Allow ${CERT_SAN_EMAIL} and ${CERT_SAN_UPN} in the ONC Identity field

chromeos/network/client_cert_resolver_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "chromeos/network/client_cert_resolver.h"
 
 #include <cert.h>
 #include <pk11pub.h>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 90 matching lines @@
       int slot_id = 0;
       const std::string pkcs11_id =
           CertLoader::GetPkcs11IdAndSlotForCert(*test_client_cert_, &slot_id);
       test_cert_id_ = base::StringPrintf("%i:%s", slot_id, pkcs11_id.c_str());
     }
   }
 
   // Imports a client certificate. Its PKCS#11 ID is stored in |test_cert_id_|.
   // If |import_issuer| is true, also imports the CA cert (stored as PEM in
   // test_ca_cert_pem_) that issued the client certificate.
-  void SetupTestCerts(bool import_issuer) {
+  void SetupTestCerts(const std::string& prefix, bool import_issuer) {
     // Load a CA cert.
     net::CertificateList ca_cert_list = net::CreateCertificateListFromFile(
-        net::GetTestCertsDirectory(), "client_1_ca.pem",
+        net::GetTestCertsDirectory(), prefix + "_ca.pem",
         net::X509Certificate::FORMAT_AUTO);
     ASSERT_TRUE(!ca_cert_list.empty());
     net::X509Certificate::GetPEMEncoded(ca_cert_list[0]->os_cert_handle(),
                                         &test_ca_cert_pem_);
     ASSERT_TRUE(!test_ca_cert_pem_.empty());
 
     if (import_issuer) {
       net::NSSCertDatabase::ImportCertFailureList failures;
       EXPECT_TRUE(test_nsscertdb_->ImportCACerts(
           ca_cert_list, net::NSSCertDatabase::TRUST_DEFAULT, &failures));
       ASSERT_TRUE(failures.empty())
           << net::ErrorToString(failures[0].net_error);
     }
 
     // Import a client cert signed by that CA.
-    test_client_cert_ =
-        net::ImportClientCertAndKeyFromFile(net::GetTestCertsDirectory(),
-                                            "client_1.pem",
-                                            "client_1.pk8",
-                                            test_nssdb_.slot());
+    test_client_cert_ = net::ImportClientCertAndKeyFromFile(
+        net::GetTestCertsDirectory(), prefix + ".pem", prefix + ".pk8",
+        test_nssdb_.slot());
     ASSERT_TRUE(test_client_cert_.get());
   }
 
   void SetupNetworkHandlers() {
     network_state_handler_.reset(NetworkStateHandler::InitializeForTest());
     network_profile_handler_.reset(new NetworkProfileHandler());
     network_config_handler_.reset(new NetworkConfigurationHandler());
     managed_config_handler_.reset(new ManagedNetworkConfigurationHandlerImpl());
     client_cert_resolver_.reset(new ClientCertResolver());
 
@@ skipping 68 matching lines @@
     ASSERT_TRUE(policy_value->GetAsList(&policy));
 
     managed_config_handler_->SetPolicy(
         onc::ONC_SOURCE_USER_POLICY, kUserHash, *policy,
         base::DictionaryValue() /* no global network config */);
   }
 
   // Sets up a policy with a certificate pattern that matches any client cert
   // that is signed by the test CA cert (stored in |test_ca_cert_pem_|). In
   // particular it will match the test client cert.
-  void SetupPolicyMatchingIssuerPEM() {
+  void SetupPolicyMatchingIssuerPEM(const std::string& identity) {
     const char* kTestPolicyTemplate =
         "[ { \"GUID\": \"wifi_stub\","
         "    \"Name\": \"wifi_stub\","
         "    \"Type\": \"WiFi\","
         "    \"WiFi\": {"
         "      \"Security\": \"WPA-EAP\","
         "      \"SSID\": \"wifi_ssid\","
         "      \"EAP\": {"
+        "        \"Identity\": \"%s\","
         "        \"Outer\": \"EAP-TLS\","
         "        \"ClientCertType\": \"Pattern\","
         "        \"ClientCertPattern\": {"
         "          \"IssuerCAPEMs\": [ \"%s\" ]"
         "        }"
         "      }"
         "    }"
         "} ]";
-    std::string policy_json =
-        base::StringPrintf(kTestPolicyTemplate, test_ca_cert_pem_.c_str());
+    std::string policy_json = base::StringPrintf(
+        kTestPolicyTemplate, identity.c_str(), test_ca_cert_pem_.c_str());
 
     std::string error;
     scoped_ptr<base::Value> policy_value = base::JSONReader::ReadAndReturnError(
         policy_json, base::JSON_ALLOW_TRAILING_COMMAS, nullptr, &error);
     ASSERT_TRUE(policy_value) << error;
 
     base::ListValue* policy = nullptr;
     ASSERT_TRUE(policy_value->GetAsList(&policy));
 
     managed_config_handler_->SetPolicy(
         onc::ONC_SOURCE_USER_POLICY,
         kUserHash,
         *policy,
         base::DictionaryValue() /* no global network config */);
   }
 
   void SetWifiState(const std::string& state) {
     ASSERT_TRUE(service_test_->SetServiceProperty(
         kWifiStub, shill::kStateProperty, base::StringValue(state)));
   }
 
-  void GetClientCertProperties(std::string* pkcs11_id) {
-    pkcs11_id->clear();
+  void GetServiceProperty(const std::string& prop_name,
+                          std::string* prop_value) {
+    prop_value->clear();
     const base::DictionaryValue* properties =
         service_test_->GetServiceProperties(kWifiStub);
     if (!properties)
       return;
-    properties->GetStringWithoutPathExpansion(shill::kEapCertIdProperty,
-                                              pkcs11_id);
+    properties->GetStringWithoutPathExpansion(prop_name, prop_value);
   }
 
   int network_properties_changed_count_;
   std::string test_cert_id_;
   scoped_ptr<base::SimpleTestClock> test_clock_;
   scoped_ptr<ClientCertResolver> client_cert_resolver_;
 
  private:
   // ClientCertResolver::Observer:
   void ResolveRequestCompleted(bool network_properties_changed) override {
@@ skipping 11 matching lines @@
   base::MessageLoop message_loop_;
   scoped_refptr<net::X509Certificate> test_client_cert_;
   std::string test_ca_cert_pem_;
   crypto::ScopedTestNSSDB test_nssdb_;
   scoped_ptr<net::NSSCertDatabaseChromeOS> test_nsscertdb_;
 
   DISALLOW_COPY_AND_ASSIGN(ClientCertResolverTest);
 };
 
 TEST_F(ClientCertResolverTest, NoMatchingCertificates) {
-  SetupTestCerts(false /* do not import the issuer */);
+  SetupTestCerts("client_1", false /* do not import the issuer */);
   StartCertLoader();
   SetupWifi();
   base::RunLoop().RunUntilIdle();
   network_properties_changed_count_ = 0;
   SetupNetworkHandlers();
-  SetupPolicyMatchingIssuerPEM();
+  SetupPolicyMatchingIssuerPEM("");
   base::RunLoop().RunUntilIdle();
 
   // Verify that no client certificate was configured.
   std::string pkcs11_id;
-  GetClientCertProperties(&pkcs11_id);
+  GetServiceProperty(shill::kEapCertIdProperty, &pkcs11_id);
   EXPECT_EQ(std::string(), pkcs11_id);
   EXPECT_EQ(1, network_properties_changed_count_);
   EXPECT_FALSE(client_cert_resolver_->IsAnyResolveTaskRunning());
 }
 
 TEST_F(ClientCertResolverTest, MatchIssuerCNWithoutIssuerInstalled) {
-  SetupTestCerts(false /* do not import the issuer */);
+  SetupTestCerts("client_1", false /* do not import the issuer */);
   SetupWifi();
   base::RunLoop().RunUntilIdle();
 
   SetupNetworkHandlers();
   SetupPolicyMatchingIssuerCN();
   base::RunLoop().RunUntilIdle();
 
   network_properties_changed_count_ = 0;
   StartCertLoader();
   base::RunLoop().RunUntilIdle();
 
   // Verify that the resolver positively matched the pattern in the policy with
   // the test client cert and configured the network.
   std::string pkcs11_id;
-  GetClientCertProperties(&pkcs11_id);
+  GetServiceProperty(shill::kEapCertIdProperty, &pkcs11_id);
   EXPECT_EQ(test_cert_id_, pkcs11_id);
   EXPECT_EQ(1, network_properties_changed_count_);
 }
 
 TEST_F(ClientCertResolverTest, ResolveOnCertificatesLoaded) {
-  SetupTestCerts(true /* import issuer */);
+  SetupTestCerts("client_1", true /* import issuer */);
   SetupWifi();
   base::RunLoop().RunUntilIdle();
 
   SetupNetworkHandlers();
-  SetupPolicyMatchingIssuerPEM();
+  SetupPolicyMatchingIssuerPEM("");
   base::RunLoop().RunUntilIdle();
 
   network_properties_changed_count_ = 0;
   StartCertLoader();
   base::RunLoop().RunUntilIdle();
 
   // Verify that the resolver positively matched the pattern in the policy with
   // the test client cert and configured the network.
   std::string pkcs11_id;
-  GetClientCertProperties(&pkcs11_id);
+  GetServiceProperty(shill::kEapCertIdProperty, &pkcs11_id);
   EXPECT_EQ(test_cert_id_, pkcs11_id);
   EXPECT_EQ(1, network_properties_changed_count_);
 }
 
 TEST_F(ClientCertResolverTest, ResolveAfterPolicyApplication) {
-  SetupTestCerts(true /* import issuer */);
+  SetupTestCerts("client_1", true /* import issuer */);
   SetupWifi();
   base::RunLoop().RunUntilIdle();
   StartCertLoader();
   SetupNetworkHandlers();
   base::RunLoop().RunUntilIdle();
 
   // Policy application will trigger the ClientCertResolver.
   network_properties_changed_count_ = 0;
-  SetupPolicyMatchingIssuerPEM();
+  SetupPolicyMatchingIssuerPEM("");
   base::RunLoop().RunUntilIdle();
 
   // Verify that the resolver positively matched the pattern in the policy with
   // the test client cert and configured the network.
   std::string pkcs11_id;
-  GetClientCertProperties(&pkcs11_id);
+  GetServiceProperty(shill::kEapCertIdProperty, &pkcs11_id);
   EXPECT_EQ(test_cert_id_, pkcs11_id);
   EXPECT_EQ(1, network_properties_changed_count_);
 }
 
 TEST_F(ClientCertResolverTest, ExpiringCertificate) {
-  SetupTestCerts(true /* import issuer */);
+  SetupTestCerts("client_1", true /* import issuer */);
   SetupWifi();
   base::RunLoop().RunUntilIdle();
 
   SetupNetworkHandlers();
-  SetupPolicyMatchingIssuerPEM();
+  SetupPolicyMatchingIssuerPEM("");
   base::RunLoop().RunUntilIdle();
 
   StartCertLoader();
   base::RunLoop().RunUntilIdle();
 
   SetWifiState(shill::kStateOnline);
   base::RunLoop().RunUntilIdle();
 
   // Verify that the resolver positively matched the pattern in the policy with
   // the test client cert and configured the network.
   std::string pkcs11_id;
-  GetClientCertProperties(&pkcs11_id);
+  GetServiceProperty(shill::kEapCertIdProperty, &pkcs11_id);
   EXPECT_EQ(test_cert_id_, pkcs11_id);
 
   // Verify that, after the certificate expired and the network disconnection
   // happens, no client certificate was configured.
   test_clock_->SetNow(base::Time::Max());
   SetWifiState(shill::kStateOffline);
   base::RunLoop().RunUntilIdle();
-  GetClientCertProperties(&pkcs11_id);
+  GetServiceProperty(shill::kEapCertIdProperty, &pkcs11_id);
   EXPECT_EQ(std::string(), pkcs11_id);
 }
 
+TEST_F(ClientCertResolverTest, PopulateIdentityFromCert) {
+  SetupTestCerts("client_3", true /* import issuer */);
+  SetupWifi();
+  base::RunLoop().RunUntilIdle();
+
+  SetupNetworkHandlers();
+  SetupPolicyMatchingIssuerPEM("${CERT_SAN_EMAIL}");
+  base::RunLoop().RunUntilIdle();
+
+  network_properties_changed_count_ = 0;
+  StartCertLoader();
+  base::RunLoop().RunUntilIdle();
+
+  // Verify that the resolver read the subjectAltName email field from the
+  // cert, and wrote it into the shill service entry.
+  std::string identity;
+  GetServiceProperty(shill::kEapIdentityProperty, &identity);
+  EXPECT_EQ("santest@example.com", identity);
+  EXPECT_EQ(1, network_properties_changed_count_);
+
+  // Verify that after changing the ONC policy to request a variant of the
+  // Microsoft Universal Principal Name field instead, the correct value is
+  // substituted into the shill service entry.
+  SetupPolicyMatchingIssuerPEM("upn-${CERT_SAN_UPN}-suffix");
+  base::RunLoop().RunUntilIdle();
+
+  GetServiceProperty(shill::kEapIdentityProperty, &identity);
+  EXPECT_EQ("upn-santest@ad.corp.example.com-suffix", identity);
+  EXPECT_EQ(2, network_properties_changed_count_);
+}
+
 }  // namespace chromeos