net/cert/test_root_certs.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_CERT_TEST_ROOT_CERTS_H_
   6 #define NET_CERT_TEST_ROOT_CERTS_H_
   7
   8 #include "base/lazy_instance.h"
   9 #include "base/memory/ref_counted.h"
  10 #include "build/build_config.h"
  11 #include "net/base/net_export.h"
  12
  13 #if defined(USE_NSS) || defined(OS_IOS)
  14 #include <list>
  15 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID)
  16 #include <vector>
  17 #elif defined(OS_WIN)
  18 #include <windows.h>
  19 #include <wincrypt.h>
  20 #elif defined(OS_MACOSX)
  21 #include <CoreFoundation/CFArray.h>
  22 #include <Security/SecTrust.h>
  23 #include "base/mac/scoped_cftyperef.h"
  24 #endif
  25
  26 namespace base {
  27 class FilePath;
  28 }
  29
  30 namespace net {
  31
  32 class X509Certificate;
  33
  34 // TestRootCerts is a helper class for unit tests that is used to
  35 // artificially mark a certificate as trusted, independent of the local
  36 // machine configuration.
  37 class NET_EXPORT_PRIVATE TestRootCerts {
  38  public:
  39   // Obtains the Singleton instance to the trusted certificates.
  40   static TestRootCerts* GetInstance();
  41
  42   // Returns true if an instance exists, without forcing an initialization.
  43   static bool HasInstance();
  44
  45   // Marks |certificate| as trusted for X509Certificate::Verify(). Returns
  46   // false if the certificate could not be marked trusted.
  47   bool Add(X509Certificate* certificate);
  48
  49   // Reads a single certificate from |file| and marks it as trusted. Returns
  50   // false if an error is encountered, such as being unable to read |file|
  51   // or more than one certificate existing in |file|.
  52   bool AddFromFile(const base::FilePath& file);
  53
  54   // Clears the trusted status of any certificates that were previously
  55   // marked trusted via Add().
  56   void Clear();
  57
  58   // Returns true if there are no certificates that have been marked trusted.
  59   bool IsEmpty() const;
  60
  61 #if defined(OS_MACOSX) && !defined(OS_IOS)
  62   CFArrayRef temporary_roots() const { return temporary_roots_; }
  63
  64   // Modifies the root certificates of |trust_ref| to include the
  65   // certificates stored in |temporary_roots_|. If IsEmpty() is true, this
  66   // does not modify |trust_ref|.
  67   OSStatus FixupSecTrustRef(SecTrustRef trust_ref) const;
  68
  69   // Configures whether or not the default/system root store should also
  70   // be trusted. By default, this is true, indicating that the TestRootCerts
  71   // are used in addition to OS trust store.
  72   void SetAllowSystemTrust(bool allow_system_trust);
  73 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID)
  74   const std::vector<scoped_refptr<X509Certificate> >&
  75       temporary_roots() const { return temporary_roots_; }
  76 #elif defined(OS_WIN)
  77   HCERTSTORE temporary_roots() const { return temporary_roots_; }
  78
  79   // Returns an HCERTCHAINENGINE suitable to be used for certificate
  80   // validation routines, or NULL to indicate that the default system chain
  81   // engine is appropriate. The caller is responsible for freeing the
  82   // returned HCERTCHAINENGINE.
  83   HCERTCHAINENGINE GetChainEngine() const;
  84 #endif
  85
  86  private:
  87   friend struct base::DefaultLazyInstanceTraits<TestRootCerts>;
  88
  89   TestRootCerts();
  90   ~TestRootCerts();
  91
  92   // Performs platform-dependent initialization.
  93   void Init();
  94
  95 #if defined(USE_NSS) || defined(OS_IOS)
  96   // It is necessary to maintain a cache of the original certificate trust
  97   // settings, in order to restore them when Clear() is called.
  98   class TrustEntry;
  99   std::list<TrustEntry*> trust_cache_;
 100 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID)
 101   std::vector<scoped_refptr<X509Certificate> > temporary_roots_;
 102 #elif defined(OS_WIN)
 103   HCERTSTORE temporary_roots_;
 104 #elif defined(OS_MACOSX)
 105   base::ScopedCFTypeRef<CFMutableArrayRef> temporary_roots_;
 106   bool allow_system_trust_;
 107 #endif
 108
 109 #if defined(OS_WIN) || defined(OS_ANDROID)
 110   // True if there are no temporarily trusted root certificates.
 111   bool empty_;
 112 #endif
 113
 114   DISALLOW_COPY_AND_ASSIGN(TestRootCerts);
 115 };
 116
 117 // Scoped helper for unittests to handle safely managing trusted roots.
 118 class NET_EXPORT_PRIVATE ScopedTestRoot {
 119  public:
 120   ScopedTestRoot();
 121   // Creates a ScopedTestRoot that will adds|cert| to the TestRootCerts store.
 122   explicit ScopedTestRoot(X509Certificate* cert);
 123   ~ScopedTestRoot();
 124
 125   // Assigns |cert| to be the new test root cert. If |cert| is NULL, undoes
 126   // any work the ScopedTestRoot may have previously done.
 127   // If |cert_| contains a certificate (due to a prior call to Reset or due to
 128   // a cert being passed at construction), the existing TestRootCerts store is
 129   // cleared.
 130   void Reset(X509Certificate* cert);
 131
 132  private:
 133   scoped_refptr<X509Certificate> cert_;
 134
 135   DISALLOW_COPY_AND_ASSIGN(ScopedTestRoot);
 136 };
 137
 138 }  // namespace net
 139
 140 #endif  // NET_CERT_TEST_ROOT_CERTS_H_