Implement a skeleton version of Expect CT reports

chrome/browser/net/chrome_network_delegate_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/chrome_network_delegate.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/prefs/pref_member.h"
 #include "base/run_loop.h"
 #include "base/test/histogram_tester.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/content_settings/cookie_settings_factory.h"
+#include "chrome/browser/net/expect_ct_monitor.h"
 #include "chrome/browser/net/safe_search_util.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chrome/test/base/testing_profile.h"
 #include "chrome/test/base/testing_profile_manager.h"
 #include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/content_settings/core/common/pref_names.h"
 #include "components/data_usage/core/data_use_aggregator.h"
 #include "components/data_usage/core/data_use_amortizer.h"
 #include "components/data_usage/core/data_use_annotator.h"
@@ skipping 20 matching lines @@
 namespace {
 
 // This function requests a URL, and makes it return a known response. If
 // |from_user| is true, it attaches a ResourceRequestInfo to the URLRequest,
 // because requests from users have this info. If |from_user| is false, the
 // request is presumed to be from a service, and the service name is set in the
 // request's user data. (As an example suggestions service tag is attached). if
 // |redirect| is true, it adds necessary socket data to have it follow redirect
 // before getting the final response.
 scoped_ptr<net::URLRequest> RequestURL(
+    GURL url,
     net::URLRequestContext* context,
     net::MockClientSocketFactory* socket_factory,
     bool from_user,
     bool redirect) {
   net::MockRead redirect_mock_reads[] = {
       net::MockRead("HTTP/1.1 302 Found\r\n"
                     "Location: http://bar.com/\r\n\r\n"),
       net::MockRead(net::SYNCHRONOUS, net::OK),
   };
   net::StaticSocketDataProvider redirect_socket_data_provider(
       redirect_mock_reads, arraysize(redirect_mock_reads), nullptr, 0);
 
   if (redirect)
     socket_factory->AddSocketDataProvider(&redirect_socket_data_provider);
   net::MockRead response_mock_reads[] = {
       net::MockRead("HTTP/1.1 200 OK\r\n\r\n"), net::MockRead("response body"),
       net::MockRead(net::SYNCHRONOUS, net::OK),
   };
   net::StaticSocketDataProvider response_socket_data_provider(
       response_mock_reads, arraysize(response_mock_reads), nullptr, 0);
   socket_factory->AddSocketDataProvider(&response_socket_data_provider);
   net::TestDelegate test_delegate;
   test_delegate.set_quit_on_complete(true);
-  scoped_ptr<net::URLRequest> request(context->CreateRequest(
-      GURL("http://example.com"), net::DEFAULT_PRIORITY, &test_delegate));
+  scoped_ptr<net::URLRequest> request(
+      context->CreateRequest(url, net::DEFAULT_PRIORITY, &test_delegate));
 
   if (from_user) {
     content::ResourceRequestInfo::AllocateForTesting(
         request.get(), content::RESOURCE_TYPE_MAIN_FRAME, nullptr, -2, -2, -2,
         true, false, true, true, false);
   } else {
     request->SetUserData(
         data_use_measurement::DataUseUserData::kUserDataKey,
         new data_use_measurement::DataUseUserData(
             data_use_measurement::DataUseUserData::SUGGESTIONS));
   }
   request->Start();
   base::RunLoop().RunUntilIdle();
   return request;
 }
 
+scoped_ptr<net::URLRequest> RequestNonSSLURL(
+    net::URLRequestContext* context,
+    net::MockClientSocketFactory* socket_factory,
+    bool from_user,
+    bool redirect) {
+  return RequestURL(GURL("http://example.test"), context, socket_factory,
+                    from_user, redirect);
+}
+
+scoped_ptr<net::URLRequest> RequestSSLURL(
+    net::CertStatus cert_status,
+    net::URLRequestContext* context,
+    net::MockClientSocketFactory* socket_factory,
+    bool from_user,
+    bool redirect) {
+  net::SSLSocketDataProvider ssl_data(net::ASYNC, net::OK);
+  ssl_data.cert_status = cert_status;
+  socket_factory->AddSSLSocketDataProvider(&ssl_data);
+  return RequestURL(GURL("https://example.test"), context, socket_factory,
+                    from_user, redirect);
+}
+
 // A fake DataUseAggregator for testing that only counts how many times its
 // respective methods have been called.
 class FakeDataUseAggregator : public data_usage::DataUseAggregator {
  public:
   FakeDataUseAggregator()
       : data_usage::DataUseAggregator(
             scoped_ptr<data_usage::DataUseAnnotator>(),
             scoped_ptr<data_usage::DataUseAmortizer>()),
         on_the_record_tx_bytes_(0),
         on_the_record_rx_bytes_(0),
@@ skipping 18 matching lines @@
   int64_t off_the_record_tx_bytes() const { return off_the_record_tx_bytes_; }
   int64_t off_the_record_rx_bytes() const { return off_the_record_rx_bytes_; }
 
  private:
   int64_t on_the_record_tx_bytes_;
   int64_t on_the_record_rx_bytes_;
   int64_t off_the_record_tx_bytes_;
   int64_t off_the_record_rx_bytes_;
 };
 
+class TestExpectCTMonitor : public ExpectCTMonitor {
+ public:
+  TestExpectCTMonitor() : num_ct_compliance_failures_(0) {}
+  ~TestExpectCTMonitor() override {}
+
+  size_t num_ct_compliance_failures() { return num_ct_compliance_failures_; }
+
+  // ExpectCTMonitor:
+  void OnCTComplianceFailed(net::URLRequest* request) override {
+    num_ct_compliance_failures_++;
+  }
+
+ private:
+  size_t num_ct_compliance_failures_;
+};
+
 }  // namespace
 
 class ChromeNetworkDelegateTest : public testing::Test {
  public:
   ChromeNetworkDelegateTest()
       : thread_bundle_(content::TestBrowserThreadBundle::IO_MAINLOOP),
         context_(new net::TestURLRequestContext(true)) {
 #if defined(ENABLE_EXTENSIONS)
     forwarder_ = new extensions::EventRouterForwarder();
 #endif
@@ skipping 49 matching lines @@
 // query which is similar to a query of a service, so it should affect
 // DataUse.TrafficSize.System.Dimensions and DataUse.MessageSize.ServiceName
 // histograms. AppState and ConnectionType dimensions are always Foreground and
 // NotCellular respectively.
 #if !defined(OS_IOS)
 TEST_F(ChromeNetworkDelegateTest, DataUseMeasurementServiceTest) {
   Initialize();
   base::HistogramTester histogram_tester;
 
   // A query from a service without redirection.
-  RequestURL(context(), socket_factory(), false, false);
+  RequestNonSSLURL(context(), socket_factory(), false, false);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.System.Downstream.Foreground.NotCellular", 1);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.System.Upstream.Foreground.NotCellular", 1);
   // One upload and one download message, so totalCount should be 2.
   histogram_tester.ExpectTotalCount("DataUse.MessageSize.Suggestions", 2);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.User.Downstream.Foreground.NotCellular", 0);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.User.Upstream.Foreground.NotCellular", 0);
 }
 
 // This function tests data use measurement for requests by user.The query from
 // a user should affect DataUse.TrafficSize.User.Dimensions histogram. AppState
 // and ConnectionType dimensions are always Foreground and NotCellular
 // respectively.
 TEST_F(ChromeNetworkDelegateTest, DataUseMeasurementUserTest) {
   Initialize();
   base::HistogramTester histogram_tester;
 
   // A query from user without redirection.
-  RequestURL(context(), socket_factory(), true, false);
+  RequestNonSSLURL(context(), socket_factory(), true, false);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.User.Downstream.Foreground.NotCellular", 1);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.User.Upstream.Foreground.NotCellular", 1);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.System.Downstream.Foreground.NotCellular", 0);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.System.Upstream.Foreground.NotCellular", 0);
   histogram_tester.ExpectTotalCount("DataUse.MessageSize.Suggestions", 0);
 }
 
 // This function tests data use measurement for requests by services in case the
 // request is redirected once. it makes a query which is similar to a query of a
 // service, so it should affect DataUse.TrafficSize.System.Dimensions and
 // DataUse.MessageSize.ServiceName histograms. AppState and ConnectionType
 // dimensions are always Foreground and NotCellular respectively.
 TEST_F(ChromeNetworkDelegateTest, DataUseMeasurementServiceTestWithRedirect) {
   Initialize();
   base::HistogramTester histogram_tester;
 
   // A query from user with one redirection.
-  RequestURL(context(), socket_factory(), false, true);
+  RequestNonSSLURL(context(), socket_factory(), false, true);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.System.Downstream.Foreground.NotCellular", 2);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.System.Upstream.Foreground.NotCellular", 2);
   // Two uploads and two downloads message, so totalCount should be 4.
   histogram_tester.ExpectTotalCount("DataUse.MessageSize.Suggestions", 4);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.User.Downstream.Foreground.NotCellular", 0);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.User.Upstream.Foreground.NotCellular", 0);
 }
 
 // This function tests data use measurement for requests by user in case the
 // request is redirected once.The query from a user should affect
 // DataUse.TrafficSize.User.Dimensions histogram. AppState and ConnectionType
 // dimensions are always Foreground and NotCellular respectively.
 TEST_F(ChromeNetworkDelegateTest, DataUseMeasurementUserTestWithRedirect) {
   Initialize();
   base::HistogramTester histogram_tester;
 
   // A query from user with one redirection.
-  RequestURL(context(), socket_factory(), true, true);
+  RequestNonSSLURL(context(), socket_factory(), true, true);
 
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.User.Downstream.Foreground.NotCellular", 2);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.User.Upstream.Foreground.NotCellular", 2);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.System.Downstream.Foreground.NotCellular", 0);
   histogram_tester.ExpectTotalCount(
       "DataUse.TrafficSize.System.Upstream.Foreground.NotCellular", 0);
   histogram_tester.ExpectTotalCount("DataUse.MessageSize.Suggestions", 0);
@@ skipping 14 matching lines @@
 }
 
 TEST_F(ChromeNetworkDelegateTest, ReportDataUseToAggregator) {
   FakeDataUseAggregator fake_aggregator;
   Initialize();
 
   chrome_network_delegate()->set_data_use_aggregator(
       &fake_aggregator, false /* is_data_usage_off_the_record */);
 
   scoped_ptr<net::URLRequest> request =
-      RequestURL(context(), socket_factory(), true, false);
+      RequestNonSSLURL(context(), socket_factory(), true, false);
   EXPECT_EQ(request->GetTotalSentBytes(),
             fake_aggregator.on_the_record_tx_bytes());
   EXPECT_EQ(request->GetTotalReceivedBytes(),
             fake_aggregator.on_the_record_rx_bytes());
   EXPECT_EQ(0, fake_aggregator.off_the_record_tx_bytes());
   EXPECT_EQ(0, fake_aggregator.off_the_record_rx_bytes());
 }
 
 TEST_F(ChromeNetworkDelegateTest, ReportOffTheRecordDataUseToAggregator) {
   FakeDataUseAggregator fake_aggregator;
   Initialize();
 
   chrome_network_delegate()->set_data_use_aggregator(
       &fake_aggregator, true /* is_data_usage_off_the_record */);
   scoped_ptr<net::URLRequest> request =
-      RequestURL(context(), socket_factory(), true, false);
+      RequestNonSSLURL(context(), socket_factory(), true, false);
 
   EXPECT_EQ(0, fake_aggregator.on_the_record_tx_bytes());
   EXPECT_EQ(0, fake_aggregator.on_the_record_rx_bytes());
   EXPECT_EQ(request->GetTotalSentBytes(),
             fake_aggregator.off_the_record_tx_bytes());
   EXPECT_EQ(request->GetTotalReceivedBytes(),
             fake_aggregator.off_the_record_rx_bytes());
 }
 
 class ChromeNetworkDelegateSafeSearchTest : public testing::Test {
@@ skipping 200 matching lines @@
                                                        kBlockedFirstPartySite));
 
   cookie_settings_->SetCookieSetting(
       ContentSettingsPattern::FromURL(kBlockedFirstPartySite),
       ContentSettingsPattern::Wildcard(),
       CONTENT_SETTING_BLOCK);
   // Privacy mode is disabled as kAllowedSite is still getting cookies
   EXPECT_FALSE(network_delegate_->CanEnablePrivacyMode(kAllowedSite,
                                                        kBlockedFirstPartySite));
 }
+
+// Tests that the ExpectCTMonitor is invoked when an Expect CT site
+// violates the Certificate Transparency policy, and not invoked for a
+// non-HTTPS request or an HTTPS request that doesn't violate the CT
+// policy.
+TEST_F(ChromeNetworkDelegateTest, ExpectCTMonitor) {
+  Initialize();
+  TestExpectCTMonitor monitor;
+  chrome_network_delegate()->set_expect_ct_monitor(&monitor);
+  EXPECT_EQ(0u, monitor.num_ct_compliance_failures());
+  RequestSSLURL(net::CERT_STATUS_CT_COMPLIANCE_FAILED, context(),
+                socket_factory(), true, false);
+  EXPECT_EQ(1u, monitor.num_ct_compliance_failures());
+  RequestNonSSLURL(context(), socket_factory(), true, false);
+  EXPECT_EQ(1u, monitor.num_ct_compliance_failures());
+  RequestSSLURL(0, context(), socket_factory(), true, false);
+  EXPECT_EQ(1u, monitor.num_ct_compliance_failures());
+}