third_party_authenticator_unittest.cc 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <memory>
  5. #include <utility>
  6. #include "base/bind.h"
  7. #include "base/memory/ptr_util.h"
  8. #include "base/run_loop.h"
  9. #include "net/base/net_errors.h"
  10. #include "remoting/base/rsa_key_pair.h"
  11. #include "remoting/protocol/authenticator.h"
  12. #include "remoting/protocol/authenticator_test_base.h"
  13. #include "remoting/protocol/channel_authenticator.h"
  14. #include "remoting/protocol/connection_tester.h"
  15. #include "remoting/protocol/fake_authenticator.h"
  16. #include "remoting/protocol/third_party_authenticator_base.h"
  17. #include "remoting/protocol/third_party_client_authenticator.h"
  18. #include "remoting/protocol/third_party_host_authenticator.h"
  19. #include "remoting/protocol/token_validator.h"
  20. #include "remoting/protocol/v2_authenticator.h"
  21. #include "testing/gmock/include/gmock/gmock.h"
  22. #include "testing/gtest/include/gtest/gtest.h"
  23. #include "third_party/libjingle_xmpp/xmllite/xmlelement.h"
  24. using testing::_;
  25. using testing::DeleteArg;
  26. using testing::SaveArg;
  27. namespace {
  28. const int kMessageSize = 100;
  29. const int kMessages = 1;
  30. const char kTokenUrl[] = "https://example.com/Issue";
  31. const char kTokenScope[] = "host:a@b.com/1 client:a@b.com/2";
  32. const char kToken[] = "abc123456xyz789";
  33. const char kSharedSecret[] = "1234-1234-5678";
  34. const char kSharedSecretBad[] = "0000-0000-0001";
  35. } // namespace
  36. namespace remoting {
  37. namespace protocol {
  38. class ThirdPartyAuthenticatorTest : public AuthenticatorTestBase {
  39. class FakeTokenFetcher {
  40. public:
  41. void FetchThirdPartyToken(
  42. const std::string& token_url,
  43. const std::string& scope,
  44. const ThirdPartyTokenFetchedCallback& token_fetched_callback) {
  45. ASSERT_EQ(token_url, kTokenUrl);
  46. ASSERT_EQ(scope, kTokenScope);
  47. ASSERT_FALSE(token_fetched_callback.is_null());
  48. on_token_fetched_ = token_fetched_callback;
  49. }
  50. void OnTokenFetched(const std::string& token,
  51. const std::string& shared_secret) {
  52. ASSERT_FALSE(on_token_fetched_.is_null());
  53. if (!shared_secret.empty()) {
  54. std::move(on_token_fetched_).Run(token, shared_secret);
  55. } else {
  56. std::move(on_token_fetched_)
  57. .Run(token, Authenticator::RejectionReason::INVALID_CREDENTIALS);
  58. }
  59. }
  60. private:
  61. ThirdPartyTokenFetchedCallback on_token_fetched_;
  62. };
  63. class FakeTokenValidator : public TokenValidator {
  64. public:
  65. FakeTokenValidator()
  66. : token_url_(kTokenUrl),
  67. token_scope_(kTokenScope) {}
  68. ~FakeTokenValidator() override = default;
  69. void ValidateThirdPartyToken(
  70. const std::string& token,
  71. TokenValidatedCallback token_validated_callback) override {
  72. ASSERT_FALSE(token_validated_callback.is_null());
  73. on_token_validated_ = std::move(token_validated_callback);
  74. }
  75. void OnTokenValidated(const std::string& shared_secret) {
  76. ASSERT_FALSE(on_token_validated_.is_null());
  77. if (!shared_secret.empty()) {
  78. std::move(on_token_validated_).Run(shared_secret);
  79. } else {
  80. std::move(on_token_validated_)
  81. .Run(Authenticator::RejectionReason::INVALID_CREDENTIALS);
  82. }
  83. }
  84. const GURL& token_url() const override { return token_url_; }
  85. const std::string& token_scope() const override { return token_scope_; }
  86. private:
  87. GURL token_url_;
  88. std::string token_scope_;
  89. TokenValidatedCallback on_token_validated_;
  90. };
  91. public:
  92. ThirdPartyAuthenticatorTest() = default;
  93. ThirdPartyAuthenticatorTest(const ThirdPartyAuthenticatorTest&) = delete;
  94. ThirdPartyAuthenticatorTest& operator=(const ThirdPartyAuthenticatorTest&) =
  95. delete;
  96. ~ThirdPartyAuthenticatorTest() override = default;
  97. protected:
  98. void InitAuthenticators() {
  99. token_validator_ = new FakeTokenValidator();
  100. host_ = std::make_unique<ThirdPartyHostAuthenticator>(
  101. base::BindRepeating(&V2Authenticator::CreateForHost, host_cert_,
  102. key_pair_),
  103. base::WrapUnique(token_validator_));
  104. client_ = std::make_unique<ThirdPartyClientAuthenticator>(
  105. base::BindRepeating(&V2Authenticator::CreateForClient),
  106. base::BindRepeating(&FakeTokenFetcher::FetchThirdPartyToken,
  107. base::Unretained(&token_fetcher_)));
  108. }
  109. FakeTokenFetcher token_fetcher_;
  110. FakeTokenValidator* token_validator_;
  111. };
  112. TEST_F(ThirdPartyAuthenticatorTest, SuccessfulAuth) {
  113. ASSERT_NO_FATAL_FAILURE(InitAuthenticators());
  114. ASSERT_NO_FATAL_FAILURE(RunHostInitiatedAuthExchange());
  115. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, client_->state());
  116. ASSERT_NO_FATAL_FAILURE(token_fetcher_.OnTokenFetched(kToken, kSharedSecret));
  117. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, host_->state());
  118. ASSERT_NO_FATAL_FAILURE(token_validator_->OnTokenValidated(kSharedSecret));
  119. // Both sides have finished.
  120. ASSERT_EQ(Authenticator::ACCEPTED, host_->state());
  121. ASSERT_EQ(Authenticator::ACCEPTED, client_->state());
  122. // An authenticated channel can be created after the authentication.
  123. client_auth_ = client_->CreateChannelAuthenticator();
  124. host_auth_ = host_->CreateChannelAuthenticator();
  125. RunChannelAuth(false);
  126. StreamConnectionTester tester(host_socket_.get(), client_socket_.get(),
  127. kMessageSize, kMessages);
  128. base::RunLoop run_loop;
  129. tester.Start(run_loop.QuitClosure());
  130. run_loop.Run();
  131. tester.CheckResults();
  132. }
  133. TEST_F(ThirdPartyAuthenticatorTest, ClientNoSecret) {
  134. ASSERT_NO_FATAL_FAILURE(InitAuthenticators());
  135. ASSERT_NO_FATAL_FAILURE(RunHostInitiatedAuthExchange());
  136. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, client_->state());
  137. ASSERT_NO_FATAL_FAILURE(token_fetcher_.OnTokenFetched(kToken, std::string()));
  138. // The end result is that the client rejected the connection, since it
  139. // couldn't fetch the secret.
  140. ASSERT_EQ(Authenticator::REJECTED, client_->state());
  141. }
  142. TEST_F(ThirdPartyAuthenticatorTest, InvalidToken) {
  143. ASSERT_NO_FATAL_FAILURE(InitAuthenticators());
  144. ASSERT_NO_FATAL_FAILURE(RunHostInitiatedAuthExchange());
  145. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, client_->state());
  146. ASSERT_NO_FATAL_FAILURE(token_fetcher_.OnTokenFetched(
  147. kToken, kSharedSecret));
  148. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, host_->state());
  149. ASSERT_NO_FATAL_FAILURE(token_validator_->OnTokenValidated(std::string()));
  150. // The end result is that the host rejected the token.
  151. ASSERT_EQ(Authenticator::REJECTED, host_->state());
  152. }
  153. TEST_F(ThirdPartyAuthenticatorTest, CannotFetchToken) {
  154. ASSERT_NO_FATAL_FAILURE(InitAuthenticators());
  155. ASSERT_NO_FATAL_FAILURE(RunHostInitiatedAuthExchange());
  156. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, client_->state());
  157. ASSERT_NO_FATAL_FAILURE(
  158. token_fetcher_.OnTokenFetched(std::string(), std::string()));
  159. // The end result is that the client rejected the connection, since it
  160. // couldn't fetch the token.
  161. ASSERT_EQ(Authenticator::REJECTED, client_->state());
  162. }
  163. // Test that negotiation stops when the fake authentication is rejected.
  164. TEST_F(ThirdPartyAuthenticatorTest, HostBadSecret) {
  165. ASSERT_NO_FATAL_FAILURE(InitAuthenticators());
  166. ASSERT_NO_FATAL_FAILURE(RunHostInitiatedAuthExchange());
  167. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, client_->state());
  168. ASSERT_NO_FATAL_FAILURE(token_fetcher_.OnTokenFetched(kToken, kSharedSecret));
  169. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, host_->state());
  170. ASSERT_NO_FATAL_FAILURE(
  171. token_validator_->OnTokenValidated(kSharedSecretBad));
  172. // The end result is that the host rejected the fake authentication.
  173. ASSERT_EQ(Authenticator::REJECTED, client_->state());
  174. }
  175. TEST_F(ThirdPartyAuthenticatorTest, ClientBadSecret) {
  176. ASSERT_NO_FATAL_FAILURE(InitAuthenticators());
  177. ASSERT_NO_FATAL_FAILURE(RunHostInitiatedAuthExchange());
  178. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, client_->state());
  179. ASSERT_NO_FATAL_FAILURE(
  180. token_fetcher_.OnTokenFetched(kToken, kSharedSecretBad));
  181. ASSERT_EQ(Authenticator::PROCESSING_MESSAGE, host_->state());
  182. ASSERT_NO_FATAL_FAILURE(
  183. token_validator_->OnTokenValidated(kSharedSecret));
  184. // The end result is that the host rejected the fake authentication.
  185. ASSERT_EQ(Authenticator::REJECTED, client_->state());
  186. }
  187. } // namespace protocol
  188. } // namespace remoting