OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/net/transport_security_persister.h" | 5 #include "chrome/browser/net/transport_security_persister.h" |
6 | 6 |
7 #include <map> | 7 #include <map> |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/file_path.h" | 10 #include "base/file_path.h" |
(...skipping 78 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
89 TransportSecurityState::DomainState::MODE_FORCE_HTTPS); | 89 TransportSecurityState::DomainState::MODE_FORCE_HTTPS); |
90 EXPECT_TRUE(state_.GetDomainState("foo.bar.baz.yahoo.com", true, | 90 EXPECT_TRUE(state_.GetDomainState("foo.bar.baz.yahoo.com", true, |
91 &domain_state)); | 91 &domain_state)); |
92 EXPECT_EQ(domain_state.upgrade_mode, | 92 EXPECT_EQ(domain_state.upgrade_mode, |
93 TransportSecurityState::DomainState::MODE_FORCE_HTTPS); | 93 TransportSecurityState::DomainState::MODE_FORCE_HTTPS); |
94 EXPECT_FALSE(state_.GetDomainState("com", true, &domain_state)); | 94 EXPECT_FALSE(state_.GetDomainState("com", true, &domain_state)); |
95 } | 95 } |
96 | 96 |
97 TEST_F(TransportSecurityPersisterTest, SerializeData3) { | 97 TEST_F(TransportSecurityPersisterTest, SerializeData3) { |
98 // Add an entry. | 98 // Add an entry. |
99 net::HashValue fp1; | 99 net::SHA1Fingerprint fp1; |
100 fp1.tag = net::HASH_VALUE_SHA1; | 100 memset(fp1.data, 0, sizeof(fp1.data)); |
101 memset(fp1.data(), 0, fp1.size()); | 101 net::SHA1Fingerprint fp2; |
102 net::HashValue fp2; | 102 memset(fp2.data, 1, sizeof(fp2.data)); |
103 fp2.tag = net::HASH_VALUE_SHA1; | |
104 memset(fp2.data(), 1, fp2.size()); | |
105 TransportSecurityState::DomainState example_state; | 103 TransportSecurityState::DomainState example_state; |
106 example_state.upgrade_expiry = | 104 example_state.upgrade_expiry = |
107 base::Time::Now() + base::TimeDelta::FromSeconds(1000); | 105 base::Time::Now() + base::TimeDelta::FromSeconds(1000); |
108 example_state.upgrade_mode = | 106 example_state.upgrade_mode = |
109 TransportSecurityState::DomainState::MODE_FORCE_HTTPS; | 107 TransportSecurityState::DomainState::MODE_FORCE_HTTPS; |
110 example_state.dynamic_spki_hashes_expiry = example_state.upgrade_expiry; | 108 example_state.dynamic_spki_hashes_expiry = example_state.upgrade_expiry; |
111 example_state.dynamic_spki_hashes.push_back(fp1); | 109 example_state.dynamic_spki_hashes.push_back(fp1); |
112 example_state.dynamic_spki_hashes.push_back(fp2); | 110 example_state.dynamic_spki_hashes.push_back(fp2); |
113 state_.EnableHost("www.example.com", example_state); | 111 state_.EnableHost("www.example.com", example_state); |
114 | 112 |
115 // Add another entry. | 113 // Add another entry. |
116 memset(fp1.data(), 2, fp1.size()); | 114 memset(fp1.data, 2, sizeof(fp1.data)); |
117 memset(fp2.data(), 3, fp2.size()); | 115 memset(fp2.data, 3, sizeof(fp2.data)); |
118 example_state.upgrade_expiry = | 116 example_state.upgrade_expiry = |
119 base::Time::Now() + base::TimeDelta::FromSeconds(3000); | 117 base::Time::Now() + base::TimeDelta::FromSeconds(3000); |
120 example_state.upgrade_mode = | 118 example_state.upgrade_mode = |
121 TransportSecurityState::DomainState::MODE_DEFAULT; | 119 TransportSecurityState::DomainState::MODE_DEFAULT; |
122 example_state.dynamic_spki_hashes_expiry = example_state.upgrade_expiry; | 120 example_state.dynamic_spki_hashes_expiry = example_state.upgrade_expiry; |
123 example_state.dynamic_spki_hashes.push_back(fp1); | 121 example_state.dynamic_spki_hashes.push_back(fp1); |
124 example_state.dynamic_spki_hashes.push_back(fp2); | 122 example_state.dynamic_spki_hashes.push_back(fp2); |
125 state_.EnableHost("www.example.net", example_state); | 123 state_.EnableHost("www.example.net", example_state); |
126 | 124 |
127 // Save a copy of everything. | 125 // Save a copy of everything. |
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
176 "}"; | 174 "}"; |
177 bool dirty; | 175 bool dirty; |
178 EXPECT_TRUE(persister_->LoadEntries(output, &dirty)); | 176 EXPECT_TRUE(persister_->LoadEntries(output, &dirty)); |
179 EXPECT_TRUE(dirty); | 177 EXPECT_TRUE(dirty); |
180 } | 178 } |
181 | 179 |
182 TEST_F(TransportSecurityPersisterTest, PublicKeyHashes) { | 180 TEST_F(TransportSecurityPersisterTest, PublicKeyHashes) { |
183 TransportSecurityState::DomainState domain_state; | 181 TransportSecurityState::DomainState domain_state; |
184 static const char kTestDomain[] = "example.com"; | 182 static const char kTestDomain[] = "example.com"; |
185 EXPECT_FALSE(state_.GetDomainState(kTestDomain, false, &domain_state)); | 183 EXPECT_FALSE(state_.GetDomainState(kTestDomain, false, &domain_state)); |
186 net::HashValueVector hashes; | 184 net::FingerprintVector hashes; |
187 EXPECT_TRUE(domain_state.IsChainOfPublicKeysPermitted(hashes)); | 185 EXPECT_TRUE(domain_state.IsChainOfPublicKeysPermitted(hashes)); |
188 | 186 |
189 net::HashValue hash; | 187 net::SHA1Fingerprint hash; |
190 hash.tag = net::HASH_VALUE_SHA1; | 188 memset(hash.data, '1', sizeof(hash.data)); |
191 memset(hash.data(), '1', hash.size()); | |
192 domain_state.static_spki_hashes.push_back(hash); | 189 domain_state.static_spki_hashes.push_back(hash); |
193 | 190 |
194 EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes)); | 191 EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes)); |
195 hashes.push_back(hash); | 192 hashes.push_back(hash); |
196 EXPECT_TRUE(domain_state.IsChainOfPublicKeysPermitted(hashes)); | 193 EXPECT_TRUE(domain_state.IsChainOfPublicKeysPermitted(hashes)); |
197 hashes[0].data()[0] = '2'; | 194 hashes[0].data[0] = '2'; |
198 EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes)); | 195 EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes)); |
199 | 196 |
200 const base::Time current_time(base::Time::Now()); | 197 const base::Time current_time(base::Time::Now()); |
201 const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000); | 198 const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000); |
202 domain_state.upgrade_expiry = expiry; | 199 domain_state.upgrade_expiry = expiry; |
203 state_.EnableHost(kTestDomain, domain_state); | 200 state_.EnableHost(kTestDomain, domain_state); |
204 std::string ser; | 201 std::string ser; |
205 EXPECT_TRUE(persister_->SerializeData(&ser)); | 202 EXPECT_TRUE(persister_->SerializeData(&ser)); |
206 bool dirty; | 203 bool dirty; |
207 EXPECT_TRUE(persister_->LoadEntries(ser, &dirty)); | 204 EXPECT_TRUE(persister_->LoadEntries(ser, &dirty)); |
208 EXPECT_TRUE(state_.GetDomainState(kTestDomain, false, &domain_state)); | 205 EXPECT_TRUE(state_.GetDomainState(kTestDomain, false, &domain_state)); |
209 EXPECT_EQ(1u, domain_state.static_spki_hashes.size()); | 206 EXPECT_EQ(1u, domain_state.static_spki_hashes.size()); |
210 EXPECT_EQ(hash.tag, domain_state.static_spki_hashes[0].tag); | 207 EXPECT_EQ(0, memcmp(domain_state.static_spki_hashes[0].data, hash.data, |
211 EXPECT_EQ(0, memcmp(domain_state.static_spki_hashes[0].data(), hash.data(), | 208 sizeof(hash.data))); |
212 hash.size())); | |
213 } | 209 } |
214 | 210 |
215 TEST_F(TransportSecurityPersisterTest, ForcePreloads) { | 211 TEST_F(TransportSecurityPersisterTest, ForcePreloads) { |
216 // The static state for docs.google.com, defined in | 212 // The static state for docs.google.com, defined in |
217 // net/base/transport_security_state_static.h, has pins and mode strict. | 213 // net/base/transport_security_state_static.h, has pins and mode strict. |
218 // This new policy overrides that with no pins and a weaker mode. We apply | 214 // This new policy overrides that with no pins and a weaker mode. We apply |
219 // this new policy with |DeserializeFromCommandLine| and expect that the | 215 // this new policy with |DeserializeFromCommandLine| and expect that the |
220 // new policy is in effect, overriding the static policy. | 216 // new policy is in effect, overriding the static policy. |
221 std::string preload("{" | 217 std::string preload("{" |
222 "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {" | 218 "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {" |
223 "\"created\": 0.0," | 219 "\"created\": 0.0," |
224 "\"expiry\": 2000000000.0," | 220 "\"expiry\": 2000000000.0," |
225 "\"include_subdomains\": false," | 221 "\"include_subdomains\": false," |
226 "\"mode\": \"pinning-only\"" | 222 "\"mode\": \"pinning-only\"" |
227 "}}"); | 223 "}}"); |
228 | 224 |
229 EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload)); | 225 EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload)); |
230 | 226 |
231 TransportSecurityState::DomainState domain_state; | 227 TransportSecurityState::DomainState domain_state; |
232 EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state)); | 228 EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state)); |
233 EXPECT_FALSE(domain_state.HasPins()); | 229 EXPECT_FALSE(domain_state.HasPins()); |
234 EXPECT_FALSE(domain_state.ShouldRedirectHTTPToHTTPS()); | 230 EXPECT_FALSE(domain_state.ShouldRedirectHTTPToHTTPS()); |
235 } | 231 } |
OLD | NEW |