cert_verifier_unittest.cc 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/cert_verifier.h"
  5. #include "base/files/file_path.h"
  6. #include "base/memory/ref_counted.h"
  7. #include "net/cert/x509_certificate.h"
  8. #include "net/cert/x509_util.h"
  9. #include "net/test/cert_test_util.h"
  10. #include "net/test/test_data_directory.h"
  11. #include "testing/gtest/include/gtest/gtest.h"
  12. namespace net {
  13. TEST(CertVerifierTest, RequestParamsComparators) {
  14. const scoped_refptr<X509Certificate> ok_cert =
  15. ImportCertFromFile(GetTestCertsDirectory(), "ok_cert.pem");
  16. ASSERT_TRUE(ok_cert.get());
  17. const scoped_refptr<X509Certificate> expired_cert =
  18. ImportCertFromFile(GetTestCertsDirectory(), "expired_cert.pem");
  19. ASSERT_TRUE(expired_cert.get());
  20. const scoped_refptr<X509Certificate> root_cert =
  21. ImportCertFromFile(GetTestCertsDirectory(), "root_ca_cert.pem");
  22. ASSERT_TRUE(root_cert.get());
  23. // Create a certificate that contains both a leaf and an
  24. // intermediate/root.
  25. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> chain;
  26. chain.push_back(bssl::UpRef(root_cert->cert_buffer()));
  27. const scoped_refptr<X509Certificate> combined_cert =
  28. X509Certificate::CreateFromBuffer(bssl::UpRef(ok_cert->cert_buffer()),
  29. std::move(chain));
  30. ASSERT_TRUE(combined_cert.get());
  31. struct {
  32. // Keys to test
  33. CertVerifier::RequestParams key1;
  34. CertVerifier::RequestParams key2;
  35. // Whether or not |key1| and |key2| are expected to be equal.
  36. bool equal;
  37. } tests[] = {
  38. {
  39. // Test for basic equivalence.
  40. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  41. /*ocsp_response=*/std::string(),
  42. /*sct_list=*/std::string()),
  43. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  44. /*ocsp_response=*/std::string(),
  45. /*sct_list=*/std::string()),
  46. true,
  47. },
  48. {
  49. // Test that different certificates but with the same CA and for
  50. // the same host are different validation keys.
  51. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  52. /*ocsp_response=*/std::string(),
  53. /*sct_list=*/std::string()),
  54. CertVerifier::RequestParams(expired_cert, "www.example.test", 0,
  55. /*ocsp_response=*/std::string(),
  56. /*sct_list=*/std::string()),
  57. false,
  58. },
  59. {
  60. // Test that the same EE certificate for the same host, but with
  61. // different chains are different validation keys.
  62. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  63. /*ocsp_response=*/std::string(),
  64. /*sct_list=*/std::string()),
  65. CertVerifier::RequestParams(combined_cert, "www.example.test", 0,
  66. /*ocsp_response=*/std::string(),
  67. /*sct_list=*/std::string()),
  68. false,
  69. },
  70. {
  71. // The same certificate, with the same chain, but for different
  72. // hosts are different validation keys.
  73. CertVerifier::RequestParams(ok_cert, "www1.example.test", 0,
  74. /*ocsp_response=*/std::string(),
  75. /*sct_list=*/std::string()),
  76. CertVerifier::RequestParams(ok_cert, "www2.example.test", 0,
  77. /*ocsp_response=*/std::string(),
  78. /*sct_list=*/std::string()),
  79. false,
  80. },
  81. {
  82. // The same certificate, chain, and host, but with different flags
  83. // are different validation keys.
  84. CertVerifier::RequestParams(
  85. ok_cert, "www.example.test",
  86. CertVerifier::VERIFY_DISABLE_NETWORK_FETCHES,
  87. /*ocsp_response=*/std::string(),
  88. /*sct_list=*/std::string()),
  89. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  90. /*ocsp_response=*/std::string(),
  91. /*sct_list=*/std::string()),
  92. false,
  93. },
  94. {
  95. // Different OCSP responses.
  96. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  97. "ocsp response",
  98. /*sct_list=*/std::string()),
  99. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  100. /*ocsp_response=*/std::string(),
  101. /*sct_list=*/std::string()),
  102. false,
  103. },
  104. {
  105. // Different SignedCertificateTimestampList.
  106. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  107. /*ocsp_response=*/std::string(),
  108. "sct list"),
  109. CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
  110. /*ocsp_response=*/std::string(),
  111. /*sct_list=*/std::string()),
  112. false,
  113. },
  114. };
  115. for (const auto& test : tests) {
  116. const CertVerifier::RequestParams& key1 = test.key1;
  117. const CertVerifier::RequestParams& key2 = test.key2;
  118. // Ensure that the keys are equivalent to themselves.
  119. EXPECT_FALSE(key1 < key1);
  120. EXPECT_FALSE(key2 < key2);
  121. if (test.equal) {
  122. EXPECT_TRUE(!(key1 < key2) && !(key2 < key1));
  123. } else {
  124. EXPECT_TRUE((key1 < key2) || (key2 < key1));
  125. }
  126. }
  127. }
  128. } // namespace net