Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(105)

Side by Side Diff: chrome/browser/net/transport_security_persister_unittest.cc

Issue 10827104: Revert 149261 - Support SHA-256 in public key pins for HTTPS. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src/
Patch Set: Created 8 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "chrome/browser/net/transport_security_persister.h" 5 #include "chrome/browser/net/transport_security_persister.h"
6 6
7 #include <map> 7 #include <map>
8 #include <string> 8 #include <string>
9 9
10 #include "base/file_path.h" 10 #include "base/file_path.h"
(...skipping 78 matching lines...) Expand 10 before | Expand all | Expand 10 after
89 TransportSecurityState::DomainState::MODE_FORCE_HTTPS); 89 TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
90 EXPECT_TRUE(state_.GetDomainState("foo.bar.baz.yahoo.com", true, 90 EXPECT_TRUE(state_.GetDomainState("foo.bar.baz.yahoo.com", true,
91 &domain_state)); 91 &domain_state));
92 EXPECT_EQ(domain_state.upgrade_mode, 92 EXPECT_EQ(domain_state.upgrade_mode,
93 TransportSecurityState::DomainState::MODE_FORCE_HTTPS); 93 TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
94 EXPECT_FALSE(state_.GetDomainState("com", true, &domain_state)); 94 EXPECT_FALSE(state_.GetDomainState("com", true, &domain_state));
95 } 95 }
96 96
97 TEST_F(TransportSecurityPersisterTest, SerializeData3) { 97 TEST_F(TransportSecurityPersisterTest, SerializeData3) {
98 // Add an entry. 98 // Add an entry.
99 net::HashValue fp1; 99 net::SHA1Fingerprint fp1;
100 fp1.tag = net::HASH_VALUE_SHA1; 100 memset(fp1.data, 0, sizeof(fp1.data));
101 memset(fp1.data(), 0, fp1.size()); 101 net::SHA1Fingerprint fp2;
102 net::HashValue fp2; 102 memset(fp2.data, 1, sizeof(fp2.data));
103 fp2.tag = net::HASH_VALUE_SHA1;
104 memset(fp2.data(), 1, fp2.size());
105 TransportSecurityState::DomainState example_state; 103 TransportSecurityState::DomainState example_state;
106 example_state.upgrade_expiry = 104 example_state.upgrade_expiry =
107 base::Time::Now() + base::TimeDelta::FromSeconds(1000); 105 base::Time::Now() + base::TimeDelta::FromSeconds(1000);
108 example_state.upgrade_mode = 106 example_state.upgrade_mode =
109 TransportSecurityState::DomainState::MODE_FORCE_HTTPS; 107 TransportSecurityState::DomainState::MODE_FORCE_HTTPS;
110 example_state.dynamic_spki_hashes_expiry = example_state.upgrade_expiry; 108 example_state.dynamic_spki_hashes_expiry = example_state.upgrade_expiry;
111 example_state.dynamic_spki_hashes.push_back(fp1); 109 example_state.dynamic_spki_hashes.push_back(fp1);
112 example_state.dynamic_spki_hashes.push_back(fp2); 110 example_state.dynamic_spki_hashes.push_back(fp2);
113 state_.EnableHost("www.example.com", example_state); 111 state_.EnableHost("www.example.com", example_state);
114 112
115 // Add another entry. 113 // Add another entry.
116 memset(fp1.data(), 2, fp1.size()); 114 memset(fp1.data, 2, sizeof(fp1.data));
117 memset(fp2.data(), 3, fp2.size()); 115 memset(fp2.data, 3, sizeof(fp2.data));
118 example_state.upgrade_expiry = 116 example_state.upgrade_expiry =
119 base::Time::Now() + base::TimeDelta::FromSeconds(3000); 117 base::Time::Now() + base::TimeDelta::FromSeconds(3000);
120 example_state.upgrade_mode = 118 example_state.upgrade_mode =
121 TransportSecurityState::DomainState::MODE_DEFAULT; 119 TransportSecurityState::DomainState::MODE_DEFAULT;
122 example_state.dynamic_spki_hashes_expiry = example_state.upgrade_expiry; 120 example_state.dynamic_spki_hashes_expiry = example_state.upgrade_expiry;
123 example_state.dynamic_spki_hashes.push_back(fp1); 121 example_state.dynamic_spki_hashes.push_back(fp1);
124 example_state.dynamic_spki_hashes.push_back(fp2); 122 example_state.dynamic_spki_hashes.push_back(fp2);
125 state_.EnableHost("www.example.net", example_state); 123 state_.EnableHost("www.example.net", example_state);
126 124
127 // Save a copy of everything. 125 // Save a copy of everything.
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after
176 "}"; 174 "}";
177 bool dirty; 175 bool dirty;
178 EXPECT_TRUE(persister_->LoadEntries(output, &dirty)); 176 EXPECT_TRUE(persister_->LoadEntries(output, &dirty));
179 EXPECT_TRUE(dirty); 177 EXPECT_TRUE(dirty);
180 } 178 }
181 179
182 TEST_F(TransportSecurityPersisterTest, PublicKeyHashes) { 180 TEST_F(TransportSecurityPersisterTest, PublicKeyHashes) {
183 TransportSecurityState::DomainState domain_state; 181 TransportSecurityState::DomainState domain_state;
184 static const char kTestDomain[] = "example.com"; 182 static const char kTestDomain[] = "example.com";
185 EXPECT_FALSE(state_.GetDomainState(kTestDomain, false, &domain_state)); 183 EXPECT_FALSE(state_.GetDomainState(kTestDomain, false, &domain_state));
186 net::HashValueVector hashes; 184 net::FingerprintVector hashes;
187 EXPECT_TRUE(domain_state.IsChainOfPublicKeysPermitted(hashes)); 185 EXPECT_TRUE(domain_state.IsChainOfPublicKeysPermitted(hashes));
188 186
189 net::HashValue hash; 187 net::SHA1Fingerprint hash;
190 hash.tag = net::HASH_VALUE_SHA1; 188 memset(hash.data, '1', sizeof(hash.data));
191 memset(hash.data(), '1', hash.size());
192 domain_state.static_spki_hashes.push_back(hash); 189 domain_state.static_spki_hashes.push_back(hash);
193 190
194 EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes)); 191 EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes));
195 hashes.push_back(hash); 192 hashes.push_back(hash);
196 EXPECT_TRUE(domain_state.IsChainOfPublicKeysPermitted(hashes)); 193 EXPECT_TRUE(domain_state.IsChainOfPublicKeysPermitted(hashes));
197 hashes[0].data()[0] = '2'; 194 hashes[0].data[0] = '2';
198 EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes)); 195 EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes));
199 196
200 const base::Time current_time(base::Time::Now()); 197 const base::Time current_time(base::Time::Now());
201 const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000); 198 const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
202 domain_state.upgrade_expiry = expiry; 199 domain_state.upgrade_expiry = expiry;
203 state_.EnableHost(kTestDomain, domain_state); 200 state_.EnableHost(kTestDomain, domain_state);
204 std::string ser; 201 std::string ser;
205 EXPECT_TRUE(persister_->SerializeData(&ser)); 202 EXPECT_TRUE(persister_->SerializeData(&ser));
206 bool dirty; 203 bool dirty;
207 EXPECT_TRUE(persister_->LoadEntries(ser, &dirty)); 204 EXPECT_TRUE(persister_->LoadEntries(ser, &dirty));
208 EXPECT_TRUE(state_.GetDomainState(kTestDomain, false, &domain_state)); 205 EXPECT_TRUE(state_.GetDomainState(kTestDomain, false, &domain_state));
209 EXPECT_EQ(1u, domain_state.static_spki_hashes.size()); 206 EXPECT_EQ(1u, domain_state.static_spki_hashes.size());
210 EXPECT_EQ(hash.tag, domain_state.static_spki_hashes[0].tag); 207 EXPECT_EQ(0, memcmp(domain_state.static_spki_hashes[0].data, hash.data,
211 EXPECT_EQ(0, memcmp(domain_state.static_spki_hashes[0].data(), hash.data(), 208 sizeof(hash.data)));
212 hash.size()));
213 } 209 }
214 210
215 TEST_F(TransportSecurityPersisterTest, ForcePreloads) { 211 TEST_F(TransportSecurityPersisterTest, ForcePreloads) {
216 // The static state for docs.google.com, defined in 212 // The static state for docs.google.com, defined in
217 // net/base/transport_security_state_static.h, has pins and mode strict. 213 // net/base/transport_security_state_static.h, has pins and mode strict.
218 // This new policy overrides that with no pins and a weaker mode. We apply 214 // This new policy overrides that with no pins and a weaker mode. We apply
219 // this new policy with |DeserializeFromCommandLine| and expect that the 215 // this new policy with |DeserializeFromCommandLine| and expect that the
220 // new policy is in effect, overriding the static policy. 216 // new policy is in effect, overriding the static policy.
221 std::string preload("{" 217 std::string preload("{"
222 "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {" 218 "\"4AGT3lHihuMSd5rUj7B4u6At0jlSH3HFePovjPR+oLE=\": {"
223 "\"created\": 0.0," 219 "\"created\": 0.0,"
224 "\"expiry\": 2000000000.0," 220 "\"expiry\": 2000000000.0,"
225 "\"include_subdomains\": false," 221 "\"include_subdomains\": false,"
226 "\"mode\": \"pinning-only\"" 222 "\"mode\": \"pinning-only\""
227 "}}"); 223 "}}");
228 224
229 EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload)); 225 EXPECT_TRUE(persister_->DeserializeFromCommandLine(preload));
230 226
231 TransportSecurityState::DomainState domain_state; 227 TransportSecurityState::DomainState domain_state;
232 EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state)); 228 EXPECT_TRUE(state_.GetDomainState("docs.google.com", true, &domain_state));
233 EXPECT_FALSE(domain_state.HasPins()); 229 EXPECT_FALSE(domain_state.HasPins());
234 EXPECT_FALSE(domain_state.ShouldRedirectHTTPToHTTPS()); 230 EXPECT_FALSE(domain_state.ShouldRedirectHTTPToHTTPS());
235 } 231 }
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698