OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/multi_log_ct_verifier.h" | 5 #include "net/cert/multi_log_ct_verifier.h" |
6 | 6 |
7 #include <string> | 7 #include <string> |
8 | 8 |
9 #include "base/files/file_path.h" | 9 #include "base/files/file_path.h" |
10 #include "base/files/file_util.h" | 10 #include "base/files/file_util.h" |
11 #include "base/metrics/histogram.h" | 11 #include "base/metrics/histogram.h" |
12 #include "base/metrics/histogram_samples.h" | 12 #include "base/metrics/histogram_samples.h" |
13 #include "base/metrics/statistics_recorder.h" | 13 #include "base/metrics/statistics_recorder.h" |
14 #include "base/values.h" | 14 #include "base/values.h" |
15 #include "net/base/net_errors.h" | 15 #include "net/base/net_errors.h" |
16 #include "net/base/test_data_directory.h" | 16 #include "net/base/test_data_directory.h" |
17 #include "net/cert/ct_log_verifier.h" | 17 #include "net/cert/ct_log_verifier.h" |
18 #include "net/cert/ct_serialization.h" | 18 #include "net/cert/ct_serialization.h" |
19 #include "net/cert/ct_verify_result.h" | 19 #include "net/cert/ct_verify_result.h" |
20 #include "net/cert/pem_tokenizer.h" | 20 #include "net/cert/pem_tokenizer.h" |
21 #include "net/cert/sct_status_flags.h" | 21 #include "net/cert/sct_status_flags.h" |
22 #include "net/cert/signed_certificate_timestamp.h" | 22 #include "net/cert/signed_certificate_timestamp.h" |
23 #include "net/cert/x509_certificate.h" | 23 #include "net/cert/x509_certificate.h" |
24 #include "net/log/capturing_net_log.h" | |
25 #include "net/log/net_log.h" | 24 #include "net/log/net_log.h" |
| 25 #include "net/log/test_net_log.h" |
26 #include "net/test/cert_test_util.h" | 26 #include "net/test/cert_test_util.h" |
27 #include "net/test/ct_test_util.h" | 27 #include "net/test/ct_test_util.h" |
28 #include "testing/gtest/include/gtest/gtest.h" | 28 #include "testing/gtest/include/gtest/gtest.h" |
29 | 29 |
30 namespace net { | 30 namespace net { |
31 | 31 |
32 namespace { | 32 namespace { |
33 | 33 |
34 const char kLogDescription[] = "somelog"; | 34 const char kLogDescription[] = "somelog"; |
35 const char kSCTCountHistogram[] = | 35 const char kSCTCountHistogram[] = |
(...skipping 28 matching lines...) Expand all Loading... |
64 result.verified_scts[0]->log_description == kLogDescription; | 64 result.verified_scts[0]->log_description == kLogDescription; |
65 } | 65 } |
66 | 66 |
67 bool CheckForSCTOrigin( | 67 bool CheckForSCTOrigin( |
68 const ct::CTVerifyResult& result, | 68 const ct::CTVerifyResult& result, |
69 ct::SignedCertificateTimestamp::Origin origin) { | 69 ct::SignedCertificateTimestamp::Origin origin) { |
70 return (result.verified_scts.size() > 0) && | 70 return (result.verified_scts.size() > 0) && |
71 (result.verified_scts[0]->origin == origin); | 71 (result.verified_scts[0]->origin == origin); |
72 } | 72 } |
73 | 73 |
74 bool CheckForEmbeddedSCTInNetLog(CapturingNetLog& net_log) { | 74 bool CheckForEmbeddedSCTInNetLog(TestNetLog& net_log) { |
75 CapturingNetLog::CapturedEntryList entries; | 75 TestNetLog::CapturedEntryList entries; |
76 net_log.GetEntries(&entries); | 76 net_log.GetEntries(&entries); |
77 if (entries.size() != 2) | 77 if (entries.size() != 2) |
78 return false; | 78 return false; |
79 | 79 |
80 const CapturingNetLog::CapturedEntry& received = entries[0]; | 80 const TestNetLog::CapturedEntry& received = entries[0]; |
81 std::string embedded_scts; | 81 std::string embedded_scts; |
82 if (!received.GetStringValue("embedded_scts", &embedded_scts)) | 82 if (!received.GetStringValue("embedded_scts", &embedded_scts)) |
83 return false; | 83 return false; |
84 if (embedded_scts.empty()) | 84 if (embedded_scts.empty()) |
85 return false; | 85 return false; |
86 | 86 |
87 const CapturingNetLog::CapturedEntry& parsed = entries[1]; | 87 const TestNetLog::CapturedEntry& parsed = entries[1]; |
88 base::ListValue* verified_scts; | 88 base::ListValue* verified_scts; |
89 if (!parsed.GetListValue("verified_scts", &verified_scts) || | 89 if (!parsed.GetListValue("verified_scts", &verified_scts) || |
90 verified_scts->GetSize() != 1) { | 90 verified_scts->GetSize() != 1) { |
91 return false; | 91 return false; |
92 } | 92 } |
93 | 93 |
94 base::DictionaryValue* the_sct; | 94 base::DictionaryValue* the_sct; |
95 if (!verified_scts->GetDictionary(0, &the_sct)) | 95 if (!verified_scts->GetDictionary(0, &the_sct)) |
96 return false; | 96 return false; |
97 | 97 |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
132 ct::CTVerifyResult* result) { | 132 ct::CTVerifyResult* result) { |
133 return verifier_->Verify(chain.get(), | 133 return verifier_->Verify(chain.get(), |
134 std::string(), | 134 std::string(), |
135 std::string(), | 135 std::string(), |
136 result, | 136 result, |
137 bound_net_log) == OK; | 137 bound_net_log) == OK; |
138 } | 138 } |
139 | 139 |
140 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) { | 140 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) { |
141 ct::CTVerifyResult result; | 141 ct::CTVerifyResult result; |
142 CapturingNetLog net_log; | 142 TestNetLog net_log; |
143 BoundNetLog bound_net_log = | 143 BoundNetLog bound_net_log = |
144 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); | 144 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); |
145 | 145 |
146 return verifier_->Verify(chain.get(), | 146 return verifier_->Verify(chain.get(), |
147 std::string(), | 147 std::string(), |
148 std::string(), | 148 std::string(), |
149 &result, | 149 &result, |
150 bound_net_log) == OK; | 150 bound_net_log) == OK; |
151 } | 151 } |
152 | 152 |
153 bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) { | 153 bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) { |
154 ct::CTVerifyResult result; | 154 ct::CTVerifyResult result; |
155 CapturingNetLog net_log; | 155 TestNetLog net_log; |
156 BoundNetLog bound_net_log = | 156 BoundNetLog bound_net_log = |
157 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); | 157 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); |
158 return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) && | 158 return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) && |
159 CheckForSingleVerifiedSCTInResult(result) && | 159 CheckForSingleVerifiedSCTInResult(result) && |
160 CheckForSCTOrigin(result, | 160 CheckForSCTOrigin(result, |
161 ct::SignedCertificateTimestamp::SCT_EMBEDDED) && | 161 ct::SignedCertificateTimestamp::SCT_EMBEDDED) && |
162 CheckForEmbeddedSCTInNetLog(net_log)); | 162 CheckForEmbeddedSCTInNetLog(net_log)); |
163 } | 163 } |
164 | 164 |
165 // Histogram-related helper methods | 165 // Histogram-related helper methods |
(...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
294 TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) { | 294 TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) { |
295 int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0); | 295 int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0); |
296 EXPECT_FALSE(VerifySinglePrecertificateChain(chain_)); | 296 EXPECT_FALSE(VerifySinglePrecertificateChain(chain_)); |
297 ASSERT_EQ(connections_without_scts + 1, | 297 ASSERT_EQ(connections_without_scts + 1, |
298 GetValueFromHistogram(kSCTCountHistogram, 0)); | 298 GetValueFromHistogram(kSCTCountHistogram, 0)); |
299 } | 299 } |
300 | 300 |
301 } // namespace | 301 } // namespace |
302 | 302 |
303 } // namespace net | 303 } // namespace net |
OLD | NEW |