add setter for enable_pkp_bypass_etc

components/cronet/ios/test/cronet_pkp_test.mm

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <Cronet/Cronet.h>
 
 #include "components/cronet/ios/test/start_cronet.h"
 #include "components/grpc_support/test/quic_test_server.h"
 #include "cronet_test_base.h"
 #include "net/base/mac/url_conversions.h"
@@ skipping 60 matching lines @@
     } else {
       ASSERT_FALSE(IsResponseSuccessful());
     }
   }
 
   // Adds a given public-key-pin and starts a Cronet engine for testing.
   void AddPkpAndStartCronet(NSString* host,
                             NSData* hash,
                             BOOL include_subdomains,
                             NSDate* expiration_date) {
+    [Cronet setEnablePublicKeyPinningBypassForLocalTrustAnchors:NO];
     NSSet* hashes = [NSSet setWithObject:hash];
     NSError* error;
     BOOL success = [Cronet addPublicKeyPinsForHost:host
                                          pinHashes:hashes
                                  includeSubdomains:include_subdomains
                                     expirationDate:(NSDate*)expiration_date
                                              error:&error];
     CHECK(success);
     CHECK(!error);
     StartCronet(grpc_support::GetQuicTestServerPort());
@@ skipping 43 matching lines @@
 }
 
 // Tests the case when the pin hash matches. The client is expected to
 // receive the successful response with the response code 200.
 TEST_F(PkpTest, TestSuccessIfPinMatches) {
   AddPkpAndStartCronet(server_host_, MatchingHash(), kExcludeSubdomains,
                        kDistantFuture);
   ASSERT_NO_FATAL_FAILURE(sendRequestAndAssertResult(request_url_, kSuccess));
 }
 
+TEST_F(PkpTest, TestBypass) {

[kapishnikov, 2017/06/28 03:42:32]

Can we add another test that tests behavior with the default bypass value? I am
afraid that if for some reason we change the default value, we may break
existing applications.

[lilyhoughton, 2017/06/28 14:38:51]

I don't know how to do this, since that would require running the test before
any of the tests which call the setter; and I don't think test-order is
guaranteed.

[kapishnikov, 2017/06/28 15:32:23]

I was thinking of creating the same test but without calling
[Cronet setEnablePublicKeyPinningBypassForLocalTrustAnchors:YES];

Let's assume that somebody in the future will change the definition of
BOOL gEnablePKPBypassForLocalTrustAnchors = YES; to 'NO' by mistake.
Since our PKP tests set the value explicitly, they will still continue passing
but the behavior will change and we will not detect it.

+  [Cronet setEnablePublicKeyPinningBypassForLocalTrustAnchors:YES];
+
+  NSSet* hashes = [NSSet setWithObject:NonMatchingHash()];
+  NSError* error;
+  BOOL success = [Cronet addPublicKeyPinsForHost:server_host_
+                                       pinHashes:hashes
+                               includeSubdomains:kExcludeSubdomains
+                                  expirationDate:(NSDate*)kDistantFuture
+                                           error:&error];
+
+  EXPECT_FALSE(success);
+  EXPECT_EQ([error code], CRNErrorIncoherentConfig);
+}
+
 // Tests the case when the pin hash does not match and the client accesses the
 // subdomain of the configured PKP host with includeSubdomains flag set to true.
 // The client is expected to receive the error response.
 TEST_F(PkpTest, TestIncludeSubdomainsFlagEqualTrue) {
   AddPkpAndStartCronet(server_domain_, NonMatchingHash(), kIncludeSubdomains,
                        kDistantFuture);
   ASSERT_NO_FATAL_FAILURE(sendRequestAndAssertResult(request_url_, kError));
 }
 
 // Tests the case when the pin hash does not match and the client accesses the
@@ skipping 90 matching lines @@
                        expirationDate:kDistantFuture
                                 error:nil];
   ASSERT_TRUE(success);
   // Add non-matching pin.
   AddPkpAndStartCronet(server_host_, NonMatchingHash(), kExcludeSubdomains,
                        kDistantFuture);
   ASSERT_NO_FATAL_FAILURE(sendRequestAndAssertResult(request_url_, kError));
 }
 
 }  // namespace cronet