Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(403)

Unified Diff: net/cert/internal/verify_name_match_unittest.cc

Issue 1125333005: RFC 2459 name comparison. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: changes for comment #23 Created 5 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: net/cert/internal/verify_name_match_unittest.cc
diff --git a/net/cert/internal/verify_name_match_unittest.cc b/net/cert/internal/verify_name_match_unittest.cc
index b7e16ad0ade4b5102543a36992a3865836c6fc39..576a0bc6afb7a118b7006ec113f52ee3fa53e0f9 100644
--- a/net/cert/internal/verify_name_match_unittest.cc
+++ b/net/cert/internal/verify_name_match_unittest.cc
@@ -4,20 +4,381 @@
#include "net/cert/internal/verify_name_match.h"
+#include "base/base_paths.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/path_service.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_util.h"
#include "net/der/input.h"
#include "testing/gtest/include/gtest/gtest.h"
namespace net {
+namespace {
-TEST(VerifyNameMatchTest, Simple) {
- // TODO(mattm): Use valid Names.
- const uint8_t hello[] = {'h', 'e', 'l', 'l', 'o'};
- const uint8_t aello[] = {'a', 'e', 'l', 'l', 'o'};
- const uint8_t hello1[] = {'h', 'e', 'l', 'l', 'o', '1'};
- EXPECT_TRUE(VerifyNameMatch(der::Input(hello), der::Input(hello)));
- EXPECT_FALSE(VerifyNameMatch(der::Input(aello), der::Input(hello)));
- EXPECT_FALSE(VerifyNameMatch(der::Input(hello), der::Input(hello1)));
- EXPECT_FALSE(VerifyNameMatch(der::Input(hello1), der::Input(hello)));
+der::Input InputFromString(const std::string& s) {
+ return der::Input(reinterpret_cast<const uint8_t*>(s.data()), s.size());
eroman 2015/07/03 22:31:20 My suggestion is to make this this a ctor of der::
eroman 2015/07/07 17:29:21 Actually seems there was already some history behi
+}
+
+std::string LoadTestData(const std::string& prefix,
eroman 2015/07/03 22:31:20 Can you add comments on what prefix/valuetype and
mattm 2015/07/16 04:42:32 Done.
+ const std::string& value_type,
+ const std::string& suffix) {
+ base::FilePath src_root;
+ PathService::Get(base::DIR_SOURCE_ROOT, &src_root);
+ std::string filename = prefix + "-" + value_type + "-" + suffix + ".der";
+ base::FilePath filepath =
+ src_root.Append(FILE_PATH_LITERAL(
+ "net/data/verify_name_match_unittest/names"))
+ .AppendASCII(filename);
+ std::string result;
+ bool success = base::ReadFileToString(filepath, &result);
+ EXPECT_TRUE(success);
+ return result;
+}
+
+// All string types.
+static const char* kValueTypes[] = {"PRINTABLESTRING",
+ "T61STRING",
+ "UTF8",
+ "BMPSTRING",
+ "UNIVERSALSTRING"};
+// String types that can encode the Unicode Basic Multilingual Plane.
+static const char* kUnicodeBMPValueTypes[] = {"UTF8",
+ "BMPSTRING",
+ "UNIVERSALSTRING"};
+// String types that can encode the Unicode Supplementary Planes.
+static const char* kUnicodeSupplementaryValueTypes[] = {"UTF8",
+ "UNIVERSALSTRING"};
+
+static const char* kMangleTypes[] = {"unmangled",
+ "case_swap",
+ "extra_whitespace"};
+
+} // namespace
+
+class VerifyNameMatchSimpleTest
+ : public ::testing::TestWithParam<
+ ::testing::tuple<const char*, const char*>> {
+ public:
+ std::string value_type() const { return ::testing::get<0>(GetParam()); }
+ std::string suffix() const { return ::testing::get<1>(GetParam()); }
+};
+
+// Compare each input against itself, verifies that all input data is parsed
+// successfully.
+TEST_P(VerifyNameMatchSimpleTest, ExactEquality) {
+ std::string der = LoadTestData("ascii", value_type(), suffix());
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(der), InputFromString(der)));
+
+ std::string der_extra_attr =
+ LoadTestData("ascii", value_type(), suffix() + "-extra_attr");
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(der_extra_attr),
+ InputFromString(der_extra_attr)));
+
+ std::string der_extra_rdn =
+ LoadTestData("ascii", value_type(), suffix() + "-extra_rdn");
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(der_extra_rdn),
+ InputFromString(der_extra_rdn)));
+}
+
+// Ensure that a Name does not match another Name which is exactly the same but
+// with an extra attribute in one Relative Distinguished Name.
+TEST_P(VerifyNameMatchSimpleTest, ExtraAttrDoesNotMatch) {
+ std::string der = LoadTestData("ascii", value_type(), suffix());
+ std::string der_extra_attr =
+ LoadTestData("ascii", value_type(), suffix() + "-extra_attr");
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(der), InputFromString(der_extra_attr)));
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(der_extra_attr), InputFromString(der)));
+}
+
+// Ensure that a Name does not match another Name which is exactly the same but
+// with an extra Relative Distinguished Name.
+TEST_P(VerifyNameMatchSimpleTest, ExtraRdnDoesNotMatch) {
+ std::string der = LoadTestData("ascii", value_type(), suffix());
+ std::string der_extra_rdn =
+ LoadTestData("ascii", value_type(), suffix() + "-extra_rdn");
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(der), InputFromString(der_extra_rdn)));
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(der_extra_rdn), InputFromString(der)));
+}
+
+INSTANTIATE_TEST_CASE_P(InstantiationName,
+ VerifyNameMatchSimpleTest,
+ ::testing::Combine(::testing::ValuesIn(kValueTypes),
eroman 2015/07/03 22:31:20 I gave up on reading all the gtest magic. Can you
mattm 2015/07/16 04:42:32 Done.
+ ::testing::ValuesIn(kMangleTypes)));
+
+class VerifyNameMatchNormalizationTest
+ : public ::testing::TestWithParam<::testing::tuple<bool, const char*>> {
+ public:
+ bool expected_result() const { return ::testing::get<0>(GetParam()); }
+ std::string value_type() const { return ::testing::get<1>(GetParam()); }
+};
+
+// Verify matching is case insensitive (for the types which currently support
+// normalization).
+TEST_P(VerifyNameMatchNormalizationTest, CaseInsensitivity) {
+ std::string normal = LoadTestData("ascii", value_type(), "unmangled");
+ std::string case_swap = LoadTestData("ascii", value_type(), "case_swap");
+ EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(normal),
+ InputFromString(case_swap)));
+ EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(case_swap),
+ InputFromString(normal)));
+}
+
+// Verify matching folds whitespace (for the types which currently support
+// normalization).
+TEST_P(VerifyNameMatchNormalizationTest, CollapseWhitespace) {
+ std::string normal = LoadTestData("ascii", value_type(), "unmangled");
+ std::string whitespace =
+ LoadTestData("ascii", value_type(), "extra_whitespace");
+ EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(normal),
+ InputFromString(whitespace)));
+ EXPECT_EQ(expected_result(), VerifyNameMatch(InputFromString(whitespace),
+ InputFromString(normal)));
+}
+
+INSTANTIATE_TEST_CASE_P(
+ InstantiationName,
+ VerifyNameMatchNormalizationTest,
+ ::testing::Values(
+ ::testing::make_tuple(true,
+ static_cast<const char*>("PRINTABLESTRING")),
+ ::testing::make_tuple(false, static_cast<const char*>("T61STRING")),
+ ::testing::make_tuple(true, static_cast<const char*>("UTF8")),
+ ::testing::make_tuple(true, static_cast<const char*>("BMPSTRING")),
+ ::testing::make_tuple(true,
+ static_cast<const char*>("UNIVERSALSTRING"))));
+
+class VerifyNameMatchDifferingTypesTest
+ : public ::testing::TestWithParam<
+ ::testing::tuple<const char*, const char*>> {
+ public:
+ std::string value_type_1() const { return ::testing::get<0>(GetParam()); }
+ std::string value_type_2() const { return ::testing::get<1>(GetParam()); }
+};
+
+TEST_P(VerifyNameMatchDifferingTypesTest, NormalizableTypesAreEqual) {
+ std::string der_1 = LoadTestData("ascii", value_type_1(), "unmangled");
+ std::string der_2 = LoadTestData("ascii", value_type_2(), "unmangled");
+ if (value_type_1() == value_type_2()) {
+ EXPECT_TRUE(
+ VerifyNameMatch(InputFromString(der_1), InputFromString(der_2)));
+ } else if ((value_type_1() == "PRINTABLESTRING" || value_type_1() == "UTF8" ||
+ value_type_1() == "BMPSTRING" ||
+ value_type_1() == "UNIVERSALSTRING") &&
+ (value_type_2() == "PRINTABLESTRING" || value_type_2() == "UTF8" ||
+ value_type_2() == "BMPSTRING" ||
+ value_type_2() == "UNIVERSALSTRING")) {
+ EXPECT_TRUE(
+ VerifyNameMatch(InputFromString(der_1), InputFromString(der_2)));
+ } else {
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(der_1), InputFromString(der_2)));
+ }
+}
+
+INSTANTIATE_TEST_CASE_P(InstantiationName,
+ VerifyNameMatchDifferingTypesTest,
+ ::testing::Combine(::testing::ValuesIn(kValueTypes),
+ ::testing::ValuesIn(kValueTypes)));
+
+class VerifyNameMatchUnicodeConversionTest
+ : public ::testing::TestWithParam<
+ ::testing::tuple<const char*,
+ ::testing::tuple<const char*, const char*>>> {
+ public:
+ std::string prefix() const { return ::testing::get<0>(GetParam()); }
+ std::string value_type_1() const {
+ return ::testing::get<0>(::testing::get<1>(GetParam()));
+ }
+ std::string value_type_2() const {
+ return ::testing::get<1>(::testing::get<1>(GetParam()));
+ }
+};
+
+TEST_P(VerifyNameMatchUnicodeConversionTest, UnicodeConversionsAreEqual) {
+ std::string der_1 = LoadTestData(prefix(), value_type_1(), "unmangled");
+ std::string der_2 = LoadTestData(prefix(), value_type_2(), "unmangled");
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(der_1), InputFromString(der_2)));
+}
+
+INSTANTIATE_TEST_CASE_P(
+ BMPConversion,
+ VerifyNameMatchUnicodeConversionTest,
+ ::testing::Combine(
+ ::testing::Values("unicode_bmp"),
+ ::testing::Combine(::testing::ValuesIn(kUnicodeBMPValueTypes),
+ ::testing::ValuesIn(kUnicodeBMPValueTypes))));
+
+INSTANTIATE_TEST_CASE_P(
+ SMPConversion,
+ VerifyNameMatchUnicodeConversionTest,
+ ::testing::Combine(
+ ::testing::Values("unicode_supplementary"),
+ ::testing::Combine(
+ ::testing::ValuesIn(kUnicodeSupplementaryValueTypes),
+ ::testing::ValuesIn(kUnicodeSupplementaryValueTypes))));
+
+// Matching should fail if a PrintableString contains invalid characters.
+TEST(VerifyNameMatchInvalidDataTest, FailOnInvalidPrintableStringChars) {
+ std::string der = LoadTestData("ascii", "PRINTABLESTRING", "unmangled");
+ // Find a known location inside a PrintableString in the DER-encoded data.
+ size_t replace_location = der.find("0123456789");
+ ASSERT_NE(std::string::npos, replace_location);
+ for (int c = 0; c < 256; ++c) {
+ SCOPED_TRACE(base::IntToString(c));
+ if (IsAsciiAlpha(c) || IsAsciiDigit(c))
+ continue;
+ switch (c) {
+ case ' ':
+ case '\'':
+ case '(':
+ case ')':
+ case '*':
+ case '+':
+ case ',':
+ case '-':
+ case '.':
+ case '/':
+ case ':':
+ case '=':
+ case '?':
+ continue;
+ }
+ der.replace(replace_location, 1, 1, c);
+ // Verification should fail due to the invalid character.
+ EXPECT_FALSE(VerifyNameMatch(InputFromString(der), InputFromString(der)));
+ }
+}
+
+// Matching should fail if an IA5String contains invalid characters.
+TEST(VerifyNameMatchInvalidDataTest, FailOnInvalidIA5StringChars) {
+ std::string der = LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_1");
+ // Find a known location inside an IA5String in the DER-encoded data.
+ size_t replace_location = der.find("eXaMple");
+ ASSERT_NE(std::string::npos, replace_location);
+ for (int c = 0; c < 256; ++c) {
+ SCOPED_TRACE(base::IntToString(c));
+ der.replace(replace_location, 1, 1, c);
+ bool expected_result = (c <= 127);
+ EXPECT_EQ(expected_result,
+ VerifyNameMatch(InputFromString(der), InputFromString(der)));
+ }
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueExtraData) {
+ std::string invalid =
+ LoadTestData("invalid", "AttributeTypeAndValue", "extradata");
+ // Verification should fail due to extra element in AttributeTypeAndValue
+ // sequence.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueShort) {
+ std::string invalid =
+ LoadTestData("invalid", "AttributeTypeAndValue", "onlyOneElement");
+ // Verification should fail due to AttributeTypeAndValue sequence having only
+ // one element.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueEmpty) {
+ std::string invalid =
+ LoadTestData("invalid", "AttributeTypeAndValue", "empty");
+ // Verification should fail due to empty AttributeTypeAndValue sequence.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnBadAttributeType) {
+ std::string invalid =
+ LoadTestData("invalid", "AttributeTypeAndValue", "badAttributeType");
+ // Verification should fail due to Attribute Type not being an OID.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnAttributeTypeAndValueNotSequence) {
+ std::string invalid =
+ LoadTestData("invalid", "AttributeTypeAndValue", "setNotSequence");
+ // Verification should fail due to AttributeTypeAndValue being a Set instead
+ // of a Sequence.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnRdnNotSet) {
+ std::string invalid = LoadTestData("invalid", "RDN", "sequenceInsteadOfSet");
+ // Verification should fail due to RDN being a Sequence instead of a Set.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnEmptyRdn) {
+ std::string invalid = LoadTestData("invalid", "RDN", "empty");
+ // Verification should fail due to RDN having zero AttributeTypeAndValues.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnNameNotSequence) {
+ std::string invalid = LoadTestData("invalid", "Name", "setInsteadOfSequence");
+ // Verification should fail due to Name being a Set instead of a Sequence.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnEmptyName) {
+ std::string invalid = LoadTestData("invalid", "Name", "empty");
+ // Verification should fail due to Name having zero RDNs.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+TEST(VerifyNameMatchInvalidDataTest, FailOnTrailingData) {
+ std::string invalid =
+ LoadTestData("ascii", "PRINTABLESTRING", "unmangled") + "X";
+ // Verification should fail due to the appended character.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+// Matching should fail if a BMPString contains surrogates.
+TEST(VerifyNameMatchInvalidDataTest, FailOnBmpStringSurrogates) {
+ std::string normal = LoadTestData("unicode_bmp", "BMPSTRING", "unmangled");
+ // Find a known location inside a BMPSTRING in the DER-encoded data.
+ size_t replace_location = normal.find("\x67\x71\x4e\xac");
+ ASSERT_NE(std::string::npos, replace_location);
+ // Replace with U+1D400 MATHEMATICAL BOLD CAPITAL A, which requires surrogates
+ // to represent.
+ std::string invalid = normal.replace(replace_location, 4, "\xd8\x35\xdc\x00");
+ // Verification should fail due to the invalid codepoints.
+ EXPECT_FALSE(
+ VerifyNameMatch(InputFromString(invalid), InputFromString(invalid)));
+}
+
+// Matching should succeed when the RDNs are sorted differently but are still
+// equal after normalizing.
+TEST(VerifyNameMatchRDNSorting, Simple) {
+ std::string a = LoadTestData("ascii", "PRINTABLESTRING", "rdn_sorting_1");
+ std::string b = LoadTestData("ascii", "PRINTABLESTRING", "rdn_sorting_2");
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(a), InputFromString(b)));
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(b), InputFromString(a)));
+}
+
+// Matching should succeed when the RDNs are sorted differently but are still
+// equal after normalizing, even in malformed RDNs that contain multiple
+// elements with the same type.
+TEST(VerifyNameMatchRDNSorting, DuplicateTypes) {
+ std::string a = LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_1");
+ std::string b = LoadTestData("ascii", "mixed", "rdn_dupetype_sorting_2");
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(a), InputFromString(b)));
+ EXPECT_TRUE(VerifyNameMatch(InputFromString(b), InputFromString(a)));
}
} // namespace net

Powered by Google App Engine
This is Rietveld 408576698