OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/cert_policy_enforcer.h" | 5 #include "net/cert/cert_policy_enforcer.h" |
6 | 6 |
7 #include <string> | 7 #include <string> |
8 | 8 |
9 #include "base/memory/scoped_ptr.h" | 9 #include "base/memory/scoped_ptr.h" |
10 #include "net/base/test_data_directory.h" | 10 #include "net/base/test_data_directory.h" |
(...skipping 26 matching lines...) Expand all Loading... |
37 ~DummyEVCertsWhitelist() override {} | 37 ~DummyEVCertsWhitelist() override {} |
38 | 38 |
39 private: | 39 private: |
40 bool canned_is_valid_; | 40 bool canned_is_valid_; |
41 bool canned_contains_response_; | 41 bool canned_contains_response_; |
42 }; | 42 }; |
43 | 43 |
44 class CertPolicyEnforcerTest : public ::testing::Test { | 44 class CertPolicyEnforcerTest : public ::testing::Test { |
45 public: | 45 public: |
46 virtual void SetUp() override { | 46 virtual void SetUp() override { |
47 policy_enforcer_.reset(new CertPolicyEnforcer(5, true)); | 47 policy_enforcer_.reset(new CertPolicyEnforcer(true)); |
48 | 48 |
49 std::string der_test_cert(ct::GetDerEncodedX509Cert()); | 49 std::string der_test_cert(ct::GetDerEncodedX509Cert()); |
50 chain_ = X509Certificate::CreateFromBytes(der_test_cert.data(), | 50 chain_ = X509Certificate::CreateFromBytes(der_test_cert.data(), |
51 der_test_cert.size()); | 51 der_test_cert.size()); |
52 ASSERT_TRUE(chain_.get()); | 52 ASSERT_TRUE(chain_.get()); |
53 } | 53 } |
54 | 54 |
55 void FillResultWithSCTsOfOrigin( | 55 void FillResultWithSCTsOfOrigin( |
56 ct::SignedCertificateTimestamp::Origin desired_origin, | 56 ct::SignedCertificateTimestamp::Origin desired_origin, |
57 int num_scts, | 57 int num_scts, |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
102 chain_.get(), non_including_whitelist.get(), result)); | 102 chain_.get(), non_including_whitelist.get(), result)); |
103 | 103 |
104 // ... but should be OK if whitelisted. | 104 // ... but should be OK if whitelisted. |
105 scoped_refptr<ct::EVCertsWhitelist> whitelist( | 105 scoped_refptr<ct::EVCertsWhitelist> whitelist( |
106 new DummyEVCertsWhitelist(true, true)); | 106 new DummyEVCertsWhitelist(true, true)); |
107 EXPECT_TRUE(policy_enforcer_->DoesConformToCTEVPolicy( | 107 EXPECT_TRUE(policy_enforcer_->DoesConformToCTEVPolicy( |
108 chain_.get(), whitelist.get(), result)); | 108 chain_.get(), whitelist.get(), result)); |
109 } | 109 } |
110 | 110 |
111 TEST_F(CertPolicyEnforcerTest, DoesNotEnforceCTPolicyIfNotRequired) { | 111 TEST_F(CertPolicyEnforcerTest, DoesNotEnforceCTPolicyIfNotRequired) { |
112 scoped_ptr<CertPolicyEnforcer> enforcer(new CertPolicyEnforcer(3, false)); | 112 scoped_ptr<CertPolicyEnforcer> enforcer(new CertPolicyEnforcer(false)); |
113 | 113 |
114 ct::CTVerifyResult result; | 114 ct::CTVerifyResult result; |
115 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, | 115 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, |
116 &result); | 116 &result); |
117 // Expect true despite the chain not having enough SCTs as the policy | 117 // Expect true despite the chain not having enough SCTs as the policy |
118 // is not enforced. | 118 // is not enforced. |
119 EXPECT_TRUE(enforcer->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); | 119 EXPECT_TRUE(enforcer->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); |
120 } | 120 } |
121 | 121 |
122 TEST_F(CertPolicyEnforcerTest, DoesNotConformToPolicyInvalidDates) { | 122 TEST_F(CertPolicyEnforcerTest, DoesNotConformToPolicyInvalidDates) { |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
157 << " for: " << curr_validity << " and " << curr_required_scts | 157 << " for: " << curr_validity << " and " << curr_required_scts |
158 << " scts=" << result.verified_scts.size() << " j=" << j; | 158 << " scts=" << result.verified_scts.size() << " j=" << j; |
159 } | 159 } |
160 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, | 160 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, |
161 &result); | 161 &result); |
162 EXPECT_TRUE( | 162 EXPECT_TRUE( |
163 policy_enforcer_->DoesConformToCTEVPolicy(cert.get(), nullptr, result)); | 163 policy_enforcer_->DoesConformToCTEVPolicy(cert.get(), nullptr, result)); |
164 } | 164 } |
165 } | 165 } |
166 | 166 |
167 TEST_F(CertPolicyEnforcerTest, | |
168 ConformsToPolicyButDoesNotRequireMoreThanNumLogs) { | |
169 scoped_ptr<CertPolicyEnforcer> enforcer(new CertPolicyEnforcer(2, true)); | |
170 | |
171 ct::CTVerifyResult result; | |
172 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 2, | |
173 &result); | |
174 // Expect true despite the chain not having enough SCTs according to the | |
175 // policy | |
176 // since we only have 2 logs. | |
177 EXPECT_TRUE(enforcer->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); | |
178 } | |
179 | |
180 TEST_F(CertPolicyEnforcerTest, ConformsToPolicyByEVWhitelistPresence) { | 167 TEST_F(CertPolicyEnforcerTest, ConformsToPolicyByEVWhitelistPresence) { |
181 scoped_refptr<ct::EVCertsWhitelist> whitelist( | 168 scoped_refptr<ct::EVCertsWhitelist> whitelist( |
182 new DummyEVCertsWhitelist(true, true)); | 169 new DummyEVCertsWhitelist(true, true)); |
183 | 170 |
184 ct::CTVerifyResult result; | 171 ct::CTVerifyResult result; |
185 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, | 172 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, |
186 &result); | 173 &result); |
187 EXPECT_TRUE(policy_enforcer_->DoesConformToCTEVPolicy( | 174 EXPECT_TRUE(policy_enforcer_->DoesConformToCTEVPolicy( |
188 chain_.get(), whitelist.get(), result)); | 175 chain_.get(), whitelist.get(), result)); |
189 } | 176 } |
(...skipping 13 matching lines...) Expand all Loading... |
203 ct::CTVerifyResult result; | 190 ct::CTVerifyResult result; |
204 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, | 191 FillResultWithSCTsOfOrigin(ct::SignedCertificateTimestamp::SCT_EMBEDDED, 1, |
205 &result); | 192 &result); |
206 EXPECT_FALSE( | 193 EXPECT_FALSE( |
207 policy_enforcer_->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); | 194 policy_enforcer_->DoesConformToCTEVPolicy(chain_.get(), nullptr, result)); |
208 } | 195 } |
209 | 196 |
210 } // namespace | 197 } // namespace |
211 | 198 |
212 } // namespace net | 199 } // namespace net |
OLD | NEW |