Don't force non-session only cookies to be session only cookies, instead delete on shutdown

chrome/browser/net/sqlite_server_bound_cert_store_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_vector.h"
 #include "base/message_loop.h"
 #include "base/scoped_temp_dir.h"
 #include "base/stl_util.h"
 #include "base/test/thread_test_helper.h"
+#include "chrome/browser/net/clear_on_exit_policy.h"
 #include "chrome/browser/net/sqlite_server_bound_cert_store.h"
 #include "chrome/common/chrome_constants.h"
 #include "content/test/test_browser_thread.h"
 #include "net/base/cert_test_util.h"
 #include "sql/statement.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "webkit/quota/mock_special_storage_policy.h"
 
 using content::BrowserThread;
 
 class SQLiteServerBoundCertStoreTest : public testing::Test {
  public:
   SQLiteServerBoundCertStoreTest()
       : db_thread_(BrowserThread::DB) {
   }
 
  protected:
@@ skipping 25 matching lines @@
     exploded_time.minute = 23;
     exploded_time.second = 45;
     exploded_time.millisecond = 0;
     return base::Time::FromUTCExploded(exploded_time);
   }
 
   virtual void SetUp() {
     db_thread_.Start();
     ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
     store_ = new SQLiteServerBoundCertStore(
-        temp_dir_.path().Append(chrome::kOBCertFilename));
+        temp_dir_.path().Append(chrome::kOBCertFilename), NULL);
     ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
     ASSERT_TRUE(store_->Load(&certs.get()));
     ASSERT_EQ(0u, certs.size());
     // Make sure the store gets written at least once.
     store_->AddServerBoundCert(
         net::DefaultServerBoundCertStore::ServerBoundCert(
             "google.com",
             net::CLIENT_CERT_RSA_SIGN,
             base::Time::FromInternalValue(1),
             base::Time::FromInternalValue(2),
@@ skipping 50 matching lines @@
   // Replace the store effectively destroying the current one and forcing it
   // to write its data to disk. Then we can see if after loading it again it
   // is still there.
   store_ = NULL;
   scoped_refptr<base::ThreadTestHelper> helper(
       new base::ThreadTestHelper(
           BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB)));
   // Make sure we wait until the destructor has run.
   ASSERT_TRUE(helper->Run());
   store_ = new SQLiteServerBoundCertStore(
-      temp_dir_.path().Append(chrome::kOBCertFilename));
+      temp_dir_.path().Append(chrome::kOBCertFilename), NULL);
 
   // Reload and test for persistence
   ASSERT_TRUE(store_->Load(&certs.get()));
   ASSERT_EQ(2U, certs.size());
   net::DefaultServerBoundCertStore::ServerBoundCert* ec_cert;
   net::DefaultServerBoundCertStore::ServerBoundCert* rsa_cert;
   if (net::CLIENT_CERT_RSA_SIGN == certs[0]->type()) {
     rsa_cert = certs[0];
     ec_cert = certs[1];
   } else {
@@ skipping 14 matching lines @@
   ASSERT_EQ(4, ec_cert->expiration_time().ToInternalValue());
 
   // Now delete the cert and check persistence again.
   store_->DeleteServerBoundCert(*certs[0]);
   store_->DeleteServerBoundCert(*certs[1]);
   store_ = NULL;
   // Make sure we wait until the destructor has run.
   ASSERT_TRUE(helper->Run());
   certs.reset();
   store_ = new SQLiteServerBoundCertStore(
-      temp_dir_.path().Append(chrome::kOBCertFilename));
+      temp_dir_.path().Append(chrome::kOBCertFilename), NULL);
 
   // Reload and check if the cert has been removed.
   ASSERT_TRUE(store_->Load(&certs.get()));
   ASSERT_EQ(0U, certs.size());
 }
 
 TEST_F(SQLiteServerBoundCertStoreTest, TestUpgradeV1) {
   // Reset the store.  We'll be using a different database for this test.
   store_ = NULL;
 
@@ skipping 30 matching lines @@
         ));
   }
 
   // Load and test the DB contents twice.  First time ensures that we can use
   // the updated values immediately.  Second time ensures that the updated
   // values are stored and read correctly on next load.
   for (int i = 0; i < 2; ++i) {
     SCOPED_TRACE(i);
 
     ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
-    store_ = new SQLiteServerBoundCertStore(v1_db_path);
+    store_ = new SQLiteServerBoundCertStore(v1_db_path, NULL);
 
     // Load the database and ensure the certs can be read and are marked as RSA.
     ASSERT_TRUE(store_->Load(&certs.get()));
     ASSERT_EQ(2U, certs.size());
 
     ASSERT_STREQ("google.com", certs[0]->server_identifier().c_str());
     ASSERT_EQ(net::CLIENT_CERT_RSA_SIGN, certs[0]->type());
     ASSERT_EQ(GetTestCertExpirationTime(),
               certs[0]->expiration_time());
     ASSERT_EQ(key_data, certs[0]->private_key());
@@ skipping 67 matching lines @@
         ));
   }
 
   // Load and test the DB contents twice.  First time ensures that we can use
   // the updated values immediately.  Second time ensures that the updated
   // values are saved and read correctly on next load.
   for (int i = 0; i < 2; ++i) {
     SCOPED_TRACE(i);
 
     ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
-    store_ = new SQLiteServerBoundCertStore(v2_db_path);
+    store_ = new SQLiteServerBoundCertStore(v2_db_path, NULL);
 
     // Load the database and ensure the certs can be read and are marked as RSA.
     ASSERT_TRUE(store_->Load(&certs.get()));
     ASSERT_EQ(2U, certs.size());
 
     ASSERT_STREQ("google.com", certs[0]->server_identifier().c_str());
     ASSERT_EQ(net::CLIENT_CERT_RSA_SIGN, certs[0]->type());
     ASSERT_EQ(GetTestCertExpirationTime(),
               certs[0]->expiration_time());
     ASSERT_EQ(key_data, certs[0]->private_key());
@@ skipping 69 matching lines @@
         ));
   }
 
   // Load and test the DB contents twice.  First time ensures that we can use
   // the updated values immediately.  Second time ensures that the updated
   // values are saved and read correctly on next load.
   for (int i = 0; i < 2; ++i) {
     SCOPED_TRACE(i);
 
     ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
-    store_ = new SQLiteServerBoundCertStore(v3_db_path);
+    store_ = new SQLiteServerBoundCertStore(v3_db_path, NULL);
 
     // Load the database and ensure the certs can be read and are marked as RSA.
     ASSERT_TRUE(store_->Load(&certs.get()));
     ASSERT_EQ(2U, certs.size());
 
     ASSERT_STREQ("google.com", certs[0]->server_identifier().c_str());
     ASSERT_EQ(net::CLIENT_CERT_RSA_SIGN, certs[0]->type());
     ASSERT_EQ(1000, certs[0]->expiration_time().ToInternalValue());
     ASSERT_EQ(GetTestCertCreationTime(),
               certs[0]->creation_time());
@@ skipping 93 matching lines @@
 
   store_->Flush(base::Bind(&CallbackCounter::Callback, counter.get()));
 
   scoped_refptr<base::ThreadTestHelper> helper(
       new base::ThreadTestHelper(
           BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB)));
   ASSERT_TRUE(helper->Run());
 
   ASSERT_EQ(1, counter->callback_count());
 }
+
+namespace {
+
+bool CertificateExistsInList(
+    std::vector<net::DefaultServerBoundCertStore::ServerBoundCert*>* certs,
+    const std::string& server,
+    int type,
+    const std::string& key,
+    const std::string& cert,
+    int creation_time,
+    int expiration_time) {
+  for (unsigned i = 0; i < certs->size(); ++i) {
+    if ((*certs)[i]->server_identifier() == server &&
+        (*certs)[i]->type() == type &&
+        (*certs)[i]->private_key() == key &&
+        (*certs)[i]->cert() == cert &&
+        (*certs)[i]->creation_time().ToInternalValue() == creation_time &&
+        (*certs)[i]->expiration_time().ToInternalValue() == expiration_time) {
+      return true;
+    }
+  }
+  return false;
+}
+
+}  // namespace
+
+// Tests the interaction with the clear on exit policy.
+TEST_F(SQLiteServerBoundCertStoreTest, TestClearOnExitPolicy) {
+  // First, delete a possibly existing store.
+  store_->SetClearLocalStateOnExit(true);
+  store_ = NULL;
+  scoped_refptr<base::ThreadTestHelper> helper(
+      new base::ThreadTestHelper(
+          BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB)));
+  ASSERT_TRUE(helper->Run());
+
+  // Create a new store with three certificates in it.
+  store_ = new SQLiteServerBoundCertStore(
+      temp_dir_.path().Append(chrome::kOBCertFilename), NULL);
+
+  ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
+  ASSERT_TRUE(store_->Load(&certs.get()));
+  ASSERT_EQ(0U, certs.size());
+
+  store_->AddServerBoundCert(
+      net::DefaultServerBoundCertStore::ServerBoundCert(
+          "other.com",
+          net::CLIENT_CERT_RSA_SIGN,
+          base::Time::FromInternalValue(1),
+          base::Time::FromInternalValue(2),
+          "a", "b"));
+  store_->AddServerBoundCert(
+      net::DefaultServerBoundCertStore::ServerBoundCert(
+          "session.com",
+          net::CLIENT_CERT_RSA_SIGN,
+          base::Time::FromInternalValue(3),
+          base::Time::FromInternalValue(4),
+          "x", "y"));
+  store_->AddServerBoundCert(
+      net::DefaultServerBoundCertStore::ServerBoundCert(
+          "protected.com",
+          net::CLIENT_CERT_RSA_SIGN,
+          base::Time::FromInternalValue(5),
+          base::Time::FromInternalValue(6),
+          "n", "m"));
+
+  // Write out the certificates to disk.
+  store_ = NULL;
+  ASSERT_TRUE(helper->Run());
+
+  // Load the store again with a clear on exit policy.
+  scoped_refptr<quota::MockSpecialStoragePolicy> storage_policy =
+      new quota::MockSpecialStoragePolicy;
+  scoped_refptr<ClearOnExitPolicy> clear_policy =
+      new ClearOnExitPolicy(storage_policy.get());
+  storage_policy->AddSessionOnly(GURL("https://session.com"));
+  storage_policy->AddSessionOnly(GURL("https://protected.com"));
+  storage_policy->AddProtected(GURL("https://protected.com"));
+  store_ = new SQLiteServerBoundCertStore(
+      temp_dir_.path().Append(chrome::kOBCertFilename), clear_policy.get());
+  ASSERT_TRUE(store_->Load(&certs.get()));
+  ASSERT_EQ(3U, certs.size());
+
+  // Delete the store. This should apply the clear on exit policy.
+  store_ = NULL;
+  // Make sure we wait until the destructor has run.
+  ASSERT_TRUE(helper->Run());
+
+  store_ = new SQLiteServerBoundCertStore(
+      temp_dir_.path().Append(chrome::kOBCertFilename), clear_policy.get());
+
+  // Reload and test for persistence
+  certs->clear();
+  ASSERT_TRUE(store_->Load(&certs.get()));
+  ASSERT_EQ(2U, certs.size());
+
+  ASSERT_TRUE(CertificateExistsInList(&certs.get(),
+                                      "other.com",
+                                      net::CLIENT_CERT_RSA_SIGN,
+                                      "a", "b", 1, 2));
+  ASSERT_TRUE(CertificateExistsInList(&certs.get(),
+                                      "protected.com",
+                                      net::CLIENT_CERT_RSA_SIGN,
+                                      "n", "m", 5, 6));
+}