Add Expect CT policy that gets checked on all certs

net/quic/crypto/proof_verifier_chromium_test.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/proof_verifier_chromium.h"
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_data_directory.h"
@@ skipping 32 matching lines @@
              CRLSet* crl_set,
              CertVerifyResult* verify_result,
              const CompletionCallback& callback,
              scoped_ptr<CertVerifier::Request>* out_req,
              const BoundNetLog& net_log) override {
     ADD_FAILURE() << "CertVerifier::Verify() should not be called";
     return ERR_FAILED;
   }
 };
 
-// CTPolicyEnforcer that will fail the test if it is ever called.
-class FailsTestCTPolicyEnforcer : public CTPolicyEnforcer {
- public:
-  FailsTestCTPolicyEnforcer() {}
-  ~FailsTestCTPolicyEnforcer() override {}
-
-  bool DoesConformToCTEVPolicy(X509Certificate* cert,
-                               const ct::EVCertsWhitelist* ev_whitelist,
-                               const ct::CTVerifyResult& ct_result,
-                               const BoundNetLog& net_log) override {
-    ADD_FAILURE() << "CTPolicyEnforcer::DoesConformToCTEVPolicy() should "
-                  << "not be called";
-    return false;
-  }
-};
-
 // CTPolicyEnforcer that can simulate whether or not a given certificate
 // conforms to the CT/EV policy.
 class MockCTPolicyEnforcer : public CTPolicyEnforcer {
  public:
   MockCTPolicyEnforcer(bool is_ev) : is_ev_(is_ev) {}
   ~MockCTPolicyEnforcer() override {}
 
-  bool DoesConformToCTEVPolicy(X509Certificate* cert,
-                               const ct::EVCertsWhitelist* ev_whitelist,
-                               const ct::CTVerifyResult& ct_result,
-                               const BoundNetLog& net_log) override {
+  bool DoesConformToCertPolicy(X509Certificate* cert,
+                               const ct::CTVerifyResult& ct_result) override {
     return is_ev_;
   }
 
+  bool DoesConformToEVPolicy(X509Certificate* cert,
+                             CertStatus cert_status,
+                             const ct::EVCertsWhitelist* ev_whitelist,
+                             const BoundNetLog& net_log) override {
+    return is_ev_;
+  }
+
  private:
   bool is_ev_;
 };
 
 class DummyProofVerifierCallback : public ProofVerifierCallback {
  public:
   DummyProofVerifierCallback() {}
   ~DummyProofVerifierCallback() override {}
 
   void Run(bool ok,
@@ skipping 295 matching lines @@
   ASSERT_EQ(QUIC_SUCCESS, status);
 
   ASSERT_TRUE(details_.get());
   ProofVerifyDetailsChromium* verify_details =
       static_cast<ProofVerifyDetailsChromium*>(details_.get());
   EXPECT_EQ(CERT_STATUS_CT_COMPLIANCE_FAILED,
             verify_details->cert_verify_result.cert_status &
                 (CERT_STATUS_CT_COMPLIANCE_FAILED | CERT_STATUS_IS_EV));
 }
 
-// Tests that the certificate policy enforcer is not consulted if
+// Tests that the certificate policy enforcer is consulted even if
 // the certificate is not EV.
-TEST_F(ProofVerifierChromiumTest, IgnoresPolicyEnforcerIfNotEV) {
+TEST_F(ProofVerifierChromiumTest, PolicyEnforcerConsultedIfNotEV) {
   scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate();
   ASSERT_TRUE(test_cert);
 
   CertVerifyResult dummy_result;
   dummy_result.verified_cert = test_cert;
   dummy_result.cert_status = 0;
 
   MockCertVerifier dummy_verifier;
   dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK);
 
-  FailsTestCTPolicyEnforcer policy_enforcer;
+  MockCTPolicyEnforcer policy_enforcer(false /*is_ev*/);
 
   ProofVerifierChromium proof_verifier(&dummy_verifier, &policy_enforcer,
                                        nullptr, ct_verifier_.get());
 
   scoped_ptr<DummyProofVerifierCallback> callback(
       new DummyProofVerifierCallback);
   QuicAsyncStatus status = proof_verifier.VerifyProof(
       kTestHostname, kTestConfig, certs_, "", GetTestSignature(),
       verify_context_.get(), &error_details_, &details_, callback.get());
   ASSERT_EQ(QUIC_SUCCESS, status);
 
   ASSERT_TRUE(details_.get());
   ProofVerifyDetailsChromium* verify_details =
       static_cast<ProofVerifyDetailsChromium*>(details_.get());
-  EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status);
+  EXPECT_EQ(CERT_STATUS_CT_COMPLIANCE_FAILED,
+            verify_details->cert_verify_result.cert_status);
 }
 
 }  // namespace test
 }  // namespace net