client_cert_store_unittest-inl.h 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_SSL_CLIENT_CERT_STORE_UNITTEST_INL_H_
  5. #define NET_SSL_CLIENT_CERT_STORE_UNITTEST_INL_H_
  6. #include <memory>
  7. #include <string>
  8. #include <vector>
  9. #include "base/files/file_path.h"
  10. #include "base/files/file_util.h"
  11. #include "base/memory/ref_counted.h"
  12. #include "net/cert/pem.h"
  13. #include "net/cert/x509_util.h"
  14. #include "net/ssl/ssl_cert_request_info.h"
  15. #include "net/test/cert_test_util.h"
  16. #include "net/test/test_data_directory.h"
  17. #include "net/test/test_with_task_environment.h"
  18. #include "testing/gtest/include/gtest/gtest.h"
  19. namespace net {
  20. namespace {
  21. // "CN=B CA" - DER encoded DN of the issuer of client_1.pem
  22. const unsigned char kAuthority1DN[] = {
  23. 0x30, 0x0f, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55,
  24. 0x04, 0x03, 0x0c, 0x04, 0x42, 0x20, 0x43, 0x41,
  25. };
  26. // "CN=E CA" - DER encoded DN of the issuer of client_2.pem
  27. const unsigned char kAuthority2DN[] = {
  28. 0x30, 0x0f, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55,
  29. 0x04, 0x03, 0x0c, 0x04, 0x45, 0x20, 0x43, 0x41,
  30. };
  31. // "CN=C Root CA" - DER encoded DN of the issuer of client_1_ca.pem,
  32. // client_2_ca.pem, and client_3_ca.pem.
  33. const unsigned char kAuthorityRootDN[] = {
  34. 0x30, 0x14, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03,
  35. 0x0c, 0x09, 0x43, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41,
  36. };
  37. } // namespace
  38. // Use a templated test to provide common testcases for all the platform
  39. // implementations of ClientCertStore. These cases test the client cert
  40. // filtering behavior.
  41. //
  42. // NOTE: If any test cases are added, removed, or renamed, the
  43. // REGISTER_TYPED_TEST_SUITE_P macro at the bottom of this file must be updated.
  44. //
  45. // The type T provided as the third argument to INSTANTIATE_TYPED_TEST_SUITE_P
  46. // by the platform implementation should implement this method: bool
  47. // SelectClientCerts(const CertificateList& input_certs,
  48. // const SSLCertRequestInfo& cert_request_info,
  49. // ClientCertIdentityList* selected_identities);
  50. template <typename T>
  51. class ClientCertStoreTest : public TestWithTaskEnvironment {
  52. public:
  53. T delegate_;
  54. };
  55. TYPED_TEST_SUITE_P(ClientCertStoreTest);
  56. TYPED_TEST_P(ClientCertStoreTest, EmptyQuery) {
  57. CertificateList certs;
  58. auto request = base::MakeRefCounted<SSLCertRequestInfo>();
  59. ClientCertIdentityList selected_identities;
  60. bool rv = this->delegate_.SelectClientCerts(certs, *request.get(),
  61. &selected_identities);
  62. EXPECT_TRUE(rv);
  63. EXPECT_EQ(0u, selected_identities.size());
  64. }
  65. // Verify that CertRequestInfo with empty |cert_authorities| matches all
  66. // issuers, rather than no issuers.
  67. TYPED_TEST_P(ClientCertStoreTest, AllIssuersAllowed) {
  68. scoped_refptr<X509Certificate> cert(
  69. ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem"));
  70. ASSERT_TRUE(cert.get());
  71. std::vector<scoped_refptr<X509Certificate> > certs;
  72. certs.push_back(cert);
  73. auto request = base::MakeRefCounted<SSLCertRequestInfo>();
  74. ClientCertIdentityList selected_identities;
  75. bool rv = this->delegate_.SelectClientCerts(certs, *request.get(),
  76. &selected_identities);
  77. EXPECT_TRUE(rv);
  78. ASSERT_EQ(1u, selected_identities.size());
  79. EXPECT_TRUE(
  80. selected_identities[0]->certificate()->EqualsExcludingChain(cert.get()));
  81. }
  82. // Verify that certificates are correctly filtered against CertRequestInfo with
  83. // |cert_authorities| containing only |authority_1_DN|.
  84. TYPED_TEST_P(ClientCertStoreTest, CertAuthorityFiltering) {
  85. scoped_refptr<X509Certificate> cert_1(
  86. ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem"));
  87. ASSERT_TRUE(cert_1.get());
  88. scoped_refptr<X509Certificate> cert_2(
  89. ImportCertFromFile(GetTestCertsDirectory(), "client_2.pem"));
  90. ASSERT_TRUE(cert_2.get());
  91. std::vector<std::string> authority_1(
  92. 1, std::string(reinterpret_cast<const char*>(kAuthority1DN),
  93. sizeof(kAuthority1DN)));
  94. std::vector<std::string> authority_2(
  95. 1, std::string(reinterpret_cast<const char*>(kAuthority2DN),
  96. sizeof(kAuthority2DN)));
  97. EXPECT_TRUE(cert_1->IsIssuedByEncoded(authority_1));
  98. EXPECT_FALSE(cert_1->IsIssuedByEncoded(authority_2));
  99. EXPECT_TRUE(cert_2->IsIssuedByEncoded(authority_2));
  100. EXPECT_FALSE(cert_2->IsIssuedByEncoded(authority_1));
  101. std::vector<scoped_refptr<X509Certificate> > certs;
  102. certs.push_back(cert_1);
  103. certs.push_back(cert_2);
  104. auto request = base::MakeRefCounted<SSLCertRequestInfo>();
  105. request->cert_authorities = authority_1;
  106. ClientCertIdentityList selected_identities;
  107. bool rv = this->delegate_.SelectClientCerts(certs, *request.get(),
  108. &selected_identities);
  109. EXPECT_TRUE(rv);
  110. ASSERT_EQ(1u, selected_identities.size());
  111. EXPECT_TRUE(selected_identities[0]->certificate()->EqualsExcludingChain(
  112. cert_1.get()));
  113. }
  114. TYPED_TEST_P(ClientCertStoreTest, PrintableStringContainingUTF8) {
  115. base::FilePath certs_dir =
  116. GetTestNetDataDirectory().AppendASCII("parse_certificate_unittest");
  117. std::string file_data;
  118. ASSERT_TRUE(base::ReadFileToString(
  119. certs_dir.AppendASCII(
  120. "subject_printable_string_containing_utf8_client_cert.pem"),
  121. &file_data));
  122. net::PEMTokenizer pem_tokenizer(file_data, {"CERTIFICATE"});
  123. ASSERT_TRUE(pem_tokenizer.GetNext());
  124. std::string cert_der(pem_tokenizer.data());
  125. ASSERT_FALSE(pem_tokenizer.GetNext());
  126. bssl::UniquePtr<CRYPTO_BUFFER> cert_handle =
  127. x509_util::CreateCryptoBuffer(cert_der);
  128. ASSERT_TRUE(cert_handle);
  129. X509Certificate::UnsafeCreateOptions options;
  130. options.printable_string_is_utf8 = true;
  131. scoped_refptr<X509Certificate> cert =
  132. X509Certificate::CreateFromBufferUnsafeOptions(std::move(cert_handle), {},
  133. options);
  134. ASSERT_TRUE(cert);
  135. auto request = base::MakeRefCounted<SSLCertRequestInfo>();
  136. ClientCertIdentityList selected_identities;
  137. bool rv = this->delegate_.SelectClientCerts({cert}, *request.get(),
  138. &selected_identities);
  139. EXPECT_TRUE(rv);
  140. ASSERT_EQ(1u, selected_identities.size());
  141. EXPECT_TRUE(
  142. selected_identities[0]->certificate()->EqualsExcludingChain(cert.get()));
  143. }
  144. REGISTER_TYPED_TEST_SUITE_P(ClientCertStoreTest,
  145. EmptyQuery,
  146. AllIssuersAllowed,
  147. CertAuthorityFiltering,
  148. PrintableStringContainingUTF8);
  149. } // namespace net
  150. #endif // NET_SSL_CLIENT_CERT_STORE_UNITTEST_INL_H_