Expose when PKP is bypassed in SSLInfo.

net/quic/crypto/proof_verifier_chromium_test.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/proof_verifier_chromium.h"
 
 #include "base/memory/ref_counted.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_data_directory.h"
 #include "net/cert/cert_status_flags.h"
@@ skipping 391 matching lines @@
       GetTestSignature(), verify_context_.get(), &error_details_, &details_,
       callback.get());
   ASSERT_EQ(QUIC_SUCCESS, status);
 
   ASSERT_TRUE(details_.get());
   ProofVerifyDetailsChromium* verify_details =
       static_cast<ProofVerifyDetailsChromium*>(details_.get());
   EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status);
 }
 
+HashValueVector MakeHashValueVector(uint8_t tag) {
+  HashValue hash(HASH_VALUE_SHA256);
+  memset(hash.data(), tag, hash.size());
+  HashValueVector hashes;
+  hashes.push_back(hash);
+  return hashes;
+}
+
+// Test that PKP is enforced for certificates that chain up to known roots

[estark, 2016/06/07 04:10:43]

So the pinning check is supposed to fail here, right? Is there any more specific
way to test for that other than just QUIC_FAILURE?

[estark, 2016/06/07 04:10:43]

also, nit (sorry): add a period
Believe it or not, it's actually in the style guide:
https://google.github.io/styleguide/cppguide.html#Punctuation,_Spelling_and_G...

[dadrian, 2016/06/07 17:48:23]

Done.

[dadrian, 2016/06/07 17:48:23]

Effectively, this is only exposed through strings: the |error_details_| string,
and the |pinning_failure_log| in VerifyDetailsChromium. I do check that the
|pinning_failure_log| is non-empty, but I'm not sure we can do much better than
that, beyond grepping through |error_details_| for
ERR_SSL_PINNED_KEY_NOT_IN_CHAIN.

+TEST_F(ProofVerifierChromiumTest, PKPEnforced) {
+  scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate();
+  ASSERT_TRUE(test_cert);
+
+  CertVerifyResult dummy_result;
+  dummy_result.verified_cert = test_cert;
+  dummy_result.is_issued_by_known_root = true;
+  dummy_result.public_key_hashes = MakeHashValueVector(0x01);
+  dummy_result.cert_status = 0;
+
+  MockCertVerifier dummy_verifier;
+  dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK);
+
+  HashValueVector pin_hashes = MakeHashValueVector(0x02);
+  TransportSecurityState transport_security_state;
+  transport_security_state.AddHPKP(
+      kTestHostname, base::Time::Now() + base::TimeDelta::FromSeconds(10000),
+      true, pin_hashes, GURL());
+
+  ProofVerifierChromium proof_verifier(&dummy_verifier, nullptr,
+                                       &transport_security_state, nullptr);
+
+  std::unique_ptr<DummyProofVerifierCallback> callback(
+      new DummyProofVerifierCallback);
+  QuicAsyncStatus status = proof_verifier.VerifyProof(
+      kTestHostname, kTestPort, kTestConfig, QUIC_VERSION_25, "", certs_, "",
+      GetTestSignature(), verify_context_.get(), &error_details_, &details_,
+      callback.get());
+  ASSERT_EQ(QUIC_FAILURE, status);
+
+  ASSERT_TRUE(details_.get());
+  ProofVerifyDetailsChromium* verify_details =
+      static_cast<ProofVerifyDetailsChromium*>(details_.get());
+  EXPECT_EQ(0u, verify_details->cert_verify_result.cert_status);
+  EXPECT_NE("", verify_details->pinning_failure_log);

[estark, 2016/06/07 04:10:43]

Perhaps check that |pkp_bypassed| is false too.

[dadrian, 2016/06/07 17:48:23]

Done.

+}
+
+// Test CERT_STATUS_PKP_BYPASSED is set when PKP is bypassed due to a local

[svaldez, 2016/06/07 14:12:48]

Name.

[dadrian, 2016/06/07 17:48:23]

Done.

+// trust anchor
+TEST_F(ProofVerifierChromiumTest, PKPBypassFlagSet) {
+  scoped_refptr<X509Certificate> test_cert = GetTestServerCertificate();
+  ASSERT_TRUE(test_cert);
+
+  CertVerifyResult dummy_result;
+  dummy_result.verified_cert = test_cert;
+  dummy_result.is_issued_by_known_root = false;
+  dummy_result.public_key_hashes = MakeHashValueVector(0x01);
+  dummy_result.cert_status = 0;
+
+  MockCertVerifier dummy_verifier;
+  dummy_verifier.AddResultForCert(test_cert.get(), dummy_result, OK);
+
+  HashValueVector expected_hashes = MakeHashValueVector(0x02);
+  TransportSecurityState transport_security_state_fail;
+  transport_security_state_fail.AddHPKP(
+      kTestHostname, base::Time::Now() + base::TimeDelta::FromSeconds(10000),
+      true, expected_hashes, GURL());
+
+  ProofVerifierChromium proof_verifier(&dummy_verifier, nullptr,
+                                       &transport_security_state_fail, nullptr);
+
+  std::unique_ptr<DummyProofVerifierCallback> callback(
+      new DummyProofVerifierCallback);
+  QuicAsyncStatus status = proof_verifier.VerifyProof(
+      kTestHostname, kTestPort, kTestConfig, QUIC_VERSION_25, "", certs_, "",
+      GetTestSignature(), verify_context_.get(), &error_details_, &details_,
+      callback.get());
+  ASSERT_EQ(QUIC_SUCCESS, status);
+
+  ASSERT_TRUE(details_.get());
+  ProofVerifyDetailsChromium* verify_details =
+      static_cast<ProofVerifyDetailsChromium*>(details_.get());
+  EXPECT_TRUE(verify_details->cert_verify_result.pkp_bypassed);
+}
+
 }  // namespace test
 }  // namespace net