chrome/browser/ssl/ssl_error_classification_unittest.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/ssl/ssl_error_classification.h"
   6
   7 #include "base/files/file_path.h"
   8 #include "base/strings/string_split.h"
   9 #include "base/time/time.h"
  10 #include "chrome/test/base/chrome_render_view_host_test_harness.h"
  11 #include "content/public/browser/web_contents.h"
  12 #include "net/base/net_errors.h"
  13 #include "net/base/test_data_directory.h"
  14 #include "net/cert/x509_cert_types.h"
  15 #include "net/cert/x509_certificate.h"
  16 #include "net/test/cert_test_util.h"
  17 #include "net/test/test_certificate_data.h"
  18 #include "testing/gtest/include/gtest/gtest.h"
  19 #include "url/gurl.h"
  20
  21 using base::Time;
  22 using content::WebContents;
  23
  24 class SSLErrorClassificationTest : public ChromeRenderViewHostTestHarness {
  25  public:
  26   SSLErrorClassificationTest() {
  27     SetThreadBundleOptions(content::TestBrowserThreadBundle::REAL_IO_THREAD);
  28   }
  29 };
  30
  31 TEST_F(SSLErrorClassificationTest, TestNameMismatch) {
  32   scoped_refptr<net::X509Certificate> google_cert(
  33       net::X509Certificate::CreateFromBytes(
  34           reinterpret_cast<const char*>(google_der), sizeof(google_der)));
  35   ASSERT_NE(static_cast<net::X509Certificate*>(NULL), google_cert.get());
  36   base::Time time = base::Time::NowFromSystemTime();
  37   std::vector<std::string> dns_names_google;
  38   dns_names_google.push_back("www");
  39   dns_names_google.push_back("google");
  40   dns_names_google.push_back("com");
  41   std::vector<std::vector<std::string>> dns_name_tokens_google;
  42   dns_name_tokens_google.push_back(dns_names_google);
  43   int cert_error = net::ERR_CERT_COMMON_NAME_INVALID;
  44   WebContents* contents = web_contents();
  45   {
  46     GURL origin("https://google.com");
  47     std::vector<std::string> host_name_tokens = base::SplitString(
  48         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  49     SSLErrorClassification ssl_error(contents,
  50                                      time,
  51                                      origin,
  52                                      cert_error,
  53                                      *google_cert);
  54     EXPECT_TRUE(ssl_error.IsWWWSubDomainMatch());
  55     EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens,
  56                                              dns_name_tokens_google));
  57     EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google,
  58                                              host_name_tokens));
  59     EXPECT_FALSE(ssl_error.IsSubDomainOutsideWildcard(host_name_tokens));
  60     EXPECT_FALSE(ssl_error.IsCertLikelyFromMultiTenantHosting());
  61     EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain());
  62   }
  63
  64   {
  65     GURL origin("https://foo.blah.google.com");
  66     std::vector<std::string> host_name_tokens = base::SplitString(
  67         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  68     SSLErrorClassification ssl_error(contents,
  69                                      time,
  70                                      origin,
  71                                      cert_error,
  72                                      *google_cert);
  73     EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch());
  74     EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens,
  75                                              dns_name_tokens_google));
  76     EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google,
  77                                              host_name_tokens));
  78     EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain());
  79   }
  80
  81   {
  82     GURL origin("https://foo.www.google.com");
  83     std::vector<std::string> host_name_tokens = base::SplitString(
  84         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
  85     SSLErrorClassification ssl_error(contents,
  86                                      time,
  87                                      origin,
  88                                      cert_error,
  89                                      *google_cert);
  90     EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch());
  91     EXPECT_TRUE(ssl_error.NameUnderAnyNames(host_name_tokens,
  92                                             dns_name_tokens_google));
  93     EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google,
  94                                              host_name_tokens));
  95     EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain());
  96   }
  97
  98   {
  99      GURL origin("https://www.google.com.foo");
 100      std::vector<std::string> host_name_tokens = base::SplitString(
 101          origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
 102      SSLErrorClassification ssl_error(contents,
 103                                       time,
 104                                       origin,
 105                                       cert_error,
 106                                       *google_cert);
 107      EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch());
 108      EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens,
 109                                               dns_name_tokens_google));
 110      EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google,
 111                                               host_name_tokens));
 112      EXPECT_FALSE(ssl_error.IsCertLikelyFromSameDomain());
 113   }
 114
 115   {
 116     GURL origin("https://www.foogoogle.com.");
 117     std::vector<std::string> host_name_tokens = base::SplitString(
 118         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
 119     SSLErrorClassification ssl_error(contents,
 120                                      time,
 121                                      origin,
 122                                      cert_error,
 123                                      *google_cert);
 124     EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch());
 125     EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens,
 126                                              dns_name_tokens_google));
 127     EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_google,
 128                                              host_name_tokens));
 129     EXPECT_FALSE(ssl_error.IsCertLikelyFromSameDomain());
 130   }
 131
 132   scoped_refptr<net::X509Certificate> webkit_cert(
 133       net::X509Certificate::CreateFromBytes(
 134           reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der)));
 135   ASSERT_NE(static_cast<net::X509Certificate*>(NULL), webkit_cert.get());
 136   std::vector<std::string> dns_names_webkit;
 137   dns_names_webkit.push_back("webkit");
 138   dns_names_webkit.push_back("org");
 139   std::vector<std::vector<std::string>> dns_name_tokens_webkit;
 140   dns_name_tokens_webkit.push_back(dns_names_webkit);
 141   {
 142     GURL origin("https://a.b.webkit.org");
 143     std::vector<std::string> host_name_tokens = base::SplitString(
 144         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
 145     SSLErrorClassification ssl_error(contents,
 146                                      time,
 147                                      origin,
 148                                      cert_error,
 149                                      *webkit_cert);
 150     EXPECT_FALSE(ssl_error.IsWWWSubDomainMatch());
 151     EXPECT_FALSE(ssl_error.NameUnderAnyNames(host_name_tokens,
 152                                              dns_name_tokens_webkit));
 153     EXPECT_FALSE(ssl_error.AnyNamesUnderName(dns_name_tokens_webkit,
 154                                              host_name_tokens));
 155     EXPECT_TRUE(ssl_error.IsSubDomainOutsideWildcard(host_name_tokens));
 156     EXPECT_FALSE(ssl_error.IsCertLikelyFromMultiTenantHosting());
 157     EXPECT_TRUE(ssl_error.IsCertLikelyFromSameDomain());
 158   }
 159 }
 160
 161 TEST_F(SSLErrorClassificationTest, TestHostNameHasKnownTLD) {
 162   EXPECT_TRUE(SSLErrorClassification::IsHostNameKnownTLD("www.google.com"));
 163   EXPECT_TRUE(SSLErrorClassification::IsHostNameKnownTLD("b.appspot.com"));
 164   EXPECT_FALSE(SSLErrorClassification::IsHostNameKnownTLD("a.private"));
 165 }
 166
 167 TEST_F(SSLErrorClassificationTest, TestPrivateURL) {
 168   EXPECT_FALSE(SSLErrorClassification::IsHostnameNonUniqueOrDotless(
 169       "www.foogoogle.com."));
 170   EXPECT_TRUE(SSLErrorClassification::IsHostnameNonUniqueOrDotless("go"));
 171   EXPECT_TRUE(
 172       SSLErrorClassification::IsHostnameNonUniqueOrDotless("172.17.108.108"));
 173   EXPECT_TRUE(SSLErrorClassification::IsHostnameNonUniqueOrDotless("foo.blah"));
 174 }