Certificate Transparency: Fetching of Signed Tree Heads (DRAFT)

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <vector>
 
 #include "base/base64.h"
 #include "base/bind.h"
@@ skipping 22 matching lines @@
 #include "chrome/browser/net/chrome_net_log.h"
 #include "chrome/browser/net/chrome_network_delegate.h"
 #include "chrome/browser/net/connect_interceptor.h"
 #include "chrome/browser/net/dns_probe_service.h"
 #include "chrome/browser/net/pref_proxy_config_tracker.h"
 #include "chrome/browser/net/proxy_service_factory.h"
 #include "chrome/common/chrome_content_client.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/chrome_version_info.h"
 #include "chrome/common/pref_names.h"
+#include "components/certificate_transparency/log_proof_fetcher.h"
+#include "components/certificate_transparency/tree_state_tracker.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_prefs.h"
 #include "components/data_reduction_proxy/core/common/data_reduction_proxy_params.h"
 #include "components/policy/core/common/policy_service.h"
 #include "components/variations/variations_associated_data.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/cookie_store_factory.h"
 #include "net/base/host_mapping_rules.h"
 #include "net/base/net_util.h"
 #include "net/base/network_quality_estimator.h"
 #include "net/base/sdch_manager.h"
@@ skipping 624 matching lines @@
   // Creates a CertVerifyProc that doesn't allow any profile-provided certs.
   globals_->cert_verifier.reset(new net::MultiThreadedCertVerifier(
       new chromeos::CertVerifyProcChromeOS()));
 #else
   globals_->cert_verifier.reset(new net::MultiThreadedCertVerifier(
       net::CertVerifyProc::CreateDefault()));
 #endif
 
   globals_->transport_security_state.reset(new net::TransportSecurityState());
 
-  // TODO(erikchen): Remove ScopedTracker below once http://crbug.com/466432
-  // is fixed.
-  tracked_objects::ScopedTracker tracking_profile7(
-      FROM_HERE_WITH_EXPLICIT_FUNCTION(
-          "466432 IOThread::InitAsync::CreateMultiLogVerifier"));
-  net::MultiLogCTVerifier* ct_verifier = new net::MultiLogCTVerifier();
-  globals_->cert_transparency_verifier.reset(ct_verifier);
-
+  // Add built-in logs
   // TODO(erikchen): Remove ScopedTracker below once http://crbug.com/466432
   // is fixed.
   tracked_objects::ScopedTracker tracking_profile8(
       FROM_HERE_WITH_EXPLICIT_FUNCTION(
-          "466432 IOThread::InitAsync::CreateLogVerifiers::Start"));
-  // Add built-in logs
-  ct_verifier->AddLogs(net::ct::CreateLogVerifiersForKnownLogs());
+          "466432 IOThread::InitAsync::AddKnownLogs::Start"));
+  ScopedVector<net::CTLogVerifier> known_logs(
+      net::ct::CreateLogVerifiersForKnownLogs());
+  for (auto it = known_logs.begin(); it != known_logs.end(); ++it)

[Ryan Sleevi, 2015/06/29 11:58:12]

STYLE: "const auto&"

alternatively:
for (known_log : known_logs) {
  globals_->ct_logs.push_back(known_log);
}

[Eran Messeri, 2015/07/10 13:15:48]

Done.

+    globals_->ct_logs.push_back(linked_ptr<net::CTLogVerifier>(*it));
+  known_logs.weak_clear();
+
   // TODO(erikchen): Remove ScopedTracker below once http://crbug.com/466432
   // is fixed.
   tracked_objects::ScopedTracker tracking_profile9(
       FROM_HERE_WITH_EXPLICIT_FUNCTION(
-          "466432 IOThread::InitAsync::CreateLogVerifiers::End"));
+          "466432 IOThread::InitAsync::AddKnownLogs::End"));
 
   // Add logs from command line
   if (command_line.HasSwitch(switches::kCertificateTransparencyLog)) {
     std::string switch_value = command_line.GetSwitchValueASCII(
         switches::kCertificateTransparencyLog);
     std::vector<std::string> logs;
     base::SplitString(switch_value, ',', &logs);
     for (std::vector<std::string>::iterator it = logs.begin(); it != logs.end();
          ++it) {
       const std::string& curr_log = *it;
       std::vector<std::string> log_metadata;
       base::SplitString(curr_log, ':', &log_metadata);
       CHECK_GE(log_metadata.size(), 3u)
           << "CT log metadata missing: Switch format is "
           << "'description:base64_key:url_without_schema'.";
       std::string log_description(log_metadata[0]);
       std::string log_url(std::string("https://") + log_metadata[2]);
       std::string ct_public_key_data;
       CHECK(base::Base64Decode(log_metadata[1], &ct_public_key_data))
           << "Unable to decode CT public key.";
       scoped_ptr<net::CTLogVerifier> external_log_verifier(
           net::CTLogVerifier::Create(ct_public_key_data, log_description,
                                      log_url));
       CHECK(external_log_verifier) << "Unable to parse CT public key.";
       VLOG(1) << "Adding log with description " << log_description;
-      ct_verifier->AddLog(external_log_verifier.Pass());
+      globals_->ct_logs.push_back(
+          linked_ptr<net::CTLogVerifier>(external_log_verifier.release()));
     }
   }
 
+  net::MultiLogCTVerifier* ct_verifier = new net::MultiLogCTVerifier();
+  ct_verifier->AddLogs(globals_->ct_logs);
+  globals_->cert_transparency_verifier.reset(ct_verifier);
+
   // TODO(erikchen): Remove ScopedTracker below once http://crbug.com/466432
   // is fixed.
   tracked_objects::ScopedTracker tracking_profile10(
       FROM_HERE_WITH_EXPLICIT_FUNCTION(
           "466432 IOThread::InitAsync::CertPolicyEnforcer"));
   net::CertPolicyEnforcer* policy_enforcer = new net::CertPolicyEnforcer;
   globals_->cert_policy_enforcer.reset(policy_enforcer);
 
   globals_->ssl_config_service = GetSSLConfigService();
 
@@ skipping 164 matching lines @@
   base::debug::LeakTracker<SafeBrowsingURLRequestContext>::CheckForLeaks();
 
 #if defined(USE_NSS_CERTS) || defined(OS_IOS)
   net::ShutdownNSSHttpIO();
 #endif
 
   system_url_request_context_getter_ = NULL;
 
   // Release objects that the net::URLRequestContext could have been pointing
   // to.
+  globals()->cert_transparency_verifier->StopNotifications();
 
   // Shutdown the HistogramWatcher on the IO thread.
   net::NetworkChangeNotifier::ShutdownHistogramWatcher();
 
   // This must be reset before the ChromeNetLog is destroyed.
   network_change_observer_.reset();
 
   system_proxy_config_service_.reset();
 
   delete globals_;
@@ skipping 306 matching lines @@
       new net::HttpNetworkLayer(
           new net::HttpNetworkSession(system_params)));
   globals_->system_url_request_job_factory.reset(
       new net::URLRequestJobFactoryImpl());
   globals_->system_request_context.reset(
       ConstructSystemRequestContext(globals_, net_log_));
   globals_->system_request_context->set_ssl_config_service(
       globals_->ssl_config_service.get());
   globals_->system_request_context->set_http_server_properties(
       globals_->http_server_properties->GetWeakPtr());
+
+  VLOG(1) << "Creating TreeStateTracker observer on IOThread.";
+  scoped_ptr<certificate_transparency::LogProofFetcher> proof_fetcher(
+          new certificate_transparency::LogProofFetcher(
+              globals_->system_request_context.get()));
+
+  certificate_transparency::TreeStateTracker* scts_observer(
+      new certificate_transparency::TreeStateTracker(
+          proof_fetcher.Pass(), globals_->ct_logs));
+  globals_->cert_transparency_observer.reset(scts_observer);
+  // The |cert_transparency_verifier| is the same one held by
+  // the |proxy_script_fetcher_context| and |system_request_context|,
+  // so no need to set the observer in their cert_transparency_verifiers.
+  globals_->cert_transparency_verifier->SetObserver(scts_observer);
+  VLOG(1) << "TreeStateTracker observer on IOThread created.";
 }
 
 void IOThread::UpdateDnsClientEnabled() {
   globals()->host_resolver->SetDnsClientEnabled(*dns_client_enabled_);
 }
 
 void IOThread::ConfigureQuic(const base::CommandLine& command_line) {
   // Always fetch the field trial group to ensure it is reported correctly.
   // The command line flags will be associated with a group that is reported
   // so long as trial is actually queried.
@@ skipping 339 matching lines @@
   net::QuicVersionVector supported_versions = net::QuicSupportedVersions();
   for (size_t i = 0; i < supported_versions.size(); ++i) {
     net::QuicVersion version = supported_versions[i];
     if (net::QuicVersionToString(version) == quic_version) {
       return version;
     }
   }
 
   return net::QUIC_VERSION_UNSUPPORTED;
 }