net/cert/x509_util_nss_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/cert/x509_util.h"
   6 #include "net/cert/x509_util_nss.h"
   7
   8 #include <cert.h>
   9 #include <secoid.h>
  10
  11 #include "base/memory/ref_counted.h"
  12 #include "base/memory/scoped_ptr.h"
  13 #include "crypto/ec_private_key.h"
  14 #include "crypto/scoped_nss_types.h"
  15 #include "crypto/signature_verifier.h"
  16 #include "net/cert/x509_certificate.h"
  17 #include "testing/gtest/include/gtest/gtest.h"
  18
  19 namespace net {
  20
  21 namespace {
  22
  23 CERTCertificate* CreateNSSCertHandleFromBytes(const char* data, size_t length) {
  24   SECItem der_cert;
  25   der_cert.data = reinterpret_cast<unsigned char*>(const_cast<char*>(data));
  26   der_cert.len  = length;
  27   der_cert.type = siDERCertBuffer;
  28
  29   // Parse into a certificate structure.
  30   return CERT_NewTempCertificate(CERT_GetDefaultCertDB(), &der_cert, NULL,
  31                                  PR_FALSE, PR_TRUE);
  32 }
  33
  34 #if !defined(OS_WIN) && !defined(OS_MACOSX)
  35 void VerifyCertificateSignature(const std::string& der_cert,
  36                                 const std::vector<uint8>& der_spki) {
  37   crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
  38
  39   CERTSignedData sd;
  40   memset(&sd, 0, sizeof(sd));
  41
  42   SECItem der_cert_item = {
  43     siDERCertBuffer,
  44     reinterpret_cast<unsigned char*>(const_cast<char*>(der_cert.data())),
  45     static_cast<unsigned int>(der_cert.size())
  46   };
  47   SECStatus rv = SEC_ASN1DecodeItem(arena.get(), &sd,
  48                                     SEC_ASN1_GET(CERT_SignedDataTemplate),
  49                                     &der_cert_item);
  50   ASSERT_EQ(SECSuccess, rv);
  51
  52   // The CERTSignedData.signatureAlgorithm is decoded, but SignatureVerifier
  53   // wants the DER encoded form, so re-encode it again.
  54   SECItem* signature_algorithm = SEC_ASN1EncodeItem(
  55       arena.get(),
  56       NULL,
  57       &sd.signatureAlgorithm,
  58       SEC_ASN1_GET(SECOID_AlgorithmIDTemplate));
  59   ASSERT_TRUE(signature_algorithm);
  60
  61   crypto::SignatureVerifier verifier;
  62   bool ok = verifier.VerifyInit(
  63       signature_algorithm->data,
  64       signature_algorithm->len,
  65       sd.signature.data,
  66       sd.signature.len / 8,  // Signature is a BIT STRING, convert to bytes.
  67       &der_spki[0],
  68       der_spki.size());
  69
  70   ASSERT_TRUE(ok);
  71   verifier.VerifyUpdate(sd.data.data,
  72                         sd.data.len);
  73
  74   ok = verifier.VerifyFinal();
  75   EXPECT_TRUE(ok);
  76 }
  77 #endif  // !defined(OS_WIN) && !defined(OS_MACOSX)
  78
  79 void VerifyDomainBoundCert(const std::string& domain,
  80                            const std::string& der_cert) {
  81   // Origin Bound Cert OID.
  82   static const char oid_string[] = "1.3.6.1.4.1.11129.2.1.6";
  83
  84   // Create object neccessary for extension lookup call.
  85   SECItem extension_object = {
  86     siAsciiString,
  87     (unsigned char*)domain.data(),
  88     static_cast<unsigned int>(domain.size())
  89   };
  90
  91   // IA5Encode and arena allocate SECItem.
  92   PLArenaPool* arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
  93   SECItem* expected = SEC_ASN1EncodeItem(arena,
  94                                          NULL,
  95                                          &extension_object,
  96                                          SEC_ASN1_GET(SEC_IA5StringTemplate));
  97
  98   ASSERT_NE(static_cast<SECItem*>(NULL), expected);
  99
 100   // Create OID SECItem.
 101   SECItem ob_cert_oid = { siDEROID, NULL, 0 };
 102   SECStatus ok = SEC_StringToOID(arena, &ob_cert_oid,
 103                                  oid_string, 0);
 104
 105   ASSERT_EQ(SECSuccess, ok);
 106
 107   SECOidTag ob_cert_oid_tag = SECOID_FindOIDTag(&ob_cert_oid);
 108
 109   ASSERT_NE(SEC_OID_UNKNOWN, ob_cert_oid_tag);
 110
 111   // This test is run on Mac and Win where X509Certificate::os_cert_handle isn't
 112   // an NSS type, so we have to manually create a NSS certificate object so we
 113   // can use CERT_FindCertExtension.  We also check the subject and validity
 114   // times using NSS since X509Certificate will fail with EC certs on OSX 10.5
 115   // (http://crbug.com/101231).
 116   CERTCertificate* nss_cert = CreateNSSCertHandleFromBytes(
 117       der_cert.data(), der_cert.size());
 118
 119   char* common_name = CERT_GetCommonName(&nss_cert->subject);
 120   ASSERT_TRUE(common_name);
 121   EXPECT_STREQ("anonymous.invalid", common_name);
 122   PORT_Free(common_name);
 123   EXPECT_EQ(SECSuccess, CERT_CertTimesValid(nss_cert));
 124
 125   // Lookup Origin Bound Cert extension in generated cert.
 126   SECItem actual = { siBuffer, NULL, 0 };
 127   ok = CERT_FindCertExtension(nss_cert,
 128                               ob_cert_oid_tag,
 129                               &actual);
 130   CERT_DestroyCertificate(nss_cert);
 131   ASSERT_EQ(SECSuccess, ok);
 132
 133   // Compare expected and actual extension values.
 134   PRBool result = SECITEM_ItemsAreEqual(expected, &actual);
 135   ASSERT_TRUE(result);
 136
 137   // Do Cleanup.
 138   SECITEM_FreeItem(&actual, PR_FALSE);
 139   PORT_FreeArena(arena, PR_FALSE);
 140 }
 141
 142 }  // namespace
 143
 144 // This test creates a domain-bound cert and an EC private key and
 145 // then verifies the content of the certificate.
 146 TEST(X509UtilNSSTest, CreateKeyAndDomainBoundCertEC) {
 147   // Create a sample ASCII weborigin.
 148   std::string domain = "weborigin.com";
 149   base::Time now = base::Time::Now();
 150
 151   scoped_ptr<crypto::ECPrivateKey> private_key;
 152   std::string der_cert;
 153   ASSERT_TRUE(x509_util::CreateKeyAndDomainBoundCertEC(
 154       domain, 1,
 155       now,
 156       now + base::TimeDelta::FromDays(1),
 157       &private_key,
 158       &der_cert));
 159
 160   VerifyDomainBoundCert(domain, der_cert);
 161
 162 #if !defined(OS_WIN) && !defined(OS_MACOSX)
 163   // signature_verifier_win and signature_verifier_mac can't handle EC certs.
 164   std::vector<uint8> spki;
 165   ASSERT_TRUE(private_key->ExportPublicKey(&spki));
 166   VerifyCertificateSignature(der_cert, spki);
 167 #endif
 168 }
 169
 170 }  // namespace net