OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
6 | 6 |
7 #include <memory> | 7 #include <memory> |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/build_time.h" | |
11 #include "base/time/time.h" | 10 #include "base/time/time.h" |
12 #include "base/version.h" | 11 #include "base/version.h" |
13 #include "crypto/rsa_private_key.h" | 12 #include "crypto/rsa_private_key.h" |
14 #include "crypto/sha2.h" | 13 #include "crypto/sha2.h" |
15 #include "net/cert/ct_ev_whitelist.h" | 14 #include "net/cert/ct_ev_whitelist.h" |
16 #include "net/cert/ct_policy_status.h" | 15 #include "net/cert/ct_policy_status.h" |
17 #include "net/cert/ct_verify_result.h" | 16 #include "net/cert/ct_verify_result.h" |
18 #include "net/cert/x509_certificate.h" | 17 #include "net/cert/x509_certificate.h" |
19 #include "net/cert/x509_util.h" | 18 #include "net/cert/x509_util.h" |
20 #include "net/log/net_log_with_source.h" | 19 #include "net/log/net_log_with_source.h" |
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
53 | 52 |
54 const char kGoogleAviatorLogID[] = | 53 const char kGoogleAviatorLogID[] = |
55 "\x68\xf6\x98\xf8\x1f\x64\x82\xbe\x3a\x8c\xee\xb9\x28\x1d\x4c\xfc\x71\x51" | 54 "\x68\xf6\x98\xf8\x1f\x64\x82\xbe\x3a\x8c\xee\xb9\x28\x1d\x4c\xfc\x71\x51" |
56 "\x5d\x67\x93\xd4\x44\xd1\x0a\x67\xac\xbb\x4f\x4f\xfb\xc4"; | 55 "\x5d\x67\x93\xd4\x44\xd1\x0a\x67\xac\xbb\x4f\x4f\xfb\xc4"; |
57 static_assert(arraysize(kGoogleAviatorLogID) - 1 == crypto::kSHA256Length, | 56 static_assert(arraysize(kGoogleAviatorLogID) - 1 == crypto::kSHA256Length, |
58 "Incorrect log ID length."); | 57 "Incorrect log ID length."); |
59 | 58 |
60 class CTPolicyEnforcerTest : public ::testing::Test { | 59 class CTPolicyEnforcerTest : public ::testing::Test { |
61 public: | 60 public: |
62 void SetUp() override { | 61 void SetUp() override { |
63 VerifyBuildIsTimely(); | |
64 | |
65 policy_enforcer_.reset(new CTPolicyEnforcer); | 62 policy_enforcer_.reset(new CTPolicyEnforcer); |
66 | 63 |
67 std::string der_test_cert(ct::GetDerEncodedX509Cert()); | 64 std::string der_test_cert(ct::GetDerEncodedX509Cert()); |
68 chain_ = X509Certificate::CreateFromBytes(der_test_cert.data(), | 65 chain_ = X509Certificate::CreateFromBytes(der_test_cert.data(), |
69 der_test_cert.size()); | 66 der_test_cert.size()); |
70 ASSERT_TRUE(chain_.get()); | 67 ASSERT_TRUE(chain_.get()); |
71 google_log_id_ = std::string(kGoogleAviatorLogID, crypto::kSHA256Length); | 68 google_log_id_ = std::string(kGoogleAviatorLogID, crypto::kSHA256Length); |
72 non_google_log_id_.assign(crypto::kSHA256Length, 1); | 69 non_google_log_id_.assign(crypto::kSHA256Length, 1); |
73 } | 70 } |
74 | 71 |
(...skipping 52 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
127 ct::SignedCertificateTimestamp::Origin desired_origin, | 124 ct::SignedCertificateTimestamp::Origin desired_origin, |
128 size_t num_scts, | 125 size_t num_scts, |
129 ct::SCTList* verified_scts) { | 126 ct::SCTList* verified_scts) { |
130 std::vector<std::string> desired_log_ids; | 127 std::vector<std::string> desired_log_ids; |
131 desired_log_ids.push_back(google_log_id_); | 128 desired_log_ids.push_back(google_log_id_); |
132 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, | 129 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, |
133 verified_scts); | 130 verified_scts); |
134 } | 131 } |
135 | 132 |
136 protected: | 133 protected: |
137 void VerifyBuildIsTimely() { | |
138 base::Time build_time = base::GetBuildTime(); | |
139 base::Time now = base::Time::Now(); | |
140 | |
141 // Internally CTPolicyEnforcer expects the build time to be no older than 10 | |
142 // weeks. If it is then many tests in this file (and other net unittests) | |
143 // will fail. crbug.com/666821 | |
144 EXPECT_LT((now - build_time).InDays(), 70) | |
145 << "IMPORTANT: There is a problem with the system clock and/or the " | |
146 "build timestamp. This will lead to many net_unittests failing " | |
147 "(crbug.com/666821)\n" | |
148 << "now: " << now << ", build_time: " << build_time; | |
149 } | |
150 | |
151 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; | 134 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; |
152 scoped_refptr<X509Certificate> chain_; | 135 scoped_refptr<X509Certificate> chain_; |
153 std::string google_log_id_; | 136 std::string google_log_id_; |
154 std::string non_google_log_id_; | 137 std::string non_google_log_id_; |
155 }; | 138 }; |
156 | 139 |
157 #if defined(OS_ANDROID) | 140 #if defined(OS_ANDROID) |
158 #define MAYBE_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle \ | 141 #define MAYBE_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle \ |
159 DISABLED_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle | 142 DISABLED_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle |
160 #else | 143 #else |
(...skipping 418 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
579 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | 562 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, |
580 &scts); | 563 &scts); |
581 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, | 564 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, |
582 policy_enforcer_->DoesConformToCTEVPolicy( | 565 policy_enforcer_->DoesConformToCTEVPolicy( |
583 chain_.get(), nullptr, scts, NetLogWithSource())); | 566 chain_.get(), nullptr, scts, NetLogWithSource())); |
584 } | 567 } |
585 | 568 |
586 } // namespace | 569 } // namespace |
587 | 570 |
588 } // namespace net | 571 } // namespace net |
OLD | NEW |