Don't process HSTS/HPKP headers when host is an IP address

net/test/spawned_test_server/base_test_server.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/test/spawned_test_server/base_test_server.h"
 
 #include <string>
 #include <vector>
 
 #include "base/base64.h"
@@ skipping 11 matching lines @@
 #include "net/dns/host_resolver.h"
 #include "net/log/net_log.h"
 #include "url/gurl.h"
 
 namespace net {
 
 namespace {
 
 std::string GetHostname(BaseTestServer::Type type,
                         const BaseTestServer::SSLOptions& options) {
-  if (BaseTestServer::UsingSSL(type) &&
-      options.server_certificate ==
-          BaseTestServer::SSLOptions::CERT_MISMATCHED_NAME) {
-    // Return a different hostname string that resolves to the same hostname.
-    return "localhost";
+  if (BaseTestServer::UsingSSL(type)) {
+    if (options.server_certificate ==
+            BaseTestServer::SSLOptions::CERT_MISMATCHED_NAME ||
+        options.server_certificate ==
+            BaseTestServer::SSLOptions::CERT_COMMON_NAME_IS_DOMAIN) {
+      // For CERT_MISMATCHED_NAME, return a different hostname string

[palmer, 2015/04/03 21:04:51]

Nit: It's good to delimit identifiers in comments with |...|: "For
|CERT_MISMATCHED_NAME|, return a...".

[estark, 2015/04/03 21:22:30]

Done.

+      // that resolves to the same hostname. For
+      // CERT_COMMON_NAME_IS_DOMAIN, the certificate is issued for
+      // "localhost" instead of "127.0.0.1".
+      return "localhost";
+    }
   }
 
   // Use the 127.0.0.1 as default.
   return BaseTestServer::kLocalhost;
 }
 
 std::string GetClientCertType(SSLClientCertType type) {
   switch (type) {
     case CLIENT_CERT_RSA_SIGN:
       return "rsa_sign";
@@ skipping 79 matching lines @@
       alert_after_handshake(false) {
 }
 
 BaseTestServer::SSLOptions::~SSLOptions() {}
 
 base::FilePath BaseTestServer::SSLOptions::GetCertificateFile() const {
   switch (server_certificate) {
     case CERT_OK:
     case CERT_MISMATCHED_NAME:
       return base::FilePath(FILE_PATH_LITERAL("ok_cert.pem"));
+    case CERT_COMMON_NAME_IS_DOMAIN:
+      return base::FilePath(FILE_PATH_LITERAL("localhost_cert.pem"));
     case CERT_EXPIRED:
       return base::FilePath(FILE_PATH_LITERAL("expired_cert.pem"));
     case CERT_CHAIN_WRONG_ROOT:
       // This chain uses its own dedicated test root certificate to avoid
       // side-effects that may affect testing.
       return base::FilePath(FILE_PATH_LITERAL("redundant-server-chain.pem"));
     case CERT_AUTO:
       return base::FilePath();
     default:
       NOTREACHED();
@@ skipping 346 matching lines @@
 
   return GenerateAdditionalArguments(arguments);
 }
 
 bool BaseTestServer::GenerateAdditionalArguments(
     base::DictionaryValue* arguments) const {
   return true;
 }
 
 }  // namespace net