Implement Expect-Staple

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
 #include "base/base64.h"
 #include "base/files/file_path.h"
 #include "base/json/json_reader.h"
 #include "base/rand_util.h"
 #include "base/sha1.h"
 #include "base/strings/string_piece.h"
 #include "base/test/histogram_tester.h"
 #include "base/values.h"
 #include "crypto/openssl_util.h"
 #include "crypto/sha2.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/base/test_data_directory.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/ct_policy_status.h"
+#include "net/cert/internal/test_helpers.h"
 #include "net/cert/test_root_certs.h"
 #include "net/cert/x509_cert_types.h"
 #include "net/cert/x509_certificate.h"
 #include "net/http/http_util.h"
 #include "net/log/net_log.h"
 #include "net/ssl/ssl_info.h"
 #include "net/test/cert_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
@@ skipping 1805 matching lines @@
   state.ProcessExpectCTHeader("preload", host_port, ssl_info);
   EXPECT_EQ(1u, reporter.num_failures());
   EXPECT_TRUE(reporter.ssl_info().ct_compliance_details_available);
   EXPECT_EQ(ssl_info.ct_cert_policy_compliance,
             reporter.ssl_info().ct_cert_policy_compliance);
   EXPECT_EQ(host_port.host(), reporter.host_port_pair().host());
   EXPECT_EQ(host_port.port(), reporter.host_port_pair().port());
   EXPECT_EQ(GURL(kExpectCTStaticReportURI), reporter.report_uri());
 }
 
+static const char kOCSPPathPrefix[] = "net/data/parse_ocsp_unittest/";

[svaldez, 2016/06/13 14:03:04]

Doesn't need to be static?

[dadrian, 2016/06/13 23:03:32]

Done.

+
+class MockExpectStapleReportSender : public MockCertificateReportSender {
+ public:
+  bool ReportSent() { return latest_report() != ""; }
+};
+
+class ExpectStapleTest : public TransportSecurityStateTest {
+ public:
+  void SetUp() override {
+    TransportSecurityStateTest::SetUp();
+    security_state_.SetReportSender(&report_sender_);
+    EnableStaticExpectStaple(&security_state_);
+  }
+
+  struct OCSPTest {
+    std::string ocsp_response;
+    scoped_refptr<X509Certificate> certificate;
+  };
+
+  static bool LoadOCSPFromFile(std::string file_name, OCSPTest* ocsp) {
+    std::string ca_data;
+    std::string cert_data;
+    const PemBlockMapping mappings[] = {
+        {"OCSP RESPONSE", &ocsp->ocsp_response},
+        {"CA CERTIFICATE", &ca_data},
+        {"CERTIFICATE", &cert_data},
+    };
+    std::string full_path = std::string(kOCSPPathPrefix) + file_name;
+    if (!ReadTestDataFromPemFile(full_path, mappings))
+      return false;
+
+    // Parse the server certificate
+    CertificateList server_cert_list =
+        X509Certificate::CreateCertificateListFromBytes(
+            cert_data.data(), cert_data.size(),
+            X509Certificate::FORMAT_SINGLE_CERTIFICATE);
+    ocsp->certificate = server_cert_list[0];
+    return true;
+  }
+
+  static TransportSecurityState::ExpectStapleState
+  GetDefaultExpectStapleState() {
+    TransportSecurityState::ExpectStapleState state;
+    state.domain = "example.com";  // Doesn't matter

[svaldez, 2016/06/13 14:03:04]

Can you use kHost?

[dadrian, 2016/06/13 23:03:32]

Done.

+    state.report_uri = GURL("reports.example.com/expect-staple");

[svaldez, 2016/06/13 14:03:04]

Use constant.

[dadrian, 2016/06/13 23:03:32]

Done.

+    state.include_subdomains = false;
+    return state;
+  }
+
+ protected:
+  void CheckExpectStaple(const OCSPTest& ocsp) {
+    TransportSecurityState::ExpectStapleState expect_staple_state =
+        GetDefaultExpectStapleState();
+    HostPortPair host_port(kExpectCTStaticHostname, 443);
+    security_state_.CheckExpectStaple(host_port, expect_staple_state,
+                                      *ocsp.certificate, ocsp.ocsp_response);
+  }
+
+  TransportSecurityState security_state_;
+  MockExpectStapleReportSender report_sender_;
+};
+
+TEST_F(ExpectStapleTest, Valid) {
+  OCSPTest ocsp;
+  ASSERT_TRUE(LoadOCSPFromFile("good_response.pem", &ocsp));
+  CheckExpectStaple(ocsp);
+  EXPECT_FALSE(report_sender_.ReportSent());
+};
+
+TEST_F(ExpectStapleTest, ValidWithExtension) {
+  OCSPTest ocsp;
+  ASSERT_TRUE(LoadOCSPFromFile("has_extension.pem", &ocsp));
+  CheckExpectStaple(ocsp);
+  EXPECT_FALSE(report_sender_.ReportSent());
+};
+
+TEST_F(ExpectStapleTest, MissingSingleResponse) {
+  OCSPTest ocsp;
+  ASSERT_TRUE(LoadOCSPFromFile("missing_response.pem", &ocsp));
+  CheckExpectStaple(ocsp);
+  EXPECT_TRUE(report_sender_.ReportSent());
+};
+
 }  // namespace net