OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
6 | 6 |
7 #include <memory> | 7 #include <memory> |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/time/time.h" | 10 #include "base/time/time.h" |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
78 for (size_t i = 0; i < num_scts; ++i) { | 78 for (size_t i = 0; i < num_scts; ++i) { |
79 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 79 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
80 new ct::SignedCertificateTimestamp()); | 80 new ct::SignedCertificateTimestamp()); |
81 sct->origin = desired_origin; | 81 sct->origin = desired_origin; |
82 if (i < desired_log_keys.size()) | 82 if (i < desired_log_keys.size()) |
83 sct->log_id = desired_log_keys[i]; | 83 sct->log_id = desired_log_keys[i]; |
84 else | 84 else |
85 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); | 85 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); |
86 | 86 |
87 if (timestamp_past_enforcement_date) { | 87 if (timestamp_past_enforcement_date) { |
88 sct->timestamp = | 88 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}, |
89 base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}); | 89 &sct->timestamp)); |
90 } else { | 90 } else { |
91 sct->timestamp = | 91 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}, |
92 base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}); | 92 &sct->timestamp)); |
93 } | 93 } |
94 | 94 |
95 verified_scts->push_back(sct); | 95 verified_scts->push_back(sct); |
96 } | 96 } |
97 } | 97 } |
98 | 98 |
99 void AddDisqualifiedLogSCT( | 99 void AddDisqualifiedLogSCT( |
100 ct::SignedCertificateTimestamp::Origin desired_origin, | 100 ct::SignedCertificateTimestamp::Origin desired_origin, |
101 bool timestamp_after_disqualification_date, | 101 bool timestamp_after_disqualification_date, |
102 ct::SCTList* verified_scts) { | 102 ct::SCTList* verified_scts) { |
103 static const char kCertlyLogID[] = | 103 static const char kCertlyLogID[] = |
104 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" | 104 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" |
105 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; | 105 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; |
106 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, | 106 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, |
107 "Incorrect log ID length."); | 107 "Incorrect log ID length."); |
108 | 108 |
109 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 109 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
110 new ct::SignedCertificateTimestamp()); | 110 new ct::SignedCertificateTimestamp()); |
111 sct->origin = desired_origin; | 111 sct->origin = desired_origin; |
112 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); | 112 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); |
113 if (timestamp_after_disqualification_date) { | 113 if (timestamp_after_disqualification_date) { |
114 sct->timestamp = | 114 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}, |
115 base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}); | 115 &sct->timestamp)); |
116 } else { | 116 } else { |
117 sct->timestamp = base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}); | 117 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}, |
| 118 &sct->timestamp)); |
118 } | 119 } |
119 | 120 |
120 verified_scts->push_back(sct); | 121 verified_scts->push_back(sct); |
121 } | 122 } |
122 | 123 |
123 void FillListWithSCTsOfOrigin( | 124 void FillListWithSCTsOfOrigin( |
124 ct::SignedCertificateTimestamp::Origin desired_origin, | 125 ct::SignedCertificateTimestamp::Origin desired_origin, |
125 size_t num_scts, | 126 size_t num_scts, |
126 ct::SCTList* verified_scts) { | 127 ct::SCTList* verified_scts) { |
127 std::vector<std::string> desired_log_ids; | 128 std::vector<std::string> desired_log_ids; |
128 desired_log_ids.push_back(google_log_id_); | 129 desired_log_ids.push_back(google_log_id_); |
129 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, | 130 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, |
130 verified_scts); | 131 verified_scts); |
131 } | 132 } |
132 | 133 |
| 134 base::Time CreateTime(const base::Time::Exploded& exploded) { |
| 135 base::Time result; |
| 136 if (!base::Time::FromUTCExploded(exploded, &result)) { |
| 137 ADD_FAILURE() << "Failed FromUTCExploded"; |
| 138 } |
| 139 return result; |
| 140 } |
| 141 |
133 protected: | 142 protected: |
134 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; | 143 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; |
135 scoped_refptr<X509Certificate> chain_; | 144 scoped_refptr<X509Certificate> chain_; |
136 std::string google_log_id_; | 145 std::string google_log_id_; |
137 std::string non_google_log_id_; | 146 std::string non_google_log_id_; |
138 }; | 147 }; |
139 | 148 |
140 TEST_F(CTPolicyEnforcerTest, | 149 TEST_F(CTPolicyEnforcerTest, |
141 DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle) { | 150 DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle) { |
142 ct::SCTList scts; | 151 ct::SCTList scts; |
(...skipping 293 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
436 chain_.get(), nullptr, scts, NetLogWithSource())); | 445 chain_.get(), nullptr, scts, NetLogWithSource())); |
437 } | 446 } |
438 | 447 |
439 TEST_F(CTPolicyEnforcerTest, | 448 TEST_F(CTPolicyEnforcerTest, |
440 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { | 449 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { |
441 std::unique_ptr<crypto::RSAPrivateKey> private_key( | 450 std::unique_ptr<crypto::RSAPrivateKey> private_key( |
442 crypto::RSAPrivateKey::Create(1024)); | 451 crypto::RSAPrivateKey::Create(1024)); |
443 ASSERT_TRUE(private_key); | 452 ASSERT_TRUE(private_key); |
444 | 453 |
445 // Test multiple validity periods | 454 // Test multiple validity periods |
| 455 base::Time time_2015_3_0_25_11_25_0_0 = |
| 456 CreateTime({2015, 3, 0, 25, 11, 25, 0, 0}); |
| 457 |
| 458 base::Time time_2016_6_0_6_11_25_0_0 = |
| 459 CreateTime({2016, 6, 0, 6, 11, 25, 0, 0}); |
| 460 |
| 461 base::Time time_2016_6_0_25_11_25_0_0 = |
| 462 CreateTime({2016, 6, 0, 25, 11, 25, 0, 0}); |
| 463 |
| 464 base::Time time_2016_6_0_27_11_25_0_0 = |
| 465 CreateTime({2016, 6, 0, 27, 11, 25, 0, 0}); |
| 466 |
| 467 base::Time time_2017_6_0_25_11_25_0_0 = |
| 468 CreateTime({2017, 6, 0, 25, 11, 25, 0, 0}); |
| 469 |
| 470 base::Time time_2017_6_0_28_11_25_0_0 = |
| 471 CreateTime({2017, 6, 0, 28, 11, 25, 0, 0}); |
| 472 |
| 473 base::Time time_2018_6_0_25_11_25_0_0 = |
| 474 CreateTime({2018, 6, 0, 25, 11, 25, 0, 0}); |
| 475 |
| 476 base::Time time_2018_6_0_27_11_25_0_0 = |
| 477 CreateTime({2018, 6, 0, 27, 11, 25, 0, 0}); |
| 478 |
446 const struct TestData { | 479 const struct TestData { |
447 base::Time validity_start; | 480 base::Time validity_start; |
448 base::Time validity_end; | 481 base::Time validity_end; |
449 size_t scts_required; | 482 size_t scts_required; |
450 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. | 483 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. |
451 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 484 time_2015_3_0_25_11_25_0_0, time_2016_6_0_6_11_25_0_0, 2}, |
452 base::Time::FromUTCExploded({2016, 6, 0, 6, 11, 25, 0, 0}), | |
453 2}, | |
454 {// Cert valid for exactly 15 months, needs 3 SCTs. | 485 {// Cert valid for exactly 15 months, needs 3 SCTs. |
455 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 486 time_2015_3_0_25_11_25_0_0, time_2016_6_0_25_11_25_0_0, 3}, |
456 base::Time::FromUTCExploded({2016, 6, 0, 25, 11, 25, 0, 0}), | |
457 3}, | |
458 {// Cert valid for over 15 months, needs 3 SCTs. | 487 {// Cert valid for over 15 months, needs 3 SCTs. |
459 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 488 time_2015_3_0_25_11_25_0_0, time_2016_6_0_27_11_25_0_0, 3}, |
460 base::Time::FromUTCExploded({2016, 6, 0, 27, 11, 25, 0, 0}), | |
461 3}, | |
462 {// Cert valid for exactly 27 months, needs 3 SCTs. | 489 {// Cert valid for exactly 27 months, needs 3 SCTs. |
463 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 490 time_2015_3_0_25_11_25_0_0, time_2017_6_0_25_11_25_0_0, 3}, |
464 base::Time::FromUTCExploded({2017, 6, 0, 25, 11, 25, 0, 0}), | |
465 3}, | |
466 {// Cert valid for over 27 months, needs 4 SCTs. | 491 {// Cert valid for over 27 months, needs 4 SCTs. |
467 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 492 time_2015_3_0_25_11_25_0_0, time_2017_6_0_28_11_25_0_0, 4}, |
468 base::Time::FromUTCExploded({2017, 6, 0, 28, 11, 25, 0, 0}), | |
469 4}, | |
470 {// Cert valid for exactly 39 months, needs 4 SCTs. | 493 {// Cert valid for exactly 39 months, needs 4 SCTs. |
471 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 494 time_2015_3_0_25_11_25_0_0, time_2018_6_0_25_11_25_0_0, 4}, |
472 base::Time::FromUTCExploded({2018, 6, 0, 25, 11, 25, 0, 0}), | |
473 4}, | |
474 {// Cert valid for over 39 months, needs 5 SCTs. | 495 {// Cert valid for over 39 months, needs 5 SCTs. |
475 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 496 time_2015_3_0_25_11_25_0_0, time_2018_6_0_27_11_25_0_0, 5}}; |
476 base::Time::FromUTCExploded({2018, 6, 0, 27, 11, 25, 0, 0}), | |
477 5}}; | |
478 | 497 |
479 for (size_t i = 0; i < arraysize(kTestData); ++i) { | 498 for (size_t i = 0; i < arraysize(kTestData); ++i) { |
480 SCOPED_TRACE(i); | 499 SCOPED_TRACE(i); |
481 const base::Time& start = kTestData[i].validity_start; | 500 const base::Time& start = kTestData[i].validity_start; |
482 const base::Time& end = kTestData[i].validity_end; | 501 const base::Time& end = kTestData[i].validity_end; |
483 size_t required_scts = kTestData[i].scts_required; | 502 size_t required_scts = kTestData[i].scts_required; |
484 | 503 |
485 // Create a self-signed certificate with exactly the validity period. | 504 // Create a self-signed certificate with exactly the validity period. |
486 std::string cert_data; | 505 std::string cert_data; |
487 ASSERT_TRUE(x509_util::CreateSelfSignedCert( | 506 ASSERT_TRUE(x509_util::CreateSelfSignedCert( |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
555 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | 574 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, |
556 &scts); | 575 &scts); |
557 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, | 576 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, |
558 policy_enforcer_->DoesConformToCTEVPolicy( | 577 policy_enforcer_->DoesConformToCTEVPolicy( |
559 chain_.get(), nullptr, scts, NetLogWithSource())); | 578 chain_.get(), nullptr, scts, NetLogWithSource())); |
560 } | 579 } |
561 | 580 |
562 } // namespace | 581 } // namespace |
563 | 582 |
564 } // namespace net | 583 } // namespace net |
OLD | NEW |