Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(412)

Side by Side Diff: net/cert/internal/verify_name_match_unittest.cc

Issue 1125333005: RFC 2459 name comparison. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: changes for comment #31 Created 5 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2015 The Chromium Authors. All rights reserved. 1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/cert/internal/verify_name_match.h" 5 #include "net/cert/internal/verify_name_match.h"
6 6
7 #include "base/base_paths.h"
8 #include "base/files/file_path.h"
9 #include "base/files/file_util.h"
10 #include "base/path_service.h"
11 #include "base/strings/string_number_conversions.h"
12 #include "base/strings/string_util.h"
13 #include "net/cert/pem_tokenizer.h"
7 #include "net/der/input.h" 14 #include "net/der/input.h"
8 #include "testing/gtest/include/gtest/gtest.h" 15 #include "testing/gtest/include/gtest/gtest.h"
9 16
10 namespace net { 17 namespace net {
11 18 namespace {
12 TEST(VerifyNameMatchTest, Simple) { 19
13 // TODO(mattm): Use valid Names. 20 der::Input InputFromString(const std::string& s) {
14 const uint8_t hello[] = {'h', 'e', 'l', 'l', 'o'}; 21 return der::Input(reinterpret_cast<const uint8_t*>(s.data()), s.size());
15 const uint8_t aello[] = {'a', 'e', 'l', 'l', 'o'}; 22 }
16 const uint8_t hello1[] = {'h', 'e', 'l', 'l', 'o', '1'}; 23
17 EXPECT_TRUE(VerifyNameMatch(der::Input(hello), der::Input(hello))); 24 // Loads test data from file. The filename is constructed from the parameters:
18 EXPECT_FALSE(VerifyNameMatch(der::Input(aello), der::Input(hello))); 25 // |prefix| describes the type of data being tested, e.g. "ascii",
19 EXPECT_FALSE(VerifyNameMatch(der::Input(hello), der::Input(hello1))); 26 // "unicode_bmp", "unicode_supplementary", and "invalid".
20 EXPECT_FALSE(VerifyNameMatch(der::Input(hello1), der::Input(hello))); 27 // |value_type| indicates what ASN.1 type is used to encode the data.
28 // |suffix| indicates any additional modifications, such as caseswapping,
29 // whitespace adding, etc.
30 ::testing::AssertionResult LoadTestData(const std::string& prefix,
31 const std::string& value_type,
32 const std::string& suffix,
33 std::string* result) {
34 base::FilePath src_root;
35 PathService::Get(base::DIR_SOURCE_ROOT, &src_root);
36 std::string filename = prefix + "-" + value_type + "-" + suffix + ".pem";
37 base::FilePath filepath =
38 src_root.Append(FILE_PATH_LITERAL(
39 "net/data/verify_name_match_unittest/names"))
40 .AppendASCII(filename);
41 std::string file_data;
42 if (!base::ReadFileToString(filepath, &file_data)) {
43 return ::testing::AssertionFailure()
44 << "ReadFileToString returned false on " << filename;
45 }
46
47 std::vector<std::string> pem_headers;
48 pem_headers.push_back("NAME");
49 PEMTokenizer pem_tokenizer(file_data, pem_headers);
50 if (!pem_tokenizer.GetNext()) {
51 return ::testing::AssertionFailure() << "PEM.GetNext returned false on "
52 << filename;
53 }
54
55 result->assign(pem_tokenizer.data());
56 return ::testing::AssertionSuccess();
57 }
58
59 // All string types.
60 static const char* kValueTypes[] = {"PRINTABLESTRING", "T61STRING", "UTF8",
61 "BMPSTRING", "UNIVERSALSTRING"};
62 // String types that can encode the Unicode Basic Multilingual Plane.
63 static const char* kUnicodeBMPValueTypes[] = {"UTF8", "BMPSTRING",
64 "UNIVERSALSTRING"};
65 // String types that can encode the Unicode Supplementary Planes.
66 static const char* kUnicodeSupplementaryValueTypes[] = {"UTF8",
67 "UNIVERSALSTRING"};
68
69 static const char* kMangleTypes[] = {"unmangled", "case_swap",
70 "extra_whitespace"};
71
72 } // namespace
73
74 class VerifyNameMatchSimpleTest
75 : public ::testing::TestWithParam<
76 ::testing::tuple<const char*, const char*>> {
77 public:
78 std::string value_type() const { return ::testing::get<0>(GetParam()); }
79 std::string suffix() const { return ::testing::get<1>(GetParam()); }
80 };
81
82 // Compare each input against itself, verifies that all input data is parsed
83 // successfully.
84 TEST_P(VerifyNameMatchSimpleTest, ExactEquality) {
85 std::string der;
86 ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix(), &der));
87 EXPECT_TRUE(VerifyNameMatch(InputFromString(der), InputFromString(der)));
88
89 std::string der_extra_attr;
90 ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_attr",
91 &der_extra_attr));
92 EXPECT_TRUE(VerifyNameMatch(InputFromString(der_extra_attr),
93 InputFromString(der_extra_attr)));
94
95 std::string der_extra_rdn;
96 ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_rdn",
97 &der_extra_rdn));
98 EXPECT_TRUE(VerifyNameMatch(InputFromString(der_extra_rdn),
99 InputFromString(der_extra_rdn)));
100 }
101
102 // Ensure that a Name does not match another Name which is exactly the same but
103 // with an extra attribute in one Relative Distinguished Name.
104 TEST_P(VerifyNameMatchSimpleTest, ExtraAttrDoesNotMatch) {
105 std::string der;
106 ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix(), &der));
107 std::string der_extra_attr;
108 ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_attr",
109 &der_extra_attr));
110 EXPECT_FALSE(
111 VerifyNameMatch(InputFromString(der), InputFromString(der_extra_attr)));
112 EXPECT_FALSE(
113 VerifyNameMatch(InputFromString(der_extra_attr), InputFromString(der)));
114 }
115
116 // Ensure that a Name does not match another Name which is exactly the same but
117 // with an extra Relative Distinguished Name.
118 TEST_P(VerifyNameMatchSimpleTest, ExtraRdnDoesNotMatch) {
119 std::string der;
120 ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix(), &der));
121 std::string der_extra_rdn;
122 ASSERT_TRUE(LoadTestData("ascii", value_type(), suffix() + "-extra_rdn",
123 &der_extra_rdn));
124 EXPECT_FALSE(
125 VerifyNameMatch(InputFromString(der), InputFromString(der_extra_rdn)));
126 EXPECT_FALSE(
127 VerifyNameMatch(InputFromString(der_extra_rdn), InputFromString(der)));
128 }
129
130 // Runs VerifyNameMatchSimpleTest for all combinations of value_type and and
131 // suffix.
132 INSTANTIATE_TEST_CASE_P(InstantiationName,
133 VerifyNameMatchSimpleTest,
134 ::testing::Combine(::testing::ValuesIn(kValueTypes),
135 ::testing::ValuesIn(kMangleTypes)));
136
137 class VerifyNameMatchNormalizationTest
138 : public ::testing::TestWithParam<::testing::tuple<bool, const char*>> {
139 public:
140 bool expected_result() const { return ::testing::get<0>(GetParam()); }
141 std::string value_type() const { return ::testing::get<1>(GetParam()); }
142 };
143
144 // Verify matching is case insensitive (for the types which currently support
145 // normalization).
146 TEST_P(VerifyNameMatchNormalizationTest, CaseInsensitivity) {
147 std::string normal;
148 ASSERT_TRUE(LoadTestData("ascii", value_type(), "unmangled", &normal));
149 std::string case_swap;
150 ASSERT_TRUE(LoadTestData("ascii", value_type(), "case_swap", &case_swap));
151 EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(normal),
152 InputFromString(case_swap)));
153 EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(case_swap),
154 InputFromString(normal)));
155 }
156
157 // Verify matching folds whitespace (for the types which currently support
158 // normalization).
159 TEST_P(VerifyNameMatchNormalizationTest, CollapseWhitespace) {
160 std::string normal;
161 ASSERT_TRUE(LoadTestData("ascii", value_type(), "unmangled", &normal));
162 std::string whitespace;
163 ASSERT_TRUE(
164 LoadTestData("ascii", value_type(), "extra_whitespace", &whitespace));
165 EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(normal),
166 InputFromString(whitespace)));
167 EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(whitespace),
168 InputFromString(normal)));
169 }
170
171 // Runs VerifyNameMatchNormalizationTest for each (expected_result, value_type)
172 // tuple.
173 INSTANTIATE_TEST_CASE_P(
174 InstantiationName,
175 VerifyNameMatchNormalizationTest,
176 ::testing::Values(
177 ::testing::make_tuple(true,
178 static_cast<const char*>("PRINTABLESTRING")),
179 ::testing::make_tuple(false, static_cast<const char*>("T61STRING")),
180 ::testing::make_tuple(true, static_cast<const char*>("UTF8")),
181 ::testing::make_tuple(true, static_cast<const char*>("BMPSTRING")),
182 ::testing::make_tuple(true,
183 static_cast<const char*>("UNIVERSALSTRING"))));
184
185 class VerifyNameMatchDifferingTypesTest
186 : public ::testing::TestWithParam<
187 ::testing::tuple<const char*, const char*>> {
188 public:
189 std::string value_type_1() const { return ::testing::get<0>(GetParam()); }
190 std::string value_type_2() const { return ::testing::get<1>(GetParam()); }
191 };
192
193 TEST_P(VerifyNameMatchDifferingTypesTest, NormalizableTypesAreEqual) {
194 std::string der_1;
195 ASSERT_TRUE(LoadTestData("ascii", value_type_1(), "unmangled", &der_1));
196 std::string der_2;
197 ASSERT_TRUE(LoadTestData("ascii", value_type_2(), "unmangled", &der_2));
198 if (value_type_1() == value_type_2()) {
199 EXPECT_TRUE(
200 VerifyNameMatch(InputFromString(der_1), InputFromString(der_2)));
201 } else if ((value_type_1() == "PRINTABLESTRING" || value_type_1() == "UTF8" ||
202 value_type_1() == "BMPSTRING" ||
203 value_type_1() == "UNIVERSALSTRING") &&
204 (value_type_2() == "PRINTABLESTRING" || value_type_2() == "UTF8" ||
205 value_type_2() == "BMPSTRING" ||
206 value_type_2() == "UNIVERSALSTRING")) {
207 EXPECT_TRUE(
208 VerifyNameMatch(InputFromString(der_1), InputFromString(der_2)));
209 } else {
210 EXPECT_FALSE(
211 VerifyNameMatch(InputFromString(der_1), InputFromString(der_2)));
212 }
213 }
214
215 // Runs VerifyNameMatchDifferingTypesTest for all combinations of value types in
216 // value_type1 and value_type_2.
217 INSTANTIATE_TEST_CASE_P(InstantiationName,
218 VerifyNameMatchDifferingTypesTest,
219 ::testing::Combine(::testing::ValuesIn(kValueTypes),
220 ::testing::ValuesIn(kValueTypes)));
221
222 class VerifyNameMatchUnicodeConversionTest
223 : public ::testing::TestWithParam<
224 ::testing::tuple<const char*,
225 ::testing::tuple<const char*, const char*>>> {
226 public:
227 std::string prefix() const { return ::testing::get<0>(GetParam()); }
228 std::string value_type_1() const {
229 return ::testing::get<0>(::testing::get<1>(GetParam()));
230 }
231 std::string value_type_2() const {
232 return ::testing::get<1>(::testing::get<1>(GetParam()));
233 }
234 };
235
236 TEST_P(VerifyNameMatchUnicodeConversionTest, UnicodeConversionsAreEqual) {
237 std::string der_1;
238 ASSERT_TRUE(LoadTestData(prefix(), value_type_1(), "unmangled", &der_1));
239 std::string der_2;
240 ASSERT_TRUE(LoadTestData(prefix(), value_type_2(), "unmangled", &der_2));
241 EXPECT_TRUE(VerifyNameMatch(InputFromString(der_1), InputFromString(der_2)));
242 }
243
244 // Runs VerifyNameMatchUnicodeConversionTest with prefix="unicode_bmp" for all
245 // combinations of Basic Multilingual Plane-capable value types in value_type1
246 // and value_type_2.
247 INSTANTIATE_TEST_CASE_P(
248 BMPConversion,
249 VerifyNameMatchUnicodeConversionTest,
250 ::testing::Combine(
251 ::testing::Values("unicode_bmp"),
252 ::testing::Combine(::testing::ValuesIn(kUnicodeBMPValueTypes),
253 ::testing::ValuesIn(kUnicodeBMPValueTypes))));
254
255 // Runs VerifyNameMatchUnicodeConversionTest with prefix="unicode_supplementary"
256 // for all combinations of Unicode Supplementary Plane-capable value types in
257 // value_type1 and value_type_2.
258 INSTANTIATE_TEST_CASE_P(
259 SMPConversion,
260 VerifyNameMatchUnicodeConversionTest,
261 ::testing::Combine(
262 ::testing::Values("unicode_supplementary"),
263 ::testing::Combine(
264 ::testing::ValuesIn(kUnicodeSupplementaryValueTypes),
265 ::testing::ValuesIn(kUnicodeSupplementaryValueTypes))));
266
267 // Matching should fail if a PrintableString contains invalid characters.
268 TEST(VerifyNameMatchInvalidDataTest, FailOnInvalidPrintableStringChars) {
269 std::string der;
270 ASSERT_TRUE(LoadTestData("ascii", "PRINTABLESTRING", "unmangled", &der));
271 // Find a known location inside a PrintableString in the DER-encoded data.
272 size_t replace_location = der.find("0123456789");
273 ASSERT_NE(std::string::npos, replace_location);
274 for (int c = 0; c < 256; ++c) {
275 SCOPED_TRACE(base::IntToString(c));
276 if (base::IsAsciiAlpha(c) || base::IsAsciiDigit(c))
277 continue;
278 switch (c) {
279 case ' ':
280 case '\'':
281 case '(':
282 case ')':
283 case '*':
284 case '+':
285 case ',':
286 case '-':
287 case '.':
288 case '/':
289 case ':':
290 case '=':
291 case '?':
292 continue;
293 }
294 der.replace(replace_location, 1, 1, c);
295 // Verification should fail due to the invalid character.
296 EXPECT_FALSE(VerifyNameMatch(InputFromString(der), InputFromString(der)));
297 }
298 }
299
300 // Matching should fail if an IA5String contains invalid characters.
301 TEST(VerifyNameMatchInvalidDataTest, FailOnInvalidIA5StringChars) {
302 std::string der;
303 ASSERT_TRUE(LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_1", &der));
304 // Find a known location inside an IA5String in the DER-encoded data.
305 size_t replace_location = der.find("eXaMple");
306 ASSERT_NE(std::string::npos, replace_location);
307 for (int c = 0; c < 256; ++c) {
308 SCOPED_TRACE(base::IntToString(c));
309 der.replace(replace_location, 1, 1, c);
310 bool expected_result = (c <= 127);
311 EXPECT_EQ(expected_result,
312 VerifyNameMatch(InputFromString(der), InputFromString(der)));
313 }
314 }
315
316 TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueExtraData) {
317 std::string invalid;
318 ASSERT_TRUE(
319 LoadTestData("invalid", "AttributeTypeAndValue", "extradata", &invalid));
320 // Verification should fail due to extra element in AttributeTypeAndValue
321 // sequence.
322 EXPECT_FALSE(
323 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
324 }
325
326 TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueShort) {
327 std::string invalid;
328 ASSERT_TRUE(LoadTestData("invalid", "AttributeTypeAndValue", "onlyOneElement",
329 &invalid));
330 // Verification should fail due to AttributeTypeAndValue sequence having only
331 // one element.
332 EXPECT_FALSE(
333 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
334 }
335
336 TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueEmpty) {
337 std::string invalid;
338 ASSERT_TRUE(
339 LoadTestData("invalid", "AttributeTypeAndValue", "empty", &invalid));
340 // Verification should fail due to empty AttributeTypeAndValue sequence.
341 EXPECT_FALSE(
342 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
343 }
344
345 TEST(VerifyNameMatchInvalidDataTest, FailOnBadAttributeType) {
346 std::string invalid;
347 ASSERT_TRUE(LoadTestData("invalid", "AttributeTypeAndValue",
348 "badAttributeType", &invalid));
349 // Verification should fail due to Attribute Type not being an OID.
350 EXPECT_FALSE(
351 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
352 }
353
354 TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueNotSequence) {
355 std::string invalid;
356 ASSERT_TRUE(LoadTestData("invalid", "AttributeTypeAndValue", "setNotSequence",
357 &invalid));
358 // Verification should fail due to AttributeTypeAndValue being a Set instead
359 // of a Sequence.
360 EXPECT_FALSE(
361 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
362 }
363
364 TEST(VerifyNameMatchInvalidDataTest, FailOnRdnNotSet) {
365 std::string invalid;
366 ASSERT_TRUE(LoadTestData("invalid", "RDN", "sequenceInsteadOfSet", &invalid));
367 // Verification should fail due to RDN being a Sequence instead of a Set.
368 EXPECT_FALSE(
369 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
370 }
371
372 TEST(VerifyNameMatchInvalidDataTest, FailOnEmptyRdn) {
373 std::string invalid;
374 ASSERT_TRUE(LoadTestData("invalid", "RDN", "empty", &invalid));
375 // Verification should fail due to RDN having zero AttributeTypeAndValues.
376 EXPECT_FALSE(
377 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
378 }
379
380 TEST(VerifyNameMatchInvalidDataTest, FailOnNameNotSequence) {
381 std::string invalid;
382 ASSERT_TRUE(
383 LoadTestData("invalid", "Name", "setInsteadOfSequence", &invalid));
384 // Verification should fail due to Name being a Set instead of a Sequence.
385 EXPECT_FALSE(
386 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
387 }
388
389 TEST(VerifyNameMatchInvalidDataTest, FailOnTrailingData) {
390 std::string invalid;
391 ASSERT_TRUE(LoadTestData("ascii", "PRINTABLESTRING", "unmangled", &invalid));
392 invalid += "X";
393 // Verification should fail due to the appended character.
394 EXPECT_FALSE(
395 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
396 }
397
398 // Matching should fail if a BMPString contains surrogates.
399 TEST(VerifyNameMatchInvalidDataTest, FailOnBmpStringSurrogates) {
400 std::string normal;
401 ASSERT_TRUE(LoadTestData("unicode_bmp", "BMPSTRING", "unmangled", &normal));
402 // Find a known location inside a BMPSTRING in the DER-encoded data.
403 size_t replace_location = normal.find("\x67\x71\x4e\xac");
404 ASSERT_NE(std::string::npos, replace_location);
405 // Replace with U+1D400 MATHEMATICAL BOLD CAPITAL A, which requires surrogates
406 // to represent.
407 std::string invalid = normal.replace(replace_location, 4, "\xd8\x35\xdc\x00");
408 // Verification should fail due to the invalid codepoints.
409 EXPECT_FALSE(
410 VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
411 }
412
413 TEST(VerifyNameMatchTest, EmptyNameMatching) {
414 std::string empty;
415 ASSERT_TRUE(LoadTestData("valid", "Name", "empty", &empty));
416 // Empty names are equal.
417 EXPECT_TRUE(VerifyNameMatch(InputFromString(empty), InputFromString(empty)));
418
419 // An empty name is not equal to non-empty name.
420 std::string non_empty;
421 ASSERT_TRUE(
422 LoadTestData("ascii", "PRINTABLESTRING", "unmangled", &non_empty));
423 EXPECT_FALSE(
424 VerifyNameMatch(InputFromString(empty), InputFromString(non_empty)));
425 EXPECT_FALSE(
426 VerifyNameMatch(InputFromString(non_empty), InputFromString(empty)));
427 }
428
429 // Matching should succeed when the RDNs are sorted differently but are still
430 // equal after normalizing.
431 TEST(VerifyNameMatchRDNSorting, Simple) {
432 std::string a;
433 ASSERT_TRUE(LoadTestData("ascii", "PRINTABLESTRING", "rdn_sorting_1", &a));
434 std::string b;
435 ASSERT_TRUE(LoadTestData("ascii", "PRINTABLESTRING", "rdn_sorting_2", &b));
436 EXPECT_TRUE(VerifyNameMatch(InputFromString(a), InputFromString(b)));
437 EXPECT_TRUE(VerifyNameMatch(InputFromString(b), InputFromString(a)));
438 }
439
440 // Matching should succeed when the RDNs are sorted differently but are still
441 // equal after normalizing, even in malformed RDNs that contain multiple
442 // elements with the same type.
443 TEST(VerifyNameMatchRDNSorting, DuplicateTypes) {
444 std::string a;
445 ASSERT_TRUE(LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_1", &a));
446 std::string b;
447 ASSERT_TRUE(LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_2", &b));
448 EXPECT_TRUE(VerifyNameMatch(InputFromString(a), InputFromString(b)));
449 EXPECT_TRUE(VerifyNameMatch(InputFromString(b), InputFromString(a)));
21 } 450 }
22 451
23 } // namespace net 452 } // namespace net
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698