Support SHA-256 in public key pins for HTTPS.

net/base/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/base64.h"
@@ skipping 812 matching lines @@
   EXPECT_TRUE(HasPins("mobile.twitter.com"));
   EXPECT_TRUE(HasPins("dev.twitter.com"));
   EXPECT_TRUE(HasPins("business.twitter.com"));
   EXPECT_TRUE(HasPins("platform.twitter.com"));
   EXPECT_TRUE(HasPins("si0.twimg.com"));
   EXPECT_TRUE(HasPins("twimg0-a.akamaihd.net"));
 }
 
 static bool AddHash(const std::string& type_and_base64,
                     FingerprintVector* out) {
-  std::string hash_str;
-  if (type_and_base64.find("sha1/") == 0 &&
-      base::Base64Decode(type_and_base64.substr(5, type_and_base64.size() - 5),
-                         &hash_str) &&
-      hash_str.size() == base::kSHA1Length) {
-    SHA1Fingerprint hash;
-    memcpy(hash.data, hash_str.data(), sizeof(hash.data));
-    out->push_back(hash);
-    return true;
-  }
-  return false;
+  Fingerprint hash;
+
+  if (!TransportSecurityState::ParsePin(type_and_base64, &hash))
+    return false;
+
+  out->push_back(hash);
+  return true;
 }
 
+
 TEST_F(TransportSecurityStateTest, PinValidationWithRejectedCerts) {
   // kGoodPath is plus.google.com via Google Internet Authority.
   static const char* kGoodPath[] = {
     "sha1/4BjDjn8v2lWeUFQnqSs0BgbIcrU=",
     "sha1/QMVAHW+MuvCLAO3vse6H0AWzuc0=",
     "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=",
     NULL,
   };
 
   // kBadPath is plus.google.com via Trustcenter, which contains a required
   // certificate (Equifax root), but also an excluded certificate
   // (Trustcenter).
   static const char* kBadPath[] = {
     "sha1/4BjDjn8v2lWeUFQnqSs0BgbIcrU=",
     "sha1/gzuEEAB/bkqdQS3EIjk2by7lW+k=",
     "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=",
     NULL,
   };
 
-  std::vector<net::SHA1Fingerprint> good_hashes, bad_hashes;
+  std::vector<net::Fingerprint> good_hashes, bad_hashes;
 
   for (size_t i = 0; kGoodPath[i]; i++) {
     EXPECT_TRUE(AddHash(kGoodPath[i], &good_hashes));
   }
   for (size_t i = 0; kBadPath[i]; i++) {
     EXPECT_TRUE(AddHash(kBadPath[i], &bad_hashes));
   }
 
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
@@ skipping 15 matching lines @@
 
   // kBadPath is plus.google.com via Trustcenter, which is utterly wrong for
   // torproject.org.
   static const char* kBadPath[] = {
     "sha1/4BjDjn8v2lWeUFQnqSs0BgbIcrU=",
     "sha1/gzuEEAB/bkqdQS3EIjk2by7lW+k=",
     "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=",
     NULL,
   };
 
-  std::vector<net::SHA1Fingerprint> good_hashes, bad_hashes;
+  std::vector<net::Fingerprint> good_hashes, bad_hashes;
 
   for (size_t i = 0; kGoodPath[i]; i++) {
     EXPECT_TRUE(AddHash(kGoodPath[i], &good_hashes));
   }
   for (size_t i = 0; kBadPath[i]; i++) {
     EXPECT_TRUE(AddHash(kBadPath[i], &bad_hashes));
   }
 
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
@@ skipping 136 matching lines @@
   // Expect to fail for SNI hosts when not searching the SNI list:
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "gmail.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "googlegroups.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "www.googlegroups.com", false));
 }
 
 }  // namespace net