Do not roll back to SSL 3.0 for Google properties.

chrome/browser/net/transport_security_persister_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/transport_security_persister.h"
 
 #include <map>
 #include <string>
 #include <vector>
 
@@ skipping 73 matching lines @@
   EXPECT_EQ(domain_state.upgrade_mode,
             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
   EXPECT_TRUE(state_.GetDomainState("foo.bar.yahoo.com", true, &domain_state));
   EXPECT_EQ(domain_state.upgrade_mode,
             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
   EXPECT_TRUE(state_.GetDomainState("foo.bar.baz.yahoo.com", true,
                                    &domain_state));
   EXPECT_EQ(domain_state.upgrade_mode,
             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
   EXPECT_FALSE(state_.GetDomainState("com", true, &domain_state));
+
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_SSL3);
 }
 
 TEST_F(TransportSecurityPersisterTest, SerializeData3) {
   // Add an entry.
   net::HashValue fp1(net::HASH_VALUE_SHA1);
   memset(fp1.data(), 0, fp1.size());
   net::HashValue fp2(net::HASH_VALUE_SHA1);
   memset(fp2.data(), 1, fp2.size());
   base::Time expiry =
       base::Time::Now() + base::TimeDelta::FromSeconds(1000);
@@ skipping 121 matching lines @@
                       "\"mode\": \"pinning-only\""
                       "}}");
 
   EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload));
 
   TransportSecurityState::DomainState domain_state;
   EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state));
   EXPECT_FALSE(domain_state.HasPublicKeyPins());
   EXPECT_FALSE(domain_state.ShouldUpgradeToSSL());
 }
+
+TEST_F(TransportSecurityPersisterTest, SSLVersionMin1) {
+  std::string preload("{"
+                      "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {"
+                      "\"created\": 0.0,"
+                      "\"expiry\": 2000000000.0,"
+                      "\"include_subdomains\": false,"
+                      "\"mode\": \"pinning-only\""
+                      "}}");
+
+  EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload));
+
+  TransportSecurityState::DomainState domain_state;
+  EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state));
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_SSL3);
+}
+
+
+TEST_F(TransportSecurityPersisterTest, SSLVersionMin2) {
+  std::string preload("{"
+                      "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {"
+                      "\"created\": 0.0,"
+                      "\"expiry\": 2000000000.0,"
+                      "\"include_subdomains\": false,"
+                      "\"mode\": \"pinning-only\","
+                      "\"ssl_version_min\": \"sslv3.0\""
+                      "}}");
+
+  EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload));
+
+  TransportSecurityState::DomainState domain_state;
+  EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state));
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_SSL3);
+}
+
+TEST_F(TransportSecurityPersisterTest, SSLVersionMin3) {
+  std::string preload("{"
+                      "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {"
+                      "\"created\": 0.0,"
+                      "\"expiry\": 2000000000.0,"
+                      "\"include_subdomains\": false,"
+                      "\"mode\": \"pinning-only\","
+                      "\"ssl_version_min\": \"tlsv1.0\""
+                      "}}");
+
+  EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload));
+
+  TransportSecurityState::DomainState domain_state;
+  EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state));
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_TLS1);
+}
+
+TEST_F(TransportSecurityPersisterTest, SSLVersionMin4) {
+  std::string preload("{"
+                      "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {"
+                      "\"created\": 0.0,"
+                      "\"expiry\": 2000000000.0,"
+                      "\"include_subdomains\": false,"
+                      "\"mode\": \"pinning-only\","
+                      "\"ssl_version_min\": \"tlsv1.1\""
+                      "}}");
+
+  EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload));
+
+  TransportSecurityState::DomainState domain_state;
+  EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state));
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_TLS1_1);
+}
+
+
+TEST_F(TransportSecurityPersisterTest, SSLVersionMin5) {
+  std::string preload("{"
+                      "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {"
+                      "\"created\": 0.0,"
+                      "\"expiry\": 2000000000.0,"
+                      "\"include_subdomains\": false,"
+                      "\"mode\": \"pinning-only\","
+                      "\"ssl_version_min\": \"tlsv1.2\""
+                      "}}");
+
+  EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload));
+
+  TransportSecurityState::DomainState domain_state;
+  EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state));
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_TLS1_2);
+}
+