OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/http/transport_security_state.h" | 5 #include "net/http/transport_security_state.h" |
6 | 6 |
7 #include <algorithm> | 7 #include <algorithm> |
8 #include <string> | 8 #include <string> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
11 #include "base/base64.h" | 11 #include "base/base64.h" |
12 #include "base/files/file_path.h" | 12 #include "base/files/file_path.h" |
13 #include "base/json/json_reader.h" | |
13 #include "base/rand_util.h" | 14 #include "base/rand_util.h" |
14 #include "base/sha1.h" | 15 #include "base/sha1.h" |
15 #include "base/strings/string_piece.h" | 16 #include "base/strings/string_piece.h" |
17 #include "base/values.h" | |
16 #include "crypto/sha2.h" | 18 #include "crypto/sha2.h" |
19 #include "net/base/host_port_pair.h" | |
17 #include "net/base/net_errors.h" | 20 #include "net/base/net_errors.h" |
18 #include "net/base/test_completion_callback.h" | 21 #include "net/base/test_completion_callback.h" |
19 #include "net/base/test_data_directory.h" | 22 #include "net/base/test_data_directory.h" |
20 #include "net/cert/asn1_util.h" | 23 #include "net/cert/asn1_util.h" |
21 #include "net/cert/cert_verifier.h" | 24 #include "net/cert/cert_verifier.h" |
22 #include "net/cert/cert_verify_result.h" | 25 #include "net/cert/cert_verify_result.h" |
23 #include "net/cert/test_root_certs.h" | 26 #include "net/cert/test_root_certs.h" |
24 #include "net/cert/x509_cert_types.h" | 27 #include "net/cert/x509_cert_types.h" |
25 #include "net/cert/x509_certificate.h" | 28 #include "net/cert/x509_certificate.h" |
26 #include "net/http/http_util.h" | 29 #include "net/http/http_util.h" |
27 #include "net/log/net_log.h" | 30 #include "net/log/net_log.h" |
28 #include "net/ssl/ssl_info.h" | 31 #include "net/ssl/ssl_info.h" |
29 #include "net/test/cert_test_util.h" | 32 #include "net/test/cert_test_util.h" |
30 #include "testing/gtest/include/gtest/gtest.h" | 33 #include "testing/gtest/include/gtest/gtest.h" |
31 | 34 |
32 #if defined(USE_OPENSSL) | 35 #if defined(USE_OPENSSL) |
33 #include "crypto/openssl_util.h" | 36 #include "crypto/openssl_util.h" |
34 #else | 37 #else |
35 #include "crypto/nss_util.h" | 38 #include "crypto/nss_util.h" |
36 #endif | 39 #endif |
37 | 40 |
41 namespace net { | |
42 | |
38 namespace { | 43 namespace { |
39 | 44 |
40 const char kReportUri[] = "http://example.test/test"; | 45 const char kReportUri[] = "http://example.test/test"; |
41 | 46 |
47 // A mock ReportSender that just remembers the latest report | |
48 // URI and report to be sent. | |
49 class MockCertificateReportSender | |
50 : public net::TransportSecurityState::ReportSender { | |
davidben
2015/07/27 19:57:01
No need for these 'net::'s.
estark
2015/07/28 13:52:39
Done.
| |
51 public: | |
52 MockCertificateReportSender() {} | |
53 ~MockCertificateReportSender() override {} | |
54 | |
55 void Send(const GURL& report_uri, const std::string& report) override { | |
56 latest_report_uri_ = report_uri; | |
57 latest_report_ = report; | |
58 } | |
59 | |
60 const GURL& latest_report_uri() { return latest_report_uri_; } | |
61 const std::string& latest_report() { return latest_report_; } | |
62 | |
63 private: | |
64 GURL latest_report_uri_; | |
65 std::string latest_report_; | |
66 }; | |
67 | |
68 void CompareCertificateChainWithList( | |
69 const scoped_refptr<net::X509Certificate>& cert_chain, | |
70 const base::ListValue* cert_list) { | |
71 ASSERT_TRUE(cert_chain); | |
72 std::vector<std::string> pem_encoded_chain; | |
73 cert_chain->GetPEMEncodedChain(&pem_encoded_chain); | |
74 EXPECT_EQ(pem_encoded_chain.size(), cert_list->GetSize()); | |
75 | |
76 for (size_t i = 0; i < pem_encoded_chain.size(); i++) { | |
77 std::string list_cert; | |
78 ASSERT_TRUE(cert_list->GetString(i, &list_cert)); | |
79 EXPECT_EQ(pem_encoded_chain[i], list_cert); | |
80 } | |
81 } | |
82 | |
83 void CheckHPKPReport( | |
84 const std::string& report, | |
85 const net::HostPortPair& host_port_pair, | |
86 const base::Time& expiry, | |
87 bool include_subdomains, | |
88 const std::string& noted_hostname, | |
89 const scoped_refptr<net::X509Certificate>& served_certificate_chain, | |
90 const scoped_refptr<net::X509Certificate>& validated_certificate_chain, | |
91 const net::HashValueVector& known_pins) { | |
92 // TODO(estark): check time in RFC3339 format. | |
93 | |
94 scoped_ptr<base::Value> value(base::JSONReader::Read(report)); | |
95 ASSERT_TRUE(value); | |
96 ASSERT_TRUE(value->IsType(base::Value::TYPE_DICTIONARY)); | |
97 | |
98 base::DictionaryValue* report_dict; | |
99 ASSERT_TRUE(value->GetAsDictionary(&report_dict)); | |
100 | |
101 std::string report_hostname; | |
102 EXPECT_TRUE(report_dict->GetString("hostname", &report_hostname)); | |
103 EXPECT_EQ(host_port_pair.host(), report_hostname); | |
104 | |
105 int report_port; | |
106 EXPECT_TRUE(report_dict->GetInteger("port", &report_port)); | |
107 EXPECT_EQ(host_port_pair.port(), report_port); | |
108 | |
109 bool report_include_subdomains; | |
110 EXPECT_TRUE(report_dict->GetBoolean("include-subdomains", | |
111 &report_include_subdomains)); | |
112 EXPECT_EQ(include_subdomains, report_include_subdomains); | |
113 | |
114 std::string report_noted_hostname; | |
115 EXPECT_TRUE(report_dict->GetString("noted-hostname", &report_noted_hostname)); | |
116 EXPECT_EQ(noted_hostname, report_noted_hostname); | |
117 | |
118 base::ListValue* report_served_certificate_chain; | |
119 EXPECT_TRUE(report_dict->GetList("served-certificate-chain", | |
120 &report_served_certificate_chain)); | |
121 ASSERT_NO_FATAL_FAILURE(CompareCertificateChainWithList( | |
122 served_certificate_chain, report_served_certificate_chain)); | |
123 | |
124 base::ListValue* report_validated_certificate_chain; | |
125 EXPECT_TRUE(report_dict->GetList("validated-certificate-chain", | |
126 &report_validated_certificate_chain)); | |
127 ASSERT_NO_FATAL_FAILURE(CompareCertificateChainWithList( | |
128 validated_certificate_chain, report_validated_certificate_chain)); | |
129 } | |
130 | |
42 } // namespace | 131 } // namespace |
43 | 132 |
44 namespace net { | |
45 | |
46 class TransportSecurityStateTest : public testing::Test { | 133 class TransportSecurityStateTest : public testing::Test { |
47 public: | 134 public: |
48 void SetUp() override { | 135 void SetUp() override { |
49 #if defined(USE_OPENSSL) | 136 #if defined(USE_OPENSSL) |
50 crypto::EnsureOpenSSLInit(); | 137 crypto::EnsureOpenSSLInit(); |
51 #else | 138 #else |
52 crypto::EnsureNSSInit(); | 139 crypto::EnsureNSSInit(); |
53 #endif | 140 #endif |
54 } | 141 } |
55 | 142 |
(...skipping 1049 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1105 | 1192 |
1106 // These hosts used to only be HSTS when SNI was available. | 1193 // These hosts used to only be HSTS when SNI was available. |
1107 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( | 1194 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( |
1108 "gmail.com")); | 1195 "gmail.com")); |
1109 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( | 1196 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( |
1110 "googlegroups.com")); | 1197 "googlegroups.com")); |
1111 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( | 1198 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( |
1112 "www.googlegroups.com")); | 1199 "www.googlegroups.com")); |
1113 } | 1200 } |
1114 | 1201 |
1202 TEST_F(TransportSecurityStateTest, HPKPReporting) { | |
1203 const char kHost[] = "example.test"; | |
1204 const char kSubdomain[] = "foo.example.test"; | |
1205 static const uint16_t kPort = 443; | |
1206 HostPortPair host_port_pair(kHost, kPort); | |
1207 HostPortPair subdomain_host_port_pair(kSubdomain, kPort); | |
1208 GURL report_uri("http://www.example.test/report"); | |
1209 // Two dummy certs to use as the server-sent and validated chains. The | |
1210 // contents don't matter. | |
1211 scoped_refptr<X509Certificate> cert1 = | |
1212 ImportCertFromFile(GetTestCertsDirectory(), "test_mail_google_com.pem"); | |
1213 scoped_refptr<X509Certificate> cert2 = | |
1214 ImportCertFromFile(GetTestCertsDirectory(), "expired_cert.pem"); | |
1215 ASSERT_TRUE(cert1); | |
1216 ASSERT_TRUE(cert2); | |
1217 | |
1218 // kGoodPath is blog.torproject.org. | |
1219 static const char* const kGoodPath[] = { | |
1220 "sha1/m9lHYJYke9k0GtVZ+bXSQYE8nDI=", "sha1/o5OZxATDsgmwgcIfIWIneMJ0jkw=", | |
1221 "sha1/wHqYaI2J+6sFZAwRfap9ZbjKzE4=", NULL, | |
1222 }; | |
1223 | |
1224 // kBadPath is plus.google.com via Trustcenter, which is utterly wrong for | |
1225 // torproject.org. | |
1226 static const char* const kBadPath[] = { | |
1227 "sha1/4BjDjn8v2lWeUFQnqSs0BgbIcrU=", "sha1/gzuEEAB/bkqdQS3EIjk2by7lW+k=", | |
1228 "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=", NULL, | |
1229 }; | |
1230 | |
1231 HashValueVector good_hashes, bad_hashes; | |
1232 | |
1233 for (size_t i = 0; kGoodPath[i]; i++) | |
1234 EXPECT_TRUE(AddHash(kGoodPath[i], &good_hashes)); | |
1235 for (size_t i = 0; kBadPath[i]; i++) | |
1236 EXPECT_TRUE(AddHash(kBadPath[i], &bad_hashes)); | |
1237 | |
1238 TransportSecurityState state; | |
1239 MockCertificateReportSender mock_report_sender; | |
1240 state.SetReportSender(&mock_report_sender); | |
1241 | |
1242 const base::Time current_time = base::Time::Now(); | |
1243 const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000); | |
1244 state.AddHPKP(kHost, expiry, true, good_hashes, report_uri); | |
1245 | |
1246 EXPECT_EQ(GURL(), mock_report_sender.latest_report_uri()); | |
1247 EXPECT_EQ(std::string(), mock_report_sender.latest_report()); | |
1248 | |
1249 std::string failure_log; | |
1250 EXPECT_FALSE(state.CheckPublicKeyPins( | |
1251 host_port_pair, true, bad_hashes, cert1.get(), cert2.get(), | |
1252 TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log)); | |
1253 | |
1254 // No report should have been sent because of the DISABLE_PIN_REPORTS | |
1255 // argument. | |
1256 EXPECT_EQ(GURL(), mock_report_sender.latest_report_uri()); | |
1257 EXPECT_EQ(std::string(), mock_report_sender.latest_report()); | |
1258 | |
1259 EXPECT_TRUE(state.CheckPublicKeyPins( | |
1260 host_port_pair, true, good_hashes, cert1.get(), cert2.get(), | |
1261 TransportSecurityState::ENABLE_PIN_REPORTS, &failure_log)); | |
1262 | |
1263 // No report should have been sent because there was no violation. | |
1264 EXPECT_EQ(GURL(), mock_report_sender.latest_report_uri()); | |
1265 EXPECT_EQ(std::string(), mock_report_sender.latest_report()); | |
1266 | |
1267 EXPECT_FALSE(state.CheckPublicKeyPins( | |
1268 host_port_pair, true, bad_hashes, cert1.get(), cert2.get(), | |
1269 TransportSecurityState::ENABLE_PIN_REPORTS, &failure_log)); | |
1270 | |
1271 // Now a report should have been sent. Check that it contains the | |
1272 // right information. | |
1273 EXPECT_EQ(report_uri, mock_report_sender.latest_report_uri()); | |
1274 std::string report = mock_report_sender.latest_report(); | |
1275 ASSERT_FALSE(report.empty()); | |
1276 ASSERT_NO_FATAL_FAILURE(CheckHPKPReport(report, host_port_pair, expiry, true, | |
1277 kHost, cert1.get(), cert2.get(), | |
1278 good_hashes)); | |
1279 | |
1280 EXPECT_FALSE(state.CheckPublicKeyPins( | |
1281 subdomain_host_port_pair, true, bad_hashes, cert1.get(), cert2.get(), | |
1282 TransportSecurityState::ENABLE_PIN_REPORTS, &failure_log)); | |
1283 | |
1284 // Now a report should have been sent for the subdomain. Check that it | |
1285 // contains the right information. | |
1286 EXPECT_EQ(report_uri, mock_report_sender.latest_report_uri()); | |
1287 report = mock_report_sender.latest_report(); | |
1288 ASSERT_FALSE(report.empty()); | |
1289 ASSERT_NO_FATAL_FAILURE(CheckHPKPReport(report, subdomain_host_port_pair, | |
1290 expiry, true, kHost, cert1.get(), | |
1291 cert2.get(), good_hashes)); | |
1292 } | |
1293 | |
1115 } // namespace net | 1294 } // namespace net |
OLD | NEW |