Add --ignore-certificate-errors-spki-list switch and UMA histogram.

chrome/browser/ssl/ignore_errors_cert_verifier_unittest.cc

+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ssl/ignore_errors_cert_verifier.h"
+
+#include "base/files/file_path.h"
+#include "base/memory/ptr_util.h"
+#include "base/memory/ref_counted.h"
+#include "net/base/net_errors.h"
+#include "net/base/test_completion_callback.h"
+#include "net/cert/mock_cert_verifier.h"
+#include "net/cert/x509_certificate.h"
+#include "net/log/net_log_with_source.h"
+#include "net/test/cert_test_util.h"
+#include "net/test/gtest_util.h"
+#include "net/test/test_data_directory.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using net::CertVerifier;
+using net::MockCertVerifier;
+using net::CompletionCallback;
+using net::HashValue;
+using net::SHA256HashValue;
+using net::SHA256HashValueLessThan;
+using net::X509Certificate;
+using net::TestCompletionCallback;
+using net::CertVerifyResult;
+using net::NetLogWithSource;
+
+using net::ERR_CERT_INVALID;
+using net::ERR_IO_PENDING;
+using net::OK;
+
+using net::test::IsError;
+using net::test::IsOk;
+
+static IgnoreErrorsCertVerifier::SPKIHashSet MakeWhitelist() {
+  std::vector<std::string> fingerprints{
+      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", "foobar",
+      // SPKI fingerprint of the intermediate from
+      // x509_verify_results.chain.pem:
+      "MtnqgdSwAIgEjse7SpxnmyKoo/RTiL9CDIWwFnz4nas=",

[Ryan Sleevi, 2017/04/12 21:53:17]

It'd be better if this was dynamically computed. x509_verify_results.chain.pem
is an auto-generated file, so any time it's regenerated, this would have to be
updated (if baked in). Having it dynamically computed doesn't seem to undermine
the system under test, but I'm curious your thoughts.

[martinkr, 2017/04/24 23:54:25]

IMHO it seems a little silly, since I essentially duplicate the SUT into the
test to compute the expected value. But to be totally honest, I originally just
printed the string and copied the test, so it's not too different I guess.
¯\_(ツ)_/¯

Done.

+      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB="};
+  return IgnoreErrorsCertVerifier::MakeWhitelist(fingerprints);
+}
+
+class IgnoreErrorsCertVerifierTest : public ::testing::Test {
+ public:
+  IgnoreErrorsCertVerifierTest()
+      : mock_verifier_(new MockCertVerifier()),
+        verifier_(base::WrapUnique(mock_verifier_), MakeWhitelist()) {}
+  ~IgnoreErrorsCertVerifierTest() override {}
+
+ protected:
+  // The wrapped CertVerifier. Defaults to returning ERR_CERT_INVALID. Owned by
+  // verifier_.
+  MockCertVerifier* mock_verifier_;
+  IgnoreErrorsCertVerifier verifier_;
+};
+
+static scoped_refptr<X509Certificate> GetNonWhitelistedTestCert() {
+  base::FilePath certs_dir = net::GetTestCertsDirectory();
+  scoped_refptr<X509Certificate> test_cert(
+      net::ImportCertFromFile(certs_dir, "ok_cert.pem"));
+  CHECK(test_cert);

[Ryan Sleevi, 2017/04/12 21:53:17]

This is a unit test, so we shouldn't CHECK() for any of these (which brings down
the whole framework), but using the unit test macros (ASSERT_ and friends). This
does require using void returns (since ASSERT_ is just a quick return) along
with
https://github.com/google/googletest/blob/master/googletest/docs/AdvancedGuid...

[martinkr, 2017/04/24 23:54:26]

Done.

+  return test_cert;
+}
+
+static CertVerifier::RequestParams MakeRequestParams(
+    const scoped_refptr<X509Certificate>& cert) {
+  return CertVerifier::RequestParams(cert, "example.com", 0, "",
+                                     net::CertificateList());
+}
+
+static scoped_refptr<X509Certificate> GetWhitelistedTestCert() {
+  base::FilePath certs_dir = net::GetTestCertsDirectory();
+  net::CertificateList certs = net::CreateCertificateListFromFile(
+      certs_dir, "x509_verify_results.chain.pem", X509Certificate::FORMAT_AUTO);
+  CHECK_EQ(3U, certs.size());

[Ryan Sleevi, 2017/04/12 21:53:17]

ditto re: CHECK

[martinkr, 2017/04/24 23:54:26]

Done.

+  X509Certificate::OSCertHandles intermediates;
+  intermediates.push_back(certs[1]->os_cert_handle());
+  intermediates.push_back(certs[2]->os_cert_handle());
+  scoped_refptr<X509Certificate> cert_chain = X509Certificate::CreateFromHandle(
+      certs[0]->os_cert_handle(), intermediates);
+  CHECK(cert_chain);
+  CHECK_EQ(2U, cert_chain->GetIntermediateCertificates().size());

[Ryan Sleevi, 2017/04/12 21:53:17]

ditto re: CHECK

[martinkr, 2017/04/24 23:54:26]

Done.

+  return cert_chain;
+}
+
+TEST_F(IgnoreErrorsCertVerifierTest, TestNoMatchCertOk) {
+  mock_verifier_->set_default_result(OK);
+
+  scoped_refptr<X509Certificate> test_cert = GetNonWhitelistedTestCert();
+  CertVerifyResult verify_result;
+  TestCompletionCallback callback;
+  std::unique_ptr<CertVerifier::Request> request;
+
+  EXPECT_THAT(callback.GetResult(verifier_.Verify(
+                  MakeRequestParams(test_cert), nullptr, &verify_result,
+                  callback.callback(), &request, NetLogWithSource())),
+              IsOk());
+}
+
+TEST_F(IgnoreErrorsCertVerifierTest, TestNoMatchCertError) {
+  scoped_refptr<X509Certificate> test_cert = GetNonWhitelistedTestCert();
+  CertVerifyResult verify_result;
+  TestCompletionCallback callback;
+  std::unique_ptr<CertVerifier::Request> request;
+
+  EXPECT_THAT(callback.GetResult(verifier_.Verify(
+                  MakeRequestParams(test_cert), nullptr, &verify_result,
+                  callback.callback(), &request, NetLogWithSource())),
+              IsError(ERR_CERT_INVALID));
+}
+
+TEST_F(IgnoreErrorsCertVerifierTest, TestNoMatchCertErrorCallback) {
+  mock_verifier_->set_async(true);
+
+  scoped_refptr<X509Certificate> test_cert = GetNonWhitelistedTestCert();
+  CertVerifyResult verify_result;
+  TestCompletionCallback callback;
+  std::unique_ptr<CertVerifier::Request> request;
+
+  EXPECT_THAT(
+      verifier_.Verify(MakeRequestParams(test_cert), nullptr, &verify_result,
+                       callback.callback(), &request, NetLogWithSource()),
+      IsError(ERR_IO_PENDING));
+  EXPECT_THAT(callback.WaitForResult(), IsError(ERR_CERT_INVALID));
+}
+
+TEST_F(IgnoreErrorsCertVerifierTest, TestMatch) {
+  scoped_refptr<X509Certificate> test_cert = GetWhitelistedTestCert();
+  CertVerifyResult verify_result;
+  TestCompletionCallback callback;
+  std::unique_ptr<CertVerifier::Request> request;
+
+  EXPECT_THAT(callback.GetResult(verifier_.Verify(
+                  MakeRequestParams(test_cert), nullptr, &verify_result,
+                  callback.callback(), &request, NetLogWithSource())),
+              IsOk());
+}
+
+TEST_F(IgnoreErrorsCertVerifierTest, TestMatchCallback) {
+  mock_verifier_->set_async(true);
+
+  scoped_refptr<X509Certificate> test_cert = GetWhitelistedTestCert();
+  CertVerifyResult verify_result;
+  TestCompletionCallback callback;
+  std::unique_ptr<CertVerifier::Request> request;
+
+  EXPECT_THAT(
+      verifier_.Verify(MakeRequestParams(test_cert), nullptr, &verify_result,
+                       callback.callback(), &request, NetLogWithSource()),
+      IsError(ERR_IO_PENDING));
+  EXPECT_THAT(callback.WaitForResult(), IsOk());
+}