| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/quic/crypto/proof_verifier_chromium.h" | 5 #include "net/quic/crypto/proof_verifier_chromium.h" |
| 6 | 6 |
| 7 #include "base/memory/ref_counted.h" | 7 #include "base/memory/ref_counted.h" |
| 8 #include "base/memory/scoped_ptr.h" | 8 #include "base/memory/scoped_ptr.h" |
| 9 #include "net/base/net_errors.h" | 9 #include "net/base/net_errors.h" |
| 10 #include "net/base/test_data_directory.h" | 10 #include "net/base/test_data_directory.h" |
| (...skipping 165 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 176 ASSERT_TRUE(test_cert.get()); | 176 ASSERT_TRUE(test_cert.get()); |
| 177 | 177 |
| 178 std::string der_bytes; | 178 std::string der_bytes; |
| 179 ASSERT_TRUE(X509Certificate::GetDEREncoded(test_cert->os_cert_handle(), | 179 ASSERT_TRUE(X509Certificate::GetDEREncoded(test_cert->os_cert_handle(), |
| 180 &der_bytes)); | 180 &der_bytes)); |
| 181 | 181 |
| 182 certs->clear(); | 182 certs->clear(); |
| 183 certs->push_back(der_bytes); | 183 certs->push_back(der_bytes); |
| 184 } | 184 } |
| 185 | 185 |
| 186 std::string GetSCTListForTesting() { |
| 187 const std::string sct = ct::GetTestSignedCertificateTimestamp(); |
| 188 std::string sct_list; |
| 189 ct::EncodeSCTListForTesting(sct, &sct_list); |
| 190 return sct_list; |
| 191 } |
| 192 |
| 193 std::string GetCorruptSCTListForTesting() { |
| 194 std::string sct = ct::GetTestSignedCertificateTimestamp(); |
| 195 sct[15] = 't'; // Corrupt a byte inside SCT. |
| 196 std::string sct_list; |
| 197 ct::EncodeSCTListForTesting(sct, &sct_list); |
| 198 return sct_list; |
| 199 } |
| 200 |
| 201 bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) { |
| 202 return (result.verified_scts.size() == 1U) && result.invalid_scts.empty() && |
| 203 result.unknown_logs_scts.empty() && |
| 204 result.verified_scts[0]->log_description == kLogDescription; |
| 205 } |
| 206 |
| 207 bool CheckForSCTOrigin(const ct::CTVerifyResult& result, |
| 208 ct::SignedCertificateTimestamp::Origin origin) { |
| 209 return (result.verified_scts.size() > 0) && |
| 210 (result.verified_scts[0]->origin == origin); |
| 211 } |
| 212 |
| 186 void CheckSCT(bool sct_expected_ok) { | 213 void CheckSCT(bool sct_expected_ok) { |
| 187 ProofVerifyDetailsChromium* proof_details = | 214 ProofVerifyDetailsChromium* proof_details = |
| 188 reinterpret_cast<ProofVerifyDetailsChromium*>(details_.get()); | 215 reinterpret_cast<ProofVerifyDetailsChromium*>(details_.get()); |
| 189 const ct::CTVerifyResult& ct_verify_result = | 216 const ct::CTVerifyResult& ct_verify_result = |
| 190 proof_details->ct_verify_result; | 217 proof_details->ct_verify_result; |
| 191 if (sct_expected_ok) { | 218 if (sct_expected_ok) { |
| 192 ASSERT_TRUE(ct::CheckForSingleVerifiedSCTInResult(ct_verify_result, | 219 ASSERT_TRUE(CheckForSingleVerifiedSCTInResult(ct_verify_result)); |
| 193 kLogDescription)); | 220 ASSERT_TRUE(CheckForSCTOrigin( |
| 194 ASSERT_TRUE(ct::CheckForSCTOrigin( | |
| 195 ct_verify_result, | 221 ct_verify_result, |
| 196 ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); | 222 ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); |
| 197 } else { | 223 } else { |
| 198 EXPECT_EQ(1U, ct_verify_result.unknown_logs_scts.size()); | 224 EXPECT_EQ(1U, ct_verify_result.unknown_logs_scts.size()); |
| 199 } | 225 } |
| 200 } | 226 } |
| 201 | 227 |
| 202 protected: | 228 protected: |
| 203 scoped_ptr<MultiLogCTVerifier> ct_verifier_; | 229 scoped_ptr<MultiLogCTVerifier> ct_verifier_; |
| 204 std::vector<scoped_refptr<const CTLogVerifier>> log_verifiers_; | 230 std::vector<scoped_refptr<const CTLogVerifier>> log_verifiers_; |
| (...skipping 23 matching lines...) Expand all Loading... |
| 228 // Use different certificates for SCT tests. | 254 // Use different certificates for SCT tests. |
| 229 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); | 255 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); |
| 230 | 256 |
| 231 MockCertVerifier cert_verifier; | 257 MockCertVerifier cert_verifier; |
| 232 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 258 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
| 233 ct_verifier_.get()); | 259 ct_verifier_.get()); |
| 234 | 260 |
| 235 scoped_ptr<DummyProofVerifierCallback> callback( | 261 scoped_ptr<DummyProofVerifierCallback> callback( |
| 236 new DummyProofVerifierCallback); | 262 new DummyProofVerifierCallback); |
| 237 QuicAsyncStatus status = proof_verifier.VerifyProof( | 263 QuicAsyncStatus status = proof_verifier.VerifyProof( |
| 238 kTestHostname, kTestConfig, certs_, ct::GetSCTListForTesting(), "", | 264 kTestHostname, kTestConfig, certs_, GetSCTListForTesting(), "", |
| 239 verify_context_.get(), &error_details_, &details_, callback.get()); | 265 verify_context_.get(), &error_details_, &details_, callback.get()); |
| 240 ASSERT_EQ(QUIC_FAILURE, status); | 266 ASSERT_EQ(QUIC_FAILURE, status); |
| 241 CheckSCT(/*sct_expected_ok=*/true); | 267 CheckSCT(/*sct_expected_ok=*/true); |
| 242 } | 268 } |
| 243 | 269 |
| 244 // Invalid SCT and signature. | 270 // Invalid SCT and signature. |
| 245 TEST_F(ProofVerifierChromiumTest, InvalidSCTList) { | 271 TEST_F(ProofVerifierChromiumTest, InvalidSCTList) { |
| 246 // Use different certificates for SCT tests. | 272 // Use different certificates for SCT tests. |
| 247 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); | 273 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); |
| 248 | 274 |
| 249 MockCertVerifier cert_verifier; | 275 MockCertVerifier cert_verifier; |
| 250 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 276 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
| 251 ct_verifier_.get()); | 277 ct_verifier_.get()); |
| 252 | 278 |
| 253 scoped_ptr<DummyProofVerifierCallback> callback( | 279 scoped_ptr<DummyProofVerifierCallback> callback( |
| 254 new DummyProofVerifierCallback); | 280 new DummyProofVerifierCallback); |
| 255 QuicAsyncStatus status = proof_verifier.VerifyProof( | 281 QuicAsyncStatus status = proof_verifier.VerifyProof( |
| 256 kTestHostname, kTestConfig, certs_, ct::GetSCTListWithInvalidSCT(), "", | 282 kTestHostname, kTestConfig, certs_, GetCorruptSCTListForTesting(), "", |
| 257 verify_context_.get(), &error_details_, &details_, callback.get()); | 283 verify_context_.get(), &error_details_, &details_, callback.get()); |
| 258 ASSERT_EQ(QUIC_FAILURE, status); | 284 ASSERT_EQ(QUIC_FAILURE, status); |
| 259 CheckSCT(/*sct_expected_ok=*/false); | 285 CheckSCT(/*sct_expected_ok=*/false); |
| 260 } | 286 } |
| 261 | 287 |
| 262 // Tests that the ProofVerifier doesn't verify certificates if the config | 288 // Tests that the ProofVerifier doesn't verify certificates if the config |
| 263 // signature fails. | 289 // signature fails. |
| 264 TEST_F(ProofVerifierChromiumTest, FailsIfSignatureFails) { | 290 TEST_F(ProofVerifierChromiumTest, FailsIfSignatureFails) { |
| 265 FailsTestCertVerifier cert_verifier; | 291 FailsTestCertVerifier cert_verifier; |
| 266 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 292 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
| (...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 395 ASSERT_EQ(QUIC_SUCCESS, status); | 421 ASSERT_EQ(QUIC_SUCCESS, status); |
| 396 | 422 |
| 397 ASSERT_TRUE(details_.get()); | 423 ASSERT_TRUE(details_.get()); |
| 398 ProofVerifyDetailsChromium* verify_details = | 424 ProofVerifyDetailsChromium* verify_details = |
| 399 static_cast<ProofVerifyDetailsChromium*>(details_.get()); | 425 static_cast<ProofVerifyDetailsChromium*>(details_.get()); |
| 400 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); | 426 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); |
| 401 } | 427 } |
| 402 | 428 |
| 403 } // namespace test | 429 } // namespace test |
| 404 } // namespace net | 430 } // namespace net |
| OLD | NEW |