Initial (partial) implementation of HPKP violation reporting

net/http/transport_security_state.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/gtest_prod_util.h"
 #include "base/threading/non_thread_safe.h"
 #include "base/time/time.h"
 #include "net/base/net_export.h"
 #include "net/cert/x509_cert_types.h"
 #include "net/cert/x509_certificate.h"
 
+class GURL;
+
 namespace net {
 
 class SSLInfo;
 
 // Tracks which hosts have enabled strict transport security and/or public
 // key pins.
 //
 // This object manages the in-memory store. Register a Delegate with
 // |SetDelegate| to persist the state to disk.
 //
 // HTTP strict transport security (HSTS) is defined in
 // http://tools.ietf.org/html/ietf-websec-strict-transport-sec, and
 // HTTP-based dynamic public key pinning (HPKP) is defined in
 // http://tools.ietf.org/html/ietf-websec-key-pinning.
 class NET_EXPORT TransportSecurityState
     : NON_EXPORTED_BASE(public base::NonThreadSafe) {
  public:
   class NET_EXPORT Delegate {
    public:
     // This function may not block and may be called with internal locks held.
     // Thus it must not reenter the TransportSecurityState object.
     virtual void StateIsDirty(TransportSecurityState* state) = 0;
 
    protected:
     virtual ~Delegate() {}
   };
 
-  TransportSecurityState();
-  ~TransportSecurityState();
-
   // A DomainState describes the transport security state (required upgrade
   // to HTTPS, and/or any public key pins).
   //
   // TODO(davidben): STSState and PKPState are queried and processed
   // independently (with the exception of ShouldSSLErrorsBeFatal triggering on
   // both and on-disk storage). DomainState should be split into the
   // two. https://crbug.com/470295.
   class NET_EXPORT DomainState {
    public:
     enum UpgradeMode {
@@ skipping 45 matching lines @@
       // NOT intersect with the set of SPKIs in the TLS server's certificate
       // chain.
       HashValueVector bad_spki_hashes;
 
       // Are subdomains subject to this policy state?
       bool include_subdomains;
 
       // The domain which matched during a search for this DomainState entry.
       // Updated by |GetDynamicDomainState| and |GetStaticDomainState|.
       std::string domain;
+
+      // Optional; a uri-reference indicating where reports should be
+      // sent when this pin is violated.
+      std::string report_uri;
     };
 
     // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if:
     //   1) |bad_static_spki_hashes| does not intersect |hashes|; AND
     //   2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty
     //      or at least one of them intersects |hashes|.
     //
     // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes,
     // any one of which is sufficient to validate the certificate chain in
     // question. The public keys could be of a root CA, intermediate CA, or
@@ skipping 33 matching lines @@
     bool HasNext() const { return iterator_ != end_; }
     void Advance() { ++iterator_; }
     const std::string& hostname() const { return iterator_->first; }
     const DomainState& domain_state() const { return iterator_->second; }
 
    private:
     std::map<std::string, DomainState>::const_iterator iterator_;
     std::map<std::string, DomainState>::const_iterator end_;
   };
 
+  class NET_EXPORT Reporter {
+   public:
+    virtual ~Reporter() {}
+
+    // Returns true if a violation report should be sent for the host in
+    // the given |pkp_state|, and returns the report destination URI in
+    // |report_uri|. Returns false if a report should not be sent.
+    virtual bool GetHPKPReportUri(const DomainState::PKPState& pkp_state,
+                                  GURL* report_uri) = 0;
+
+    // Builds a serialized HPKP violation report in
+    // |serialized_report|. Returns true on success and false on
+    // failure.
+    virtual bool BuildHPKPReport(
+        const std::string& hostname,
+        uint16_t port,
+        const base::Time& expiry,
+        bool include_subdomains,
+        const std::string& effective_hostname,
+        const scoped_refptr<X509Certificate>& served_certificate_chain,
+        const scoped_refptr<X509Certificate>& validated_certificate_chain,
+        const HashValueVector& spki_hashes,
+        std::string* serialized_report) = 0;
+
+    // Sends the given serialized |report| to |report_uri|.
+    virtual void SendHPKPReport(const GURL& report_uri,
+                                const std::string& report) = 0;
+  };
+
+  // Indicates whether or not a public key pin check should send a
+  // report if a violation is detected.
+  enum PublicKeyPinReportStatus {
+    DO_NOT_SEND_PUBLIC_KEY_PIN_REPORT,
+    SEND_PUBLIC_KEY_PIN_REPORT
+  };
+
+  TransportSecurityState();
+  ~TransportSecurityState();
+
   // These functions search for static and dynamic DomainStates, and invoke the
   // functions of the same name on them. These functions are the primary public
   // interface; direct access to DomainStates is best left to tests.
   bool ShouldSSLErrorsBeFatal(const std::string& host);
   bool ShouldUpgradeToSSL(const std::string& host);
-  bool CheckPublicKeyPins(const std::string& host,
-                          bool is_issued_by_known_root,
-                          const HashValueVector& hashes,
-                          std::string* failure_log);
+  bool CheckPublicKeyPins(
+      const std::string& host,
+      bool is_issued_by_known_root,
+      const HashValueVector& hashes,
+      uint16_t port,
+      const scoped_refptr<X509Certificate>& served_certificate_chain,
+      const scoped_refptr<X509Certificate>& validated_certificate_chain,
+      const PublicKeyPinReportStatus report_status,
+      std::string* failure_log);
   bool HasPublicKeyPins(const std::string& host);
 
   // Assign a |Delegate| for persisting the transport security state. If
   // |NULL|, state will not be persisted. The caller retains
   // ownership of |delegate|.
   // Note: This is only used for serializing/deserializing the
   // TransportSecurityState.
   void SetDelegate(Delegate* delegate);
 
+  void SetReporter(Reporter* reporter);
+
   // Clears all dynamic data (e.g. HSTS and HPKP data).
   //
   // Does NOT persist changes using the Delegate, as this function is only
   // used to clear any dynamic data prior to re-loading it from a file.
   // Note: This is only used for serializing/deserializing the
   // TransportSecurityState.
   void ClearDynamicData();
 
   // Inserts |state| into |enabled_hosts_| under the key |hashed_host|.
   // |hashed_host| is already in the internal representation.
@@ skipping 50 matching lines @@
   // HSTS header (used for net-internals and unit tests).
   void AddHSTS(const std::string& host,
                const base::Time& expiry,
                bool include_subdomains);
 
   // Adds explicitly-specified data as if it was processed from an
   // HPKP header (used for net-internals and unit tests).
   void AddHPKP(const std::string& host,
                const base::Time& expiry,
                bool include_subdomains,
-               const HashValueVector& hashes);
+               const HashValueVector& hashes,
+               const std::string& report_uri);
 
   // Returns true iff we have any static public key pins for the |host| and
   // iff its set of required pins is the set we expect for Google
   // properties.
   //
   // If |host| matches both an exact entry and is a subdomain of another
   // entry, the exact match determines the return value.
   static bool IsGooglePinnedProperty(const std::string& host);
 
   // The maximum number of seconds for which we'll cache an HSTS request.
@@ skipping 16 matching lines @@
   // representation of first-class DomainStates, and exposing the preloads
   // to the caller with |GetStaticDomainState|.
   static void ReportUMAOnPinFailure(const std::string& host);
 
   // IsBuildTimely returns true if the current build is new enough ensure that
   // built in security information (i.e. HSTS preloading and pinning
   // information) is timely.
   static bool IsBuildTimely();
 
   // Helper method for actually checking pins.
-  bool CheckPublicKeyPinsImpl(const std::string& host,
-                              const HashValueVector& hashes,
-                              std::string* failure_log);
+  bool CheckPublicKeyPinsImpl(
+      const std::string& host,
+      const HashValueVector& hashes,
+      uint16_t port,
+      const scoped_refptr<X509Certificate>& served_certificate_chain,
+      const scoped_refptr<X509Certificate>& validated_certificate_chain,
+      const PublicKeyPinReportStatus report_status,
+      std::string* failure_log);
 
   // If a Delegate is present, notify it that the internal state has
   // changed.
   void DirtyNotify();
 
   // Adds HSTS state to |host|.
   void AddHSTSInternal(const std::string& host,
                        DomainState::UpgradeMode upgrade_mode,
                        const base::Time& expiry,
                        bool include_subdomains);
 
   // Adds HPKP state to |host|.
   void AddHPKPInternal(const std::string& host,
                        const base::Time& last_observed,
                        const base::Time& expiry,
                        bool include_subdomains,
-                       const HashValueVector& hashes);
+                       const HashValueVector& hashes,
+                       const std::string& report_uri);
 
   // Enable TransportSecurity for |host|. |state| supercedes any previous
   // state for the |host|, including static entries.
   //
   // The new state for |host| is persisted using the Delegate (if any).
   void EnableHost(const std::string& host, const DomainState& state);
 
   // The set of hosts that have enabled TransportSecurity. |sts.domain| and
   // |pkp.domain| will always be empty for a DomainState in this map; the domain
   // comes from the map key instead.
   DomainStateMap enabled_hosts_;
 
   Delegate* delegate_;
 
+  Reporter* reporter_;
+
   // True if static pins should be used.
   bool enable_static_pins_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_TRANSPORT_SECURITY_STATE_H_