Implement referred Token Bindings

net/http/http_network_transaction_ssl_unittest.cc

Index: net/http/http_network_transaction_ssl_unittest.cc
diff --git a/net/http/http_network_transaction_ssl_unittest.cc b/net/http/http_network_transaction_ssl_unittest.cc
index d856996e93176727d06bd1559e7ee344c6c93081..575b2b949e4bc0c4b7669e67590b9f2ac8147ac3 100644
--- a/net/http/http_network_transaction_ssl_unittest.cc
+++ b/net/http/http_network_transaction_ssl_unittest.cc
@@ -172,16 +172,16 @@ TEST_F(HttpNetworkTransactionSSLTest, TokenBinding) {
   mock_socket_factory_.AddSocketDataProvider(&data);
 
   HttpNetworkSession session(session_params_);
-  HttpNetworkTransaction trans(DEFAULT_PRIORITY, &session);
+  HttpNetworkTransaction trans1(DEFAULT_PRIORITY, &session);
 
   TestCompletionCallback callback;
-  int rv =
-      callback.GetResult(trans.Start(GetRequestInfo("https://www.example.com/"),
-                                     callback.callback(), BoundNetLog()));
+  int rv = callback.GetResult(
+      trans1.Start(GetRequestInfo("https://www.example.com/"),
+                   callback.callback(), BoundNetLog()));
   EXPECT_EQ(OK, rv);
 
   HttpRequestHeaders headers1;
-  ASSERT_TRUE(trans.GetFullRequestHeaders(&headers1));
+  ASSERT_TRUE(trans1.GetFullRequestHeaders(&headers1));
   std::string token_binding_header1;
   EXPECT_TRUE(headers1.GetHeader(HttpRequestHeaders::kTokenBinding,
                                  &token_binding_header1));
@@ -191,20 +191,53 @@ TEST_F(HttpNetworkTransactionSSLTest, TokenBinding) {
   mock_socket_factory_.AddSSLSocketDataProvider(&ssl_data);
   StaticSocketDataProvider data2(mock_reads, arraysize(mock_reads), NULL, 0);
   mock_socket_factory_.AddSocketDataProvider(&data2);
+  HttpNetworkTransaction trans2(DEFAULT_PRIORITY, &session);
 
-  rv =
-      callback.GetResult(trans.Start(GetRequestInfo("https://www.example.com/"),
-                                     callback.callback(), BoundNetLog()));
+  rv = callback.GetResult(
+      trans2.Start(GetRequestInfo("https://www.example.com/"),
+                   callback.callback(), BoundNetLog()));
   EXPECT_EQ(OK, rv);
 
   HttpRequestHeaders headers2;
-  ASSERT_TRUE(trans.GetFullRequestHeaders(&headers2));
+  ASSERT_TRUE(trans2.GetFullRequestHeaders(&headers2));
   std::string token_binding_header2;
   EXPECT_TRUE(headers2.GetHeader(HttpRequestHeaders::kTokenBinding,
                                  &token_binding_header2));
 
   EXPECT_EQ(token_binding_header1, token_binding_header2);
 }
+
+TEST_F(HttpNetworkTransactionSSLTest, NoTokenBindingOverHttp) {
+  ssl_config_service_ = new TokenBindingSSLConfigService;
+  session_params_.ssl_config_service = ssl_config_service_.get();
+  ChannelIDService channel_id_service(new DefaultChannelIDStore(NULL),
+                                      base::ThreadTaskRunnerHandle::Get());
+  session_params_.channel_id_service = &channel_id_service;
+
+  SSLSocketDataProvider ssl_data(ASYNC, OK);
+  ssl_data.token_binding_negotiated = true;
+  ssl_data.token_binding_key_param = TB_PARAM_ECDSAP256;
+  mock_socket_factory_.AddSSLSocketDataProvider(&ssl_data);
+  MockRead mock_reads[] = {MockRead("HTTP/1.1 200 OK\r\n\r\n"),
+                           MockRead(SYNCHRONOUS, OK)};
+  StaticSocketDataProvider data(mock_reads, arraysize(mock_reads), NULL, 0);
+  mock_socket_factory_.AddSocketDataProvider(&data);
+
+  HttpNetworkSession session(session_params_);
+  HttpNetworkTransaction trans(DEFAULT_PRIORITY, &session);
+
+  TestCompletionCallback callback;
+  int rv =
+      callback.GetResult(trans.Start(GetRequestInfo("http://www.example.com/"),
+                                     callback.callback(), BoundNetLog()));

[davidben, 2016/03/24 20:53:52]

What is this testing? It looks like we've got a request to an http URL over an
SSLSocketDataProvider. (I guess this is what you meant by "what would have to go
wrong"?)

I meant a test with an HTTPS -> HTTP redirect where the HTTPS URL requested TB
forwarding. This would be to make sure we don't get internally confused
somewhere because token_binding_referrer but the target URL isn't HTTPS. I think
the IsTokenBindingEnabled() checks mean we're good, but it seems worth a test.

I guess that would be similar to a test that did a HTTPS+TB -> HTTPS+NO_TB
redirect? Anyway, I don't think we've currently got a test for that?

[nharper, 2016/03/25 01:34:29]

This is testing that we don't send a Token-Binding header over HTTP. I think
this covers testing the HTTPS->HTTP redirect, because if we never send a
Token-Binding header on an HTTP request, then we can never send a referred token
binding (on an HTTP request).

I'm adding an HTTPS+TB -> HTTPS+NO_TB test to URLRequestTest.

+  EXPECT_EQ(OK, rv);
+
+  HttpRequestHeaders headers;
+  ASSERT_TRUE(trans.GetFullRequestHeaders(&headers));
+  std::string token_binding_header;
+  EXPECT_FALSE(headers.GetHeader(HttpRequestHeaders::kTokenBinding,
+                                 &token_binding_header));
+}
 #endif  // !defined(OS_IOS)
 
 }  // namespace net