net/cert/multi_log_ct_verifier_unittest.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/cert/multi_log_ct_verifier.h"
   6
   7 #include <string>
   8
   9 #include "base/files/file_path.h"
  10 #include "base/files/file_util.h"
  11 #include "base/metrics/histogram.h"
  12 #include "base/metrics/histogram_samples.h"
  13 #include "base/metrics/statistics_recorder.h"
  14 #include "base/values.h"
  15 #include "net/base/net_errors.h"
  16 #include "net/base/test_data_directory.h"
  17 #include "net/cert/ct_log_verifier.h"
  18 #include "net/cert/ct_serialization.h"
  19 #include "net/cert/ct_verify_result.h"
  20 #include "net/cert/pem_tokenizer.h"
  21 #include "net/cert/sct_status_flags.h"
  22 #include "net/cert/signed_certificate_timestamp.h"
  23 #include "net/cert/x509_certificate.h"
  24 #include "net/log/net_log.h"
  25 #include "net/log/test_net_log.h"
  26 #include "net/log/test_net_log_entry.h"
  27 #include "net/test/cert_test_util.h"
  28 #include "net/test/ct_test_util.h"
  29 #include "testing/gmock/include/gmock/gmock.h"
  30 #include "testing/gtest/include/gtest/gtest.h"
  31
  32 using testing::_;
  33 using testing::Mock;
  34
  35 namespace net {
  36
  37 namespace {
  38
  39 const char kLogDescription[] = "somelog";
  40 const char kSCTCountHistogram[] =
  41     "Net.CertificateTransparency.SCTsPerConnection";
  42
  43 class MockSCTObserver : public CTVerifier::Observer {
  44  public:
  45   MOCK_METHOD2(OnSCTVerified,
  46                void(X509Certificate* cert,
  47                     const ct::SignedCertificateTimestamp* sct));
  48 };
  49
  50 class MultiLogCTVerifierTest : public ::testing::Test {
  51  public:
  52   void SetUp() override {
  53     scoped_refptr<CTLogVerifier> log(CTLogVerifier::Create(
  54         ct::GetTestPublicKey(), kLogDescription, "https://ct.example.com"));
  55     ASSERT_TRUE(log);
  56     log_verifiers_.push_back(log);
  57
  58     verifier_.reset(new MultiLogCTVerifier());
  59     verifier_->AddLogs(log_verifiers_);
  60     std::string der_test_cert(ct::GetDerEncodedX509Cert());
  61     chain_ = X509Certificate::CreateFromBytes(
  62         der_test_cert.data(),
  63         der_test_cert.length());
  64     ASSERT_TRUE(chain_.get());
  65
  66     embedded_sct_chain_ =
  67         CreateCertificateChainFromFile(GetTestCertsDirectory(),
  68                                        "ct-test-embedded-cert.pem",
  69                                        X509Certificate::FORMAT_AUTO);
  70     ASSERT_TRUE(embedded_sct_chain_.get());
  71   }
  72
  73   bool CheckForSingleVerifiedSCTInResult(const ct::CTVerifyResult& result) {
  74     return (result.verified_scts.size() == 1U) &&
  75         result.invalid_scts.empty() &&
  76         result.unknown_logs_scts.empty() &&
  77         result.verified_scts[0]->log_description == kLogDescription;
  78   }
  79
  80   bool CheckForSCTOrigin(
  81       const ct::CTVerifyResult& result,
  82       ct::SignedCertificateTimestamp::Origin origin) {
  83     return (result.verified_scts.size() > 0) &&
  84         (result.verified_scts[0]->origin == origin);
  85   }
  86
  87   bool CheckForEmbeddedSCTInNetLog(TestNetLog& net_log) {
  88     TestNetLogEntry::List entries;
  89     net_log.GetEntries(&entries);
  90     if (entries.size() != 2)
  91       return false;
  92
  93     const TestNetLogEntry& received = entries[0];
  94     std::string embedded_scts;
  95     if (!received.GetStringValue("embedded_scts", &embedded_scts))
  96       return false;
  97     if (embedded_scts.empty())
  98       return false;
  99
 100     const TestNetLogEntry& parsed = entries[1];
 101     base::ListValue* verified_scts;
 102     if (!parsed.GetListValue("verified_scts", &verified_scts) ||
 103         verified_scts->GetSize() != 1) {
 104       return false;
 105     }
 106
 107     base::DictionaryValue* the_sct;
 108     if (!verified_scts->GetDictionary(0, &the_sct))
 109       return false;
 110
 111     std::string origin;
 112     if (!the_sct->GetString("origin", &origin))
 113       return false;
 114     if (origin != "embedded_in_certificate")
 115       return false;
 116
 117     base::ListValue* other_scts;
 118     if (!parsed.GetListValue("invalid_scts", &other_scts) ||
 119         !other_scts->empty()) {
 120       return false;
 121     }
 122
 123     if (!parsed.GetListValue("unknown_logs_scts", &other_scts) ||
 124         !other_scts->empty()) {
 125       return false;
 126     }
 127
 128     return true;
 129   }
 130
 131   std::string GetSCTListWithInvalidSCT() {
 132     std::string sct(ct::GetTestSignedCertificateTimestamp());
 133
 134     // Change a byte inside the Log ID part of the SCT so it does
 135     // not match the log used in the tests
 136     sct[15] = 't';
 137
 138     std::string sct_list;
 139     ct::EncodeSCTListForTesting(sct, &sct_list);
 140     return sct_list;
 141   }
 142
 143   bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain,
 144                                        const BoundNetLog& bound_net_log,
 145                                        ct::CTVerifyResult* result) {
 146     return verifier_->Verify(chain.get(),
 147                              std::string(),
 148                              std::string(),
 149                              result,
 150                              bound_net_log) == OK;
 151   }
 152
 153   bool VerifySinglePrecertificateChain(scoped_refptr<X509Certificate> chain) {
 154     ct::CTVerifyResult result;
 155     TestNetLog net_log;
 156     BoundNetLog bound_net_log =
 157         BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB);
 158
 159     return verifier_->Verify(chain.get(),
 160                              std::string(),
 161                              std::string(),
 162                              &result,
 163                              bound_net_log) == OK;
 164   }
 165
 166   bool CheckPrecertificateVerification(scoped_refptr<X509Certificate> chain) {
 167     ct::CTVerifyResult result;
 168     TestNetLog net_log;
 169     BoundNetLog bound_net_log =
 170       BoundNetLog::Make(&net_log, NetLog::SOURCE_CONNECT_JOB);
 171     return (VerifySinglePrecertificateChain(chain, bound_net_log, &result) &&
 172             CheckForSingleVerifiedSCTInResult(result) &&
 173             CheckForSCTOrigin(result,
 174                               ct::SignedCertificateTimestamp::SCT_EMBEDDED) &&
 175             CheckForEmbeddedSCTInNetLog(net_log));
 176   }
 177
 178   // Histogram-related helper methods
 179   int GetValueFromHistogram(const std::string& histogram_name,
 180                             int sample_index) {
 181     base::Histogram* histogram = static_cast<base::Histogram*>(
 182         base::StatisticsRecorder::FindHistogram(histogram_name));
 183
 184     if (histogram == NULL)
 185       return 0;
 186
 187     scoped_ptr<base::HistogramSamples> samples = histogram->SnapshotSamples();
 188     return samples->GetCount(sample_index);
 189   }
 190
 191   int NumConnectionsWithSingleSCT() {
 192     return GetValueFromHistogram(kSCTCountHistogram, 1);
 193   }
 194
 195   int NumEmbeddedSCTsInHistogram() {
 196     return GetValueFromHistogram("Net.CertificateTransparency.SCTOrigin",
 197                                  ct::SignedCertificateTimestamp::SCT_EMBEDDED);
 198   }
 199
 200   int NumValidSCTsInStatusHistogram() {
 201     return GetValueFromHistogram("Net.CertificateTransparency.SCTStatus",
 202                                  ct::SCT_STATUS_OK);
 203   }
 204
 205  protected:
 206   scoped_ptr<MultiLogCTVerifier> verifier_;
 207   scoped_refptr<X509Certificate> chain_;
 208   scoped_refptr<X509Certificate> embedded_sct_chain_;
 209   std::vector<scoped_refptr<CTLogVerifier>> log_verifiers_;
 210 };
 211
 212 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCT) {
 213   ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_));
 214 }
 215
 216 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithPreCA) {
 217   scoped_refptr<X509Certificate> chain(
 218       CreateCertificateChainFromFile(GetTestCertsDirectory(),
 219                                      "ct-test-embedded-with-preca-chain.pem",
 220                                      X509Certificate::FORMAT_AUTO));
 221   ASSERT_TRUE(chain.get());
 222   ASSERT_TRUE(CheckPrecertificateVerification(chain));
 223 }
 224
 225 TEST_F(MultiLogCTVerifierTest, VerifiesEmbeddedSCTWithIntermediate) {
 226   scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile(
 227       GetTestCertsDirectory(),
 228       "ct-test-embedded-with-intermediate-chain.pem",
 229       X509Certificate::FORMAT_AUTO));
 230   ASSERT_TRUE(chain.get());
 231   ASSERT_TRUE(CheckPrecertificateVerification(chain));
 232 }
 233
 234 TEST_F(MultiLogCTVerifierTest,
 235        VerifiesEmbeddedSCTWithIntermediateAndPreCA) {
 236   scoped_refptr<X509Certificate> chain(CreateCertificateChainFromFile(
 237       GetTestCertsDirectory(),
 238       "ct-test-embedded-with-intermediate-preca-chain.pem",
 239       X509Certificate::FORMAT_AUTO));
 240   ASSERT_TRUE(chain.get());
 241   ASSERT_TRUE(CheckPrecertificateVerification(chain));
 242 }
 243
 244 TEST_F(MultiLogCTVerifierTest,
 245        VerifiesSCTOverX509Cert) {
 246   std::string sct(ct::GetTestSignedCertificateTimestamp());
 247
 248   std::string sct_list;
 249   ASSERT_TRUE(ct::EncodeSCTListForTesting(sct, &sct_list));
 250
 251   ct::CTVerifyResult result;
 252   EXPECT_EQ(OK,
 253             verifier_->Verify(
 254                 chain_.get(), std::string(), sct_list, &result, BoundNetLog()));
 255   ASSERT_TRUE(CheckForSingleVerifiedSCTInResult(result));
 256   ASSERT_TRUE(CheckForSCTOrigin(
 257       result, ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION));
 258 }
 259
 260 TEST_F(MultiLogCTVerifierTest,
 261        IdentifiesSCTFromUnknownLog) {
 262   std::string sct_list = GetSCTListWithInvalidSCT();
 263   ct::CTVerifyResult result;
 264
 265   EXPECT_NE(OK,
 266             verifier_->Verify(
 267                 chain_.get(), std::string(), sct_list, &result, BoundNetLog()));
 268   EXPECT_EQ(1U, result.unknown_logs_scts.size());
 269   EXPECT_EQ("", result.unknown_logs_scts[0]->log_description);
 270 }
 271
 272 TEST_F(MultiLogCTVerifierTest, CountsValidSCTsInStatusHistogram) {
 273   int num_valid_scts = NumValidSCTsInStatusHistogram();
 274
 275   ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_));
 276
 277   EXPECT_EQ(num_valid_scts + 1, NumValidSCTsInStatusHistogram());
 278 }
 279
 280 TEST_F(MultiLogCTVerifierTest, CountsInvalidSCTsInStatusHistogram) {
 281   std::string sct_list = GetSCTListWithInvalidSCT();
 282   ct::CTVerifyResult result;
 283   int num_valid_scts = NumValidSCTsInStatusHistogram();
 284   int num_invalid_scts = GetValueFromHistogram(
 285       "Net.CertificateTransparency.SCTStatus", ct::SCT_STATUS_LOG_UNKNOWN);
 286
 287   EXPECT_NE(OK,
 288             verifier_->Verify(
 289                 chain_.get(), std::string(), sct_list, &result, BoundNetLog()));
 290
 291   ASSERT_EQ(num_valid_scts, NumValidSCTsInStatusHistogram());
 292   ASSERT_EQ(num_invalid_scts + 1,
 293             GetValueFromHistogram("Net.CertificateTransparency.SCTStatus",
 294                                   ct::SCT_STATUS_LOG_UNKNOWN));
 295 }
 296
 297 TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInConnectionsHistogram) {
 298   int old_sct_count = NumConnectionsWithSingleSCT();
 299   ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_));
 300   EXPECT_EQ(old_sct_count + 1, NumConnectionsWithSingleSCT());
 301 }
 302
 303 TEST_F(MultiLogCTVerifierTest, CountsSingleEmbeddedSCTInOriginsHistogram) {
 304   int old_embedded_count = NumEmbeddedSCTsInHistogram();
 305   ASSERT_TRUE(CheckPrecertificateVerification(embedded_sct_chain_));
 306   EXPECT_EQ(old_embedded_count + 1, NumEmbeddedSCTsInHistogram());
 307 }
 308
 309 TEST_F(MultiLogCTVerifierTest, CountsZeroSCTsCorrectly) {
 310   int connections_without_scts = GetValueFromHistogram(kSCTCountHistogram, 0);
 311   EXPECT_FALSE(VerifySinglePrecertificateChain(chain_));
 312   ASSERT_EQ(connections_without_scts + 1,
 313             GetValueFromHistogram(kSCTCountHistogram, 0));
 314 }
 315
 316 TEST_F(MultiLogCTVerifierTest, NotifiesOfValidSCT) {
 317   MockSCTObserver observer;
 318   verifier_->SetObserver(&observer);
 319
 320   EXPECT_CALL(observer, OnSCTVerified(embedded_sct_chain_.get(), _));
 321   ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_));
 322 }
 323
 324 TEST_F(MultiLogCTVerifierTest, StopsNotifyingCorrectly) {
 325   MockSCTObserver observer;
 326   verifier_->SetObserver(&observer);
 327
 328   EXPECT_CALL(observer, OnSCTVerified(embedded_sct_chain_.get(), _)).Times(1);
 329   ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_));
 330   Mock::VerifyAndClearExpectations(&observer);
 331
 332   EXPECT_CALL(observer, OnSCTVerified(embedded_sct_chain_.get(), _)).Times(0);
 333   verifier_->SetObserver(nullptr);
 334   ASSERT_TRUE(VerifySinglePrecertificateChain(embedded_sct_chain_));
 335 }
 336
 337 }  // namespace
 338
 339 }  // namespace net