ct_objects_extractor_unittest.cc 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/ct_objects_extractor.h"
  5. #include "base/files/file_path.h"
  6. #include "net/cert/ct_log_verifier.h"
  7. #include "net/cert/ct_serialization.h"
  8. #include "net/cert/signed_certificate_timestamp.h"
  9. #include "net/cert/x509_certificate.h"
  10. #include "net/test/cert_test_util.h"
  11. #include "net/test/ct_test_util.h"
  12. #include "net/test/test_data_directory.h"
  13. #include "testing/gtest/include/gtest/gtest.h"
  14. namespace net::ct {
  15. class CTObjectsExtractorTest : public ::testing::Test {
  16. public:
  17. void SetUp() override {
  18. precert_chain_ =
  19. CreateCertificateListFromFile(GetTestCertsDirectory(),
  20. "ct-test-embedded-cert.pem",
  21. X509Certificate::FORMAT_AUTO);
  22. ASSERT_EQ(2u, precert_chain_.size());
  23. std::string der_test_cert(ct::GetDerEncodedX509Cert());
  24. test_cert_ = X509Certificate::CreateFromBytes(
  25. base::as_bytes(base::make_span(der_test_cert)));
  26. ASSERT_TRUE(test_cert_);
  27. log_ = CTLogVerifier::Create(ct::GetTestPublicKey(), "testlog");
  28. ASSERT_TRUE(log_);
  29. }
  30. void ExtractEmbeddedSCT(scoped_refptr<X509Certificate> cert,
  31. scoped_refptr<SignedCertificateTimestamp>* sct) {
  32. std::string sct_list;
  33. ASSERT_TRUE(ExtractEmbeddedSCTList(cert->cert_buffer(), &sct_list));
  34. std::vector<base::StringPiece> parsed_scts;
  35. // Make sure the SCT list can be decoded properly
  36. ASSERT_TRUE(DecodeSCTList(sct_list, &parsed_scts));
  37. ASSERT_EQ(1u, parsed_scts.size());
  38. EXPECT_TRUE(DecodeSignedCertificateTimestamp(&parsed_scts[0], sct));
  39. }
  40. protected:
  41. CertificateList precert_chain_;
  42. scoped_refptr<X509Certificate> test_cert_;
  43. scoped_refptr<const CTLogVerifier> log_;
  44. };
  45. // Test that an SCT can be extracted and the extracted SCT contains the
  46. // expected data.
  47. TEST_F(CTObjectsExtractorTest, ExtractEmbeddedSCT) {
  48. auto sct = base::MakeRefCounted<ct::SignedCertificateTimestamp>();
  49. ExtractEmbeddedSCT(precert_chain_[0], &sct);
  50. EXPECT_EQ(sct->version, SignedCertificateTimestamp::V1);
  51. EXPECT_EQ(ct::GetTestPublicKeyId(), sct->log_id);
  52. base::Time expected_timestamp =
  53. base::Time::UnixEpoch() + base::Milliseconds(1365181456275);
  54. EXPECT_EQ(expected_timestamp, sct->timestamp);
  55. }
  56. // Test that the extractor correctly skips over issuerUniqueID and
  57. // subjectUniqueID fields. See https://crbug.com/1199744.
  58. TEST_F(CTObjectsExtractorTest, ExtractEmbeddedSCTListWithUIDs) {
  59. CertificateList certs = CreateCertificateListFromFile(
  60. GetTestCertsDirectory(), "ct-test-embedded-with-uids.pem",
  61. X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
  62. ASSERT_EQ(1u, certs.size());
  63. auto sct = base::MakeRefCounted<ct::SignedCertificateTimestamp>();
  64. ExtractEmbeddedSCT(certs[0], &sct);
  65. EXPECT_EQ(sct->version, SignedCertificateTimestamp::V1);
  66. EXPECT_EQ(ct::GetTestPublicKeyId(), sct->log_id);
  67. base::Time expected_timestamp =
  68. base::Time::UnixEpoch() + base::Milliseconds(1365181456275);
  69. EXPECT_EQ(expected_timestamp, sct->timestamp);
  70. }
  71. TEST_F(CTObjectsExtractorTest, ExtractPrecert) {
  72. SignedEntryData entry;
  73. ASSERT_TRUE(GetPrecertSignedEntry(precert_chain_[0]->cert_buffer(),
  74. precert_chain_[1]->cert_buffer(), &entry));
  75. ASSERT_EQ(ct::SignedEntryData::LOG_ENTRY_TYPE_PRECERT, entry.type);
  76. // Should have empty leaf cert for this log entry type.
  77. ASSERT_TRUE(entry.leaf_certificate.empty());
  78. // Compare hash values of issuer spki.
  79. SHA256HashValue expected_issuer_key_hash;
  80. memcpy(expected_issuer_key_hash.data, GetDefaultIssuerKeyHash().data(), 32);
  81. ASSERT_EQ(expected_issuer_key_hash, entry.issuer_key_hash);
  82. }
  83. TEST_F(CTObjectsExtractorTest, ExtractOrdinaryX509Cert) {
  84. SignedEntryData entry;
  85. ASSERT_TRUE(GetX509SignedEntry(test_cert_->cert_buffer(), &entry));
  86. ASSERT_EQ(ct::SignedEntryData::LOG_ENTRY_TYPE_X509, entry.type);
  87. // Should have empty tbs_certificate for this log entry type.
  88. ASSERT_TRUE(entry.tbs_certificate.empty());
  89. // Length of leaf_certificate should be 718, see the CT Serialization tests.
  90. ASSERT_EQ(718U, entry.leaf_certificate.size());
  91. }
  92. // Test that the embedded SCT verifies
  93. TEST_F(CTObjectsExtractorTest, ExtractedSCTVerifies) {
  94. auto sct = base::MakeRefCounted<ct::SignedCertificateTimestamp>();
  95. ExtractEmbeddedSCT(precert_chain_[0], &sct);
  96. SignedEntryData entry;
  97. ASSERT_TRUE(GetPrecertSignedEntry(precert_chain_[0]->cert_buffer(),
  98. precert_chain_[1]->cert_buffer(), &entry));
  99. EXPECT_TRUE(log_->Verify(entry, *sct.get()));
  100. }
  101. // Test that an externally-provided SCT verifies over the SignedEntryData
  102. // of a regular X.509 Certificate
  103. TEST_F(CTObjectsExtractorTest, ComplementarySCTVerifies) {
  104. auto sct = base::MakeRefCounted<ct::SignedCertificateTimestamp>();
  105. GetX509CertSCT(&sct);
  106. SignedEntryData entry;
  107. ASSERT_TRUE(GetX509SignedEntry(test_cert_->cert_buffer(), &entry));
  108. EXPECT_TRUE(log_->Verify(entry, *sct.get()));
  109. }
  110. // Test that the extractor can parse OCSP responses.
  111. TEST_F(CTObjectsExtractorTest, ExtractSCTListFromOCSPResponse) {
  112. std::string der_subject_cert(ct::GetDerEncodedFakeOCSPResponseCert());
  113. scoped_refptr<X509Certificate> subject_cert =
  114. X509Certificate::CreateFromBytes(
  115. base::as_bytes(base::make_span(der_subject_cert)));
  116. ASSERT_TRUE(subject_cert);
  117. std::string der_issuer_cert(ct::GetDerEncodedFakeOCSPResponseIssuerCert());
  118. scoped_refptr<X509Certificate> issuer_cert = X509Certificate::CreateFromBytes(
  119. base::as_bytes(base::make_span(der_issuer_cert)));
  120. ASSERT_TRUE(issuer_cert);
  121. std::string fake_sct_list = ct::GetFakeOCSPExtensionValue();
  122. ASSERT_FALSE(fake_sct_list.empty());
  123. std::string ocsp_response = ct::GetDerEncodedFakeOCSPResponse();
  124. std::string extracted_sct_list;
  125. EXPECT_TRUE(ct::ExtractSCTListFromOCSPResponse(
  126. issuer_cert->cert_buffer(), subject_cert->serial_number(), ocsp_response,
  127. &extracted_sct_list));
  128. EXPECT_EQ(extracted_sct_list, fake_sct_list);
  129. }
  130. // Test that the extractor honours serial number.
  131. TEST_F(CTObjectsExtractorTest, ExtractSCTListFromOCSPResponseMatchesSerial) {
  132. std::string der_issuer_cert(ct::GetDerEncodedFakeOCSPResponseIssuerCert());
  133. scoped_refptr<X509Certificate> issuer_cert = X509Certificate::CreateFromBytes(
  134. base::as_bytes(base::make_span(der_issuer_cert)));
  135. ASSERT_TRUE(issuer_cert);
  136. std::string ocsp_response = ct::GetDerEncodedFakeOCSPResponse();
  137. std::string extracted_sct_list;
  138. EXPECT_FALSE(ct::ExtractSCTListFromOCSPResponse(
  139. issuer_cert->cert_buffer(), test_cert_->serial_number(), ocsp_response,
  140. &extracted_sct_list));
  141. }
  142. // Test that the extractor honours issuer ID.
  143. TEST_F(CTObjectsExtractorTest, ExtractSCTListFromOCSPResponseMatchesIssuer) {
  144. std::string der_subject_cert(ct::GetDerEncodedFakeOCSPResponseCert());
  145. scoped_refptr<X509Certificate> subject_cert =
  146. X509Certificate::CreateFromBytes(
  147. base::as_bytes(base::make_span(der_subject_cert)));
  148. ASSERT_TRUE(subject_cert);
  149. std::string ocsp_response = ct::GetDerEncodedFakeOCSPResponse();
  150. std::string extracted_sct_list;
  151. // Use test_cert_ for issuer - it is not the correct issuer of |subject_cert|.
  152. EXPECT_FALSE(ct::ExtractSCTListFromOCSPResponse(
  153. test_cert_->cert_buffer(), subject_cert->serial_number(), ocsp_response,
  154. &extracted_sct_list));
  155. }
  156. } // namespace net::ct