trial_comparison_cert_verifier_mojo_unittest.cc 8.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229
  1. // Copyright 2019 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "services/cert_verifier/trial_comparison_cert_verifier_mojo.h"
  5. #include "base/containers/span.h"
  6. #include "base/test/task_environment.h"
  7. #include "build/build_config.h"
  8. #include "net/cert/cert_verify_proc.h"
  9. #include "net/cert/cert_verify_proc_builtin.h"
  10. #include "net/der/encode_values.h"
  11. #include "net/der/parse_values.h"
  12. #include "net/net_buildflags.h"
  13. #include "net/test/cert_test_util.h"
  14. #include "net/test/test_data_directory.h"
  15. #include "testing/gtest/include/gtest/gtest.h"
  16. #if BUILDFLAG(IS_MAC)
  17. #include "net/cert/cert_verify_proc_mac.h"
  18. #include "net/cert/internal/trust_store_mac.h"
  19. #endif
  20. #if BUILDFLAG(IS_WIN)
  21. #include "net/cert/cert_verify_proc_win.h"
  22. #endif
  23. struct ReceivedReport {
  24. std::string hostname;
  25. scoped_refptr<net::X509Certificate> unverified_cert;
  26. bool enable_rev_checking;
  27. bool require_rev_checking_local_anchors;
  28. bool enable_sha1_local_anchors;
  29. bool disable_symantec_enforcement;
  30. std::vector<uint8_t> stapled_ocsp;
  31. std::vector<uint8_t> sct_list;
  32. net::CertVerifyResult primary_result;
  33. net::CertVerifyResult trial_result;
  34. cert_verifier::mojom::CertVerifierDebugInfoPtr debug_info;
  35. };
  36. class FakeReportClient
  37. : public cert_verifier::mojom::TrialComparisonCertVerifierReportClient {
  38. public:
  39. explicit FakeReportClient(
  40. mojo::PendingReceiver<
  41. cert_verifier::mojom::TrialComparisonCertVerifierReportClient>
  42. report_client_receiver)
  43. : receiver_(this, std::move(report_client_receiver)) {}
  44. // TrialComparisonCertVerifierReportClient implementation:
  45. void SendTrialReport(
  46. const std::string& hostname,
  47. const scoped_refptr<net::X509Certificate>& unverified_cert,
  48. bool enable_rev_checking,
  49. bool require_rev_checking_local_anchors,
  50. bool enable_sha1_local_anchors,
  51. bool disable_symantec_enforcement,
  52. const std::vector<uint8_t>& stapled_ocsp,
  53. const std::vector<uint8_t>& sct_list,
  54. const net::CertVerifyResult& primary_result,
  55. const net::CertVerifyResult& trial_result,
  56. cert_verifier::mojom::CertVerifierDebugInfoPtr debug_info) override {
  57. ReceivedReport report;
  58. report.hostname = hostname;
  59. report.unverified_cert = unverified_cert;
  60. report.enable_rev_checking = enable_rev_checking;
  61. report.require_rev_checking_local_anchors =
  62. require_rev_checking_local_anchors;
  63. report.enable_sha1_local_anchors = enable_sha1_local_anchors;
  64. report.disable_symantec_enforcement = disable_symantec_enforcement;
  65. report.stapled_ocsp = stapled_ocsp;
  66. report.sct_list = sct_list;
  67. report.primary_result = primary_result;
  68. report.trial_result = trial_result;
  69. report.debug_info = std::move(debug_info);
  70. reports_.push_back(std::move(report));
  71. run_loop_.Quit();
  72. }
  73. const std::vector<ReceivedReport>& reports() const { return reports_; }
  74. void WaitForReport() { run_loop_.Run(); }
  75. private:
  76. mojo::Receiver<cert_verifier::mojom::TrialComparisonCertVerifierReportClient>
  77. receiver_;
  78. std::vector<ReceivedReport> reports_;
  79. base::RunLoop run_loop_;
  80. };
  81. TEST(TrialComparisonCertVerifierMojoTest, SendReportDebugInfo) {
  82. base::test::TaskEnvironment scoped_task_environment;
  83. scoped_refptr<net::X509Certificate> unverified_cert =
  84. net::ImportCertFromFile(net::GetTestCertsDirectory(), "ok_cert.pem");
  85. scoped_refptr<net::X509Certificate> chain1 =
  86. net::CreateCertificateChainFromFile(net::GetTestCertsDirectory(),
  87. "x509_verify_results.chain.pem",
  88. net::X509Certificate::FORMAT_AUTO);
  89. scoped_refptr<net::X509Certificate> chain2 =
  90. net::CreateCertificateChainFromFile(net::GetTestCertsDirectory(),
  91. "multi-root-chain1.pem",
  92. net::X509Certificate::FORMAT_AUTO);
  93. net::CertVerifyResult primary_result;
  94. primary_result.verified_cert = chain1;
  95. net::CertVerifyResult trial_result;
  96. trial_result.verified_cert = chain2;
  97. base::Time time = base::Time::Now();
  98. #if BUILDFLAG(IS_MAC)
  99. constexpr uint32_t kExpectedTrustResult = 4;
  100. constexpr int32_t kExpectedResultCode = -12345;
  101. std::vector<net::CertVerifyProcMac::ResultDebugData::CertEvidenceInfo>
  102. expected_status_chain;
  103. net::CertVerifyProcMac::ResultDebugData::CertEvidenceInfo info;
  104. info.status_bits = 23456;
  105. expected_status_chain.push_back(info);
  106. info.status_bits = 34567;
  107. info.status_codes.push_back(-4567);
  108. info.status_codes.push_back(-56789);
  109. expected_status_chain.push_back(info);
  110. info.status_bits = 45678;
  111. info.status_codes.clear();
  112. info.status_codes.push_back(-97261);
  113. expected_status_chain.push_back(info);
  114. net::CertVerifyProcMac::ResultDebugData::Create(
  115. kExpectedTrustResult, kExpectedResultCode, expected_status_chain,
  116. &primary_result);
  117. constexpr int kExpectedTrustDebugInfo = 0xABCD;
  118. auto* mac_trust_debug_info =
  119. net::TrustStoreMac::ResultDebugData::GetOrCreate(&trial_result);
  120. ASSERT_TRUE(mac_trust_debug_info);
  121. mac_trust_debug_info->UpdateTrustDebugInfo(
  122. kExpectedTrustDebugInfo, net::TrustStoreMac::TrustImplType::kSimple);
  123. #endif
  124. #if BUILDFLAG(IS_WIN)
  125. std::vector<uint8_t> authroot_sequence{'T', 'E', 'S', 'T'};
  126. net::CertVerifyProcWin::ResultDebugData::Create(time, authroot_sequence,
  127. &primary_result);
  128. #endif
  129. absl::optional<int64_t> chrome_root_store_version = absl::nullopt;
  130. #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED)
  131. chrome_root_store_version = 42;
  132. #endif
  133. net::der::GeneralizedTime der_time;
  134. der_time.year = 2019;
  135. der_time.month = 9;
  136. der_time.day = 27;
  137. der_time.hours = 22;
  138. der_time.minutes = 11;
  139. der_time.seconds = 8;
  140. net::CertVerifyProcBuiltinResultDebugData::Create(
  141. &trial_result, time, der_time, chrome_root_store_version);
  142. mojo::PendingRemote<
  143. cert_verifier::mojom::TrialComparisonCertVerifierReportClient>
  144. report_client_remote;
  145. FakeReportClient report_client(
  146. report_client_remote.InitWithNewPipeAndPassReceiver());
  147. cert_verifier::TrialComparisonCertVerifierMojo tccvm(
  148. true, {}, std::move(report_client_remote), nullptr, nullptr, nullptr,
  149. nullptr);
  150. tccvm.OnSendTrialReport("example.com", unverified_cert, false, false, false,
  151. false, "stapled ocsp", "sct list", primary_result,
  152. trial_result);
  153. report_client.WaitForReport();
  154. ASSERT_EQ(1U, report_client.reports().size());
  155. const ReceivedReport& report = report_client.reports()[0];
  156. EXPECT_TRUE(
  157. unverified_cert->EqualsIncludingChain(report.unverified_cert.get()));
  158. EXPECT_TRUE(
  159. chain1->EqualsIncludingChain(report.primary_result.verified_cert.get()));
  160. EXPECT_TRUE(
  161. chain2->EqualsIncludingChain(report.trial_result.verified_cert.get()));
  162. EXPECT_EQ("stapled ocsp", std::string(report.stapled_ocsp.begin(),
  163. report.stapled_ocsp.end()));
  164. EXPECT_EQ("sct list",
  165. std::string(report.sct_list.begin(), report.sct_list.end()));
  166. ASSERT_TRUE(report.debug_info);
  167. #if BUILDFLAG(IS_MAC)
  168. ASSERT_TRUE(report.debug_info->mac_platform_debug_info);
  169. EXPECT_EQ(kExpectedTrustResult,
  170. report.debug_info->mac_platform_debug_info->trust_result);
  171. EXPECT_EQ(kExpectedResultCode,
  172. report.debug_info->mac_platform_debug_info->result_code);
  173. ASSERT_EQ(expected_status_chain.size(),
  174. report.debug_info->mac_platform_debug_info->status_chain.size());
  175. for (size_t i = 0; i < expected_status_chain.size(); ++i) {
  176. EXPECT_EQ(expected_status_chain[i].status_bits,
  177. report.debug_info->mac_platform_debug_info->status_chain[i]
  178. ->status_bits);
  179. EXPECT_EQ(expected_status_chain[i].status_codes,
  180. report.debug_info->mac_platform_debug_info->status_chain[i]
  181. ->status_codes);
  182. }
  183. EXPECT_EQ(kExpectedTrustDebugInfo,
  184. report.debug_info->mac_combined_trust_debug_info);
  185. EXPECT_EQ(
  186. cert_verifier::mojom::CertVerifierDebugInfo::MacTrustImplType::kSimple,
  187. report.debug_info->mac_trust_impl);
  188. #endif
  189. #if BUILDFLAG(IS_WIN)
  190. ASSERT_TRUE(report.debug_info->win_platform_debug_info);
  191. EXPECT_EQ(time,
  192. report.debug_info->win_platform_debug_info->authroot_this_update);
  193. EXPECT_EQ(
  194. authroot_sequence,
  195. report.debug_info->win_platform_debug_info->authroot_sequence_number);
  196. #endif
  197. #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED)
  198. ASSERT_TRUE(report.debug_info->chrome_root_store_debug_info);
  199. EXPECT_EQ(chrome_root_store_version.value(),
  200. report.debug_info->chrome_root_store_debug_info
  201. ->chrome_root_store_version);
  202. #endif
  203. EXPECT_EQ(time, report.debug_info->trial_verification_time);
  204. EXPECT_EQ("20190927221108Z", report.debug_info->trial_der_verification_time);
  205. }