| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
| 6 | 6 |
| 7 #include <memory> | 7 #include <memory> |
| 8 #include <string> | 8 #include <string> |
| 9 | 9 |
| 10 #include "base/time/time.h" | 10 #include "base/time/time.h" |
| (...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 78 for (size_t i = 0; i < num_scts; ++i) { | 78 for (size_t i = 0; i < num_scts; ++i) { |
| 79 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 79 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
| 80 new ct::SignedCertificateTimestamp()); | 80 new ct::SignedCertificateTimestamp()); |
| 81 sct->origin = desired_origin; | 81 sct->origin = desired_origin; |
| 82 if (i < desired_log_keys.size()) | 82 if (i < desired_log_keys.size()) |
| 83 sct->log_id = desired_log_keys[i]; | 83 sct->log_id = desired_log_keys[i]; |
| 84 else | 84 else |
| 85 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); | 85 sct->log_id = std::string(crypto::kSHA256Length, static_cast<char>(i)); |
| 86 | 86 |
| 87 if (timestamp_past_enforcement_date) { | 87 if (timestamp_past_enforcement_date) { |
| 88 sct->timestamp = | 88 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}, |
| 89 base::Time::FromUTCExploded({2015, 8, 0, 15, 0, 0, 0, 0}); | 89 &sct->timestamp)); |
| 90 } else { | 90 } else { |
| 91 sct->timestamp = | 91 EXPECT_TRUE(base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}, |
| 92 base::Time::FromUTCExploded({2015, 6, 0, 15, 0, 0, 0, 0}); | 92 &sct->timestamp)); |
| 93 } | 93 } |
| 94 | 94 |
| 95 verified_scts->push_back(sct); | 95 verified_scts->push_back(sct); |
| 96 } | 96 } |
| 97 } | 97 } |
| 98 | 98 |
| 99 void AddDisqualifiedLogSCT( | 99 void AddDisqualifiedLogSCT( |
| 100 ct::SignedCertificateTimestamp::Origin desired_origin, | 100 ct::SignedCertificateTimestamp::Origin desired_origin, |
| 101 bool timestamp_after_disqualification_date, | 101 bool timestamp_after_disqualification_date, |
| 102 ct::SCTList* verified_scts) { | 102 ct::SCTList* verified_scts) { |
| 103 static const char kCertlyLogID[] = | 103 static const char kCertlyLogID[] = |
| 104 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" | 104 "\xcd\xb5\x17\x9b\x7f\xc1\xc0\x46\xfe\xea\x31\x13\x6a\x3f\x8f\x00\x2e" |
| 105 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; | 105 "\x61\x82\xfa\xf8\x89\x6f\xec\xc8\xb2\xf5\xb5\xab\x60\x49\x00"; |
| 106 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, | 106 static_assert(arraysize(kCertlyLogID) - 1 == crypto::kSHA256Length, |
| 107 "Incorrect log ID length."); | 107 "Incorrect log ID length."); |
| 108 | 108 |
| 109 scoped_refptr<ct::SignedCertificateTimestamp> sct( | 109 scoped_refptr<ct::SignedCertificateTimestamp> sct( |
| 110 new ct::SignedCertificateTimestamp()); | 110 new ct::SignedCertificateTimestamp()); |
| 111 sct->origin = desired_origin; | 111 sct->origin = desired_origin; |
| 112 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); | 112 sct->log_id = std::string(kCertlyLogID, crypto::kSHA256Length); |
| 113 if (timestamp_after_disqualification_date) { | 113 if (timestamp_after_disqualification_date) { |
| 114 sct->timestamp = | 114 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}, |
| 115 base::Time::FromUTCExploded({2016, 4, 0, 16, 0, 0, 0, 0}); | 115 &sct->timestamp)); |
| 116 } else { | 116 } else { |
| 117 sct->timestamp = base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}); | 117 EXPECT_TRUE(base::Time::FromUTCExploded({2016, 4, 0, 1, 0, 0, 0, 0}, |
| 118 &sct->timestamp)); |
| 118 } | 119 } |
| 119 | 120 |
| 120 verified_scts->push_back(sct); | 121 verified_scts->push_back(sct); |
| 121 } | 122 } |
| 122 | 123 |
| 123 void FillListWithSCTsOfOrigin( | 124 void FillListWithSCTsOfOrigin( |
| 124 ct::SignedCertificateTimestamp::Origin desired_origin, | 125 ct::SignedCertificateTimestamp::Origin desired_origin, |
| 125 size_t num_scts, | 126 size_t num_scts, |
| 126 ct::SCTList* verified_scts) { | 127 ct::SCTList* verified_scts) { |
| 127 std::vector<std::string> desired_log_ids; | 128 std::vector<std::string> desired_log_ids; |
| 128 desired_log_ids.push_back(google_log_id_); | 129 desired_log_ids.push_back(google_log_id_); |
| 129 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, | 130 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, |
| 130 verified_scts); | 131 verified_scts); |
| 131 } | 132 } |
| 132 | 133 |
| 134 base::Time CreateTime(const base::Time::Exploded& exploded) { |
| 135 base::Time result; |
| 136 if (!base::Time::FromUTCExploded(exploded, &result)) { |
| 137 ADD_FAILURE() << "Failed FromUTCExploded"; |
| 138 } |
| 139 return result; |
| 140 } |
| 141 |
| 133 protected: | 142 protected: |
| 134 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; | 143 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; |
| 135 scoped_refptr<X509Certificate> chain_; | 144 scoped_refptr<X509Certificate> chain_; |
| 136 std::string google_log_id_; | 145 std::string google_log_id_; |
| 137 std::string non_google_log_id_; | 146 std::string non_google_log_id_; |
| 138 }; | 147 }; |
| 139 | 148 |
| 140 #if defined(OS_ANDROID) | 149 #if defined(OS_ANDROID) |
| 141 #define MAYBE_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle \ | 150 #define MAYBE_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle \ |
| 142 DISABLED_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle | 151 DISABLED_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle |
| (...skipping 300 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 443 chain_.get(), nullptr, scts, NetLogWithSource())); | 452 chain_.get(), nullptr, scts, NetLogWithSource())); |
| 444 } | 453 } |
| 445 | 454 |
| 446 TEST_F(CTPolicyEnforcerTest, | 455 TEST_F(CTPolicyEnforcerTest, |
| 447 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { | 456 ConformsToPolicyExactNumberOfSCTsForValidityPeriod) { |
| 448 std::unique_ptr<crypto::RSAPrivateKey> private_key( | 457 std::unique_ptr<crypto::RSAPrivateKey> private_key( |
| 449 crypto::RSAPrivateKey::Create(1024)); | 458 crypto::RSAPrivateKey::Create(1024)); |
| 450 ASSERT_TRUE(private_key); | 459 ASSERT_TRUE(private_key); |
| 451 | 460 |
| 452 // Test multiple validity periods | 461 // Test multiple validity periods |
| 462 base::Time time_2015_3_0_25_11_25_0_0 = |
| 463 CreateTime({2015, 3, 0, 25, 11, 25, 0, 0}); |
| 464 |
| 465 base::Time time_2016_6_0_6_11_25_0_0 = |
| 466 CreateTime({2016, 6, 0, 6, 11, 25, 0, 0}); |
| 467 |
| 468 base::Time time_2016_6_0_25_11_25_0_0 = |
| 469 CreateTime({2016, 6, 0, 25, 11, 25, 0, 0}); |
| 470 |
| 471 base::Time time_2016_6_0_27_11_25_0_0 = |
| 472 CreateTime({2016, 6, 0, 27, 11, 25, 0, 0}); |
| 473 |
| 474 base::Time time_2017_6_0_25_11_25_0_0 = |
| 475 CreateTime({2017, 6, 0, 25, 11, 25, 0, 0}); |
| 476 |
| 477 base::Time time_2017_6_0_28_11_25_0_0 = |
| 478 CreateTime({2017, 6, 0, 28, 11, 25, 0, 0}); |
| 479 |
| 480 base::Time time_2018_6_0_25_11_25_0_0 = |
| 481 CreateTime({2018, 6, 0, 25, 11, 25, 0, 0}); |
| 482 |
| 483 base::Time time_2018_6_0_27_11_25_0_0 = |
| 484 CreateTime({2018, 6, 0, 27, 11, 25, 0, 0}); |
| 485 |
| 453 const struct TestData { | 486 const struct TestData { |
| 454 base::Time validity_start; | 487 base::Time validity_start; |
| 455 base::Time validity_end; | 488 base::Time validity_end; |
| 456 size_t scts_required; | 489 size_t scts_required; |
| 457 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. | 490 } kTestData[] = {{// Cert valid for 14 months, needs 2 SCTs. |
| 458 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 491 time_2015_3_0_25_11_25_0_0, time_2016_6_0_6_11_25_0_0, 2}, |
| 459 base::Time::FromUTCExploded({2016, 6, 0, 6, 11, 25, 0, 0}), | |
| 460 2}, | |
| 461 {// Cert valid for exactly 15 months, needs 3 SCTs. | 492 {// Cert valid for exactly 15 months, needs 3 SCTs. |
| 462 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 493 time_2015_3_0_25_11_25_0_0, time_2016_6_0_25_11_25_0_0, 3}, |
| 463 base::Time::FromUTCExploded({2016, 6, 0, 25, 11, 25, 0, 0}), | |
| 464 3}, | |
| 465 {// Cert valid for over 15 months, needs 3 SCTs. | 494 {// Cert valid for over 15 months, needs 3 SCTs. |
| 466 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 495 time_2015_3_0_25_11_25_0_0, time_2016_6_0_27_11_25_0_0, 3}, |
| 467 base::Time::FromUTCExploded({2016, 6, 0, 27, 11, 25, 0, 0}), | |
| 468 3}, | |
| 469 {// Cert valid for exactly 27 months, needs 3 SCTs. | 496 {// Cert valid for exactly 27 months, needs 3 SCTs. |
| 470 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 497 time_2015_3_0_25_11_25_0_0, time_2017_6_0_25_11_25_0_0, 3}, |
| 471 base::Time::FromUTCExploded({2017, 6, 0, 25, 11, 25, 0, 0}), | |
| 472 3}, | |
| 473 {// Cert valid for over 27 months, needs 4 SCTs. | 498 {// Cert valid for over 27 months, needs 4 SCTs. |
| 474 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 499 time_2015_3_0_25_11_25_0_0, time_2017_6_0_28_11_25_0_0, 4}, |
| 475 base::Time::FromUTCExploded({2017, 6, 0, 28, 11, 25, 0, 0}), | |
| 476 4}, | |
| 477 {// Cert valid for exactly 39 months, needs 4 SCTs. | 500 {// Cert valid for exactly 39 months, needs 4 SCTs. |
| 478 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 501 time_2015_3_0_25_11_25_0_0, time_2018_6_0_25_11_25_0_0, 4}, |
| 479 base::Time::FromUTCExploded({2018, 6, 0, 25, 11, 25, 0, 0}), | |
| 480 4}, | |
| 481 {// Cert valid for over 39 months, needs 5 SCTs. | 502 {// Cert valid for over 39 months, needs 5 SCTs. |
| 482 base::Time::FromUTCExploded({2015, 3, 0, 25, 11, 25, 0, 0}), | 503 time_2015_3_0_25_11_25_0_0, time_2018_6_0_27_11_25_0_0, 5}}; |
| 483 base::Time::FromUTCExploded({2018, 6, 0, 27, 11, 25, 0, 0}), | |
| 484 5}}; | |
| 485 | 504 |
| 486 for (size_t i = 0; i < arraysize(kTestData); ++i) { | 505 for (size_t i = 0; i < arraysize(kTestData); ++i) { |
| 487 SCOPED_TRACE(i); | 506 SCOPED_TRACE(i); |
| 488 const base::Time& start = kTestData[i].validity_start; | 507 const base::Time& start = kTestData[i].validity_start; |
| 489 const base::Time& end = kTestData[i].validity_end; | 508 const base::Time& end = kTestData[i].validity_end; |
| 490 size_t required_scts = kTestData[i].scts_required; | 509 size_t required_scts = kTestData[i].scts_required; |
| 491 | 510 |
| 492 // Create a self-signed certificate with exactly the validity period. | 511 // Create a self-signed certificate with exactly the validity period. |
| 493 std::string cert_data; | 512 std::string cert_data; |
| 494 ASSERT_TRUE(x509_util::CreateSelfSignedCert( | 513 ASSERT_TRUE(x509_util::CreateSelfSignedCert( |
| (...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 562 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | 581 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, |
| 563 &scts); | 582 &scts); |
| 564 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, | 583 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, |
| 565 policy_enforcer_->DoesConformToCTEVPolicy( | 584 policy_enforcer_->DoesConformToCTEVPolicy( |
| 566 chain_.get(), nullptr, scts, NetLogWithSource())); | 585 chain_.get(), nullptr, scts, NetLogWithSource())); |
| 567 } | 586 } |
| 568 | 587 |
| 569 } // namespace | 588 } // namespace |
| 570 | 589 |
| 571 } // namespace net | 590 } // namespace net |
| OLD | NEW |