1f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// Copyright 2013 The Chromium Authors. All rights reserved. 2f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 3f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// found in the LICENSE file. 4f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 5f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/cert/multi_log_ct_verifier.h" 6f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 7f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include <string> 8f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 9f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/files/file_path.h" 101320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci#include "base/files/file_util.h" 115d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/metrics/histogram.h" 125d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/metrics/histogram_samples.h" 135d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/metrics/statistics_recorder.h" 145d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/values.h" 15a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include "net/base/capturing_net_log.h" 16f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/base/net_errors.h" 17a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#include "net/base/net_log.h" 18f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/base/test_data_directory.h" 19f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/cert/ct_log_verifier.h" 20f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/cert/ct_serialization.h" 21f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/cert/ct_verify_result.h" 22f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/cert/pem_tokenizer.h" 235d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "net/cert/sct_status_flags.h" 24f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/cert/signed_certificate_timestamp.h" 25f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/cert/x509_certificate.h" 26f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/test/cert_test_util.h" 27f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "net/test/ct_test_util.h" 28f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "testing/gtest/include/gtest/gtest.h" 29f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 30f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)namespace net { 31f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 32f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)namespace { 33f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 34a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)const char kLogDescription[] = "somelog"; 355d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)const char kSCTCountHistogram[] = 365d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) "Net.CertificateTransparency.SCTsPerConnection"; 37a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 38f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)class MultiLogCTVerifierTest : public ::testing::Test { 39f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) public: 40f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) virtual void SetUp() OVERRIDE { 41f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) scoped_ptr<CTLogVerifier> log( 42a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CTLogVerifier::Create(ct::GetTestPublicKey(), kLogDescription)); 43f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ASSERT_TRUE(log); 44f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 45f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) verifier_.reset(new MultiLogCTVerifier()); 46f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) verifier_->AddLog(log.Pass()); 47f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) std::string der_test_cert(ct::GetDerEncodedX509Cert()); 48f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) chain_ = X509Certificate::CreateFromBytes( 49f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) der_test_cert.data(), 50f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) der_test_cert.length()); 511320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci ASSERT_TRUE(chain_.get()); 525d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 535d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) embedded_sct_chain_ = 545d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) CreateCertificateChainFromFile(GetTestCertsDirectory(), 555d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) "ct-test-embedded-cert.pem", 565d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) X509Certificate::FORMAT_AUTO); 571320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci ASSERT_TRUE(embedded_sct_chain_.get()); 58f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 59f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 60f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) { 61f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return (result.verified_scts.size() == 1U) && 62a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) result.invalid_scts.empty() && 63a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) result.unknown_logs_scts.empty() && 64a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) result.verified_scts[0]->log_description == kLogDescription; 65f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 66f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 67f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) bool CheckForSCTOrigin( 68f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) const ct::CTVerifyResult& result, 69f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ct::SignedCertificateTimestamp::Origin origin) { 70f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return (result.verified_scts.size() > 0) && 71f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) (result.verified_scts[0]->origin == origin); 72f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 73f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 74a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) bool CheckForEmbeddedSCTInNetLog(CapturingNetLog& net_log) { 75a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CapturingNetLog::CapturedEntryList entries; 76a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) net_log.GetEntries(&entries); 77a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (entries.size() != 2) 78a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return false; 79a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 805d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const CapturingNetLog::CapturedEntry& received = entries[0]; 81a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) std::string embedded_scts; 82a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!received.GetStringValue("embedded_scts", &embedded_scts)) 83a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return false; 84a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (embedded_scts.empty()) 85a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return false; 86a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 875d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const CapturingNetLog::CapturedEntry& parsed = entries[1]; 885d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) base::ListValue* verified_scts; 895d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!parsed.GetListValue("verified_scts", &verified_scts) || 905d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) verified_scts->GetSize() != 1) { 915d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return false; 925d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 935d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 945d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) base::DictionaryValue* the_sct; 955d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!verified_scts->GetDictionary(0, &the_sct)) 965d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return false; 975d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 985d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) std::string origin; 995d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!the_sct->GetString("origin", &origin)) 1005d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return false; 1015d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (origin != "embedded_in_certificate") 1025d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return false; 1035d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1045d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) base::ListValue* other_scts; 1055d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!parsed.GetListValue("invalid_scts", &other_scts) || 1065d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) !other_scts->empty()) { 1075d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return false; 1085d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1095d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1105d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!parsed.GetListValue("unknown_logs_scts", &other_scts) || 1115d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) !other_scts->empty()) { 1125d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return false; 1135d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 114a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 115a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return true; 116a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) } 117a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 1185d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) std::string GetSCTListWithInvalidSCT() { 1195d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) std::string sct(ct::GetTestSignedCertificateTimestamp()); 1205d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1215d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // Change a byte inside the Log ID part of the SCT so it does 1225d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // not match the log used in the tests 1235d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) sct[15] = 't'; 1245d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1255d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) std::string sct_list; 1265d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ct::EncodeSCTListForTesting(sct, &sct_list); 1275d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return sct_list; 1285d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1295d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1305d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain, 1315d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const BoundNetLog& bound_net_log, 1325d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ct::CTVerifyResult* result) { 1331320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci return verifier_->Verify(chain.get(), 1341320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci std::string(), 1351320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci std::string(), 1361320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci result, 1371320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci bound_net_log) == OK; 1385d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1395d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1405d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) { 1415d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ct::CTVerifyResult result; 1425d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) CapturingNetLog net_log; 1435d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) BoundNetLog bound_net_log = 1445d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); 1455d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1461320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci return verifier_->Verify(chain.get(), 1471320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci std::string(), 1481320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci std::string(), 1491320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci &result, 1501320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci bound_net_log) == OK; 1515d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1525d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 153f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) { 154f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ct::CTVerifyResult result; 155a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CapturingNetLog net_log; 156a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) BoundNetLog bound_net_log = 157a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB); 1585d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) && 1595d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) CheckForSingleVerifiedSCTInResult(result) && 1605d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) CheckForSCTOrigin(result, 1615d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ct::SignedCertificateTimestamp::SCT_EMBEDDED) && 1625d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) CheckForEmbeddedSCTInNetLog(net_log)); 1635d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1645d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1655d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // Histogram-related helper methods 1665d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int GetValueFromHistogram(std::string histogram_name, int sample_index) { 1675d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) base::Histogram* histogram = static_cast<base::Histogram*>( 1685d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) base::StatisticsRecorder::FindHistogram(histogram_name)); 1695d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1705d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (histogram == NULL) 1715d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return 0; 1725d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1735d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) scoped_ptr<base::HistogramSamples> samples = histogram->SnapshotSamples(); 1745d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return samples->GetCount(sample_index); 1755d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1765d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1775d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int NumConnectionsWithSingleSCT() { 1785d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return GetValueFromHistogram(kSCTCountHistogram, 1); 1795d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1805d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1815d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int NumEmbeddedSCTsInHistogram() { 1825d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return GetValueFromHistogram("Net.CertificateTransparency.SCTOrigin", 1835d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ct::SignedCertificateTimestamp::SCT_EMBEDDED); 1845d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1855d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1865d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int NumValidSCTsInStatusHistogram() { 1875d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return GetValueFromHistogram("Net.CertificateTransparency.SCTStatus", 1885d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ct::SCT_STATUS_OK); 189f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) } 190f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 191f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) protected: 192f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) scoped_ptr<MultiLogCTVerifier> verifier_; 193f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) scoped_refptr<X509Certificate> chain_; 1945d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) scoped_refptr<X509Certificate> embedded_sct_chain_; 195f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)}; 196f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 197f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCT) { 1985d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_)); 199f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 200f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 201f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithPreCA) { 202f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) scoped_refptr<X509Certificate> chain( 203f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) CreateCertificateChainFromFile(GetTestCertsDirectory(), 204f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) "ct-test-embedded-with-preca-chain.pem", 205f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) X509Certificate::FORMAT_AUTO)); 2061320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci ASSERT_TRUE(chain.get()); 207f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ASSERT_TRUE(CheckPrecertificateVerification(chain)); 208f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 209f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 210f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithIntermediate) { 211f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile( 212f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) GetTestCertsDirectory(), 213f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) "ct-test-embedded-with-intermediate-chain.pem", 214f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) X509Certificate::FORMAT_AUTO)); 2151320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci ASSERT_TRUE(chain.get()); 216f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ASSERT_TRUE(CheckPrecertificateVerification(chain)); 217f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 218f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 219f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)TEST_F(MultiLogCTVerifierTest, 220f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) VerifiesEmbeddedSCTWithIntermediateAndPreCA) { 221f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile( 222f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) GetTestCertsDirectory(), 223f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) "ct-test-embedded-with-intermediate-preca-chain.pem", 224f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) X509Certificate::FORMAT_AUTO)); 2251320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci ASSERT_TRUE(chain.get()); 226f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ASSERT_TRUE(CheckPrecertificateVerification(chain)); 227f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 228f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 229f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)TEST_F(MultiLogCTVerifierTest, 230f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) VerifiesSCTOverX509Cert) { 231f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) std::string sct(ct::GetTestSignedCertificateTimestamp()); 232f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 233f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) std::string sct_list; 234f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ASSERT_TRUE(ct::EncodeSCTListForTesting(sct, &sct_list)); 235f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 236f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ct::CTVerifyResult result; 237a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) EXPECT_EQ(OK, 2381320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci verifier_->Verify( 2391320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci chain_.get(), std::string(), sct_list, &result, BoundNetLog())); 240f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ASSERT_TRUE(CheckForSingleVerifiedSCTInResult(result)); 241f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ASSERT_TRUE(CheckForSCTOrigin( 242f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) result, ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION)); 243f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 244f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 245f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)TEST_F(MultiLogCTVerifierTest, 246f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) IdentifiesSCTFromUnknownLog) { 2475d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) std::string sct_list = GetSCTListWithInvalidSCT(); 2485d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ct::CTVerifyResult result; 249f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 2505d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_NE(OK, 2515d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) verifier_->Verify( 2521320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci chain_.get(), std::string(), sct_list, &result, BoundNetLog())); 2535d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_EQ(1U, result.unknown_logs_scts.size()); 2545d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_EQ("", result.unknown_logs_scts[0]->log_description); 2555d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 256f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 2575d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)TEST_F(MultiLogCTVerifierTest, CountsValidSCTsInStatusHistogram) { 2585d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int num_valid_scts = NumValidSCTsInStatusHistogram(); 2595d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 2605d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_)); 2615d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 2625d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_EQ(num_valid_scts + 1, NumValidSCTsInStatusHistogram()); 2635d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 264f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 2655d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)TEST_F(MultiLogCTVerifierTest, CountsInvalidSCTsInStatusHistogram) { 2665d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) std::string sct_list = GetSCTListWithInvalidSCT(); 267f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) ct::CTVerifyResult result; 2685d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int num_valid_scts = NumValidSCTsInStatusHistogram(); 2695d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int num_invalid_scts = GetValueFromHistogram( 2705d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) "Net.CertificateTransparency.SCTStatus", ct::SCT_STATUS_LOG_UNKNOWN); 2715d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 272a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) EXPECT_NE(OK, 2731320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci verifier_->Verify( 2741320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci chain_.get(), std::string(), sct_list, &result, BoundNetLog())); 2755d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 2765d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ASSERT_EQ(num_valid_scts, NumValidSCTsInStatusHistogram()); 2775d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ASSERT_EQ(num_invalid_scts + 1, 2785d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) GetValueFromHistogram("Net.CertificateTransparency.SCTStatus", 2795d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ct::SCT_STATUS_LOG_UNKNOWN)); 2805d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 2815d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 2825d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInConnectionsHistogram) { 2835d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int old_sct_count = NumConnectionsWithSingleSCT(); 2845d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_)); 2855d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_EQ(old_sct_count + 1, NumConnectionsWithSingleSCT()); 2865d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 2875d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 2885d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInOriginsHistogram) { 2895d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int old_embedded_count = NumEmbeddedSCTsInHistogram(); 2905d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_)); 2915d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_EQ(old_embedded_count + 1, NumEmbeddedSCTsInHistogram()); 2925d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 2935d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 2945d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) { 2955d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0); 2965d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) EXPECT_FALSE(VerifySinglePrecertificateChain(chain_)); 2975d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ASSERT_EQ(connections_without_scts + 1, 2985d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) GetValueFromHistogram(kSCTCountHistogram, 0)); 299f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 300f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 301f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} // namespace 302f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 303f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} // namespace net 304