test_root_certs_unittest.cc 9.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/test_root_certs.h"
  5. #include "base/files/file_path.h"
  6. #include "build/build_config.h"
  7. #include "net/base/features.h"
  8. #include "net/base/net_errors.h"
  9. #include "net/cert/cert_net_fetcher.h"
  10. #include "net/cert/cert_status_flags.h"
  11. #include "net/cert/cert_verify_proc.h"
  12. #include "net/cert/cert_verify_result.h"
  13. #include "net/cert/crl_set.h"
  14. #include "net/cert/x509_certificate.h"
  15. #include "net/log/net_log_with_source.h"
  16. #include "net/test/cert_test_util.h"
  17. #include "net/test/gtest_util.h"
  18. #include "net/test/test_data_directory.h"
  19. #include "testing/gmock/include/gmock/gmock.h"
  20. #include "testing/gtest/include/gtest/gtest.h"
  21. using net::test::IsOk;
  22. namespace net {
  23. namespace {
  24. // The local test root certificate.
  25. const char kRootCertificateFile[] = "root_ca_cert.pem";
  26. // A certificate issued by the local test root for 127.0.0.1.
  27. const char kGoodCertificateFile[] = "ok_cert.pem";
  28. scoped_refptr<CertVerifyProc> CreateCertVerifyProc() {
  29. #if BUILDFLAG(IS_FUCHSIA) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
  30. return CertVerifyProc::CreateBuiltinVerifyProc(/*cert_net_fetcher=*/nullptr);
  31. #elif BUILDFLAG(BUILTIN_CERT_VERIFIER_FEATURE_SUPPORTED)
  32. if (base::FeatureList::IsEnabled(features::kCertVerifierBuiltinFeature)) {
  33. return CertVerifyProc::CreateBuiltinVerifyProc(
  34. /*cert_net_fetcher=*/nullptr);
  35. } else {
  36. return CertVerifyProc::CreateSystemVerifyProc(/*cert_net_fetcher=*/nullptr);
  37. }
  38. #else
  39. return CertVerifyProc::CreateSystemVerifyProc(/*cert_net_fetcher=*/nullptr);
  40. #endif
  41. }
  42. } // namespace
  43. // Test basic functionality when adding from an existing X509Certificate.
  44. TEST(TestRootCertsTest, AddFromPointer) {
  45. scoped_refptr<X509Certificate> root_cert =
  46. ImportCertFromFile(GetTestCertsDirectory(), kRootCertificateFile);
  47. ASSERT_NE(static_cast<X509Certificate*>(nullptr), root_cert.get());
  48. TestRootCerts* test_roots = TestRootCerts::GetInstance();
  49. ASSERT_NE(static_cast<TestRootCerts*>(nullptr), test_roots);
  50. EXPECT_TRUE(test_roots->IsEmpty());
  51. {
  52. ScopedTestRoot scoped_root(root_cert.get());
  53. EXPECT_FALSE(test_roots->IsEmpty());
  54. }
  55. EXPECT_TRUE(test_roots->IsEmpty());
  56. }
  57. // Test that TestRootCerts actually adds the appropriate trust status flags
  58. // when requested, and that the trusted status is cleared once the root is
  59. // removed the TestRootCerts. This test acts as a canary/sanity check for
  60. // the results of the rest of net_unittests, ensuring that the trust status
  61. // is properly being set and cleared.
  62. TEST(TestRootCertsTest, OverrideTrust) {
  63. TestRootCerts* test_roots = TestRootCerts::GetInstance();
  64. ASSERT_NE(static_cast<TestRootCerts*>(nullptr), test_roots);
  65. EXPECT_TRUE(test_roots->IsEmpty());
  66. scoped_refptr<X509Certificate> test_cert =
  67. ImportCertFromFile(GetTestCertsDirectory(), kGoodCertificateFile);
  68. ASSERT_NE(static_cast<X509Certificate*>(nullptr), test_cert.get());
  69. // Test that the good certificate fails verification, because the root
  70. // certificate should not yet be trusted.
  71. int flags = 0;
  72. CertVerifyResult bad_verify_result;
  73. scoped_refptr<CertVerifyProc> verify_proc(CreateCertVerifyProc());
  74. int bad_status = verify_proc->Verify(
  75. test_cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  76. /*sct_list=*/std::string(), flags, net::CRLSet::BuiltinCRLSet().get(),
  77. CertificateList(), &bad_verify_result, NetLogWithSource());
  78. EXPECT_NE(OK, bad_status);
  79. EXPECT_NE(0u, bad_verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID);
  80. // Add the root certificate and mark it as trusted.
  81. scoped_refptr<X509Certificate> root_cert =
  82. ImportCertFromFile(GetTestCertsDirectory(), kRootCertificateFile);
  83. ASSERT_TRUE(root_cert);
  84. ScopedTestRoot scoped_root(root_cert.get());
  85. EXPECT_FALSE(test_roots->IsEmpty());
  86. // Test that the certificate verification now succeeds, because the
  87. // TestRootCerts is successfully imbuing trust.
  88. CertVerifyResult good_verify_result;
  89. int good_status = verify_proc->Verify(
  90. test_cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  91. /*sct_list=*/std::string(), flags, CRLSet::BuiltinCRLSet().get(),
  92. CertificateList(), &good_verify_result, NetLogWithSource());
  93. EXPECT_THAT(good_status, IsOk());
  94. EXPECT_EQ(0u, good_verify_result.cert_status);
  95. test_roots->Clear();
  96. EXPECT_TRUE(test_roots->IsEmpty());
  97. // Ensure that when the TestRootCerts is cleared, the trust settings
  98. // revert to their original state, and don't linger. If trust status
  99. // lingers, it will likely break other tests in net_unittests.
  100. CertVerifyResult restored_verify_result;
  101. int restored_status = verify_proc->Verify(
  102. test_cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  103. /*sct_list=*/std::string(), flags, CRLSet::BuiltinCRLSet().get(),
  104. CertificateList(), &restored_verify_result, NetLogWithSource());
  105. EXPECT_NE(OK, restored_status);
  106. EXPECT_NE(0u,
  107. restored_verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID);
  108. EXPECT_EQ(bad_status, restored_status);
  109. EXPECT_EQ(bad_verify_result.cert_status, restored_verify_result.cert_status);
  110. }
  111. TEST(TestRootCertsTest, Moveable) {
  112. TestRootCerts* test_roots = TestRootCerts::GetInstance();
  113. ASSERT_NE(static_cast<TestRootCerts*>(nullptr), test_roots);
  114. EXPECT_TRUE(test_roots->IsEmpty());
  115. scoped_refptr<X509Certificate> test_cert =
  116. ImportCertFromFile(GetTestCertsDirectory(), kGoodCertificateFile);
  117. ASSERT_NE(static_cast<X509Certificate*>(nullptr), test_cert.get());
  118. int flags = 0;
  119. CertVerifyResult bad_verify_result;
  120. int bad_status;
  121. scoped_refptr<CertVerifyProc> verify_proc(CreateCertVerifyProc());
  122. {
  123. // Empty ScopedTestRoot at outer scope has no effect.
  124. ScopedTestRoot scoped_root_outer;
  125. EXPECT_TRUE(test_roots->IsEmpty());
  126. // Test that the good certificate fails verification, because the root
  127. // certificate should not yet be trusted.
  128. bad_status = verify_proc->Verify(
  129. test_cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  130. /*sct_list=*/std::string(), flags, net::CRLSet::BuiltinCRLSet().get(),
  131. CertificateList(), &bad_verify_result, NetLogWithSource());
  132. EXPECT_NE(OK, bad_status);
  133. EXPECT_NE(0u,
  134. bad_verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID);
  135. {
  136. // Add the root certificate and mark it as trusted.
  137. scoped_refptr<X509Certificate> root_cert =
  138. ImportCertFromFile(GetTestCertsDirectory(), kRootCertificateFile);
  139. ASSERT_TRUE(root_cert);
  140. ScopedTestRoot scoped_root_inner(root_cert.get());
  141. EXPECT_FALSE(test_roots->IsEmpty());
  142. // Test that the certificate verification now succeeds, because the
  143. // TestRootCerts is successfully imbuing trust.
  144. CertVerifyResult good_verify_result;
  145. int good_status = verify_proc->Verify(
  146. test_cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  147. /*sct_list=*/std::string(), flags, CRLSet::BuiltinCRLSet().get(),
  148. CertificateList(), &good_verify_result, NetLogWithSource());
  149. EXPECT_THAT(good_status, IsOk());
  150. EXPECT_EQ(0u, good_verify_result.cert_status);
  151. EXPECT_FALSE(scoped_root_inner.IsEmpty());
  152. EXPECT_TRUE(scoped_root_outer.IsEmpty());
  153. // Move from inner scoped root to outer
  154. scoped_root_outer = std::move(scoped_root_inner);
  155. EXPECT_FALSE(test_roots->IsEmpty());
  156. EXPECT_FALSE(scoped_root_outer.IsEmpty());
  157. }
  158. // After inner scoper was freed, test root is still trusted since ownership
  159. // was moved to the outer scoper.
  160. EXPECT_FALSE(test_roots->IsEmpty());
  161. EXPECT_FALSE(scoped_root_outer.IsEmpty());
  162. // Test that the certificate verification still succeeds, because the
  163. // TestRootCerts is successfully imbuing trust.
  164. CertVerifyResult good_verify_result;
  165. int good_status = verify_proc->Verify(
  166. test_cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  167. /*sct_list=*/std::string(), flags, CRLSet::BuiltinCRLSet().get(),
  168. CertificateList(), &good_verify_result, NetLogWithSource());
  169. EXPECT_THAT(good_status, IsOk());
  170. EXPECT_EQ(0u, good_verify_result.cert_status);
  171. }
  172. EXPECT_TRUE(test_roots->IsEmpty());
  173. // Ensure that when the TestRootCerts is cleared, the trust settings
  174. // revert to their original state, and don't linger. If trust status
  175. // lingers, it will likely break other tests in net_unittests.
  176. CertVerifyResult restored_verify_result;
  177. int restored_status = verify_proc->Verify(
  178. test_cert.get(), "127.0.0.1", /*ocsp_response=*/std::string(),
  179. /*sct_list=*/std::string(), flags, CRLSet::BuiltinCRLSet().get(),
  180. CertificateList(), &restored_verify_result, NetLogWithSource());
  181. EXPECT_NE(OK, restored_status);
  182. EXPECT_NE(0u,
  183. restored_verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID);
  184. EXPECT_EQ(bad_status, restored_status);
  185. EXPECT_EQ(bad_verify_result.cert_status, restored_verify_result.cert_status);
  186. }
  187. // TODO(rsleevi): Add tests for revocation checking via CRLs, ensuring that
  188. // TestRootCerts properly injects itself into the validation process. See
  189. // http://crbug.com/63958
  190. } // namespace net