Report second-level domains for UMA on pin failure.

net/base/transport_security_state.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ecdsa.h>
 #include <openssl/ssl.h>
 #else  // !defined(USE_OPENSSL)
 #include <nspr.h>
 
 #include <cryptohi.h>
 #include <hasht.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #endif
 
 #include "base/base64.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/metrics/histogram.h"
 #include "base/sha1.h"
 #include "base/string_number_conversions.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
 #include "crypto/sha2.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/dns_util.h"
 
@@ skipping 207 matching lines @@
         if (!LowerCaseEqualsASCII(tokenizer.token(), "max-age"))
           return false;
         state = AFTER_MAX_AGE_LABEL;
         break;
 
       case AFTER_MAX_AGE_LABEL:
         if (IsAsciiWhitespace(*tokenizer.token_begin()))
           continue;
         if (*tokenizer.token_begin() != '=')
           return false;
-        DCHECK(tokenizer.token().length() ==  1);
+        DCHECK_EQ(tokenizer.token().length(), 1U);
         state = AFTER_MAX_AGE_EQUALS;
         break;
 
       case AFTER_MAX_AGE_EQUALS:
         if (IsAsciiWhitespace(*tokenizer.token_begin()))
           continue;
         if (!MaxAgeToInt(tokenizer.token_begin(),
                          tokenizer.token_end(),
                          &max_age_candidate))
           return false;
@@ skipping 538 matching lines @@
     // step 3(b)
     if (new_host[i + 1] == '-' ||
         new_host[i + label_length] == '-') {
       return std::string();
     }
   }
 
   return new_host;
 }
 
+// |ReportUMAOnPinFailure| uses these to report which domain was associated
+// with the public key pinning failure.
+//
+// DO NOT CHANGE THE ORDERING OF THESE NAMES OR REMOVE ANY OF THEM. Add new
+// domains at the END of the listing (but before DOMAIN_NUM_EVENTS).
+enum LowResolutionDomainName {

[wtc, 2011/10/27 22:21:42]

What does "low resolution" mean here?  Perhaps you should
call it "second level", the term you used in the bug report
and the CL's commit message.

[palmer, 2011/10/28 00:24:39]

Done.

+  DOMAIN_NOT_PINNED,
+
+  DOMAIN_GOOGLE_COM,
+  DOMAIN_ANDROID_COM,
+  DOMAIN_GOOGLE_ANALYTICS_COM,
+  DOMAIN_GOOGLEPLEX_COM,
+  DOMAIN_YTIMG_COM,
+  DOMAIN_GOOGLEUSERCONTENT_COM,
+  DOMAIN_YOUTUBE_COM,
+  DOMAIN_GOOGLEAPIS_COM,
+  DOMAIN_GOOGLEADSERVICES_COM,
+  DOMAIN_GOOGLECODE_COM,
+  DOMAIN_APPSPOT_COM,
+  DOMAIN_GOOGLESYNDICATION_COM,
+  DOMAIN_DOUBLECLICK_NET,
+  DOMAIN_GSTATIC_COM,
+  DOMAIN_GMAIL_COM,
+  DOMAIN_GOOGLEMAIL_COM,
+  DOMAIN_GOOGLEGROUPS_COM,
+
+  DOMAIN_TORPROJECT_ORG,
+
+  DOMAIN_TWITTER_COM,
+  DOMAIN_TWIMG_COM,
+  DOMAIN_AKAMAIHD_NET,

[wtc, 2011/10/27 22:21:42]

You seem to group the enum constants by company affiliation.
So DOMAIN_AKAMAIHD_NET should be its own group, separate
from the two Twitter domains.

[palmer, 2011/10/28 00:24:39]

Done.

+
+  // Boundary value for UMA_HISTOGRAM_ENUMERATION:
+  DOMAIN_NUM_EVENTS
+};
+
 struct HSTSPreload {
   uint8 length;
   bool include_subdomains;
   char dns_name[30];
   bool https_required;
   const char* const* required_hashes;
+  LowResolutionDomainName low_res_name;
 };
 
 static bool HasPreload(const struct HSTSPreload* entries, size_t num_entries,
                        const std::string& canonicalized_host, size_t i,
                        TransportSecurityState::DomainState* out, bool* ret) {
   for (size_t j = 0; j < num_entries; j++) {
     if (entries[j].length == canonicalized_host.size() - i &&
         memcmp(entries[j].dns_name, &canonicalized_host[i],
                entries[j].length) == 0) {
       if (!entries[j].include_subdomains && i != 0) {
@@ skipping 130 matching lines @@
 #if defined(OS_CHROMEOS)
   static const bool kTwitterHSTS = true;
 #else
   static const bool kTwitterHSTS = false;
 #endif
 
 // In the medium term this list is likely to just be hardcoded here. This
 // slightly odd form removes the need for additional relocations records.
 static const struct HSTSPreload kPreloadedSTS[] = {
   // (*.)google.com, iff using SSL must use an acceptable certificate.
-  {12, true, "\006google\003com", false, kGoogleAcceptableCerts },
+  {12, true, "\006google\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
   {25, true, "\013pinningtest\007appspot\003com", false,
-      kTestAcceptableCerts },
+      kTestAcceptableCerts, DOMAIN_APPSPOT_COM },
   // Now we force HTTPS for subtrees of google.com.
-  {19, true, "\006health\006google\003com", true, kGoogleAcceptableCerts },
-  {21, true, "\010checkout\006google\003com", true, kGoogleAcceptableCerts },
-  {19, true, "\006chrome\006google\003com", true, kGoogleAcceptableCerts },
-  {17, true, "\004docs\006google\003com", true, kGoogleAcceptableCerts },
-  {18, true, "\005sites\006google\003com", true, kGoogleAcceptableCerts },
+  {19, true, "\006health\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM  },
+  {21, true, "\010checkout\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
+  {19, true, "\006chrome\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
+  {17, true, "\004docs\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
+  {18, true, "\005sites\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
   {25, true, "\014spreadsheets\006google\003com", true,
-      kGoogleAcceptableCerts },
+      kGoogleAcceptableCerts, DOMAIN_GOOGLE_COM },
   {22, false, "\011appengine\006google\003com", true,
-      kGoogleAcceptableCerts },
-  {22, true, "\011encrypted\006google\003com", true, kGoogleAcceptableCerts },
-  {21, true, "\010accounts\006google\003com", true, kGoogleAcceptableCerts },
-  {21, true, "\010profiles\006google\003com", true, kGoogleAcceptableCerts },
-  {17, true, "\004mail\006google\003com", true, kGoogleAcceptableCerts },
+      kGoogleAcceptableCerts, DOMAIN_GOOGLE_COM },
+  {22, true, "\011encrypted\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
+  {21, true, "\010accounts\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
+  {21, true, "\010profiles\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
+  {17, true, "\004mail\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
   {23, true, "\012talkgadget\006google\003com", true,
-      kGoogleAcceptableCerts },
-  {17, true, "\004talk\006google\003com", true, kGoogleAcceptableCerts },
+      kGoogleAcceptableCerts, DOMAIN_GOOGLE_COM },
+  {17, true, "\004talk\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
   {29, true, "\020hostedtalkgadget\006google\003com", true,
-      kGoogleAcceptableCerts },
-  {17, true, "\004plus\006google\003com", true, kGoogleAcceptableCerts },
+      kGoogleAcceptableCerts, DOMAIN_GOOGLE_COM },
+  {17, true, "\004plus\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
   // Other Google-related domains that must use HTTPS.
-  {20, true, "\006market\007android\003com", true, kGoogleAcceptableCerts },
+  {20, true, "\006market\007android\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_ANDROID_COM },
   {26, true, "\003ssl\020google-analytics\003com", true,
-      kGoogleAcceptableCerts },
-  {18, true, "\005drive\006google\003com", true, kGoogleAcceptableCerts },
-  {16, true, "\012googleplex\003com", true, kGoogleAcceptableCerts },
-  {19, true, "\006groups\006google\003com", true, kGoogleAcceptableCerts },
+      kGoogleAcceptableCerts, DOMAIN_GOOGLE_ANALYTICS_COM },
+  {18, true, "\005drive\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
+  {16, true, "\012googleplex\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLEPLEX_COM },
+  {19, true, "\006groups\006google\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLE_COM },
   // Other Google-related domains that must use an acceptable certificate
   // iff using SSL.
-  {11, true, "\005ytimg\003com", false, kGoogleAcceptableCerts },
-  {23, true, "\021googleusercontent\003com", false, kGoogleAcceptableCerts },
-  {13, true, "\007youtube\003com", false, kGoogleAcceptableCerts },
-  {16, true, "\012googleapis\003com", false, kGoogleAcceptableCerts },
-  {22, true, "\020googleadservices\003com", false, kGoogleAcceptableCerts },
-  {16, true, "\012googlecode\003com", false, kGoogleAcceptableCerts },
-  {13, true, "\007appspot\003com", false, kGoogleAcceptableCerts },
-  {23, true, "\021googlesyndication\003com", false, kGoogleAcceptableCerts },
-  {17, true, "\013doubleclick\003net", false, kGoogleAcceptableCerts },
-  {17, true, "\003ssl\007gstatic\003com", false, kGoogleAcceptableCerts },
+  {11, true, "\005ytimg\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_YTIMG_COM },
+  {23, true, "\021googleusercontent\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLEUSERCONTENT_COM },
+  {13, true, "\007youtube\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_YOUTUBE_COM },
+  {16, true, "\012googleapis\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLEAPIS_COM },
+  {22, true, "\020googleadservices\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLEADSERVICES_COM },
+  {16, true, "\012googlecode\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLECODE_COM },
+  {13, true, "\007appspot\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_APPSPOT_COM },
+  {23, true, "\021googlesyndication\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLESYNDICATION_COM },
+  {17, true, "\013doubleclick\003net", false, kGoogleAcceptableCerts,
+      DOMAIN_DOUBLECLICK_NET },
+  {17, true, "\003ssl\007gstatic\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_GSTATIC_COM },
   // Exclude the learn.doubleclick.net subdomain because it uses a different
   // CA.
-  {23, true, "\005learn\013doubleclick\003net", false, 0 },
+  {23, true, "\005learn\013doubleclick\003net", false, 0,
+      DOMAIN_DOUBLECLICK_NET },

[wtc, 2011/10/27 22:21:42]

This should be DOMAIN_NOT_PINNED because its required_hashes
field is 0.

[palmer, 2011/10/28 00:24:39]

Done.

   // Now we force HTTPS for other sites that have requested it.
-  {16, false, "\003www\006paypal\003com", true, 0 },
-  {16, false, "\003www\006elanex\003biz", true, 0 },
-  {12, true,  "\006jottit\003com", true, 0 },
-  {19, true,  "\015sunshinepress\003org", true, 0 },
-  {21, false, "\003www\013noisebridge\003net", true, 0 },
-  {10, false, "\004neg9\003org", true, 0 },
-  {12, true, "\006riseup\003net", true, 0 },
-  {11, false, "\006factor\002cc", true, 0 },
-  {22, false, "\007members\010mayfirst\003org", true, 0 },
-  {22, false, "\007support\010mayfirst\003org", true, 0 },
-  {17, false, "\002id\010mayfirst\003org", true, 0 },
-  {20, false, "\005lists\010mayfirst\003org", true, 0 },
-  {19, true, "\015splendidbacon\003com", true, 0 },
-  {28, false, "\016aladdinschools\007appspot\003com", true, 0 },
-  {14, true, "\011ottospora\002nl", true, 0 },
-  {25, false, "\003www\017paycheckrecords\003com", true, 0 },
-  {14, false, "\010lastpass\003com", true, 0 },
-  {18, false, "\003www\010lastpass\003com", true, 0 },
-  {14, true, "\010keyerror\003com", true, 0 },
-  {13, false, "\010entropia\002de", true, 0 },
-  {17, false, "\003www\010entropia\002de", true, 0 },
-  {11, true, "\005romab\003com", true, 0 },
-  {16, false, "\012logentries\003com", true, 0 },
-  {20, false, "\003www\012logentries\003com", true, 0 },
-  {12, true, "\006stripe\003com", true, 0 },
-  {27, true, "\025cloudsecurityalliance\003org", true, 0 },
-  {15, true, "\005login\004sapo\002pt", true, 0 },
-  {19, true, "\015mattmccutchen\003net", true, 0 },
-  {11, true, "\006betnet\002fr", true, 0 },
-  {13, true, "\010uprotect\002it", true, 0 },
-  {14, false, "\010squareup\003com", true, 0 },
-  {9, true, "\004cert\002se", true, 0 },
-  {11, true, "\006crypto\002is", true, 0 },
-  {20, true, "\005simon\007butcher\004name", true, 0 },
-  {10, true, "\004linx\003net", true, 0 },
-  {13, false, "\007dropcam\003com", true, 0 },
-  {17, false, "\003www\007dropcam\003com", true, 0 },
-  {30, true, "\010ebanking\014indovinabank\003com\002vn", true, 0 },
-  {13, false, "\007epoxate\003com", true, 0 },
-  {16, false, "\012torproject\003org", true, kTorAcceptableCerts },
-  {21, true, "\004blog\012torproject\003org", true, kTorAcceptableCerts },
-  {22, true, "\005check\012torproject\003org", true, kTorAcceptableCerts },
-  {20, true, "\003www\012torproject\003org", true, kTorAcceptableCerts },
-  {22, true, "\003www\014moneybookers\003com", true, 0 },
-  {17, false, "\013ledgerscope\003net", true, 0 },
-  {21, false, "\003www\013ledgerscope\003net", true, 0 },
-  {10, false, "\004kyps\003net", true, 0 },
-  {14, false, "\003www\004kyps\003net", true, 0 },
-  {17, true, "\003app\007recurly\003com", true, 0 },
-  {17, true, "\003api\007recurly\003com", true, 0 },
-  {13, false, "\007greplin\003com", true, 0 },
-  {17, false, "\003www\007greplin\003com", true, 0 },
-  {27, true, "\006luneta\016nearbuysystems\003com", true, 0 },
-  {12, true, "\006ubertt\003org", true, 0 },
-
-  {13, false, "\007twitter\003com", kTwitterHSTS, kTwitterComAcceptableCerts },
-  {17, true, "\003www\007twitter\003com", kTwitterHSTS, kTwitterComAcceptableCerts },
-  {17, true, "\003api\007twitter\003com", kTwitterHSTS, kTwitterComAcceptableCerts },
-  {19, true, "\005oauth\007twitter\003com", kTwitterHSTS, kTwitterComAcceptableCerts },
-  {20, true, "\006mobile\007twitter\003com", kTwitterHSTS, kTwitterComAcceptableCerts },
-  {17, true, "\003dev\007twitter\003com", kTwitterHSTS, kTwitterComAcceptableCerts },
-  {22, true, "\010business\007twitter\003com", kTwitterHSTS, kTwitterComAcceptableCerts },
+  {16, false, "\003www\006paypal\003com", true, 0, DOMAIN_NOT_PINNED },
+  {16, false, "\003www\006elanex\003biz", true, 0, DOMAIN_NOT_PINNED },
+  {12, true,  "\006jottit\003com", true, 0, DOMAIN_NOT_PINNED },
+  {19, true,  "\015sunshinepress\003org", true, 0, DOMAIN_NOT_PINNED },
+  {21, false, "\003www\013noisebridge\003net", true, 0,
+      DOMAIN_NOT_PINNED },
+  {10, false, "\004neg9\003org", true, 0, DOMAIN_NOT_PINNED },
+  {12, true, "\006riseup\003net", true, 0, DOMAIN_NOT_PINNED },
+  {11, false, "\006factor\002cc", true, 0, DOMAIN_NOT_PINNED },
+  {22, false, "\007members\010mayfirst\003org", true, 0, DOMAIN_NOT_PINNED },
+  {22, false, "\007support\010mayfirst\003org", true, 0, DOMAIN_NOT_PINNED },
+  {17, false, "\002id\010mayfirst\003org", true, 0, DOMAIN_NOT_PINNED },
+  {20, false, "\005lists\010mayfirst\003org", true, 0, DOMAIN_NOT_PINNED },
+  {19, true, "\015splendidbacon\003com", true, 0, DOMAIN_NOT_PINNED },
+  {28, false, "\016aladdinschools\007appspot\003com", true, 0,
+      DOMAIN_APPSPOT_COM },

[wtc, 2011/10/27 22:21:42]

This should be DOMAIN_NOT_PINNED for the same reason.

[palmer, 2011/10/28 00:24:39]

Done.

+  {14, true, "\011ottospora\002nl", true, 0, DOMAIN_NOT_PINNED },
+  {25, false, "\003www\017paycheckrecords\003com", true, 0,
+      DOMAIN_NOT_PINNED },
+  {14, false, "\010lastpass\003com", true, 0, DOMAIN_NOT_PINNED },
+  {18, false, "\003www\010lastpass\003com", true, 0, DOMAIN_NOT_PINNED },
+  {14, true, "\010keyerror\003com", true, 0, DOMAIN_NOT_PINNED },
+  {13, false, "\010entropia\002de", true, 0, DOMAIN_NOT_PINNED },
+  {17, false, "\003www\010entropia\002de", true, 0, DOMAIN_NOT_PINNED },
+  {11, true, "\005romab\003com", true, 0, DOMAIN_NOT_PINNED },
+  {16, false, "\012logentries\003com", true, 0, DOMAIN_NOT_PINNED },
+  {20, false, "\003www\012logentries\003com", true, 0, DOMAIN_NOT_PINNED },
+  {12, true, "\006stripe\003com", true, 0, DOMAIN_NOT_PINNED },
+  {27, true, "\025cloudsecurityalliance\003org", true, 0,
+      DOMAIN_NOT_PINNED },
+  {15, true, "\005login\004sapo\002pt", true, 0, DOMAIN_NOT_PINNED },
+  {19, true, "\015mattmccutchen\003net", true, 0, DOMAIN_NOT_PINNED },
+  {11, true, "\006betnet\002fr", true, 0, DOMAIN_NOT_PINNED },
+  {13, true, "\010uprotect\002it", true, 0, DOMAIN_NOT_PINNED },
+  {14, false, "\010squareup\003com", true, 0, DOMAIN_NOT_PINNED },
+  {9, true, "\004cert\002se", true, 0, DOMAIN_NOT_PINNED },
+  {11, true, "\006crypto\002is", true, 0, DOMAIN_NOT_PINNED },
+  {20, true, "\005simon\007butcher\004name", true, 0, DOMAIN_NOT_PINNED },
+  {10, true, "\004linx\003net", true, 0, DOMAIN_NOT_PINNED },
+  {13, false, "\007dropcam\003com", true, 0, DOMAIN_NOT_PINNED },
+  {17, false, "\003www\007dropcam\003com", true, 0, DOMAIN_NOT_PINNED },
+  {30, true, "\010ebanking\014indovinabank\003com\002vn", true, 0,
+      DOMAIN_NOT_PINNED },
+  {13, false, "\007epoxate\003com", true, 0, DOMAIN_NOT_PINNED },
+  {16, false, "\012torproject\003org", true, kTorAcceptableCerts,
+      DOMAIN_TORPROJECT_ORG },
+  {21, true, "\004blog\012torproject\003org", true, kTorAcceptableCerts,
+      DOMAIN_TORPROJECT_ORG },
+  {22, true, "\005check\012torproject\003org", true, kTorAcceptableCerts,
+      DOMAIN_TORPROJECT_ORG },
+  {20, true, "\003www\012torproject\003org", true, kTorAcceptableCerts,
+      DOMAIN_TORPROJECT_ORG },
+  {22, true, "\003www\014moneybookers\003com", true, 0,
+      DOMAIN_NOT_PINNED },
+  {17, false, "\013ledgerscope\003net", true, 0, DOMAIN_NOT_PINNED },
+  {21, false, "\003www\013ledgerscope\003net", true, 0,
+      DOMAIN_NOT_PINNED },
+  {10, false, "\004kyps\003net", true, 0, DOMAIN_NOT_PINNED },
+  {14, false, "\003www\004kyps\003net", true, 0, DOMAIN_NOT_PINNED },
+  {17, true, "\003app\007recurly\003com", true, 0, DOMAIN_NOT_PINNED },
+  {17, true, "\003api\007recurly\003com", true, 0, DOMAIN_NOT_PINNED },
+  {13, false, "\007greplin\003com", true, 0, DOMAIN_NOT_PINNED },
+  {17, false, "\003www\007greplin\003com", true, 0, DOMAIN_NOT_PINNED },
+  {27, true, "\006luneta\016nearbuysystems\003com", true, 0,
+      DOMAIN_NOT_PINNED },
+  {12, true, "\006ubertt\003org", true, 0, DOMAIN_NOT_PINNED },
+
+  {13, false, "\007twitter\003com", kTwitterHSTS,
+      kTwitterComAcceptableCerts, DOMAIN_TWITTER_COM },
+  {17, true, "\003www\007twitter\003com", kTwitterHSTS,
+      kTwitterComAcceptableCerts, DOMAIN_TWITTER_COM },
+  {17, true, "\003api\007twitter\003com", kTwitterHSTS,
+      kTwitterComAcceptableCerts, DOMAIN_TWITTER_COM },
+  {19, true, "\005oauth\007twitter\003com", kTwitterHSTS,
+      kTwitterComAcceptableCerts, DOMAIN_TWITTER_COM },
+  {20, true, "\006mobile\007twitter\003com", kTwitterHSTS,
+      kTwitterComAcceptableCerts, DOMAIN_TWITTER_COM },
+  {17, true, "\003dev\007twitter\003com", kTwitterHSTS,
+      kTwitterComAcceptableCerts, DOMAIN_TWITTER_COM },
+  {22, true, "\010business\007twitter\003com", kTwitterHSTS,
+      kTwitterComAcceptableCerts, DOMAIN_TWITTER_COM },
 
 #if 0
   // Twitter CDN pins disabled in order to track down pinning failures --agl
-  {22, true, "\010platform\007twitter\003com", false, kTwitterCDNAcceptableCerts },
-  {15, true, "\003si0\005twimg\003com", false, kTwitterCDNAcceptableCerts },
-  {23, true, "\010twimg0-a\010akamaihd\003net", false, kTwitterCDNAcceptableCerts },
+  {22, true, "\010platform\007twitter\003com", false,
+      kTwitterCDNAcceptableCerts, DOMAIN_TWITTER_COM },
+  {15, true, "\003si0\005twimg\003com", false, kTwitterCDNAcceptableCerts,
+      DOMAIN_TWIMG_COM },
+  {23, true, "\010twimg0-a\010akamaihd\003net", false,
+      kTwitterCDNAcceptableCerts, DOMAIN_AKAMAIHD_NET },
 #endif
 };
 static const size_t kNumPreloadedSTS = ARRAYSIZE_UNSAFE(kPreloadedSTS);
 
 static const struct HSTSPreload kPreloadedSNISTS[] = {
   // These SNI-only domains must always use HTTPS.
-  {11, false, "\005gmail\003com", true, kGoogleAcceptableCerts },
-  {16, false, "\012googlemail\003com", true, kGoogleAcceptableCerts },
-  {15, false, "\003www\005gmail\003com", true, kGoogleAcceptableCerts },
-  {20, false, "\003www\012googlemail\003com", true, kGoogleAcceptableCerts },
+  {11, false, "\005gmail\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GMAIL_COM },
+  {16, false, "\012googlemail\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLEMAIL_COM },
+  {15, false, "\003www\005gmail\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GMAIL_COM },
+  {20, false, "\003www\012googlemail\003com", true, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLEMAIL_COM },
   // These SNI-only domains must use an acceptable certificate iff using
   // HTTPS.
-  {22, true, "\020google-analytics\003com", false, kGoogleAcceptableCerts },
+  {22, true, "\020google-analytics\003com", false, kGoogleAcceptableCerts,
+     DOMAIN_GOOGLE_ANALYTICS_COM },
   // www. requires SNI.
-  {18, true, "\014googlegroups\003com", false, kGoogleAcceptableCerts },
+  {18, true, "\014googlegroups\003com", false, kGoogleAcceptableCerts,
+      DOMAIN_GOOGLEGROUPS_COM },
 };
 static const size_t kNumPreloadedSNISTS = ARRAYSIZE_UNSAFE(kPreloadedSNISTS);
 
-// Returns true if there is an HSTSPreload entry for the host in |entries|, and
-// if its |required_hashes| member is identical (by address) to |certs|.
-static bool ScanForHostAndCerts(
+// Returns the HSTSPreload entry for the |canonicalized_host| in |entries|,
+// or NULL if there is none. Prefers exact hostname matches to those that
+// match only because HSTSPreload.include_subdomains is true.
+//
+// |canonicalized_host| should be the hostname as canonicalized by
+// CanonicalizeHost.
+static const struct HSTSPreload* GetHSTSPreload(
     const std::string& canonicalized_host,
     const struct HSTSPreload* entries,
-    size_t num_entries,
-    const char* const certs[]) {
-  bool hit = false;
+    size_t num_entries) {
+  const struct HSTSPreload* hit = NULL;
 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     for (size_t j = 0; j < num_entries; j++) {
-      const struct HSTSPreload& entry = entries[j];
-
-      if (i != 0 && !entry.include_subdomains)
+      const struct HSTSPreload* entry = entries + j;
+
+      if (i != 0 && !entry->include_subdomains)
         continue;
 
-      if (entry.length == canonicalized_host.size() - i &&
-          memcmp(entry.dns_name, &canonicalized_host[i], entry.length) == 0) {
-        hit = entry.required_hashes == certs;
-        // Return immediately upon exact match:
+      if (entry->length == canonicalized_host.size() - i &&
+          memcmp(entry->dns_name, &canonicalized_host[i], entry->length) == 0) {
+        // Return immediately upon exact match.
         if (i == 0)
-          return hit;
+          return entry;
+        hit = entry;

[wtc, 2011/10/27 22:21:42]

It seems that we should always return entry here, for any i.
I don't see why we should continue either the inner or outer
loop if i != 0.

1. If we should continue the inner loop, that means there
may be duplicate entries in the HSTSPreload array.

2. If we should continue the outer loop, that means a
less exact match of a lower resolution domain is preferrable.

Neither of these seems right.

[palmer, 2011/10/28 00:24:39]

Yep, you are right! Thanks. Tests all still pass, as expected.

       }
     }
   }
 
   return hit;
 }
 
 // static
 bool TransportSecurityState::IsGooglePinnedProperty(const std::string& host,
                                                     bool sni_available) {
   std::string canonicalized_host = CanonicalizeHost(host);
+  const struct HSTSPreload* entry =
+      GetHSTSPreload(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS);
 
-  if (ScanForHostAndCerts(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS,
-                          kGoogleAcceptableCerts)) {
+  if (entry && entry->required_hashes == kGoogleAcceptableCerts)
     return true;
-  }
 
   if (sni_available) {
-    if (ScanForHostAndCerts(canonicalized_host, kPreloadedSNISTS, kNumPreloadedSNISTS,
-                            kGoogleAcceptableCerts)) {
+    entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS,
+                           kNumPreloadedSNISTS);
+    if (entry && entry->required_hashes == kGoogleAcceptableCerts)
       return true;
-    }
   }
 
   return false;
 }
 
+// static
+void TransportSecurityState::ReportUMAOnPinFailure(const std::string& host) {
+  std::string canonicalized_host = CanonicalizeHost(host);
+
+  const struct HSTSPreload* entry =
+      GetHSTSPreload(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS);
+
+  if (!entry) {
+    entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS,
+                           kNumPreloadedSNISTS);
+  }
+
+  DCHECK_NE(static_cast<const struct HSTSPreload*>(NULL), entry);

[wtc, 2011/10/27 22:21:42]

You may want to assert these two:
  DCHECK(entry->required_hashes);
  DCHECK(entry->low_res_name != DOMAIN_NOT_PINNED);

[palmer, 2011/10/28 00:24:39]

Done.

+
+  UMA_HISTOGRAM_ENUMERATION("SSL.PublicKeyPinFailure", entry->low_res_name,
+                            DOMAIN_NUM_EVENTS);
+}
 
 // IsPreloadedSTS returns true if the canonicalized hostname should always be
 // considered to have STS enabled.
 bool TransportSecurityState::IsPreloadedSTS(
     const std::string& canonicalized_host,
     bool sni_available,
     DomainState* out) {
   DCHECK(CalledOnValidThread());
 
   out->preloaded = true;
@@ skipping 66 matching lines @@
   }
 
   LOG(ERROR) << "Rejecting public key chain for domain " << domain
              << ". Validated chain: " << HashesToBase64String(hashes)
              << ", expected: " << HashesToBase64String(public_key_hashes);
 
   return false;
 }
 
 }  // namespace