nss_cert_database_unittest.cc 42 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/nss_cert_database.h"
  5. #include <cert.h>
  6. #include <certdb.h>
  7. #include <pk11pub.h>
  8. #include <algorithm>
  9. #include <memory>
  10. #include <string>
  11. #include "base/bind.h"
  12. #include "base/files/file_path.h"
  13. #include "base/files/file_util.h"
  14. #include "base/lazy_instance.h"
  15. #include "base/run_loop.h"
  16. #include "base/strings/string_util.h"
  17. #include "base/strings/utf_string_conversions.h"
  18. #include "crypto/scoped_nss_types.h"
  19. #include "crypto/scoped_test_nss_db.h"
  20. #include "net/base/hash_value.h"
  21. #include "net/base/net_errors.h"
  22. #include "net/cert/cert_net_fetcher.h"
  23. #include "net/cert/cert_status_flags.h"
  24. #include "net/cert/cert_verify_proc.h"
  25. #include "net/cert/cert_verify_result.h"
  26. #include "net/cert/crl_set.h"
  27. #include "net/cert/x509_certificate.h"
  28. #include "net/cert/x509_util_nss.h"
  29. #include "net/log/net_log_with_source.h"
  30. #include "net/test/cert_test_util.h"
  31. #include "net/test/gtest_util.h"
  32. #include "net/test/test_data_directory.h"
  33. #include "net/test/test_with_task_environment.h"
  34. #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
  35. #include "testing/gmock/include/gmock/gmock.h"
  36. #include "testing/gtest/include/gtest/gtest.h"
  37. using base::ASCIIToUTF16;
  38. using net::test::IsError;
  39. using net::test::IsOk;
  40. namespace net {
  41. namespace {
  42. void SwapCertList(ScopedCERTCertificateList* destination,
  43. ScopedCERTCertificateList source) {
  44. ASSERT_TRUE(destination);
  45. destination->swap(source);
  46. }
  47. std::string GetSubjectCN(CERTCertificate* cert) {
  48. char* cn = CERT_GetCommonName(&cert->subject);
  49. std::string s = cn;
  50. PORT_Free(cn);
  51. return s;
  52. }
  53. } // namespace
  54. class CertDatabaseNSSTest : public TestWithTaskEnvironment {
  55. public:
  56. void SetUp() override {
  57. ASSERT_TRUE(test_nssdb_.is_open());
  58. cert_db_ = std::make_unique<NSSCertDatabase>(
  59. crypto::ScopedPK11Slot(
  60. PK11_ReferenceSlot(test_nssdb_.slot())) /* public slot */,
  61. crypto::ScopedPK11Slot(
  62. PK11_ReferenceSlot(test_nssdb_.slot())) /* private slot */);
  63. public_slot_ = cert_db_->GetPublicSlot();
  64. crl_set_ = CRLSet::BuiltinCRLSet();
  65. // Test db should be empty at start of test.
  66. EXPECT_EQ(0U, ListCerts().size());
  67. }
  68. void TearDown() override {
  69. // Run the message loop to process any observer callbacks (e.g. for the
  70. // ClientSocketFactory singleton) so that the scoped ref ptrs created in
  71. // NSSCertDatabase::NotifyObservers* get released.
  72. base::RunLoop().RunUntilIdle();
  73. }
  74. protected:
  75. PK11SlotInfo* GetPublicSlot() { return public_slot_.get(); }
  76. static std::string ReadTestFile(const std::string& name) {
  77. std::string result;
  78. base::FilePath cert_path = GetTestCertsDirectory().AppendASCII(name);
  79. EXPECT_TRUE(base::ReadFileToString(cert_path, &result));
  80. return result;
  81. }
  82. static bool ReadCertIntoList(const std::string& name,
  83. ScopedCERTCertificateList* certs) {
  84. ScopedCERTCertificate cert =
  85. ImportCERTCertificateFromFile(GetTestCertsDirectory(), name);
  86. if (!cert)
  87. return false;
  88. certs->push_back(std::move(cert));
  89. return true;
  90. }
  91. ScopedCERTCertificateList ListCerts() {
  92. ScopedCERTCertificateList result;
  93. CERTCertList* cert_list = PK11_ListCertsInSlot(test_nssdb_.slot());
  94. if (!cert_list)
  95. return result;
  96. for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list);
  97. !CERT_LIST_END(node, cert_list);
  98. node = CERT_LIST_NEXT(node)) {
  99. result.push_back(x509_util::DupCERTCertificate(node->cert));
  100. }
  101. CERT_DestroyCertList(cert_list);
  102. // Sort the result so that test comparisons can be deterministic.
  103. std::sort(
  104. result.begin(), result.end(),
  105. [](const ScopedCERTCertificate& lhs, const ScopedCERTCertificate& rhs) {
  106. return x509_util::CalculateFingerprint256(lhs.get()) <
  107. x509_util::CalculateFingerprint256(rhs.get());
  108. });
  109. return result;
  110. }
  111. std::unique_ptr<NSSCertDatabase> cert_db_;
  112. // When building with libstdc++, |empty_cert_list_| does not have a default
  113. // constructor. Initialize it explicitly so that CertDatabaseNSSTest gets a
  114. // default constructor.
  115. const CertificateList empty_cert_list_ = CertificateList();
  116. crypto::ScopedTestNSSDB test_nssdb_;
  117. crypto::ScopedPK11Slot public_slot_;
  118. scoped_refptr<CRLSet> crl_set_;
  119. };
  120. TEST_F(CertDatabaseNSSTest, ListCerts) {
  121. // This test isn't terribly useful, though it might help with memory
  122. // leak tests.
  123. ScopedCERTCertificateList certs;
  124. cert_db_->ListCerts(base::BindOnce(&SwapCertList, base::Unretained(&certs)));
  125. EXPECT_EQ(0U, certs.size());
  126. RunUntilIdle();
  127. // The test DB is empty, but let's assume there will always be something in
  128. // the other slots.
  129. EXPECT_LT(0U, certs.size());
  130. }
  131. TEST_F(CertDatabaseNSSTest, ImportFromPKCS12WrongPassword) {
  132. std::string pkcs12_data = ReadTestFile("client.p12");
  133. EXPECT_EQ(
  134. ERR_PKCS12_IMPORT_BAD_PASSWORD,
  135. cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data, std::u16string(),
  136. true, // is_extractable
  137. nullptr));
  138. // Test db should still be empty.
  139. EXPECT_EQ(0U, ListCerts().size());
  140. }
  141. TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AsExtractableAndExportAgain) {
  142. std::string pkcs12_data = ReadTestFile("client.p12");
  143. EXPECT_EQ(OK,
  144. cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data, u"12345",
  145. true, // is_extractable
  146. nullptr));
  147. ScopedCERTCertificateList cert_list = ListCerts();
  148. ASSERT_EQ(1U, cert_list.size());
  149. EXPECT_EQ("testusercert", GetSubjectCN(cert_list[0].get()));
  150. // TODO(mattm): move export test to separate test case?
  151. std::string exported_data;
  152. EXPECT_EQ(1,
  153. cert_db_->ExportToPKCS12(cert_list, u"exportpw", &exported_data));
  154. ASSERT_LT(0U, exported_data.size());
  155. // TODO(mattm): further verification of exported data?
  156. }
  157. TEST_F(CertDatabaseNSSTest, ImportFromPKCS12Twice) {
  158. std::string pkcs12_data = ReadTestFile("client.p12");
  159. EXPECT_EQ(OK,
  160. cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data, u"12345",
  161. true, // is_extractable
  162. nullptr));
  163. EXPECT_EQ(1U, ListCerts().size());
  164. // NSS has a SEC_ERROR_PKCS12_DUPLICATE_DATA error, but it doesn't look like
  165. // it's ever used. This test verifies that.
  166. EXPECT_EQ(OK,
  167. cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data, u"12345",
  168. true, // is_extractable
  169. nullptr));
  170. EXPECT_EQ(1U, ListCerts().size());
  171. }
  172. TEST_F(CertDatabaseNSSTest, ImportFromPKCS12AsUnextractableAndExportAgain) {
  173. std::string pkcs12_data = ReadTestFile("client.p12");
  174. EXPECT_EQ(OK,
  175. cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data, u"12345",
  176. false, // is_extractable
  177. nullptr));
  178. ScopedCERTCertificateList cert_list = ListCerts();
  179. ASSERT_EQ(1U, cert_list.size());
  180. EXPECT_EQ("testusercert", GetSubjectCN(cert_list[0].get()));
  181. std::string exported_data;
  182. EXPECT_EQ(0,
  183. cert_db_->ExportToPKCS12(cert_list, u"exportpw", &exported_data));
  184. }
  185. // Importing a PKCS#12 file with a certificate but no corresponding
  186. // private key should not mark an existing private key as unextractable.
  187. TEST_F(CertDatabaseNSSTest, ImportFromPKCS12OnlyMarkIncludedKey) {
  188. std::string pkcs12_data = ReadTestFile("client.p12");
  189. EXPECT_EQ(OK,
  190. cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data, u"12345",
  191. true, // is_extractable
  192. nullptr));
  193. ScopedCERTCertificateList cert_list = ListCerts();
  194. ASSERT_EQ(1U, cert_list.size());
  195. // Now import a PKCS#12 file with just a certificate but no private key.
  196. pkcs12_data = ReadTestFile("client-nokey.p12");
  197. EXPECT_EQ(OK,
  198. cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data, u"12345",
  199. false, // is_extractable
  200. nullptr));
  201. cert_list = ListCerts();
  202. ASSERT_EQ(1U, cert_list.size());
  203. // Make sure the imported private key is still extractable.
  204. std::string exported_data;
  205. EXPECT_EQ(1,
  206. cert_db_->ExportToPKCS12(cert_list, u"exportpw", &exported_data));
  207. ASSERT_LT(0U, exported_data.size());
  208. }
  209. TEST_F(CertDatabaseNSSTest, ImportFromPKCS12InvalidFile) {
  210. std::string pkcs12_data = "Foobarbaz";
  211. EXPECT_EQ(
  212. ERR_PKCS12_IMPORT_INVALID_FILE,
  213. cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data, std::u16string(),
  214. true, // is_extractable
  215. nullptr));
  216. // Test db should still be empty.
  217. EXPECT_EQ(0U, ListCerts().size());
  218. }
  219. TEST_F(CertDatabaseNSSTest, ImportFromPKCS12EmptyPassword) {
  220. std::string pkcs12_data = ReadTestFile("client-empty-password.p12");
  221. EXPECT_EQ(OK, cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data,
  222. std::u16string(),
  223. true, // is_extractable
  224. nullptr));
  225. EXPECT_EQ(1U, ListCerts().size());
  226. }
  227. TEST_F(CertDatabaseNSSTest, ImportFromPKCS12NullPassword) {
  228. std::string pkcs12_data = ReadTestFile("client-null-password.p12");
  229. EXPECT_EQ(OK, cert_db_->ImportFromPKCS12(GetPublicSlot(), pkcs12_data,
  230. std::u16string(),
  231. true, // is_extractable
  232. nullptr));
  233. EXPECT_EQ(1U, ListCerts().size());
  234. }
  235. TEST_F(CertDatabaseNSSTest, ImportCACert_SSLTrust) {
  236. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  237. GetTestCertsDirectory(), "root_ca_cert.pem",
  238. X509Certificate::FORMAT_AUTO);
  239. ASSERT_EQ(1U, certs.size());
  240. EXPECT_FALSE(certs[0]->isperm);
  241. // Import it.
  242. NSSCertDatabase::ImportCertFailureList failed;
  243. EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_SSL,
  244. &failed));
  245. EXPECT_EQ(0U, failed.size());
  246. ScopedCERTCertificateList cert_list = ListCerts();
  247. ASSERT_EQ(1U, cert_list.size());
  248. CERTCertificate* cert = cert_list[0].get();
  249. EXPECT_EQ("Test Root CA", GetSubjectCN(cert));
  250. EXPECT_EQ(NSSCertDatabase::TRUSTED_SSL,
  251. cert_db_->GetCertTrust(cert, CA_CERT));
  252. EXPECT_EQ(
  253. unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA),
  254. cert->trust->sslFlags);
  255. EXPECT_EQ(unsigned(CERTDB_VALID_CA), cert->trust->emailFlags);
  256. EXPECT_EQ(unsigned(CERTDB_VALID_CA), cert->trust->objectSigningFlags);
  257. }
  258. TEST_F(CertDatabaseNSSTest, ImportCACert_EmailTrust) {
  259. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  260. GetTestCertsDirectory(), "root_ca_cert.pem",
  261. X509Certificate::FORMAT_AUTO);
  262. ASSERT_EQ(1U, certs.size());
  263. EXPECT_FALSE(certs[0]->isperm);
  264. // Import it.
  265. NSSCertDatabase::ImportCertFailureList failed;
  266. EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_EMAIL,
  267. &failed));
  268. EXPECT_EQ(0U, failed.size());
  269. ScopedCERTCertificateList cert_list = ListCerts();
  270. ASSERT_EQ(1U, cert_list.size());
  271. CERTCertificate* cert = cert_list[0].get();
  272. EXPECT_EQ("Test Root CA", GetSubjectCN(cert));
  273. EXPECT_EQ(NSSCertDatabase::TRUSTED_EMAIL,
  274. cert_db_->GetCertTrust(cert, CA_CERT));
  275. EXPECT_EQ(unsigned(CERTDB_VALID_CA), cert->trust->sslFlags);
  276. EXPECT_EQ(
  277. unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA),
  278. cert->trust->emailFlags);
  279. EXPECT_EQ(unsigned(CERTDB_VALID_CA), cert->trust->objectSigningFlags);
  280. }
  281. TEST_F(CertDatabaseNSSTest, ImportCACert_ObjSignTrust) {
  282. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  283. GetTestCertsDirectory(), "root_ca_cert.pem",
  284. X509Certificate::FORMAT_AUTO);
  285. ASSERT_EQ(1U, certs.size());
  286. EXPECT_FALSE(certs[0]->isperm);
  287. // Import it.
  288. NSSCertDatabase::ImportCertFailureList failed;
  289. EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_OBJ_SIGN,
  290. &failed));
  291. EXPECT_EQ(0U, failed.size());
  292. ScopedCERTCertificateList cert_list = ListCerts();
  293. ASSERT_EQ(1U, cert_list.size());
  294. CERTCertificate* cert = cert_list[0].get();
  295. EXPECT_EQ("Test Root CA", GetSubjectCN(cert));
  296. EXPECT_EQ(NSSCertDatabase::TRUSTED_OBJ_SIGN,
  297. cert_db_->GetCertTrust(cert, CA_CERT));
  298. EXPECT_EQ(unsigned(CERTDB_VALID_CA), cert->trust->sslFlags);
  299. EXPECT_EQ(unsigned(CERTDB_VALID_CA), cert->trust->emailFlags);
  300. EXPECT_EQ(
  301. unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA),
  302. cert->trust->objectSigningFlags);
  303. }
  304. TEST_F(CertDatabaseNSSTest, ImportCA_NotCACert) {
  305. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  306. GetTestCertsDirectory(), "ok_cert.pem", X509Certificate::FORMAT_AUTO);
  307. ASSERT_EQ(1U, certs.size());
  308. EXPECT_FALSE(certs[0]->isperm);
  309. // Import it.
  310. NSSCertDatabase::ImportCertFailureList failed;
  311. EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUSTED_SSL,
  312. &failed));
  313. ASSERT_EQ(1U, failed.size());
  314. // Note: this compares pointers directly. It's okay in this case because
  315. // ImportCACerts returns the same pointers that were passed in. In the
  316. // general case x509_util::CryptoBufferEqual should be used.
  317. EXPECT_EQ(certs[0], failed[0].certificate);
  318. EXPECT_THAT(failed[0].net_error, IsError(ERR_IMPORT_CA_CERT_NOT_CA));
  319. EXPECT_EQ(0U, ListCerts().size());
  320. }
  321. TEST_F(CertDatabaseNSSTest, ImportCACertHierarchy) {
  322. ScopedCERTCertificateList certs;
  323. ASSERT_TRUE(ReadCertIntoList("multi-root-D-by-D.pem", &certs));
  324. ASSERT_TRUE(ReadCertIntoList("multi-root-C-by-D.pem", &certs));
  325. ASSERT_TRUE(ReadCertIntoList("multi-root-B-by-C.pem", &certs));
  326. ASSERT_TRUE(ReadCertIntoList("multi-root-A-by-B.pem", &certs));
  327. // Import it.
  328. NSSCertDatabase::ImportCertFailureList failed;
  329. // Have to specify email trust for the cert verification of the child cert to
  330. // work (see
  331. // http://mxr.mozilla.org/mozilla/source/security/nss/lib/certhigh/certvfy.c#752
  332. // "XXX This choice of trustType seems arbitrary.")
  333. EXPECT_TRUE(cert_db_->ImportCACerts(
  334. certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL,
  335. &failed));
  336. ASSERT_EQ(1U, failed.size());
  337. EXPECT_EQ("127.0.0.1", GetSubjectCN(failed[0].certificate.get()));
  338. EXPECT_THAT(failed[0].net_error, IsError(ERR_IMPORT_CA_CERT_NOT_CA));
  339. ScopedCERTCertificateList cert_list = ListCerts();
  340. ASSERT_EQ(3U, cert_list.size());
  341. EXPECT_EQ("B CA - Multi-root", GetSubjectCN(cert_list[0].get()));
  342. EXPECT_EQ("D Root CA - Multi-root", GetSubjectCN(cert_list[1].get()));
  343. EXPECT_EQ("C CA - Multi-root", GetSubjectCN(cert_list[2].get()));
  344. }
  345. TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyDupeRoot) {
  346. ScopedCERTCertificateList certs;
  347. ASSERT_TRUE(ReadCertIntoList("multi-root-D-by-D.pem", &certs));
  348. // First import just the root.
  349. NSSCertDatabase::ImportCertFailureList failed;
  350. EXPECT_TRUE(cert_db_->ImportCACerts(
  351. certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL,
  352. &failed));
  353. EXPECT_EQ(0U, failed.size());
  354. ScopedCERTCertificateList cert_list = ListCerts();
  355. ASSERT_EQ(1U, cert_list.size());
  356. EXPECT_EQ("D Root CA - Multi-root", GetSubjectCN(cert_list[0].get()));
  357. ASSERT_TRUE(ReadCertIntoList("multi-root-C-by-D.pem", &certs));
  358. ASSERT_TRUE(ReadCertIntoList("multi-root-B-by-C.pem", &certs));
  359. ASSERT_TRUE(ReadCertIntoList("multi-root-A-by-B.pem", &certs));
  360. // Now import with the other certs in the list too. Even though the root is
  361. // already present, we should still import the rest.
  362. failed.clear();
  363. EXPECT_TRUE(cert_db_->ImportCACerts(
  364. certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL,
  365. &failed));
  366. ASSERT_EQ(2U, failed.size());
  367. EXPECT_EQ("D Root CA - Multi-root",
  368. GetSubjectCN(failed[0].certificate.get()));
  369. EXPECT_THAT(failed[0].net_error, IsError(ERR_IMPORT_CERT_ALREADY_EXISTS));
  370. EXPECT_EQ("127.0.0.1", GetSubjectCN(failed[1].certificate.get()));
  371. EXPECT_THAT(failed[1].net_error, IsError(ERR_IMPORT_CA_CERT_NOT_CA));
  372. cert_list = ListCerts();
  373. ASSERT_EQ(3U, cert_list.size());
  374. EXPECT_EQ("B CA - Multi-root", GetSubjectCN(cert_list[0].get()));
  375. EXPECT_EQ("D Root CA - Multi-root", GetSubjectCN(cert_list[1].get()));
  376. EXPECT_EQ("C CA - Multi-root", GetSubjectCN(cert_list[2].get()));
  377. }
  378. TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyUntrusted) {
  379. ScopedCERTCertificateList certs;
  380. ASSERT_TRUE(ReadCertIntoList("multi-root-D-by-D.pem", &certs));
  381. ASSERT_TRUE(ReadCertIntoList("multi-root-C-by-D.pem", &certs));
  382. // Import it.
  383. NSSCertDatabase::ImportCertFailureList failed;
  384. EXPECT_TRUE(cert_db_->ImportCACerts(certs, NSSCertDatabase::TRUST_DEFAULT,
  385. &failed));
  386. ASSERT_EQ(1U, failed.size());
  387. EXPECT_EQ("C CA - Multi-root", GetSubjectCN(failed[0].certificate.get()));
  388. // TODO(mattm): should check for net error equivalent of
  389. // SEC_ERROR_UNTRUSTED_ISSUER
  390. EXPECT_THAT(failed[0].net_error, IsError(ERR_FAILED));
  391. ScopedCERTCertificateList cert_list = ListCerts();
  392. ASSERT_EQ(1U, cert_list.size());
  393. EXPECT_EQ("D Root CA - Multi-root", GetSubjectCN(cert_list[0].get()));
  394. }
  395. TEST_F(CertDatabaseNSSTest, ImportCACertHierarchyTree) {
  396. ScopedCERTCertificateList certs;
  397. ASSERT_TRUE(ReadCertIntoList("multi-root-E-by-E.pem", &certs));
  398. ASSERT_TRUE(ReadCertIntoList("multi-root-C-by-E.pem", &certs));
  399. ASSERT_TRUE(ReadCertIntoList("multi-root-F-by-E.pem", &certs));
  400. // Import it.
  401. NSSCertDatabase::ImportCertFailureList failed;
  402. EXPECT_TRUE(cert_db_->ImportCACerts(
  403. certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL,
  404. &failed));
  405. ScopedCERTCertificateList cert_list = ListCerts();
  406. ASSERT_EQ(3U, cert_list.size());
  407. EXPECT_EQ("F CA - Multi-root", GetSubjectCN(cert_list[0].get()));
  408. EXPECT_EQ("C CA - Multi-root", GetSubjectCN(cert_list[1].get()));
  409. EXPECT_EQ("E Root CA - Multi-root", GetSubjectCN(cert_list[2].get()));
  410. }
  411. TEST_F(CertDatabaseNSSTest, ImportCACertNotHierarchy) {
  412. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  413. GetTestCertsDirectory(), "root_ca_cert.pem",
  414. X509Certificate::FORMAT_AUTO);
  415. ASSERT_EQ(1U, certs.size());
  416. ASSERT_TRUE(ReadCertIntoList("multi-root-F-by-E.pem", &certs));
  417. ASSERT_TRUE(ReadCertIntoList("multi-root-C-by-E.pem", &certs));
  418. // Import it.
  419. NSSCertDatabase::ImportCertFailureList failed;
  420. EXPECT_TRUE(cert_db_->ImportCACerts(
  421. certs, NSSCertDatabase::TRUSTED_SSL | NSSCertDatabase::TRUSTED_EMAIL,
  422. &failed));
  423. ASSERT_EQ(2U, failed.size());
  424. // TODO(mattm): should check for net error equivalent of
  425. // SEC_ERROR_UNKNOWN_ISSUER
  426. EXPECT_EQ("F CA - Multi-root", GetSubjectCN(failed[0].certificate.get()));
  427. EXPECT_THAT(failed[0].net_error, IsError(ERR_FAILED));
  428. EXPECT_EQ("C CA - Multi-root", GetSubjectCN(failed[1].certificate.get()));
  429. EXPECT_THAT(failed[1].net_error, IsError(ERR_FAILED));
  430. ScopedCERTCertificateList cert_list = ListCerts();
  431. ASSERT_EQ(1U, cert_list.size());
  432. EXPECT_EQ("Test Root CA", GetSubjectCN(cert_list[0].get()));
  433. }
  434. // Test importing a server cert + chain to the NSS DB with default trust. After
  435. // importing, all the certs should be found in the DB and should have default
  436. // trust flags.
  437. TEST_F(CertDatabaseNSSTest, ImportServerCert) {
  438. // Import the server and its chain.
  439. ScopedCERTCertificateList certs_to_import;
  440. ASSERT_TRUE(
  441. ReadCertIntoList("ok_cert_by_intermediate.pem", &certs_to_import));
  442. ASSERT_TRUE(ReadCertIntoList("intermediate_ca_cert.pem", &certs_to_import));
  443. ASSERT_TRUE(ReadCertIntoList("root_ca_cert.pem", &certs_to_import));
  444. NSSCertDatabase::ImportCertFailureList failed;
  445. EXPECT_TRUE(cert_db_->ImportServerCert(
  446. certs_to_import, NSSCertDatabase::TRUST_DEFAULT, &failed));
  447. EXPECT_EQ(0U, failed.size());
  448. // All the certs in the imported list should now be found in the NSS DB.
  449. ScopedCERTCertificateList cert_list = ListCerts();
  450. ASSERT_EQ(3U, cert_list.size());
  451. CERTCertificate* found_server_cert = nullptr;
  452. CERTCertificate* found_intermediate_cert = nullptr;
  453. CERTCertificate* found_root_cert = nullptr;
  454. for (const auto& cert : cert_list) {
  455. if (GetSubjectCN(cert.get()) == "127.0.0.1")
  456. found_server_cert = cert.get();
  457. else if (GetSubjectCN(cert.get()) == "Test Intermediate CA")
  458. found_intermediate_cert = cert.get();
  459. else if (GetSubjectCN(cert.get()) == "Test Root CA")
  460. found_root_cert = cert.get();
  461. }
  462. ASSERT_TRUE(found_server_cert);
  463. ASSERT_TRUE(found_intermediate_cert);
  464. ASSERT_TRUE(found_root_cert);
  465. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  466. cert_db_->GetCertTrust(found_server_cert, SERVER_CERT));
  467. EXPECT_EQ(0U, found_server_cert->trust->sslFlags);
  468. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  469. cert_db_->GetCertTrust(found_intermediate_cert, CA_CERT));
  470. EXPECT_EQ(0U, found_intermediate_cert->trust->sslFlags);
  471. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  472. cert_db_->GetCertTrust(found_root_cert, CA_CERT));
  473. EXPECT_EQ(0U, found_root_cert->trust->sslFlags);
  474. // Verification fails, as the intermediate & CA certs are imported without
  475. // trust.
  476. scoped_refptr<X509Certificate> x509_found_server_cert =
  477. x509_util::CreateX509CertificateFromCERTCertificate(found_server_cert);
  478. ASSERT_TRUE(x509_found_server_cert);
  479. scoped_refptr<CertVerifyProc> verify_proc(
  480. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  481. int flags = 0;
  482. CertVerifyResult verify_result;
  483. int error = verify_proc->Verify(
  484. x509_found_server_cert.get(), "127.0.0.1",
  485. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  486. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  487. EXPECT_THAT(error, IsError(ERR_CERT_AUTHORITY_INVALID));
  488. EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status);
  489. }
  490. TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned) {
  491. ScopedCERTCertificateList certs;
  492. ASSERT_TRUE(ReadCertIntoList("punycodetest.pem", &certs));
  493. NSSCertDatabase::ImportCertFailureList failed;
  494. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
  495. &failed));
  496. EXPECT_EQ(0U, failed.size());
  497. ScopedCERTCertificateList cert_list = ListCerts();
  498. ASSERT_EQ(1U, cert_list.size());
  499. CERTCertificate* puny_cert = cert_list[0].get();
  500. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  501. cert_db_->GetCertTrust(puny_cert, SERVER_CERT));
  502. EXPECT_EQ(0U, puny_cert->trust->sslFlags);
  503. scoped_refptr<X509Certificate> x509_puny_cert =
  504. x509_util::CreateX509CertificateFromCERTCertificate(puny_cert);
  505. ASSERT_TRUE(x509_puny_cert);
  506. scoped_refptr<CertVerifyProc> verify_proc(
  507. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  508. int flags = 0;
  509. CertVerifyResult verify_result;
  510. int error = verify_proc->Verify(
  511. x509_puny_cert.get(), "xn--wgv71a119e.com",
  512. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  513. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  514. EXPECT_THAT(error, IsError(ERR_CERT_AUTHORITY_INVALID));
  515. EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status);
  516. }
  517. TEST_F(CertDatabaseNSSTest, ImportServerCert_SelfSigned_Trusted) {
  518. ScopedCERTCertificateList certs;
  519. ASSERT_TRUE(ReadCertIntoList("punycodetest.pem", &certs));
  520. NSSCertDatabase::ImportCertFailureList failed;
  521. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUSTED_SSL,
  522. &failed));
  523. EXPECT_EQ(0U, failed.size());
  524. ScopedCERTCertificateList cert_list = ListCerts();
  525. ASSERT_EQ(1U, cert_list.size());
  526. CERTCertificate* puny_cert = cert_list[0].get();
  527. EXPECT_EQ(NSSCertDatabase::TRUSTED_SSL,
  528. cert_db_->GetCertTrust(puny_cert, SERVER_CERT));
  529. EXPECT_EQ(unsigned(CERTDB_TRUSTED | CERTDB_TERMINAL_RECORD),
  530. puny_cert->trust->sslFlags);
  531. scoped_refptr<X509Certificate> x509_puny_cert =
  532. x509_util::CreateX509CertificateFromCERTCertificate(puny_cert);
  533. ASSERT_TRUE(x509_puny_cert);
  534. scoped_refptr<CertVerifyProc> verify_proc(
  535. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  536. int flags = 0;
  537. CertVerifyResult verify_result;
  538. int error = verify_proc->Verify(
  539. x509_puny_cert.get(), "xn--wgv71a119e.com",
  540. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  541. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  542. // New verifier does not support server cert trust records.
  543. EXPECT_THAT(error, IsError(ERR_CERT_AUTHORITY_INVALID));
  544. EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status);
  545. }
  546. TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert) {
  547. ScopedCERTCertificateList ca_certs = CreateCERTCertificateListFromFile(
  548. GetTestCertsDirectory(), "root_ca_cert.pem",
  549. X509Certificate::FORMAT_AUTO);
  550. ASSERT_EQ(1U, ca_certs.size());
  551. // Import CA cert and trust it.
  552. NSSCertDatabase::ImportCertFailureList failed;
  553. EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL,
  554. &failed));
  555. EXPECT_EQ(0U, failed.size());
  556. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  557. GetTestCertsDirectory(), "ok_cert.pem", X509Certificate::FORMAT_AUTO);
  558. ASSERT_EQ(1U, certs.size());
  559. // Import server cert with default trust.
  560. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
  561. &failed));
  562. EXPECT_EQ(0U, failed.size());
  563. // Server cert should verify.
  564. scoped_refptr<X509Certificate> x509_server_cert =
  565. x509_util::CreateX509CertificateFromCERTCertificate(certs[0].get());
  566. ASSERT_TRUE(x509_server_cert);
  567. scoped_refptr<CertVerifyProc> verify_proc(
  568. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  569. int flags = 0;
  570. CertVerifyResult verify_result;
  571. int error = verify_proc->Verify(
  572. x509_server_cert.get(), "127.0.0.1",
  573. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  574. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  575. EXPECT_THAT(error, IsOk());
  576. EXPECT_EQ(0U, verify_result.cert_status);
  577. }
  578. TEST_F(CertDatabaseNSSTest, ImportCaAndServerCert_DistrustServer) {
  579. ScopedCERTCertificateList ca_certs = CreateCERTCertificateListFromFile(
  580. GetTestCertsDirectory(), "root_ca_cert.pem",
  581. X509Certificate::FORMAT_AUTO);
  582. ASSERT_EQ(1U, ca_certs.size());
  583. // Import CA cert and trust it.
  584. NSSCertDatabase::ImportCertFailureList failed;
  585. EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL,
  586. &failed));
  587. EXPECT_EQ(0U, failed.size());
  588. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  589. GetTestCertsDirectory(), "ok_cert.pem", X509Certificate::FORMAT_AUTO);
  590. ASSERT_EQ(1U, certs.size());
  591. // Import server cert without inheriting trust from issuer (explicit
  592. // distrust).
  593. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::DISTRUSTED_SSL,
  594. &failed));
  595. EXPECT_EQ(0U, failed.size());
  596. EXPECT_EQ(NSSCertDatabase::DISTRUSTED_SSL,
  597. cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
  598. EXPECT_EQ(unsigned(CERTDB_TERMINAL_RECORD), certs[0]->trust->sslFlags);
  599. // Server cert should fail to verify.
  600. scoped_refptr<X509Certificate> x509_server_cert =
  601. x509_util::CreateX509CertificateFromCERTCertificate(certs[0].get());
  602. ASSERT_TRUE(x509_server_cert);
  603. scoped_refptr<CertVerifyProc> verify_proc(
  604. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  605. int flags = 0;
  606. CertVerifyResult verify_result;
  607. int error = verify_proc->Verify(
  608. x509_server_cert.get(), "127.0.0.1",
  609. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  610. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  611. // This hits the "Cannot verify a chain of length 1" error in the new
  612. // verifier, since path building stops at the leaf which has a distrust
  613. // record.
  614. EXPECT_THAT(error, IsError(ERR_CERT_INVALID));
  615. EXPECT_EQ(CERT_STATUS_INVALID, verify_result.cert_status);
  616. }
  617. TEST_F(CertDatabaseNSSTest, TrustIntermediateCa) {
  618. ScopedCERTCertificateList ca_certs = CreateCERTCertificateListFromFile(
  619. GetTestCertsDirectory(), "2048-rsa-root.pem",
  620. X509Certificate::FORMAT_AUTO);
  621. ASSERT_EQ(1U, ca_certs.size());
  622. // Import Root CA cert and distrust it.
  623. NSSCertDatabase::ImportCertFailureList failed;
  624. EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::DISTRUSTED_SSL,
  625. &failed));
  626. EXPECT_EQ(0U, failed.size());
  627. ScopedCERTCertificateList intermediate_certs =
  628. CreateCERTCertificateListFromFile(GetTestCertsDirectory(),
  629. "2048-rsa-intermediate.pem",
  630. X509Certificate::FORMAT_AUTO);
  631. ASSERT_EQ(1U, intermediate_certs.size());
  632. // Import Intermediate CA cert and trust it.
  633. EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs,
  634. NSSCertDatabase::TRUSTED_SSL, &failed));
  635. EXPECT_EQ(0U, failed.size());
  636. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  637. GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem",
  638. X509Certificate::FORMAT_AUTO);
  639. ASSERT_EQ(1U, certs.size());
  640. // Import server cert with default trust.
  641. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
  642. &failed));
  643. EXPECT_EQ(0U, failed.size());
  644. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  645. cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
  646. // Server cert should verify.
  647. scoped_refptr<X509Certificate> x509_server_cert =
  648. x509_util::CreateX509CertificateFromCERTCertificate(certs[0].get());
  649. ASSERT_TRUE(x509_server_cert);
  650. scoped_refptr<CertVerifyProc> verify_proc(
  651. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  652. int flags = 0;
  653. CertVerifyResult verify_result;
  654. int error = verify_proc->Verify(
  655. x509_server_cert.get(), "127.0.0.1",
  656. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  657. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  658. EXPECT_THAT(error, IsOk());
  659. EXPECT_EQ(0U, verify_result.cert_status);
  660. // Trust the root cert and distrust the intermediate.
  661. EXPECT_TRUE(cert_db_->SetCertTrust(
  662. ca_certs[0].get(), CA_CERT, NSSCertDatabase::TRUSTED_SSL));
  663. EXPECT_TRUE(cert_db_->SetCertTrust(
  664. intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::DISTRUSTED_SSL));
  665. EXPECT_EQ(
  666. unsigned(CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA),
  667. ca_certs[0]->trust->sslFlags);
  668. EXPECT_EQ(unsigned(CERTDB_VALID_CA), ca_certs[0]->trust->emailFlags);
  669. EXPECT_EQ(unsigned(CERTDB_VALID_CA), ca_certs[0]->trust->objectSigningFlags);
  670. EXPECT_EQ(unsigned(CERTDB_TERMINAL_RECORD),
  671. intermediate_certs[0]->trust->sslFlags);
  672. EXPECT_EQ(unsigned(CERTDB_VALID_CA),
  673. intermediate_certs[0]->trust->emailFlags);
  674. EXPECT_EQ(unsigned(CERTDB_VALID_CA),
  675. intermediate_certs[0]->trust->objectSigningFlags);
  676. // Server cert should fail to verify.
  677. CertVerifyResult verify_result2;
  678. error = verify_proc->Verify(x509_server_cert.get(), "127.0.0.1",
  679. /*ocsp_response=*/std::string(),
  680. /*sct_list=*/std::string(), flags, crl_set_.get(),
  681. empty_cert_list_, &verify_result2,
  682. NetLogWithSource());
  683. EXPECT_THAT(error, IsError(ERR_CERT_AUTHORITY_INVALID));
  684. EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status);
  685. }
  686. TEST_F(CertDatabaseNSSTest, TrustIntermediateCa2) {
  687. NSSCertDatabase::ImportCertFailureList failed;
  688. ScopedCERTCertificateList intermediate_certs =
  689. CreateCERTCertificateListFromFile(GetTestCertsDirectory(),
  690. "2048-rsa-intermediate.pem",
  691. X509Certificate::FORMAT_AUTO);
  692. ASSERT_EQ(1U, intermediate_certs.size());
  693. // Import Intermediate CA cert and trust it.
  694. EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs,
  695. NSSCertDatabase::TRUSTED_SSL, &failed));
  696. EXPECT_EQ(0U, failed.size());
  697. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  698. GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem",
  699. X509Certificate::FORMAT_AUTO);
  700. ASSERT_EQ(1U, certs.size());
  701. // Import server cert with default trust.
  702. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
  703. &failed));
  704. EXPECT_EQ(0U, failed.size());
  705. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  706. cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
  707. // Server cert should verify.
  708. scoped_refptr<X509Certificate> x509_server_cert =
  709. x509_util::CreateX509CertificateFromCERTCertificate(certs[0].get());
  710. ASSERT_TRUE(x509_server_cert);
  711. scoped_refptr<CertVerifyProc> verify_proc(
  712. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  713. int flags = 0;
  714. CertVerifyResult verify_result;
  715. int error = verify_proc->Verify(
  716. x509_server_cert.get(), "127.0.0.1",
  717. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  718. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  719. EXPECT_THAT(error, IsOk());
  720. EXPECT_EQ(0U, verify_result.cert_status);
  721. // Without explicit trust of the intermediate, verification should fail.
  722. EXPECT_TRUE(cert_db_->SetCertTrust(
  723. intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
  724. // Server cert should fail to verify.
  725. CertVerifyResult verify_result2;
  726. error = verify_proc->Verify(x509_server_cert.get(), "127.0.0.1",
  727. /*ocsp_response=*/std::string(),
  728. /*sct_list=*/std::string(), flags, crl_set_.get(),
  729. empty_cert_list_, &verify_result2,
  730. NetLogWithSource());
  731. EXPECT_THAT(error, IsError(ERR_CERT_AUTHORITY_INVALID));
  732. EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status);
  733. }
  734. TEST_F(CertDatabaseNSSTest, TrustIntermediateCa3) {
  735. NSSCertDatabase::ImportCertFailureList failed;
  736. ScopedCERTCertificateList ca_certs = CreateCERTCertificateListFromFile(
  737. GetTestCertsDirectory(), "2048-rsa-root.pem",
  738. X509Certificate::FORMAT_AUTO);
  739. ASSERT_EQ(1U, ca_certs.size());
  740. // Import Root CA cert and default trust it.
  741. EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUST_DEFAULT,
  742. &failed));
  743. EXPECT_EQ(0U, failed.size());
  744. ScopedCERTCertificateList intermediate_certs =
  745. CreateCERTCertificateListFromFile(GetTestCertsDirectory(),
  746. "2048-rsa-intermediate.pem",
  747. X509Certificate::FORMAT_AUTO);
  748. ASSERT_EQ(1U, intermediate_certs.size());
  749. // Import Intermediate CA cert and trust it.
  750. EXPECT_TRUE(cert_db_->ImportCACerts(intermediate_certs,
  751. NSSCertDatabase::TRUSTED_SSL, &failed));
  752. EXPECT_EQ(0U, failed.size());
  753. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  754. GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem",
  755. X509Certificate::FORMAT_AUTO);
  756. ASSERT_EQ(1U, certs.size());
  757. // Import server cert with default trust.
  758. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
  759. &failed));
  760. EXPECT_EQ(0U, failed.size());
  761. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  762. cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
  763. // Server cert should verify.
  764. scoped_refptr<X509Certificate> x509_server_cert =
  765. x509_util::CreateX509CertificateFromCERTCertificate(certs[0].get());
  766. ASSERT_TRUE(x509_server_cert);
  767. scoped_refptr<CertVerifyProc> verify_proc(
  768. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  769. int flags = 0;
  770. CertVerifyResult verify_result;
  771. int error = verify_proc->Verify(
  772. x509_server_cert.get(), "127.0.0.1",
  773. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  774. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  775. EXPECT_THAT(error, IsOk());
  776. EXPECT_EQ(0U, verify_result.cert_status);
  777. // Without explicit trust of the intermediate, verification should fail.
  778. EXPECT_TRUE(cert_db_->SetCertTrust(
  779. intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
  780. // Server cert should fail to verify.
  781. CertVerifyResult verify_result2;
  782. error = verify_proc->Verify(x509_server_cert.get(), "127.0.0.1",
  783. /*ocsp_response=*/std::string(),
  784. /*sct_list=*/std::string(), flags, crl_set_.get(),
  785. empty_cert_list_, &verify_result2,
  786. NetLogWithSource());
  787. EXPECT_THAT(error, IsError(ERR_CERT_AUTHORITY_INVALID));
  788. EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result2.cert_status);
  789. }
  790. TEST_F(CertDatabaseNSSTest, TrustIntermediateCa4) {
  791. NSSCertDatabase::ImportCertFailureList failed;
  792. ScopedCERTCertificateList ca_certs = CreateCERTCertificateListFromFile(
  793. GetTestCertsDirectory(), "2048-rsa-root.pem",
  794. X509Certificate::FORMAT_AUTO);
  795. ASSERT_EQ(1U, ca_certs.size());
  796. // Import Root CA cert and trust it.
  797. EXPECT_TRUE(cert_db_->ImportCACerts(ca_certs, NSSCertDatabase::TRUSTED_SSL,
  798. &failed));
  799. EXPECT_EQ(0U, failed.size());
  800. ScopedCERTCertificateList intermediate_certs =
  801. CreateCERTCertificateListFromFile(GetTestCertsDirectory(),
  802. "2048-rsa-intermediate.pem",
  803. X509Certificate::FORMAT_AUTO);
  804. ASSERT_EQ(1U, intermediate_certs.size());
  805. // Import Intermediate CA cert and distrust it.
  806. EXPECT_TRUE(cert_db_->ImportCACerts(
  807. intermediate_certs, NSSCertDatabase::DISTRUSTED_SSL, &failed));
  808. EXPECT_EQ(0U, failed.size());
  809. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  810. GetTestCertsDirectory(), "2048-rsa-ee-by-2048-rsa-intermediate.pem",
  811. X509Certificate::FORMAT_AUTO);
  812. ASSERT_EQ(1U, certs.size());
  813. // Import server cert with default trust.
  814. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
  815. &failed));
  816. EXPECT_EQ(0U, failed.size());
  817. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  818. cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
  819. // Server cert should not verify.
  820. scoped_refptr<X509Certificate> x509_server_cert =
  821. x509_util::CreateX509CertificateFromCERTCertificate(certs[0].get());
  822. ASSERT_TRUE(x509_server_cert);
  823. scoped_refptr<CertVerifyProc> verify_proc(
  824. CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr));
  825. int flags = 0;
  826. CertVerifyResult verify_result;
  827. int error = verify_proc->Verify(
  828. x509_server_cert.get(), "127.0.0.1",
  829. /*ocsp_response=*/std::string(), /*sct_list=*/std::string(), flags,
  830. crl_set_.get(), empty_cert_list_, &verify_result, NetLogWithSource());
  831. EXPECT_THAT(error, IsError(ERR_CERT_AUTHORITY_INVALID));
  832. EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status);
  833. // Without explicit distrust of the intermediate, verification should succeed.
  834. EXPECT_TRUE(cert_db_->SetCertTrust(
  835. intermediate_certs[0].get(), CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
  836. // Server cert should verify.
  837. CertVerifyResult verify_result2;
  838. error = verify_proc->Verify(x509_server_cert.get(), "127.0.0.1",
  839. /*ocsp_response=*/std::string(),
  840. /*sct_list=*/std::string(), flags, crl_set_.get(),
  841. empty_cert_list_, &verify_result2,
  842. NetLogWithSource());
  843. EXPECT_THAT(error, IsOk());
  844. EXPECT_EQ(0U, verify_result2.cert_status);
  845. }
  846. // Importing two certificates with the same issuer and subject common name,
  847. // but overall distinct subject names, should succeed and generate a unique
  848. // nickname for the second certificate.
  849. TEST_F(CertDatabaseNSSTest, ImportDuplicateCommonName) {
  850. ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
  851. GetTestCertsDirectory(), "duplicate_cn_1.pem",
  852. X509Certificate::FORMAT_AUTO);
  853. ASSERT_EQ(1U, certs.size());
  854. EXPECT_EQ(0U, ListCerts().size());
  855. // Import server cert with default trust.
  856. NSSCertDatabase::ImportCertFailureList failed;
  857. EXPECT_TRUE(cert_db_->ImportServerCert(certs, NSSCertDatabase::TRUST_DEFAULT,
  858. &failed));
  859. EXPECT_EQ(0U, failed.size());
  860. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  861. cert_db_->GetCertTrust(certs[0].get(), SERVER_CERT));
  862. ScopedCERTCertificateList new_certs = ListCerts();
  863. ASSERT_EQ(1U, new_certs.size());
  864. // Now attempt to import a different certificate with the same common name.
  865. ScopedCERTCertificateList certs2 = CreateCERTCertificateListFromFile(
  866. GetTestCertsDirectory(), "duplicate_cn_2.pem",
  867. X509Certificate::FORMAT_AUTO);
  868. ASSERT_EQ(1U, certs2.size());
  869. // Import server cert with default trust.
  870. EXPECT_TRUE(cert_db_->ImportServerCert(certs2, NSSCertDatabase::TRUST_DEFAULT,
  871. &failed));
  872. EXPECT_EQ(0U, failed.size());
  873. EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
  874. cert_db_->GetCertTrust(certs2[0].get(), SERVER_CERT));
  875. new_certs = ListCerts();
  876. ASSERT_EQ(2U, new_certs.size());
  877. EXPECT_STRNE(new_certs[0]->nickname, new_certs[1]->nickname);
  878. }
  879. } // namespace net