path: root/chromium/net/cert/internal/trust_store_mac_unittest.cc

// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "net/cert/internal/trust_store_mac.h"

#include "base/base_paths.h"
#include "base/files/file_util.h"
#include "base/files/scoped_temp_dir.h"
#include "base/logging.h"
#include "base/path_service.h"
#include "base/process/launch.h"
#include "base/strings/string_split.h"
#include "base/synchronization/lock.h"
#include "crypto/mac_security_services_lock.h"
#include "net/cert/internal/cert_errors.h"
#include "net/cert/internal/test_helpers.h"
#include "net/cert/known_roots_mac.h"
#include "net/cert/pem.h"
#include "net/cert/test_keychain_search_list_mac.h"
#include "net/cert/x509_certificate.h"
#include "net/cert/x509_util.h"
#include "net/cert/x509_util_apple.h"
#include "net/test/test_data_directory.h"
#include "testing/gmock/include/gmock/gmock.h"
#include "testing/gtest/include/gtest/gtest.h"

using ::testing::UnorderedElementsAreArray;

namespace net {

namespace {

constexpr size_t kDefaultCacheSize = 512;

// The PEM block header used for DER certificates
const char kCertificateHeader[] = "CERTIFICATE";

// Parses a PEM encoded certificate from |file_name| and stores in |result|.
::testing::AssertionResult ReadTestCert(
    const std::string& file_name,
    scoped_refptr<ParsedCertificate>* result) {
  std::string der;
  const PemBlockMapping mappings[] = {
      {kCertificateHeader, &der},
  };

  ::testing::AssertionResult r = ReadTestDataFromPemFile(
      "net/data/ssl/certificates/" + file_name, mappings);
  if (!r)
    return r;

  CertErrors errors;
  *result = ParsedCertificate::Create(x509_util::CreateCryptoBuffer(der), {},
                                      &errors);
  if (!*result) {
    return ::testing::AssertionFailure()
           << "ParseCertificate::Create() failed:\n"
           << errors.ToDebugString();
  }
  return ::testing::AssertionSuccess();
}

// Returns the DER encodings of the  in |array|.
std::vector<std::string> CryptoBufferVectorAsStringVector(
    const std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>& array) {
  std::vector<std::string> result;

  for (const auto& buffer : array) {
    result.push_back(
        std::string(x509_util::CryptoBufferAsStringPiece(buffer.get())));
  }

  return result;
}

// Returns the DER encodings of the ParsedCertificates in |list|.
std::vector<std::string> ParsedCertificateListAsDER(
    ParsedCertificateList list) {
  std::vector<std::string> result;
  for (const auto& it : list)
    result.push_back(it->der_cert().AsString());
  return result;
}

class DebugData : public base::SupportsUserData {
 public:
  ~DebugData() override = default;
};

enum IsKnownRootTestOrder {
  TEST_IS_KNOWN_ROOT_BEFORE,
  TEST_IS_KNOWN_ROOT_AFTER,
};

}  // namespace

class TrustStoreMacImplTest
    : public testing::TestWithParam<
          std::tuple<TrustStoreMac::TrustImplType, IsKnownRootTestOrder>> {};

// Test the trust store using known test certificates in a keychain.  Tests
// that issuer searching returns the expected certificates, and that none of
// the certificates are trusted.
TEST_P(TrustStoreMacImplTest, MultiRootNotTrusted) {
  std::unique_ptr<TestKeychainSearchList> test_keychain_search_list(
      TestKeychainSearchList::Create());
  ASSERT_TRUE(test_keychain_search_list);
  base::FilePath keychain_path(
      GetTestCertsDirectory().AppendASCII("multi-root.keychain"));
  // SecKeychainOpen does not fail if the file doesn't exist, so assert it here
  // for easier debugging.
  ASSERT_TRUE(base::PathExists(keychain_path));
  base::ScopedCFTypeRef<SecKeychainRef> keychain;
  OSStatus status = SecKeychainOpen(keychain_path.MaybeAsASCII().c_str(),
                                    keychain.InitializeInto());
  ASSERT_EQ(errSecSuccess, status);
  ASSERT_TRUE(keychain);
  test_keychain_search_list->AddKeychain(keychain);

  const TrustStoreMac::TrustImplType trust_impl = std::get<0>(GetParam());
  const IsKnownRootTestOrder is_known_root_test_order = std::get<1>(GetParam());
  TrustStoreMac trust_store(kSecPolicyAppleSSL, trust_impl, kDefaultCacheSize);

  scoped_refptr<ParsedCertificate> a_by_b, b_by_c, b_by_f, c_by_d, c_by_e,
      f_by_e, d_by_d, e_by_e;
  ASSERT_TRUE(ReadTestCert("multi-root-A-by-B.pem", &a_by_b));
  ASSERT_TRUE(ReadTestCert("multi-root-B-by-C.pem", &b_by_c));
  ASSERT_TRUE(ReadTestCert("multi-root-B-by-F.pem", &b_by_f));
  ASSERT_TRUE(ReadTestCert("multi-root-C-by-D.pem", &c_by_d));
  ASSERT_TRUE(ReadTestCert("multi-root-C-by-E.pem", &c_by_e));
  ASSERT_TRUE(ReadTestCert("multi-root-F-by-E.pem", &f_by_e));
  ASSERT_TRUE(ReadTestCert("multi-root-D-by-D.pem", &d_by_d));
  ASSERT_TRUE(ReadTestCert("multi-root-E-by-E.pem", &e_by_e));

  base::ScopedCFTypeRef<CFDataRef> normalized_name_b =
      TrustStoreMac::GetMacNormalizedIssuer(a_by_b.get());
  ASSERT_TRUE(normalized_name_b);
  base::ScopedCFTypeRef<CFDataRef> normalized_name_c =
      TrustStoreMac::GetMacNormalizedIssuer(b_by_c.get());
  ASSERT_TRUE(normalized_name_c);
  base::ScopedCFTypeRef<CFDataRef> normalized_name_f =
      TrustStoreMac::GetMacNormalizedIssuer(b_by_f.get());
  ASSERT_TRUE(normalized_name_f);
  base::ScopedCFTypeRef<CFDataRef> normalized_name_d =
      TrustStoreMac::GetMacNormalizedIssuer(c_by_d.get());
  ASSERT_TRUE(normalized_name_d);
  base::ScopedCFTypeRef<CFDataRef> normalized_name_e =
      TrustStoreMac::GetMacNormalizedIssuer(f_by_e.get());
  ASSERT_TRUE(normalized_name_e);

  // Test that the matching keychain items are found, even though they aren't
  // trusted.
  // TODO(eroman): These tests could be using TrustStore::SyncGetIssuersOf().
  {
    std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> scoped_matching_items =
        TrustStoreMac::FindMatchingCertificatesForMacNormalizedSubject(
            normalized_name_b.get());

    EXPECT_THAT(CryptoBufferVectorAsStringVector(scoped_matching_items),
                UnorderedElementsAreArray(
                    ParsedCertificateListAsDER({b_by_c, b_by_f})));
  }

  {
    std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> scoped_matching_items =
        TrustStoreMac::FindMatchingCertificatesForMacNormalizedSubject(
            normalized_name_c.get());
    EXPECT_THAT(CryptoBufferVectorAsStringVector(scoped_matching_items),
                UnorderedElementsAreArray(
                    ParsedCertificateListAsDER({c_by_d, c_by_e})));
  }

  {
    std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> scoped_matching_items =
        TrustStoreMac::FindMatchingCertificatesForMacNormalizedSubject(
            normalized_name_f.get());
    EXPECT_THAT(
        CryptoBufferVectorAsStringVector(scoped_matching_items),
        UnorderedElementsAreArray(ParsedCertificateListAsDER({f_by_e})));
  }

  {
    std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> scoped_matching_items =
        TrustStoreMac::FindMatchingCertificatesForMacNormalizedSubject(
            normalized_name_d.get());
    EXPECT_THAT(
        CryptoBufferVectorAsStringVector(scoped_matching_items),
        UnorderedElementsAreArray(ParsedCertificateListAsDER({d_by_d})));
  }

  {
    std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> scoped_matching_items =
        TrustStoreMac::FindMatchingCertificatesForMacNormalizedSubject(
            normalized_name_e.get());
    EXPECT_THAT(
        CryptoBufferVectorAsStringVector(scoped_matching_items),
        UnorderedElementsAreArray(ParsedCertificateListAsDER({e_by_e})));
  }

  // Verify that none of the added certificates are considered trusted (since
  // the test certs in the keychain aren't trusted, unless someone manually
  // added and trusted the test certs on the machine the test is being run on).
  for (const auto& cert :
       {a_by_b, b_by_c, b_by_f, c_by_d, c_by_e, f_by_e, d_by_d, e_by_e}) {
    if (is_known_root_test_order == TEST_IS_KNOWN_ROOT_BEFORE)
      EXPECT_FALSE(trust_store.IsKnownRoot(cert.get()));
    DebugData debug_data;
    CertificateTrust trust = trust_store.GetTrust(cert.get(), &debug_data);
    EXPECT_EQ(CertificateTrustType::UNSPECIFIED, trust.type);
    // The combined_trust_debug_info should be 0 since no trust records
    // should exist for these test certs.
    const TrustStoreMac::ResultDebugData* trust_debug_data =
        TrustStoreMac::ResultDebugData::Get(&debug_data);
    ASSERT_TRUE(trust_debug_data);
    EXPECT_EQ(0, trust_debug_data->combined_trust_debug_info());
    EXPECT_EQ(trust_impl, trust_debug_data->trust_impl());
    if (is_known_root_test_order == TEST_IS_KNOWN_ROOT_AFTER)
      EXPECT_FALSE(trust_store.IsKnownRoot(cert.get()));
  }
}

// Test against all the certificates in the default keychains. Confirms that
// the computed trust value matches that of SecTrustEvaluate.
TEST_P(TrustStoreMacImplTest, SystemCerts) {
  // Get the list of all certificates in the user & system keychains.
  // This may include both trusted and untrusted certificates.
  //
  // The output contains zero or more repetitions of:
  // "SHA-1 hash: <hash>\n<PEM encoded cert>\n"
  // Starting with macOS 10.15, it includes both SHA-256 and SHA-1 hashes:
  // "SHA-256 hash: <hash>\nSHA-1 hash: <hash>\n<PEM encoded cert>\n"
  std::string find_certificate_default_search_list_output;
  ASSERT_TRUE(
      base::GetAppOutput({"security", "find-certificate", "-a", "-p", "-Z"},
                         &find_certificate_default_search_list_output));
  // Get the list of all certificates in the system roots keychain.
  // (Same details as above.)
  std::string find_certificate_system_roots_output;
  ASSERT_TRUE(base::GetAppOutput(
      {"security", "find-certificate", "-a", "-p", "-Z",
       "/System/Library/Keychains/SystemRootCertificates.keychain"},
      &find_certificate_system_roots_output));

  const TrustStoreMac::TrustImplType trust_impl = std::get<0>(GetParam());
  const IsKnownRootTestOrder is_known_root_test_order = std::get<1>(GetParam());
  TrustStoreMac trust_store(kSecPolicyAppleX509Basic, trust_impl,
                            kDefaultCacheSize);

  base::ScopedCFTypeRef<SecPolicyRef> sec_policy(SecPolicyCreateBasicX509());
  ASSERT_TRUE(sec_policy);
  for (const std::string& hash_and_pem_partial : base::SplitStringUsingSubstr(
           find_certificate_system_roots_output +
               find_certificate_default_search_list_output,
           "-----END CERTIFICATE-----", base::TRIM_WHITESPACE,
           base::SPLIT_WANT_NONEMPTY)) {
    // Re-add the PEM ending mark, since SplitStringUsingSubstr eats it.
    const std::string hash_and_pem =
        hash_and_pem_partial + "\n-----END CERTIFICATE-----\n";

    // Use the first hash value found in the text. This might be SHA-256 or
    // SHA-1, but it's only for debugging purposes so it doesn't matter as long
    // as one exists.
    std::string::size_type hash_pos = hash_and_pem.find("hash: ");
    ASSERT_NE(std::string::npos, hash_pos);
    hash_pos += 6;
    std::string::size_type eol_pos = hash_and_pem.find_first_of("\r\n");
    ASSERT_NE(std::string::npos, eol_pos);
    // Extract the hash of the certificate. This isn't necessary for the
    // test, but is a convenient identifier to use in any error messages.
    std::string hash_text = hash_and_pem.substr(hash_pos, eol_pos - hash_pos);

    SCOPED_TRACE(hash_text);
    // TODO(mattm): The same cert might exist in both lists, could de-dupe
    // before testing?

    // Parse the PEM encoded text to DER bytes.
    PEMTokenizer pem_tokenizer(hash_and_pem, {kCertificateHeader});
    ASSERT_TRUE(pem_tokenizer.GetNext());
    std::string cert_der(pem_tokenizer.data());
    ASSERT_FALSE(pem_tokenizer.GetNext());

    CertErrors errors;
    // Note: don't actually need to make a ParsedCertificate here, just need
    // the DER bytes. But parsing it here ensures the test can skip any certs
    // that won't be returned due to parsing failures inside TrustStoreMac.
    // The parsing options set here need to match the ones used in
    // trust_store_mac.cc.
    ParseCertificateOptions options;
    // For https://crt.sh/?q=D3EEFBCBBCF49867838626E23BB59CA01E305DB7:
    options.allow_invalid_serial_numbers = true;
    scoped_refptr<ParsedCertificate> cert = ParsedCertificate::Create(
        x509_util::CreateCryptoBuffer(cert_der), options, &errors);
    if (!cert) {
      LOG(WARNING) << "ParseCertificate::Create " << hash_text << " failed:\n"
                   << errors.ToDebugString();
      continue;
    }

    base::ScopedCFTypeRef<SecCertificateRef> cert_handle(
        x509_util::CreateSecCertificateFromBytes(cert->der_cert().UnsafeData(),
                                                 cert->der_cert().Length()));
    if (!cert_handle) {
      ADD_FAILURE() << "CreateCertBufferFromBytes " << hash_text;
      continue;
    }

    if (is_known_root_test_order == TEST_IS_KNOWN_ROOT_BEFORE) {
      bool trust_store_is_known_root = trust_store.IsKnownRoot(cert.get());
      {
        base::AutoLock lock(crypto::GetMacSecurityServicesLock());
        EXPECT_EQ(net::IsKnownRoot(cert_handle), trust_store_is_known_root);
      }
    }

    // Check if this cert is considered a trust anchor by TrustStoreMac.
    DebugData debug_data;
    CertificateTrust cert_trust = trust_store.GetTrust(cert.get(), &debug_data);
    bool is_trust_anchor = cert_trust.IsTrustAnchor();
    if (is_trust_anchor) {
      EXPECT_EQ(CertificateTrustType::TRUSTED_ANCHOR_WITH_EXPIRATION,
                cert_trust.type);
    }

    // Check if this cert is considered a trust anchor by the OS.
    base::ScopedCFTypeRef<SecTrustRef> trust;
    {
      base::AutoLock lock(crypto::GetMacSecurityServicesLock());
      ASSERT_EQ(noErr,
                SecTrustCreateWithCertificates(cert_handle, sec_policy,
                                               trust.InitializeInto()));
      ASSERT_EQ(noErr,
                SecTrustSetOptions(trust, kSecTrustOptionLeafIsCA |
                                              kSecTrustOptionAllowExpired |
                                              kSecTrustOptionAllowExpiredRoot));

      SecTrustResultType trust_result;
      ASSERT_EQ(noErr, SecTrustEvaluate(trust, &trust_result));
      bool expected_trust_anchor =
          ((trust_result == kSecTrustResultProceed) ||
           (trust_result == kSecTrustResultUnspecified)) &&
          (SecTrustGetCertificateCount(trust) == 1);
      EXPECT_EQ(expected_trust_anchor, is_trust_anchor);
      auto* trust_debug_data = TrustStoreMac::ResultDebugData::Get(&debug_data);
      ASSERT_TRUE(trust_debug_data);
      if (is_trust_anchor) {
        // Since this test queries the real trust store, can't know exactly
        // what bits should be set in the trust debug info, but if it's trusted
        // it should at least have something set.
        EXPECT_NE(0, trust_debug_data->combined_trust_debug_info());
      }
      // The impl that was used should be specified in the debug data.
      EXPECT_EQ(trust_impl, trust_debug_data->trust_impl());
    }

    if (is_known_root_test_order == TEST_IS_KNOWN_ROOT_AFTER) {
      bool trust_store_is_known_root = trust_store.IsKnownRoot(cert.get());
      {
        base::AutoLock lock(crypto::GetMacSecurityServicesLock());
        EXPECT_EQ(net::IsKnownRoot(cert_handle), trust_store_is_known_root);
      }
    }

    // Call GetTrust again on the same cert. This should exercise the code
    // that checks the trust value for a cert which has already been cached.
    DebugData debug_data2;
    CertificateTrust cert_trust2 =
        trust_store.GetTrust(cert.get(), &debug_data2);
    EXPECT_EQ(cert_trust.type, cert_trust2.type);
    auto* trust_debug_data = TrustStoreMac::ResultDebugData::Get(&debug_data);
    ASSERT_TRUE(trust_debug_data);
    auto* trust_debug_data2 = TrustStoreMac::ResultDebugData::Get(&debug_data2);
    ASSERT_TRUE(trust_debug_data2);
    EXPECT_EQ(trust_debug_data->combined_trust_debug_info(),
              trust_debug_data2->combined_trust_debug_info());
    EXPECT_EQ(trust_debug_data->trust_impl(), trust_debug_data2->trust_impl());
  }
}

INSTANTIATE_TEST_SUITE_P(
    Impl,
    TrustStoreMacImplTest,
    testing::Combine(
        testing::Values(TrustStoreMac::TrustImplType::kDomainCache,
                        TrustStoreMac::TrustImplType::kSimple,
                        TrustStoreMac::TrustImplType::kLruCache),
        // Some TrustImpls may calculate/cache IsKnownRoot values and trust
        // values independently, so test with calling IsKnownRoot both before
        // and after GetTrust to try to ensure there is no ordering issue with
        // which one initializes the cache first.
        testing::Values(TEST_IS_KNOWN_ROOT_BEFORE, TEST_IS_KNOWN_ROOT_AFTER)));

}  // namespace net