Add initial version of captive portal list checking.

chrome/browser/ssl/ssl_error_handler_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/ssl_error_handler.h"
 
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/field_trial.h"
 #include "base/run_loop.h"
 #include "base/test/histogram_tester.h"
 #include "base/test/simple_test_clock.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "base/time/time.h"
 #include "chrome/browser/captive_portal/captive_portal_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ssl/common_name_mismatch_handler.h"
+#include "chrome/browser/ssl/tls_error_assistant.pb.h"
 #include "chrome/common/features.h"
 #include "chrome/test/base/chrome_render_view_host_test_harness.h"
 #include "chrome/test/base/testing_profile.h"
 #include "components/captive_portal/captive_portal_testing_utils.h"
 #include "components/network_time/network_time_test_utils.h"
 #include "components/network_time/network_time_tracker.h"
 #include "components/prefs/testing_pref_service.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/notification_service.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/x509_certificate.h"
 #include "net/http/http_response_headers.h"
 #include "net/ssl/ssl_info.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/test/test_certificate_data.h"
 #include "net/test/test_data_directory.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace {
 
 const char kCertDateErrorHistogram[] =
     "interstitial.ssl_error_handler.cert_date_error_delay";
 
+const net::SHA256HashValue kCertPublicKeyHashValue = {{0x01, 0x02}};
+
 }  // namespace
 
 class SSLErrorHandlerForTest : public SSLErrorHandler {
  public:
   SSLErrorHandlerForTest(Profile* profile,
                          content::WebContents* web_contents,
                          const net::SSLInfo& ssl_info)
       : SSLErrorHandler(
             web_contents,
             net::MapCertStatusToNetError(ssl_info.cert_status),
@@ skipping 108 matching lines @@
 class SSLErrorHandlerNameMismatchTest : public ChromeRenderViewHostTestHarness {
  public:
   SSLErrorHandlerNameMismatchTest() : field_trial_list_(nullptr) {}
 
   void SetUp() override {
     ChromeRenderViewHostTestHarness::SetUp();
     SSLErrorHandler::SetInterstitialDelayForTesting(base::TimeDelta());
     ssl_info_.cert =
         net::ImportCertFromFile(net::GetTestCertsDirectory(), "ok_cert.pem");
     ssl_info_.cert_status = net::CERT_STATUS_COMMON_NAME_INVALID;
+    ssl_info_.public_key_hashes.push_back(
+        net::HashValue(kCertPublicKeyHashValue));
     error_handler_.reset(
         new SSLErrorHandlerForTest(profile(), web_contents(), ssl_info_));
     // Enable finch experiment for captive portal interstitials.
     ASSERT_TRUE(base::FieldTrialList::CreateFieldTrial(
                     "CaptivePortalInterstitial", "Enabled"));
     // Enable finch experiment for SSL common name mismatch handling.
     ASSERT_TRUE(base::FieldTrialList::CreateFieldTrial(
                     "SSLCommonNameMismatchHandling", "Enabled"));
   }
 
   void TearDown() override {
     EXPECT_FALSE(error_handler()->IsTimerRunning());
     error_handler_.reset(nullptr);
     ChromeRenderViewHostTestHarness::TearDown();
   }
 
   SSLErrorHandlerForTest* error_handler() { return error_handler_.get(); }
 
+  const net::SSLInfo& ssl_info() { return ssl_info_; }
+
  private:
   net::SSLInfo ssl_info_;
   std::unique_ptr<SSLErrorHandlerForTest> error_handler_;
   base::FieldTrialList field_trial_list_;
 
   DISALLOW_COPY_AND_ASSIGN(SSLErrorHandlerNameMismatchTest);
 };
 
 class SSLErrorHandlerDateInvalidTest : public ChromeRenderViewHostTestHarness {
  public:
@@ skipping 340 matching lines @@
   // Check that the histogram for the delay was recorded.
   histograms.ExpectTotalCount(kCertDateErrorHistogram, 1);
 
   // Clear the error handler to test that, when the request completes,
   // it doesn't try to call a callback on a deleted SSLErrorHandler.
   ClearErrorHandler();
 
   // Shut down the server to cancel the pending request.
   ASSERT_TRUE(test_server()->ShutdownAndWaitUntilComplete());
 }
+
+TEST_F(SSLErrorHandlerNameMismatchTest, KnownCaptivePortal) {
+  base::HistogramTester histograms;
+
+  EXPECT_FALSE(error_handler()->IsTimerRunning());
+  EXPECT_EQ(1u, ssl_info().public_key_hashes.size());

[estark, 2017/01/12 18:54:44]

nit: might want to add a test case for when there's more than one
public_key_hash

[meacer, 2017/01/20 21:30:00]

Changed this test to use multiple hashes.

+
+  chrome_browser_ssl::TLSErrorAssistantConfig config_proto;
+  config_proto.add_captive_portal_cert()->set_sha256_hash(
+      ssl_info().public_key_hashes[0].ToString());
+  SSLErrorHandler::SetErrorAssistantProtoForTesting(config_proto);
+
+  error_handler()->StartHandlingError();
+
+  // Timer shouldn't start for a known captive portal certificate.
+  EXPECT_FALSE(error_handler()->IsTimerRunning());
+  EXPECT_FALSE(error_handler()->captive_portal_checked());
+  EXPECT_FALSE(error_handler()->ssl_interstitial_shown());
+  EXPECT_TRUE(error_handler()->captive_portal_interstitial_shown());
+
+  base::RunLoop().RunUntilIdle();

[estark, 2017/01/12 18:54:43]

This is a little confusing, why do we run the run loop and then check the same
assertions again? (Maybe add a comment?)

[meacer, 2017/01/12 23:54:03]

This is in case SSLErrorHandler incorrectly starts a timer, in which case we'll
want to wait until the end.

[meacer, 2017/01/20 21:30:00]

Added a comment.

+
+  EXPECT_FALSE(error_handler()->IsTimerRunning());
+  EXPECT_FALSE(error_handler()->captive_portal_checked());
+  EXPECT_FALSE(error_handler()->ssl_interstitial_shown());
+  EXPECT_TRUE(error_handler()->captive_portal_interstitial_shown());
+
+  // Check that the histogram for the captive portal cert was recorded.
+  histograms.ExpectBucketCount(SSLErrorHandler::GetHistogramNameForTesting(),
+                               SSLErrorHandler::HANDLE_ALL, 1);
+  histograms.ExpectBucketCount(SSLErrorHandler::GetHistogramNameForTesting(),
+                               SSLErrorHandler::CAPTIVE_PORTAL_CERT_FOUND, 1);
+}