OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
6 | 6 |
7 #include <memory> | 7 #include <memory> |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/time/time.h" | 10 #include "base/time/time.h" |
(...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
77 for (size_t i = 0; i < num_scts; ++i) { | 77 for (size_t i = 0; i < num_scts; ++i) { |
78 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 78 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
79 new ct::SignedCertificateTimestamp()); | 79 new ct::SignedCertificateTimestamp()); |
80 sct->origin = desired_origin; | 80 sct->origin = desired_origin; |
81 if (i < desired_log_keys.size()) | 81 if (i < desired_log_keys.size()) |
82 sct->log_id = desired_log_keys[i]; | 82 sct->log_id = desired_log_keys[i]; |
83 else | 83 else |
84 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); | 84 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); |
85 | 85 |
86 if (timestamp_past_enforcement_date) { | 86 if (timestamp_past_enforcement_date) { |
87 sct->timestamp = | 87 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}, |
88 base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}); | 88 &sct->timestamp)); |
89 } else { | 89 } else { |
90 sct->timestamp = | 90 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}, |
91 base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}); | 91 &sct->timestamp)); |
92 } | 92 } |
93 | 93 |
94 verified_scts->push_back(sct); | 94 verified_scts->push_back(sct); |
95 } | 95 } |
96 } | 96 } |
97 | 97 |
98 void AddDisqualifiedLogSCT( | 98 void AddDisqualifiedLogSCT( |
99 ct::SignedCertificateTimestamp::Origin desired_origin, | 99 ct::SignedCertificateTimestamp::Origin desired_origin, |
100 bool timestamp_after_disqualification_date, | 100 bool timestamp_after_disqualification_date, |
101 ct::SCTList* verified_scts) { | 101 ct::SCTList* verified_scts) { |
102 static const char kCertlyLogID[] = | 102 static const char kCertlyLogID[] = |
103 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" | 103 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" |
104 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; | 104 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; |
105 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, | 105 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, |
106 "Incorrect log ID length."); | 106 "Incorrect log ID length."); |
107 | 107 |
108 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 108 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
109 new ct::SignedCertificateTimestamp()); | 109 new ct::SignedCertificateTimestamp()); |
110 sct->origin = desired_origin; | 110 sct->origin = desired_origin; |
111 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); | 111 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); |
112 if (timestamp_after_disqualification_date) { | 112 if (timestamp_after_disqualification_date) { |
113 sct->timestamp = | 113 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}, |
114 base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}); | 114 &sct->timestamp)); |
115 } else { | 115 } else { |
116 sct->timestamp = base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}); | 116 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}, |
| 117 &sct->timestamp)); |
117 } | 118 } |
118 | 119 |
119 verified_scts->push_back(sct); | 120 verified_scts->push_back(sct); |
120 } | 121 } |
121 | 122 |
122 void FillListWithSCTsOfOrigin( | 123 void FillListWithSCTsOfOrigin( |
123 ct::SignedCertificateTimestamp::Origin desired_origin, | 124 ct::SignedCertificateTimestamp::Origin desired_origin, |
124 size_t num_scts, | 125 size_t num_scts, |
125 ct::SCTList* verified_scts) { | 126 ct::SCTList* verified_scts) { |
126 std::vector<std::string> desired_log_ids; | 127 std::vector<std::string> desired_log_ids; |
(...skipping 308 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
435 scts, BoundNetLog())); | 436 scts, BoundNetLog())); |
436 } | 437 } |
437 | 438 |
438 TEST_F(CTPolicyEnforcerTest, | 439 TEST_F(CTPolicyEnforcerTest, |
439 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { | 440 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { |
440 std::unique_ptr<crypto::RSAPrivateKey> private_key( | 441 std::unique_ptr<crypto::RSAPrivateKey> private_key( |
441 crypto::RSAPrivateKey::Create(1024)); | 442 crypto::RSAPrivateKey::Create(1024)); |
442 ASSERT_TRUE(private_key); | 443 ASSERT_TRUE(private_key); |
443 | 444 |
444 // Test multiple validity periods | 445 // Test multiple validity periods |
| 446 base::Time time_2015_3_0_25_11_25_0_0; |
| 447 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}, |
| 448 &time_2015_3_0_25_11_25_0_0)); |
| 449 |
| 450 base::Time time_2016_6_0_6_11_25_0_0; |
| 451 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 6, 0, 6, 11, 25, 0, 0}, |
| 452 &time_2016_6_0_6_11_25_0_0)); |
| 453 |
| 454 base::Time time_2016_6_0_25_11_25_0_0; |
| 455 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 6, 0, 25, 11, 25, 0, 0}, |
| 456 &time_2016_6_0_25_11_25_0_0)); |
| 457 |
| 458 base::Time time_2016_6_0_27_11_25_0_0; |
| 459 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 6, 0, 27, 11, 25, 0, 0}, |
| 460 &time_2016_6_0_27_11_25_0_0)); |
| 461 |
| 462 base::Time time_2017_6_0_25_11_25_0_0; |
| 463 EXPECT_TRUE(base::Time::FromUTCExploded({2017, 6, 0, 25, 11, 25, 0, 0}, |
| 464 &time_2017_6_0_25_11_25_0_0)); |
| 465 |
| 466 base::Time time_2017_6_0_28_11_25_0_0; |
| 467 EXPECT_TRUE(base::Time::FromUTCExploded({2017, 6, 0, 28, 11, 25, 0, 0}, |
| 468 &time_2017_6_0_28_11_25_0_0)); |
| 469 |
| 470 base::Time time_2018_6_0_25_11_25_0_0; |
| 471 EXPECT_TRUE(base::Time::FromUTCExploded({2018, 6, 0, 25, 11, 25, 0, 0}, |
| 472 &time_2018_6_0_25_11_25_0_0)); |
| 473 |
| 474 base::Time time_2018_6_0_27_11_25_0_0; |
| 475 EXPECT_TRUE(base::Time::FromUTCExploded({2018, 6, 0, 27, 11, 25, 0, 0}, |
| 476 &time_2018_6_0_27_11_25_0_0)); |
| 477 |
445 const struct TestData { | 478 const struct TestData { |
446 base::Time validity_start; | 479 base::Time validity_start; |
447 base::Time validity_end; | 480 base::Time validity_end; |
448 size_t scts_required; | 481 size_t scts_required; |
449 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. | 482 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. |
450 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 483 time_2015_3_0_25_11_25_0_0, time_2016_6_0_6_11_25_0_0, 2}, |
451 base::Time::FromUTCExploded({2016, 6, 0, 6, 11, 25, 0, 0}), | |
452 2}, | |
453 {// Cert valid for exactly 15 months, needs 3 SCTs. | 484 {// Cert valid for exactly 15 months, needs 3 SCTs. |
454 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 485 time_2015_3_0_25_11_25_0_0, time_2016_6_0_25_11_25_0_0, 3}, |
455 base::Time::FromUTCExploded({2016, 6, 0, 25, 11, 25, 0, 0}), | |
456 3}, | |
457 {// Cert valid for over 15 months, needs 3 SCTs. | 486 {// Cert valid for over 15 months, needs 3 SCTs. |
458 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 487 time_2015_3_0_25_11_25_0_0, time_2016_6_0_27_11_25_0_0, 3}, |
459 base::Time::FromUTCExploded({2016, 6, 0, 27, 11, 25, 0, 0}), | |
460 3}, | |
461 {// Cert valid for exactly 27 months, needs 3 SCTs. | 488 {// Cert valid for exactly 27 months, needs 3 SCTs. |
462 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 489 time_2015_3_0_25_11_25_0_0, time_2017_6_0_25_11_25_0_0, 3}, |
463 base::Time::FromUTCExploded({2017, 6, 0, 25, 11, 25, 0, 0}), | |
464 3}, | |
465 {// Cert valid for over 27 months, needs 4 SCTs. | 490 {// Cert valid for over 27 months, needs 4 SCTs. |
466 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 491 time_2015_3_0_25_11_25_0_0, time_2017_6_0_28_11_25_0_0, 4}, |
467 base::Time::FromUTCExploded({2017, 6, 0, 28, 11, 25, 0, 0}), | |
468 4}, | |
469 {// Cert valid for exactly 39 months, needs 4 SCTs. | 492 {// Cert valid for exactly 39 months, needs 4 SCTs. |
470 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 493 time_2015_3_0_25_11_25_0_0, time_2018_6_0_25_11_25_0_0, 4}, |
471 base::Time::FromUTCExploded({2018, 6, 0, 25, 11, 25, 0, 0}), | |
472 4}, | |
473 {// Cert valid for over 39 months, needs 5 SCTs. | 494 {// Cert valid for over 39 months, needs 5 SCTs. |
474 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 495 time_2015_3_0_25_11_25_0_0, time_2018_6_0_27_11_25_0_0, 5}}; |
475 base::Time::FromUTCExploded({2018, 6, 0, 27, 11, 25, 0, 0}), | |
476 5}}; | |
477 | 496 |
478 for (size_t i = 0; i < arraysize(kTestData); ++i) { | 497 for (size_t i = 0; i < arraysize(kTestData); ++i) { |
479 SCOPED_TRACE(i); | 498 SCOPED_TRACE(i); |
480 const base::Time& start = kTestData[i].validity_start; | 499 const base::Time& start = kTestData[i].validity_start; |
481 const base::Time& end = kTestData[i].validity_end; | 500 const base::Time& end = kTestData[i].validity_end; |
482 size_t required_scts = kTestData[i].scts_required; | 501 size_t required_scts = kTestData[i].scts_required; |
483 | 502 |
484 // Create a self-signed certificate with exactly the validity period. | 503 // Create a self-signed certificate with exactly the validity period. |
485 std::string cert_data; | 504 std::string cert_data; |
486 ASSERT_TRUE(x509_util::CreateSelfSignedCert( | 505 ASSERT_TRUE(x509_util::CreateSelfSignedCert( |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
554 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | 573 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, |
555 &scts); | 574 &scts); |
556 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, | 575 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, |
557 policy_enforcer_->DoesConformToCTEVPolicy(chain_.get(), nullptr, | 576 policy_enforcer_->DoesConformToCTEVPolicy(chain_.get(), nullptr, |
558 scts, BoundNetLog())); | 577 scts, BoundNetLog())); |
559 } | 578 } |
560 | 579 |
561 } // namespace | 580 } // namespace |
562 | 581 |
563 } // namespace net | 582 } // namespace net |
OLD | NEW |