DO NOT REVIEW: CT policy enforcement WIP

net/cert/ct_policy_enforcer.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/ct_policy_enforcer.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 12 matching lines @@
 #include "net/cert/ct_verify_result.h"
 #include "net/cert/signed_certificate_timestamp.h"
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_certificate_net_log_param.h"
 #include "net/log/net_log.h"
 
 namespace net {
 
 namespace {
 
-bool IsEmbeddedSCT(const scoped_refptr<ct::SignedCertificateTimestamp>& sct) {
-  return sct->origin == ct::SignedCertificateTimestamp::SCT_EMBEDDED;
-}
-
 // Returns true if the current build is recent enough to ensure that
 // built-in security information (e.g. CT Logs) is fresh enough.
 // TODO(eranm): Move to base or net/base
 bool IsBuildTimely() {
   const base::Time build_time = base::GetBuildTime();
   // We consider built-in information to be timely for 10 weeks.
   return (base::Time::Now() - build_time).InDays() < 70 /* 10 weeks */;
 }
 
 bool IsGoogleIssuedSCT(
@@ skipping 24 matching lines @@
   uint32_t month_diff = (exploded_expiry.year - exploded_start.year) * 12 +
                         (exploded_expiry.month - exploded_start.month);
   if (exploded_expiry.day_of_month < exploded_start.day_of_month)
     --month_diff;
   else if (exploded_expiry.day_of_month == exploded_start.day_of_month)
     *has_partial_month = false;
 
   *rounded_months_difference = month_diff;
 }
 
+bool CheckSCTPolicy(const X509Certificate& cert,
+                    const ct::SCTList& verified_scts) {
+  const base::Time now = base::Time::Now();
+  const base::Time earliest_sct = base::Time::Max();
+
+  // Scan for the earliest SCT; this is used to determine whether or not to
+  // enforce log diversity requirements, as well as to determine when to
+  // compare log disqualification. It is OK to ignore the source of the SCT
+  // here, because it is presumed that an OCSP/TLS-delivered SCT cannot
+  // predate those delivered in the certificate, unless the CA submitted the
+  // precert to additional logs that didn't appear in the certificate. If
+  // the CA did, that is acceptable proof that the certificate was issued
+  // at that time.
+  for (const auto& sct : verified_scts) {
+    base::Time unused;
+    // Only allow still-valid logs to contribute to determining the issuance
+    // date.
+    if (IsLogDisqualified(sct->log_id, &unused))
+      continue;
+    if (it->timestamp < earliest_sct)
+      earliest_timestamp = it->timestamp;
+  }
+
+  enum {
+    HAS_GOOGLE_SCT = (1 << 0),
+    HAS_NON_GOOGLE_SCT = (1 << 1),
+    HAS_DIVERSE_SCTS = (HAS_GOOGLE_SCT & HAS_NON_GOOGLE_SCT),
+  };
+
+  struct SCTPolicyStatus {
+    int diversity = 0;
+    size_t qualifying_scts = 0;
+  };
+
+  SCTPolicyStatus ocsp_status;
+  SCTPolicyStatus tls_status;
+  SCTPolicyStatus embedded_status;
+  bool has_one_valid_embedded = false;
+
+  for (const auto& sct : verified_scts) {
+    base::Time disqualification_date;
+    bool is_disqualified =
+        IsLogDisqualified(sct->log_id, &disqualification_date);
+
+    // For OCSP and TLS-delivered SCTs, only SCTs that are valid at the time
+    // of check are accepted.
+    if (sct->origin != SignedCertificateTimestamp::SCT_EMBEDDED &&
+        is_disqualified)
+      continue;
+    // TODO(rsleevi): To be truly consistent, we wouldn't count disqualified
+    // SCTs towards the diversity requirement for precerts, requiring one
+    // (valid) Google and one (valid) non-Google. If that was the case, this
+    // would be rewritten as:
+    // if (is_disqualified &&
+    //     (sct->origin != SignedCertificateTimestamp::SCT_EMBEDDED ||
+    //     earliest_sct >= disqualification_date ||
+    //     sct->timestamp >= disqualification_date)) {
+    //   continue;
+    // }
+    SCTPolicyStatus* policy_status = nullptr;
+
+    switch (sct->origin) {
+      case SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION:
+        tls_status.qualifying_scts++;
+        policy_status = &tls_status;
+        break;
+      case SignedCertificateTimestamp::SCT_FROM_OCSP_RESPONSE:
+        ocsp_status.qualifying_scts++;
+        policy_status = &ocsp_status;
+        break;
+      case SignedCertificateTimestamp::SCT_EMBEDDED:
+        if (is_disqualified && earliest_sct < disqualification_date &&
+            sct->timestamp < disqualification_date)
+          embedded_status.qualifying_scts++;
+        policy_status = &embedded_status;
+        break;
+      default:
+        NOTREACHED();
+        break;
+    }
+    if (policy_status->diversity != HAS_DIVERSE_SCTS) {
+      policy_status->diversity &= IsLogOperatedByGoogle(sct->log_id)
+                                      ? HAS_GOOGLE_SCT
+                                      : HAS_NON_GOOGLE_SCT;
+    }
+  }
+  if (tls_status.qualifying_scts >= 2 &&
+          tls_status.diversity == HAS_DIVERSE_SCTS ||
+      ocsp_status.qualifying_scts >= 2 &&
+          ocsp_status.diversity == HAS_DIVERSE_SCTS)
+    return true;
+
+  size_t num_expected_scts = 0;
+  if (embedded_status.qualifying_scts >= num_expected_scts &&
+      embedded_status.diversity == HAS_DIVERSE_SCTS) {
+    return true;
+  }
+
+  return false;
+}
+
 bool HasRequiredNumberOfSCTs(const X509Certificate& cert,
                              const ct::SCTList& verified_scts) {
+  const base::Time now = base::Time::Now();
+
   size_t num_valid_scts = verified_scts.size();
-  size_t num_embedded_scts = base::checked_cast<size_t>(
-      std::count_if(verified_scts.begin(), verified_scts.end(), IsEmbeddedSCT));
+  size_t num_embedded_scts = base::checked_cast<size_t>(std::count_if(
+      verified_scts.begin(), verified_scts.end(), IsQualifyingEmbeddedSCT));
 
   size_t num_non_embedded_scts = num_valid_scts - num_embedded_scts;
   // If at least two valid SCTs were delivered by means other than embedding
   // (i.e. in a TLS extension or OCSP), then the certificate conforms to bullet
   // number 3 of the "Qualifying Certificate" section of the CT/EV policy.
   if (num_non_embedded_scts >= 2)
     return true;
 
   if (cert.valid_start().is_null() || cert.valid_expiry().is_null() ||
       cert.valid_start().is_max() || cert.valid_expiry().is_max()) {
@@ skipping 276 matching lines @@
 
   if (!details.build_timely)
     return ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY;
 
   LogEVPolicyComplianceToUMA(details.status, ev_whitelist);
 
   return details.status;
 }
 
 }  // namespace net