| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
| 6 | 6 |
| 7 #include <memory> | 7 #include <memory> |
| 8 #include <string> | 8 #include <string> |
| 9 | 9 |
| 10 #include "base/time/time.h" | 10 #include "base/time/time.h" |
| (...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 78 for (size_t i = 0; i < num_scts; ++i) { | 78 for (size_t i = 0; i < num_scts; ++i) { |
| 79 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 79 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
| 80 new ct::SignedCertificateTimestamp()); | 80 new ct::SignedCertificateTimestamp()); |
| 81 sct->origin = desired_origin; | 81 sct->origin = desired_origin; |
| 82 if (i < desired_log_keys.size()) | 82 if (i < desired_log_keys.size()) |
| 83 sct->log_id = desired_log_keys[i]; | 83 sct->log_id = desired_log_keys[i]; |
| 84 else | 84 else |
| 85 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); | 85 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); |
| 86 | 86 |
| 87 if (timestamp_past_enforcement_date) { | 87 if (timestamp_past_enforcement_date) { |
| 88 sct->timestamp = | 88 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}, |
| 89 base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}); | 89 &sct->timestamp)); |
| 90 } else { | 90 } else { |
| 91 sct->timestamp = | 91 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}, |
| 92 base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}); | 92 &sct->timestamp)); |
| 93 } | 93 } |
| 94 | 94 |
| 95 verified_scts->push_back(sct); | 95 verified_scts->push_back(sct); |
| 96 } | 96 } |
| 97 } | 97 } |
| 98 | 98 |
| 99 void AddDisqualifiedLogSCT( | 99 void AddDisqualifiedLogSCT( |
| 100 ct::SignedCertificateTimestamp::Origin desired_origin, | 100 ct::SignedCertificateTimestamp::Origin desired_origin, |
| 101 bool timestamp_after_disqualification_date, | 101 bool timestamp_after_disqualification_date, |
| 102 ct::SCTList* verified_scts) { | 102 ct::SCTList* verified_scts) { |
| 103 static const char kCertlyLogID[] = | 103 static const char kCertlyLogID[] = |
| 104 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" | 104 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" |
| 105 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; | 105 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; |
| 106 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, | 106 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, |
| 107 "Incorrect log ID length."); | 107 "Incorrect log ID length."); |
| 108 | 108 |
| 109 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 109 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
| 110 new ct::SignedCertificateTimestamp()); | 110 new ct::SignedCertificateTimestamp()); |
| 111 sct->origin = desired_origin; | 111 sct->origin = desired_origin; |
| 112 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); | 112 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); |
| 113 if (timestamp_after_disqualification_date) { | 113 if (timestamp_after_disqualification_date) { |
| 114 sct->timestamp = | 114 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}, |
| 115 base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}); | 115 &sct->timestamp)); |
| 116 } else { | 116 } else { |
| 117 sct->timestamp = base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}); | 117 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}, |
| 118 &sct->timestamp)); |
| 118 } | 119 } |
| 119 | 120 |
| 120 verified_scts->push_back(sct); | 121 verified_scts->push_back(sct); |
| 121 } | 122 } |
| 122 | 123 |
| 123 void FillListWithSCTsOfOrigin( | 124 void FillListWithSCTsOfOrigin( |
| 124 ct::SignedCertificateTimestamp::Origin desired_origin, | 125 ct::SignedCertificateTimestamp::Origin desired_origin, |
| 125 size_t num_scts, | 126 size_t num_scts, |
| 126 ct::SCTList* verified_scts) { | 127 ct::SCTList* verified_scts) { |
| 127 std::vector<std::string> desired_log_ids; | 128 std::vector<std::string> desired_log_ids; |
| (...skipping 308 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 436 chain_.get(), nullptr, scts, NetLogWithSource())); | 437 chain_.get(), nullptr, scts, NetLogWithSource())); |
| 437 } | 438 } |
| 438 | 439 |
| 439 TEST_F(CTPolicyEnforcerTest, | 440 TEST_F(CTPolicyEnforcerTest, |
| 440 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { | 441 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { |
| 441 std::unique_ptr<crypto::RSAPrivateKey> private_key( | 442 std::unique_ptr<crypto::RSAPrivateKey> private_key( |
| 442 crypto::RSAPrivateKey::Create(1024)); | 443 crypto::RSAPrivateKey::Create(1024)); |
| 443 ASSERT_TRUE(private_key); | 444 ASSERT_TRUE(private_key); |
| 444 | 445 |
| 445 // Test multiple validity periods | 446 // Test multiple validity periods |
| 447 base::Time time_2015_3_0_25_11_25_0_0; |
| 448 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}, |
| 449 &time_2015_3_0_25_11_25_0_0)); |
| 450 |
| 451 base::Time time_2016_6_0_6_11_25_0_0; |
| 452 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 6, 0, 6, 11, 25, 0, 0}, |
| 453 &time_2016_6_0_6_11_25_0_0)); |
| 454 |
| 455 base::Time time_2016_6_0_25_11_25_0_0; |
| 456 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 6, 0, 25, 11, 25, 0, 0}, |
| 457 &time_2016_6_0_25_11_25_0_0)); |
| 458 |
| 459 base::Time time_2016_6_0_27_11_25_0_0; |
| 460 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 6, 0, 27, 11, 25, 0, 0}, |
| 461 &time_2016_6_0_27_11_25_0_0)); |
| 462 |
| 463 base::Time time_2017_6_0_25_11_25_0_0; |
| 464 EXPECT_TRUE(base::Time::FromUTCExploded({2017, 6, 0, 25, 11, 25, 0, 0}, |
| 465 &time_2017_6_0_25_11_25_0_0)); |
| 466 |
| 467 base::Time time_2017_6_0_28_11_25_0_0; |
| 468 EXPECT_TRUE(base::Time::FromUTCExploded({2017, 6, 0, 28, 11, 25, 0, 0}, |
| 469 &time_2017_6_0_28_11_25_0_0)); |
| 470 |
| 471 base::Time time_2018_6_0_25_11_25_0_0; |
| 472 EXPECT_TRUE(base::Time::FromUTCExploded({2018, 6, 0, 25, 11, 25, 0, 0}, |
| 473 &time_2018_6_0_25_11_25_0_0)); |
| 474 |
| 475 base::Time time_2018_6_0_27_11_25_0_0; |
| 476 EXPECT_TRUE(base::Time::FromUTCExploded({2018, 6, 0, 27, 11, 25, 0, 0}, |
| 477 &time_2018_6_0_27_11_25_0_0)); |
| 478 |
| 446 const struct TestData { | 479 const struct TestData { |
| 447 base::Time validity_start; | 480 base::Time validity_start; |
| 448 base::Time validity_end; | 481 base::Time validity_end; |
| 449 size_t scts_required; | 482 size_t scts_required; |
| 450 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. | 483 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. |
| 451 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 484 time_2015_3_0_25_11_25_0_0, time_2016_6_0_6_11_25_0_0, 2}, |
| 452 base::Time::FromUTCExploded({2016, 6, 0, 6, 11, 25, 0, 0}), | |
| 453 2}, | |
| 454 {// Cert valid for exactly 15 months, needs 3 SCTs. | 485 {// Cert valid for exactly 15 months, needs 3 SCTs. |
| 455 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 486 time_2015_3_0_25_11_25_0_0, time_2016_6_0_25_11_25_0_0, 3}, |
| 456 base::Time::FromUTCExploded({2016, 6, 0, 25, 11, 25, 0, 0}), | |
| 457 3}, | |
| 458 {// Cert valid for over 15 months, needs 3 SCTs. | 487 {// Cert valid for over 15 months, needs 3 SCTs. |
| 459 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 488 time_2015_3_0_25_11_25_0_0, time_2016_6_0_27_11_25_0_0, 3}, |
| 460 base::Time::FromUTCExploded({2016, 6, 0, 27, 11, 25, 0, 0}), | |
| 461 3}, | |
| 462 {// Cert valid for exactly 27 months, needs 3 SCTs. | 489 {// Cert valid for exactly 27 months, needs 3 SCTs. |
| 463 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 490 time_2015_3_0_25_11_25_0_0, time_2017_6_0_25_11_25_0_0, 3}, |
| 464 base::Time::FromUTCExploded({2017, 6, 0, 25, 11, 25, 0, 0}), | |
| 465 3}, | |
| 466 {// Cert valid for over 27 months, needs 4 SCTs. | 491 {// Cert valid for over 27 months, needs 4 SCTs. |
| 467 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 492 time_2015_3_0_25_11_25_0_0, time_2017_6_0_28_11_25_0_0, 4}, |
| 468 base::Time::FromUTCExploded({2017, 6, 0, 28, 11, 25, 0, 0}), | |
| 469 4}, | |
| 470 {// Cert valid for exactly 39 months, needs 4 SCTs. | 493 {// Cert valid for exactly 39 months, needs 4 SCTs. |
| 471 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 494 time_2015_3_0_25_11_25_0_0, time_2018_6_0_25_11_25_0_0, 4}, |
| 472 base::Time::FromUTCExploded({2018, 6, 0, 25, 11, 25, 0, 0}), | |
| 473 4}, | |
| 474 {// Cert valid for over 39 months, needs 5 SCTs. | 495 {// Cert valid for over 39 months, needs 5 SCTs. |
| 475 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 496 time_2015_3_0_25_11_25_0_0, time_2018_6_0_27_11_25_0_0, 5}}; |
| 476 base::Time::FromUTCExploded({2018, 6, 0, 27, 11, 25, 0, 0}), | |
| 477 5}}; | |
| 478 | 497 |
| 479 for (size_t i = 0; i < arraysize(kTestData); ++i) { | 498 for (size_t i = 0; i < arraysize(kTestData); ++i) { |
| 480 SCOPED_TRACE(i); | 499 SCOPED_TRACE(i); |
| 481 const base::Time& start = kTestData[i].validity_start; | 500 const base::Time& start = kTestData[i].validity_start; |
| 482 const base::Time& end = kTestData[i].validity_end; | 501 const base::Time& end = kTestData[i].validity_end; |
| 483 size_t required_scts = kTestData[i].scts_required; | 502 size_t required_scts = kTestData[i].scts_required; |
| 484 | 503 |
| 485 // Create a self-signed certificate with exactly the validity period. | 504 // Create a self-signed certificate with exactly the validity period. |
| 486 std::string cert_data; | 505 std::string cert_data; |
| 487 ASSERT_TRUE(x509_util::CreateSelfSignedCert( | 506 ASSERT_TRUE(x509_util::CreateSelfSignedCert( |
| (...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 555 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | 574 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, |
| 556 &scts); | 575 &scts); |
| 557 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, | 576 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, |
| 558 policy_enforcer_->DoesConformToCTEVPolicy( | 577 policy_enforcer_->DoesConformToCTEVPolicy( |
| 559 chain_.get(), nullptr, scts, NetLogWithSource())); | 578 chain_.get(), nullptr, scts, NetLogWithSource())); |
| 560 } | 579 } |
| 561 | 580 |
| 562 } // namespace | 581 } // namespace |
| 563 | 582 |
| 564 } // namespace net | 583 } // namespace net |
| OLD | NEW |