Parse HPKP report-uri and persist in TransportSecurityPersister

net/http/transport_security_persister_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_persister.h"
 
 #include <map>
 #include <string>
 #include <vector>
 
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/message_loop/message_loop.h"
 #include "net/http/transport_security_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
 
 namespace {
 
+const char kReportUri[] = "http://www.example.com/report";
+
 class TransportSecurityPersisterTest : public testing::Test {
  public:
   TransportSecurityPersisterTest() {
   }
 
   ~TransportSecurityPersisterTest() override {
     base::MessageLoopForIO::current()->RunUntilIdle();
   }
 
   void SetUp() override {
@@ skipping 60 matching lines @@
   HashValue fp2(HASH_VALUE_SHA1);
   memset(fp2.data(), 1, fp2.size());
   base::Time expiry =
       base::Time::Now() + base::TimeDelta::FromSeconds(1000);
   HashValueVector dynamic_spki_hashes;
   dynamic_spki_hashes.push_back(fp1);
   dynamic_spki_hashes.push_back(fp2);
   bool include_subdomains = false;
   state_.AddHSTS("www.example.com", expiry, include_subdomains);
   state_.AddHPKP("www.example.com", expiry, include_subdomains,
-                 dynamic_spki_hashes);
+                 dynamic_spki_hashes, kReportUri);
 
   // Add another entry.
   memset(fp1.data(), 2, fp1.size());
   memset(fp2.data(), 3, fp2.size());
   expiry =
       base::Time::Now() + base::TimeDelta::FromSeconds(3000);
   dynamic_spki_hashes.push_back(fp1);
   dynamic_spki_hashes.push_back(fp2);
   state_.AddHSTS("www.example.net", expiry, include_subdomains);
   state_.AddHPKP("www.example.net", expiry, include_subdomains,
-                 dynamic_spki_hashes);
+                 dynamic_spki_hashes, kReportUri);
 
   // Save a copy of everything.
   std::set<std::string> sts_saved;
   TransportSecurityState::STSStateIterator sts_iter(state_);
   while (sts_iter.HasNext()) {
     sts_saved.insert(sts_iter.hostname());
     sts_iter.Advance();
   }
 
   std::set<std::string> pkp_saved;
@@ skipping 51 matching lines @@
       "\"mode\": \"strict\" "
       "}"
       "}";
   bool dirty;
   EXPECT_TRUE(persister_->LoadEntries(output, &dirty));
   EXPECT_TRUE(dirty);
 }
 
 TEST_F(TransportSecurityPersisterTest, PublicKeyHashes) {
   TransportSecurityState::PKPState pkp_state;
+  static const char kReportUri[] = "http://example.com/test";

[davidben, 2015/07/15 22:21:06]

Remove this line in favor of the global one? (Confusing the shadow the name
anyway.)

[estark, 2015/07/16 00:07:01]

Done.

   static const char kTestDomain[] = "example.com";
+
   EXPECT_FALSE(state_.GetDynamicPKPState(kTestDomain, &pkp_state));
   HashValueVector hashes;
   std::string failure_log;
   EXPECT_FALSE(pkp_state.CheckPublicKeyPins(hashes, &failure_log));
 
   HashValue sha1(HASH_VALUE_SHA1);
   memset(sha1.data(), '1', sha1.size());
   pkp_state.spki_hashes.push_back(sha1);
 
   EXPECT_FALSE(pkp_state.CheckPublicKeyPins(hashes, &failure_log));
 
   hashes.push_back(sha1);
   EXPECT_TRUE(pkp_state.CheckPublicKeyPins(hashes, &failure_log));
 
   hashes[0].data()[0] = '2';
   EXPECT_FALSE(pkp_state.CheckPublicKeyPins(hashes, &failure_log));
 
   const base::Time current_time(base::Time::Now());
   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
   bool include_subdomains = false;
   state_.AddHSTS(kTestDomain, expiry, include_subdomains);
-  state_.AddHPKP(kTestDomain, expiry, include_subdomains,
-                 pkp_state.spki_hashes);
+  state_.AddHPKP(kTestDomain, expiry, include_subdomains, pkp_state.spki_hashes,
+                 kReportUri);
   std::string serialized;
   EXPECT_TRUE(persister_->SerializeData(&serialized));
   bool dirty;
+  EXPECT_TRUE(persister_->LoadEntries(serialized, &dirty));
+
+  TransportSecurityState::PKPState new_pkp_state;
+  EXPECT_TRUE(state_.GetDynamicPKPState(kTestDomain, &new_pkp_state));
+  EXPECT_EQ(1u, new_pkp_state.spki_hashes.size());
+  EXPECT_EQ(sha1.tag, new_pkp_state.spki_hashes[0].tag);
+  EXPECT_EQ(
+      0, memcmp(new_pkp_state.spki_hashes[0].data(), sha1.data(), sha1.size()));
+  EXPECT_EQ(kReportUri, new_pkp_state.report_uri);
+}
+
+TEST_F(TransportSecurityPersisterTest, PublicKeyPinReportUri) {

[davidben, 2015/07/15 22:21:06]

Isn't this test the same as the one above, or am I missing something? (Maybe
just rename it to PublicKeyPins.)

[estark, 2015/07/16 00:07:01]

Er, sorry, don't know what I was thinking there. Done.

+  TransportSecurityState::PKPState pkp_state;
+  static const char kTestDomain[] = "example.com";
+  static const char kTestReportUri[] = "http://example.com/report";
+
+  EXPECT_FALSE(state_.GetDynamicPKPState(kTestDomain, &pkp_state));
+  HashValueVector hashes;
+  std::string failure_log;
+  EXPECT_FALSE(pkp_state.CheckPublicKeyPins(hashes, &failure_log));
+
+  HashValue sha1(HASH_VALUE_SHA1);
+  memset(sha1.data(), '1', sha1.size());
+  pkp_state.spki_hashes.push_back(sha1);
+
+  EXPECT_FALSE(pkp_state.CheckPublicKeyPins(hashes, &failure_log));
+
+  hashes.push_back(sha1);
+  EXPECT_TRUE(pkp_state.CheckPublicKeyPins(hashes, &failure_log));
+
+  hashes[0].data()[0] = '2';
+  EXPECT_FALSE(pkp_state.CheckPublicKeyPins(hashes, &failure_log));
+
+  const base::Time current_time(base::Time::Now());
+  const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
+  bool include_subdomains = false;
+  state_.AddHPKP(kTestDomain, expiry, include_subdomains, pkp_state.spki_hashes,
+                 kTestReportUri);
+  std::string serialized;
+  EXPECT_TRUE(persister_->SerializeData(&serialized));
+  bool dirty;
   EXPECT_TRUE(persister_->LoadEntries(serialized, &dirty));
 
   TransportSecurityState::PKPState new_pkp_state;
   EXPECT_TRUE(state_.GetDynamicPKPState(kTestDomain, &new_pkp_state));
   EXPECT_EQ(1u, new_pkp_state.spki_hashes.size());
   EXPECT_EQ(sha1.tag, new_pkp_state.spki_hashes[0].tag);
   EXPECT_EQ(
       0, memcmp(new_pkp_state.spki_hashes[0].data(), sha1.data(), sha1.size()));
+  EXPECT_EQ(kTestReportUri, new_pkp_state.report_uri);
 }
 
 }  // namespace
 
 }  // namespace net