ssl_config_service_mojo_unittest.cc 6.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <memory>
  5. #include "base/files/file_util.h"
  6. #include "base/task/sequenced_task_runner.h"
  7. #include "base/task/task_traits.h"
  8. #include "base/test/scoped_feature_list.h"
  9. #include "base/test/task_environment.h"
  10. #include "build/build_config.h"
  11. #include "mojo/public/cpp/bindings/pending_remote.h"
  12. #include "net/base/test_completion_callback.h"
  13. #include "net/cert/test_root_certs.h"
  14. #include "net/cert/x509_util.h"
  15. #include "net/test/cert_test_util.h"
  16. #include "net/test/gtest_util.h"
  17. #include "net/test/test_data_directory.h"
  18. #include "net/url_request/url_request_context.h"
  19. #include "services/cert_verifier/cert_net_url_loader/cert_net_fetcher_url_loader.h"
  20. #include "services/cert_verifier/cert_verifier_service_factory.h"
  21. #include "services/network/network_context.h"
  22. #include "services/network/network_service.h"
  23. #include "services/network/public/cpp/features.h"
  24. #include "services/network/public/mojom/cert_verifier_service.mojom.h"
  25. #include "services/network/public/mojom/network_context.mojom.h"
  26. #include "services/network/ssl_config_service_mojo.h"
  27. #include "testing/gtest/include/gtest/gtest.h"
  28. namespace cert_verifier {
  29. // Base class for any tests that just need a NetworkService and a
  30. // TaskEnvironment, and to create NetworkContexts using the NetworkService.
  31. class SSLConfigServiceMojoTestWithCertVerifier : public testing::Test {
  32. public:
  33. SSLConfigServiceMojoTestWithCertVerifier()
  34. : task_environment_(base::test::TaskEnvironment::MainThreadType::IO),
  35. service_(network::NetworkService::CreateForTesting()),
  36. cert_verifier_service_impl_(
  37. cert_verifier_service_remote_.BindNewPipeAndPassReceiver()) {}
  38. ~SSLConfigServiceMojoTestWithCertVerifier() override = default;
  39. void DestroyService() { service_.reset(); }
  40. network::mojom::NetworkContextParamsPtr CreateNetworkContextParams() {
  41. mojo::PendingRemote<mojom::CertVerifierService> cv_service_remote;
  42. // Create a cert verifier service.
  43. cert_verifier_service_impl_.GetNewCertVerifierForTesting(
  44. cv_service_remote.InitWithNewPipeAndPassReceiver(),
  45. mojom::CertVerifierCreationParams::New(),
  46. &cert_net_fetcher_url_loader_);
  47. network::mojom::NetworkContextParamsPtr params =
  48. network::mojom::NetworkContextParams::New();
  49. params->cert_verifier_params =
  50. network::mojom::CertVerifierServiceRemoteParams::New(
  51. std::move(cv_service_remote));
  52. // Use a fixed proxy config, to avoid dependencies on local network
  53. // configuration.
  54. params->initial_proxy_config =
  55. net::ProxyConfigWithAnnotation::CreateDirect();
  56. return params;
  57. }
  58. void CreateNetworkContext(network::mojom::NetworkContextParamsPtr params) {
  59. network_context_ = std::make_unique<network::NetworkContext>(
  60. service_.get(), network_context_remote_.BindNewPipeAndPassReceiver(),
  61. std::move(params));
  62. }
  63. base::test::TaskEnvironment* task_environment() { return &task_environment_; }
  64. network::NetworkService* service() const { return service_.get(); }
  65. network::NetworkContext* network_context() { return network_context_.get(); }
  66. mojo::Remote<network::mojom::NetworkContext>& network_context_remote() {
  67. return network_context_remote_;
  68. }
  69. CertNetFetcherURLLoader* cert_net_fetcher_url_loader() {
  70. return cert_net_fetcher_url_loader_.get();
  71. }
  72. private:
  73. base::test::TaskEnvironment task_environment_;
  74. std::unique_ptr<network::NetworkService> service_;
  75. mojo::Remote<network::mojom::NetworkContext> network_context_remote_;
  76. std::unique_ptr<network::NetworkContext> network_context_;
  77. mojo::Remote<mojom::CertVerifierServiceFactory> cert_verifier_service_remote_;
  78. CertVerifierServiceFactoryImpl cert_verifier_service_impl_;
  79. scoped_refptr<CertNetFetcherURLLoader> cert_net_fetcher_url_loader_;
  80. };
  81. #if !BUILDFLAG(IS_IOS) && !BUILDFLAG(IS_ANDROID)
  82. TEST_F(SSLConfigServiceMojoTestWithCertVerifier, CRLSetIsApplied) {
  83. mojo::Remote<network::mojom::SSLConfigClient> ssl_config_client;
  84. network::mojom::NetworkContextParamsPtr context_params =
  85. CreateNetworkContextParams();
  86. context_params->ssl_config_client_receiver =
  87. ssl_config_client.BindNewPipeAndPassReceiver();
  88. CreateNetworkContext(std::move(context_params));
  89. network::SSLConfigServiceMojo* config_service =
  90. static_cast<network::SSLConfigServiceMojo*>(
  91. network_context()->url_request_context()->ssl_config_service());
  92. scoped_refptr<net::X509Certificate> root_cert =
  93. net::CreateCertificateChainFromFile(
  94. net::GetTestCertsDirectory(), "root_ca_cert.pem",
  95. net::X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
  96. ASSERT_TRUE(root_cert);
  97. net::ScopedTestRoot test_root(root_cert.get());
  98. scoped_refptr<net::X509Certificate> leaf_cert =
  99. net::CreateCertificateChainFromFile(
  100. net::GetTestCertsDirectory(), "ok_cert.pem",
  101. net::X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
  102. ASSERT_TRUE(leaf_cert);
  103. // Ensure that |leaf_cert| is trusted without any CRLSet explicitly
  104. // configured.
  105. net::TestCompletionCallback callback1;
  106. net::CertVerifyResult cert_verify_result1;
  107. std::unique_ptr<net::CertVerifier::Request> request1;
  108. int result =
  109. network_context()->url_request_context()->cert_verifier()->Verify(
  110. net::CertVerifier::RequestParams(leaf_cert, "127.0.0.1",
  111. /*flags=*/0,
  112. /*ocsp_response=*/std::string(),
  113. /*sct_list=*/std::string()),
  114. &cert_verify_result1, callback1.callback(), &request1,
  115. net::NetLogWithSource());
  116. ASSERT_THAT(callback1.GetResult(result), net::test::IsOk());
  117. // Load a CRLSet that removes trust in |leaf_cert| by SPKI.
  118. scoped_refptr<net::CRLSet> crl_set;
  119. std::string crl_set_bytes;
  120. ASSERT_TRUE(base::ReadFileToString(
  121. net::GetTestCertsDirectory().AppendASCII("crlset_by_leaf_spki.raw"),
  122. &crl_set_bytes));
  123. ASSERT_TRUE(net::CRLSet::ParseAndStoreUnparsedData(crl_set_bytes, &crl_set));
  124. config_service->OnNewCRLSet(crl_set);
  125. // Ensure that |leaf_cert| is revoked, due to the CRLSet being applied.
  126. net::TestCompletionCallback callback2;
  127. net::CertVerifyResult cert_verify_result2;
  128. std::unique_ptr<net::CertVerifier::Request> request2;
  129. result = network_context()->url_request_context()->cert_verifier()->Verify(
  130. net::CertVerifier::RequestParams(leaf_cert, "127.0.0.1",
  131. /*flags=*/0,
  132. /*ocsp_response=*/std::string(),
  133. /*sct_list=*/std::string()),
  134. &cert_verify_result2, callback2.callback(), &request2,
  135. net::NetLogWithSource());
  136. ASSERT_THAT(callback2.GetResult(result),
  137. net::test::IsError(net::ERR_CERT_REVOKED));
  138. }
  139. #endif // !BUILDFLAG(IS_IOS) && !BUILDFLAG(IS_ANDROID)
  140. } // namespace cert_verifier