| // Copyright 2020 The Chromium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "quic/quic_transport/web_transport_fingerprint_proof_verifier.h" |
| |
| #include <memory> |
| |
| #include "absl/strings/escaping.h" |
| #include "absl/strings/string_view.h" |
| #include "quic/core/quic_types.h" |
| #include "quic/core/quic_utils.h" |
| #include "quic/platform/api/quic_test.h" |
| #include "quic/test_tools/mock_clock.h" |
| #include "quic/test_tools/test_certificates.h" |
| |
| namespace quic { |
| namespace test { |
| namespace { |
| |
| using ::testing::HasSubstr; |
| |
| // 2020-02-01 12:35:56 UTC |
| constexpr QuicTime::Delta kValidTime = QuicTime::Delta::FromSeconds(1580560556); |
| |
| struct VerifyResult { |
| QuicAsyncStatus status; |
| WebTransportFingerprintProofVerifier::Status detailed_status; |
| std::string error; |
| }; |
| |
| class WebTransportFingerprintProofVerifierTest : public QuicTest { |
| public: |
| WebTransportFingerprintProofVerifierTest() { |
| clock_.AdvanceTime(kValidTime); |
| verifier_ = std::make_unique<WebTransportFingerprintProofVerifier>( |
| &clock_, /*max_validity_days=*/365); |
| AddTestCertificate(); |
| } |
| |
| protected: |
| VerifyResult Verify(absl::string_view certificate) { |
| VerifyResult result; |
| std::unique_ptr<ProofVerifyDetails> details; |
| uint8_t tls_alert; |
| result.status = verifier_->VerifyCertChain( |
| /*hostname=*/"", /*port=*/0, |
| std::vector<std::string>{std::string(certificate)}, |
| /*ocsp_response=*/"", |
| /*cert_sct=*/"", |
| /*context=*/nullptr, &result.error, &details, &tls_alert, |
| /*callback=*/nullptr); |
| result.detailed_status = |
| static_cast<WebTransportFingerprintProofVerifier::Details*>( |
| details.get()) |
| ->status(); |
| return result; |
| } |
| |
| void AddTestCertificate() { |
| EXPECT_TRUE(verifier_->AddFingerprint(WebTransportHash{ |
| WebTransportHash::kSha256, RawSha256(kTestCertificate)})); |
| } |
| |
| MockClock clock_; |
| std::unique_ptr<WebTransportFingerprintProofVerifier> verifier_; |
| }; |
| |
| TEST_F(WebTransportFingerprintProofVerifierTest, Sha256Fingerprint) { |
| // Computed using `openssl x509 -fingerprint -sha256`. |
| EXPECT_EQ(absl::BytesToHexString(RawSha256(kTestCertificate)), |
| "f2e5465e2bf7ecd6f63066a5a37511734aa0eb7c4701" |
| "0e86d6758ed4f4fa1b0f"); |
| } |
| |
| TEST_F(WebTransportFingerprintProofVerifierTest, SimpleFingerprint) { |
| VerifyResult result = Verify(kTestCertificate); |
| EXPECT_EQ(result.status, QUIC_SUCCESS); |
| EXPECT_EQ(result.detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kValidCertificate); |
| |
| result = Verify(kWildcardCertificate); |
| EXPECT_EQ(result.status, QUIC_FAILURE); |
| EXPECT_EQ(result.detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kUnknownFingerprint); |
| |
| result = Verify("Some random text"); |
| EXPECT_EQ(result.status, QUIC_FAILURE); |
| } |
| |
| TEST_F(WebTransportFingerprintProofVerifierTest, Validity) { |
| // Validity periods of kTestCertificate, according to `openssl x509 -text`: |
| // Not Before: Jan 30 18:13:59 2020 GMT |
| // Not After : Feb 2 18:13:59 2020 GMT |
| |
| // 2020-01-29 19:00:00 UTC |
| constexpr QuicTime::Delta kStartTime = |
| QuicTime::Delta::FromSeconds(1580324400); |
| clock_.Reset(); |
| clock_.AdvanceTime(kStartTime); |
| |
| VerifyResult result = Verify(kTestCertificate); |
| EXPECT_EQ(result.status, QUIC_FAILURE); |
| EXPECT_EQ(result.detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kExpired); |
| |
| clock_.AdvanceTime(QuicTime::Delta::FromSeconds(86400)); |
| result = Verify(kTestCertificate); |
| EXPECT_EQ(result.status, QUIC_SUCCESS); |
| EXPECT_EQ(result.detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kValidCertificate); |
| |
| clock_.AdvanceTime(QuicTime::Delta::FromSeconds(4 * 86400)); |
| result = Verify(kTestCertificate); |
| EXPECT_EQ(result.status, QUIC_FAILURE); |
| EXPECT_EQ(result.detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kExpired); |
| } |
| |
| TEST_F(WebTransportFingerprintProofVerifierTest, MaxValidity) { |
| verifier_ = std::make_unique<WebTransportFingerprintProofVerifier>( |
| &clock_, /*max_validity_days=*/2); |
| AddTestCertificate(); |
| VerifyResult result = Verify(kTestCertificate); |
| EXPECT_EQ(result.status, QUIC_FAILURE); |
| EXPECT_EQ(result.detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kExpiryTooLong); |
| EXPECT_THAT(result.error, HasSubstr("limit of 2 days")); |
| |
| // kTestCertificate is valid for exactly four days. |
| verifier_ = std::make_unique<WebTransportFingerprintProofVerifier>( |
| &clock_, /*max_validity_days=*/4); |
| AddTestCertificate(); |
| result = Verify(kTestCertificate); |
| EXPECT_EQ(result.status, QUIC_SUCCESS); |
| EXPECT_EQ(result.detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kValidCertificate); |
| } |
| |
| TEST_F(WebTransportFingerprintProofVerifierTest, InvalidCertificate) { |
| constexpr absl::string_view kInvalidCertificate = "Hello, world!"; |
| ASSERT_TRUE(verifier_->AddFingerprint(WebTransportHash{ |
| WebTransportHash::kSha256, RawSha256(kInvalidCertificate)})); |
| |
| VerifyResult result = Verify(kInvalidCertificate); |
| EXPECT_EQ(result.status, QUIC_FAILURE); |
| EXPECT_EQ( |
| result.detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kCertificateParseFailure); |
| } |
| |
| TEST_F(WebTransportFingerprintProofVerifierTest, AddCertificate) { |
| // Accept all-uppercase fingerprints. |
| verifier_ = std::make_unique<WebTransportFingerprintProofVerifier>( |
| &clock_, /*max_validity_days=*/365); |
| EXPECT_TRUE(verifier_->AddFingerprint(CertificateFingerprint{ |
| CertificateFingerprint::kSha256, |
| "F2:E5:46:5E:2B:F7:EC:D6:F6:30:66:A5:A3:75:11:73:4A:A0:EB:" |
| "7C:47:01:0E:86:D6:75:8E:D4:F4:FA:1B:0F"})); |
| EXPECT_EQ(Verify(kTestCertificate).detailed_status, |
| WebTransportFingerprintProofVerifier::Status::kValidCertificate); |
| |
| // Reject unknown hash algorithms. |
| EXPECT_FALSE(verifier_->AddFingerprint(CertificateFingerprint{ |
| "sha-1", "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"})); |
| // Reject invalid length. |
| EXPECT_FALSE(verifier_->AddFingerprint( |
| CertificateFingerprint{CertificateFingerprint::kSha256, "00:00:00:00"})); |
| // Reject missing colons. |
| EXPECT_FALSE(verifier_->AddFingerprint(CertificateFingerprint{ |
| CertificateFingerprint::kSha256, |
| "00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00.00." |
| "00.00.00.00.00.00.00.00.00.00.00.00.00"})); |
| // Reject non-hex symbols. |
| EXPECT_FALSE(verifier_->AddFingerprint(CertificateFingerprint{ |
| CertificateFingerprint::kSha256, |
| "zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:" |
| "zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz:zz"})); |
| } |
| |
| } // namespace |
| } // namespace test |
| } // namespace quic |