cast_cert_validator_unittest.cc 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "components/cast_certificate/cast_cert_validator.h"
  5. #include <memory>
  6. #include "base/test/task_environment.h"
  7. #include "base/time/time.h"
  8. #include "components/cast_certificate/cast_cert_reader.h"
  9. #include "components/cast_certificate/cast_cert_test_helpers.h"
  10. #include "net/cert/pki/cert_errors.h"
  11. #include "net/cert/pki/parsed_certificate.h"
  12. #include "net/cert/pki/signature_algorithm.h"
  13. #include "net/cert/pki/trust_store_in_memory.h"
  14. #include "net/cert/x509_util.h"
  15. #include "testing/gtest/include/gtest/gtest.h"
  16. namespace cast_certificate {
  17. namespace {
  18. // Creates an std::string given a uint8_t array.
  19. template <size_t N>
  20. std::string CreateString(const uint8_t (&data)[N]) {
  21. return std::string(reinterpret_cast<const char*>(data), N);
  22. }
  23. enum TrustStoreDependency {
  24. // Uses the built-in trust store for Cast. This is how certificates are
  25. // verified in production.
  26. TRUST_STORE_BUILTIN,
  27. // Instead of using the built-in trust store, use root certificate in the
  28. // provided test chain as the trust anchor.
  29. //
  30. // This trust anchor is initialized with anchor constraints, similar to how
  31. // TrustAnchors in the built-in store are setup.
  32. TRUST_STORE_FROM_TEST_FILE,
  33. // This is the same as TRUST_STORE_FROM_TEST_FILE except the TrustAnchor is
  34. // setup to NOT enforce anchor constraints. This mode is useful for
  35. // verifying control groups. It is not how code works in production.
  36. TRUST_STORE_FROM_TEST_FILE_UNCONSTRAINED,
  37. };
  38. // Reads a test chain from |certs_file_name|, and asserts that verifying it as
  39. // a Cast device certificate yields |expected_result|.
  40. //
  41. // RunTest() also checks that the resulting CertVerificationContext does not
  42. // incorrectly verify invalid signatures.
  43. //
  44. // * |expected_policy| - The policy that should have been identified for the
  45. // device certificate.
  46. // * |time| - The timestamp to use when verifying the certificate.
  47. // * |trust_store_dependency| - Which trust store to use when verifying (see
  48. // enum's definition).
  49. // * |optional_signed_data_file_name| - optional path to a PEM file containing
  50. // a valid signature generated by the device certificate.
  51. //
  52. void RunTest(CastCertError expected_result,
  53. const std::string& expected_common_name,
  54. CastDeviceCertPolicy expected_policy,
  55. const std::string& certs_file_name,
  56. const base::Time& time,
  57. TrustStoreDependency trust_store_dependency,
  58. const std::string& optional_signed_data_file_name) {
  59. base::test::TaskEnvironment te;
  60. auto certs = ReadCertificateChainFromFile(
  61. testing::GetCastCertificatesSubDirectory().AppendASCII(certs_file_name));
  62. std::unique_ptr<net::TrustStoreInMemory> trust_store;
  63. switch (trust_store_dependency) {
  64. case TRUST_STORE_BUILTIN:
  65. // Leave trust_store as nullptr.
  66. break;
  67. case TRUST_STORE_FROM_TEST_FILE:
  68. case TRUST_STORE_FROM_TEST_FILE_UNCONSTRAINED: {
  69. ASSERT_FALSE(certs.empty());
  70. // Parse the root certificate of the chain.
  71. net::CertErrors errors;
  72. scoped_refptr<net::ParsedCertificate> root =
  73. net::ParsedCertificate::Create(
  74. net::x509_util::CreateCryptoBuffer(certs.back()), {}, &errors);
  75. ASSERT_TRUE(root) << errors.ToDebugString();
  76. // Remove it from the chain.
  77. certs.pop_back();
  78. // Add it to the trust store as a trust anchor
  79. trust_store = std::make_unique<net::TrustStoreInMemory>();
  80. if (trust_store_dependency == TRUST_STORE_FROM_TEST_FILE_UNCONSTRAINED) {
  81. // This is a test-only mode where anchor constraints are not enforced.
  82. trust_store->AddTrustAnchor(std::move(root));
  83. } else {
  84. // Add a trust anchor and enforce constraints on it (regular mode for
  85. // built-in Cast roots).
  86. trust_store->AddTrustAnchorWithConstraints(std::move(root));
  87. }
  88. }
  89. }
  90. std::unique_ptr<CertVerificationContext> context;
  91. CastDeviceCertPolicy policy;
  92. CastCertError result = VerifyDeviceCertUsingCustomTrustStore(
  93. certs, time, &context, &policy, nullptr, CRLPolicy::CRL_OPTIONAL,
  94. trust_store.get());
  95. ASSERT_EQ(expected_result, result);
  96. if (expected_result != CastCertError::OK)
  97. return;
  98. EXPECT_EQ(expected_policy, policy);
  99. ASSERT_TRUE(context.get());
  100. // Test that the context is good.
  101. EXPECT_EQ(expected_common_name, context->GetCommonName());
  102. ASSERT_TRUE(context);
  103. // Test verification of some invalid signatures.
  104. EXPECT_FALSE(context->VerifySignatureOverData("bogus signature", "bogus data",
  105. CastDigestAlgorithm::SHA256));
  106. EXPECT_FALSE(context->VerifySignatureOverData("", "bogus data",
  107. CastDigestAlgorithm::SHA256));
  108. EXPECT_FALSE(
  109. context->VerifySignatureOverData("", "", CastDigestAlgorithm::SHA256));
  110. // If valid signatures are known for this device certificate, test them.
  111. if (!optional_signed_data_file_name.empty()) {
  112. auto signature_data = cast_certificate::testing::ReadSignatureTestData(
  113. optional_signed_data_file_name);
  114. // Test verification of a valid SHA1 signature.
  115. EXPECT_TRUE(context->VerifySignatureOverData(signature_data.signature_sha1,
  116. signature_data.message,
  117. CastDigestAlgorithm::SHA1));
  118. // Test verification of a valid SHA256 signature.
  119. EXPECT_TRUE(context->VerifySignatureOverData(
  120. signature_data.signature_sha256, signature_data.message,
  121. CastDigestAlgorithm::SHA256));
  122. }
  123. }
  124. // Creates a time in UTC at midnight.
  125. //
  126. // The maximum date usable here is limited to year 2038 on 32 bit systems due to
  127. // base::Time::FromExploded clamping the range to what is supported by mktime
  128. // and timegm.
  129. base::Time CreateDate(int year, int month, int day) {
  130. base::Time::Exploded time = {0};
  131. time.year = year;
  132. time.month = month;
  133. time.day_of_month = day;
  134. base::Time result;
  135. EXPECT_TRUE(base::Time::FromUTCExploded(time, &result));
  136. return result;
  137. }
  138. // Returns 2016-04-01 00:00:00 UTC.
  139. //
  140. // This is a time when most of the test certificate paths are
  141. // valid.
  142. base::Time AprilFirst2016() {
  143. return CreateDate(2016, 4, 1);
  144. }
  145. // Returns 2015-01-01 00:00:00 UTC.
  146. base::Time JanuaryFirst2015() {
  147. return CreateDate(2015, 1, 1);
  148. }
  149. // Returns 2037-03-01 00:00:00 UTC.
  150. //
  151. // This is so far in the future that the test chains in this unit-test
  152. // should all be invalid.
  153. base::Time MarchFirst2037() {
  154. return CreateDate(2037, 3, 1);
  155. }
  156. // Tests verifying a valid certificate chain of length 2:
  157. //
  158. // 0: 2ZZBG9 FA8FCA3EF91A
  159. // 1: Eureka Gen1 ICA
  160. //
  161. // Chains to trust anchor:
  162. // Eureka Root CA (built-in trust store)
  163. TEST(VerifyCastDeviceCertTest, ChromecastGen1) {
  164. RunTest(CastCertError::OK, "2ZZBG9 FA8FCA3EF91A", CastDeviceCertPolicy::NONE,
  165. "chromecast_gen1.pem", AprilFirst2016(), TRUST_STORE_BUILTIN,
  166. "signeddata/2ZZBG9_FA8FCA3EF91A.pem");
  167. }
  168. // Tests verifying a valid certificate chain of length 2:
  169. //
  170. // 0: 2ZZBG9 FA8FCA3EF91A
  171. // 1: Eureka Gen1 ICA
  172. //
  173. // Chains to trust anchor:
  174. // Cast Root CA (built-in trust store)
  175. TEST(VerifyCastDeviceCertTest, ChromecastGen1Reissue) {
  176. RunTest(CastCertError::OK, "2ZZBG9 FA8FCA3EF91A", CastDeviceCertPolicy::NONE,
  177. "chromecast_gen1_reissue.pem", AprilFirst2016(), TRUST_STORE_BUILTIN,
  178. "signeddata/2ZZBG9_FA8FCA3EF91A.pem");
  179. }
  180. // Tests verifying a valid certificate chain of length 2:
  181. //
  182. // 0: 3ZZAK6 FA8FCA3F0D35
  183. // 1: Chromecast ICA 3
  184. //
  185. // Chains to trust anchor:
  186. // Cast Root CA (built-in trust store)
  187. TEST(VerifyCastDeviceCertTest, ChromecastGen2) {
  188. RunTest(CastCertError::OK, "3ZZAK6 FA8FCA3F0D35", CastDeviceCertPolicy::NONE,
  189. "chromecast_gen2.pem", AprilFirst2016(), TRUST_STORE_BUILTIN, "");
  190. }
  191. // Tests verifying a valid certificate chain of length 3:
  192. //
  193. // 0: -6394818897508095075
  194. // 1: Asus fugu Cast ICA
  195. // 2: Widevine Cast Subroot
  196. //
  197. // Chains to trust anchor:
  198. // Cast Root CA (built-in trust store)
  199. TEST(VerifyCastDeviceCertTest, Fugu) {
  200. RunTest(CastCertError::OK, "-6394818897508095075", CastDeviceCertPolicy::NONE,
  201. "fugu.pem", AprilFirst2016(), TRUST_STORE_BUILTIN, "");
  202. }
  203. // Tests verifying an invalid certificate chain of length 1:
  204. //
  205. // 0: Cast Test Untrusted Device
  206. //
  207. // Chains to:
  208. // Cast Test Untrusted ICA (Not part of trust store)
  209. //
  210. // This is invalid because it does not chain to a trust anchor.
  211. TEST(VerifyCastDeviceCertTest, Unchained) {
  212. RunTest(CastCertError::ERR_CERTS_VERIFY_GENERIC, "",
  213. CastDeviceCertPolicy::NONE, "unchained.pem", AprilFirst2016(),
  214. TRUST_STORE_BUILTIN, "");
  215. }
  216. // Tests verifying one of the self-signed trust anchors (chain of length 1):
  217. //
  218. // 0: Cast Root CA
  219. //
  220. // Chains to trust anchor:
  221. // Cast Root CA (built-in trust store)
  222. //
  223. // Although this is a valid and trusted certificate (it is one of the
  224. // trust anchors after all) it fails the test as it is not a *device
  225. // certificate*.
  226. TEST(VerifyCastDeviceCertTest, CastRootCa) {
  227. RunTest(CastCertError::ERR_CERTS_RESTRICTIONS, "", CastDeviceCertPolicy::NONE,
  228. "cast_root_ca.pem", AprilFirst2016(), TRUST_STORE_BUILTIN, "");
  229. }
  230. // Tests verifying a valid certificate chain of length 2:
  231. //
  232. // 0: 4ZZDZJ FA8FCA7EFE3C
  233. // 1: Chromecast ICA 4 (Audio)
  234. //
  235. // Chains to trust anchor:
  236. // Cast Root CA (built-in trust store)
  237. //
  238. // This device certificate has a policy that means it is valid only for audio
  239. // devices.
  240. TEST(VerifyCastDeviceCertTest, ChromecastAudio) {
  241. RunTest(CastCertError::OK, "4ZZDZJ FA8FCA7EFE3C",
  242. CastDeviceCertPolicy::AUDIO_ONLY, "chromecast_audio.pem",
  243. AprilFirst2016(), TRUST_STORE_BUILTIN, "");
  244. }
  245. // Tests verifying a valid certificate chain of length 3:
  246. //
  247. // 0: MediaTek Audio Dev Test
  248. // 1: MediaTek Audio Dev Model
  249. // 2: Cast Audio Dev Root CA
  250. //
  251. // Chains to trust anchor:
  252. // Cast Root CA (built-in trust store)
  253. //
  254. // This device certificate has a policy that means it is valid only for audio
  255. // devices.
  256. TEST(VerifyCastDeviceCertTest, MtkAudioDev) {
  257. RunTest(CastCertError::OK, "MediaTek Audio Dev Test",
  258. CastDeviceCertPolicy::AUDIO_ONLY, "mtk_audio_dev.pem",
  259. JanuaryFirst2015(), TRUST_STORE_BUILTIN, "");
  260. }
  261. // Tests verifying a valid certificate chain of length 2:
  262. //
  263. // 0: 9V0000VB FA8FCA784D01
  264. // 1: Cast TV ICA (Vizio)
  265. //
  266. // Chains to trust anchor:
  267. // Cast Root CA (built-in trust store)
  268. TEST(VerifyCastDeviceCertTest, Vizio) {
  269. RunTest(CastCertError::OK, "9V0000VB FA8FCA784D01",
  270. CastDeviceCertPolicy::NONE, "vizio.pem", AprilFirst2016(),
  271. TRUST_STORE_BUILTIN, "");
  272. }
  273. // Tests verifying a valid certificate chain of length 2 using expired
  274. // time points.
  275. TEST(VerifyCastDeviceCertTest, ChromecastGen2InvalidTime) {
  276. const char* kCertsFile = "chromecast_gen2.pem";
  277. // Control test - certificate should be valid at some time otherwise
  278. // this test is pointless.
  279. RunTest(CastCertError::OK, "3ZZAK6 FA8FCA3F0D35", CastDeviceCertPolicy::NONE,
  280. kCertsFile, AprilFirst2016(), TRUST_STORE_BUILTIN, "");
  281. // Use a time before notBefore.
  282. RunTest(CastCertError::ERR_CERTS_DATE_INVALID, "", CastDeviceCertPolicy::NONE,
  283. kCertsFile, JanuaryFirst2015(), TRUST_STORE_BUILTIN, "");
  284. // Use a time after notAfter.
  285. RunTest(CastCertError::ERR_CERTS_DATE_INVALID, "", CastDeviceCertPolicy::NONE,
  286. kCertsFile, MarchFirst2037(), TRUST_STORE_BUILTIN, "");
  287. }
  288. // Tests verifying a valid certificate chain of length 3:
  289. //
  290. // 0: Audio Reference Dev Test
  291. // 1: Audio Reference Dev Model
  292. // 2: Cast Audio Dev Root CA
  293. //
  294. // Chains to trust anchor:
  295. // Cast Root CA (built-in trust store)
  296. //
  297. // This device certificate has a policy that means it is valid only for audio
  298. // devices.
  299. TEST(VerifyCastDeviceCertTest, AudioRefDevTestChain3) {
  300. RunTest(CastCertError::OK, "Audio Reference Dev Test",
  301. CastDeviceCertPolicy::AUDIO_ONLY, "audio_ref_dev_test_chain_3.pem",
  302. AprilFirst2016(), TRUST_STORE_BUILTIN,
  303. "signeddata/AudioReferenceDevTest.pem");
  304. }
  305. // Tests verifying a valid certificate chain of length 3. Note that the first
  306. // intermediate has a serial number that is 21 octets long, which violates RFC
  307. // 5280. However cast verification accepts this certificate for compatibility
  308. // reasons.
  309. //
  310. // 0: 8C579B806FFC8A9DFFFF F8:8F:CA:6B:E6:DA
  311. // 1: Sony so16vic CA
  312. // 2: Cast Audio Sony CA
  313. //
  314. // Chains to trust anchor:
  315. // Cast Root CA (built-in trust store)
  316. //
  317. // This device certificate has a policy that means it is valid only for audio
  318. // devices.
  319. TEST(VerifyCastDeviceCertTest, IntermediateSerialNumberTooLong) {
  320. RunTest(CastCertError::OK, "8C579B806FFC8A9DFFFF F8:8F:CA:6B:E6:DA",
  321. CastDeviceCertPolicy::AUDIO_ONLY,
  322. "intermediate_serialnumber_toolong.pem", AprilFirst2016(),
  323. TRUST_STORE_BUILTIN, "");
  324. }
  325. // Tests verifying a valid certificate chain of length 2 when the trust anchor
  326. // is "expired". This is expected to work since expiration is not an enforced
  327. // anchor constraint, even though it may appear in the root certificate.
  328. //
  329. // 0: CastDevice
  330. // 1: CastIntermediate
  331. //
  332. // Chains to trust anchor:
  333. // Expired CastRoot (provided by test data)
  334. TEST(VerifyCastDeviceCertTest, ExpiredTrustAnchor) {
  335. // The root certificate is only valid in 2015, so validating with a time in
  336. // 2016 means it is expired.
  337. RunTest(CastCertError::OK, "CastDevice", CastDeviceCertPolicy::NONE,
  338. "expired_root.pem", AprilFirst2016(), TRUST_STORE_FROM_TEST_FILE, "");
  339. }
  340. // Tests verifying a certificate chain where the root certificate has a pathlen
  341. // constraint which is violated by the chain. In this case Root has a pathlen=1
  342. // constraint, however neither intermediate is constrained.
  343. //
  344. // The expectation is for pathlen constraints on trust anchors to be enforced,
  345. // so this validation must fail.
  346. //
  347. // 0: Target
  348. // 1: Intermediate2
  349. // 2: Intermediate1
  350. //
  351. // Chains to trust anchor:
  352. // Root (provided by test data; has pathlen=1 constraint)
  353. TEST(VerifyCastDeviceCertTest, ViolatesPathlenTrustAnchorConstraint) {
  354. // First do a control test -- when anchor constraints are NOT enforced this
  355. // chain should validate just fine.
  356. RunTest(CastCertError::OK, "Target", CastDeviceCertPolicy::NONE,
  357. "violates_root_pathlen_constraint.pem", AprilFirst2016(),
  358. TRUST_STORE_FROM_TEST_FILE_UNCONSTRAINED, "");
  359. // Now do the real test and verify validation fails when using a TrustAncho
  360. // with pathlen constraint.
  361. RunTest(CastCertError::ERR_CERTS_VERIFY_GENERIC, "Target",
  362. CastDeviceCertPolicy::NONE, "violates_root_pathlen_constraint.pem",
  363. AprilFirst2016(), TRUST_STORE_FROM_TEST_FILE, "");
  364. }
  365. // Tests verifying a certificate chain with the policies:
  366. //
  367. // Root: policies={}
  368. // Intermediate: policies={anyPolicy}
  369. // Leaf: policies={anyPolicy}
  370. TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafAnypolicy) {
  371. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::NONE,
  372. "policies_ica_anypolicy_leaf_anypolicy.pem", AprilFirst2016(),
  373. TRUST_STORE_FROM_TEST_FILE, "");
  374. }
  375. // Test verifying a certificate chain with the policies:
  376. //
  377. // Root: policies={}
  378. // Intermediate: policies={anyPolicy}
  379. // Leaf: policies={audioOnly}
  380. TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafAudioonly) {
  381. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
  382. "policies_ica_anypolicy_leaf_audioonly.pem", AprilFirst2016(),
  383. TRUST_STORE_FROM_TEST_FILE, "");
  384. }
  385. // Test verifying a certificate chain with the policies:
  386. //
  387. // Root: policies={}
  388. // Intermediate: policies={anyPolicy}
  389. // Leaf: policies={foo}
  390. TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafFoo) {
  391. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::NONE,
  392. "policies_ica_anypolicy_leaf_foo.pem", AprilFirst2016(),
  393. TRUST_STORE_FROM_TEST_FILE, "");
  394. }
  395. // Test verifying a certificate chain with the policies:
  396. //
  397. // Root: policies={}
  398. // Intermediate: policies={anyPolicy}
  399. // Leaf: policies={}
  400. TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafNone) {
  401. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::NONE,
  402. "policies_ica_anypolicy_leaf_none.pem", AprilFirst2016(),
  403. TRUST_STORE_FROM_TEST_FILE, "");
  404. }
  405. // Test verifying a certificate chain with the policies:
  406. //
  407. // Root: policies={}
  408. // Intermediate: policies={audioOnly}
  409. // Leaf: policies={anyPolicy}
  410. TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafAnypolicy) {
  411. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
  412. "policies_ica_audioonly_leaf_anypolicy.pem", AprilFirst2016(),
  413. TRUST_STORE_FROM_TEST_FILE, "");
  414. }
  415. // Test verifying a certificate chain with the policies:
  416. //
  417. // Root: policies={}
  418. // Intermediate: policies={audioOnly}
  419. // Leaf: policies={audioOnly}
  420. TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafAudioonly) {
  421. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
  422. "policies_ica_audioonly_leaf_audioonly.pem", AprilFirst2016(),
  423. TRUST_STORE_FROM_TEST_FILE, "");
  424. }
  425. // Test verifying a certificate chain with the policies:
  426. //
  427. // Root: policies={}
  428. // Intermediate: policies={audioOnly}
  429. // Leaf: policies={foo}
  430. TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafFoo) {
  431. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
  432. "policies_ica_audioonly_leaf_foo.pem", AprilFirst2016(),
  433. TRUST_STORE_FROM_TEST_FILE, "");
  434. }
  435. // Test verifying a certificate chain with the policies:
  436. //
  437. // Root: policies={}
  438. // Intermediate: policies={audioOnly}
  439. // Leaf: policies={}
  440. TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafNone) {
  441. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
  442. "policies_ica_audioonly_leaf_none.pem", AprilFirst2016(),
  443. TRUST_STORE_FROM_TEST_FILE, "");
  444. }
  445. // Test verifying a certificate chain with the policies:
  446. //
  447. // Root: policies={}
  448. // Intermediate: policies={}
  449. // Leaf: policies={anyPolicy}
  450. TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafAnypolicy) {
  451. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::NONE,
  452. "policies_ica_none_leaf_anypolicy.pem", AprilFirst2016(),
  453. TRUST_STORE_FROM_TEST_FILE, "");
  454. }
  455. // Test verifying a certificate chain with the policies:
  456. //
  457. // Root: policies={}
  458. // Intermediate: policies={}
  459. // Leaf: policies={audioOnly}
  460. TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafAudioonly) {
  461. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
  462. "policies_ica_none_leaf_audioonly.pem", AprilFirst2016(),
  463. TRUST_STORE_FROM_TEST_FILE, "");
  464. }
  465. // Test verifying a certificate chain with the policies:
  466. //
  467. // Root: policies={}
  468. // Intermediate: policies={}
  469. // Leaf: policies={foo}
  470. TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafFoo) {
  471. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::NONE,
  472. "policies_ica_none_leaf_foo.pem", AprilFirst2016(),
  473. TRUST_STORE_FROM_TEST_FILE, "");
  474. }
  475. // Test verifying a certificate chain with the policies:
  476. //
  477. // Root: policies={}
  478. // Intermediate: policies={}
  479. // Leaf: policies={}
  480. TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafNone) {
  481. RunTest(CastCertError::OK, "Leaf", CastDeviceCertPolicy::NONE,
  482. "policies_ica_none_leaf_none.pem", AprilFirst2016(),
  483. TRUST_STORE_FROM_TEST_FILE, "");
  484. }
  485. // Tests verifying a certificate chain where the leaf certificate has a
  486. // 1024-bit RSA key. Verification should fail since the target's key is
  487. // too weak.
  488. TEST(VerifyCastDeviceCertTest, DeviceCertHas1024BitRsaKey) {
  489. RunTest(CastCertError::ERR_CERTS_VERIFY_GENERIC, "RSA 1024 Device Cert",
  490. CastDeviceCertPolicy::NONE, "rsa1024_device_cert.pem",
  491. AprilFirst2016(), TRUST_STORE_FROM_TEST_FILE, "");
  492. }
  493. // Tests verifying a certificate chain where the leaf certificate has a
  494. // 2048-bit RSA key, and then verifying signed data (both SHA1 and SHA256)
  495. // for it.
  496. TEST(VerifyCastDeviceCertTest, DeviceCertHas2048BitRsaKey) {
  497. RunTest(CastCertError::OK, "RSA 2048 Device Cert", CastDeviceCertPolicy::NONE,
  498. "rsa2048_device_cert.pem", AprilFirst2016(),
  499. TRUST_STORE_FROM_TEST_FILE,
  500. "signeddata/rsa2048_device_cert_data.pem");
  501. }
  502. } // namespace
  503. } // namespace cast_certificate