// Copyright 2019 The Chromium Authors // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "cast/common/certificate/cast_cert_validator.h" #include <stdio.h> #include <string.h> #include "cast/common/certificate/date_time.h" #include "cast/common/certificate/testing/test_helpers.h" #include "cast/common/public/trust_store.h" #include "gtest/gtest.h" #include "openssl/pem.h" #include "platform/test/byte_view_test_util.h" #include "platform/test/paths.h" #include "util/crypto/pem_helpers.h" namespace openscreen::cast { namespace { enum TrustStoreDependency { … }; // Reads a test chain from |certs_file_name|, and asserts that verifying it as // a Cast device certificate yields |expected_result|. // // RunTest() also checks that the resulting device certificate does not // incorrectly verify invalid signatures. // // * |expected_policy| - The policy that should have been identified for the // device certificate. // * |time| - The timestamp to use when verifying the certificate. // * |trust_store_dependency| - Which trust store to use when verifying (see // enum's definition). // * |optional_signed_data_file_name| - optional path to a PEM file containing // a valid signature generated by the device certificate. // void RunTest(Error::Code expected_result, const std::string& expected_common_name, CastDeviceCertPolicy expected_policy, const std::string& certs_file_name, const DateTime& time, TrustStoreDependency trust_store_dependency, const std::string& optional_signed_data_file_name) { … } // Creates a time in UTC at midnight. DateTime CreateDate(int year, int month, int day) { … } // Returns 2016-04-01 00:00:00 UTC. // // This is a time when most of the test certificate paths are valid. DateTime AprilFirst2016() { … } DateTime AprilFirst2020() { … } // Returns 2015-01-01 00:00:00 UTC. DateTime JanuaryFirst2015() { … } // Returns 2037-03-01 00:00:00 UTC. // // This is so far in the future that the test chains in this unit-test should // all be invalid. DateTime MarchFirst2037() { … } const std::string& GetSpecificTestDataPath() { … } // Tests verifying a valid certificate chain of length 2: // // 0: 2ZZBG9 FA8FCA3EF91A // 1: Eureka Gen1 ICA // // Chains to trust anchor: // Eureka Root CA (built-in trust store) TEST(VerifyCastDeviceCertTest, ChromecastGen1) { … } // Tests verifying a valid certificate chain of length 2: // // 0: 2ZZBG9 FA8FCA3EF91A // 1: Eureka Gen1 ICA // // Chains to trust anchor: // Cast Root CA (built-in trust store) TEST(VerifyCastDeviceCertTest, ChromecastGen1Reissue) { … } // Tests verifying a valid certificate chain of length 2: // // 0: 3ZZAK6 FA8FCA3F0D35 // 1: Chromecast ICA 3 // // Chains to trust anchor: // Cast Root CA (built-in trust store) TEST(VerifyCastDeviceCertTest, ChromecastGen2) { … } // Tests verifying a valid certificate chain of length 3: // // 0: -6394818897508095075 // 1: Asus fugu Cast ICA // 2: Widevine Cast Subroot // // Chains to trust anchor: // Cast Root CA (built-in trust store) TEST(VerifyCastDeviceCertTest, Fugu) { … } // Tests verifying an invalid certificate chain of length 1: // // 0: Cast Test Untrusted Device // // Chains to: // Cast Test Untrusted ICA (Not part of trust store) // // This is invalid because it does not chain to a trust anchor. TEST(VerifyCastDeviceCertTest, Unchained) { … } // Tests verifying one of the self-signed trust anchors (chain of length 1): // // 0: Cast Root CA // // Chains to trust anchor: // Cast Root CA (built-in trust store) // // Although this is a valid and trusted certificate (it is one of the // trust anchors after all) it fails the test as it is not a *device // certificate*. TEST(VerifyCastDeviceCertTest, CastRootCa) { … } // Tests verifying a valid certificate chain of length 2: // // 0: 4ZZDZJ FA8FCA7EFE3C // 1: Chromecast ICA 4 (Audio) // // Chains to trust anchor: // Cast Root CA (built-in trust store) // // This device certificate has a policy that means it is valid only for audio // devices. TEST(VerifyCastDeviceCertTest, ChromecastAudio) { … } // Tests verifying a valid certificate chain of length 3: // // 0: MediaTek Audio Dev Test // 1: MediaTek Audio Dev Model // 2: Cast Audio Dev Root CA // // Chains to trust anchor: // Cast Root CA (built-in trust store) // // This device certificate has a policy that means it is valid only for audio // devices. TEST(VerifyCastDeviceCertTest, MtkAudioDev) { … } // Tests verifying a valid certificate chain of length 2: // // 0: 9V0000VB FA8FCA784D01 // 1: Cast TV ICA (Vizio) // // Chains to trust anchor: // Cast Root CA (built-in trust store) TEST(VerifyCastDeviceCertTest, Vizio) { … } // Tests verifying a valid certificate chain of length 2 using expired // time points. TEST(VerifyCastDeviceCertTest, ChromecastGen2InvalidTime) { … } // Tests verifying a valid certificate chain of length 3: // // 0: Audio Reference Dev Test // 1: Audio Reference Dev Model // 2: Cast Audio Dev Root CA // // Chains to trust anchor: // Cast Root CA (built-in trust store) // // This device certificate has a policy that means it is valid only for audio // devices. TEST(VerifyCastDeviceCertTest, AudioRefDevTestChain3) { … } // TODO(btolsch): This won't work by default with boringssl, so do we want to // find a way to work around this or is it safe to enforce 20-octet length now? // Previous TODO from eroman@ suggested 2017 or even sooner was safe to remove // this. #if 0 // Tests verifying a valid certificate chain of length 3. Note that the first // intermediate has a serial number that is 21 octets long, which violates RFC // 5280. However cast verification accepts this certificate for compatibility // reasons. // // 0: 8C579B806FFC8A9DFFFF F8:8F:CA:6B:E6:DA // 1: Sony so16vic CA // 2: Cast Audio Sony CA // // Chains to trust anchor: // Cast Root CA (built-in trust store) // // This device certificate has a policy that means it is valid only for audio // devices. TEST(VerifyCastDeviceCertTest, IntermediateSerialNumberTooLong) { RunTest(Error::Code::kNone, "8C579B806FFC8A9DFFFF F8:8F:CA:6B:E6:DA", CastDeviceCertPolicy::AUDIO_ONLY, "certificates/intermediate_serialnumber_toolong.pem", AprilFirst2016(), TRUST_STORE_BUILTIN, ""); } #endif // Tests verifying a valid certificate chain of length 2 when the trust anchor // is "expired". This is expected to work since expiration is not an enforced // anchor constraint, even though it may appear in the root certificate. // // 0: CastDevice // 1: CastIntermediate // // Chains to trust anchor: // Expired CastRoot (provided by test data) TEST(VerifyCastDeviceCertTest, ExpiredTrustAnchor) { … } // Tests verifying a certificate chain where the root certificate has a pathlen // constraint which is violated by the chain. In this case Root has a pathlen=1 // constraint, however neither intermediate is constrained. // // The expectation is for pathlen constraints on trust anchors to be enforced, // so this validation must fail. // // 0: Target // 1: Intermediate2 // 2: Intermediate1 // // Chains to trust anchor: // Root (provided by test data; has pathlen=1 constraint) TEST(VerifyCastDeviceCertTest, ViolatesPathlenTrustAnchorConstraint) { … } // Tests verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={anyPolicy} // Leaf: policies={anyPolicy} TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafAnypolicy) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={anyPolicy} // Leaf: policies={audioOnly} TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafAudioonly) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={anyPolicy} // Leaf: policies={foo} TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafFoo) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={anyPolicy} // Leaf: policies={} TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafNone) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={audioOnly} // Leaf: policies={anyPolicy} TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafAnypolicy) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={audioOnly} // Leaf: policies={audioOnly} TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafAudioonly) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={audioOnly} // Leaf: policies={foo} TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafFoo) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={audioOnly} // Leaf: policies={} TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafNone) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={} // Leaf: policies={anyPolicy} TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafAnypolicy) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={} // Leaf: policies={audioOnly} TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafAudioonly) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={} // Leaf: policies={foo} TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafFoo) { … } // Test verifying a certificate chain with the policies: // // Root: policies={} // Intermediate: policies={} // Leaf: policies={} TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafNone) { … } // Tests verifying a certificate chain where the leaf certificate has a // 1024-bit RSA key. Verification should fail since the target's key is // too weak. TEST(VerifyCastDeviceCertTest, DeviceCertHas1024BitRsaKey) { … } // Tests verifying a certificate chain where the leaf certificate has a // 2048-bit RSA key, and then verifying signed data (both SHA1 and SHA256) // for it. TEST(VerifyCastDeviceCertTest, DeviceCertHas2048BitRsaKey) { … } // Tests verifying a certificate chain where an intermediate certificate has a // nameConstraints extension but the leaf certificate is still permitted under // these constraints. TEST(VerifyCastDeviceCertTest, NameConstraintsObeyed) { … } // Tests verifying a certificate chain where an intermediate certificate has a // nameConstraints extension and the leaf certificate is not permitted under // these constraints. TEST(VerifyCastDeviceCertTest, NameConstraintsViolated) { … } // Tests reversibility between DateTimeToSeconds and DateTimeFromSeconds TEST(VerifyCastDeviceCertTest, TimeDateConversionValidate) { … } } // namespace } // namespace openscreen::cast