Extract the certificate to use in the download protection pingback.

chrome/browser/safe_browsing/download_protection_service.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/download_protection_service.h"
 
 #include "base/bind.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/histogram.h"
 #include "base/stl_util.h"
@@ skipping 98 matching lines @@
 
 class DownloadProtectionService::CheckClientDownloadRequest
     : public base::RefCountedThreadSafe<
           DownloadProtectionService::CheckClientDownloadRequest,
           BrowserThread::DeleteOnUIThread>,
       public content::URLFetcherDelegate {
  public:
   CheckClientDownloadRequest(const DownloadInfo& info,
                              const CheckDownloadCallback& callback,
                              DownloadProtectionService* service,
-                             SafeBrowsingService* sb_service)
+                             SafeBrowsingService* sb_service,
+                             SignatureUtil* signature_util)
       : info_(info),
         callback_(callback),
         service_(service),
+        signature_util_(signature_util),
         sb_service_(sb_service),
-        pingback_enabled_(service_->enabled()),
-        is_signed_(false) {
+        pingback_enabled_(service_->enabled()) {
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   }
 
   void Start() {
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
     // TODO(noelutz): implement some cache to make sure we don't issue the same
     // request over and over again if a user downloads the same binary multiple
     // times.
     if (info_.download_url_chain.empty()) {
       RecordStats(REASON_INVALID_URL);
@@ skipping 76 matching lines @@
  private:
   friend struct BrowserThread::DeleteOnThread<BrowserThread::UI>;
   friend class DeleteTask<CheckClientDownloadRequest>;
 
   virtual ~CheckClientDownloadRequest() {
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   }
 
   void ExtractFileFeatures() {
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
-    if (safe_browsing::signature_util::IsSigned(info_.local_file)) {
+    signature_util_->CheckSignature(info_.local_file, &signature_info_);
+    bool is_signed;
+    if (signature_info_.has_certificate_contents()) {
       VLOG(2) << "Downloaded a signed binary: " << info_.local_file.value();
-      is_signed_ = true;
+      is_signed = true;
     } else {
       VLOG(2) << "Downloaded an unsigned binary: " << info_.local_file.value();
-      is_signed_ = false;
+      is_signed = false;

[noelutz, 2011/11/04 04:41:11]

nit: I guess you don't really need that boolean anymore?

[Brian Ryner, 2011/11/04 22:20:30]

I left it as a convenience, that way we only need to write
|signature_info_.has_certificate_contents()| once.  However, I did simplify this
a bit just now by pulling the initialization all onto one line.

     }
-    UMA_HISTOGRAM_BOOLEAN("SBClientDownload.SignedBinaryDownload", is_signed_);
+    UMA_HISTOGRAM_BOOLEAN("SBClientDownload.SignedBinaryDownload", is_signed);
 
     // TODO(noelutz): DownloadInfo should also contain the IP address of every
     // URL in the redirect chain.  We also should check whether the download
     // URL is hosted on the internal network.
     BrowserThread::PostTask(
         BrowserThread::IO,
         FROM_HERE,
         base::Bind(&CheckClientDownloadRequest::CheckWhitelists, this));
   }
 
   void CheckWhitelists() {
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
     DownloadCheckResultReason reason = REASON_MAX;
     if (!sb_service_.get()) {
       reason = REASON_SB_DISABLED;
     } else {
       for (size_t i = 0; i < info_.download_url_chain.size(); ++i) {
         const GURL& url = info_.download_url_chain[i];
         if (url.is_valid() && sb_service_->MatchDownloadWhitelistUrl(url)) {
           reason = REASON_WHITELISTED_URL;
           break;
         }
       }
       if (info_.referrer_url.is_valid() && reason == REASON_MAX &&
           sb_service_->MatchDownloadWhitelistUrl(info_.referrer_url)) {
         reason = REASON_WHITELISTED_REFERRER;
       }
-      if (reason != REASON_MAX || is_signed_) {
+      if (reason != REASON_MAX || signature_info_.has_certificate_contents()) {
         UMA_HISTOGRAM_COUNTS("SBClientDownload.SignedOrWhitelistedDownload", 1);
       }
     }
     if (reason != REASON_MAX) {
       RecordStats(reason);
       PostFinishTask(SAFE);
     } else if (!pingback_enabled_) {
       RecordStats(REASON_SB_DISABLED);
       PostFinishTask(SAFE);
     } else {
@@ skipping 29 matching lines @@
       if (i == info_.download_url_chain.size() - 1) {
         // The last URL in the chain is the download URL.
         resource->set_type(ClientDownloadRequest::DOWNLOAD_URL);
         resource->set_referrer(info_.referrer_url.spec());
       } else {
         resource->set_type(ClientDownloadRequest::DOWNLOAD_REDIRECT);
       }
       // TODO(noelutz): fill out the remote IP addresses.
     }
     request.set_user_initiated(info_.user_initiated);
+    request.mutable_signature()->CopyFrom(signature_info_);
     std::string request_data;
     if (!request.SerializeToString(&request_data)) {
       RecordStats(REASON_INVALID_REQUEST_PROTO);
       FinishRequest(SAFE);
       return;
     }
 
     VLOG(2) << "Sending a request for URL: "
             << info_.download_url_chain.back();
     fetcher_.reset(content::URLFetcher::Create(0 /* ID used for testing */,
@@ skipping 23 matching lines @@
     }
   }
 
   void RecordStats(DownloadCheckResultReason reason) {
     UMA_HISTOGRAM_ENUMERATION("SBClientDownload.CheckDownloadStats",
                               reason,
                               REASON_MAX);
   }
 
   DownloadInfo info_;
+  ClientDownloadRequest_SignatureInfo signature_info_;
   CheckDownloadCallback callback_;
   // Will be NULL if the request has been canceled.
   DownloadProtectionService* service_;
+  scoped_refptr<SignatureUtil> signature_util_;
   scoped_refptr<SafeBrowsingService> sb_service_;
   const bool pingback_enabled_;
-  bool is_signed_;
   scoped_ptr<content::URLFetcher> fetcher_;
 
   DISALLOW_COPY_AND_ASSIGN(CheckClientDownloadRequest);
 };
 
 DownloadProtectionService::DownloadProtectionService(
     SafeBrowsingService* sb_service,
     net::URLRequestContextGetter* request_context_getter)
     : sb_service_(sb_service),
       request_context_getter_(request_context_getter),
-      enabled_(false) {}
+      enabled_(false),
+      signature_util_(new SignatureUtil()) {}
 
 DownloadProtectionService::~DownloadProtectionService() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   CancelPendingRequests();
 }
 
 void DownloadProtectionService::SetEnabled(bool enabled) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   if (enabled == enabled_) {
     return;
   }
   enabled_ = enabled;
   if (!enabled_) {
     CancelPendingRequests();
   }
 }
 
 void DownloadProtectionService::CheckClientDownload(
     const DownloadProtectionService::DownloadInfo& info,
     const CheckDownloadCallback& callback) {
   scoped_refptr<CheckClientDownloadRequest> request(
-      new CheckClientDownloadRequest(info, callback, this, sb_service_));
+      new CheckClientDownloadRequest(info, callback, this,
+                                     sb_service_, signature_util_.get()));
   download_requests_.insert(request);
   request->Start();
 }
 
 void DownloadProtectionService::CancelPendingRequests() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   for (std::set<scoped_refptr<CheckClientDownloadRequest> >::iterator it =
            download_requests_.begin();
        it != download_requests_.end(); ++it) {
     (*it)->Cancel();
   }
   download_requests_.clear();
 }
 
 void DownloadProtectionService::RequestFinished(
     CheckClientDownloadRequest* request) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   std::set<scoped_refptr<CheckClientDownloadRequest> >::iterator it =
       download_requests_.find(request);
   DCHECK(it != download_requests_.end());
   download_requests_.erase(*it);
 }
 
 }  // namespace safe_browsing