OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/socket/ssl_client_socket.h" | 5 #include "net/socket/ssl_client_socket.h" |
6 | 6 |
7 #include <utility> | 7 #include <utility> |
8 | 8 |
9 #include "base/callback_helpers.h" | 9 #include "base/callback_helpers.h" |
10 #include "base/location.h" | 10 #include "base/location.h" |
(...skipping 666 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
677 const std::string&, | 677 const std::string&, |
678 const std::string&, | 678 const std::string&, |
679 ct::CTVerifyResult*, | 679 ct::CTVerifyResult*, |
680 const BoundNetLog&)); | 680 const BoundNetLog&)); |
681 MOCK_METHOD1(SetObserver, void(CTVerifier::Observer*)); | 681 MOCK_METHOD1(SetObserver, void(CTVerifier::Observer*)); |
682 }; | 682 }; |
683 | 683 |
684 // A mock CTPolicyEnforcer that returns a custom verification result. | 684 // A mock CTPolicyEnforcer that returns a custom verification result. |
685 class MockCTPolicyEnforcer : public CTPolicyEnforcer { | 685 class MockCTPolicyEnforcer : public CTPolicyEnforcer { |
686 public: | 686 public: |
687 MOCK_METHOD4(DoesConformToCTEVPolicy, | 687 MOCK_METHOD2(DoesConformToCertPolicy, |
| 688 bool(X509Certificate* cert, const ct::CTVerifyResult&)); |
| 689 MOCK_METHOD4(DoesConformToEVPolicy, |
688 bool(X509Certificate* cert, | 690 bool(X509Certificate* cert, |
| 691 const ct::CTVerifyResult&, |
689 const ct::EVCertsWhitelist*, | 692 const ct::EVCertsWhitelist*, |
690 const ct::CTVerifyResult&, | |
691 const BoundNetLog&)); | 693 const BoundNetLog&)); |
692 }; | 694 }; |
693 | 695 |
694 class SSLClientSocketTest : public PlatformTest { | 696 class SSLClientSocketTest : public PlatformTest { |
695 public: | 697 public: |
696 SSLClientSocketTest() | 698 SSLClientSocketTest() |
697 : socket_factory_(ClientSocketFactory::GetDefaultFactory()), | 699 : socket_factory_(ClientSocketFactory::GetDefaultFactory()), |
698 cert_verifier_(new MockCertVerifier), | 700 cert_verifier_(new MockCertVerifier), |
699 transport_security_state_(new TransportSecurityState) { | 701 transport_security_state_(new TransportSecurityState) { |
700 cert_verifier_->set_default_result(OK); | 702 cert_verifier_->set_default_result(OK); |
(...skipping 1626 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2327 | 2329 |
2328 // To activate the CT/EV policy enforcement non-null CTVerifier and | 2330 // To activate the CT/EV policy enforcement non-null CTVerifier and |
2329 // CTPolicyEnforcer are needed. | 2331 // CTPolicyEnforcer are needed. |
2330 MockCTVerifier ct_verifier; | 2332 MockCTVerifier ct_verifier; |
2331 SetCTVerifier(&ct_verifier); | 2333 SetCTVerifier(&ct_verifier); |
2332 EXPECT_CALL(ct_verifier, Verify(_, "", "", _, _)).WillRepeatedly(Return(OK)); | 2334 EXPECT_CALL(ct_verifier, Verify(_, "", "", _, _)).WillRepeatedly(Return(OK)); |
2333 | 2335 |
2334 // Emulate compliance of the certificate to the policy. | 2336 // Emulate compliance of the certificate to the policy. |
2335 MockCTPolicyEnforcer policy_enforcer; | 2337 MockCTPolicyEnforcer policy_enforcer; |
2336 SetCTPolicyEnforcer(&policy_enforcer); | 2338 SetCTPolicyEnforcer(&policy_enforcer); |
2337 EXPECT_CALL(policy_enforcer, DoesConformToCTEVPolicy(_, _, _, _)) | 2339 EXPECT_CALL(policy_enforcer, DoesConformToCertPolicy(_, _)) |
| 2340 .WillRepeatedly(Return(true)); |
| 2341 EXPECT_CALL(policy_enforcer, DoesConformToEVPolicy(_, _, _, _)) |
2338 .WillRepeatedly(Return(true)); | 2342 .WillRepeatedly(Return(true)); |
2339 | 2343 |
2340 int rv; | 2344 int rv; |
2341 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); | 2345 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); |
2342 EXPECT_EQ(OK, rv); | 2346 EXPECT_EQ(OK, rv); |
2343 | 2347 |
2344 SSLInfo result; | 2348 SSLInfo result; |
2345 ASSERT_TRUE(sock_->GetSSLInfo(&result)); | 2349 ASSERT_TRUE(sock_->GetSSLInfo(&result)); |
2346 | 2350 |
2347 EXPECT_TRUE(result.cert_status & CERT_STATUS_IS_EV); | 2351 EXPECT_TRUE(result.cert_status & CERT_STATUS_IS_EV); |
(...skipping 11 matching lines...) Expand all Loading... |
2359 | 2363 |
2360 // To activate the CT/EV policy enforcement non-null CTVerifier and | 2364 // To activate the CT/EV policy enforcement non-null CTVerifier and |
2361 // CTPolicyEnforcer are needed. | 2365 // CTPolicyEnforcer are needed. |
2362 MockCTVerifier ct_verifier; | 2366 MockCTVerifier ct_verifier; |
2363 SetCTVerifier(&ct_verifier); | 2367 SetCTVerifier(&ct_verifier); |
2364 EXPECT_CALL(ct_verifier, Verify(_, "", "", _, _)).WillRepeatedly(Return(OK)); | 2368 EXPECT_CALL(ct_verifier, Verify(_, "", "", _, _)).WillRepeatedly(Return(OK)); |
2365 | 2369 |
2366 // Emulate non-compliance of the certificate to the policy. | 2370 // Emulate non-compliance of the certificate to the policy. |
2367 MockCTPolicyEnforcer policy_enforcer; | 2371 MockCTPolicyEnforcer policy_enforcer; |
2368 SetCTPolicyEnforcer(&policy_enforcer); | 2372 SetCTPolicyEnforcer(&policy_enforcer); |
2369 EXPECT_CALL(policy_enforcer, DoesConformToCTEVPolicy(_, _, _, _)) | 2373 EXPECT_CALL(policy_enforcer, DoesConformToCertPolicy(_, _)) |
| 2374 .WillRepeatedly(Return(false)); |
| 2375 EXPECT_CALL(policy_enforcer, DoesConformToEVPolicy(_, _, _, _)) |
2370 .WillRepeatedly(Return(false)); | 2376 .WillRepeatedly(Return(false)); |
2371 | 2377 |
2372 int rv; | 2378 int rv; |
2373 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); | 2379 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); |
2374 EXPECT_EQ(OK, rv); | 2380 EXPECT_EQ(OK, rv); |
2375 | 2381 |
2376 SSLInfo result; | 2382 SSLInfo result; |
2377 ASSERT_TRUE(sock_->GetSSLInfo(&result)); | 2383 ASSERT_TRUE(sock_->GetSSLInfo(&result)); |
2378 | 2384 |
2379 EXPECT_FALSE(result.cert_status & CERT_STATUS_IS_EV); | 2385 EXPECT_FALSE(result.cert_status & CERT_STATUS_IS_EV); |
2380 EXPECT_TRUE(result.cert_status & CERT_STATUS_CT_COMPLIANCE_FAILED); | 2386 EXPECT_TRUE(result.cert_status & CERT_STATUS_CT_COMPLIANCE_FAILED); |
2381 } | 2387 } |
2382 | 2388 |
| 2389 // Test that when a CT verifier and a CTPolicyEnforcer are defined, but |
| 2390 // the non-EV certificate used does not conform to the CT/EV policy, the |
| 2391 // correct cert status flag is set. |
| 2392 TEST_F(SSLClientSocketTest, CertStatusSetForNonCompliantNonEVCert) { |
| 2393 SpawnedTestServer::SSLOptions ssl_options; |
| 2394 ASSERT_TRUE(StartTestServer(ssl_options)); |
| 2395 |
| 2396 SSLConfig ssl_config; |
| 2397 |
| 2398 // To activate the CT/EV policy enforcement non-null CTVerifier and |
| 2399 // CTPolicyEnforcer are needed. |
| 2400 MockCTVerifier ct_verifier; |
| 2401 SetCTVerifier(&ct_verifier); |
| 2402 EXPECT_CALL(ct_verifier, Verify(_, "", "", _, _)).WillRepeatedly(Return(OK)); |
| 2403 |
| 2404 // Emulate non-compliance of the certificate to the policy. |
| 2405 MockCTPolicyEnforcer policy_enforcer; |
| 2406 SetCTPolicyEnforcer(&policy_enforcer); |
| 2407 EXPECT_CALL(policy_enforcer, DoesConformToCertPolicy(_, _)) |
| 2408 .WillRepeatedly(Return(false)); |
| 2409 |
| 2410 int rv; |
| 2411 ASSERT_TRUE(CreateAndConnectSSLClientSocket(ssl_config, &rv)); |
| 2412 EXPECT_EQ(OK, rv); |
| 2413 |
| 2414 SSLInfo result; |
| 2415 ASSERT_TRUE(sock_->GetSSLInfo(&result)); |
| 2416 |
| 2417 EXPECT_TRUE(result.cert_status & CERT_STATUS_CT_COMPLIANCE_FAILED); |
| 2418 } |
| 2419 |
2383 namespace { | 2420 namespace { |
2384 | 2421 |
2385 bool IsValidOCSPResponse(const base::StringPiece& input) { | 2422 bool IsValidOCSPResponse(const base::StringPiece& input) { |
2386 der::Parser parser(der::Input(reinterpret_cast<const uint8_t*>(input.data()), | 2423 der::Parser parser(der::Input(reinterpret_cast<const uint8_t*>(input.data()), |
2387 input.length())); | 2424 input.length())); |
2388 der::Parser sequence; | 2425 der::Parser sequence; |
2389 return parser.ReadSequence(&sequence) && !parser.HasMore() && | 2426 return parser.ReadSequence(&sequence) && !parser.HasMore() && |
2390 sequence.SkipTag(der::kEnumerated) && | 2427 sequence.SkipTag(der::kEnumerated) && |
2391 sequence.SkipTag(der::kTagContextSpecific | der::kTagConstructed | | 2428 sequence.SkipTag(der::kTagContextSpecific | der::kTagConstructed | |
2392 0) && | 2429 0) && |
(...skipping 842 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3235 int rv; | 3272 int rv; |
3236 ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv)); | 3273 ASSERT_TRUE(CreateAndConnectSSLClientSocket(client_config, &rv)); |
3237 EXPECT_EQ(OK, rv); | 3274 EXPECT_EQ(OK, rv); |
3238 | 3275 |
3239 std::string proto; | 3276 std::string proto; |
3240 EXPECT_EQ(SSLClientSocket::kNextProtoUnsupported, | 3277 EXPECT_EQ(SSLClientSocket::kNextProtoUnsupported, |
3241 sock_->GetNextProto(&proto)); | 3278 sock_->GetNextProto(&proto)); |
3242 } | 3279 } |
3243 | 3280 |
3244 } // namespace net | 3281 } // namespace net |
OLD | NEW |