| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/multi_log_ct_verifier.h" | 5 #include "net/cert/multi_log_ct_verifier.h" |
| 6 | 6 |
| 7 #include <string> | 7 #include <string> |
| 8 | 8 |
| 9 #include "base/files/file_path.h" | 9 #include "base/files/file_path.h" |
| 10 #include "base/files/file_util.h" | 10 #include "base/files/file_util.h" |
| 11 #include "base/metrics/histogram.h" | 11 #include "base/metrics/histogram.h" |
| 12 #include "base/metrics/histogram_samples.h" | 12 #include "base/metrics/histogram_samples.h" |
| 13 #include "base/metrics/statistics_recorder.h" | 13 #include "base/metrics/statistics_recorder.h" |
| 14 #include "base/values.h" | 14 #include "base/values.h" |
| 15 #include "net/base/net_errors.h" | 15 #include "net/base/net_errors.h" |
| 16 #include "net/base/test_data_directory.h" | 16 #include "net/base/test_data_directory.h" |
| 17 #include "net/cert/ct_log_verifier.h" | 17 #include "net/cert/ct_log_verifier.h" |
| 18 #include "net/cert/ct_serialization.h" | 18 #include "net/cert/ct_serialization.h" |
| 19 #include "net/cert/ct_verify_result.h" | 19 #include "net/cert/ct_verify_result.h" |
| 20 #include "net/cert/pem_tokenizer.h" | 20 #include "net/cert/pem_tokenizer.h" |
| 21 #include "net/cert/sct_status_flags.h" | 21 #include "net/cert/sct_status_flags.h" |
| 22 #include "net/cert/signed_certificate_timestamp.h" | 22 #include "net/cert/signed_certificate_timestamp.h" |
| 23 #include "net/cert/x509_certificate.h" | 23 #include "net/cert/x509_certificate.h" |
| 24 #include "net/log/capturing_net_log.h" | |
| 25 #include "net/log/net_log.h" | 24 #include "net/log/net_log.h" |
| 25 #include "net/log/test_net_log.h" |
| 26 #include "net/test/cert_test_util.h" | 26 #include "net/test/cert_test_util.h" |
| 27 #include "net/test/ct_test_util.h" | 27 #include "net/test/ct_test_util.h" |
| 28 #include "testing/gtest/include/gtest/gtest.h" | 28 #include "testing/gtest/include/gtest/gtest.h" |
| 29 | 29 |
| 30 namespace net { | 30 namespace net { |
| 31 | 31 |
| 32 namespace { | 32 namespace { |
| 33 | 33 |
| 34 const char kLogDescription[] = "somelog"; | 34 const char kLogDescription[] = "somelog"; |
| 35 const char kSCTCountHistogram[] = | 35 const char kSCTCountHistogram[] = |
| (...skipping 28 matching lines...) Expand all Loading... |
| 64 result.verified_scts[0]->log_description == kLogDescription; | 64 result.verified_scts[0]->log_description == kLogDescription; |
| 65 } | 65 } |
| 66 | 66 |
| 67 bool CheckForSCTOrigin( | 67 bool CheckForSCTOrigin( |
| 68 const ct::CTVerifyResult& result, | 68 const ct::CTVerifyResult& result, |
| 69 ct::SignedCertificateTimestamp::Origin origin) { | 69 ct::SignedCertificateTimestamp::Origin origin) { |
| 70 return (result.verified_scts.size() > 0) && | 70 return (result.verified_scts.size() > 0) && |
| 71 (result.verified_scts[0]->origin == origin); | 71 (result.verified_scts[0]->origin == origin); |
| 72 } | 72 } |
| 73 | 73 |
| 74 bool CheckForEmbeddedSCTInNetLog(CapturingNetLog& net_log) { | 74 bool CheckForEmbeddedSCTInNetLog(TestNetLog& net_log) { |
| 75 CapturingNetLog::CapturedEntryList entries; | 75 TestNetLog::CapturedEntryList entries; |
| 76 net_log.GetEntries(&entries); | 76 net_log.GetEntries(&entries); |
| 77 if (entries.size() != 2) | 77 if (entries.size() != 2) |
| 78 return false; | 78 return false; |
| 79 | 79 |
| 80 const CapturingNetLog::CapturedEntry& received = entries[0]; | 80 const TestNetLog::CapturedEntry& received = entries[0]; |
| 81 std::string embedded_scts; | 81 std::string embedded_scts; |
| 82 if (!received.GetStringValue("embedded_scts", &embedded_scts)) | 82 if (!received.GetStringValue("embedded_scts", &embedded_scts)) |
| 83 return false; | 83 return false; |
| 84 if (embedded_scts.empty()) | 84 if (embedded_scts.empty()) |
| 85 return false; | 85 return false; |
| 86 | 86 |
| 87 const CapturingNetLog::CapturedEntry& parsed = entries[1]; | 87 const TestNetLog::CapturedEntry& parsed = entries[1]; |
| 88 base::ListValue* verified_scts; | 88 base::ListValue* verified_scts; |
| 89 if (!parsed.GetListValue("verified_scts", &verified_scts) || | 89 if (!parsed.GetListValue("verified_scts", &verified_scts) || |
| 90 verified_scts->GetSize() != 1) { | 90 verified_scts->GetSize() != 1) { |
| 91 return false; | 91 return false; |
| 92 } | 92 } |
| 93 | 93 |
| 94 base::DictionaryValue* the_sct; | 94 base::DictionaryValue* the_sct; |
| 95 if (!verified_scts->GetDictionary(0, &the_sct)) | 95 if (!verified_scts->GetDictionary(0, &the_sct)) |
| 96 return false; | 96 return false; |
| 97 | 97 |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 132 ct::CTVerifyResult* result) { | 132 ct::CTVerifyResult* result) { |
| 133 return verifier_->Verify(chain.get(), | 133 return verifier_->Verify(chain.get(), |
| 134 std::string(), | 134 std::string(), |
| 135 std::string(), | 135 std::string(), |
| 136 result, | 136 result, |
| 137 bound_net_log) == OK; | 137 bound_net_log) == OK; |
| 138 } | 138 } |
| 139 | 139 |
| 140 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) { | 140 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) { |
| 141 ct::CTVerifyResult result; | 141 ct::CTVerifyResult result; |
| 142 CapturingNetLog net_log; | 142 TestNetLog net_log; |
| 143 BoundNetLog bound_net_log = | 143 BoundNetLog bound_net_log = |
| 144 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); | 144 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); |
| 145 | 145 |
| 146 return verifier_->Verify(chain.get(), | 146 return verifier_->Verify(chain.get(), |
| 147 std::string(), | 147 std::string(), |
| 148 std::string(), | 148 std::string(), |
| 149 &result, | 149 &result, |
| 150 bound_net_log) == OK; | 150 bound_net_log) == OK; |
| 151 } | 151 } |
| 152 | 152 |
| 153 bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) { | 153 bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) { |
| 154 ct::CTVerifyResult result; | 154 ct::CTVerifyResult result; |
| 155 CapturingNetLog net_log; | 155 TestNetLog net_log; |
| 156 BoundNetLog bound_net_log = | 156 BoundNetLog bound_net_log = |
| 157 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); | 157 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); |
| 158 return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) && | 158 return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) && |
| 159 CheckForSingleVerifiedSCTInResult(result) && | 159 CheckForSingleVerifiedSCTInResult(result) && |
| 160 CheckForSCTOrigin(result, | 160 CheckForSCTOrigin(result, |
| 161 ct::SignedCertificateTimestamp::SCT_EMBEDDED) && | 161 ct::SignedCertificateTimestamp::SCT_EMBEDDED) && |
| 162 CheckForEmbeddedSCTInNetLog(net_log)); | 162 CheckForEmbeddedSCTInNetLog(net_log)); |
| 163 } | 163 } |
| 164 | 164 |
| 165 // Histogram-related helper methods | 165 // Histogram-related helper methods |
| (...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 294 TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) { | 294 TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) { |
| 295 int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0); | 295 int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0); |
| 296 EXPECT_FALSE(VerifySinglePrecertificateChain(chain_)); | 296 EXPECT_FALSE(VerifySinglePrecertificateChain(chain_)); |
| 297 ASSERT_EQ(connections_without_scts + 1, | 297 ASSERT_EQ(connections_without_scts + 1, |
| 298 GetValueFromHistogram(kSCTCountHistogram, 0)); | 298 GetValueFromHistogram(kSCTCountHistogram, 0)); |
| 299 } | 299 } |
| 300 | 300 |
| 301 } // namespace | 301 } // namespace |
| 302 | 302 |
| 303 } // namespace net | 303 } // namespace net |
| OLD | NEW |