| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
| 6 | 6 |
| 7 #include <memory> | 7 #include <memory> |
| 8 #include <string> | 8 #include <string> |
| 9 | 9 |
| 10 #include "base/build_time.h" | |
| 11 #include "base/time/time.h" | 10 #include "base/time/time.h" |
| 12 #include "base/version.h" | 11 #include "base/version.h" |
| 13 #include "crypto/rsa_private_key.h" | 12 #include "crypto/rsa_private_key.h" |
| 14 #include "crypto/sha2.h" | 13 #include "crypto/sha2.h" |
| 15 #include "net/cert/ct_ev_whitelist.h" | 14 #include "net/cert/ct_ev_whitelist.h" |
| 16 #include "net/cert/ct_policy_status.h" | 15 #include "net/cert/ct_policy_status.h" |
| 17 #include "net/cert/ct_verify_result.h" | 16 #include "net/cert/ct_verify_result.h" |
| 18 #include "net/cert/x509_certificate.h" | 17 #include "net/cert/x509_certificate.h" |
| 19 #include "net/cert/x509_util.h" | 18 #include "net/cert/x509_util.h" |
| 20 #include "net/log/net_log_with_source.h" | 19 #include "net/log/net_log_with_source.h" |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 53 | 52 |
| 54 const char kGoogleAviatorLogID[] = | 53 const char kGoogleAviatorLogID[] = |
| 55 "\x68\xf6\x98\xf8\x1f\x64\x82\xbe\x3a\x8c\xee\xb9\x28\x1d\x4c\xfc\x71\x51" | 54 "\x68\xf6\x98\xf8\x1f\x64\x82\xbe\x3a\x8c\xee\xb9\x28\x1d\x4c\xfc\x71\x51" |
| 56 "\x5d\x67\x93\xd4\x44\xd1\x0a\x67\xac\xbb\x4f\x4f\xfb\xc4"; | 55 "\x5d\x67\x93\xd4\x44\xd1\x0a\x67\xac\xbb\x4f\x4f\xfb\xc4"; |
| 57 static_assert(arraysize(kGoogleAviatorLogID) - 1 == crypto::kSHA256Length, | 56 static_assert(arraysize(kGoogleAviatorLogID) - 1 == crypto::kSHA256Length, |
| 58 "Incorrect log ID length."); | 57 "Incorrect log ID length."); |
| 59 | 58 |
| 60 class CTPolicyEnforcerTest : public ::testing::Test { | 59 class CTPolicyEnforcerTest : public ::testing::Test { |
| 61 public: | 60 public: |
| 62 void SetUp() override { | 61 void SetUp() override { |
| 63 VerifyBuildIsTimely(); | |
| 64 | |
| 65 policy_enforcer_.reset(new CTPolicyEnforcer); | 62 policy_enforcer_.reset(new CTPolicyEnforcer); |
| 66 | 63 |
| 67 std::string der_test_cert(ct::GetDerEncodedX509Cert()); | 64 std::string der_test_cert(ct::GetDerEncodedX509Cert()); |
| 68 chain_ = X509Certificate::CreateFromBytes(der_test_cert.data(), | 65 chain_ = X509Certificate::CreateFromBytes(der_test_cert.data(), |
| 69 der_test_cert.size()); | 66 der_test_cert.size()); |
| 70 ASSERT_TRUE(chain_.get()); | 67 ASSERT_TRUE(chain_.get()); |
| 71 google_log_id_ = std::string(kGoogleAviatorLogID, crypto::kSHA256Length); | 68 google_log_id_ = std::string(kGoogleAviatorLogID, crypto::kSHA256Length); |
| 72 non_google_log_id_.assign(crypto::kSHA256Length, 1); | 69 non_google_log_id_.assign(crypto::kSHA256Length, 1); |
| 73 } | 70 } |
| 74 | 71 |
| (...skipping 52 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 127 ct::SignedCertificateTimestamp::Origin desired_origin, | 124 ct::SignedCertificateTimestamp::Origin desired_origin, |
| 128 size_t num_scts, | 125 size_t num_scts, |
| 129 ct::SCTList* verified_scts) { | 126 ct::SCTList* verified_scts) { |
| 130 std::vector<std::string> desired_log_ids; | 127 std::vector<std::string> desired_log_ids; |
| 131 desired_log_ids.push_back(google_log_id_); | 128 desired_log_ids.push_back(google_log_id_); |
| 132 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, | 129 FillListWithSCTsOfOrigin(desired_origin, num_scts, desired_log_ids, true, |
| 133 verified_scts); | 130 verified_scts); |
| 134 } | 131 } |
| 135 | 132 |
| 136 protected: | 133 protected: |
| 137 void VerifyBuildIsTimely() { | |
| 138 base::Time build_time = base::GetBuildTime(); | |
| 139 base::Time now = base::Time::Now(); | |
| 140 | |
| 141 // Internally CTPolicyEnforcer expects the build time to be no older than 10 | |
| 142 // weeks. If it is then many tests in this file (and other net unittests) | |
| 143 // will fail. crbug.com/666821 | |
| 144 EXPECT_LT((now - build_time).InDays(), 70) | |
| 145 << "IMPORTANT: There is a problem with the system clock and/or the " | |
| 146 "build timestamp. This will lead to many net_unittests failing " | |
| 147 "(crbug.com/666821)\n" | |
| 148 << "now: " << now << ", build_time: " << build_time; | |
| 149 } | |
| 150 | |
| 151 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; | 134 std::unique_ptr<CTPolicyEnforcer> policy_enforcer_; |
| 152 scoped_refptr<X509Certificate> chain_; | 135 scoped_refptr<X509Certificate> chain_; |
| 153 std::string google_log_id_; | 136 std::string google_log_id_; |
| 154 std::string non_google_log_id_; | 137 std::string non_google_log_id_; |
| 155 }; | 138 }; |
| 156 | 139 |
| 157 #if defined(OS_ANDROID) | 140 #if defined(OS_ANDROID) |
| 158 #define MAYBE_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle \ | 141 #define MAYBE_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle \ |
| 159 DISABLED_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle | 142 DISABLED_DoesNotConformToCTEVPolicyNotEnoughDiverseSCTsAllGoogle |
| 160 #else | 143 #else |
| (...skipping 418 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 579 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | 562 FillListWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, |
| 580 &scts); | 563 &scts); |
| 581 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, | 564 EXPECT_EQ(ct::EVPolicyCompliance::EV_POLICY_NOT_ENOUGH_SCTS, |
| 582 policy_enforcer_->DoesConformToCTEVPolicy( | 565 policy_enforcer_->DoesConformToCTEVPolicy( |
| 583 chain_.get(), nullptr, scts, NetLogWithSource())); | 566 chain_.get(), nullptr, scts, NetLogWithSource())); |
| 584 } | 567 } |
| 585 | 568 |
| 586 } // namespace | 569 } // namespace |
| 587 | 570 |
| 588 } // namespace net | 571 } // namespace net |
| OLD | NEW |