OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/net/ssl_config_service_manager.h" | 5 #include "components/ssl_config/ssl_config_service_manager.h" |
6 | 6 |
7 #include "base/command_line.h" | |
8 #include "base/memory/ref_counted.h" | 7 #include "base/memory/ref_counted.h" |
9 #include "base/message_loop/message_loop.h" | 8 #include "base/message_loop/message_loop.h" |
10 #include "base/prefs/pref_registry_simple.h" | 9 #include "base/prefs/testing_pref_service.h" |
11 #include "base/prefs/testing_pref_store.h" | 10 #include "base/thread_task_runner_handle.h" |
12 #include "base/values.h" | 11 #include "base/values.h" |
13 #include "chrome/browser/prefs/command_line_pref_store.h" | 12 #include "components/ssl_config/ssl_config_prefs.h" |
14 #include "chrome/common/chrome_switches.h" | 13 #include "components/ssl_config/ssl_config_switches.h" |
15 #include "chrome/common/pref_names.h" | |
16 #include "chrome/test/base/testing_profile.h" | |
17 #include "components/content_settings/core/browser/host_content_settings_map.h" | |
18 #include "components/content_settings/core/common/content_settings.h" | |
19 #include "components/syncable_prefs/pref_service_mock_factory.h" | |
20 #include "components/syncable_prefs/testing_pref_service_syncable.h" | |
21 #include "content/public/test/test_browser_thread.h" | |
22 #include "net/ssl/ssl_config.h" | 14 #include "net/ssl/ssl_config.h" |
23 #include "net/ssl/ssl_config_service.h" | 15 #include "net/ssl/ssl_config_service.h" |
24 #include "testing/gtest/include/gtest/gtest.h" | 16 #include "testing/gtest/include/gtest/gtest.h" |
25 | 17 |
26 using base::ListValue; | 18 using base::ListValue; |
27 using base::Value; | |
28 using content::BrowserThread; | |
29 using net::SSLConfig; | 19 using net::SSLConfig; |
30 using net::SSLConfigService; | 20 using net::SSLConfigService; |
| 21 using ssl_config::SSLConfigServiceManager; |
31 | 22 |
32 class SSLConfigServiceManagerPrefTest : public testing::Test { | 23 class SSLConfigServiceManagerPrefTest : public testing::Test { |
33 public: | 24 public: |
34 SSLConfigServiceManagerPrefTest() | 25 SSLConfigServiceManagerPrefTest() {} |
35 : ui_thread_(BrowserThread::UI, &message_loop_), | |
36 io_thread_(BrowserThread::IO, &message_loop_) {} | |
37 | 26 |
38 protected: | 27 protected: |
39 base::MessageLoop message_loop_; | 28 base::MessageLoop message_loop_; |
40 content::TestBrowserThread ui_thread_; | |
41 content::TestBrowserThread io_thread_; | |
42 }; | 29 }; |
43 | 30 |
44 // Test channel id with no user prefs. | 31 // Test channel id with no user prefs. |
45 TEST_F(SSLConfigServiceManagerPrefTest, ChannelIDWithoutUserPrefs) { | 32 TEST_F(SSLConfigServiceManagerPrefTest, ChannelIDWithoutUserPrefs) { |
46 TestingPrefServiceSimple local_state; | 33 TestingPrefServiceSimple local_state; |
47 SSLConfigServiceManager::RegisterPrefs(local_state.registry()); | 34 SSLConfigServiceManager::RegisterPrefs(local_state.registry()); |
48 | 35 |
49 scoped_ptr<SSLConfigServiceManager> config_manager( | 36 scoped_ptr<SSLConfigServiceManager> config_manager( |
50 SSLConfigServiceManager::CreateDefaultManager(&local_state)); | 37 SSLConfigServiceManager::CreateDefaultManager( |
| 38 &local_state, base::ThreadTaskRunnerHandle::Get())); |
51 ASSERT_TRUE(config_manager.get()); | 39 ASSERT_TRUE(config_manager.get()); |
52 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); | 40 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); |
53 ASSERT_TRUE(config_service.get()); | 41 ASSERT_TRUE(config_service.get()); |
54 | 42 |
55 SSLConfig config; | 43 SSLConfig config; |
56 config_service->GetSSLConfig(&config); | 44 config_service->GetSSLConfig(&config); |
57 EXPECT_TRUE(config.channel_id_enabled); | 45 EXPECT_TRUE(config.channel_id_enabled); |
58 } | 46 } |
59 | 47 |
60 // Test that cipher suites can be disabled. "Good" refers to the fact that | 48 // Test that cipher suites can be disabled. "Good" refers to the fact that |
61 // every value is expected to be successfully parsed into a cipher suite. | 49 // every value is expected to be successfully parsed into a cipher suite. |
62 TEST_F(SSLConfigServiceManagerPrefTest, GoodDisabledCipherSuites) { | 50 TEST_F(SSLConfigServiceManagerPrefTest, GoodDisabledCipherSuites) { |
63 TestingPrefServiceSimple local_state; | 51 TestingPrefServiceSimple local_state; |
64 SSLConfigServiceManager::RegisterPrefs(local_state.registry()); | 52 SSLConfigServiceManager::RegisterPrefs(local_state.registry()); |
65 | 53 |
66 scoped_ptr<SSLConfigServiceManager> config_manager( | 54 scoped_ptr<SSLConfigServiceManager> config_manager( |
67 SSLConfigServiceManager::CreateDefaultManager(&local_state)); | 55 SSLConfigServiceManager::CreateDefaultManager( |
| 56 &local_state, base::ThreadTaskRunnerHandle::Get())); |
68 ASSERT_TRUE(config_manager.get()); | 57 ASSERT_TRUE(config_manager.get()); |
69 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); | 58 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); |
70 ASSERT_TRUE(config_service.get()); | 59 ASSERT_TRUE(config_service.get()); |
71 | 60 |
72 SSLConfig old_config; | 61 SSLConfig old_config; |
73 config_service->GetSSLConfig(&old_config); | 62 config_service->GetSSLConfig(&old_config); |
74 EXPECT_TRUE(old_config.disabled_cipher_suites.empty()); | 63 EXPECT_TRUE(old_config.disabled_cipher_suites.empty()); |
75 | 64 |
76 base::ListValue* list_value = new base::ListValue(); | 65 base::ListValue* list_value = new base::ListValue(); |
77 list_value->Append(new base::StringValue("0x0004")); | 66 list_value->Append(new base::StringValue("0x0004")); |
78 list_value->Append(new base::StringValue("0x0005")); | 67 list_value->Append(new base::StringValue("0x0005")); |
79 local_state.SetUserPref(prefs::kCipherSuiteBlacklist, list_value); | 68 local_state.SetUserPref(ssl_config::prefs::kCipherSuiteBlacklist, list_value); |
80 | 69 |
81 // Pump the message loop to notify the SSLConfigServiceManagerPref that the | 70 // Pump the message loop to notify the SSLConfigServiceManagerPref that the |
82 // preferences changed. | 71 // preferences changed. |
83 message_loop_.RunUntilIdle(); | 72 message_loop_.RunUntilIdle(); |
84 | 73 |
85 SSLConfig config; | 74 SSLConfig config; |
86 config_service->GetSSLConfig(&config); | 75 config_service->GetSSLConfig(&config); |
87 | 76 |
88 EXPECT_NE(old_config.disabled_cipher_suites, config.disabled_cipher_suites); | 77 EXPECT_NE(old_config.disabled_cipher_suites, config.disabled_cipher_suites); |
89 ASSERT_EQ(2u, config.disabled_cipher_suites.size()); | 78 ASSERT_EQ(2u, config.disabled_cipher_suites.size()); |
90 EXPECT_EQ(0x0004, config.disabled_cipher_suites[0]); | 79 EXPECT_EQ(0x0004, config.disabled_cipher_suites[0]); |
91 EXPECT_EQ(0x0005, config.disabled_cipher_suites[1]); | 80 EXPECT_EQ(0x0005, config.disabled_cipher_suites[1]); |
92 } | 81 } |
93 | 82 |
94 // Test that cipher suites can be disabled. "Bad" refers to the fact that | 83 // Test that cipher suites can be disabled. "Bad" refers to the fact that |
95 // there are one or more non-cipher suite strings in the preference. They | 84 // there are one or more non-cipher suite strings in the preference. They |
96 // should be ignored. | 85 // should be ignored. |
97 TEST_F(SSLConfigServiceManagerPrefTest, BadDisabledCipherSuites) { | 86 TEST_F(SSLConfigServiceManagerPrefTest, BadDisabledCipherSuites) { |
98 TestingPrefServiceSimple local_state; | 87 TestingPrefServiceSimple local_state; |
99 SSLConfigServiceManager::RegisterPrefs(local_state.registry()); | 88 SSLConfigServiceManager::RegisterPrefs(local_state.registry()); |
100 | 89 |
101 scoped_ptr<SSLConfigServiceManager> config_manager( | 90 scoped_ptr<SSLConfigServiceManager> config_manager( |
102 SSLConfigServiceManager::CreateDefaultManager(&local_state)); | 91 SSLConfigServiceManager::CreateDefaultManager( |
| 92 &local_state, base::ThreadTaskRunnerHandle::Get())); |
103 ASSERT_TRUE(config_manager.get()); | 93 ASSERT_TRUE(config_manager.get()); |
104 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); | 94 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); |
105 ASSERT_TRUE(config_service.get()); | 95 ASSERT_TRUE(config_service.get()); |
106 | 96 |
107 SSLConfig old_config; | 97 SSLConfig old_config; |
108 config_service->GetSSLConfig(&old_config); | 98 config_service->GetSSLConfig(&old_config); |
109 EXPECT_TRUE(old_config.disabled_cipher_suites.empty()); | 99 EXPECT_TRUE(old_config.disabled_cipher_suites.empty()); |
110 | 100 |
111 base::ListValue* list_value = new base::ListValue(); | 101 base::ListValue* list_value = new base::ListValue(); |
112 list_value->Append(new base::StringValue("0x0004")); | 102 list_value->Append(new base::StringValue("0x0004")); |
113 list_value->Append(new base::StringValue("TLS_NOT_WITH_A_CIPHER_SUITE")); | 103 list_value->Append(new base::StringValue("TLS_NOT_WITH_A_CIPHER_SUITE")); |
114 list_value->Append(new base::StringValue("0x0005")); | 104 list_value->Append(new base::StringValue("0x0005")); |
115 list_value->Append(new base::StringValue("0xBEEFY")); | 105 list_value->Append(new base::StringValue("0xBEEFY")); |
116 local_state.SetUserPref(prefs::kCipherSuiteBlacklist, list_value); | 106 local_state.SetUserPref(ssl_config::prefs::kCipherSuiteBlacklist, list_value); |
117 | 107 |
118 // Pump the message loop to notify the SSLConfigServiceManagerPref that the | 108 // Pump the message loop to notify the SSLConfigServiceManagerPref that the |
119 // preferences changed. | 109 // preferences changed. |
120 message_loop_.RunUntilIdle(); | 110 message_loop_.RunUntilIdle(); |
121 | 111 |
122 SSLConfig config; | 112 SSLConfig config; |
123 config_service->GetSSLConfig(&config); | 113 config_service->GetSSLConfig(&config); |
124 | 114 |
125 EXPECT_NE(old_config.disabled_cipher_suites, config.disabled_cipher_suites); | 115 EXPECT_NE(old_config.disabled_cipher_suites, config.disabled_cipher_suites); |
126 ASSERT_EQ(2u, config.disabled_cipher_suites.size()); | 116 ASSERT_EQ(2u, config.disabled_cipher_suites.size()); |
127 EXPECT_EQ(0x0004, config.disabled_cipher_suites[0]); | 117 EXPECT_EQ(0x0004, config.disabled_cipher_suites[0]); |
128 EXPECT_EQ(0x0005, config.disabled_cipher_suites[1]); | 118 EXPECT_EQ(0x0005, config.disabled_cipher_suites[1]); |
129 } | 119 } |
130 | 120 |
131 // Test that without command-line settings for minimum and maximum SSL versions, | 121 // Test that without command-line settings for minimum and maximum SSL versions, |
132 // TLS versions from 1.0 up to 1.1 or 1.2 are enabled. | 122 // TLS versions from 1.0 up to 1.1 or 1.2 are enabled. |
133 TEST_F(SSLConfigServiceManagerPrefTest, NoCommandLinePrefs) { | 123 TEST_F(SSLConfigServiceManagerPrefTest, NoCommandLinePrefs) { |
134 scoped_refptr<TestingPrefStore> local_state_store(new TestingPrefStore()); | 124 scoped_refptr<TestingPrefStore> local_state_store(new TestingPrefStore()); |
135 | 125 TestingPrefServiceSimple local_state; |
136 syncable_prefs::PrefServiceMockFactory factory; | 126 SSLConfigServiceManager::RegisterPrefs(local_state.registry()); |
137 factory.set_user_prefs(local_state_store); | |
138 scoped_refptr<PrefRegistrySimple> registry = new PrefRegistrySimple; | |
139 scoped_ptr<PrefService> local_state(factory.Create(registry.get())); | |
140 | |
141 SSLConfigServiceManager::RegisterPrefs(registry.get()); | |
142 | 127 |
143 scoped_ptr<SSLConfigServiceManager> config_manager( | 128 scoped_ptr<SSLConfigServiceManager> config_manager( |
144 SSLConfigServiceManager::CreateDefaultManager(local_state.get())); | 129 SSLConfigServiceManager::CreateDefaultManager( |
| 130 &local_state, base::ThreadTaskRunnerHandle::Get())); |
145 ASSERT_TRUE(config_manager.get()); | 131 ASSERT_TRUE(config_manager.get()); |
146 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); | 132 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); |
147 ASSERT_TRUE(config_service.get()); | 133 ASSERT_TRUE(config_service.get()); |
148 | 134 |
149 SSLConfig ssl_config; | 135 SSLConfig ssl_config; |
150 config_service->GetSSLConfig(&ssl_config); | 136 config_service->GetSSLConfig(&ssl_config); |
151 // In the absence of command-line options, the default TLS version range is | 137 // In the absence of command-line options, the default TLS version range is |
152 // enabled. | 138 // enabled. |
153 EXPECT_EQ(net::kDefaultSSLVersionMin, ssl_config.version_min); | 139 EXPECT_EQ(net::kDefaultSSLVersionMin, ssl_config.version_min); |
154 EXPECT_EQ(net::kDefaultSSLVersionMax, ssl_config.version_max); | 140 EXPECT_EQ(net::kDefaultSSLVersionMax, ssl_config.version_max); |
155 | 141 |
156 // The settings should not be added to the local_state. | 142 // The settings should not be added to the local_state. |
157 EXPECT_FALSE(local_state->HasPrefPath(prefs::kSSLVersionMin)); | 143 EXPECT_FALSE(local_state.HasPrefPath(ssl_config::prefs::kSSLVersionMin)); |
158 EXPECT_FALSE(local_state->HasPrefPath(prefs::kSSLVersionMax)); | 144 EXPECT_FALSE(local_state.HasPrefPath(ssl_config::prefs::kSSLVersionMax)); |
159 | 145 |
160 // Explicitly double-check the settings are not in the preference store. | 146 // Explicitly double-check the settings are not in the preference store. |
161 std::string version_min_str; | 147 std::string version_min_str; |
162 std::string version_max_str; | 148 std::string version_max_str; |
163 EXPECT_FALSE(local_state_store->GetString(prefs::kSSLVersionMin, | 149 EXPECT_FALSE(local_state_store->GetString(ssl_config::prefs::kSSLVersionMin, |
164 &version_min_str)); | 150 &version_min_str)); |
165 EXPECT_FALSE(local_state_store->GetString(prefs::kSSLVersionMax, | 151 EXPECT_FALSE(local_state_store->GetString(ssl_config::prefs::kSSLVersionMax, |
166 &version_max_str)); | 152 &version_max_str)); |
167 } | 153 } |
168 | 154 |
169 // Test that command-line settings for minimum and maximum SSL versions are | |
170 // respected and that they do not persist to the preferences files. | |
171 TEST_F(SSLConfigServiceManagerPrefTest, CommandLinePrefs) { | |
172 scoped_refptr<TestingPrefStore> local_state_store(new TestingPrefStore()); | |
173 | |
174 base::CommandLine command_line(base::CommandLine::NO_PROGRAM); | |
175 command_line.AppendSwitchASCII(switches::kSSLVersionMin, "tls1.1"); | |
176 command_line.AppendSwitchASCII(switches::kSSLVersionMax, "tls1"); | |
177 | |
178 syncable_prefs::PrefServiceMockFactory factory; | |
179 factory.set_user_prefs(local_state_store); | |
180 factory.set_command_line_prefs(new CommandLinePrefStore(&command_line)); | |
181 scoped_refptr<PrefRegistrySimple> registry = new PrefRegistrySimple; | |
182 scoped_ptr<PrefService> local_state(factory.Create(registry.get())); | |
183 | |
184 SSLConfigServiceManager::RegisterPrefs(registry.get()); | |
185 | |
186 scoped_ptr<SSLConfigServiceManager> config_manager( | |
187 SSLConfigServiceManager::CreateDefaultManager(local_state.get())); | |
188 ASSERT_TRUE(config_manager.get()); | |
189 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); | |
190 ASSERT_TRUE(config_service.get()); | |
191 | |
192 SSLConfig ssl_config; | |
193 config_service->GetSSLConfig(&ssl_config); | |
194 // Command-line flags should be respected. | |
195 EXPECT_EQ(net::SSL_PROTOCOL_VERSION_TLS1_1, ssl_config.version_min); | |
196 EXPECT_EQ(net::SSL_PROTOCOL_VERSION_TLS1, ssl_config.version_max); | |
197 | |
198 // Explicitly double-check the settings are not in the preference store. | |
199 const PrefService::Preference* version_min_pref = | |
200 local_state->FindPreference(prefs::kSSLVersionMin); | |
201 EXPECT_FALSE(version_min_pref->IsUserModifiable()); | |
202 | |
203 const PrefService::Preference* version_max_pref = | |
204 local_state->FindPreference(prefs::kSSLVersionMax); | |
205 EXPECT_FALSE(version_max_pref->IsUserModifiable()); | |
206 | |
207 std::string version_min_str; | |
208 std::string version_max_str; | |
209 EXPECT_FALSE(local_state_store->GetString(prefs::kSSLVersionMin, | |
210 &version_min_str)); | |
211 EXPECT_FALSE(local_state_store->GetString(prefs::kSSLVersionMax, | |
212 &version_max_str)); | |
213 } | |
214 | |
215 // Tests that "ssl3" is not treated as a valid minimum version. | 155 // Tests that "ssl3" is not treated as a valid minimum version. |
216 TEST_F(SSLConfigServiceManagerPrefTest, NoSSL3) { | 156 TEST_F(SSLConfigServiceManagerPrefTest, NoSSL3) { |
217 scoped_refptr<TestingPrefStore> local_state_store(new TestingPrefStore()); | 157 scoped_refptr<TestingPrefStore> local_state_store(new TestingPrefStore()); |
218 | 158 |
219 base::CommandLine command_line(base::CommandLine::NO_PROGRAM); | 159 TestingPrefServiceSimple local_state; |
220 command_line.AppendSwitchASCII(switches::kSSLVersionMin, "ssl3"); | 160 local_state.SetUserPref(ssl_config::prefs::kSSLVersionMin, |
221 | 161 new base::StringValue("ssl3")); |
222 syncable_prefs::PrefServiceMockFactory factory; | 162 SSLConfigServiceManager::RegisterPrefs(local_state.registry()); |
223 factory.set_user_prefs(local_state_store); | |
224 factory.set_command_line_prefs(new CommandLinePrefStore(&command_line)); | |
225 scoped_refptr<PrefRegistrySimple> registry = new PrefRegistrySimple; | |
226 scoped_ptr<PrefService> local_state(factory.Create(registry.get())); | |
227 | |
228 SSLConfigServiceManager::RegisterPrefs(registry.get()); | |
229 | 163 |
230 scoped_ptr<SSLConfigServiceManager> config_manager( | 164 scoped_ptr<SSLConfigServiceManager> config_manager( |
231 SSLConfigServiceManager::CreateDefaultManager(local_state.get())); | 165 SSLConfigServiceManager::CreateDefaultManager( |
| 166 &local_state, base::ThreadTaskRunnerHandle::Get())); |
232 ASSERT_TRUE(config_manager.get()); | 167 ASSERT_TRUE(config_manager.get()); |
233 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); | 168 scoped_refptr<SSLConfigService> config_service(config_manager->Get()); |
234 ASSERT_TRUE(config_service.get()); | 169 ASSERT_TRUE(config_service.get()); |
235 | 170 |
236 SSLConfig ssl_config; | 171 SSLConfig ssl_config; |
237 config_service->GetSSLConfig(&ssl_config); | 172 config_service->GetSSLConfig(&ssl_config); |
238 // The command-line option must not have been honored. | 173 // The command-line option must not have been honored. |
239 EXPECT_LE(net::SSL_PROTOCOL_VERSION_TLS1, ssl_config.version_min); | 174 EXPECT_LE(net::SSL_PROTOCOL_VERSION_TLS1, ssl_config.version_min); |
240 } | 175 } |
OLD | NEW |