1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include <cert.h> 6 #include <certdb.h> 7 #include <pk11pub.h> 8 9 #include <algorithm> 10 11 #include "base/bind.h" 12 #include "base/files/file_path.h" 13 #include "base/files/file_util.h" 14 #include "base/lazy_instance.h" 15 #include "base/message_loop/message_loop.h" 16 #include "base/message_loop/message_loop_proxy.h" 17 #include "base/path_service.h" 18 #include "base/run_loop.h" 19 #include "base/strings/string16.h" 20 #include "base/strings/string_util.h" 21 #include "base/strings/utf_string_conversions.h" 22 #include "crypto/scoped_nss_types.h" 23 #include "crypto/scoped_test_nss_db.h" 24 #include "net/base/crypto_module.h" 25 #include "net/base/net_errors.h" 26 #include "net/base/test_data_directory.h" 27 #include "net/cert/cert_status_flags.h" 28 #include "net/cert/cert_verify_proc_nss.h" 29 #include "net/cert/cert_verify_result.h" 30 #include "net/cert/nss_cert_database.h" 31 #include "net/cert/x509_certificate.h" 32 #include "net/test/cert_test_util.h" 33 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h" 34 #include "testing/gtest/include/gtest/gtest.h" 35 36 // In NSS 3.13, CERTDB_VALID_PEER was renamed CERTDB_TERMINAL_RECORD. So we use 37 // the new name of the macro. 38 #if !defined(CERTDB_TERMINAL_RECORD) 39 #define CERTDB_TERMINAL_RECORD CERTDB_VALID_PEER 40 #endif 41 42 using base::ASCIIToUTF16; 43 44 namespace net { 45 46 namespace { 47 48 void SwapCertList(CertificateList* destination, 49 scoped_ptr<CertificateList> source) { 50 ASSERT_TRUE(destination); 51 destination->swap(*source); 52 } 53 54 } // namespace 55 56 class CertDatabaseNSSTest : public testing::Test { 57 public: 58 virtual void SetUp() { 59 ASSERT_TRUE(test_nssdb_.is_open()); 60 cert_db_.reset(new NSSCertDatabase( 61 crypto::ScopedPK11Slot( 62 PK11_ReferenceSlot(test_nssdb_.slot())) /* public slot */, 63 crypto::ScopedPK11Slot( 64 PK11_ReferenceSlot(test_nssdb_.slot())) /* private slot */)); 65 public_module_ = cert_db_->GetPublicModule(); 66 67 // Test db should be empty at start of test. 68 EXPECT_EQ(0U, ListCerts().size()); 69 } 70 71 virtual void TearDown() { 72 // Run the message loop to process any observer callbacks (e.g. for the 73 // ClientSocketFactory singleton) so that the scoped ref ptrs created in 74 // NSSCertDatabase::NotifyObservers* get released. 75 base::MessageLoop::current()->RunUntilIdle(); 76 } 77 78 protected: 79 net::CryptoModule* GetPublicModule() { 80 return public_module_.get(); 81 } 82 83 static std::string ReadTestFile(const std::string& name) { 84 std::string result; 85 base::FilePath cert_path = GetTestCertsDirectory().AppendASCII(name); 86 EXPECT_TRUE(base::ReadFileToString(cert_path, &result)); 87 return result; 88 } 89 90 static bool ReadCertIntoList(const std::string& name, 91 CertificateList* certs) { 92 scoped_refptr<X509Certificate> cert( 93 ImportCertFromFile(GetTestCertsDirectory(), name)); 94 if (!cert.get()) 95 return false; 96 97 certs->push_back(cert); 98 return true; 99 } 100 101 CertificateList ListCerts() { 102 CertificateList result; 103 CERTCertList* cert_list = PK11_ListCertsInSlot(test_nssdb_.slot()); 104 for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list); 105 !CERT_LIST_END(node, cert_list); 106 node = CERT_LIST_NEXT(node)) { 107 result.push_back(X509Certificate::CreateFromHandle( 108 node->cert, X509Certificate::OSCertHandles())); 109 } 110 CERT_DestroyCertList(cert_list); 111 112 // Sort the result so that test comparisons can be deterministic. 113 std::sort(result.begin(), result.end(), X509Certificate::LessThan()); 114 return result; 115 } 116 117 scoped_ptr<NSSCertDatabase> cert_db_; 118 const CertificateList empty_cert_list_; 119 crypto::ScopedTestNSSDB test_nssdb_; 120 scoped_refptr<net::CryptoModule> public_module_; 121 }; 122 123 TEST_F(CertDatabaseNSSTest, ListCertsSync) { 124 // This test isn't terribly useful, though it will at least let valgrind test 125 // for leaks. 126 CertificateList certs; 127 cert_db_->ListCertsSync(&certs); 128 // The test DB is empty, but let's assume there will always be something in 129 // the other slots. 130 EXPECT_LT(0U, certs.size()); 131 } 132 133 TEST_F(CertDatabaseNSSTest, ListCerts) { 134 // This test isn't terribly useful, though it will at least let valgrind test 135 // for leaks. 136 CertificateList certs; 137 cert_db_->SetSlowTaskRunnerForTest(base::MessageLoopProxy::current()); 138 cert_db_->ListCerts(base::Bind(&SwapCertList, base::Unretained(&certs))); 139 EXPECT_EQ(0U, certs.size()); 140 141 base::RunLoop().RunUntilIdle(); 142 143 // The test DB is empty, but let's assume there will always be something in 144 // the other slots. 145 EXPECT_LT(0U, certs.size()); 146 } 147 148 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12WrongPassword) { 149 std::string pkcs12_data = ReadTestFile("client.p12"); 150 151 EXPECT_EQ(ERR_PKCS12_IMPORT_BAD_PASSWORD, 152 cert_db_->ImportFromPKCS12(GetPublicModule(), 153 pkcs12_data, 154 base::string16(), 155 true, // is_extractable 156 NULL)); 157 158 // Test db should still be empty. 159 EXPECT_EQ(0U, ListCerts().size()); 160 } 161 162 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AsExtractableAndExportAgain) { 163 std::string pkcs12_data = ReadTestFile("client.p12"); 164 165 EXPECT_EQ(OK, 166 cert_db_->ImportFromPKCS12(GetPublicModule(), 167 pkcs12_data, 168 ASCIIToUTF16("12345"), 169 true, // is_extractable 170 NULL)); 171 172 CertificateList cert_list = ListCerts(); 173 ASSERT_EQ(1U, cert_list.size()); 174 scoped_refptr<X509Certificate> cert(cert_list[0]); 175 176 EXPECT_EQ("testusercert", 177 cert->subject().common_name); 178 179 // TODO(mattm): move export test to separate test case? 180 std::string exported_data; 181 EXPECT_EQ(1, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"), 182 &exported_data)); 183 ASSERT_LT(0U, exported_data.size()); 184 // TODO(mattm): further verification of exported data? 185 } 186 187 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12Twice) { 188 std::string pkcs12_data = ReadTestFile("client.p12"); 189 190 EXPECT_EQ(OK, 191 cert_db_->ImportFromPKCS12(GetPublicModule(), 192 pkcs12_data, 193 ASCIIToUTF16("12345"), 194 true, // is_extractable 195 NULL)); 196 EXPECT_EQ(1U, ListCerts().size()); 197 198 // NSS has a SEC_ERROR_PKCS12_DUPLICATE_DATA error, but it doesn't look like 199 // it's ever used. This test verifies that. 200 EXPECT_EQ(OK, 201 cert_db_->ImportFromPKCS12(GetPublicModule(), 202 pkcs12_data, 203 ASCIIToUTF16("12345"), 204 true, // is_extractable 205 NULL)); 206 EXPECT_EQ(1U, ListCerts().size()); 207 } 208 209 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AsUnextractableAndExportAgain) { 210 std::string pkcs12_data = ReadTestFile("client.p12"); 211 212 EXPECT_EQ(OK, 213 cert_db_->ImportFromPKCS12(GetPublicModule(), 214 pkcs12_data, 215 ASCIIToUTF16("12345"), 216 false, // is_extractable 217 NULL)); 218 219 CertificateList cert_list = ListCerts(); 220 ASSERT_EQ(1U, cert_list.size()); 221 scoped_refptr<X509Certificate> cert(cert_list[0]); 222 223 EXPECT_EQ("testusercert", 224 cert->subject().common_name); 225 226 std::string exported_data; 227 EXPECT_EQ(0, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"), 228 &exported_data)); 229 } 230 231 // Importing a PKCS#12 file with a certificate but no corresponding 232 // private key should not mark an existing private key as unextractable. 233 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12OnlyMarkIncludedKey) { 234 std::string pkcs12_data = ReadTestFile("client.p12"); 235 EXPECT_EQ(OK, 236 cert_db_->ImportFromPKCS12(GetPublicModule(), 237 pkcs12_data, 238 ASCIIToUTF16("12345"), 239 true, // is_extractable 240 NULL)); 241 242 CertificateList cert_list = ListCerts(); 243 ASSERT_EQ(1U, cert_list.size()); 244 245 // Now import a PKCS#12 file with just a certificate but no private key. 246 pkcs12_data = ReadTestFile("client-nokey.p12"); 247 EXPECT_EQ(OK, 248 cert_db_->ImportFromPKCS12(GetPublicModule(), 249 pkcs12_data, 250 ASCIIToUTF16("12345"), 251 false, // is_extractable 252 NULL)); 253 254 cert_list = ListCerts(); 255 ASSERT_EQ(1U, cert_list.size()); 256 257 // Make sure the imported private key is still extractable. 258 std::string exported_data; 259 EXPECT_EQ(1, cert_db_->ExportToPKCS12(cert_list, ASCIIToUTF16("exportpw"), 260 &exported_data)); 261 ASSERT_LT(0U, exported_data.size()); 262 } 263 264 TEST_F(CertDatabaseNSSTest, ImportFromPKCS12InvalidFile) { 265 std::string pkcs12_data = "Foobarbaz"; 266 267 EXPECT_EQ(ERR_PKCS12_IMPORT_INVALID_FILE, 268 cert_db_->ImportFromPKCS12(GetPublicModule(), 269 pkcs12_data, 270 base::string16(), 271 true, // is_extractable 272 NULL)); 273 274 // Test db should still be empty. 275 EXPECT_EQ(0U, ListCerts().size()); 276 } 277 278 TEST_F(CertDatabaseNSSTest, ImportCACert_SSLTrust) { 279 CertificateList certs = CreateCertificateListFromFile( 280 GetTestCertsDirectory(), "root_ca_cert.pem", 281 X509Certificate::FORMAT_AUTO); 282 ASSERT_EQ(1U, certs.size()); 283 EXPECT_FALSE(certs[0]->os_cert_handle()->isperm); 284 285 // Import it. 286 NSSCertDatabase::ImportCertFailureList failed; 287 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_SSL, 288 &failed)); 289 290 EXPECT_EQ(0U, failed.size()); 291 292 CertificateList cert_list = ListCerts(); 293 ASSERT_EQ(1U, cert_list.size()); 294 scoped_refptr<X509Certificate> cert(cert_list[0]); 295 EXPECT_EQ("Test Root CA", cert->subject().common_name); 296 297 EXPECT_EQ(NSSCertDatabase::TRUSTED_SSL, 298 cert_db_->GetCertTrust(cert.get(), CA_CERT)); 299 300 EXPECT_EQ(unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | 301 CERTDB_TRUSTED_CLIENT_CA), 302 cert->os_cert_handle()->trust->sslFlags); 303 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 304 cert->os_cert_handle()->trust->emailFlags); 305 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 306 cert->os_cert_handle()->trust->objectSigningFlags); 307 } 308 309 TEST_F(CertDatabaseNSSTest, ImportCACert_EmailTrust) { 310 CertificateList certs = CreateCertificateListFromFile( 311 GetTestCertsDirectory(), "root_ca_cert.pem", 312 X509Certificate::FORMAT_AUTO); 313 ASSERT_EQ(1U, certs.size()); 314 EXPECT_FALSE(certs[0]->os_cert_handle()->isperm); 315 316 // Import it. 317 NSSCertDatabase::ImportCertFailureList failed; 318 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_EMAIL, 319 &failed)); 320 321 EXPECT_EQ(0U, failed.size()); 322 323 CertificateList cert_list = ListCerts(); 324 ASSERT_EQ(1U, cert_list.size()); 325 scoped_refptr<X509Certificate> cert(cert_list[0]); 326 EXPECT_EQ("Test Root CA", cert->subject().common_name); 327 328 EXPECT_EQ(NSSCertDatabase::TRUSTED_EMAIL, 329 cert_db_->GetCertTrust(cert.get(), CA_CERT)); 330 331 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 332 cert->os_cert_handle()->trust->sslFlags); 333 EXPECT_EQ(unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | 334 CERTDB_TRUSTED_CLIENT_CA), 335 cert->os_cert_handle()->trust->emailFlags); 336 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 337 cert->os_cert_handle()->trust->objectSigningFlags); 338 } 339 340 TEST_F(CertDatabaseNSSTest, ImportCACert_ObjSignTrust) { 341 CertificateList certs = CreateCertificateListFromFile( 342 GetTestCertsDirectory(), "root_ca_cert.pem", 343 X509Certificate::FORMAT_AUTO); 344 ASSERT_EQ(1U, certs.size()); 345 EXPECT_FALSE(certs[0]->os_cert_handle()->isperm); 346 347 // Import it. 348 NSSCertDatabase::ImportCertFailureList failed; 349 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_OBJ_SIGN, 350 &failed)); 351 352 EXPECT_EQ(0U, failed.size()); 353 354 CertificateList cert_list = ListCerts(); 355 ASSERT_EQ(1U, cert_list.size()); 356 scoped_refptr<X509Certificate> cert(cert_list[0]); 357 EXPECT_EQ("Test Root CA", cert->subject().common_name); 358 359 EXPECT_EQ(NSSCertDatabase::TRUSTED_OBJ_SIGN, 360 cert_db_->GetCertTrust(cert.get(), CA_CERT)); 361 362 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 363 cert->os_cert_handle()->trust->sslFlags); 364 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 365 cert->os_cert_handle()->trust->emailFlags); 366 EXPECT_EQ(unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | 367 CERTDB_TRUSTED_CLIENT_CA), 368 cert->os_cert_handle()->trust->objectSigningFlags); 369 } 370 371 TEST_F(CertDatabaseNSSTest, ImportCA_NotCACert) { 372 CertificateList certs = CreateCertificateListFromFile( 373 GetTestCertsDirectory(), "ok_cert.pem", 374 X509Certificate::FORMAT_AUTO); 375 ASSERT_EQ(1U, certs.size()); 376 EXPECT_FALSE(certs[0]->os_cert_handle()->isperm); 377 378 // Import it. 379 NSSCertDatabase::ImportCertFailureList failed; 380 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_SSL, 381 &failed)); 382 ASSERT_EQ(1U, failed.size()); 383 // Note: this compares pointers directly. It's okay in this case because 384 // ImportCACerts returns the same pointers that were passed in. In the 385 // general case IsSameOSCert should be used. 386 EXPECT_EQ(certs[0], failed[0].certificate); 387 EXPECT_EQ(ERR_IMPORT_CA_CERT_NOT_CA, failed[0].net_error); 388 389 EXPECT_EQ(0U, ListCerts().size()); 390 } 391 392 TEST_F(CertDatabaseNSSTest, ImportCACertHierarchy) { 393 CertificateList certs; 394 ASSERT_TRUE(ReadCertIntoList("dod_root_ca_2_cert.der", &certs)); 395 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 396 ASSERT_TRUE(ReadCertIntoList("www_us_army_mil_cert.der", &certs)); 397 398 // Import it. 399 NSSCertDatabase::ImportCertFailureList failed; 400 // Have to specify email trust for the cert verification of the child cert to 401 // work (see 402 // http://mxr.mozilla.org/mozilla/source/security/nss/lib/certhigh/certvfy.c#752 403 // "XXX This choice of trustType seems arbitrary.") 404 EXPECT_TRUE(cert_db_->ImportCACerts( 405 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL, 406 &failed)); 407 408 ASSERT_EQ(2U, failed.size()); 409 EXPECT_EQ("DOD CA-17", failed[0].certificate->subject().common_name); 410 EXPECT_EQ(ERR_FAILED, failed[0].net_error); // The certificate expired. 411 EXPECT_EQ("www.us.army.mil", failed[1].certificate->subject().common_name); 412 EXPECT_EQ(ERR_IMPORT_CA_CERT_NOT_CA, failed[1].net_error); 413 414 CertificateList cert_list = ListCerts(); 415 ASSERT_EQ(1U, cert_list.size()); 416 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 417 } 418 419 TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyDupeRoot) { 420 CertificateList certs; 421 ASSERT_TRUE(ReadCertIntoList("dod_root_ca_2_cert.der", &certs)); 422 423 // First import just the root. 424 NSSCertDatabase::ImportCertFailureList failed; 425 EXPECT_TRUE(cert_db_->ImportCACerts( 426 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL, 427 &failed)); 428 429 EXPECT_EQ(0U, failed.size()); 430 CertificateList cert_list = ListCerts(); 431 ASSERT_EQ(1U, cert_list.size()); 432 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 433 434 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 435 ASSERT_TRUE(ReadCertIntoList("www_us_army_mil_cert.der", &certs)); 436 437 // Now import with the other certs in the list too. Even though the root is 438 // already present, we should still import the rest. 439 failed.clear(); 440 EXPECT_TRUE(cert_db_->ImportCACerts( 441 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL, 442 &failed)); 443 444 ASSERT_EQ(3U, failed.size()); 445 EXPECT_EQ("DoD Root CA 2", failed[0].certificate->subject().common_name); 446 EXPECT_EQ(ERR_IMPORT_CERT_ALREADY_EXISTS, failed[0].net_error); 447 EXPECT_EQ("DOD CA-17", failed[1].certificate->subject().common_name); 448 EXPECT_EQ(ERR_FAILED, failed[1].net_error); // The certificate expired. 449 EXPECT_EQ("www.us.army.mil", failed[2].certificate->subject().common_name); 450 EXPECT_EQ(ERR_IMPORT_CA_CERT_NOT_CA, failed[2].net_error); 451 452 cert_list = ListCerts(); 453 ASSERT_EQ(1U, cert_list.size()); 454 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 455 } 456 457 TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyUntrusted) { 458 CertificateList certs; 459 ASSERT_TRUE(ReadCertIntoList("dod_root_ca_2_cert.der", &certs)); 460 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 461 462 // Import it. 463 NSSCertDatabase::ImportCertFailureList failed; 464 EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUST_DEFAULT, 465 &failed)); 466 467 ASSERT_EQ(1U, failed.size()); 468 EXPECT_EQ("DOD CA-17", failed[0].certificate->subject().common_name); 469 // TODO(mattm): should check for net error equivalent of 470 // SEC_ERROR_UNTRUSTED_ISSUER 471 EXPECT_EQ(ERR_FAILED, failed[0].net_error); 472 473 CertificateList cert_list = ListCerts(); 474 ASSERT_EQ(1U, cert_list.size()); 475 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 476 } 477 478 TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyTree) { 479 CertificateList certs; 480 ASSERT_TRUE(ReadCertIntoList("dod_root_ca_2_cert.der", &certs)); 481 ASSERT_TRUE(ReadCertIntoList("dod_ca_13_cert.der", &certs)); 482 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 483 484 // Import it. 485 NSSCertDatabase::ImportCertFailureList failed; 486 EXPECT_TRUE(cert_db_->ImportCACerts( 487 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL, 488 &failed)); 489 490 EXPECT_EQ(2U, failed.size()); 491 EXPECT_EQ("DOD CA-13", failed[0].certificate->subject().common_name); 492 EXPECT_EQ(ERR_FAILED, failed[0].net_error); // The certificate expired. 493 EXPECT_EQ("DOD CA-17", failed[1].certificate->subject().common_name); 494 EXPECT_EQ(ERR_FAILED, failed[1].net_error); // The certificate expired. 495 496 CertificateList cert_list = ListCerts(); 497 ASSERT_EQ(1U, cert_list.size()); 498 EXPECT_EQ("DoD Root CA 2", cert_list[0]->subject().common_name); 499 } 500 501 TEST_F(CertDatabaseNSSTest, ImportCACertNotHierarchy) { 502 CertificateList certs = CreateCertificateListFromFile( 503 GetTestCertsDirectory(), "root_ca_cert.pem", 504 X509Certificate::FORMAT_AUTO); 505 ASSERT_EQ(1U, certs.size()); 506 ASSERT_TRUE(ReadCertIntoList("dod_ca_13_cert.der", &certs)); 507 ASSERT_TRUE(ReadCertIntoList("dod_ca_17_cert.der", &certs)); 508 509 // Import it. 510 NSSCertDatabase::ImportCertFailureList failed; 511 EXPECT_TRUE(cert_db_->ImportCACerts( 512 certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL | 513 NSSCertDatabase::TRUSTED_OBJ_SIGN, &failed)); 514 515 ASSERT_EQ(2U, failed.size()); 516 // TODO(mattm): should check for net error equivalent of 517 // SEC_ERROR_UNKNOWN_ISSUER 518 EXPECT_EQ("DOD CA-13", failed[0].certificate->subject().common_name); 519 EXPECT_EQ(ERR_FAILED, failed[0].net_error); 520 EXPECT_EQ("DOD CA-17", failed[1].certificate->subject().common_name); 521 EXPECT_EQ(ERR_FAILED, failed[1].net_error); 522 523 CertificateList cert_list = ListCerts(); 524 ASSERT_EQ(1U, cert_list.size()); 525 EXPECT_EQ("Test Root CA", cert_list[0]->subject().common_name); 526 } 527 528 // http://crbug.com/108009 - Disabled, as google.chain.pem is an expired 529 // certificate. 530 TEST_F(CertDatabaseNSSTest, DISABLED_ImportServerCert) { 531 // Need to import intermediate cert for the verify of google cert, otherwise 532 // it will try to fetch it automatically with cert_pi_useAIACertFetch, which 533 // will cause OCSPCreateSession on the main thread, which is not allowed. 534 CertificateList certs = CreateCertificateListFromFile( 535 GetTestCertsDirectory(), "google.chain.pem", 536 X509Certificate::FORMAT_AUTO); 537 ASSERT_EQ(2U, certs.size()); 538 539 NSSCertDatabase::ImportCertFailureList failed; 540 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT, 541 &failed)); 542 543 EXPECT_EQ(0U, failed.size()); 544 545 CertificateList cert_list = ListCerts(); 546 ASSERT_EQ(2U, cert_list.size()); 547 scoped_refptr<X509Certificate> goog_cert(cert_list[0]); 548 scoped_refptr<X509Certificate> thawte_cert(cert_list[1]); 549 EXPECT_EQ("www.google.com", goog_cert->subject().common_name); 550 EXPECT_EQ("Thawte SGC CA", thawte_cert->subject().common_name); 551 552 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 553 cert_db_->GetCertTrust(goog_cert.get(), SERVER_CERT)); 554 555 EXPECT_EQ(0U, goog_cert->os_cert_handle()->trust->sslFlags); 556 557 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 558 int flags = 0; 559 CertVerifyResult verify_result; 560 int error = verify_proc->Verify(goog_cert.get(), 561 "www.google.com", 562 flags, 563 NULL, 564 empty_cert_list_, 565 &verify_result); 566 EXPECT_EQ(OK, error); 567 EXPECT_EQ(0U, verify_result.cert_status); 568 } 569 570 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned) { 571 CertificateList certs; 572 ASSERT_TRUE(ReadCertIntoList("punycodetest.pem", &certs)); 573 574 NSSCertDatabase::ImportCertFailureList failed; 575 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT, 576 &failed)); 577 578 EXPECT_EQ(0U, failed.size()); 579 580 CertificateList cert_list = ListCerts(); 581 ASSERT_EQ(1U, cert_list.size()); 582 scoped_refptr<X509Certificate> puny_cert(cert_list[0]); 583 584 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 585 cert_db_->GetCertTrust(puny_cert.get(), SERVER_CERT)); 586 EXPECT_EQ(0U, puny_cert->os_cert_handle()->trust->sslFlags); 587 588 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 589 int flags = 0; 590 CertVerifyResult verify_result; 591 int error = verify_proc->Verify(puny_cert.get(), 592 "xn--wgv71a119e.com", 593 flags, 594 NULL, 595 empty_cert_list_, 596 &verify_result); 597 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 598 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status); 599 } 600 601 TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned_Trusted) { 602 CertificateList certs; 603 ASSERT_TRUE(ReadCertIntoList("punycodetest.pem", &certs)); 604 605 NSSCertDatabase::ImportCertFailureList failed; 606 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUSTED_SSL, 607 &failed)); 608 609 EXPECT_EQ(0U, failed.size()); 610 611 CertificateList cert_list = ListCerts(); 612 ASSERT_EQ(1U, cert_list.size()); 613 scoped_refptr<X509Certificate> puny_cert(cert_list[0]); 614 615 EXPECT_EQ(NSSCertDatabase::TRUSTED_SSL, 616 cert_db_->GetCertTrust(puny_cert.get(), SERVER_CERT)); 617 EXPECT_EQ(unsigned(CERTDB_TRUSTED | CERTDB_TERMINAL_RECORD), 618 puny_cert->os_cert_handle()->trust->sslFlags); 619 620 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 621 int flags = 0; 622 CertVerifyResult verify_result; 623 int error = verify_proc->Verify(puny_cert.get(), 624 "xn--wgv71a119e.com", 625 flags, 626 NULL, 627 empty_cert_list_, 628 &verify_result); 629 EXPECT_EQ(OK, error); 630 EXPECT_EQ(0U, verify_result.cert_status); 631 } 632 633 TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert) { 634 CertificateList ca_certs = CreateCertificateListFromFile( 635 GetTestCertsDirectory(), "root_ca_cert.pem", 636 X509Certificate::FORMAT_AUTO); 637 ASSERT_EQ(1U, ca_certs.size()); 638 639 // Import CA cert and trust it. 640 NSSCertDatabase::ImportCertFailureList failed; 641 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL, 642 &failed)); 643 EXPECT_EQ(0U, failed.size()); 644 645 CertificateList certs = CreateCertificateListFromFile( 646 GetTestCertsDirectory(), "ok_cert.pem", 647 X509Certificate::FORMAT_AUTO); 648 ASSERT_EQ(1U, certs.size()); 649 650 // Import server cert with default trust. 651 EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT, 652 &failed)); 653 EXPECT_EQ(0U, failed.size()); 654 655 // Server cert should verify. 656 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 657 int flags = 0; 658 CertVerifyResult verify_result; 659 int error = verify_proc->Verify(certs[0].get(), 660 "127.0.0.1", 661 flags, 662 NULL, 663 empty_cert_list_, 664 &verify_result); 665 EXPECT_EQ(OK, error); 666 EXPECT_EQ(0U, verify_result.cert_status); 667 } 668 669 TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert_DistrustServer) { 670 CertificateList ca_certs = CreateCertificateListFromFile( 671 GetTestCertsDirectory(), "root_ca_cert.pem", 672 X509Certificate::FORMAT_AUTO); 673 ASSERT_EQ(1U, ca_certs.size()); 674 675 // Import CA cert and trust it. 676 NSSCertDatabase::ImportCertFailureList failed; 677 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL, 678 &failed)); 679 EXPECT_EQ(0U, failed.size()); 680 681 CertificateList certs = CreateCertificateListFromFile( 682 GetTestCertsDirectory(), "ok_cert.pem", 683 X509Certificate::FORMAT_AUTO); 684 ASSERT_EQ(1U, certs.size()); 685 686 // Import server cert without inheriting trust from issuer (explicit 687 // distrust). 688 EXPECT_TRUE(cert_db_->ImportServerCert( 689 certs, NSSCertDatabase::DISTRUSTED_SSL, &failed)); 690 EXPECT_EQ(0U, failed.size()); 691 EXPECT_EQ(NSSCertDatabase::DISTRUSTED_SSL, 692 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 693 694 EXPECT_EQ(unsigned(CERTDB_TERMINAL_RECORD), 695 certs[0]->os_cert_handle()->trust->sslFlags); 696 697 // Server cert should fail to verify. 698 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 699 int flags = 0; 700 CertVerifyResult verify_result; 701 int error = verify_proc->Verify(certs[0].get(), 702 "127.0.0.1", 703 flags, 704 NULL, 705 empty_cert_list_, 706 &verify_result); 707 EXPECT_EQ(ERR_CERT_REVOKED, error); 708 EXPECT_EQ(CERT_STATUS_REVOKED, verify_result.cert_status); 709 } 710 711 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa) { 712 CertificateList ca_certs = CreateCertificateListFromFile( 713 GetTestCertsDirectory(), "2048-rsa-root.pem", 714 X509Certificate::FORMAT_AUTO); 715 ASSERT_EQ(1U, ca_certs.size()); 716 717 // Import Root CA cert and distrust it. 718 NSSCertDatabase::ImportCertFailureList failed; 719 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::DISTRUSTED_SSL, 720 &failed)); 721 EXPECT_EQ(0U, failed.size()); 722 723 CertificateList intermediate_certs = CreateCertificateListFromFile( 724 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", 725 X509Certificate::FORMAT_AUTO); 726 ASSERT_EQ(1U, intermediate_certs.size()); 727 728 // Import Intermediate CA cert and trust it. 729 EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs, 730 NSSCertDatabase::TRUSTED_SSL, &failed)); 731 EXPECT_EQ(0U, failed.size()); 732 733 CertificateList certs = CreateCertificateListFromFile( 734 GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem", 735 X509Certificate::FORMAT_AUTO); 736 ASSERT_EQ(1U, certs.size()); 737 738 // Import server cert with default trust. 739 EXPECT_TRUE(cert_db_->ImportServerCert( 740 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 741 EXPECT_EQ(0U, failed.size()); 742 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 743 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 744 745 // Server cert should verify. 746 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 747 int flags = 0; 748 CertVerifyResult verify_result; 749 int error = verify_proc->Verify(certs[0].get(), 750 "127.0.0.1", 751 flags, 752 NULL, 753 empty_cert_list_, 754 &verify_result); 755 EXPECT_EQ(OK, error); 756 EXPECT_EQ(0U, verify_result.cert_status); 757 758 // Trust the root cert and distrust the intermediate. 759 EXPECT_TRUE(cert_db_->SetCertTrust( 760 ca_certs[0].get(), CA_CERT, NSSCertDatabase::TRUSTED_SSL)); 761 EXPECT_TRUE(cert_db_->SetCertTrust( 762 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::DISTRUSTED_SSL)); 763 EXPECT_EQ( 764 unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA), 765 ca_certs[0]->os_cert_handle()->trust->sslFlags); 766 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 767 ca_certs[0]->os_cert_handle()->trust->emailFlags); 768 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 769 ca_certs[0]->os_cert_handle()->trust->objectSigningFlags); 770 EXPECT_EQ(unsigned(CERTDB_TERMINAL_RECORD), 771 intermediate_certs[0]->os_cert_handle()->trust->sslFlags); 772 EXPECT_EQ(unsigned(CERTDB_VALID_CA), 773 intermediate_certs[0]->os_cert_handle()->trust->emailFlags); 774 EXPECT_EQ( 775 unsigned(CERTDB_VALID_CA), 776 intermediate_certs[0]->os_cert_handle()->trust->objectSigningFlags); 777 778 // Server cert should fail to verify. 779 CertVerifyResult verify_result2; 780 error = verify_proc->Verify(certs[0].get(), 781 "127.0.0.1", 782 flags, 783 NULL, 784 empty_cert_list_, 785 &verify_result2); 786 EXPECT_EQ(ERR_CERT_REVOKED, error); 787 EXPECT_EQ(CERT_STATUS_REVOKED, verify_result2.cert_status); 788 } 789 790 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa2) { 791 if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) { 792 // See http://bugzil.la/863947 for details. 793 LOG(INFO) << "Skipping test for NSS 3.14.2 - NSS 3.15"; 794 return; 795 } 796 797 NSSCertDatabase::ImportCertFailureList failed; 798 799 CertificateList intermediate_certs = CreateCertificateListFromFile( 800 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", 801 X509Certificate::FORMAT_AUTO); 802 ASSERT_EQ(1U, intermediate_certs.size()); 803 804 // Import Intermediate CA cert and trust it. 805 EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs, 806 NSSCertDatabase::TRUSTED_SSL, &failed)); 807 EXPECT_EQ(0U, failed.size()); 808 809 CertificateList certs = CreateCertificateListFromFile( 810 GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem", 811 X509Certificate::FORMAT_AUTO); 812 ASSERT_EQ(1U, certs.size()); 813 814 // Import server cert with default trust. 815 EXPECT_TRUE(cert_db_->ImportServerCert( 816 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 817 EXPECT_EQ(0U, failed.size()); 818 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 819 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 820 821 // Server cert should verify. 822 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 823 int flags = 0; 824 CertVerifyResult verify_result; 825 int error = verify_proc->Verify(certs[0].get(), 826 "127.0.0.1", 827 flags, 828 NULL, 829 empty_cert_list_, 830 &verify_result); 831 EXPECT_EQ(OK, error); 832 EXPECT_EQ(0U, verify_result.cert_status); 833 834 // Without explicit trust of the intermediate, verification should fail. 835 EXPECT_TRUE(cert_db_->SetCertTrust( 836 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT)); 837 838 // Server cert should fail to verify. 839 CertVerifyResult verify_result2; 840 error = verify_proc->Verify(certs[0].get(), 841 "127.0.0.1", 842 flags, 843 NULL, 844 empty_cert_list_, 845 &verify_result2); 846 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 847 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status); 848 } 849 850 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa3) { 851 if (NSS_VersionCheck("3.14.2") && !NSS_VersionCheck("3.15")) { 852 // See http://bugzil.la/863947 for details. 853 LOG(INFO) << "Skipping test for NSS 3.14.2 - NSS 3.15"; 854 return; 855 } 856 857 NSSCertDatabase::ImportCertFailureList failed; 858 859 CertificateList ca_certs = CreateCertificateListFromFile( 860 GetTestCertsDirectory(), "2048-rsa-root.pem", 861 X509Certificate::FORMAT_AUTO); 862 ASSERT_EQ(1U, ca_certs.size()); 863 864 // Import Root CA cert and default trust it. 865 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUST_DEFAULT, 866 &failed)); 867 EXPECT_EQ(0U, failed.size()); 868 869 CertificateList intermediate_certs = CreateCertificateListFromFile( 870 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", 871 X509Certificate::FORMAT_AUTO); 872 ASSERT_EQ(1U, intermediate_certs.size()); 873 874 // Import Intermediate CA cert and trust it. 875 EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs, 876 NSSCertDatabase::TRUSTED_SSL, &failed)); 877 EXPECT_EQ(0U, failed.size()); 878 879 CertificateList certs = CreateCertificateListFromFile( 880 GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem", 881 X509Certificate::FORMAT_AUTO); 882 ASSERT_EQ(1U, certs.size()); 883 884 // Import server cert with default trust. 885 EXPECT_TRUE(cert_db_->ImportServerCert( 886 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 887 EXPECT_EQ(0U, failed.size()); 888 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 889 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 890 891 // Server cert should verify. 892 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 893 int flags = 0; 894 CertVerifyResult verify_result; 895 int error = verify_proc->Verify(certs[0].get(), 896 "127.0.0.1", 897 flags, 898 NULL, 899 empty_cert_list_, 900 &verify_result); 901 EXPECT_EQ(OK, error); 902 EXPECT_EQ(0U, verify_result.cert_status); 903 904 // Without explicit trust of the intermediate, verification should fail. 905 EXPECT_TRUE(cert_db_->SetCertTrust( 906 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT)); 907 908 // Server cert should fail to verify. 909 CertVerifyResult verify_result2; 910 error = verify_proc->Verify(certs[0].get(), 911 "127.0.0.1", 912 flags, 913 NULL, 914 empty_cert_list_, 915 &verify_result2); 916 EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error); 917 EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status); 918 } 919 920 TEST_F(CertDatabaseNSSTest, TrustIntermediateCa4) { 921 NSSCertDatabase::ImportCertFailureList failed; 922 923 CertificateList ca_certs = CreateCertificateListFromFile( 924 GetTestCertsDirectory(), "2048-rsa-root.pem", 925 X509Certificate::FORMAT_AUTO); 926 ASSERT_EQ(1U, ca_certs.size()); 927 928 // Import Root CA cert and trust it. 929 EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL, 930 &failed)); 931 EXPECT_EQ(0U, failed.size()); 932 933 CertificateList intermediate_certs = CreateCertificateListFromFile( 934 GetTestCertsDirectory(), "2048-rsa-intermediate.pem", 935 X509Certificate::FORMAT_AUTO); 936 ASSERT_EQ(1U, intermediate_certs.size()); 937 938 // Import Intermediate CA cert and distrust it. 939 EXPECT_TRUE(cert_db_->ImportCACerts( 940 intermediate_certs, NSSCertDatabase::DISTRUSTED_SSL, &failed)); 941 EXPECT_EQ(0U, failed.size()); 942 943 CertificateList certs = CreateCertificateListFromFile( 944 GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem", 945 X509Certificate::FORMAT_AUTO); 946 ASSERT_EQ(1U, certs.size()); 947 948 // Import server cert with default trust. 949 EXPECT_TRUE(cert_db_->ImportServerCert( 950 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 951 EXPECT_EQ(0U, failed.size()); 952 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 953 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 954 955 // Server cert should not verify. 956 scoped_refptr<CertVerifyProc> verify_proc(new CertVerifyProcNSS()); 957 int flags = 0; 958 CertVerifyResult verify_result; 959 int error = verify_proc->Verify(certs[0].get(), 960 "127.0.0.1", 961 flags, 962 NULL, 963 empty_cert_list_, 964 &verify_result); 965 EXPECT_EQ(ERR_CERT_REVOKED, error); 966 EXPECT_EQ(CERT_STATUS_REVOKED, verify_result.cert_status); 967 968 // Without explicit distrust of the intermediate, verification should succeed. 969 EXPECT_TRUE(cert_db_->SetCertTrust( 970 intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT)); 971 972 // Server cert should verify. 973 CertVerifyResult verify_result2; 974 error = verify_proc->Verify(certs[0].get(), 975 "127.0.0.1", 976 flags, 977 NULL, 978 empty_cert_list_, 979 &verify_result2); 980 EXPECT_EQ(OK, error); 981 EXPECT_EQ(0U, verify_result2.cert_status); 982 } 983 984 // Importing two certificates with the same issuer and subject common name, 985 // but overall distinct subject names, should succeed and generate a unique 986 // nickname for the second certificate. 987 TEST_F(CertDatabaseNSSTest, ImportDuplicateCommonName) { 988 CertificateList certs = 989 CreateCertificateListFromFile(GetTestCertsDirectory(), 990 "duplicate_cn_1.pem", 991 X509Certificate::FORMAT_AUTO); 992 ASSERT_EQ(1U, certs.size()); 993 994 EXPECT_EQ(0U, ListCerts().size()); 995 996 // Import server cert with default trust. 997 NSSCertDatabase::ImportCertFailureList failed; 998 EXPECT_TRUE(cert_db_->ImportServerCert( 999 certs, NSSCertDatabase::TRUST_DEFAULT, &failed)); 1000 EXPECT_EQ(0U, failed.size()); 1001 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 1002 cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT)); 1003 1004 CertificateList new_certs = ListCerts(); 1005 ASSERT_EQ(1U, new_certs.size()); 1006 1007 // Now attempt to import a different certificate with the same common name. 1008 CertificateList certs2 = 1009 CreateCertificateListFromFile(GetTestCertsDirectory(), 1010 "duplicate_cn_2.pem", 1011 X509Certificate::FORMAT_AUTO); 1012 ASSERT_EQ(1U, certs2.size()); 1013 1014 // Import server cert with default trust. 1015 EXPECT_TRUE(cert_db_->ImportServerCert( 1016 certs2, NSSCertDatabase::TRUST_DEFAULT, &failed)); 1017 EXPECT_EQ(0U, failed.size()); 1018 EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT, 1019 cert_db_->GetCertTrust(certs2[0].get(), SERVER_CERT)); 1020 1021 new_certs = ListCerts(); 1022 ASSERT_EQ(2U, new_certs.size()); 1023 EXPECT_STRNE(new_certs[0]->os_cert_handle()->nickname, 1024 new_certs[1]->os_cert_handle()->nickname); 1025 } 1026 1027 } // namespace net 1028
