Return enum from TransportSecurityState::CheckPublicKeyPins

net/http/http_security_headers_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/strings/string_piece.h"
 #include "crypto/sha2.h"
@@ skipping 692 matching lines @@
                    dynamic_pkp_state.spki_hashes.end(), backup_hash);
   EXPECT_NE(dynamic_pkp_state.spki_hashes.end(), hash);
 
   // Expect the overall state to reflect the header, too.
   EXPECT_TRUE(state.HasPublicKeyPins(domain));
   HashValueVector hashes;
   hashes.push_back(good_hash);
   std::string failure_log;
   const bool is_issued_by_known_root = true;
   HostPortPair domain_port(domain, 443);
-  EXPECT_TRUE(state.CheckPublicKeyPins(
-      domain_port, is_issued_by_known_root, hashes, nullptr, nullptr,
-      TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
+  EXPECT_EQ(TransportSecurityState::PKPStatus::OK,
+            state.CheckPublicKeyPins(
+                domain_port, is_issued_by_known_root, hashes, nullptr, nullptr,
+                TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
 
   TransportSecurityState::PKPState new_dynamic_pkp_state;
   EXPECT_TRUE(state.GetDynamicPKPState(domain, &new_dynamic_pkp_state));
   EXPECT_EQ(2UL, new_dynamic_pkp_state.spki_hashes.size());
   EXPECT_EQ(report_uri, new_dynamic_pkp_state.report_uri);
 
   hash = std::find(new_dynamic_pkp_state.spki_hashes.begin(),
                    new_dynamic_pkp_state.spki_hashes.end(), good_hash);
   EXPECT_NE(new_dynamic_pkp_state.spki_hashes.end(), hash);
 
@@ skipping 62 matching lines @@
   EXPECT_TRUE(state.ShouldSSLErrorsBeFatal(domain));
   std::string failure_log;
 
   // Damage the hashes to cause a pin validation failure.
   new_static_pkp_state2.spki_hashes[0].data()[0] ^= 0x80;
   new_static_pkp_state2.spki_hashes[1].data()[0] ^= 0x80;
   new_static_pkp_state2.spki_hashes[2].data()[0] ^= 0x80;
 
   const bool is_issued_by_known_root = true;
   HostPortPair domain_port(domain, 443);
-  EXPECT_FALSE(state.CheckPublicKeyPins(
-      domain_port, is_issued_by_known_root, new_static_pkp_state2.spki_hashes,
-      nullptr, nullptr, TransportSecurityState::DISABLE_PIN_REPORTS,
-      &failure_log));
+  EXPECT_EQ(TransportSecurityState::PKPStatus::VIOLATED,
+            state.CheckPublicKeyPins(
+                domain_port, is_issued_by_known_root,
+                new_static_pkp_state2.spki_hashes, nullptr, nullptr,
+                TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
   EXPECT_NE(0UL, failure_log.length());
 }
 
 // Tests that when a static HSTS and a static HPKP entry are present, adding a
 // dynamic HSTS header does not clobber the static HPKP entry. Further, adding a
 // dynamic HPKP entry could not affect the HSTS entry for the site.
 TEST_F(HttpSecurityHeadersTest, NoClobberPins) {
   TransportSecurityState state;
   TransportSecurityState::STSState sts_state;
   TransportSecurityState::PKPState pkp_state;
@@ skipping 12 matching lines @@
   EXPECT_TRUE(state.HasPublicKeyPins(domain));
 
   // Add a dynamic HSTS header. CheckPublicKeyPins should still pass when given
   // the original |saved_hashes|, indicating that the static PKP data is still
   // configured for the domain.
   EXPECT_TRUE(state.AddHSTSHeader(domain, "includesubdomains; max-age=10000"));
   EXPECT_TRUE(state.ShouldUpgradeToSSL(domain));
   std::string failure_log;
   const bool is_issued_by_known_root = true;
   HostPortPair domain_port(domain, 443);
-  EXPECT_TRUE(state.CheckPublicKeyPins(
-      domain_port, is_issued_by_known_root, saved_hashes, nullptr, nullptr,
-      TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
+  EXPECT_EQ(
+      TransportSecurityState::PKPStatus::OK,
+      state.CheckPublicKeyPins(
+          domain_port, is_issued_by_known_root, saved_hashes, nullptr, nullptr,
+          TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
 
   // Add an HPKP header, which should only update the dynamic state.
   HashValue good_hash = GetTestHashValue(1, HASH_VALUE_SHA256);
   std::string good_pin = GetTestPin(1, HASH_VALUE_SHA256);
   std::string backup_pin = GetTestPin(2, HASH_VALUE_SHA256);
   std::string header = "max-age = 10000; " + good_pin + "; " + backup_pin;
 
   // Construct a fake SSLInfo that will pass AddHPKPHeader's checks.
   SSLInfo ssl_info;
   ssl_info.public_key_hashes.push_back(good_hash);
   ssl_info.public_key_hashes.push_back(saved_hashes[0]);
   EXPECT_TRUE(state.AddHPKPHeader(domain, header, ssl_info));
 
   EXPECT_TRUE(state.AddHPKPHeader(domain, header, ssl_info));
   // HSTS should still be configured for this domain.
   EXPECT_TRUE(sts_state.ShouldUpgradeToSSL());
   EXPECT_TRUE(state.ShouldUpgradeToSSL(domain));
   // The dynamic pins, which do not match |saved_hashes|, should take
   // precedence over the static pins and cause the check to fail.
-  EXPECT_FALSE(state.CheckPublicKeyPins(
-      domain_port, is_issued_by_known_root, saved_hashes, nullptr, nullptr,
-      TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
+  EXPECT_EQ(
+      TransportSecurityState::PKPStatus::VIOLATED,
+      state.CheckPublicKeyPins(
+          domain_port, is_issued_by_known_root, saved_hashes, nullptr, nullptr,
+          TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
 }
 
 // Tests that seeing an invalid HPKP header leaves the existing one alone.
 TEST_F(HttpSecurityHeadersTest, IgnoreInvalidHeaders) {
   TransportSecurityState state;
 
   HashValue good_hash = GetTestHashValue(1, HASH_VALUE_SHA256);
   std::string good_pin = GetTestPin(1, HASH_VALUE_SHA256);
   std::string bad_pin = GetTestPin(2, HASH_VALUE_SHA256);
   std::string backup_pin = GetTestPin(3, HASH_VALUE_SHA256);
 
   SSLInfo ssl_info;
   ssl_info.public_key_hashes.push_back(good_hash);
 
   // Add a valid HPKP header.
   EXPECT_TRUE(state.AddHPKPHeader(
       "example.com", "max-age = 10000; " + good_pin + "; " + backup_pin,
       ssl_info));
 
   // Check the insertion was valid.
   EXPECT_TRUE(state.HasPublicKeyPins("example.com"));
   std::string failure_log;
   bool is_issued_by_known_root = true;
   HostPortPair domain_port("example.com", 443);
-  EXPECT_TRUE(state.CheckPublicKeyPins(
-      domain_port, is_issued_by_known_root, ssl_info.public_key_hashes, nullptr,
-      nullptr, TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
+  EXPECT_EQ(TransportSecurityState::PKPStatus::OK,
+            state.CheckPublicKeyPins(
+                domain_port, is_issued_by_known_root,
+                ssl_info.public_key_hashes, nullptr, nullptr,
+                TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
 
   // Now assert an invalid one. This should fail.
   EXPECT_FALSE(state.AddHPKPHeader(
       "example.com", "max-age = 10000; " + bad_pin + "; " + backup_pin,
       ssl_info));
 
   // The old pins must still exist.
   EXPECT_TRUE(state.HasPublicKeyPins("example.com"));
-  EXPECT_TRUE(state.CheckPublicKeyPins(
-      domain_port, is_issued_by_known_root, ssl_info.public_key_hashes, nullptr,
-      nullptr, TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
+  EXPECT_EQ(TransportSecurityState::PKPStatus::OK,
+            state.CheckPublicKeyPins(
+                domain_port, is_issued_by_known_root,
+                ssl_info.public_key_hashes, nullptr, nullptr,
+                TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
 }
 
 };    // namespace net