1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
6 #include "base/files/file_util.h"
7 #include "base/files/scoped_temp_dir.h"
8 #include "base/memory/ref_counted.h"
9 #include "base/memory/scoped_vector.h"
10 #include "base/message_loop/message_loop.h"
11 #include "base/run_loop.h"
12 #include "base/stl_util.h"
13 #include "net/base/test_data_directory.h"
14 #include "net/extras/sqlite/sqlite_channel_id_store.h"
15 #include "net/ssl/ssl_client_cert_type.h"
16 #include "net/test/cert_test_util.h"
17 #include "sql/statement.h"
18 #include "testing/gtest/include/gtest/gtest.h"
22 const base::FilePath::CharType kTestChannelIDFilename[] =
23 FILE_PATH_LITERAL("ChannelID");
25 class SQLiteChannelIDStoreTest : public testing::Test {
27 void Load(ScopedVector<DefaultChannelIDStore::ChannelID>* channel_ids) {
28 base::RunLoop run_loop;
29 store_->Load(base::Bind(&SQLiteChannelIDStoreTest::OnLoaded,
30 base::Unretained(this),
33 channel_ids->swap(channel_ids_);
38 base::RunLoop* run_loop,
39 scoped_ptr<ScopedVector<DefaultChannelIDStore::ChannelID> > channel_ids) {
40 channel_ids_.swap(*channel_ids);
45 static void ReadTestKeyAndCert(std::string* key, std::string* cert) {
46 base::FilePath key_path =
47 GetTestCertsDirectory().AppendASCII("unittest.originbound.key.der");
48 base::FilePath cert_path =
49 GetTestCertsDirectory().AppendASCII("unittest.originbound.der");
50 ASSERT_TRUE(base::ReadFileToString(key_path, key));
51 ASSERT_TRUE(base::ReadFileToString(cert_path, cert));
54 static base::Time GetTestCertExpirationTime() {
55 // Cert expiration time from 'dumpasn1 unittest.originbound.der':
56 // GeneralizedTime 19/11/2111 02:23:45 GMT
57 // base::Time::FromUTCExploded can't generate values past 2038 on 32-bit
58 // linux, so we use the raw value here.
59 return base::Time::FromInternalValue(GG_INT64_C(16121816625000000));
62 static base::Time GetTestCertCreationTime() {
63 // UTCTime 13/12/2011 02:23:45 GMT
64 base::Time::Exploded exploded_time;
65 exploded_time.year = 2011;
66 exploded_time.month = 12;
67 exploded_time.day_of_week = 0; // Unused.
68 exploded_time.day_of_month = 13;
69 exploded_time.hour = 2;
70 exploded_time.minute = 23;
71 exploded_time.second = 45;
72 exploded_time.millisecond = 0;
73 return base::Time::FromUTCExploded(exploded_time);
76 virtual void SetUp() {
77 ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
78 store_ = new SQLiteChannelIDStore(
79 temp_dir_.path().Append(kTestChannelIDFilename),
80 base::MessageLoopProxy::current());
81 ScopedVector<DefaultChannelIDStore::ChannelID> channel_ids;
83 ASSERT_EQ(0u, channel_ids.size());
84 // Make sure the store gets written at least once.
86 DefaultChannelIDStore::ChannelID("google.com",
87 base::Time::FromInternalValue(1),
88 base::Time::FromInternalValue(2),
93 base::ScopedTempDir temp_dir_;
94 scoped_refptr<SQLiteChannelIDStore> store_;
95 ScopedVector<DefaultChannelIDStore::ChannelID> channel_ids_;
98 // Test if data is stored as expected in the SQLite database.
99 TEST_F(SQLiteChannelIDStoreTest, TestPersistence) {
100 store_->AddChannelID(
101 DefaultChannelIDStore::ChannelID("foo.com",
102 base::Time::FromInternalValue(3),
103 base::Time::FromInternalValue(4),
107 ScopedVector<DefaultChannelIDStore::ChannelID> channel_ids;
108 // Replace the store effectively destroying the current one and forcing it
109 // to write its data to disk. Then we can see if after loading it again it
112 // Make sure we wait until the destructor has run.
113 base::RunLoop().RunUntilIdle();
115 new SQLiteChannelIDStore(temp_dir_.path().Append(kTestChannelIDFilename),
116 base::MessageLoopProxy::current());
118 // Reload and test for persistence
120 ASSERT_EQ(2U, channel_ids.size());
121 DefaultChannelIDStore::ChannelID* goog_channel_id;
122 DefaultChannelIDStore::ChannelID* foo_channel_id;
123 if (channel_ids[0]->server_identifier() == "google.com") {
124 goog_channel_id = channel_ids[0];
125 foo_channel_id = channel_ids[1];
127 goog_channel_id = channel_ids[1];
128 foo_channel_id = channel_ids[0];
130 ASSERT_EQ("google.com", goog_channel_id->server_identifier());
131 ASSERT_STREQ("a", goog_channel_id->private_key().c_str());
132 ASSERT_STREQ("b", goog_channel_id->cert().c_str());
133 ASSERT_EQ(1, goog_channel_id->creation_time().ToInternalValue());
134 ASSERT_EQ(2, goog_channel_id->expiration_time().ToInternalValue());
135 ASSERT_EQ("foo.com", foo_channel_id->server_identifier());
136 ASSERT_STREQ("c", foo_channel_id->private_key().c_str());
137 ASSERT_STREQ("d", foo_channel_id->cert().c_str());
138 ASSERT_EQ(3, foo_channel_id->creation_time().ToInternalValue());
139 ASSERT_EQ(4, foo_channel_id->expiration_time().ToInternalValue());
141 // Now delete the cert and check persistence again.
142 store_->DeleteChannelID(*channel_ids[0]);
143 store_->DeleteChannelID(*channel_ids[1]);
145 // Make sure we wait until the destructor has run.
146 base::RunLoop().RunUntilIdle();
149 new SQLiteChannelIDStore(temp_dir_.path().Append(kTestChannelIDFilename),
150 base::MessageLoopProxy::current());
152 // Reload and check if the cert has been removed.
154 ASSERT_EQ(0U, channel_ids.size());
157 // Make sure we wait until the destructor has run.
158 base::RunLoop().RunUntilIdle();
161 // Test if data is stored as expected in the SQLite database.
162 TEST_F(SQLiteChannelIDStoreTest, TestDeleteAll) {
163 store_->AddChannelID(
164 DefaultChannelIDStore::ChannelID("foo.com",
165 base::Time::FromInternalValue(3),
166 base::Time::FromInternalValue(4),
170 ScopedVector<DefaultChannelIDStore::ChannelID> channel_ids;
171 // Replace the store effectively destroying the current one and forcing it
172 // to write its data to disk. Then we can see if after loading it again it
175 // Make sure we wait until the destructor has run.
176 base::RunLoop().RunUntilIdle();
178 new SQLiteChannelIDStore(temp_dir_.path().Append(kTestChannelIDFilename),
179 base::MessageLoopProxy::current());
181 // Reload and test for persistence
183 ASSERT_EQ(2U, channel_ids.size());
184 // DeleteAll except foo.com (shouldn't fail if one is missing either).
185 std::list<std::string> delete_server_identifiers;
186 delete_server_identifiers.push_back("google.com");
187 delete_server_identifiers.push_back("missing.com");
188 store_->DeleteAllInList(delete_server_identifiers);
190 // Now check persistence again.
192 // Make sure we wait until the destructor has run.
193 base::RunLoop().RunUntilIdle();
196 new SQLiteChannelIDStore(temp_dir_.path().Append(kTestChannelIDFilename),
197 base::MessageLoopProxy::current());
199 // Reload and check that only foo.com persisted in store.
201 ASSERT_EQ(1U, channel_ids.size());
202 ASSERT_EQ("foo.com", channel_ids[0]->server_identifier());
205 // Make sure we wait until the destructor has run.
206 base::RunLoop().RunUntilIdle();
209 TEST_F(SQLiteChannelIDStoreTest, TestUpgradeV1) {
210 // Reset the store. We'll be using a different database for this test.
213 base::FilePath v1_db_path(temp_dir_.path().AppendASCII("v1db"));
215 std::string key_data;
216 std::string cert_data;
217 ReadTestKeyAndCert(&key_data, &cert_data);
219 // Create a version 1 database.
222 ASSERT_TRUE(db.Open(v1_db_path));
223 ASSERT_TRUE(db.Execute(
224 "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY,"
225 "value LONGVARCHAR);"
226 "INSERT INTO \"meta\" VALUES('version','1');"
227 "INSERT INTO \"meta\" VALUES('last_compatible_version','1');"
228 "CREATE TABLE origin_bound_certs ("
229 "origin TEXT NOT NULL UNIQUE PRIMARY KEY,"
230 "private_key BLOB NOT NULL,cert BLOB NOT NULL);"));
232 sql::Statement add_smt(db.GetUniqueStatement(
233 "INSERT INTO origin_bound_certs (origin, private_key, cert) "
235 add_smt.BindString(0, "google.com");
236 add_smt.BindBlob(1, key_data.data(), key_data.size());
237 add_smt.BindBlob(2, cert_data.data(), cert_data.size());
238 ASSERT_TRUE(add_smt.Run());
240 ASSERT_TRUE(db.Execute(
241 "INSERT INTO \"origin_bound_certs\" VALUES("
242 "'foo.com',X'AA',X'BB');"));
245 // Load and test the DB contents twice. First time ensures that we can use
246 // the updated values immediately. Second time ensures that the updated
247 // values are stored and read correctly on next load.
248 for (int i = 0; i < 2; ++i) {
251 ScopedVector<DefaultChannelIDStore::ChannelID> channel_ids;
253 new SQLiteChannelIDStore(v1_db_path, base::MessageLoopProxy::current());
255 // Load the database. Because the existing v1 certs are implicitly of type
256 // RSA, which is unsupported, they're discarded.
258 ASSERT_EQ(0U, channel_ids.size());
261 base::RunLoop().RunUntilIdle();
263 // Verify the database version is updated.
266 ASSERT_TRUE(db.Open(v1_db_path));
267 sql::Statement smt(db.GetUniqueStatement(
268 "SELECT value FROM meta WHERE key = \"version\""));
269 ASSERT_TRUE(smt.Step());
270 EXPECT_EQ(4, smt.ColumnInt(0));
271 EXPECT_FALSE(smt.Step());
276 TEST_F(SQLiteChannelIDStoreTest, TestUpgradeV2) {
277 // Reset the store. We'll be using a different database for this test.
280 base::FilePath v2_db_path(temp_dir_.path().AppendASCII("v2db"));
282 std::string key_data;
283 std::string cert_data;
284 ReadTestKeyAndCert(&key_data, &cert_data);
286 // Create a version 2 database.
289 ASSERT_TRUE(db.Open(v2_db_path));
290 ASSERT_TRUE(db.Execute(
291 "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY,"
292 "value LONGVARCHAR);"
293 "INSERT INTO \"meta\" VALUES('version','2');"
294 "INSERT INTO \"meta\" VALUES('last_compatible_version','1');"
295 "CREATE TABLE origin_bound_certs ("
296 "origin TEXT NOT NULL UNIQUE PRIMARY KEY,"
297 "private_key BLOB NOT NULL,"
298 "cert BLOB NOT NULL,"
299 "cert_type INTEGER);"));
301 sql::Statement add_smt(db.GetUniqueStatement(
302 "INSERT INTO origin_bound_certs (origin, private_key, cert, cert_type) "
303 "VALUES (?,?,?,?)"));
304 add_smt.BindString(0, "google.com");
305 add_smt.BindBlob(1, key_data.data(), key_data.size());
306 add_smt.BindBlob(2, cert_data.data(), cert_data.size());
307 add_smt.BindInt64(3, 64);
308 ASSERT_TRUE(add_smt.Run());
310 ASSERT_TRUE(db.Execute(
311 "INSERT INTO \"origin_bound_certs\" VALUES("
312 "'foo.com',X'AA',X'BB',64);"));
315 // Load and test the DB contents twice. First time ensures that we can use
316 // the updated values immediately. Second time ensures that the updated
317 // values are saved and read correctly on next load.
318 for (int i = 0; i < 2; ++i) {
321 ScopedVector<DefaultChannelIDStore::ChannelID> channel_ids;
323 new SQLiteChannelIDStore(v2_db_path, base::MessageLoopProxy::current());
325 // Load the database and ensure the certs can be read.
327 ASSERT_EQ(2U, channel_ids.size());
329 ASSERT_EQ("google.com", channel_ids[0]->server_identifier());
330 ASSERT_EQ(GetTestCertExpirationTime(), channel_ids[0]->expiration_time());
331 ASSERT_EQ(key_data, channel_ids[0]->private_key());
332 ASSERT_EQ(cert_data, channel_ids[0]->cert());
334 ASSERT_EQ("foo.com", channel_ids[1]->server_identifier());
335 // Undecodable cert, expiration time will be uninitialized.
336 ASSERT_EQ(base::Time(), channel_ids[1]->expiration_time());
337 ASSERT_STREQ("\xaa", channel_ids[1]->private_key().c_str());
338 ASSERT_STREQ("\xbb", channel_ids[1]->cert().c_str());
341 // Make sure we wait until the destructor has run.
342 base::RunLoop().RunUntilIdle();
344 // Verify the database version is updated.
347 ASSERT_TRUE(db.Open(v2_db_path));
348 sql::Statement smt(db.GetUniqueStatement(
349 "SELECT value FROM meta WHERE key = \"version\""));
350 ASSERT_TRUE(smt.Step());
351 EXPECT_EQ(4, smt.ColumnInt(0));
352 EXPECT_FALSE(smt.Step());
357 TEST_F(SQLiteChannelIDStoreTest, TestUpgradeV3) {
358 // Reset the store. We'll be using a different database for this test.
361 base::FilePath v3_db_path(temp_dir_.path().AppendASCII("v3db"));
363 std::string key_data;
364 std::string cert_data;
365 ReadTestKeyAndCert(&key_data, &cert_data);
367 // Create a version 3 database.
370 ASSERT_TRUE(db.Open(v3_db_path));
371 ASSERT_TRUE(db.Execute(
372 "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY,"
373 "value LONGVARCHAR);"
374 "INSERT INTO \"meta\" VALUES('version','3');"
375 "INSERT INTO \"meta\" VALUES('last_compatible_version','1');"
376 "CREATE TABLE origin_bound_certs ("
377 "origin TEXT NOT NULL UNIQUE PRIMARY KEY,"
378 "private_key BLOB NOT NULL,"
379 "cert BLOB NOT NULL,"
381 "expiration_time INTEGER);"));
383 sql::Statement add_smt(db.GetUniqueStatement(
384 "INSERT INTO origin_bound_certs (origin, private_key, cert, cert_type, "
385 "expiration_time) VALUES (?,?,?,?,?)"));
386 add_smt.BindString(0, "google.com");
387 add_smt.BindBlob(1, key_data.data(), key_data.size());
388 add_smt.BindBlob(2, cert_data.data(), cert_data.size());
389 add_smt.BindInt64(3, 64);
390 add_smt.BindInt64(4, 1000);
391 ASSERT_TRUE(add_smt.Run());
393 ASSERT_TRUE(db.Execute(
394 "INSERT INTO \"origin_bound_certs\" VALUES("
395 "'foo.com',X'AA',X'BB',64,2000);"));
398 // Load and test the DB contents twice. First time ensures that we can use
399 // the updated values immediately. Second time ensures that the updated
400 // values are saved and read correctly on next load.
401 for (int i = 0; i < 2; ++i) {
404 ScopedVector<DefaultChannelIDStore::ChannelID> channel_ids;
406 new SQLiteChannelIDStore(v3_db_path, base::MessageLoopProxy::current());
408 // Load the database and ensure the certs can be read.
410 ASSERT_EQ(2U, channel_ids.size());
412 ASSERT_EQ("google.com", channel_ids[0]->server_identifier());
413 ASSERT_EQ(1000, channel_ids[0]->expiration_time().ToInternalValue());
414 ASSERT_EQ(GetTestCertCreationTime(), channel_ids[0]->creation_time());
415 ASSERT_EQ(key_data, channel_ids[0]->private_key());
416 ASSERT_EQ(cert_data, channel_ids[0]->cert());
418 ASSERT_EQ("foo.com", channel_ids[1]->server_identifier());
419 ASSERT_EQ(2000, channel_ids[1]->expiration_time().ToInternalValue());
420 // Undecodable cert, creation time will be uninitialized.
421 ASSERT_EQ(base::Time(), channel_ids[1]->creation_time());
422 ASSERT_STREQ("\xaa", channel_ids[1]->private_key().c_str());
423 ASSERT_STREQ("\xbb", channel_ids[1]->cert().c_str());
426 // Make sure we wait until the destructor has run.
427 base::RunLoop().RunUntilIdle();
429 // Verify the database version is updated.
432 ASSERT_TRUE(db.Open(v3_db_path));
433 sql::Statement smt(db.GetUniqueStatement(
434 "SELECT value FROM meta WHERE key = \"version\""));
435 ASSERT_TRUE(smt.Step());
436 EXPECT_EQ(4, smt.ColumnInt(0));
437 EXPECT_FALSE(smt.Step());
442 TEST_F(SQLiteChannelIDStoreTest, TestRSADiscarded) {
443 // Reset the store. We'll be using a different database for this test.
446 base::FilePath v4_db_path(temp_dir_.path().AppendASCII("v4dbrsa"));
448 std::string key_data;
449 std::string cert_data;
450 ReadTestKeyAndCert(&key_data, &cert_data);
452 // Create a version 4 database with a mix of RSA and ECDSA certs.
455 ASSERT_TRUE(db.Open(v4_db_path));
456 ASSERT_TRUE(db.Execute(
457 "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY,"
458 "value LONGVARCHAR);"
459 "INSERT INTO \"meta\" VALUES('version','4');"
460 "INSERT INTO \"meta\" VALUES('last_compatible_version','1');"
461 "CREATE TABLE origin_bound_certs ("
462 "origin TEXT NOT NULL UNIQUE PRIMARY KEY,"
463 "private_key BLOB NOT NULL,"
464 "cert BLOB NOT NULL,"
466 "expiration_time INTEGER,"
467 "creation_time INTEGER);"));
469 sql::Statement add_smt(db.GetUniqueStatement(
470 "INSERT INTO origin_bound_certs "
471 "(origin, private_key, cert, cert_type, expiration_time, creation_time)"
472 " VALUES (?,?,?,?,?,?)"));
473 add_smt.BindString(0, "google.com");
474 add_smt.BindBlob(1, key_data.data(), key_data.size());
475 add_smt.BindBlob(2, cert_data.data(), cert_data.size());
476 add_smt.BindInt64(3, 64);
477 add_smt.BindInt64(4, GetTestCertExpirationTime().ToInternalValue());
478 add_smt.BindInt64(5, base::Time::Now().ToInternalValue());
479 ASSERT_TRUE(add_smt.Run());
482 add_smt.Assign(db.GetUniqueStatement(
483 "INSERT INTO origin_bound_certs "
484 "(origin, private_key, cert, cert_type, expiration_time, creation_time)"
485 " VALUES (?,?,?,?,?,?)"));
486 add_smt.BindString(0, "foo.com");
487 add_smt.BindBlob(1, key_data.data(), key_data.size());
488 add_smt.BindBlob(2, cert_data.data(), cert_data.size());
489 add_smt.BindInt64(3, 1);
490 add_smt.BindInt64(4, GetTestCertExpirationTime().ToInternalValue());
491 add_smt.BindInt64(5, base::Time::Now().ToInternalValue());
492 ASSERT_TRUE(add_smt.Run());
495 ScopedVector<DefaultChannelIDStore::ChannelID> channel_ids;
497 new SQLiteChannelIDStore(v4_db_path, base::MessageLoopProxy::current());
499 // Load the database and ensure the certs can be read.
501 // Only the ECDSA cert (for google.com) is read, the RSA one is discarded.
502 ASSERT_EQ(1U, channel_ids.size());
504 ASSERT_EQ("google.com", channel_ids[0]->server_identifier());
505 ASSERT_EQ(GetTestCertExpirationTime(), channel_ids[0]->expiration_time());
506 ASSERT_EQ(key_data, channel_ids[0]->private_key());
507 ASSERT_EQ(cert_data, channel_ids[0]->cert());
510 // Make sure we wait until the destructor has run.
511 base::RunLoop().RunUntilIdle();