cert_verify_proc_win_unittest.cc 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/cert_verify_proc_win.h"
  5. #include <memory>
  6. #include "base/cxx17_backports.h"
  7. #include "base/files/file_path.h"
  8. #include "base/memory/scoped_refptr.h"
  9. #include "net/base/net_errors.h"
  10. #include "net/cert/cert_verifier.h"
  11. #include "net/cert/cert_verify_result.h"
  12. #include "net/cert/crl_set.h"
  13. #include "net/cert/test_root_certs.h"
  14. #include "net/cert/x509_certificate.h"
  15. #include "net/log/net_log_with_source.h"
  16. #include "net/test/cert_test_util.h"
  17. #include "net/test/gtest_util.h"
  18. #include "net/test/test_data_directory.h"
  19. #include "testing/gmock/include/gmock/gmock.h"
  20. #include "testing/gtest/include/gtest/gtest.h"
  21. namespace net {
  22. namespace {
  23. using net::test::IsError;
  24. using net::test::IsOk;
  25. // Tests that Windows debug data for the AuthRoot version is provided for
  26. // successful certificate validations (in this case, using `ScopedTestRoot`).
  27. TEST(CertVerifyProcWinTest, ReadsAuthRootVersionSuccessfulValidation) {
  28. scoped_refptr<X509Certificate> root =
  29. ImportCertFromFile(GetTestCertsDirectory(), "root_ca_cert.pem");
  30. ASSERT_TRUE(root);
  31. ScopedTestRoot test_root(root.get());
  32. scoped_refptr<X509Certificate> cert =
  33. ImportCertFromFile(GetTestCertsDirectory(), "ok_cert.pem");
  34. ASSERT_TRUE(cert);
  35. scoped_refptr<CertVerifyProc> verify_proc =
  36. base::MakeRefCounted<CertVerifyProcWin>();
  37. int flags = 0;
  38. CertVerifyResult verify_result;
  39. int error = verify_proc->Verify(
  40. cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  41. /*sct_list=*/std::string(), flags, CRLSet::BuiltinCRLSet().get(),
  42. CertificateList(), &verify_result, NetLogWithSource());
  43. EXPECT_THAT(error, IsOk());
  44. const CertVerifyProcWin::ResultDebugData* win_debug_data =
  45. CertVerifyProcWin::ResultDebugData::Get(&verify_result);
  46. ASSERT_TRUE(win_debug_data);
  47. // Unfortunately, it's not possible to use something like
  48. // `registry_util::RegistryOverrideManager` to provide a fully fake CTL
  49. // (e.g. created by `CryptMsgEncodeAndSignCTL`), as CryptoAPI will still
  50. // attempt to validate the CTL and fail chain building if it is not able to.
  51. // While it's possible to check in a Microsoft-signed CTL as a resource and
  52. // use that to override, that still leaves a fair amount of dependency on
  53. // platform-specific behaviours.
  54. // Given the lack of easy substitution, the current test merely ensures that
  55. // DebugData is attached, but can't check that the values are sensible (e.g.
  56. // `!authroot_this_update().is_null()`), because the system that the test is
  57. // running on may not have populated the AuthRoot registry. However, the
  58. // following lines reflect "expected" results for a system with AuthRoot.
  59. // EXPECT_FALSE(win_debug_data->authroot_this_update().is_null());
  60. // EXPECT_FALSE(win_debug_data->authroot_sequence_number().empty());
  61. }
  62. // Tests that Windows debug data for the AuthRoot version is still provided
  63. // even if certificate validation fails early (e.g. for an untrusted CA). This
  64. // information should be available regardless of the verification result.
  65. TEST(CertVerifyProcWinTest, ReadsAuthRootVersionFailedValidation) {
  66. scoped_refptr<X509Certificate> cert =
  67. ImportCertFromFile(GetTestCertsDirectory(), "ok_cert.pem");
  68. ASSERT_TRUE(cert);
  69. scoped_refptr<CertVerifyProc> verify_proc =
  70. base::MakeRefCounted<CertVerifyProcWin>();
  71. int flags = 0;
  72. CertVerifyResult verify_result;
  73. int error = verify_proc->Verify(
  74. cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  75. /*sct_list=*/std::string(), flags, CRLSet::BuiltinCRLSet().get(),
  76. CertificateList(), &verify_result, NetLogWithSource());
  77. EXPECT_THAT(error, IsError(ERR_CERT_AUTHORITY_INVALID));
  78. const CertVerifyProcWin::ResultDebugData* win_debug_data =
  79. CertVerifyProcWin::ResultDebugData::Get(&verify_result);
  80. ASSERT_TRUE(win_debug_data);
  81. // Unfortunately, it's not possible to use something like
  82. // `registry_util::RegistryOverrideManager` to provide a fully fake CTL
  83. // (e.g. created by `CryptMsgEncodeAndSignCTL`), as CryptoAPI will still
  84. // attempt to validate the CTL and fail chain building if it is not able to.
  85. // While it's possible to check in a Microsoft-signed CTL as a resource and
  86. // use that to override, that still leaves a fair amount of dependency on
  87. // platform-specific behaviours.
  88. // Given the lack of easy substitution, the current test merely ensures that
  89. // DebugData is attached, but can't check that the values are sensible (e.g.
  90. // `!authroot_this_update().is_null()`), because the system that the test is
  91. // running on may not have populated the AuthRoot registry. However, the
  92. // following lines reflect "expected" results for a system with AuthRoot.
  93. // EXPECT_FALSE(win_debug_data->authroot_this_update().is_null());
  94. // EXPECT_FALSE(win_debug_data->authroot_sequence_number().empty());
  95. }
  96. } // namespace
  97. } // namespace net