chromeos/network/network_cert_migrator_unittest.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/network/network_cert_migrator.h"
   6
   7 #include <cert.h>
   8
   9 #include "base/files/file_path.h"
  10 #include "base/files/file_util.h"
  11 #include "base/run_loop.h"
  12 #include "base/strings/string_number_conversions.h"
  13 #include "chromeos/cert_loader.h"
  14 #include "chromeos/dbus/dbus_thread_manager.h"
  15 #include "chromeos/dbus/shill_profile_client.h"
  16 #include "chromeos/dbus/shill_service_client.h"
  17 #include "chromeos/network/network_state_handler.h"
  18 #include "chromeos/tpm_token_loader.h"
  19 #include "crypto/nss_util_internal.h"
  20 #include "crypto/scoped_test_nss_chromeos_user.h"
  21 #include "net/base/crypto_module.h"
  22 #include "net/base/net_errors.h"
  23 #include "net/base/test_data_directory.h"
  24 #include "net/cert/nss_cert_database_chromeos.h"
  25 #include "net/cert/x509_certificate.h"
  26 #include "net/test/cert_test_util.h"
  27 #include "testing/gtest/include/gtest/gtest.h"
  28 #include "third_party/cros_system_api/dbus/service_constants.h"
  29
  30 namespace chromeos {
  31
  32 namespace {
  33
  34 const char* kWifiStub = "wifi_stub";
  35 const char* kEthernetEapStub = "ethernet_eap_stub";
  36 const char* kVPNStub = "vpn_stub";
  37 const char* kNSSNickname = "nss_nickname";
  38 const char* kFakePEM = "pem";
  39 const char* kProfile = "/profile/profile1";
  40
  41 }  // namespace
  42
  43 class NetworkCertMigratorTest : public testing::Test {
  44  public:
  45   NetworkCertMigratorTest() : service_test_(NULL),
  46                               user_("user_hash") {
  47   }
  48   virtual ~NetworkCertMigratorTest() {}
  49
  50   virtual void SetUp() OVERRIDE {
  51     // Initialize NSS db for the user.
  52     ASSERT_TRUE(user_.constructed_successfully());
  53     user_.FinishInit();
  54     test_nssdb_.reset(new net::NSSCertDatabaseChromeOS(
  55         crypto::GetPublicSlotForChromeOSUser(user_.username_hash()),
  56         crypto::GetPrivateSlotForChromeOSUser(
  57             user_.username_hash(),
  58             base::Callback<void(crypto::ScopedPK11Slot)>())));
  59     test_nssdb_->SetSlowTaskRunnerForTest(message_loop_.message_loop_proxy());
  60
  61     DBusThreadManager::Initialize();
  62     service_test_ =
  63         DBusThreadManager::Get()->GetShillServiceClient()->GetTestInterface();
  64     DBusThreadManager::Get()
  65         ->GetShillProfileClient()
  66         ->GetTestInterface()
  67         ->AddProfile(kProfile, "" /* userhash */);
  68     base::RunLoop().RunUntilIdle();
  69     service_test_->ClearServices();
  70     base::RunLoop().RunUntilIdle();
  71
  72     CertLoader::Initialize();
  73     CertLoader* cert_loader_ = CertLoader::Get();
  74     cert_loader_->StartWithNSSDB(test_nssdb_.get());
  75   }
  76
  77   virtual void TearDown() OVERRIDE {
  78     network_cert_migrator_.reset();
  79     network_state_handler_.reset();
  80     CertLoader::Shutdown();
  81     DBusThreadManager::Shutdown();
  82     CleanupTestCert();
  83   }
  84
  85  protected:
  86   void SetupTestCACert() {
  87     scoped_refptr<net::X509Certificate> cert_wo_nickname =
  88         net::CreateCertificateListFromFile(net::GetTestCertsDirectory(),
  89                                            "eku-test-root.pem",
  90                                            net::X509Certificate::FORMAT_AUTO)
  91             .back();
  92     net::X509Certificate::GetPEMEncoded(cert_wo_nickname->os_cert_handle(),
  93                                         &test_ca_cert_pem_);
  94     std::string der_encoded;
  95     net::X509Certificate::GetDEREncoded(cert_wo_nickname->os_cert_handle(),
  96                                         &der_encoded);
  97     cert_wo_nickname = NULL;
  98
  99     test_ca_cert_ = net::X509Certificate::CreateFromBytesWithNickname(
 100         der_encoded.data(), der_encoded.size(), kNSSNickname);
 101     net::CertificateList cert_list;
 102     cert_list.push_back(test_ca_cert_);
 103     net::NSSCertDatabase::ImportCertFailureList failures;
 104     EXPECT_TRUE(test_nssdb_->ImportCACerts(
 105         cert_list, net::NSSCertDatabase::TRUST_DEFAULT, &failures));
 106     ASSERT_TRUE(failures.empty()) << net::ErrorToString(failures[0].net_error);
 107   }
 108
 109   void SetupTestClientCert() {
 110     std::string pkcs12_data;
 111     ASSERT_TRUE(base::ReadFileToString(
 112         net::GetTestCertsDirectory().Append("websocket_client_cert.p12"),
 113         &pkcs12_data));
 114
 115     net::CertificateList client_cert_list;
 116     scoped_refptr<net::CryptoModule> module(net::CryptoModule::CreateFromHandle(
 117         test_nssdb_->GetPrivateSlot().get()));
 118     ASSERT_EQ(net::OK,
 119               test_nssdb_->ImportFromPKCS12(module.get(),
 120                                             pkcs12_data,
 121                                             base::string16(),
 122                                             false,
 123                                             &client_cert_list));
 124     ASSERT_TRUE(!client_cert_list.empty());
 125     test_client_cert_ = client_cert_list[0];
 126
 127     int slot_id = -1;
 128     test_client_cert_pkcs11_id_ = CertLoader::GetPkcs11IdAndSlotForCert(
 129         *test_client_cert_, &slot_id);
 130     ASSERT_FALSE(test_client_cert_pkcs11_id_.empty());
 131     ASSERT_NE(-1, slot_id);
 132     test_client_cert_slot_id_ = base::IntToString(slot_id);
 133   }
 134
 135   void SetupNetworkHandlers() {
 136     network_state_handler_.reset(NetworkStateHandler::InitializeForTest());
 137     network_cert_migrator_.reset(new NetworkCertMigrator);
 138     network_cert_migrator_->Init(network_state_handler_.get());
 139   }
 140
 141   void AddService(const std::string& network_id,
 142                   const std::string& type,
 143                   const std::string& state) {
 144     service_test_->AddService(network_id /* service_path */,
 145                               network_id /* guid */,
 146                               network_id /* name */,
 147                               type,
 148                               state,
 149                               true /* add_to_visible */);
 150
 151     // Ensure that the service appears as 'configured', i.e. is associated to a
 152     // Shill profile.
 153     service_test_->SetServiceProperty(
 154         network_id, shill::kProfileProperty, base::StringValue(kProfile));
 155   }
 156
 157   void SetupWifiWithNss() {
 158     AddService(kWifiStub, shill::kTypeWifi, shill::kStateOnline);
 159     service_test_->SetServiceProperty(kWifiStub,
 160                                       shill::kEapCaCertNssProperty,
 161                                       base::StringValue(kNSSNickname));
 162   }
 163
 164   void SetupNetworkWithEapCertId(bool wifi, const std::string& cert_id) {
 165     std::string type = wifi ? shill::kTypeWifi: shill::kTypeEthernetEap;
 166     std::string name = wifi ? kWifiStub : kEthernetEapStub;
 167     AddService(name, type, shill::kStateOnline);
 168     service_test_->SetServiceProperty(
 169         name, shill::kEapCertIdProperty, base::StringValue(cert_id));
 170     service_test_->SetServiceProperty(
 171         name, shill::kEapKeyIdProperty, base::StringValue(cert_id));
 172
 173     if (wifi) {
 174       service_test_->SetServiceProperty(
 175           name,
 176           shill::kSecurityProperty,
 177           base::StringValue(shill::kSecurity8021x));
 178     }
 179   }
 180
 181   void GetEapCertId(bool wifi, std::string* cert_id) {
 182     cert_id->clear();
 183
 184     std::string name = wifi ? kWifiStub : kEthernetEapStub;
 185     const base::DictionaryValue* properties =
 186         service_test_->GetServiceProperties(name);
 187     properties->GetStringWithoutPathExpansion(shill::kEapCertIdProperty,
 188                                               cert_id);
 189   }
 190
 191   void SetupVpnWithCertId(bool open_vpn,
 192                           const std::string& slot_id,
 193                           const std::string& pkcs11_id) {
 194     AddService(kVPNStub, shill::kTypeVPN, shill::kStateIdle);
 195     base::DictionaryValue provider;
 196     if (open_vpn) {
 197       provider.SetStringWithoutPathExpansion(shill::kTypeProperty,
 198                                              shill::kProviderOpenVpn);
 199       provider.SetStringWithoutPathExpansion(
 200           shill::kOpenVPNClientCertIdProperty, pkcs11_id);
 201     } else {
 202       provider.SetStringWithoutPathExpansion(shill::kTypeProperty,
 203                                              shill::kProviderL2tpIpsec);
 204       provider.SetStringWithoutPathExpansion(
 205           shill::kL2tpIpsecClientCertSlotProperty, slot_id);
 206       provider.SetStringWithoutPathExpansion(
 207           shill::kL2tpIpsecClientCertIdProperty, pkcs11_id);
 208     }
 209     service_test_->SetServiceProperty(
 210         kVPNStub, shill::kProviderProperty, provider);
 211   }
 212
 213   void GetVpnCertId(bool open_vpn,
 214                     std::string* slot_id,
 215                     std::string* pkcs11_id) {
 216     slot_id->clear();
 217     pkcs11_id->clear();
 218
 219     const base::DictionaryValue* properties =
 220         service_test_->GetServiceProperties(kVPNStub);
 221     ASSERT_TRUE(properties);
 222     const base::DictionaryValue* provider = NULL;
 223     properties->GetDictionaryWithoutPathExpansion(shill::kProviderProperty,
 224                                                   &provider);
 225     if (!provider)
 226       return;
 227     if (open_vpn) {
 228       provider->GetStringWithoutPathExpansion(
 229           shill::kOpenVPNClientCertIdProperty, pkcs11_id);
 230     } else {
 231       provider->GetStringWithoutPathExpansion(
 232           shill::kL2tpIpsecClientCertSlotProperty, slot_id);
 233       provider->GetStringWithoutPathExpansion(
 234           shill::kL2tpIpsecClientCertIdProperty, pkcs11_id);
 235     }
 236   }
 237
 238   void GetEapCACertProperties(std::string* nss_nickname, std::string* ca_pem) {
 239     nss_nickname->clear();
 240     ca_pem->clear();
 241     const base::DictionaryValue* properties =
 242         service_test_->GetServiceProperties(kWifiStub);
 243     properties->GetStringWithoutPathExpansion(shill::kEapCaCertNssProperty,
 244                                               nss_nickname);
 245     const base::ListValue* ca_pems = NULL;
 246     properties->GetListWithoutPathExpansion(shill::kEapCaCertPemProperty,
 247                                             &ca_pems);
 248     if (ca_pems && !ca_pems->empty())
 249       ca_pems->GetString(0, ca_pem);
 250   }
 251
 252   void SetupVpnWithNss(bool open_vpn) {
 253     AddService(kVPNStub, shill::kTypeVPN, shill::kStateIdle);
 254     base::DictionaryValue provider;
 255     const char* nss_property = open_vpn ? shill::kOpenVPNCaCertNSSProperty
 256                                         : shill::kL2tpIpsecCaCertNssProperty;
 257     provider.SetStringWithoutPathExpansion(nss_property, kNSSNickname);
 258     service_test_->SetServiceProperty(
 259         kVPNStub, shill::kProviderProperty, provider);
 260   }
 261
 262   void GetVpnCACertProperties(bool open_vpn,
 263                               std::string* nss_nickname,
 264                               std::string* ca_pem) {
 265     nss_nickname->clear();
 266     ca_pem->clear();
 267     const base::DictionaryValue* properties =
 268         service_test_->GetServiceProperties(kVPNStub);
 269     const base::DictionaryValue* provider = NULL;
 270     properties->GetDictionaryWithoutPathExpansion(shill::kProviderProperty,
 271                                                   &provider);
 272     if (!provider)
 273       return;
 274     const char* nss_property = open_vpn ? shill::kOpenVPNCaCertNSSProperty
 275                                         : shill::kL2tpIpsecCaCertNssProperty;
 276     provider->GetStringWithoutPathExpansion(nss_property, nss_nickname);
 277     const base::ListValue* ca_pems = NULL;
 278     const char* pem_property = open_vpn ? shill::kOpenVPNCaCertPemProperty
 279                                         : shill::kL2tpIpsecCaCertPemProperty;
 280     provider->GetListWithoutPathExpansion(pem_property, &ca_pems);
 281     if (ca_pems && !ca_pems->empty())
 282       ca_pems->GetString(0, ca_pem);
 283   }
 284
 285   ShillServiceClient::TestInterface* service_test_;
 286   scoped_refptr<net::X509Certificate> test_ca_cert_;
 287   scoped_refptr<net::X509Certificate> test_client_cert_;
 288   std::string test_client_cert_pkcs11_id_;
 289   std::string test_client_cert_slot_id_;
 290   std::string test_ca_cert_pem_;
 291   base::MessageLoop message_loop_;
 292
 293  private:
 294   void CleanupTestCert() {
 295     if (test_ca_cert_.get())
 296       ASSERT_TRUE(test_nssdb_->DeleteCertAndKey(test_ca_cert_.get()));
 297
 298     if (test_client_cert_.get())
 299       ASSERT_TRUE(test_nssdb_->DeleteCertAndKey(test_client_cert_.get()));
 300   }
 301
 302   scoped_ptr<NetworkStateHandler> network_state_handler_;
 303   scoped_ptr<NetworkCertMigrator> network_cert_migrator_;
 304   crypto::ScopedTestNSSChromeOSUser user_;
 305   scoped_ptr<net::NSSCertDatabaseChromeOS> test_nssdb_;
 306
 307   DISALLOW_COPY_AND_ASSIGN(NetworkCertMigratorTest);
 308 };
 309
 310 TEST_F(NetworkCertMigratorTest, MigrateNssOnInitialization) {
 311   // Add a new network for migration before the handlers are initialized.
 312   SetupWifiWithNss();
 313   SetupTestCACert();
 314   SetupNetworkHandlers();
 315
 316   base::RunLoop().RunUntilIdle();
 317   std::string nss_nickname, ca_pem;
 318   GetEapCACertProperties(&nss_nickname, &ca_pem);
 319   EXPECT_TRUE(nss_nickname.empty());
 320   EXPECT_EQ(test_ca_cert_pem_, ca_pem);
 321 }
 322
 323 TEST_F(NetworkCertMigratorTest, MigrateNssOnNetworkAppearance) {
 324   SetupTestCACert();
 325   SetupNetworkHandlers();
 326   base::RunLoop().RunUntilIdle();
 327
 328   // Add a new network for migration after the handlers are initialized.
 329   SetupWifiWithNss();
 330
 331   base::RunLoop().RunUntilIdle();
 332   std::string nss_nickname, ca_pem;
 333   GetEapCACertProperties(&nss_nickname, &ca_pem);
 334   EXPECT_TRUE(nss_nickname.empty());
 335   EXPECT_EQ(test_ca_cert_pem_, ca_pem);
 336 }
 337
 338 TEST_F(NetworkCertMigratorTest, DoNotMigrateNssIfPemSet) {
 339   // Add a new network with an already set PEM property.
 340   SetupWifiWithNss();
 341   base::ListValue ca_pems;
 342   ca_pems.AppendString(kFakePEM);
 343   service_test_->SetServiceProperty(
 344       kWifiStub, shill::kEapCaCertPemProperty, ca_pems);
 345
 346   SetupTestCACert();
 347   SetupNetworkHandlers();
 348   base::RunLoop().RunUntilIdle();
 349
 350   std::string nss_nickname, ca_pem;
 351   GetEapCACertProperties(&nss_nickname, &ca_pem);
 352   EXPECT_TRUE(nss_nickname.empty());
 353   EXPECT_EQ(kFakePEM, ca_pem);
 354 }
 355
 356 TEST_F(NetworkCertMigratorTest, MigrateNssOpenVpn) {
 357   // Add a new network for migration before the handlers are initialized.
 358   SetupVpnWithNss(true /* OpenVPN */);
 359
 360   SetupTestCACert();
 361   SetupNetworkHandlers();
 362
 363   base::RunLoop().RunUntilIdle();
 364   std::string nss_nickname, ca_pem;
 365   GetVpnCACertProperties(true /* OpenVPN */, &nss_nickname, &ca_pem);
 366   EXPECT_TRUE(nss_nickname.empty());
 367   EXPECT_EQ(test_ca_cert_pem_, ca_pem);
 368 }
 369
 370 TEST_F(NetworkCertMigratorTest, MigrateNssIpsecVpn) {
 371   // Add a new network for migration before the handlers are initialized.
 372   SetupVpnWithNss(false /* not OpenVPN */);
 373
 374   SetupTestCACert();
 375   SetupNetworkHandlers();
 376
 377   base::RunLoop().RunUntilIdle();
 378   std::string nss_nickname, ca_pem;
 379   GetVpnCACertProperties(false /* not OpenVPN */, &nss_nickname, &ca_pem);
 380   EXPECT_TRUE(nss_nickname.empty());
 381   EXPECT_EQ(test_ca_cert_pem_, ca_pem);
 382 }
 383
 384 TEST_F(NetworkCertMigratorTest, MigrateEapCertIdNoMatchingCert) {
 385   SetupTestClientCert();
 386   SetupNetworkHandlers();
 387   base::RunLoop().RunUntilIdle();
 388
 389   // Add a new network for migration after the handlers are initialized.
 390   SetupNetworkWithEapCertId(true /* wifi */, "unknown pkcs11 id");
 391
 392   base::RunLoop().RunUntilIdle();
 393   // Since the PKCS11 ID is unknown, the certificate configuration will be
 394   // cleared.
 395   std::string cert_id;
 396   GetEapCertId(true /* wifi */, &cert_id);
 397   EXPECT_EQ(std::string(), cert_id);
 398 }
 399
 400 TEST_F(NetworkCertMigratorTest, MigrateEapCertIdNoSlotId) {
 401   SetupTestClientCert();
 402   SetupNetworkHandlers();
 403   base::RunLoop().RunUntilIdle();
 404
 405   // Add a new network for migration after the handlers are initialized.
 406   SetupNetworkWithEapCertId(true /* wifi */, test_client_cert_pkcs11_id_);
 407
 408   base::RunLoop().RunUntilIdle();
 409
 410   std::string cert_id;
 411   GetEapCertId(true /* wifi */, &cert_id);
 412   std::string expected_cert_id =
 413       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 414   EXPECT_EQ(expected_cert_id, cert_id);
 415 }
 416
 417 TEST_F(NetworkCertMigratorTest, MigrateWifiEapCertIdWrongSlotId) {
 418   SetupTestClientCert();
 419   SetupNetworkHandlers();
 420   base::RunLoop().RunUntilIdle();
 421
 422   // Add a new network for migration after the handlers are initialized.
 423   SetupNetworkWithEapCertId(true /* wifi */,
 424                             "123:" + test_client_cert_pkcs11_id_);
 425
 426   base::RunLoop().RunUntilIdle();
 427
 428   std::string cert_id;
 429   GetEapCertId(true /* wifi */, &cert_id);
 430   std::string expected_cert_id =
 431       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 432   EXPECT_EQ(expected_cert_id, cert_id);
 433 }
 434
 435 TEST_F(NetworkCertMigratorTest, DoNotChangeEapCertIdWithCorrectSlotId) {
 436   SetupTestClientCert();
 437   SetupNetworkHandlers();
 438   base::RunLoop().RunUntilIdle();
 439
 440   std::string expected_cert_id =
 441       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 442
 443   // Add a new network for migration after the handlers are initialized.
 444   SetupNetworkWithEapCertId(true /* wifi */, expected_cert_id);
 445
 446   base::RunLoop().RunUntilIdle();
 447
 448   std::string cert_id;
 449   GetEapCertId(true /* wifi */, &cert_id);
 450   EXPECT_EQ(expected_cert_id, cert_id);
 451 }
 452
 453 TEST_F(NetworkCertMigratorTest, IgnoreOpenVPNCertId) {
 454   SetupTestClientCert();
 455   SetupNetworkHandlers();
 456   base::RunLoop().RunUntilIdle();
 457
 458   const char kPkcs11Id[] = "any slot id";
 459
 460   // Add a new network for migration after the handlers are initialized.
 461   SetupVpnWithCertId(
 462       true /* OpenVPN */, std::string() /* no slot id */, kPkcs11Id);
 463
 464   base::RunLoop().RunUntilIdle();
 465
 466   std::string pkcs11_id;
 467   std::string unused_slot_id;
 468   GetVpnCertId(true /* OpenVPN */, &unused_slot_id, &pkcs11_id);
 469   EXPECT_EQ(kPkcs11Id, pkcs11_id);
 470 }
 471
 472 TEST_F(NetworkCertMigratorTest, MigrateEthernetEapCertIdWrongSlotId) {
 473   SetupTestClientCert();
 474   SetupNetworkHandlers();
 475   base::RunLoop().RunUntilIdle();
 476
 477   // Add a new network for migration after the handlers are initialized.
 478   SetupNetworkWithEapCertId(
 479       false /* ethernet */, "123:" + test_client_cert_pkcs11_id_);
 480
 481   base::RunLoop().RunUntilIdle();
 482
 483   std::string cert_id;
 484   GetEapCertId(false /* ethernet */, &cert_id);
 485   std::string expected_cert_id =
 486       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 487   EXPECT_EQ(expected_cert_id, cert_id);
 488 }
 489
 490 TEST_F(NetworkCertMigratorTest, MigrateIpsecCertIdWrongSlotId) {
 491   SetupTestClientCert();
 492   SetupNetworkHandlers();
 493   base::RunLoop().RunUntilIdle();
 494
 495   // Add a new network for migration after the handlers are initialized.
 496   SetupVpnWithCertId(false /* IPsec */, "123", test_client_cert_pkcs11_id_);
 497
 498   base::RunLoop().RunUntilIdle();
 499
 500   std::string pkcs11_id;
 501   std::string slot_id;
 502   GetVpnCertId(false /* IPsec */, &slot_id, &pkcs11_id);
 503   EXPECT_EQ(test_client_cert_pkcs11_id_, pkcs11_id);
 504   EXPECT_EQ(test_client_cert_slot_id_, slot_id);
 505 }
 506
 507 }  // namespace chromeos