Add Expect CT policy that gets checked on all certs

chrome/browser/ssl/ssl_browser_tests.cc

Index: chrome/browser/ssl/ssl_browser_tests.cc
diff --git a/chrome/browser/ssl/ssl_browser_tests.cc b/chrome/browser/ssl/ssl_browser_tests.cc
index 20b8c8bc291a94138751fc5f349f74fb62a2ad28..de9263620382bba1e49cde22eb7040fe3da67517 100644
--- a/chrome/browser/ssl/ssl_browser_tests.cc
+++ b/chrome/browser/ssl/ssl_browser_tests.cc
@@ -2505,6 +2505,14 @@ IN_PROC_BROWSER_TEST_F(SSLUITest,
   entry = tab->GetController().GetActiveEntry();
   ASSERT_TRUE(entry);
 
+  // Certificate Transparency compliance is not checked until the
+  // connection completes successfully, so the certificate will not have
+  // been marked as failing CT on the interstitial.

[Ryan Sleevi, 2016/01/22 23:49:41]

That's... weird.

[estark, 2016/01/23 01:38:41]

Yeah :/ Not sure how else to deal with it though... I guess maybe this test
shouldn't necessarily be requiring that interstitial_ssl_status.cert_status ==
after_interstitial_ssl_status.cert_status, but rather just checking that they
both contain the relevant cert error.

Also apparently I didn't understand subject verb agreement when I wrote
CheckSSLStatusesEquals(). *twitch*

+  EXPECT_EQ(0u, interstitial_ssl_status.cert_status &
+                    net::CERT_STATUS_CT_COMPLIANCE_FAILED);
+  interstitial_ssl_status.cert_status = interstitial_ssl_status.cert_status |
+                                        net::CERT_STATUS_CT_COMPLIANCE_FAILED;
+
   content::SSLStatus after_interstitial_ssl_status = entry->GetSSL();
   ASSERT_NO_FATAL_FAILURE(CheckSSLStatusesEquals(after_interstitial_ssl_status,
                                                  interstitial_ssl_status));
@@ -2554,6 +2562,14 @@ IN_PROC_BROWSER_TEST_F(SSLUITest,
   // on the clock interstitial.
   entry = tab->GetController().GetActiveEntry();
   ASSERT_TRUE(entry);
+  // Certificate Transparency compliance is not checked until the
+  // connection completes successfully, so the certificate will not have
+  // been marked as failing CT on the interstitial.
+  EXPECT_EQ(0u, clock_interstitial_ssl_status.cert_status &
+                    net::CERT_STATUS_CT_COMPLIANCE_FAILED);
+  clock_interstitial_ssl_status.cert_status =
+      clock_interstitial_ssl_status.cert_status |
+      net::CERT_STATUS_CT_COMPLIANCE_FAILED;
   content::SSLStatus after_interstitial_ssl_status = entry->GetSSL();
   ASSERT_NO_FATAL_FAILURE(CheckSSLStatusesEquals(
       after_interstitial_ssl_status, clock_interstitial_ssl_status));