OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stdint.h> | 5 #include <stdint.h> |
6 #include <algorithm> | 6 #include <algorithm> |
7 | 7 |
8 #include "base/base64.h" | 8 #include "base/base64.h" |
9 #include "base/sha1.h" | 9 #include "base/sha1.h" |
10 #include "base/strings/string_piece.h" | 10 #include "base/strings/string_piece.h" |
(...skipping 134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
145 // values for its predictable fields. | 145 // values for its predictable fields. |
146 EXPECT_EQ(0, max_age.InSeconds()); | 146 EXPECT_EQ(0, max_age.InSeconds()); |
147 EXPECT_FALSE(include_subdomains); | 147 EXPECT_FALSE(include_subdomains); |
148 } | 148 } |
149 | 149 |
150 static void TestBogusPinsHeaders(HashValueTag tag) { | 150 static void TestBogusPinsHeaders(HashValueTag tag) { |
151 base::TimeDelta max_age; | 151 base::TimeDelta max_age; |
152 bool include_subdomains; | 152 bool include_subdomains; |
153 HashValueVector hashes; | 153 HashValueVector hashes; |
154 HashValueVector chain_hashes; | 154 HashValueVector chain_hashes; |
| 155 std::string report_uri; |
155 | 156 |
156 // Set some fake "chain" hashes | 157 // Set some fake "chain" hashes |
157 chain_hashes.push_back(GetTestHashValue(1, tag)); | 158 chain_hashes.push_back(GetTestHashValue(1, tag)); |
158 chain_hashes.push_back(GetTestHashValue(2, tag)); | 159 chain_hashes.push_back(GetTestHashValue(2, tag)); |
159 chain_hashes.push_back(GetTestHashValue(3, tag)); | 160 chain_hashes.push_back(GetTestHashValue(3, tag)); |
160 | 161 |
161 // The good pin must be in the chain, the backup pin must not be | 162 // The good pin must be in the chain, the backup pin must not be |
162 std::string good_pin = GetTestPin(2, tag); | 163 std::string good_pin = GetTestPin(2, tag); |
163 std::string good_pin_unquoted = GetTestPinUnquoted(2, tag); | 164 std::string good_pin_unquoted = GetTestPinUnquoted(2, tag); |
164 std::string backup_pin = GetTestPin(4, tag); | 165 std::string backup_pin = GetTestPin(4, tag); |
165 | 166 |
166 EXPECT_FALSE(ParseHPKPHeader(std::string(), chain_hashes, &max_age, | 167 EXPECT_FALSE(ParseHPKPHeader(std::string(), chain_hashes, &max_age, |
167 &include_subdomains, &hashes)); | 168 &include_subdomains, &hashes, &report_uri)); |
168 EXPECT_FALSE(ParseHPKPHeader(" ", chain_hashes, &max_age, | 169 EXPECT_FALSE(ParseHPKPHeader(" ", chain_hashes, &max_age, |
169 &include_subdomains, &hashes)); | 170 &include_subdomains, &hashes, &report_uri)); |
170 EXPECT_FALSE(ParseHPKPHeader("abc", chain_hashes, &max_age, | 171 EXPECT_FALSE(ParseHPKPHeader("abc", chain_hashes, &max_age, |
171 &include_subdomains, &hashes)); | 172 &include_subdomains, &hashes, &report_uri)); |
172 EXPECT_FALSE(ParseHPKPHeader(" abc", chain_hashes, &max_age, | 173 EXPECT_FALSE(ParseHPKPHeader(" abc", chain_hashes, &max_age, |
173 &include_subdomains, &hashes)); | 174 &include_subdomains, &hashes, &report_uri)); |
174 EXPECT_FALSE(ParseHPKPHeader(" abc ", chain_hashes, &max_age, | 175 EXPECT_FALSE(ParseHPKPHeader(" abc ", chain_hashes, &max_age, |
175 &include_subdomains, &hashes)); | 176 &include_subdomains, &hashes, &report_uri)); |
176 EXPECT_FALSE(ParseHPKPHeader("max-age", chain_hashes, &max_age, | 177 EXPECT_FALSE(ParseHPKPHeader("max-age", chain_hashes, &max_age, |
177 &include_subdomains, &hashes)); | 178 &include_subdomains, &hashes, &report_uri)); |
178 EXPECT_FALSE(ParseHPKPHeader(" max-age", chain_hashes, &max_age, | 179 EXPECT_FALSE(ParseHPKPHeader(" max-age", chain_hashes, &max_age, |
179 &include_subdomains, &hashes)); | 180 &include_subdomains, &hashes, &report_uri)); |
180 EXPECT_FALSE(ParseHPKPHeader(" max-age ", chain_hashes, &max_age, | 181 EXPECT_FALSE(ParseHPKPHeader(" max-age ", chain_hashes, &max_age, |
181 &include_subdomains, &hashes)); | 182 &include_subdomains, &hashes, &report_uri)); |
182 EXPECT_FALSE(ParseHPKPHeader("max-age=", chain_hashes, &max_age, | 183 EXPECT_FALSE(ParseHPKPHeader("max-age=", chain_hashes, &max_age, |
183 &include_subdomains, &hashes)); | 184 &include_subdomains, &hashes, &report_uri)); |
184 EXPECT_FALSE(ParseHPKPHeader(" max-age=", chain_hashes, &max_age, | 185 EXPECT_FALSE(ParseHPKPHeader(" max-age=", chain_hashes, &max_age, |
185 &include_subdomains, &hashes)); | 186 &include_subdomains, &hashes, &report_uri)); |
186 EXPECT_FALSE(ParseHPKPHeader(" max-age =", chain_hashes, &max_age, | 187 EXPECT_FALSE(ParseHPKPHeader(" max-age =", chain_hashes, &max_age, |
187 &include_subdomains, &hashes)); | 188 &include_subdomains, &hashes, &report_uri)); |
188 EXPECT_FALSE(ParseHPKPHeader(" max-age= ", chain_hashes, &max_age, | 189 EXPECT_FALSE(ParseHPKPHeader(" max-age= ", chain_hashes, &max_age, |
189 &include_subdomains, &hashes)); | 190 &include_subdomains, &hashes, &report_uri)); |
190 EXPECT_FALSE(ParseHPKPHeader(" max-age = ", chain_hashes, | 191 EXPECT_FALSE(ParseHPKPHeader(" max-age = ", chain_hashes, &max_age, |
191 &max_age, &include_subdomains, &hashes)); | 192 &include_subdomains, &hashes, &report_uri)); |
192 EXPECT_FALSE(ParseHPKPHeader(" max-age = xy", chain_hashes, | 193 EXPECT_FALSE(ParseHPKPHeader(" max-age = xy", chain_hashes, &max_age, |
193 &max_age, &include_subdomains, &hashes)); | 194 &include_subdomains, &hashes, &report_uri)); |
194 EXPECT_FALSE(ParseHPKPHeader(" max-age = 3488a923", | 195 EXPECT_FALSE(ParseHPKPHeader(" max-age = 3488a923", chain_hashes, |
| 196 &max_age, &include_subdomains, &hashes, |
| 197 &report_uri)); |
| 198 EXPECT_FALSE(ParseHPKPHeader("max-age=3488a923 ", chain_hashes, &max_age, |
| 199 &include_subdomains, &hashes, &report_uri)); |
| 200 EXPECT_FALSE(ParseHPKPHeader( |
| 201 "max-ag=3488923pins=" + good_pin + "," + backup_pin, chain_hashes, |
| 202 &max_age, &include_subdomains, &hashes, &report_uri)); |
| 203 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923;pins=" + good_pin + "," + |
| 204 backup_pin + "report-uri=\"http://foo.com\"", |
195 chain_hashes, &max_age, &include_subdomains, | 205 chain_hashes, &max_age, &include_subdomains, |
196 &hashes)); | 206 &hashes, &report_uri)); |
197 EXPECT_FALSE(ParseHPKPHeader("max-age=3488a923 ", chain_hashes, | 207 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923" + backup_pin, chain_hashes, |
198 &max_age, &include_subdomains, &hashes)); | 208 &max_age, &include_subdomains, &hashes, |
199 EXPECT_FALSE(ParseHPKPHeader("max-ag=3488923pins=" + good_pin + "," + | 209 &report_uri)); |
200 backup_pin, | 210 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + backup_pin, chain_hashes, |
| 211 &max_age, &include_subdomains, &hashes, |
| 212 &report_uri)); |
| 213 EXPECT_FALSE(ParseHPKPHeader( |
| 214 "max-aged=3488923; " + backup_pin + ";" + backup_pin, chain_hashes, |
| 215 &max_age, &include_subdomains, &hashes, &report_uri)); |
| 216 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin + ";" + good_pin, |
201 chain_hashes, &max_age, &include_subdomains, | 217 chain_hashes, &max_age, &include_subdomains, |
202 &hashes)); | 218 &hashes, &report_uri)); |
203 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923" + backup_pin, | 219 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin, chain_hashes, |
204 chain_hashes, &max_age, &include_subdomains, | 220 &max_age, &include_subdomains, &hashes, |
205 &hashes)); | 221 &report_uri)); |
206 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + backup_pin, | |
207 chain_hashes, &max_age, &include_subdomains, | |
208 &hashes)); | |
209 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + backup_pin + ";" + | |
210 backup_pin, | |
211 chain_hashes, &max_age, &include_subdomains, | |
212 &hashes)); | |
213 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin + ";" + | |
214 good_pin, | |
215 chain_hashes, &max_age, &include_subdomains, | |
216 &hashes)); | |
217 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin, | |
218 chain_hashes, &max_age, &include_subdomains, | |
219 &hashes)); | |
220 EXPECT_FALSE(ParseHPKPHeader("max-age==3488923", chain_hashes, &max_age, | 222 EXPECT_FALSE(ParseHPKPHeader("max-age==3488923", chain_hashes, &max_age, |
221 &include_subdomains, &hashes)); | 223 &include_subdomains, &hashes, &report_uri)); |
222 EXPECT_FALSE(ParseHPKPHeader("amax-age=3488923", chain_hashes, &max_age, | 224 EXPECT_FALSE(ParseHPKPHeader("amax-age=3488923", chain_hashes, &max_age, |
223 &include_subdomains, &hashes)); | 225 &include_subdomains, &hashes, &report_uri)); |
224 EXPECT_FALSE(ParseHPKPHeader("max-age=-3488923", chain_hashes, &max_age, | 226 EXPECT_FALSE(ParseHPKPHeader("max-age=-3488923", chain_hashes, &max_age, |
225 &include_subdomains, &hashes)); | 227 &include_subdomains, &hashes, &report_uri)); |
226 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923;", chain_hashes, &max_age, | 228 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923;", chain_hashes, &max_age, |
227 &include_subdomains, &hashes)); | 229 &include_subdomains, &hashes, &report_uri)); |
228 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923 e", chain_hashes, | 230 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923 e", chain_hashes, &max_age, |
229 &max_age, &include_subdomains, &hashes)); | 231 &include_subdomains, &hashes, &report_uri)); |
230 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923 includesubdomain", | 232 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923 includesubdomain", |
231 chain_hashes, &max_age, &include_subdomains, | 233 chain_hashes, &max_age, &include_subdomains, |
232 &hashes)); | 234 &hashes, &report_uri)); |
| 235 EXPECT_FALSE(ParseHPKPHeader( |
| 236 "max-age=3488923 report-uri=\"http://foo.com\"", chain_hashes, |
| 237 &max_age, &include_subdomains, &hashes, &report_uri)); |
233 EXPECT_FALSE(ParseHPKPHeader("max-age=34889.23", chain_hashes, &max_age, | 238 EXPECT_FALSE(ParseHPKPHeader("max-age=34889.23", chain_hashes, &max_age, |
234 &include_subdomains, &hashes)); | 239 &include_subdomains, &hashes, &report_uri)); |
235 EXPECT_FALSE( | 240 EXPECT_FALSE(ParseHPKPHeader( |
236 ParseHPKPHeader("max-age=243; " + good_pin_unquoted + ";" + backup_pin, | 241 "max-age=243; " + good_pin_unquoted + ";" + backup_pin, chain_hashes, |
237 chain_hashes, &max_age, &include_subdomains, &hashes)); | 242 &max_age, &include_subdomains, &hashes, &report_uri)); |
| 243 EXPECT_FALSE(ParseHPKPHeader( |
| 244 "max-age=243; " + good_pin + ";" + backup_pin + ";report-uri=;", |
| 245 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
| 246 EXPECT_FALSE(ParseHPKPHeader("max-age=243; " + good_pin + ";" + backup_pin + |
| 247 ";report-uri=http://foo.com;", |
| 248 chain_hashes, &max_age, &include_subdomains, |
| 249 &hashes, &report_uri)); |
| 250 EXPECT_FALSE(ParseHPKPHeader( |
| 251 "max-age=243; " + good_pin + ";" + backup_pin + ";report-uri=''", |
| 252 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
| 253 |
| 254 // Test that the parser rejects misquoted strings. |
| 255 EXPECT_FALSE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 256 "; report-uri=\"http://foo;bar\'", |
| 257 chain_hashes, &max_age, &include_subdomains, |
| 258 &hashes, &report_uri)); |
238 | 259 |
239 // Check the out args were not updated by checking the default | 260 // Check the out args were not updated by checking the default |
240 // values for its predictable fields. | 261 // values for its predictable fields. |
241 EXPECT_EQ(0, max_age.InSeconds()); | 262 EXPECT_EQ(0, max_age.InSeconds()); |
242 EXPECT_EQ(hashes.size(), (size_t)0); | 263 EXPECT_EQ(hashes.size(), (size_t)0); |
243 } | 264 } |
244 | 265 |
245 TEST_F(HttpSecurityHeadersTest, ValidSTSHeaders) { | 266 TEST_F(HttpSecurityHeadersTest, ValidSTSHeaders) { |
246 base::TimeDelta max_age; | 267 base::TimeDelta max_age; |
247 base::TimeDelta expect_max_age; | 268 base::TimeDelta expect_max_age; |
(...skipping 150 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
398 EXPECT_EQ(expect_max_age, max_age); | 419 EXPECT_EQ(expect_max_age, max_age); |
399 EXPECT_TRUE(include_subdomains); | 420 EXPECT_TRUE(include_subdomains); |
400 } | 421 } |
401 | 422 |
402 static void TestValidPKPHeaders(HashValueTag tag) { | 423 static void TestValidPKPHeaders(HashValueTag tag) { |
403 base::TimeDelta max_age; | 424 base::TimeDelta max_age; |
404 base::TimeDelta expect_max_age; | 425 base::TimeDelta expect_max_age; |
405 bool include_subdomains; | 426 bool include_subdomains; |
406 HashValueVector hashes; | 427 HashValueVector hashes; |
407 HashValueVector chain_hashes; | 428 HashValueVector chain_hashes; |
| 429 std::string expect_report_uri; |
| 430 std::string report_uri; |
408 | 431 |
409 // Set some fake "chain" hashes into chain_hashes | 432 // Set some fake "chain" hashes into chain_hashes |
410 chain_hashes.push_back(GetTestHashValue(1, tag)); | 433 chain_hashes.push_back(GetTestHashValue(1, tag)); |
411 chain_hashes.push_back(GetTestHashValue(2, tag)); | 434 chain_hashes.push_back(GetTestHashValue(2, tag)); |
412 chain_hashes.push_back(GetTestHashValue(3, tag)); | 435 chain_hashes.push_back(GetTestHashValue(3, tag)); |
413 | 436 |
414 // The good pin must be in the chain, the backup pin must not be | 437 // The good pin must be in the chain, the backup pin must not be |
415 std::string good_pin = GetTestPin(2, tag); | 438 std::string good_pin = GetTestPin(2, tag); |
416 std::string good_pin2 = GetTestPin(3, tag); | 439 std::string good_pin2 = GetTestPin(3, tag); |
417 std::string backup_pin = GetTestPin(4, tag); | 440 std::string backup_pin = GetTestPin(4, tag); |
418 | 441 |
419 EXPECT_TRUE(ParseHPKPHeader( | 442 EXPECT_TRUE(ParseHPKPHeader("max-age=243; " + good_pin + ";" + backup_pin, |
420 "max-age=243; " + good_pin + ";" + backup_pin, | 443 chain_hashes, &max_age, &include_subdomains, |
421 chain_hashes, &max_age, &include_subdomains, &hashes)); | 444 &hashes, &report_uri)); |
422 expect_max_age = base::TimeDelta::FromSeconds(243); | 445 expect_max_age = base::TimeDelta::FromSeconds(243); |
423 EXPECT_EQ(expect_max_age, max_age); | 446 EXPECT_EQ(expect_max_age, max_age); |
424 EXPECT_FALSE(include_subdomains); | 447 EXPECT_FALSE(include_subdomains); |
| 448 EXPECT_EQ(std::string(), report_uri); |
425 | 449 |
426 EXPECT_TRUE(ParseHPKPHeader( | 450 EXPECT_TRUE(ParseHPKPHeader( |
427 " " + good_pin + "; " + backup_pin + " ; Max-agE = 567", | 451 "max-age=243; " + good_pin + ";" + backup_pin + "; report-uri= \"/foo\"", |
428 chain_hashes, &max_age, &include_subdomains, &hashes)); | 452 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
429 expect_max_age = base::TimeDelta::FromSeconds(567); | 453 expect_max_age = base::TimeDelta::FromSeconds(243); |
| 454 expect_report_uri = "/foo"; |
430 EXPECT_EQ(expect_max_age, max_age); | 455 EXPECT_EQ(expect_max_age, max_age); |
431 EXPECT_FALSE(include_subdomains); | 456 EXPECT_FALSE(include_subdomains); |
| 457 EXPECT_EQ(expect_report_uri, report_uri); |
432 | 458 |
433 EXPECT_TRUE(ParseHPKPHeader( | 459 EXPECT_TRUE(ParseHPKPHeader(" " + good_pin + "; " + backup_pin + |
434 "includeSubDOMAINS;" + good_pin + ";" + backup_pin + | 460 " ; Max-agE = 567; repOrT-URi = \"/foo\"", |
435 " ; mAx-aGe = 890 ", | 461 chain_hashes, &max_age, &include_subdomains, |
436 chain_hashes, &max_age, &include_subdomains, &hashes)); | 462 &hashes, &report_uri)); |
| 463 expect_max_age = base::TimeDelta::FromSeconds(567); |
| 464 expect_report_uri = "/foo"; |
| 465 EXPECT_EQ(expect_max_age, max_age); |
| 466 EXPECT_FALSE(include_subdomains); |
| 467 EXPECT_EQ(expect_report_uri, report_uri); |
| 468 |
| 469 EXPECT_TRUE(ParseHPKPHeader("includeSubDOMAINS;" + good_pin + ";" + |
| 470 backup_pin + " ; mAx-aGe = 890 ", |
| 471 chain_hashes, &max_age, &include_subdomains, |
| 472 &hashes, &report_uri)); |
437 expect_max_age = base::TimeDelta::FromSeconds(890); | 473 expect_max_age = base::TimeDelta::FromSeconds(890); |
438 EXPECT_EQ(expect_max_age, max_age); | 474 EXPECT_EQ(expect_max_age, max_age); |
439 EXPECT_TRUE(include_subdomains); | 475 EXPECT_TRUE(include_subdomains); |
440 | 476 |
441 EXPECT_TRUE(ParseHPKPHeader( | 477 EXPECT_TRUE(ParseHPKPHeader( |
442 good_pin + ";" + backup_pin + "; max-age=123;IGNORED;", | 478 good_pin + ";" + backup_pin + "; max-age=123;IGNORED;", chain_hashes, |
443 chain_hashes, &max_age, &include_subdomains, &hashes)); | 479 &max_age, &include_subdomains, &hashes, &report_uri)); |
444 expect_max_age = base::TimeDelta::FromSeconds(123); | 480 expect_max_age = base::TimeDelta::FromSeconds(123); |
445 EXPECT_EQ(expect_max_age, max_age); | 481 EXPECT_EQ(expect_max_age, max_age); |
446 EXPECT_FALSE(include_subdomains); | 482 EXPECT_FALSE(include_subdomains); |
447 | 483 |
448 EXPECT_TRUE(ParseHPKPHeader( | 484 EXPECT_TRUE(ParseHPKPHeader( |
449 "max-age=394082;" + backup_pin + ";" + good_pin + "; ", | 485 "max-age=394082;" + backup_pin + ";" + good_pin + "; ", chain_hashes, |
450 chain_hashes, &max_age, &include_subdomains, &hashes)); | 486 &max_age, &include_subdomains, &hashes, &report_uri)); |
451 expect_max_age = base::TimeDelta::FromSeconds(394082); | 487 expect_max_age = base::TimeDelta::FromSeconds(394082); |
452 EXPECT_EQ(expect_max_age, max_age); | 488 EXPECT_EQ(expect_max_age, max_age); |
453 EXPECT_FALSE(include_subdomains); | 489 EXPECT_FALSE(include_subdomains); |
454 | 490 |
455 EXPECT_TRUE(ParseHPKPHeader( | 491 EXPECT_TRUE(ParseHPKPHeader( |
456 "max-age=39408299 ;" + backup_pin + ";" + good_pin + "; ", | 492 "max-age=39408299 ;" + backup_pin + ";" + good_pin + "; ", chain_hashes, |
457 chain_hashes, &max_age, &include_subdomains, &hashes)); | 493 &max_age, &include_subdomains, &hashes, &report_uri)); |
458 expect_max_age = base::TimeDelta::FromSeconds( | 494 expect_max_age = base::TimeDelta::FromSeconds( |
459 std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(39408299)))); | 495 std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(39408299)))); |
460 EXPECT_EQ(expect_max_age, max_age); | 496 EXPECT_EQ(expect_max_age, max_age); |
461 EXPECT_FALSE(include_subdomains); | 497 EXPECT_FALSE(include_subdomains); |
462 | 498 |
463 EXPECT_TRUE(ParseHPKPHeader( | 499 EXPECT_TRUE(ParseHPKPHeader( |
464 "max-age=39408038 ; cybers=39408038 ; includeSubdomains; " + | 500 "max-age=39408038 ; cybers=39408038 ; includeSubdomains; " + |
465 good_pin + ";" + backup_pin + "; ", | 501 good_pin + ";" + backup_pin + "; ", |
466 chain_hashes, &max_age, &include_subdomains, &hashes)); | 502 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
467 expect_max_age = base::TimeDelta::FromSeconds( | 503 expect_max_age = base::TimeDelta::FromSeconds( |
468 std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(394082038)))); | 504 std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(394082038)))); |
469 EXPECT_EQ(expect_max_age, max_age); | 505 EXPECT_EQ(expect_max_age, max_age); |
470 EXPECT_TRUE(include_subdomains); | 506 EXPECT_TRUE(include_subdomains); |
471 | 507 |
472 EXPECT_TRUE(ParseHPKPHeader( | 508 EXPECT_TRUE(ParseHPKPHeader(" max-age=0 ; " + good_pin + ";" + backup_pin, |
473 " max-age=0 ; " + good_pin + ";" + backup_pin, | 509 chain_hashes, &max_age, &include_subdomains, |
474 chain_hashes, &max_age, &include_subdomains, &hashes)); | 510 &hashes, &report_uri)); |
475 expect_max_age = base::TimeDelta::FromSeconds(0); | 511 expect_max_age = base::TimeDelta::FromSeconds(0); |
476 EXPECT_EQ(expect_max_age, max_age); | 512 EXPECT_EQ(expect_max_age, max_age); |
477 EXPECT_FALSE(include_subdomains); | 513 EXPECT_FALSE(include_subdomains); |
478 | 514 |
479 EXPECT_TRUE(ParseHPKPHeader( | 515 EXPECT_TRUE(ParseHPKPHeader( |
480 " max-age=0 ; includeSubdomains; " + good_pin + ";" + backup_pin, | 516 " max-age=0 ; includeSubdomains; " + good_pin + ";" + backup_pin, |
481 chain_hashes, &max_age, &include_subdomains, &hashes)); | 517 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
482 expect_max_age = base::TimeDelta::FromSeconds(0); | 518 expect_max_age = base::TimeDelta::FromSeconds(0); |
483 EXPECT_EQ(expect_max_age, max_age); | 519 EXPECT_EQ(expect_max_age, max_age); |
484 EXPECT_TRUE(include_subdomains); | 520 EXPECT_TRUE(include_subdomains); |
485 | 521 |
486 EXPECT_TRUE(ParseHPKPHeader( | 522 EXPECT_TRUE(ParseHPKPHeader( |
487 " max-age=999999999999999999999999999999999999999999999 ; " + | 523 " max-age=999999999999999999999999999999999999999999999 ; " + |
488 backup_pin + ";" + good_pin + "; ", | 524 backup_pin + ";" + good_pin + "; ", |
489 chain_hashes, &max_age, &include_subdomains, &hashes)); | 525 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
490 expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs); | 526 expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs); |
491 EXPECT_EQ(expect_max_age, max_age); | 527 EXPECT_EQ(expect_max_age, max_age); |
492 EXPECT_FALSE(include_subdomains); | 528 EXPECT_FALSE(include_subdomains); |
493 | 529 |
| 530 EXPECT_TRUE(ParseHPKPHeader( |
| 531 " max-age=999999999999999999999999999999999999999999999 ; " + |
| 532 backup_pin + ";" + good_pin + "; report-uri=\"/foo\"", |
| 533 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
| 534 expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs); |
| 535 expect_report_uri = "/foo"; |
| 536 EXPECT_EQ(expect_max_age, max_age); |
| 537 EXPECT_FALSE(include_subdomains); |
| 538 EXPECT_EQ(expect_report_uri, report_uri); |
| 539 |
494 // Test that parsing a different header resets the hashes. | 540 // Test that parsing a different header resets the hashes. |
495 hashes.clear(); | 541 hashes.clear(); |
496 EXPECT_TRUE(ParseHPKPHeader( | 542 EXPECT_TRUE(ParseHPKPHeader( |
497 " max-age=999; " + | 543 " max-age=999; " + backup_pin + ";" + good_pin + "; ", chain_hashes, |
498 backup_pin + ";" + good_pin + "; ", | 544 &max_age, &include_subdomains, &hashes, &report_uri)); |
499 chain_hashes, &max_age, &include_subdomains, &hashes)); | |
500 EXPECT_EQ(2u, hashes.size()); | 545 EXPECT_EQ(2u, hashes.size()); |
501 EXPECT_TRUE(ParseHPKPHeader( | 546 EXPECT_TRUE(ParseHPKPHeader( |
502 " max-age=999; " + backup_pin + ";" + good_pin2 + "; ", chain_hashes, | 547 " max-age=999; " + backup_pin + ";" + good_pin2 + "; ", chain_hashes, |
503 &max_age, &include_subdomains, &hashes)); | 548 &max_age, &include_subdomains, &hashes, &report_uri)); |
504 EXPECT_EQ(2u, hashes.size()); | 549 EXPECT_EQ(2u, hashes.size()); |
| 550 |
| 551 // Test that the parser correctly parses an unencoded ';' inside a |
| 552 // quoted report-uri. |
| 553 EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 554 "; report-uri=\"http://foo;bar\"", |
| 555 chain_hashes, &max_age, &include_subdomains, |
| 556 &hashes, &report_uri)); |
| 557 expect_max_age = base::TimeDelta::FromSeconds(999); |
| 558 expect_report_uri = "http://foo;bar"; |
| 559 EXPECT_EQ(expect_max_age, max_age); |
| 560 EXPECT_FALSE(include_subdomains); |
| 561 EXPECT_EQ(expect_report_uri, report_uri); |
| 562 |
| 563 // Test that the parser correctly parses a report-uri with a >0x7f |
| 564 // character. |
| 565 expect_report_uri = "http://foo"; |
| 566 expect_report_uri += char(0x7f); |
| 567 EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 568 "; report-uri=\"" + expect_report_uri + "\"", |
| 569 chain_hashes, &max_age, &include_subdomains, |
| 570 &hashes, &report_uri)); |
| 571 expect_max_age = base::TimeDelta::FromSeconds(999); |
| 572 EXPECT_EQ(expect_max_age, max_age); |
| 573 EXPECT_FALSE(include_subdomains); |
| 574 EXPECT_EQ(expect_report_uri, report_uri); |
| 575 |
| 576 // Test that the parser allows quoted max-age values. |
| 577 EXPECT_TRUE(ParseHPKPHeader("max-age='999'; " + backup_pin + "; " + good_pin, |
| 578 chain_hashes, &max_age, &include_subdomains, |
| 579 &hashes, &report_uri)); |
| 580 expect_max_age = base::TimeDelta::FromSeconds(999); |
| 581 EXPECT_EQ(expect_max_age, max_age); |
| 582 EXPECT_FALSE(include_subdomains); |
| 583 |
| 584 // Test that the parser handles escaped values. |
| 585 expect_report_uri = "http://foo.com'a"; |
| 586 EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 587 "; report-uri='http://foo.com\\'\\a'", |
| 588 chain_hashes, &max_age, &include_subdomains, |
| 589 &hashes, &report_uri)); |
| 590 expect_max_age = base::TimeDelta::FromSeconds(999); |
| 591 EXPECT_EQ(expect_max_age, max_age); |
| 592 EXPECT_FALSE(include_subdomains); |
| 593 EXPECT_EQ(expect_report_uri, report_uri); |
505 } | 594 } |
506 | 595 |
507 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA1) { | 596 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA1) { |
508 TestBogusPinsHeaders(HASH_VALUE_SHA1); | 597 TestBogusPinsHeaders(HASH_VALUE_SHA1); |
509 } | 598 } |
510 | 599 |
511 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA256) { | 600 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA256) { |
512 TestBogusPinsHeaders(HASH_VALUE_SHA256); | 601 TestBogusPinsHeaders(HASH_VALUE_SHA256); |
513 } | 602 } |
514 | 603 |
(...skipping 16 matching lines...) Expand all Loading... |
531 EXPECT_TRUE( | 620 EXPECT_TRUE( |
532 state.GetStaticDomainState(domain, &static_sts_state, &static_pkp_state)); | 621 state.GetStaticDomainState(domain, &static_sts_state, &static_pkp_state)); |
533 EXPECT_GT(static_pkp_state.spki_hashes.size(), 1UL); | 622 EXPECT_GT(static_pkp_state.spki_hashes.size(), 1UL); |
534 HashValueVector saved_hashes = static_pkp_state.spki_hashes; | 623 HashValueVector saved_hashes = static_pkp_state.spki_hashes; |
535 | 624 |
536 // Add a header, which should only update the dynamic state. | 625 // Add a header, which should only update the dynamic state. |
537 HashValue good_hash = GetTestHashValue(1, HASH_VALUE_SHA1); | 626 HashValue good_hash = GetTestHashValue(1, HASH_VALUE_SHA1); |
538 HashValue backup_hash = GetTestHashValue(2, HASH_VALUE_SHA1); | 627 HashValue backup_hash = GetTestHashValue(2, HASH_VALUE_SHA1); |
539 std::string good_pin = GetTestPin(1, HASH_VALUE_SHA1); | 628 std::string good_pin = GetTestPin(1, HASH_VALUE_SHA1); |
540 std::string backup_pin = GetTestPin(2, HASH_VALUE_SHA1); | 629 std::string backup_pin = GetTestPin(2, HASH_VALUE_SHA1); |
541 std::string header = "max-age = 10000; " + good_pin + "; " + backup_pin; | 630 std::string report_uri = "http://google.com"; |
| 631 std::string header = "max-age = 10000; " + good_pin + "; " + backup_pin + |
| 632 ";report-uri=\"" + report_uri + "\""; |
542 | 633 |
543 // Construct a fake SSLInfo that will pass AddHPKPHeader's checks. | 634 // Construct a fake SSLInfo that will pass AddHPKPHeader's checks. |
544 SSLInfo ssl_info; | 635 SSLInfo ssl_info; |
545 ssl_info.public_key_hashes.push_back(good_hash); | 636 ssl_info.public_key_hashes.push_back(good_hash); |
546 ssl_info.public_key_hashes.push_back(saved_hashes[0]); | 637 ssl_info.public_key_hashes.push_back(saved_hashes[0]); |
547 EXPECT_TRUE(state.AddHPKPHeader(domain, header, ssl_info)); | 638 EXPECT_TRUE(state.AddHPKPHeader(domain, header, ssl_info)); |
548 | 639 |
549 // Expect the static state to remain unchanged. | 640 // Expect the static state to remain unchanged. |
550 TransportSecurityState::STSState new_static_sts_state; | 641 TransportSecurityState::STSState new_static_sts_state; |
551 TransportSecurityState::PKPState new_static_pkp_state; | 642 TransportSecurityState::PKPState new_static_pkp_state; |
552 EXPECT_TRUE(state.GetStaticDomainState(domain, &new_static_sts_state, | 643 EXPECT_TRUE(state.GetStaticDomainState(domain, &new_static_sts_state, |
553 &new_static_pkp_state)); | 644 &new_static_pkp_state)); |
554 for (size_t i = 0; i < saved_hashes.size(); ++i) { | 645 for (size_t i = 0; i < saved_hashes.size(); ++i) { |
555 EXPECT_TRUE( | 646 EXPECT_TRUE( |
556 HashValuesEqual(saved_hashes[i])(new_static_pkp_state.spki_hashes[i])); | 647 HashValuesEqual(saved_hashes[i])(new_static_pkp_state.spki_hashes[i])); |
557 } | 648 } |
558 | 649 |
559 // Expect the dynamic state to reflect the header. | 650 // Expect the dynamic state to reflect the header. |
560 TransportSecurityState::PKPState dynamic_pkp_state; | 651 TransportSecurityState::PKPState dynamic_pkp_state; |
561 EXPECT_TRUE(state.GetDynamicPKPState(domain, &dynamic_pkp_state)); | 652 EXPECT_TRUE(state.GetDynamicPKPState(domain, &dynamic_pkp_state)); |
562 EXPECT_EQ(2UL, dynamic_pkp_state.spki_hashes.size()); | 653 EXPECT_EQ(2UL, dynamic_pkp_state.spki_hashes.size()); |
| 654 EXPECT_EQ(report_uri, dynamic_pkp_state.report_uri); |
563 | 655 |
564 HashValueVector::const_iterator hash = std::find_if( | 656 HashValueVector::const_iterator hash = std::find_if( |
565 dynamic_pkp_state.spki_hashes.begin(), | 657 dynamic_pkp_state.spki_hashes.begin(), |
566 dynamic_pkp_state.spki_hashes.end(), HashValuesEqual(good_hash)); | 658 dynamic_pkp_state.spki_hashes.end(), HashValuesEqual(good_hash)); |
567 EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash); | 659 EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash); |
568 | 660 |
569 hash = std::find_if(dynamic_pkp_state.spki_hashes.begin(), | 661 hash = std::find_if(dynamic_pkp_state.spki_hashes.begin(), |
570 dynamic_pkp_state.spki_hashes.end(), | 662 dynamic_pkp_state.spki_hashes.end(), |
571 HashValuesEqual(backup_hash)); | 663 HashValuesEqual(backup_hash)); |
572 EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash); | 664 EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash); |
573 | 665 |
574 // Expect the overall state to reflect the header, too. | 666 // Expect the overall state to reflect the header, too. |
575 EXPECT_TRUE(state.HasPublicKeyPins(domain)); | 667 EXPECT_TRUE(state.HasPublicKeyPins(domain)); |
576 HashValueVector hashes; | 668 HashValueVector hashes; |
577 hashes.push_back(good_hash); | 669 hashes.push_back(good_hash); |
578 std::string failure_log; | 670 std::string failure_log; |
579 const bool is_issued_by_known_root = true; | 671 const bool is_issued_by_known_root = true; |
580 EXPECT_TRUE(state.CheckPublicKeyPins( | 672 EXPECT_TRUE(state.CheckPublicKeyPins( |
581 domain, is_issued_by_known_root, hashes, &failure_log)); | 673 domain, is_issued_by_known_root, hashes, &failure_log)); |
582 | 674 |
583 TransportSecurityState::PKPState new_dynamic_pkp_state; | 675 TransportSecurityState::PKPState new_dynamic_pkp_state; |
584 EXPECT_TRUE(state.GetDynamicPKPState(domain, &new_dynamic_pkp_state)); | 676 EXPECT_TRUE(state.GetDynamicPKPState(domain, &new_dynamic_pkp_state)); |
585 EXPECT_EQ(2UL, new_dynamic_pkp_state.spki_hashes.size()); | 677 EXPECT_EQ(2UL, new_dynamic_pkp_state.spki_hashes.size()); |
| 678 EXPECT_EQ(report_uri, new_dynamic_pkp_state.report_uri); |
586 | 679 |
587 hash = std::find_if(new_dynamic_pkp_state.spki_hashes.begin(), | 680 hash = std::find_if(new_dynamic_pkp_state.spki_hashes.begin(), |
588 new_dynamic_pkp_state.spki_hashes.end(), | 681 new_dynamic_pkp_state.spki_hashes.end(), |
589 HashValuesEqual(good_hash)); | 682 HashValuesEqual(good_hash)); |
590 EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash); | 683 EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash); |
591 | 684 |
592 hash = std::find_if(new_dynamic_pkp_state.spki_hashes.begin(), | 685 hash = std::find_if(new_dynamic_pkp_state.spki_hashes.begin(), |
593 new_dynamic_pkp_state.spki_hashes.end(), | 686 new_dynamic_pkp_state.spki_hashes.end(), |
594 HashValuesEqual(backup_hash)); | 687 HashValuesEqual(backup_hash)); |
595 EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash); | 688 EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash); |
(...skipping 167 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
763 ssl_info)); | 856 ssl_info)); |
764 | 857 |
765 // The old pins must still exist. | 858 // The old pins must still exist. |
766 EXPECT_TRUE(state.HasPublicKeyPins("example.com")); | 859 EXPECT_TRUE(state.HasPublicKeyPins("example.com")); |
767 EXPECT_TRUE(state.CheckPublicKeyPins("example.com", is_issued_by_known_root, | 860 EXPECT_TRUE(state.CheckPublicKeyPins("example.com", is_issued_by_known_root, |
768 ssl_info.public_key_hashes, | 861 ssl_info.public_key_hashes, |
769 &failure_log)); | 862 &failure_log)); |
770 } | 863 } |
771 | 864 |
772 }; // namespace net | 865 }; // namespace net |
OLD | NEW |