1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/cert/multi_log_ct_verifier.h"
6
7 #include <string>
8
9 #include "base/file_util.h"
10 #include "base/files/file_path.h"
11 #include "net/base/capturing_net_log.h"
12 #include "net/base/net_errors.h"
13 #include "net/base/net_log.h"
14 #include "net/base/test_data_directory.h"
15 #include "net/cert/ct_log_verifier.h"
16 #include "net/cert/ct_serialization.h"
17 #include "net/cert/ct_verify_result.h"
18 #include "net/cert/pem_tokenizer.h"
19 #include "net/cert/signed_certificate_timestamp.h"
20 #include "net/cert/x509_certificate.h"
21 #include "net/test/cert_test_util.h"
22 #include "net/test/ct_test_util.h"
23 #include "testing/gtest/include/gtest/gtest.h"
24
25 namespace net {
26
27 namespace {
28
29 const char kLogDescription[] = "somelog";
30
31 class MultiLogCTVerifierTest : public ::testing::Test {
32 public:
SetUp()33 virtual void SetUp() OVERRIDE {
34 scoped_ptr<CTLogVerifier> log(
35 CTLogVerifier::Create(ct::GetTestPublicKey(), kLogDescription));
36 ASSERT_TRUE(log);
37
38 verifier_.reset(new MultiLogCTVerifier());
39 verifier_->AddLog(log.Pass());
40 std::string der_test_cert(ct::GetDerEncodedX509Cert());
41 chain_ = X509Certificate::CreateFromBytes(
42 der_test_cert.data(),
43 der_test_cert.length());
44 ASSERT_TRUE(chain_);
45 }
46
CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult & result)47 bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) {
48 return (result.verified_scts.size() == 1U) &&
49 result.invalid_scts.empty() &&
50 result.unknown_logs_scts.empty() &&
51 result.verified_scts[0]->log_description == kLogDescription;
52 }
53
CheckForSCTOrigin(const ct::CTVerifyResult & result,ct::SignedCertificateTimestamp::Origin origin)54 bool CheckForSCTOrigin(
55 const ct::CTVerifyResult& result,
56 ct::SignedCertificateTimestamp::Origin origin) {
57 return (result.verified_scts.size() > 0) &&
58 (result.verified_scts[0]->origin == origin);
59 }
60
CheckForEmbeddedSCTInNetLog(CapturingNetLog & net_log)61 bool CheckForEmbeddedSCTInNetLog(CapturingNetLog& net_log) {
62 CapturingNetLog::CapturedEntryList entries;
63 net_log.GetEntries(&entries);
64 if (entries.size() != 2)
65 return false;
66
67 const CapturingNetLog::CapturedEntry& received(entries[0]);
68 std::string embedded_scts;
69 if (!received.GetStringValue("embedded_scts", &embedded_scts))
70 return false;
71 if (embedded_scts.empty())
72 return false;
73
74 //XXX(eranm): entries[1] is the NetLog message with the checked SCTs.
75 //When CapturedEntry has methods to get a dictionary, rather than just
76 //a string, add more checks here.
77
78 return true;
79 }
80
CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain)81 bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) {
82 ct::CTVerifyResult result;
83 CapturingNetLog net_log;
84 BoundNetLog bound_net_log =
85 BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB);
86 return (verifier_->Verify(chain, std::string(), std::string(), &result,
87 bound_net_log) == OK) &&
88 CheckForSingleVerifiedSCTInResult(result) &&
89 CheckForSCTOrigin(
90 result, ct::SignedCertificateTimestamp::SCT_EMBEDDED) &&
91 CheckForEmbeddedSCTInNetLog(net_log);
92 }
93
94 protected:
95 scoped_ptr<MultiLogCTVerifier> verifier_;
96 scoped_refptr<X509Certificate> chain_;
97 };
98
TEST_F(MultiLogCTVerifierTest,VerifiesEmbeddedSCT)99 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCT) {
100 scoped_refptr<X509Certificate> chain(
101 CreateCertificateChainFromFile(GetTestCertsDirectory(),
102 "ct-test-embedded-cert.pem",
103 X509Certificate::FORMAT_AUTO));
104 ASSERT_TRUE(chain);
105 ASSERT_TRUE(CheckPrecertificateVerification(chain));
106 }
107
TEST_F(MultiLogCTVerifierTest,VerifiesEmbeddedSCTWithPreCA)108 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithPreCA) {
109 scoped_refptr<X509Certificate> chain(
110 CreateCertificateChainFromFile(GetTestCertsDirectory(),
111 "ct-test-embedded-with-preca-chain.pem",
112 X509Certificate::FORMAT_AUTO));
113 ASSERT_TRUE(chain);
114 ASSERT_TRUE(CheckPrecertificateVerification(chain));
115 }
116
TEST_F(MultiLogCTVerifierTest,VerifiesEmbeddedSCTWithIntermediate)117 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithIntermediate) {
118 scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile(
119 GetTestCertsDirectory(),
120 "ct-test-embedded-with-intermediate-chain.pem",
121 X509Certificate::FORMAT_AUTO));
122 ASSERT_TRUE(chain);
123 ASSERT_TRUE(CheckPrecertificateVerification(chain));
124 }
125
TEST_F(MultiLogCTVerifierTest,VerifiesEmbeddedSCTWithIntermediateAndPreCA)126 TEST_F(MultiLogCTVerifierTest,
127 VerifiesEmbeddedSCTWithIntermediateAndPreCA) {
128 scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile(
129 GetTestCertsDirectory(),
130 "ct-test-embedded-with-intermediate-preca-chain.pem",
131 X509Certificate::FORMAT_AUTO));
132 ASSERT_TRUE(chain);
133 ASSERT_TRUE(CheckPrecertificateVerification(chain));
134 }
135
TEST_F(MultiLogCTVerifierTest,VerifiesSCTOverX509Cert)136 TEST_F(MultiLogCTVerifierTest,
137 VerifiesSCTOverX509Cert) {
138 std::string sct(ct::GetTestSignedCertificateTimestamp());
139
140 std::string sct_list;
141 ASSERT_TRUE(ct::EncodeSCTListForTesting(sct, &sct_list));
142
143 ct::CTVerifyResult result;
144 EXPECT_EQ(OK,
145 verifier_->Verify(chain_, std::string(), sct_list, &result,
146 BoundNetLog()));
147 ASSERT_TRUE(CheckForSingleVerifiedSCTInResult(result));
148 ASSERT_TRUE(CheckForSCTOrigin(
149 result, ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION));
150 }
151
TEST_F(MultiLogCTVerifierTest,IdentifiesSCTFromUnknownLog)152 TEST_F(MultiLogCTVerifierTest,
153 IdentifiesSCTFromUnknownLog) {
154 std::string sct(ct::GetTestSignedCertificateTimestamp());
155
156 // Change a byte inside the Log ID part of the SCT so it does
157 // not match the log used in the tests
158 sct[15] = 't';
159
160 std::string sct_list;
161 ASSERT_TRUE(ct::EncodeSCTListForTesting(sct, &sct_list));
162
163 ct::CTVerifyResult result;
164 EXPECT_NE(OK,
165 verifier_->Verify(chain_, std::string(), sct_list, &result,
166 BoundNetLog()));
167 EXPECT_EQ(1U, result.unknown_logs_scts.size());
168 EXPECT_EQ("", result.unknown_logs_scts[0]->log_description);
169 }
170
171 } // namespace
172
173 } // namespace net
174