OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/multi_log_ct_verifier.h" | 5 #include "net/cert/multi_log_ct_verifier.h" |
6 | 6 |
7 #include <memory> | 7 #include <memory> |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/files/file_path.h" | 10 #include "base/files/file_path.h" |
(...skipping 94 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
105 std::string verification_status; | 105 std::string verification_status; |
106 if (!the_sct->GetString("verification_status", &verification_status)) | 106 if (!the_sct->GetString("verification_status", &verification_status)) |
107 return false; | 107 return false; |
108 if (verification_status != "Verified") | 108 if (verification_status != "Verified") |
109 return false; | 109 return false; |
110 | 110 |
111 return true; | 111 return true; |
112 } | 112 } |
113 | 113 |
114 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain, | 114 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain, |
115 const BoundNetLog& bound_net_log, | 115 const NetLogWithSource& bound_net_log, |
116 ct::CTVerifyResult* result) { | 116 ct::CTVerifyResult* result) { |
117 return verifier_->Verify(chain.get(), | 117 return verifier_->Verify(chain.get(), |
118 std::string(), | 118 std::string(), |
119 std::string(), | 119 std::string(), |
120 result, | 120 result, |
121 bound_net_log) == OK; | 121 bound_net_log) == OK; |
122 } | 122 } |
123 | 123 |
124 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) { | 124 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) { |
125 ct::CTVerifyResult result; | 125 ct::CTVerifyResult result; |
126 TestNetLog net_log; | 126 TestNetLog net_log; |
127 BoundNetLog bound_net_log = | 127 NetLogWithSource bound_net_log = |
128 BoundNetLog::Make(&net_log, NetLogSourceType::CONNECT_JOB); | 128 NetLogWithSource::Make(&net_log, NetLogSourceType::CONNECT_JOB); |
129 | 129 |
130 return verifier_->Verify(chain.get(), | 130 return verifier_->Verify(chain.get(), |
131 std::string(), | 131 std::string(), |
132 std::string(), | 132 std::string(), |
133 &result, | 133 &result, |
134 bound_net_log) == OK; | 134 bound_net_log) == OK; |
135 } | 135 } |
136 | 136 |
137 bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) { | 137 bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) { |
138 ct::CTVerifyResult result; | 138 ct::CTVerifyResult result; |
139 TestNetLog net_log; | 139 TestNetLog net_log; |
140 BoundNetLog bound_net_log = | 140 NetLogWithSource bound_net_log = |
141 BoundNetLog::Make(&net_log, NetLogSourceType::CONNECT_JOB); | 141 NetLogWithSource::Make(&net_log, NetLogSourceType::CONNECT_JOB); |
142 return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) && | 142 return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) && |
143 ct::CheckForSingleVerifiedSCTInResult(result, kLogDescription) && | 143 ct::CheckForSingleVerifiedSCTInResult(result, kLogDescription) && |
144 ct::CheckForSCTOrigin( | 144 ct::CheckForSCTOrigin( |
145 result, ct::SignedCertificateTimestamp::SCT_EMBEDDED) && | 145 result, ct::SignedCertificateTimestamp::SCT_EMBEDDED) && |
146 CheckForEmbeddedSCTInNetLog(net_log)); | 146 CheckForEmbeddedSCTInNetLog(net_log)); |
147 } | 147 } |
148 | 148 |
149 // Histogram-related helper methods | 149 // Histogram-related helper methods |
150 int GetValueFromHistogram(const std::string& histogram_name, | 150 int GetValueFromHistogram(const std::string& histogram_name, |
151 int sample_index) { | 151 int sample_index) { |
(...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
210 "ct-test-embedded-with-intermediate-preca-chain.pem", | 210 "ct-test-embedded-with-intermediate-preca-chain.pem", |
211 X509Certificate::FORMAT_AUTO)); | 211 X509Certificate::FORMAT_AUTO)); |
212 ASSERT_TRUE(chain.get()); | 212 ASSERT_TRUE(chain.get()); |
213 ASSERT_TRUE(CheckPrecertificateVerification(chain)); | 213 ASSERT_TRUE(CheckPrecertificateVerification(chain)); |
214 } | 214 } |
215 | 215 |
216 TEST_F(MultiLogCTVerifierTest, VerifiesSCTOverX509Cert) { | 216 TEST_F(MultiLogCTVerifierTest, VerifiesSCTOverX509Cert) { |
217 std::string sct_list = ct::GetSCTListForTesting(); | 217 std::string sct_list = ct::GetSCTListForTesting(); |
218 | 218 |
219 ct::CTVerifyResult result; | 219 ct::CTVerifyResult result; |
220 EXPECT_EQ(OK, | 220 EXPECT_EQ(OK, verifier_->Verify(chain_.get(), std::string(), sct_list, |
221 verifier_->Verify( | 221 &result, NetLogWithSource())); |
222 chain_.get(), std::string(), sct_list, &result, BoundNetLog())); | |
223 ASSERT_TRUE(ct::CheckForSingleVerifiedSCTInResult(result, kLogDescription)); | 222 ASSERT_TRUE(ct::CheckForSingleVerifiedSCTInResult(result, kLogDescription)); |
224 ASSERT_TRUE(ct::CheckForSCTOrigin( | 223 ASSERT_TRUE(ct::CheckForSCTOrigin( |
225 result, ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); | 224 result, ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); |
226 } | 225 } |
227 | 226 |
228 TEST_F(MultiLogCTVerifierTest, IdentifiesSCTFromUnknownLog) { | 227 TEST_F(MultiLogCTVerifierTest, IdentifiesSCTFromUnknownLog) { |
229 std::string sct_list = ct::GetSCTListWithInvalidSCT(); | 228 std::string sct_list = ct::GetSCTListWithInvalidSCT(); |
230 ct::CTVerifyResult result; | 229 ct::CTVerifyResult result; |
231 | 230 |
232 EXPECT_NE(OK, | 231 EXPECT_NE(OK, verifier_->Verify(chain_.get(), std::string(), sct_list, |
233 verifier_->Verify( | 232 &result, NetLogWithSource())); |
234 chain_.get(), std::string(), sct_list, &result, BoundNetLog())); | |
235 EXPECT_EQ(1U, result.scts.size()); | 233 EXPECT_EQ(1U, result.scts.size()); |
236 EXPECT_EQ("", result.scts[0].sct->log_description); | 234 EXPECT_EQ("", result.scts[0].sct->log_description); |
237 EXPECT_EQ(ct::SCT_STATUS_LOG_UNKNOWN, result.scts[0].status); | 235 EXPECT_EQ(ct::SCT_STATUS_LOG_UNKNOWN, result.scts[0].status); |
238 } | 236 } |
239 | 237 |
240 TEST_F(MultiLogCTVerifierTest, CountsValidSCTsInStatusHistogram) { | 238 TEST_F(MultiLogCTVerifierTest, CountsValidSCTsInStatusHistogram) { |
241 int num_valid_scts = NumValidSCTsInStatusHistogram(); | 239 int num_valid_scts = NumValidSCTsInStatusHistogram(); |
242 | 240 |
243 ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_)); | 241 ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_)); |
244 | 242 |
245 EXPECT_EQ(num_valid_scts + 1, NumValidSCTsInStatusHistogram()); | 243 EXPECT_EQ(num_valid_scts + 1, NumValidSCTsInStatusHistogram()); |
246 } | 244 } |
247 | 245 |
248 TEST_F(MultiLogCTVerifierTest, CountsInvalidSCTsInStatusHistogram) { | 246 TEST_F(MultiLogCTVerifierTest, CountsInvalidSCTsInStatusHistogram) { |
249 std::string sct_list = ct::GetSCTListWithInvalidSCT(); | 247 std::string sct_list = ct::GetSCTListWithInvalidSCT(); |
250 ct::CTVerifyResult result; | 248 ct::CTVerifyResult result; |
251 int num_valid_scts = NumValidSCTsInStatusHistogram(); | 249 int num_valid_scts = NumValidSCTsInStatusHistogram(); |
252 int num_invalid_scts = GetValueFromHistogram( | 250 int num_invalid_scts = GetValueFromHistogram( |
253 "Net.CertificateTransparency.SCTStatus", ct::SCT_STATUS_LOG_UNKNOWN); | 251 "Net.CertificateTransparency.SCTStatus", ct::SCT_STATUS_LOG_UNKNOWN); |
254 | 252 |
255 EXPECT_NE(OK, | 253 EXPECT_NE(OK, verifier_->Verify(chain_.get(), std::string(), sct_list, |
256 verifier_->Verify( | 254 &result, NetLogWithSource())); |
257 chain_.get(), std::string(), sct_list, &result, BoundNetLog())); | |
258 | 255 |
259 ASSERT_EQ(num_valid_scts, NumValidSCTsInStatusHistogram()); | 256 ASSERT_EQ(num_valid_scts, NumValidSCTsInStatusHistogram()); |
260 ASSERT_EQ(num_invalid_scts + 1, | 257 ASSERT_EQ(num_invalid_scts + 1, |
261 GetValueFromHistogram("Net.CertificateTransparency.SCTStatus", | 258 GetValueFromHistogram("Net.CertificateTransparency.SCTStatus", |
262 ct::SCT_STATUS_LOG_UNKNOWN)); | 259 ct::SCT_STATUS_LOG_UNKNOWN)); |
263 } | 260 } |
264 | 261 |
265 TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInConnectionsHistogram) { | 262 TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInConnectionsHistogram) { |
266 int old_sct_count = NumConnectionsWithSingleSCT(); | 263 int old_sct_count = NumConnectionsWithSingleSCT(); |
267 ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_)); | 264 ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_)); |
(...skipping 30 matching lines...) Expand all Loading... |
298 Mock::VerifyAndClearExpectations(&observer); | 295 Mock::VerifyAndClearExpectations(&observer); |
299 | 296 |
300 EXPECT_CALL(observer, OnSCTVerified(embedded_sct_chain_.get(), _)).Times(0); | 297 EXPECT_CALL(observer, OnSCTVerified(embedded_sct_chain_.get(), _)).Times(0); |
301 verifier_->SetObserver(nullptr); | 298 verifier_->SetObserver(nullptr); |
302 ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_)); | 299 ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_)); |
303 } | 300 } |
304 | 301 |
305 } // namespace | 302 } // namespace |
306 | 303 |
307 } // namespace net | 304 } // namespace net |
OLD | NEW |