| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "chrome/browser/ssl/security_state_model.h" | |
| 6 | |
| 7 #include "chrome/browser/ssl/security_state_model_client.h" | |
| 8 #include "chrome/test/base/chrome_render_view_host_test_harness.h" | |
| 9 #include "chrome/test/base/testing_profile.h" | |
| 10 #include "content/public/browser/cert_store.h" | |
| 11 #include "content/public/common/origin_util.h" | |
| 12 #include "content/public/test/mock_render_process_host.h" | |
| 13 #include "content/public/test/test_browser_thread_bundle.h" | |
| 14 #include "net/base/test_data_directory.h" | |
| 15 #include "net/cert/x509_certificate.h" | |
| 16 #include "net/ssl/ssl_connection_status_flags.h" | |
| 17 #include "net/test/cert_test_util.h" | |
| 18 #include "net/test/test_certificate_data.h" | |
| 19 #include "testing/gtest/include/gtest/gtest.h" | |
| 20 | |
| 21 namespace { | |
| 22 | |
| 23 const char kUrl[] = "https://foo.test"; | |
| 24 | |
| 25 class TestSecurityStateModelClient : public SecurityStateModelClient { | |
| 26 public: | |
| 27 TestSecurityStateModelClient() | |
| 28 : initial_security_level_(SecurityStateModel::SECURE), | |
| 29 connection_status_(net::SSL_CONNECTION_VERSION_TLS1_2 | |
| 30 << net::SSL_CONNECTION_VERSION_SHIFT), | |
| 31 cert_status_(net::CERT_STATUS_SHA1_SIGNATURE_PRESENT), | |
| 32 displayed_mixed_content_(false), | |
| 33 ran_mixed_content_(false) { | |
| 34 cert_ = | |
| 35 net::ImportCertFromFile(net::GetTestCertsDirectory(), "sha1_2016.pem"); | |
| 36 } | |
| 37 ~TestSecurityStateModelClient() override {} | |
| 38 | |
| 39 void set_connection_status(int connection_status) { | |
| 40 connection_status_ = connection_status; | |
| 41 } | |
| 42 void SetCipherSuite(uint16 ciphersuite) { | |
| 43 net::SSLConnectionStatusSetCipherSuite(ciphersuite, &connection_status_); | |
| 44 } | |
| 45 void AddCertStatus(net::CertStatus cert_status) { | |
| 46 cert_status_ |= cert_status; | |
| 47 } | |
| 48 void SetDisplayedMixedContent(bool displayed_mixed_content) { | |
| 49 displayed_mixed_content_ = displayed_mixed_content; | |
| 50 } | |
| 51 void SetRanMixedContent(bool ran_mixed_content) { | |
| 52 ran_mixed_content_ = ran_mixed_content; | |
| 53 } | |
| 54 void set_initial_security_level( | |
| 55 SecurityStateModel::SecurityLevel security_level) { | |
| 56 initial_security_level_ = security_level; | |
| 57 } | |
| 58 | |
| 59 // SecurityStateModelClient: | |
| 60 void GetVisibleSecurityState( | |
| 61 SecurityStateModel::VisibleSecurityState* state) override { | |
| 62 state->initialized = true; | |
| 63 state->url = GURL(kUrl); | |
| 64 state->initial_security_level = initial_security_level_; | |
| 65 state->cert_id = 1; | |
| 66 state->cert_status = cert_status_; | |
| 67 state->connection_status = connection_status_; | |
| 68 state->security_bits = 256; | |
| 69 state->displayed_mixed_content = displayed_mixed_content_; | |
| 70 state->ran_mixed_content = ran_mixed_content_; | |
| 71 } | |
| 72 | |
| 73 bool RetrieveCert(scoped_refptr<net::X509Certificate>* cert) override { | |
| 74 *cert = cert_; | |
| 75 return true; | |
| 76 } | |
| 77 | |
| 78 bool UsedPolicyInstalledCertificate() override { return false; } | |
| 79 | |
| 80 bool IsOriginSecure(const GURL& url) override { | |
| 81 return content::IsOriginSecure(url); | |
| 82 } | |
| 83 | |
| 84 private: | |
| 85 SecurityStateModel::SecurityLevel initial_security_level_; | |
| 86 scoped_refptr<net::X509Certificate> cert_; | |
| 87 int connection_status_; | |
| 88 net::CertStatus cert_status_; | |
| 89 bool displayed_mixed_content_; | |
| 90 bool ran_mixed_content_; | |
| 91 }; | |
| 92 | |
| 93 class SecurityStateModelTest : public ChromeRenderViewHostTestHarness {}; | |
| 94 | |
| 95 // Tests that SHA1-signed certificates expiring in 2016 downgrade the | |
| 96 // security state of the page. | |
| 97 TEST_F(SecurityStateModelTest, SHA1Warning) { | |
| 98 TestSecurityStateModelClient client; | |
| 99 SecurityStateModel model; | |
| 100 model.SetClient(&client); | |
| 101 const SecurityStateModel::SecurityInfo& security_info = | |
| 102 model.GetSecurityInfo(); | |
| 103 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, | |
| 104 security_info.sha1_deprecation_status); | |
| 105 EXPECT_EQ(SecurityStateModel::NONE, security_info.security_level); | |
| 106 } | |
| 107 | |
| 108 // Tests that SHA1 warnings don't interfere with the handling of mixed | |
| 109 // content. | |
| 110 TEST_F(SecurityStateModelTest, SHA1WarningMixedContent) { | |
| 111 TestSecurityStateModelClient client; | |
| 112 SecurityStateModel model; | |
| 113 model.SetClient(&client); | |
| 114 client.SetDisplayedMixedContent(true); | |
| 115 const SecurityStateModel::SecurityInfo& security_info1 = | |
| 116 model.GetSecurityInfo(); | |
| 117 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, | |
| 118 security_info1.sha1_deprecation_status); | |
| 119 EXPECT_EQ(SecurityStateModel::DISPLAYED_MIXED_CONTENT, | |
| 120 security_info1.mixed_content_status); | |
| 121 EXPECT_EQ(SecurityStateModel::NONE, security_info1.security_level); | |
| 122 | |
| 123 client.set_initial_security_level(SecurityStateModel::SECURITY_ERROR); | |
| 124 client.SetDisplayedMixedContent(false); | |
| 125 client.SetRanMixedContent(true); | |
| 126 const SecurityStateModel::SecurityInfo& security_info2 = | |
| 127 model.GetSecurityInfo(); | |
| 128 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, | |
| 129 security_info2.sha1_deprecation_status); | |
| 130 EXPECT_EQ(SecurityStateModel::RAN_MIXED_CONTENT, | |
| 131 security_info2.mixed_content_status); | |
| 132 EXPECT_EQ(SecurityStateModel::SECURITY_ERROR, security_info2.security_level); | |
| 133 } | |
| 134 | |
| 135 // Tests that SHA1 warnings don't interfere with the handling of major | |
| 136 // cert errors. | |
| 137 TEST_F(SecurityStateModelTest, SHA1WarningBrokenHTTPS) { | |
| 138 TestSecurityStateModelClient client; | |
| 139 SecurityStateModel model; | |
| 140 model.SetClient(&client); | |
| 141 client.set_initial_security_level(SecurityStateModel::SECURITY_ERROR); | |
| 142 client.AddCertStatus(net::CERT_STATUS_DATE_INVALID); | |
| 143 const SecurityStateModel::SecurityInfo& security_info = | |
| 144 model.GetSecurityInfo(); | |
| 145 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, | |
| 146 security_info.sha1_deprecation_status); | |
| 147 EXPECT_EQ(SecurityStateModel::SECURITY_ERROR, security_info.security_level); | |
| 148 } | |
| 149 | |
| 150 // Tests that |security_info.is_secure_protocol_and_ciphersuite| is | |
| 151 // computed correctly. | |
| 152 TEST_F(SecurityStateModelTest, SecureProtocolAndCiphersuite) { | |
| 153 TestSecurityStateModelClient client; | |
| 154 SecurityStateModel model; | |
| 155 model.SetClient(&client); | |
| 156 // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 from | |
| 157 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param
eters-4 | |
| 158 const uint16 ciphersuite = 0xc02f; | |
| 159 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_2 | |
| 160 << net::SSL_CONNECTION_VERSION_SHIFT); | |
| 161 client.SetCipherSuite(ciphersuite); | |
| 162 const SecurityStateModel::SecurityInfo& security_info = | |
| 163 model.GetSecurityInfo(); | |
| 164 EXPECT_TRUE(security_info.is_secure_protocol_and_ciphersuite); | |
| 165 } | |
| 166 | |
| 167 TEST_F(SecurityStateModelTest, NonsecureProtocol) { | |
| 168 TestSecurityStateModelClient client; | |
| 169 SecurityStateModel model; | |
| 170 model.SetClient(&client); | |
| 171 // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 from | |
| 172 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param
eters-4 | |
| 173 const uint16 ciphersuite = 0xc02f; | |
| 174 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_1 | |
| 175 << net::SSL_CONNECTION_VERSION_SHIFT); | |
| 176 client.SetCipherSuite(ciphersuite); | |
| 177 const SecurityStateModel::SecurityInfo& security_info = | |
| 178 model.GetSecurityInfo(); | |
| 179 EXPECT_FALSE(security_info.is_secure_protocol_and_ciphersuite); | |
| 180 } | |
| 181 | |
| 182 TEST_F(SecurityStateModelTest, NonsecureCiphersuite) { | |
| 183 TestSecurityStateModelClient client; | |
| 184 SecurityStateModel model; | |
| 185 model.SetClient(&client); | |
| 186 // TLS_RSA_WITH_AES_128_CCM_8 from | |
| 187 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param
eters-4 | |
| 188 const uint16 ciphersuite = 0xc0a0; | |
| 189 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_2 | |
| 190 << net::SSL_CONNECTION_VERSION_SHIFT); | |
| 191 client.SetCipherSuite(ciphersuite); | |
| 192 const SecurityStateModel::SecurityInfo& security_info = | |
| 193 model.GetSecurityInfo(); | |
| 194 EXPECT_FALSE(security_info.is_secure_protocol_and_ciphersuite); | |
| 195 } | |
| 196 | |
| 197 } // namespace | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1539043002:
Pull SecurityStateModel out into a component (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master