Add a build flag to configure bundling of HSTS preload list

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 15 matching lines @@
 #include "net/base/test_completion_callback.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/ct_policy_status.h"
 #include "net/cert/test_root_certs.h"
 #include "net/cert/x509_cert_types.h"
 #include "net/cert/x509_certificate.h"
 #include "net/http/http_status_code.h"
 #include "net/http/http_util.h"
+#include "net/net_features.h"
 #include "net/ssl/ssl_info.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/test_data_directory.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
 
 namespace {
 
+namespace test0 {
+#include "net/http/transport_security_state_static_unittest0.h"
+}
+
 namespace test1 {
 #include "net/http/transport_security_state_static_unittest1.h"
 }
 namespace test2 {
 #include "net/http/transport_security_state_static_unittest2.h"
 }
 namespace test3 {
 #include "net/http/transport_security_state_static_unittest3.h"
 }
 
@@ skipping 335 matching lines @@
   std::string serialized_report = reporter->latest_report();
   EXPECT_NO_FATAL_FAILURE(CheckSerializedExpectStapleReport(
       serialized_report, host_port, ssl_info, ocsp_response, response_status,
       cert_status));
 }
 
 }  // namespace
 
 class TransportSecurityStateTest : public testing::Test {
  public:
+  TransportSecurityStateTest() {
+    old_transport_security_state_source_ =
+        GetTransportSecurityStateSourceForTesting();
+#if !BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST)
+    SetTransportSecurityStateSourceForTesting(&test0::kHSTSSource);
+#endif
+  }
+
   ~TransportSecurityStateTest() override {
-    SetTransportSecurityStateSourceForTesting(nullptr);
+    SetTransportSecurityStateSourceForTesting(
+        old_transport_security_state_source_);
   }
 
   void SetUp() override {
     crypto::EnsureOpenSSLInit();
   }
 
   static void DisableStaticPins(TransportSecurityState* state) {
     state->enable_static_pins_ = false;
   }
 
@@ skipping 36 matching lines @@
                         const std::string& host,
                         TransportSecurityState::ExpectCTState* result) {
     return state->GetStaticExpectCTState(host, result);
   }
 
   bool GetExpectStapleState(TransportSecurityState* state,
                             const std::string& host,
                             TransportSecurityState::ExpectStapleState* result) {
     return state->GetStaticExpectStapleState(host, result);
   }
+
+ private:
+  const TransportSecurityStateSource* old_transport_security_state_source_;
 };
 
 TEST_F(TransportSecurityStateTest, DomainNameOddities) {
   TransportSecurityState state;
   const base::Time current_time(base::Time::Now());
   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
 
   // DNS suffix search tests. Some DNS resolvers allow a terminal "." to
   // indicate not perform DNS suffix searching. Ensure that regardless
   // of how this is treated at the resolver layer, or at the URL/origin
@@ skipping 880 matching lines @@
 static bool AddHash(const std::string& type_and_base64,
                     HashValueVector* out) {
   HashValue hash;
   if (!hash.FromString(type_and_base64))
     return false;
 
   out->push_back(hash);
   return true;
 }
 
-TEST_F(TransportSecurityStateTest, PinValidationWithoutRejectedCerts) {
+// This test depends on the pinset of tor.
+#if !BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST)
+#define MAYBE_PinValidationWithoutRejectedCerts \
+  DISABLED_PinValidationWithoutRejectedCerts
+#else
+#define MAYBE_PinValidationWithoutRejectedCerts \
+  PinValidationWithoutRejectedCerts
+#endif
+TEST_F(TransportSecurityStateTest, MAYBE_PinValidationWithoutRejectedCerts) {
   HashValueVector good_hashes, bad_hashes;
 
   for (size_t i = 0; kGoodPath[i]; i++) {
     EXPECT_TRUE(AddHash(kGoodPath[i], &good_hashes));
   }
   for (size_t i = 0; kBadPath[i]; i++) {
     EXPECT_TRUE(AddHash(kBadPath[i], &bad_hashes));
   }
 
   TransportSecurityState state;
@@ skipping 1995 matching lines @@
   EXPECT_EQ(expiry, reporter.expiration());
   EXPECT_EQ(cert1.get(), reporter.validated_certificate_chain());
   EXPECT_EQ(cert2.get(), reporter.served_certificate_chain());
   EXPECT_EQ(sct_list.size(), reporter.signed_certificate_timestamps().size());
   EXPECT_EQ(sct_list[0].status,
             reporter.signed_certificate_timestamps()[0].status);
   EXPECT_EQ(sct_list[0].sct, reporter.signed_certificate_timestamps()[0].sct);
 }
 
 }  // namespace net