Certificate Transparency: Require SCTs for EV certificates.

net/cert/multi_log_ct_verifier_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_log_ct_verifier.h"
 
 #include <string>
 
 #include "base/file_util.h"
 #include "base/files/file_path.h"
@@ skipping 26 matching lines @@
 
 class MultiLogCTVerifierTest : public ::testing::Test {
  public:
   virtual void SetUp() OVERRIDE {
     scoped_ptr<CTLogVerifier> log(
         CTLogVerifier::Create(ct::GetTestPublicKey(), kLogDescription));
     ASSERT_TRUE(log);
 
     verifier_.reset(new MultiLogCTVerifier());
     verifier_->AddLog(log.Pass());
+    verifier_->SetEnforceCTEVPolicy(true);
     std::string der_test_cert(ct::GetDerEncodedX509Cert());
     chain_ = X509Certificate::CreateFromBytes(
         der_test_cert.data(),
         der_test_cert.length());
     ASSERT_TRUE(chain_);
 
     embedded_sct_chain_ =
         CreateCertificateChainFromFile(GetTestCertsDirectory(),
                                        "ct-test-embedded-cert.pem",
                                        X509Certificate::FORMAT_AUTO);
     ASSERT_TRUE(embedded_sct_chain_);
   }
 
   bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) {
     return (result.verified_scts.size() == 1U) &&
         result.invalid_scts.empty() &&
         result.unknown_logs_scts.empty() &&
         result.verified_scts[0]->log_description == kLogDescription;
   }
 
   bool CheckForSCTOrigin(
       const ct::CTVerifyResult& result,
       ct::SignedCertificateTimestamp::Origin origin) {
     return (result.verified_scts.size() > 0) &&
         (result.verified_scts[0]->origin == origin);
   }
 
-  bool CheckForEmbeddedSCTInNetLog(CapturingNetLog& net_log) {
+  bool CheckForEmbeddedSCTInNetLog(const CapturingNetLog& net_log) {
     CapturingNetLog::CapturedEntryList entries;
     net_log.GetEntries(&entries);
     if (entries.size() != 2)
       return false;
 
     const CapturingNetLog::CapturedEntry& received = entries[0];
     std::string embedded_scts;
     if (!received.GetStringValue("embedded_scts", &embedded_scts))
       return false;
     if (embedded_scts.empty())
@@ skipping 92 matching lines @@
   int NumEmbeddedSCTsInHistogram() {
     return GetValueFromHistogram("Net.CertificateTransparency.SCTOrigin",
                                  ct::SignedCertificateTimestamp::SCT_EMBEDDED);
   }
 
   int NumValidSCTsInStatusHistogram() {
     return GetValueFromHistogram("Net.CertificateTransparency.SCTStatus",
                                  ct::SCT_STATUS_OK);
   }
 
+  void FillResultWithSCTsOfOrigin(
+      ct::SignedCertificateTimestamp::Origin desired_origin,
+      int num_scts,
+      ct::CTVerifyResult* result) {
+    for (int i = 0; i < num_scts; ++i) {
+      scoped_refptr<ct::SignedCertificateTimestamp> sct(
+          new ct::SignedCertificateTimestamp());
+      sct->origin = desired_origin;
+      result->verified_scts.push_back(sct);
+    }
+  }
+
  protected:
   scoped_ptr<MultiLogCTVerifier> verifier_;
   scoped_refptr<X509Certificate> chain_;
   scoped_refptr<X509Certificate> embedded_sct_chain_;
 };
 
 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCT) {
   ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_));
 }
 
@@ skipping 90 matching lines @@
   EXPECT_EQ(old_embedded_count + 1, NumEmbeddedSCTsInHistogram());
 }
 
 TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) {
   int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0);
   EXPECT_FALSE(VerifySinglePrecertificateChain(chain_));
   ASSERT_EQ(connections_without_scts + 1,
             GetValueFromHistogram(kSCTCountHistogram, 0));
 }
 
+TEST_F(MultiLogCTVerifierTest, ConformsToCTEVPolicyWithNonEmbeddedSCTs) {
+  ct::CTVerifyResult result;
+  FillResultWithSCTsOfOrigin(
+      ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION,
+      2,
+      &result);
+
+  ASSERT_TRUE(verifier_->DoesConformToCTEVPolicy(chain_, result));
+}
+
+TEST_F(MultiLogCTVerifierTest, ConformsToCTEVPolicyWithEmbeddedSCTs) {
+  // We know that the chain_ is valid for 10 years - over 121 months - so
+  // requires 5 SCTs.
+  ct::CTVerifyResult result;
+  FillResultWithSCTsOfOrigin(
+      ct::SignedCertificateTimestamp::SCT_EMBEDDED,
+      5,
+      &result);
+
+  ASSERT_TRUE(verifier_->DoesConformToCTEVPolicy(chain_, result));
+}
+
+TEST_F(MultiLogCTVerifierTest, ConformsToCTEVPolicyMixedOriginSCTs) {
+  ct::CTVerifyResult result;
+  FillResultWithSCTsOfOrigin(
+      ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION,
+      2,
+      &result);
+  result.verified_scts[1]->origin =
+      ct::SignedCertificateTimestamp::SCT_EMBEDDED;
+  ASSERT_TRUE(verifier_->DoesConformToCTEVPolicy(chain_, result));
+}
+
+TEST_F(MultiLogCTVerifierTest, DoesNotConformToCTEVPolicyNotEnoughSCTs) {
+  // We know that the chain_ is valid for 10 years - over 121 months - so
+  // 5 SCTs are required. However, as there are only two logs, two SCTs
+  // will be required - so provide one to guarantee the test fails.
+  ct::CTVerifyResult result;
+  FillResultWithSCTsOfOrigin(
+      ct::SignedCertificateTimestamp::SCT_EMBEDDED,
+      1,
+      &result);
+
+  ASSERT_FALSE(verifier_->DoesConformToCTEVPolicy(chain_, result));
+}
+
+
 }  // namespace
 
 }  // namespace net