Record UMA metrics for Must-Staple certificates on private roots

net/cert/x509_certificate_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <stdint.h>
 
 #include <memory>
 
@@ skipping 474 matching lines @@
   std::vector<base::StringPiece> crl_urls;
   EXPECT_TRUE(asn1::ExtractCRLURLsFromDERCert(derBytes, &crl_urls));
 
   EXPECT_EQ(1u, crl_urls.size());
   if (crl_urls.size() > 0) {
     EXPECT_EQ("http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl",
               crl_urls[0].as_string());
   }
 }
 
+TEST(X509CertificateTest, HasTLSFeatureExtension) {
+  base::FilePath certs_dir = GetTestCertsDirectory();
+  scoped_refptr<X509Certificate> cert =
+      ImportCertFromFile(certs_dir, "tls_feature_extension.pem");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get());
+
+  std::string derBytes;
+  EXPECT_TRUE(
+      X509Certificate::GetDEREncoded(cert->os_cert_handle(), &derBytes));
+
+  bool has_tls_feature_extension = true;
+  EXPECT_TRUE(
+      asn1::HasTLSFeatureExtension(derBytes, &has_tls_feature_extension));
+  EXPECT_TRUE(has_tls_feature_extension);
+}
+
+TEST(X509CertificateTest, DoesNotHaveTLSFeatureExtension) {
+  base::FilePath certs_dir = GetTestCertsDirectory();
+  scoped_refptr<X509Certificate> cert =
+      ImportCertFromFile(certs_dir, "ok_cert.pem");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), cert.get());
+
+  std::string derBytes;
+  EXPECT_TRUE(
+      X509Certificate::GetDEREncoded(cert->os_cert_handle(), &derBytes));
+
+  bool has_tls_feature_extension = true;
+  EXPECT_TRUE(
+      asn1::HasTLSFeatureExtension(derBytes, &has_tls_feature_extension));
+  EXPECT_FALSE(has_tls_feature_extension);
+}
+
 // Tests X509CertificateCache via X509Certificate::CreateFromHandle.  We
 // call X509Certificate::CreateFromHandle several times and observe whether
 // it returns a cached or new OSCertHandle.
 TEST(X509CertificateTest, Cache) {
   X509Certificate::OSCertHandle google_cert_handle;
   X509Certificate::OSCertHandle thawte_cert_handle;
 
   // Add a single certificate to the certificate cache.
   google_cert_handle = X509Certificate::CreateOSCertHandleFromBytes(
       reinterpret_cast<const char*>(google_der), sizeof(google_der));
@@ skipping 663 matching lines @@
                                     &actual_type);
 
   EXPECT_EQ(data.expected_bits, actual_bits);
   EXPECT_EQ(data.expected_type, actual_type);
 }
 
 INSTANTIATE_TEST_CASE_P(, X509CertificatePublicKeyInfoTest,
                         testing::ValuesIn(kPublicKeyInfoTestData));
 
 }  // namespace net