chrome/browser/chromeos/net/client_cert_store_chromeos_unittest.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/net/client_cert_store_chromeos.h"
   6
   7 #include <string>
   8
   9 #include "base/callback.h"
  10 #include "base/files/file_path.h"
  11 #include "base/memory/ref_counted.h"
  12 #include "base/memory/scoped_ptr.h"
  13 #include "base/message_loop/message_loop.h"
  14 #include "base/run_loop.h"
  15 #include "chrome/browser/chromeos/certificate_provider/certificate_provider.h"
  16 #include "crypto/scoped_test_nss_db.h"
  17 #include "net/base/test_data_directory.h"
  18 #include "net/cert/x509_certificate.h"
  19 #include "net/ssl/ssl_cert_request_info.h"
  20 #include "net/test/cert_test_util.h"
  21 #include "testing/gtest/include/gtest/gtest.h"
  22
  23 namespace chromeos {
  24
  25 namespace {
  26
  27 // "CN=B CA" - DER encoded DN of the issuer of client_1.pem
  28 const unsigned char kAuthority1DN[] = {0x30, 0x0f, 0x31, 0x0d, 0x30, 0x0b,
  29                                        0x06, 0x03, 0x55, 0x04, 0x03, 0x0c,
  30                                        0x04, 0x42, 0x20, 0x43, 0x41};
  31
  32 class TestCertFilter : public ClientCertStoreChromeOS::CertFilter {
  33  public:
  34   explicit TestCertFilter(bool init_finished) : init_finished_(init_finished) {}
  35
  36   ~TestCertFilter() override {}
  37
  38   // ClientCertStoreChromeOS::CertFilter:
  39   bool Init(const base::Closure& callback) override {
  40     init_called_ = true;
  41     if (init_finished_)
  42       return true;
  43     pending_callback_ = callback;
  44     return false;
  45   }
  46
  47   bool IsCertAllowed(
  48       const scoped_refptr<net::X509Certificate>& cert) const override {
  49     if (not_allowed_cert_.get() && cert->Equals(not_allowed_cert_.get()))
  50       return false;
  51     return true;
  52   }
  53
  54   bool init_called() { return init_called_; }
  55
  56   void FinishInit() {
  57     init_finished_ = true;
  58     base::MessageLoop::current()->PostTask(FROM_HERE, pending_callback_);
  59     pending_callback_.Reset();
  60   }
  61
  62   void SetNotAllowedCert(scoped_refptr<net::X509Certificate> cert) {
  63     not_allowed_cert_ = cert;
  64   }
  65
  66  private:
  67   bool init_finished_;
  68   bool init_called_ = false;
  69   base::Closure pending_callback_;
  70   scoped_refptr<net::X509Certificate> not_allowed_cert_;
  71 };
  72
  73 }  // namespace
  74
  75 class ClientCertStoreChromeOSTest : public ::testing::Test {
  76  public:
  77   ClientCertStoreChromeOSTest() : message_loop_(new base::MessageLoopForIO()) {}
  78
  79   scoped_refptr<net::X509Certificate> ImportCertToSlot(
  80       const std::string& cert_filename,
  81       const std::string& key_filename,
  82       PK11SlotInfo* slot) {
  83     return net::ImportClientCertAndKeyFromFile(
  84         net::GetTestCertsDirectory(), cert_filename, key_filename, slot);
  85   }
  86
  87  private:
  88   scoped_ptr<base::MessageLoop> message_loop_;
  89 };
  90
  91 // Ensure that cert requests, that are started before the filter is initialized,
  92 // will wait for the initialization and succeed afterwards.
  93 TEST_F(ClientCertStoreChromeOSTest, RequestWaitsForNSSInitAndSucceeds) {
  94   crypto::ScopedTestNSSDB test_db;
  95   ASSERT_TRUE(test_db.is_open());
  96
  97   TestCertFilter* cert_filter =
  98       new TestCertFilter(false /* init asynchronously */);
  99   ClientCertStoreChromeOS store(
 100       nullptr /* no additional provider */, make_scoped_ptr(cert_filter),
 101       ClientCertStoreChromeOS::PasswordDelegateFactory());
 102
 103   scoped_refptr<net::X509Certificate> cert_1(
 104       ImportCertToSlot("client_1.pem", "client_1.pk8", test_db.slot()));
 105   ASSERT_TRUE(cert_1.get());
 106
 107   // Request any client certificate, which is expected to match client_1.
 108   scoped_refptr<net::SSLCertRequestInfo> request_all(
 109       new net::SSLCertRequestInfo());
 110
 111   base::RunLoop run_loop;
 112   store.GetClientCerts(*request_all, &request_all->client_certs,
 113                        run_loop.QuitClosure());
 114
 115   {
 116     base::RunLoop run_loop_inner;
 117     run_loop_inner.RunUntilIdle();
 118     // GetClientCerts should wait for the initialization of the filter to
 119     // finish.
 120     ASSERT_EQ(0u, request_all->client_certs.size());
 121     EXPECT_TRUE(cert_filter->init_called());
 122   }
 123   cert_filter->FinishInit();
 124   run_loop.Run();
 125
 126   ASSERT_EQ(1u, request_all->client_certs.size());
 127 }
 128
 129 // Ensure that cert requests, that are started after the filter was initialized,
 130 // will succeed.
 131 TEST_F(ClientCertStoreChromeOSTest, RequestsAfterNSSInitSucceed) {
 132   crypto::ScopedTestNSSDB test_db;
 133   ASSERT_TRUE(test_db.is_open());
 134
 135   ClientCertStoreChromeOS store(
 136       nullptr,  // no additional provider
 137       make_scoped_ptr(new TestCertFilter(true /* init synchronously */)),
 138       ClientCertStoreChromeOS::PasswordDelegateFactory());
 139
 140   scoped_refptr<net::X509Certificate> cert_1(
 141       ImportCertToSlot("client_1.pem", "client_1.pk8", test_db.slot()));
 142   ASSERT_TRUE(cert_1.get());
 143
 144   scoped_refptr<net::SSLCertRequestInfo> request_all(
 145       new net::SSLCertRequestInfo());
 146
 147   base::RunLoop run_loop;
 148   store.GetClientCerts(*request_all, &request_all->client_certs,
 149                        run_loop.QuitClosure());
 150   run_loop.Run();
 151
 152   ASSERT_EQ(1u, request_all->client_certs.size());
 153 }
 154
 155 TEST_F(ClientCertStoreChromeOSTest, Filter) {
 156   crypto::ScopedTestNSSDB test_db;
 157   ASSERT_TRUE(test_db.is_open());
 158
 159   TestCertFilter* cert_filter =
 160       new TestCertFilter(true /* init synchronously */);
 161   ClientCertStoreChromeOS store(
 162       nullptr /* no additional provider */, make_scoped_ptr(cert_filter),
 163       ClientCertStoreChromeOS::PasswordDelegateFactory());
 164
 165   scoped_refptr<net::X509Certificate> cert_1(
 166       ImportCertToSlot("client_1.pem", "client_1.pk8", test_db.slot()));
 167   ASSERT_TRUE(cert_1.get());
 168   scoped_refptr<net::X509Certificate> cert_2(
 169       ImportCertToSlot("client_2.pem", "client_2.pk8", test_db.slot()));
 170   ASSERT_TRUE(cert_2.get());
 171
 172   scoped_refptr<net::SSLCertRequestInfo> request_all(
 173       new net::SSLCertRequestInfo());
 174
 175   {
 176     base::RunLoop run_loop;
 177     cert_filter->SetNotAllowedCert(cert_2);
 178     net::CertificateList selected_certs;
 179     store.GetClientCerts(*request_all, &selected_certs, run_loop.QuitClosure());
 180     run_loop.Run();
 181
 182     ASSERT_EQ(1u, selected_certs.size());
 183     EXPECT_TRUE(cert_1->Equals(selected_certs[0].get()));
 184   }
 185
 186   {
 187     base::RunLoop run_loop;
 188     cert_filter->SetNotAllowedCert(cert_1);
 189     net::CertificateList selected_certs;
 190     store.GetClientCerts(*request_all, &selected_certs, run_loop.QuitClosure());
 191     run_loop.Run();
 192
 193     ASSERT_EQ(1u, selected_certs.size());
 194     EXPECT_TRUE(cert_2->Equals(selected_certs[0].get()));
 195   }
 196 }
 197
 198 // Ensure that the delegation of the request matching to the base class is
 199 // functional.
 200 TEST_F(ClientCertStoreChromeOSTest, CertRequestMatching) {
 201   crypto::ScopedTestNSSDB test_db;
 202   ASSERT_TRUE(test_db.is_open());
 203
 204   TestCertFilter* cert_filter =
 205       new TestCertFilter(true /* init synchronously */);
 206   ClientCertStoreChromeOS store(
 207       nullptr,  // no additional provider
 208       make_scoped_ptr(cert_filter),
 209       ClientCertStoreChromeOS::PasswordDelegateFactory());
 210
 211   scoped_refptr<net::X509Certificate> cert_1(
 212       ImportCertToSlot("client_1.pem", "client_1.pk8", test_db.slot()));
 213   ASSERT_TRUE(cert_1.get());
 214   scoped_refptr<net::X509Certificate> cert_2(
 215       ImportCertToSlot("client_2.pem", "client_2.pk8", test_db.slot()));
 216   ASSERT_TRUE(cert_2.get());
 217
 218   std::vector<std::string> authority_1(
 219       1, std::string(reinterpret_cast<const char*>(kAuthority1DN),
 220                      sizeof(kAuthority1DN)));
 221   scoped_refptr<net::SSLCertRequestInfo> request(new net::SSLCertRequestInfo());
 222   request->cert_authorities = authority_1;
 223
 224   base::RunLoop run_loop;
 225   net::CertificateList selected_certs;
 226   store.GetClientCerts(*request, &selected_certs, run_loop.QuitClosure());
 227   run_loop.Run();
 228
 229   ASSERT_EQ(1u, selected_certs.size());
 230   EXPECT_TRUE(cert_1->Equals(selected_certs[0].get()));
 231 }
 232
 233 }  // namespace chromeos