Add parsing for Public-Key-Pins-Report-Only header

net/http/http_security_headers_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/sha1.h"
 #include "base/strings/string_piece.h"
@@ skipping 46 matching lines @@
 std::string GetTestPin(uint8 label, HashValueTag tag) {
   return GetTestPinImpl(label, tag, true);
 }
 
 std::string GetTestPinUnquoted(uint8 label, HashValueTag tag) {
   return GetTestPinImpl(label, tag, false);
 }
 
 };
 
+// Parses the given header |value| as both a Public-Key-Pins-Report-Only
+// and Public-Key-Pins header. Returns true if the value parses
+// successfully for both header types, and if the parsed hashes and
+// report_uri match for both header types.
+bool ParseBothHPKPHeaders(const std::string& value,

[Ryan Sleevi, 2015/07/30 01:43:50]

Naming wise, this feels a bit odd - you're not parsing both headers
simultaneously, except that's what seems to read as.

RFC 7469 calls these "Public-Key-Directives" ABNF, but on a grammar nit, perhaps
"ParseEitherHPKPHeader" ? Or simply "ParseHPKPHeader", since both PKP and PKP-RO
*are* HPKP headers :)

[estark, 2015/07/30 02:43:49]

I thought it might be weird to shadow net::ParseHPKPHeader()... but maybe that's
okay? Otherwise I'm fine with ParseEitherHPKPHeader().

[Ryan Sleevi, 2015/07/30 02:53:32]

ParsesAsHPKPHeader ? :)

[estark, 2015/07/30 15:21:21]

Done.

+                          const HashValueVector& chain_hashes,
+                          base::TimeDelta* max_age,
+                          bool* include_subdomains,
+                          HashValueVector* hashes,
+                          GURL* report_uri) {
+  GURL report_only_uri;
+  HashValueVector report_only_hashes;
+  if (!ParseHPKPReportOnlyHeader(value, &report_only_hashes,
+                                 &report_only_uri)) {
+    return false;
+  }
+
+  bool result = ParseHPKPHeader(value, chain_hashes, max_age,
+                                include_subdomains, hashes, report_uri);
+  if (!result || report_only_uri != *report_uri ||
+      report_only_hashes.size() != hashes->size()) {
+    return false;
+  }
+
+  for (size_t i = 0; i < report_only_hashes.size(); i++) {
+    if (!(*hashes)[i].Equals(report_only_hashes[i]))
+      return false;
+  }
+
+  return true;
+}
 
 class HttpSecurityHeadersTest : public testing::Test {
 };
 
 
 TEST_F(HttpSecurityHeadersTest, BogusHeaders) {
   base::TimeDelta max_age;
   bool include_subdomains = false;
 
   EXPECT_FALSE(
@@ skipping 81 matching lines @@
   // Set some fake "chain" hashes
   chain_hashes.push_back(GetTestHashValue(1, tag));
   chain_hashes.push_back(GetTestHashValue(2, tag));
   chain_hashes.push_back(GetTestHashValue(3, tag));
 
   // The good pin must be in the chain, the backup pin must not be
   std::string good_pin = GetTestPin(2, tag);
   std::string good_pin_unquoted = GetTestPinUnquoted(2, tag);
   std::string backup_pin = GetTestPin(4, tag);
 
-  EXPECT_FALSE(ParseHPKPHeader(std::string(), chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("    ", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("abc", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("  abc", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("  abc   ", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("  max-age", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("  max-age  ", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("   max-age=", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("   max-age  =", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("   max-age=   ", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("   max-age  =     ", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("   max-age  =     xy", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("   max-age  =     3488a923", chain_hashes,
-                               &max_age, &include_subdomains, &hashes,
-                               &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=3488a923  ", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader(
+  EXPECT_FALSE(ParseBothHPKPHeaders(std::string(), chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("    ", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("abc", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("  abc", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("  abc   ", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("  max-age", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("  max-age  ", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age=", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("   max-age=", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("   max-age  =", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("   max-age=   ", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("   max-age  =     ", chain_hashes,
+                                    &max_age, &include_subdomains, &hashes,
+                                    &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("   max-age  =     xy", chain_hashes,
+                                    &max_age, &include_subdomains, &hashes,
+                                    &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("   max-age  =     3488a923", chain_hashes,
+                                    &max_age, &include_subdomains, &hashes,
+                                    &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age=3488a923  ", chain_hashes,
+                                    &max_age, &include_subdomains, &hashes,
+                                    &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders(
       "max-ag=3488923pins=" + good_pin + "," + backup_pin, chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=3488923;pins=" + good_pin + "," +
-                                   backup_pin + "report-uri=\"http://foo.com\"",
-                               chain_hashes, &max_age, &include_subdomains,
-                               &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923" + backup_pin, chain_hashes,
-                               &max_age, &include_subdomains, &hashes,
-                               &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + backup_pin, chain_hashes,
-                               &max_age, &include_subdomains, &hashes,
-                               &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader(
+  EXPECT_FALSE(ParseBothHPKPHeaders(
+      "max-age=3488923;pins=" + good_pin + "," + backup_pin +
+          "report-uri=\"http://foo.com\"",
+      chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-aged=3488923" + backup_pin,
+                                    chain_hashes, &max_age, &include_subdomains,
+                                    &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-aged=3488923; " + backup_pin,
+                                    chain_hashes, &max_age, &include_subdomains,
+                                    &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders(
       "max-aged=3488923; " + backup_pin + ";" + backup_pin, chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin + ";" + good_pin,
-                               chain_hashes, &max_age, &include_subdomains,
-                               &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-aged=3488923; " + good_pin, chain_hashes,
-                               &max_age, &include_subdomains, &hashes,
-                               &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age==3488923", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("amax-age=3488923", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=-3488923", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=3488923;", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=3488923     e", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=3488923     includesubdomain",
-                               chain_hashes, &max_age, &include_subdomains,
-                               &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader(
+  EXPECT_FALSE(ParseBothHPKPHeaders(
+      "max-aged=3488923; " + good_pin + ";" + good_pin, chain_hashes, &max_age,
+      &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-aged=3488923; " + good_pin,
+                                    chain_hashes, &max_age, &include_subdomains,
+                                    &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age==3488923", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("amax-age=3488923", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age=-3488923", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age=3488923;", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age=3488923     e", chain_hashes,
+                                    &max_age, &include_subdomains, &hashes,
+                                    &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age=3488923     includesubdomain",
+                                    chain_hashes, &max_age, &include_subdomains,
+                                    &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders(
       "max-age=3488923     report-uri=\"http://foo.com\"", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=34889.23", chain_hashes, &max_age,
-                               &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader(
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age=34889.23", chain_hashes, &max_age,
+                                    &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders(
       "max-age=243; " + good_pin_unquoted + ";" + backup_pin, chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader(
+  EXPECT_FALSE(ParseBothHPKPHeaders(
       "max-age=243; " + good_pin + ";" + backup_pin + ";report-uri=;",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader("max-age=243; " + good_pin + ";" + backup_pin +
-                                   ";report-uri=http://foo.com;",
-                               chain_hashes, &max_age, &include_subdomains,
-                               &hashes, &report_uri));
-  EXPECT_FALSE(ParseHPKPHeader(
+  EXPECT_FALSE(ParseBothHPKPHeaders(
+      "max-age=243; " + good_pin + ";" + backup_pin +
+          ";report-uri=http://foo.com;",
+      chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders(
       "max-age=243; " + good_pin + ";" + backup_pin + ";report-uri=''",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
 
   // Test that the parser rejects misquoted strings.
-  EXPECT_FALSE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin +
-                                   "; report-uri=\"http://foo;bar\'",
-                               chain_hashes, &max_age, &include_subdomains,
-                               &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders(
+      "max-age=999; " + backup_pin + "; " + good_pin +
+          "; report-uri=\"http://foo;bar\'",
+      chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
 
   // Test that the parser rejects invalid report-uris.
-  EXPECT_FALSE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin +
-                                   "; report-uri=\"foo;bar\'",
-                               chain_hashes, &max_age, &include_subdomains,
-                               &hashes, &report_uri));
+  EXPECT_FALSE(ParseBothHPKPHeaders("max-age=999; " + backup_pin + "; " +
+                                        good_pin + "; report-uri=\"foo;bar\'",
+                                    chain_hashes, &max_age, &include_subdomains,
+                                    &hashes, &report_uri));
 
   // Check the out args were not updated by checking the default
   // values for its predictable fields.
   EXPECT_EQ(0, max_age.InSeconds());
   EXPECT_EQ(hashes.size(), (size_t)0);
 }
 
 TEST_F(HttpSecurityHeadersTest, ValidSTSHeaders) {
   base::TimeDelta max_age;
   base::TimeDelta expect_max_age;
@@ skipping 163 matching lines @@
   // Set some fake "chain" hashes into chain_hashes
   chain_hashes.push_back(GetTestHashValue(1, tag));
   chain_hashes.push_back(GetTestHashValue(2, tag));
   chain_hashes.push_back(GetTestHashValue(3, tag));
 
   // The good pin must be in the chain, the backup pin must not be
   std::string good_pin = GetTestPin(2, tag);
   std::string good_pin2 = GetTestPin(3, tag);
   std::string backup_pin = GetTestPin(4, tag);
 
-  EXPECT_TRUE(ParseHPKPHeader("max-age=243; " + good_pin + ";" + backup_pin,
-                              chain_hashes, &max_age, &include_subdomains,
-                              &hashes, &report_uri));
+  EXPECT_TRUE(ParseBothHPKPHeaders(
+      "max-age=243; " + good_pin + ";" + backup_pin, chain_hashes, &max_age,
+      &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(243);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
   EXPECT_TRUE(report_uri.is_empty());
 
-  EXPECT_TRUE(ParseHPKPHeader("max-age=243; " + good_pin + ";" + backup_pin +
-                                  "; report-uri= \"http://example.test/foo\"",
-                              chain_hashes, &max_age, &include_subdomains,
-                              &hashes, &report_uri));
+  EXPECT_TRUE(ParseBothHPKPHeaders(
+      "max-age=243; " + good_pin + ";" + backup_pin +
+          "; report-uri= \"http://example.test/foo\"",
+      chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(243);
   expect_report_uri = GURL("http://example.test/foo");
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
   EXPECT_EQ(expect_report_uri, report_uri);
 
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "   " + good_pin + "; " + backup_pin +
           "  ; Max-agE    = 567; repOrT-URi = \"http://example.test/foo\"",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(567);
   expect_report_uri = GURL("http://example.test/foo");
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
   EXPECT_EQ(expect_report_uri, report_uri);
 
-  EXPECT_TRUE(ParseHPKPHeader("includeSubDOMAINS;" + good_pin + ";" +
-                                  backup_pin + "  ; mAx-aGe    = 890      ",
-                              chain_hashes, &max_age, &include_subdomains,
-                              &hashes, &report_uri));
+  EXPECT_TRUE(ParseBothHPKPHeaders(
+      "includeSubDOMAINS;" + good_pin + ";" + backup_pin +
+          "  ; mAx-aGe    = 890      ",
+      chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(890);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_TRUE(include_subdomains);
 
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       good_pin + ";" + backup_pin + "; max-age=123;IGNORED;", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(123);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "max-age=394082;" + backup_pin + ";" + good_pin + ";  ", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(394082);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "max-age=39408299  ;" + backup_pin + ";" + good_pin + ";  ", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(
       std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(39408299))));
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "max-age=39408038  ;    cybers=39408038  ;  includeSubdomains; " +
           good_pin + ";" + backup_pin + ";   ",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(
       std::min(kMaxHSTSAgeSecs, static_cast<int64>(INT64_C(394082038))));
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_TRUE(include_subdomains);
 
-  EXPECT_TRUE(ParseHPKPHeader("  max-age=0  ;  " + good_pin + ";" + backup_pin,
-                              chain_hashes, &max_age, &include_subdomains,
-                              &hashes, &report_uri));
+  EXPECT_TRUE(ParseBothHPKPHeaders(
+      "  max-age=0  ;  " + good_pin + ";" + backup_pin, chain_hashes, &max_age,
+      &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(0);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "  max-age=0 ; includeSubdomains;  " + good_pin + ";" + backup_pin,
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(0);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_TRUE(include_subdomains);
 
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "  max-age=999999999999999999999999999999999999999999999  ;  " +
           backup_pin + ";" + good_pin + ";   ",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "  max-age=999999999999999999999999999999999999999999999  ;  " +
           backup_pin + ";" + good_pin +
           ";   report-uri=\"http://example.test/foo\"",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs);
   expect_report_uri = GURL("http://example.test/foo");
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
   EXPECT_EQ(expect_report_uri, report_uri);
 
   // Test that parsing a different header resets the hashes.
   hashes.clear();
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "  max-age=999;  " + backup_pin + ";" + good_pin + ";   ", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
   EXPECT_EQ(2u, hashes.size());
-  EXPECT_TRUE(ParseHPKPHeader(
+  EXPECT_TRUE(ParseBothHPKPHeaders(
       "  max-age=999;  " + backup_pin + ";" + good_pin2 + ";   ", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
   EXPECT_EQ(2u, hashes.size());
 
   // Test that the parser correctly parses an unencoded ';' inside a
   // quoted report-uri.
-  EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin +
-                                  "; report-uri=\"http://foo.com/?;bar\"",
-                              chain_hashes, &max_age, &include_subdomains,
-                              &hashes, &report_uri));
+  EXPECT_TRUE(ParseBothHPKPHeaders(
+      "max-age=999; " + backup_pin + "; " + good_pin +
+          "; report-uri=\"http://foo.com/?;bar\"",
+      chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(999);
   expect_report_uri = GURL("http://foo.com/?;bar");
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
   EXPECT_EQ(expect_report_uri, report_uri);
 
   // Test that the parser correctly parses a report-uri with a >0x7f
   // character.
   std::string uri = "http://foo.com/";
   uri += char(0x7f);
   expect_report_uri = GURL(uri);
-  EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin +
-                                  "; report-uri=\"" + uri + "\"",
-                              chain_hashes, &max_age, &include_subdomains,
-                              &hashes, &report_uri));
+  EXPECT_TRUE(ParseBothHPKPHeaders(
+      "max-age=999; " + backup_pin + "; " + good_pin + "; report-uri=\"" + uri +
+          "\"",
+      chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(999);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
   EXPECT_EQ(expect_report_uri, report_uri);
 
   // Test that the parser allows quoted max-age values.
-  EXPECT_TRUE(ParseHPKPHeader("max-age='999'; " + backup_pin + "; " + good_pin,
-                              chain_hashes, &max_age, &include_subdomains,
-                              &hashes, &report_uri));
+  EXPECT_TRUE(ParseBothHPKPHeaders(
+      "max-age='999'; " + backup_pin + "; " + good_pin, chain_hashes, &max_age,
+      &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(999);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
   // Test that the parser handles escaped values.
   expect_report_uri = GURL("http://foo.com'a");
-  EXPECT_TRUE(ParseHPKPHeader("max-age=999; " + backup_pin + "; " + good_pin +
-                                  "; report-uri='http://foo.com\\'\\a'",
-                              chain_hashes, &max_age, &include_subdomains,
-                              &hashes, &report_uri));
+  EXPECT_TRUE(ParseBothHPKPHeaders(
+      "max-age=999; " + backup_pin + "; " + good_pin +
+          "; report-uri='http://foo.com\\'\\a'",
+      chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(999);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
   EXPECT_EQ(expect_report_uri, report_uri);
+
+  // Test that the parser does not require max-age for Report-Only
+  // headers.
+  expect_report_uri = GURL("http://foo.com");
+  EXPECT_TRUE(ParseHPKPReportOnlyHeader(
+      backup_pin + "; " + good_pin + "; report-uri='http://foo.com'", &hashes,
+      &report_uri));
+  EXPECT_EQ(expect_report_uri, report_uri);
 }
 
 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA1) {
   TestBogusPinsHeaders(HASH_VALUE_SHA1);
 }
 
 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA256) {
   TestBogusPinsHeaders(HASH_VALUE_SHA256);
 }
 
@@ skipping 256 matching lines @@
       ssl_info));
 
   // The old pins must still exist.
   EXPECT_TRUE(state.HasPublicKeyPins("example.com"));
   EXPECT_TRUE(state.CheckPublicKeyPins(
       domain_port, is_issued_by_known_root, ssl_info.public_key_hashes, nullptr,
       nullptr, TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
 }
 
 };    // namespace net