Blimp: add support for SSL connections.

blimp/client/session/assignment_source_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "blimp/client/session/assignment_source.h"
 
 #include "base/command_line.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
+#include "base/message_loop/message_loop.h"
+#include "base/path_service.h"
+#include "base/run_loop.h"
 #include "base/test/test_simple_task_runner.h"
 #include "base/thread_task_runner_handle.h"
 #include "base/values.h"
 #include "blimp/client/app/blimp_client_switches.h"
 #include "blimp/common/protocol_version.h"
+#include "components/safe_json/testing_json_parser.h"
+#include "net/base/test_data_directory.h"
 #include "net/url_request/test_url_fetcher_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using testing::_;
+using testing::DoAll;
 using testing::InSequence;
+using testing::NotNull;
+using testing::Return;
+using testing::SetArgPointee;
 
 namespace blimp {
 namespace client {
 namespace {
 
+const uint8_t kTestIPAddressStringAddress[] = {127, 0, 0, 1};
+const uint16_t kTestPort = 8086;
+const char kTestIPAddressString[] = "127.0.0.1";
+const char kTCPTransportName[] = "tcp";
+const char kSSLTransportName[] = "ssl";
+const char kCertRelativePath[] =
+    "blimp/client/session/test_selfsigned_cert.pem";
+
 MATCHER_P(AssignmentEquals, assignment, "") {
   return arg.transport_protocol == assignment.transport_protocol &&
-         arg.ip_endpoint == assignment.ip_endpoint &&
+         arg.engine_endpoint == assignment.engine_endpoint &&
          arg.client_token == assignment.client_token &&
-         arg.certificate == assignment.certificate &&
-         arg.certificate_fingerprint == assignment.certificate_fingerprint;
+         ((!assignment.cert && !arg.cert) ||
+          (arg.cert && assignment.cert &&
+           arg.cert->Equals(assignment.cert.get())));
 }
 
-net::IPEndPoint BuildIPEndPoint(const std::string& ip, int port) {
-  net::IPAddress ip_address;
-  EXPECT_TRUE(ip_address.AssignFromIPLiteral(ip));
-
-  return net::IPEndPoint(ip_address, port);
-}
-
-Assignment BuildValidAssignment() {
-  Assignment assignment;
-  assignment.transport_protocol = Assignment::TransportProtocol::SSL;
-  assignment.ip_endpoint = BuildIPEndPoint("100.150.200.250", 500);
-  assignment.client_token = "SecretT0kenz";
-  assignment.certificate_fingerprint = "WhaleWhaleWhale";
-  assignment.certificate = "whaaaaaaaaaaaaale";
-  return assignment;
-}
-
-std::string BuildResponseFromAssignment(const Assignment& assignment) {
+// Builds simulated JSON response from the Assigner service.
+// |assignment|: The Assignment to convert.
+// |expected_cert_str|: The PEM encoded certificate to include in the response.
+std::string BuildResponseFromAssignment(const Assignment& assignment,
+                                        const std::string& expected_cert_str) {

[Wez, 2016/03/02 02:26:45]

nit: AFAICT all the calls to this API get passed the result of
BuildValidAssignment(), and cert_pem_, so you could make this a zero-parameter
method of the test base.

[Kevin M, 2016/03/02 18:05:34]

Good suggestion, done.

   base::DictionaryValue dict;
   dict.SetString("clientToken", assignment.client_token);
-  dict.SetString("host", assignment.ip_endpoint.address().ToString());
-  dict.SetInteger("port", assignment.ip_endpoint.port());
-  dict.SetString("certificateFingerprint", assignment.certificate_fingerprint);
-  dict.SetString("certificate", assignment.certificate);
+  dict.SetString("host", assignment.engine_endpoint.address().ToString());
+  dict.SetInteger("port", assignment.engine_endpoint.port());
+  dict.SetString("certificate", expected_cert_str);
 
   std::string json;
   base::JSONWriter::Write(dict, &json);
   return json;
 }
 
 class AssignmentSourceTest : public testing::Test {
  public:
   AssignmentSourceTest()
-      : task_runner_(new base::TestSimpleTaskRunner),
-        task_runner_handle_(task_runner_),
-        source_(task_runner_, task_runner_) {}
+      : source_(message_loop_.task_runner(), message_loop_.task_runner()) {}
+
+  void SetUp() override {
+    base::FilePath src_root;
+    PathService::Get(base::DIR_SOURCE_ROOT, &src_root);

[Wez, 2016/03/02 02:26:45]

nit: ASSERT_TRUE this as well.

[Kevin M, 2016/03/02 18:05:34]

Done.

+    cert_path_ = src_root.Append(kCertRelativePath);
+    ASSERT_TRUE(base::ReadFileToString(cert_path_, &cert_pem_));
+    cert_ = std::move(net::X509Certificate::CreateCertificateListFromBytes(
+        cert_pem_.data(), cert_pem_.size(),
+        net::X509Certificate::FORMAT_PEM_CERT_SEQUENCE)[0]);

[Wez, 2016/03/02 02:26:45]

nit: ASSERT_TRUE that |cert_| is not empty?

[Kevin M, 2016/03/02 18:05:34]

Done.

+  }
 
   // This expects the AssignmentSource::GetAssignment to return a custom
   // endpoint without having to hit the network.  This will typically be used
   // for testing that specifying an assignment via the command line works as
   // expected.
   void GetAlternateAssignment() {
     source_.GetAssignment("",
                           base::Bind(&AssignmentSourceTest::AssignmentResponse,
                                      base::Unretained(this)));
     EXPECT_EQ(nullptr, factory_.GetFetcherByID(0));
-    task_runner_->RunUntilIdle();
+    base::RunLoop().RunUntilIdle();
   }
 
   // See net/base/net_errors.h for possible status errors.
   void GetNetworkAssignmentAndWaitForResponse(
       net::HttpStatusCode response_code,
       int status,
       const std::string& response,
       const std::string& client_auth_token,
       const std::string& protocol_version) {
     source_.GetAssignment(client_auth_token,
                           base::Bind(&AssignmentSourceTest::AssignmentResponse,
                                      base::Unretained(this)));
+    base::RunLoop().RunUntilIdle();
 
     net::TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
 
-    task_runner_->RunUntilIdle();
-
     EXPECT_NE(nullptr, fetcher);
     EXPECT_EQ(kDefaultAssignerURL, fetcher->GetOriginalURL().spec());
 
     // Check that the request has a valid protocol_version.
     scoped_ptr<base::Value> json =
         base::JSONReader::Read(fetcher->upload_data());
     EXPECT_NE(nullptr, json.get());
 
     const base::DictionaryValue* dict;
     EXPECT_TRUE(json->GetAsDictionary(&dict));
@@ skipping 10 matching lines @@
     std::string authorization;
     EXPECT_TRUE(headers.GetHeader("Authorization", &authorization));
     EXPECT_EQ("Bearer " + client_auth_token, authorization);
 
     // Send the fake response back.
     fetcher->set_response_code(response_code);
     fetcher->set_status(net::URLRequestStatus::FromError(status));
     fetcher->SetResponseString(response);
     fetcher->delegate()->OnURLFetchComplete(fetcher);
 
-    task_runner_->RunUntilIdle();
+    base::RunLoop().RunUntilIdle();
   }
 
   MOCK_METHOD2(AssignmentResponse,
                void(AssignmentSource::Result, const Assignment&));
 
  protected:
+  Assignment BuildValidAssignment();

[Wez, 2016/03/02 02:26:45]

nit: Suggest renaming this to BuildSslAssignment(), since that's what it does,
for clarity. :)

[Kevin M, 2016/03/02 18:05:34]

Done.

+
   // Used to drive all AssignmentSource tasks.
-  scoped_refptr<base::TestSimpleTaskRunner> task_runner_;
-  base::ThreadTaskRunnerHandle task_runner_handle_;
+  // MessageLoop is required by TestingJsonParser's self-deletion logic.
+  // TODO(bauerb): Replace this with a TestSimpleTaskRunner once
+  // TestingJsonParser no longer requires having a MessageLoop.
+  base::MessageLoop message_loop_;
 
   net::TestURLFetcherFactory factory_;
 
+  base::ScopedTempDir temp_dir_;

[Wez, 2016/03/02 02:26:45]

nit: Doesn't look like this is used any more?

[Kevin M, 2016/03/02 18:05:34]

Done.

+
+  // Path to the PEM-encoded certificate chain.
+  base::FilePath cert_path_;
+
+  // Payload of PEM certificate chain at |cert_path_|.
+  std::string cert_pem_;
+
+  // X509 certificate decoded from |cert_path_|.
+  scoped_refptr<net::X509Certificate> cert_;
+
   AssignmentSource source_;
+
+  safe_json::TestingJsonParser::ScopedFactoryOverride json_parsing_factory_;

[Wez, 2016/03/02 02:26:45]

nit: One-line comment to explain this?

[Kevin M, 2016/03/02 18:05:34]

Done.

 };
 
+Assignment AssignmentSourceTest::BuildValidAssignment() {
+  Assignment assignment;
+  assignment.transport_protocol = Assignment::TransportProtocol::SSL;
+  assignment.engine_endpoint =
+      net::IPEndPoint(kTestIPAddressStringAddress, kTestPort);
+  assignment.client_token = "SecretT0kenz";
+  assignment.cert = cert_;
+  return assignment;
+}
+
 TEST_F(AssignmentSourceTest, TestTCPAlternateEndpointSuccess) {
   Assignment assignment;
   assignment.transport_protocol = Assignment::TransportProtocol::TCP;
-  assignment.ip_endpoint = BuildIPEndPoint("100.150.200.250", 500);
+  assignment.engine_endpoint =
+      net::IPEndPoint(kTestIPAddressStringAddress, kTestPort);
   assignment.client_token = kDummyClientToken;
+  assignment.cert = scoped_refptr<net::X509Certificate>(nullptr);
 
   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-      switches::kBlimpletEndpoint, "tcp:100.150.200.250:500");
+      switches::kEngineIP, kTestIPAddressString);
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kEnginePort, std::to_string(kTestPort));
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kEngineTransport, kTCPTransportName);
 
   EXPECT_CALL(*this, AssignmentResponse(AssignmentSource::Result::RESULT_OK,
                                         AssignmentEquals(assignment)))
       .Times(1);
 
   GetAlternateAssignment();
 }
 
 TEST_F(AssignmentSourceTest, TestSSLAlternateEndpointSuccess) {
   Assignment assignment;
   assignment.transport_protocol = Assignment::TransportProtocol::SSL;
-  assignment.ip_endpoint = BuildIPEndPoint("100.150.200.250", 500);
+  assignment.engine_endpoint =
+      net::IPEndPoint(kTestIPAddressStringAddress, kTestPort);
   assignment.client_token = kDummyClientToken;
+  assignment.cert = cert_;
 
   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-      switches::kBlimpletEndpoint, "ssl:100.150.200.250:500");
+      switches::kEngineIP, kTestIPAddressString);
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kEnginePort, std::to_string(kTestPort));
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kEngineTransport, kSSLTransportName);
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kEngineCertPath, cert_path_.value());
 
   EXPECT_CALL(*this, AssignmentResponse(AssignmentSource::Result::RESULT_OK,
                                         AssignmentEquals(assignment)))
-      .Times(1);
-
-  GetAlternateAssignment();
-}
-
-TEST_F(AssignmentSourceTest, TestQUICAlternateEndpointSuccess) {
-  Assignment assignment;
-  assignment.transport_protocol = Assignment::TransportProtocol::QUIC;
-  assignment.ip_endpoint = BuildIPEndPoint("100.150.200.250", 500);
-  assignment.client_token = kDummyClientToken;
-
-  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-      switches::kBlimpletEndpoint, "quic:100.150.200.250:500");
-
-  EXPECT_CALL(*this, AssignmentResponse(AssignmentSource::Result::RESULT_OK,
-                                        AssignmentEquals(assignment)))
       .Times(1);
 
   GetAlternateAssignment();
 }
 
 TEST_F(AssignmentSourceTest, TestSuccess) {
   Assignment assignment = BuildValidAssignment();
 
   EXPECT_CALL(*this, AssignmentResponse(AssignmentSource::Result::RESULT_OK,
                                         AssignmentEquals(assignment)))
       .Times(1);
 
   GetNetworkAssignmentAndWaitForResponse(
-      net::HTTP_OK, net::Error::OK, BuildResponseFromAssignment(assignment),
-      "UserAuthT0kenz", kEngineVersion);
-}
-
-TEST_F(AssignmentSourceTest, TestSecondRequestInterruptsFirst) {
-  InSequence sequence;
-  Assignment assignment = BuildValidAssignment();
-
-  source_.GetAssignment("",
-                        base::Bind(&AssignmentSourceTest::AssignmentResponse,
-                                   base::Unretained(this)));
-
-  EXPECT_CALL(*this, AssignmentResponse(
-                         AssignmentSource::Result::RESULT_SERVER_INTERRUPTED,
-                         AssignmentEquals(Assignment())))
-      .Times(1)
-      .RetiresOnSaturation();
-
-  EXPECT_CALL(*this, AssignmentResponse(AssignmentSource::Result::RESULT_OK,
-                                        AssignmentEquals(assignment)))
-      .Times(1)
-      .RetiresOnSaturation();
-
-  GetNetworkAssignmentAndWaitForResponse(
-      net::HTTP_OK, net::Error::OK, BuildResponseFromAssignment(assignment),
-      "UserAuthT0kenz", kEngineVersion);
+      net::HTTP_OK, net::Error::OK,
+      BuildResponseFromAssignment(assignment, cert_pem_), "UserAuthT0kenz",

[Wez, 2016/03/02 02:26:45]

nit: Move this token value into a constant?

[Kevin M, 2016/03/02 18:05:34]

Done.

+      kEngineVersion);
 }
 
 TEST_F(AssignmentSourceTest, TestValidAfterError) {
   InSequence sequence;
   Assignment assignment = BuildValidAssignment();
 
   EXPECT_CALL(*this, AssignmentResponse(
                          AssignmentSource::Result::RESULT_NETWORK_FAILURE, _))
       .Times(1)
       .RetiresOnSaturation();
 
   EXPECT_CALL(*this, AssignmentResponse(AssignmentSource::Result::RESULT_OK,
                                         AssignmentEquals(assignment)))
       .Times(1)
       .RetiresOnSaturation();
 
   GetNetworkAssignmentAndWaitForResponse(net::HTTP_OK,
                                          net::Error::ERR_INSUFFICIENT_RESOURCES,
                                          "", "UserAuthT0kenz", kEngineVersion);
 
   GetNetworkAssignmentAndWaitForResponse(
-      net::HTTP_OK, net::Error::OK, BuildResponseFromAssignment(assignment),
-      "UserAuthT0kenz", kEngineVersion);
+      net::HTTP_OK, net::Error::OK,
+      BuildResponseFromAssignment(assignment, cert_pem_), "UserAuthT0kenz",
+      kEngineVersion);
 }
 
 TEST_F(AssignmentSourceTest, TestNetworkFailure) {
   EXPECT_CALL(*this, AssignmentResponse(
                          AssignmentSource::Result::RESULT_NETWORK_FAILURE, _));
   GetNetworkAssignmentAndWaitForResponse(net::HTTP_OK,
                                          net::Error::ERR_INSUFFICIENT_RESOURCES,
                                          "", "UserAuthT0kenz", kEngineVersion);
 }
 
@@ skipping 40 matching lines @@
                          AssignmentSource::Result::RESULT_BAD_RESPONSE, _));
   GetNetworkAssignmentAndWaitForResponse(net::HTTP_NOT_IMPLEMENTED,
                                          net::Error::OK, "", "UserAuthT0kenz",
                                          kEngineVersion);
 }
 
 TEST_F(AssignmentSourceTest, TestInvalidJsonResponse) {
   Assignment assignment = BuildValidAssignment();
 
   // Remove half the response.
-  std::string response = BuildResponseFromAssignment(assignment);
+  std::string response = BuildResponseFromAssignment(assignment, cert_pem_);
   response = response.substr(response.size() / 2);
 
   EXPECT_CALL(*this, AssignmentResponse(
                          AssignmentSource::Result::RESULT_BAD_RESPONSE, _));
   GetNetworkAssignmentAndWaitForResponse(net::HTTP_OK, net::Error::OK, response,
                                          "UserAuthT0kenz", kEngineVersion);
 }
 
 TEST_F(AssignmentSourceTest, TestMissingResponsePort) {
   // Purposely do not add the 'port' field to the response.
   base::DictionaryValue dict;
   dict.SetString("clientToken", "SecretT0kenz");
   dict.SetString("host", "happywhales");
-  dict.SetString("certificateFingerprint", "WhaleWhaleWhale");
   dict.SetString("certificate", "whaaaaaaaaaaaaale");
 
   std::string response;
   base::JSONWriter::Write(dict, &response);
 
   EXPECT_CALL(*this, AssignmentResponse(
                          AssignmentSource::Result::RESULT_BAD_RESPONSE, _));
   GetNetworkAssignmentAndWaitForResponse(net::HTTP_OK, net::Error::OK, response,
                                          "UserAuthT0kenz", kEngineVersion);
 }
 
 TEST_F(AssignmentSourceTest, TestInvalidIPAddress) {
   // Purposely add an invalid IP field to the response.
   base::DictionaryValue dict;
   dict.SetString("clientToken", "SecretT0kenz");
   dict.SetString("host", "happywhales");
   dict.SetInteger("port", 500);
-  dict.SetString("certificateFingerprint", "WhaleWhaleWhale");
   dict.SetString("certificate", "whaaaaaaaaaaaaale");
 
   std::string response;
   base::JSONWriter::Write(dict, &response);
 
   EXPECT_CALL(*this, AssignmentResponse(
                          AssignmentSource::Result::RESULT_BAD_RESPONSE, _));
   GetNetworkAssignmentAndWaitForResponse(net::HTTP_OK, net::Error::OK, response,
                                          "UserAuthT0kenz", kEngineVersion);
 }
 
+TEST_F(AssignmentSourceTest, TestMissingCert) {
+  base::DictionaryValue dict;
+  dict.SetString("clientToken", "SecretT0kenz");
+  dict.SetString("host", "127.0.0.1");
+  dict.SetInteger("port", 500);

[Wez, 2016/03/02 02:26:45]

nit: You could just call BuildResponse...() and then Remove("certificate",
nullptr) here, and in the other "missing field" tests, which would make them
easier to grok.

[Kevin M, 2016/03/02 18:05:34]

Done.

+
+  std::string response;
+  base::JSONWriter::Write(dict, &response);
+
+  EXPECT_CALL(*this, AssignmentResponse(
+                         AssignmentSource::Result::RESULT_BAD_RESPONSE, _));
+  GetNetworkAssignmentAndWaitForResponse(net::HTTP_OK, net::Error::OK, response,
+                                         "UserAuthT0kenz", kEngineVersion);
+}
+
+TEST_F(AssignmentSourceTest, TestInvalidCert) {
+  base::DictionaryValue dict;
+  dict.SetString("clientToken", "SecretT0kenz");
+  dict.SetString("host", "127.0.0.1");
+  dict.SetInteger("port", 500);
+  dict.SetString("certificate", "h4x0r c3r7");
+
+  std::string response;
+  base::JSONWriter::Write(dict, &response);
+
+  EXPECT_CALL(*this, AssignmentResponse(
+                         AssignmentSource::Result::RESULT_INVALID_CERT, _));
+  GetNetworkAssignmentAndWaitForResponse(net::HTTP_OK, net::Error::OK, response,
+                                         "UserAuthT0kenz", kEngineVersion);
+}
+
 }  // namespace
 }  // namespace client
 }  // namespace blimp