Index: net/cert/internal/verify_name_match_unittest.cc |
diff --git a/net/cert/internal/verify_name_match_unittest.cc b/net/cert/internal/verify_name_match_unittest.cc |
index b7e16ad0ade4b5102543a36992a3865836c6fc39..576a0bc6afb7a118b7006ec113f52ee3fa53e0f9 100644 |
--- a/net/cert/internal/verify_name_match_unittest.cc |
+++ b/net/cert/internal/verify_name_match_unittest.cc |
@@ -4,20 +4,381 @@ |
#include "net/cert/internal/verify_name_match.h" |
+#include "base/base_paths.h" |
+#include "base/files/file_path.h" |
+#include "base/files/file_util.h" |
+#include "base/path_service.h" |
+#include "base/strings/string_number_conversions.h" |
+#include "base/strings/string_util.h" |
#include "net/der/input.h" |
#include "testing/gtest/include/gtest/gtest.h" |
namespace net { |
+namespace { |
-TEST(VerifyNameMatchTest, Simple) { |
- // TODO(mattm): Use valid Names. |
- const uint8_t hello[] = {'h', 'e', 'l', 'l', 'o'}; |
- const uint8_t aello[] = {'a', 'e', 'l', 'l', 'o'}; |
- const uint8_t hello1[] = {'h', 'e', 'l', 'l', 'o', '1'}; |
- EXPECT_TRUE(VerifyNameMatch(der::Input(hello), der::Input(hello))); |
- EXPECT_FALSE(VerifyNameMatch(der::Input(aello), der::Input(hello))); |
- EXPECT_FALSE(VerifyNameMatch(der::Input(hello), der::Input(hello1))); |
- EXPECT_FALSE(VerifyNameMatch(der::Input(hello1), der::Input(hello))); |
+der::Input InputFromString(const std::string& s) { |
+ return der::Input(reinterpret_cast<const uint8_t*>(s.data()), s.size()); |
eroman
2015/07/03 22:31:20
My suggestion is to make this this a ctor of der::
eroman
2015/07/07 17:29:21
Actually seems there was already some history behi
|
+} |
+ |
+std::string LoadTestData(const std::string& prefix, |
eroman
2015/07/03 22:31:20
Can you add comments on what prefix/valuetype and
mattm
2015/07/16 04:42:32
Done.
|
+ const std::string& value_type, |
+ const std::string& suffix) { |
+ base::FilePath src_root; |
+ PathService::Get(base::DIR_SOURCE_ROOT, &src_root); |
+ std::string filename = prefix + "-" + value_type + "-" + suffix + ".der"; |
+ base::FilePath filepath = |
+ src_root.Append(FILE_PATH_LITERAL( |
+ "net/data/verify_name_match_unittest/names")) |
+ .AppendASCII(filename); |
+ std::string result; |
+ bool success = base::ReadFileToString(filepath, &result); |
+ EXPECT_TRUE(success); |
+ return result; |
+} |
+ |
+// All string types. |
+static const char* kValueTypes[] = {"PRINTABLESTRING", |
+ "T61STRING", |
+ "UTF8", |
+ "BMPSTRING", |
+ "UNIVERSALSTRING"}; |
+// String types that can encode the Unicode Basic Multilingual Plane. |
+static const char* kUnicodeBMPValueTypes[] = {"UTF8", |
+ "BMPSTRING", |
+ "UNIVERSALSTRING"}; |
+// String types that can encode the Unicode Supplementary Planes. |
+static const char* kUnicodeSupplementaryValueTypes[] = {"UTF8", |
+ "UNIVERSALSTRING"}; |
+ |
+static const char* kMangleTypes[] = {"unmangled", |
+ "case_swap", |
+ "extra_whitespace"}; |
+ |
+} // namespace |
+ |
+class VerifyNameMatchSimpleTest |
+ : public ::testing::TestWithParam< |
+ ::testing::tuple<const char*, const char*>> { |
+ public: |
+ std::string value_type() const { return ::testing::get<0>(GetParam()); } |
+ std::string suffix() const { return ::testing::get<1>(GetParam()); } |
+}; |
+ |
+// Compare each input against itself, verifies that all input data is parsed |
+// successfully. |
+TEST_P(VerifyNameMatchSimpleTest, ExactEquality) { |
+ std::string der = LoadTestData("ascii", value_type(), suffix()); |
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(der), InputFromString(der))); |
+ |
+ std::string der_extra_attr = |
+ LoadTestData("ascii", value_type(), suffix() + "-extra_attr"); |
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(der_extra_attr), |
+ InputFromString(der_extra_attr))); |
+ |
+ std::string der_extra_rdn = |
+ LoadTestData("ascii", value_type(), suffix() + "-extra_rdn"); |
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(der_extra_rdn), |
+ InputFromString(der_extra_rdn))); |
+} |
+ |
+// Ensure that a Name does not match another Name which is exactly the same but |
+// with an extra attribute in one Relative Distinguished Name. |
+TEST_P(VerifyNameMatchSimpleTest, ExtraAttrDoesNotMatch) { |
+ std::string der = LoadTestData("ascii", value_type(), suffix()); |
+ std::string der_extra_attr = |
+ LoadTestData("ascii", value_type(), suffix() + "-extra_attr"); |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(der), InputFromString(der_extra_attr))); |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(der_extra_attr), InputFromString(der))); |
+} |
+ |
+// Ensure that a Name does not match another Name which is exactly the same but |
+// with an extra Relative Distinguished Name. |
+TEST_P(VerifyNameMatchSimpleTest, ExtraRdnDoesNotMatch) { |
+ std::string der = LoadTestData("ascii", value_type(), suffix()); |
+ std::string der_extra_rdn = |
+ LoadTestData("ascii", value_type(), suffix() + "-extra_rdn"); |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(der), InputFromString(der_extra_rdn))); |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(der_extra_rdn), InputFromString(der))); |
+} |
+ |
+INSTANTIATE_TEST_CASE_P(InstantiationName, |
+ VerifyNameMatchSimpleTest, |
+ ::testing::Combine(::testing::ValuesIn(kValueTypes), |
eroman
2015/07/03 22:31:20
I gave up on reading all the gtest magic. Can you
mattm
2015/07/16 04:42:32
Done.
|
+ ::testing::ValuesIn(kMangleTypes))); |
+ |
+class VerifyNameMatchNormalizationTest |
+ : public ::testing::TestWithParam<::testing::tuple<bool, const char*>> { |
+ public: |
+ bool expected_result() const { return ::testing::get<0>(GetParam()); } |
+ std::string value_type() const { return ::testing::get<1>(GetParam()); } |
+}; |
+ |
+// Verify matching is case insensitive (for the types which currently support |
+// normalization). |
+TEST_P(VerifyNameMatchNormalizationTest, CaseInsensitivity) { |
+ std::string normal = LoadTestData("ascii", value_type(), "unmangled"); |
+ std::string case_swap = LoadTestData("ascii", value_type(), "case_swap"); |
+ EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(normal), |
+ InputFromString(case_swap))); |
+ EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(case_swap), |
+ InputFromString(normal))); |
+} |
+ |
+// Verify matching folds whitespace (for the types which currently support |
+// normalization). |
+TEST_P(VerifyNameMatchNormalizationTest, CollapseWhitespace) { |
+ std::string normal = LoadTestData("ascii", value_type(), "unmangled"); |
+ std::string whitespace = |
+ LoadTestData("ascii", value_type(), "extra_whitespace"); |
+ EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(normal), |
+ InputFromString(whitespace))); |
+ EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(whitespace), |
+ InputFromString(normal))); |
+} |
+ |
+INSTANTIATE_TEST_CASE_P( |
+ InstantiationName, |
+ VerifyNameMatchNormalizationTest, |
+ ::testing::Values( |
+ ::testing::make_tuple(true, |
+ static_cast<const char*>("PRINTABLESTRING")), |
+ ::testing::make_tuple(false, static_cast<const char*>("T61STRING")), |
+ ::testing::make_tuple(true, static_cast<const char*>("UTF8")), |
+ ::testing::make_tuple(true, static_cast<const char*>("BMPSTRING")), |
+ ::testing::make_tuple(true, |
+ static_cast<const char*>("UNIVERSALSTRING")))); |
+ |
+class VerifyNameMatchDifferingTypesTest |
+ : public ::testing::TestWithParam< |
+ ::testing::tuple<const char*, const char*>> { |
+ public: |
+ std::string value_type_1() const { return ::testing::get<0>(GetParam()); } |
+ std::string value_type_2() const { return ::testing::get<1>(GetParam()); } |
+}; |
+ |
+TEST_P(VerifyNameMatchDifferingTypesTest, NormalizableTypesAreEqual) { |
+ std::string der_1 = LoadTestData("ascii", value_type_1(), "unmangled"); |
+ std::string der_2 = LoadTestData("ascii", value_type_2(), "unmangled"); |
+ if (value_type_1() == value_type_2()) { |
+ EXPECT_TRUE( |
+ VerifyNameMatch(InputFromString(der_1), InputFromString(der_2))); |
+ } else if ((value_type_1() == "PRINTABLESTRING" || value_type_1() == "UTF8" || |
+ value_type_1() == "BMPSTRING" || |
+ value_type_1() == "UNIVERSALSTRING") && |
+ (value_type_2() == "PRINTABLESTRING" || value_type_2() == "UTF8" || |
+ value_type_2() == "BMPSTRING" || |
+ value_type_2() == "UNIVERSALSTRING")) { |
+ EXPECT_TRUE( |
+ VerifyNameMatch(InputFromString(der_1), InputFromString(der_2))); |
+ } else { |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(der_1), InputFromString(der_2))); |
+ } |
+} |
+ |
+INSTANTIATE_TEST_CASE_P(InstantiationName, |
+ VerifyNameMatchDifferingTypesTest, |
+ ::testing::Combine(::testing::ValuesIn(kValueTypes), |
+ ::testing::ValuesIn(kValueTypes))); |
+ |
+class VerifyNameMatchUnicodeConversionTest |
+ : public ::testing::TestWithParam< |
+ ::testing::tuple<const char*, |
+ ::testing::tuple<const char*, const char*>>> { |
+ public: |
+ std::string prefix() const { return ::testing::get<0>(GetParam()); } |
+ std::string value_type_1() const { |
+ return ::testing::get<0>(::testing::get<1>(GetParam())); |
+ } |
+ std::string value_type_2() const { |
+ return ::testing::get<1>(::testing::get<1>(GetParam())); |
+ } |
+}; |
+ |
+TEST_P(VerifyNameMatchUnicodeConversionTest, UnicodeConversionsAreEqual) { |
+ std::string der_1 = LoadTestData(prefix(), value_type_1(), "unmangled"); |
+ std::string der_2 = LoadTestData(prefix(), value_type_2(), "unmangled"); |
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(der_1), InputFromString(der_2))); |
+} |
+ |
+INSTANTIATE_TEST_CASE_P( |
+ BMPConversion, |
+ VerifyNameMatchUnicodeConversionTest, |
+ ::testing::Combine( |
+ ::testing::Values("unicode_bmp"), |
+ ::testing::Combine(::testing::ValuesIn(kUnicodeBMPValueTypes), |
+ ::testing::ValuesIn(kUnicodeBMPValueTypes)))); |
+ |
+INSTANTIATE_TEST_CASE_P( |
+ SMPConversion, |
+ VerifyNameMatchUnicodeConversionTest, |
+ ::testing::Combine( |
+ ::testing::Values("unicode_supplementary"), |
+ ::testing::Combine( |
+ ::testing::ValuesIn(kUnicodeSupplementaryValueTypes), |
+ ::testing::ValuesIn(kUnicodeSupplementaryValueTypes)))); |
+ |
+// Matching should fail if a PrintableString contains invalid characters. |
+TEST(VerifyNameMatchInvalidDataTest, FailOnInvalidPrintableStringChars) { |
+ std::string der = LoadTestData("ascii", "PRINTABLESTRING", "unmangled"); |
+ // Find a known location inside a PrintableString in the DER-encoded data. |
+ size_t replace_location = der.find("0123456789"); |
+ ASSERT_NE(std::string::npos, replace_location); |
+ for (int c = 0; c < 256; ++c) { |
+ SCOPED_TRACE(base::IntToString(c)); |
+ if (IsAsciiAlpha(c) || IsAsciiDigit(c)) |
+ continue; |
+ switch (c) { |
+ case ' ': |
+ case '\'': |
+ case '(': |
+ case ')': |
+ case '*': |
+ case '+': |
+ case ',': |
+ case '-': |
+ case '.': |
+ case '/': |
+ case ':': |
+ case '=': |
+ case '?': |
+ continue; |
+ } |
+ der.replace(replace_location, 1, 1, c); |
+ // Verification should fail due to the invalid character. |
+ EXPECT_FALSE(VerifyNameMatch(InputFromString(der), InputFromString(der))); |
+ } |
+} |
+ |
+// Matching should fail if an IA5String contains invalid characters. |
+TEST(VerifyNameMatchInvalidDataTest, FailOnInvalidIA5StringChars) { |
+ std::string der = LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_1"); |
+ // Find a known location inside an IA5String in the DER-encoded data. |
+ size_t replace_location = der.find("eXaMple"); |
+ ASSERT_NE(std::string::npos, replace_location); |
+ for (int c = 0; c < 256; ++c) { |
+ SCOPED_TRACE(base::IntToString(c)); |
+ der.replace(replace_location, 1, 1, c); |
+ bool expected_result = (c <= 127); |
+ EXPECT_EQ(expected_result, |
+ VerifyNameMatch(InputFromString(der), InputFromString(der))); |
+ } |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueExtraData) { |
+ std::string invalid = |
+ LoadTestData("invalid", "AttributeTypeAndValue", "extradata"); |
+ // Verification should fail due to extra element in AttributeTypeAndValue |
+ // sequence. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueShort) { |
+ std::string invalid = |
+ LoadTestData("invalid", "AttributeTypeAndValue", "onlyOneElement"); |
+ // Verification should fail due to AttributeTypeAndValue sequence having only |
+ // one element. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueEmpty) { |
+ std::string invalid = |
+ LoadTestData("invalid", "AttributeTypeAndValue", "empty"); |
+ // Verification should fail due to empty AttributeTypeAndValue sequence. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnBadAttributeType) { |
+ std::string invalid = |
+ LoadTestData("invalid", "AttributeTypeAndValue", "badAttributeType"); |
+ // Verification should fail due to Attribute Type not being an OID. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueNotSequence) { |
+ std::string invalid = |
+ LoadTestData("invalid", "AttributeTypeAndValue", "setNotSequence"); |
+ // Verification should fail due to AttributeTypeAndValue being a Set instead |
+ // of a Sequence. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnRdnNotSet) { |
+ std::string invalid = LoadTestData("invalid", "RDN", "sequenceInsteadOfSet"); |
+ // Verification should fail due to RDN being a Sequence instead of a Set. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnEmptyRdn) { |
+ std::string invalid = LoadTestData("invalid", "RDN", "empty"); |
+ // Verification should fail due to RDN having zero AttributeTypeAndValues. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnNameNotSequence) { |
+ std::string invalid = LoadTestData("invalid", "Name", "setInsteadOfSequence"); |
+ // Verification should fail due to Name being a Set instead of a Sequence. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnEmptyName) { |
+ std::string invalid = LoadTestData("invalid", "Name", "empty"); |
+ // Verification should fail due to Name having zero RDNs. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+TEST(VerifyNameMatchInvalidDataTest, FailOnTrailingData) { |
+ std::string invalid = |
+ LoadTestData("ascii", "PRINTABLESTRING", "unmangled") + "X"; |
+ // Verification should fail due to the appended character. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+// Matching should fail if a BMPString contains surrogates. |
+TEST(VerifyNameMatchInvalidDataTest, FailOnBmpStringSurrogates) { |
+ std::string normal = LoadTestData("unicode_bmp", "BMPSTRING", "unmangled"); |
+ // Find a known location inside a BMPSTRING in the DER-encoded data. |
+ size_t replace_location = normal.find("\x67\x71\x4e\xac"); |
+ ASSERT_NE(std::string::npos, replace_location); |
+ // Replace with U+1D400 MATHEMATICAL BOLD CAPITAL A, which requires surrogates |
+ // to represent. |
+ std::string invalid = normal.replace(replace_location, 4, "\xd8\x35\xdc\x00"); |
+ // Verification should fail due to the invalid codepoints. |
+ EXPECT_FALSE( |
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid))); |
+} |
+ |
+// Matching should succeed when the RDNs are sorted differently but are still |
+// equal after normalizing. |
+TEST(VerifyNameMatchRDNSorting, Simple) { |
+ std::string a = LoadTestData("ascii", "PRINTABLESTRING", "rdn_sorting_1"); |
+ std::string b = LoadTestData("ascii", "PRINTABLESTRING", "rdn_sorting_2"); |
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(a), InputFromString(b))); |
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(b), InputFromString(a))); |
+} |
+ |
+// Matching should succeed when the RDNs are sorted differently but are still |
+// equal after normalizing, even in malformed RDNs that contain multiple |
+// elements with the same type. |
+TEST(VerifyNameMatchRDNSorting, DuplicateTypes) { |
+ std::string a = LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_1"); |
+ std::string b = LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_2"); |
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(a), InputFromString(b))); |
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(b), InputFromString(a))); |
} |
} // namespace net |