net/test/ct_test_util.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/test/ct_test_util.h"
   6
   7 #include <stdint.h>
   8 #include <string>
   9 #include <vector>
  10
  11 #include "base/base64.h"
  12 #include "base/strings/string_number_conversions.h"
  13 #include "base/strings/string_piece.h"
  14 #include "base/strings/string_util.h"
  15 #include "base/strings/stringprintf.h"
  16 #include "net/cert/ct_serialization.h"
  17 #include "net/cert/signed_certificate_timestamp.h"
  18 #include "net/cert/signed_tree_head.h"
  19 #include "net/cert/x509_certificate.h"
  20
  21 namespace net {
  22
  23 namespace ct {
  24
  25 namespace {
  26
  27 std::string HexToBytes(const char* hex_data) {
  28   std::vector<uint8> output;
  29   std::string result;
  30   if (base::HexStringToBytes(hex_data, &output))
  31     result.assign(reinterpret_cast<const char*>(&output[0]), output.size());
  32   return result;
  33 }
  34
  35 // The following test vectors are from
  36 // http://code.google.com/p/certificate-transparency
  37
  38 const char kDefaultDerCert[] =
  39     "308202ca30820233a003020102020106300d06092a864886f70d01010505003055310b3009"
  40     "06035504061302474231243022060355040a131b4365727469666963617465205472616e73"
  41     "706172656e6379204341310e300c0603550408130557616c65733110300e06035504071307"
  42     "4572772057656e301e170d3132303630313030303030305a170d3232303630313030303030"
  43     "305a3052310b30090603550406130247423121301f060355040a1318436572746966696361"
  44     "7465205472616e73706172656e6379310e300c0603550408130557616c65733110300e0603"
  45     "55040713074572772057656e30819f300d06092a864886f70d010101050003818d00308189"
  46     "02818100b1fa37936111f8792da2081c3fe41925008531dc7f2c657bd9e1de4704160b4c9f"
  47     "19d54ada4470404c1c51341b8f1f7538dddd28d9aca48369fc5646ddcc7617f8168aae5b41"
  48     "d43331fca2dadfc804d57208949061f9eef902ca47ce88c644e000f06eeeccabdc9dd2f68a"
  49     "22ccb09dc76e0dbc73527765b1a37a8c676253dcc10203010001a381ac3081a9301d060355"
  50     "1d0e041604146a0d982a3b62c44b6d2ef4e9bb7a01aa9cb798e2307d0603551d2304763074"
  51     "80145f9d880dc873e654d4f80dd8e6b0c124b447c355a159a4573055310b30090603550406"
  52     "1302474231243022060355040a131b4365727469666963617465205472616e73706172656e"
  53     "6379204341310e300c0603550408130557616c65733110300e060355040713074572772057"
  54     "656e82010030090603551d1304023000300d06092a864886f70d010105050003818100171c"
  55     "d84aac414a9a030f22aac8f688b081b2709b848b4e5511406cd707fed028597a9faefc2eee"
  56     "2978d633aaac14ed3235197da87e0f71b8875f1ac9e78b281749ddedd007e3ecf50645f8cb"
  57     "f667256cd6a1647b5e13203bb8582de7d6696f656d1c60b95f456b7fcf338571908f1c6972"
  58     "7d24c4fccd249295795814d1dac0e6";
  59
  60 const char kDefaultIssuerKeyHash[] =
  61     "02adddca08b8bf9861f035940c940156d8350fdff899a6239c6bd77255b8f8fc";
  62
  63 const char kDefaultDerTbsCert[] =
  64     "30820233a003020102020107300d06092a864886f70d01010505003055310b300906035504"
  65     "061302474231243022060355040a131b4365727469666963617465205472616e7370617265"
  66     "6e6379204341310e300c0603550408130557616c65733110300e0603550407130745727720"
  67     "57656e301e170d3132303630313030303030305a170d3232303630313030303030305a3052"
  68     "310b30090603550406130247423121301f060355040a131843657274696669636174652054"
  69     "72616e73706172656e6379310e300c0603550408130557616c65733110300e060355040713"
  70     "074572772057656e30819f300d06092a864886f70d010101050003818d0030818902818100"
  71     "beef98e7c26877ae385f75325a0c1d329bedf18faaf4d796bf047eb7e1ce15c95ba2f80ee4"
  72     "58bd7db86f8a4b252191a79bd700c38e9c0389b45cd4dc9a120ab21e0cb41cd0e72805a410"
  73     "cd9c5bdb5d4927726daf1710f60187377ea25b1a1e39eed0b88119dc154dc68f7da8e30caf"
  74     "158a33e6c9509f4a05b01409ff5dd87eb50203010001a381ac3081a9301d0603551d0e0416"
  75     "04142031541af25c05ffd8658b6843794f5e9036f7b4307d0603551d230476307480145f9d"
  76     "880dc873e654d4f80dd8e6b0c124b447c355a159a4573055310b3009060355040613024742"
  77     "31243022060355040a131b4365727469666963617465205472616e73706172656e63792043"
  78     "41310e300c0603550408130557616c65733110300e060355040713074572772057656e8201"
  79     "0030090603551d1304023000";
  80
  81 const char kTestDigitallySigned[] =
  82     "0403004730450220606e10ae5c2d5a1b0aed49dc4937f48de71a4e9784e9c208dfbfe9ef53"
  83     "6cf7f2022100beb29c72d7d06d61d06bdb38a069469aa86fe12e18bb7cc45689a2c0187ef5"
  84     "a5";
  85
  86 const char kTestSignedCertificateTimestamp[] =
  87     "00df1c2ec11500945247a96168325ddc5c7959e8f7c6d388fc002e0bbd3f74d7640000013d"
  88     "db27ded900000403004730450220606e10ae5c2d5a1b0aed49dc4937f48de71a4e9784e9c2"
  89     "08dfbfe9ef536cf7f2022100beb29c72d7d06d61d06bdb38a069469aa86fe12e18bb7cc456"
  90     "89a2c0187ef5a5";
  91
  92 const char kEcP256PublicKey[] =
  93     "3059301306072a8648ce3d020106082a8648ce3d0301070342000499783cb14533c0161a5a"
  94     "b45bf95d08a29cd0ea8dd4c84274e2be59ad15c676960cf0afa1074a57ac644b23479e5b3f"
  95     "b7b245eb4b420ef370210371a944beaceb";
  96
  97 const char kTestKeyId[] =
  98     "df1c2ec11500945247a96168325ddc5c7959e8f7c6d388fc002e0bbd3f74d764";
  99
 100 const char kTestSCTSignatureData[] =
 101     "30450220606e10ae5c2d5a1b0aed49dc4937f48de71a4e9784e9c208dfbfe9ef536cf7f202"
 102     "2100beb29c72d7d06d61d06bdb38a069469aa86fe12e18bb7cc45689a2c0187ef5a5";
 103
 104 const char kTestSCTPrecertSignatureData[] =
 105     "30450220482f6751af35dba65436be1fd6640f3dbf9a41429495924530288fa3e5e23e0602"
 106     "2100e4edc0db3ac572b1e2f5e8ab6a680653987dcf41027dfeffa105519d89edbf08";
 107
 108 // A well-formed OCSP response with fake SCT contents. Does not come from
 109 // http://code.google.com/p/certificate-transparency, does not pertain to any
 110 // of the test certs here, and is only used to test extracting the extension
 111 // contents from the response.
 112 const char kFakeOCSPResponse[] =
 113     "3082016e0a0100a08201673082016306092b060105050730010104820154308201503081ba"
 114     "a21604144edfdf5ff9c90ffacfca66e7fbc436bc39ee3fc7180f3230313030313031303630"
 115     "3030305a30818e30818b3049300906052b0e03021a050004141833a1e6a4f09577cca0e64c"
 116     "e7d145ca4b93700904144edfdf5ff9c90ffacfca66e7fbc436bc39ee3fc7021001aef99bde"
 117     "e0bb58c6f2b816bc3ae02f8000180f32303130303130313036303030305aa011180f323033"
 118     "30303130313036303030305aa11830163014060a2b06010401d67902040504060404746573"
 119     "74300d06092a864886f70d0101050500038181003586ffcf0794e64eb643d52a3d570a1c93"
 120     "836395986a2f792dd4e9c70b05161186c55c1658e0607dc9ec0d0924ac37fb99506c870579"
 121     "634be1de62ba2fced5f61f3b428f959fcee9bddf6f268c8e14c14fdf3b447786e638a5c8cc"
 122     "b610893df17a60e4cff30f4780aeffe0086ef19910f0d9cd7414bc93d1945686f88ad0a3c3"
 123     ;
 124
 125 const char kFakeOCSPResponseCert[] =
 126     "3082022930820192a003020102021001aef99bdee0bb58c6f2b816bc3ae02f300d06092a86"
 127     "4886f70d01010505003015311330110603550403130a54657374696e67204341301e170d31"
 128     "30303130313036303030305a170d3332313230313036303030305a30373112301006035504"
 129     "0313093132372e302e302e31310b300906035504061302585831143012060355040a130b54"
 130     "657374696e67204f726730819d300d06092a864886f70d010101050003818b003081870281"
 131     "8100a71998f2930bfe73d031a87f133d2f378eeeeed52a77e44d0fc9ff6f07ff32cbf3da99"
 132     "9de4ed65832afcb0807f98787506539d258a0ce3c2c77967653099a9034a9b115a876c39a8"
 133     "c4e4ed4acd0c64095946fb39eeeb47a0704dbb018acf48c3a1c4b895fc409fb4a340a986b1"
 134     "afc45519ab9eca47c30185c771c64aa5ecf07d020103a35a3058303a06082b060105050701"
 135     "01010100042b3029302706082b06010505073001861b687474703a2f2f3132372e302e302e"
 136     "313a35353038312f6f637370301a0603551d200101000410300e300c060a2b06010401d679"
 137     "020401300d06092a864886f70d01010505000381810065e04fadd3484197f3412479d917e1"
 138     "9d8f7db57b526f2d0e4c046f86cebe643bf568ea0cd6570b228842aa057c6a7c79f209dfcd"
 139     "3419a4d93b1ecfb1c0224f33083c7d4da023499fbd00d81d6711ad58ffcf65f1545247fe9d"
 140     "83203425fd706b4fc5e797002af3d88151be5901eef56ec30aacdfc404be1bd35865ff1943"
 141     "2516";
 142
 143 const char kFakeOCSPResponseIssuerCert[] =
 144     "308201d13082013aa003020102020101300d06092a864886f70d0101050500301531133011"
 145     "0603550403130a54657374696e67204341301e170d3130303130313036303030305a170d33"
 146     "32313230313036303030305a3015311330110603550403130a54657374696e672043413081"
 147     "9d300d06092a864886f70d010101050003818b0030818702818100a71998f2930bfe73d031"
 148     "a87f133d2f378eeeeed52a77e44d0fc9ff6f07ff32cbf3da999de4ed65832afcb0807f9878"
 149     "7506539d258a0ce3c2c77967653099a9034a9b115a876c39a8c4e4ed4acd0c64095946fb39"
 150     "eeeb47a0704dbb018acf48c3a1c4b895fc409fb4a340a986b1afc45519ab9eca47c30185c7"
 151     "71c64aa5ecf07d020103a333303130120603551d130101ff040830060101ff020100301b06"
 152     "03551d200101000411300f300d060b2b06010401d6790201ce0f300d06092a864886f70d01"
 153     "01050500038181003f4936f8d00e83fbdde331f2c64335dcf7dec8b1a2597683edeed61af0"
 154     "fa862412fad848938fe7ab77f1f9a43671ff6fdb729386e26f49e7aca0c0ea216e5970d933"
 155     "3ea1e11df2ccb357a5fed5220f9c6239e8946b9b7517707631d51ab996833d58a022cff5a6"
 156     "2169ac9258ec110efee78da9ab4a641e3b3c9ee5e8bd291460";
 157
 158
 159 const char kFakeOCSPExtensionValue[] = "74657374";  // "test"
 160
 161 // For the sample STH
 162 const char kSampleSTHSHA256RootHash[] =
 163     "726467216167397babca293dca398e4ce6b621b18b9bc42f30c900d1f92ac1e4";
 164 const char kSampleSTHTreeHeadSignature[] =
 165     "0403004730450220365a91a2a88f2b9332f41d8959fa7086da7e6d634b7b089bc9da066426"
 166     "6c7a20022100e38464f3c0fd066257b982074f7ac87655e0c8f714768a050b4be9a7b441cb"
 167     "d3";
 168 size_t kSampleSTHTreeSize = 21u;
 169 int64_t kSampleSTHTimestamp = 1396877277237u;
 170
 171 }  // namespace
 172
 173 void GetX509CertLogEntry(LogEntry* entry) {
 174   entry->type = ct::LogEntry::LOG_ENTRY_TYPE_X509;
 175   entry->leaf_certificate = HexToBytes(kDefaultDerCert);
 176 }
 177
 178 std::string GetDerEncodedX509Cert() { return HexToBytes(kDefaultDerCert); }
 179
 180 void GetPrecertLogEntry(LogEntry* entry) {
 181   entry->type = ct::LogEntry::LOG_ENTRY_TYPE_PRECERT;
 182   std::string issuer_hash(HexToBytes(kDefaultIssuerKeyHash));
 183   memcpy(entry->issuer_key_hash.data, issuer_hash.data(), issuer_hash.size());
 184   entry->tbs_certificate = HexToBytes(kDefaultDerTbsCert);
 185 }
 186
 187 std::string GetTestDigitallySigned() {
 188   return HexToBytes(kTestDigitallySigned);
 189 }
 190
 191 std::string GetTestSignedCertificateTimestamp() {
 192   return HexToBytes(kTestSignedCertificateTimestamp);
 193 }
 194
 195 std::string GetTestPublicKey() {
 196   return HexToBytes(kEcP256PublicKey);
 197 }
 198
 199 std::string GetTestPublicKeyId() {
 200   return HexToBytes(kTestKeyId);
 201 }
 202
 203 void GetX509CertSCT(scoped_refptr<SignedCertificateTimestamp>* sct_ref) {
 204   CHECK(sct_ref != NULL);
 205   *sct_ref = new SignedCertificateTimestamp();
 206   SignedCertificateTimestamp *const sct(sct_ref->get());
 207   sct->version = ct::SignedCertificateTimestamp::SCT_VERSION_1;
 208   sct->log_id = HexToBytes(kTestKeyId);
 209   // Time the log issued a SCT for this certificate, which is
 210   // Fri Apr  5 10:04:16.089 2013
 211   sct->timestamp = base::Time::UnixEpoch() +
 212       base::TimeDelta::FromMilliseconds(INT64_C(1365181456089));
 213   sct->extensions.clear();
 214
 215   sct->signature.hash_algorithm = ct::DigitallySigned::HASH_ALGO_SHA256;
 216   sct->signature.signature_algorithm = ct::DigitallySigned::SIG_ALGO_ECDSA;
 217   sct->signature.signature_data = HexToBytes(kTestSCTSignatureData);
 218 }
 219
 220 void GetPrecertSCT(scoped_refptr<SignedCertificateTimestamp>* sct_ref) {
 221   CHECK(sct_ref != NULL);
 222   *sct_ref = new SignedCertificateTimestamp();
 223   SignedCertificateTimestamp *const sct(sct_ref->get());
 224   sct->version = ct::SignedCertificateTimestamp::SCT_VERSION_1;
 225   sct->log_id = HexToBytes(kTestKeyId);
 226   // Time the log issued a SCT for this Precertificate, which is
 227   // Fri Apr  5 10:04:16.275 2013
 228   sct->timestamp = base::Time::UnixEpoch() +
 229     base::TimeDelta::FromMilliseconds(INT64_C(1365181456275));
 230   sct->extensions.clear();
 231
 232   sct->signature.hash_algorithm = ct::DigitallySigned::HASH_ALGO_SHA256;
 233   sct->signature.signature_algorithm = ct::DigitallySigned::SIG_ALGO_ECDSA;
 234   sct->signature.signature_data = HexToBytes(kTestSCTPrecertSignatureData);
 235 }
 236
 237 std::string GetDefaultIssuerKeyHash() {
 238   return HexToBytes(kDefaultIssuerKeyHash);
 239 }
 240
 241 std::string GetDerEncodedFakeOCSPResponse() {
 242 return HexToBytes(kFakeOCSPResponse);
 243 }
 244
 245 std::string GetFakeOCSPExtensionValue() {
 246   return HexToBytes(kFakeOCSPExtensionValue);
 247 }
 248
 249 std::string GetDerEncodedFakeOCSPResponseCert() {
 250   return HexToBytes(kFakeOCSPResponseCert);
 251 }
 252
 253 std::string GetDerEncodedFakeOCSPResponseIssuerCert() {
 254   return HexToBytes(kFakeOCSPResponseIssuerCert);
 255 }
 256
 257 // A sample, valid STH
 258 void GetSampleSignedTreeHead(SignedTreeHead* sth) {
 259   sth->version = SignedTreeHead::V1;
 260   sth->timestamp = base::Time::UnixEpoch() +
 261                    base::TimeDelta::FromMilliseconds(kSampleSTHTimestamp);
 262   sth->tree_size = kSampleSTHTreeSize;
 263   std::string sha256_root_hash = GetSampleSTHSHA256RootHash();
 264   memcpy(sth->sha256_root_hash, sha256_root_hash.c_str(), kSthRootHashLength);
 265
 266   GetSampleSTHTreeHeadDecodedSignature(&(sth->signature));
 267 }
 268
 269 std::string GetSampleSTHSHA256RootHash() {
 270   return HexToBytes(kSampleSTHSHA256RootHash);
 271 }
 272
 273 std::string GetSampleSTHTreeHeadSignature() {
 274   return HexToBytes(kSampleSTHTreeHeadSignature);
 275 }
 276
 277 void GetSampleSTHTreeHeadDecodedSignature(DigitallySigned* signature) {
 278   std::string tree_head_signature = HexToBytes(kSampleSTHTreeHeadSignature);
 279   base::StringPiece sp(tree_head_signature);
 280   CHECK(DecodeDigitallySigned(&sp, signature));
 281   CHECK(sp.empty());
 282 }
 283
 284 std::string GetSampleSTHAsJson() {
 285   return CreateSignedTreeHeadJsonString(kSampleSTHTreeSize, kSampleSTHTimestamp,
 286                                         GetSampleSTHSHA256RootHash(),
 287                                         GetSampleSTHTreeHeadSignature());
 288 }
 289
 290 std::string CreateSignedTreeHeadJsonString(size_t tree_size,
 291                                            int64_t timestamp,
 292                                            std::string sha256_root_hash,
 293                                            std::string tree_head_signature) {
 294   std::string sth_json =
 295       std::string("{\"tree_size\":") + base::SizeTToString(tree_size) +
 296       std::string(",\"timestamp\":") + base::Int64ToString(timestamp);
 297
 298   if (!sha256_root_hash.empty()) {
 299     std::string root_hash_b64;
 300     base::Base64Encode(sha256_root_hash, &root_hash_b64);
 301     sth_json += base::StringPrintf(",\"sha256_root_hash\":\"%s\"",
 302                                    root_hash_b64.c_str());
 303   }
 304   if (!tree_head_signature.empty()) {
 305     std::string tree_head_signature_b64;
 306     base::Base64Encode(tree_head_signature, &tree_head_signature_b64);
 307     sth_json += base::StringPrintf(",\"tree_head_signature\":\"%s\"",
 308                                    tree_head_signature_b64.c_str());
 309   }
 310
 311   sth_json += "}";
 312   return sth_json;
 313 }
 314
 315 }  // namespace ct
 316
 317 }  // namespace net