| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/quic/test_tools/crypto_test_utils.h" | 5 #include "net/quic/test_tools/crypto_test_utils.h" |
| 6 | 6 |
| 7 #include <utility> | 7 #include <utility> |
| 8 | 8 |
| 9 #include "base/callback_helpers.h" | 9 #include "base/callback_helpers.h" |
| 10 #include "base/logging.h" | 10 #include "base/logging.h" |
| (...skipping 60 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 71 private: | 71 private: |
| 72 ScopedTestRoot scoped_root_; | 72 ScopedTestRoot scoped_root_; |
| 73 scoped_ptr<CertVerifier> cert_verifier_; | 73 scoped_ptr<CertVerifier> cert_verifier_; |
| 74 scoped_ptr<TransportSecurityState> transport_security_state_; | 74 scoped_ptr<TransportSecurityState> transport_security_state_; |
| 75 scoped_ptr<CTVerifier> cert_transparency_verifier_; | 75 scoped_ptr<CTVerifier> cert_transparency_verifier_; |
| 76 }; | 76 }; |
| 77 | 77 |
| 78 const char kSignature[] = "signature"; | 78 const char kSignature[] = "signature"; |
| 79 const char kSCT[] = "CryptoServerTests"; | 79 const char kSCT[] = "CryptoServerTests"; |
| 80 | 80 |
| 81 class FakeProofSource : public ProofSource { | |
| 82 public: | |
| 83 FakeProofSource() {} | |
| 84 ~FakeProofSource() override {} | |
| 85 | |
| 86 // ProofSource interface | |
| 87 bool Initialize(const base::FilePath& cert_path, | |
| 88 const base::FilePath& key_path, | |
| 89 const base::FilePath& sct_path) { | |
| 90 std::string cert_data; | |
| 91 if (!base::ReadFileToString(cert_path, &cert_data)) { | |
| 92 DLOG(FATAL) << "Unable to read certificates."; | |
| 93 return false; | |
| 94 } | |
| 95 | |
| 96 CertificateList certs_in_file = | |
| 97 X509Certificate::CreateCertificateListFromBytes( | |
| 98 cert_data.data(), cert_data.size(), X509Certificate::FORMAT_AUTO); | |
| 99 | |
| 100 if (certs_in_file.empty()) { | |
| 101 DLOG(FATAL) << "No certificates."; | |
| 102 return false; | |
| 103 } | |
| 104 | |
| 105 vector<string> certs; | |
| 106 for (const scoped_refptr<X509Certificate>& cert : certs_in_file) { | |
| 107 std::string der_encoded_cert; | |
| 108 if (!X509Certificate::GetDEREncoded(cert->os_cert_handle(), | |
| 109 &der_encoded_cert)) { | |
| 110 return false; | |
| 111 } | |
| 112 certs.push_back(der_encoded_cert); | |
| 113 } | |
| 114 chain_ = new ProofSource::Chain(certs); | |
| 115 return true; | |
| 116 } | |
| 117 | |
| 118 bool GetProof(const IPAddress& server_ip, | |
| 119 const std::string& hostname, | |
| 120 const std::string& server_config, | |
| 121 QuicVersion quic_version, | |
| 122 StringPiece chlo_hash, | |
| 123 bool ecdsa_ok, | |
| 124 scoped_refptr<ProofSource::Chain>* out_chain, | |
| 125 std::string* out_signature, | |
| 126 std::string* out_leaf_cert_sct) override { | |
| 127 out_signature->assign(kSignature); | |
| 128 *out_chain = chain_; | |
| 129 *out_leaf_cert_sct = kSCT; | |
| 130 return true; | |
| 131 } | |
| 132 | |
| 133 private: | |
| 134 scoped_refptr<ProofSource::Chain> chain_; | |
| 135 | |
| 136 DISALLOW_COPY_AND_ASSIGN(FakeProofSource); | |
| 137 }; | |
| 138 | |
| 139 class FakeProofVerifier : public TestProofVerifierChromium { | |
| 140 public: | |
| 141 FakeProofVerifier(scoped_ptr<CertVerifier> cert_verifier, | |
| 142 scoped_ptr<TransportSecurityState> transport_security_state, | |
| 143 scoped_ptr<CTVerifier> cert_transparency_verifier, | |
| 144 const std::string& cert_file) | |
| 145 : TestProofVerifierChromium(std::move(cert_verifier), | |
| 146 std::move(transport_security_state), | |
| 147 std::move(cert_transparency_verifier), | |
| 148 cert_file) {} | |
| 149 ~FakeProofVerifier() override {} | |
| 150 | |
| 151 // ProofVerifier interface | |
| 152 QuicAsyncStatus VerifyProof(const std::string& hostname, | |
| 153 const uint16_t port, | |
| 154 const std::string& server_config, | |
| 155 QuicVersion quic_version, | |
| 156 StringPiece chlo_hash, | |
| 157 const std::vector<std::string>& certs, | |
| 158 const std::string& cert_sct, | |
| 159 const std::string& signature, | |
| 160 const ProofVerifyContext* verify_context, | |
| 161 std::string* error_details, | |
| 162 scoped_ptr<ProofVerifyDetails>* verify_details, | |
| 163 ProofVerifierCallback* callback) override { | |
| 164 error_details->clear(); | |
| 165 scoped_ptr<ProofVerifyDetailsChromium> verify_details_chromium( | |
| 166 new ProofVerifyDetailsChromium); | |
| 167 DCHECK(!certs.empty()); | |
| 168 // Convert certs to X509Certificate. | |
| 169 vector<StringPiece> cert_pieces(certs.size()); | |
| 170 for (unsigned i = 0; i < certs.size(); i++) { | |
| 171 cert_pieces[i] = base::StringPiece(certs[i]); | |
| 172 } | |
| 173 scoped_refptr<X509Certificate> x509_cert = | |
| 174 X509Certificate::CreateFromDERCertChain(cert_pieces); | |
| 175 | |
| 176 if (!x509_cert.get()) { | |
| 177 *error_details = "Failed to create certificate chain"; | |
| 178 verify_details_chromium->cert_verify_result.cert_status = | |
| 179 CERT_STATUS_INVALID; | |
| 180 *verify_details = std::move(verify_details_chromium); | |
| 181 return QUIC_FAILURE; | |
| 182 } | |
| 183 | |
| 184 const ProofVerifyContextChromium* chromium_context = | |
| 185 reinterpret_cast<const ProofVerifyContextChromium*>(verify_context); | |
| 186 scoped_ptr<CertVerifier::Request> cert_verifier_request_; | |
| 187 TestCompletionCallback test_callback; | |
| 188 int result = cert_verifier()->Verify( | |
| 189 x509_cert.get(), hostname, std::string(), | |
| 190 chromium_context->cert_verify_flags, | |
| 191 SSLConfigService::GetCRLSet().get(), | |
| 192 &verify_details_chromium->cert_verify_result, test_callback.callback(), | |
| 193 &cert_verifier_request_, chromium_context->net_log); | |
| 194 if (result != OK) { | |
| 195 std::string error_string = ErrorToString(result); | |
| 196 *error_details = StringPrintf("Failed to verify certificate chain: %s", | |
| 197 error_string.c_str()); | |
| 198 verify_details_chromium->cert_verify_result.cert_status = | |
| 199 CERT_STATUS_INVALID; | |
| 200 *verify_details = std::move(verify_details_chromium); | |
| 201 return QUIC_FAILURE; | |
| 202 } | |
| 203 if (signature != kSignature) { | |
| 204 *error_details = "Invalid proof"; | |
| 205 verify_details_chromium->cert_verify_result.cert_status = | |
| 206 CERT_STATUS_INVALID; | |
| 207 *verify_details = std::move(verify_details_chromium); | |
| 208 return QUIC_FAILURE; | |
| 209 } | |
| 210 *verify_details = std::move(verify_details_chromium); | |
| 211 return QUIC_SUCCESS; | |
| 212 } | |
| 213 | |
| 214 private: | |
| 215 DISALLOW_COPY_AND_ASSIGN(FakeProofVerifier); | |
| 216 }; | |
| 217 | |
| 218 } // namespace | 81 } // namespace |
| 219 | 82 |
| 220 // static | 83 // static |
| 221 ProofSource* CryptoTestUtils::ProofSourceForTesting() { | 84 ProofSource* CryptoTestUtils::ProofSourceForTesting() { |
| 222 #if defined(USE_OPENSSL) | |
| 223 ProofSourceChromium* source = new ProofSourceChromium(); | 85 ProofSourceChromium* source = new ProofSourceChromium(); |
| 224 #else | |
| 225 FakeProofSource* source = new FakeProofSource(); | |
| 226 #endif | |
| 227 base::FilePath certs_dir = GetTestCertsDirectory(); | 86 base::FilePath certs_dir = GetTestCertsDirectory(); |
| 228 CHECK(source->Initialize( | 87 CHECK(source->Initialize( |
| 229 certs_dir.AppendASCII("quic_chain.crt"), | 88 certs_dir.AppendASCII("quic_chain.crt"), |
| 230 certs_dir.AppendASCII("quic_test.example.com.key.pkcs8"), | 89 certs_dir.AppendASCII("quic_test.example.com.key.pkcs8"), |
| 231 certs_dir.AppendASCII("quic_test.example.com.key.sct"))); | 90 certs_dir.AppendASCII("quic_test.example.com.key.sct"))); |
| 232 return source; | 91 return source; |
| 233 } | 92 } |
| 234 | 93 |
| 235 // static | 94 // static |
| 236 ProofVerifier* ProofVerifierForTestingInternal(bool use_real_proof_verifier) { | 95 ProofVerifier* ProofVerifierForTestingInternal(bool use_real_proof_verifier) { |
| 237 // TODO(rch): use a real cert verifier? | 96 // TODO(rch): use a real cert verifier? |
| 238 scoped_ptr<MockCertVerifier> cert_verifier(new MockCertVerifier()); | 97 scoped_ptr<MockCertVerifier> cert_verifier(new MockCertVerifier()); |
| 239 net::CertVerifyResult verify_result; | 98 net::CertVerifyResult verify_result; |
| 240 verify_result.verified_cert = | 99 verify_result.verified_cert = |
| 241 ImportCertFromFile(GetTestCertsDirectory(), "quic_test.example.com.crt"); | 100 ImportCertFromFile(GetTestCertsDirectory(), "quic_test.example.com.crt"); |
| 242 cert_verifier->AddResultForCertAndHost(verify_result.verified_cert.get(), | 101 cert_verifier->AddResultForCertAndHost(verify_result.verified_cert.get(), |
| 243 "test.example.com", verify_result, OK); | 102 "test.example.com", verify_result, OK); |
| 244 verify_result.verified_cert = ImportCertFromFile( | 103 verify_result.verified_cert = ImportCertFromFile( |
| 245 GetTestCertsDirectory(), "quic_test_ecc.example.com.crt"); | 104 GetTestCertsDirectory(), "quic_test_ecc.example.com.crt"); |
| 246 cert_verifier->AddResultForCertAndHost(verify_result.verified_cert.get(), | 105 cert_verifier->AddResultForCertAndHost(verify_result.verified_cert.get(), |
| 247 "test.example.com", verify_result, OK); | 106 "test.example.com", verify_result, OK); |
| 248 if (use_real_proof_verifier) { | 107 if (use_real_proof_verifier) { |
| 249 return new TestProofVerifierChromium( | 108 return new TestProofVerifierChromium( |
| 250 std::move(cert_verifier), make_scoped_ptr(new TransportSecurityState), | 109 std::move(cert_verifier), make_scoped_ptr(new TransportSecurityState), |
| 251 make_scoped_ptr(new MultiLogCTVerifier), "quic_root.crt"); | 110 make_scoped_ptr(new MultiLogCTVerifier), "quic_root.crt"); |
| 252 } | 111 } |
| 253 #if defined(USE_OPENSSL) | |
| 254 return new TestProofVerifierChromium( | 112 return new TestProofVerifierChromium( |
| 255 std::move(cert_verifier), make_scoped_ptr(new TransportSecurityState), | 113 std::move(cert_verifier), make_scoped_ptr(new TransportSecurityState), |
| 256 make_scoped_ptr(new MultiLogCTVerifier), "quic_root.crt"); | 114 make_scoped_ptr(new MultiLogCTVerifier), "quic_root.crt"); |
| 257 #else | |
| 258 return new FakeProofVerifier( | |
| 259 std::move(cert_verifier), make_scoped_ptr(new TransportSecurityState), | |
| 260 make_scoped_ptr(new MultiLogCTVerifier), "quic_root.crt"); | |
| 261 #endif | |
| 262 } | 115 } |
| 263 | 116 |
| 264 // static | 117 // static |
| 265 ProofVerifier* CryptoTestUtils::ProofVerifierForTesting() { | 118 ProofVerifier* CryptoTestUtils::ProofVerifierForTesting() { |
| 266 return ProofVerifierForTestingInternal(/*use_real_proof_verifier=*/false); | 119 return ProofVerifierForTestingInternal(/*use_real_proof_verifier=*/false); |
| 267 } | 120 } |
| 268 | 121 |
| 269 // static | 122 // static |
| 270 ProofVerifier* CryptoTestUtils::RealProofVerifierForTesting() { | 123 ProofVerifier* CryptoTestUtils::RealProofVerifierForTesting() { |
| 271 return ProofVerifierForTestingInternal(/*use_real_proof_verifier=*/true); | 124 return ProofVerifierForTestingInternal(/*use_real_proof_verifier=*/true); |
| 272 } | 125 } |
| 273 | 126 |
| 274 // static | 127 // static |
| 275 ProofVerifyContext* CryptoTestUtils::ProofVerifyContextForTesting() { | 128 ProofVerifyContext* CryptoTestUtils::ProofVerifyContextForTesting() { |
| 276 return new ProofVerifyContextChromium(/*cert_verify_flags=*/0, BoundNetLog()); | 129 return new ProofVerifyContextChromium(/*cert_verify_flags=*/0, BoundNetLog()); |
| 277 } | 130 } |
| 278 | 131 |
| 279 } // namespace test | 132 } // namespace test |
| 280 | 133 |
| 281 } // namespace net | 134 } // namespace net |
| OLD | NEW |