| OLD | NEW | 
|---|
|  | (Empty) | 
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. |  | 
| 2 // Use of this source code is governed by a BSD-style license that can be |  | 
| 3 // found in the LICENSE file. |  | 
| 4 |  | 
| 5 #include "chrome/browser/safe_browsing/binary_feature_extractor.h" |  | 
| 6 |  | 
| 7 #include <string> |  | 
| 8 #include <vector> |  | 
| 9 |  | 
| 10 #include "base/base_paths.h" |  | 
| 11 #include "base/files/file_path.h" |  | 
| 12 #include "base/memory/ref_counted.h" |  | 
| 13 #include "base/path_service.h" |  | 
| 14 #include "chrome/common/chrome_paths.h" |  | 
| 15 #include "chrome/common/safe_browsing/csd.pb.h" |  | 
| 16 #include "net/cert/x509_cert_types.h" |  | 
| 17 #include "net/cert/x509_certificate.h" |  | 
| 18 #include "testing/gtest/include/gtest/gtest.h" |  | 
| 19 |  | 
| 20 namespace safe_browsing { |  | 
| 21 |  | 
| 22 class BinaryFeatureExtractorWinTest : public testing::Test { |  | 
| 23  protected: |  | 
| 24   virtual void SetUp() override { |  | 
| 25     base::FilePath source_path; |  | 
| 26     ASSERT_TRUE(PathService::Get(chrome::DIR_TEST_DATA, &source_path)); |  | 
| 27     testdata_path_ = source_path |  | 
| 28         .AppendASCII("safe_browsing") |  | 
| 29         .AppendASCII("download_protection"); |  | 
| 30 |  | 
| 31     binary_feature_extractor_ = new BinaryFeatureExtractor(); |  | 
| 32   } |  | 
| 33 |  | 
| 34   // Given a certificate chain protobuf, parse it into X509Certificates. |  | 
| 35   void ParseCertificateChain( |  | 
| 36       const ClientDownloadRequest_CertificateChain& chain, |  | 
| 37       std::vector<scoped_refptr<net::X509Certificate> >* certs) { |  | 
| 38     for (int i = 0; i < chain.element_size(); ++i) { |  | 
| 39       certs->push_back( |  | 
| 40           net::X509Certificate::CreateFromBytes( |  | 
| 41               chain.element(i).certificate().data(), |  | 
| 42               chain.element(i).certificate().size())); |  | 
| 43     } |  | 
| 44   } |  | 
| 45 |  | 
| 46   base::FilePath testdata_path_; |  | 
| 47   scoped_refptr<BinaryFeatureExtractor> binary_feature_extractor_; |  | 
| 48 }; |  | 
| 49 |  | 
| 50 TEST_F(BinaryFeatureExtractorWinTest, UntrustedSignedBinary) { |  | 
| 51   // signed.exe is signed by an untrusted root CA. |  | 
| 52   ClientDownloadRequest_SignatureInfo signature_info; |  | 
| 53   binary_feature_extractor_->CheckSignature( |  | 
| 54       testdata_path_.Append(L"signed.exe"), |  | 
| 55       &signature_info); |  | 
| 56   ASSERT_EQ(1, signature_info.certificate_chain_size()); |  | 
| 57   std::vector<scoped_refptr<net::X509Certificate> > certs; |  | 
| 58   ParseCertificateChain(signature_info.certificate_chain(0), &certs); |  | 
| 59   ASSERT_EQ(2, certs.size()); |  | 
| 60   EXPECT_EQ("Joe's-Software-Emporium", certs[0]->subject().common_name); |  | 
| 61   EXPECT_EQ("Root Agency", certs[1]->subject().common_name); |  | 
| 62 |  | 
| 63   EXPECT_TRUE(signature_info.has_trusted()); |  | 
| 64   EXPECT_FALSE(signature_info.trusted()); |  | 
| 65 } |  | 
| 66 |  | 
| 67 TEST_F(BinaryFeatureExtractorWinTest, TrustedBinary) { |  | 
| 68   // wow_helper.exe is signed using Google's signing certifiacte. |  | 
| 69   ClientDownloadRequest_SignatureInfo signature_info; |  | 
| 70   binary_feature_extractor_->CheckSignature( |  | 
| 71       testdata_path_.Append(L"wow_helper.exe"), |  | 
| 72       &signature_info); |  | 
| 73   ASSERT_EQ(1, signature_info.certificate_chain_size()); |  | 
| 74   std::vector<scoped_refptr<net::X509Certificate> > certs; |  | 
| 75   ParseCertificateChain(signature_info.certificate_chain(0), &certs); |  | 
| 76   ASSERT_EQ(3, certs.size()); |  | 
| 77 |  | 
| 78   EXPECT_EQ("Google Inc", certs[0]->subject().common_name); |  | 
| 79   EXPECT_EQ("VeriSign Class 3 Code Signing 2009-2 CA", |  | 
| 80             certs[1]->subject().common_name); |  | 
| 81   EXPECT_EQ("Class 3 Public Primary Certification Authority", |  | 
| 82             certs[2]->subject().organization_unit_names[0]); |  | 
| 83 |  | 
| 84   EXPECT_TRUE(signature_info.trusted()); |  | 
| 85 } |  | 
| 86 |  | 
| 87 TEST_F(BinaryFeatureExtractorWinTest, UnsignedBinary) { |  | 
| 88   // unsigned.exe has no signature information. |  | 
| 89   ClientDownloadRequest_SignatureInfo signature_info; |  | 
| 90   binary_feature_extractor_->CheckSignature( |  | 
| 91       testdata_path_.Append(L"unsigned.exe"), |  | 
| 92       &signature_info); |  | 
| 93   EXPECT_EQ(0, signature_info.certificate_chain_size()); |  | 
| 94   EXPECT_FALSE(signature_info.has_trusted()); |  | 
| 95 } |  | 
| 96 |  | 
| 97 TEST_F(BinaryFeatureExtractorWinTest, NonExistentBinary) { |  | 
| 98   // Test a file that doesn't exist. |  | 
| 99   ClientDownloadRequest_SignatureInfo signature_info; |  | 
| 100   binary_feature_extractor_->CheckSignature( |  | 
| 101       testdata_path_.Append(L"doesnotexist.exe"), |  | 
| 102       &signature_info); |  | 
| 103   EXPECT_EQ(0, signature_info.certificate_chain_size()); |  | 
| 104   EXPECT_FALSE(signature_info.has_trusted()); |  | 
| 105 } |  | 
| 106 |  | 
| 107 TEST_F(BinaryFeatureExtractorWinTest, ExtractImageHeadersNoFile) { |  | 
| 108   // Test extracting headers from a file that doesn't exist. |  | 
| 109   ClientDownloadRequest_ImageHeaders image_headers; |  | 
| 110   ASSERT_FALSE(binary_feature_extractor_->ExtractImageHeaders( |  | 
| 111       testdata_path_.AppendASCII("this_file_does_not_exist"), |  | 
| 112       BinaryFeatureExtractor::kDefaultOptions, |  | 
| 113       &image_headers)); |  | 
| 114   EXPECT_FALSE(image_headers.has_pe_headers()); |  | 
| 115 } |  | 
| 116 |  | 
| 117 TEST_F(BinaryFeatureExtractorWinTest, ExtractImageHeadersNonImage) { |  | 
| 118   // Test extracting headers from something that is not a PE image. |  | 
| 119   ClientDownloadRequest_ImageHeaders image_headers; |  | 
| 120   ASSERT_FALSE(binary_feature_extractor_->ExtractImageHeaders( |  | 
| 121       testdata_path_.AppendASCII("simple_exe.cc"), |  | 
| 122       BinaryFeatureExtractor::kDefaultOptions, |  | 
| 123       &image_headers)); |  | 
| 124   EXPECT_FALSE(image_headers.has_pe_headers()); |  | 
| 125 } |  | 
| 126 |  | 
| 127 TEST_F(BinaryFeatureExtractorWinTest, ExtractImageHeaders) { |  | 
| 128   // Test extracting headers from something that is a PE image. |  | 
| 129   ClientDownloadRequest_ImageHeaders image_headers; |  | 
| 130   ASSERT_TRUE(binary_feature_extractor_->ExtractImageHeaders( |  | 
| 131       testdata_path_.AppendASCII("unsigned.exe"), |  | 
| 132       BinaryFeatureExtractor::kDefaultOptions, |  | 
| 133       &image_headers)); |  | 
| 134   EXPECT_TRUE(image_headers.has_pe_headers()); |  | 
| 135   const ClientDownloadRequest_PEImageHeaders& pe_headers = |  | 
| 136       image_headers.pe_headers(); |  | 
| 137   EXPECT_TRUE(pe_headers.has_dos_header()); |  | 
| 138   EXPECT_TRUE(pe_headers.has_file_header()); |  | 
| 139   EXPECT_TRUE(pe_headers.has_optional_headers32()); |  | 
| 140   EXPECT_FALSE(pe_headers.has_optional_headers64()); |  | 
| 141   EXPECT_NE(0, pe_headers.section_header_size()); |  | 
| 142   EXPECT_FALSE(pe_headers.has_export_section_data()); |  | 
| 143   EXPECT_EQ(0, pe_headers.debug_data_size()); |  | 
| 144 } |  | 
| 145 |  | 
| 146 TEST_F(BinaryFeatureExtractorWinTest, ExtractImageHeadersWithDebugData) { |  | 
| 147   // Test extracting headers from something that is a PE image with debug data. |  | 
| 148   ClientDownloadRequest_ImageHeaders image_headers; |  | 
| 149   ASSERT_TRUE(binary_feature_extractor_->ExtractImageHeaders( |  | 
| 150       testdata_path_.DirName().AppendASCII("module_with_exports_x86.dll"), |  | 
| 151       BinaryFeatureExtractor::kDefaultOptions, |  | 
| 152       &image_headers)); |  | 
| 153   EXPECT_TRUE(image_headers.has_pe_headers()); |  | 
| 154   const ClientDownloadRequest_PEImageHeaders& pe_headers = |  | 
| 155       image_headers.pe_headers(); |  | 
| 156   EXPECT_TRUE(pe_headers.has_dos_header()); |  | 
| 157   EXPECT_TRUE(pe_headers.has_file_header()); |  | 
| 158   EXPECT_TRUE(pe_headers.has_optional_headers32()); |  | 
| 159   EXPECT_FALSE(pe_headers.has_optional_headers64()); |  | 
| 160   EXPECT_NE(0, pe_headers.section_header_size()); |  | 
| 161   EXPECT_TRUE(pe_headers.has_export_section_data()); |  | 
| 162   EXPECT_EQ(1U, pe_headers.debug_data_size()); |  | 
| 163 } |  | 
| 164 |  | 
| 165 TEST_F(BinaryFeatureExtractorWinTest, ExtractImageHeadersWithoutExports) { |  | 
| 166   // Test extracting headers from something that is a PE image with debug data. |  | 
| 167   ClientDownloadRequest_ImageHeaders image_headers; |  | 
| 168   ASSERT_TRUE(binary_feature_extractor_->ExtractImageHeaders( |  | 
| 169       testdata_path_.DirName().AppendASCII("module_with_exports_x86.dll"), |  | 
| 170       BinaryFeatureExtractor::kOmitExports, |  | 
| 171       &image_headers)); |  | 
| 172   EXPECT_TRUE(image_headers.has_pe_headers()); |  | 
| 173   const ClientDownloadRequest_PEImageHeaders& pe_headers = |  | 
| 174       image_headers.pe_headers(); |  | 
| 175   EXPECT_TRUE(pe_headers.has_dos_header()); |  | 
| 176   EXPECT_TRUE(pe_headers.has_file_header()); |  | 
| 177   EXPECT_TRUE(pe_headers.has_optional_headers32()); |  | 
| 178   EXPECT_FALSE(pe_headers.has_optional_headers64()); |  | 
| 179   EXPECT_NE(0, pe_headers.section_header_size()); |  | 
| 180   EXPECT_FALSE(pe_headers.has_export_section_data()); |  | 
| 181   EXPECT_EQ(1U, pe_headers.debug_data_size()); |  | 
| 182 } |  | 
| 183 |  | 
| 184 }  // namespace safe_browsing |  | 
| OLD | NEW | 
|---|