Store dynamic Expect-CT state

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
 #include "base/base64.h"
 #include "base/files/file_path.h"
 #include "base/json/json_reader.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/field_trial.h"
 #include "base/rand_util.h"
 #include "base/sha1.h"
 #include "base/strings/string_piece.h"
 #include "base/test/histogram_tester.h"
 #include "base/test/mock_entropy_provider.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/values.h"
 #include "crypto/openssl_util.h"
 #include "crypto/sha2.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/ct_policy_status.h"
@@ skipping 2562 matching lines @@
       base::MakeUnique<base::MockEntropyProvider>());
   base::FieldTrialList::CreateFieldTrial("EnforceCTForProblematicRoots",
                                          "disabled");
 
   EXPECT_FALSE(
       state.ShouldRequireCT("www.example.com", before_cert.get(), hashes));
   EXPECT_FALSE(
       state.ShouldRequireCT("www.example.com", after_cert.get(), hashes));
 }
 
+// Tests that dynamic Expect-CT state can be added and retrieved.
+TEST_F(TransportSecurityStateTest, DynamicExpectCTState) {
+  base::test::ScopedFeatureList feature_list;
+  feature_list.InitAndEnableFeature(
+      TransportSecurityState::kDynamicExpectCTFeature);
+  const std::string host("example.test");
+  TransportSecurityState state;
+  TransportSecurityState::ExpectCTState expect_ct_state;
+  const base::Time current_time = base::Time::Now();
+  const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
+
+  // Test that Expect-CT state can be added and retrieved.
+  state.AddExpectCT(host, expiry, true, GURL());
+  EXPECT_TRUE(state.GetDynamicExpectCTState(host, &expect_ct_state));
+  EXPECT_TRUE(expect_ct_state.enforce);
+  EXPECT_TRUE(expect_ct_state.report_uri.is_empty());
+  EXPECT_EQ(expiry, expect_ct_state.expiry);
+
+  // Test that Expect-CT can be updated (e.g. by changing |enforce| to false and
+  // adding a report-uri).
+  const GURL report_uri("https://example-report.test");
+  state.AddExpectCT(host, expiry, false, report_uri);
+  EXPECT_TRUE(state.GetDynamicExpectCTState(host, &expect_ct_state));
+  EXPECT_FALSE(expect_ct_state.enforce);
+  EXPECT_EQ(report_uri, expect_ct_state.report_uri);
+  EXPECT_EQ(expiry, expect_ct_state.expiry);
+
+  // Test that Expect-CT state is discarded when expired.
+  state.AddExpectCT(host, current_time - base::TimeDelta::FromSeconds(1000),
+                    true, report_uri);
+  EXPECT_FALSE(state.GetDynamicExpectCTState(host, &expect_ct_state));
+}
+
+// Tests that dynamic Expect-CT state cannot be added when the feature is not
+// enabled.
+TEST_F(TransportSecurityStateTest, DynamicExpectCTStateDisabled) {
+  base::test::ScopedFeatureList feature_list;
+  feature_list.InitAndDisableFeature(
+      TransportSecurityState::kDynamicExpectCTFeature);
+  const std::string host("example.test");
+  TransportSecurityState state;
+  TransportSecurityState::ExpectCTState expect_ct_state;
+  const base::Time current_time = base::Time::Now();
+  const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
+
+  state.AddExpectCT(host, expiry, true, GURL());
+  EXPECT_FALSE(state.GetDynamicExpectCTState(host, &expect_ct_state));
+}
+
 }  // namespace net