net: trim allowed Google pins now that we have switched to GIAG2.

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 529 matching lines @@
 static bool AddHash(const std::string& type_and_base64,
                     HashValueVector* out) {
   HashValue hash;
   if (!hash.FromString(type_and_base64))
     return false;
 
   out->push_back(hash);
   return true;
 }
 
-TEST_F(TransportSecurityStateTest, PinValidationWithRejectedCerts) {
-  // kGoodPath is plus.google.com via Google Internet Authority.
-  static const char* kGoodPath[] = {
-    "sha1/4BjDjn8v2lWeUFQnqSs0BgbIcrU=",
-    "sha1/QMVAHW+MuvCLAO3vse6H0AWzuc0=",
-    "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=",
-    NULL,
-  };
-
-  // kBadPath is plus.google.com via Trustcenter, which contains a required
-  // certificate (Equifax root), but also an excluded certificate
-  // (Trustcenter).
-  static const char* kBadPath[] = {
-    "sha1/4BjDjn8v2lWeUFQnqSs0BgbIcrU=",
-    "sha1/gzuEEAB/bkqdQS3EIjk2by7lW+k=",
-    "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=",
-    NULL,
-  };
-
-  HashValueVector good_hashes, bad_hashes;
-
-  for (size_t i = 0; kGoodPath[i]; i++) {
-    EXPECT_TRUE(AddHash(kGoodPath[i], &good_hashes));
-  }
-  for (size_t i = 0; kBadPath[i]; i++) {
-    EXPECT_TRUE(AddHash(kBadPath[i], &bad_hashes));
-  }
-
-  TransportSecurityState state;
-  TransportSecurityState::DomainState domain_state;
-  EXPECT_TRUE(state.GetDomainState("plus.google.com", true, &domain_state));
-  EXPECT_TRUE(domain_state.HasPublicKeyPins());
-
-  EXPECT_TRUE(domain_state.CheckPublicKeyPins(good_hashes));
-  EXPECT_FALSE(domain_state.CheckPublicKeyPins(bad_hashes));
-}
-
 TEST_F(TransportSecurityStateTest, PinValidationWithoutRejectedCerts) {
   // kGoodPath is blog.torproject.org.
   static const char* kGoodPath[] = {
     "sha1/m9lHYJYke9k0GtVZ+bXSQYE8nDI=",
     "sha1/o5OZxATDsgmwgcIfIWIneMJ0jkw=",
     "sha1/wHqYaI2J+6sFZAwRfap9ZbjKzE4=",
     NULL,
   };
 
   // kBadPath is plus.google.com via Trustcenter, which is utterly wrong for
@@ skipping 16 matching lines @@
 
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
   EXPECT_TRUE(state.GetDomainState("blog.torproject.org", true, &domain_state));
   EXPECT_TRUE(domain_state.HasPublicKeyPins());
 
   EXPECT_TRUE(domain_state.CheckPublicKeyPins(good_hashes));
   EXPECT_FALSE(domain_state.CheckPublicKeyPins(bad_hashes));
 }
 
-TEST_F(TransportSecurityStateTest, PinValidationWithRejectedCertsMixedHashes) {
-  static const char* ee_sha1 = "sha1/4BjDjn8v2lWeUFQnqSs0BgbIcrU=";
-  static const char* ee_sha256 =
-      "sha256/sRJBQqWhpaKIGcc1NA7/jJ4vgWj+47oYfyU7waOS1+I=";
-  static const char* google_1024_sha1 = "sha1/QMVAHW+MuvCLAO3vse6H0AWzuc0=";
-  static const char* google_1024_sha256 =
-      "sha256/trlUMquuV/4CDLK3T0+fkXPIxwivyecyrOIyeQR8bQU=";
-  static const char* equifax_sha1 = "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=";
-  static const char* equifax_sha256 =
-      "sha256//1aAzXOlcD2gSBegdf1GJQanNQbEuBoVg+9UlHjSZHY=";
-  static const char* trustcenter_sha1 = "sha1/gzuEEAB/bkqdQS3EIjk2by7lW+k=";
-  static const char* trustcenter_sha256 =
-      "sha256/Dq58KIA4NMLsboWMLU8/aTREzaAGEFW+EtUule8dd/M=";
-
-  // Good chains for plus.google.com chain up through google_1024_sha{1,256}
-  // to equifax_sha{1,256}. Bad chains chain up to Equifax through
-  // trustcenter_sha{1,256}, which is a blacklisted key. Even though Equifax
-  // and Google1024 are known-good, the blacklistedness of Trustcenter
-  // should override and cause pin validation failure.
-
-  TransportSecurityState state;
-  TransportSecurityState::DomainState domain_state;
-  EXPECT_TRUE(state.GetDomainState("plus.google.com", true, &domain_state));
-  EXPECT_TRUE(domain_state.HasPublicKeyPins());
-
-  // The statically-defined pins are all SHA-1, so we add some SHA-256 pins
-  // manually:
-  EXPECT_TRUE(AddHash(google_1024_sha256, &domain_state.static_spki_hashes));
-  EXPECT_TRUE(AddHash(trustcenter_sha256,
-                      &domain_state.bad_static_spki_hashes));
-
-  // Try an all-good SHA1 chain.
-  HashValueVector validated_chain;
-  EXPECT_TRUE(AddHash(ee_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(google_1024_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha1, &validated_chain));
-  EXPECT_TRUE(domain_state.CheckPublicKeyPins(validated_chain));
-
-  // Try an all-bad SHA1 chain.
-  validated_chain.clear();
-  EXPECT_TRUE(AddHash(ee_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(trustcenter_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha1, &validated_chain));
-  EXPECT_FALSE(domain_state.CheckPublicKeyPins(validated_chain));
-
-  // Try an all-good SHA-256 chain.
-  validated_chain.clear();
-  EXPECT_TRUE(AddHash(ee_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(google_1024_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha256, &validated_chain));
-  EXPECT_TRUE(domain_state.CheckPublicKeyPins(validated_chain));
-
-  // Try an all-bad SHA-256 chain.
-  validated_chain.clear();
-  EXPECT_TRUE(AddHash(ee_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(trustcenter_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha256, &validated_chain));
-  EXPECT_FALSE(domain_state.CheckPublicKeyPins(validated_chain));
-
-  // Try a mixed-hash good chain.
-  validated_chain.clear();
-  EXPECT_TRUE(AddHash(ee_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(google_1024_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha256, &validated_chain));
-  EXPECT_TRUE(domain_state.CheckPublicKeyPins(validated_chain));
-
-  // Try a mixed-hash bad chain.
-  validated_chain.clear();
-  EXPECT_TRUE(AddHash(ee_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(trustcenter_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha1, &validated_chain));
-  EXPECT_FALSE(domain_state.CheckPublicKeyPins(validated_chain));
-
-  // Try a chain with all good hashes.
-  validated_chain.clear();
-  EXPECT_TRUE(AddHash(ee_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(google_1024_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(ee_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(google_1024_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha256, &validated_chain));
-  EXPECT_TRUE(domain_state.CheckPublicKeyPins(validated_chain));
-
-  // Try a chain with all bad hashes.
-  validated_chain.clear();
-  EXPECT_TRUE(AddHash(ee_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(trustcenter_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha1, &validated_chain));
-  EXPECT_TRUE(AddHash(ee_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(trustcenter_sha256, &validated_chain));
-  EXPECT_TRUE(AddHash(equifax_sha256, &validated_chain));
-  EXPECT_FALSE(domain_state.CheckPublicKeyPins(validated_chain));
-}
-
 TEST_F(TransportSecurityStateTest, OptionalHSTSCertPins) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
 
   EXPECT_FALSE(ShouldRedirect("www.google-analytics.com"));
 
   EXPECT_FALSE(HasPublicKeyPins("www.google-analytics.com", false));
   EXPECT_TRUE(HasPublicKeyPins("www.google-analytics.com"));
   EXPECT_TRUE(HasPublicKeyPins("google.com"));
   EXPECT_TRUE(HasPublicKeyPins("www.google.com"));
@@ skipping 87 matching lines @@
   // Expect to fail for SNI hosts when not searching the SNI list:
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "gmail.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "googlegroups.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "www.googlegroups.com", false));
 }
 
 }  // namespace net