client_cert_store_mac_unittest.cc 7.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/ssl/client_cert_store_mac.h"
  5. #include <memory>
  6. #include "base/strings/string_number_conversions.h"
  7. #include "net/cert/pki/extended_key_usage.h"
  8. #include "net/cert/pki/parse_certificate.h"
  9. #include "net/cert/x509_util_apple.h"
  10. #include "net/ssl/client_cert_identity_mac.h"
  11. #include "net/ssl/client_cert_identity_test_util.h"
  12. #include "net/ssl/client_cert_store_unittest-inl.h"
  13. #include "net/ssl/ssl_private_key.h"
  14. #include "net/test/cert_builder.h"
  15. namespace net {
  16. namespace {
  17. std::vector<std::unique_ptr<ClientCertIdentityMac>>
  18. ClientCertIdentityMacListFromCertificateList(const CertificateList& certs) {
  19. // This doesn't quite construct a real `ClientCertIdentityMac` the
  20. // `SecIdentityRef` is null. This means `SelectClientCertsForTesting` must
  21. // turn off the KeyChain query. If this becomes an issue, change
  22. // client_cert_store_unittest-inl.h to pass in the key data and use
  23. // `ScopedTestKeychain` with `ImportCertAndKeyToKeychain`.
  24. std::vector<std::unique_ptr<ClientCertIdentityMac>> identities;
  25. identities.reserve(certs.size());
  26. for (const auto& cert : certs) {
  27. identities.push_back(std::make_unique<ClientCertIdentityMac>(
  28. cert, base::ScopedCFTypeRef<SecIdentityRef>()));
  29. }
  30. return identities;
  31. }
  32. std::string InputVectorToString(std::vector<der::Input> vec) {
  33. std::string r = "{";
  34. std::string sep;
  35. for (const auto& element : vec) {
  36. r += sep;
  37. r += base::HexEncode(element.AsSpan());
  38. sep = ',';
  39. }
  40. r += '}';
  41. return r;
  42. }
  43. std::string KeyUsageVectorToString(std::vector<KeyUsageBit> vec) {
  44. std::string r = "{";
  45. std::string sep;
  46. for (const auto& element : vec) {
  47. r += sep;
  48. r += base::NumberToString(static_cast<int>(element));
  49. sep = ',';
  50. }
  51. r += '}';
  52. return r;
  53. }
  54. } // namespace
  55. class ClientCertStoreMacTestDelegate {
  56. public:
  57. bool SelectClientCerts(const CertificateList& input_certs,
  58. const SSLCertRequestInfo& cert_request_info,
  59. ClientCertIdentityList* selected_certs) {
  60. return store_.SelectClientCertsForTesting(
  61. ClientCertIdentityMacListFromCertificateList(input_certs),
  62. cert_request_info, selected_certs);
  63. }
  64. private:
  65. ClientCertStoreMac store_;
  66. };
  67. INSTANTIATE_TYPED_TEST_SUITE_P(Mac,
  68. ClientCertStoreTest,
  69. ClientCertStoreMacTestDelegate);
  70. class ClientCertStoreMacTest : public ::testing::Test {
  71. protected:
  72. bool SelectClientCerts(const CertificateList& input_certs,
  73. const SSLCertRequestInfo& cert_request_info,
  74. ClientCertIdentityList* selected_certs) {
  75. return store_.SelectClientCertsForTesting(
  76. ClientCertIdentityMacListFromCertificateList(input_certs),
  77. cert_request_info, selected_certs);
  78. }
  79. bool SelectClientCertsGivenPreferred(
  80. const scoped_refptr<X509Certificate>& preferred_cert,
  81. const CertificateList& regular_certs,
  82. const SSLCertRequestInfo& request,
  83. ClientCertIdentityList* selected_certs) {
  84. auto preferred_identity = std::make_unique<ClientCertIdentityMac>(
  85. preferred_cert, base::ScopedCFTypeRef<SecIdentityRef>());
  86. return store_.SelectClientCertsGivenPreferredForTesting(
  87. std::move(preferred_identity),
  88. ClientCertIdentityMacListFromCertificateList(regular_certs), request,
  89. selected_certs);
  90. }
  91. private:
  92. ClientCertStoreMac store_;
  93. };
  94. // Verify that the preferred cert gets filtered out when it doesn't match the
  95. // server criteria.
  96. TEST_F(ClientCertStoreMacTest, FilterOutThePreferredCert) {
  97. scoped_refptr<X509Certificate> cert_1(
  98. ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem"));
  99. ASSERT_TRUE(cert_1.get());
  100. std::vector<std::string> authority_2(
  101. 1, std::string(reinterpret_cast<const char*>(kAuthority2DN),
  102. sizeof(kAuthority2DN)));
  103. EXPECT_FALSE(cert_1->IsIssuedByEncoded(authority_2));
  104. std::vector<scoped_refptr<X509Certificate> > certs;
  105. auto request = base::MakeRefCounted<SSLCertRequestInfo>();
  106. request->cert_authorities = authority_2;
  107. ClientCertIdentityList selected_certs;
  108. bool rv = SelectClientCertsGivenPreferred(
  109. cert_1, certs, *request.get(), &selected_certs);
  110. EXPECT_TRUE(rv);
  111. EXPECT_EQ(0u, selected_certs.size());
  112. }
  113. // Verify that the preferred cert takes the first position in the output list,
  114. // when it does not get filtered out.
  115. TEST_F(ClientCertStoreMacTest, PreferredCertGoesFirst) {
  116. scoped_refptr<X509Certificate> cert_1(
  117. ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem"));
  118. ASSERT_TRUE(cert_1.get());
  119. scoped_refptr<X509Certificate> cert_2(
  120. ImportCertFromFile(GetTestCertsDirectory(), "client_2.pem"));
  121. ASSERT_TRUE(cert_2.get());
  122. std::vector<scoped_refptr<X509Certificate> > certs;
  123. certs.push_back(cert_2);
  124. auto request = base::MakeRefCounted<SSLCertRequestInfo>();
  125. ClientCertIdentityList selected_certs;
  126. bool rv = SelectClientCertsGivenPreferred(
  127. cert_1, certs, *request.get(), &selected_certs);
  128. EXPECT_TRUE(rv);
  129. ASSERT_EQ(2u, selected_certs.size());
  130. EXPECT_TRUE(
  131. selected_certs[0]->certificate()->EqualsExcludingChain(cert_1.get()));
  132. EXPECT_TRUE(
  133. selected_certs[1]->certificate()->EqualsExcludingChain(cert_2.get()));
  134. }
  135. TEST_F(ClientCertStoreMacTest, CertSupportsClientAuth) {
  136. base::FilePath certs_dir = GetTestCertsDirectory();
  137. std::unique_ptr<CertBuilder> builder =
  138. CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  139. ASSERT_TRUE(builder);
  140. struct {
  141. bool expected_result;
  142. std::vector<KeyUsageBit> key_usages;
  143. std::vector<der::Input> ekus;
  144. } cases[] = {
  145. {true, {}, {}},
  146. {true, {KEY_USAGE_BIT_DIGITAL_SIGNATURE}, {}},
  147. {true,
  148. {KEY_USAGE_BIT_DIGITAL_SIGNATURE, KEY_USAGE_BIT_KEY_CERT_SIGN},
  149. {}},
  150. {false, {KEY_USAGE_BIT_NON_REPUDIATION}, {}},
  151. {false, {KEY_USAGE_BIT_KEY_ENCIPHERMENT}, {}},
  152. {false, {KEY_USAGE_BIT_DATA_ENCIPHERMENT}, {}},
  153. {false, {KEY_USAGE_BIT_KEY_AGREEMENT}, {}},
  154. {false, {KEY_USAGE_BIT_KEY_CERT_SIGN}, {}},
  155. {false, {KEY_USAGE_BIT_CRL_SIGN}, {}},
  156. {false, {KEY_USAGE_BIT_ENCIPHER_ONLY}, {}},
  157. {false, {KEY_USAGE_BIT_DECIPHER_ONLY}, {}},
  158. {true, {}, {der::Input(kAnyEKU)}},
  159. {true, {}, {der::Input(kClientAuth)}},
  160. {true, {}, {der::Input(kServerAuth), der::Input(kClientAuth)}},
  161. {true, {}, {der::Input(kClientAuth), der::Input(kServerAuth)}},
  162. {false, {}, {der::Input(kServerAuth)}},
  163. {true, {KEY_USAGE_BIT_DIGITAL_SIGNATURE}, {der::Input(kClientAuth)}},
  164. {false, {KEY_USAGE_BIT_KEY_CERT_SIGN}, {der::Input(kClientAuth)}},
  165. {false, {KEY_USAGE_BIT_DIGITAL_SIGNATURE}, {der::Input(kServerAuth)}},
  166. };
  167. for (const auto& testcase : cases) {
  168. SCOPED_TRACE(testcase.expected_result);
  169. SCOPED_TRACE(KeyUsageVectorToString(testcase.key_usages));
  170. SCOPED_TRACE(InputVectorToString(testcase.ekus));
  171. if (testcase.key_usages.empty())
  172. builder->EraseExtension(der::Input(kKeyUsageOid));
  173. else
  174. builder->SetKeyUsages(testcase.key_usages);
  175. if (testcase.ekus.empty())
  176. builder->EraseExtension(der::Input(kExtKeyUsageOid));
  177. else
  178. builder->SetExtendedKeyUsages(testcase.ekus);
  179. auto request = base::MakeRefCounted<SSLCertRequestInfo>();
  180. ClientCertIdentityList selected_certs;
  181. bool rv = SelectClientCerts({builder->GetX509Certificate()}, *request.get(),
  182. &selected_certs);
  183. EXPECT_TRUE(rv);
  184. if (testcase.expected_result) {
  185. ASSERT_EQ(1U, selected_certs.size());
  186. EXPECT_TRUE(selected_certs[0]->certificate()->EqualsExcludingChain(
  187. builder->GetX509Certificate().get()));
  188. } else {
  189. EXPECT_TRUE(selected_certs.empty());
  190. }
  191. }
  192. }
  193. } // namespace net