OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stdint.h> | 5 #include <stdint.h> |
6 #include <algorithm> | 6 #include <algorithm> |
7 | 7 |
8 #include "base/base64.h" | 8 #include "base/base64.h" |
9 #include "base/sha1.h" | 9 #include "base/sha1.h" |
10 #include "base/strings/string_piece.h" | 10 #include "base/strings/string_piece.h" |
(...skipping 134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
145 // values for its predictable fields. | 145 // values for its predictable fields. |
146 EXPECT_EQ(0, max_age.InSeconds()); | 146 EXPECT_EQ(0, max_age.InSeconds()); |
147 EXPECT_FALSE(include_subdomains); | 147 EXPECT_FALSE(include_subdomains); |
148 } | 148 } |
149 | 149 |
150 static void TestBogusPinsHeaders(HashValueTag tag) { | 150 static void TestBogusPinsHeaders(HashValueTag tag) { |
151 base::TimeDelta max_age; | 151 base::TimeDelta max_age; |
152 bool include_subdomains; | 152 bool include_subdomains; |
153 HashValueVector hashes; | 153 HashValueVector hashes; |
154 HashValueVector chain_hashes; | 154 HashValueVector chain_hashes; |
| 155 GURL report_uri; |
155 | 156 |
156 // Set some fake "chain" hashes | 157 // Set some fake "chain" hashes |
157 chain_hashes.push_back(GetTestHashValue(1, tag)); | 158 chain_hashes.push_back(GetTestHashValue(1, tag)); |
158 chain_hashes.push_back(GetTestHashValue(2, tag)); | 159 chain_hashes.push_back(GetTestHashValue(2, tag)); |
159 chain_hashes.push_back(GetTestHashValue(3, tag)); | 160 chain_hashes.push_back(GetTestHashValue(3, tag)); |
160 | 161 |
161 // The good pin must be in the chain, the backup pin must not be | 162 // The good pin must be in the chain, the backup pin must not be |
162 std::string good_pin = GetTestPin(2, tag); | 163 std::string good_pin = GetTestPin(2, tag); |
163 std::string good_pin_unquoted = GetTestPinUnquoted(2, tag); | 164 std::string good_pin_unquoted = GetTestPinUnquoted(2, tag); |
164 std::string backup_pin = GetTestPin(4, tag); | 165 std::string backup_pin = GetTestPin(4, tag); |
165 | 166 |
166 EXPECT_FALSE(ParseHPKPHeader(std::string(), chain_hashes, &max_age, | 167 EXPECT_FALSE(ParseHPKPHeader(std::string(), chain_hashes, &max_age, |
167 &include_subdomains, &hashes)); | 168 &include_subdomains, &hashes, &report_uri)); |
168 EXPECT_FALSE(ParseHPKPHeader(" ", chain_hashes, &max_age, | 169 EXPECT_FALSE(ParseHPKPHeader(" ", chain_hashes, &max_age, |
169 &include_subdomains, &hashes)); | 170 &include_subdomains, &hashes, &report_uri)); |
170 EXPECT_FALSE(ParseHPKPHeader("abc", chain_hashes, &max_age, | 171 EXPECT_FALSE(ParseHPKPHeader("abc", chain_hashes, &max_age, |
171 &include_subdomains, &hashes)); | 172 &include_subdomains, &hashes, &report_uri)); |
172 EXPECT_FALSE(ParseHPKPHeader(" abc", chain_hashes, &max_age, | 173 EXPECT_FALSE(ParseHPKPHeader(" abc", chain_hashes, &max_age, |
173 &include_subdomains, &hashes)); | 174 &include_subdomains, &hashes, &report_uri)); |
174 EXPECT_FALSE(ParseHPKPHeader(" abc ", chain_hashes, &max_age, | 175 EXPECT_FALSE(ParseHPKPHeader(" abc ", chain_hashes, &max_age, |
175 &include_subdomains, &hashes)); | 176 &include_subdomains, &hashes, &report_uri)); |
176 EXPECT_FALSE(ParseHPKPHeader("max-age", chain_hashes, &max_age, | 177 EXPECT_FALSE(ParseHPKPHeader("max-age", chain_hashes, &max_age, |
177 &include_subdomains, &hashes)); | 178 &include_subdomains, &hashes, &report_uri)); |
178 EXPECT_FALSE(ParseHPKPHeader(" max-age", chain_hashes, &max_age, | 179 EXPECT_FALSE(ParseHPKPHeader(" max-age", chain_hashes, &max_age, |
179 &include_subdomains, &hashes)); | 180 &include_subdomains, &hashes, &report_uri)); |
180 EXPECT_FALSE(ParseHPKPHeader(" max-age ", chain_hashes, &max_age, | 181 EXPECT_FALSE(ParseHPKPHeader(" max-age ", chain_hashes, &max_age, |
181 &include_subdomains, &hashes)); | 182 &include_subdomains, &hashes, &report_uri)); |
182 EXPECT_FALSE(ParseHPKPHeader("max-age=", chain_hashes, &max_age, | 183 EXPECT_FALSE(ParseHPKPHeader("max-age=", chain_hashes, &max_age, |
183 &include_subdomains, &hashes)); | 184 &include_subdomains, &hashes, &report_uri)); |
184 EXPECT_FALSE(ParseHPKPHeader(" max-age=", chain_hashes, &max_age, | 185 EXPECT_FALSE(ParseHPKPHeader(" max-age=", chain_hashes, &max_age, |
185 &include_subdomains, &hashes)); | 186 &include_subdomains, &hashes, &report_uri)); |
186 EXPECT_FALSE(ParseHPKPHeader(" max-age =", chain_hashes, &max_age, | 187 EXPECT_FALSE(ParseHPKPHeader(" max-age =", chain_hashes, &max_age, |
187 &include_subdomains, &hashes)); | 188 &include_subdomains, &hashes, &report_uri)); |
188 EXPECT_FALSE(ParseHPKPHeader(" max-age= ", chain_hashes, &max_age, | 189 EXPECT_FALSE(ParseHPKPHeader(" max-age= ", chain_hashes, &max_age, |
189 &include_subdomains, &hashes)); | 190 &include_subdomains, &hashes, &report_uri)); |
190 EXPECT_FALSE(ParseHPKPHeader(" max-age = ", chain_hashes, | 191 EXPECT_FALSE(ParseHPKPHeader(" max-age = ", chain_hashes, &max_age, |
191 &max_age, &include_subdomains, &hashes)); | 192 &include_subdomains, &hashes, &report_uri)); |
192 EXPECT_FALSE(ParseHPKPHeader(" max-age = xy", chain_hashes, | 193 EXPECT_FALSE(ParseHPKPHeader(" max-age = xy", chain_hashes, &max_age, |
193 &max_age, &include_subdomains, &hashes)); | 194 &include_subdomains, &hashes, &report_uri)); |
194 EXPECT_FALSE(ParseHPKPHeader(" max-age = 3488a923", | 195 EXPECT_FALSE(ParseHPKPHeader(" max-age = 3488a923", chain_hashes, |
| 196 &max_age, &include_subdomains, &hashes, |
| 197 &report_uri)); |
| 198 EXPECT_FALSE(ParseHPKPHeader("max-age=3488a923 ", chain_hashes, &max_age, |
| 199 &include_subdomains, &hashes, &report_uri)); |
| 200 EXPECT_FALSE(ParseHPKPHeader( |
| 201 "max-ag=3488923pins=" + good_pin + "," + backup_pin, chain_hashes, |
| 202 &max_age, &include_subdomains, &hashes, &report_uri)); |
| 203 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923;pins=" + good_pin + "," + |
| 204 backup_pin + "report-uri=\"http://foo.com\"", |
195 chain_hashes, &max_age, &include_subdomains, | 205 chain_hashes, &max_age, &include_subdomains, |
196 &hashes)); | 206 &hashes, &report_uri)); |
197 EXPECT_FALSE(ParseHPKPHeader("max-age=3488a923 ", chain_hashes, | 207 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923" + backup_pin, chain_hashes, |
198 &max_age, &include_subdomains, &hashes)); | 208 &max_age, &include_subdomains, &hashes, |
199 EXPECT_FALSE(ParseHPKPHeader("max-ag=3488923pins=" + good_pin + "," + | 209 &report_uri)); |
200 backup_pin, | 210 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + backup_pin, chain_hashes, |
| 211 &max_age, &include_subdomains, &hashes, |
| 212 &report_uri)); |
| 213 EXPECT_FALSE(ParseHPKPHeader( |
| 214 "max-aged=3488923; " + backup_pin + ";" + backup_pin, chain_hashes, |
| 215 &max_age, &include_subdomains, &hashes, &report_uri)); |
| 216 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin + ";" + good_pin, |
201 chain_hashes, &max_age, &include_subdomains, | 217 chain_hashes, &max_age, &include_subdomains, |
202 &hashes)); | 218 &hashes, &report_uri)); |
203 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923" + backup_pin, | 219 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin, chain_hashes, |
204 chain_hashes, &max_age, &include_subdomains, | 220 &max_age, &include_subdomains, &hashes, |
205 &hashes)); | 221 &report_uri)); |
206 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + backup_pin, | |
207 chain_hashes, &max_age, &include_subdomains, | |
208 &hashes)); | |
209 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + backup_pin + ";" + | |
210 backup_pin, | |
211 chain_hashes, &max_age, &include_subdomains, | |
212 &hashes)); | |
213 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin + ";" + | |
214 good_pin, | |
215 chain_hashes, &max_age, &include_subdomains, | |
216 &hashes)); | |
217 EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin, | |
218 chain_hashes, &max_age, &include_subdomains, | |
219 &hashes)); | |
220 EXPECT_FALSE(ParseHPKPHeader("max-age==3488923", chain_hashes, &max_age, | 222 EXPECT_FALSE(ParseHPKPHeader("max-age==3488923", chain_hashes, &max_age, |
221 &include_subdomains, &hashes)); | 223 &include_subdomains, &hashes, &report_uri)); |
222 EXPECT_FALSE(ParseHPKPHeader("amax-age=3488923", chain_hashes, &max_age, | 224 EXPECT_FALSE(ParseHPKPHeader("amax-age=3488923", chain_hashes, &max_age, |
223 &include_subdomains, &hashes)); | 225 &include_subdomains, &hashes, &report_uri)); |
224 EXPECT_FALSE(ParseHPKPHeader("max-age=-3488923", chain_hashes, &max_age, | 226 EXPECT_FALSE(ParseHPKPHeader("max-age=-3488923", chain_hashes, &max_age, |
225 &include_subdomains, &hashes)); | 227 &include_subdomains, &hashes, &report_uri)); |
226 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923;", chain_hashes, &max_age, | 228 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923;", chain_hashes, &max_age, |
227 &include_subdomains, &hashes)); | 229 &include_subdomains, &hashes, &report_uri)); |
228 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923 e", chain_hashes, | 230 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923 e", chain_hashes, &max_age, |
229 &max_age, &include_subdomains, &hashes)); | 231 &include_subdomains, &hashes, &report_uri)); |
230 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923 includesubdomain", | 232 EXPECT_FALSE(ParseHPKPHeader("max-age=3488923 includesubdomain", |
231 chain_hashes, &max_age, &include_subdomains, | 233 chain_hashes, &max_age, &include_subdomains, |
232 &hashes)); | 234 &hashes, &report_uri)); |
| 235 EXPECT_FALSE(ParseHPKPHeader( |
| 236 "max-age=3488923 report-uri=\"http://foo.com\"", chain_hashes, |
| 237 &max_age, &include_subdomains, &hashes, &report_uri)); |
233 EXPECT_FALSE(ParseHPKPHeader("max-age=34889.23", chain_hashes, &max_age, | 238 EXPECT_FALSE(ParseHPKPHeader("max-age=34889.23", chain_hashes, &max_age, |
234 &include_subdomains, &hashes)); | 239 &include_subdomains, &hashes, &report_uri)); |
235 EXPECT_FALSE( | 240 EXPECT_FALSE(ParseHPKPHeader( |
236 ParseHPKPHeader("max-age=243; " + good_pin_unquoted + ";" + backup_pin, | 241 "max-age=243; " + good_pin_unquoted + ";" + backup_pin, chain_hashes, |
237 chain_hashes, &max_age, &include_subdomains, &hashes)); | 242 &max_age, &include_subdomains, &hashes, &report_uri)); |
| 243 EXPECT_FALSE(ParseHPKPHeader( |
| 244 "max-age=243; " + good_pin + ";" + backup_pin + ";report-uri=;", |
| 245 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
| 246 EXPECT_FALSE(ParseHPKPHeader("max-age=243; " + good_pin + ";" + backup_pin + |
| 247 ";report-uri=http://foo.com;", |
| 248 chain_hashes, &max_age, &include_subdomains, |
| 249 &hashes, &report_uri)); |
| 250 EXPECT_FALSE(ParseHPKPHeader( |
| 251 "max-age=243; " + good_pin + ";" + backup_pin + ";report-uri=''", |
| 252 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
| 253 |
| 254 // Test that the parser rejects misquoted strings. |
| 255 EXPECT_FALSE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 256 "; report-uri=\"http://foo;bar\'", |
| 257 chain_hashes, &max_age, &include_subdomains, |
| 258 &hashes, &report_uri)); |
| 259 |
| 260 // Test that the parser rejects invalid report-uris. |
| 261 EXPECT_FALSE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 262 "; report-uri=\"foo;bar\'", |
| 263 chain_hashes, &max_age, &include_subdomains, |
| 264 &hashes, &report_uri)); |
238 | 265 |
239 // Check the out args were not updated by checking the default | 266 // Check the out args were not updated by checking the default |
240 // values for its predictable fields. | 267 // values for its predictable fields. |
241 EXPECT_EQ(0, max_age.InSeconds()); | 268 EXPECT_EQ(0, max_age.InSeconds()); |
242 EXPECT_EQ(hashes.size(), (size_t)0); | 269 EXPECT_EQ(hashes.size(), (size_t)0); |
243 } | 270 } |
244 | 271 |
245 TEST_F(HttpSecurityHeadersTest, ValidSTSHeaders) { | 272 TEST_F(HttpSecurityHeadersTest, ValidSTSHeaders) { |
246 base::TimeDelta max_age; | 273 base::TimeDelta max_age; |
247 base::TimeDelta expect_max_age; | 274 base::TimeDelta expect_max_age; |
(...skipping 150 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
398 EXPECT_EQ(expect_max_age, max_age); | 425 EXPECT_EQ(expect_max_age, max_age); |
399 EXPECT_TRUE(include_subdomains); | 426 EXPECT_TRUE(include_subdomains); |
400 } | 427 } |
401 | 428 |
402 static void TestValidPKPHeaders(HashValueTag tag) { | 429 static void TestValidPKPHeaders(HashValueTag tag) { |
403 base::TimeDelta max_age; | 430 base::TimeDelta max_age; |
404 base::TimeDelta expect_max_age; | 431 base::TimeDelta expect_max_age; |
405 bool include_subdomains; | 432 bool include_subdomains; |
406 HashValueVector hashes; | 433 HashValueVector hashes; |
407 HashValueVector chain_hashes; | 434 HashValueVector chain_hashes; |
| 435 GURL expect_report_uri; |
| 436 GURL report_uri; |
408 | 437 |
409 // Set some fake "chain" hashes into chain_hashes | 438 // Set some fake "chain" hashes into chain_hashes |
410 chain_hashes.push_back(GetTestHashValue(1, tag)); | 439 chain_hashes.push_back(GetTestHashValue(1, tag)); |
411 chain_hashes.push_back(GetTestHashValue(2, tag)); | 440 chain_hashes.push_back(GetTestHashValue(2, tag)); |
412 chain_hashes.push_back(GetTestHashValue(3, tag)); | 441 chain_hashes.push_back(GetTestHashValue(3, tag)); |
413 | 442 |
414 // The good pin must be in the chain, the backup pin must not be | 443 // The good pin must be in the chain, the backup pin must not be |
415 std::string good_pin = GetTestPin(2, tag); | 444 std::string good_pin = GetTestPin(2, tag); |
416 std::string good_pin2 = GetTestPin(3, tag); | 445 std::string good_pin2 = GetTestPin(3, tag); |
417 std::string backup_pin = GetTestPin(4, tag); | 446 std::string backup_pin = GetTestPin(4, tag); |
418 | 447 |
419 EXPECT_TRUE(ParseHPKPHeader( | 448 EXPECT_TRUE(ParseHPKPHeader("max-age=243; " + good_pin + ";" + backup_pin, |
420 "max-age=243; " + good_pin + ";" + backup_pin, | 449 chain_hashes, &max_age, &include_subdomains, |
421 chain_hashes, &max_age, &include_subdomains, &hashes)); | 450 &hashes, &report_uri)); |
422 expect_max_age = base::TimeDelta::FromSeconds(243); | 451 expect_max_age = base::TimeDelta::FromSeconds(243); |
423 EXPECT_EQ(expect_max_age, max_age); | 452 EXPECT_EQ(expect_max_age, max_age); |
424 EXPECT_FALSE(include_subdomains); | 453 EXPECT_FALSE(include_subdomains); |
| 454 EXPECT_TRUE(report_uri.is_empty()); |
| 455 |
| 456 EXPECT_TRUE(ParseHPKPHeader("max-age=243; " + good_pin + ";" + backup_pin + |
| 457 "; report-uri= \"http://example.test/foo\"", |
| 458 chain_hashes, &max_age, &include_subdomains, |
| 459 &hashes, &report_uri)); |
| 460 expect_max_age = base::TimeDelta::FromSeconds(243); |
| 461 expect_report_uri = GURL("http://example.test/foo"); |
| 462 EXPECT_EQ(expect_max_age, max_age); |
| 463 EXPECT_FALSE(include_subdomains); |
| 464 EXPECT_EQ(expect_report_uri, report_uri); |
425 | 465 |
426 EXPECT_TRUE(ParseHPKPHeader( | 466 EXPECT_TRUE(ParseHPKPHeader( |
427 " " + good_pin + "; " + backup_pin + " ; Max-agE = 567", | 467 " " + good_pin + "; " + backup_pin + |
428 chain_hashes, &max_age, &include_subdomains, &hashes)); | 468 " ; Max-agE = 567; repOrT-URi = \"http://example.test/foo\"", |
| 469 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
429 expect_max_age = base::TimeDelta::FromSeconds(567); | 470 expect_max_age = base::TimeDelta::FromSeconds(567); |
| 471 expect_report_uri = GURL("http://example.test/foo"); |
430 EXPECT_EQ(expect_max_age, max_age); | 472 EXPECT_EQ(expect_max_age, max_age); |
431 EXPECT_FALSE(include_subdomains); | 473 EXPECT_FALSE(include_subdomains); |
| 474 EXPECT_EQ(expect_report_uri, report_uri); |
432 | 475 |
433 EXPECT_TRUE(ParseHPKPHeader( | 476 EXPECT_TRUE(ParseHPKPHeader("includeSubDOMAINS;" + good_pin + ";" + |
434 "includeSubDOMAINS;" + good_pin + ";" + backup_pin + | 477 backup_pin + " ; mAx-aGe = 890 ", |
435 " ; mAx-aGe = 890 ", | 478 chain_hashes, &max_age, &include_subdomains, |
436 chain_hashes, &max_age, &include_subdomains, &hashes)); | 479 &hashes, &report_uri)); |
437 expect_max_age = base::TimeDelta::FromSeconds(890); | 480 expect_max_age = base::TimeDelta::FromSeconds(890); |
438 EXPECT_EQ(expect_max_age, max_age); | 481 EXPECT_EQ(expect_max_age, max_age); |
439 EXPECT_TRUE(include_subdomains); | 482 EXPECT_TRUE(include_subdomains); |
440 | 483 |
441 EXPECT_TRUE(ParseHPKPHeader( | 484 EXPECT_TRUE(ParseHPKPHeader( |
442 good_pin + ";" + backup_pin + "; max-age=123;IGNORED;", | 485 good_pin + ";" + backup_pin + "; max-age=123;IGNORED;", chain_hashes, |
443 chain_hashes, &max_age, &include_subdomains, &hashes)); | 486 &max_age, &include_subdomains, &hashes, &report_uri)); |
444 expect_max_age = base::TimeDelta::FromSeconds(123); | 487 expect_max_age = base::TimeDelta::FromSeconds(123); |
445 EXPECT_EQ(expect_max_age, max_age); | 488 EXPECT_EQ(expect_max_age, max_age); |
446 EXPECT_FALSE(include_subdomains); | 489 EXPECT_FALSE(include_subdomains); |
447 | 490 |
448 EXPECT_TRUE(ParseHPKPHeader( | 491 EXPECT_TRUE(ParseHPKPHeader( |
449 "max-age=394082;" + backup_pin + ";" + good_pin + "; ", | 492 "max-age=394082;" + backup_pin + ";" + good_pin + "; ", chain_hashes, |
450 chain_hashes, &max_age, &include_subdomains, &hashes)); | 493 &max_age, &include_subdomains, &hashes, &report_uri)); |
451 expect_max_age = base::TimeDelta::FromSeconds(394082); | 494 expect_max_age = base::TimeDelta::FromSeconds(394082); |
452 EXPECT_EQ(expect_max_age, max_age); | 495 EXPECT_EQ(expect_max_age, max_age); |
453 EXPECT_FALSE(include_subdomains); | 496 EXPECT_FALSE(include_subdomains); |
454 | 497 |
455 EXPECT_TRUE(ParseHPKPHeader( | 498 EXPECT_TRUE(ParseHPKPHeader( |
456 "max-age=39408299 ;" + backup_pin + ";" + good_pin + "; ", | 499 "max-age=39408299 ;" + backup_pin + ";" + good_pin + "; ", chain_hashes, |
457 chain_hashes, &max_age, &include_subdomains, &hashes)); | 500 &max_age, &include_subdomains, &hashes, &report_uri)); |
458 expect_max_age = base::TimeDelta::FromSeconds( | 501 expect_max_age = base::TimeDelta::FromSeconds( |
459 std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(39408299)))); | 502 std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(39408299)))); |
460 EXPECT_EQ(expect_max_age, max_age); | 503 EXPECT_EQ(expect_max_age, max_age); |
461 EXPECT_FALSE(include_subdomains); | 504 EXPECT_FALSE(include_subdomains); |
462 | 505 |
463 EXPECT_TRUE(ParseHPKPHeader( | 506 EXPECT_TRUE(ParseHPKPHeader( |
464 "max-age=39408038 ; cybers=39408038 ; includeSubdomains; " + | 507 "max-age=39408038 ; cybers=39408038 ; includeSubdomains; " + |
465 good_pin + ";" + backup_pin + "; ", | 508 good_pin + ";" + backup_pin + "; ", |
466 chain_hashes, &max_age, &include_subdomains, &hashes)); | 509 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
467 expect_max_age = base::TimeDelta::FromSeconds( | 510 expect_max_age = base::TimeDelta::FromSeconds( |
468 std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(394082038)))); | 511 std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(394082038)))); |
469 EXPECT_EQ(expect_max_age, max_age); | 512 EXPECT_EQ(expect_max_age, max_age); |
470 EXPECT_TRUE(include_subdomains); | 513 EXPECT_TRUE(include_subdomains); |
471 | 514 |
472 EXPECT_TRUE(ParseHPKPHeader( | 515 EXPECT_TRUE(ParseHPKPHeader(" max-age=0 ; " + good_pin + ";" + backup_pin, |
473 " max-age=0 ; " + good_pin + ";" + backup_pin, | 516 chain_hashes, &max_age, &include_subdomains, |
474 chain_hashes, &max_age, &include_subdomains, &hashes)); | 517 &hashes, &report_uri)); |
475 expect_max_age = base::TimeDelta::FromSeconds(0); | 518 expect_max_age = base::TimeDelta::FromSeconds(0); |
476 EXPECT_EQ(expect_max_age, max_age); | 519 EXPECT_EQ(expect_max_age, max_age); |
477 EXPECT_FALSE(include_subdomains); | 520 EXPECT_FALSE(include_subdomains); |
478 | 521 |
479 EXPECT_TRUE(ParseHPKPHeader( | 522 EXPECT_TRUE(ParseHPKPHeader( |
480 " max-age=0 ; includeSubdomains; " + good_pin + ";" + backup_pin, | 523 " max-age=0 ; includeSubdomains; " + good_pin + ";" + backup_pin, |
481 chain_hashes, &max_age, &include_subdomains, &hashes)); | 524 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
482 expect_max_age = base::TimeDelta::FromSeconds(0); | 525 expect_max_age = base::TimeDelta::FromSeconds(0); |
483 EXPECT_EQ(expect_max_age, max_age); | 526 EXPECT_EQ(expect_max_age, max_age); |
484 EXPECT_TRUE(include_subdomains); | 527 EXPECT_TRUE(include_subdomains); |
485 | 528 |
486 EXPECT_TRUE(ParseHPKPHeader( | 529 EXPECT_TRUE(ParseHPKPHeader( |
487 " max-age=999999999999999999999999999999999999999999999 ; " + | 530 " max-age=999999999999999999999999999999999999999999999 ; " + |
488 backup_pin + ";" + good_pin + "; ", | 531 backup_pin + ";" + good_pin + "; ", |
489 chain_hashes, &max_age, &include_subdomains, &hashes)); | 532 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
490 expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs); | 533 expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs); |
491 EXPECT_EQ(expect_max_age, max_age); | 534 EXPECT_EQ(expect_max_age, max_age); |
492 EXPECT_FALSE(include_subdomains); | 535 EXPECT_FALSE(include_subdomains); |
493 | 536 |
| 537 EXPECT_TRUE(ParseHPKPHeader( |
| 538 " max-age=999999999999999999999999999999999999999999999 ; " + |
| 539 backup_pin + ";" + good_pin + |
| 540 "; report-uri=\"http://example.test/foo\"", |
| 541 chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri)); |
| 542 expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs); |
| 543 expect_report_uri = GURL("http://example.test/foo"); |
| 544 EXPECT_EQ(expect_max_age, max_age); |
| 545 EXPECT_FALSE(include_subdomains); |
| 546 EXPECT_EQ(expect_report_uri, report_uri); |
| 547 |
494 // Test that parsing a different header resets the hashes. | 548 // Test that parsing a different header resets the hashes. |
495 hashes.clear(); | 549 hashes.clear(); |
496 EXPECT_TRUE(ParseHPKPHeader( | 550 EXPECT_TRUE(ParseHPKPHeader( |
497 " max-age=999; " + | 551 " max-age=999; " + backup_pin + ";" + good_pin + "; ", chain_hashes, |
498 backup_pin + ";" + good_pin + "; ", | 552 &max_age, &include_subdomains, &hashes, &report_uri)); |
499 chain_hashes, &max_age, &include_subdomains, &hashes)); | |
500 EXPECT_EQ(2u, hashes.size()); | 553 EXPECT_EQ(2u, hashes.size()); |
501 EXPECT_TRUE(ParseHPKPHeader( | 554 EXPECT_TRUE(ParseHPKPHeader( |
502 " max-age=999; " + backup_pin + ";" + good_pin2 + "; ", chain_hashes, | 555 " max-age=999; " + backup_pin + ";" + good_pin2 + "; ", chain_hashes, |
503 &max_age, &include_subdomains, &hashes)); | 556 &max_age, &include_subdomains, &hashes, &report_uri)); |
504 EXPECT_EQ(2u, hashes.size()); | 557 EXPECT_EQ(2u, hashes.size()); |
| 558 |
| 559 // Test that the parser correctly parses an unencoded ';' inside a |
| 560 // quoted report-uri. |
| 561 EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 562 "; report-uri=\"http://foo.com/?;bar\"", |
| 563 chain_hashes, &max_age, &include_subdomains, |
| 564 &hashes, &report_uri)); |
| 565 expect_max_age = base::TimeDelta::FromSeconds(999); |
| 566 expect_report_uri = GURL("http://foo.com/?;bar"); |
| 567 EXPECT_EQ(expect_max_age, max_age); |
| 568 EXPECT_FALSE(include_subdomains); |
| 569 EXPECT_EQ(expect_report_uri, report_uri); |
| 570 |
| 571 // Test that the parser correctly parses a report-uri with a >0x7f |
| 572 // character. |
| 573 std::string uri = "http://foo.com/"; |
| 574 uri += char(0x7f); |
| 575 expect_report_uri = GURL(uri); |
| 576 EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 577 "; report-uri=\"" + uri + "\"", |
| 578 chain_hashes, &max_age, &include_subdomains, |
| 579 &hashes, &report_uri)); |
| 580 expect_max_age = base::TimeDelta::FromSeconds(999); |
| 581 EXPECT_EQ(expect_max_age, max_age); |
| 582 EXPECT_FALSE(include_subdomains); |
| 583 EXPECT_EQ(expect_report_uri, report_uri); |
| 584 |
| 585 // Test that the parser allows quoted max-age values. |
| 586 EXPECT_TRUE(ParseHPKPHeader("max-age='999'; " + backup_pin + "; " + good_pin, |
| 587 chain_hashes, &max_age, &include_subdomains, |
| 588 &hashes, &report_uri)); |
| 589 expect_max_age = base::TimeDelta::FromSeconds(999); |
| 590 EXPECT_EQ(expect_max_age, max_age); |
| 591 EXPECT_FALSE(include_subdomains); |
| 592 |
| 593 // Test that the parser handles escaped values. |
| 594 expect_report_uri = GURL("http://foo.com'a"); |
| 595 EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin + |
| 596 "; report-uri='http://foo.com\\'\\a'", |
| 597 chain_hashes, &max_age, &include_subdomains, |
| 598 &hashes, &report_uri)); |
| 599 expect_max_age = base::TimeDelta::FromSeconds(999); |
| 600 EXPECT_EQ(expect_max_age, max_age); |
| 601 EXPECT_FALSE(include_subdomains); |
| 602 EXPECT_EQ(expect_report_uri, report_uri); |
505 } | 603 } |
506 | 604 |
507 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA1) { | 605 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA1) { |
508 TestBogusPinsHeaders(HASH_VALUE_SHA1); | 606 TestBogusPinsHeaders(HASH_VALUE_SHA1); |
509 } | 607 } |
510 | 608 |
511 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA256) { | 609 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA256) { |
512 TestBogusPinsHeaders(HASH_VALUE_SHA256); | 610 TestBogusPinsHeaders(HASH_VALUE_SHA256); |
513 } | 611 } |
514 | 612 |
(...skipping 16 matching lines...) Expand all Loading... |
531 EXPECT_TRUE( | 629 EXPECT_TRUE( |
532 state.GetStaticDomainState(domain, &static_sts_state, &static_pkp_state)); | 630 state.GetStaticDomainState(domain, &static_sts_state, &static_pkp_state)); |
533 EXPECT_GT(static_pkp_state.spki_hashes.size(), 1UL); | 631 EXPECT_GT(static_pkp_state.spki_hashes.size(), 1UL); |
534 HashValueVector saved_hashes = static_pkp_state.spki_hashes; | 632 HashValueVector saved_hashes = static_pkp_state.spki_hashes; |
535 | 633 |
536 // Add a header, which should only update the dynamic state. | 634 // Add a header, which should only update the dynamic state. |
537 HashValue good_hash = GetTestHashValue(1, HASH_VALUE_SHA1); | 635 HashValue good_hash = GetTestHashValue(1, HASH_VALUE_SHA1); |
538 HashValue backup_hash = GetTestHashValue(2, HASH_VALUE_SHA1); | 636 HashValue backup_hash = GetTestHashValue(2, HASH_VALUE_SHA1); |
539 std::string good_pin = GetTestPin(1, HASH_VALUE_SHA1); | 637 std::string good_pin = GetTestPin(1, HASH_VALUE_SHA1); |
540 std::string backup_pin = GetTestPin(2, HASH_VALUE_SHA1); | 638 std::string backup_pin = GetTestPin(2, HASH_VALUE_SHA1); |
541 std::string header = "max-age = 10000; " + good_pin + "; " + backup_pin; | 639 GURL report_uri("http://google.com"); |
| 640 std::string header = "max-age = 10000; " + good_pin + "; " + backup_pin + |
| 641 ";report-uri=\"" + report_uri.spec() + "\""; |
542 | 642 |
543 // Construct a fake SSLInfo that will pass AddHPKPHeader's checks. | 643 // Construct a fake SSLInfo that will pass AddHPKPHeader's checks. |
544 SSLInfo ssl_info; | 644 SSLInfo ssl_info; |
545 ssl_info.public_key_hashes.push_back(good_hash); | 645 ssl_info.public_key_hashes.push_back(good_hash); |
546 ssl_info.public_key_hashes.push_back(saved_hashes[0]); | 646 ssl_info.public_key_hashes.push_back(saved_hashes[0]); |
547 EXPECT_TRUE(state.AddHPKPHeader(domain, header, ssl_info)); | 647 EXPECT_TRUE(state.AddHPKPHeader(domain, header, ssl_info)); |
548 | 648 |
549 // Expect the static state to remain unchanged. | 649 // Expect the static state to remain unchanged. |
550 TransportSecurityState::STSState new_static_sts_state; | 650 TransportSecurityState::STSState new_static_sts_state; |
551 TransportSecurityState::PKPState new_static_pkp_state; | 651 TransportSecurityState::PKPState new_static_pkp_state; |
552 EXPECT_TRUE(state.GetStaticDomainState(domain, &new_static_sts_state, | 652 EXPECT_TRUE(state.GetStaticDomainState(domain, &new_static_sts_state, |
553 &new_static_pkp_state)); | 653 &new_static_pkp_state)); |
554 for (size_t i = 0; i < saved_hashes.size(); ++i) { | 654 for (size_t i = 0; i < saved_hashes.size(); ++i) { |
555 EXPECT_TRUE( | 655 EXPECT_TRUE( |
556 HashValuesEqual(saved_hashes[i])(new_static_pkp_state.spki_hashes[i])); | 656 HashValuesEqual(saved_hashes[i])(new_static_pkp_state.spki_hashes[i])); |
557 } | 657 } |
558 | 658 |
559 // Expect the dynamic state to reflect the header. | 659 // Expect the dynamic state to reflect the header. |
560 TransportSecurityState::PKPState dynamic_pkp_state; | 660 TransportSecurityState::PKPState dynamic_pkp_state; |
561 EXPECT_TRUE(state.GetDynamicPKPState(domain, &dynamic_pkp_state)); | 661 EXPECT_TRUE(state.GetDynamicPKPState(domain, &dynamic_pkp_state)); |
562 EXPECT_EQ(2UL, dynamic_pkp_state.spki_hashes.size()); | 662 EXPECT_EQ(2UL, dynamic_pkp_state.spki_hashes.size()); |
| 663 EXPECT_EQ(report_uri, dynamic_pkp_state.report_uri); |
563 | 664 |
564 HashValueVector::const_iterator hash = std::find_if( | 665 HashValueVector::const_iterator hash = std::find_if( |
565 dynamic_pkp_state.spki_hashes.begin(), | 666 dynamic_pkp_state.spki_hashes.begin(), |
566 dynamic_pkp_state.spki_hashes.end(), HashValuesEqual(good_hash)); | 667 dynamic_pkp_state.spki_hashes.end(), HashValuesEqual(good_hash)); |
567 EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash); | 668 EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash); |
568 | 669 |
569 hash = std::find_if(dynamic_pkp_state.spki_hashes.begin(), | 670 hash = std::find_if(dynamic_pkp_state.spki_hashes.begin(), |
570 dynamic_pkp_state.spki_hashes.end(), | 671 dynamic_pkp_state.spki_hashes.end(), |
571 HashValuesEqual(backup_hash)); | 672 HashValuesEqual(backup_hash)); |
572 EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash); | 673 EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash); |
573 | 674 |
574 // Expect the overall state to reflect the header, too. | 675 // Expect the overall state to reflect the header, too. |
575 EXPECT_TRUE(state.HasPublicKeyPins(domain)); | 676 EXPECT_TRUE(state.HasPublicKeyPins(domain)); |
576 HashValueVector hashes; | 677 HashValueVector hashes; |
577 hashes.push_back(good_hash); | 678 hashes.push_back(good_hash); |
578 std::string failure_log; | 679 std::string failure_log; |
579 const bool is_issued_by_known_root = true; | 680 const bool is_issued_by_known_root = true; |
580 EXPECT_TRUE(state.CheckPublicKeyPins( | 681 EXPECT_TRUE(state.CheckPublicKeyPins( |
581 domain, is_issued_by_known_root, hashes, &failure_log)); | 682 domain, is_issued_by_known_root, hashes, &failure_log)); |
582 | 683 |
583 TransportSecurityState::PKPState new_dynamic_pkp_state; | 684 TransportSecurityState::PKPState new_dynamic_pkp_state; |
584 EXPECT_TRUE(state.GetDynamicPKPState(domain, &new_dynamic_pkp_state)); | 685 EXPECT_TRUE(state.GetDynamicPKPState(domain, &new_dynamic_pkp_state)); |
585 EXPECT_EQ(2UL, new_dynamic_pkp_state.spki_hashes.size()); | 686 EXPECT_EQ(2UL, new_dynamic_pkp_state.spki_hashes.size()); |
| 687 EXPECT_EQ(report_uri, new_dynamic_pkp_state.report_uri); |
586 | 688 |
587 hash = std::find_if(new_dynamic_pkp_state.spki_hashes.begin(), | 689 hash = std::find_if(new_dynamic_pkp_state.spki_hashes.begin(), |
588 new_dynamic_pkp_state.spki_hashes.end(), | 690 new_dynamic_pkp_state.spki_hashes.end(), |
589 HashValuesEqual(good_hash)); | 691 HashValuesEqual(good_hash)); |
590 EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash); | 692 EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash); |
591 | 693 |
592 hash = std::find_if(new_dynamic_pkp_state.spki_hashes.begin(), | 694 hash = std::find_if(new_dynamic_pkp_state.spki_hashes.begin(), |
593 new_dynamic_pkp_state.spki_hashes.end(), | 695 new_dynamic_pkp_state.spki_hashes.end(), |
594 HashValuesEqual(backup_hash)); | 696 HashValuesEqual(backup_hash)); |
595 EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash); | 697 EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash); |
(...skipping 167 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
763 ssl_info)); | 865 ssl_info)); |
764 | 866 |
765 // The old pins must still exist. | 867 // The old pins must still exist. |
766 EXPECT_TRUE(state.HasPublicKeyPins("example.com")); | 868 EXPECT_TRUE(state.HasPublicKeyPins("example.com")); |
767 EXPECT_TRUE(state.CheckPublicKeyPins("example.com", is_issued_by_known_root, | 869 EXPECT_TRUE(state.CheckPublicKeyPins("example.com", is_issued_by_known_root, |
768 ssl_info.public_key_hashes, | 870 ssl_info.public_key_hashes, |
769 &failure_log)); | 871 &failure_log)); |
770 } | 872 } |
771 | 873 |
772 }; // namespace net | 874 }; // namespace net |
OLD | NEW |