Treat HSTS and HPKP state independently.

net/http/http_security_headers_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/sha1.h"
 #include "base/strings/string_piece.h"
 #include "crypto/sha2.h"
@@ skipping 373 matching lines @@
   HashValueVector hashes;
   HashValueVector chain_hashes;
 
   // Set some fake "chain" hashes into chain_hashes
   chain_hashes.push_back(GetTestHashValue(1, tag));
   chain_hashes.push_back(GetTestHashValue(2, tag));
   chain_hashes.push_back(GetTestHashValue(3, tag));
 
   // The good pin must be in the chain, the backup pin must not be
   std::string good_pin = GetTestPin(2, tag);
+  std::string good_pin2 = GetTestPin(3, tag);
   std::string backup_pin = GetTestPin(4, tag);
 
   EXPECT_TRUE(ParseHPKPHeader(
       "max-age=243; " + good_pin + ";" + backup_pin,
       chain_hashes, &max_age, &include_subdomains, &hashes));
   expect_max_age = base::TimeDelta::FromSeconds(243);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
   EXPECT_TRUE(ParseHPKPHeader(
@@ skipping 57 matching lines @@
   EXPECT_TRUE(include_subdomains);
 
   EXPECT_TRUE(ParseHPKPHeader(
       "  max-age=999999999999999999999999999999999999999999999  ;  " +
           backup_pin + ";" + good_pin + ";   ",
       chain_hashes, &max_age, &include_subdomains, &hashes));
   expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
 
-  // Test that parsing the same header twice doesn't duplicate the recorded
-  // hashes.
+  // Test that parsing a different header resets the hashes.
   hashes.clear();
   EXPECT_TRUE(ParseHPKPHeader(
       "  max-age=999;  " +
           backup_pin + ";" + good_pin + ";   ",
       chain_hashes, &max_age, &include_subdomains, &hashes));
   EXPECT_EQ(2u, hashes.size());
   EXPECT_TRUE(ParseHPKPHeader(
-      "  max-age=999;  " +
-          backup_pin + ";" + good_pin + ";   ",
-      chain_hashes, &max_age, &include_subdomains, &hashes));
+      "  max-age=999;  " + backup_pin + ";" + good_pin2 + ";   ", chain_hashes,
+      &max_age, &include_subdomains, &hashes));
   EXPECT_EQ(2u, hashes.size());
 }
 
 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA1) {
   TestBogusPinsHeaders(HASH_VALUE_SHA1);
 }
 
 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA256) {
   TestBogusPinsHeaders(HASH_VALUE_SHA256);
 }
@@ skipping 215 matching lines @@
   EXPECT_TRUE(domain_state.ShouldUpgradeToSSL());
   EXPECT_TRUE(state.ShouldUpgradeToSSL(domain));
   // The dynamic pins, which do not match |saved_hashes|, should take
   // precedence over the static pins and cause the check to fail.
   EXPECT_FALSE(state.CheckPublicKeyPins(domain,
                                         is_issued_by_known_root,
                                         saved_hashes,
                                         &failure_log));
 }
 
+// Tests that seeing an invalid HPKP header leaves the existing one alone.
+TEST_F(HttpSecurityHeadersTest, IgnoreInvalidHeaders) {
+  TransportSecurityState state;
+
+  HashValue good_hash = GetTestHashValue(1, HASH_VALUE_SHA256);
+  std::string good_pin = GetTestPin(1, HASH_VALUE_SHA256);
+  std::string bad_pin = GetTestPin(2, HASH_VALUE_SHA256);
+  std::string backup_pin = GetTestPin(3, HASH_VALUE_SHA256);
+
+  SSLInfo ssl_info;
+  ssl_info.public_key_hashes.push_back(good_hash);
+
+  // Add a valid HPKP header.
+  EXPECT_TRUE(state.AddHPKPHeader(
+      "example.com", "max-age = 10000; " + good_pin + "; " + backup_pin,
+      ssl_info));
+
+  // Check the insertion was valid.
+  EXPECT_TRUE(state.HasPublicKeyPins("example.com"));
+  std::string failure_log;
+  bool is_issued_by_known_root = true;
+  EXPECT_TRUE(state.CheckPublicKeyPins("example.com", is_issued_by_known_root,
+                                       ssl_info.public_key_hashes,
+                                       &failure_log));
+
+  // Now assert an invalid one. This should fail.
+  EXPECT_FALSE(state.AddHPKPHeader(
+      "example.com", "max-age = 10000; " + bad_pin + "; " + backup_pin,
+      ssl_info));
+
+  // The old pins must still exist.
+  EXPECT_TRUE(state.HasPublicKeyPins("example.com"));
+  EXPECT_TRUE(state.CheckPublicKeyPins("example.com", is_issued_by_known_root,
+                                       ssl_info.public_key_hashes,
+                                       &failure_log));
+}
+
 };    // namespace net