x509_certificate_unittest.cc 57 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/x509_certificate.h"
  5. #include <stdint.h>
  6. #include <memory>
  7. #include "base/files/file_path.h"
  8. #include "base/files/file_util.h"
  9. #include "base/hash/sha1.h"
  10. #include "base/pickle.h"
  11. #include "base/strings/string_number_conversions.h"
  12. #include "base/strings/string_split.h"
  13. #include "base/strings/string_util.h"
  14. #include "base/time/time.h"
  15. #include "crypto/rsa_private_key.h"
  16. #include "net/base/net_errors.h"
  17. #include "net/cert/asn1_util.h"
  18. #include "net/cert/pem.h"
  19. #include "net/cert/pki/parse_certificate.h"
  20. #include "net/cert/x509_util.h"
  21. #include "net/test/cert_test_util.h"
  22. #include "net/test/test_certificate_data.h"
  23. #include "net/test/test_data_directory.h"
  24. #include "testing/gtest/include/gtest/gtest.h"
  25. using base::HexEncode;
  26. using base::Time;
  27. namespace net {
  28. // Certificates for test data. They're obtained with:
  29. //
  30. // $ openssl s_client -connect [host]:443 -showcerts > /tmp/host.pem < /dev/null
  31. // $ openssl x509 -inform PEM -outform DER < /tmp/host.pem > /tmp/host.der
  32. //
  33. // For fingerprint
  34. // $ openssl x509 -inform DER -fingerprint -noout < /tmp/host.der
  35. // For valid_start, valid_expiry
  36. // $ openssl x509 -inform DER -text -noout < /tmp/host.der |
  37. // grep -A 2 Validity
  38. // $ date +%s -d '<date str>'
  39. // Google's cert.
  40. SHA256HashValue google_fingerprint = {
  41. {0x21, 0xaf, 0x58, 0x74, 0xea, 0x6b, 0xad, 0xbd, 0xe4, 0xb3, 0xb1,
  42. 0xaa, 0x53, 0x32, 0x80, 0x8f, 0xbf, 0x8a, 0x24, 0x7d, 0x98, 0xec,
  43. 0x7f, 0x77, 0x49, 0x38, 0x42, 0x81, 0x26, 0x7f, 0xed, 0x38}};
  44. // The fingerprint of the Google certificate used in the parsing tests,
  45. // which is newer than the one included in the x509_certificate_data.h
  46. SHA256HashValue google_parse_fingerprint = {
  47. {0xf6, 0x41, 0xc3, 0x6c, 0xfe, 0xf4, 0x9b, 0xc0, 0x71, 0x35, 0x9e,
  48. 0xcf, 0x88, 0xee, 0xd9, 0x31, 0x7b, 0x73, 0x8b, 0x59, 0x89, 0x41,
  49. 0x6a, 0xd4, 0x01, 0x72, 0x0c, 0x0a, 0x4e, 0x2e, 0x63, 0x52}};
  50. // The fingerprint for the Thawte SGC certificate
  51. SHA256HashValue thawte_parse_fingerprint = {
  52. {0x10, 0x85, 0xa6, 0xf4, 0x54, 0xd0, 0xc9, 0x11, 0x98, 0xfd, 0xda,
  53. 0xb1, 0x1a, 0x31, 0xc7, 0x16, 0xd5, 0xdc, 0xd6, 0x8d, 0xf9, 0x1c,
  54. 0x03, 0x9c, 0xe1, 0x8d, 0xca, 0x9b, 0xeb, 0x3c, 0xde, 0x3d}};
  55. // Dec 18 00:00:00 2009 GMT
  56. const double kGoogleParseValidFrom = 1261094400;
  57. // Dec 18 23:59:59 2011 GMT
  58. const double kGoogleParseValidTo = 1324252799;
  59. void CheckGoogleCert(const scoped_refptr<X509Certificate>& google_cert,
  60. const SHA256HashValue& expected_fingerprint,
  61. double valid_from,
  62. double valid_to) {
  63. ASSERT_NE(static_cast<X509Certificate*>(nullptr), google_cert.get());
  64. const CertPrincipal& subject = google_cert->subject();
  65. EXPECT_EQ("www.google.com", subject.common_name);
  66. EXPECT_EQ("Mountain View", subject.locality_name);
  67. EXPECT_EQ("California", subject.state_or_province_name);
  68. EXPECT_EQ("US", subject.country_name);
  69. EXPECT_EQ(0U, subject.street_addresses.size());
  70. ASSERT_EQ(1U, subject.organization_names.size());
  71. EXPECT_EQ("Google Inc", subject.organization_names[0]);
  72. EXPECT_EQ(0U, subject.organization_unit_names.size());
  73. EXPECT_EQ(0U, subject.domain_components.size());
  74. const CertPrincipal& issuer = google_cert->issuer();
  75. EXPECT_EQ("Thawte SGC CA", issuer.common_name);
  76. EXPECT_EQ("", issuer.locality_name);
  77. EXPECT_EQ("", issuer.state_or_province_name);
  78. EXPECT_EQ("ZA", issuer.country_name);
  79. EXPECT_EQ(0U, issuer.street_addresses.size());
  80. ASSERT_EQ(1U, issuer.organization_names.size());
  81. EXPECT_EQ("Thawte Consulting (Pty) Ltd.", issuer.organization_names[0]);
  82. EXPECT_EQ(0U, issuer.organization_unit_names.size());
  83. EXPECT_EQ(0U, issuer.domain_components.size());
  84. // Use DoubleT because its epoch is the same on all platforms
  85. const Time& valid_start = google_cert->valid_start();
  86. EXPECT_EQ(valid_from, valid_start.ToDoubleT());
  87. const Time& valid_expiry = google_cert->valid_expiry();
  88. EXPECT_EQ(valid_to, valid_expiry.ToDoubleT());
  89. EXPECT_EQ(expected_fingerprint, X509Certificate::CalculateFingerprint256(
  90. google_cert->cert_buffer()));
  91. }
  92. TEST(X509CertificateTest, GoogleCertParsing) {
  93. scoped_refptr<X509Certificate> google_cert(
  94. X509Certificate::CreateFromBytes(google_der));
  95. CheckGoogleCert(google_cert, google_fingerprint,
  96. 1238192407, // Mar 27 22:20:07 2009 GMT
  97. 1269728407); // Mar 27 22:20:07 2010 GMT
  98. }
  99. TEST(X509CertificateTest, WebkitCertParsing) {
  100. scoped_refptr<X509Certificate> webkit_cert(
  101. X509Certificate::CreateFromBytes(webkit_der));
  102. ASSERT_NE(static_cast<X509Certificate*>(nullptr), webkit_cert.get());
  103. const CertPrincipal& subject = webkit_cert->subject();
  104. EXPECT_EQ("Cupertino", subject.locality_name);
  105. EXPECT_EQ("California", subject.state_or_province_name);
  106. EXPECT_EQ("US", subject.country_name);
  107. EXPECT_EQ(0U, subject.street_addresses.size());
  108. ASSERT_EQ(1U, subject.organization_names.size());
  109. EXPECT_EQ("Apple Inc.", subject.organization_names[0]);
  110. ASSERT_EQ(1U, subject.organization_unit_names.size());
  111. EXPECT_EQ("Mac OS Forge", subject.organization_unit_names[0]);
  112. EXPECT_EQ(0U, subject.domain_components.size());
  113. const CertPrincipal& issuer = webkit_cert->issuer();
  114. EXPECT_EQ("Go Daddy Secure Certification Authority", issuer.common_name);
  115. EXPECT_EQ("Scottsdale", issuer.locality_name);
  116. EXPECT_EQ("Arizona", issuer.state_or_province_name);
  117. EXPECT_EQ("US", issuer.country_name);
  118. EXPECT_EQ(0U, issuer.street_addresses.size());
  119. ASSERT_EQ(1U, issuer.organization_names.size());
  120. EXPECT_EQ("GoDaddy.com, Inc.", issuer.organization_names[0]);
  121. ASSERT_EQ(1U, issuer.organization_unit_names.size());
  122. EXPECT_EQ("http://certificates.godaddy.com/repository",
  123. issuer.organization_unit_names[0]);
  124. EXPECT_EQ(0U, issuer.domain_components.size());
  125. // Use DoubleT because its epoch is the same on all platforms
  126. const Time& valid_start = webkit_cert->valid_start();
  127. EXPECT_EQ(1205883319, valid_start.ToDoubleT()); // Mar 18 23:35:19 2008 GMT
  128. const Time& valid_expiry = webkit_cert->valid_expiry();
  129. EXPECT_EQ(1300491319, valid_expiry.ToDoubleT()); // Mar 18 23:35:19 2011 GMT
  130. std::vector<std::string> dns_names;
  131. EXPECT_TRUE(webkit_cert->GetSubjectAltName(&dns_names, nullptr));
  132. ASSERT_EQ(2U, dns_names.size());
  133. EXPECT_EQ("*.webkit.org", dns_names[0]);
  134. EXPECT_EQ("webkit.org", dns_names[1]);
  135. // Test that the wildcard cert matches properly.
  136. EXPECT_TRUE(webkit_cert->VerifyNameMatch("www.webkit.org"));
  137. EXPECT_TRUE(webkit_cert->VerifyNameMatch("foo.webkit.org"));
  138. EXPECT_TRUE(webkit_cert->VerifyNameMatch("webkit.org"));
  139. EXPECT_FALSE(webkit_cert->VerifyNameMatch("www.webkit.com"));
  140. EXPECT_FALSE(webkit_cert->VerifyNameMatch("www.foo.webkit.com"));
  141. }
  142. TEST(X509CertificateTest, ThawteCertParsing) {
  143. scoped_refptr<X509Certificate> thawte_cert(
  144. X509Certificate::CreateFromBytes(thawte_der));
  145. ASSERT_NE(static_cast<X509Certificate*>(nullptr), thawte_cert.get());
  146. const CertPrincipal& subject = thawte_cert->subject();
  147. EXPECT_EQ("www.thawte.com", subject.common_name);
  148. EXPECT_EQ("Mountain View", subject.locality_name);
  149. EXPECT_EQ("California", subject.state_or_province_name);
  150. EXPECT_EQ("US", subject.country_name);
  151. EXPECT_EQ(0U, subject.street_addresses.size());
  152. ASSERT_EQ(1U, subject.organization_names.size());
  153. EXPECT_EQ("Thawte Inc", subject.organization_names[0]);
  154. EXPECT_EQ(0U, subject.organization_unit_names.size());
  155. EXPECT_EQ(0U, subject.domain_components.size());
  156. const CertPrincipal& issuer = thawte_cert->issuer();
  157. EXPECT_EQ("thawte Extended Validation SSL CA", issuer.common_name);
  158. EXPECT_EQ("", issuer.locality_name);
  159. EXPECT_EQ("", issuer.state_or_province_name);
  160. EXPECT_EQ("US", issuer.country_name);
  161. EXPECT_EQ(0U, issuer.street_addresses.size());
  162. ASSERT_EQ(1U, issuer.organization_names.size());
  163. EXPECT_EQ("thawte, Inc.", issuer.organization_names[0]);
  164. ASSERT_EQ(1U, issuer.organization_unit_names.size());
  165. EXPECT_EQ("Terms of use at https://www.thawte.com/cps (c)06",
  166. issuer.organization_unit_names[0]);
  167. EXPECT_EQ(0U, issuer.domain_components.size());
  168. // Use DoubleT because its epoch is the same on all platforms
  169. const Time& valid_start = thawte_cert->valid_start();
  170. EXPECT_EQ(1227052800, valid_start.ToDoubleT()); // Nov 19 00:00:00 2008 GMT
  171. const Time& valid_expiry = thawte_cert->valid_expiry();
  172. EXPECT_EQ(1263772799, valid_expiry.ToDoubleT()); // Jan 17 23:59:59 2010 GMT
  173. }
  174. // Test that all desired AttributeAndValue pairs can be extracted when only
  175. // a single RelativeDistinguishedName is present. "Normally" there is only
  176. // one AVA per RDN, but some CAs place all AVAs within a single RDN.
  177. // This is a regression test for http://crbug.com/101009
  178. TEST(X509CertificateTest, MultivalueRDN) {
  179. base::FilePath certs_dir = GetTestCertsDirectory();
  180. scoped_refptr<X509Certificate> multivalue_rdn_cert =
  181. ImportCertFromFile(certs_dir, "multivalue_rdn.pem");
  182. ASSERT_NE(static_cast<X509Certificate*>(nullptr), multivalue_rdn_cert.get());
  183. const CertPrincipal& subject = multivalue_rdn_cert->subject();
  184. EXPECT_EQ("Multivalue RDN Test", subject.common_name);
  185. EXPECT_EQ("", subject.locality_name);
  186. EXPECT_EQ("", subject.state_or_province_name);
  187. EXPECT_EQ("US", subject.country_name);
  188. EXPECT_EQ(0U, subject.street_addresses.size());
  189. ASSERT_EQ(1U, subject.organization_names.size());
  190. EXPECT_EQ("Chromium", subject.organization_names[0]);
  191. ASSERT_EQ(1U, subject.organization_unit_names.size());
  192. EXPECT_EQ("Chromium net_unittests", subject.organization_unit_names[0]);
  193. ASSERT_EQ(1U, subject.domain_components.size());
  194. EXPECT_EQ("Chromium", subject.domain_components[0]);
  195. }
  196. // Test that characters which would normally be escaped in the string form,
  197. // such as '=' or '"', are not escaped when parsed as individual components.
  198. // This is a regression test for http://crbug.com/102839
  199. TEST(X509CertificateTest, UnescapedSpecialCharacters) {
  200. base::FilePath certs_dir = GetTestCertsDirectory();
  201. scoped_refptr<X509Certificate> unescaped_cert =
  202. ImportCertFromFile(certs_dir, "unescaped.pem");
  203. ASSERT_NE(static_cast<X509Certificate*>(nullptr), unescaped_cert.get());
  204. const CertPrincipal& subject = unescaped_cert->subject();
  205. EXPECT_EQ("127.0.0.1", subject.common_name);
  206. EXPECT_EQ("Mountain View", subject.locality_name);
  207. EXPECT_EQ("California", subject.state_or_province_name);
  208. EXPECT_EQ("US", subject.country_name);
  209. ASSERT_EQ(1U, subject.street_addresses.size());
  210. EXPECT_EQ("1600 Amphitheatre Parkway", subject.street_addresses[0]);
  211. ASSERT_EQ(1U, subject.organization_names.size());
  212. EXPECT_EQ("Chromium = \"net_unittests\"", subject.organization_names[0]);
  213. ASSERT_EQ(2U, subject.organization_unit_names.size());
  214. EXPECT_EQ("net_unittests", subject.organization_unit_names[0]);
  215. EXPECT_EQ("Chromium", subject.organization_unit_names[1]);
  216. EXPECT_EQ(0U, subject.domain_components.size());
  217. }
  218. TEST(X509CertificateTest, InvalidPrintableStringIsUtf8) {
  219. base::FilePath certs_dir =
  220. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  221. std::string file_data;
  222. ASSERT_TRUE(base::ReadFileToString(
  223. certs_dir.AppendASCII(
  224. "subject_printable_string_containing_utf8_client_cert.pem"),
  225. &file_data));
  226. net::PEMTokenizer pem_tokenizer(file_data, {"CERTIFICATE"});
  227. ASSERT_TRUE(pem_tokenizer.GetNext());
  228. std::string cert_der(pem_tokenizer.data());
  229. ASSERT_FALSE(pem_tokenizer.GetNext());
  230. bssl::UniquePtr<CRYPTO_BUFFER> cert_handle =
  231. x509_util::CreateCryptoBuffer(cert_der);
  232. ASSERT_TRUE(cert_handle);
  233. EXPECT_FALSE(
  234. X509Certificate::CreateFromBuffer(bssl::UpRef(cert_handle.get()), {}));
  235. X509Certificate::UnsafeCreateOptions options;
  236. options.printable_string_is_utf8 = true;
  237. scoped_refptr<X509Certificate> cert =
  238. X509Certificate::CreateFromBufferUnsafeOptions(
  239. bssl::UpRef(cert_handle.get()), {}, options);
  240. const CertPrincipal& subject = cert->subject();
  241. EXPECT_EQ("Foo@#_ Clïênt Cërt", subject.common_name);
  242. }
  243. TEST(X509CertificateTest, TeletexStringIsLatin1) {
  244. base::FilePath certs_dir =
  245. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  246. scoped_refptr<X509Certificate> cert =
  247. ImportCertFromFile(certs_dir, "subject_t61string.pem");
  248. ASSERT_TRUE(cert);
  249. const CertPrincipal& subject = cert->subject();
  250. EXPECT_EQ(
  251. " !\"#$%&'()*+,-./"
  252. "0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`"
  253. "abcdefghijklmnopqrstuvwxyz{|}~"
  254. " ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæç"
  255. "èéêëìíîïðñòóôõö÷øùúûüýþÿ",
  256. subject.organization_names[0]);
  257. }
  258. TEST(X509CertificateTest, TeletexStringControlChars) {
  259. base::FilePath certs_dir =
  260. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  261. scoped_refptr<X509Certificate> cert =
  262. ImportCertFromFile(certs_dir, "subject_t61string_1-32.pem");
  263. ASSERT_TRUE(cert);
  264. const CertPrincipal& subject = cert->subject();
  265. EXPECT_EQ(
  266. "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12"
  267. "\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20",
  268. subject.organization_names[0]);
  269. }
  270. TEST(X509CertificateTest, TeletexStringIsLatin1NotCp1252) {
  271. base::FilePath certs_dir =
  272. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  273. scoped_refptr<X509Certificate> cert =
  274. ImportCertFromFile(certs_dir, "subject_t61string_126-160.pem");
  275. ASSERT_TRUE(cert);
  276. const CertPrincipal& subject = cert->subject();
  277. // TeletexString is decoded as latin1, so 127-160 get decoded to equivalent
  278. // unicode control chars.
  279. EXPECT_EQ(
  280. "~\x7F\xC2\x80\xC2\x81\xC2\x82\xC2\x83\xC2\x84\xC2\x85\xC2\x86\xC2\x87"
  281. "\xC2\x88\xC2\x89\xC2\x8A\xC2\x8B\xC2\x8C\xC2\x8D\xC2\x8E\xC2\x8F\xC2\x90"
  282. "\xC2\x91\xC2\x92\xC2\x93\xC2\x94\xC2\x95\xC2\x96\xC2\x97\xC2\x98\xC2\x99"
  283. "\xC2\x9A\xC2\x9B\xC2\x9C\xC2\x9D\xC2\x9E\xC2\x9F\xC2\xA0",
  284. subject.organization_names[0]);
  285. }
  286. TEST(X509CertificateTest, TeletexStringIsNotARealT61String) {
  287. base::FilePath certs_dir =
  288. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  289. scoped_refptr<X509Certificate> cert =
  290. ImportCertFromFile(certs_dir, "subject_t61string_actual.pem");
  291. ASSERT_TRUE(cert);
  292. const CertPrincipal& subject = cert->subject();
  293. // If TeletexStrings were actually parsed according to T.61, this would be
  294. // "あ". (Probably. Not verified against a real implementation.)
  295. EXPECT_EQ("\x1B$@$\"", subject.organization_names[0]);
  296. }
  297. TEST(X509CertificateTest, SerialNumbers) {
  298. scoped_refptr<X509Certificate> google_cert(
  299. X509Certificate::CreateFromBytes(google_der));
  300. ASSERT_TRUE(google_cert);
  301. static const uint8_t google_serial[16] = {
  302. 0x01,0x2a,0x39,0x76,0x0d,0x3f,0x4f,0xc9,
  303. 0x0b,0xe7,0xbd,0x2b,0xcf,0x95,0x2e,0x7a,
  304. };
  305. ASSERT_EQ(sizeof(google_serial), google_cert->serial_number().size());
  306. EXPECT_TRUE(memcmp(google_cert->serial_number().data(), google_serial,
  307. sizeof(google_serial)) == 0);
  308. }
  309. TEST(X509CertificateTest, SerialNumberZeroPadded) {
  310. base::FilePath certs_dir =
  311. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  312. scoped_refptr<X509Certificate> cert =
  313. ImportCertFromFile(certs_dir, "serial_zero_padded.pem");
  314. ASSERT_TRUE(cert);
  315. // Check a serial number where the first byte is >= 0x80, the DER returned by
  316. // serial() should contain the leading 0 padding byte.
  317. static const uint8_t expected_serial[3] = {0x00, 0x80, 0x01};
  318. ASSERT_EQ(sizeof(expected_serial), cert->serial_number().size());
  319. EXPECT_TRUE(memcmp(cert->serial_number().data(), expected_serial,
  320. sizeof(expected_serial)) == 0);
  321. }
  322. TEST(X509CertificateTest, SerialNumberZeroPadded21BytesLong) {
  323. base::FilePath certs_dir =
  324. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  325. scoped_refptr<X509Certificate> cert =
  326. ImportCertFromFile(certs_dir, "serial_zero_padded_21_bytes.pem");
  327. ASSERT_TRUE(cert);
  328. // Check a serial number where the first byte is >= 0x80, causing the encoded
  329. // length to be 21 bytes long. This should be an error, but serial number
  330. // parsing is currently permissive.
  331. static const uint8_t expected_serial[21] = {
  332. 0x00, 0x80, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
  333. 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13};
  334. ASSERT_EQ(sizeof(expected_serial), cert->serial_number().size());
  335. EXPECT_TRUE(memcmp(cert->serial_number().data(), expected_serial,
  336. sizeof(expected_serial)) == 0);
  337. }
  338. TEST(X509CertificateTest, SerialNumberNegative) {
  339. base::FilePath certs_dir =
  340. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  341. scoped_refptr<X509Certificate> cert =
  342. ImportCertFromFile(certs_dir, "serial_negative.pem");
  343. ASSERT_TRUE(cert);
  344. // RFC 5280 does not allow serial numbers to be negative, but serial number
  345. // parsing is currently permissive, so this does not cause an error.
  346. static const uint8_t expected_serial[2] = {0x80, 0x01};
  347. ASSERT_EQ(sizeof(expected_serial), cert->serial_number().size());
  348. EXPECT_TRUE(memcmp(cert->serial_number().data(), expected_serial,
  349. sizeof(expected_serial)) == 0);
  350. }
  351. TEST(X509CertificateTest, SerialNumber37BytesLong) {
  352. base::FilePath certs_dir =
  353. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  354. scoped_refptr<X509Certificate> cert =
  355. ImportCertFromFile(certs_dir, "serial_37_bytes.pem");
  356. ASSERT_TRUE(cert);
  357. // Check a serial number which is very long. This should be an error, but
  358. // serial number parsing is currently permissive.
  359. static const uint8_t expected_serial[37] = {
  360. 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
  361. 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14,
  362. 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e,
  363. 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25};
  364. ASSERT_EQ(sizeof(expected_serial), cert->serial_number().size());
  365. EXPECT_TRUE(memcmp(cert->serial_number().data(), expected_serial,
  366. sizeof(expected_serial)) == 0);
  367. }
  368. TEST(X509CertificateTest, SHA256FingerprintsCorrectly) {
  369. scoped_refptr<X509Certificate> google_cert(
  370. X509Certificate::CreateFromBytes(google_der));
  371. ASSERT_TRUE(google_cert);
  372. const SHA256HashValue google_sha256_fingerprint = {
  373. {0x21, 0xaf, 0x58, 0x74, 0xea, 0x6b, 0xad, 0xbd, 0xe4, 0xb3, 0xb1,
  374. 0xaa, 0x53, 0x32, 0x80, 0x8f, 0xbf, 0x8a, 0x24, 0x7d, 0x98, 0xec,
  375. 0x7f, 0x77, 0x49, 0x38, 0x42, 0x81, 0x26, 0x7f, 0xed, 0x38}};
  376. EXPECT_EQ(google_sha256_fingerprint, X509Certificate::CalculateFingerprint256(
  377. google_cert->cert_buffer()));
  378. }
  379. TEST(X509CertificateTest, CAFingerprints) {
  380. base::FilePath certs_dir = GetTestCertsDirectory();
  381. scoped_refptr<X509Certificate> server_cert =
  382. ImportCertFromFile(certs_dir, "salesforce_com_test.pem");
  383. ASSERT_NE(static_cast<X509Certificate*>(nullptr), server_cert.get());
  384. scoped_refptr<X509Certificate> intermediate_cert1 =
  385. ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2011.pem");
  386. ASSERT_NE(static_cast<X509Certificate*>(nullptr), intermediate_cert1.get());
  387. scoped_refptr<X509Certificate> intermediate_cert2 =
  388. ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2016.pem");
  389. ASSERT_NE(static_cast<X509Certificate*>(nullptr), intermediate_cert2.get());
  390. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
  391. intermediates.push_back(bssl::UpRef(intermediate_cert1->cert_buffer()));
  392. scoped_refptr<X509Certificate> cert_chain1 =
  393. X509Certificate::CreateFromBuffer(bssl::UpRef(server_cert->cert_buffer()),
  394. std::move(intermediates));
  395. ASSERT_TRUE(cert_chain1);
  396. intermediates.clear();
  397. intermediates.push_back(bssl::UpRef(intermediate_cert2->cert_buffer()));
  398. scoped_refptr<X509Certificate> cert_chain2 =
  399. X509Certificate::CreateFromBuffer(bssl::UpRef(server_cert->cert_buffer()),
  400. std::move(intermediates));
  401. ASSERT_TRUE(cert_chain2);
  402. // No intermediate CA certicates.
  403. intermediates.clear();
  404. scoped_refptr<X509Certificate> cert_chain3 =
  405. X509Certificate::CreateFromBuffer(bssl::UpRef(server_cert->cert_buffer()),
  406. std::move(intermediates));
  407. ASSERT_TRUE(cert_chain3);
  408. SHA256HashValue cert_chain1_chain_fingerprint_256 = {
  409. {0xac, 0xff, 0xcc, 0x63, 0x0d, 0xd0, 0xa7, 0x19, 0x78, 0xb5, 0x8a,
  410. 0x47, 0x8b, 0x67, 0x97, 0xcb, 0x8d, 0xe1, 0x6a, 0x8a, 0x57, 0x70,
  411. 0xda, 0x9a, 0x53, 0x72, 0xe2, 0xa0, 0x08, 0xab, 0xcc, 0x8f}};
  412. SHA256HashValue cert_chain2_chain_fingerprint_256 = {
  413. {0x67, 0x3a, 0x11, 0x20, 0xd6, 0x94, 0x14, 0xe4, 0x16, 0x9f, 0x58,
  414. 0xe2, 0x8b, 0xf7, 0x27, 0xed, 0xbb, 0xe8, 0xa7, 0xff, 0x1c, 0x8c,
  415. 0x0f, 0x21, 0x38, 0x16, 0x7c, 0xad, 0x1f, 0x22, 0x6f, 0x9b}};
  416. SHA256HashValue cert_chain3_chain_fingerprint_256 = {
  417. {0x16, 0x7a, 0xbd, 0xb4, 0x57, 0x04, 0x65, 0x3c, 0x3b, 0xef, 0x6e,
  418. 0x6a, 0xa6, 0x02, 0x73, 0x30, 0x3e, 0x34, 0x1b, 0x43, 0xc2, 0x7c,
  419. 0x98, 0x52, 0x9f, 0x34, 0x7f, 0x55, 0x97, 0xe9, 0x1a, 0x10}};
  420. EXPECT_EQ(cert_chain1_chain_fingerprint_256,
  421. cert_chain1->CalculateChainFingerprint256());
  422. EXPECT_EQ(cert_chain2_chain_fingerprint_256,
  423. cert_chain2->CalculateChainFingerprint256());
  424. EXPECT_EQ(cert_chain3_chain_fingerprint_256,
  425. cert_chain3->CalculateChainFingerprint256());
  426. }
  427. TEST(X509CertificateTest, ParseSubjectAltNames) {
  428. base::FilePath certs_dir = GetTestCertsDirectory();
  429. scoped_refptr<X509Certificate> san_cert =
  430. ImportCertFromFile(certs_dir, "subjectAltName_sanity_check.pem");
  431. ASSERT_NE(static_cast<X509Certificate*>(nullptr), san_cert.get());
  432. // Ensure that testing for SAN without using it is accepted.
  433. EXPECT_TRUE(san_cert->GetSubjectAltName(nullptr, nullptr));
  434. // Ensure that it's possible to get just dNSNames.
  435. std::vector<std::string> dns_names;
  436. EXPECT_TRUE(san_cert->GetSubjectAltName(&dns_names, nullptr));
  437. // Ensure that it's possible to get just iPAddresses.
  438. std::vector<std::string> ip_addresses;
  439. EXPECT_TRUE(san_cert->GetSubjectAltName(nullptr, &ip_addresses));
  440. // Ensure that DNS names are correctly parsed.
  441. ASSERT_EQ(1U, dns_names.size());
  442. EXPECT_EQ("test.example", dns_names[0]);
  443. // Ensure that both IPv4 and IPv6 addresses are correctly parsed.
  444. ASSERT_EQ(2U, ip_addresses.size());
  445. static const uint8_t kIPv4Address[] = {
  446. 0x7F, 0x00, 0x00, 0x02
  447. };
  448. ASSERT_EQ(std::size(kIPv4Address), ip_addresses[0].size());
  449. EXPECT_EQ(
  450. 0, memcmp(ip_addresses[0].data(), kIPv4Address, std::size(kIPv4Address)));
  451. static const uint8_t kIPv6Address[] = {
  452. 0xFE, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  453. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
  454. };
  455. ASSERT_EQ(std::size(kIPv6Address), ip_addresses[1].size());
  456. EXPECT_EQ(
  457. 0, memcmp(ip_addresses[1].data(), kIPv6Address, std::size(kIPv6Address)));
  458. // Ensure the subjectAltName dirName has not influenced the handling of
  459. // the subject commonName.
  460. EXPECT_EQ("127.0.0.1", san_cert->subject().common_name);
  461. scoped_refptr<X509Certificate> no_san_cert =
  462. ImportCertFromFile(certs_dir, "salesforce_com_test.pem");
  463. ASSERT_NE(static_cast<X509Certificate*>(nullptr), no_san_cert.get());
  464. EXPECT_NE(0u, dns_names.size());
  465. EXPECT_NE(0u, ip_addresses.size());
  466. EXPECT_FALSE(no_san_cert->GetSubjectAltName(&dns_names, &ip_addresses));
  467. EXPECT_EQ(0u, dns_names.size());
  468. EXPECT_EQ(0u, ip_addresses.size());
  469. }
  470. TEST(X509CertificateTest, ExtractSPKIFromDERCert) {
  471. base::FilePath certs_dir = GetTestCertsDirectory();
  472. scoped_refptr<X509Certificate> cert =
  473. ImportCertFromFile(certs_dir, "nist.der");
  474. ASSERT_NE(static_cast<X509Certificate*>(nullptr), cert.get());
  475. base::StringPiece spkiBytes;
  476. EXPECT_TRUE(asn1::ExtractSPKIFromDERCert(
  477. x509_util::CryptoBufferAsStringPiece(cert->cert_buffer()), &spkiBytes));
  478. uint8_t hash[base::kSHA1Length];
  479. base::SHA1HashBytes(reinterpret_cast<const uint8_t*>(spkiBytes.data()),
  480. spkiBytes.size(), hash);
  481. EXPECT_EQ(0, memcmp(hash, kNistSPKIHash, sizeof(hash)));
  482. }
  483. TEST(X509CertificateTest, HasCanSignHttpExchangesDraftExtension) {
  484. base::FilePath certs_dir = GetTestCertsDirectory();
  485. scoped_refptr<X509Certificate> cert = ImportCertFromFile(
  486. certs_dir, "can_sign_http_exchanges_draft_extension.pem");
  487. ASSERT_NE(static_cast<X509Certificate*>(nullptr), cert.get());
  488. EXPECT_TRUE(asn1::HasCanSignHttpExchangesDraftExtension(
  489. x509_util::CryptoBufferAsStringPiece(cert->cert_buffer())));
  490. }
  491. TEST(X509CertificateTest, HasCanSignHttpExchangesDraftExtensionInvalid) {
  492. base::FilePath certs_dir = GetTestCertsDirectory();
  493. scoped_refptr<X509Certificate> cert = ImportCertFromFile(
  494. certs_dir, "can_sign_http_exchanges_draft_extension_invalid.pem");
  495. ASSERT_NE(static_cast<X509Certificate*>(nullptr), cert.get());
  496. EXPECT_FALSE(asn1::HasCanSignHttpExchangesDraftExtension(
  497. x509_util::CryptoBufferAsStringPiece(cert->cert_buffer())));
  498. }
  499. TEST(X509CertificateTest, DoesNotHaveCanSignHttpExchangesDraftExtension) {
  500. base::FilePath certs_dir = GetTestCertsDirectory();
  501. scoped_refptr<X509Certificate> cert =
  502. ImportCertFromFile(certs_dir, "ok_cert.pem");
  503. ASSERT_NE(static_cast<X509Certificate*>(nullptr), cert.get());
  504. EXPECT_FALSE(asn1::HasCanSignHttpExchangesDraftExtension(
  505. x509_util::CryptoBufferAsStringPiece(cert->cert_buffer())));
  506. }
  507. TEST(X509CertificateTest, ExtractExtension) {
  508. base::FilePath certs_dir = GetTestCertsDirectory();
  509. scoped_refptr<X509Certificate> cert =
  510. ImportCertFromFile(certs_dir, "ok_cert.pem");
  511. ASSERT_TRUE(cert);
  512. bool present, critical;
  513. base::StringPiece contents;
  514. ASSERT_TRUE(asn1::ExtractExtensionFromDERCert(
  515. x509_util::CryptoBufferAsStringPiece(cert->cert_buffer()),
  516. der::Input(kBasicConstraintsOid).AsStringPiece(), &present, &critical,
  517. &contents));
  518. EXPECT_TRUE(present);
  519. EXPECT_TRUE(critical);
  520. ASSERT_EQ(base::StringPiece("\x30\x00", 2), contents);
  521. static constexpr uint8_t kNonsenseOID[] = {0x56, 0x1d, 0x13};
  522. ASSERT_TRUE(asn1::ExtractExtensionFromDERCert(
  523. x509_util::CryptoBufferAsStringPiece(cert->cert_buffer()),
  524. base::StringPiece(reinterpret_cast<const char*>(kNonsenseOID),
  525. sizeof(kNonsenseOID)),
  526. &present, &critical, &contents));
  527. ASSERT_FALSE(present);
  528. scoped_refptr<X509Certificate> uid_cert =
  529. ImportCertFromFile(certs_dir, "ct-test-embedded-with-uids.pem");
  530. ASSERT_TRUE(uid_cert);
  531. ASSERT_TRUE(asn1::ExtractExtensionFromDERCert(
  532. x509_util::CryptoBufferAsStringPiece(uid_cert->cert_buffer()),
  533. der::Input(kBasicConstraintsOid).AsStringPiece(), &present, &critical,
  534. &contents));
  535. EXPECT_TRUE(present);
  536. EXPECT_FALSE(critical);
  537. ASSERT_EQ(base::StringPiece("\x30\x00", 2), contents);
  538. }
  539. // Tests CRYPTO_BUFFER deduping via X509Certificate::CreateFromBuffer. We
  540. // call X509Certificate::CreateFromBuffer several times and observe whether
  541. // it returns a cached or new CRYPTO_BUFFER.
  542. TEST(X509CertificateTest, Cache) {
  543. bssl::UniquePtr<CRYPTO_BUFFER> google_cert_handle;
  544. bssl::UniquePtr<CRYPTO_BUFFER> thawte_cert_handle;
  545. // Add a single certificate to the certificate cache.
  546. google_cert_handle = X509Certificate::CreateCertBufferFromBytes(google_der);
  547. ASSERT_TRUE(google_cert_handle);
  548. scoped_refptr<X509Certificate> cert1(
  549. X509Certificate::CreateFromBuffer(std::move(google_cert_handle), {}));
  550. ASSERT_TRUE(cert1);
  551. // Add the same certificate, but as a new handle.
  552. google_cert_handle = X509Certificate::CreateCertBufferFromBytes(google_der);
  553. ASSERT_TRUE(google_cert_handle);
  554. scoped_refptr<X509Certificate> cert2(
  555. X509Certificate::CreateFromBuffer(std::move(google_cert_handle), {}));
  556. ASSERT_TRUE(cert2);
  557. // A new X509Certificate should be returned.
  558. EXPECT_NE(cert1.get(), cert2.get());
  559. // But both instances should share the underlying OS certificate handle.
  560. EXPECT_EQ(cert1->cert_buffer(), cert2->cert_buffer());
  561. EXPECT_EQ(0u, cert1->intermediate_buffers().size());
  562. EXPECT_EQ(0u, cert2->intermediate_buffers().size());
  563. // Add the same certificate, but this time with an intermediate. This
  564. // should result in the intermediate being cached. Note that this is not
  565. // a legitimate chain, but is suitable for testing.
  566. google_cert_handle = X509Certificate::CreateCertBufferFromBytes(google_der);
  567. thawte_cert_handle = X509Certificate::CreateCertBufferFromBytes(thawte_der);
  568. ASSERT_TRUE(google_cert_handle);
  569. ASSERT_TRUE(thawte_cert_handle);
  570. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
  571. intermediates.push_back(std::move(thawte_cert_handle));
  572. scoped_refptr<X509Certificate> cert3(X509Certificate::CreateFromBuffer(
  573. std::move(google_cert_handle), std::move(intermediates)));
  574. ASSERT_TRUE(cert3);
  575. // Test that the new certificate, even with intermediates, results in the
  576. // same underlying handle being used.
  577. EXPECT_EQ(cert1->cert_buffer(), cert3->cert_buffer());
  578. // Though they use the same OS handle, the intermediates should be different.
  579. EXPECT_NE(cert1->intermediate_buffers().size(),
  580. cert3->intermediate_buffers().size());
  581. }
  582. TEST(X509CertificateTest, Pickle) {
  583. bssl::UniquePtr<CRYPTO_BUFFER> google_cert_handle =
  584. X509Certificate::CreateCertBufferFromBytes(google_der);
  585. ASSERT_TRUE(google_cert_handle);
  586. bssl::UniquePtr<CRYPTO_BUFFER> thawte_cert_handle =
  587. X509Certificate::CreateCertBufferFromBytes(thawte_der);
  588. ASSERT_TRUE(thawte_cert_handle);
  589. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
  590. intermediates.push_back(std::move(thawte_cert_handle));
  591. scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromBuffer(
  592. std::move(google_cert_handle), std::move(intermediates));
  593. ASSERT_TRUE(cert);
  594. base::Pickle pickle;
  595. cert->Persist(&pickle);
  596. base::PickleIterator iter(pickle);
  597. scoped_refptr<X509Certificate> cert_from_pickle =
  598. X509Certificate::CreateFromPickle(&iter);
  599. ASSERT_TRUE(cert_from_pickle);
  600. EXPECT_TRUE(x509_util::CryptoBufferEqual(cert->cert_buffer(),
  601. cert_from_pickle->cert_buffer()));
  602. const auto& cert_intermediates = cert->intermediate_buffers();
  603. const auto& pickle_intermediates = cert_from_pickle->intermediate_buffers();
  604. ASSERT_EQ(cert_intermediates.size(), pickle_intermediates.size());
  605. for (size_t i = 0; i < cert_intermediates.size(); ++i) {
  606. EXPECT_TRUE(x509_util::CryptoBufferEqual(cert_intermediates[i].get(),
  607. pickle_intermediates[i].get()));
  608. }
  609. }
  610. TEST(X509CertificateTest, IntermediateCertificates) {
  611. scoped_refptr<X509Certificate> webkit_cert(
  612. X509Certificate::CreateFromBytes(webkit_der));
  613. ASSERT_TRUE(webkit_cert);
  614. scoped_refptr<X509Certificate> thawte_cert(
  615. X509Certificate::CreateFromBytes(thawte_der));
  616. ASSERT_TRUE(thawte_cert);
  617. bssl::UniquePtr<CRYPTO_BUFFER> google_handle;
  618. // Create object with no intermediates:
  619. google_handle = X509Certificate::CreateCertBufferFromBytes(google_der);
  620. scoped_refptr<X509Certificate> cert1;
  621. cert1 =
  622. X509Certificate::CreateFromBuffer(bssl::UpRef(google_handle.get()), {});
  623. ASSERT_TRUE(cert1);
  624. EXPECT_EQ(0u, cert1->intermediate_buffers().size());
  625. // Create object with 2 intermediates:
  626. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates2;
  627. intermediates2.push_back(bssl::UpRef(webkit_cert->cert_buffer()));
  628. intermediates2.push_back(bssl::UpRef(thawte_cert->cert_buffer()));
  629. scoped_refptr<X509Certificate> cert2 = X509Certificate::CreateFromBuffer(
  630. std::move(google_handle), std::move(intermediates2));
  631. ASSERT_TRUE(cert2);
  632. // Verify it has all the intermediates:
  633. const auto& cert2_intermediates = cert2->intermediate_buffers();
  634. ASSERT_EQ(2u, cert2_intermediates.size());
  635. EXPECT_TRUE(x509_util::CryptoBufferEqual(cert2_intermediates[0].get(),
  636. webkit_cert->cert_buffer()));
  637. EXPECT_TRUE(x509_util::CryptoBufferEqual(cert2_intermediates[1].get(),
  638. thawte_cert->cert_buffer()));
  639. }
  640. TEST(X509CertificateTest, Equals) {
  641. CertificateList certs = CreateCertificateListFromFile(
  642. GetTestCertsDirectory(), "multi-root-chain1.pem",
  643. X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
  644. ASSERT_EQ(4u, certs.size());
  645. // Comparing X509Certificates with no intermediates.
  646. EXPECT_TRUE(certs[0]->EqualsExcludingChain(certs[0].get()));
  647. EXPECT_FALSE(certs[1]->EqualsExcludingChain(certs[0].get()));
  648. EXPECT_FALSE(certs[0]->EqualsExcludingChain(certs[1].get()));
  649. EXPECT_TRUE(certs[0]->EqualsIncludingChain(certs[0].get()));
  650. EXPECT_FALSE(certs[1]->EqualsIncludingChain(certs[0].get()));
  651. EXPECT_FALSE(certs[0]->EqualsIncludingChain(certs[1].get()));
  652. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates1;
  653. intermediates1.push_back(bssl::UpRef(certs[1]->cert_buffer()));
  654. scoped_refptr<X509Certificate> cert0_with_intermediate =
  655. X509Certificate::CreateFromBuffer(bssl::UpRef(certs[0]->cert_buffer()),
  656. std::move(intermediates1));
  657. ASSERT_TRUE(cert0_with_intermediate);
  658. // Comparing X509Certificate with one intermediate to X509Certificate with no
  659. // intermediates.
  660. EXPECT_TRUE(certs[0]->EqualsExcludingChain(cert0_with_intermediate.get()));
  661. EXPECT_TRUE(cert0_with_intermediate->EqualsExcludingChain(certs[0].get()));
  662. EXPECT_FALSE(certs[0]->EqualsIncludingChain(cert0_with_intermediate.get()));
  663. EXPECT_FALSE(cert0_with_intermediate->EqualsIncludingChain(certs[0].get()));
  664. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates2;
  665. intermediates2.push_back(bssl::UpRef(certs[2]->cert_buffer()));
  666. scoped_refptr<X509Certificate> cert0_with_intermediate2 =
  667. X509Certificate::CreateFromBuffer(bssl::UpRef(certs[0]->cert_buffer()),
  668. std::move(intermediates2));
  669. ASSERT_TRUE(cert0_with_intermediate2);
  670. // Comparing X509Certificate with one intermediate to X509Certificate with
  671. // one different intermediate.
  672. EXPECT_TRUE(cert0_with_intermediate2->EqualsExcludingChain(
  673. cert0_with_intermediate.get()));
  674. EXPECT_TRUE(cert0_with_intermediate->EqualsExcludingChain(
  675. cert0_with_intermediate2.get()));
  676. EXPECT_FALSE(cert0_with_intermediate2->EqualsIncludingChain(
  677. cert0_with_intermediate.get()));
  678. EXPECT_FALSE(cert0_with_intermediate->EqualsIncludingChain(
  679. cert0_with_intermediate2.get()));
  680. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates12;
  681. intermediates12.push_back(bssl::UpRef(certs[1]->cert_buffer()));
  682. intermediates12.push_back(bssl::UpRef(certs[2]->cert_buffer()));
  683. scoped_refptr<X509Certificate> cert0_with_intermediates12 =
  684. X509Certificate::CreateFromBuffer(bssl::UpRef(certs[0]->cert_buffer()),
  685. std::move(intermediates12));
  686. ASSERT_TRUE(cert0_with_intermediates12);
  687. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates21;
  688. intermediates21.push_back(bssl::UpRef(certs[2]->cert_buffer()));
  689. intermediates21.push_back(bssl::UpRef(certs[1]->cert_buffer()));
  690. scoped_refptr<X509Certificate> cert0_with_intermediates21 =
  691. X509Certificate::CreateFromBuffer(bssl::UpRef(certs[0]->cert_buffer()),
  692. std::move(intermediates21));
  693. ASSERT_TRUE(cert0_with_intermediates21);
  694. // Comparing X509Certificate with two intermediates to X509Certificate with
  695. // same two intermediates but in reverse order
  696. EXPECT_TRUE(cert0_with_intermediates21->EqualsExcludingChain(
  697. cert0_with_intermediates12.get()));
  698. EXPECT_TRUE(cert0_with_intermediates12->EqualsExcludingChain(
  699. cert0_with_intermediates21.get()));
  700. EXPECT_FALSE(cert0_with_intermediates21->EqualsIncludingChain(
  701. cert0_with_intermediates12.get()));
  702. EXPECT_FALSE(cert0_with_intermediates12->EqualsIncludingChain(
  703. cert0_with_intermediates21.get()));
  704. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates12b;
  705. intermediates12b.push_back(bssl::UpRef(certs[1]->cert_buffer()));
  706. intermediates12b.push_back(bssl::UpRef(certs[2]->cert_buffer()));
  707. scoped_refptr<X509Certificate> cert0_with_intermediates12b =
  708. X509Certificate::CreateFromBuffer(bssl::UpRef(certs[0]->cert_buffer()),
  709. std::move(intermediates12b));
  710. ASSERT_TRUE(cert0_with_intermediates12b);
  711. // Comparing X509Certificate with two intermediates to X509Certificate with
  712. // same two intermediates in same order.
  713. EXPECT_TRUE(cert0_with_intermediates12->EqualsExcludingChain(
  714. cert0_with_intermediates12b.get()));
  715. EXPECT_TRUE(cert0_with_intermediates12b->EqualsExcludingChain(
  716. cert0_with_intermediates12.get()));
  717. EXPECT_TRUE(cert0_with_intermediates12->EqualsIncludingChain(
  718. cert0_with_intermediates12b.get()));
  719. EXPECT_TRUE(cert0_with_intermediates12b->EqualsIncludingChain(
  720. cert0_with_intermediates12.get()));
  721. }
  722. TEST(X509CertificateTest, IsIssuedByEncoded) {
  723. base::FilePath certs_dir = GetTestCertsDirectory();
  724. // Test a client certificate from MIT.
  725. scoped_refptr<X509Certificate> mit_davidben_cert(
  726. ImportCertFromFile(certs_dir, "mit.davidben.der"));
  727. ASSERT_NE(static_cast<X509Certificate*>(nullptr), mit_davidben_cert.get());
  728. std::string mit_issuer(reinterpret_cast<const char*>(MITDN),
  729. sizeof(MITDN));
  730. // Test a certificate from Google, issued by Thawte
  731. scoped_refptr<X509Certificate> google_cert(
  732. ImportCertFromFile(certs_dir, "google.single.der"));
  733. ASSERT_NE(static_cast<X509Certificate*>(nullptr), google_cert.get());
  734. std::string thawte_issuer(reinterpret_cast<const char*>(ThawteDN),
  735. sizeof(ThawteDN));
  736. // Check that the David Ben certificate is issued by MIT, but not
  737. // by Thawte.
  738. std::vector<std::string> issuers;
  739. issuers.clear();
  740. issuers.push_back(mit_issuer);
  741. EXPECT_TRUE(mit_davidben_cert->IsIssuedByEncoded(issuers));
  742. EXPECT_FALSE(google_cert->IsIssuedByEncoded(issuers));
  743. // Check that the Google certificate is issued by Thawte and not
  744. // by MIT.
  745. issuers.clear();
  746. issuers.push_back(thawte_issuer);
  747. EXPECT_FALSE(mit_davidben_cert->IsIssuedByEncoded(issuers));
  748. EXPECT_TRUE(google_cert->IsIssuedByEncoded(issuers));
  749. // Check that they both pass when given a list of the two issuers.
  750. issuers.clear();
  751. issuers.push_back(mit_issuer);
  752. issuers.push_back(thawte_issuer);
  753. EXPECT_TRUE(mit_davidben_cert->IsIssuedByEncoded(issuers));
  754. EXPECT_TRUE(google_cert->IsIssuedByEncoded(issuers));
  755. }
  756. TEST(X509CertificateTest, IsSelfSigned) {
  757. base::FilePath certs_dir = GetTestCertsDirectory();
  758. scoped_refptr<X509Certificate> cert(
  759. ImportCertFromFile(certs_dir, "mit.davidben.der"));
  760. ASSERT_NE(static_cast<X509Certificate*>(nullptr), cert.get());
  761. EXPECT_FALSE(X509Certificate::IsSelfSigned(cert->cert_buffer()));
  762. scoped_refptr<X509Certificate> self_signed(
  763. ImportCertFromFile(certs_dir, "root_ca_cert.pem"));
  764. ASSERT_NE(static_cast<X509Certificate*>(nullptr), self_signed.get());
  765. EXPECT_TRUE(X509Certificate::IsSelfSigned(self_signed->cert_buffer()));
  766. scoped_refptr<X509Certificate> bad_name(
  767. ImportCertFromFile(certs_dir, "self-signed-invalid-name.pem"));
  768. ASSERT_NE(static_cast<X509Certificate*>(nullptr), bad_name.get());
  769. EXPECT_FALSE(X509Certificate::IsSelfSigned(bad_name->cert_buffer()));
  770. scoped_refptr<X509Certificate> bad_sig(
  771. ImportCertFromFile(certs_dir, "self-signed-invalid-sig.pem"));
  772. ASSERT_NE(static_cast<X509Certificate*>(nullptr), bad_sig.get());
  773. EXPECT_FALSE(X509Certificate::IsSelfSigned(bad_sig->cert_buffer()));
  774. }
  775. TEST(X509CertificateTest, IsIssuedByEncodedWithIntermediates) {
  776. static const unsigned char kPolicyRootDN[] = {
  777. 0x30, 0x1e, 0x31, 0x1c, 0x30, 0x1a, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c,
  778. 0x13, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x20, 0x54, 0x65, 0x73, 0x74,
  779. 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41
  780. };
  781. static const unsigned char kPolicyIntermediateDN[] = {
  782. 0x30, 0x26, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c,
  783. 0x1b, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x20, 0x54, 0x65, 0x73, 0x74,
  784. 0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x74,
  785. 0x65, 0x20, 0x43, 0x41
  786. };
  787. base::FilePath certs_dir = GetTestCertsDirectory();
  788. CertificateList policy_chain = CreateCertificateListFromFile(
  789. certs_dir, "explicit-policy-chain.pem", X509Certificate::FORMAT_AUTO);
  790. ASSERT_EQ(3u, policy_chain.size());
  791. // The intermediate CA certificate's policyConstraints extension has a
  792. // requireExplicitPolicy field with SkipCerts=0.
  793. std::string policy_intermediate_dn(
  794. reinterpret_cast<const char*>(kPolicyIntermediateDN),
  795. sizeof(kPolicyIntermediateDN));
  796. std::string policy_root_dn(reinterpret_cast<const char*>(kPolicyRootDN),
  797. sizeof(kPolicyRootDN));
  798. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
  799. intermediates.push_back(bssl::UpRef(policy_chain[1]->cert_buffer()));
  800. scoped_refptr<X509Certificate> cert_chain = X509Certificate::CreateFromBuffer(
  801. bssl::UpRef(policy_chain[0]->cert_buffer()), std::move(intermediates));
  802. ASSERT_TRUE(cert_chain);
  803. std::vector<std::string> issuers;
  804. // Check that the chain is issued by the intermediate.
  805. issuers.clear();
  806. issuers.push_back(policy_intermediate_dn);
  807. EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers));
  808. // Check that the chain is also issued by the root.
  809. issuers.clear();
  810. issuers.push_back(policy_root_dn);
  811. EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers));
  812. // Check that the chain is issued by either the intermediate or the root.
  813. issuers.clear();
  814. issuers.push_back(policy_intermediate_dn);
  815. issuers.push_back(policy_root_dn);
  816. EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers));
  817. // Check that an empty issuers list returns false.
  818. issuers.clear();
  819. EXPECT_FALSE(cert_chain->IsIssuedByEncoded(issuers));
  820. // Check that the chain is not issued by Verisign
  821. std::string mit_issuer(reinterpret_cast<const char*>(VerisignDN),
  822. sizeof(VerisignDN));
  823. issuers.clear();
  824. issuers.push_back(mit_issuer);
  825. EXPECT_FALSE(cert_chain->IsIssuedByEncoded(issuers));
  826. }
  827. const struct CertificateFormatTestData {
  828. const char* file_name;
  829. X509Certificate::Format format;
  830. SHA256HashValue* chain_fingerprints[3];
  831. } kFormatTestData[] = {
  832. // DER Parsing - single certificate, DER encoded
  833. {"google.single.der",
  834. X509Certificate::FORMAT_SINGLE_CERTIFICATE,
  835. {
  836. &google_parse_fingerprint,
  837. nullptr,
  838. }},
  839. // DER parsing - single certificate, PEM encoded
  840. {"google.single.pem",
  841. X509Certificate::FORMAT_SINGLE_CERTIFICATE,
  842. {
  843. &google_parse_fingerprint,
  844. nullptr,
  845. }},
  846. // PEM parsing - single certificate, PEM encoded with a PEB of
  847. // "CERTIFICATE"
  848. {"google.single.pem",
  849. X509Certificate::FORMAT_PEM_CERT_SEQUENCE,
  850. {
  851. &google_parse_fingerprint,
  852. nullptr,
  853. }},
  854. // PEM parsing - sequence of certificates, PEM encoded with a PEB of
  855. // "CERTIFICATE"
  856. {"google.chain.pem",
  857. X509Certificate::FORMAT_PEM_CERT_SEQUENCE,
  858. {
  859. &google_parse_fingerprint,
  860. &thawte_parse_fingerprint,
  861. nullptr,
  862. }},
  863. // PKCS#7 parsing - "degenerate" SignedData collection of certificates, DER
  864. // encoding
  865. {"google.binary.p7b",
  866. X509Certificate::FORMAT_PKCS7,
  867. {
  868. &google_parse_fingerprint,
  869. &thawte_parse_fingerprint,
  870. nullptr,
  871. }},
  872. // PKCS#7 parsing - "degenerate" SignedData collection of certificates, PEM
  873. // encoded with a PEM PEB of "CERTIFICATE"
  874. {"google.pem_cert.p7b",
  875. X509Certificate::FORMAT_PKCS7,
  876. {
  877. &google_parse_fingerprint,
  878. &thawte_parse_fingerprint,
  879. nullptr,
  880. }},
  881. // PKCS#7 parsing - "degenerate" SignedData collection of certificates, PEM
  882. // encoded with a PEM PEB of "PKCS7"
  883. {"google.pem_pkcs7.p7b",
  884. X509Certificate::FORMAT_PKCS7,
  885. {
  886. &google_parse_fingerprint,
  887. &thawte_parse_fingerprint,
  888. nullptr,
  889. }},
  890. // All of the above, this time using auto-detection
  891. {"google.single.der",
  892. X509Certificate::FORMAT_AUTO,
  893. {
  894. &google_parse_fingerprint,
  895. nullptr,
  896. }},
  897. {"google.single.pem",
  898. X509Certificate::FORMAT_AUTO,
  899. {
  900. &google_parse_fingerprint,
  901. nullptr,
  902. }},
  903. {"google.chain.pem",
  904. X509Certificate::FORMAT_AUTO,
  905. {
  906. &google_parse_fingerprint,
  907. &thawte_parse_fingerprint,
  908. nullptr,
  909. }},
  910. {"google.binary.p7b",
  911. X509Certificate::FORMAT_AUTO,
  912. {
  913. &google_parse_fingerprint,
  914. &thawte_parse_fingerprint,
  915. nullptr,
  916. }},
  917. {"google.pem_cert.p7b",
  918. X509Certificate::FORMAT_AUTO,
  919. {
  920. &google_parse_fingerprint,
  921. &thawte_parse_fingerprint,
  922. nullptr,
  923. }},
  924. {"google.pem_pkcs7.p7b",
  925. X509Certificate::FORMAT_AUTO,
  926. {
  927. &google_parse_fingerprint,
  928. &thawte_parse_fingerprint,
  929. nullptr,
  930. }},
  931. };
  932. class X509CertificateParseTest
  933. : public testing::TestWithParam<CertificateFormatTestData> {
  934. public:
  935. ~X509CertificateParseTest() override = default;
  936. void SetUp() override { test_data_ = GetParam(); }
  937. void TearDown() override {}
  938. protected:
  939. CertificateFormatTestData test_data_;
  940. };
  941. TEST_P(X509CertificateParseTest, CanParseFormat) {
  942. base::FilePath certs_dir = GetTestCertsDirectory();
  943. CertificateList certs = CreateCertificateListFromFile(
  944. certs_dir, test_data_.file_name, test_data_.format);
  945. ASSERT_FALSE(certs.empty());
  946. ASSERT_LE(certs.size(), std::size(test_data_.chain_fingerprints));
  947. CheckGoogleCert(certs.front(), google_parse_fingerprint,
  948. kGoogleParseValidFrom, kGoogleParseValidTo);
  949. for (size_t i = 0; i < std::size(test_data_.chain_fingerprints); ++i) {
  950. if (!test_data_.chain_fingerprints[i]) {
  951. // No more test certificates expected - make sure no more were
  952. // returned before marking this test a success.
  953. EXPECT_EQ(i, certs.size());
  954. break;
  955. }
  956. // A cert is expected - make sure that one was parsed.
  957. ASSERT_LT(i, certs.size());
  958. ASSERT_TRUE(certs[i]);
  959. // Compare the parsed certificate with the expected certificate, by
  960. // comparing fingerprints.
  961. EXPECT_EQ(
  962. *test_data_.chain_fingerprints[i],
  963. X509Certificate::CalculateFingerprint256(certs[i]->cert_buffer()));
  964. }
  965. }
  966. INSTANTIATE_TEST_SUITE_P(All,
  967. X509CertificateParseTest,
  968. testing::ValuesIn(kFormatTestData));
  969. struct CertificateNameVerifyTestData {
  970. // true iff we expect hostname to match an entry in cert_names.
  971. bool expected;
  972. // The hostname to match.
  973. const char* hostname;
  974. // Comma separated list of certificate names to match against. Any occurrence
  975. // of '#' will be replaced with a null character before processing.
  976. const char* dns_names;
  977. // Comma separated list of certificate IP Addresses to match against. Each
  978. // address is x prefixed 16 byte hex code for v6 or dotted-decimals for v4.
  979. const char* ip_addrs;
  980. };
  981. // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how
  982. // to output the parameter that was passed. Without this, it will simply
  983. // attempt to print out the first twenty bytes of the object, which depending
  984. // on platform and alignment, may result in an invalid read.
  985. void PrintTo(const CertificateNameVerifyTestData& data, std::ostream* os) {
  986. ASSERT_TRUE(data.hostname);
  987. ASSERT_TRUE(data.dns_names || data.ip_addrs);
  988. *os << " expected: " << data.expected << "; hostname: " << data.hostname
  989. << "; dns_names: " << (data.dns_names ? data.dns_names : "")
  990. << "; ip_addrs: " << (data.ip_addrs ? data.ip_addrs : "");
  991. }
  992. const CertificateNameVerifyTestData kNameVerifyTestData[] = {
  993. {true, "foo.com", "foo.com"},
  994. {true, "f", "f"},
  995. {false, "h", "i"},
  996. {true, "bar.foo.com", "*.foo.com"},
  997. {true, "www.test.fr", "*.test.com,*.test.co.uk,*.test.de,*.test.fr"},
  998. {true, "wwW.tESt.fr", ",*.*,*.test.de,*.test.FR,www"},
  999. {false, "f.uk", ".uk"},
  1000. {false, "w.bar.foo.com", "?.bar.foo.com"},
  1001. {false, "www.foo.com", "(www|ftp).foo.com"},
  1002. {false, "www.foo.com", "www.foo.com#"}, // # = null char.
  1003. {false, "www.foo.com", "www.foo.com#*.foo.com,#,#"},
  1004. {false, "www.house.example", "ww.house.example"},
  1005. {false, "test.org", "www.test.org,*.test.org,*.org"},
  1006. {false, "w.bar.foo.com", "w*.bar.foo.com"},
  1007. {false, "www.bar.foo.com", "ww*ww.bar.foo.com"},
  1008. {false, "wwww.bar.foo.com", "ww*ww.bar.foo.com"},
  1009. {false, "wwww.bar.foo.com", "w*w.bar.foo.com"},
  1010. {false, "wwww.bar.foo.com", "w*w.bar.foo.c0m"},
  1011. {false, "WALLY.bar.foo.com", "wa*.bar.foo.com"},
  1012. {false, "wally.bar.foo.com", "*Ly.bar.foo.com"},
  1013. // Hostname escaping tests
  1014. {true, "ww%57.foo.com", "www.foo.com"},
  1015. {true, "www%2Efoo.com", "www.foo.com"},
  1016. {false, "www%00.foo.com", "www,foo.com,www.foo.com"},
  1017. {false, "www%0D.foo.com", "www.foo.com,www\r.foo.com"},
  1018. {false, "www%40foo.com", "www@foo.com"},
  1019. {false, "www%2E%2Efoo.com", "www.foo.com,www..foo.com"},
  1020. {false, "www%252Efoo.com", "www.foo.com"},
  1021. // IDN tests
  1022. {true, "xn--poema-9qae5a.com.br", "xn--poema-9qae5a.com.br"},
  1023. {true, "www.xn--poema-9qae5a.com.br", "*.xn--poema-9qae5a.com.br"},
  1024. {false, "xn--poema-9qae5a.com.br",
  1025. "*.xn--poema-9qae5a.com.br,"
  1026. "xn--poema-*.com.br,"
  1027. "xn--*-9qae5a.com.br,"
  1028. "*--poema-9qae5a.com.br"},
  1029. // The following are adapted from the examples quoted from
  1030. // http://tools.ietf.org/html/rfc6125#section-6.4.3
  1031. // (e.g., *.example.com would match foo.example.com but
  1032. // not bar.foo.example.com or example.com).
  1033. {true, "foo.example.com", "*.example.com"},
  1034. {false, "bar.foo.example.com", "*.example.com"},
  1035. {false, "example.com", "*.example.com"},
  1036. // Partial wildcards are disallowed, though RFC 2818 rules allow them.
  1037. // That is, forms such as baz*.example.net, *baz.example.net, and
  1038. // b*z.example.net should NOT match domains. Instead, the wildcard must
  1039. // always be the left-most label, and only a single label.
  1040. {false, "baz1.example.net", "baz*.example.net"},
  1041. {false, "foobaz.example.net", "*baz.example.net"},
  1042. {false, "buzz.example.net", "b*z.example.net"},
  1043. {false, "www.test.example.net", "www.*.example.net"},
  1044. // Wildcards should not be valid for public registry controlled domains,
  1045. // and unknown/unrecognized domains, at least three domain components must
  1046. // be present.
  1047. {true, "www.test.example", "*.test.example"},
  1048. {true, "test.example.co.uk", "*.example.co.uk"},
  1049. {false, "test.example", "*.example"},
  1050. {false, "example.co.uk", "*.co.uk"},
  1051. {false, "foo.com", "*.com"},
  1052. {false, "foo.us", "*.us"},
  1053. {false, "foo", "*"},
  1054. // IDN variants of wildcards and registry controlled domains.
  1055. {true, "www.xn--poema-9qae5a.com.br", "*.xn--poema-9qae5a.com.br"},
  1056. {true, "test.example.xn--mgbaam7a8h", "*.example.xn--mgbaam7a8h"},
  1057. {false, "xn--poema-9qae5a.com.br", "*.com.br"},
  1058. {false, "example.xn--mgbaam7a8h", "*.xn--mgbaam7a8h"},
  1059. // Wildcards should be permissible for 'private' registry controlled
  1060. // domains.
  1061. {true, "www.appspot.com", "*.appspot.com"},
  1062. {true, "foo.s3.amazonaws.com", "*.s3.amazonaws.com"},
  1063. // Multiple wildcards are not valid.
  1064. {false, "foo.example.com", "*.*.com"},
  1065. {false, "foo.bar.example.com", "*.bar.*.com"},
  1066. // Absolute vs relative DNS name tests. Although not explicitly specified
  1067. // in RFC 6125, absolute reference names (those ending in a .) should
  1068. // match either absolute or relative presented names.
  1069. {true, "foo.com", "foo.com."},
  1070. {true, "foo.com.", "foo.com"},
  1071. {true, "foo.com.", "foo.com."},
  1072. {true, "f", "f."},
  1073. {true, "f.", "f"},
  1074. {true, "f.", "f."},
  1075. {true, "www-3.bar.foo.com", "*.bar.foo.com."},
  1076. {true, "www-3.bar.foo.com.", "*.bar.foo.com"},
  1077. {true, "www-3.bar.foo.com.", "*.bar.foo.com."},
  1078. {false, ".", "."},
  1079. {false, "example.com", "*.com."},
  1080. {false, "example.com.", "*.com"},
  1081. {false, "example.com.", "*.com."},
  1082. {false, "foo.", "*."},
  1083. {false, "foo", "*."},
  1084. {false, "foo.co.uk", "*.co.uk."},
  1085. {false, "foo.co.uk.", "*.co.uk."},
  1086. // IP addresses in subject alternative name
  1087. {true, "10.1.2.3", "", "10.1.2.3"},
  1088. {true, "14.15", "", "14.0.0.15"},
  1089. {false, "10.1.2.7", "", "10.1.2.6,10.1.2.8"},
  1090. {false, "10.1.2.8", "foo"},
  1091. {true, "::4.5.6.7", "", "x00000000000000000000000004050607"},
  1092. {false, "::6.7.8.9", "::6.7.8.9",
  1093. "x00000000000000000000000006070808,x0000000000000000000000000607080a,"
  1094. "xff000000000000000000000006070809,6.7.8.9"},
  1095. {true, "FE80::200:f8ff:fe21:67cf", "",
  1096. "x00000000000000000000000006070808,xfe800000000000000200f8fffe2167cf,"
  1097. "xff0000000000000000000000060708ff,10.0.0.1"},
  1098. // Invalid hostnames with final numeric component.
  1099. {false, "121.2.3.512", "1*1.2.3.512,*1.2.3.512,1*.2.3.512,*.2.3.512",
  1100. "121.2.3.0"},
  1101. {false, "1.2.3.4.5.6", "*.2.3.4.5.6"},
  1102. {false, "1.2.3.4.5", "1.2.3.4.5"},
  1103. {false, "a.0.0.1", "*.0.0.1"},
  1104. // IP addresses in dNSName should not match commonName
  1105. {false, "127.0.0.1", "127.0.0.1"},
  1106. {false, "127.0.0.1", "*.0.0.1"},
  1107. // Invalid host names.
  1108. {false, ".", ""},
  1109. {false, ".", "."},
  1110. {false, "1.2.3.4..", "", "1.2.3.4"},
  1111. {false, "www..domain.example", "www.domain.example"},
  1112. {false, "www^domain.example", "www^domain.example"},
  1113. {false, "www%20.domain.example", "www .domain.example"},
  1114. {false, "www%2520.domain.example", "www .domain.example"},
  1115. {false, "www%5E.domain.example", "www^domain.example"},
  1116. {false, "www,domain.example", "www,domain.example"},
  1117. {false, "0x000000002200037955161..", "0x000000002200037955161"},
  1118. {false, "junk)(£)$*!@~#", "junk)(£)$*!@~#"},
  1119. {false, "www.*.com", "www.*.com"},
  1120. {false, "w$w.f.com", "w$w.f.com"},
  1121. {false, "nocolonallowed:example", "nocolonallowed:example"},
  1122. {false, "www-1.[::FFFF:129.144.52.38]", "*.[::FFFF:129.144.52.38]"},
  1123. {false, "[::4.5.6.9]", "", "x00000000000000000000000004050609"},
  1124. };
  1125. class X509CertificateNameVerifyTest
  1126. : public testing::TestWithParam<CertificateNameVerifyTestData> {
  1127. };
  1128. TEST_P(X509CertificateNameVerifyTest, VerifyHostname) {
  1129. CertificateNameVerifyTestData test_data = GetParam();
  1130. std::vector<std::string> dns_names, ip_addressses;
  1131. if (test_data.dns_names) {
  1132. // Build up the certificate DNS names list.
  1133. std::string dns_name_line(test_data.dns_names);
  1134. std::replace(dns_name_line.begin(), dns_name_line.end(), '#', '\0');
  1135. dns_names = base::SplitString(dns_name_line, ",", base::TRIM_WHITESPACE,
  1136. base::SPLIT_WANT_ALL);
  1137. }
  1138. if (test_data.ip_addrs) {
  1139. // Build up the certificate IP address list.
  1140. std::string ip_addrs_line(test_data.ip_addrs);
  1141. std::vector<std::string> ip_addressses_ascii = base::SplitString(
  1142. ip_addrs_line, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
  1143. for (size_t i = 0; i < ip_addressses_ascii.size(); ++i) {
  1144. std::string& addr_ascii = ip_addressses_ascii[i];
  1145. ASSERT_NE(0U, addr_ascii.length());
  1146. if (addr_ascii[0] == 'x') { // Hex encoded address
  1147. addr_ascii.erase(0, 1);
  1148. std::string bytes;
  1149. EXPECT_TRUE(base::HexStringToString(addr_ascii, &bytes))
  1150. << "Could not parse hex address " << addr_ascii << " i = " << i;
  1151. ip_addressses.push_back(std::move(bytes));
  1152. ASSERT_EQ(16U, ip_addressses.back().size()) << i;
  1153. } else { // Decimal groups
  1154. std::vector<std::string> decimals_ascii_list = base::SplitString(
  1155. addr_ascii, ".", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
  1156. EXPECT_EQ(4U, decimals_ascii_list.size()) << i;
  1157. std::string addr_bytes;
  1158. for (const auto& decimals_ascii : decimals_ascii_list) {
  1159. int decimal_value;
  1160. EXPECT_TRUE(base::StringToInt(decimals_ascii, &decimal_value));
  1161. EXPECT_GE(decimal_value, 0);
  1162. EXPECT_LE(decimal_value, 255);
  1163. addr_bytes.push_back(static_cast<char>(decimal_value));
  1164. }
  1165. ip_addressses.push_back(addr_bytes);
  1166. ASSERT_EQ(4U, ip_addressses.back().size()) << i;
  1167. }
  1168. }
  1169. }
  1170. EXPECT_EQ(test_data.expected,
  1171. X509Certificate::VerifyHostname(test_data.hostname, dns_names,
  1172. ip_addressses));
  1173. }
  1174. INSTANTIATE_TEST_SUITE_P(All,
  1175. X509CertificateNameVerifyTest,
  1176. testing::ValuesIn(kNameVerifyTestData));
  1177. const struct PublicKeyInfoTestData {
  1178. const char* cert_file;
  1179. size_t expected_bits;
  1180. X509Certificate::PublicKeyType expected_type;
  1181. } kPublicKeyInfoTestData[] = {
  1182. {"768-rsa-ee-by-768-rsa-intermediate.pem", 768,
  1183. X509Certificate::kPublicKeyTypeRSA},
  1184. {"1024-rsa-ee-by-768-rsa-intermediate.pem", 1024,
  1185. X509Certificate::kPublicKeyTypeRSA},
  1186. {"prime256v1-ecdsa-ee-by-1024-rsa-intermediate.pem", 256,
  1187. X509Certificate::kPublicKeyTypeECDSA},
  1188. {"large_key.pem", 8200, X509Certificate::kPublicKeyTypeRSA},
  1189. };
  1190. class X509CertificatePublicKeyInfoTest
  1191. : public testing::TestWithParam<PublicKeyInfoTestData> {
  1192. };
  1193. TEST_P(X509CertificatePublicKeyInfoTest, GetPublicKeyInfo) {
  1194. PublicKeyInfoTestData data = GetParam();
  1195. scoped_refptr<X509Certificate> cert(
  1196. ImportCertFromFile(GetTestCertsDirectory(), data.cert_file));
  1197. ASSERT_TRUE(cert.get());
  1198. size_t actual_bits = 0;
  1199. X509Certificate::PublicKeyType actual_type =
  1200. X509Certificate::kPublicKeyTypeUnknown;
  1201. X509Certificate::GetPublicKeyInfo(cert->cert_buffer(), &actual_bits,
  1202. &actual_type);
  1203. EXPECT_EQ(data.expected_bits, actual_bits);
  1204. EXPECT_EQ(data.expected_type, actual_type);
  1205. }
  1206. INSTANTIATE_TEST_SUITE_P(All,
  1207. X509CertificatePublicKeyInfoTest,
  1208. testing::ValuesIn(kPublicKeyInfoTestData));
  1209. } // namespace net