Implement referred Token Bindings

net/http/http_network_transaction_ssl_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 #include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "net/base/request_priority.h"
@@ skipping 154 matching lines @@
   SSLSocketDataProvider ssl_data(ASYNC, OK);
   ssl_data.token_binding_negotiated = true;
   ssl_data.token_binding_key_param = TB_PARAM_ECDSAP256;
   mock_socket_factory_.AddSSLSocketDataProvider(&ssl_data);
   MockRead mock_reads[] = {MockRead("HTTP/1.1 200 OK\r\n\r\n"),
                            MockRead(SYNCHRONOUS, OK)};
   StaticSocketDataProvider data(mock_reads, arraysize(mock_reads), NULL, 0);
   mock_socket_factory_.AddSocketDataProvider(&data);
 
   HttpNetworkSession session(session_params_);
-  HttpNetworkTransaction trans(DEFAULT_PRIORITY, &session);
+  HttpNetworkTransaction trans1(DEFAULT_PRIORITY, &session);
 
   TestCompletionCallback callback;
-  int rv =
-      callback.GetResult(trans.Start(GetRequestInfo("https://www.example.com/"),
-                                     callback.callback(), BoundNetLog()));
+  int rv = callback.GetResult(
+      trans1.Start(GetRequestInfo("https://www.example.com/"),
+                   callback.callback(), BoundNetLog()));
   EXPECT_EQ(OK, rv);
 
   HttpRequestHeaders headers1;
-  ASSERT_TRUE(trans.GetFullRequestHeaders(&headers1));
+  ASSERT_TRUE(trans1.GetFullRequestHeaders(&headers1));
   std::string token_binding_header1;
   EXPECT_TRUE(headers1.GetHeader(HttpRequestHeaders::kTokenBinding,
                                  &token_binding_header1));
 
   // Send a second request and verify that the token binding header is the same
   // as in the first request.
   mock_socket_factory_.AddSSLSocketDataProvider(&ssl_data);
   StaticSocketDataProvider data2(mock_reads, arraysize(mock_reads), NULL, 0);
   mock_socket_factory_.AddSocketDataProvider(&data2);
+  HttpNetworkTransaction trans2(DEFAULT_PRIORITY, &session);
 
-  rv =
-      callback.GetResult(trans.Start(GetRequestInfo("https://www.example.com/"),
-                                     callback.callback(), BoundNetLog()));
+  rv = callback.GetResult(
+      trans2.Start(GetRequestInfo("https://www.example.com/"),
+                   callback.callback(), BoundNetLog()));
   EXPECT_EQ(OK, rv);
 
   HttpRequestHeaders headers2;
-  ASSERT_TRUE(trans.GetFullRequestHeaders(&headers2));
+  ASSERT_TRUE(trans2.GetFullRequestHeaders(&headers2));
   std::string token_binding_header2;
   EXPECT_TRUE(headers2.GetHeader(HttpRequestHeaders::kTokenBinding,
                                  &token_binding_header2));
 
   EXPECT_EQ(token_binding_header1, token_binding_header2);
 }
+
+TEST_F(HttpNetworkTransactionSSLTest, NoTokenBindingOverHttp) {
+  ssl_config_service_ = new TokenBindingSSLConfigService;
+  session_params_.ssl_config_service = ssl_config_service_.get();
+  ChannelIDService channel_id_service(new DefaultChannelIDStore(NULL),
+                                      base::ThreadTaskRunnerHandle::Get());
+  session_params_.channel_id_service = &channel_id_service;
+
+  SSLSocketDataProvider ssl_data(ASYNC, OK);
+  ssl_data.token_binding_negotiated = true;
+  ssl_data.token_binding_key_param = TB_PARAM_ECDSAP256;
+  mock_socket_factory_.AddSSLSocketDataProvider(&ssl_data);
+  MockRead mock_reads[] = {MockRead("HTTP/1.1 200 OK\r\n\r\n"),
+                           MockRead(SYNCHRONOUS, OK)};
+  StaticSocketDataProvider data(mock_reads, arraysize(mock_reads), NULL, 0);
+  mock_socket_factory_.AddSocketDataProvider(&data);
+
+  HttpNetworkSession session(session_params_);
+  HttpNetworkTransaction trans(DEFAULT_PRIORITY, &session);
+
+  TestCompletionCallback callback;
+  int rv =
+      callback.GetResult(trans.Start(GetRequestInfo("http://www.example.com/"),
+                                     callback.callback(), BoundNetLog()));

[davidben, 2016/03/24 20:53:52]

What is this testing? It looks like we've got a request to an http URL over an
SSLSocketDataProvider. (I guess this is what you meant by "what would have to go
wrong"?)

I meant a test with an HTTPS -> HTTP redirect where the HTTPS URL requested TB
forwarding. This would be to make sure we don't get internally confused
somewhere because token_binding_referrer but the target URL isn't HTTPS. I think
the IsTokenBindingEnabled() checks mean we're good, but it seems worth a test.

I guess that would be similar to a test that did a HTTPS+TB -> HTTPS+NO_TB
redirect? Anyway, I don't think we've currently got a test for that?

[nharper, 2016/03/25 01:34:29]

This is testing that we don't send a Token-Binding header over HTTP. I think
this covers testing the HTTPS->HTTP redirect, because if we never send a
Token-Binding header on an HTTP request, then we can never send a referred token
binding (on an HTTP request).

I'm adding an HTTPS+TB -> HTTPS+NO_TB test to URLRequestTest.

+  EXPECT_EQ(OK, rv);
+
+  HttpRequestHeaders headers;
+  ASSERT_TRUE(trans.GetFullRequestHeaders(&headers));
+  std::string token_binding_header;
+  EXPECT_FALSE(headers.GetHeader(HttpRequestHeaders::kTokenBinding,
+                                 &token_binding_header));
+}
 #endif  // !defined(OS_IOS)
 
 }  // namespace net