| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/ssl/ssl_error_classification.h" | 5 #include "chrome/browser/ssl/ssl_error_classification.h" |
| 6 | 6 |
| 7 #include "base/files/file_path.h" | 7 #include "base/files/file_path.h" |
| 8 #include "base/strings/string_split.h" | 8 #include "base/strings/string_split.h" |
| 9 #include "base/time/time.h" | 9 #include "base/time/time.h" |
| 10 #include "chrome/test/base/chrome_render_view_host_test_harness.h" | |
| 11 #include "content/public/browser/web_contents.h" | |
| 12 #include "net/base/net_errors.h" | 10 #include "net/base/net_errors.h" |
| 13 #include "net/base/test_data_directory.h" | 11 #include "net/base/test_data_directory.h" |
| 14 #include "net/cert/x509_cert_types.h" | 12 #include "net/cert/x509_cert_types.h" |
| 15 #include "net/cert/x509_certificate.h" | 13 #include "net/cert/x509_certificate.h" |
| 16 #include "net/test/cert_test_util.h" | 14 #include "net/test/cert_test_util.h" |
| 17 #include "net/test/test_certificate_data.h" | 15 #include "net/test/test_certificate_data.h" |
| 18 #include "testing/gtest/include/gtest/gtest.h" | 16 #include "testing/gtest/include/gtest/gtest.h" |
| 19 #include "url/gurl.h" | 17 #include "url/gurl.h" |
| 20 | 18 |
| 21 using base::Time; | 19 using base::Time; |
| 22 using content::WebContents; | |
| 23 | 20 |
| 24 class SSLErrorClassificationTest : public ChromeRenderViewHostTestHarness { | 21 class SSLErrorClassificationTest : public testing::Test {}; |
| 25 public: | |
| 26 SSLErrorClassificationTest() { | |
| 27 SetThreadBundleOptions(content::TestBrowserThreadBundle::REAL_IO_THREAD); | |
| 28 } | |
| 29 }; | |
| 30 | 22 |
| 31 TEST_F(SSLErrorClassificationTest, TestNameMismatch) { | 23 TEST_F(SSLErrorClassificationTest, TestNameMismatch) { |
| 32 scoped_refptr<net::X509Certificate> google_cert( | 24 scoped_refptr<net::X509Certificate> google_cert( |
| 33 net::X509Certificate::CreateFromBytes( | 25 net::X509Certificate::CreateFromBytes( |
| 34 reinterpret_cast<const char*>(google_der), sizeof(google_der))); | 26 reinterpret_cast<const char*>(google_der), sizeof(google_der))); |
| 35 ASSERT_NE(static_cast<net::X509Certificate*>(NULL), google_cert.get()); | 27 ASSERT_NE(static_cast<net::X509Certificate*>(NULL), google_cert.get()); |
| 36 base::Time time = base::Time::NowFromSystemTime(); | 28 base::Time time = base::Time::NowFromSystemTime(); |
| 37 std::vector<std::string> dns_names_google; | 29 std::vector<std::string> dns_names_google; |
| 38 dns_names_google.push_back("www"); | 30 dns_names_google.push_back("www"); |
| 39 dns_names_google.push_back("google"); | 31 dns_names_google.push_back("google"); |
| 40 dns_names_google.push_back("com"); | 32 dns_names_google.push_back("com"); |
| 41 std::vector<std::vector<std::string>> dns_name_tokens_google; | 33 std::vector<std::vector<std::string>> dns_name_tokens_google; |
| 42 dns_name_tokens_google.push_back(dns_names_google); | 34 dns_name_tokens_google.push_back(dns_names_google); |
| 43 int cert_error = net::ERR_CERT_COMMON_NAME_INVALID; | 35 int cert_error = net::ERR_CERT_COMMON_NAME_INVALID; |
| 44 WebContents* contents = web_contents(); | |
| 45 { | 36 { |
| 46 GURL origin("https://google.com"); | 37 GURL origin("https://google.com"); |
| 47 std::vector<std::string> host_name_tokens = base::SplitString( | 38 std::vector<std::string> host_name_tokens = base::SplitString( |
| 48 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); | 39 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); |
| 49 SSLErrorClassification ssl_error(contents, | 40 SSLErrorClassification ssl_error(time, origin, cert_error, *google_cert); |
| 50 time, | |
| 51 origin, | |
| 52 cert_error, | |
| 53 *google_cert); | |
| 54 EXPECT_TRUE(ssl_error.IsWWWSubDomainMatch()); | 41 EXPECT_TRUE(ssl_error.IsWWWSubDomainMatch()); |
| 55 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, | 42 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, |
| 56 dns_name_tokens_google)); | 43 dns_name_tokens_google)); |
| 57 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, | 44 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, |
| 58 host_name_tokens)); | 45 host_name_tokens)); |
| 59 EXPECT_FALSE(ssl_error.IsSubDomainOutsideWildcard(host_name_tokens)); | 46 EXPECT_FALSE(ssl_error.IsSubDomainOutsideWildcard(host_name_tokens)); |
| 60 EXPECT_FALSE(ssl_error.IsCertLikelyFromMultiTenantHosting()); | 47 EXPECT_FALSE(ssl_error.IsCertLikelyFromMultiTenantHosting()); |
| 61 EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain()); | 48 EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain()); |
| 62 } | 49 } |
| 63 | 50 |
| 64 { | 51 { |
| 65 GURL origin("https://foo.blah.google.com"); | 52 GURL origin("https://foo.blah.google.com"); |
| 66 std::vector<std::string> host_name_tokens = base::SplitString( | 53 std::vector<std::string> host_name_tokens = base::SplitString( |
| 67 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); | 54 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); |
| 68 SSLErrorClassification ssl_error(contents, | 55 SSLErrorClassification ssl_error(time, origin, cert_error, *google_cert); |
| 69 time, | |
| 70 origin, | |
| 71 cert_error, | |
| 72 *google_cert); | |
| 73 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); | 56 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); |
| 74 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, | 57 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, |
| 75 dns_name_tokens_google)); | 58 dns_name_tokens_google)); |
| 76 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, | 59 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, |
| 77 host_name_tokens)); | 60 host_name_tokens)); |
| 78 EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain()); | 61 EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain()); |
| 79 } | 62 } |
| 80 | 63 |
| 81 { | 64 { |
| 82 GURL origin("https://foo.www.google.com"); | 65 GURL origin("https://foo.www.google.com"); |
| 83 std::vector<std::string> host_name_tokens = base::SplitString( | 66 std::vector<std::string> host_name_tokens = base::SplitString( |
| 84 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); | 67 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); |
| 85 SSLErrorClassification ssl_error(contents, | 68 SSLErrorClassification ssl_error(time, origin, cert_error, *google_cert); |
| 86 time, | |
| 87 origin, | |
| 88 cert_error, | |
| 89 *google_cert); | |
| 90 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); | 69 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); |
| 91 EXPECT_TRUE(ssl_error.NameUnderAnyNames(host_name_tokens, | 70 EXPECT_TRUE(ssl_error.NameUnderAnyNames(host_name_tokens, |
| 92 dns_name_tokens_google)); | 71 dns_name_tokens_google)); |
| 93 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, | 72 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, |
| 94 host_name_tokens)); | 73 host_name_tokens)); |
| 95 EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain()); | 74 EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain()); |
| 96 } | 75 } |
| 97 | 76 |
| 98 { | 77 { |
| 99 GURL origin("https://www.google.com.foo"); | 78 GURL origin("https://www.google.com.foo"); |
| 100 std::vector<std::string> host_name_tokens = base::SplitString( | 79 std::vector<std::string> host_name_tokens = base::SplitString( |
| 101 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); | 80 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); |
| 102 SSLErrorClassification ssl_error(contents, | 81 SSLErrorClassification ssl_error(time, origin, cert_error, *google_cert); |
| 103 time, | |
| 104 origin, | |
| 105 cert_error, | |
| 106 *google_cert); | |
| 107 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); | 82 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); |
| 108 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, | 83 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, |
| 109 dns_name_tokens_google)); | 84 dns_name_tokens_google)); |
| 110 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, | 85 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, |
| 111 host_name_tokens)); | 86 host_name_tokens)); |
| 112 EXPECT_FALSE(ssl_error.IsCertLikelyFromSameDomain()); | 87 EXPECT_FALSE(ssl_error.IsCertLikelyFromSameDomain()); |
| 113 } | 88 } |
| 114 | 89 |
| 115 { | 90 { |
| 116 GURL origin("https://www.foogoogle.com."); | 91 GURL origin("https://www.foogoogle.com."); |
| 117 std::vector<std::string> host_name_tokens = base::SplitString( | 92 std::vector<std::string> host_name_tokens = base::SplitString( |
| 118 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); | 93 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); |
| 119 SSLErrorClassification ssl_error(contents, | 94 SSLErrorClassification ssl_error(time, origin, cert_error, *google_cert); |
| 120 time, | |
| 121 origin, | |
| 122 cert_error, | |
| 123 *google_cert); | |
| 124 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); | 95 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); |
| 125 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, | 96 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, |
| 126 dns_name_tokens_google)); | 97 dns_name_tokens_google)); |
| 127 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, | 98 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google, |
| 128 host_name_tokens)); | 99 host_name_tokens)); |
| 129 EXPECT_FALSE(ssl_error.IsCertLikelyFromSameDomain()); | 100 EXPECT_FALSE(ssl_error.IsCertLikelyFromSameDomain()); |
| 130 } | 101 } |
| 131 | 102 |
| 132 scoped_refptr<net::X509Certificate> webkit_cert( | 103 scoped_refptr<net::X509Certificate> webkit_cert( |
| 133 net::X509Certificate::CreateFromBytes( | 104 net::X509Certificate::CreateFromBytes( |
| 134 reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der))); | 105 reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der))); |
| 135 ASSERT_NE(static_cast<net::X509Certificate*>(NULL), webkit_cert.get()); | 106 ASSERT_NE(static_cast<net::X509Certificate*>(NULL), webkit_cert.get()); |
| 136 std::vector<std::string> dns_names_webkit; | 107 std::vector<std::string> dns_names_webkit; |
| 137 dns_names_webkit.push_back("webkit"); | 108 dns_names_webkit.push_back("webkit"); |
| 138 dns_names_webkit.push_back("org"); | 109 dns_names_webkit.push_back("org"); |
| 139 std::vector<std::vector<std::string>> dns_name_tokens_webkit; | 110 std::vector<std::vector<std::string>> dns_name_tokens_webkit; |
| 140 dns_name_tokens_webkit.push_back(dns_names_webkit); | 111 dns_name_tokens_webkit.push_back(dns_names_webkit); |
| 141 { | 112 { |
| 142 GURL origin("https://a.b.webkit.org"); | 113 GURL origin("https://a.b.webkit.org"); |
| 143 std::vector<std::string> host_name_tokens = base::SplitString( | 114 std::vector<std::string> host_name_tokens = base::SplitString( |
| 144 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); | 115 origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL); |
| 145 SSLErrorClassification ssl_error(contents, | 116 SSLErrorClassification ssl_error(time, origin, cert_error, *webkit_cert); |
| 146 time, | |
| 147 origin, | |
| 148 cert_error, | |
| 149 *webkit_cert); | |
| 150 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); | 117 EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch()); |
| 151 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, | 118 EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens, |
| 152 dns_name_tokens_webkit)); | 119 dns_name_tokens_webkit)); |
| 153 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_webkit, | 120 EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_webkit, |
| 154 host_name_tokens)); | 121 host_name_tokens)); |
| 155 EXPECT_TRUE(ssl_error.IsSubDomainOutsideWildcard(host_name_tokens)); | 122 EXPECT_TRUE(ssl_error.IsSubDomainOutsideWildcard(host_name_tokens)); |
| 156 EXPECT_FALSE(ssl_error.IsCertLikelyFromMultiTenantHosting()); | 123 EXPECT_FALSE(ssl_error.IsCertLikelyFromMultiTenantHosting()); |
| 157 EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain()); | 124 EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain()); |
| 158 } | 125 } |
| 159 } | 126 } |
| 160 | 127 |
| 161 TEST_F(SSLErrorClassificationTest, TestHostNameHasKnownTLD) { | 128 TEST_F(SSLErrorClassificationTest, TestHostNameHasKnownTLD) { |
| 162 EXPECT_TRUE(SSLErrorClassification::IsHostNameKnownTLD("www.google.com")); | 129 EXPECT_TRUE(SSLErrorClassification::IsHostNameKnownTLD("www.google.com")); |
| 163 EXPECT_TRUE(SSLErrorClassification::IsHostNameKnownTLD("b.appspot.com")); | 130 EXPECT_TRUE(SSLErrorClassification::IsHostNameKnownTLD("b.appspot.com")); |
| 164 EXPECT_FALSE(SSLErrorClassification::IsHostNameKnownTLD("a.private")); | 131 EXPECT_FALSE(SSLErrorClassification::IsHostNameKnownTLD("a.private")); |
| 165 } | 132 } |
| 166 | 133 |
| 167 TEST_F(SSLErrorClassificationTest, TestPrivateURL) { | 134 TEST_F(SSLErrorClassificationTest, TestPrivateURL) { |
| 168 EXPECT_FALSE(SSLErrorClassification::IsHostnameNonUniqueOrDotless( | 135 EXPECT_FALSE(SSLErrorClassification::IsHostnameNonUniqueOrDotless( |
| 169 "www.foogoogle.com.")); | 136 "www.foogoogle.com.")); |
| 170 EXPECT_TRUE(SSLErrorClassification::IsHostnameNonUniqueOrDotless("go")); | 137 EXPECT_TRUE(SSLErrorClassification::IsHostnameNonUniqueOrDotless("go")); |
| 171 EXPECT_TRUE( | 138 EXPECT_TRUE( |
| 172 SSLErrorClassification::IsHostnameNonUniqueOrDotless("172.17.108.108")); | 139 SSLErrorClassification::IsHostnameNonUniqueOrDotless("172.17.108.108")); |
| 173 EXPECT_TRUE(SSLErrorClassification::IsHostnameNonUniqueOrDotless("foo.blah")); | 140 EXPECT_TRUE(SSLErrorClassification::IsHostnameNonUniqueOrDotless("foo.blah")); |
| 174 } | 141 } |
| OLD | NEW |