net/cert/caching_cert_verifier_unittest.cc - chromium/src.git - Git at Google

 // Copyright 2016 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "net/cert/caching_cert_verifier.h"

 #include <memory>

 #include "base/files/file_path.h"
 #include "base/memory/ref_counted.h"
 #include "base/test/task_environment.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/cert/cert_database.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/mock_cert_verifier.h"
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util.h"
 #include "net/log/net_log_with_source.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/ct_test_util.h"
 #include "net/test/gtest_util.h"
 #include "net/test/test_data_directory.h"
 #include "net/test/test_with_task_environment.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"

 using net::test::IsError;
 using net::test::IsOk;

 using testing::_;
 using testing::Mock;
 using testing::Return;
 using testing::ReturnRef;

 namespace net {

 class CachingCertVerifierTest : public TestWithTaskEnvironment {
  public:
   CachingCertVerifierTest() : verifier_(std::make_unique<MockCertVerifier>()) {}
   ~CachingCertVerifierTest() override = default;

  protected:
   CachingCertVerifier verifier_;
 };

 TEST_F(CachingCertVerifierTest, CacheHit) {
   base::FilePath certs_dir = GetTestCertsDirectory();
   scoped_refptr<X509Certificate> test_cert(
       ImportCertFromFile(certs_dir, "ok_cert.pem"));
   ASSERT_TRUE(test_cert.get());

   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   std::unique_ptr<CertVerifier::Request> request;

   error = callback.GetResult(verifier_.Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource()));
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_EQ(1u, verifier_.requests());
   ASSERT_EQ(0u, verifier_.cache_hits());
   ASSERT_EQ(1u, verifier_.GetCacheSize());

   error = verifier_.Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource());
   // Synchronous completion.
   ASSERT_NE(ERR_IO_PENDING, error);
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_FALSE(request);
   ASSERT_EQ(2u, verifier_.requests());
   ASSERT_EQ(1u, verifier_.cache_hits());
   ASSERT_EQ(1u, verifier_.GetCacheSize());
 }

 TEST_F(CachingCertVerifierTest, CacheHitCTResultsCached) {
   base::FilePath certs_dir = GetTestCertsDirectory();
   scoped_refptr<X509Certificate> test_cert(
       ImportCertFromFile(certs_dir, "ok_cert.pem"));
   ASSERT_TRUE(test_cert.get());

   auto cert_verifier = std::make_unique<MockCertVerifier>();
   // Mock the cert verification and CT verification results.
   CertVerifyResult mock_result;
   mock_result.cert_status = OK;
   mock_result.verified_cert = test_cert;

   scoped_refptr<ct::SignedCertificateTimestamp> sct;
   ct::GetX509CertSCT(&sct);
   SignedCertificateTimestampAndStatus sct_and_status(sct, ct::SCT_STATUS_OK);
   SignedCertificateTimestampAndStatusList sct_list{sct_and_status};
   mock_result.scts = sct_list;
   cert_verifier->AddResultForCert(test_cert, mock_result, OK);

   // We don't use verifier_ here because we needed to call AddResultForCert from
   // the mock verifier.
   CachingCertVerifier cache_verifier(std::move(cert_verifier));

   int result;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   std::unique_ptr<CertVerifier::Request> request;

   result = callback.GetResult(cache_verifier.Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource()));
   ASSERT_EQ(OK, result);
   ASSERT_EQ(1u, verify_result.scts.size());
   ASSERT_EQ(ct::SCT_STATUS_OK, verify_result.scts[0].status);
   ASSERT_EQ(1u, cache_verifier.requests());
   ASSERT_EQ(0u, cache_verifier.cache_hits());
   ASSERT_EQ(1u, cache_verifier.GetCacheSize());

   result = cache_verifier.Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource());
   // Synchronous completion.
   ASSERT_EQ(OK, result);
   ASSERT_FALSE(request);
   ASSERT_EQ(1u, verify_result.scts.size());
   ASSERT_EQ(ct::SCT_STATUS_OK, verify_result.scts[0].status);
   ASSERT_EQ(2u, cache_verifier.requests());
   ASSERT_EQ(1u, cache_verifier.cache_hits());
   ASSERT_EQ(1u, cache_verifier.GetCacheSize());
 }

 // Tests the same server certificate with different intermediate CA
 // certificates.  These should be treated as different certificate chains even
 // though the two X509Certificate objects contain the same server certificate.
 TEST_F(CachingCertVerifierTest, DifferentCACerts) {
   base::FilePath certs_dir = GetTestCertsDirectory();

   scoped_refptr<X509Certificate> server_cert =
       ImportCertFromFile(certs_dir, "salesforce_com_test.pem");
   ASSERT_TRUE(server_cert);

   scoped_refptr<X509Certificate> intermediate_cert1 =
       ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2011.pem");
   ASSERT_TRUE(intermediate_cert1);

   scoped_refptr<X509Certificate> intermediate_cert2 =
       ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2016.pem");
   ASSERT_TRUE(intermediate_cert2);

   std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
   intermediates.push_back(bssl::UpRef(intermediate_cert1->cert_buffer()));
   scoped_refptr<X509Certificate> cert_chain1 =
       X509Certificate::CreateFromBuffer(bssl::UpRef(server_cert->cert_buffer()),
                                         std::move(intermediates));
   ASSERT_TRUE(cert_chain1);

   intermediates.clear();
   intermediates.push_back(bssl::UpRef(intermediate_cert2->cert_buffer()));
   scoped_refptr<X509Certificate> cert_chain2 =
       X509Certificate::CreateFromBuffer(bssl::UpRef(server_cert->cert_buffer()),
                                         std::move(intermediates));
   ASSERT_TRUE(cert_chain2);

   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   std::unique_ptr<CertVerifier::Request> request;

   error = callback.GetResult(verifier_.Verify(
       CertVerifier::RequestParams(cert_chain1, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource()));
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_EQ(1u, verifier_.requests());
   ASSERT_EQ(0u, verifier_.cache_hits());
   ASSERT_EQ(1u, verifier_.GetCacheSize());

   error = callback.GetResult(verifier_.Verify(
       CertVerifier::RequestParams(cert_chain2, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource()));
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_EQ(2u, verifier_.requests());
   ASSERT_EQ(0u, verifier_.cache_hits());
   ASSERT_EQ(2u, verifier_.GetCacheSize());
 }

 TEST_F(CachingCertVerifierTest, ObserverIsForwarded) {
   auto mock_cert_verifier = std::make_unique<MockCertVerifier>();
   MockCertVerifier* mock_cert_verifier_ptr = mock_cert_verifier.get();
   CachingCertVerifier cache_verifier(std::move(mock_cert_verifier));

   CertVerifierObserverCounter observer_(&cache_verifier);
   EXPECT_EQ(observer_.change_count(), 0u);
   // A CertVerifierChanged event on the wrapped verifier should be forwarded to
   // observers registered on CachingCertVerifier.
   mock_cert_verifier_ptr->SimulateOnCertVerifierChanged();
   EXPECT_EQ(observer_.change_count(), 1u);
 }

 namespace {
 enum class ChangeType {
   kSetConfig,
   kCertVerifierChanged,
   kCertDBChanged,
 };
 }  // namespace

 class CachingCertVerifierCacheClearingTest
     : public testing::TestWithParam<ChangeType> {
  public:
   CachingCertVerifierCacheClearingTest() {
     auto mock_cert_verifier = std::make_unique<MockCertVerifier>();
     mock_verifier_ = mock_cert_verifier.get();
     verifier_ =
         std::make_unique<CachingCertVerifier>(std::move(mock_cert_verifier));
   }

   ChangeType change_type() const { return GetParam(); }

   void DoCacheClearingAction() {
     switch (change_type()) {
       case ChangeType::kSetConfig:
         verifier_->SetConfig({});
         break;
       case ChangeType::kCertVerifierChanged:
         mock_verifier_->SimulateOnCertVerifierChanged();
         break;
       case ChangeType::kCertDBChanged:
         CertDatabase::GetInstance()->NotifyObserversTrustStoreChanged();
         base::RunLoop().RunUntilIdle();
         break;
     }
   }

  protected:
   base::test::SingleThreadTaskEnvironment task_environment_;
   std::unique_ptr<CachingCertVerifier> verifier_;
   raw_ptr<MockCertVerifier> mock_verifier_;
 };

 TEST_P(CachingCertVerifierCacheClearingTest, CacheClearedSyncVerification) {
   base::FilePath certs_dir = GetTestCertsDirectory();
   scoped_refptr<X509Certificate> test_cert(
       ImportCertFromFile(certs_dir, "ok_cert.pem"));
   ASSERT_TRUE(test_cert.get());

   mock_verifier_->set_async(false);

   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   std::unique_ptr<CertVerifier::Request> request;

   error = verifier_->Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource());
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_EQ(1u, verifier_->requests());
   ASSERT_EQ(0u, verifier_->cache_hits());
   ASSERT_EQ(1u, verifier_->GetCacheSize());

   DoCacheClearingAction();
   ASSERT_EQ(0u, verifier_->GetCacheSize());

   error = verifier_->Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource());
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_FALSE(request);
   ASSERT_EQ(2u, verifier_->requests());
   ASSERT_EQ(0u, verifier_->cache_hits());
   ASSERT_EQ(1u, verifier_->GetCacheSize());
 }

 TEST_P(CachingCertVerifierCacheClearingTest, CacheClearedAsyncVerification) {
   base::FilePath certs_dir = GetTestCertsDirectory();
   scoped_refptr<X509Certificate> test_cert(
       ImportCertFromFile(certs_dir, "ok_cert.pem"));
   ASSERT_TRUE(test_cert.get());

   mock_verifier_->set_async(true);

   int error;
   CertVerifyResult verify_result;
   TestCompletionCallback callback;
   std::unique_ptr<CertVerifier::Request> request;

   error = verifier_->Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource());
   ASSERT_EQ(ERR_IO_PENDING, error);
   ASSERT_TRUE(request);
   ASSERT_EQ(1u, verifier_->requests());
   ASSERT_EQ(0u, verifier_->cache_hits());
   ASSERT_EQ(0u, verifier_->GetCacheSize());

   DoCacheClearingAction();
   ASSERT_EQ(0u, verifier_->GetCacheSize());

   error = callback.WaitForResult();
   ASSERT_TRUE(IsCertificateError(error));
   // Async result should not have been cached since it was from a verification
   // started before the config changed.
   ASSERT_EQ(0u, verifier_->GetCacheSize());

   error = verifier_->Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource());
   ASSERT_EQ(ERR_IO_PENDING, error);
   ASSERT_TRUE(request);
   ASSERT_EQ(2u, verifier_->requests());
   ASSERT_EQ(0u, verifier_->cache_hits());
   ASSERT_EQ(0u, verifier_->GetCacheSize());

   error = callback.WaitForResult();
   ASSERT_TRUE(IsCertificateError(error));
   // New async result should be cached since it was from a verification started
   // after the config changed.
   ASSERT_EQ(1u, verifier_->GetCacheSize());

   // Verify again. Result should be synchronous this time since it will get the
   // cached result.
   error = verifier_->Verify(
       CertVerifier::RequestParams(test_cert, "www.example.com", 0,
                                   /*ocsp_response=*/std::string(),
                                   /*sct_list=*/std::string()),
       &verify_result, callback.callback(), &request, NetLogWithSource());
   ASSERT_TRUE(IsCertificateError(error));
   ASSERT_FALSE(request);
   ASSERT_EQ(3u, verifier_->requests());
   ASSERT_EQ(1u, verifier_->cache_hits());
   ASSERT_EQ(1u, verifier_->GetCacheSize());
 }

 INSTANTIATE_TEST_SUITE_P(All,
                          CachingCertVerifierCacheClearingTest,
                          testing::Values(ChangeType::kSetConfig,
                                          ChangeType::kCertVerifierChanged,
                                          ChangeType::kCertDBChanged));

 }  // namespace net
	// Copyright 2016 The Chromium Authors
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "net/cert/caching_cert_verifier.h"

	#include <memory>

	#include "base/files/file_path.h"
	#include "base/memory/ref_counted.h"
	#include "base/test/task_environment.h"
	#include "net/base/net_errors.h"
	#include "net/base/test_completion_callback.h"
	#include "net/cert/cert_database.h"
	#include "net/cert/cert_verifier.h"
	#include "net/cert/cert_verify_result.h"
	#include "net/cert/mock_cert_verifier.h"
	#include "net/cert/x509_certificate.h"
	#include "net/cert/x509_util.h"
	#include "net/log/net_log_with_source.h"
	#include "net/test/cert_test_util.h"
	#include "net/test/ct_test_util.h"
	#include "net/test/gtest_util.h"
	#include "net/test/test_data_directory.h"
	#include "net/test/test_with_task_environment.h"
	#include "testing/gmock/include/gmock/gmock.h"
	#include "testing/gtest/include/gtest/gtest.h"

	using net::test::IsError;
	using net::test::IsOk;

	using testing::_;
	using testing::Mock;
	using testing::Return;
	using testing::ReturnRef;

	namespace net {

	class CachingCertVerifierTest : public TestWithTaskEnvironment {
	public:
	CachingCertVerifierTest() : verifier_(std::make_unique<MockCertVerifier>()) {}
	~CachingCertVerifierTest() override = default;

	protected:
	CachingCertVerifier verifier_;
	};

	TEST_F(CachingCertVerifierTest, CacheHit) {
	base::FilePath certs_dir = GetTestCertsDirectory();
	scoped_refptr<X509Certificate> test_cert(
	ImportCertFromFile(certs_dir, "ok_cert.pem"));
	ASSERT_TRUE(test_cert.get());

	int error;
	CertVerifyResult verify_result;
	TestCompletionCallback callback;
	std::unique_ptr<CertVerifier::Request> request;

	error = callback.GetResult(verifier_.Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource()));
	ASSERT_TRUE(IsCertificateError(error));
	ASSERT_EQ(1u, verifier_.requests());
	ASSERT_EQ(0u, verifier_.cache_hits());
	ASSERT_EQ(1u, verifier_.GetCacheSize());

	error = verifier_.Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource());
	// Synchronous completion.
	ASSERT_NE(ERR_IO_PENDING, error);
	ASSERT_TRUE(IsCertificateError(error));
	ASSERT_FALSE(request);
	ASSERT_EQ(2u, verifier_.requests());
	ASSERT_EQ(1u, verifier_.cache_hits());
	ASSERT_EQ(1u, verifier_.GetCacheSize());
	}

	TEST_F(CachingCertVerifierTest, CacheHitCTResultsCached) {
	base::FilePath certs_dir = GetTestCertsDirectory();
	scoped_refptr<X509Certificate> test_cert(
	ImportCertFromFile(certs_dir, "ok_cert.pem"));
	ASSERT_TRUE(test_cert.get());

	auto cert_verifier = std::make_unique<MockCertVerifier>();
	// Mock the cert verification and CT verification results.
	CertVerifyResult mock_result;
	mock_result.cert_status = OK;
	mock_result.verified_cert = test_cert;

	scoped_refptr<ct::SignedCertificateTimestamp> sct;
	ct::GetX509CertSCT(&sct);
	SignedCertificateTimestampAndStatus sct_and_status(sct, ct::SCT_STATUS_OK);
	SignedCertificateTimestampAndStatusList sct_list{sct_and_status};
	mock_result.scts = sct_list;
	cert_verifier->AddResultForCert(test_cert, mock_result, OK);

	// We don't use verifier_ here because we needed to call AddResultForCert from
	// the mock verifier.
	CachingCertVerifier cache_verifier(std::move(cert_verifier));

	int result;
	CertVerifyResult verify_result;
	TestCompletionCallback callback;
	std::unique_ptr<CertVerifier::Request> request;

	result = callback.GetResult(cache_verifier.Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource()));
	ASSERT_EQ(OK, result);
	ASSERT_EQ(1u, verify_result.scts.size());
	ASSERT_EQ(ct::SCT_STATUS_OK, verify_result.scts[0].status);
	ASSERT_EQ(1u, cache_verifier.requests());
	ASSERT_EQ(0u, cache_verifier.cache_hits());
	ASSERT_EQ(1u, cache_verifier.GetCacheSize());

	result = cache_verifier.Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource());
	// Synchronous completion.
	ASSERT_EQ(OK, result);
	ASSERT_FALSE(request);
	ASSERT_EQ(1u, verify_result.scts.size());
	ASSERT_EQ(ct::SCT_STATUS_OK, verify_result.scts[0].status);
	ASSERT_EQ(2u, cache_verifier.requests());
	ASSERT_EQ(1u, cache_verifier.cache_hits());
	ASSERT_EQ(1u, cache_verifier.GetCacheSize());
	}

	// Tests the same server certificate with different intermediate CA
	// certificates. These should be treated as different certificate chains even
	// though the two X509Certificate objects contain the same server certificate.
	TEST_F(CachingCertVerifierTest, DifferentCACerts) {
	base::FilePath certs_dir = GetTestCertsDirectory();

	scoped_refptr<X509Certificate> server_cert =
	ImportCertFromFile(certs_dir, "salesforce_com_test.pem");
	ASSERT_TRUE(server_cert);

	scoped_refptr<X509Certificate> intermediate_cert1 =
	ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2011.pem");
	ASSERT_TRUE(intermediate_cert1);

	scoped_refptr<X509Certificate> intermediate_cert2 =
	ImportCertFromFile(certs_dir, "verisign_intermediate_ca_2016.pem");
	ASSERT_TRUE(intermediate_cert2);

	std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
	intermediates.push_back(bssl::UpRef(intermediate_cert1->cert_buffer()));
	scoped_refptr<X509Certificate> cert_chain1 =
	X509Certificate::CreateFromBuffer(bssl::UpRef(server_cert->cert_buffer()),
	std::move(intermediates));
	ASSERT_TRUE(cert_chain1);

	intermediates.clear();
	intermediates.push_back(bssl::UpRef(intermediate_cert2->cert_buffer()));
	scoped_refptr<X509Certificate> cert_chain2 =
	X509Certificate::CreateFromBuffer(bssl::UpRef(server_cert->cert_buffer()),
	std::move(intermediates));
	ASSERT_TRUE(cert_chain2);

	int error;
	CertVerifyResult verify_result;
	TestCompletionCallback callback;
	std::unique_ptr<CertVerifier::Request> request;

	error = callback.GetResult(verifier_.Verify(
	CertVerifier::RequestParams(cert_chain1, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource()));
	ASSERT_TRUE(IsCertificateError(error));
	ASSERT_EQ(1u, verifier_.requests());
	ASSERT_EQ(0u, verifier_.cache_hits());
	ASSERT_EQ(1u, verifier_.GetCacheSize());

	error = callback.GetResult(verifier_.Verify(
	CertVerifier::RequestParams(cert_chain2, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource()));
	ASSERT_TRUE(IsCertificateError(error));
	ASSERT_EQ(2u, verifier_.requests());
	ASSERT_EQ(0u, verifier_.cache_hits());
	ASSERT_EQ(2u, verifier_.GetCacheSize());
	}

	TEST_F(CachingCertVerifierTest, ObserverIsForwarded) {
	auto mock_cert_verifier = std::make_unique<MockCertVerifier>();
	MockCertVerifier* mock_cert_verifier_ptr = mock_cert_verifier.get();
	CachingCertVerifier cache_verifier(std::move(mock_cert_verifier));

	CertVerifierObserverCounter observer_(&cache_verifier);
	EXPECT_EQ(observer_.change_count(), 0u);
	// A CertVerifierChanged event on the wrapped verifier should be forwarded to
	// observers registered on CachingCertVerifier.
	mock_cert_verifier_ptr->SimulateOnCertVerifierChanged();
	EXPECT_EQ(observer_.change_count(), 1u);
	}

	namespace {
	enum class ChangeType {
	kSetConfig,
	kCertVerifierChanged,
	kCertDBChanged,
	};
	} // namespace

	class CachingCertVerifierCacheClearingTest
	: public testing::TestWithParam<ChangeType> {
	public:
	CachingCertVerifierCacheClearingTest() {
	auto mock_cert_verifier = std::make_unique<MockCertVerifier>();
	mock_verifier_ = mock_cert_verifier.get();
	verifier_ =
	std::make_unique<CachingCertVerifier>(std::move(mock_cert_verifier));
	}

	ChangeType change_type() const { return GetParam(); }

	void DoCacheClearingAction() {
	switch (change_type()) {
	case ChangeType::kSetConfig:
	verifier_->SetConfig({});
	break;
	case ChangeType::kCertVerifierChanged:
	mock_verifier_->SimulateOnCertVerifierChanged();
	break;
	case ChangeType::kCertDBChanged:
	CertDatabase::GetInstance()->NotifyObserversTrustStoreChanged();
	base::RunLoop().RunUntilIdle();
	break;
	}
	}

	protected:
	base::test::SingleThreadTaskEnvironment task_environment_;
	std::unique_ptr<CachingCertVerifier> verifier_;
	raw_ptr<MockCertVerifier> mock_verifier_;
	};

	TEST_P(CachingCertVerifierCacheClearingTest, CacheClearedSyncVerification) {
	base::FilePath certs_dir = GetTestCertsDirectory();
	scoped_refptr<X509Certificate> test_cert(
	ImportCertFromFile(certs_dir, "ok_cert.pem"));
	ASSERT_TRUE(test_cert.get());

	mock_verifier_->set_async(false);

	int error;
	CertVerifyResult verify_result;
	TestCompletionCallback callback;
	std::unique_ptr<CertVerifier::Request> request;

	error = verifier_->Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource());
	ASSERT_TRUE(IsCertificateError(error));
	ASSERT_EQ(1u, verifier_->requests());
	ASSERT_EQ(0u, verifier_->cache_hits());
	ASSERT_EQ(1u, verifier_->GetCacheSize());

	DoCacheClearingAction();
	ASSERT_EQ(0u, verifier_->GetCacheSize());

	error = verifier_->Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource());
	ASSERT_TRUE(IsCertificateError(error));
	ASSERT_FALSE(request);
	ASSERT_EQ(2u, verifier_->requests());
	ASSERT_EQ(0u, verifier_->cache_hits());
	ASSERT_EQ(1u, verifier_->GetCacheSize());
	}

	TEST_P(CachingCertVerifierCacheClearingTest, CacheClearedAsyncVerification) {
	base::FilePath certs_dir = GetTestCertsDirectory();
	scoped_refptr<X509Certificate> test_cert(
	ImportCertFromFile(certs_dir, "ok_cert.pem"));
	ASSERT_TRUE(test_cert.get());

	mock_verifier_->set_async(true);

	int error;
	CertVerifyResult verify_result;
	TestCompletionCallback callback;
	std::unique_ptr<CertVerifier::Request> request;

	error = verifier_->Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource());
	ASSERT_EQ(ERR_IO_PENDING, error);
	ASSERT_TRUE(request);
	ASSERT_EQ(1u, verifier_->requests());
	ASSERT_EQ(0u, verifier_->cache_hits());
	ASSERT_EQ(0u, verifier_->GetCacheSize());

	DoCacheClearingAction();
	ASSERT_EQ(0u, verifier_->GetCacheSize());

	error = callback.WaitForResult();
	ASSERT_TRUE(IsCertificateError(error));
	// Async result should not have been cached since it was from a verification
	// started before the config changed.
	ASSERT_EQ(0u, verifier_->GetCacheSize());

	error = verifier_->Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource());
	ASSERT_EQ(ERR_IO_PENDING, error);
	ASSERT_TRUE(request);
	ASSERT_EQ(2u, verifier_->requests());
	ASSERT_EQ(0u, verifier_->cache_hits());
	ASSERT_EQ(0u, verifier_->GetCacheSize());

	error = callback.WaitForResult();
	ASSERT_TRUE(IsCertificateError(error));
	// New async result should be cached since it was from a verification started
	// after the config changed.
	ASSERT_EQ(1u, verifier_->GetCacheSize());

	// Verify again. Result should be synchronous this time since it will get the
	// cached result.
	error = verifier_->Verify(
	CertVerifier::RequestParams(test_cert, "www.example.com", 0,
	/ocsp_response=/std::string(),
	/sct_list=/std::string()),
	&verify_result, callback.callback(), &request, NetLogWithSource());
	ASSERT_TRUE(IsCertificateError(error));
	ASSERT_FALSE(request);
	ASSERT_EQ(3u, verifier_->requests());
	ASSERT_EQ(1u, verifier_->cache_hits());
	ASSERT_EQ(1u, verifier_->GetCacheSize());
	}

	INSTANTIATE_TEST_SUITE_P(All,
	CachingCertVerifierCacheClearingTest,
	testing::Values(ChangeType::kSetConfig,
	ChangeType::kCertVerifierChanged,
	ChangeType::kCertDBChanged));

	} // namespace net