nss_profile_filter_chromeos_unittest.cc 8.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211
  1. // Copyright 2014 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/nss_profile_filter_chromeos.h"
  5. #include <cert.h>
  6. #include <pk11pub.h>
  7. #include <secmod.h>
  8. #include <algorithm>
  9. #include <utility>
  10. #include "crypto/nss_util_internal.h"
  11. #include "crypto/scoped_nss_types.h"
  12. #include "crypto/scoped_test_nss_chromeos_user.h"
  13. #include "crypto/scoped_test_nss_db.h"
  14. #include "net/base/hash_value.h"
  15. #include "net/cert/x509_util_nss.h"
  16. #include "net/test/cert_test_util.h"
  17. #include "net/test/test_data_directory.h"
  18. #include "testing/gtest/include/gtest/gtest.h"
  19. namespace net {
  20. namespace {
  21. crypto::ScopedPK11Slot GetRootCertsSlot() {
  22. crypto::AutoSECMODListReadLock auto_lock;
  23. SECMODModuleList* head = SECMOD_GetDefaultModuleList();
  24. for (SECMODModuleList* item = head; item != nullptr; item = item->next) {
  25. int slot_count = item->module->loaded ? item->module->slotCount : 0;
  26. for (int i = 0; i < slot_count; i++) {
  27. PK11SlotInfo* slot = item->module->slots[i];
  28. if (!PK11_IsPresent(slot))
  29. continue;
  30. if (PK11_HasRootCerts(slot))
  31. return crypto::ScopedPK11Slot(PK11_ReferenceSlot(slot));
  32. }
  33. }
  34. return crypto::ScopedPK11Slot();
  35. }
  36. ScopedCERTCertificateList ListCertsInSlot(PK11SlotInfo* slot) {
  37. ScopedCERTCertificateList result;
  38. CERTCertList* cert_list = PK11_ListCertsInSlot(slot);
  39. if (!cert_list)
  40. return result;
  41. for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list);
  42. !CERT_LIST_END(node, cert_list);
  43. node = CERT_LIST_NEXT(node)) {
  44. result.push_back(x509_util::DupCERTCertificate(node->cert));
  45. }
  46. CERT_DestroyCertList(cert_list);
  47. // Sort the result so that test comparisons can be deterministic.
  48. std::sort(
  49. result.begin(), result.end(),
  50. [](const ScopedCERTCertificate& lhs, const ScopedCERTCertificate& rhs) {
  51. return x509_util::CalculateFingerprint256(lhs.get()) <
  52. x509_util::CalculateFingerprint256(rhs.get());
  53. });
  54. return result;
  55. }
  56. } // anonymous namespace
  57. class NSSProfileFilterChromeOSTest : public testing::Test {
  58. public:
  59. NSSProfileFilterChromeOSTest() : user_1_("user1"), user_2_("user2") {}
  60. void SetUp() override {
  61. ASSERT_TRUE(system_slot_user_.is_open());
  62. ASSERT_TRUE(user_1_.constructed_successfully());
  63. ASSERT_TRUE(user_2_.constructed_successfully());
  64. user_1_.FinishInit();
  65. user_2_.FinishInit();
  66. // TODO(mattm): more accurately test public/private slot filtering somehow.
  67. // (The slots used to initialize a profile filter should be separate slots
  68. // in separate modules, while ScopedTestNSSChromeOSUser uses the same slot
  69. // for both.)
  70. crypto::ScopedPK11Slot private_slot_1(crypto::GetPrivateSlotForChromeOSUser(
  71. user_1_.username_hash(),
  72. base::OnceCallback<void(crypto::ScopedPK11Slot)>()));
  73. ASSERT_TRUE(private_slot_1.get());
  74. profile_filter_1_.Init(
  75. crypto::GetPublicSlotForChromeOSUser(user_1_.username_hash()),
  76. std::move(private_slot_1), get_system_slot());
  77. profile_filter_1_copy_ = profile_filter_1_;
  78. crypto::ScopedPK11Slot private_slot_2(crypto::GetPrivateSlotForChromeOSUser(
  79. user_2_.username_hash(),
  80. base::OnceCallback<void(crypto::ScopedPK11Slot)>()));
  81. ASSERT_TRUE(private_slot_2.get());
  82. profile_filter_2_.Init(
  83. crypto::GetPublicSlotForChromeOSUser(user_2_.username_hash()),
  84. std::move(private_slot_2),
  85. crypto::ScopedPK11Slot() /* no system slot */);
  86. certs_ = CreateCERTCertificateListFromFile(GetTestCertsDirectory(),
  87. "root_ca_cert.pem",
  88. X509Certificate::FORMAT_AUTO);
  89. ASSERT_EQ(1U, certs_.size());
  90. }
  91. crypto::ScopedPK11Slot get_system_slot() {
  92. return crypto::ScopedPK11Slot(PK11_ReferenceSlot(system_slot_user_.slot()));
  93. }
  94. protected:
  95. ScopedCERTCertificateList certs_;
  96. crypto::ScopedTestNSSDB system_slot_user_;
  97. crypto::ScopedTestNSSChromeOSUser user_1_;
  98. crypto::ScopedTestNSSChromeOSUser user_2_;
  99. NSSProfileFilterChromeOS no_slots_profile_filter_;
  100. NSSProfileFilterChromeOS profile_filter_1_;
  101. NSSProfileFilterChromeOS profile_filter_2_;
  102. NSSProfileFilterChromeOS profile_filter_1_copy_;
  103. };
  104. TEST_F(NSSProfileFilterChromeOSTest, TempCertNotAllowed) {
  105. EXPECT_EQ(nullptr, certs_[0]->slot);
  106. EXPECT_FALSE(no_slots_profile_filter_.IsCertAllowed(certs_[0].get()));
  107. EXPECT_FALSE(profile_filter_1_.IsCertAllowed(certs_[0].get()));
  108. EXPECT_FALSE(profile_filter_1_copy_.IsCertAllowed(certs_[0].get()));
  109. EXPECT_FALSE(profile_filter_2_.IsCertAllowed(certs_[0].get()));
  110. }
  111. TEST_F(NSSProfileFilterChromeOSTest, InternalSlotAllowed) {
  112. crypto::ScopedPK11Slot internal_slot(PK11_GetInternalSlot());
  113. ASSERT_TRUE(internal_slot.get());
  114. EXPECT_TRUE(no_slots_profile_filter_.IsModuleAllowed(internal_slot.get()));
  115. EXPECT_TRUE(profile_filter_1_.IsModuleAllowed(internal_slot.get()));
  116. EXPECT_TRUE(profile_filter_1_copy_.IsModuleAllowed(internal_slot.get()));
  117. EXPECT_TRUE(profile_filter_2_.IsModuleAllowed(internal_slot.get()));
  118. crypto::ScopedPK11Slot internal_key_slot(PK11_GetInternalKeySlot());
  119. ASSERT_TRUE(internal_key_slot.get());
  120. EXPECT_TRUE(
  121. no_slots_profile_filter_.IsModuleAllowed(internal_key_slot.get()));
  122. EXPECT_TRUE(profile_filter_1_.IsModuleAllowed(internal_key_slot.get()));
  123. EXPECT_TRUE(profile_filter_1_copy_.IsModuleAllowed(internal_key_slot.get()));
  124. EXPECT_TRUE(profile_filter_2_.IsModuleAllowed(internal_key_slot.get()));
  125. }
  126. TEST_F(NSSProfileFilterChromeOSTest, RootCertsAllowed) {
  127. crypto::ScopedPK11Slot root_certs_slot(GetRootCertsSlot());
  128. ASSERT_TRUE(root_certs_slot.get());
  129. EXPECT_TRUE(no_slots_profile_filter_.IsModuleAllowed(root_certs_slot.get()));
  130. EXPECT_TRUE(profile_filter_1_.IsModuleAllowed(root_certs_slot.get()));
  131. EXPECT_TRUE(profile_filter_1_copy_.IsModuleAllowed(root_certs_slot.get()));
  132. EXPECT_TRUE(profile_filter_2_.IsModuleAllowed(root_certs_slot.get()));
  133. ScopedCERTCertificateList root_certs(ListCertsInSlot(root_certs_slot.get()));
  134. ASSERT_FALSE(root_certs.empty());
  135. EXPECT_TRUE(no_slots_profile_filter_.IsCertAllowed(root_certs[0].get()));
  136. EXPECT_TRUE(profile_filter_1_.IsCertAllowed(root_certs[0].get()));
  137. EXPECT_TRUE(profile_filter_1_copy_.IsCertAllowed(root_certs[0].get()));
  138. EXPECT_TRUE(profile_filter_2_.IsCertAllowed(root_certs[0].get()));
  139. }
  140. TEST_F(NSSProfileFilterChromeOSTest, SoftwareSlots) {
  141. crypto::ScopedPK11Slot system_slot(get_system_slot());
  142. crypto::ScopedPK11Slot slot_1(
  143. crypto::GetPublicSlotForChromeOSUser(user_1_.username_hash()));
  144. ASSERT_TRUE(slot_1);
  145. crypto::ScopedPK11Slot slot_2(
  146. crypto::GetPublicSlotForChromeOSUser(user_2_.username_hash()));
  147. ASSERT_TRUE(slot_2);
  148. CERTCertificate* cert_1 = certs_[0].get();
  149. ScopedCERTCertificateList certs_2 = CreateCERTCertificateListFromFile(
  150. GetTestCertsDirectory(), "ok_cert.pem", X509Certificate::FORMAT_AUTO);
  151. ASSERT_EQ(1U, certs_2.size());
  152. CERTCertificate* cert_2 = certs_2[0].get();
  153. ScopedCERTCertificateList system_certs = CreateCERTCertificateListFromFile(
  154. GetTestCertsDirectory(), "mit.davidben.der",
  155. X509Certificate::FORMAT_AUTO);
  156. ASSERT_EQ(1U, system_certs.size());
  157. CERTCertificate* system_cert = system_certs[0].get();
  158. ASSERT_EQ(SECSuccess,
  159. PK11_ImportCert(slot_1.get(), cert_1, CK_INVALID_HANDLE, "cert1",
  160. PR_FALSE /* includeTrust (unused) */));
  161. ASSERT_EQ(SECSuccess,
  162. PK11_ImportCert(slot_2.get(), cert_2, CK_INVALID_HANDLE, "cert2",
  163. PR_FALSE /* includeTrust (unused) */));
  164. ASSERT_EQ(SECSuccess, PK11_ImportCert(system_slot.get(), system_cert,
  165. CK_INVALID_HANDLE, "systemcert",
  166. PR_FALSE /* includeTrust (unused) */));
  167. EXPECT_FALSE(no_slots_profile_filter_.IsCertAllowed(cert_1));
  168. EXPECT_FALSE(no_slots_profile_filter_.IsCertAllowed(cert_2));
  169. EXPECT_FALSE(no_slots_profile_filter_.IsCertAllowed(system_cert));
  170. EXPECT_TRUE(profile_filter_1_.IsCertAllowed(cert_1));
  171. EXPECT_TRUE(profile_filter_1_copy_.IsCertAllowed(cert_1));
  172. EXPECT_FALSE(profile_filter_1_.IsCertAllowed(cert_2));
  173. EXPECT_FALSE(profile_filter_1_copy_.IsCertAllowed(cert_2));
  174. EXPECT_TRUE(profile_filter_1_.IsCertAllowed(system_cert));
  175. EXPECT_TRUE(profile_filter_1_copy_.IsCertAllowed(system_cert));
  176. EXPECT_FALSE(profile_filter_2_.IsCertAllowed(cert_1));
  177. EXPECT_TRUE(profile_filter_2_.IsCertAllowed(cert_2));
  178. EXPECT_FALSE(profile_filter_2_.IsCertAllowed(system_cert));
  179. }
  180. } // namespace net