[Cast Channel] Add support for nonce challenge to Cast channel authentication.

extensions/browser/api/cast_channel/cast_auth_util_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/cast_channel/cast_auth_util.h"
 
 #include <string>
 
 #include "base/macros.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/time/time.h"
 #include "components/cast_certificate/cast_cert_validator.h"
 #include "components/cast_certificate/cast_cert_validator_test_helpers.h"
 #include "components/cast_certificate/cast_crl.h"
 #include "components/cast_certificate/proto/test_suite.pb.h"
 #include "extensions/common/api/cast_channel/cast_channel.pb.h"
 #include "net/cert/internal/trust_store_in_memory.h"
+#include "net/cert/x509_certificate.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace extensions {
 namespace api {
 namespace cast_channel {
 namespace {
 
 class CastAuthUtilTest : public testing::Test {
  public:
   CastAuthUtilTest() {}
@@ skipping 70 matching lines @@
 
 TEST_F(CastAuthUtilTest, VerifyBadPeerCert) {
   std::string signed_data;
   AuthResponse auth_response = CreateAuthResponse(&signed_data);
   MangleString(&signed_data);
   AuthResult result = VerifyCredentials(auth_response, signed_data);
   EXPECT_FALSE(result.success());
   EXPECT_EQ(AuthResult::ERROR_SIGNED_BLOBS_MISMATCH, result.error_type);
 }
 
+TEST_F(CastAuthUtilTest, VerifySenderNonceMatch) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitAndEnableFeature(
+      base::Feature{"CastNonceEnforced", base::FEATURE_DISABLED_BY_DEFAULT});
+  AuthContext context = AuthContext::Create();
+  AuthResult result = context.VerifySenderNonce(context.nonce());
+  EXPECT_TRUE(result.success());
+}
+
+TEST_F(CastAuthUtilTest, VerifySenderNonceMismatch) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitAndEnableFeature(
+      base::Feature{"CastNonceEnforced", base::FEATURE_DISABLED_BY_DEFAULT});
+  AuthContext context = AuthContext::Create();
+  std::string received_nonce = "test2";
+  EXPECT_NE(received_nonce, context.nonce());
+  AuthResult result = context.VerifySenderNonce(received_nonce);
+  EXPECT_FALSE(result.success());
+  EXPECT_EQ(AuthResult::ERROR_SENDER_NONCE_MISMATCH, result.error_type);
+}
+
+TEST_F(CastAuthUtilTest, VerifySenderNonceMissing) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitAndEnableFeature(
+      base::Feature{"CastNonceEnforced", base::FEATURE_DISABLED_BY_DEFAULT});
+  AuthContext context = AuthContext::Create();
+  std::string received_nonce = "";
+  EXPECT_FALSE(context.nonce().empty());
+  AuthResult result = context.VerifySenderNonce(received_nonce);
+  EXPECT_FALSE(result.success());
+  EXPECT_EQ(AuthResult::ERROR_SENDER_NONCE_MISMATCH, result.error_type);
+}
+
+TEST_F(CastAuthUtilTest, VerifyTLSCertificateSuccess) {
+  auto tls_cert_der = cast_certificate::testing::ReadCertificateChainFromFile(
+      "certificates/test_tls_cert.pem");
+
+  scoped_refptr<net::X509Certificate> tls_cert =
+      net::X509Certificate::CreateFromBytes(tls_cert_der[0].data(),
+                                            tls_cert_der[0].size());
+  std::string peer_cert_der;
+  AuthResult result =
+      VerifyTLSCertificate(*tls_cert, &peer_cert_der, tls_cert->valid_start());
+  EXPECT_TRUE(result.success());
+}
+
+TEST_F(CastAuthUtilTest, VerifyTLSCertificateTooEarly) {
+  auto tls_cert_der = cast_certificate::testing::ReadCertificateChainFromFile(
+      "certificates/test_tls_cert.pem");
+
+  scoped_refptr<net::X509Certificate> tls_cert =
+      net::X509Certificate::CreateFromBytes(tls_cert_der[0].data(),
+                                            tls_cert_der[0].size());
+  std::string peer_cert_der;
+  AuthResult result = VerifyTLSCertificate(
+      *tls_cert, &peer_cert_der,
+      tls_cert->valid_start() - base::TimeDelta::FromSeconds(1));
+  EXPECT_FALSE(result.success());
+  EXPECT_EQ(AuthResult::ERROR_TLS_CERT_VALID_START_DATE_IN_FUTURE,
+            result.error_type);
+}
+
+TEST_F(CastAuthUtilTest, VerifyTLSCertificateTooLate) {
+  auto tls_cert_der = cast_certificate::testing::ReadCertificateChainFromFile(
+      "certificates/test_tls_cert.pem");
+
+  scoped_refptr<net::X509Certificate> tls_cert =
+      net::X509Certificate::CreateFromBytes(tls_cert_der[0].data(),
+                                            tls_cert_der[0].size());
+  std::string peer_cert_der;
+  AuthResult result = VerifyTLSCertificate(
+      *tls_cert, &peer_cert_der,
+      tls_cert->valid_expiry() + base::TimeDelta::FromSeconds(2));
+  EXPECT_FALSE(result.success());
+  EXPECT_EQ(AuthResult::ERROR_TLS_CERT_EXPIRED, result.error_type);
+}
+
 // Indicates the expected result of test step's verification.
 enum TestStepResult {
   RESULT_SUCCESS,
   RESULT_FAIL,
 };
 
 // Verifies that the certificate chain provided is not revoked according to
 // the provided Cast CRL at |verification_time|.
 // The provided CRL is verified at |verification_time|.
 // If |crl_required| is set, then a valid Cast CRL must be provided.
@@ skipping 134 matching lines @@
 }
 
 TEST_F(CastAuthUtilTest, CRLTestSuite) {
   RunTestSuite("testsuite/testsuite1.pb");
 }
 
 }  // namespace
 }  // namespace cast_channel
 }  // namespace api
 }  // namespace extensions