net/http/transport_security_persister_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/http/transport_security_persister.h"
   6
   7 #include <map>
   8 #include <string>
   9 #include <vector>
  10
  11 #include "base/files/file_path.h"
  12 #include "base/files/file_util.h"
  13 #include "base/files/scoped_temp_dir.h"
  14 #include "base/message_loop/message_loop.h"
  15 #include "net/http/transport_security_state.h"
  16 #include "testing/gtest/include/gtest/gtest.h"
  17
  18 using net::TransportSecurityPersister;
  19 using net::TransportSecurityState;
  20
  21 class TransportSecurityPersisterTest : public testing::Test {
  22  public:
  23   TransportSecurityPersisterTest() {
  24   }
  25
  26   ~TransportSecurityPersisterTest() override {
  27     base::MessageLoopForIO::current()->RunUntilIdle();
  28   }
  29
  30   void SetUp() override {
  31     ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
  32     persister_.reset(new TransportSecurityPersister(
  33         &state_,
  34         temp_dir_.path(),
  35         base::MessageLoopForIO::current()->message_loop_proxy(),
  36         false));
  37   }
  38
  39  protected:
  40   base::ScopedTempDir temp_dir_;
  41   TransportSecurityState state_;
  42   scoped_ptr<TransportSecurityPersister> persister_;
  43 };
  44
  45 TEST_F(TransportSecurityPersisterTest, SerializeData1) {
  46   std::string output;
  47   bool dirty;
  48
  49   EXPECT_TRUE(persister_->SerializeData(&output));
  50   EXPECT_TRUE(persister_->LoadEntries(output, &dirty));
  51   EXPECT_FALSE(dirty);
  52 }
  53
  54 TEST_F(TransportSecurityPersisterTest, SerializeData2) {
  55   TransportSecurityState::DomainState domain_state;
  56   const base::Time current_time(base::Time::Now());
  57   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
  58   static const char kYahooDomain[] = "yahoo.com";
  59
  60   EXPECT_FALSE(state_.GetStaticDomainState(kYahooDomain, &domain_state));
  61   EXPECT_FALSE(state_.GetDynamicDomainState(kYahooDomain, &domain_state));
  62
  63   bool include_subdomains = true;
  64   state_.AddHSTS(kYahooDomain, expiry, include_subdomains);
  65
  66   std::string output;
  67   bool dirty;
  68   EXPECT_TRUE(persister_->SerializeData(&output));
  69   EXPECT_TRUE(persister_->LoadEntries(output, &dirty));
  70
  71   EXPECT_TRUE(state_.GetDynamicDomainState(kYahooDomain, &domain_state));
  72   EXPECT_EQ(domain_state.sts.upgrade_mode,
  73             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
  74   EXPECT_TRUE(state_.GetDynamicDomainState("foo.yahoo.com", &domain_state));
  75   EXPECT_EQ(domain_state.sts.upgrade_mode,
  76             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
  77   EXPECT_TRUE(state_.GetDynamicDomainState("foo.bar.yahoo.com", &domain_state));
  78   EXPECT_EQ(domain_state.sts.upgrade_mode,
  79             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
  80   EXPECT_TRUE(
  81       state_.GetDynamicDomainState("foo.bar.baz.yahoo.com", &domain_state));
  82   EXPECT_EQ(domain_state.sts.upgrade_mode,
  83             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
  84   EXPECT_FALSE(state_.GetStaticDomainState("com", &domain_state));
  85 }
  86
  87 TEST_F(TransportSecurityPersisterTest, SerializeData3) {
  88   // Add an entry.
  89   net::HashValue fp1(net::HASH_VALUE_SHA1);
  90   memset(fp1.data(), 0, fp1.size());
  91   net::HashValue fp2(net::HASH_VALUE_SHA1);
  92   memset(fp2.data(), 1, fp2.size());
  93   base::Time expiry =
  94       base::Time::Now() + base::TimeDelta::FromSeconds(1000);
  95   net::HashValueVector dynamic_spki_hashes;
  96   dynamic_spki_hashes.push_back(fp1);
  97   dynamic_spki_hashes.push_back(fp2);
  98   bool include_subdomains = false;
  99   state_.AddHSTS("www.example.com", expiry, include_subdomains);
 100   state_.AddHPKP("www.example.com", expiry, include_subdomains,
 101                  dynamic_spki_hashes);
 102
 103   // Add another entry.
 104   memset(fp1.data(), 2, fp1.size());
 105   memset(fp2.data(), 3, fp2.size());
 106   expiry =
 107       base::Time::Now() + base::TimeDelta::FromSeconds(3000);
 108   dynamic_spki_hashes.push_back(fp1);
 109   dynamic_spki_hashes.push_back(fp2);
 110   state_.AddHSTS("www.example.net", expiry, include_subdomains);
 111   state_.AddHPKP("www.example.net", expiry, include_subdomains,
 112                  dynamic_spki_hashes);
 113
 114   // Save a copy of everything.
 115   std::map<std::string, TransportSecurityState::DomainState> saved;
 116   TransportSecurityState::Iterator i(state_);
 117   while (i.HasNext()) {
 118     saved[i.hostname()] = i.domain_state();
 119     i.Advance();
 120   }
 121
 122   std::string serialized;
 123   EXPECT_TRUE(persister_->SerializeData(&serialized));
 124
 125   // Persist the data to the file. For the test to be fast and not flaky, we
 126   // just do it directly rather than call persister_->StateIsDirty. (That uses
 127   // ImportantFileWriter, which has an asynchronous commit interval rather
 128   // than block.) Use a different basename just for cleanliness.
 129   base::FilePath path =
 130       temp_dir_.path().AppendASCII("TransportSecurityPersisterTest");
 131   EXPECT_TRUE(base::WriteFile(path, serialized.c_str(), serialized.size()));
 132
 133   // Read the data back.
 134   std::string persisted;
 135   EXPECT_TRUE(base::ReadFileToString(path, &persisted));
 136   EXPECT_EQ(persisted, serialized);
 137   bool dirty;
 138   EXPECT_TRUE(persister_->LoadEntries(persisted, &dirty));
 139   EXPECT_FALSE(dirty);
 140
 141   // Check that states are the same as saved.
 142   size_t count = 0;
 143   TransportSecurityState::Iterator j(state_);
 144   while (j.HasNext()) {
 145     count++;
 146     j.Advance();
 147   }
 148   EXPECT_EQ(count, saved.size());
 149 }
 150
 151 TEST_F(TransportSecurityPersisterTest, SerializeDataOld) {
 152   // This is an old-style piece of transport state JSON, which has no creation
 153   // date.
 154   std::string output =
 155       "{ "
 156       "\"NiyD+3J1r6z1wjl2n1ALBu94Zj9OsEAMo0kCN8js0Uk=\": {"
 157       "\"expiry\": 1266815027.983453, "
 158       "\"include_subdomains\": false, "
 159       "\"mode\": \"strict\" "
 160       "}"
 161       "}";
 162   bool dirty;
 163   EXPECT_TRUE(persister_->LoadEntries(output, &dirty));
 164   EXPECT_TRUE(dirty);
 165 }
 166
 167 TEST_F(TransportSecurityPersisterTest, PublicKeyHashes) {
 168   TransportSecurityState::DomainState domain_state;
 169   static const char kTestDomain[] = "example.com";
 170   EXPECT_FALSE(state_.GetDynamicDomainState(kTestDomain, &domain_state));
 171   net::HashValueVector hashes;
 172   std::string failure_log;
 173   EXPECT_FALSE(domain_state.CheckPublicKeyPins(hashes, &failure_log));
 174
 175   net::HashValue sha1(net::HASH_VALUE_SHA1);
 176   memset(sha1.data(), '1', sha1.size());
 177   domain_state.pkp.spki_hashes.push_back(sha1);
 178
 179   EXPECT_FALSE(domain_state.CheckPublicKeyPins(hashes, &failure_log));
 180
 181   hashes.push_back(sha1);
 182   EXPECT_TRUE(domain_state.CheckPublicKeyPins(hashes, &failure_log));
 183
 184   hashes[0].data()[0] = '2';
 185   EXPECT_FALSE(domain_state.CheckPublicKeyPins(hashes, &failure_log));
 186
 187   const base::Time current_time(base::Time::Now());
 188   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
 189   bool include_subdomains = false;
 190   state_.AddHSTS(kTestDomain, expiry, include_subdomains);
 191   state_.AddHPKP(
 192       kTestDomain, expiry, include_subdomains, domain_state.pkp.spki_hashes);
 193   std::string serialized;
 194   EXPECT_TRUE(persister_->SerializeData(&serialized));
 195   bool dirty;
 196   EXPECT_TRUE(persister_->LoadEntries(serialized, &dirty));
 197
 198   TransportSecurityState::DomainState new_domain_state;
 199   EXPECT_TRUE(state_.GetDynamicDomainState(kTestDomain, &new_domain_state));
 200   EXPECT_EQ(1u, new_domain_state.pkp.spki_hashes.size());
 201   EXPECT_EQ(sha1.tag, new_domain_state.pkp.spki_hashes[0].tag);
 202   EXPECT_EQ(0,
 203             memcmp(new_domain_state.pkp.spki_hashes[0].data(),
 204                    sha1.data(),
 205                    sha1.size()));
 206 }