Initial support for HSTS certificate locking. This isn't a finished work, but

chrome/browser/ui/webui/net_internals_ui.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/net_internals_ui.h"
 
 #include <algorithm>
 #include <string>
 #include <utility>
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/memory/singleton.h"
 #include "base/message_loop.h"
 #include "base/path_service.h"
 #include "base/string_number_conversions.h"
 #include "base/string_piece.h"
+#include "base/string_split.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/io_thread.h"
 #include "chrome/browser/net/chrome_net_log.h"
 #include "chrome/browser/net/connection_tester.h"
 #include "chrome/browser/net/passive_log_collector.h"
 #include "chrome/browser/net/url_fixer_upper.h"
 #include "chrome/browser/platform_util.h"
@@ skipping 1029 matching lines @@
       net::TransportSecurityState::DomainState state;
       const bool found = transport_security_state->IsEnabledForHost(
           &state, domain);
 
       result->SetBoolean("result", found);
       if (found) {
         result->SetInteger("mode", static_cast<int>(state.mode));
         result->SetBoolean("subdomains", state.include_subdomains);
         result->SetBoolean("preloaded", state.preloaded);
         result->SetString("domain", state.domain);
+        result->SetString("cert_pins",
+                          JoinString(state.cert_pins, ','));
       }
     }
   }
 
   CallJavascriptFunction(L"g_browser.receivedHSTSResult", result);
 }
 
 void NetInternalsMessageHandler::IOThreadImpl::OnHSTSAdd(
     const ListValue* list) {
-  // |list| should be: [<domain to query>, <include subdomains>].
+  // |list| should be: [<domain to query>, <include subdomains>, <cert pins>].
   std::string domain;
   CHECK(list->GetString(0, &domain));
   if (!IsStringASCII(domain)) {
     // Silently fail. The user will get a helpful error if they query for the
     // name.
     return;
   }
   bool include_subdomains;
   CHECK(list->GetBoolean(1, &include_subdomains));
+  std::string cert_pins_str;
+  CHECK(list->GetString(2, &cert_pins_str));
 
   net::TransportSecurityState* transport_security_state =
       context_getter_->GetURLRequestContext()->transport_security_state();
   if (!transport_security_state)
     return;
 
   net::TransportSecurityState::DomainState state;
   state.expiry = state.created + base::TimeDelta::FromDays(1000);
   state.include_subdomains = include_subdomains;
+  state.cert_pins.clear();
+  if (!cert_pins_str.empty()) {
+    std::vector<std::string> cert_pins;
+    base::SplitString(cert_pins_str, ',', &cert_pins);
+    std::vector<std::string>::const_iterator i = cert_pins.begin();
+    for (; i != cert_pins.end(); ++i) {
+      std::string pin = *i;
+      RemoveChars(pin, " \t\r\n", &pin);
+      StringToLowerASCII(&pin);
+      state.cert_pins.push_back(pin);
+    }
+  }
 
   transport_security_state->EnableHost(domain, state);
 }
 
 void NetInternalsMessageHandler::IOThreadImpl::OnHSTSDelete(
     const ListValue* list) {
   // |list| should be: [<domain to query>].
   std::string domain;
   CHECK(list->GetString(0, &domain));
   if (!IsStringASCII(domain)) {
@@ skipping 273 matching lines @@
 ////////////////////////////////////////////////////////////////////////////////
 
 NetInternalsUI::NetInternalsUI(TabContents* contents) : WebUI(contents) {
   AddMessageHandler((new NetInternalsMessageHandler())->Attach(this));
 
   NetInternalsHTMLSource* html_source = new NetInternalsHTMLSource();
 
   // Set up the chrome://net-internals/ source.
   contents->profile()->GetChromeURLDataManager()->AddDataSource(html_source);
 }