| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/cert/multi_log_ct_verifier.h" | |
| 6 | |
| 7 #include <string> | |
| 8 | |
| 9 #include "base/files/file_path.h" | |
| 10 #include "base/files/file_util.h" | |
| 11 #include "base/metrics/histogram.h" | |
| 12 #include "base/metrics/histogram_samples.h" | |
| 13 #include "base/metrics/statistics_recorder.h" | |
| 14 #include "base/values.h" | |
| 15 #include "net/base/capturing_net_log.h" | |
| 16 #include "net/base/net_errors.h" | |
| 17 #include "net/base/net_log.h" | |
| 18 #include "net/base/test_data_directory.h" | |
| 19 #include "net/cert/ct_log_verifier.h" | |
| 20 #include "net/cert/ct_serialization.h" | |
| 21 #include "net/cert/ct_verify_result.h" | |
| 22 #include "net/cert/pem_tokenizer.h" | |
| 23 #include "net/cert/sct_status_flags.h" | |
| 24 #include "net/cert/signed_certificate_timestamp.h" | |
| 25 #include "net/cert/x509_certificate.h" | |
| 26 #include "net/test/cert_test_util.h" | |
| 27 #include "net/test/ct_test_util.h" | |
| 28 #include "testing/gtest/include/gtest/gtest.h" | |
| 29 | |
| 30 namespace net { | |
| 31 | |
| 32 namespace { | |
| 33 | |
| 34 const char kLogDescription[] = "somelog"; | |
| 35 const char kSCTCountHistogram[] = | |
| 36 "Net.CertificateTransparency.SCTsPerConnection"; | |
| 37 | |
| 38 class MultiLogCTVerifierTest : public ::testing::Test { | |
| 39 public: | |
| 40 void SetUp() override { | |
| 41 scoped_ptr<CTLogVerifier> log( | |
| 42 CTLogVerifier::Create(ct::GetTestPublicKey(), kLogDescription)); | |
| 43 ASSERT_TRUE(log); | |
| 44 | |
| 45 verifier_.reset(new MultiLogCTVerifier()); | |
| 46 verifier_->AddLog(log.Pass()); | |
| 47 std::string der_test_cert(ct::GetDerEncodedX509Cert()); | |
| 48 chain_ = X509Certificate::CreateFromBytes( | |
| 49 der_test_cert.data(), | |
| 50 der_test_cert.length()); | |
| 51 ASSERT_TRUE(chain_.get()); | |
| 52 | |
| 53 embedded_sct_chain_ = | |
| 54 CreateCertificateChainFromFile(GetTestCertsDirectory(), | |
| 55 "ct-test-embedded-cert.pem", | |
| 56 X509Certificate::FORMAT_AUTO); | |
| 57 ASSERT_TRUE(embedded_sct_chain_.get()); | |
| 58 } | |
| 59 | |
| 60 bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) { | |
| 61 return (result.verified_scts.size() == 1U) && | |
| 62 result.invalid_scts.empty() && | |
| 63 result.unknown_logs_scts.empty() && | |
| 64 result.verified_scts[0]->log_description == kLogDescription; | |
| 65 } | |
| 66 | |
| 67 bool CheckForSCTOrigin( | |
| 68 const ct::CTVerifyResult& result, | |
| 69 ct::SignedCertificateTimestamp::Origin origin) { | |
| 70 return (result.verified_scts.size() > 0) && | |
| 71 (result.verified_scts[0]->origin == origin); | |
| 72 } | |
| 73 | |
| 74 bool CheckForEmbeddedSCTInNetLog(CapturingNetLog& net_log) { | |
| 75 CapturingNetLog::CapturedEntryList entries; | |
| 76 net_log.GetEntries(&entries); | |
| 77 if (entries.size() != 2) | |
| 78 return false; | |
| 79 | |
| 80 const CapturingNetLog::CapturedEntry& received = entries[0]; | |
| 81 std::string embedded_scts; | |
| 82 if (!received.GetStringValue("embedded_scts", &embedded_scts)) | |
| 83 return false; | |
| 84 if (embedded_scts.empty()) | |
| 85 return false; | |
| 86 | |
| 87 const CapturingNetLog::CapturedEntry& parsed = entries[1]; | |
| 88 base::ListValue* verified_scts; | |
| 89 if (!parsed.GetListValue("verified_scts", &verified_scts) || | |
| 90 verified_scts->GetSize() != 1) { | |
| 91 return false; | |
| 92 } | |
| 93 | |
| 94 base::DictionaryValue* the_sct; | |
| 95 if (!verified_scts->GetDictionary(0, &the_sct)) | |
| 96 return false; | |
| 97 | |
| 98 std::string origin; | |
| 99 if (!the_sct->GetString("origin", &origin)) | |
| 100 return false; | |
| 101 if (origin != "embedded_in_certificate") | |
| 102 return false; | |
| 103 | |
| 104 base::ListValue* other_scts; | |
| 105 if (!parsed.GetListValue("invalid_scts", &other_scts) || | |
| 106 !other_scts->empty()) { | |
| 107 return false; | |
| 108 } | |
| 109 | |
| 110 if (!parsed.GetListValue("unknown_logs_scts", &other_scts) || | |
| 111 !other_scts->empty()) { | |
| 112 return false; | |
| 113 } | |
| 114 | |
| 115 return true; | |
| 116 } | |
| 117 | |
| 118 std::string GetSCTListWithInvalidSCT() { | |
| 119 std::string sct(ct::GetTestSignedCertificateTimestamp()); | |
| 120 | |
| 121 // Change a byte inside the Log ID part of the SCT so it does | |
| 122 // not match the log used in the tests | |
| 123 sct[15] = 't'; | |
| 124 | |
| 125 std::string sct_list; | |
| 126 ct::EncodeSCTListForTesting(sct, &sct_list); | |
| 127 return sct_list; | |
| 128 } | |
| 129 | |
| 130 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain, | |
| 131 const BoundNetLog& bound_net_log, | |
| 132 ct::CTVerifyResult* result) { | |
| 133 return verifier_->Verify(chain.get(), | |
| 134 std::string(), | |
| 135 std::string(), | |
| 136 result, | |
| 137 bound_net_log) == OK; | |
| 138 } | |
| 139 | |
| 140 bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) { | |
| 141 ct::CTVerifyResult result; | |
| 142 CapturingNetLog net_log; | |
| 143 BoundNetLog bound_net_log = | |
| 144 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); | |
| 145 | |
| 146 return verifier_->Verify(chain.get(), | |
| 147 std::string(), | |
| 148 std::string(), | |
| 149 &result, | |
| 150 bound_net_log) == OK; | |
| 151 } | |
| 152 | |
| 153 bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) { | |
| 154 ct::CTVerifyResult result; | |
| 155 CapturingNetLog net_log; | |
| 156 BoundNetLog bound_net_log = | |
| 157 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); | |
| 158 return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) && | |
| 159 CheckForSingleVerifiedSCTInResult(result) && | |
| 160 CheckForSCTOrigin(result, | |
| 161 ct::SignedCertificateTimestamp::SCT_EMBEDDED) && | |
| 162 CheckForEmbeddedSCTInNetLog(net_log)); | |
| 163 } | |
| 164 | |
| 165 // Histogram-related helper methods | |
| 166 int GetValueFromHistogram(std::string histogram_name, int sample_index) { | |
| 167 base::Histogram* histogram = static_cast<base::Histogram*>( | |
| 168 base::StatisticsRecorder::FindHistogram(histogram_name)); | |
| 169 | |
| 170 if (histogram == NULL) | |
| 171 return 0; | |
| 172 | |
| 173 scoped_ptr<base::HistogramSamples> samples = histogram->SnapshotSamples(); | |
| 174 return samples->GetCount(sample_index); | |
| 175 } | |
| 176 | |
| 177 int NumConnectionsWithSingleSCT() { | |
| 178 return GetValueFromHistogram(kSCTCountHistogram, 1); | |
| 179 } | |
| 180 | |
| 181 int NumEmbeddedSCTsInHistogram() { | |
| 182 return GetValueFromHistogram("Net.CertificateTransparency.SCTOrigin", | |
| 183 ct::SignedCertificateTimestamp::SCT_EMBEDDED); | |
| 184 } | |
| 185 | |
| 186 int NumValidSCTsInStatusHistogram() { | |
| 187 return GetValueFromHistogram("Net.CertificateTransparency.SCTStatus", | |
| 188 ct::SCT_STATUS_OK); | |
| 189 } | |
| 190 | |
| 191 protected: | |
| 192 scoped_ptr<MultiLogCTVerifier> verifier_; | |
| 193 scoped_refptr<X509Certificate> chain_; | |
| 194 scoped_refptr<X509Certificate> embedded_sct_chain_; | |
| 195 }; | |
| 196 | |
| 197 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCT) { | |
| 198 ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_)); | |
| 199 } | |
| 200 | |
| 201 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithPreCA) { | |
| 202 scoped_refptr<X509Certificate> chain( | |
| 203 CreateCertificateChainFromFile(GetTestCertsDirectory(), | |
| 204 "ct-test-embedded-with-preca-chain.pem", | |
| 205 X509Certificate::FORMAT_AUTO)); | |
| 206 ASSERT_TRUE(chain.get()); | |
| 207 ASSERT_TRUE(CheckPrecertificateVerification(chain)); | |
| 208 } | |
| 209 | |
| 210 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithIntermediate) { | |
| 211 scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile( | |
| 212 GetTestCertsDirectory(), | |
| 213 "ct-test-embedded-with-intermediate-chain.pem", | |
| 214 X509Certificate::FORMAT_AUTO)); | |
| 215 ASSERT_TRUE(chain.get()); | |
| 216 ASSERT_TRUE(CheckPrecertificateVerification(chain)); | |
| 217 } | |
| 218 | |
| 219 TEST_F(MultiLogCTVerifierTest, | |
| 220 VerifiesEmbeddedSCTWithIntermediateAndPreCA) { | |
| 221 scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile( | |
| 222 GetTestCertsDirectory(), | |
| 223 "ct-test-embedded-with-intermediate-preca-chain.pem", | |
| 224 X509Certificate::FORMAT_AUTO)); | |
| 225 ASSERT_TRUE(chain.get()); | |
| 226 ASSERT_TRUE(CheckPrecertificateVerification(chain)); | |
| 227 } | |
| 228 | |
| 229 TEST_F(MultiLogCTVerifierTest, | |
| 230 VerifiesSCTOverX509Cert) { | |
| 231 std::string sct(ct::GetTestSignedCertificateTimestamp()); | |
| 232 | |
| 233 std::string sct_list; | |
| 234 ASSERT_TRUE(ct::EncodeSCTListForTesting(sct, &sct_list)); | |
| 235 | |
| 236 ct::CTVerifyResult result; | |
| 237 EXPECT_EQ(OK, | |
| 238 verifier_->Verify( | |
| 239 chain_.get(), std::string(), sct_list, &result, BoundNetLog())); | |
| 240 ASSERT_TRUE(CheckForSingleVerifiedSCTInResult(result)); | |
| 241 ASSERT_TRUE(CheckForSCTOrigin( | |
| 242 result, ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); | |
| 243 } | |
| 244 | |
| 245 TEST_F(MultiLogCTVerifierTest, | |
| 246 IdentifiesSCTFromUnknownLog) { | |
| 247 std::string sct_list = GetSCTListWithInvalidSCT(); | |
| 248 ct::CTVerifyResult result; | |
| 249 | |
| 250 EXPECT_NE(OK, | |
| 251 verifier_->Verify( | |
| 252 chain_.get(), std::string(), sct_list, &result, BoundNetLog())); | |
| 253 EXPECT_EQ(1U, result.unknown_logs_scts.size()); | |
| 254 EXPECT_EQ("", result.unknown_logs_scts[0]->log_description); | |
| 255 } | |
| 256 | |
| 257 TEST_F(MultiLogCTVerifierTest, CountsValidSCTsInStatusHistogram) { | |
| 258 int num_valid_scts = NumValidSCTsInStatusHistogram(); | |
| 259 | |
| 260 ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_)); | |
| 261 | |
| 262 EXPECT_EQ(num_valid_scts + 1, NumValidSCTsInStatusHistogram()); | |
| 263 } | |
| 264 | |
| 265 TEST_F(MultiLogCTVerifierTest, CountsInvalidSCTsInStatusHistogram) { | |
| 266 std::string sct_list = GetSCTListWithInvalidSCT(); | |
| 267 ct::CTVerifyResult result; | |
| 268 int num_valid_scts = NumValidSCTsInStatusHistogram(); | |
| 269 int num_invalid_scts = GetValueFromHistogram( | |
| 270 "Net.CertificateTransparency.SCTStatus", ct::SCT_STATUS_LOG_UNKNOWN); | |
| 271 | |
| 272 EXPECT_NE(OK, | |
| 273 verifier_->Verify( | |
| 274 chain_.get(), std::string(), sct_list, &result, BoundNetLog())); | |
| 275 | |
| 276 ASSERT_EQ(num_valid_scts, NumValidSCTsInStatusHistogram()); | |
| 277 ASSERT_EQ(num_invalid_scts + 1, | |
| 278 GetValueFromHistogram("Net.CertificateTransparency.SCTStatus", | |
| 279 ct::SCT_STATUS_LOG_UNKNOWN)); | |
| 280 } | |
| 281 | |
| 282 TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInConnectionsHistogram) { | |
| 283 int old_sct_count = NumConnectionsWithSingleSCT(); | |
| 284 ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_)); | |
| 285 EXPECT_EQ(old_sct_count + 1, NumConnectionsWithSingleSCT()); | |
| 286 } | |
| 287 | |
| 288 TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInOriginsHistogram) { | |
| 289 int old_embedded_count = NumEmbeddedSCTsInHistogram(); | |
| 290 ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_)); | |
| 291 EXPECT_EQ(old_embedded_count + 1, NumEmbeddedSCTsInHistogram()); | |
| 292 } | |
| 293 | |
| 294 TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) { | |
| 295 int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0); | |
| 296 EXPECT_FALSE(VerifySinglePrecertificateChain(chain_)); | |
| 297 ASSERT_EQ(connections_without_scts + 1, | |
| 298 GetValueFromHistogram(kSCTCountHistogram, 0)); | |
| 299 } | |
| 300 | |
| 301 } // namespace | |
| 302 | |
| 303 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master