Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/ssl/security_state_model.h" | 5 #include "components/security_state/security_state_model.h" |
| 6 | 6 |
| 7 #include <stdint.h> | 7 #include <stdint.h> |
| 8 | 8 |
| 9 #include "chrome/browser/ssl/security_state_model_client.h" | 9 #include "components/security_state/security_state_model_client.h" |
| 10 #include "chrome/test/base/chrome_render_view_host_test_harness.h" | |
| 11 #include "chrome/test/base/testing_profile.h" | |
| 12 #include "content/public/browser/cert_store.h" | |
| 13 #include "content/public/common/origin_util.h" | |
| 14 #include "content/public/test/mock_render_process_host.h" | |
| 15 #include "content/public/test/test_browser_thread_bundle.h" | |
| 16 #include "net/base/test_data_directory.h" | 10 #include "net/base/test_data_directory.h" |
| 17 #include "net/cert/x509_certificate.h" | 11 #include "net/cert/x509_certificate.h" |
| 18 #include "net/ssl/ssl_connection_status_flags.h" | 12 #include "net/ssl/ssl_connection_status_flags.h" |
| 19 #include "net/test/cert_test_util.h" | 13 #include "net/test/cert_test_util.h" |
| 20 #include "net/test/test_certificate_data.h" | 14 #include "net/test/test_certificate_data.h" |
| 21 #include "testing/gtest/include/gtest/gtest.h" | 15 #include "testing/gtest/include/gtest/gtest.h" |
| 22 | 16 |
| 17 namespace security_state { | |
| 18 | |
| 23 namespace { | 19 namespace { |
| 24 | 20 |
| 25 const char kUrl[] = "https://foo.test"; | 21 const char kUrl[] = "https://foo.test"; |
| 26 | 22 |
| 27 class TestSecurityStateModelClient : public SecurityStateModelClient { | 23 class TestSecurityStateModelClient : public SecurityStateModelClient { |
| 28 public: | 24 public: |
| 29 TestSecurityStateModelClient() | 25 TestSecurityStateModelClient() |
| 30 : initial_security_level_(SecurityStateModel::SECURE), | 26 : initial_security_level_(SecurityStateModel::SECURE), |
| 31 connection_status_(net::SSL_CONNECTION_VERSION_TLS1_2 | 27 connection_status_(net::SSL_CONNECTION_VERSION_TLS1_2 |
| 32 << net::SSL_CONNECTION_VERSION_SHIFT), | 28 << net::SSL_CONNECTION_VERSION_SHIFT), |
| (...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 72 state->ran_mixed_content = ran_mixed_content_; | 68 state->ran_mixed_content = ran_mixed_content_; |
| 73 } | 69 } |
| 74 | 70 |
| 75 bool RetrieveCert(scoped_refptr<net::X509Certificate>* cert) override { | 71 bool RetrieveCert(scoped_refptr<net::X509Certificate>* cert) override { |
| 76 *cert = cert_; | 72 *cert = cert_; |
| 77 return true; | 73 return true; |
| 78 } | 74 } |
| 79 | 75 |
| 80 bool UsedPolicyInstalledCertificate() override { return false; } | 76 bool UsedPolicyInstalledCertificate() override { return false; } |
| 81 | 77 |
| 82 bool IsOriginSecure(const GURL& url) override { | 78 bool IsOriginSecure(const GURL& url) override { return true; } |
|
eroman
2016/01/11 18:12:12
Without knowing more about this test, why is this
estark
2016/01/11 18:15:52
The former (all tests are using secure origins). I
| |
| 83 return content::IsOriginSecure(url); | |
| 84 } | |
| 85 | 79 |
| 86 private: | 80 private: |
| 87 SecurityStateModel::SecurityLevel initial_security_level_; | 81 SecurityStateModel::SecurityLevel initial_security_level_; |
| 88 scoped_refptr<net::X509Certificate> cert_; | 82 scoped_refptr<net::X509Certificate> cert_; |
| 89 int connection_status_; | 83 int connection_status_; |
| 90 net::CertStatus cert_status_; | 84 net::CertStatus cert_status_; |
| 91 bool displayed_mixed_content_; | 85 bool displayed_mixed_content_; |
| 92 bool ran_mixed_content_; | 86 bool ran_mixed_content_; |
| 93 }; | 87 }; |
| 94 | 88 |
| 95 class SecurityStateModelTest : public ChromeRenderViewHostTestHarness {}; | |
| 96 | |
| 97 // Tests that SHA1-signed certificates expiring in 2016 downgrade the | 89 // Tests that SHA1-signed certificates expiring in 2016 downgrade the |
| 98 // security state of the page. | 90 // security state of the page. |
| 99 TEST_F(SecurityStateModelTest, SHA1Warning) { | 91 TEST(SecurityStateModelTest, SHA1Warning) { |
| 100 TestSecurityStateModelClient client; | 92 TestSecurityStateModelClient client; |
| 101 SecurityStateModel model; | 93 SecurityStateModel model; |
| 102 model.SetClient(&client); | 94 model.SetClient(&client); |
| 103 const SecurityStateModel::SecurityInfo& security_info = | 95 const SecurityStateModel::SecurityInfo& security_info = |
| 104 model.GetSecurityInfo(); | 96 model.GetSecurityInfo(); |
| 105 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, | 97 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, |
| 106 security_info.sha1_deprecation_status); | 98 security_info.sha1_deprecation_status); |
| 107 EXPECT_EQ(SecurityStateModel::NONE, security_info.security_level); | 99 EXPECT_EQ(SecurityStateModel::NONE, security_info.security_level); |
| 108 } | 100 } |
| 109 | 101 |
| 110 // Tests that SHA1 warnings don't interfere with the handling of mixed | 102 // Tests that SHA1 warnings don't interfere with the handling of mixed |
| 111 // content. | 103 // content. |
| 112 TEST_F(SecurityStateModelTest, SHA1WarningMixedContent) { | 104 TEST(SecurityStateModelTest, SHA1WarningMixedContent) { |
| 113 TestSecurityStateModelClient client; | 105 TestSecurityStateModelClient client; |
| 114 SecurityStateModel model; | 106 SecurityStateModel model; |
| 115 model.SetClient(&client); | 107 model.SetClient(&client); |
| 116 client.SetDisplayedMixedContent(true); | 108 client.SetDisplayedMixedContent(true); |
| 117 const SecurityStateModel::SecurityInfo& security_info1 = | 109 const SecurityStateModel::SecurityInfo& security_info1 = |
| 118 model.GetSecurityInfo(); | 110 model.GetSecurityInfo(); |
| 119 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, | 111 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, |
| 120 security_info1.sha1_deprecation_status); | 112 security_info1.sha1_deprecation_status); |
| 121 EXPECT_EQ(SecurityStateModel::DISPLAYED_MIXED_CONTENT, | 113 EXPECT_EQ(SecurityStateModel::DISPLAYED_MIXED_CONTENT, |
| 122 security_info1.mixed_content_status); | 114 security_info1.mixed_content_status); |
| 123 EXPECT_EQ(SecurityStateModel::NONE, security_info1.security_level); | 115 EXPECT_EQ(SecurityStateModel::NONE, security_info1.security_level); |
| 124 | 116 |
| 125 client.set_initial_security_level(SecurityStateModel::SECURITY_ERROR); | 117 client.set_initial_security_level(SecurityStateModel::SECURITY_ERROR); |
| 126 client.SetDisplayedMixedContent(false); | 118 client.SetDisplayedMixedContent(false); |
| 127 client.SetRanMixedContent(true); | 119 client.SetRanMixedContent(true); |
| 128 const SecurityStateModel::SecurityInfo& security_info2 = | 120 const SecurityStateModel::SecurityInfo& security_info2 = |
| 129 model.GetSecurityInfo(); | 121 model.GetSecurityInfo(); |
| 130 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, | 122 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, |
| 131 security_info2.sha1_deprecation_status); | 123 security_info2.sha1_deprecation_status); |
| 132 EXPECT_EQ(SecurityStateModel::RAN_MIXED_CONTENT, | 124 EXPECT_EQ(SecurityStateModel::RAN_MIXED_CONTENT, |
| 133 security_info2.mixed_content_status); | 125 security_info2.mixed_content_status); |
| 134 EXPECT_EQ(SecurityStateModel::SECURITY_ERROR, security_info2.security_level); | 126 EXPECT_EQ(SecurityStateModel::SECURITY_ERROR, security_info2.security_level); |
| 135 } | 127 } |
| 136 | 128 |
| 137 // Tests that SHA1 warnings don't interfere with the handling of major | 129 // Tests that SHA1 warnings don't interfere with the handling of major |
| 138 // cert errors. | 130 // cert errors. |
| 139 TEST_F(SecurityStateModelTest, SHA1WarningBrokenHTTPS) { | 131 TEST(SecurityStateModelTest, SHA1WarningBrokenHTTPS) { |
| 140 TestSecurityStateModelClient client; | 132 TestSecurityStateModelClient client; |
| 141 SecurityStateModel model; | 133 SecurityStateModel model; |
| 142 model.SetClient(&client); | 134 model.SetClient(&client); |
| 143 client.set_initial_security_level(SecurityStateModel::SECURITY_ERROR); | 135 client.set_initial_security_level(SecurityStateModel::SECURITY_ERROR); |
| 144 client.AddCertStatus(net::CERT_STATUS_DATE_INVALID); | 136 client.AddCertStatus(net::CERT_STATUS_DATE_INVALID); |
| 145 const SecurityStateModel::SecurityInfo& security_info = | 137 const SecurityStateModel::SecurityInfo& security_info = |
| 146 model.GetSecurityInfo(); | 138 model.GetSecurityInfo(); |
| 147 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, | 139 EXPECT_EQ(SecurityStateModel::DEPRECATED_SHA1_MINOR, |
| 148 security_info.sha1_deprecation_status); | 140 security_info.sha1_deprecation_status); |
| 149 EXPECT_EQ(SecurityStateModel::SECURITY_ERROR, security_info.security_level); | 141 EXPECT_EQ(SecurityStateModel::SECURITY_ERROR, security_info.security_level); |
| 150 } | 142 } |
| 151 | 143 |
| 152 // Tests that |security_info.is_secure_protocol_and_ciphersuite| is | 144 // Tests that |security_info.is_secure_protocol_and_ciphersuite| is |
| 153 // computed correctly. | 145 // computed correctly. |
| 154 TEST_F(SecurityStateModelTest, SecureProtocolAndCiphersuite) { | 146 TEST(SecurityStateModelTest, SecureProtocolAndCiphersuite) { |
| 155 TestSecurityStateModelClient client; | 147 TestSecurityStateModelClient client; |
| 156 SecurityStateModel model; | 148 SecurityStateModel model; |
| 157 model.SetClient(&client); | 149 model.SetClient(&client); |
| 158 // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 from | 150 // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 from |
| 159 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param eters-4 | 151 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param eters-4 |
| 160 const uint16_t ciphersuite = 0xc02f; | 152 const uint16_t ciphersuite = 0xc02f; |
| 161 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_2 | 153 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_2 |
| 162 << net::SSL_CONNECTION_VERSION_SHIFT); | 154 << net::SSL_CONNECTION_VERSION_SHIFT); |
| 163 client.SetCipherSuite(ciphersuite); | 155 client.SetCipherSuite(ciphersuite); |
| 164 const SecurityStateModel::SecurityInfo& security_info = | 156 const SecurityStateModel::SecurityInfo& security_info = |
| 165 model.GetSecurityInfo(); | 157 model.GetSecurityInfo(); |
| 166 EXPECT_TRUE(security_info.is_secure_protocol_and_ciphersuite); | 158 EXPECT_TRUE(security_info.is_secure_protocol_and_ciphersuite); |
| 167 } | 159 } |
| 168 | 160 |
| 169 TEST_F(SecurityStateModelTest, NonsecureProtocol) { | 161 TEST(SecurityStateModelTest, NonsecureProtocol) { |
| 170 TestSecurityStateModelClient client; | 162 TestSecurityStateModelClient client; |
| 171 SecurityStateModel model; | 163 SecurityStateModel model; |
| 172 model.SetClient(&client); | 164 model.SetClient(&client); |
| 173 // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 from | 165 // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 from |
| 174 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param eters-4 | 166 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param eters-4 |
| 175 const uint16_t ciphersuite = 0xc02f; | 167 const uint16_t ciphersuite = 0xc02f; |
| 176 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_1 | 168 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_1 |
| 177 << net::SSL_CONNECTION_VERSION_SHIFT); | 169 << net::SSL_CONNECTION_VERSION_SHIFT); |
| 178 client.SetCipherSuite(ciphersuite); | 170 client.SetCipherSuite(ciphersuite); |
| 179 const SecurityStateModel::SecurityInfo& security_info = | 171 const SecurityStateModel::SecurityInfo& security_info = |
| 180 model.GetSecurityInfo(); | 172 model.GetSecurityInfo(); |
| 181 EXPECT_FALSE(security_info.is_secure_protocol_and_ciphersuite); | 173 EXPECT_FALSE(security_info.is_secure_protocol_and_ciphersuite); |
| 182 } | 174 } |
| 183 | 175 |
| 184 TEST_F(SecurityStateModelTest, NonsecureCiphersuite) { | 176 TEST(SecurityStateModelTest, NonsecureCiphersuite) { |
| 185 TestSecurityStateModelClient client; | 177 TestSecurityStateModelClient client; |
| 186 SecurityStateModel model; | 178 SecurityStateModel model; |
| 187 model.SetClient(&client); | 179 model.SetClient(&client); |
| 188 // TLS_RSA_WITH_AES_128_CCM_8 from | 180 // TLS_RSA_WITH_AES_128_CCM_8 from |
| 189 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param eters-4 | 181 // http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-param eters-4 |
| 190 const uint16_t ciphersuite = 0xc0a0; | 182 const uint16_t ciphersuite = 0xc0a0; |
| 191 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_2 | 183 client.set_connection_status(net::SSL_CONNECTION_VERSION_TLS1_2 |
| 192 << net::SSL_CONNECTION_VERSION_SHIFT); | 184 << net::SSL_CONNECTION_VERSION_SHIFT); |
| 193 client.SetCipherSuite(ciphersuite); | 185 client.SetCipherSuite(ciphersuite); |
| 194 const SecurityStateModel::SecurityInfo& security_info = | 186 const SecurityStateModel::SecurityInfo& security_info = |
| 195 model.GetSecurityInfo(); | 187 model.GetSecurityInfo(); |
| 196 EXPECT_FALSE(security_info.is_secure_protocol_and_ciphersuite); | 188 EXPECT_FALSE(security_info.is_secure_protocol_and_ciphersuite); |
| 197 } | 189 } |
| 198 | 190 |
| 199 } // namespace | 191 } // namespace |
| 192 | |
| 193 } // namespace security_state | |
| OLD | NEW |