CT: Adding SCT verification functionality: A CTLogVerifier instance can verify SCTs signed by a sin…

net/cert/ct_log_verifier_unittest.cc

Index: net/cert/ct_log_verifier_unittest.cc
diff --git a/net/cert/ct_log_verifier_unittest.cc b/net/cert/ct_log_verifier_unittest.cc
new file mode 100644
index 0000000000000000000000000000000000000000..f4edd276e97f1923b882c9da1fee88acde4930cd
--- /dev/null
+++ b/net/cert/ct_log_verifier_unittest.cc
@@ -0,0 +1,78 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/cert/ct_log_verifier.h"
+
+#include <string>
+
+#include "base/time/time.h"
+#include "net/cert/signed_certificate_timestamp.h"
+#include "net/test/ct_test_util.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace net {
+
+class CTLogVerifierTest : public ::testing::Test {
+ public:
+  CTLogVerifierTest() {}
+
+  virtual void SetUp() OVERRIDE {
+    log_ = CTLogVerifier::Create(ct::GetTestPublicKey()).Pass();
+
+    ASSERT_TRUE(log_);
+    ASSERT_EQ(log_->key_id(), ct::GetTestPublicKeyId());
+  }
+
+ protected:
+  scoped_ptr<CTLogVerifier> log_;
+};
+
+TEST_F(CTLogVerifierTest, VerifiesCertSCT) {
+  ct::LogEntry cert_entry;
+  ct::GetX509CertLogEntry(&cert_entry);
+
+  ct::SignedCertificateTimestamp cert_sct;
+  ct::GetX509CertSCT(&cert_sct);
+
+  EXPECT_TRUE(log_->VerifySCT(cert_entry, cert_sct));
+}
+
+TEST_F(CTLogVerifierTest, VerifiesPrecertSCT) {
+  ct::LogEntry precert_entry;
+  ct::GetPrecertLogEntry(&precert_entry);
+
+  ct::SignedCertificateTimestamp precert_sct;
+  ct::GetPrecertSCT(&precert_sct);
+
+  EXPECT_TRUE(log_->VerifySCT(precert_entry, precert_sct));
+}
+
+TEST_F(CTLogVerifierTest, FailsInvalidTimestamp) {
+  ct::LogEntry cert_entry;
+  ct::GetX509CertLogEntry(&cert_entry);
+
+  ct::SignedCertificateTimestamp cert_sct;
+  ct::GetX509CertSCT(&cert_sct);
+
+  // Mangle the timestamp, so that it should fail signature validation.
+  cert_sct.timestamp = base::Time::Now();
+
+  EXPECT_FALSE(log_->VerifySCT(cert_entry, cert_sct));
+}
+
+TEST_F(CTLogVerifierTest, FailsInvalidLogID) {
+  ct::LogEntry cert_entry;
+  ct::GetX509CertLogEntry(&cert_entry);
+
+  ct::SignedCertificateTimestamp cert_sct;
+  ct::GetX509CertSCT(&cert_sct);
+
+  // Mangle the log ID, which should cause it to match a different log before
+  // ever attempting signature validation.

[wtc, 2013/11/08 21:51:14]

Nit: is "ever" a typo of "even"?

[Eran M. (Google), 2013/11/12 12:01:28]

It was just confusing - removed the word entirely.

+  cert_sct.log_id = std::string(cert_sct.log_id.size(), '\0');

[wtc, 2013/11/08 21:51:14]

Nit: you can use the assign method to avoid the constructor.

[Eran M. (Google), 2013/11/12 12:01:28]

Done.

+
+  EXPECT_FALSE(log_->VerifySCT(cert_entry, cert_sct));
+}
+
+}  // namespace net