OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/quic/crypto/proof_verifier_chromium.h" | 5 #include "net/quic/crypto/proof_verifier_chromium.h" |
6 | 6 |
7 #include "base/memory/ref_counted.h" | 7 #include "base/memory/ref_counted.h" |
8 #include "base/memory/scoped_ptr.h" | 8 #include "base/memory/scoped_ptr.h" |
9 #include "net/base/net_errors.h" | 9 #include "net/base/net_errors.h" |
10 #include "net/base/test_data_directory.h" | 10 #include "net/base/test_data_directory.h" |
(...skipping 165 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
176 ASSERT_TRUE(test_cert.get()); | 176 ASSERT_TRUE(test_cert.get()); |
177 | 177 |
178 std::string der_bytes; | 178 std::string der_bytes; |
179 ASSERT_TRUE(X509Certificate::GetDEREncoded(test_cert->os_cert_handle(), | 179 ASSERT_TRUE(X509Certificate::GetDEREncoded(test_cert->os_cert_handle(), |
180 &der_bytes)); | 180 &der_bytes)); |
181 | 181 |
182 certs->clear(); | 182 certs->clear(); |
183 certs->push_back(der_bytes); | 183 certs->push_back(der_bytes); |
184 } | 184 } |
185 | 185 |
| 186 std::string GetSCTListForTesting() { |
| 187 const std::string sct = ct::GetTestSignedCertificateTimestamp(); |
| 188 std::string sct_list; |
| 189 ct::EncodeSCTListForTesting(sct, &sct_list); |
| 190 return sct_list; |
| 191 } |
| 192 |
| 193 std::string GetCorruptSCTListForTesting() { |
| 194 std::string sct = ct::GetTestSignedCertificateTimestamp(); |
| 195 sct[15] = 't'; // Corrupt a byte inside SCT. |
| 196 std::string sct_list; |
| 197 ct::EncodeSCTListForTesting(sct, &sct_list); |
| 198 return sct_list; |
| 199 } |
| 200 |
| 201 bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) { |
| 202 return (result.verified_scts.size() == 1U) && result.invalid_scts.empty() && |
| 203 result.unknown_logs_scts.empty() && |
| 204 result.verified_scts[0]->log_description == kLogDescription; |
| 205 } |
| 206 |
| 207 bool CheckForSCTOrigin(const ct::CTVerifyResult& result, |
| 208 ct::SignedCertificateTimestamp::Origin origin) { |
| 209 return (result.verified_scts.size() > 0) && |
| 210 (result.verified_scts[0]->origin == origin); |
| 211 } |
| 212 |
186 void CheckSCT(bool sct_expected_ok) { | 213 void CheckSCT(bool sct_expected_ok) { |
187 ProofVerifyDetailsChromium* proof_details = | 214 ProofVerifyDetailsChromium* proof_details = |
188 reinterpret_cast<ProofVerifyDetailsChromium*>(details_.get()); | 215 reinterpret_cast<ProofVerifyDetailsChromium*>(details_.get()); |
189 const ct::CTVerifyResult& ct_verify_result = | 216 const ct::CTVerifyResult& ct_verify_result = |
190 proof_details->ct_verify_result; | 217 proof_details->ct_verify_result; |
191 if (sct_expected_ok) { | 218 if (sct_expected_ok) { |
192 ASSERT_TRUE(ct::CheckForSingleVerifiedSCTInResult(ct_verify_result, | 219 ASSERT_TRUE(CheckForSingleVerifiedSCTInResult(ct_verify_result)); |
193 kLogDescription)); | 220 ASSERT_TRUE(CheckForSCTOrigin( |
194 ASSERT_TRUE(ct::CheckForSCTOrigin( | |
195 ct_verify_result, | 221 ct_verify_result, |
196 ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); | 222 ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); |
197 } else { | 223 } else { |
198 EXPECT_EQ(1U, ct_verify_result.unknown_logs_scts.size()); | 224 EXPECT_EQ(1U, ct_verify_result.unknown_logs_scts.size()); |
199 } | 225 } |
200 } | 226 } |
201 | 227 |
202 protected: | 228 protected: |
203 scoped_ptr<MultiLogCTVerifier> ct_verifier_; | 229 scoped_ptr<MultiLogCTVerifier> ct_verifier_; |
204 std::vector<scoped_refptr<const CTLogVerifier>> log_verifiers_; | 230 std::vector<scoped_refptr<const CTLogVerifier>> log_verifiers_; |
(...skipping 23 matching lines...) Expand all Loading... |
228 // Use different certificates for SCT tests. | 254 // Use different certificates for SCT tests. |
229 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); | 255 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); |
230 | 256 |
231 MockCertVerifier cert_verifier; | 257 MockCertVerifier cert_verifier; |
232 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 258 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
233 ct_verifier_.get()); | 259 ct_verifier_.get()); |
234 | 260 |
235 scoped_ptr<DummyProofVerifierCallback> callback( | 261 scoped_ptr<DummyProofVerifierCallback> callback( |
236 new DummyProofVerifierCallback); | 262 new DummyProofVerifierCallback); |
237 QuicAsyncStatus status = proof_verifier.VerifyProof( | 263 QuicAsyncStatus status = proof_verifier.VerifyProof( |
238 kTestHostname, kTestConfig, certs_, ct::GetSCTListForTesting(), "", | 264 kTestHostname, kTestConfig, certs_, GetSCTListForTesting(), "", |
239 verify_context_.get(), &error_details_, &details_, callback.get()); | 265 verify_context_.get(), &error_details_, &details_, callback.get()); |
240 ASSERT_EQ(QUIC_FAILURE, status); | 266 ASSERT_EQ(QUIC_FAILURE, status); |
241 CheckSCT(/*sct_expected_ok=*/true); | 267 CheckSCT(/*sct_expected_ok=*/true); |
242 } | 268 } |
243 | 269 |
244 // Invalid SCT and signature. | 270 // Invalid SCT and signature. |
245 TEST_F(ProofVerifierChromiumTest, InvalidSCTList) { | 271 TEST_F(ProofVerifierChromiumTest, InvalidSCTList) { |
246 // Use different certificates for SCT tests. | 272 // Use different certificates for SCT tests. |
247 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); | 273 ASSERT_NO_FATAL_FAILURE(GetSCTTestCertificates(&certs_)); |
248 | 274 |
249 MockCertVerifier cert_verifier; | 275 MockCertVerifier cert_verifier; |
250 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 276 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
251 ct_verifier_.get()); | 277 ct_verifier_.get()); |
252 | 278 |
253 scoped_ptr<DummyProofVerifierCallback> callback( | 279 scoped_ptr<DummyProofVerifierCallback> callback( |
254 new DummyProofVerifierCallback); | 280 new DummyProofVerifierCallback); |
255 QuicAsyncStatus status = proof_verifier.VerifyProof( | 281 QuicAsyncStatus status = proof_verifier.VerifyProof( |
256 kTestHostname, kTestConfig, certs_, ct::GetSCTListWithInvalidSCT(), "", | 282 kTestHostname, kTestConfig, certs_, GetCorruptSCTListForTesting(), "", |
257 verify_context_.get(), &error_details_, &details_, callback.get()); | 283 verify_context_.get(), &error_details_, &details_, callback.get()); |
258 ASSERT_EQ(QUIC_FAILURE, status); | 284 ASSERT_EQ(QUIC_FAILURE, status); |
259 CheckSCT(/*sct_expected_ok=*/false); | 285 CheckSCT(/*sct_expected_ok=*/false); |
260 } | 286 } |
261 | 287 |
262 // Tests that the ProofVerifier doesn't verify certificates if the config | 288 // Tests that the ProofVerifier doesn't verify certificates if the config |
263 // signature fails. | 289 // signature fails. |
264 TEST_F(ProofVerifierChromiumTest, FailsIfSignatureFails) { | 290 TEST_F(ProofVerifierChromiumTest, FailsIfSignatureFails) { |
265 FailsTestCertVerifier cert_verifier; | 291 FailsTestCertVerifier cert_verifier; |
266 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, | 292 ProofVerifierChromium proof_verifier(&cert_verifier, nullptr, nullptr, |
(...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
395 ASSERT_EQ(QUIC_SUCCESS, status); | 421 ASSERT_EQ(QUIC_SUCCESS, status); |
396 | 422 |
397 ASSERT_TRUE(details_.get()); | 423 ASSERT_TRUE(details_.get()); |
398 ProofVerifyDetailsChromium* verify_details = | 424 ProofVerifyDetailsChromium* verify_details = |
399 static_cast<ProofVerifyDetailsChromium*>(details_.get()); | 425 static_cast<ProofVerifyDetailsChromium*>(details_.get()); |
400 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); | 426 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); |
401 } | 427 } |
402 | 428 |
403 } // namespace test | 429 } // namespace test |
404 } // namespace net | 430 } // namespace net |
OLD | NEW |