http_auth_sspi_win_unittest.cc 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/http/http_auth_sspi_win.h"
  5. #include <vector>
  6. #include "base/base64.h"
  7. #include "base/bind.h"
  8. #include "base/json/json_reader.h"
  9. #include "net/base/net_errors.h"
  10. #include "net/http/http_auth.h"
  11. #include "net/http/http_auth_challenge_tokenizer.h"
  12. #include "net/http/mock_sspi_library_win.h"
  13. #include "net/log/net_log_entry.h"
  14. #include "net/log/net_log_event_type.h"
  15. #include "net/log/net_log_with_source.h"
  16. #include "net/log/test_net_log.h"
  17. #include "net/test/gtest_util.h"
  18. #include "testing/gmock/include/gmock/gmock.h"
  19. #include "testing/gtest/include/gtest/gtest.h"
  20. using net::test::IsError;
  21. using net::test::IsOk;
  22. namespace net {
  23. namespace {
  24. void MatchDomainUserAfterSplit(const std::u16string& combined,
  25. const std::u16string& expected_domain,
  26. const std::u16string& expected_user) {
  27. std::u16string actual_domain;
  28. std::u16string actual_user;
  29. SplitDomainAndUser(combined, &actual_domain, &actual_user);
  30. EXPECT_EQ(expected_domain, actual_domain);
  31. EXPECT_EQ(expected_user, actual_user);
  32. }
  33. const ULONG kMaxTokenLength = 100;
  34. void UnexpectedCallback(int result) {
  35. // At present getting tokens from gssapi is fully synchronous, so the callback
  36. // should never be called.
  37. ADD_FAILURE();
  38. }
  39. } // namespace
  40. TEST(HttpAuthSSPITest, SplitUserAndDomain) {
  41. MatchDomainUserAfterSplit(u"foobar", u"", u"foobar");
  42. MatchDomainUserAfterSplit(u"FOO\\bar", u"FOO", u"bar");
  43. }
  44. TEST(HttpAuthSSPITest, DetermineMaxTokenLength_Normal) {
  45. SecPkgInfoW package_info;
  46. memset(&package_info, 0x0, sizeof(package_info));
  47. package_info.cbMaxToken = 1337;
  48. MockSSPILibrary mock_library{L"NTLM"};
  49. mock_library.ExpectQuerySecurityPackageInfo(SEC_E_OK, &package_info);
  50. ULONG max_token_length = kMaxTokenLength;
  51. int rv = mock_library.DetermineMaxTokenLength(&max_token_length);
  52. EXPECT_THAT(rv, IsOk());
  53. EXPECT_EQ(1337u, max_token_length);
  54. }
  55. TEST(HttpAuthSSPITest, DetermineMaxTokenLength_InvalidPackage) {
  56. MockSSPILibrary mock_library{L"Foo"};
  57. mock_library.ExpectQuerySecurityPackageInfo(SEC_E_SECPKG_NOT_FOUND, nullptr);
  58. ULONG max_token_length = kMaxTokenLength;
  59. int rv = mock_library.DetermineMaxTokenLength(&max_token_length);
  60. EXPECT_THAT(rv, IsError(ERR_UNSUPPORTED_AUTH_SCHEME));
  61. // |DetermineMaxTokenLength()| interface states that |max_token_length| should
  62. // not change on failure.
  63. EXPECT_EQ(100u, max_token_length);
  64. }
  65. TEST(HttpAuthSSPITest, ParseChallenge_FirstRound) {
  66. // The first round should just consist of an unadorned "Negotiate" header.
  67. MockSSPILibrary mock_library{NEGOSSP_NAME};
  68. HttpAuthSSPI auth_sspi(&mock_library, HttpAuth::AUTH_SCHEME_NEGOTIATE);
  69. std::string challenge_text = "Negotiate";
  70. HttpAuthChallengeTokenizer challenge(challenge_text.begin(),
  71. challenge_text.end());
  72. EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  73. auth_sspi.ParseChallenge(&challenge));
  74. }
  75. TEST(HttpAuthSSPITest, ParseChallenge_TwoRounds) {
  76. // The first round should just have "Negotiate", and the second round should
  77. // have a valid base64 token associated with it.
  78. MockSSPILibrary mock_library{NEGOSSP_NAME};
  79. HttpAuthSSPI auth_sspi(&mock_library, HttpAuth::AUTH_SCHEME_NEGOTIATE);
  80. std::string first_challenge_text = "Negotiate";
  81. HttpAuthChallengeTokenizer first_challenge(first_challenge_text.begin(),
  82. first_challenge_text.end());
  83. EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  84. auth_sspi.ParseChallenge(&first_challenge));
  85. // Generate an auth token and create another thing.
  86. std::string auth_token;
  87. EXPECT_EQ(OK,
  88. auth_sspi.GenerateAuthToken(
  89. nullptr, "HTTP/intranet.google.com", std::string(), &auth_token,
  90. NetLogWithSource(), base::BindOnce(&UnexpectedCallback)));
  91. std::string second_challenge_text = "Negotiate Zm9vYmFy";
  92. HttpAuthChallengeTokenizer second_challenge(second_challenge_text.begin(),
  93. second_challenge_text.end());
  94. EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  95. auth_sspi.ParseChallenge(&second_challenge));
  96. }
  97. TEST(HttpAuthSSPITest, ParseChallenge_UnexpectedTokenFirstRound) {
  98. // If the first round challenge has an additional authentication token, it
  99. // should be treated as an invalid challenge from the server.
  100. MockSSPILibrary mock_library{NEGOSSP_NAME};
  101. HttpAuthSSPI auth_sspi(&mock_library, HttpAuth::AUTH_SCHEME_NEGOTIATE);
  102. std::string challenge_text = "Negotiate Zm9vYmFy";
  103. HttpAuthChallengeTokenizer challenge(challenge_text.begin(),
  104. challenge_text.end());
  105. EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_INVALID,
  106. auth_sspi.ParseChallenge(&challenge));
  107. }
  108. TEST(HttpAuthSSPITest, ParseChallenge_MissingTokenSecondRound) {
  109. // If a later-round challenge is simply "Negotiate", it should be treated as
  110. // an authentication challenge rejection from the server or proxy.
  111. MockSSPILibrary mock_library{NEGOSSP_NAME};
  112. HttpAuthSSPI auth_sspi(&mock_library, HttpAuth::AUTH_SCHEME_NEGOTIATE);
  113. std::string first_challenge_text = "Negotiate";
  114. HttpAuthChallengeTokenizer first_challenge(first_challenge_text.begin(),
  115. first_challenge_text.end());
  116. EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  117. auth_sspi.ParseChallenge(&first_challenge));
  118. std::string auth_token;
  119. EXPECT_EQ(OK,
  120. auth_sspi.GenerateAuthToken(
  121. nullptr, "HTTP/intranet.google.com", std::string(), &auth_token,
  122. NetLogWithSource(), base::BindOnce(&UnexpectedCallback)));
  123. std::string second_challenge_text = "Negotiate";
  124. HttpAuthChallengeTokenizer second_challenge(second_challenge_text.begin(),
  125. second_challenge_text.end());
  126. EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_REJECT,
  127. auth_sspi.ParseChallenge(&second_challenge));
  128. }
  129. TEST(HttpAuthSSPITest, ParseChallenge_NonBase64EncodedToken) {
  130. // If a later-round challenge has an invalid base64 encoded token, it should
  131. // be treated as an invalid challenge.
  132. MockSSPILibrary mock_library{NEGOSSP_NAME};
  133. HttpAuthSSPI auth_sspi(&mock_library, HttpAuth::AUTH_SCHEME_NEGOTIATE);
  134. std::string first_challenge_text = "Negotiate";
  135. HttpAuthChallengeTokenizer first_challenge(first_challenge_text.begin(),
  136. first_challenge_text.end());
  137. EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  138. auth_sspi.ParseChallenge(&first_challenge));
  139. std::string auth_token;
  140. EXPECT_EQ(OK,
  141. auth_sspi.GenerateAuthToken(
  142. nullptr, "HTTP/intranet.google.com", std::string(), &auth_token,
  143. NetLogWithSource(), base::BindOnce(&UnexpectedCallback)));
  144. std::string second_challenge_text = "Negotiate =happyjoy=";
  145. HttpAuthChallengeTokenizer second_challenge(second_challenge_text.begin(),
  146. second_challenge_text.end());
  147. EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_INVALID,
  148. auth_sspi.ParseChallenge(&second_challenge));
  149. }
  150. // Runs through a full handshake against the MockSSPILibrary.
  151. TEST(HttpAuthSSPITest, GenerateAuthToken_FullHandshake_AmbientCreds) {
  152. MockSSPILibrary mock_library{NEGOSSP_NAME};
  153. HttpAuthSSPI auth_sspi(&mock_library, HttpAuth::AUTH_SCHEME_NEGOTIATE);
  154. std::string first_challenge_text = "Negotiate";
  155. HttpAuthChallengeTokenizer first_challenge(first_challenge_text.begin(),
  156. first_challenge_text.end());
  157. ASSERT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  158. auth_sspi.ParseChallenge(&first_challenge));
  159. std::string auth_token;
  160. ASSERT_EQ(OK,
  161. auth_sspi.GenerateAuthToken(
  162. nullptr, "HTTP/intranet.google.com", std::string(), &auth_token,
  163. NetLogWithSource(), base::BindOnce(&UnexpectedCallback)));
  164. EXPECT_EQ("Negotiate ", auth_token.substr(0, 10));
  165. std::string decoded_token;
  166. ASSERT_TRUE(base::Base64Decode(auth_token.substr(10), &decoded_token));
  167. // This token string indicates that HttpAuthSSPI correctly established the
  168. // security context using the default credentials.
  169. EXPECT_EQ("<Default>'s token #1 for HTTP/intranet.google.com", decoded_token);
  170. // The server token is arbitrary.
  171. std::string second_challenge_text = "Negotiate UmVzcG9uc2U=";
  172. HttpAuthChallengeTokenizer second_challenge(second_challenge_text.begin(),
  173. second_challenge_text.end());
  174. ASSERT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  175. auth_sspi.ParseChallenge(&second_challenge));
  176. ASSERT_EQ(OK,
  177. auth_sspi.GenerateAuthToken(
  178. nullptr, "HTTP/intranet.google.com", std::string(), &auth_token,
  179. NetLogWithSource(), base::BindOnce(&UnexpectedCallback)));
  180. ASSERT_EQ("Negotiate ", auth_token.substr(0, 10));
  181. ASSERT_TRUE(base::Base64Decode(auth_token.substr(10), &decoded_token));
  182. EXPECT_EQ("<Default>'s token #2 for HTTP/intranet.google.com", decoded_token);
  183. }
  184. // Test NetLogs produced while going through a full Negotiate handshake.
  185. TEST(HttpAuthSSPITest, GenerateAuthToken_FullHandshake_AmbientCreds_Logging) {
  186. RecordingNetLogObserver net_log_observer;
  187. NetLogWithSource net_log_with_source =
  188. NetLogWithSource::Make(NetLogSourceType::NONE);
  189. MockSSPILibrary mock_library{NEGOSSP_NAME};
  190. HttpAuthSSPI auth_sspi(&mock_library, HttpAuth::AUTH_SCHEME_NEGOTIATE);
  191. std::string first_challenge_text = "Negotiate";
  192. HttpAuthChallengeTokenizer first_challenge(first_challenge_text.begin(),
  193. first_challenge_text.end());
  194. ASSERT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  195. auth_sspi.ParseChallenge(&first_challenge));
  196. std::string auth_token;
  197. ASSERT_EQ(OK,
  198. auth_sspi.GenerateAuthToken(
  199. nullptr, "HTTP/intranet.google.com", std::string(), &auth_token,
  200. net_log_with_source, base::BindOnce(&UnexpectedCallback)));
  201. // The token is the ASCII string "Response" in base64.
  202. std::string second_challenge_text = "Negotiate UmVzcG9uc2U=";
  203. HttpAuthChallengeTokenizer second_challenge(second_challenge_text.begin(),
  204. second_challenge_text.end());
  205. ASSERT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
  206. auth_sspi.ParseChallenge(&second_challenge));
  207. ASSERT_EQ(OK,
  208. auth_sspi.GenerateAuthToken(
  209. nullptr, "HTTP/intranet.google.com", std::string(), &auth_token,
  210. net_log_with_source, base::BindOnce(&UnexpectedCallback)));
  211. auto entries = net_log_observer.GetEntriesWithType(
  212. NetLogEventType::AUTH_LIBRARY_ACQUIRE_CREDS);
  213. ASSERT_EQ(2u, entries.size()); // BEGIN and END.
  214. auto expected = base::JSONReader::Read(R"(
  215. {
  216. "status": {
  217. "net_error": 0,
  218. "security_status": 0
  219. }
  220. }
  221. )");
  222. EXPECT_EQ(expected, entries[1].params);
  223. entries = net_log_observer.GetEntriesWithType(
  224. NetLogEventType::AUTH_LIBRARY_INIT_SEC_CTX);
  225. ASSERT_EQ(4u, entries.size());
  226. expected = base::JSONReader::Read(R"(
  227. {
  228. "flags": {
  229. "delegated": false,
  230. "mutual": false,
  231. "value": "0x00000000"
  232. },
  233. "spn": "HTTP/intranet.google.com"
  234. }
  235. )");
  236. EXPECT_EQ(expected, entries[0].params);
  237. expected = base::JSONReader::Read(R"(
  238. {
  239. "context": {
  240. "authority": "Dodgy Server",
  241. "flags": {
  242. "delegated": false,
  243. "mutual": false,
  244. "value": "0x00000000"
  245. },
  246. "mechanism": "Itsa me Kerberos!!",
  247. "open": true,
  248. "source": "\u003CDefault>",
  249. "target": "HTTP/intranet.google.com"
  250. },
  251. "status": {
  252. "net_error": 0,
  253. "security_status": 0
  254. }
  255. }
  256. )");
  257. EXPECT_EQ(expected, entries[1].params);
  258. expected = base::JSONReader::Read(R"(
  259. {
  260. "context": {
  261. "authority": "Dodgy Server",
  262. "flags": {
  263. "delegated": false,
  264. "mutual": false,
  265. "value": "0x00000000"
  266. },
  267. "mechanism": "Itsa me Kerberos!!",
  268. "open": false,
  269. "source": "\u003CDefault>",
  270. "target": "HTTP/intranet.google.com"
  271. },
  272. "status": {
  273. "net_error": 0,
  274. "security_status": 0
  275. }
  276. }
  277. )");
  278. EXPECT_EQ(expected, entries[3].params);
  279. }
  280. } // namespace net