Introduce the ability to require CT for specific hosts

net/spdy/spdy_session_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_session.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/base64.h"
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/run_loop.h"
 #include "base/test/histogram_tester.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/io_buffer.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/proxy_delegate.h"
 #include "net/base/request_priority.h"
 #include "net/base/test_data_stream.h"
 #include "net/base/test_proxy_delegate.h"
+#include "net/cert/ct_policy_status.h"
 #include "net/log/test_net_log.h"
 #include "net/log/test_net_log_entry.h"
 #include "net/log/test_net_log_util.h"
 #include "net/proxy/proxy_server.h"
 #include "net/socket/client_socket_pool_manager.h"
 #include "net/socket/next_proto.h"
 #include "net/socket/socket_test_util.h"
 #include "net/spdy/spdy_http_utils.h"
 #include "net/spdy/spdy_session_pool.h"
 #include "net/spdy/spdy_session_test_util.h"
 #include "net/spdy/spdy_stream.h"
 #include "net/spdy/spdy_stream_test_util.h"
 #include "net/spdy/spdy_test_util_common.h"
 #include "net/spdy/spdy_test_utils.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/test_data_directory.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/platform_test.h"
 
 namespace net {
 
 namespace {
 
 enum TestCase {
   // Test using the SPDY/3.1 protocol.
   kTestCaseSPDY31,
 
@@ skipping 23 matching lines @@
 base::TimeTicks SlowReads() {
   g_time_delta +=
       base::TimeDelta::FromMilliseconds(2 * kYieldAfterDurationMilliseconds);
   return base::TimeTicks::Now() + g_time_delta;
 }
 
 base::TimeTicks InstantaneousReads() {
   return g_time_now;
 }
 
+class MockRequireCTDelegate : public TransportSecurityState::RequireCTDelegate {
+ public:
+  MOCK_METHOD1(IsCTRequiredForHost,
+               CTRequirementLevel(const std::string& host));
+};
+
 }  // namespace
 
 class SpdySessionTest : public PlatformTest,
                         public ::testing::WithParamInterface<TestCase> {
  public:
   // Functions used with RunResumeAfterUnstallTest().
 
   void StallSessionOnly(SpdyStream* stream) { StallSessionSend(); }
 
   void StallStreamOnly(SpdyStream* stream) { StallStreamSend(stream); }
@@ skipping 5638 matching lines @@
   SSLInfo ssl_info;
   ssl_info.cert = ImportCertFromFile(GetTestCertsDirectory(),
                                      "spdy_pooling.pem");
   ssl_info.is_issued_by_known_root = true;
   ssl_info.public_key_hashes.push_back(test::GetTestHashValue(bad_pin));
 
   EXPECT_FALSE(SpdySession::CanPool(
       &tss, ssl_info, "www.example.org", "mail.example.org"));
 }
 
+TEST(CanPoolTest, CanNotPoolWithBadCTWhenCTRequired) {
+  using testing::_;
+  using testing::Return;
+  using CTRequirementLevel =
+      TransportSecurityState::RequireCTDelegate::CTRequirementLevel;
+
+  SSLInfo ssl_info;
+  ssl_info.cert =
+      ImportCertFromFile(GetTestCertsDirectory(), "spdy_pooling.pem");
+  ssl_info.is_issued_by_known_root = true;
+  ssl_info.public_key_hashes.push_back(test::GetTestHashValue(1));
+  ssl_info.ct_cert_policy_compliance =
+      ct::CertPolicyCompliance::CERT_POLICY_NOT_ENOUGH_SCTS;
+
+  MockRequireCTDelegate require_ct_delegate;
+  EXPECT_CALL(require_ct_delegate, IsCTRequiredForHost("www.example.org"))
+      .WillRepeatedly(Return(CTRequirementLevel::NOT_REQUIRED));

[davidben, 2016/06/23 19:51:43]

Only mail.example.org is queried, right?

[Ryan Sleevi, 2016/06/23 21:38:31]

Correct, but nothing in the interface contract of SpdySession::CanPool states
that, so I instead am treating it as a blackbox and testing the observables.

+  EXPECT_CALL(require_ct_delegate, IsCTRequiredForHost("mail.example.org"))
+      .WillRepeatedly(Return(CTRequirementLevel::REQUIRED));
+
+  TransportSecurityState tss;
+  tss.SetRequireCTDelegate(&require_ct_delegate);
+
+  EXPECT_FALSE(SpdySession::CanPool(&tss, ssl_info, "www.example.org",
+                                    "mail.example.org"));
+}
+
+TEST(CanPoolTest, CanPoolWithBadCTWhenCTNotRequired) {
+  using testing::_;
+  using testing::Return;
+  using CTRequirementLevel =
+      TransportSecurityState::RequireCTDelegate::CTRequirementLevel;
+
+  SSLInfo ssl_info;
+  ssl_info.cert =
+      ImportCertFromFile(GetTestCertsDirectory(), "spdy_pooling.pem");
+  ssl_info.is_issued_by_known_root = true;
+  ssl_info.public_key_hashes.push_back(test::GetTestHashValue(1));
+  ssl_info.ct_cert_policy_compliance =
+      ct::CertPolicyCompliance::CERT_POLICY_NOT_ENOUGH_SCTS;
+
+  MockRequireCTDelegate require_ct_delegate;
+  EXPECT_CALL(require_ct_delegate, IsCTRequiredForHost("www.example.org"))
+      .WillRepeatedly(Return(CTRequirementLevel::NOT_REQUIRED));

[davidben, 2016/06/23 19:51:43]

Ditto.

+  EXPECT_CALL(require_ct_delegate, IsCTRequiredForHost("mail.example.org"))
+      .WillRepeatedly(Return(CTRequirementLevel::NOT_REQUIRED));
+
+  TransportSecurityState tss;
+  tss.SetRequireCTDelegate(&require_ct_delegate);
+
+  EXPECT_TRUE(SpdySession::CanPool(&tss, ssl_info, "www.example.org",
+                                   "mail.example.org"));
+}
+
+TEST(CanPoolTest, CanPoolWithGoodCTWhenCTRequired) {
+  using testing::_;
+  using testing::Return;
+  using CTRequirementLevel =
+      TransportSecurityState::RequireCTDelegate::CTRequirementLevel;
+
+  SSLInfo ssl_info;
+  ssl_info.cert =
+      ImportCertFromFile(GetTestCertsDirectory(), "spdy_pooling.pem");
+  ssl_info.is_issued_by_known_root = true;
+  ssl_info.public_key_hashes.push_back(test::GetTestHashValue(1));
+  ssl_info.ct_cert_policy_compliance =
+      ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS;
+
+  MockRequireCTDelegate require_ct_delegate;
+  EXPECT_CALL(require_ct_delegate, IsCTRequiredForHost("www.example.org"))
+      .WillRepeatedly(Return(CTRequirementLevel::NOT_REQUIRED));

[davidben, 2016/06/23 19:51:43]

Ditto.

+  EXPECT_CALL(require_ct_delegate, IsCTRequiredForHost("mail.example.org"))
+      .WillRepeatedly(Return(CTRequirementLevel::REQUIRED));
+
+  TransportSecurityState tss;
+  tss.SetRequireCTDelegate(&require_ct_delegate);
+
+  EXPECT_TRUE(SpdySession::CanPool(&tss, ssl_info, "www.example.org",
+                                   "mail.example.org"));
+}
+
 TEST(CanPoolTest, CanPoolWithAcceptablePins) {
   uint8_t primary_pin = 1;
   uint8_t backup_pin = 2;
   TransportSecurityState tss;
   test::AddPin(&tss, "mail.example.org", primary_pin, backup_pin);
 
   SSLInfo ssl_info;
   ssl_info.cert = ImportCertFromFile(GetTestCertsDirectory(),
                                      "spdy_pooling.pem");
   ssl_info.is_issued_by_known_root = true;
   ssl_info.public_key_hashes.push_back(test::GetTestHashValue(primary_pin));
 
   EXPECT_TRUE(SpdySession::CanPool(
       &tss, ssl_info, "www.example.org", "mail.example.org"));
 }
 
 }  // namespace net