Remove the "snionly" concept from the HSTS preload.

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 39 matching lines @@
     state->enable_static_pins_ = false;
   }
 
   static void EnableStaticPins(TransportSecurityState* state) {
     state->enable_static_pins_ = true;
   }
 
  protected:
   bool GetStaticDomainState(TransportSecurityState* state,
                             const std::string& host,
-                            bool sni_enabled,
                             TransportSecurityState::DomainState* result) {
-    return state->GetStaticDomainState(host, sni_enabled, result);
+    return state->GetStaticDomainState(host, result);
   }
 
   void EnableHost(TransportSecurityState* state,
                   const std::string& host,
                   const TransportSecurityState::DomainState& domain_state) {
     return state->EnableHost(host, domain_state);
   }
 };
 
 TEST_F(TransportSecurityStateTest, SimpleMatches) {
@@ skipping 98 matching lines @@
   EXPECT_FALSE(state.GetDynamicDomainState("yahoo.com", &domain_state));
 }
 
 TEST_F(TransportSecurityStateTest, EnableStaticPins) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
 
   EnableStaticPins(&state);
 
   EXPECT_TRUE(
-      state.GetStaticDomainState("chrome.google.com", true, &domain_state));
+      state.GetStaticDomainState("chrome.google.com", &domain_state));
   EXPECT_FALSE(domain_state.pkp.spki_hashes.empty());
 }
 
 TEST_F(TransportSecurityStateTest, DisableStaticPins) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
 
   DisableStaticPins(&state);
   EXPECT_TRUE(
-      state.GetStaticDomainState("chrome.google.com", true, &domain_state));
+      state.GetStaticDomainState("chrome.google.com", &domain_state));
   EXPECT_TRUE(domain_state.pkp.spki_hashes.empty());
 }
 
 TEST_F(TransportSecurityStateTest, IsPreloaded) {
   const std::string paypal = "paypal.com";
   const std::string www_paypal = "www.paypal.com";
   const std::string foo_paypal = "foo.paypal.com";
   const std::string a_www_paypal = "a.www.paypal.com";
   const std::string abc_paypal = "a.b.c.paypal.com";
   const std::string example = "example.com";
   const std::string aypal = "aypal.com";
 
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
 
-  EXPECT_TRUE(GetStaticDomainState(&state, paypal, true, &domain_state));
-  EXPECT_TRUE(GetStaticDomainState(&state, www_paypal, true, &domain_state));
+  EXPECT_TRUE(GetStaticDomainState(&state, paypal, &domain_state));
+  EXPECT_TRUE(GetStaticDomainState(&state, www_paypal, &domain_state));
   EXPECT_FALSE(domain_state.sts.include_subdomains);
-  EXPECT_FALSE(GetStaticDomainState(&state, a_www_paypal, true, &domain_state));
-  EXPECT_FALSE(GetStaticDomainState(&state, abc_paypal, true, &domain_state));
-  EXPECT_FALSE(GetStaticDomainState(&state, example, true, &domain_state));
-  EXPECT_FALSE(GetStaticDomainState(&state, aypal, true, &domain_state));
+  EXPECT_FALSE(GetStaticDomainState(&state, a_www_paypal, &domain_state));
+  EXPECT_FALSE(GetStaticDomainState(&state, abc_paypal, &domain_state));
+  EXPECT_FALSE(GetStaticDomainState(&state, example, &domain_state));
+  EXPECT_FALSE(GetStaticDomainState(&state, aypal, &domain_state));
 }
 
 TEST_F(TransportSecurityStateTest, PreloadedDomainSet) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
 
   // The domain wasn't being set, leading to a blank string in the
   // chrome://net-internals/#hsts UI. So test that.
   EXPECT_TRUE(
-      state.GetStaticDomainState("market.android.com", true, &domain_state));
+      state.GetStaticDomainState("market.android.com", &domain_state));
   EXPECT_EQ(domain_state.domain, "market.android.com");
   EXPECT_TRUE(state.GetStaticDomainState(
-      "sub.market.android.com", true, &domain_state));
+      "sub.market.android.com", &domain_state));
   EXPECT_EQ(domain_state.domain, "market.android.com");
 }
 
 static bool StaticShouldRedirect(const char* hostname) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
   return state.GetStaticDomainState(
-             hostname, true /* SNI ok */, &domain_state) &&
+             hostname, &domain_state) &&
          domain_state.ShouldUpgradeToSSL();
 }
 
 static bool HasStaticState(const char* hostname) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
-  return state.GetStaticDomainState(hostname, true /* SNI ok */, &domain_state);
+  return state.GetStaticDomainState(hostname, &domain_state);
 }
 
-static bool HasStaticPublicKeyPins(const char* hostname, bool sni_enabled) {
+static bool HasStaticPublicKeyPins(const char* hostname) {
   TransportSecurityState state;
   TransportSecurityStateTest::EnableStaticPins(&state);
   TransportSecurityState::DomainState domain_state;
-  if (!state.GetStaticDomainState(hostname, sni_enabled, &domain_state))
+  if (!state.GetStaticDomainState(hostname, &domain_state))
     return false;
 
   return domain_state.HasPublicKeyPins();
 }
 
-static bool HasStaticPublicKeyPins(const char* hostname) {
-  return HasStaticPublicKeyPins(hostname, true);
-}
-
 static bool OnlyPinningInStaticState(const char* hostname) {
   TransportSecurityState state;
   TransportSecurityStateTest::EnableStaticPins(&state);
   TransportSecurityState::DomainState domain_state;
-  if (!state.GetStaticDomainState(hostname, true /* SNI ok */, &domain_state))
+  if (!state.GetStaticDomainState(hostname, &domain_state))
     return false;
 
   return (domain_state.pkp.spki_hashes.size() > 0 ||
           domain_state.pkp.bad_spki_hashes.size() > 0) &&
          !domain_state.ShouldUpgradeToSSL();
 }
 
 TEST_F(TransportSecurityStateTest, Preloaded) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
 
   // We do more extensive checks for the first domain.
   EXPECT_TRUE(
-      state.GetStaticDomainState("www.paypal.com", true, &domain_state));
+      state.GetStaticDomainState("www.paypal.com", &domain_state));
   EXPECT_EQ(domain_state.sts.upgrade_mode,
             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
   EXPECT_FALSE(domain_state.sts.include_subdomains);
   EXPECT_FALSE(domain_state.pkp.include_subdomains);
 
   EXPECT_TRUE(HasStaticState("paypal.com"));
   EXPECT_FALSE(HasStaticState("www2.paypal.com"));
   EXPECT_FALSE(HasStaticState("www2.paypal.com"));
 
   // Google hosts:
@@ skipping 19 matching lines @@
   EXPECT_TRUE(StaticShouldRedirect("groups.google.com"));
   EXPECT_TRUE(StaticShouldRedirect("apis.google.com"));
   EXPECT_FALSE(StaticShouldRedirect("chart.apis.google.com"));
   EXPECT_TRUE(StaticShouldRedirect("ssl.google-analytics.com"));
   EXPECT_TRUE(StaticShouldRedirect("gmail.com"));
   EXPECT_TRUE(StaticShouldRedirect("www.gmail.com"));
   EXPECT_TRUE(StaticShouldRedirect("googlemail.com"));
   EXPECT_TRUE(StaticShouldRedirect("www.googlemail.com"));
   EXPECT_TRUE(StaticShouldRedirect("googleplex.com"));
   EXPECT_TRUE(StaticShouldRedirect("www.googleplex.com"));
-  EXPECT_FALSE(HasStaticState("m.gmail.com"));
-  EXPECT_FALSE(HasStaticState("m.googlemail.com"));
 
-  // Tests for domains that don't work without SNI.
-  EXPECT_FALSE(state.GetStaticDomainState("gmail.com", false, &domain_state));
-  EXPECT_FALSE(
-      state.GetStaticDomainState("www.gmail.com", false, &domain_state));
-  EXPECT_FALSE(state.GetStaticDomainState("m.gmail.com", false, &domain_state));
-  EXPECT_FALSE(
-      state.GetStaticDomainState("googlemail.com", false, &domain_state));
-  EXPECT_FALSE(
-      state.GetStaticDomainState("www.googlemail.com", false, &domain_state));
-  EXPECT_FALSE(
-      state.GetStaticDomainState("m.googlemail.com", false, &domain_state));
+  // These domains used to be only HSTS when SNI was available.
+  EXPECT_TRUE(state.GetStaticDomainState("gmail.com", &domain_state));
+  EXPECT_TRUE(state.GetStaticDomainState("www.gmail.com", &domain_state));
+  EXPECT_TRUE(state.GetStaticDomainState("googlemail.com", &domain_state));
+  EXPECT_TRUE(state.GetStaticDomainState("www.googlemail.com", &domain_state));
 
   // Other hosts:
 
   EXPECT_TRUE(StaticShouldRedirect("aladdinschools.appspot.com"));
 
   EXPECT_TRUE(StaticShouldRedirect("ottospora.nl"));
   EXPECT_TRUE(StaticShouldRedirect("www.ottospora.nl"));
 
   EXPECT_TRUE(StaticShouldRedirect("www.paycheckrecords.com"));
 
@@ skipping 137 matching lines @@
   EXPECT_TRUE(StaticShouldRedirect("foo.crate.io"));
 }
 
 TEST_F(TransportSecurityStateTest, PreloadedPins) {
   TransportSecurityState state;
   EnableStaticPins(&state);
   TransportSecurityState::DomainState domain_state;
 
   // We do more extensive checks for the first domain.
   EXPECT_TRUE(
-      state.GetStaticDomainState("www.paypal.com", true, &domain_state));
+      state.GetStaticDomainState("www.paypal.com", &domain_state));
   EXPECT_EQ(domain_state.sts.upgrade_mode,
             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
   EXPECT_FALSE(domain_state.sts.include_subdomains);
   EXPECT_FALSE(domain_state.pkp.include_subdomains);
 
   EXPECT_TRUE(OnlyPinningInStaticState("www.google.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("foo.google.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("google.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("www.youtube.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("youtube.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("i.ytimg.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("ytimg.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("googleusercontent.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("www.googleusercontent.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("www.google-analytics.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("googleapis.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("googleadservices.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("googlecode.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("appspot.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("googlesyndication.com"));
   EXPECT_TRUE(OnlyPinningInStaticState("doubleclick.net"));
   EXPECT_TRUE(OnlyPinningInStaticState("googlegroups.com"));
 
   EXPECT_TRUE(HasStaticPublicKeyPins("torproject.org"));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.torproject.org"));
   EXPECT_TRUE(HasStaticPublicKeyPins("check.torproject.org"));
   EXPECT_TRUE(HasStaticPublicKeyPins("blog.torproject.org"));
   EXPECT_FALSE(HasStaticState("foo.torproject.org"));
 
-  EXPECT_TRUE(
-      state.GetStaticDomainState("torproject.org", false, &domain_state));
+  EXPECT_TRUE(state.GetStaticDomainState("torproject.org", &domain_state));
+  EXPECT_FALSE(domain_state.pkp.spki_hashes.empty());
+  EXPECT_TRUE(state.GetStaticDomainState("www.torproject.org", &domain_state));
   EXPECT_FALSE(domain_state.pkp.spki_hashes.empty());
   EXPECT_TRUE(
-      state.GetStaticDomainState("www.torproject.org", false, &domain_state));
+      state.GetStaticDomainState("check.torproject.org", &domain_state));
   EXPECT_FALSE(domain_state.pkp.spki_hashes.empty());
-  EXPECT_TRUE(
-      state.GetStaticDomainState("check.torproject.org", false, &domain_state));
-  EXPECT_FALSE(domain_state.pkp.spki_hashes.empty());
-  EXPECT_TRUE(
-      state.GetStaticDomainState("blog.torproject.org", false, &domain_state));
+  EXPECT_TRUE(state.GetStaticDomainState("blog.torproject.org", &domain_state));
   EXPECT_FALSE(domain_state.pkp.spki_hashes.empty());
 
   EXPECT_TRUE(HasStaticPublicKeyPins("www.twitter.com"));
 }
 
 TEST_F(TransportSecurityStateTest, LongNames) {
   TransportSecurityState state;
   const char kLongName[] =
       "lookupByWaveIdHashAndWaveIdIdAndWaveIdDomainAndWaveletIdIdAnd"
       "WaveletIdDomainAndBlipBlipid";
   TransportSecurityState::DomainState domain_state;
   // Just checks that we don't hit a NOTREACHED.
-  EXPECT_FALSE(state.GetStaticDomainState(kLongName, true, &domain_state));
+  EXPECT_FALSE(state.GetStaticDomainState(kLongName, &domain_state));
   EXPECT_FALSE(state.GetDynamicDomainState(kLongName, &domain_state));
 }
 
 TEST_F(TransportSecurityStateTest, BuiltinCertPins) {
   TransportSecurityState state;
   EnableStaticPins(&state);
   TransportSecurityState::DomainState domain_state;
 
   EXPECT_TRUE(
-      state.GetStaticDomainState("chrome.google.com", true, &domain_state));
+      state.GetStaticDomainState("chrome.google.com", &domain_state));
   EXPECT_TRUE(HasStaticPublicKeyPins("chrome.google.com"));
 
   HashValueVector hashes;
   std::string failure_log;
   // Checks that a built-in list does exist.
   EXPECT_FALSE(domain_state.CheckPublicKeyPins(hashes, &failure_log));
   EXPECT_FALSE(HasStaticPublicKeyPins("www.paypal.com"));
 
   EXPECT_TRUE(HasStaticPublicKeyPins("docs.google.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("1.docs.google.com"));
@@ skipping 69 matching lines @@
   }
   for (size_t i = 0; kBadPath[i]; i++) {
     EXPECT_TRUE(AddHash(kBadPath[i], &bad_hashes));
   }
 
   TransportSecurityState state;
   EnableStaticPins(&state);
 
   TransportSecurityState::DomainState domain_state;
   EXPECT_TRUE(
-      state.GetStaticDomainState("blog.torproject.org", true, &domain_state));
+      state.GetStaticDomainState("blog.torproject.org", &domain_state));
   EXPECT_TRUE(domain_state.HasPublicKeyPins());
 
   std::string failure_log;
   EXPECT_TRUE(domain_state.CheckPublicKeyPins(good_hashes, &failure_log));
   EXPECT_FALSE(domain_state.CheckPublicKeyPins(bad_hashes, &failure_log));
 }
 
 TEST_F(TransportSecurityStateTest, OptionalHSTSCertPins) {
   TransportSecurityState state;
   EnableStaticPins(&state);
   TransportSecurityState::DomainState domain_state;
 
   EXPECT_FALSE(StaticShouldRedirect("www.google-analytics.com"));
 
-  EXPECT_FALSE(HasStaticPublicKeyPins("www.google-analytics.com", false));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.google-analytics.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("google.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.google.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("mail-attachment.googleusercontent.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("www.youtube.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("i.ytimg.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("googleapis.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("ajax.googleapis.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("googleadservices.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("pagead2.googleadservices.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("googlecode.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("kibbles.googlecode.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("appspot.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("googlesyndication.com"));
   EXPECT_TRUE(HasStaticPublicKeyPins("doubleclick.net"));
   EXPECT_TRUE(HasStaticPublicKeyPins("ad.doubleclick.net"));
   EXPECT_FALSE(HasStaticPublicKeyPins("learn.doubleclick.net"));
   EXPECT_TRUE(HasStaticPublicKeyPins("a.googlegroups.com"));
-  EXPECT_FALSE(HasStaticPublicKeyPins("a.googlegroups.com", false));
 }
 
 TEST_F(TransportSecurityStateTest, OverrideBuiltins) {
   EXPECT_TRUE(HasStaticPublicKeyPins("google.com"));
   EXPECT_FALSE(StaticShouldRedirect("google.com"));
   EXPECT_FALSE(StaticShouldRedirect("www.google.com"));
 
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
   const base::Time current_time(base::Time::Now());
   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
   domain_state.sts.expiry = expiry;
   EnableHost(&state, "www.google.com", domain_state);
 
   EXPECT_TRUE(state.GetDynamicDomainState("www.google.com", &domain_state));
 }
 
 TEST_F(TransportSecurityStateTest, GooglePinnedProperties) {
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "www.example.com", true));
+      "www.example.com"));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "www.paypal.com", true));
+      "www.paypal.com"));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "mail.twitter.com", true));
+      "mail.twitter.com"));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "www.google.com.int", true));
+      "www.google.com.int"));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "jottit.com", true));
+      "jottit.com"));
   // learn.doubleclick.net has a more specific match than
   // *.doubleclick.com, and has 0 or NULL for its required certs.
   // This test ensures that the exact-match-preferred behavior
   // works.
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "learn.doubleclick.net", true));
+      "learn.doubleclick.net"));
 
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "encrypted.google.com", true));
+      "encrypted.google.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "mail.google.com", true));
+      "mail.google.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "accounts.google.com", true));
+      "accounts.google.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "doubleclick.net", true));
+      "doubleclick.net"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "ad.doubleclick.net", true));
+      "ad.doubleclick.net"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "youtube.com", true));
+      "youtube.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "www.profiles.google.com", true));
+      "www.profiles.google.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "checkout.google.com", true));
+      "checkout.google.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "googleadservices.com", true));
+      "googleadservices.com"));
 
-  // Test with sni_enabled false:
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "www.example.com", false));
+      "www.example.com"));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "www.paypal.com", false));
+      "www.paypal.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "checkout.google.com", false));
+      "checkout.google.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "googleadservices.com", false));
+      "googleadservices.com"));
 
   // Test some SNI hosts:
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "gmail.com", true));
+      "gmail.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "googlegroups.com", true));
+      "googlegroups.com"));
   EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
-      "www.googlegroups.com", true));
-  // Expect to fail for SNI hosts when not searching the SNI list:
-  EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "gmail.com", false));
-  EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "googlegroups.com", false));
-  EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
-      "www.googlegroups.com", false));
+      "www.googlegroups.com"));
+
+  // These hosts used to only be HSTS when SNI was available.
+  EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
+      "gmail.com"));
+  EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
+      "googlegroups.com"));
+  EXPECT_TRUE(TransportSecurityState::IsGooglePinnedProperty(
+      "www.googlegroups.com"));
 }
 
 }  // namespace net