net/cert/x509_certificate_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/cert/x509_certificate.h"
   6
   7 #include "base/basictypes.h"
   8 #include "base/files/file_path.h"
   9 #include "base/memory/scoped_ptr.h"
  10 #include "base/pickle.h"
  11 #include "base/sha1.h"
  12 #include "base/strings/string_number_conversions.h"
  13 #include "base/strings/string_split.h"
  14 #include "crypto/rsa_private_key.h"
  15 #include "net/base/net_errors.h"
  16 #include "net/base/test_data_directory.h"
  17 #include "net/cert/asn1_util.h"
  18 #include "net/test/cert_test_util.h"
  19 #include "net/test/test_certificate_data.h"
  20 #include "testing/gtest/include/gtest/gtest.h"
  21
  22 #if defined(USE_NSS)
  23 #include <cert.h>
  24 #endif
  25
  26 #if defined(OS_WIN)
  27 #include "base/win/windows_version.h"
  28 #endif
  29
  30 using base::HexEncode;
  31 using base::Time;
  32
  33 namespace net {
  34
  35 // Certificates for test data. They're obtained with:
  36 //
  37 // $ openssl s_client -connect [host]:443 -showcerts > /tmp/host.pem < /dev/null
  38 // $ openssl x509 -inform PEM -outform DER < /tmp/host.pem > /tmp/host.der
  39 //
  40 // For fingerprint
  41 // $ openssl x509 -inform DER -fingerprint -noout < /tmp/host.der
  42
  43 // For valid_start, valid_expiry
  44 // $ openssl x509 -inform DER -text -noout < /tmp/host.der |
  45 //    grep -A 2 Validity
  46 // $ date +%s -d '<date str>'
  47
  48 // Google's cert.
  49 uint8 google_fingerprint[] = {
  50   0xab, 0xbe, 0x5e, 0xb4, 0x93, 0x88, 0x4e, 0xe4, 0x60, 0xc6, 0xef, 0xf8,
  51   0xea, 0xd4, 0xb1, 0x55, 0x4b, 0xc9, 0x59, 0x3c
  52 };
  53
  54 // webkit.org's cert.
  55 uint8 webkit_fingerprint[] = {
  56   0xa1, 0x4a, 0x94, 0x46, 0x22, 0x8e, 0x70, 0x66, 0x2b, 0x94, 0xf9, 0xf8,
  57   0x57, 0x83, 0x2d, 0xa2, 0xff, 0xbc, 0x84, 0xc2
  58 };
  59
  60 // thawte.com's cert (it's EV-licious!).
  61 uint8 thawte_fingerprint[] = {
  62   0x85, 0x04, 0x2d, 0xfd, 0x2b, 0x0e, 0xc6, 0xc8, 0xaf, 0x2d, 0x77, 0xd6,
  63   0xa1, 0x3a, 0x64, 0x04, 0x27, 0x90, 0x97, 0x37
  64 };
  65
  66 // A certificate for https://www.unosoft.hu/, whose AIA extension contains
  67 // an LDAP URL without a host name.
  68 uint8 unosoft_hu_fingerprint[] = {
  69   0x32, 0xff, 0xe3, 0xbe, 0x2c, 0x3b, 0xc7, 0xca, 0xbf, 0x2d, 0x64, 0xbd,
  70   0x25, 0x66, 0xf2, 0xec, 0x8b, 0x0f, 0xbf, 0xd8
  71 };
  72
  73 // The fingerprint of the Google certificate used in the parsing tests,
  74 // which is newer than the one included in the x509_certificate_data.h
  75 uint8 google_parse_fingerprint[] = {
  76   0x40, 0x50, 0x62, 0xe5, 0xbe, 0xfd, 0xe4, 0xaf, 0x97, 0xe9, 0x38, 0x2a,
  77   0xf1, 0x6c, 0xc8, 0x7c, 0x8f, 0xb7, 0xc4, 0xe2
  78 };
  79
  80 // The fingerprint for the Thawte SGC certificate
  81 uint8 thawte_parse_fingerprint[] = {
  82   0xec, 0x07, 0x10, 0x03, 0xd8, 0xf5, 0xa3, 0x7f, 0x42, 0xc4, 0x55, 0x7f,
  83   0x65, 0x6a, 0xae, 0x86, 0x65, 0xfa, 0x4b, 0x02
  84 };
  85
  86 // Dec 18 00:00:00 2009 GMT
  87 const double kGoogleParseValidFrom = 1261094400;
  88 // Dec 18 23:59:59 2011 GMT
  89 const double kGoogleParseValidTo = 1324252799;
  90
  91 void CheckGoogleCert(const scoped_refptr<X509Certificate>& google_cert,
  92                      uint8* expected_fingerprint,
  93                      double valid_from, double valid_to) {
  94   ASSERT_NE(static_cast<X509Certificate*>(NULL), google_cert.get());
  95
  96   const CertPrincipal& subject = google_cert->subject();
  97   EXPECT_EQ("www.google.com", subject.common_name);
  98   EXPECT_EQ("Mountain View", subject.locality_name);
  99   EXPECT_EQ("California", subject.state_or_province_name);
 100   EXPECT_EQ("US", subject.country_name);
 101   EXPECT_EQ(0U, subject.street_addresses.size());
 102   ASSERT_EQ(1U, subject.organization_names.size());
 103   EXPECT_EQ("Google Inc", subject.organization_names[0]);
 104   EXPECT_EQ(0U, subject.organization_unit_names.size());
 105   EXPECT_EQ(0U, subject.domain_components.size());
 106
 107   const CertPrincipal& issuer = google_cert->issuer();
 108   EXPECT_EQ("Thawte SGC CA", issuer.common_name);
 109   EXPECT_EQ("", issuer.locality_name);
 110   EXPECT_EQ("", issuer.state_or_province_name);
 111   EXPECT_EQ("ZA", issuer.country_name);
 112   EXPECT_EQ(0U, issuer.street_addresses.size());
 113   ASSERT_EQ(1U, issuer.organization_names.size());
 114   EXPECT_EQ("Thawte Consulting (Pty) Ltd.", issuer.organization_names[0]);
 115   EXPECT_EQ(0U, issuer.organization_unit_names.size());
 116   EXPECT_EQ(0U, issuer.domain_components.size());
 117
 118   // Use DoubleT because its epoch is the same on all platforms
 119   const Time& valid_start = google_cert->valid_start();
 120   EXPECT_EQ(valid_from, valid_start.ToDoubleT());
 121
 122   const Time& valid_expiry = google_cert->valid_expiry();
 123   EXPECT_EQ(valid_to, valid_expiry.ToDoubleT());
 124
 125   const SHA1HashValue& fingerprint = google_cert->fingerprint();
 126   for (size_t i = 0; i < 20; ++i)
 127     EXPECT_EQ(expected_fingerprint[i], fingerprint.data[i]);
 128
 129   std::vector<std::string> dns_names;
 130   google_cert->GetDNSNames(&dns_names);
 131   ASSERT_EQ(1U, dns_names.size());
 132   EXPECT_EQ("www.google.com", dns_names[0]);
 133 }
 134
 135 TEST(X509CertificateTest, GoogleCertParsing) {
 136   scoped_refptr<X509Certificate> google_cert(
 137       X509Certificate::CreateFromBytes(
 138           reinterpret_cast<const char*>(google_der), sizeof(google_der)));
 139
 140   CheckGoogleCert(google_cert, google_fingerprint,
 141                   1238192407,   // Mar 27 22:20:07 2009 GMT
 142                   1269728407);  // Mar 27 22:20:07 2010 GMT
 143 }
 144
 145 TEST(X509CertificateTest, WebkitCertParsing) {
 146   scoped_refptr<X509Certificate> webkit_cert(X509Certificate::CreateFromBytes(
 147       reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der)));
 148
 149   ASSERT_NE(static_cast<X509Certificate*>(NULL), webkit_cert.get());
 150
 151   const CertPrincipal& subject = webkit_cert->subject();
 152   EXPECT_EQ("Cupertino", subject.locality_name);
 153   EXPECT_EQ("California", subject.state_or_province_name);
 154   EXPECT_EQ("US", subject.country_name);
 155   EXPECT_EQ(0U, subject.street_addresses.size());
 156   ASSERT_EQ(1U, subject.organization_names.size());
 157   EXPECT_EQ("Apple Inc.", subject.organization_names[0]);
 158   ASSERT_EQ(1U, subject.organization_unit_names.size());
 159   EXPECT_EQ("Mac OS Forge", subject.organization_unit_names[0]);
 160   EXPECT_EQ(0U, subject.domain_components.size());
 161
 162   const CertPrincipal& issuer = webkit_cert->issuer();
 163   EXPECT_EQ("Go Daddy Secure Certification Authority", issuer.common_name);
 164   EXPECT_EQ("Scottsdale", issuer.locality_name);
 165   EXPECT_EQ("Arizona", issuer.state_or_province_name);
 166   EXPECT_EQ("US", issuer.country_name);
 167   EXPECT_EQ(0U, issuer.street_addresses.size());
 168   ASSERT_EQ(1U, issuer.organization_names.size());
 169   EXPECT_EQ("GoDaddy.com, Inc.", issuer.organization_names[0]);
 170   ASSERT_EQ(1U, issuer.organization_unit_names.size());
 171   EXPECT_EQ("http://certificates.godaddy.com/repository",
 172       issuer.organization_unit_names[0]);
 173   EXPECT_EQ(0U, issuer.domain_components.size());
 174
 175   // Use DoubleT because its epoch is the same on all platforms
 176   const Time& valid_start = webkit_cert->valid_start();
 177   EXPECT_EQ(1205883319, valid_start.ToDoubleT());  // Mar 18 23:35:19 2008 GMT
 178
 179   const Time& valid_expiry = webkit_cert->valid_expiry();
 180   EXPECT_EQ(1300491319, valid_expiry.ToDoubleT());  // Mar 18 23:35:19 2011 GMT
 181
 182   const SHA1HashValue& fingerprint = webkit_cert->fingerprint();
 183   for (size_t i = 0; i < 20; ++i)
 184     EXPECT_EQ(webkit_fingerprint[i], fingerprint.data[i]);
 185
 186   std::vector<std::string> dns_names;
 187   webkit_cert->GetDNSNames(&dns_names);
 188   ASSERT_EQ(2U, dns_names.size());
 189   EXPECT_EQ("*.webkit.org", dns_names[0]);
 190   EXPECT_EQ("webkit.org", dns_names[1]);
 191
 192   // Test that the wildcard cert matches properly.
 193   bool unused = false;
 194   EXPECT_TRUE(webkit_cert->VerifyNameMatch("www.webkit.org", &unused));
 195   EXPECT_TRUE(webkit_cert->VerifyNameMatch("foo.webkit.org", &unused));
 196   EXPECT_TRUE(webkit_cert->VerifyNameMatch("webkit.org", &unused));
 197   EXPECT_FALSE(webkit_cert->VerifyNameMatch("www.webkit.com", &unused));
 198   EXPECT_FALSE(webkit_cert->VerifyNameMatch("www.foo.webkit.com", &unused));
 199 }
 200
 201 TEST(X509CertificateTest, ThawteCertParsing) {
 202   scoped_refptr<X509Certificate> thawte_cert(X509Certificate::CreateFromBytes(
 203       reinterpret_cast<const char*>(thawte_der), sizeof(thawte_der)));
 204
 205   ASSERT_NE(static_cast<X509Certificate*>(NULL), thawte_cert.get());
 206
 207   const CertPrincipal& subject = thawte_cert->subject();
 208   EXPECT_EQ("www.thawte.com", subject.common_name);
 209   EXPECT_EQ("Mountain View", subject.locality_name);
 210   EXPECT_EQ("California", subject.state_or_province_name);
 211   EXPECT_EQ("US", subject.country_name);
 212   EXPECT_EQ(0U, subject.street_addresses.size());
 213   ASSERT_EQ(1U, subject.organization_names.size());
 214   EXPECT_EQ("Thawte Inc", subject.organization_names[0]);
 215   EXPECT_EQ(0U, subject.organization_unit_names.size());
 216   EXPECT_EQ(0U, subject.domain_components.size());
 217
 218   const CertPrincipal& issuer = thawte_cert->issuer();
 219   EXPECT_EQ("thawte Extended Validation SSL CA", issuer.common_name);
 220   EXPECT_EQ("", issuer.locality_name);
 221   EXPECT_EQ("", issuer.state_or_province_name);
 222   EXPECT_EQ("US", issuer.country_name);
 223   EXPECT_EQ(0U, issuer.street_addresses.size());
 224   ASSERT_EQ(1U, issuer.organization_names.size());
 225   EXPECT_EQ("thawte, Inc.", issuer.organization_names[0]);
 226   ASSERT_EQ(1U, issuer.organization_unit_names.size());
 227   EXPECT_EQ("Terms of use at https://www.thawte.com/cps (c)06",
 228             issuer.organization_unit_names[0]);
 229   EXPECT_EQ(0U, issuer.domain_components.size());
 230
 231   // Use DoubleT because its epoch is the same on all platforms
 232   const Time& valid_start = thawte_cert->valid_start();
 233   EXPECT_EQ(1227052800, valid_start.ToDoubleT());  // Nov 19 00:00:00 2008 GMT
 234
 235   const Time& valid_expiry = thawte_cert->valid_expiry();
 236   EXPECT_EQ(1263772799, valid_expiry.ToDoubleT());  // Jan 17 23:59:59 2010 GMT
 237
 238   const SHA1HashValue& fingerprint = thawte_cert->fingerprint();
 239   for (size_t i = 0; i < 20; ++i)
 240     EXPECT_EQ(thawte_fingerprint[i], fingerprint.data[i]);
 241
 242   std::vector<std::string> dns_names;
 243   thawte_cert->GetDNSNames(&dns_names);
 244   ASSERT_EQ(1U, dns_names.size());
 245   EXPECT_EQ("www.thawte.com", dns_names[0]);
 246 }
 247
 248 // Test that all desired AttributeAndValue pairs can be extracted when only
 249 // a single RelativeDistinguishedName is present. "Normally" there is only
 250 // one AVA per RDN, but some CAs place all AVAs within a single RDN.
 251 // This is a regression test for http://crbug.com/101009
 252 TEST(X509CertificateTest, MultivalueRDN) {
 253   base::FilePath certs_dir = GetTestCertsDirectory();
 254
 255   scoped_refptr<X509Certificate> multivalue_rdn_cert =
 256       ImportCertFromFile(certs_dir, "multivalue_rdn.pem");
 257   ASSERT_NE(static_cast<X509Certificate*>(NULL), multivalue_rdn_cert.get());
 258
 259   const CertPrincipal& subject = multivalue_rdn_cert->subject();
 260   EXPECT_EQ("Multivalue RDN Test", subject.common_name);
 261   EXPECT_EQ("", subject.locality_name);
 262   EXPECT_EQ("", subject.state_or_province_name);
 263   EXPECT_EQ("US", subject.country_name);
 264   EXPECT_EQ(0U, subject.street_addresses.size());
 265   ASSERT_EQ(1U, subject.organization_names.size());
 266   EXPECT_EQ("Chromium", subject.organization_names[0]);
 267   ASSERT_EQ(1U, subject.organization_unit_names.size());
 268   EXPECT_EQ("Chromium net_unittests", subject.organization_unit_names[0]);
 269   ASSERT_EQ(1U, subject.domain_components.size());
 270   EXPECT_EQ("Chromium", subject.domain_components[0]);
 271 }
 272
 273 // Test that characters which would normally be escaped in the string form,
 274 // such as '=' or '"', are not escaped when parsed as individual components.
 275 // This is a regression test for http://crbug.com/102839
 276 TEST(X509CertificateTest, UnescapedSpecialCharacters) {
 277   base::FilePath certs_dir = GetTestCertsDirectory();
 278
 279   scoped_refptr<X509Certificate> unescaped_cert =
 280       ImportCertFromFile(certs_dir, "unescaped.pem");
 281   ASSERT_NE(static_cast<X509Certificate*>(NULL), unescaped_cert.get());
 282
 283   const CertPrincipal& subject = unescaped_cert->subject();
 284   EXPECT_EQ("127.0.0.1", subject.common_name);
 285   EXPECT_EQ("Mountain View", subject.locality_name);
 286   EXPECT_EQ("California", subject.state_or_province_name);
 287   EXPECT_EQ("US", subject.country_name);
 288   ASSERT_EQ(1U, subject.street_addresses.size());
 289   EXPECT_EQ("1600 Amphitheatre Parkway", subject.street_addresses[0]);
 290   ASSERT_EQ(1U, subject.organization_names.size());
 291   EXPECT_EQ("Chromium = \"net_unittests\"", subject.organization_names[0]);
 292   ASSERT_EQ(2U, subject.organization_unit_names.size());
 293   EXPECT_EQ("net_unittests", subject.organization_unit_names[0]);
 294   EXPECT_EQ("Chromium", subject.organization_unit_names[1]);
 295   EXPECT_EQ(0U, subject.domain_components.size());
 296 }
 297
 298 TEST(X509CertificateTest, SerialNumbers) {
 299   scoped_refptr<X509Certificate> google_cert(
 300       X509Certificate::CreateFromBytes(
 301           reinterpret_cast<const char*>(google_der), sizeof(google_der)));
 302
 303   static const uint8 google_serial[16] = {
 304     0x01,0x2a,0x39,0x76,0x0d,0x3f,0x4f,0xc9,
 305     0x0b,0xe7,0xbd,0x2b,0xcf,0x95,0x2e,0x7a,
 306   };
 307
 308   ASSERT_EQ(sizeof(google_serial), google_cert->serial_number().size());
 309   EXPECT_TRUE(memcmp(google_cert->serial_number().data(), google_serial,
 310                      sizeof(google_serial)) == 0);
 311
 312   // We also want to check a serial number where the first byte is >= 0x80 in
 313   // case the underlying library tries to pad it.
 314   scoped_refptr<X509Certificate> paypal_null_cert(
 315       X509Certificate::CreateFromBytes(
 316           reinterpret_cast<const char*>(paypal_null_der),
 317           sizeof(paypal_null_der)));
 318
 319   static const uint8 paypal_null_serial[3] = {0x00, 0xf0, 0x9b};
 320   ASSERT_EQ(sizeof(paypal_null_serial),
 321             paypal_null_cert->serial_number().size());
 322   EXPECT_TRUE(memcmp(paypal_null_cert->serial_number().data(),
 323                      paypal_null_serial, sizeof(paypal_null_serial)) == 0);
 324 }
 325
 326 TEST(X509CertificateTest, CAFingerprints) {
 327   base::FilePath certs_dir = GetTestCertsDirectory();
 328
 329   scoped_refptr<X509Certificate> server_cert =
 330       ImportCertFromFile(certs_dir, "salesforce_com_test.pem");
 331   ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert.get());
 332
 333   scoped_refptr<X509Certificate> intermediate_cert1 =
 334       ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2011.pem");
 335   ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert1.get());
 336
 337   scoped_refptr<X509Certificate> intermediate_cert2 =
 338       ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2016.pem");
 339   ASSERT_NE(static_cast<X509Certificate*>(NULL), intermediate_cert2.get());
 340
 341   X509Certificate::OSCertHandles intermediates;
 342   intermediates.push_back(intermediate_cert1->os_cert_handle());
 343   scoped_refptr<X509Certificate> cert_chain1 =
 344       X509Certificate::CreateFromHandle(server_cert->os_cert_handle(),
 345                                         intermediates);
 346
 347   intermediates.clear();
 348   intermediates.push_back(intermediate_cert2->os_cert_handle());
 349   scoped_refptr<X509Certificate> cert_chain2 =
 350       X509Certificate::CreateFromHandle(server_cert->os_cert_handle(),
 351                                         intermediates);
 352
 353   // No intermediate CA certicates.
 354   intermediates.clear();
 355   scoped_refptr<X509Certificate> cert_chain3 =
 356       X509Certificate::CreateFromHandle(server_cert->os_cert_handle(),
 357                                         intermediates);
 358
 359   static const uint8 cert_chain1_ca_fingerprint[20] = {
 360     0xc2, 0xf0, 0x08, 0x7d, 0x01, 0xe6, 0x86, 0x05, 0x3a, 0x4d,
 361     0x63, 0x3e, 0x7e, 0x70, 0xd4, 0xef, 0x65, 0xc2, 0xcc, 0x4f
 362   };
 363   static const uint8 cert_chain2_ca_fingerprint[20] = {
 364     0xd5, 0x59, 0xa5, 0x86, 0x66, 0x9b, 0x08, 0xf4, 0x6a, 0x30,
 365     0xa1, 0x33, 0xf8, 0xa9, 0xed, 0x3d, 0x03, 0x8e, 0x2e, 0xa8
 366   };
 367   // The SHA-1 hash of nothing.
 368   static const uint8 cert_chain3_ca_fingerprint[20] = {
 369     0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b, 0x0d, 0x32, 0x55,
 370     0xbf, 0xef, 0x95, 0x60, 0x18, 0x90, 0xaf, 0xd8, 0x07, 0x09
 371   };
 372   EXPECT_TRUE(memcmp(cert_chain1->ca_fingerprint().data,
 373                      cert_chain1_ca_fingerprint, 20) == 0);
 374   EXPECT_TRUE(memcmp(cert_chain2->ca_fingerprint().data,
 375                      cert_chain2_ca_fingerprint, 20) == 0);
 376   EXPECT_TRUE(memcmp(cert_chain3->ca_fingerprint().data,
 377                      cert_chain3_ca_fingerprint, 20) == 0);
 378
 379   // Test the SHA-256 hash calculation functions explicitly since they are not
 380   // used by X509Certificate internally.
 381   static const uint8 cert_chain1_ca_fingerprint_256[32] = {
 382     0x51, 0x15, 0x30, 0x49, 0x97, 0x54, 0xf8, 0xb4, 0x17, 0x41,
 383     0x6b, 0x58, 0x78, 0xb0, 0x89, 0xd2, 0xc3, 0xae, 0x66, 0xc1,
 384     0x16, 0x80, 0xa0, 0x78, 0xe7, 0x53, 0x45, 0xa2, 0xfb, 0x80,
 385     0xe1, 0x07
 386   };
 387   static const uint8 cert_chain2_ca_fingerprint_256[32] = {
 388     0x00, 0xbd, 0x2b, 0x0e, 0xdd, 0x83, 0x40, 0xb1, 0x74, 0x6c,
 389     0xc3, 0x95, 0xc0, 0xe3, 0x55, 0xb2, 0x16, 0x58, 0x53, 0xfd,
 390     0xb9, 0x3c, 0x52, 0xda, 0xdd, 0xa8, 0x22, 0x8b, 0x07, 0x00,
 391     0x2d, 0xce
 392   };
 393   // The SHA-256 hash of nothing.
 394   static const uint8 cert_chain3_ca_fingerprint_256[32] = {
 395     0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb,
 396     0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4,
 397     0x64, 0x9b, 0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52,
 398     0xb8, 0x55
 399   };
 400   SHA256HashValue ca_fingerprint_256_1 =
 401       X509Certificate::CalculateCAFingerprint256(
 402           cert_chain1->GetIntermediateCertificates());
 403   SHA256HashValue ca_fingerprint_256_2 =
 404       X509Certificate::CalculateCAFingerprint256(
 405           cert_chain2->GetIntermediateCertificates());
 406   SHA256HashValue ca_fingerprint_256_3 =
 407       X509Certificate::CalculateCAFingerprint256(
 408           cert_chain3->GetIntermediateCertificates());
 409   EXPECT_TRUE(memcmp(ca_fingerprint_256_1.data,
 410                      cert_chain1_ca_fingerprint_256, 32) == 0);
 411   EXPECT_TRUE(memcmp(ca_fingerprint_256_2.data,
 412                      cert_chain2_ca_fingerprint_256, 32) == 0);
 413   EXPECT_TRUE(memcmp(ca_fingerprint_256_3.data,
 414                      cert_chain3_ca_fingerprint_256, 32) == 0);
 415
 416   static const uint8 cert_chain1_chain_fingerprint_256[32] = {
 417     0xac, 0xff, 0xcc, 0x63, 0x0d, 0xd0, 0xa7, 0x19, 0x78, 0xb5,
 418     0x8a, 0x47, 0x8b, 0x67, 0x97, 0xcb, 0x8d, 0xe1, 0x6a, 0x8a,
 419     0x57, 0x70, 0xda, 0x9a, 0x53, 0x72, 0xe2, 0xa0, 0x08, 0xab,
 420     0xcc, 0x8f
 421   };
 422   static const uint8 cert_chain2_chain_fingerprint_256[32] = {
 423     0x67, 0x3a, 0x11, 0x20, 0xd6, 0x94, 0x14, 0xe4, 0x16, 0x9f,
 424     0x58, 0xe2, 0x8b, 0xf7, 0x27, 0xed, 0xbb, 0xe8, 0xa7, 0xff,
 425     0x1c, 0x8c, 0x0f, 0x21, 0x38, 0x16, 0x7c, 0xad, 0x1f, 0x22,
 426     0x6f, 0x9b
 427   };
 428   static const uint8 cert_chain3_chain_fingerprint_256[32] = {
 429     0x16, 0x7a, 0xbd, 0xb4, 0x57, 0x04, 0x65, 0x3c, 0x3b, 0xef,
 430     0x6e, 0x6a, 0xa6, 0x02, 0x73, 0x30, 0x3e, 0x34, 0x1b, 0x43,
 431     0xc2, 0x7c, 0x98, 0x52, 0x9f, 0x34, 0x7f, 0x55, 0x97, 0xe9,
 432     0x1a, 0x10
 433   };
 434   SHA256HashValue chain_fingerprint_256_1 =
 435       X509Certificate::CalculateChainFingerprint256(
 436           cert_chain1->os_cert_handle(),
 437           cert_chain1->GetIntermediateCertificates());
 438   SHA256HashValue chain_fingerprint_256_2 =
 439       X509Certificate::CalculateChainFingerprint256(
 440           cert_chain2->os_cert_handle(),
 441           cert_chain2->GetIntermediateCertificates());
 442   SHA256HashValue chain_fingerprint_256_3 =
 443       X509Certificate::CalculateChainFingerprint256(
 444           cert_chain3->os_cert_handle(),
 445           cert_chain3->GetIntermediateCertificates());
 446   EXPECT_TRUE(memcmp(chain_fingerprint_256_1.data,
 447                      cert_chain1_chain_fingerprint_256, 32) == 0);
 448   EXPECT_TRUE(memcmp(chain_fingerprint_256_2.data,
 449                      cert_chain2_chain_fingerprint_256, 32) == 0);
 450   EXPECT_TRUE(memcmp(chain_fingerprint_256_3.data,
 451                      cert_chain3_chain_fingerprint_256, 32) == 0);
 452 }
 453
 454 TEST(X509CertificateTest, ParseSubjectAltNames) {
 455   base::FilePath certs_dir = GetTestCertsDirectory();
 456
 457   scoped_refptr<X509Certificate> san_cert =
 458       ImportCertFromFile(certs_dir, "subjectAltName_sanity_check.pem");
 459   ASSERT_NE(static_cast<X509Certificate*>(NULL), san_cert.get());
 460
 461   std::vector<std::string> dns_names;
 462   std::vector<std::string> ip_addresses;
 463   san_cert->GetSubjectAltName(&dns_names, &ip_addresses);
 464
 465   // Ensure that DNS names are correctly parsed.
 466   ASSERT_EQ(1U, dns_names.size());
 467   EXPECT_EQ("test.example", dns_names[0]);
 468
 469   // Ensure that both IPv4 and IPv6 addresses are correctly parsed.
 470   ASSERT_EQ(2U, ip_addresses.size());
 471
 472   static const uint8 kIPv4Address[] = {
 473       0x7F, 0x00, 0x00, 0x02
 474   };
 475   ASSERT_EQ(arraysize(kIPv4Address), ip_addresses[0].size());
 476   EXPECT_EQ(0, memcmp(ip_addresses[0].data(), kIPv4Address,
 477                       arraysize(kIPv4Address)));
 478
 479   static const uint8 kIPv6Address[] = {
 480       0xFE, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 481       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
 482   };
 483   ASSERT_EQ(arraysize(kIPv6Address), ip_addresses[1].size());
 484   EXPECT_EQ(0, memcmp(ip_addresses[1].data(), kIPv6Address,
 485                       arraysize(kIPv6Address)));
 486
 487   // Ensure the subjectAltName dirName has not influenced the handling of
 488   // the subject commonName.
 489   EXPECT_EQ("127.0.0.1", san_cert->subject().common_name);
 490 }
 491
 492 TEST(X509CertificateTest, ExtractSPKIFromDERCert) {
 493   base::FilePath certs_dir = GetTestCertsDirectory();
 494   scoped_refptr<X509Certificate> cert =
 495       ImportCertFromFile(certs_dir, "nist.der");
 496   ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get());
 497
 498   std::string derBytes;
 499   EXPECT_TRUE(X509Certificate::GetDEREncoded(cert->os_cert_handle(),
 500                                              &derBytes));
 501
 502   base::StringPiece spkiBytes;
 503   EXPECT_TRUE(asn1::ExtractSPKIFromDERCert(derBytes, &spkiBytes));
 504
 505   uint8 hash[base::kSHA1Length];
 506   base::SHA1HashBytes(reinterpret_cast<const uint8*>(spkiBytes.data()),
 507                       spkiBytes.size(), hash);
 508
 509   EXPECT_EQ(0, memcmp(hash, kNistSPKIHash, sizeof(hash)));
 510 }
 511
 512 TEST(X509CertificateTest, ExtractCRLURLsFromDERCert) {
 513   base::FilePath certs_dir = GetTestCertsDirectory();
 514   scoped_refptr<X509Certificate> cert =
 515       ImportCertFromFile(certs_dir, "nist.der");
 516   ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get());
 517
 518   std::string derBytes;
 519   EXPECT_TRUE(X509Certificate::GetDEREncoded(cert->os_cert_handle(),
 520                                              &derBytes));
 521
 522   std::vector<base::StringPiece> crl_urls;
 523   EXPECT_TRUE(asn1::ExtractCRLURLsFromDERCert(derBytes, &crl_urls));
 524
 525   EXPECT_EQ(1u, crl_urls.size());
 526   if (crl_urls.size() > 0) {
 527     EXPECT_EQ("http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl",
 528               crl_urls[0].as_string());
 529   }
 530 }
 531
 532 // Tests X509CertificateCache via X509Certificate::CreateFromHandle.  We
 533 // call X509Certificate::CreateFromHandle several times and observe whether
 534 // it returns a cached or new OSCertHandle.
 535 TEST(X509CertificateTest, Cache) {
 536   X509Certificate::OSCertHandle google_cert_handle;
 537   X509Certificate::OSCertHandle thawte_cert_handle;
 538
 539   // Add a single certificate to the certificate cache.
 540   google_cert_handle = X509Certificate::CreateOSCertHandleFromBytes(
 541       reinterpret_cast<const char*>(google_der), sizeof(google_der));
 542   scoped_refptr<X509Certificate> cert1(X509Certificate::CreateFromHandle(
 543       google_cert_handle, X509Certificate::OSCertHandles()));
 544   X509Certificate::FreeOSCertHandle(google_cert_handle);
 545
 546   // Add the same certificate, but as a new handle.
 547   google_cert_handle = X509Certificate::CreateOSCertHandleFromBytes(
 548       reinterpret_cast<const char*>(google_der), sizeof(google_der));
 549   scoped_refptr<X509Certificate> cert2(X509Certificate::CreateFromHandle(
 550       google_cert_handle, X509Certificate::OSCertHandles()));
 551   X509Certificate::FreeOSCertHandle(google_cert_handle);
 552
 553   // A new X509Certificate should be returned.
 554   EXPECT_NE(cert1.get(), cert2.get());
 555   // But both instances should share the underlying OS certificate handle.
 556   EXPECT_EQ(cert1->os_cert_handle(), cert2->os_cert_handle());
 557   EXPECT_EQ(0u, cert1->GetIntermediateCertificates().size());
 558   EXPECT_EQ(0u, cert2->GetIntermediateCertificates().size());
 559
 560   // Add the same certificate, but this time with an intermediate. This
 561   // should result in the intermediate being cached. Note that this is not
 562   // a legitimate chain, but is suitable for testing.
 563   google_cert_handle = X509Certificate::CreateOSCertHandleFromBytes(
 564       reinterpret_cast<const char*>(google_der), sizeof(google_der));
 565   thawte_cert_handle = X509Certificate::CreateOSCertHandleFromBytes(
 566       reinterpret_cast<const char*>(thawte_der), sizeof(thawte_der));
 567   X509Certificate::OSCertHandles intermediates;
 568   intermediates.push_back(thawte_cert_handle);
 569   scoped_refptr<X509Certificate> cert3(X509Certificate::CreateFromHandle(
 570       google_cert_handle, intermediates));
 571   X509Certificate::FreeOSCertHandle(google_cert_handle);
 572   X509Certificate::FreeOSCertHandle(thawte_cert_handle);
 573
 574   // Test that the new certificate, even with intermediates, results in the
 575   // same underlying handle being used.
 576   EXPECT_EQ(cert1->os_cert_handle(), cert3->os_cert_handle());
 577   // Though they use the same OS handle, the intermediates should be different.
 578   EXPECT_NE(cert1->GetIntermediateCertificates().size(),
 579       cert3->GetIntermediateCertificates().size());
 580 }
 581
 582 TEST(X509CertificateTest, Pickle) {
 583   X509Certificate::OSCertHandle google_cert_handle =
 584       X509Certificate::CreateOSCertHandleFromBytes(
 585           reinterpret_cast<const char*>(google_der), sizeof(google_der));
 586   X509Certificate::OSCertHandle thawte_cert_handle =
 587       X509Certificate::CreateOSCertHandleFromBytes(
 588           reinterpret_cast<const char*>(thawte_der), sizeof(thawte_der));
 589
 590   X509Certificate::OSCertHandles intermediates;
 591   intermediates.push_back(thawte_cert_handle);
 592   scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle(
 593       google_cert_handle, intermediates);
 594   ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get());
 595
 596   X509Certificate::FreeOSCertHandle(google_cert_handle);
 597   X509Certificate::FreeOSCertHandle(thawte_cert_handle);
 598
 599   Pickle pickle;
 600   cert->Persist(&pickle);
 601
 602   PickleIterator iter(pickle);
 603   scoped_refptr<X509Certificate> cert_from_pickle =
 604       X509Certificate::CreateFromPickle(
 605           pickle, &iter, X509Certificate::PICKLETYPE_CERTIFICATE_CHAIN_V3);
 606   ASSERT_NE(static_cast<X509Certificate*>(NULL), cert_from_pickle.get());
 607   EXPECT_TRUE(X509Certificate::IsSameOSCert(
 608       cert->os_cert_handle(), cert_from_pickle->os_cert_handle()));
 609   const X509Certificate::OSCertHandles& cert_intermediates =
 610       cert->GetIntermediateCertificates();
 611   const X509Certificate::OSCertHandles& pickle_intermediates =
 612       cert_from_pickle->GetIntermediateCertificates();
 613   ASSERT_EQ(cert_intermediates.size(), pickle_intermediates.size());
 614   for (size_t i = 0; i < cert_intermediates.size(); ++i) {
 615     EXPECT_TRUE(X509Certificate::IsSameOSCert(cert_intermediates[i],
 616                                               pickle_intermediates[i]));
 617   }
 618 }
 619
 620 TEST(X509CertificateTest, IntermediateCertificates) {
 621   scoped_refptr<X509Certificate> webkit_cert(
 622       X509Certificate::CreateFromBytes(
 623           reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der)));
 624
 625   scoped_refptr<X509Certificate> thawte_cert(
 626       X509Certificate::CreateFromBytes(
 627           reinterpret_cast<const char*>(thawte_der), sizeof(thawte_der)));
 628
 629   X509Certificate::OSCertHandle google_handle;
 630   // Create object with no intermediates:
 631   google_handle = X509Certificate::CreateOSCertHandleFromBytes(
 632       reinterpret_cast<const char*>(google_der), sizeof(google_der));
 633   X509Certificate::OSCertHandles intermediates1;
 634   scoped_refptr<X509Certificate> cert1;
 635   cert1 = X509Certificate::CreateFromHandle(google_handle, intermediates1);
 636   EXPECT_EQ(0u, cert1->GetIntermediateCertificates().size());
 637
 638   // Create object with 2 intermediates:
 639   X509Certificate::OSCertHandles intermediates2;
 640   intermediates2.push_back(webkit_cert->os_cert_handle());
 641   intermediates2.push_back(thawte_cert->os_cert_handle());
 642   scoped_refptr<X509Certificate> cert2;
 643   cert2 = X509Certificate::CreateFromHandle(google_handle, intermediates2);
 644
 645   // Verify it has all the intermediates:
 646   const X509Certificate::OSCertHandles& cert2_intermediates =
 647       cert2->GetIntermediateCertificates();
 648   ASSERT_EQ(2u, cert2_intermediates.size());
 649   EXPECT_TRUE(X509Certificate::IsSameOSCert(cert2_intermediates[0],
 650                                             webkit_cert->os_cert_handle()));
 651   EXPECT_TRUE(X509Certificate::IsSameOSCert(cert2_intermediates[1],
 652                                             thawte_cert->os_cert_handle()));
 653
 654   // Cleanup
 655   X509Certificate::FreeOSCertHandle(google_handle);
 656 }
 657
 658 TEST(X509CertificateTest, IsIssuedByEncoded) {
 659   base::FilePath certs_dir = GetTestCertsDirectory();
 660
 661   // Test a client certificate from MIT.
 662   scoped_refptr<X509Certificate> mit_davidben_cert(
 663       ImportCertFromFile(certs_dir, "mit.davidben.der"));
 664   ASSERT_NE(static_cast<X509Certificate*>(NULL), mit_davidben_cert.get());
 665
 666   std::string mit_issuer(reinterpret_cast<const char*>(MITDN),
 667                          sizeof(MITDN));
 668
 669   // Test a certificate from Google, issued by Thawte
 670   scoped_refptr<X509Certificate> google_cert(
 671       ImportCertFromFile(certs_dir, "google.single.der"));
 672   ASSERT_NE(static_cast<X509Certificate*>(NULL), google_cert.get());
 673
 674   std::string thawte_issuer(reinterpret_cast<const char*>(ThawteDN),
 675                             sizeof(ThawteDN));
 676
 677   // Check that the David Ben certificate is issued by MIT, but not
 678   // by Thawte.
 679   std::vector<std::string> issuers;
 680   issuers.clear();
 681   issuers.push_back(mit_issuer);
 682   EXPECT_TRUE(mit_davidben_cert->IsIssuedByEncoded(issuers));
 683   EXPECT_FALSE(google_cert->IsIssuedByEncoded(issuers));
 684
 685   // Check that the Google certificate is issued by Thawte and not
 686   // by MIT.
 687   issuers.clear();
 688   issuers.push_back(thawte_issuer);
 689   EXPECT_FALSE(mit_davidben_cert->IsIssuedByEncoded(issuers));
 690   EXPECT_TRUE(google_cert->IsIssuedByEncoded(issuers));
 691
 692   // Check that they both pass when given a list of the two issuers.
 693   issuers.clear();
 694   issuers.push_back(mit_issuer);
 695   issuers.push_back(thawte_issuer);
 696   EXPECT_TRUE(mit_davidben_cert->IsIssuedByEncoded(issuers));
 697   EXPECT_TRUE(google_cert->IsIssuedByEncoded(issuers));
 698 }
 699
 700 TEST(X509CertificateTest, IsIssuedByEncodedWithIntermediates) {
 701   static const unsigned char kPolicyRootDN[] = {
 702     0x30, 0x1e, 0x31, 0x1c, 0x30, 0x1a, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c,
 703     0x13, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x20, 0x54, 0x65, 0x73, 0x74,
 704     0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41
 705   };
 706   static const unsigned char kPolicyIntermediateDN[] = {
 707     0x30, 0x26, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c,
 708     0x1b, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x20, 0x54, 0x65, 0x73, 0x74,
 709     0x20, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x74,
 710     0x65, 0x20, 0x43, 0x41
 711   };
 712
 713   base::FilePath certs_dir = GetTestCertsDirectory();
 714
 715   CertificateList policy_chain = CreateCertificateListFromFile(
 716       certs_dir, "explicit-policy-chain.pem", X509Certificate::FORMAT_AUTO);
 717   ASSERT_EQ(3u, policy_chain.size());
 718
 719   // The intermediate CA certificate's policyConstraints extension has a
 720   // requireExplicitPolicy field with SkipCerts=0.
 721   std::string policy_intermediate_dn(
 722       reinterpret_cast<const char*>(kPolicyIntermediateDN),
 723       sizeof(kPolicyIntermediateDN));
 724   std::string policy_root_dn(reinterpret_cast<const char*>(kPolicyRootDN),
 725                              sizeof(kPolicyRootDN));
 726
 727   X509Certificate::OSCertHandles intermediates;
 728   intermediates.push_back(policy_chain[1]->os_cert_handle());
 729   scoped_refptr<X509Certificate> cert_chain =
 730       X509Certificate::CreateFromHandle(policy_chain[0]->os_cert_handle(),
 731                                         intermediates);
 732
 733   std::vector<std::string> issuers;
 734
 735   // Check that the chain is issued by the intermediate.
 736   issuers.clear();
 737   issuers.push_back(policy_intermediate_dn);
 738   EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers));
 739
 740   // Check that the chain is also issued by the root.
 741   issuers.clear();
 742   issuers.push_back(policy_root_dn);
 743   EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers));
 744
 745   // Check that the chain is issued by either the intermediate or the root.
 746   issuers.clear();
 747   issuers.push_back(policy_intermediate_dn);
 748   issuers.push_back(policy_root_dn);
 749   EXPECT_TRUE(cert_chain->IsIssuedByEncoded(issuers));
 750
 751   // Check that an empty issuers list returns false.
 752   issuers.clear();
 753   EXPECT_FALSE(cert_chain->IsIssuedByEncoded(issuers));
 754
 755   // Check that the chain is not issued by Verisign
 756   std::string mit_issuer(reinterpret_cast<const char*>(VerisignDN),
 757                          sizeof(VerisignDN));
 758   issuers.clear();
 759   issuers.push_back(mit_issuer);
 760   EXPECT_FALSE(cert_chain->IsIssuedByEncoded(issuers));
 761 }
 762
 763 // Tests that FreeOSCertHandle ignores NULL on each OS.
 764 TEST(X509CertificateTest, FreeNullHandle) {
 765   X509Certificate::FreeOSCertHandle(NULL);
 766 }
 767
 768 #if defined(USE_NSS)
 769 TEST(X509CertificateTest, GetDefaultNickname) {
 770   base::FilePath certs_dir = GetTestCertsDirectory();
 771
 772   scoped_refptr<X509Certificate> test_cert(
 773       ImportCertFromFile(certs_dir, "no_subject_common_name_cert.pem"));
 774   ASSERT_NE(static_cast<X509Certificate*>(NULL), test_cert.get());
 775
 776   std::string nickname = test_cert->GetDefaultNickname(USER_CERT);
 777   EXPECT_EQ("wtc@google.com's COMODO Client Authentication and "
 778             "Secure Email CA ID", nickname);
 779 }
 780 #endif
 781
 782 const struct CertificateFormatTestData {
 783   const char* file_name;
 784   X509Certificate::Format format;
 785   uint8* chain_fingerprints[3];
 786 } kFormatTestData[] = {
 787   // DER Parsing - single certificate, DER encoded
 788   { "google.single.der", X509Certificate::FORMAT_SINGLE_CERTIFICATE,
 789     { google_parse_fingerprint,
 790       NULL, } },
 791   // DER parsing - single certificate, PEM encoded
 792   { "google.single.pem", X509Certificate::FORMAT_SINGLE_CERTIFICATE,
 793     { google_parse_fingerprint,
 794       NULL, } },
 795   // PEM parsing - single certificate, PEM encoded with a PEB of
 796   // "CERTIFICATE"
 797   { "google.single.pem", X509Certificate::FORMAT_PEM_CERT_SEQUENCE,
 798     { google_parse_fingerprint,
 799       NULL, } },
 800   // PEM parsing - sequence of certificates, PEM encoded with a PEB of
 801   // "CERTIFICATE"
 802   { "google.chain.pem", X509Certificate::FORMAT_PEM_CERT_SEQUENCE,
 803     { google_parse_fingerprint,
 804       thawte_parse_fingerprint,
 805       NULL, } },
 806   // PKCS#7 parsing - "degenerate" SignedData collection of certificates, DER
 807   // encoding
 808   { "google.binary.p7b", X509Certificate::FORMAT_PKCS7,
 809     { google_parse_fingerprint,
 810       thawte_parse_fingerprint,
 811       NULL, } },
 812   // PKCS#7 parsing - "degenerate" SignedData collection of certificates, PEM
 813   // encoded with a PEM PEB of "CERTIFICATE"
 814   { "google.pem_cert.p7b", X509Certificate::FORMAT_PKCS7,
 815     { google_parse_fingerprint,
 816       thawte_parse_fingerprint,
 817       NULL, } },
 818   // PKCS#7 parsing - "degenerate" SignedData collection of certificates, PEM
 819   // encoded with a PEM PEB of "PKCS7"
 820   { "google.pem_pkcs7.p7b", X509Certificate::FORMAT_PKCS7,
 821     { google_parse_fingerprint,
 822       thawte_parse_fingerprint,
 823       NULL, } },
 824   // All of the above, this time using auto-detection
 825   { "google.single.der", X509Certificate::FORMAT_AUTO,
 826     { google_parse_fingerprint,
 827       NULL, } },
 828   { "google.single.pem", X509Certificate::FORMAT_AUTO,
 829     { google_parse_fingerprint,
 830       NULL, } },
 831   { "google.chain.pem", X509Certificate::FORMAT_AUTO,
 832     { google_parse_fingerprint,
 833       thawte_parse_fingerprint,
 834       NULL, } },
 835   { "google.binary.p7b", X509Certificate::FORMAT_AUTO,
 836     { google_parse_fingerprint,
 837       thawte_parse_fingerprint,
 838       NULL, } },
 839   { "google.pem_cert.p7b", X509Certificate::FORMAT_AUTO,
 840     { google_parse_fingerprint,
 841       thawte_parse_fingerprint,
 842       NULL, } },
 843   { "google.pem_pkcs7.p7b", X509Certificate::FORMAT_AUTO,
 844     { google_parse_fingerprint,
 845       thawte_parse_fingerprint,
 846       NULL, } },
 847 };
 848
 849 class X509CertificateParseTest
 850     : public testing::TestWithParam<CertificateFormatTestData> {
 851  public:
 852   virtual ~X509CertificateParseTest() {}
 853   virtual void SetUp() {
 854     test_data_ = GetParam();
 855   }
 856   virtual void TearDown() {}
 857
 858  protected:
 859   CertificateFormatTestData test_data_;
 860 };
 861
 862 TEST_P(X509CertificateParseTest, CanParseFormat) {
 863   base::FilePath certs_dir = GetTestCertsDirectory();
 864   CertificateList certs = CreateCertificateListFromFile(
 865       certs_dir, test_data_.file_name, test_data_.format);
 866   ASSERT_FALSE(certs.empty());
 867   ASSERT_LE(certs.size(), arraysize(test_data_.chain_fingerprints));
 868   CheckGoogleCert(certs.front(), google_parse_fingerprint,
 869                   kGoogleParseValidFrom, kGoogleParseValidTo);
 870
 871   size_t i;
 872   for (i = 0; i < arraysize(test_data_.chain_fingerprints); ++i) {
 873     if (test_data_.chain_fingerprints[i] == NULL) {
 874       // No more test certificates expected - make sure no more were
 875       // returned before marking this test a success.
 876       EXPECT_EQ(i, certs.size());
 877       break;
 878     }
 879
 880     // A cert is expected - make sure that one was parsed.
 881     ASSERT_LT(i, certs.size());
 882
 883     // Compare the parsed certificate with the expected certificate, by
 884     // comparing fingerprints.
 885     const X509Certificate* cert = certs[i].get();
 886     const SHA1HashValue& actual_fingerprint = cert->fingerprint();
 887     uint8* expected_fingerprint = test_data_.chain_fingerprints[i];
 888
 889     for (size_t j = 0; j < 20; ++j)
 890       EXPECT_EQ(expected_fingerprint[j], actual_fingerprint.data[j]);
 891   }
 892 }
 893
 894 INSTANTIATE_TEST_CASE_P(, X509CertificateParseTest,
 895                         testing::ValuesIn(kFormatTestData));
 896
 897 struct CertificateNameVerifyTestData {
 898   // true iff we expect hostname to match an entry in cert_names.
 899   bool expected;
 900   // The hostname to match.
 901   const char* hostname;
 902   // Common name, may be used if |dns_names| or |ip_addrs| are empty.
 903   const char* common_name;
 904   // Comma separated list of certificate names to match against. Any occurrence
 905   // of '#' will be replaced with a null character before processing.
 906   const char* dns_names;
 907   // Comma separated list of certificate IP Addresses to match against. Each
 908   // address is x prefixed 16 byte hex code for v6 or dotted-decimals for v4.
 909   const char* ip_addrs;
 910 };
 911
 912 // GTest 'magic' pretty-printer, so that if/when a test fails, it knows how
 913 // to output the parameter that was passed. Without this, it will simply
 914 // attempt to print out the first twenty bytes of the object, which depending
 915 // on platform and alignment, may result in an invalid read.
 916 void PrintTo(const CertificateNameVerifyTestData& data, std::ostream* os) {
 917   ASSERT_TRUE(data.hostname && data.common_name);
 918   // Using StringPiece to allow for optional fields being NULL.
 919   *os << " expected: " << data.expected
 920       << "; hostname: " << data.hostname
 921       << "; common_name: " << data.common_name
 922       << "; dns_names: " << base::StringPiece(data.dns_names)
 923       << "; ip_addrs: " << base::StringPiece(data.ip_addrs);
 924 }
 925
 926 const CertificateNameVerifyTestData kNameVerifyTestData[] = {
 927     { true, "foo.com", "foo.com" },
 928     { true, "f", "f" },
 929     { false, "h", "i" },
 930     { true, "bar.foo.com", "*.foo.com" },
 931     { true, "www.test.fr", "common.name",
 932         "*.test.com,*.test.co.uk,*.test.de,*.test.fr" },
 933     { true, "wwW.tESt.fr",  "common.name",
 934         ",*.*,*.test.de,*.test.FR,www" },
 935     { false, "f.uk", ".uk" },
 936     { false, "w.bar.foo.com", "?.bar.foo.com" },
 937     { false, "www.foo.com", "(www|ftp).foo.com" },
 938     { false, "www.foo.com", "www.foo.com#" },  // # = null char.
 939     { false, "www.foo.com", "", "www.foo.com#*.foo.com,#,#" },
 940     { false, "www.house.example", "ww.house.example" },
 941     { false, "test.org", "", "www.test.org,*.test.org,*.org" },
 942     { false, "w.bar.foo.com", "w*.bar.foo.com" },
 943     { false, "www.bar.foo.com", "ww*ww.bar.foo.com" },
 944     { false, "wwww.bar.foo.com", "ww*ww.bar.foo.com" },
 945     { true, "wwww.bar.foo.com", "w*w.bar.foo.com" },
 946     { false, "wwww.bar.foo.com", "w*w.bar.foo.c0m" },
 947     { true, "WALLY.bar.foo.com", "wa*.bar.foo.com" },
 948     { true, "wally.bar.foo.com", "*Ly.bar.foo.com" },
 949     { true, "ww%57.foo.com", "", "www.foo.com" },
 950     { true, "www&.foo.com", "www%26.foo.com" },
 951     // Common name must not be used if subject alternative name was provided.
 952     { false, "www.test.co.jp",  "www.test.co.jp",
 953         "*.test.de,*.jp,www.test.co.uk,www.*.co.jp" },
 954     { false, "www.bar.foo.com", "www.bar.foo.com",
 955       "*.foo.com,*.*.foo.com,*.*.bar.foo.com,*..bar.foo.com," },
 956     { false, "www.bath.org", "www.bath.org", "", "20.30.40.50" },
 957     { false, "66.77.88.99", "www.bath.org", "www.bath.org" },
 958     // IDN tests
 959     { true, "xn--poema-9qae5a.com.br", "xn--poema-9qae5a.com.br" },
 960     { true, "www.xn--poema-9qae5a.com.br", "*.xn--poema-9qae5a.com.br" },
 961     { false, "xn--poema-9qae5a.com.br", "", "*.xn--poema-9qae5a.com.br,"
 962                                             "xn--poema-*.com.br,"
 963                                             "xn--*-9qae5a.com.br,"
 964                                             "*--poema-9qae5a.com.br" },
 965     // The following are adapted from the  examples quoted from
 966     // http://tools.ietf.org/html/rfc6125#section-6.4.3
 967     //  (e.g., *.example.com would match foo.example.com but
 968     //   not bar.foo.example.com or example.com).
 969     { true, "foo.example.com", "*.example.com" },
 970     { false, "bar.foo.example.com", "*.example.com" },
 971     { false, "example.com", "*.example.com" },
 972     //   (e.g., baz*.example.net and *baz.example.net and b*z.example.net would
 973     //   be taken to match baz1.example.net and foobaz.example.net and
 974     //   buzz.example.net, respectively
 975     { true, "baz1.example.net", "baz*.example.net" },
 976     { true, "foobaz.example.net", "*baz.example.net" },
 977     { true, "buzz.example.net", "b*z.example.net" },
 978     // Wildcards should not be valid for public registry controlled domains,
 979     // and unknown/unrecognized domains, at least three domain components must
 980     // be present.
 981     { true, "www.test.example", "*.test.example" },
 982     { true, "test.example.co.uk", "*.example.co.uk" },
 983     { false, "test.example", "*.exmaple" },
 984     { false, "example.co.uk", "*.co.uk" },
 985     { false, "foo.com", "*.com" },
 986     { false, "foo.us", "*.us" },
 987     { false, "foo", "*" },
 988     // IDN variants of wildcards and registry controlled domains.
 989     { true, "www.xn--poema-9qae5a.com.br", "*.xn--poema-9qae5a.com.br" },
 990     { true, "test.example.xn--mgbaam7a8h", "*.example.xn--mgbaam7a8h" },
 991     { false, "xn--poema-9qae5a.com.br", "*.com.br" },
 992     { false, "example.xn--mgbaam7a8h", "*.xn--mgbaam7a8h" },
 993     // Wildcards should be permissible for 'private' registry controlled
 994     // domains.
 995     { true, "www.appspot.com", "*.appspot.com" },
 996     { true, "foo.s3.amazonaws.com", "*.s3.amazonaws.com" },
 997     // Multiple wildcards are not valid.
 998     { false, "foo.example.com", "*.*.com" },
 999     { false, "foo.bar.example.com", "*.bar.*.com" },
1000     // Absolute vs relative DNS name tests. Although not explicitly specified
1001     // in RFC 6125, absolute reference names (those ending in a .) should
1002     // match either absolute or relative presented names.
1003     { true, "foo.com", "foo.com." },
1004     { true, "foo.com.", "foo.com" },
1005     { true, "foo.com.", "foo.com." },
1006     { true, "f", "f." },
1007     { true, "f.", "f" },
1008     { true, "f.", "f." },
1009     { true, "www-3.bar.foo.com", "*.bar.foo.com." },
1010     { true, "www-3.bar.foo.com.", "*.bar.foo.com" },
1011     { true, "www-3.bar.foo.com.", "*.bar.foo.com." },
1012     { false, ".", "." },
1013     { false, "example.com", "*.com." },
1014     { false, "example.com.", "*.com" },
1015     { false, "example.com.", "*.com." },
1016     { false, "foo.", "*." },
1017     { false, "foo", "*." },
1018     { false, "foo.co.uk", "*.co.uk." },
1019     { false, "foo.co.uk.", "*.co.uk." },
1020     // IP addresses in common name; IPv4 only.
1021     { true, "127.0.0.1", "127.0.0.1" },
1022     { true, "192.168.1.1", "192.168.1.1" },
1023     { true,  "676768", "0.10.83.160" },
1024     { true,  "1.2.3", "1.2.0.3" },
1025     { false, "192.169.1.1", "192.168.1.1" },
1026     { false, "12.19.1.1", "12.19.1.1/255.255.255.0" },
1027     { false, "FEDC:ba98:7654:3210:FEDC:BA98:7654:3210",
1028       "FEDC:BA98:7654:3210:FEDC:ba98:7654:3210" },
1029     { false, "1111:2222:3333:4444:5555:6666:7777:8888",
1030       "1111:2222:3333:4444:5555:6666:7777:8888" },
1031     { false, "::192.9.5.5", "[::192.9.5.5]" },
1032     // No wildcard matching in valid IP addresses
1033     { false, "::192.9.5.5", "*.9.5.5" },
1034     { false, "2010:836B:4179::836B:4179", "*:836B:4179::836B:4179" },
1035     { false, "192.168.1.11", "*.168.1.11" },
1036     { false, "FEDC:BA98:7654:3210:FEDC:BA98:7654:3210", "*.]" },
1037     // IP addresses in subject alternative name (common name ignored)
1038     { true, "10.1.2.3", "", "", "10.1.2.3" },
1039     { true,  "14.15", "", "", "14.0.0.15" },
1040     { false, "10.1.2.7", "10.1.2.7", "", "10.1.2.6,10.1.2.8" },
1041     { false, "10.1.2.8", "10.20.2.8", "foo" },
1042     { true, "::4.5.6.7", "", "", "x00000000000000000000000004050607" },
1043     { false, "::6.7.8.9", "::6.7.8.9", "::6.7.8.9",
1044         "x00000000000000000000000006070808,x0000000000000000000000000607080a,"
1045         "xff000000000000000000000006070809,6.7.8.9" },
1046     { true, "FE80::200:f8ff:fe21:67cf", "no.common.name", "",
1047         "x00000000000000000000000006070808,xfe800000000000000200f8fffe2167cf,"
1048         "xff0000000000000000000000060708ff,10.0.0.1" },
1049     // Numeric only hostnames (none of these are considered valid IP addresses).
1050     { false,  "12345.6", "12345.6" },
1051     { false, "121.2.3.512", "", "1*1.2.3.512,*1.2.3.512,1*.2.3.512,*.2.3.512",
1052         "121.2.3.0"},
1053     { false, "1.2.3.4.5.6", "*.2.3.4.5.6" },
1054     { true, "1.2.3.4.5", "", "1.2.3.4.5" },
1055     // Invalid host names.
1056     { false, "junk)(£)$*!@~#", "junk)(£)$*!@~#" },
1057     { false, "www.*.com", "www.*.com" },
1058     { false, "w$w.f.com", "w$w.f.com" },
1059     { false, "nocolonallowed:example", "", "nocolonallowed:example" },
1060     { false, "www-1.[::FFFF:129.144.52.38]", "*.[::FFFF:129.144.52.38]" },
1061     { false, "[::4.5.6.9]", "", "", "x00000000000000000000000004050609" },
1062 };
1063
1064 class X509CertificateNameVerifyTest
1065     : public testing::TestWithParam<CertificateNameVerifyTestData> {
1066 };
1067
1068 TEST_P(X509CertificateNameVerifyTest, VerifyHostname) {
1069   CertificateNameVerifyTestData test_data = GetParam();
1070
1071   std::string common_name(test_data.common_name);
1072   ASSERT_EQ(std::string::npos, common_name.find(','));
1073   std::replace(common_name.begin(), common_name.end(), '#', '\0');
1074
1075   std::vector<std::string> dns_names, ip_addressses;
1076   if (test_data.dns_names) {
1077     // Build up the certificate DNS names list.
1078     std::string dns_name_line(test_data.dns_names);
1079     std::replace(dns_name_line.begin(), dns_name_line.end(), '#', '\0');
1080     base::SplitString(dns_name_line, ',', &dns_names);
1081   }
1082
1083   if (test_data.ip_addrs) {
1084     // Build up the certificate IP address list.
1085     std::string ip_addrs_line(test_data.ip_addrs);
1086     std::vector<std::string> ip_addressses_ascii;
1087     base::SplitString(ip_addrs_line, ',', &ip_addressses_ascii);
1088     for (size_t i = 0; i < ip_addressses_ascii.size(); ++i) {
1089       std::string& addr_ascii = ip_addressses_ascii[i];
1090       ASSERT_NE(0U, addr_ascii.length());
1091       if (addr_ascii[0] == 'x') {  // Hex encoded address
1092         addr_ascii.erase(0, 1);
1093         std::vector<uint8> bytes;
1094         EXPECT_TRUE(base::HexStringToBytes(addr_ascii, &bytes))
1095             << "Could not parse hex address " << addr_ascii << " i = " << i;
1096         ip_addressses.push_back(std::string(reinterpret_cast<char*>(&bytes[0]),
1097                                             bytes.size()));
1098         ASSERT_EQ(16U, ip_addressses.back().size()) << i;
1099       } else {  // Decimal groups
1100         std::vector<std::string> decimals_ascii;
1101         base::SplitString(addr_ascii, '.', &decimals_ascii);
1102         EXPECT_EQ(4U, decimals_ascii.size()) << i;
1103         std::string addr_bytes;
1104         for (size_t j = 0; j < decimals_ascii.size(); ++j) {
1105           int decimal_value;
1106           EXPECT_TRUE(base::StringToInt(decimals_ascii[j], &decimal_value));
1107           EXPECT_GE(decimal_value, 0);
1108           EXPECT_LE(decimal_value, 255);
1109           addr_bytes.push_back(static_cast<char>(decimal_value));
1110         }
1111         ip_addressses.push_back(addr_bytes);
1112         ASSERT_EQ(4U, ip_addressses.back().size()) << i;
1113       }
1114     }
1115   }
1116
1117   bool unused = false;
1118   EXPECT_EQ(test_data.expected, X509Certificate::VerifyHostname(
1119       test_data.hostname, common_name, dns_names, ip_addressses, &unused));
1120 }
1121
1122 INSTANTIATE_TEST_CASE_P(, X509CertificateNameVerifyTest,
1123                         testing::ValuesIn(kNameVerifyTestData));
1124
1125 const struct PublicKeyInfoTestData {
1126   const char* cert_file;
1127   size_t expected_bits;
1128   X509Certificate::PublicKeyType expected_type;
1129 } kPublicKeyInfoTestData[] = {
1130   { "768-rsa-ee-by-768-rsa-intermediate.pem", 768,
1131     X509Certificate::kPublicKeyTypeRSA },
1132   { "1024-rsa-ee-by-768-rsa-intermediate.pem", 1024,
1133     X509Certificate::kPublicKeyTypeRSA },
1134   { "prime256v1-ecdsa-ee-by-1024-rsa-intermediate.pem", 256,
1135     X509Certificate::kPublicKeyTypeECDSA },
1136 };
1137
1138 class X509CertificatePublicKeyInfoTest
1139     : public testing::TestWithParam<PublicKeyInfoTestData> {
1140 };
1141
1142 TEST_P(X509CertificatePublicKeyInfoTest, GetPublicKeyInfo) {
1143   PublicKeyInfoTestData data = GetParam();
1144
1145 #if defined(OS_WIN)
1146   if (base::win::GetVersion() < base::win::VERSION_VISTA &&
1147       data.expected_type == X509Certificate::kPublicKeyTypeECDSA) {
1148     // ECC is only supported on Vista+. Skip the test.
1149     return;
1150   }
1151 #endif
1152
1153   scoped_refptr<X509Certificate> cert(
1154       ImportCertFromFile(GetTestCertsDirectory(), data.cert_file));
1155   ASSERT_TRUE(cert.get());
1156
1157   size_t actual_bits = 0;
1158   X509Certificate::PublicKeyType actual_type =
1159       X509Certificate::kPublicKeyTypeUnknown;
1160
1161   X509Certificate::GetPublicKeyInfo(cert->os_cert_handle(), &actual_bits,
1162                                     &actual_type);
1163
1164   EXPECT_EQ(data.expected_bits, actual_bits);
1165   EXPECT_EQ(data.expected_type, actual_type);
1166 }
1167
1168 INSTANTIATE_TEST_CASE_P(, X509CertificatePublicKeyInfoTest,
1169                         testing::ValuesIn(kPublicKeyInfoTestData));
1170
1171 }  // namespace net