| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/quic/crypto/proof_verifier_chromium.h" | 5 #include "net/quic/crypto/proof_verifier_chromium.h" |
| 6 | 6 |
| 7 #include "base/memory/ref_counted.h" | 7 #include "base/memory/ref_counted.h" |
| 8 #include "base/memory/scoped_ptr.h" | 8 #include "base/memory/scoped_ptr.h" |
| 9 #include "net/base/net_errors.h" | 9 #include "net/base/net_errors.h" |
| 10 #include "net/base/test_data_directory.h" | 10 #include "net/base/test_data_directory.h" |
| (...skipping 165 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 176 ASSERT_TRUE(test_cert.get()); | 176 ASSERT_TRUE(test_cert.get()); |
| 177 | 177 |
| 178 std::string der_bytes; | 178 std::string der_bytes; |
| 179 ASSERT_TRUE(X509Certificate::GetDEREncoded(test_cert->os_cert_handle(), | 179 ASSERT_TRUE(X509Certificate::GetDEREncoded(test_cert->os_cert_handle(), |
| 180 &der_bytes)); | 180 &der_bytes)); |
| 181 | 181 |
| 182 certs->clear(); | 182 certs->clear(); |
| 183 certs->push_back(der_bytes); | 183 certs->push_back(der_bytes); |
| 184 } | 184 } |
| 185 | 185 |
| 186 std::string GetSCTListForTesting() { | |
| 187 const std::string sct = ct::GetTestSignedCertificateTimestamp(); | |
| 188 std::string sct_list; | |
| 189 ct::EncodeSCTListForTesting(sct, &sct_list); | |
| 190 return sct_list; | |
| 191 } | |
| 192 | |
| 193 std::string GetCorruptSCTListForTesting() { | |
| 194 std::string sct = ct::GetTestSignedCertificateTimestamp(); | |
| 195 sct[15] = 't'; // Corrupt a byte inside SCT. | |
| 196 std::string sct_list; | |
| 197 ct::EncodeSCTListForTesting(sct, &sct_list); | |
| 198 return sct_list; | |
| 199 } | |
| 200 | |
| 201 bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) { | |
| 202 return (result.verified_scts.size() == 1U) && result.invalid_scts.empty() && | |
| 203 result.unknown_logs_scts.empty() && | |
| 204 result.verified_scts[0]->log_description == kLogDescription; | |
| 205 } | |
| 206 | |
| 207 bool CheckForSCTOrigin(const ct::CTVerifyResult& result, | |
| 208 ct::SignedCertificateTimestamp::Origin origin) { | |
| 209 return (result.verified_scts.size() > 0) && | |
| 210 (result.verified_scts[0]->origin == origin); | |
| 211 } | |
| 212 | |
| 213 void CheckSCT(bool sct_expected_ok) { | 186 void CheckSCT(bool sct_expected_ok) { |
| 214 ProofVerifyDetailsChromium* proof_details = | 187 ProofVerifyDetailsChromium* proof_details = |
| 215 reinterpret_cast<ProofVerifyDetailsChromium*>(details_.get()); | 188 reinterpret_cast<ProofVerifyDetailsChromium*>(details_.get()); |
| 216 const ct::CTVerifyResult& ct_verify_result = | 189 const ct::CTVerifyResult& ct_verify_result = |
| 217 proof_details->ct_verify_result; | 190 proof_details->ct_verify_result; |
| 218 if (sct_expected_ok) { | 191 if (sct_expected_ok) { |
| 219 ASSERT_TRUE(CheckForSingleVerifiedSCTInResult(ct_verify_result)); | 192 ASSERT_TRUE(ct::CheckForSingleVerifiedSCTInResult(ct_verify_result, |
| 220 ASSERT_TRUE(CheckForSCTOrigin( | 193 kLogDescription)); |
| 194 ASSERT_TRUE(ct::CheckForSCTOrigin( |
| 221 ct_verify_result, | 195 ct_verify_result, |
| 222 ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); | 196 ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); |
| 223 } else { | 197 } else { |
| 224 EXPECT_EQ(1U, ct_verify_result.unknown_logs_scts.size()); | 198 EXPECT_EQ(1U, ct_verify_result.unknown_logs_scts.size()); |
| 225 } | 199 } |
| 226 } | 200 } |
| 227 | 201 |
| 228 protected: | 202 protected: |
| 229 scoped_ptr<MultiLogCTVerifier> ct_verifier_; | 203 scoped_ptr<MultiLogCTVerifier> ct_verifier_; |
| 230 std::vector<scoped_refptr<const CTLogVerifier>> log_verifiers_; | 204 std::vector<scoped_refptr<const CTLogVerifier>> log_verifiers_; |
| (...skipping 23 matching lines...) Expand all Loading... |
| 254 // Use different certificates for SCT tests. | 228 // Use different certificates for SCT tests. |
| 255 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); | 229 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); |
| 256 | 230 |
| 257 MockCertVerifier cert_verifier; | 231 MockCertVerifier cert_verifier; |
| 258 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 232 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
| 259 ct_verifier_.get()); | 233 ct_verifier_.get()); |
| 260 | 234 |
| 261 scoped_ptr<DummyProofVerifierCallback> callback( | 235 scoped_ptr<DummyProofVerifierCallback> callback( |
| 262 new DummyProofVerifierCallback); | 236 new DummyProofVerifierCallback); |
| 263 QuicAsyncStatus status = proof_verifier.VerifyProof( | 237 QuicAsyncStatus status = proof_verifier.VerifyProof( |
| 264 kTestHostname, kTestConfig, certs_, GetSCTListForTesting(), "", | 238 kTestHostname, kTestConfig, certs_, ct::GetSCTListForTesting(), "", |
| 265 verify_context_.get(), &error_details_, &details_, callback.get()); | 239 verify_context_.get(), &error_details_, &details_, callback.get()); |
| 266 ASSERT_EQ(QUIC_FAILURE, status); | 240 ASSERT_EQ(QUIC_FAILURE, status); |
| 267 CheckSCT(/*sct_expected_ok=*/true); | 241 CheckSCT(/*sct_expected_ok=*/true); |
| 268 } | 242 } |
| 269 | 243 |
| 270 // Invalid SCT and signature. | 244 // Invalid SCT and signature. |
| 271 TEST_F(ProofVerifierChromiumTest, InvalidSCTList) { | 245 TEST_F(ProofVerifierChromiumTest, InvalidSCTList) { |
| 272 // Use different certificates for SCT tests. | 246 // Use different certificates for SCT tests. |
| 273 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); | 247 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); |
| 274 | 248 |
| 275 MockCertVerifier cert_verifier; | 249 MockCertVerifier cert_verifier; |
| 276 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 250 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
| 277 ct_verifier_.get()); | 251 ct_verifier_.get()); |
| 278 | 252 |
| 279 scoped_ptr<DummyProofVerifierCallback> callback( | 253 scoped_ptr<DummyProofVerifierCallback> callback( |
| 280 new DummyProofVerifierCallback); | 254 new DummyProofVerifierCallback); |
| 281 QuicAsyncStatus status = proof_verifier.VerifyProof( | 255 QuicAsyncStatus status = proof_verifier.VerifyProof( |
| 282 kTestHostname, kTestConfig, certs_, GetCorruptSCTListForTesting(), "", | 256 kTestHostname, kTestConfig, certs_, ct::GetSCTListWithInvalidSCT(), "", |
| 283 verify_context_.get(), &error_details_, &details_, callback.get()); | 257 verify_context_.get(), &error_details_, &details_, callback.get()); |
| 284 ASSERT_EQ(QUIC_FAILURE, status); | 258 ASSERT_EQ(QUIC_FAILURE, status); |
| 285 CheckSCT(/*sct_expected_ok=*/false); | 259 CheckSCT(/*sct_expected_ok=*/false); |
| 286 } | 260 } |
| 287 | 261 |
| 288 // Tests that the ProofVerifier doesn't verify certificates if the config | 262 // Tests that the ProofVerifier doesn't verify certificates if the config |
| 289 // signature fails. | 263 // signature fails. |
| 290 TEST_F(ProofVerifierChromiumTest, FailsIfSignatureFails) { | 264 TEST_F(ProofVerifierChromiumTest, FailsIfSignatureFails) { |
| 291 FailsTestCertVerifier cert_verifier; | 265 FailsTestCertVerifier cert_verifier; |
| 292 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 266 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
| (...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 421 ASSERT_EQ(QUIC_SUCCESS, status); | 395 ASSERT_EQ(QUIC_SUCCESS, status); |
| 422 | 396 |
| 423 ASSERT_TRUE(details_.get()); | 397 ASSERT_TRUE(details_.get()); |
| 424 ProofVerifyDetailsChromium* verify_details = | 398 ProofVerifyDetailsChromium* verify_details = |
| 425 static_cast<ProofVerifyDetailsChromium*>(details_.get()); | 399 static_cast<ProofVerifyDetailsChromium*>(details_.get()); |
| 426 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); | 400 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); |
| 427 } | 401 } |
| 428 | 402 |
| 429 } // namespace test | 403 } // namespace test |
| 430 } // namespace net | 404 } // namespace net |
| OLD | NEW |