cert_verifier_service_factory_unittest.cc 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "services/cert_verifier/cert_verifier_service_factory.h"
  5. #include <cstddef>
  6. #include <memory>
  7. #include <vector>
  8. #include "base/bind.h"
  9. #include "base/check_op.h"
  10. #include "base/memory/scoped_refptr.h"
  11. #include "base/run_loop.h"
  12. #include "base/test/bind.h"
  13. #include "base/test/task_environment.h"
  14. #include "base/time/time.h"
  15. #include "mojo/public/cpp/bindings/pending_receiver.h"
  16. #include "mojo/public/cpp/bindings/pending_remote.h"
  17. #include "mojo/public/cpp/bindings/remote.h"
  18. #include "net/base/net_errors.h"
  19. #include "net/cert/cert_status_flags.h"
  20. #include "net/log/net_log_with_source.h"
  21. #include "net/test/cert_builder.h"
  22. #include "net/test/cert_test_util.h"
  23. #include "net/test/test_data_directory.h"
  24. #include "services/cert_verifier/public/mojom/cert_verifier_service_factory.mojom.h"
  25. #include "services/network/public/mojom/cert_verifier_service.mojom.h"
  26. #include "services/network/public/mojom/network_context.mojom.h"
  27. #include "services/network/public/mojom/url_loader_factory.mojom.h"
  28. #include "testing/gtest/include/gtest/gtest.h"
  29. #include "testing/platform_test.h"
  30. #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED)
  31. #include "mojo/public/cpp/base/big_buffer.h"
  32. #include "net/cert/internal/trust_store_chrome.h"
  33. #include "net/cert/pki/parse_name.h"
  34. #include "net/cert/root_store_proto_lite/root_store.pb.h"
  35. #include "net/der/input.h"
  36. #endif
  37. namespace cert_verifier {
  38. namespace {
  39. struct DummyCVServiceRequest : public mojom::CertVerifierRequest {
  40. explicit DummyCVServiceRequest(base::RepeatingClosure on_finish)
  41. : on_finish_(std::move(on_finish)) {}
  42. void Complete(const net::CertVerifyResult& result_param,
  43. int32_t net_error_param) override {
  44. is_completed = true;
  45. result = result_param;
  46. net_error = net_error_param;
  47. std::move(on_finish_).Run();
  48. }
  49. base::RepeatingClosure on_finish_;
  50. bool is_completed = false;
  51. net::CertVerifyResult result;
  52. int net_error;
  53. };
  54. } // namespace
  55. TEST(CertVerifierServiceFactoryTest, GetNewCertVerifier) {
  56. base::test::TaskEnvironment task_environment;
  57. base::FilePath certs_dir = net::GetTestCertsDirectory();
  58. scoped_refptr<net::X509Certificate> test_cert(
  59. net::ImportCertFromFile(certs_dir, "ok_cert.pem"));
  60. ASSERT_NE(nullptr, test_cert.get());
  61. mojo::Remote<mojom::CertVerifierServiceFactory> cv_service_factory_remote;
  62. CertVerifierServiceFactoryImpl cv_service_factory_impl(
  63. cv_service_factory_remote.BindNewPipeAndPassReceiver());
  64. mojo::Remote<mojom::CertVerifierService> cv_service_remote;
  65. mojom::CertVerifierCreationParamsPtr cv_creation_params =
  66. mojom::CertVerifierCreationParams::New();
  67. cv_service_factory_remote->GetNewCertVerifier(
  68. cv_service_remote.BindNewPipeAndPassReceiver(),
  69. std::move(cv_creation_params));
  70. base::RunLoop request_completed_run_loop;
  71. DummyCVServiceRequest dummy_cv_service_req(
  72. request_completed_run_loop.QuitClosure());
  73. mojo::Receiver<mojom::CertVerifierRequest> dummy_cv_service_req_receiver(
  74. &dummy_cv_service_req);
  75. auto net_log(net::NetLogWithSource::Make(
  76. net::NetLog::Get(), net::NetLogSourceType::CERT_VERIFIER_JOB));
  77. cv_service_remote->Verify(
  78. net::CertVerifier::RequestParams(test_cert, "www.example.com", 0,
  79. /*ocsp_response=*/std::string(),
  80. /*sct_list=*/std::string()),
  81. static_cast<uint32_t>(net_log.source().type), net_log.source().id,
  82. net_log.source().start_time,
  83. dummy_cv_service_req_receiver.BindNewPipeAndPassRemote());
  84. request_completed_run_loop.Run();
  85. ASSERT_EQ(dummy_cv_service_req.net_error, net::ERR_CERT_AUTHORITY_INVALID);
  86. ASSERT_TRUE(dummy_cv_service_req.result.cert_status &
  87. net::CERT_STATUS_AUTHORITY_INVALID);
  88. }
  89. #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED)
  90. // Test that a new Cert verifier will use an updated Chrome Root Store if
  91. // one was already passed into CertVerifierServiceFactory.
  92. TEST(CertVerifierServiceFactoryTest, GetNewCertVerifierWithUpdatedRootStore) {
  93. // Create leaf and root certs.
  94. base::test::TaskEnvironment task_environment;
  95. std::unique_ptr<net::CertBuilder> leaf, root;
  96. net::CertBuilder::CreateSimpleChain(&leaf, &root);
  97. base::Time now = base::Time::Now();
  98. leaf->SetValidity(now - base::Days(1), now + base::Days(1));
  99. // Create updated Chrome Root Store with just the root cert from above.
  100. chrome_root_store::RootStore root_store_proto;
  101. root_store_proto.set_version_major(net::CompiledChromeRootStoreVersion() + 1);
  102. chrome_root_store::TrustAnchor* anchor = root_store_proto.add_trust_anchors();
  103. anchor->set_der(root->GetDER());
  104. std::string proto_serialized;
  105. root_store_proto.SerializeToString(&proto_serialized);
  106. cert_verifier::mojom::ChromeRootStorePtr root_store_ptr =
  107. cert_verifier::mojom::ChromeRootStore::New(
  108. base::as_bytes(base::make_span(proto_serialized)));
  109. mojo::Remote<mojom::CertVerifierServiceFactory> cv_service_factory_remote;
  110. CertVerifierServiceFactoryImpl cv_service_factory_impl(
  111. cv_service_factory_remote.BindNewPipeAndPassReceiver());
  112. // Feed factory the new Chrome Root Store.
  113. cv_service_factory_impl.UpdateChromeRootStore(std::move(root_store_ptr));
  114. mojo::Remote<mojom::CertVerifierService> cv_service_remote;
  115. mojom::CertVerifierCreationParamsPtr cv_creation_params =
  116. mojom::CertVerifierCreationParams::New();
  117. cv_creation_params->use_chrome_root_store = cert_verifier::mojom::
  118. CertVerifierCreationParams::ChromeRootImpl::kRootChrome;
  119. cv_service_factory_remote->GetNewCertVerifier(
  120. cv_service_remote.BindNewPipeAndPassReceiver(),
  121. std::move(cv_creation_params));
  122. base::RunLoop request_completed_run_loop;
  123. DummyCVServiceRequest dummy_cv_service_req(
  124. request_completed_run_loop.QuitClosure());
  125. mojo::Receiver<mojom::CertVerifierRequest> dummy_cv_service_req_receiver(
  126. &dummy_cv_service_req);
  127. auto net_log(net::NetLogWithSource::Make(
  128. net::NetLog::Get(), net::NetLogSourceType::CERT_VERIFIER_JOB));
  129. cv_service_remote->Verify(
  130. net::CertVerifier::RequestParams(leaf->GetX509Certificate(),
  131. "www.example.com", 0,
  132. /*ocsp_response=*/std::string(),
  133. /*sct_list=*/std::string()),
  134. static_cast<uint32_t>(net_log.source().type), net_log.source().id,
  135. net_log.source().start_time,
  136. dummy_cv_service_req_receiver.BindNewPipeAndPassRemote());
  137. request_completed_run_loop.Run();
  138. ASSERT_EQ(dummy_cv_service_req.net_error, net::OK);
  139. }
  140. // Test that an existing CertVerifierService will use an updated Chrome Root
  141. // Store if one is provided to the CertVerifierServiceFactory
  142. TEST(CertVerifierServiceFactoryTest, UpdateExistingCertVerifierWithRootStore) {
  143. // Create leaf and root certs.
  144. base::test::TaskEnvironment task_environment;
  145. std::unique_ptr<net::CertBuilder> leaf, root;
  146. net::CertBuilder::CreateSimpleChain(&leaf, &root);
  147. base::Time now = base::Time::Now();
  148. leaf->SetValidity(now - base::Days(1), now + base::Days(1));
  149. mojo::Remote<mojom::CertVerifierServiceFactory> cv_service_factory_remote;
  150. CertVerifierServiceFactoryImpl cv_service_factory_impl(
  151. cv_service_factory_remote.BindNewPipeAndPassReceiver());
  152. mojo::Remote<mojom::CertVerifierService> cv_service_remote;
  153. mojom::CertVerifierCreationParamsPtr cv_creation_params =
  154. mojom::CertVerifierCreationParams::New();
  155. cv_creation_params->use_chrome_root_store = cert_verifier::mojom::
  156. CertVerifierCreationParams::ChromeRootImpl::kRootChrome;
  157. cv_service_factory_remote->GetNewCertVerifier(
  158. cv_service_remote.BindNewPipeAndPassReceiver(),
  159. std::move(cv_creation_params));
  160. // Try request, it should fail because we haven't updated the Root Store yet.
  161. {
  162. base::RunLoop request_completed_run_loop;
  163. DummyCVServiceRequest dummy_cv_service_req(
  164. request_completed_run_loop.QuitClosure());
  165. mojo::Receiver<mojom::CertVerifierRequest> dummy_cv_service_req_receiver(
  166. &dummy_cv_service_req);
  167. auto net_log(net::NetLogWithSource::Make(
  168. net::NetLog::Get(), net::NetLogSourceType::CERT_VERIFIER_JOB));
  169. cv_service_remote->Verify(
  170. net::CertVerifier::RequestParams(leaf->GetX509Certificate(),
  171. "www.example.com", 0,
  172. /*ocsp_response=*/std::string(),
  173. /*sct_list=*/std::string()),
  174. static_cast<uint32_t>(net_log.source().type), net_log.source().id,
  175. net_log.source().start_time,
  176. dummy_cv_service_req_receiver.BindNewPipeAndPassRemote());
  177. request_completed_run_loop.Run();
  178. ASSERT_EQ(dummy_cv_service_req.net_error, net::ERR_CERT_AUTHORITY_INVALID);
  179. ASSERT_TRUE(dummy_cv_service_req.result.cert_status &
  180. net::CERT_STATUS_AUTHORITY_INVALID);
  181. }
  182. // Create updated Chrome Root Store with just the root cert from above.
  183. chrome_root_store::RootStore root_store_proto;
  184. root_store_proto.set_version_major(net::CompiledChromeRootStoreVersion() + 1);
  185. chrome_root_store::TrustAnchor* anchor = root_store_proto.add_trust_anchors();
  186. anchor->set_der(root->GetDER());
  187. std::string proto_serialized;
  188. root_store_proto.SerializeToString(&proto_serialized);
  189. cert_verifier::mojom::ChromeRootStorePtr root_store_ptr =
  190. cert_verifier::mojom::ChromeRootStore::New(
  191. base::as_bytes(base::make_span(proto_serialized)));
  192. // Feed factory the new Chrome Root Store.
  193. cv_service_factory_impl.UpdateChromeRootStore(std::move(root_store_ptr));
  194. // Try request, it should succeed.
  195. {
  196. base::RunLoop request_completed_run_loop;
  197. DummyCVServiceRequest dummy_cv_service_req(
  198. request_completed_run_loop.QuitClosure());
  199. mojo::Receiver<mojom::CertVerifierRequest> dummy_cv_service_req_receiver(
  200. &dummy_cv_service_req);
  201. auto net_log(net::NetLogWithSource::Make(
  202. net::NetLog::Get(), net::NetLogSourceType::CERT_VERIFIER_JOB));
  203. cv_service_remote->Verify(
  204. net::CertVerifier::RequestParams(leaf->GetX509Certificate(),
  205. "www.example.com", 0,
  206. /*ocsp_response=*/std::string(),
  207. /*sct_list=*/std::string()),
  208. static_cast<uint32_t>(net_log.source().type), net_log.source().id,
  209. net_log.source().start_time,
  210. dummy_cv_service_req_receiver.BindNewPipeAndPassRemote());
  211. request_completed_run_loop.Run();
  212. ASSERT_EQ(dummy_cv_service_req.net_error, net::OK);
  213. }
  214. }
  215. TEST(CertVerifierServiceFactoryTest, OldRootStoreUpdateIgnored) {
  216. // Create leaf and root certs.
  217. base::test::TaskEnvironment task_environment;
  218. std::unique_ptr<net::CertBuilder> leaf, root;
  219. net::CertBuilder::CreateSimpleChain(&leaf, &root);
  220. base::Time now = base::Time::Now();
  221. leaf->SetValidity(now - base::Days(1), now + base::Days(1));
  222. // Create updated Chrome Root Store with just the root cert from above, but
  223. // set the version # so that the version is ignored.
  224. chrome_root_store::RootStore root_store_proto;
  225. root_store_proto.set_version_major(net::CompiledChromeRootStoreVersion());
  226. chrome_root_store::TrustAnchor* anchor = root_store_proto.add_trust_anchors();
  227. anchor->set_der(root->GetDER());
  228. std::string proto_serialized;
  229. root_store_proto.SerializeToString(&proto_serialized);
  230. cert_verifier::mojom::ChromeRootStorePtr root_store_ptr =
  231. cert_verifier::mojom::ChromeRootStore::New(
  232. base::as_bytes(base::make_span(proto_serialized)));
  233. mojo::Remote<mojom::CertVerifierServiceFactory> cv_service_factory_remote;
  234. CertVerifierServiceFactoryImpl cv_service_factory_impl(
  235. cv_service_factory_remote.BindNewPipeAndPassReceiver());
  236. // Feed factory the new Chrome Root Store.
  237. cv_service_factory_impl.UpdateChromeRootStore(std::move(root_store_ptr));
  238. mojo::Remote<mojom::CertVerifierService> cv_service_remote;
  239. mojom::CertVerifierCreationParamsPtr cv_creation_params =
  240. mojom::CertVerifierCreationParams::New();
  241. cv_creation_params->use_chrome_root_store = cert_verifier::mojom::
  242. CertVerifierCreationParams::ChromeRootImpl::kRootChrome;
  243. cv_service_factory_remote->GetNewCertVerifier(
  244. cv_service_remote.BindNewPipeAndPassReceiver(),
  245. std::move(cv_creation_params));
  246. base::RunLoop request_completed_run_loop;
  247. DummyCVServiceRequest dummy_cv_service_req(
  248. request_completed_run_loop.QuitClosure());
  249. mojo::Receiver<mojom::CertVerifierRequest> dummy_cv_service_req_receiver(
  250. &dummy_cv_service_req);
  251. auto net_log(net::NetLogWithSource::Make(
  252. net::NetLog::Get(), net::NetLogSourceType::CERT_VERIFIER_JOB));
  253. cv_service_remote->Verify(
  254. net::CertVerifier::RequestParams(leaf->GetX509Certificate(),
  255. "www.example.com", 0,
  256. /*ocsp_response=*/std::string(),
  257. /*sct_list=*/std::string()),
  258. static_cast<uint32_t>(net_log.source().type), net_log.source().id,
  259. net_log.source().start_time,
  260. dummy_cv_service_req_receiver.BindNewPipeAndPassRemote());
  261. request_completed_run_loop.Run();
  262. // Request should result in error because root store update was ignored.
  263. ASSERT_EQ(dummy_cv_service_req.net_error, net::ERR_CERT_AUTHORITY_INVALID);
  264. ASSERT_TRUE(dummy_cv_service_req.result.cert_status &
  265. net::CERT_STATUS_AUTHORITY_INVALID);
  266. }
  267. TEST(CertVerifierServiceFactoryTest, BadRootStoreUpdateIgnored) {
  268. // Create leaf and root certs.
  269. base::test::TaskEnvironment task_environment;
  270. std::unique_ptr<net::CertBuilder> leaf, root;
  271. net::CertBuilder::CreateSimpleChain(&leaf, &root);
  272. base::Time now = base::Time::Now();
  273. leaf->SetValidity(now - base::Days(1), now + base::Days(1));
  274. // Create updated Chrome Root Store with just the root cert from above.
  275. chrome_root_store::RootStore root_store_proto;
  276. root_store_proto.set_version_major(net::CompiledChromeRootStoreVersion() + 1);
  277. chrome_root_store::TrustAnchor* anchor = root_store_proto.add_trust_anchors();
  278. anchor->set_der(root->GetDER());
  279. std::string proto_serialized;
  280. root_store_proto.SerializeToString(&proto_serialized);
  281. cert_verifier::mojom::ChromeRootStorePtr root_store_ptr =
  282. cert_verifier::mojom::ChromeRootStore::New(
  283. base::as_bytes(base::make_span(proto_serialized)));
  284. mojo::Remote<mojom::CertVerifierServiceFactory> cv_service_factory_remote;
  285. CertVerifierServiceFactoryImpl cv_service_factory_impl(
  286. cv_service_factory_remote.BindNewPipeAndPassReceiver());
  287. // Feed factory the new Chrome Root Store.
  288. cv_service_factory_impl.UpdateChromeRootStore(std::move(root_store_ptr));
  289. mojo::Remote<mojom::CertVerifierService> cv_service_remote;
  290. mojom::CertVerifierCreationParamsPtr cv_creation_params =
  291. mojom::CertVerifierCreationParams::New();
  292. cv_creation_params->use_chrome_root_store = cert_verifier::mojom::
  293. CertVerifierCreationParams::ChromeRootImpl::kRootChrome;
  294. cv_service_factory_remote->GetNewCertVerifier(
  295. cv_service_remote.BindNewPipeAndPassReceiver(),
  296. std::move(cv_creation_params));
  297. // Initial request should succeed.
  298. {
  299. base::RunLoop request_completed_run_loop;
  300. DummyCVServiceRequest dummy_cv_service_req(
  301. request_completed_run_loop.QuitClosure());
  302. mojo::Receiver<mojom::CertVerifierRequest> dummy_cv_service_req_receiver(
  303. &dummy_cv_service_req);
  304. auto net_log(net::NetLogWithSource::Make(
  305. net::NetLog::Get(), net::NetLogSourceType::CERT_VERIFIER_JOB));
  306. cv_service_remote->Verify(
  307. net::CertVerifier::RequestParams(leaf->GetX509Certificate(),
  308. "www.example.com", 0,
  309. /*ocsp_response=*/std::string(),
  310. /*sct_list=*/std::string()),
  311. static_cast<uint32_t>(net_log.source().type), net_log.source().id,
  312. net_log.source().start_time,
  313. dummy_cv_service_req_receiver.BindNewPipeAndPassRemote());
  314. request_completed_run_loop.Run();
  315. // Request should be OK.
  316. ASSERT_EQ(dummy_cv_service_req.net_error, net::OK);
  317. }
  318. // Create updated Chrome Root Store with an invalid cert; update should be
  319. // ignored.
  320. chrome_root_store::RootStore invalid_root_store_proto;
  321. invalid_root_store_proto.set_version_major(
  322. net::CompiledChromeRootStoreVersion() + 2);
  323. chrome_root_store::TrustAnchor* invalid_anchor =
  324. invalid_root_store_proto.add_trust_anchors();
  325. invalid_anchor->set_der("gibberishcert");
  326. invalid_root_store_proto.SerializeToString(&proto_serialized);
  327. cert_verifier::mojom::ChromeRootStorePtr invalid_root_store_ptr =
  328. cert_verifier::mojom::ChromeRootStore::New(
  329. base::as_bytes(base::make_span(proto_serialized)));
  330. // Feed factory the new Chrome Root Store.
  331. cv_service_factory_impl.UpdateChromeRootStore(
  332. std::move(invalid_root_store_ptr));
  333. {
  334. base::RunLoop request_completed_run_loop;
  335. DummyCVServiceRequest dummy_cv_service_req(
  336. request_completed_run_loop.QuitClosure());
  337. mojo::Receiver<mojom::CertVerifierRequest> dummy_cv_service_req_receiver(
  338. &dummy_cv_service_req);
  339. auto net_log(net::NetLogWithSource::Make(
  340. net::NetLog::Get(), net::NetLogSourceType::CERT_VERIFIER_JOB));
  341. cv_service_remote->Verify(
  342. net::CertVerifier::RequestParams(leaf->GetX509Certificate(),
  343. "www.example.com", 0,
  344. /*ocsp_response=*/std::string(),
  345. /*sct_list=*/std::string()),
  346. static_cast<uint32_t>(net_log.source().type), net_log.source().id,
  347. net_log.source().start_time,
  348. dummy_cv_service_req_receiver.BindNewPipeAndPassRemote());
  349. request_completed_run_loop.Run();
  350. // Request should be OK because root store update was ignored.
  351. ASSERT_EQ(dummy_cv_service_req.net_error, net::OK);
  352. }
  353. // Clear all certs from the proto
  354. root_store_proto.clear_trust_anchors();
  355. root_store_proto.SerializeToString(&proto_serialized);
  356. cert_verifier::mojom::ChromeRootStorePtr empty_root_store_ptr =
  357. cert_verifier::mojom::ChromeRootStore::New(
  358. base::as_bytes(base::make_span(proto_serialized)));
  359. // Feed factory the new Chrome Root Store.
  360. cv_service_factory_impl.UpdateChromeRootStore(
  361. std::move(empty_root_store_ptr));
  362. {
  363. base::RunLoop request_completed_run_loop;
  364. DummyCVServiceRequest dummy_cv_service_req(
  365. request_completed_run_loop.QuitClosure());
  366. mojo::Receiver<mojom::CertVerifierRequest> dummy_cv_service_req_receiver(
  367. &dummy_cv_service_req);
  368. auto net_log(net::NetLogWithSource::Make(
  369. net::NetLog::Get(), net::NetLogSourceType::CERT_VERIFIER_JOB));
  370. cv_service_remote->Verify(
  371. net::CertVerifier::RequestParams(leaf->GetX509Certificate(),
  372. "www.example.com", 0,
  373. /*ocsp_response=*/std::string(),
  374. /*sct_list=*/std::string()),
  375. static_cast<uint32_t>(net_log.source().type), net_log.source().id,
  376. net_log.source().start_time,
  377. dummy_cv_service_req_receiver.BindNewPipeAndPassRemote());
  378. request_completed_run_loop.Run();
  379. // Request should be OK because root store update was ignored.
  380. ASSERT_EQ(dummy_cv_service_req.net_error, net::OK);
  381. }
  382. }
  383. void GetRootStoreInfo(cert_verifier::mojom::ChromeRootStoreInfoPtr* return_ptr,
  384. base::RepeatingClosure quit_closure,
  385. cert_verifier::mojom::ChromeRootStoreInfoPtr info) {
  386. *return_ptr = std::move(info);
  387. quit_closure.Run();
  388. }
  389. TEST(CertVerifierServiceFactoryTest, RootStoreInfoWithUpdatedRootStore) {
  390. // Create leaf and root certs.
  391. base::test::TaskEnvironment task_environment;
  392. std::unique_ptr<net::CertBuilder> leaf, root;
  393. net::CertBuilder::CreateSimpleChain(&leaf, &root);
  394. ASSERT_TRUE(leaf && root);
  395. base::Time now = base::Time::Now();
  396. leaf->SetValidity(now - base::Days(1), now + base::Days(1));
  397. // Create updated Chrome Root Store with just the root cert from above.
  398. chrome_root_store::RootStore root_store_proto;
  399. root_store_proto.set_version_major(net::CompiledChromeRootStoreVersion() + 1);
  400. chrome_root_store::TrustAnchor* anchor = root_store_proto.add_trust_anchors();
  401. anchor->set_der(root->GetDER());
  402. std::string proto_serialized;
  403. root_store_proto.SerializeToString(&proto_serialized);
  404. cert_verifier::mojom::ChromeRootStorePtr root_store_ptr =
  405. cert_verifier::mojom::ChromeRootStore::New(
  406. base::as_bytes(base::make_span(proto_serialized)));
  407. mojo::Remote<mojom::CertVerifierServiceFactory> cv_service_factory_remote;
  408. CertVerifierServiceFactoryImpl cv_service_factory_impl(
  409. cv_service_factory_remote.BindNewPipeAndPassReceiver());
  410. // Feed factory the new Chrome Root Store.
  411. cv_service_factory_impl.UpdateChromeRootStore(std::move(root_store_ptr));
  412. cert_verifier::mojom::ChromeRootStoreInfoPtr info_ptr;
  413. base::RunLoop request_completed_run_loop;
  414. cv_service_factory_remote->GetChromeRootStoreInfo(base::BindOnce(
  415. &GetRootStoreInfo, &info_ptr, request_completed_run_loop.QuitClosure()));
  416. request_completed_run_loop.Run();
  417. ASSERT_TRUE(info_ptr);
  418. EXPECT_EQ(info_ptr->version, root_store_proto.version_major());
  419. ASSERT_EQ(info_ptr->root_cert_info.size(), static_cast<std::size_t>(1));
  420. net::der::Input subject_tlv(&root->GetSubject());
  421. net::RDNSequence subject_rdn;
  422. ASSERT_TRUE(net::ParseName(subject_tlv, &subject_rdn));
  423. std::string subject_string;
  424. ASSERT_TRUE(net::ConvertToRFC2253(subject_rdn, &subject_string));
  425. EXPECT_EQ(info_ptr->root_cert_info[0]->name, subject_string);
  426. net::SHA256HashValue root_hash =
  427. net::X509Certificate::CalculateFingerprint256(root->GetCertBuffer());
  428. EXPECT_EQ(info_ptr->root_cert_info[0]->sha256hash_hex,
  429. base::HexEncode(root_hash.data, std::size(root_hash.data)));
  430. }
  431. TEST(CertVerifierServiceFactoryTest, RootStoreInfoWithCompiledRootStore) {
  432. base::test::TaskEnvironment task_environment;
  433. net::ParsedCertificateList anchors = net::CompiledChromeRootStoreAnchors();
  434. mojo::Remote<mojom::CertVerifierServiceFactory> cv_service_factory_remote;
  435. CertVerifierServiceFactoryImpl cv_service_factory_impl(
  436. cv_service_factory_remote.BindNewPipeAndPassReceiver());
  437. cert_verifier::mojom::ChromeRootStoreInfoPtr info_ptr;
  438. base::RunLoop request_completed_run_loop;
  439. cv_service_factory_remote->GetChromeRootStoreInfo(base::BindOnce(
  440. &GetRootStoreInfo, &info_ptr, request_completed_run_loop.QuitClosure()));
  441. request_completed_run_loop.Run();
  442. ASSERT_TRUE(info_ptr);
  443. EXPECT_EQ(info_ptr->version, net::CompiledChromeRootStoreVersion());
  444. EXPECT_EQ(info_ptr->root_cert_info.size(), anchors.size());
  445. }
  446. #endif
  447. } // namespace cert_verifier