OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/quic/crypto/proof_verifier_chromium.h" | 5 #include "net/quic/crypto/proof_verifier_chromium.h" |
6 | 6 |
7 #include "base/memory/ref_counted.h" | 7 #include "base/memory/ref_counted.h" |
8 #include "base/memory/scoped_ptr.h" | 8 #include "base/memory/scoped_ptr.h" |
9 #include "net/base/net_errors.h" | 9 #include "net/base/net_errors.h" |
10 #include "net/base/test_data_directory.h" | 10 #include "net/base/test_data_directory.h" |
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
43 CRLSet* crl_set, | 43 CRLSet* crl_set, |
44 CertVerifyResult* verify_result, | 44 CertVerifyResult* verify_result, |
45 const CompletionCallback& callback, | 45 const CompletionCallback& callback, |
46 scoped_ptr<CertVerifier::Request>* out_req, | 46 scoped_ptr<CertVerifier::Request>* out_req, |
47 const BoundNetLog& net_log) override { | 47 const BoundNetLog& net_log) override { |
48 ADD_FAILURE() << "CertVerifier::Verify() should not be called"; | 48 ADD_FAILURE() << "CertVerifier::Verify() should not be called"; |
49 return ERR_FAILED; | 49 return ERR_FAILED; |
50 } | 50 } |
51 }; | 51 }; |
52 | 52 |
53 // CTPolicyEnforcer that will fail the test if it is ever called. | |
54 class FailsTestCTPolicyEnforcer : public CTPolicyEnforcer { | |
55 public: | |
56 FailsTestCTPolicyEnforcer() {} | |
57 ~FailsTestCTPolicyEnforcer() override {} | |
58 | |
59 bool DoesConformToCTEVPolicy(X509Certificate* cert, | |
60 const ct::EVCertsWhitelist* ev_whitelist, | |
61 const ct::CTVerifyResult& ct_result, | |
62 const BoundNetLog& net_log) override { | |
63 ADD_FAILURE() << "CTPolicyEnforcer::DoesConformToCTEVPolicy() should " | |
64 << "not be called"; | |
65 return false; | |
66 } | |
67 }; | |
68 | |
69 // CTPolicyEnforcer that can simulate whether or not a given certificate | 53 // CTPolicyEnforcer that can simulate whether or not a given certificate |
70 // conforms to the CT/EV policy. | 54 // conforms to the CT/EV policy. |
71 class MockCTPolicyEnforcer : public CTPolicyEnforcer { | 55 class MockCTPolicyEnforcer : public CTPolicyEnforcer { |
72 public: | 56 public: |
73 MockCTPolicyEnforcer(bool is_ev) : is_ev_(is_ev) {} | 57 MockCTPolicyEnforcer(bool is_ev) : is_ev_(is_ev) {} |
74 ~MockCTPolicyEnforcer() override {} | 58 ~MockCTPolicyEnforcer() override {} |
75 | 59 |
76 bool DoesConformToCTEVPolicy(X509Certificate* cert, | 60 bool DoesConformToCTPolicy(X509Certificate* cert, |
77 const ct::EVCertsWhitelist* ev_whitelist, | 61 const ct::EVCertsWhitelist* ev_whitelist, |
78 const ct::CTVerifyResult& ct_result, | 62 const ct::CTVerifyResult& ct_result, |
79 const BoundNetLog& net_log) override { | 63 const BoundNetLog& net_log) override { |
80 return is_ev_; | 64 return is_ev_; |
81 } | 65 } |
82 | 66 |
83 private: | 67 private: |
84 bool is_ev_; | 68 bool is_ev_; |
85 }; | 69 }; |
86 | 70 |
87 class DummyProofVerifierCallback : public ProofVerifierCallback { | 71 class DummyProofVerifierCallback : public ProofVerifierCallback { |
88 public: | 72 public: |
89 DummyProofVerifierCallback() {} | 73 DummyProofVerifierCallback() {} |
(...skipping 298 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
388 ASSERT_EQ(QUIC_SUCCESS, status); | 372 ASSERT_EQ(QUIC_SUCCESS, status); |
389 | 373 |
390 ASSERT_TRUE(details_.get()); | 374 ASSERT_TRUE(details_.get()); |
391 ProofVerifyDetailsChromium* verify_details = | 375 ProofVerifyDetailsChromium* verify_details = |
392 static_cast<ProofVerifyDetailsChromium*>(details_.get()); | 376 static_cast<ProofVerifyDetailsChromium*>(details_.get()); |
393 EXPECT_EQ(CERT_STATUS_CT_COMPLIANCE_FAILED, | 377 EXPECT_EQ(CERT_STATUS_CT_COMPLIANCE_FAILED, |
394 verify_details->cert_verify_result.cert_status & | 378 verify_details->cert_verify_result.cert_status & |
395 (CERT_STATUS_CT_COMPLIANCE_FAILED | CERT_STATUS_IS_EV)); | 379 (CERT_STATUS_CT_COMPLIANCE_FAILED | CERT_STATUS_IS_EV)); |
396 } | 380 } |
397 | 381 |
398 // Tests that the certificate policy enforcer is not consulted if | 382 // Tests that the certificate policy enforcer is consulted even if |
399 // the certificate is not EV. | 383 // the certificate is not EV. |
400 TEST_F(ProofVerifierChromiumTest, IgnoresPolicyEnforcerIfNotEV) { | 384 TEST_F(ProofVerifierChromiumTest, PolicyEnforcerConsultedIfNotEV) { |
401 scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate(); | 385 scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate(); |
402 ASSERT_TRUE(test_cert); | 386 ASSERT_TRUE(test_cert); |
403 | 387 |
404 CertVerifyResult dummy_result; | 388 CertVerifyResult dummy_result; |
405 dummy_result.verified_cert = test_cert; | 389 dummy_result.verified_cert = test_cert; |
406 dummy_result.cert_status = 0; | 390 dummy_result.cert_status = 0; |
407 | 391 |
408 MockCertVerifier dummy_verifier; | 392 MockCertVerifier dummy_verifier; |
409 dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK); | 393 dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK); |
410 | 394 |
411 FailsTestCTPolicyEnforcer policy_enforcer; | 395 MockCTPolicyEnforcer policy_enforcer(false /*is_ev*/); |
412 | 396 |
413 ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer, | 397 ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer, |
414 nullptr, ct_verifier_.get()); | 398 nullptr, ct_verifier_.get()); |
415 | 399 |
416 scoped_ptr<DummyProofVerifierCallback> callback( | 400 scoped_ptr<DummyProofVerifierCallback> callback( |
417 new DummyProofVerifierCallback); | 401 new DummyProofVerifierCallback); |
418 QuicAsyncStatus status = proof_verifier.VerifyProof( | 402 QuicAsyncStatus status = proof_verifier.VerifyProof( |
419 kTestHostname, kTestConfig, certs_, "", GetTestSignature(), | 403 kTestHostname, kTestConfig, certs_, "", GetTestSignature(), |
420 verify_context_.get(), &error_details_, &details_, callback.get()); | 404 verify_context_.get(), &error_details_, &details_, callback.get()); |
421 ASSERT_EQ(QUIC_SUCCESS, status); | 405 ASSERT_EQ(QUIC_SUCCESS, status); |
422 | 406 |
423 ASSERT_TRUE(details_.get()); | 407 ASSERT_TRUE(details_.get()); |
424 ProofVerifyDetailsChromium* verify_details = | 408 ProofVerifyDetailsChromium* verify_details = |
425 static_cast<ProofVerifyDetailsChromium*>(details_.get()); | 409 static_cast<ProofVerifyDetailsChromium*>(details_.get()); |
426 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); | 410 EXPECT_EQ(CERT_STATUS_CT_COMPLIANCE_FAILED, |
| 411 verify_details->cert_verify_result.cert_status); |
427 } | 412 } |
428 | 413 |
429 } // namespace test | 414 } // namespace test |
430 } // namespace net | 415 } // namespace net |
OLD | NEW |