Index: chrome/browser/ssl/ignore_errors_cert_verifier_unittest.cc |
diff --git a/chrome/browser/ssl/ignore_errors_cert_verifier_unittest.cc b/chrome/browser/ssl/ignore_errors_cert_verifier_unittest.cc |
new file mode 100644 |
index 0000000000000000000000000000000000000000..97596f98ff582b8773b5321bb483183493599997 |
--- /dev/null |
+++ b/chrome/browser/ssl/ignore_errors_cert_verifier_unittest.cc |
@@ -0,0 +1,158 @@ |
+// Copyright (c) 2017 The Chromium Authors. All rights reserved. |
+// Use of this source code is governed by a BSD-style license that can be |
+// found in the LICENSE file. |
+ |
+#include "chrome/browser/ssl/ignore_errors_cert_verifier.h" |
+ |
+#include "base/files/file_path.h" |
+#include "base/memory/ptr_util.h" |
+#include "base/memory/ref_counted.h" |
+#include "net/base/net_errors.h" |
+#include "net/base/test_completion_callback.h" |
+#include "net/cert/mock_cert_verifier.h" |
+#include "net/cert/x509_certificate.h" |
+#include "net/log/net_log_with_source.h" |
+#include "net/test/cert_test_util.h" |
+#include "net/test/gtest_util.h" |
+#include "net/test/test_data_directory.h" |
+#include "testing/gmock/include/gmock/gmock.h" |
+#include "testing/gtest/include/gtest/gtest.h" |
+ |
+using net::CertVerifier; |
+using net::MockCertVerifier; |
+using net::CompletionCallback; |
+using net::HashValue; |
+using net::SHA256HashValue; |
+using net::SHA256HashValueLessThan; |
+using net::X509Certificate; |
+using net::TestCompletionCallback; |
+using net::CertVerifyResult; |
+using net::NetLogWithSource; |
+ |
+using net::ERR_CERT_INVALID; |
+using net::ERR_IO_PENDING; |
+using net::OK; |
+ |
+using net::test::IsError; |
+using net::test::IsOk; |
+ |
+static IgnoreErrorsCertVerifier::SPKIHashSet MakeWhitelist() { |
+ std::vector<std::string> fingerprints{ |
+ "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", "foobar", |
+ // SPKI fingerprint of the intermediate from |
+ // x509_verify_results.chain.pem: |
+ "MtnqgdSwAIgEjse7SpxnmyKoo/RTiL9CDIWwFnz4nas=", |
Ryan Sleevi
2017/04/12 21:53:17
It'd be better if this was dynamically computed. x
martinkr
2017/04/24 23:54:25
IMHO it seems a little silly, since I essentially
|
+ "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB="}; |
+ return IgnoreErrorsCertVerifier::MakeWhitelist(fingerprints); |
+} |
+ |
+class IgnoreErrorsCertVerifierTest : public ::testing::Test { |
+ public: |
+ IgnoreErrorsCertVerifierTest() |
+ : mock_verifier_(new MockCertVerifier()), |
+ verifier_(base::WrapUnique(mock_verifier_), MakeWhitelist()) {} |
+ ~IgnoreErrorsCertVerifierTest() override {} |
+ |
+ protected: |
+ // The wrapped CertVerifier. Defaults to returning ERR_CERT_INVALID. Owned by |
+ // verifier_. |
+ MockCertVerifier* mock_verifier_; |
+ IgnoreErrorsCertVerifier verifier_; |
+}; |
+ |
+static scoped_refptr<X509Certificate> GetNonWhitelistedTestCert() { |
+ base::FilePath certs_dir = net::GetTestCertsDirectory(); |
+ scoped_refptr<X509Certificate> test_cert( |
+ net::ImportCertFromFile(certs_dir, "ok_cert.pem")); |
+ CHECK(test_cert); |
Ryan Sleevi
2017/04/12 21:53:17
This is a unit test, so we shouldn't CHECK() for a
martinkr
2017/04/24 23:54:26
Done.
|
+ return test_cert; |
+} |
+ |
+static CertVerifier::RequestParams MakeRequestParams( |
+ const scoped_refptr<X509Certificate>& cert) { |
+ return CertVerifier::RequestParams(cert, "example.com", 0, "", |
+ net::CertificateList()); |
+} |
+ |
+static scoped_refptr<X509Certificate> GetWhitelistedTestCert() { |
+ base::FilePath certs_dir = net::GetTestCertsDirectory(); |
+ net::CertificateList certs = net::CreateCertificateListFromFile( |
+ certs_dir, "x509_verify_results.chain.pem", X509Certificate::FORMAT_AUTO); |
+ CHECK_EQ(3U, certs.size()); |
Ryan Sleevi
2017/04/12 21:53:17
ditto re: CHECK
martinkr
2017/04/24 23:54:26
Done.
|
+ X509Certificate::OSCertHandles intermediates; |
+ intermediates.push_back(certs[1]->os_cert_handle()); |
+ intermediates.push_back(certs[2]->os_cert_handle()); |
+ scoped_refptr<X509Certificate> cert_chain = X509Certificate::CreateFromHandle( |
+ certs[0]->os_cert_handle(), intermediates); |
+ CHECK(cert_chain); |
+ CHECK_EQ(2U, cert_chain->GetIntermediateCertificates().size()); |
Ryan Sleevi
2017/04/12 21:53:17
ditto re: CHECK
martinkr
2017/04/24 23:54:26
Done.
|
+ return cert_chain; |
+} |
+ |
+TEST_F(IgnoreErrorsCertVerifierTest, TestNoMatchCertOk) { |
+ mock_verifier_->set_default_result(OK); |
+ |
+ scoped_refptr<X509Certificate> test_cert = GetNonWhitelistedTestCert(); |
+ CertVerifyResult verify_result; |
+ TestCompletionCallback callback; |
+ std::unique_ptr<CertVerifier::Request> request; |
+ |
+ EXPECT_THAT(callback.GetResult(verifier_.Verify( |
+ MakeRequestParams(test_cert), nullptr, &verify_result, |
+ callback.callback(), &request, NetLogWithSource())), |
+ IsOk()); |
+} |
+ |
+TEST_F(IgnoreErrorsCertVerifierTest, TestNoMatchCertError) { |
+ scoped_refptr<X509Certificate> test_cert = GetNonWhitelistedTestCert(); |
+ CertVerifyResult verify_result; |
+ TestCompletionCallback callback; |
+ std::unique_ptr<CertVerifier::Request> request; |
+ |
+ EXPECT_THAT(callback.GetResult(verifier_.Verify( |
+ MakeRequestParams(test_cert), nullptr, &verify_result, |
+ callback.callback(), &request, NetLogWithSource())), |
+ IsError(ERR_CERT_INVALID)); |
+} |
+ |
+TEST_F(IgnoreErrorsCertVerifierTest, TestNoMatchCertErrorCallback) { |
+ mock_verifier_->set_async(true); |
+ |
+ scoped_refptr<X509Certificate> test_cert = GetNonWhitelistedTestCert(); |
+ CertVerifyResult verify_result; |
+ TestCompletionCallback callback; |
+ std::unique_ptr<CertVerifier::Request> request; |
+ |
+ EXPECT_THAT( |
+ verifier_.Verify(MakeRequestParams(test_cert), nullptr, &verify_result, |
+ callback.callback(), &request, NetLogWithSource()), |
+ IsError(ERR_IO_PENDING)); |
+ EXPECT_THAT(callback.WaitForResult(), IsError(ERR_CERT_INVALID)); |
+} |
+ |
+TEST_F(IgnoreErrorsCertVerifierTest, TestMatch) { |
+ scoped_refptr<X509Certificate> test_cert = GetWhitelistedTestCert(); |
+ CertVerifyResult verify_result; |
+ TestCompletionCallback callback; |
+ std::unique_ptr<CertVerifier::Request> request; |
+ |
+ EXPECT_THAT(callback.GetResult(verifier_.Verify( |
+ MakeRequestParams(test_cert), nullptr, &verify_result, |
+ callback.callback(), &request, NetLogWithSource())), |
+ IsOk()); |
+} |
+ |
+TEST_F(IgnoreErrorsCertVerifierTest, TestMatchCallback) { |
+ mock_verifier_->set_async(true); |
+ |
+ scoped_refptr<X509Certificate> test_cert = GetWhitelistedTestCert(); |
+ CertVerifyResult verify_result; |
+ TestCompletionCallback callback; |
+ std::unique_ptr<CertVerifier::Request> request; |
+ |
+ EXPECT_THAT( |
+ verifier_.Verify(MakeRequestParams(test_cert), nullptr, &verify_result, |
+ callback.callback(), &request, NetLogWithSource()), |
+ IsError(ERR_IO_PENDING)); |
+ EXPECT_THAT(callback.WaitForResult(), IsOk()); |
+} |