ct_serialization_unittest.cc 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/ct_serialization.h"
  5. #include <string>
  6. #include "base/files/file_path.h"
  7. #include "base/files/file_util.h"
  8. #include "net/base/test_completion_callback.h"
  9. #include "net/cert/merkle_tree_leaf.h"
  10. #include "net/cert/signed_certificate_timestamp.h"
  11. #include "net/cert/signed_tree_head.h"
  12. #include "net/cert/x509_certificate.h"
  13. #include "net/test/cert_test_util.h"
  14. #include "net/test/ct_test_util.h"
  15. #include "net/test/test_data_directory.h"
  16. #include "testing/gmock/include/gmock/gmock.h"
  17. #include "testing/gtest/include/gtest/gtest.h"
  18. using ::testing::ElementsAreArray;
  19. namespace net {
  20. class CtSerializationTest : public ::testing::Test {
  21. public:
  22. void SetUp() override {
  23. test_digitally_signed_ = ct::GetTestDigitallySigned();
  24. }
  25. protected:
  26. std::string test_digitally_signed_;
  27. };
  28. TEST_F(CtSerializationTest, DecodesDigitallySigned) {
  29. base::StringPiece digitally_signed(test_digitally_signed_);
  30. ct::DigitallySigned parsed;
  31. ASSERT_TRUE(ct::DecodeDigitallySigned(&digitally_signed, &parsed));
  32. EXPECT_EQ(
  33. ct::DigitallySigned::HASH_ALGO_SHA256,
  34. parsed.hash_algorithm);
  35. EXPECT_EQ(
  36. ct::DigitallySigned::SIG_ALGO_ECDSA,
  37. parsed.signature_algorithm);
  38. // The encoded data contains the signature itself from the 4th byte.
  39. // The first bytes are:
  40. // 1 byte of hash algorithm
  41. // 1 byte of signature algorithm
  42. // 2 bytes - prefix containing length of the signature data.
  43. EXPECT_EQ(
  44. test_digitally_signed_.substr(4),
  45. parsed.signature_data);
  46. }
  47. TEST_F(CtSerializationTest, FailsToDecodePartialDigitallySigned) {
  48. base::StringPiece digitally_signed(test_digitally_signed_);
  49. base::StringPiece partial_digitally_signed(
  50. digitally_signed.substr(0, test_digitally_signed_.size() - 5));
  51. ct::DigitallySigned parsed;
  52. ASSERT_FALSE(ct::DecodeDigitallySigned(&partial_digitally_signed, &parsed));
  53. }
  54. TEST_F(CtSerializationTest, EncodesDigitallySigned) {
  55. ct::DigitallySigned digitally_signed;
  56. digitally_signed.hash_algorithm = ct::DigitallySigned::HASH_ALGO_SHA256;
  57. digitally_signed.signature_algorithm = ct::DigitallySigned::SIG_ALGO_ECDSA;
  58. digitally_signed.signature_data = test_digitally_signed_.substr(4);
  59. std::string encoded;
  60. ASSERT_TRUE(ct::EncodeDigitallySigned(digitally_signed, &encoded));
  61. EXPECT_EQ(test_digitally_signed_, encoded);
  62. }
  63. TEST_F(CtSerializationTest, EncodesSignedEntryForX509Cert) {
  64. ct::SignedEntryData entry;
  65. ct::GetX509CertSignedEntry(&entry);
  66. std::string encoded;
  67. ASSERT_TRUE(ct::EncodeSignedEntry(entry, &encoded));
  68. EXPECT_EQ((718U + 5U), encoded.size());
  69. // First two bytes are log entry type. Next, length:
  70. // Length is 718 which is 512 + 206, which is 0x2ce
  71. std::string expected_prefix("\0\0\0\x2\xCE", 5);
  72. // Note we use std::string comparison rather than ASSERT_STREQ due
  73. // to null characters in the buffer.
  74. EXPECT_EQ(expected_prefix, encoded.substr(0, 5));
  75. }
  76. TEST_F(CtSerializationTest, EncodesSignedEntryForPrecert) {
  77. ct::SignedEntryData entry;
  78. ct::GetPrecertSignedEntry(&entry);
  79. std::string encoded;
  80. ASSERT_TRUE(ct::EncodeSignedEntry(entry, &encoded));
  81. EXPECT_EQ(604u, encoded.size());
  82. // First two bytes are the log entry type.
  83. EXPECT_EQ(std::string("\x00\x01", 2), encoded.substr(0, 2));
  84. // Next comes the 32-byte issuer key hash
  85. EXPECT_THAT(encoded.substr(2, 32),
  86. ElementsAreArray(entry.issuer_key_hash.data));
  87. // Then the length of the TBS cert (604 bytes = 0x237)
  88. EXPECT_EQ(std::string("\x00\x02\x37", 3), encoded.substr(34, 3));
  89. // Then the TBS cert itself
  90. EXPECT_EQ(entry.tbs_certificate, encoded.substr(37));
  91. }
  92. TEST_F(CtSerializationTest, EncodesV1SCTSignedData) {
  93. base::Time timestamp =
  94. base::Time::UnixEpoch() + base::Milliseconds(1348589665525);
  95. std::string dummy_entry("abc");
  96. std::string empty_extensions;
  97. // For now, no known failure cases.
  98. std::string encoded;
  99. ASSERT_TRUE(ct::EncodeV1SCTSignedData(
  100. timestamp,
  101. dummy_entry,
  102. empty_extensions,
  103. &encoded));
  104. EXPECT_EQ((size_t) 15, encoded.size());
  105. // Byte 0 is version, byte 1 is signature type
  106. // Bytes 2-10 are timestamp
  107. // Bytes 11-14 are the log signature
  108. // Byte 15 is the empty extension
  109. //EXPECT_EQ(0, timestamp.ToTimeT());
  110. std::string expected_buffer(
  111. "\x0\x0\x0\x0\x1\x39\xFE\x35\x3C\xF5\x61\x62\x63\x0\x0", 15);
  112. EXPECT_EQ(expected_buffer, encoded);
  113. }
  114. TEST_F(CtSerializationTest, DecodesSCTList) {
  115. // Two items in the list: "abc", "def"
  116. base::StringPiece encoded("\x0\xa\x0\x3\x61\x62\x63\x0\x3\x64\x65\x66", 12);
  117. std::vector<base::StringPiece> decoded;
  118. ASSERT_TRUE(ct::DecodeSCTList(encoded, &decoded));
  119. ASSERT_STREQ("abc", decoded[0].data());
  120. ASSERT_STREQ("def", decoded[1].data());
  121. }
  122. TEST_F(CtSerializationTest, FailsDecodingInvalidSCTList) {
  123. // A list with one item that's too short
  124. base::StringPiece encoded("\x0\xa\x0\x3\x61\x62\x63\x0\x5\x64\x65\x66", 12);
  125. std::vector<base::StringPiece> decoded;
  126. ASSERT_FALSE(ct::DecodeSCTList(encoded, &decoded));
  127. }
  128. TEST_F(CtSerializationTest, EncodeSignedCertificateTimestamp) {
  129. std::string encoded_test_sct(ct::GetTestSignedCertificateTimestamp());
  130. base::StringPiece encoded_sct(encoded_test_sct);
  131. scoped_refptr<ct::SignedCertificateTimestamp> sct;
  132. ASSERT_TRUE(ct::DecodeSignedCertificateTimestamp(&encoded_sct, &sct));
  133. std::string serialized;
  134. ASSERT_TRUE(ct::EncodeSignedCertificateTimestamp(sct, &serialized));
  135. EXPECT_EQ(serialized, encoded_test_sct);
  136. }
  137. TEST_F(CtSerializationTest, DecodesSignedCertificateTimestamp) {
  138. std::string encoded_test_sct(ct::GetTestSignedCertificateTimestamp());
  139. base::StringPiece encoded_sct(encoded_test_sct);
  140. scoped_refptr<ct::SignedCertificateTimestamp> sct;
  141. ASSERT_TRUE(ct::DecodeSignedCertificateTimestamp(&encoded_sct, &sct));
  142. EXPECT_EQ(0, sct->version);
  143. EXPECT_EQ(ct::GetTestPublicKeyId(), sct->log_id);
  144. base::Time expected_time =
  145. base::Time::UnixEpoch() + base::Milliseconds(1365181456089);
  146. EXPECT_EQ(expected_time, sct->timestamp);
  147. // Subtracting 4 bytes for signature data (hash & sig algs),
  148. // actual signature data should be 71 bytes.
  149. EXPECT_EQ((size_t) 71, sct->signature.signature_data.size());
  150. EXPECT_TRUE(sct->extensions.empty());
  151. }
  152. TEST_F(CtSerializationTest, FailsDecodingInvalidSignedCertificateTimestamp) {
  153. // Invalid version
  154. base::StringPiece invalid_version_sct("\x2\x0", 2);
  155. scoped_refptr<ct::SignedCertificateTimestamp> sct;
  156. ASSERT_FALSE(
  157. ct::DecodeSignedCertificateTimestamp(&invalid_version_sct, &sct));
  158. // Valid version, invalid length (missing data)
  159. base::StringPiece invalid_length_sct("\x0\xa\xb\xc", 4);
  160. ASSERT_FALSE(
  161. ct::DecodeSignedCertificateTimestamp(&invalid_length_sct, &sct));
  162. }
  163. TEST_F(CtSerializationTest, EncodesMerkleTreeLeafForX509Cert) {
  164. ct::MerkleTreeLeaf tree_leaf;
  165. ct::GetX509CertTreeLeaf(&tree_leaf);
  166. std::string encoded;
  167. ASSERT_TRUE(ct::EncodeTreeLeaf(tree_leaf, &encoded));
  168. EXPECT_EQ(741u, encoded.size()) << "Merkle tree leaf encoded incorrectly";
  169. EXPECT_EQ(std::string("\x00", 1), encoded.substr(0, 1)) <<
  170. "Version encoded incorrectly";
  171. EXPECT_EQ(std::string("\x00", 1), encoded.substr(1, 1)) <<
  172. "Merkle tree leaf type encoded incorrectly";
  173. EXPECT_EQ(std::string("\x00\x00\x01\x45\x3c\x5f\xb8\x35", 8),
  174. encoded.substr(2, 8)) <<
  175. "Timestamp encoded incorrectly";
  176. EXPECT_EQ(std::string("\x00\x00", 2), encoded.substr(10, 2)) <<
  177. "Log entry type encoded incorrectly";
  178. EXPECT_EQ(std::string("\x00\x02\xce", 3), encoded.substr(12, 3)) <<
  179. "Certificate length encoded incorrectly";
  180. EXPECT_EQ(tree_leaf.signed_entry.leaf_certificate, encoded.substr(15, 718))
  181. << "Certificate encoded incorrectly";
  182. EXPECT_EQ(std::string("\x00\x06", 2), encoded.substr(733, 2)) <<
  183. "CT extensions length encoded incorrectly";
  184. EXPECT_EQ(tree_leaf.extensions, encoded.substr(735, 6)) <<
  185. "CT extensions encoded incorrectly";
  186. }
  187. TEST_F(CtSerializationTest, EncodesMerkleTreeLeafForPrecert) {
  188. ct::MerkleTreeLeaf tree_leaf;
  189. ct::GetPrecertTreeLeaf(&tree_leaf);
  190. std::string encoded;
  191. ASSERT_TRUE(ct::EncodeTreeLeaf(tree_leaf, &encoded));
  192. EXPECT_EQ(622u, encoded.size()) << "Merkle tree leaf encoded incorrectly";
  193. EXPECT_EQ(std::string("\x00", 1), encoded.substr(0, 1)) <<
  194. "Version encoded incorrectly";
  195. EXPECT_EQ(std::string("\x00", 1), encoded.substr(1, 1)) <<
  196. "Merkle tree leaf type encoded incorrectly";
  197. EXPECT_EQ(std::string("\x00\x00\x01\x45\x3c\x5f\xb8\x35", 8),
  198. encoded.substr(2, 8)) <<
  199. "Timestamp encoded incorrectly";
  200. EXPECT_EQ(std::string("\x00\x01", 2), encoded.substr(10, 2)) <<
  201. "Log entry type encoded incorrectly";
  202. EXPECT_THAT(encoded.substr(12, 32),
  203. ElementsAreArray(tree_leaf.signed_entry.issuer_key_hash.data))
  204. << "Issuer key hash encoded incorrectly";
  205. EXPECT_EQ(std::string("\x00\x02\x37", 3), encoded.substr(44, 3)) <<
  206. "TBS certificate length encoded incorrectly";
  207. EXPECT_EQ(tree_leaf.signed_entry.tbs_certificate, encoded.substr(47, 567))
  208. << "TBS certificate encoded incorrectly";
  209. EXPECT_EQ(std::string("\x00\x06", 2), encoded.substr(614, 2)) <<
  210. "CT extensions length encoded incorrectly";
  211. EXPECT_EQ(tree_leaf.extensions, encoded.substr(616, 6)) <<
  212. "CT extensions encoded incorrectly";
  213. }
  214. TEST_F(CtSerializationTest, EncodesValidSignedTreeHead) {
  215. ct::SignedTreeHead signed_tree_head;
  216. ASSERT_TRUE(GetSampleSignedTreeHead(&signed_tree_head));
  217. std::string encoded;
  218. ASSERT_TRUE(ct::EncodeTreeHeadSignature(signed_tree_head, &encoded));
  219. // Expected size is 50 bytes:
  220. // Byte 0 is version, byte 1 is signature type
  221. // Bytes 2-9 are timestamp
  222. // Bytes 10-17 are tree size
  223. // Bytes 18-49 are sha256 root hash
  224. ASSERT_EQ(50u, encoded.length());
  225. std::string expected_buffer(
  226. "\x0\x1\x0\x0\x1\x45\x3c\x5f\xb8\x35\x0\x0\x0\x0\x0\x0\x0\x15", 18);
  227. expected_buffer.append(ct::GetSampleSTHSHA256RootHash());
  228. ASSERT_EQ(expected_buffer, encoded);
  229. }
  230. } // namespace net