chromeos/network/network_cert_migrator_unittest.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chromeos/network/network_cert_migrator.h"
   6
   7 #include <cert.h>
   8 #include <pk11pub.h>
   9 #include <string>
  10
  11 #include "base/files/file_path.h"
  12 #include "base/run_loop.h"
  13 #include "base/strings/string_number_conversions.h"
  14 #include "chromeos/cert_loader.h"
  15 #include "chromeos/dbus/dbus_thread_manager.h"
  16 #include "chromeos/dbus/shill_profile_client.h"
  17 #include "chromeos/dbus/shill_service_client.h"
  18 #include "chromeos/network/network_state_handler.h"
  19 #include "crypto/scoped_nss_types.h"
  20 #include "crypto/scoped_test_nss_db.h"
  21 #include "net/base/test_data_directory.h"
  22 #include "net/cert/nss_cert_database_chromeos.h"
  23 #include "net/cert/x509_certificate.h"
  24 #include "net/test/cert_test_util.h"
  25 #include "testing/gtest/include/gtest/gtest.h"
  26 #include "third_party/cros_system_api/dbus/service_constants.h"
  27
  28 namespace chromeos {
  29
  30 namespace {
  31
  32 const char* kWifiStub = "wifi_stub";
  33 const char* kEthernetEapStub = "ethernet_eap_stub";
  34 const char* kVPNStub = "vpn_stub";
  35 const char* kProfile = "/profile/profile1";
  36
  37 }  // namespace
  38
  39 class NetworkCertMigratorTest : public testing::Test {
  40  public:
  41   NetworkCertMigratorTest() : service_test_(nullptr) {}
  42   ~NetworkCertMigratorTest() override {}
  43
  44   void SetUp() override {
  45     ASSERT_TRUE(test_nssdb_.is_open());
  46     // Use the same DB for public and private slot.
  47     test_nsscertdb_.reset(new net::NSSCertDatabaseChromeOS(
  48         crypto::ScopedPK11Slot(PK11_ReferenceSlot(test_nssdb_.slot())),
  49         crypto::ScopedPK11Slot(PK11_ReferenceSlot(test_nssdb_.slot()))));
  50     test_nsscertdb_->SetSlowTaskRunnerForTest(
  51         message_loop_.message_loop_proxy());
  52
  53     DBusThreadManager::Initialize();
  54     service_test_ =
  55         DBusThreadManager::Get()->GetShillServiceClient()->GetTestInterface();
  56     DBusThreadManager::Get()
  57         ->GetShillProfileClient()
  58         ->GetTestInterface()
  59         ->AddProfile(kProfile, "" /* userhash */);
  60     base::RunLoop().RunUntilIdle();
  61     service_test_->ClearServices();
  62     base::RunLoop().RunUntilIdle();
  63
  64     CertLoader::Initialize();
  65     CertLoader* cert_loader_ = CertLoader::Get();
  66     cert_loader_->StartWithNSSDB(test_nsscertdb_.get());
  67   }
  68
  69   void TearDown() override {
  70     network_cert_migrator_.reset();
  71     network_state_handler_.reset();
  72     CertLoader::Shutdown();
  73     DBusThreadManager::Shutdown();
  74   }
  75
  76  protected:
  77   void SetupTestClientCert() {
  78     test_client_cert_ = net::ImportClientCertAndKeyFromFile(
  79         net::GetTestCertsDirectory(), "client_1.pem", "client_1.pk8",
  80         test_nssdb_.slot());
  81     ASSERT_TRUE(test_client_cert_.get());
  82
  83     int slot_id = -1;
  84     test_client_cert_pkcs11_id_ = CertLoader::GetPkcs11IdAndSlotForCert(
  85         *test_client_cert_, &slot_id);
  86     ASSERT_FALSE(test_client_cert_pkcs11_id_.empty());
  87     ASSERT_NE(-1, slot_id);
  88     test_client_cert_slot_id_ = base::IntToString(slot_id);
  89   }
  90
  91   void SetupNetworkHandlers() {
  92     network_state_handler_.reset(NetworkStateHandler::InitializeForTest());
  93     network_cert_migrator_.reset(new NetworkCertMigrator);
  94     network_cert_migrator_->Init(network_state_handler_.get());
  95   }
  96
  97   void AddService(const std::string& network_id,
  98                   const std::string& type,
  99                   const std::string& state) {
 100     service_test_->AddService(network_id /* service_path */,
 101                               network_id /* guid */,
 102                               network_id /* name */,
 103                               type,
 104                               state,
 105                               true /* add_to_visible */);
 106
 107     // Ensure that the service appears as 'configured', i.e. is associated to a
 108     // Shill profile.
 109     service_test_->SetServiceProperty(
 110         network_id, shill::kProfileProperty, base::StringValue(kProfile));
 111   }
 112
 113   void SetupNetworkWithEapCertId(bool wifi, const std::string& cert_id) {
 114     std::string type = wifi ? shill::kTypeWifi: shill::kTypeEthernetEap;
 115     std::string name = wifi ? kWifiStub : kEthernetEapStub;
 116     AddService(name, type, shill::kStateOnline);
 117     service_test_->SetServiceProperty(
 118         name, shill::kEapCertIdProperty, base::StringValue(cert_id));
 119     service_test_->SetServiceProperty(
 120         name, shill::kEapKeyIdProperty, base::StringValue(cert_id));
 121
 122     if (wifi) {
 123       service_test_->SetServiceProperty(
 124           name,
 125           shill::kSecurityClassProperty,
 126           base::StringValue(shill::kSecurity8021x));
 127     }
 128   }
 129
 130   void GetEapCertId(bool wifi, std::string* cert_id) {
 131     cert_id->clear();
 132
 133     std::string name = wifi ? kWifiStub : kEthernetEapStub;
 134     const base::DictionaryValue* properties =
 135         service_test_->GetServiceProperties(name);
 136     properties->GetStringWithoutPathExpansion(shill::kEapCertIdProperty,
 137                                               cert_id);
 138   }
 139
 140   void SetupVpnWithCertId(bool open_vpn,
 141                           const std::string& slot_id,
 142                           const std::string& pkcs11_id) {
 143     AddService(kVPNStub, shill::kTypeVPN, shill::kStateIdle);
 144     base::DictionaryValue provider;
 145     if (open_vpn) {
 146       provider.SetStringWithoutPathExpansion(shill::kTypeProperty,
 147                                              shill::kProviderOpenVpn);
 148       provider.SetStringWithoutPathExpansion(
 149           shill::kOpenVPNClientCertIdProperty, pkcs11_id);
 150     } else {
 151       provider.SetStringWithoutPathExpansion(shill::kTypeProperty,
 152                                              shill::kProviderL2tpIpsec);
 153       provider.SetStringWithoutPathExpansion(
 154           shill::kL2tpIpsecClientCertSlotProperty, slot_id);
 155       provider.SetStringWithoutPathExpansion(
 156           shill::kL2tpIpsecClientCertIdProperty, pkcs11_id);
 157     }
 158     service_test_->SetServiceProperty(
 159         kVPNStub, shill::kProviderProperty, provider);
 160   }
 161
 162   void GetVpnCertId(bool open_vpn,
 163                     std::string* slot_id,
 164                     std::string* pkcs11_id) {
 165     slot_id->clear();
 166     pkcs11_id->clear();
 167
 168     const base::DictionaryValue* properties =
 169         service_test_->GetServiceProperties(kVPNStub);
 170     ASSERT_TRUE(properties);
 171     const base::DictionaryValue* provider = nullptr;
 172     properties->GetDictionaryWithoutPathExpansion(shill::kProviderProperty,
 173                                                   &provider);
 174     if (!provider)
 175       return;
 176     if (open_vpn) {
 177       provider->GetStringWithoutPathExpansion(
 178           shill::kOpenVPNClientCertIdProperty, pkcs11_id);
 179     } else {
 180       provider->GetStringWithoutPathExpansion(
 181           shill::kL2tpIpsecClientCertSlotProperty, slot_id);
 182       provider->GetStringWithoutPathExpansion(
 183           shill::kL2tpIpsecClientCertIdProperty, pkcs11_id);
 184     }
 185   }
 186
 187   ShillServiceClient::TestInterface* service_test_;
 188   scoped_refptr<net::X509Certificate> test_client_cert_;
 189   std::string test_client_cert_pkcs11_id_;
 190   std::string test_client_cert_slot_id_;
 191   base::MessageLoop message_loop_;
 192
 193  private:
 194   scoped_ptr<NetworkStateHandler> network_state_handler_;
 195   scoped_ptr<NetworkCertMigrator> network_cert_migrator_;
 196   crypto::ScopedTestNSSDB test_nssdb_;
 197   scoped_ptr<net::NSSCertDatabaseChromeOS> test_nsscertdb_;
 198
 199   DISALLOW_COPY_AND_ASSIGN(NetworkCertMigratorTest);
 200 };
 201
 202 TEST_F(NetworkCertMigratorTest, MigrateOnInitialization) {
 203   SetupTestClientCert();
 204   // Add a network for migration before the handlers are initialized.
 205   SetupNetworkWithEapCertId(true /* wifi */,
 206                             "123:" + test_client_cert_pkcs11_id_);
 207   SetupNetworkHandlers();
 208   base::RunLoop().RunUntilIdle();
 209
 210   std::string cert_id;
 211   GetEapCertId(true /* wifi */, &cert_id);
 212   std::string expected_cert_id =
 213       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 214   EXPECT_EQ(expected_cert_id, cert_id);
 215 }
 216
 217 TEST_F(NetworkCertMigratorTest, MigrateEapCertIdNoMatchingCert) {
 218   SetupTestClientCert();
 219   SetupNetworkHandlers();
 220   base::RunLoop().RunUntilIdle();
 221
 222   // Add a new network for migration after the handlers are initialized.
 223   SetupNetworkWithEapCertId(true /* wifi */, "unknown pkcs11 id");
 224
 225   base::RunLoop().RunUntilIdle();
 226   // Since the PKCS11 ID is unknown, the certificate configuration will be
 227   // cleared.
 228   std::string cert_id;
 229   GetEapCertId(true /* wifi */, &cert_id);
 230   EXPECT_EQ(std::string(), cert_id);
 231 }
 232
 233 TEST_F(NetworkCertMigratorTest, MigrateEapCertIdNoSlotId) {
 234   SetupTestClientCert();
 235   SetupNetworkHandlers();
 236   base::RunLoop().RunUntilIdle();
 237
 238   // Add a new network for migration after the handlers are initialized.
 239   SetupNetworkWithEapCertId(true /* wifi */, test_client_cert_pkcs11_id_);
 240
 241   base::RunLoop().RunUntilIdle();
 242
 243   std::string cert_id;
 244   GetEapCertId(true /* wifi */, &cert_id);
 245   std::string expected_cert_id =
 246       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 247   EXPECT_EQ(expected_cert_id, cert_id);
 248 }
 249
 250 TEST_F(NetworkCertMigratorTest, MigrateWifiEapCertIdWrongSlotId) {
 251   SetupTestClientCert();
 252   SetupNetworkHandlers();
 253   base::RunLoop().RunUntilIdle();
 254
 255   // Add a new network for migration after the handlers are initialized.
 256   SetupNetworkWithEapCertId(true /* wifi */,
 257                             "123:" + test_client_cert_pkcs11_id_);
 258
 259   base::RunLoop().RunUntilIdle();
 260
 261   std::string cert_id;
 262   GetEapCertId(true /* wifi */, &cert_id);
 263   std::string expected_cert_id =
 264       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 265   EXPECT_EQ(expected_cert_id, cert_id);
 266 }
 267
 268 TEST_F(NetworkCertMigratorTest, DoNotChangeEapCertIdWithCorrectSlotId) {
 269   SetupTestClientCert();
 270   SetupNetworkHandlers();
 271   base::RunLoop().RunUntilIdle();
 272
 273   std::string expected_cert_id =
 274       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 275
 276   // Add a new network for migration after the handlers are initialized.
 277   SetupNetworkWithEapCertId(true /* wifi */, expected_cert_id);
 278
 279   base::RunLoop().RunUntilIdle();
 280
 281   std::string cert_id;
 282   GetEapCertId(true /* wifi */, &cert_id);
 283   EXPECT_EQ(expected_cert_id, cert_id);
 284 }
 285
 286 TEST_F(NetworkCertMigratorTest, IgnoreOpenVPNCertId) {
 287   SetupTestClientCert();
 288   SetupNetworkHandlers();
 289   base::RunLoop().RunUntilIdle();
 290
 291   const char kPkcs11Id[] = "any slot id";
 292
 293   // Add a new network for migration after the handlers are initialized.
 294   SetupVpnWithCertId(
 295       true /* OpenVPN */, std::string() /* no slot id */, kPkcs11Id);
 296
 297   base::RunLoop().RunUntilIdle();
 298
 299   std::string pkcs11_id;
 300   std::string unused_slot_id;
 301   GetVpnCertId(true /* OpenVPN */, &unused_slot_id, &pkcs11_id);
 302   EXPECT_EQ(kPkcs11Id, pkcs11_id);
 303 }
 304
 305 TEST_F(NetworkCertMigratorTest, MigrateEthernetEapCertIdWrongSlotId) {
 306   SetupTestClientCert();
 307   SetupNetworkHandlers();
 308   base::RunLoop().RunUntilIdle();
 309
 310   // Add a new network for migration after the handlers are initialized.
 311   SetupNetworkWithEapCertId(
 312       false /* ethernet */, "123:" + test_client_cert_pkcs11_id_);
 313
 314   base::RunLoop().RunUntilIdle();
 315
 316   std::string cert_id;
 317   GetEapCertId(false /* ethernet */, &cert_id);
 318   std::string expected_cert_id =
 319       test_client_cert_slot_id_ + ":" + test_client_cert_pkcs11_id_;
 320   EXPECT_EQ(expected_cert_id, cert_id);
 321 }
 322
 323 TEST_F(NetworkCertMigratorTest, MigrateIpsecCertIdWrongSlotId) {
 324   SetupTestClientCert();
 325   SetupNetworkHandlers();
 326   base::RunLoop().RunUntilIdle();
 327
 328   // Add a new network for migration after the handlers are initialized.
 329   SetupVpnWithCertId(false /* IPsec */, "123", test_client_cert_pkcs11_id_);
 330
 331   base::RunLoop().RunUntilIdle();
 332
 333   std::string pkcs11_id;
 334   std::string slot_id;
 335   GetVpnCertId(false /* IPsec */, &slot_id, &pkcs11_id);
 336   EXPECT_EQ(test_client_cert_pkcs11_id_, pkcs11_id);
 337   EXPECT_EQ(test_client_cert_slot_id_, slot_id);
 338 }
 339
 340 }  // namespace chromeos