net/cert/test_root_certs.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_CERT_TEST_ROOT_CERTS_H_
   6 #define NET_CERT_TEST_ROOT_CERTS_H_
   7
   8 #include "base/lazy_instance.h"
   9 #include "base/memory/ref_counted.h"
  10 #include "build/build_config.h"
  11 #include "net/base/net_export.h"
  12
  13 #if defined(USE_NSS) || defined(OS_IOS)
  14 #include <list>
  15 #elif defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID)
  16 #include <vector>
  17 #elif defined(OS_WIN)
  18 #include <windows.h>
  19 #include "crypto/wincrypt_shim.h"
  20 #elif defined(OS_MACOSX)
  21 #include <CoreFoundation/CFArray.h>
  22 #include <Security/SecTrust.h>
  23 #include "base/mac/scoped_cftyperef.h"
  24 #endif
  25
  26 #if defined(USE_NSS)
  27 typedef struct CERTCertificateStr CERTCertificate;
  28 #elif defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID)
  29 typedef struct x509_st X509;
  30 #endif
  31
  32 namespace base {
  33 class FilePath;
  34 }
  35
  36 namespace net {
  37
  38 class X509Certificate;
  39
  40 // TestRootCerts is a helper class for unit tests that is used to
  41 // artificially mark a certificate as trusted, independent of the local
  42 // machine configuration.
  43 class NET_EXPORT TestRootCerts {
  44  public:
  45   // Obtains the Singleton instance to the trusted certificates.
  46   static TestRootCerts* GetInstance();
  47
  48   // Returns true if an instance exists, without forcing an initialization.
  49   static bool HasInstance();
  50
  51   // Marks |certificate| as trusted for X509Certificate::Verify(). Returns
  52   // false if the certificate could not be marked trusted.
  53   bool Add(X509Certificate* certificate);
  54
  55   // Reads a single certificate from |file| and marks it as trusted. Returns
  56   // false if an error is encountered, such as being unable to read |file|
  57   // or more than one certificate existing in |file|.
  58   bool AddFromFile(const base::FilePath& file);
  59
  60   // Clears the trusted status of any certificates that were previously
  61   // marked trusted via Add().
  62   void Clear();
  63
  64   // Returns true if there are no certificates that have been marked trusted.
  65   bool IsEmpty() const;
  66
  67 #if defined(USE_NSS)
  68   bool Contains(CERTCertificate* cert) const;
  69 #elif defined(OS_MACOSX) && !defined(OS_IOS)
  70   CFArrayRef temporary_roots() const { return temporary_roots_; }
  71
  72   // Modifies the root certificates of |trust_ref| to include the
  73   // certificates stored in |temporary_roots_|. If IsEmpty() is true, this
  74   // does not modify |trust_ref|.
  75   OSStatus FixupSecTrustRef(SecTrustRef trust_ref) const;
  76
  77   // Configures whether or not the default/system root store should also
  78   // be trusted. By default, this is true, indicating that the TestRootCerts
  79   // are used in addition to OS trust store.
  80   void SetAllowSystemTrust(bool allow_system_trust);
  81 #elif defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID)
  82   const std::vector<scoped_refptr<X509Certificate> >&
  83       temporary_roots() const { return temporary_roots_; }
  84   bool Contains(X509* cert) const;
  85 #elif defined(OS_WIN)
  86   HCERTSTORE temporary_roots() const { return temporary_roots_; }
  87
  88   // Returns an HCERTCHAINENGINE suitable to be used for certificate
  89   // validation routines, or NULL to indicate that the default system chain
  90   // engine is appropriate. The caller is responsible for freeing the
  91   // returned HCERTCHAINENGINE.
  92   HCERTCHAINENGINE GetChainEngine() const;
  93 #endif
  94
  95  private:
  96   friend struct base::DefaultLazyInstanceTraits<TestRootCerts>;
  97
  98   TestRootCerts();
  99   ~TestRootCerts();
 100
 101   // Performs platform-dependent initialization.
 102   void Init();
 103
 104 #if defined(USE_NSS) || defined(OS_IOS)
 105   // It is necessary to maintain a cache of the original certificate trust
 106   // settings, in order to restore them when Clear() is called.
 107   class TrustEntry;
 108   std::list<TrustEntry*> trust_cache_;
 109 #elif defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID)
 110   std::vector<scoped_refptr<X509Certificate> > temporary_roots_;
 111 #elif defined(OS_WIN)
 112   HCERTSTORE temporary_roots_;
 113 #elif defined(OS_MACOSX)
 114   base::ScopedCFTypeRef<CFMutableArrayRef> temporary_roots_;
 115   bool allow_system_trust_;
 116 #endif
 117
 118 #if defined(OS_WIN) || defined(OS_ANDROID)
 119   // True if there are no temporarily trusted root certificates.
 120   bool empty_;
 121 #endif
 122
 123   DISALLOW_COPY_AND_ASSIGN(TestRootCerts);
 124 };
 125
 126 // Scoped helper for unittests to handle safely managing trusted roots.
 127 class NET_EXPORT_PRIVATE ScopedTestRoot {
 128  public:
 129   ScopedTestRoot();
 130   // Creates a ScopedTestRoot that will adds|cert| to the TestRootCerts store.
 131   explicit ScopedTestRoot(X509Certificate* cert);
 132   ~ScopedTestRoot();
 133
 134   // Assigns |cert| to be the new test root cert. If |cert| is NULL, undoes
 135   // any work the ScopedTestRoot may have previously done.
 136   // If |cert_| contains a certificate (due to a prior call to Reset or due to
 137   // a cert being passed at construction), the existing TestRootCerts store is
 138   // cleared.
 139   void Reset(X509Certificate* cert);
 140
 141  private:
 142   scoped_refptr<X509Certificate> cert_;
 143
 144   DISALLOW_COPY_AND_ASSIGN(ScopedTestRoot);
 145 };
 146
 147 }  // namespace net
 148
 149 #endif  // NET_CERT_TEST_ROOT_CERTS_H_