1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#ifndef NET_CERT_TEST_ROOT_CERTS_H_ 6#define NET_CERT_TEST_ROOT_CERTS_H_ 7 8#include "base/lazy_instance.h" 9#include "base/memory/ref_counted.h" 10#include "build/build_config.h" 11#include "net/base/net_export.h" 12 13#if defined(USE_NSS) || defined(OS_IOS) 14#include <list> 15#elif defined(OS_WIN) 16#include <windows.h> 17#include <wincrypt.h> 18#elif defined(OS_MACOSX) 19#include <CoreFoundation/CFArray.h> 20#include <Security/SecTrust.h> 21#include "base/mac/scoped_cftyperef.h" 22#endif 23 24namespace base { 25class FilePath; 26} 27 28namespace net { 29 30class X509Certificate; 31 32// TestRootCerts is a helper class for unit tests that is used to 33// artificially mark a certificate as trusted, independent of the local 34// machine configuration. 35class NET_EXPORT_PRIVATE TestRootCerts { 36 public: 37 // Obtains the Singleton instance to the trusted certificates. 38 static TestRootCerts* GetInstance(); 39 40 // Returns true if an instance exists, without forcing an initialization. 41 static bool HasInstance(); 42 43 // Marks |certificate| as trusted for X509Certificate::Verify(). Returns 44 // false if the certificate could not be marked trusted. 45 bool Add(X509Certificate* certificate); 46 47 // Reads a single certificate from |file| and marks it as trusted. Returns 48 // false if an error is encountered, such as being unable to read |file| 49 // or more than one certificate existing in |file|. 50 bool AddFromFile(const base::FilePath& file); 51 52 // Clears the trusted status of any certificates that were previously 53 // marked trusted via Add(). 54 void Clear(); 55 56 // Returns true if there are no certificates that have been marked trusted. 57 bool IsEmpty() const; 58 59#if defined(OS_MACOSX) && !defined(OS_IOS) 60 CFArrayRef temporary_roots() const { return temporary_roots_; } 61 62 // Modifies the root certificates of |trust_ref| to include the 63 // certificates stored in |temporary_roots_|. If IsEmpty() is true, this 64 // does not modify |trust_ref|. 65 OSStatus FixupSecTrustRef(SecTrustRef trust_ref) const; 66 67 // Configures whether or not the default/system root store should also 68 // be trusted. By default, this is true, indicating that the TestRootCerts 69 // are used in addition to OS trust store. 70 void SetAllowSystemTrust(bool allow_system_trust); 71 72#elif defined(OS_WIN) 73 HCERTSTORE temporary_roots() const { return temporary_roots_; } 74 75 // Returns an HCERTCHAINENGINE suitable to be used for certificate 76 // validation routines, or NULL to indicate that the default system chain 77 // engine is appropriate. The caller is responsible for freeing the 78 // returned HCERTCHAINENGINE. 79 HCERTCHAINENGINE GetChainEngine() const; 80#endif 81 82 private: 83 friend struct base::DefaultLazyInstanceTraits<TestRootCerts>; 84 85 TestRootCerts(); 86 ~TestRootCerts(); 87 88 // Performs platform-dependent initialization. 89 void Init(); 90 91#if defined(USE_NSS) || defined(OS_IOS) 92 // It is necessary to maintain a cache of the original certificate trust 93 // settings, in order to restore them when Clear() is called. 94 class TrustEntry; 95 std::list<TrustEntry*> trust_cache_; 96#elif defined(OS_WIN) 97 HCERTSTORE temporary_roots_; 98#elif defined(OS_MACOSX) 99 base::ScopedCFTypeRef<CFMutableArrayRef> temporary_roots_; 100 bool allow_system_trust_; 101#endif 102 103#if defined(OS_WIN) || defined(USE_OPENSSL) 104 // True if there are no temporarily trusted root certificates. 105 bool empty_; 106#endif 107 108 DISALLOW_COPY_AND_ASSIGN(TestRootCerts); 109}; 110 111// Scoped helper for unittests to handle safely managing trusted roots. 112class NET_EXPORT_PRIVATE ScopedTestRoot { 113 public: 114 ScopedTestRoot(); 115 // Creates a ScopedTestRoot that will adds|cert| to the TestRootCerts store. 116 explicit ScopedTestRoot(X509Certificate* cert); 117 ~ScopedTestRoot(); 118 119 // Assigns |cert| to be the new test root cert. If |cert| is NULL, undoes 120 // any work the ScopedTestRoot may have previously done. 121 // If |cert_| contains a certificate (due to a prior call to Reset or due to 122 // a cert being passed at construction), the existing TestRootCerts store is 123 // cleared. 124 void Reset(X509Certificate* cert); 125 126 private: 127 scoped_refptr<X509Certificate> cert_; 128 129 DISALLOW_COPY_AND_ASSIGN(ScopedTestRoot); 130}; 131 132} // namespace net 133 134#endif // NET_CERT_TEST_ROOT_CERTS_H_ 135