OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
6 | 6 |
7 #include <memory> | 7 #include <memory> |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/time/time.h" | 10 #include "base/time/time.h" |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
78 for (size_t i = 0; i < num_scts; ++i) { | 78 for (size_t i = 0; i < num_scts; ++i) { |
79 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 79 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
80 new ct::SignedCertificateTimestamp()); | 80 new ct::SignedCertificateTimestamp()); |
81 sct->origin = desired_origin; | 81 sct->origin = desired_origin; |
82 if (i < desired_log_keys.size()) | 82 if (i < desired_log_keys.size()) |
83 sct->log_id = desired_log_keys[i]; | 83 sct->log_id = desired_log_keys[i]; |
84 else | 84 else |
85 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); | 85 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); |
86 | 86 |
87 if (timestamp_past_enforcement_date) { | 87 if (timestamp_past_enforcement_date) { |
88 sct->timestamp = | 88 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}, |
89 base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}); | 89 &sct->timestamp)); |
90 } else { | 90 } else { |
91 sct->timestamp = | 91 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}, |
92 base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}); | 92 &sct->timestamp)); |
93 } | 93 } |
94 | 94 |
95 verified_scts->push_back(sct); | 95 verified_scts->push_back(sct); |
96 } | 96 } |
97 } | 97 } |
98 | 98 |
99 void AddDisqualifiedLogSCT( | 99 void AddDisqualifiedLogSCT( |
100 ct::SignedCertificateTimestamp::Origin desired_origin, | 100 ct::SignedCertificateTimestamp::Origin desired_origin, |
101 bool timestamp_after_disqualification_date, | 101 bool timestamp_after_disqualification_date, |
102 ct::SCTList* verified_scts) { | 102 ct::SCTList* verified_scts) { |
103 static const char kCertlyLogID[] = | 103 static const char kCertlyLogID[] = |
104 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" | 104 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" |
105 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; | 105 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; |
106 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, | 106 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, |
107 "Incorrect log ID length."); | 107 "Incorrect log ID length."); |
108 | 108 |
109 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 109 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
110 new ct::SignedCertificateTimestamp()); | 110 new ct::SignedCertificateTimestamp()); |
111 sct->origin = desired_origin; | 111 sct->origin = desired_origin; |
112 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); | 112 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); |
113 if (timestamp_after_disqualification_date) { | 113 if (timestamp_after_disqualification_date) { |
114 sct->timestamp = | 114 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}, |
115 base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}); | 115 &sct->timestamp)); |
116 } else { | 116 } else { |
117 sct->timestamp = base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}); | 117 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}, |
| 118 &sct->timestamp)); |
118 } | 119 } |
119 | 120 |
120 verified_scts->push_back(sct); | 121 verified_scts->push_back(sct); |
121 } | 122 } |
122 | 123 |
123 void FillListWithSCTsOfOrigin( | 124 void FillListWithSCTsOfOrigin( |
124 ct::SignedCertificateTimestamp::Origin desired_origin, | 125 ct::SignedCertificateTimestamp::Origin desired_origin, |
125 size_t num_scts, | 126 size_t num_scts, |
126 ct::SCTList* verified_scts) { | 127 ct::SCTList* verified_scts) { |
127 std::vector<std::string> desired_log_ids; | 128 std::vector<std::string> desired_log_ids; |
128 desired_log_ids.push_back(google_log_id_); | 129 desired_log_ids.push_back(google_log_id_); |
129 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, | 130 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, |
130 verified_scts); | 131 verified_scts); |
131 } | 132 } |
132 | 133 |
| 134 base::Time CreateTime(const base::Time::Exploded& exploded) { |
| 135 base::Time result; |
| 136 if (!base::Time::FromUTCExploded(exploded, &result)) { |
| 137 ADD_FAILURE() << "Failed FromUTCExploded"; |
| 138 } |
| 139 return result; |
| 140 } |
| 141 |
133 protected: | 142 protected: |
134 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; | 143 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; |
135 scoped_refptr<X509Certificate> chain_; | 144 scoped_refptr<X509Certificate> chain_; |
136 std::string google_log_id_; | 145 std::string google_log_id_; |
137 std::string non_google_log_id_; | 146 std::string non_google_log_id_; |
138 }; | 147 }; |
139 | 148 |
140 #if defined(OS_ANDROID) | 149 #if defined(OS_ANDROID) |
141 #define MAYBE_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle \ | 150 #define MAYBE_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle \ |
142 DISABLED_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle | 151 DISABLED_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle |
(...skipping 300 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
443 chain_.get(), nullptr, scts, NetLogWithSource())); | 452 chain_.get(), nullptr, scts, NetLogWithSource())); |
444 } | 453 } |
445 | 454 |
446 TEST_F(CTPolicyEnforcerTest, | 455 TEST_F(CTPolicyEnforcerTest, |
447 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { | 456 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { |
448 std::unique_ptr<crypto::RSAPrivateKey> private_key( | 457 std::unique_ptr<crypto::RSAPrivateKey> private_key( |
449 crypto::RSAPrivateKey::Create(1024)); | 458 crypto::RSAPrivateKey::Create(1024)); |
450 ASSERT_TRUE(private_key); | 459 ASSERT_TRUE(private_key); |
451 | 460 |
452 // Test multiple validity periods | 461 // Test multiple validity periods |
| 462 base::Time time_2015_3_0_25_11_25_0_0 = |
| 463 CreateTime({2015, 3, 0, 25, 11, 25, 0, 0}); |
| 464 |
| 465 base::Time time_2016_6_0_6_11_25_0_0 = |
| 466 CreateTime({2016, 6, 0, 6, 11, 25, 0, 0}); |
| 467 |
| 468 base::Time time_2016_6_0_25_11_25_0_0 = |
| 469 CreateTime({2016, 6, 0, 25, 11, 25, 0, 0}); |
| 470 |
| 471 base::Time time_2016_6_0_27_11_25_0_0 = |
| 472 CreateTime({2016, 6, 0, 27, 11, 25, 0, 0}); |
| 473 |
| 474 base::Time time_2017_6_0_25_11_25_0_0 = |
| 475 CreateTime({2017, 6, 0, 25, 11, 25, 0, 0}); |
| 476 |
| 477 base::Time time_2017_6_0_28_11_25_0_0 = |
| 478 CreateTime({2017, 6, 0, 28, 11, 25, 0, 0}); |
| 479 |
| 480 base::Time time_2018_6_0_25_11_25_0_0 = |
| 481 CreateTime({2018, 6, 0, 25, 11, 25, 0, 0}); |
| 482 |
| 483 base::Time time_2018_6_0_27_11_25_0_0 = |
| 484 CreateTime({2018, 6, 0, 27, 11, 25, 0, 0}); |
| 485 |
453 const struct TestData { | 486 const struct TestData { |
454 base::Time validity_start; | 487 base::Time validity_start; |
455 base::Time validity_end; | 488 base::Time validity_end; |
456 size_t scts_required; | 489 size_t scts_required; |
457 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. | 490 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. |
458 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 491 time_2015_3_0_25_11_25_0_0, time_2016_6_0_6_11_25_0_0, 2}, |
459 base::Time::FromUTCExploded({2016, 6, 0, 6, 11, 25, 0, 0}), | |
460 2}, | |
461 {// Cert valid for exactly 15 months, needs 3 SCTs. | 492 {// Cert valid for exactly 15 months, needs 3 SCTs. |
462 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 493 time_2015_3_0_25_11_25_0_0, time_2016_6_0_25_11_25_0_0, 3}, |
463 base::Time::FromUTCExploded({2016, 6, 0, 25, 11, 25, 0, 0}), | |
464 3}, | |
465 {// Cert valid for over 15 months, needs 3 SCTs. | 494 {// Cert valid for over 15 months, needs 3 SCTs. |
466 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 495 time_2015_3_0_25_11_25_0_0, time_2016_6_0_27_11_25_0_0, 3}, |
467 base::Time::FromUTCExploded({2016, 6, 0, 27, 11, 25, 0, 0}), | |
468 3}, | |
469 {// Cert valid for exactly 27 months, needs 3 SCTs. | 496 {// Cert valid for exactly 27 months, needs 3 SCTs. |
470 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 497 time_2015_3_0_25_11_25_0_0, time_2017_6_0_25_11_25_0_0, 3}, |
471 base::Time::FromUTCExploded({2017, 6, 0, 25, 11, 25, 0, 0}), | |
472 3}, | |
473 {// Cert valid for over 27 months, needs 4 SCTs. | 498 {// Cert valid for over 27 months, needs 4 SCTs. |
474 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 499 time_2015_3_0_25_11_25_0_0, time_2017_6_0_28_11_25_0_0, 4}, |
475 base::Time::FromUTCExploded({2017, 6, 0, 28, 11, 25, 0, 0}), | |
476 4}, | |
477 {// Cert valid for exactly 39 months, needs 4 SCTs. | 500 {// Cert valid for exactly 39 months, needs 4 SCTs. |
478 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 501 time_2015_3_0_25_11_25_0_0, time_2018_6_0_25_11_25_0_0, 4}, |
479 base::Time::FromUTCExploded({2018, 6, 0, 25, 11, 25, 0, 0}), | |
480 4}, | |
481 {// Cert valid for over 39 months, needs 5 SCTs. | 502 {// Cert valid for over 39 months, needs 5 SCTs. |
482 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 503 time_2015_3_0_25_11_25_0_0, time_2018_6_0_27_11_25_0_0, 5}}; |
483 base::Time::FromUTCExploded({2018, 6, 0, 27, 11, 25, 0, 0}), | |
484 5}}; | |
485 | 504 |
486 for (size_t i = 0; i < arraysize(kTestData); ++i) { | 505 for (size_t i = 0; i < arraysize(kTestData); ++i) { |
487 SCOPED_TRACE(i); | 506 SCOPED_TRACE(i); |
488 const base::Time& start = kTestData[i].validity_start; | 507 const base::Time& start = kTestData[i].validity_start; |
489 const base::Time& end = kTestData[i].validity_end; | 508 const base::Time& end = kTestData[i].validity_end; |
490 size_t required_scts = kTestData[i].scts_required; | 509 size_t required_scts = kTestData[i].scts_required; |
491 | 510 |
492 // Create a self-signed certificate with exactly the validity period. | 511 // Create a self-signed certificate with exactly the validity period. |
493 std::string cert_data; | 512 std::string cert_data; |
494 ASSERT_TRUE(x509_util::CreateSelfSignedCert( | 513 ASSERT_TRUE(x509_util::CreateSelfSignedCert( |
(...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
562 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | 581 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, |
563 &scts); | 582 &scts); |
564 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, | 583 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, |
565 policy_enforcer_->DoesConformToCTEVPolicy( | 584 policy_enforcer_->DoesConformToCTEVPolicy( |
566 chain_.get(), nullptr, scts, NetLogWithSource())); | 585 chain_.get(), nullptr, scts, NetLogWithSource())); |
567 } | 586 } |
568 | 587 |
569 } // namespace | 588 } // namespace |
570 | 589 |
571 } // namespace net | 590 } // namespace net |
OLD | NEW |