Centralize the logic for checking public key pins

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 19 matching lines @@
 
 #if defined(USE_OPENSSL)
 #include "crypto/openssl_util.h"
 #else
 #include "crypto/nss_util.h"
 #endif
 
 namespace net {
 
 class TransportSecurityStateTest : public testing::Test {
+ public:
   virtual void SetUp() {
 #if defined(USE_OPENSSL)
     crypto::EnsureOpenSSLInit();
 #else
     crypto::EnsureNSSInit();
 #endif
   }
 
+  static void DisableStaticPinning(TransportSecurityState* state) {
+    state->enable_static_pinning_ = false;
+  }
+
+  static void EnableStaticPinning(TransportSecurityState* state) {

[wtc, 2014/08/07 23:39:13]

These methods (and the EnableStaticPinning test) should be renamed
DisableStaticPins and EnableStaticPins if enable_static_pinning_ is renamed
enable_static_pins_.

[Ryan Hamilton, 2014/08/08 00:54:01]

Done.

+    state->enable_static_pinning_ = true;
+  }
+
  protected:
   bool GetStaticDomainState(TransportSecurityState* state,
                             const std::string& host,
                             bool sni_enabled,
                             TransportSecurityState::DomainState* result) {
     return state->GetStaticDomainState(host, sni_enabled, result);
   }
 
   void EnableHost(TransportSecurityState* state,
                   const std::string& host,
@@ skipping 97 matching lines @@
   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
   bool include_subdomains = false;
   state.AddHSTS("yahoo.com", expiry, include_subdomains);
 
   EXPECT_TRUE(state.GetDynamicDomainState("yahoo.com", &domain_state));
   EXPECT_FALSE(state.GetDynamicDomainState("example.com", &domain_state));
   EXPECT_TRUE(state.DeleteDynamicDataForHost("yahoo.com"));
   EXPECT_FALSE(state.GetDynamicDomainState("yahoo.com", &domain_state));
 }
 
+TEST_F(TransportSecurityStateTest, EnableStaticPinning) {
+  TransportSecurityState state;
+  TransportSecurityState::DomainState domain_state;
+
+  EnableStaticPinning(&state);
+  EXPECT_TRUE(
+      state.GetStaticDomainState("chrome.google.com", true, &domain_state));
+
+  DisableStaticPinning(&state);
+  EXPECT_FALSE(
+      state.GetStaticDomainState("chrome.google.com", true, &domain_state));
+}
+
 TEST_F(TransportSecurityStateTest, IsPreloaded) {
   const std::string paypal = "paypal.com";
   const std::string www_paypal = "www.paypal.com";
   const std::string foo_paypal = "foo.paypal.com";
   const std::string a_www_paypal = "a.www.paypal.com";
   const std::string abc_paypal = "a.b.c.paypal.com";
   const std::string example = "example.com";
   const std::string aypal = "aypal.com";
 
   TransportSecurityState state;
+  EnableStaticPinning(&state);

[Ryan Sleevi, 2014/08/07 23:48:40]

Let's make this test more explicit about the STS bit vs the PKP part

Delete this line, and remove line 203

[Ryan Hamilton, 2014/08/08 00:54:00]

Done.

   TransportSecurityState::DomainState domain_state;
 
   EXPECT_TRUE(GetStaticDomainState(&state, paypal, true, &domain_state));
   EXPECT_TRUE(GetStaticDomainState(&state, www_paypal, true, &domain_state));
   EXPECT_FALSE(domain_state.sts.include_subdomains);
   EXPECT_FALSE(domain_state.pkp.include_subdomains);
   EXPECT_FALSE(GetStaticDomainState(&state, a_www_paypal, true, &domain_state));
   EXPECT_FALSE(GetStaticDomainState(&state, abc_paypal, true, &domain_state));
   EXPECT_FALSE(GetStaticDomainState(&state, example, true, &domain_state));
   EXPECT_FALSE(GetStaticDomainState(&state, aypal, true, &domain_state));
 }
 
 TEST_F(TransportSecurityStateTest, PreloadedDomainSet) {
   TransportSecurityState state;
+  EnableStaticPinning(&state);

[Ryan Sleevi, 2014/08/07 23:48:39]

Remove this

[Ryan Hamilton, 2014/08/08 00:54:00]

Done.

   TransportSecurityState::DomainState domain_state;
 
   // The domain wasn't being set, leading to a blank string in the
   // chrome://net-internals/#hsts UI. So test that.
   EXPECT_TRUE(
       state.GetStaticDomainState("market.android.com", true, &domain_state));
   EXPECT_EQ(domain_state.domain, "market.android.com");
   EXPECT_TRUE(state.GetStaticDomainState(
       "sub.market.android.com", true, &domain_state));
   EXPECT_EQ(domain_state.domain, "market.android.com");
 }
 
 static bool StaticShouldRedirect(const char* hostname) {
   TransportSecurityState state;
+  TransportSecurityStateTest::EnableStaticPinning(&state);

[Ryan Sleevi, 2014/08/07 23:48:39]

Definitely removed - would have caught this bug :)

[Ryan Hamilton, 2014/08/08 00:54:01]

Done.

   TransportSecurityState::DomainState domain_state;
   return state.GetStaticDomainState(
              hostname, true /* SNI ok */, &domain_state) &&
          domain_state.ShouldUpgradeToSSL();
 }
 
 static bool HasStaticState(const char* hostname) {
   TransportSecurityState state;
+  TransportSecurityStateTest::EnableStaticPinning(&state);

[Ryan Sleevi, 2014/08/07 23:48:39]

This should be removed, I think. At least from the usage.

[Ryan Hamilton, 2014/08/08 00:54:00]

Done.

   TransportSecurityState::DomainState domain_state;
   return state.GetStaticDomainState(hostname, true /* SNI ok */, &domain_state);
 }
 
 static bool HasStaticPublicKeyPins(const char* hostname, bool sni_enabled) {
   TransportSecurityState state;
+  TransportSecurityStateTest::EnableStaticPinning(&state);
   TransportSecurityState::DomainState domain_state;
   if (!state.GetStaticDomainState(hostname, sni_enabled, &domain_state))
     return false;
 
   return domain_state.HasPublicKeyPins();
 }
 
 static bool HasStaticPublicKeyPins(const char* hostname) {
   return HasStaticPublicKeyPins(hostname, true);
 }
 
 static bool OnlyPinningInStaticState(const char* hostname) {
   TransportSecurityState state;
+  TransportSecurityStateTest::EnableStaticPinning(&state);
   TransportSecurityState::DomainState domain_state;
   if (!state.GetStaticDomainState(hostname, true /* SNI ok */, &domain_state))
     return false;
 
   return (domain_state.pkp.spki_hashes.size() > 0 ||
           domain_state.pkp.bad_spki_hashes.size() > 0) &&
          !domain_state.ShouldUpgradeToSSL();
 }
 
 TEST_F(TransportSecurityStateTest, Preloaded) {
   TransportSecurityState state;
+  EnableStaticPinning(&state);

[Ryan Sleevi, 2014/08/07 23:48:40]

So, we should probably split this in two, with only the latter calling
EnableStaticPinning

which domains you need to transfer over "should" be easy - the
OnlyPinningInStaticState / HasStaticPublicPins tests move over.

I'm not sure how we got here, since BuiltinCertPins was meant to be this split
(in that it only tests for pinning data). You should be able to do a superbowl
shuffle of those few pinned bits into the BuiltinCertPins

[Ryan Hamilton, 2014/08/08 00:54:00]

Done.

   TransportSecurityState::DomainState domain_state;
 
   // We do more extensive checks for the first domain.
   EXPECT_TRUE(
       state.GetStaticDomainState("www.paypal.com", true, &domain_state));
   EXPECT_EQ(domain_state.sts.upgrade_mode,
             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
   EXPECT_FALSE(domain_state.sts.include_subdomains);
   EXPECT_FALSE(domain_state.pkp.include_subdomains);
 
@@ skipping 237 matching lines @@
       "lookupByWaveIdHashAndWaveIdIdAndWaveIdDomainAndWaveletIdIdAnd"
       "WaveletIdDomainAndBlipBlipid";
   TransportSecurityState::DomainState domain_state;
   // Just checks that we don't hit a NOTREACHED.
   EXPECT_FALSE(state.GetStaticDomainState(kLongName, true, &domain_state));
   EXPECT_FALSE(state.GetDynamicDomainState(kLongName, &domain_state));
 }
 
 TEST_F(TransportSecurityStateTest, BuiltinCertPins) {
   TransportSecurityState state;
+  EnableStaticPinning(&state);
   TransportSecurityState::DomainState domain_state;
 
   EXPECT_TRUE(
       state.GetStaticDomainState("chrome.google.com", true, &domain_state));
   EXPECT_TRUE(HasStaticPublicKeyPins("chrome.google.com"));
 
   HashValueVector hashes;
   std::string failure_log;
   // Checks that a built-in list does exist.
   EXPECT_FALSE(domain_state.CheckPublicKeyPins(hashes, &failure_log));
@@ skipping 19 matching lines @@
   EXPECT_TRUE(HasStaticPublicKeyPins("plus.google.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("groups.google.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("apis.google.com"));
 
   EXPECT_TRUE(HasStaticPublicKeyPins("ssl.gstatic.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("gstatic.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.gstatic.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("ssl.google-analytics.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.googleplex.com"));
 
   // Disabled in order to help track down pinning failures --agl

[Ryan Sleevi, 2014/08/07 23:48:39]

*Cough* Let's nuke this comment ;)

[Ryan Hamilton, 2014/08/08 00:54:00]

Done.

   EXPECT_TRUE(HasStaticPublicKeyPins("twitter.com"));
   EXPECT_FALSE(HasStaticPublicKeyPins("foo.twitter.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.twitter.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("api.twitter.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("oauth.twitter.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("mobile.twitter.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("dev.twitter.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("business.twitter.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("platform.twitter.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("si0.twimg.com"));
@@ skipping 30 matching lines @@
   HashValueVector good_hashes, bad_hashes;
 
   for (size_t i = 0; kGoodPath[i]; i++) {
     EXPECT_TRUE(AddHash(kGoodPath[i], &good_hashes));
   }
   for (size_t i = 0; kBadPath[i]; i++) {
     EXPECT_TRUE(AddHash(kBadPath[i], &bad_hashes));
   }
 
   TransportSecurityState state;
+  EnableStaticPinning(&state);
+
   TransportSecurityState::DomainState domain_state;
   EXPECT_TRUE(
       state.GetStaticDomainState("blog.torproject.org", true, &domain_state));
   EXPECT_TRUE(domain_state.HasPublicKeyPins());
 
   std::string failure_log;
   EXPECT_TRUE(domain_state.CheckPublicKeyPins(good_hashes, &failure_log));
   EXPECT_FALSE(domain_state.CheckPublicKeyPins(bad_hashes, &failure_log));
 }
 
 TEST_F(TransportSecurityStateTest, OptionalHSTSCertPins) {
   TransportSecurityState state;
+  EnableStaticPinning(&state);
   TransportSecurityState::DomainState domain_state;
 
   EXPECT_FALSE(StaticShouldRedirect("www.google-analytics.com"));
 
   EXPECT_FALSE(HasStaticPublicKeyPins("www.google-analytics.com", false));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.google-analytics.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("google.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.google.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("mail-attachment.googleusercontent.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.youtube.com"));
@@ skipping 12 matching lines @@
   EXPECT_TRUE(HasStaticPublicKeyPins("a.googlegroups.com"));
   EXPECT_FALSE(HasStaticPublicKeyPins("a.googlegroups.com", false));
 }
 
 TEST_F(TransportSecurityStateTest, OverrideBuiltins) {
   EXPECT_TRUE(HasStaticPublicKeyPins("google.com"));
   EXPECT_FALSE(StaticShouldRedirect("google.com"));
   EXPECT_FALSE(StaticShouldRedirect("www.google.com"));
 
   TransportSecurityState state;
+  EnableStaticPinning(&state);

[Ryan Sleevi, 2014/08/07 23:48:39]

This should be removed. This is an HSTS test.

[Ryan Hamilton, 2014/08/08 00:54:00]

Done.

   TransportSecurityState::DomainState domain_state;
   const base::Time current_time(base::Time::Now());
   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
   domain_state.sts.expiry = expiry;
   EnableHost(&state, "www.google.com", domain_state);
 
   EXPECT_TRUE(state.GetDynamicDomainState("www.google.com", &domain_state));
 }
 
 TEST_F(TransportSecurityStateTest, GooglePinnedProperties) {
@@ skipping 53 matching lines @@
   // Expect to fail for SNI hosts when not searching the SNI list:
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "gmail.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "googlegroups.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "www.googlegroups.com", false));
 }
 
 }  // namespace net