blob: 7759b8c0dd91237efbad0c8b17378cf7c43e2bbe (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef NET_BASE_TEST_ROOT_CERTS_H_
#define NET_BASE_TEST_ROOT_CERTS_H_
#pragma once
#include "base/lazy_instance.h"
#include "base/memory/ref_counted.h"
#include "build/build_config.h"
#include "net/base/net_export.h"
#if defined(OS_WIN)
#include <windows.h>
#include <wincrypt.h>
#elif defined(OS_MACOSX)
#include <CoreFoundation/CFArray.h>
#include <Security/SecTrust.h>
#include "base/mac/scoped_cftyperef.h"
#elif defined(USE_NSS)
#include <list>
#endif
class FilePath;
namespace net {
class X509Certificate;
// TestRootCerts is a helper class for unit tests that is used to
// artificially mark a certificate as trusted, independent of the local
// machine configuration.
class NET_EXPORT_PRIVATE TestRootCerts {
public:
// Obtains the Singleton instance to the trusted certificates.
static TestRootCerts* GetInstance();
// Returns true if an instance exists, without forcing an initialization.
static bool HasInstance();
// Marks |certificate| as trusted for X509Certificate::Verify(). Returns
// false if the certificate could not be marked trusted.
bool Add(X509Certificate* certificate);
// Reads a single certificate from |file| and marks it as trusted. Returns
// false if an error is encountered, such as being unable to read |file|
// or more than one certificate existing in |file|.
bool AddFromFile(const FilePath& file);
// Clears the trusted status of any certificates that were previously
// marked trusted via Add().
void Clear();
// Returns true if there are no certificates that have been marked trusted.
bool IsEmpty() const;
#if defined(OS_MACOSX)
CFArrayRef temporary_roots() const { return temporary_roots_; }
// Modifies the root certificates of |trust_ref| to include the
// certificates stored in |temporary_roots_|. If IsEmpty() is true, this
// does not modify |trust_ref|.
OSStatus FixupSecTrustRef(SecTrustRef trust_ref) const;
#elif defined(OS_WIN)
HCERTSTORE temporary_roots() const { return temporary_roots_; }
// Returns an HCERTCHAINENGINE suitable to be used for certificate
// validation routines, or NULL to indicate that the default system chain
// engine is appropriate. The caller is responsible for freeing the
// returned HCERTCHAINENGINE.
HCERTCHAINENGINE GetChainEngine() const;
#endif
private:
friend struct base::DefaultLazyInstanceTraits<TestRootCerts>;
TestRootCerts();
~TestRootCerts();
// Performs platform-dependent initialization.
void Init();
#if defined(OS_MACOSX)
base::mac::ScopedCFTypeRef<CFMutableArrayRef> temporary_roots_;
#elif defined(OS_WIN)
HCERTSTORE temporary_roots_;
#elif defined(USE_NSS)
// It is necessary to maintain a cache of the original certificate trust
// settings, in order to restore them when Clear() is called.
class TrustEntry;
std::list<TrustEntry*> trust_cache_;
#endif
#if defined(OS_WIN) || defined(USE_OPENSSL)
// True if there are no temporarily trusted root certificates.
bool empty_;
#endif
DISALLOW_COPY_AND_ASSIGN(TestRootCerts);
};
// Scoped helper for unittests to handle safely managing trusted roots.
class NET_EXPORT_PRIVATE ScopedTestRoot {
public:
ScopedTestRoot();
// Creates a ScopedTestRoot that will adds|cert| to the TestRootCerts store.
explicit ScopedTestRoot(X509Certificate* cert);
~ScopedTestRoot();
// Assigns |cert| to be the new test root cert. If |cert| is NULL, undoes
// any work the ScopedTestRoot may have previously done.
// If |cert_| contains a certificate (due to a prior call to Reset or due to
// a cert being passed at construction), the existing TestRootCerts store is
// cleared.
void Reset(X509Certificate* cert);
private:
scoped_refptr<X509Certificate> cert_;
DISALLOW_COPY_AND_ASSIGN(ScopedTestRoot);
};
} // namespace net
#endif // NET_BASE_TEST_ROOT_CERTS_H_
|
