Drop SSLv3 cache entries

net/http/http_response_info_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_response_info.h"
 
 #include "base/pickle.h"
 #include "net/cert/signed_certificate_timestamp.h"
 #include "net/cert/signed_certificate_timestamp_and_status.h"
 #include "net/http/http_response_headers.h"
@@ skipping 145 matching lines @@
   SSLConnectionStatusSetVersion(SSL_CONNECTION_VERSION_TLS1_2,
                                 &response_info_.ssl_info.connection_status);
   SSLConnectionStatusSetCipherSuite(0xffff,
                                     &response_info_.ssl_info.connection_status);
   response_info_.ssl_info.key_exchange_group = 1024;
   net::HttpResponseInfo restored_response_info;
   PickleAndRestore(response_info_, &restored_response_info);
   EXPECT_EQ(0, restored_response_info.ssl_info.key_exchange_group);
 }
 
+// Tests that cache entries loaded over SSLv3 (no longer supported) are dropped.
+TEST_F(HttpResponseInfoTest, FailsInitFromPickleWithSSLV3) {
+  // A valid certificate is needed for ssl_info.is_valid() to be true.
+  response_info_.ssl_info.cert =
+      ImportCertFromFile(GetTestCertsDirectory(), "ok_cert.pem");
+
+  // Non-SSLv3 versions should succeed.
+  SSLConnectionStatusSetVersion(SSL_CONNECTION_VERSION_TLS1_2,
+                                &response_info_.ssl_info.connection_status);
+  base::Pickle tls12_pickle;
+  response_info_.Persist(&tls12_pickle, false, false);
+  bool truncated = false;
+  net::HttpResponseInfo restored_tls12_response_info;
+  EXPECT_TRUE(
+      restored_tls12_response_info.InitFromPickle(tls12_pickle, &truncated));
+  EXPECT_EQ(SSL_CONNECTION_VERSION_TLS1_2,
+            SSLConnectionStatusToVersion(
+                restored_tls12_response_info.ssl_info.connection_status));
+  EXPECT_FALSE(truncated);
+
+  // SSLv3 should fail.
+  SSLConnectionStatusSetVersion(SSL_CONNECTION_VERSION_SSL3,
+                                &response_info_.ssl_info.connection_status);
+  base::Pickle ssl3_pickle;
+  response_info_.Persist(&ssl3_pickle, false, false);
+  net::HttpResponseInfo restored_ssl3_response_info;
+  EXPECT_FALSE(
+      restored_ssl3_response_info.InitFromPickle(ssl3_pickle, &truncated));
+}
+
 }  // namespace
 
 }  // namespace net