| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/quic/crypto/proof_verifier_chromium.h" | 5 #include "net/quic/crypto/proof_verifier_chromium.h" |
| 6 | 6 |
| 7 #include "base/memory/ref_counted.h" | 7 #include "base/memory/ref_counted.h" |
| 8 #include "base/memory/scoped_ptr.h" | 8 #include "base/memory/scoped_ptr.h" |
| 9 #include "net/base/net_errors.h" | 9 #include "net/base/net_errors.h" |
| 10 #include "net/base/test_data_directory.h" | 10 #include "net/base/test_data_directory.h" |
| 11 #include "net/cert/cert_policy_enforcer.h" | |
| 12 #include "net/cert/cert_status_flags.h" | 11 #include "net/cert/cert_status_flags.h" |
| 13 #include "net/cert/cert_verifier.h" | 12 #include "net/cert/cert_verifier.h" |
| 14 #include "net/cert/ct_log_verifier.h" | 13 #include "net/cert/ct_log_verifier.h" |
| 14 #include "net/cert/ct_policy_enforcer.h" |
| 15 #include "net/cert/ct_serialization.h" | 15 #include "net/cert/ct_serialization.h" |
| 16 #include "net/cert/ct_verify_result.h" | 16 #include "net/cert/ct_verify_result.h" |
| 17 #include "net/cert/mock_cert_verifier.h" | 17 #include "net/cert/mock_cert_verifier.h" |
| 18 #include "net/cert/multi_log_ct_verifier.h" | 18 #include "net/cert/multi_log_ct_verifier.h" |
| 19 #include "net/cert/x509_certificate.h" | 19 #include "net/cert/x509_certificate.h" |
| 20 #include "net/http/transport_security_state.h" | 20 #include "net/http/transport_security_state.h" |
| 21 #include "net/log/net_log.h" | 21 #include "net/log/net_log.h" |
| 22 #include "net/quic/crypto/proof_verifier.h" | 22 #include "net/quic/crypto/proof_verifier.h" |
| 23 #include "net/test/cert_test_util.h" | 23 #include "net/test/cert_test_util.h" |
| 24 #include "net/test/ct_test_util.h" | 24 #include "net/test/ct_test_util.h" |
| (...skipping 18 matching lines...) Expand all Loading... |
| 43 CRLSet* crl_set, | 43 CRLSet* crl_set, |
| 44 CertVerifyResult* verify_result, | 44 CertVerifyResult* verify_result, |
| 45 const CompletionCallback& callback, | 45 const CompletionCallback& callback, |
| 46 scoped_ptr<CertVerifier::Request>* out_req, | 46 scoped_ptr<CertVerifier::Request>* out_req, |
| 47 const BoundNetLog& net_log) override { | 47 const BoundNetLog& net_log) override { |
| 48 ADD_FAILURE() << "CertVerifier::Verify() should not be called"; | 48 ADD_FAILURE() << "CertVerifier::Verify() should not be called"; |
| 49 return ERR_FAILED; | 49 return ERR_FAILED; |
| 50 } | 50 } |
| 51 }; | 51 }; |
| 52 | 52 |
| 53 // CertPolicyEnforcer that will fail the test if it is ever called. | 53 // CTPolicyEnforcer that will fail the test if it is ever called. |
| 54 class FailsTestCertPolicyEnforcer : public CertPolicyEnforcer { | 54 class FailsTestCTPolicyEnforcer : public CTPolicyEnforcer { |
| 55 public: | 55 public: |
| 56 FailsTestCertPolicyEnforcer() {} | 56 FailsTestCTPolicyEnforcer() {} |
| 57 ~FailsTestCertPolicyEnforcer() override {} | 57 ~FailsTestCTPolicyEnforcer() override {} |
| 58 | 58 |
| 59 bool DoesConformToCTEVPolicy(X509Certificate* cert, | 59 bool DoesConformToCTEVPolicy(X509Certificate* cert, |
| 60 const ct::EVCertsWhitelist* ev_whitelist, | 60 const ct::EVCertsWhitelist* ev_whitelist, |
| 61 const ct::CTVerifyResult& ct_result, | 61 const ct::CTVerifyResult& ct_result, |
| 62 const BoundNetLog& net_log) override { | 62 const BoundNetLog& net_log) override { |
| 63 ADD_FAILURE() << "CertPolicyEnforcer::DoesConformToCTEVPolicy() should " | 63 ADD_FAILURE() << "CTPolicyEnforcer::DoesConformToCTEVPolicy() should " |
| 64 << "not be called"; | 64 << "not be called"; |
| 65 return false; | 65 return false; |
| 66 } | 66 } |
| 67 }; | 67 }; |
| 68 | 68 |
| 69 // CertPolicyEnforcer that can simulate whether or not a given certificate | 69 // CTPolicyEnforcer that can simulate whether or not a given certificate |
| 70 // conforms to the CT/EV policy. | 70 // conforms to the CT/EV policy. |
| 71 class MockCertPolicyEnforcer : public CertPolicyEnforcer { | 71 class MockCTPolicyEnforcer : public CTPolicyEnforcer { |
| 72 public: | 72 public: |
| 73 MockCertPolicyEnforcer(bool is_ev) : is_ev_(is_ev) {} | 73 MockCTPolicyEnforcer(bool is_ev) : is_ev_(is_ev) {} |
| 74 ~MockCertPolicyEnforcer() override {} | 74 ~MockCTPolicyEnforcer() override {} |
| 75 | 75 |
| 76 bool DoesConformToCTEVPolicy(X509Certificate* cert, | 76 bool DoesConformToCTEVPolicy(X509Certificate* cert, |
| 77 const ct::EVCertsWhitelist* ev_whitelist, | 77 const ct::EVCertsWhitelist* ev_whitelist, |
| 78 const ct::CTVerifyResult& ct_result, | 78 const ct::CTVerifyResult& ct_result, |
| 79 const BoundNetLog& net_log) override { | 79 const BoundNetLog& net_log) override { |
| 80 return is_ev_; | 80 return is_ev_; |
| 81 } | 81 } |
| 82 | 82 |
| 83 private: | 83 private: |
| 84 bool is_ev_; | 84 bool is_ev_; |
| (...skipping 251 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 336 scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate(); | 336 scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate(); |
| 337 ASSERT_TRUE(test_cert); | 337 ASSERT_TRUE(test_cert); |
| 338 | 338 |
| 339 CertVerifyResult dummy_result; | 339 CertVerifyResult dummy_result; |
| 340 dummy_result.verified_cert = test_cert; | 340 dummy_result.verified_cert = test_cert; |
| 341 dummy_result.cert_status = CERT_STATUS_IS_EV; | 341 dummy_result.cert_status = CERT_STATUS_IS_EV; |
| 342 | 342 |
| 343 MockCertVerifier dummy_verifier; | 343 MockCertVerifier dummy_verifier; |
| 344 dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK); | 344 dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK); |
| 345 | 345 |
| 346 MockCertPolicyEnforcer policy_enforcer(true /*is_ev*/); | 346 MockCTPolicyEnforcer policy_enforcer(true /*is_ev*/); |
| 347 | 347 |
| 348 ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer, | 348 ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer, |
| 349 nullptr, ct_verifier_.get()); | 349 nullptr, ct_verifier_.get()); |
| 350 | 350 |
| 351 scoped_ptr<DummyProofVerifierCallback> callback( | 351 scoped_ptr<DummyProofVerifierCallback> callback( |
| 352 new DummyProofVerifierCallback); | 352 new DummyProofVerifierCallback); |
| 353 QuicAsyncStatus status = proof_verifier.VerifyProof( | 353 QuicAsyncStatus status = proof_verifier.VerifyProof( |
| 354 kTestHostname, kTestConfig, certs_, "", GetTestSignature(), | 354 kTestHostname, kTestConfig, certs_, "", GetTestSignature(), |
| 355 verify_context_.get(), &error_details_, &details_, callback.get()); | 355 verify_context_.get(), &error_details_, &details_, callback.get()); |
| 356 ASSERT_EQ(QUIC_SUCCESS, status); | 356 ASSERT_EQ(QUIC_SUCCESS, status); |
| (...skipping 11 matching lines...) Expand all Loading... |
| 368 scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate(); | 368 scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate(); |
| 369 ASSERT_TRUE(test_cert); | 369 ASSERT_TRUE(test_cert); |
| 370 | 370 |
| 371 CertVerifyResult dummy_result; | 371 CertVerifyResult dummy_result; |
| 372 dummy_result.verified_cert = test_cert; | 372 dummy_result.verified_cert = test_cert; |
| 373 dummy_result.cert_status = CERT_STATUS_IS_EV; | 373 dummy_result.cert_status = CERT_STATUS_IS_EV; |
| 374 | 374 |
| 375 MockCertVerifier dummy_verifier; | 375 MockCertVerifier dummy_verifier; |
| 376 dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK); | 376 dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK); |
| 377 | 377 |
| 378 MockCertPolicyEnforcer policy_enforcer(false /*is_ev*/); | 378 MockCTPolicyEnforcer policy_enforcer(false /*is_ev*/); |
| 379 | 379 |
| 380 ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer, | 380 ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer, |
| 381 nullptr, ct_verifier_.get()); | 381 nullptr, ct_verifier_.get()); |
| 382 | 382 |
| 383 scoped_ptr<DummyProofVerifierCallback> callback( | 383 scoped_ptr<DummyProofVerifierCallback> callback( |
| 384 new DummyProofVerifierCallback); | 384 new DummyProofVerifierCallback); |
| 385 QuicAsyncStatus status = proof_verifier.VerifyProof( | 385 QuicAsyncStatus status = proof_verifier.VerifyProof( |
| 386 kTestHostname, kTestConfig, certs_, "", GetTestSignature(), | 386 kTestHostname, kTestConfig, certs_, "", GetTestSignature(), |
| 387 verify_context_.get(), &error_details_, &details_, callback.get()); | 387 verify_context_.get(), &error_details_, &details_, callback.get()); |
| 388 ASSERT_EQ(QUIC_SUCCESS, status); | 388 ASSERT_EQ(QUIC_SUCCESS, status); |
| (...skipping 12 matching lines...) Expand all Loading... |
| 401 scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate(); | 401 scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate(); |
| 402 ASSERT_TRUE(test_cert); | 402 ASSERT_TRUE(test_cert); |
| 403 | 403 |
| 404 CertVerifyResult dummy_result; | 404 CertVerifyResult dummy_result; |
| 405 dummy_result.verified_cert = test_cert; | 405 dummy_result.verified_cert = test_cert; |
| 406 dummy_result.cert_status = 0; | 406 dummy_result.cert_status = 0; |
| 407 | 407 |
| 408 MockCertVerifier dummy_verifier; | 408 MockCertVerifier dummy_verifier; |
| 409 dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK); | 409 dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK); |
| 410 | 410 |
| 411 FailsTestCertPolicyEnforcer policy_enforcer; | 411 FailsTestCTPolicyEnforcer policy_enforcer; |
| 412 | 412 |
| 413 ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer, | 413 ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer, |
| 414 nullptr, ct_verifier_.get()); | 414 nullptr, ct_verifier_.get()); |
| 415 | 415 |
| 416 scoped_ptr<DummyProofVerifierCallback> callback( | 416 scoped_ptr<DummyProofVerifierCallback> callback( |
| 417 new DummyProofVerifierCallback); | 417 new DummyProofVerifierCallback); |
| 418 QuicAsyncStatus status = proof_verifier.VerifyProof( | 418 QuicAsyncStatus status = proof_verifier.VerifyProof( |
| 419 kTestHostname, kTestConfig, certs_, "", GetTestSignature(), | 419 kTestHostname, kTestConfig, certs_, "", GetTestSignature(), |
| 420 verify_context_.get(), &error_details_, &details_, callback.get()); | 420 verify_context_.get(), &error_details_, &details_, callback.get()); |
| 421 ASSERT_EQ(QUIC_SUCCESS, status); | 421 ASSERT_EQ(QUIC_SUCCESS, status); |
| 422 | 422 |
| 423 ASSERT_TRUE(details_.get()); | 423 ASSERT_TRUE(details_.get()); |
| 424 ProofVerifyDetailsChromium* verify_details = | 424 ProofVerifyDetailsChromium* verify_details = |
| 425 static_cast<ProofVerifyDetailsChromium*>(details_.get()); | 425 static_cast<ProofVerifyDetailsChromium*>(details_.get()); |
| 426 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); | 426 EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status); |
| 427 } | 427 } |
| 428 | 428 |
| 429 } // namespace test | 429 } // namespace test |
| 430 } // namespace net | 430 } // namespace net |
| OLD | NEW |