1 // Copyright 2016 The Chromium Authors
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //     https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #include "verify_certificate_chain.h"
16 
17 #include <openssl/pool.h>
18 #include "input.h"
19 #include "parsed_certificate.h"
20 #include "simple_path_builder_delegate.h"
21 #include "trust_store.h"
22 
23 // These require CRL support, which is not implemented at the
24 // VerifyCertificateChain level.
25 #define Section7InvalidkeyUsageCriticalcRLSignFalseTest4 \
26   DISABLED_Section7InvalidkeyUsageCriticalcRLSignFalseTest4
27 #define Section7InvalidkeyUsageNotCriticalcRLSignFalseTest5 \
28   DISABLED_Section7InvalidkeyUsageNotCriticalcRLSignFalseTest5
29 
30 #include "nist_pkits_unittest.h"
31 
32 BSSL_NAMESPACE_BEGIN
33 
34 namespace {
35 
36 class VerifyCertificateChainPkitsTestDelegate {
37  public:
RunTest(std::vector<std::string> cert_ders,std::vector<std::string> crl_ders,const PkitsTestInfo & info)38   static void RunTest(std::vector<std::string> cert_ders,
39                       std::vector<std::string> crl_ders,
40                       const PkitsTestInfo &info) {
41     ASSERT_FALSE(cert_ders.empty());
42 
43     // PKITS lists chains from trust anchor to target, whereas
44     // VerifyCertificateChain takes them starting with the target and ending
45     // with the trust anchor.
46     std::vector<std::shared_ptr<const ParsedCertificate>> input_chain;
47     CertErrors parsing_errors;
48     for (auto i = cert_ders.rbegin(); i != cert_ders.rend(); ++i) {
49       ASSERT_TRUE(ParsedCertificate::CreateAndAddToVector(
50           bssl::UniquePtr<CRYPTO_BUFFER>(
51               CRYPTO_BUFFER_new(reinterpret_cast<const uint8_t *>(i->data()),
52                                 i->size(), nullptr)),
53           {}, &input_chain, &parsing_errors))
54           << parsing_errors.ToDebugString();
55     }
56 
57     SimplePathBuilderDelegate path_builder_delegate(
58         1024, SimplePathBuilderDelegate::DigestPolicy::kWeakAllowSha1);
59 
60     std::set<der::Input> user_constrained_policy_set;
61 
62     CertPathErrors path_errors;
63     VerifyCertificateChain(
64         input_chain, CertificateTrust::ForTrustAnchor(), &path_builder_delegate,
65         info.time, KeyPurpose::ANY_EKU, info.initial_explicit_policy,
66         info.initial_policy_set, info.initial_policy_mapping_inhibit,
67         info.initial_inhibit_any_policy, &user_constrained_policy_set,
68         &path_errors);
69     bool did_succeed = !path_errors.ContainsHighSeverityErrors();
70 
71     EXPECT_EQ(info.should_validate, did_succeed);
72     EXPECT_EQ(info.user_constrained_policy_set, user_constrained_policy_set);
73 
74     // Check that the errors match expectations. The errors are saved in a
75     // parallel file, as they don't apply generically to the third_party
76     // PKITS data.
77     if (!info.should_validate && !did_succeed) {
78       std::string errors_file_path =
79           std::string(
80               "testdata/verify_certificate_chain_unittest/pkits_errors/") +
81           info.test_number + std::string(".txt");
82 
83       std::string expected_errors = ReadTestFileToString(errors_file_path);
84 
85       // Check that the errors match.
86       VerifyCertPathErrors(expected_errors, path_errors, input_chain,
87                            errors_file_path);
88     } else if (!did_succeed) {
89       // If it failed and wasn't supposed to fail, print the errors.
90       EXPECT_EQ("", path_errors.ToDebugString(input_chain));
91     }
92   }
93 };
94 
95 }  // namespace
96 
97 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
98                                PkitsTest01SignatureVerification,
99                                VerifyCertificateChainPkitsTestDelegate);
100 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
101                                PkitsTest02ValidityPeriods,
102                                VerifyCertificateChainPkitsTestDelegate);
103 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
104                                PkitsTest03VerifyingNameChaining,
105                                VerifyCertificateChainPkitsTestDelegate);
106 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
107                                PkitsTest06VerifyingBasicConstraints,
108                                VerifyCertificateChainPkitsTestDelegate);
109 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain, PkitsTest07KeyUsage,
110                                VerifyCertificateChainPkitsTestDelegate);
111 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
112                                PkitsTest08CertificatePolicies,
113                                VerifyCertificateChainPkitsTestDelegate);
114 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
115                                PkitsTest09RequireExplicitPolicy,
116                                VerifyCertificateChainPkitsTestDelegate);
117 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
118                                PkitsTest10PolicyMappings,
119                                VerifyCertificateChainPkitsTestDelegate);
120 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
121                                PkitsTest11InhibitPolicyMapping,
122                                VerifyCertificateChainPkitsTestDelegate);
123 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
124                                PkitsTest12InhibitAnyPolicy,
125                                VerifyCertificateChainPkitsTestDelegate);
126 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
127                                PkitsTest13NameConstraints,
128                                VerifyCertificateChainPkitsTestDelegate);
129 INSTANTIATE_TYPED_TEST_SUITE_P(VerifyCertificateChain,
130                                PkitsTest16PrivateCertificateExtensions,
131                                VerifyCertificateChainPkitsTestDelegate);
132 
133 // These require CRL support, which is not implemented at the
134 // VerifyCertificateChain level:
135 // PkitsTest04BasicCertificateRevocationTests,
136 // PkitsTest05VerifyingPathswithSelfIssuedCertificates,
137 // PkitsTest14DistributionPoints, PkitsTest15DeltaCRLs
138 
139 BSSL_NAMESPACE_END
140