Build and send HPKP violation reports

chrome/browser/profiles/profile_io_data.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_PROFILES_PROFILE_IO_DATA_H_
 #define CHROME_BROWSER_PROFILES_PROFILE_IO_DATA_H_
 
 #include <map>
 #include <string>
 #include <vector>
@@ skipping 50 matching lines @@
 class CertVerifier;
 class ChannelIDService;
 class CookieStore;
 class FraudulentCertificateReporter;
 class FtpTransactionFactory;
 class HttpServerProperties;
 class HttpTransactionFactory;
 class ProxyConfigService;
 class ProxyService;
 class SSLConfigService;
+class CertificateReportSender;

[davidben, 2015/07/24 20:42:55]

Nit: Alphabetize.

[estark, 2015/07/25 00:10:31]

Done.

 class TransportSecurityPersister;
 class TransportSecurityState;
 class URLRequestJobFactoryImpl;
 }  // namespace net
 
 namespace policy {
 class PolicyCertVerifier;
 class PolicyHeaderIOHelper;
 class URLBlacklistManager;
 }  // namespace policy
@@ skipping 469 matching lines @@
   // Set to |cert_verifier_| if it references a PolicyCertVerifier. In that
   // case, the verifier is owned by  |cert_verifier_|. Otherwise, set to NULL.
   mutable policy::PolicyCertVerifier* policy_cert_verifier_;
   mutable scoped_ptr<net::CertVerifier> cert_verifier_;
   mutable std::string username_hash_;
   mutable bool use_system_key_slot_;
 #endif
 
   mutable scoped_ptr<net::TransportSecurityPersister>
       transport_security_persister_;
+  mutable scoped_ptr<net::CertificateReportSender> certificate_report_sender_;

[davidben, 2015/07/24 20:42:55]

This is really obnoxious, but there's a window where certificate_report_sender_
is alive and main_request_context_ isn't. Which actually can trip
AssertNoURLRequests if there are any live reports in flight on shutdown. And the
CertificateReportSender cannot outlive main_request_context_. (At the same time,
transport_security_state_ can't have a pointer to certificate_report_sender_
after it's been destroyed.)

Really the problem is you have a cycle. So you'll need some code in some
destructor to break one of the pointers, probably TSS -> CRS. (Note that
TransportSecurityPersister's destructor calls SetDelegate(NULL) which is why it
can outlive TransportSecurityState.)

Probably just putting something in ~ProfileIOData to disconnect it and either
certificate_report_sender_.reset() early or place it underneath
main_request_context_ so it's destroyed first.

[estark, 2015/07/25 00:10:31]

Ah, yeah, mmenke and I were talking about this earlier this week on
crbug.com/512461. Done.

 
   // These are only valid in between LazyInitialize() and their accessor being
   // called.
   mutable scoped_ptr<net::URLRequestContext> main_request_context_;
   mutable scoped_ptr<net::URLRequestContext> extensions_request_context_;
   // One URLRequestContext per isolated app for main and media requests.
   mutable URLRequestContextMap app_request_context_map_;
   mutable URLRequestContextMap isolated_media_request_context_map_;
 
   mutable scoped_ptr<ResourceContext> resource_context_;
@@ skipping 23 matching lines @@
 
   // TODO(jhawkins): Remove once crbug.com/102004 is fixed.
   bool initialized_on_UI_thread_;
 
   const Profile::ProfileType profile_type_;
 
   DISALLOW_COPY_AND_ASSIGN(ProfileIOData);
 };
 
 #endif  // CHROME_BROWSER_PROFILES_PROFILE_IO_DATA_H_