OLD | NEW |
---|---|
(Empty) | |
1 // Copyright (c) 2017 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "chrome/browser/ssl/ignore_errors_cert_verifier.h" | |
6 | |
7 #include "base/base64.h" | |
8 #include "base/files/file_path.h" | |
9 #include "base/memory/ptr_util.h" | |
10 #include "base/memory/ref_counted.h" | |
11 #include "base/strings/string_piece.h" | |
12 #include "base/strings/string_util.h" | |
13 #include "chrome/browser/io_thread.h" | |
14 #include "chrome/common/chrome_switches.h" | |
15 #include "crypto/sha2.h" | |
16 #include "net/base/net_errors.h" | |
17 #include "net/base/test_completion_callback.h" | |
18 #include "net/cert/asn1_util.h" | |
19 #include "net/cert/mock_cert_verifier.h" | |
20 #include "net/cert/x509_certificate.h" | |
21 #include "net/log/net_log_with_source.h" | |
22 #include "net/test/cert_test_util.h" | |
23 #include "net/test/gtest_util.h" | |
24 #include "net/test/test_data_directory.h" | |
25 #include "testing/gmock/include/gmock/gmock.h" | |
26 #include "testing/gtest/include/gtest/gtest.h" | |
27 | |
28 using net::CertVerifier; | |
29 using net::MockCertVerifier; | |
30 using net::CompletionCallback; | |
31 using net::HashValue; | |
32 using net::SHA256HashValue; | |
33 using net::SHA256HashValueLessThan; | |
34 using net::X509Certificate; | |
35 using net::TestCompletionCallback; | |
36 using net::CertVerifyResult; | |
37 using net::NetLogWithSource; | |
38 | |
39 using net::ERR_CERT_INVALID; | |
40 using net::ERR_IO_PENDING; | |
41 using net::OK; | |
42 | |
43 using net::test::IsError; | |
44 using net::test::IsOk; | |
45 | |
46 static std::vector<std::string> MakeWhitelist() { | |
47 base::FilePath certs_dir = net::GetTestCertsDirectory(); | |
48 net::CertificateList certs = net::CreateCertificateListFromFile( | |
49 certs_dir, "x509_verify_results.chain.pem", X509Certificate::FORMAT_AUTO); | |
50 std::string cert_der, hash_base64; | |
51 base::StringPiece cert_spki; | |
52 SHA256HashValue hash; | |
53 X509Certificate::GetDEREncoded(certs[1]->os_cert_handle(), &cert_der); | |
54 net::asn1::ExtractSPKIFromDERCert(cert_der, &cert_spki); | |
55 | |
56 crypto::SHA256HashString(cert_spki, &hash, sizeof(SHA256HashValue)); | |
57 base::Base64Encode(base::StringPiece(reinterpret_cast<const char*>(hash.data), | |
58 sizeof(hash.data)), | |
59 &hash_base64); | |
60 return {"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", "foobar", hash_base64, | |
61 "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB="}; | |
62 } | |
63 | |
64 class IgnoreErrorsCertVerifierTest : public ::testing::Test { | |
65 public: | |
66 IgnoreErrorsCertVerifierTest() | |
67 : mock_verifier_(new MockCertVerifier()), | |
68 verifier_(base::WrapUnique(mock_verifier_), | |
69 IgnoreErrorsCertVerifier::SPKIHashSet()) {} | |
70 ~IgnoreErrorsCertVerifierTest() override {} | |
71 | |
72 protected: | |
73 void SetUp() override { | |
74 verifier_.set_whitelist( | |
75 IgnoreErrorsCertVerifier::MakeWhitelist(MakeWhitelist())); | |
76 }; | |
77 | |
78 // The wrapped CertVerifier. Defaults to returning ERR_CERT_INVALID. Owned by | |
79 // verifier_. | |
estark
2017/05/17 18:04:18
teeny-tiny nit: |verifier_|
martinkr
2017/05/23 18:30:43
Done.
| |
80 MockCertVerifier* mock_verifier_; | |
81 IgnoreErrorsCertVerifier verifier_; | |
82 }; | |
83 | |
84 static void GetNonWhitelistedTestCert(scoped_refptr<X509Certificate>* out) { | |
85 base::FilePath certs_dir = net::GetTestCertsDirectory(); | |
86 scoped_refptr<X509Certificate> test_cert( | |
87 net::ImportCertFromFile(certs_dir, "ok_cert.pem")); | |
88 ASSERT_TRUE(test_cert); | |
89 out->swap(test_cert); | |
90 } | |
91 | |
92 static CertVerifier::RequestParams MakeRequestParams( | |
93 const scoped_refptr<X509Certificate>& cert) { | |
94 return CertVerifier::RequestParams(cert, "example.com", 0, "", | |
95 net::CertificateList()); | |
96 } | |
97 | |
98 static void GetWhitelistedTestCert(scoped_refptr<X509Certificate>* out) { | |
99 base::FilePath certs_dir = net::GetTestCertsDirectory(); | |
100 net::CertificateList certs = net::CreateCertificateListFromFile( | |
101 certs_dir, "x509_verify_results.chain.pem", X509Certificate::FORMAT_AUTO); | |
102 ASSERT_EQ(3U, certs.size()); | |
103 X509Certificate::OSCertHandles intermediates; | |
104 intermediates.push_back(certs[1]->os_cert_handle()); | |
105 intermediates.push_back(certs[2]->os_cert_handle()); | |
106 scoped_refptr<X509Certificate> cert_chain = X509Certificate::CreateFromHandle( | |
107 certs[0]->os_cert_handle(), intermediates); | |
108 ASSERT_TRUE(cert_chain); | |
109 ASSERT_EQ(2U, cert_chain->GetIntermediateCertificates().size()); | |
110 out->swap(cert_chain); | |
111 } | |
112 | |
113 TEST_F(IgnoreErrorsCertVerifierTest, TestNoMatchCertOk) { | |
114 mock_verifier_->set_default_result(OK); | |
115 | |
116 scoped_refptr<X509Certificate> test_cert; | |
117 ASSERT_NO_FATAL_FAILURE(GetNonWhitelistedTestCert(&test_cert)); | |
118 CertVerifyResult verify_result; | |
119 TestCompletionCallback callback; | |
120 std::unique_ptr<CertVerifier::Request> request; | |
121 | |
122 EXPECT_THAT(callback.GetResult(verifier_.Verify( | |
123 MakeRequestParams(test_cert), nullptr, &verify_result, | |
124 callback.callback(), &request, NetLogWithSource())), | |
125 IsOk()); | |
126 } | |
127 | |
128 TEST_F(IgnoreErrorsCertVerifierTest, TestNoMatchCertError) { | |
129 scoped_refptr<X509Certificate> test_cert; | |
130 ASSERT_NO_FATAL_FAILURE(GetNonWhitelistedTestCert(&test_cert)); | |
131 CertVerifyResult verify_result; | |
132 TestCompletionCallback callback; | |
133 std::unique_ptr<CertVerifier::Request> request; | |
134 | |
135 EXPECT_THAT(callback.GetResult(verifier_.Verify( | |
136 MakeRequestParams(test_cert), nullptr, &verify_result, | |
137 callback.callback(), &request, NetLogWithSource())), | |
138 IsError(ERR_CERT_INVALID)); | |
139 } | |
140 | |
141 TEST_F(IgnoreErrorsCertVerifierTest, TestMatch) { | |
142 scoped_refptr<X509Certificate> test_cert; | |
143 ASSERT_NO_FATAL_FAILURE(GetWhitelistedTestCert(&test_cert)); | |
144 CertVerifyResult verify_result; | |
145 TestCompletionCallback callback; | |
146 std::unique_ptr<CertVerifier::Request> request; | |
147 | |
148 EXPECT_THAT(callback.GetResult(verifier_.Verify( | |
149 MakeRequestParams(test_cert), nullptr, &verify_result, | |
150 callback.callback(), &request, NetLogWithSource())), | |
151 IsOk()); | |
152 } | |
153 | |
154 class IgnoreCertificateErrorsSPKIListFlagTest | |
155 : public ::testing::TestWithParam<bool> { | |
156 public: | |
157 IgnoreCertificateErrorsSPKIListFlagTest() { | |
158 base::CommandLine command_line(base::CommandLine::NO_PROGRAM); | |
159 if (GetParam()) { | |
160 command_line.AppendSwitchASCII(switches::kUserDataDir, "/foo/bar/baz"); | |
161 } | |
162 command_line.AppendSwitchASCII(switches::kIgnoreCertificateErrorsSPKIList, | |
163 base::JoinString(MakeWhitelist(), ",")); | |
164 | |
165 auto mock_verifier = base::MakeUnique<MockCertVerifier>(); | |
166 mock_verifier->set_default_result(ERR_CERT_INVALID); | |
167 verifier_ = IgnoreErrorsCertVerifier::MaybeWrapCertVerifier( | |
168 command_line, std::move(mock_verifier)); | |
169 } | |
170 ~IgnoreCertificateErrorsSPKIListFlagTest() override {} | |
171 | |
172 protected: | |
173 std::unique_ptr<CertVerifier> verifier_; | |
174 }; | |
175 | |
176 // Only if both --user-data-dir and --ignore-certificate-errors-from-spki-list | |
177 // are present, certificate verification is bypassed. | |
178 TEST_P(IgnoreCertificateErrorsSPKIListFlagTest, TestFoo) { | |
estark
2017/05/17 18:04:18
"TestFoo" could stand to be a tad more descriptive
martinkr
2017/05/23 18:30:43
Eh, don't you think it's pretty self explanatory?
| |
179 scoped_refptr<X509Certificate> test_cert; | |
180 ASSERT_NO_FATAL_FAILURE(GetWhitelistedTestCert(&test_cert)); | |
181 CertVerifyResult verify_result; | |
182 TestCompletionCallback callback; | |
183 std::unique_ptr<CertVerifier::Request> request; | |
184 | |
185 if (GetParam()) { | |
186 EXPECT_THAT(callback.GetResult(verifier_->Verify( | |
187 MakeRequestParams(test_cert), nullptr, &verify_result, | |
188 callback.callback(), &request, NetLogWithSource())), | |
189 IsOk()); | |
190 } else { | |
191 EXPECT_THAT(callback.GetResult(verifier_->Verify( | |
192 MakeRequestParams(test_cert), nullptr, &verify_result, | |
193 callback.callback(), &request, NetLogWithSource())), | |
194 IsError(ERR_CERT_INVALID)); | |
195 } | |
196 } | |
197 | |
198 INSTANTIATE_TEST_CASE_P(WithUserDataDirSwitchPresent, | |
199 IgnoreCertificateErrorsSPKIListFlagTest, | |
200 ::testing::Bool()); | |
OLD | NEW |