1// Copyright 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "net/cert/multi_log_ct_verifier.h"
6
7#include <string>
8
9#include "base/file_util.h"
10#include "base/files/file_path.h"
11#include "base/metrics/histogram.h"
12#include "base/metrics/histogram_samples.h"
13#include "base/metrics/statistics_recorder.h"
14#include "base/values.h"
15#include "net/base/capturing_net_log.h"
16#include "net/base/net_errors.h"
17#include "net/base/net_log.h"
18#include "net/base/test_data_directory.h"
19#include "net/cert/ct_log_verifier.h"
20#include "net/cert/ct_serialization.h"
21#include "net/cert/ct_verify_result.h"
22#include "net/cert/pem_tokenizer.h"
23#include "net/cert/sct_status_flags.h"
24#include "net/cert/signed_certificate_timestamp.h"
25#include "net/cert/x509_certificate.h"
26#include "net/test/cert_test_util.h"
27#include "net/test/ct_test_util.h"
28#include "testing/gtest/include/gtest/gtest.h"
29
30namespace net {
31
32namespace {
33
34const char kLogDescription[] = "somelog";
35const char kSCTCountHistogram[] =
36    "Net.CertificateTransparency.SCTsPerConnection";
37
38class MultiLogCTVerifierTest : public ::testing::Test {
39 public:
40  virtual void SetUp() OVERRIDE {
41    scoped_ptr<CTLogVerifier> log(
42        CTLogVerifier::Create(ct::GetTestPublicKey(), kLogDescription));
43    ASSERT_TRUE(log);
44
45    verifier_.reset(new MultiLogCTVerifier());
46    verifier_->AddLog(log.Pass());
47    std::string der_test_cert(ct::GetDerEncodedX509Cert());
48    chain_ = X509Certificate::CreateFromBytes(
49        der_test_cert.data(),
50        der_test_cert.length());
51    ASSERT_TRUE(chain_);
52
53    embedded_sct_chain_ =
54        CreateCertificateChainFromFile(GetTestCertsDirectory(),
55                                       "ct-test-embedded-cert.pem",
56                                       X509Certificate::FORMAT_AUTO);
57    ASSERT_TRUE(embedded_sct_chain_);
58  }
59
60  bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) {
61    return (result.verified_scts.size() == 1U) &&
62        result.invalid_scts.empty() &&
63        result.unknown_logs_scts.empty() &&
64        result.verified_scts[0]->log_description == kLogDescription;
65  }
66
67  bool CheckForSCTOrigin(
68      const ct::CTVerifyResult& result,
69      ct::SignedCertificateTimestamp::Origin origin) {
70    return (result.verified_scts.size() > 0) &&
71        (result.verified_scts[0]->origin == origin);
72  }
73
74  bool CheckForEmbeddedSCTInNetLog(CapturingNetLog& net_log) {
75    CapturingNetLog::CapturedEntryList entries;
76    net_log.GetEntries(&entries);
77    if (entries.size() != 2)
78      return false;
79
80    const CapturingNetLog::CapturedEntry& received = entries[0];
81    std::string embedded_scts;
82    if (!received.GetStringValue("embedded_scts", &embedded_scts))
83      return false;
84    if (embedded_scts.empty())
85      return false;
86
87    const CapturingNetLog::CapturedEntry& parsed = entries[1];
88    base::ListValue* verified_scts;
89    if (!parsed.GetListValue("verified_scts", &verified_scts) ||
90        verified_scts->GetSize() != 1) {
91      return false;
92    }
93
94    base::DictionaryValue* the_sct;
95    if (!verified_scts->GetDictionary(0, &the_sct))
96      return false;
97
98    std::string origin;
99    if (!the_sct->GetString("origin", &origin))
100      return false;
101    if (origin != "embedded_in_certificate")
102      return false;
103
104    base::ListValue* other_scts;
105    if (!parsed.GetListValue("invalid_scts", &other_scts) ||
106        !other_scts->empty()) {
107      return false;
108    }
109
110    if (!parsed.GetListValue("unknown_logs_scts", &other_scts) ||
111        !other_scts->empty()) {
112      return false;
113    }
114
115    return true;
116  }
117
118  std::string GetSCTListWithInvalidSCT() {
119    std::string sct(ct::GetTestSignedCertificateTimestamp());
120
121    // Change a byte inside the Log ID part of the SCT so it does
122    // not match the log used in the tests
123    sct[15] = 't';
124
125    std::string sct_list;
126    ct::EncodeSCTListForTesting(sct, &sct_list);
127    return sct_list;
128  }
129
130  bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain,
131                                       const BoundNetLog& bound_net_log,
132                                       ct::CTVerifyResult* result) {
133    return verifier_->Verify(
134               chain, std::string(), std::string(), result, bound_net_log) ==
135           OK;
136  }
137
138  bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) {
139    ct::CTVerifyResult result;
140    CapturingNetLog net_log;
141    BoundNetLog bound_net_log =
142        BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB);
143
144    return verifier_->Verify(
145               chain, std::string(), std::string(), &result, bound_net_log) ==
146           OK;
147  }
148
149  bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) {
150    ct::CTVerifyResult result;
151    CapturingNetLog net_log;
152    BoundNetLog bound_net_log =
153      BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB);
154    return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) &&
155            CheckForSingleVerifiedSCTInResult(result) &&
156            CheckForSCTOrigin(result,
157                              ct::SignedCertificateTimestamp::SCT_EMBEDDED) &&
158            CheckForEmbeddedSCTInNetLog(net_log));
159  }
160
161  // Histogram-related helper methods
162  int GetValueFromHistogram(std::string histogram_name, int sample_index) {
163    base::Histogram* histogram = static_cast<base::Histogram*>(
164        base::StatisticsRecorder::FindHistogram(histogram_name));
165
166    if (histogram == NULL)
167      return 0;
168
169    scoped_ptr<base::HistogramSamples> samples = histogram->SnapshotSamples();
170    return samples->GetCount(sample_index);
171  }
172
173  int NumConnectionsWithSingleSCT() {
174    return GetValueFromHistogram(kSCTCountHistogram, 1);
175  }
176
177  int NumEmbeddedSCTsInHistogram() {
178    return GetValueFromHistogram("Net.CertificateTransparency.SCTOrigin",
179                                 ct::SignedCertificateTimestamp::SCT_EMBEDDED);
180  }
181
182  int NumValidSCTsInStatusHistogram() {
183    return GetValueFromHistogram("Net.CertificateTransparency.SCTStatus",
184                                 ct::SCT_STATUS_OK);
185  }
186
187 protected:
188  scoped_ptr<MultiLogCTVerifier> verifier_;
189  scoped_refptr<X509Certificate> chain_;
190  scoped_refptr<X509Certificate> embedded_sct_chain_;
191};
192
193TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCT) {
194  ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_));
195}
196
197TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithPreCA) {
198  scoped_refptr<X509Certificate> chain(
199      CreateCertificateChainFromFile(GetTestCertsDirectory(),
200                                     "ct-test-embedded-with-preca-chain.pem",
201                                     X509Certificate::FORMAT_AUTO));
202  ASSERT_TRUE(chain);
203  ASSERT_TRUE(CheckPrecertificateVerification(chain));
204}
205
206TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithIntermediate) {
207  scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile(
208      GetTestCertsDirectory(),
209      "ct-test-embedded-with-intermediate-chain.pem",
210      X509Certificate::FORMAT_AUTO));
211  ASSERT_TRUE(chain);
212  ASSERT_TRUE(CheckPrecertificateVerification(chain));
213}
214
215TEST_F(MultiLogCTVerifierTest,
216       VerifiesEmbeddedSCTWithIntermediateAndPreCA) {
217  scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile(
218      GetTestCertsDirectory(),
219      "ct-test-embedded-with-intermediate-preca-chain.pem",
220      X509Certificate::FORMAT_AUTO));
221  ASSERT_TRUE(chain);
222  ASSERT_TRUE(CheckPrecertificateVerification(chain));
223}
224
225TEST_F(MultiLogCTVerifierTest,
226       VerifiesSCTOverX509Cert) {
227  std::string sct(ct::GetTestSignedCertificateTimestamp());
228
229  std::string sct_list;
230  ASSERT_TRUE(ct::EncodeSCTListForTesting(sct, &sct_list));
231
232  ct::CTVerifyResult result;
233  EXPECT_EQ(OK,
234            verifier_->Verify(chain_, std::string(), sct_list, &result,
235                              BoundNetLog()));
236  ASSERT_TRUE(CheckForSingleVerifiedSCTInResult(result));
237  ASSERT_TRUE(CheckForSCTOrigin(
238      result, ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION));
239}
240
241TEST_F(MultiLogCTVerifierTest,
242       IdentifiesSCTFromUnknownLog) {
243  std::string sct_list = GetSCTListWithInvalidSCT();
244  ct::CTVerifyResult result;
245
246  EXPECT_NE(OK,
247            verifier_->Verify(
248                chain_, std::string(), sct_list, &result, BoundNetLog()));
249  EXPECT_EQ(1U, result.unknown_logs_scts.size());
250  EXPECT_EQ("", result.unknown_logs_scts[0]->log_description);
251}
252
253TEST_F(MultiLogCTVerifierTest, CountsValidSCTsInStatusHistogram) {
254  int num_valid_scts = NumValidSCTsInStatusHistogram();
255
256  ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_));
257
258  EXPECT_EQ(num_valid_scts + 1, NumValidSCTsInStatusHistogram());
259}
260
261TEST_F(MultiLogCTVerifierTest, CountsInvalidSCTsInStatusHistogram) {
262  std::string sct_list = GetSCTListWithInvalidSCT();
263  ct::CTVerifyResult result;
264  int num_valid_scts = NumValidSCTsInStatusHistogram();
265  int num_invalid_scts = GetValueFromHistogram(
266      "Net.CertificateTransparency.SCTStatus", ct::SCT_STATUS_LOG_UNKNOWN);
267
268  EXPECT_NE(OK,
269            verifier_->Verify(chain_, std::string(), sct_list, &result,
270                              BoundNetLog()));
271
272  ASSERT_EQ(num_valid_scts, NumValidSCTsInStatusHistogram());
273  ASSERT_EQ(num_invalid_scts + 1,
274            GetValueFromHistogram("Net.CertificateTransparency.SCTStatus",
275                                  ct::SCT_STATUS_LOG_UNKNOWN));
276}
277
278TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInConnectionsHistogram) {
279  int old_sct_count = NumConnectionsWithSingleSCT();
280  ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_));
281  EXPECT_EQ(old_sct_count + 1, NumConnectionsWithSingleSCT());
282}
283
284TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInOriginsHistogram) {
285  int old_embedded_count = NumEmbeddedSCTsInHistogram();
286  ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_));
287  EXPECT_EQ(old_embedded_count + 1, NumEmbeddedSCTsInHistogram());
288}
289
290TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) {
291  int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0);
292  EXPECT_FALSE(VerifySinglePrecertificateChain(chain_));
293  ASSERT_EQ(connections_without_scts + 1,
294            GetValueFromHistogram(kSCTCountHistogram, 0));
295}
296
297}  // namespace
298
299}  // namespace net
300