OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/http/transport_security_state.h" | 5 #include "net/http/transport_security_state.h" |
6 | 6 |
7 #include <algorithm> | 7 #include <algorithm> |
8 #include <string> | 8 #include <string> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
11 #include "base/base64.h" | 11 #include "base/base64.h" |
12 #include "base/files/file_path.h" | 12 #include "base/files/file_path.h" |
| 13 #include "base/json/json_reader.h" |
13 #include "base/rand_util.h" | 14 #include "base/rand_util.h" |
14 #include "base/sha1.h" | 15 #include "base/sha1.h" |
15 #include "base/strings/string_piece.h" | 16 #include "base/strings/string_piece.h" |
| 17 #include "base/values.h" |
16 #include "crypto/sha2.h" | 18 #include "crypto/sha2.h" |
| 19 #include "net/base/host_port_pair.h" |
17 #include "net/base/net_errors.h" | 20 #include "net/base/net_errors.h" |
18 #include "net/base/test_completion_callback.h" | 21 #include "net/base/test_completion_callback.h" |
19 #include "net/base/test_data_directory.h" | 22 #include "net/base/test_data_directory.h" |
20 #include "net/cert/asn1_util.h" | 23 #include "net/cert/asn1_util.h" |
21 #include "net/cert/cert_verifier.h" | 24 #include "net/cert/cert_verifier.h" |
22 #include "net/cert/cert_verify_result.h" | 25 #include "net/cert/cert_verify_result.h" |
23 #include "net/cert/test_root_certs.h" | 26 #include "net/cert/test_root_certs.h" |
24 #include "net/cert/x509_cert_types.h" | 27 #include "net/cert/x509_cert_types.h" |
25 #include "net/cert/x509_certificate.h" | 28 #include "net/cert/x509_certificate.h" |
26 #include "net/http/http_util.h" | 29 #include "net/http/http_util.h" |
27 #include "net/log/net_log.h" | 30 #include "net/log/net_log.h" |
28 #include "net/ssl/ssl_info.h" | 31 #include "net/ssl/ssl_info.h" |
29 #include "net/test/cert_test_util.h" | 32 #include "net/test/cert_test_util.h" |
30 #include "testing/gtest/include/gtest/gtest.h" | 33 #include "testing/gtest/include/gtest/gtest.h" |
31 | 34 |
32 #if defined(USE_OPENSSL) | 35 #if defined(USE_OPENSSL) |
33 #include "crypto/openssl_util.h" | 36 #include "crypto/openssl_util.h" |
34 #else | 37 #else |
35 #include "crypto/nss_util.h" | 38 #include "crypto/nss_util.h" |
36 #endif | 39 #endif |
37 | 40 |
| 41 namespace net { |
| 42 |
38 namespace { | 43 namespace { |
39 | 44 |
40 const char kReportUri[] = "http://example.test/test"; | 45 const char kReportUri[] = "http://example.test/test"; |
41 | 46 |
| 47 // A mock ReportSender that just remembers the latest report |
| 48 // URI and report to be sent. |
| 49 class MockCertificateReportSender |
| 50 : public TransportSecurityState::ReportSender { |
| 51 public: |
| 52 MockCertificateReportSender() {} |
| 53 ~MockCertificateReportSender() override {} |
| 54 |
| 55 void Send(const GURL& report_uri, const std::string& report) override { |
| 56 latest_report_uri_ = report_uri; |
| 57 latest_report_ = report; |
| 58 } |
| 59 |
| 60 const GURL& latest_report_uri() { return latest_report_uri_; } |
| 61 const std::string& latest_report() { return latest_report_; } |
| 62 |
| 63 private: |
| 64 GURL latest_report_uri_; |
| 65 std::string latest_report_; |
| 66 }; |
| 67 |
| 68 void CompareCertificateChainWithList( |
| 69 const scoped_refptr<X509Certificate>& cert_chain, |
| 70 const base::ListValue* cert_list) { |
| 71 ASSERT_TRUE(cert_chain); |
| 72 std::vector<std::string> pem_encoded_chain; |
| 73 cert_chain->GetPEMEncodedChain(&pem_encoded_chain); |
| 74 EXPECT_EQ(pem_encoded_chain.size(), cert_list->GetSize()); |
| 75 |
| 76 for (size_t i = 0; i < pem_encoded_chain.size(); i++) { |
| 77 std::string list_cert; |
| 78 ASSERT_TRUE(cert_list->GetString(i, &list_cert)); |
| 79 EXPECT_EQ(pem_encoded_chain[i], list_cert); |
| 80 } |
| 81 } |
| 82 |
| 83 void CheckHPKPReport( |
| 84 const std::string& report, |
| 85 const HostPortPair& host_port_pair, |
| 86 const base::Time& expiry, |
| 87 bool include_subdomains, |
| 88 const std::string& noted_hostname, |
| 89 const scoped_refptr<X509Certificate>& served_certificate_chain, |
| 90 const scoped_refptr<X509Certificate>& validated_certificate_chain, |
| 91 const HashValueVector& known_pins) { |
| 92 // TODO(estark): check time in RFC3339 format. |
| 93 |
| 94 scoped_ptr<base::Value> value(base::JSONReader::Read(report)); |
| 95 ASSERT_TRUE(value); |
| 96 ASSERT_TRUE(value->IsType(base::Value::TYPE_DICTIONARY)); |
| 97 |
| 98 base::DictionaryValue* report_dict; |
| 99 ASSERT_TRUE(value->GetAsDictionary(&report_dict)); |
| 100 |
| 101 std::string report_hostname; |
| 102 EXPECT_TRUE(report_dict->GetString("hostname", &report_hostname)); |
| 103 EXPECT_EQ(host_port_pair.host(), report_hostname); |
| 104 |
| 105 int report_port; |
| 106 EXPECT_TRUE(report_dict->GetInteger("port", &report_port)); |
| 107 EXPECT_EQ(host_port_pair.port(), report_port); |
| 108 |
| 109 bool report_include_subdomains; |
| 110 EXPECT_TRUE(report_dict->GetBoolean("include-subdomains", |
| 111 &report_include_subdomains)); |
| 112 EXPECT_EQ(include_subdomains, report_include_subdomains); |
| 113 |
| 114 std::string report_noted_hostname; |
| 115 EXPECT_TRUE(report_dict->GetString("noted-hostname", &report_noted_hostname)); |
| 116 EXPECT_EQ(noted_hostname, report_noted_hostname); |
| 117 |
| 118 base::ListValue* report_served_certificate_chain; |
| 119 EXPECT_TRUE(report_dict->GetList("served-certificate-chain", |
| 120 &report_served_certificate_chain)); |
| 121 ASSERT_NO_FATAL_FAILURE(CompareCertificateChainWithList( |
| 122 served_certificate_chain, report_served_certificate_chain)); |
| 123 |
| 124 base::ListValue* report_validated_certificate_chain; |
| 125 EXPECT_TRUE(report_dict->GetList("validated-certificate-chain", |
| 126 &report_validated_certificate_chain)); |
| 127 ASSERT_NO_FATAL_FAILURE(CompareCertificateChainWithList( |
| 128 validated_certificate_chain, report_validated_certificate_chain)); |
| 129 } |
| 130 |
42 } // namespace | 131 } // namespace |
43 | 132 |
44 namespace net { | |
45 | |
46 class TransportSecurityStateTest : public testing::Test { | 133 class TransportSecurityStateTest : public testing::Test { |
47 public: | 134 public: |
48 void SetUp() override { | 135 void SetUp() override { |
49 #if defined(USE_OPENSSL) | 136 #if defined(USE_OPENSSL) |
50 crypto::EnsureOpenSSLInit(); | 137 crypto::EnsureOpenSSLInit(); |
51 #else | 138 #else |
52 crypto::EnsureNSSInit(); | 139 crypto::EnsureNSSInit(); |
53 #endif | 140 #endif |
54 } | 141 } |
55 | 142 |
(...skipping 1049 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1105 | 1192 |
1106 // These hosts used to only be HSTS when SNI was available. | 1193 // These hosts used to only be HSTS when SNI was available. |
1107 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( | 1194 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( |
1108 "gmail.com")); | 1195 "gmail.com")); |
1109 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( | 1196 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( |
1110 "googlegroups.com")); | 1197 "googlegroups.com")); |
1111 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( | 1198 EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty( |
1112 "www.googlegroups.com")); | 1199 "www.googlegroups.com")); |
1113 } | 1200 } |
1114 | 1201 |
| 1202 TEST_F(TransportSecurityStateTest, HPKPReporting) { |
| 1203 const char kHost[] = "example.test"; |
| 1204 const char kSubdomain[] = "foo.example.test"; |
| 1205 static const uint16_t kPort = 443; |
| 1206 HostPortPair host_port_pair(kHost, kPort); |
| 1207 HostPortPair subdomain_host_port_pair(kSubdomain, kPort); |
| 1208 GURL report_uri("http://www.example.test/report"); |
| 1209 // Two dummy certs to use as the server-sent and validated chains. The |
| 1210 // contents don't matter. |
| 1211 scoped_refptr<X509Certificate> cert1 = |
| 1212 ImportCertFromFile(GetTestCertsDirectory(), "test_mail_google_com.pem"); |
| 1213 scoped_refptr<X509Certificate> cert2 = |
| 1214 ImportCertFromFile(GetTestCertsDirectory(), "expired_cert.pem"); |
| 1215 ASSERT_TRUE(cert1); |
| 1216 ASSERT_TRUE(cert2); |
| 1217 |
| 1218 // kGoodPath is blog.torproject.org. |
| 1219 static const char* const kGoodPath[] = { |
| 1220 "sha1/m9lHYJYke9k0GtVZ+bXSQYE8nDI=", "sha1/o5OZxATDsgmwgcIfIWIneMJ0jkw=", |
| 1221 "sha1/wHqYaI2J+6sFZAwRfap9ZbjKzE4=", NULL, |
| 1222 }; |
| 1223 |
| 1224 // kBadPath is plus.google.com via Trustcenter, which is utterly wrong for |
| 1225 // torproject.org. |
| 1226 static const char* const kBadPath[] = { |
| 1227 "sha1/4BjDjn8v2lWeUFQnqSs0BgbIcrU=", "sha1/gzuEEAB/bkqdQS3EIjk2by7lW+k=", |
| 1228 "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=", NULL, |
| 1229 }; |
| 1230 |
| 1231 HashValueVector good_hashes, bad_hashes; |
| 1232 |
| 1233 for (size_t i = 0; kGoodPath[i]; i++) |
| 1234 EXPECT_TRUE(AddHash(kGoodPath[i], &good_hashes)); |
| 1235 for (size_t i = 0; kBadPath[i]; i++) |
| 1236 EXPECT_TRUE(AddHash(kBadPath[i], &bad_hashes)); |
| 1237 |
| 1238 TransportSecurityState state; |
| 1239 MockCertificateReportSender mock_report_sender; |
| 1240 state.SetReportSender(&mock_report_sender); |
| 1241 |
| 1242 const base::Time current_time = base::Time::Now(); |
| 1243 const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000); |
| 1244 state.AddHPKP(kHost, expiry, true, good_hashes, report_uri); |
| 1245 |
| 1246 EXPECT_EQ(GURL(), mock_report_sender.latest_report_uri()); |
| 1247 EXPECT_EQ(std::string(), mock_report_sender.latest_report()); |
| 1248 |
| 1249 std::string failure_log; |
| 1250 EXPECT_FALSE(state.CheckPublicKeyPins( |
| 1251 host_port_pair, true, bad_hashes, cert1.get(), cert2.get(), |
| 1252 TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log)); |
| 1253 |
| 1254 // No report should have been sent because of the DISABLE_PIN_REPORTS |
| 1255 // argument. |
| 1256 EXPECT_EQ(GURL(), mock_report_sender.latest_report_uri()); |
| 1257 EXPECT_EQ(std::string(), mock_report_sender.latest_report()); |
| 1258 |
| 1259 EXPECT_TRUE(state.CheckPublicKeyPins( |
| 1260 host_port_pair, true, good_hashes, cert1.get(), cert2.get(), |
| 1261 TransportSecurityState::ENABLE_PIN_REPORTS, &failure_log)); |
| 1262 |
| 1263 // No report should have been sent because there was no violation. |
| 1264 EXPECT_EQ(GURL(), mock_report_sender.latest_report_uri()); |
| 1265 EXPECT_EQ(std::string(), mock_report_sender.latest_report()); |
| 1266 |
| 1267 EXPECT_FALSE(state.CheckPublicKeyPins( |
| 1268 host_port_pair, true, bad_hashes, cert1.get(), cert2.get(), |
| 1269 TransportSecurityState::ENABLE_PIN_REPORTS, &failure_log)); |
| 1270 |
| 1271 // Now a report should have been sent. Check that it contains the |
| 1272 // right information. |
| 1273 EXPECT_EQ(report_uri, mock_report_sender.latest_report_uri()); |
| 1274 std::string report = mock_report_sender.latest_report(); |
| 1275 ASSERT_FALSE(report.empty()); |
| 1276 ASSERT_NO_FATAL_FAILURE(CheckHPKPReport(report, host_port_pair, expiry, true, |
| 1277 kHost, cert1.get(), cert2.get(), |
| 1278 good_hashes)); |
| 1279 |
| 1280 EXPECT_FALSE(state.CheckPublicKeyPins( |
| 1281 subdomain_host_port_pair, true, bad_hashes, cert1.get(), cert2.get(), |
| 1282 TransportSecurityState::ENABLE_PIN_REPORTS, &failure_log)); |
| 1283 |
| 1284 // Now a report should have been sent for the subdomain. Check that it |
| 1285 // contains the right information. |
| 1286 EXPECT_EQ(report_uri, mock_report_sender.latest_report_uri()); |
| 1287 report = mock_report_sender.latest_report(); |
| 1288 ASSERT_FALSE(report.empty()); |
| 1289 ASSERT_NO_FATAL_FAILURE(CheckHPKPReport(report, subdomain_host_port_pair, |
| 1290 expiry, true, kHost, cert1.get(), |
| 1291 cert2.get(), good_hashes)); |
| 1292 } |
| 1293 |
1115 } // namespace net | 1294 } // namespace net |
OLD | NEW |