Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(153)

Side by Side Diff: net/http/transport_security_state_unittest.cc

Issue 2176183003: Revert of Enable Expect-Staple in SSLClientSocket. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@ocsp-reporting
Patch Set: Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « net/http/transport_security_state.cc ('k') | net/quic/quic_crypto_client_stream.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/http/transport_security_state.h" 5 #include "net/http/transport_security_state.h"
6 6
7 #include <algorithm> 7 #include <algorithm>
8 #include <string> 8 #include <string>
9 #include <vector> 9 #include <vector>
10 10
(...skipping 346 matching lines...) Expand 10 before | Expand all | Expand 10 after
357 } 357 }
358 358
359 static void EnableStaticPins(TransportSecurityState* state) { 359 static void EnableStaticPins(TransportSecurityState* state) {
360 state->enable_static_pins_ = true; 360 state->enable_static_pins_ = true;
361 } 361 }
362 362
363 static void EnableStaticExpectCT(TransportSecurityState* state) { 363 static void EnableStaticExpectCT(TransportSecurityState* state) {
364 state->enable_static_expect_ct_ = true; 364 state->enable_static_expect_ct_ = true;
365 } 365 }
366 366
367 static void SetEnableStaticExpectStaple(TransportSecurityState* state, 367 static void EnableStaticExpectStaple(TransportSecurityState* state) {
368 bool enabled) { 368 state->enable_static_expect_staple_ = true;
369 state->enable_static_expect_staple_ = enabled;
370 } 369 }
371 370
372 static HashValueVector GetSampleSPKIHashes() { 371 static HashValueVector GetSampleSPKIHashes() {
373 HashValueVector spki_hashes; 372 HashValueVector spki_hashes;
374 HashValue hash(HASH_VALUE_SHA256); 373 HashValue hash(HASH_VALUE_SHA256);
375 memset(hash.data(), 0, hash.size()); 374 memset(hash.data(), 0, hash.size());
376 spki_hashes.push_back(hash); 375 spki_hashes.push_back(hash);
377 return spki_hashes; 376 return spki_hashes;
378 } 377 }
379 378
(...skipping 1455 matching lines...) Expand 10 before | Expand all | Expand 10 after
1835 EXPECT_EQ(kExpectCTStaticHostname, expect_ct_state.domain); 1834 EXPECT_EQ(kExpectCTStaticHostname, expect_ct_state.domain);
1836 EXPECT_EQ(GURL(kExpectCTStaticReportURI), expect_ct_state.report_uri); 1835 EXPECT_EQ(GURL(kExpectCTStaticReportURI), expect_ct_state.report_uri);
1837 EXPECT_FALSE( 1836 EXPECT_FALSE(
1838 GetExpectCTState(&state, "pinning-test.badssl.com", &expect_ct_state)); 1837 GetExpectCTState(&state, "pinning-test.badssl.com", &expect_ct_state));
1839 } 1838 }
1840 1839
1841 // Tests that static (preloaded) expect staple state is read correctly. 1840 // Tests that static (preloaded) expect staple state is read correctly.
1842 TEST_F(TransportSecurityStateTest, PreloadedExpectStaple) { 1841 TEST_F(TransportSecurityStateTest, PreloadedExpectStaple) {
1843 TransportSecurityState state; 1842 TransportSecurityState state;
1844 TransportSecurityState::ExpectStapleState expect_staple_state; 1843 TransportSecurityState::ExpectStapleState expect_staple_state;
1845 TransportSecurityStateTest::SetEnableStaticExpectStaple(&state, false);
1846 EXPECT_FALSE(GetExpectStapleState(&state, kExpectStapleStaticHostname, 1844 EXPECT_FALSE(GetExpectStapleState(&state, kExpectStapleStaticHostname,
1847 &expect_staple_state)); 1845 &expect_staple_state));
1848 TransportSecurityStateTest::SetEnableStaticExpectStaple(&state, true); 1846 TransportSecurityStateTest::EnableStaticExpectStaple(&state);
1849 EXPECT_TRUE(GetExpectStapleState(&state, kExpectStapleStaticHostname, 1847 EXPECT_TRUE(GetExpectStapleState(&state, kExpectStapleStaticHostname,
1850 &expect_staple_state)); 1848 &expect_staple_state));
1851 EXPECT_EQ(kExpectStapleStaticHostname, expect_staple_state.domain); 1849 EXPECT_EQ(kExpectStapleStaticHostname, expect_staple_state.domain);
1852 EXPECT_EQ(GURL(kExpectStapleStaticReportURI), expect_staple_state.report_uri); 1850 EXPECT_EQ(GURL(kExpectStapleStaticReportURI), expect_staple_state.report_uri);
1853 EXPECT_FALSE(expect_staple_state.include_subdomains); 1851 EXPECT_FALSE(expect_staple_state.include_subdomains);
1854 EXPECT_FALSE(GetExpectStapleState(&state, "pinning-test.badssl.com", 1852 EXPECT_FALSE(GetExpectStapleState(&state, "pinning-test.badssl.com",
1855 &expect_staple_state)); 1853 &expect_staple_state));
1856 std::string subdomain = "subdomain."; 1854 std::string subdomain = "subdomain.";
1857 subdomain += kExpectStapleStaticHostname; 1855 subdomain += kExpectStapleStaticHostname;
1858 EXPECT_FALSE(GetExpectStapleState(&state, subdomain, &expect_staple_state)); 1856 EXPECT_FALSE(GetExpectStapleState(&state, subdomain, &expect_staple_state));
1859 } 1857 }
1860 1858
1861 TEST_F(TransportSecurityStateTest, PreloadedExpectStapleIncludeSubdomains) { 1859 TEST_F(TransportSecurityStateTest, PreloadedExpectStapleIncludeSubdomains) {
1862 TransportSecurityState state; 1860 TransportSecurityState state;
1863 TransportSecurityStateTest::SetEnableStaticExpectStaple(&state, true); 1861 TransportSecurityStateTest::EnableStaticExpectStaple(&state);
1864 TransportSecurityState::ExpectStapleState expect_staple_state; 1862 TransportSecurityState::ExpectStapleState expect_staple_state;
1865 std::string subdomain = "subdomain."; 1863 std::string subdomain = "subdomain.";
1866 subdomain += kExpectStapleStaticIncludeSubdomainsHostname; 1864 subdomain += kExpectStapleStaticIncludeSubdomainsHostname;
1867 EXPECT_TRUE(GetExpectStapleState(&state, subdomain, &expect_staple_state)); 1865 EXPECT_TRUE(GetExpectStapleState(&state, subdomain, &expect_staple_state));
1868 EXPECT_EQ(kExpectStapleStaticIncludeSubdomainsHostname, 1866 EXPECT_EQ(kExpectStapleStaticIncludeSubdomainsHostname,
1869 expect_staple_state.domain); 1867 expect_staple_state.domain);
1870 EXPECT_TRUE(expect_staple_state.include_subdomains); 1868 EXPECT_TRUE(expect_staple_state.include_subdomains);
1871 EXPECT_EQ(GURL(kExpectStapleStaticReportURI), expect_staple_state.report_uri); 1869 EXPECT_EQ(GURL(kExpectStapleStaticReportURI), expect_staple_state.report_uri);
1872 } 1870 }
1873 1871
(...skipping 149 matching lines...) Expand 10 before | Expand all | Expand 10 after
2023 2021
2024 class ExpectStapleErrorResponseTest 2022 class ExpectStapleErrorResponseTest
2025 : public TransportSecurityStateTest, 2023 : public TransportSecurityStateTest,
2026 public testing::WithParamInterface<ExpectStapleErrorResponseData> {}; 2024 public testing::WithParamInterface<ExpectStapleErrorResponseData> {};
2027 2025
2028 // For every |response_status| indicating an OCSP response was provided, but had 2026 // For every |response_status| indicating an OCSP response was provided, but had
2029 // some sort of parsing/validation error, test that the ExpectStaple report is 2027 // some sort of parsing/validation error, test that the ExpectStaple report is
2030 // serialized correctly. 2028 // serialized correctly.
2031 TEST_P(ExpectStapleErrorResponseTest, CheckResponseStatusSerialization) { 2029 TEST_P(ExpectStapleErrorResponseTest, CheckResponseStatusSerialization) {
2032 TransportSecurityState state; 2030 TransportSecurityState state;
2033 TransportSecurityStateTest::SetEnableStaticExpectStaple(&state, true); 2031 TransportSecurityStateTest::EnableStaticExpectStaple(&state);
2034 MockCertificateReportSender reporter; 2032 MockCertificateReportSender reporter;
2035 ExpectStapleErrorResponseData test = GetParam(); 2033 ExpectStapleErrorResponseData test = GetParam();
2036 2034
2037 std::string ocsp_response; 2035 std::string ocsp_response;
2038 if (test.response_status != OCSPVerifyResult::MISSING) 2036 if (test.response_status != OCSPVerifyResult::MISSING)
2039 ocsp_response = "dummy_response"; 2037 ocsp_response = "dummy_response";
2040 2038
2041 // Two dummy certs to use as the server-sent and validated chains. The 2039 // Two dummy certs to use as the server-sent and validated chains. The
2042 // contents don't matter. 2040 // contents don't matter.
2043 scoped_refptr<X509Certificate> cert1 = 2041 scoped_refptr<X509Certificate> cert1 =
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after
2078 2076
2079 class ExpectStapleErrorCertStatusTest 2077 class ExpectStapleErrorCertStatusTest
2080 : public TransportSecurityStateTest, 2078 : public TransportSecurityStateTest,
2081 public testing::WithParamInterface<ExpectStapleErrorCertStatusData> {}; 2079 public testing::WithParamInterface<ExpectStapleErrorCertStatusData> {};
2082 2080
2083 // Test that |revocation_status| is serialized into the |cert-status| field of 2081 // Test that |revocation_status| is serialized into the |cert-status| field of
2084 // the Expect-Staple report whenever |response_status| is PROVIDED and 2082 // the Expect-Staple report whenever |response_status| is PROVIDED and
2085 // |revocation_status| != GOOD. 2083 // |revocation_status| != GOOD.
2086 TEST_P(ExpectStapleErrorCertStatusTest, CheckCertStatusSerialization) { 2084 TEST_P(ExpectStapleErrorCertStatusTest, CheckCertStatusSerialization) {
2087 TransportSecurityState state; 2085 TransportSecurityState state;
2088 TransportSecurityStateTest::SetEnableStaticExpectStaple(&state, true); 2086 TransportSecurityStateTest::EnableStaticExpectStaple(&state);
2089 MockCertificateReportSender reporter; 2087 MockCertificateReportSender reporter;
2090 ExpectStapleErrorCertStatusData test = GetParam(); 2088 ExpectStapleErrorCertStatusData test = GetParam();
2091 std::string ocsp_response = "dummy_response"; 2089 std::string ocsp_response = "dummy_response";
2092 2090
2093 // Two dummy certs to use as the server-sent and validated chains. The 2091 // Two dummy certs to use as the server-sent and validated chains. The
2094 // contents don't matter. 2092 // contents don't matter.
2095 scoped_refptr<X509Certificate> cert1 = 2093 scoped_refptr<X509Certificate> cert1 =
2096 ImportCertFromFile(GetTestCertsDirectory(), "test_mail_google_com.pem"); 2094 ImportCertFromFile(GetTestCertsDirectory(), "test_mail_google_com.pem");
2097 scoped_refptr<X509Certificate> cert2 = 2095 scoped_refptr<X509Certificate> cert2 =
2098 ImportCertFromFile(GetTestCertsDirectory(), "expired_cert.pem"); 2096 ImportCertFromFile(GetTestCertsDirectory(), "expired_cert.pem");
(...skipping 19 matching lines...) Expand all
2118 ocsp_response, "PROVIDED", 2116 ocsp_response, "PROVIDED",
2119 test.cert_status_string)); 2117 test.cert_status_string));
2120 }; 2118 };
2121 2119
2122 INSTANTIATE_TEST_CASE_P(ExpectStaple, 2120 INSTANTIATE_TEST_CASE_P(ExpectStaple,
2123 ExpectStapleErrorCertStatusTest, 2121 ExpectStapleErrorCertStatusTest,
2124 testing::ValuesIn(kExpectStapleErrorCertStatusData)); 2122 testing::ValuesIn(kExpectStapleErrorCertStatusData));
2125 2123
2126 TEST_F(TransportSecurityStateTest, ExpectStapleDoesNotReportValidStaple) { 2124 TEST_F(TransportSecurityStateTest, ExpectStapleDoesNotReportValidStaple) {
2127 TransportSecurityState state; 2125 TransportSecurityState state;
2128 TransportSecurityStateTest::SetEnableStaticExpectStaple(&state, true); 2126 TransportSecurityStateTest::EnableStaticExpectStaple(&state);
2129 MockCertificateReportSender reporter; 2127 MockCertificateReportSender reporter;
2130 state.SetReportSender(&reporter); 2128 state.SetReportSender(&reporter);
2131 2129
2132 // Baked-in preloaded Expect-Staple test hosts. 2130 // Baked-in preloaded Expect-Staple test hosts.
2133 HostPortPair host_port(kExpectStapleStaticHostname, 443); 2131 HostPortPair host_port(kExpectStapleStaticHostname, 443);
2134 2132
2135 // Two dummy certs to use as the server-sent and validated chains. The 2133 // Two dummy certs to use as the server-sent and validated chains. The
2136 // contents don't matter. 2134 // contents don't matter.
2137 scoped_refptr<X509Certificate> cert1 = 2135 scoped_refptr<X509Certificate> cert1 =
2138 ImportCertFromFile(GetTestCertsDirectory(), "test_mail_google_com.pem"); 2136 ImportCertFromFile(GetTestCertsDirectory(), "test_mail_google_com.pem");
(...skipping 14 matching lines...) Expand all
2153 EXPECT_TRUE(reporter.latest_report().empty()); 2151 EXPECT_TRUE(reporter.latest_report().empty());
2154 2152
2155 ssl_info.is_issued_by_known_root = false; 2153 ssl_info.is_issued_by_known_root = false;
2156 state.CheckExpectStaple(host_port, ssl_info, ocsp_response); 2154 state.CheckExpectStaple(host_port, ssl_info, ocsp_response);
2157 EXPECT_EQ(GURL(), reporter.latest_report_uri()); 2155 EXPECT_EQ(GURL(), reporter.latest_report_uri());
2158 EXPECT_TRUE(reporter.latest_report().empty()); 2156 EXPECT_TRUE(reporter.latest_report().empty());
2159 } 2157 }
2160 2158
2161 TEST_F(TransportSecurityStateTest, ExpectStapleRequiresPreload) { 2159 TEST_F(TransportSecurityStateTest, ExpectStapleRequiresPreload) {
2162 TransportSecurityState state; 2160 TransportSecurityState state;
2163 TransportSecurityStateTest::SetEnableStaticExpectStaple(&state, true); 2161 TransportSecurityStateTest::EnableStaticExpectStaple(&state);
2164 MockCertificateReportSender reporter; 2162 MockCertificateReportSender reporter;
2165 state.SetReportSender(&reporter); 2163 state.SetReportSender(&reporter);
2166 2164
2167 HostPortPair host_port("not-preloaded.host.example", 443); 2165 HostPortPair host_port("not-preloaded.host.example", 443);
2168 2166
2169 // Two dummy certs to use as the server-sent and validated chains. The 2167 // Two dummy certs to use as the server-sent and validated chains. The
2170 // contents don't matter. 2168 // contents don't matter.
2171 scoped_refptr<X509Certificate> cert1 = 2169 scoped_refptr<X509Certificate> cert1 =
2172 ImportCertFromFile(GetTestCertsDirectory(), "test_mail_google_com.pem"); 2170 ImportCertFromFile(GetTestCertsDirectory(), "test_mail_google_com.pem");
2173 scoped_refptr<X509Certificate> cert2 = 2171 scoped_refptr<X509Certificate> cert2 =
(...skipping 145 matching lines...) Expand 10 before | Expand all | Expand 10 after
2319 base::FieldTrialList::CreateFieldTrial("EnforceCTForProblematicRoots", 2317 base::FieldTrialList::CreateFieldTrial("EnforceCTForProblematicRoots",
2320 "disabled"); 2318 "disabled");
2321 2319
2322 EXPECT_FALSE( 2320 EXPECT_FALSE(
2323 state.ShouldRequireCT("www.example.com", before_cert.get(), hashes)); 2321 state.ShouldRequireCT("www.example.com", before_cert.get(), hashes));
2324 EXPECT_FALSE( 2322 EXPECT_FALSE(
2325 state.ShouldRequireCT("www.example.com", after_cert.get(), hashes)); 2323 state.ShouldRequireCT("www.example.com", after_cert.get(), hashes));
2326 } 2324 }
2327 2325
2328 } // namespace net 2326 } // namespace net
OLDNEW
« no previous file with comments | « net/http/transport_security_state.cc ('k') | net/quic/quic_crypto_client_stream.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698