Encrypt certificate reports before uploading to HTTP URLs

chrome/browser/net/certificate_error_reporter.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_NET_CERTIFICATE_ERROR_REPORTER_H_
 #define CHROME_BROWSER_NET_CERTIFICATE_ERROR_REPORTER_H_
 
 #include <set>
 #include <string>
 
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "net/url_request/url_request.h"
 #include "url/gurl.h"
 
 namespace net {
 class URLRequestContext;
 class SSLInfo;
 }
 
 namespace chrome_browser_net {
 
 class CertLoggerRequest;
+class EncryptedCertLoggerRequest;
+
+// Used by tests.
+bool DecryptCertificateErrorReport(

[agl, 2015/04/21 20:28:25]

Could this be a static method on CertificateErrorReporter? It's a tad odd to
have it at the top-level of a namespace.

[estark, 2015/04/22 03:55:30]

Done. (Sorry, missed that in your first review.)

+    const uint8 server_private_key[32],
+    const EncryptedCertLoggerRequest& encrypted_report,
+    CertLoggerRequest* decrypted_report);
 
 // Provides functionality for sending reports about invalid SSL
 // certificate chains to a report collection server.
 class CertificateErrorReporter : public net::URLRequest::Delegate {
  public:
   // These represent the types of reports that can be sent.
   enum ReportType {
     // A report of a certificate chain that failed a certificate pinning
     // check.
     REPORT_TYPE_PINNING_VIOLATION,
     // A report for an invalid certificate chain that is being sent for
     // a user who has opted-in to the extended reporting program.
     REPORT_TYPE_EXTENDED_REPORTING
   };
 
   // Represents whether or not to send cookies along with reports sent
   // to the server.
   enum CookiesPreference { SEND_COOKIES, DO_NOT_SEND_COOKIES };
 
   // Create a certificate error reporter that will send certificate
   // error reports to |upload_url|, using |request_context| as the
   // context for the reports. |cookies_preference| controls whether
   // cookies will be sent along with the reports.
   CertificateErrorReporter(net::URLRequestContext* request_context,
                            const GURL& upload_url,
                            CookiesPreference cookies_preference);
 
+  // Allows tests to use a server public key with known private key.
+  CertificateErrorReporter(net::URLRequestContext* request_context,
+                           const GURL& upload_url,
+                           CookiesPreference cookies_preference,
+                           const uint8 server_public_key[32],
+                           const uint32 server_public_key_version);
+
   ~CertificateErrorReporter() override;
 
   // Construct, serialize, and send a certificate report to the report
   // collection server containing the |ssl_info| associated with a
   // connection to |hostname|.
   //
   // SendReport actually sends the report over the network; callers are
   // responsible for enforcing any preconditions (such as obtaining user
   // opt-in, only sending reports for certain hostnames, checking for
   // incognito mode, etc.).
   virtual void SendReport(ReportType type,
                           const std::string& hostname,
                           const net::SSLInfo& ssl_info);
 
   // net::URLRequest::Delegate
   void OnResponseStarted(net::URLRequest* request) override;
   void OnReadCompleted(net::URLRequest* request, int bytes_read) override;
 
+  // On some platforms (but not all), CertificateErrorReporter can use
+  // an HTTP endpoint to send encrypted extended reporting reports. On
+  // unsupported platforms, callers must send extended reporting reports
+  // over SSL.
+  static bool IsHttpUploadUrlSupported();

[estark, 2015/04/18 05:24:42]

This seems weird to me but I'm not sure what else to do. I want to let users of
this class send reports over HTTPS when sending them encrypted over HTTP isn't
supported.

The name is weird because it only applies to extended reporting, not to Google
pinning violation reports, so maybe I should rename it to
IsHttpUploadUrlSupportedForExtendedReporting?

Open to other suggestions too... maybe users of this class shouldn't specify the
upload URL, and CertificateErrorReporter should just decide itself which URL to
use for a given report based on the report type and BoringSSL support.

+
  private:
   // Create a URLRequest with which to send a certificate report to the
   // server.
   virtual scoped_ptr<net::URLRequest> CreateURLRequest(
       net::URLRequestContext* context);
 
   // Serialize and send a CertLoggerRequest protobuf to the report
   // collection server.
   void SendCertLoggerRequest(const CertLoggerRequest& request);
 
+  void SendSerializedRequest(const std::string& serialized_request);
+
   // Populate the CertLoggerRequest for a report.
   static void BuildReport(const std::string& hostname,
                           const net::SSLInfo& ssl_info,
                           CertLoggerRequest* out_request);
 
   // Performs post-report cleanup.
   void RequestComplete(net::URLRequest* request);
 
   net::URLRequestContext* const request_context_;
   const GURL upload_url_;
 
   // Owns the contained requests.
   std::set<net::URLRequest*> inflight_requests_;
 
   CookiesPreference cookies_preference_;
 
+  const uint8* server_public_key_;
+  const uint32 server_public_key_version_;
+
   DISALLOW_COPY_AND_ASSIGN(CertificateErrorReporter);
 };
 
 }  // namespace chrome_browser_net
 
 #endif  // CHROME_BROWSER_NET_CERTIFICATE_ERROR_REPORTER_H_