Work around GTE CyberTrust/Baltimore CyberTrust cross-signing issues

net/cert/cert_verify_proc_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include <vector>
 
 #include "base/files/file_path.h"
 #include "base/logging.h"
@@ skipping 841 matching lines @@
 
   // Clearing the |trust_anchors| makes verification fail again (the cache
   // should be skipped).
   error = Verify(
       cert.get(), "127.0.0.1", flags, NULL, empty_cert_list_, &verify_result);
   EXPECT_EQ(ERR_CERT_AUTHORITY_INVALID, error);
   EXPECT_EQ(CERT_STATUS_AUTHORITY_INVALID, verify_result.cert_status);
   EXPECT_FALSE(verify_result.is_issued_by_additional_trust_anchor);
 }
 
+#if defined(OS_MACOSX) && !defined(OS_IOS)
+// Tests that, on OS X, issues with a cross-certified Baltimore CyberTrust
+// Root can be successfully worked around once Apple completes removing the
+// older GTE CyberTrust Root from its trusted root store.
+//
+// The issue is caused by servers supplying the cross-certified intermediate
+// (necessary for certain mobile platforms), which OS X does not recognize
+// as already existing within its trust store.
+TEST_F(CertVerifyProcTest, CybertrustGTERoot) {
+  CertificateList certs = CreateCertificateListFromFile(
+      GetTestCertsDirectory(),
+      "cybertrust_omniroot_chain.pem",
+      X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
+  ASSERT_EQ(2U, certs.size());
+
+  X509Certificate::OSCertHandles intermediates;
+  intermediates.push_back(certs[1]->os_cert_handle());
+
+  scoped_refptr<X509Certificate> cybertrust_basic =
+      X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(),
+                                        intermediates);
+  ASSERT_TRUE(cybertrust_basic.get());
+
+  scoped_refptr<X509Certificate> baltimore_root =
+      ImportCertFromFile(GetTestCertsDirectory(),
+                         "cybertrust_baltimore_root.pem");
+  ASSERT_TRUE(baltimore_root.get());
+
+  ScopedTestRoot scoped_root(baltimore_root);
+
+  // Ensure that ONLY the Baltimore CyberTrust Root is trusted. This
+  // simulates Keychain removing support for the GTE CyberTrust Root.
+  TestRootCerts::GetInstance()->SetAllowSystemTrust(false);
+  base::ScopedClosureRunner reset_system_trust(
+      base::Bind(&TestRootCerts::SetAllowSystemTrust,
+                 base::Unretained(TestRootCerts::GetInstance()),
+                 true));
+
+  // First, make sure a simple certificate chain from
+  //   EE -> Public SureServer SV -> Baltimore CyberTrust
+  // works. Only the first two certificates are included in the chain.
+  int flags = 0;
+  CertVerifyResult verify_result;
+  int error = Verify(cybertrust_basic, "cacert.omniroot.com", flags, NULL,
+                     empty_cert_list_, &verify_result);
+  EXPECT_EQ(OK, error);
+  EXPECT_EQ(0U, verify_result.cert_status);
+
+  // Attempt to verify with the first known cross-certified intermediate
+  // provided.
+  scoped_refptr<X509Certificate> baltimore_intermediate_1 =
+      ImportCertFromFile(GetTestCertsDirectory(),
+                         "cybertrust_baltimore_cross_certified_1.pem");
+  ASSERT_TRUE(baltimore_intermediate_1.get());
+
+  X509Certificate::OSCertHandles intermediate_chain_1 =
+      cybertrust_basic->GetIntermediateCertificates();
+  intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle());
+
+  scoped_refptr<X509Certificate> baltimore_chain_1 =
+      X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
+                                        intermediate_chain_1);
+  error = Verify(baltimore_chain_1, "cacert.omniroot.com", flags, NULL,
+                 empty_cert_list_, &verify_result);
+  EXPECT_EQ(OK, error);
+  EXPECT_EQ(0U, verify_result.cert_status);
+
+  // Attempt to verify with the second known cross-certified intermediate
+  // provided.
+  scoped_refptr<X509Certificate> baltimore_intermediate_2 =
+      ImportCertFromFile(GetTestCertsDirectory(),
+                         "cybertrust_baltimore_cross_certified_2.pem");
+  ASSERT_TRUE(baltimore_intermediate_2.get());
+
+  X509Certificate::OSCertHandles intermediate_chain_2 =
+      cybertrust_basic->GetIntermediateCertificates();
+  intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle());
+
+  scoped_refptr<X509Certificate> baltimore_chain_2 =
+      X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
+                                        intermediate_chain_2);
+  error = Verify(baltimore_chain_2, "cacert.omniroot.com", flags, NULL,
+                 empty_cert_list_, &verify_result);
+  EXPECT_EQ(OK, error);
+  EXPECT_EQ(0U, verify_result.cert_status);
+
+  // Attempt to verify when both a cross-certified intermediate AND
+  // the legacy GTE root are provided.
+  scoped_refptr<X509Certificate> cybertrust_root =
+      ImportCertFromFile(GetTestCertsDirectory(),
+                         "cybertrust_gte_root.pem");
+  ASSERT_TRUE(cybertrust_root.get());
+
+  intermediate_chain_2.push_back(cybertrust_root->os_cert_handle());
+  scoped_refptr<X509Certificate> baltimore_chain_with_root =
+      X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
+                                        intermediate_chain_2);
+  error = Verify(baltimore_chain_with_root, "cacert.omniroot.com", flags,
+                 NULL, empty_cert_list_, &verify_result);
+  EXPECT_EQ(OK, error);
+  EXPECT_EQ(0U, verify_result.cert_status);
+
+}
+#endif
+
 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX)
 static const uint8 kCRLSetThawteSPKIBlocked[] = {
   0x8e, 0x00, 0x7b, 0x22, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x3a,
   0x30, 0x2c, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70,
   0x65, 0x22, 0x3a, 0x22, 0x43, 0x52, 0x4c, 0x53, 0x65, 0x74, 0x22, 0x2c, 0x22,
   0x53, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x63, 0x65, 0x22, 0x3a, 0x30, 0x2c, 0x22,
   0x44, 0x65, 0x6c, 0x74, 0x61, 0x46, 0x72, 0x6f, 0x6d, 0x22, 0x3a, 0x30, 0x2c,
   0x22, 0x4e, 0x75, 0x6d, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x3a,
   0x30, 0x2c, 0x22, 0x42, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x53, 0x50, 0x4b,
   0x49, 0x73, 0x22, 0x3a, 0x5b, 0x22, 0x36, 0x58, 0x36, 0x4d, 0x78, 0x52, 0x37,
@@ skipping 417 matching lines @@
 TEST_P(CertVerifyProcNonUniqueNameTest, IsHostnameNonUnique) {
   const NonUniqueNameTestData& test_data = GetParam();
 
   EXPECT_EQ(test_data.is_unique, IsUnique(test_data.hostname));
 }
 
 INSTANTIATE_TEST_CASE_P(, CertVerifyProcNonUniqueNameTest,
                         testing::ValuesIn(kNonUniqueNameTestData));
 
 }  // namespace net