Limit Public-Key-Pins max-age to 60 days

net/http/http_security_headers_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/strings/string_piece.h"
 #include "crypto/sha2.h"
@@ skipping 512 matching lines @@
       "max-age=394082;" + backup_pin + ";" + good_pin + ";  ", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(394082);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
   EXPECT_TRUE(ParseAsHPKPHeader(
       "max-age=39408299  ;" + backup_pin + ";" + good_pin + ";  ", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(
-      std::min(kMaxHSTSAgeSecs, static_cast<int64_t>(INT64_C(39408299))));
+      std::min(kMaxHPKPAgeSecs, static_cast<int64_t>(INT64_C(39408299))));
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
   EXPECT_TRUE(ParseAsHPKPHeader(
       "max-age=39408038  ;    cybers=39408038  ;  includeSubdomains; " +
           good_pin + ";" + backup_pin + ";   ",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(
-      std::min(kMaxHSTSAgeSecs, static_cast<int64_t>(INT64_C(394082038))));
+      std::min(kMaxHPKPAgeSecs, static_cast<int64_t>(INT64_C(394082038))));
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_TRUE(include_subdomains);
 
   EXPECT_TRUE(ParseAsHPKPHeader(
       "  max-age=0  ;  " + good_pin + ";" + backup_pin, chain_hashes, &max_age,
       &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(0);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
   EXPECT_TRUE(ParseAsHPKPHeader(
       "  max-age=0 ; includeSubdomains;  " + good_pin + ";" + backup_pin,
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
   expect_max_age = base::TimeDelta::FromSeconds(0);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_TRUE(include_subdomains);
 
   EXPECT_TRUE(ParseAsHPKPHeader(
       "  max-age=999999999999999999999999999999999999999999999  ;  " +
           backup_pin + ";" + good_pin + ";   ",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
-  expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs);
+  expect_max_age = base::TimeDelta::FromSeconds(kMaxHPKPAgeSecs);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
   EXPECT_TRUE(ParseAsHPKPHeader(
       "  max-age=999999999999999999999999999999999999999999999  ;  " +
           backup_pin + ";" + good_pin +
           ";   report-uri=\"http://example.test/foo\"",
       chain_hashes, &max_age, &include_subdomains, &hashes, &report_uri));
-  expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs);
+  expect_max_age = base::TimeDelta::FromSeconds(kMaxHPKPAgeSecs);
   expect_report_uri = GURL("http://example.test/foo");
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
   EXPECT_EQ(expect_report_uri, report_uri);
 
   // Test that parsing a different header resets the hashes.
   hashes.clear();
   EXPECT_TRUE(ParseAsHPKPHeader(
       "  max-age=999;  " + backup_pin + ";" + good_pin + ";   ", chain_hashes,
       &max_age, &include_subdomains, &hashes, &report_uri));
@@ skipping 316 matching lines @@
       ssl_info));
 
   // The old pins must still exist.
   EXPECT_TRUE(state.HasPublicKeyPins("example.com"));
   EXPECT_TRUE(state.CheckPublicKeyPins(
       domain_port, is_issued_by_known_root, ssl_info.public_key_hashes, nullptr,
       nullptr, TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
 }
 
 };    // namespace net