QUIC - Code to verify SCT tag with certificate transparency verifier

net/quic/test_tools/crypto_test_utils_chromium.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/test_tools/crypto_test_utils.h"
 
 #include "base/callback_helpers.h"
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/base/test_data_directory.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
+#include "net/cert/ct_verifier.h"
 #include "net/cert/mock_cert_verifier.h"
 #include "net/cert/test_root_certs.h"
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util.h"
 #include "net/http/transport_security_state.h"
 #include "net/log/net_log.h"
 #include "net/quic/crypto/crypto_utils.h"
 #include "net/quic/crypto/proof_source_chromium.h"
 #include "net/quic/crypto/proof_verifier_chromium.h"
 #include "net/ssl/ssl_config_service.h"
 #include "net/test/cert_test_util.h"
+#include "net/test/ct_test_util.h"
 
 using base::StringPiece;
 using base::StringPrintf;
 using std::string;
 using std::vector;
 
 namespace net {
 
 namespace test {
 
 namespace {
 
 class TestProofVerifierChromium : public ProofVerifierChromium {
  public:
   TestProofVerifierChromium(
       scoped_ptr<CertVerifier> cert_verifier,
       scoped_ptr<TransportSecurityState> transport_security_state,
+      scoped_ptr<CTVerifier> cert_transparency_verifier,
       const std::string& cert_file)
       : ProofVerifierChromium(cert_verifier.get(),
                               nullptr,
-                              transport_security_state.get()),
+                              transport_security_state.get(),
+                              cert_transparency_verifier.get()),
         cert_verifier_(cert_verifier.Pass()),
-        transport_security_state_(transport_security_state.Pass()) {
+        transport_security_state_(transport_security_state.Pass()),
+        cert_transparency_verifier_(cert_transparency_verifier.Pass()) {
     // Load and install the root for the validated chain.
     scoped_refptr<X509Certificate> root_cert =
         ImportCertFromFile(GetTestCertsDirectory(), cert_file);
     scoped_root_.Reset(root_cert.get());
   }
 
   ~TestProofVerifierChromium() override {}
 
   CertVerifier* cert_verifier() { return cert_verifier_.get(); }
 
  private:
   ScopedTestRoot scoped_root_;
   scoped_ptr<CertVerifier> cert_verifier_;
   scoped_ptr<TransportSecurityState> transport_security_state_;
+  scoped_ptr<CTVerifier> cert_transparency_verifier_;
+};
+
+class FakeCTVerifier : public CTVerifier {
+ public:
+  FakeCTVerifier() {}
+  ~FakeCTVerifier() override {}
+
+  // CTVerifier implementation:
+  int Verify(X509Certificate* cert,
+             const std::string& stapled_ocsp_response,
+             const std::string& sct_list_from_tls_extension,
+             ct::CTVerifyResult* result,
+             const BoundNetLog& net_log) override {
+    if (sct_list_from_tls_extension ==
+        ct::GetTestSignedCertificateTimestamp()) {
+      return OK;
+    }
+    return ERR_FAILED;
+  }
+
+  void SetObserver(Observer* observer) override {}
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FakeCTVerifier);
 };
 
 const char kSignature[] = "signature";
-const char kSCT[] = "CryptoServerTests";
 
 class FakeProofSource : public ProofSource {
  public:
   FakeProofSource() {}
   ~FakeProofSource() override {}
 
   // ProofSource interface
   bool Initialize(const base::FilePath& cert_path,
                   const base::FilePath& key_path,
                   const base::FilePath& sct_path) {
@@ skipping 25 matching lines @@
 
   bool GetProof(const IPAddressNumber& server_ip,
                 const std::string& hostname,
                 const std::string& server_config,
                 bool ecdsa_ok,
                 const std::vector<std::string>** out_certs,
                 std::string* out_signature,
                 std::string* out_leaf_cert_sct) override {
     out_signature->assign(kSignature);
     *out_certs = &certificates_;
-    *out_leaf_cert_sct = kSCT;
+    *out_leaf_cert_sct = ct::GetTestSignedCertificateTimestamp();
     return true;
   }
 
  private:
   std::vector<std::string> certificates_;
 
   DISALLOW_COPY_AND_ASSIGN(FakeProofSource);
 };
 
 class FakeProofVerifier : public TestProofVerifierChromium {
  public:
   FakeProofVerifier(scoped_ptr<CertVerifier> cert_verifier,
                     scoped_ptr<TransportSecurityState> transport_security_state,
+                    scoped_ptr<CTVerifier> cert_transparency_verifier,
                     const std::string& cert_file)
       : TestProofVerifierChromium(cert_verifier.Pass(),
                                   transport_security_state.Pass(),
+                                  cert_transparency_verifier.Pass(),
                                   cert_file) {}
   ~FakeProofVerifier() override {}
 
   // ProofVerifier interface
   QuicAsyncStatus VerifyProof(const std::string& hostname,
                               const std::string& server_config,
                               const std::vector<std::string>& certs,
                               const std::string& cert_sct,
                               const std::string& signature,
                               const ProofVerifyContext* verify_context,
@@ skipping 80 matching lines @@
       ImportCertFromFile(GetTestCertsDirectory(), "quic_test.example.com.crt");
   cert_verifier->AddResultForCertAndHost(verify_result.verified_cert.get(),
                                          "test.example.com", verify_result, OK);
   verify_result.verified_cert = ImportCertFromFile(
       GetTestCertsDirectory(), "quic_test_ecc.example.com.crt");
   cert_verifier->AddResultForCertAndHost(verify_result.verified_cert.get(),
                                          "test.example.com", verify_result, OK);
   if (use_real_proof_verifier) {
     return new TestProofVerifierChromium(
         cert_verifier.Pass(), make_scoped_ptr(new TransportSecurityState),
-        "quic_root.crt");
+        make_scoped_ptr(new FakeCTVerifier), "quic_root.crt");
   }
 #if defined(USE_OPENSSL)
   return new TestProofVerifierChromium(
       cert_verifier.Pass(), make_scoped_ptr(new TransportSecurityState),
-      "quic_root.crt");
+      make_scoped_ptr(new FakeCTVerifier), "quic_root.crt");
 #else
-  return new FakeProofVerifier(cert_verifier.Pass(),
-                               make_scoped_ptr(new TransportSecurityState),
-                               "quic_root.crt");
+  return new FakeProofVerifier(
+      cert_verifier.Pass(), make_scoped_ptr(new TransportSecurityState),
+      make_scoped_ptr(new FakeCTVerifier), "quic_root.crt");
 #endif
 }
 
 // static
 ProofVerifier* CryptoTestUtils::ProofVerifierForTesting() {
   return ProofVerifierForTestingInternal(/*use_real_proof_verifier=*/false);
 }
 
 // static
 ProofVerifier* CryptoTestUtils::RealProofVerifierForTesting() {
   return ProofVerifierForTestingInternal(/*use_real_proof_verifier=*/true);
 }
 
 // static
 ProofVerifyContext* CryptoTestUtils::ProofVerifyContextForTesting() {
   return new ProofVerifyContextChromium(/*cert_verify_flags=*/0, BoundNetLog());
 }
 
+// static
+CTVerifier* CryptoTestUtils::CTVerifierTesting() {
+  return new FakeCTVerifier();
+}
+
 }  // namespace test
 
 }  // namespace net