Certificate Transparency: Add observer for Signed Certificate Timestamps

net/cert/multi_log_ct_verifier_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_log_ct_verifier.h"
 
 #include <string>
 
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/histogram_samples.h"
 #include "base/metrics/statistics_recorder.h"
 #include "base/values.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_data_directory.h"
 #include "net/cert/ct_log_verifier.h"
 #include "net/cert/ct_serialization.h"
 #include "net/cert/ct_verify_result.h"
 #include "net/cert/pem_tokenizer.h"
 #include "net/cert/sct_status_flags.h"
 #include "net/cert/signed_certificate_timestamp.h"
 #include "net/cert/x509_certificate.h"
 #include "net/log/net_log.h"
 #include "net/log/test_net_log.h"
 #include "net/log/test_net_log_entry.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/ct_test_util.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+using testing::_;
+using testing::Mock;
+
 namespace net {
 
 namespace {
 
 const char kLogDescription[] = "somelog";
 const char kSCTCountHistogram[] =
     "Net.CertificateTransparency.SCTsPerConnection";
 
+class MockSCTObserver : public CTVerifier::Observer {
+ public:
+  MOCK_METHOD2(OnSCTVerified,
+               void(X509Certificate* cert,
+                    const ct::SignedCertificateTimestamp* sct));
+};
+
 class MultiLogCTVerifierTest : public ::testing::Test {
  public:
   void SetUp() override {
     scoped_refptr<CTLogVerifier> log(CTLogVerifier::Create(
         ct::GetTestPublicKey(), kLogDescription, "https://ct.example.com"));
     ASSERT_TRUE(log);
     log_verifiers_.push_back(log);
 
     verifier_.reset(new MultiLogCTVerifier());
     verifier_->AddLogs(log_verifiers_);
@@ skipping 245 matching lines @@
   EXPECT_EQ(old_embedded_count + 1, NumEmbeddedSCTsInHistogram());
 }
 
 TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) {
   int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0);
   EXPECT_FALSE(VerifySinglePrecertificateChain(chain_));
   ASSERT_EQ(connections_without_scts + 1,
             GetValueFromHistogram(kSCTCountHistogram, 0));
 }
 
+TEST_F(MultiLogCTVerifierTest, NotifiesOfValidSCT) {
+  MockSCTObserver observer;
+  verifier_->SetObserver(&observer);
+
+  EXPECT_CALL(observer, OnSCTVerified(embedded_sct_chain_.get(), _));
+  ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_));
+  Mock::VerifyAndClearExpectations(&observer);

[Ryan Sleevi, 2015/07/02 14:25:46]

This isn't needed if you remove 322/323, since this is implicitly handled as the
mock object goes out of scope.

[Eran Messeri, 2015/07/02 15:04:38]

Done.

+
+  verifier_->SetObserver(nullptr);

[Ryan Sleevi, 2015/07/02 14:25:46]

This isn't necessary - is it? verifier_ gets deleted as soon as this test
completed.

[Eran Messeri, 2015/07/02 15:04:39]

Done.

+}
+
+TEST_F(MultiLogCTVerifierTest, StopsNotifyingCorrectly) {
+  MockSCTObserver observer;
+  verifier_->SetObserver(&observer);
+
+  EXPECT_CALL(observer, OnSCTVerified(embedded_sct_chain_.get(), _)).Times(1);
+  ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_));
+  verifier_->SetObserver(nullptr);

[Ryan Sleevi, 2015/07/02 14:25:46]

335 isn't strictly necessary, but it seems like you're not testing the ordering
of the calls (namely, that the delivery of notifications happens prior to the
SetObserver(nullptr)

Suggested restructuring:

331 ASSERT_TRUE(...);
332 Mock::VerifyAndClearExpectations(&observer);
333
334 verifier_->SetObserver(nullptr)
335 ASSERT_TRUE(...);
336 }

[Eran Messeri, 2015/07/02 15:04:38]

Done, though I had to add:
EXPECT_CALL(observer, OnSCTVerified(...)).Times(0);
after VerifyAndClearExpectations otherwise the call would be allowed (and a
warning would be emitted about an uninteresting mock function call)

+  ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_));
+
+  Mock::VerifyAndClearExpectations(&observer);
+}
+
 }  // namespace
 
 }  // namespace net