Add Expect-Staple to preload list

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 27 matching lines @@
 namespace net {
 
 namespace {
 
 const char kHost[] = "example.test";
 const char kSubdomain[] = "foo.example.test";
 const uint16_t kPort = 443;
 const char kReportUri[] = "http://report-example.test/test";
 const char kExpectCTStaticHostname[] = "preloaded-expect-ct.badssl.com";
 const char kExpectCTStaticReportURI[] = "https://report.badssl.com/expect-ct";
+const char kExpectStapleStaticHostname[] = "preloaded-expect-staple.badssl.com";
+const char kExpectStapleStaticReportURI[] =
+    "https://report.badssl.com/expect-staple";
+const char kExpectStapleStaticIncludeSubdomainsHostname[] =
+    "preloaded-expect-staple-include-subdomains.badssl.com";
 
 // kGoodPath is blog.torproject.org.
 const char* const kGoodPath[] = {
     "sha1/Yz4vayd/83rQfDXkDPn2yhzIScw=",
     "sha1/3lKvjNsfmrn+WmfDhvr2iVh/yRs=",
     "sha1/gzF+YoVCU9bXeDGQ7JGQVumRueM=",
     "sha256/4osU79hfY3P2+WJGlT2mxmSL+5FIwLEVxTQcavyBNgQ=",
     "sha256/k2v657xBsOVe1PQRwOsHsw3bsGT2VzIqz5K+59sNQws=",
     "sha256/WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=",
     nullptr,
@@ skipping 181 matching lines @@
   }
 
   static void EnableStaticPins(TransportSecurityState* state) {
     state->enable_static_pins_ = true;
   }
 
   static void EnableStaticExpectCT(TransportSecurityState* state) {
     state->enable_static_expect_ct_ = true;
   }
 
+  static void EnableStaticExpectStaple(TransportSecurityState* state) {
+    state->enable_static_expect_staple_ = true;
+  }
+
   static HashValueVector GetSampleSPKIHashes() {
     HashValueVector spki_hashes;
     HashValue hash(HASH_VALUE_SHA256);
     memset(hash.data(), 0, hash.size());
     spki_hashes.push_back(hash);
     return spki_hashes;
   }
 
  protected:
   bool GetStaticDomainState(TransportSecurityState* state,
                             const std::string& host,
                             TransportSecurityState::STSState* sts_result,
                             TransportSecurityState::PKPState* pkp_result) {
     return state->GetStaticDomainState(host, sts_result, pkp_result);
   }
 
   bool GetExpectCTState(TransportSecurityState* state,
                         const std::string& host,
                         TransportSecurityState::ExpectCTState* result) {
     return state->GetStaticExpectCTState(host, result);
   }
+
+  bool GetExpectStapleState(TransportSecurityState* state,
+                            const std::string& host,
+                            TransportSecurityState::ExpectStapleState* result) {
+    return state->GetStaticExpectStapleState(host, result);
+  }
 };
 
 TEST_F(TransportSecurityStateTest, DomainNameOddities) {
   TransportSecurityState state;
   const base::Time current_time(base::Time::Now());
   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
 
   // DNS suffix search tests. Some DNS resolvers allow a terminal "." to
   // indicate not perform DNS suffix searching. Ensure that regardless
   // of how this is treated at the resolver layer, or at the URL/origin
@@ skipping 1380 matching lines @@
   TransportSecurityStateTest::EnableStaticExpectCT(&state);
   TransportSecurityState::ExpectCTState expect_ct_state;
   EXPECT_TRUE(
       GetExpectCTState(&state, kExpectCTStaticHostname, &expect_ct_state));
   EXPECT_EQ(kExpectCTStaticHostname, expect_ct_state.domain);
   EXPECT_EQ(GURL(kExpectCTStaticReportURI), expect_ct_state.report_uri);
   EXPECT_FALSE(
       GetExpectCTState(&state, "pinning-test.badssl.com", &expect_ct_state));
 }
 
+// Tests that static (preloaded) expect staple state is read correctly.
+TEST_F(TransportSecurityStateTest, PreloadedExpectStaple) {
+  TransportSecurityState state;
+  TransportSecurityStateTest::EnableStaticExpectStaple(&state);

[estark, 2016/06/03 22:54:14]

Sorry, I am doing a terrible job getting all my comments in in one round. One
more request: could you please add a test that GetExpectStapleState() is false
when enable_static_expect_staple_ is false?

+  TransportSecurityState::ExpectStapleState expect_staple_state;
+  EXPECT_TRUE(GetExpectStapleState(&state, kExpectStapleStaticHostname,
+                                   &expect_staple_state));
+  EXPECT_EQ(kExpectStapleStaticHostname, expect_staple_state.domain);
+  EXPECT_EQ(GURL(kExpectStapleStaticReportURI), expect_staple_state.report_uri);
+  EXPECT_FALSE(expect_staple_state.include_subdomains);
+  EXPECT_FALSE(GetExpectStapleState(&state, "pinning-test.badssl.com",
+                                    &expect_staple_state));
+  std::string subdomain = "subdomain.";
+  subdomain += kExpectStapleStaticHostname;
+  EXPECT_FALSE(GetExpectStapleState(&state, subdomain, &expect_staple_state));
+}
+
+TEST_F(TransportSecurityStateTest, PreloadedExpectStapleIncludeSubdomains) {
+  TransportSecurityState state;
+  TransportSecurityStateTest::EnableStaticExpectStaple(&state);
+  TransportSecurityState::ExpectStapleState expect_staple_state;
+  std::string subdomain = "subdomain.";
+  subdomain += kExpectStapleStaticIncludeSubdomainsHostname;
+  EXPECT_TRUE(GetExpectStapleState(&state, subdomain, &expect_staple_state));
+  EXPECT_EQ(kExpectStapleStaticIncludeSubdomainsHostname,
+            expect_staple_state.domain);
+  EXPECT_TRUE(expect_staple_state.include_subdomains);
+  EXPECT_EQ(GURL(kExpectStapleStaticReportURI), expect_staple_state.report_uri);
+}
+
 // Tests that the Expect CT reporter is not notified for invalid or absent
 // header values.
 TEST_F(TransportSecurityStateTest, InvalidExpectCTHeader) {
   HostPortPair host_port(kExpectCTStaticHostname, 443);
   SSLInfo ssl_info;
   ssl_info.ct_compliance_details_available = true;
   ssl_info.ct_cert_policy_compliance =
       ct::CertPolicyCompliance::CERT_POLICY_NOT_ENOUGH_SCTS;
   ssl_info.is_issued_by_known_root = true;
 
@@ skipping 118 matching lines @@
   EXPECT_EQ(1u, reporter.num_failures());
   EXPECT_TRUE(reporter.ssl_info().ct_compliance_details_available);
   EXPECT_EQ(ssl_info.ct_cert_policy_compliance,
             reporter.ssl_info().ct_cert_policy_compliance);
   EXPECT_EQ(host_port.host(), reporter.host_port_pair().host());
   EXPECT_EQ(host_port.port(), reporter.host_port_pair().port());
   EXPECT_EQ(GURL(kExpectCTStaticReportURI), reporter.report_uri());
 }
 
 }  // namespace net