| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/cert_policy_enforcer.h" | 5 #include "net/cert/cert_policy_enforcer.h" |
| 6 | 6 |
| 7 #include <string> | 7 #include <string> |
| 8 | 8 |
| 9 #include "base/memory/scoped_ptr.h" | 9 #include "base/memory/scoped_ptr.h" |
| 10 #include "net/base/test_data_directory.h" | 10 #include "net/base/test_data_directory.h" |
| (...skipping 26 matching lines...) Expand all Loading... |
| 37 ~DummyEVCertsWhitelist() override {} | 37 ~DummyEVCertsWhitelist() override {} |
| 38 | 38 |
| 39 private: | 39 private: |
| 40 bool canned_is_valid_; | 40 bool canned_is_valid_; |
| 41 bool canned_contains_response_; | 41 bool canned_contains_response_; |
| 42 }; | 42 }; |
| 43 | 43 |
| 44 class CertPolicyEnforcerTest : public ::testing::Test { | 44 class CertPolicyEnforcerTest : public ::testing::Test { |
| 45 public: | 45 public: |
| 46 virtual void SetUp() override { | 46 virtual void SetUp() override { |
| 47 policy_enforcer_.reset(new CertPolicyEnforcer(5, true)); | 47 policy_enforcer_.reset(new CertPolicyEnforcer(true)); |
| 48 | 48 |
| 49 std::string der_test_cert(ct::GetDerEncodedX509Cert()); | 49 std::string der_test_cert(ct::GetDerEncodedX509Cert()); |
| 50 chain_ = X509Certificate::CreateFromBytes(der_test_cert.data(), | 50 chain_ = X509Certificate::CreateFromBytes(der_test_cert.data(), |
| 51 der_test_cert.size()); | 51 der_test_cert.size()); |
| 52 ASSERT_TRUE(chain_.get()); | 52 ASSERT_TRUE(chain_.get()); |
| 53 } | 53 } |
| 54 | 54 |
| 55 void FillResultWithSCTsOfOrigin( | 55 void FillResultWithSCTsOfOrigin( |
| 56 ct::SignedCertificateTimestamp::Origin desired_origin, | 56 ct::SignedCertificateTimestamp::Origin desired_origin, |
| 57 int num_scts, | 57 int num_scts, |
| (...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 102 chain_.get(), non_including_whitelist.get(), result)); | 102 chain_.get(), non_including_whitelist.get(), result)); |
| 103 | 103 |
| 104 // ... but should be OK if whitelisted. | 104 // ... but should be OK if whitelisted. |
| 105 scoped_refptr<ct::EVCertsWhitelist> whitelist( | 105 scoped_refptr<ct::EVCertsWhitelist> whitelist( |
| 106 new DummyEVCertsWhitelist(true, true)); | 106 new DummyEVCertsWhitelist(true, true)); |
| 107 EXPECT_TRUE(policy_enforcer_->DoesConformToCTEVPolicy( | 107 EXPECT_TRUE(policy_enforcer_->DoesConformToCTEVPolicy( |
| 108 chain_.get(), whitelist.get(), result)); | 108 chain_.get(), whitelist.get(), result)); |
| 109 } | 109 } |
| 110 | 110 |
| 111 TEST_F(CertPolicyEnforcerTest, DoesNotEnforceCTPolicyIfNotRequired) { | 111 TEST_F(CertPolicyEnforcerTest, DoesNotEnforceCTPolicyIfNotRequired) { |
| 112 scoped_ptr<CertPolicyEnforcer> enforcer(new CertPolicyEnforcer(3, false)); | 112 scoped_ptr<CertPolicyEnforcer> enforcer(new CertPolicyEnforcer(false)); |
| 113 | 113 |
| 114 ct::CTVerifyResult result; | 114 ct::CTVerifyResult result; |
| 115 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, | 115 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, |
| 116 &result); | 116 &result); |
| 117 // Expect true despite the chain not having enough SCTs as the policy | 117 // Expect true despite the chain not having enough SCTs as the policy |
| 118 // is not enforced. | 118 // is not enforced. |
| 119 EXPECT_TRUE(enforcer->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); | 119 EXPECT_TRUE(enforcer->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); |
| 120 } | 120 } |
| 121 | 121 |
| 122 TEST_F(CertPolicyEnforcerTest, DoesNotConformToPolicyInvalidDates) { | 122 TEST_F(CertPolicyEnforcerTest, DoesNotConformToPolicyInvalidDates) { |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 157 << " for: " << curr_validity << " and " << curr_required_scts | 157 << " for: " << curr_validity << " and " << curr_required_scts |
| 158 << " scts=" << result.verified_scts.size() << " j=" << j; | 158 << " scts=" << result.verified_scts.size() << " j=" << j; |
| 159 } | 159 } |
| 160 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, | 160 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, |
| 161 &result); | 161 &result); |
| 162 EXPECT_TRUE( | 162 EXPECT_TRUE( |
| 163 policy_enforcer_->DoesConformToCTEVPolicy(cert.get(), nullptr, result)); | 163 policy_enforcer_->DoesConformToCTEVPolicy(cert.get(), nullptr, result)); |
| 164 } | 164 } |
| 165 } | 165 } |
| 166 | 166 |
| 167 TEST_F(CertPolicyEnforcerTest, | |
| 168 ConformsToPolicyButDoesNotRequireMoreThanNumLogs) { | |
| 169 scoped_ptr<CertPolicyEnforcer> enforcer(new CertPolicyEnforcer(2, true)); | |
| 170 | |
| 171 ct::CTVerifyResult result; | |
| 172 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | |
| 173 &result); | |
| 174 // Expect true despite the chain not having enough SCTs according to the | |
| 175 // policy | |
| 176 // since we only have 2 logs. | |
| 177 EXPECT_TRUE(enforcer->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); | |
| 178 } | |
| 179 | |
| 180 TEST_F(CertPolicyEnforcerTest, ConformsToPolicyByEVWhitelistPresence) { | 167 TEST_F(CertPolicyEnforcerTest, ConformsToPolicyByEVWhitelistPresence) { |
| 181 scoped_refptr<ct::EVCertsWhitelist> whitelist( | 168 scoped_refptr<ct::EVCertsWhitelist> whitelist( |
| 182 new DummyEVCertsWhitelist(true, true)); | 169 new DummyEVCertsWhitelist(true, true)); |
| 183 | 170 |
| 184 ct::CTVerifyResult result; | 171 ct::CTVerifyResult result; |
| 185 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, | 172 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, |
| 186 &result); | 173 &result); |
| 187 EXPECT_TRUE(policy_enforcer_->DoesConformToCTEVPolicy( | 174 EXPECT_TRUE(policy_enforcer_->DoesConformToCTEVPolicy( |
| 188 chain_.get(), whitelist.get(), result)); | 175 chain_.get(), whitelist.get(), result)); |
| 189 } | 176 } |
| (...skipping 13 matching lines...) Expand all Loading... |
| 203 ct::CTVerifyResult result; | 190 ct::CTVerifyResult result; |
| 204 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, | 191 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, |
| 205 &result); | 192 &result); |
| 206 EXPECT_FALSE( | 193 EXPECT_FALSE( |
| 207 policy_enforcer_->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); | 194 policy_enforcer_->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); |
| 208 } | 195 } |
| 209 | 196 |
| 210 } // namespace | 197 } // namespace |
| 211 | 198 |
| 212 } // namespace net | 199 } // namespace net |
| OLD | NEW |