by OS X / NSS 1498 { "weak_digest_sha1_root.pem", "weak_digest_md4_intermediate.pem", 1499 "weak_digest_md2_ee.pem", EXPECT_MD2 | EXPECT_MD4 }, 1500 #endif 1501 }; 1502 // NSS does not support MD4 and does not enable MD2 by default, making all 1503 // permutations invalid. 1504 #if defined(USE_NSS) || defined(OS_IOS) 1505 #define MAYBE_VerifyMixed DISABLED_VerifyMixed 1506 #else 1507 #define MAYBE_VerifyMixed VerifyMixed 1508 #endif 1509 WRAPPED_INSTANTIATE_TEST_CASE_P( 1510 MAYBE_VerifyMixed, 1511 CertVerifyProcWeakDigestTest, 1512 testing::ValuesIn(kVerifyMixedTestData)); 1513 1514 // For the list of valid hostnames, see 1515 // net/cert/data/ssl/certificates/subjectAltName_sanity_check.pem 1516 static const struct CertVerifyProcNameData { 1517 const char* hostname; 1518 bool valid; // Whether or not |hostname| matches a subjectAltName. 1519 } kVerifyNameData[] = { 1520 { "127.0.0.1", false }, // Don't match the common name 1521 { "127.0.0.2", true }, // Matches the iPAddress SAN (IPv4) 1522 { "FE80:0:0:0:0:0:0:1", true }, // Matches the iPAddress SAN (IPv6) 1523 { "[FE80:0:0:0:0:0:0:1]", false }, // Should not match the iPAddress SAN 1524 { "FE80::1", true }, // Compressed form matches the iPAddress SAN (IPv6) 1525 { "::127.0.0.2", false }, // IPv6 mapped form should NOT match iPAddress SAN 1526 { "test.example", true }, // Matches the dNSName SAN 1527 { "test.example.", true }, // Matches the dNSName SAN (trailing . ignored) 1528 { "www.test.example", false }, // Should not match the dNSName SAN 1529 { "test..example", false }, // Should not match the dNSName SAN 1530 { "test.example..", false }, // Should not match the dNSName SAN 1531 { ".test.example.", false }, // Should not match the dNSName SAN 1532 { ".test.example", false }, // Should not match the dNSName SAN 1533 }; 1534 1535 // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how 1536 // to output the parameter that was passed. Without this, it will simply 1537 // attempt to print out the first twenty bytes of the object, which depending 1538 // on platform and alignment, may result in an invalid read. 1539 void PrintTo(const CertVerifyProcNameData& data, std::ostream* os) { 1540 *os << "Hostname: " << data.hostname << "; valid=" << data.valid; 1541 } 1542 1543 class CertVerifyProcNameTest 1544 : public CertVerifyProcTest, 1545 public testing::WithParamInterface<CertVerifyProcNameData> { 1546 public: 1547 CertVerifyProcNameTest() {} 1548 virtual ~CertVerifyProcNameTest() {} 1549 }; 1550 1551 TEST_P(CertVerifyProcNameTest, VerifyCertName) { 1552 CertVerifyProcNameData data = GetParam(); 1553 1554 CertificateList cert_list = CreateCertificateListFromFile( 1555 GetTestCertsDirectory(), "subjectAltName_sanity_check.pem", 1556 X509Certificate::FORMAT_AUTO); 1557 ASSERT_EQ(1U, cert_list.size()); 1558 scoped_refptr<X509Certificate> cert(cert_list[0]); 1559 1560 ScopedTestRoot scoped_root(cert.get()); 1561 1562 CertVerifyResult verify_result; 1563 int error = Verify(cert.get(), data.hostname, 0, NULL, empty_cert_list_, 1564 &verify_result); 1565 if (data.valid) { 1566 EXPECT_EQ(OK, error); 1567 EXPECT_FALSE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID); 1568 } else { 1569 EXPECT_EQ(ERR_CERT_COMMON_NAME_INVALID, error); 1570 EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID); 1571 } 1572 } 1573 1574 WRAPPED_INSTANTIATE_TEST_CASE_P( 1575 VerifyName, 1576 CertVerifyProcNameTest, 1577 testing::ValuesIn(kVerifyNameData)); 1578 1579 } // namespace net 1580
