Add net::CertificateReportSender for handling cert report sending

net/http/certificate_report_sender_impl.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/http/certificate_report_sender_impl.h"
+
+#include "base/stl_util.h"
+#include "net/base/elements_upload_data_stream.h"
+#include "net/base/load_flags.h"
+#include "net/base/request_priority.h"
+#include "net/base/upload_bytes_element_reader.h"
+#include "net/url_request/url_request_context.h"
+#include "net/url_request/url_request_status.h"
+
+namespace net {
+
+CertificateReportSenderImpl::CertificateReportSenderImpl(
+    URLRequestContext* request_context,
+    CookiesPreference cookies_preference)
+    : request_context_(request_context),
+      cookies_preference_(cookies_preference) {
+}
+
+CertificateReportSenderImpl::~CertificateReportSenderImpl() {
+  STLDeleteElements(&inflight_requests_);
+}
+
+void CertificateReportSenderImpl::Send(const GURL& report_uri,
+                                       const std::string& report) {
+  scoped_ptr<URLRequest> url_request =
+      CreateURLRequest(request_context_, report_uri);
+  url_request->set_method("POST");
+
+  scoped_ptr<UploadElementReader> reader(
+      UploadOwnedBytesElementReader::CreateWithString(report));
+  url_request->set_upload(
+      ElementsUploadDataStream::CreateWithReader(reader.Pass(), 0));
+
+  URLRequest* raw_url_request = url_request.get();
+  inflight_requests_.insert(url_request.release());
+  raw_url_request->Start();
+}
+
+void CertificateReportSenderImpl::OnResponseStarted(URLRequest* request) {
+  // TODO(estark): call a callback so that the caller can print a
+  //  warning on failure.

[Ryan Sleevi, 2015/06/26 20:03:46]

// warning

[estark, 2015/07/07 21:59:28]

Done.

+  RequestComplete(request);
+}
+
+void CertificateReportSenderImpl::OnReadCompleted(URLRequest* request,
+                                                  int bytes_read) {
+}
+
+scoped_ptr<URLRequest> CertificateReportSenderImpl::CreateURLRequest(
+    URLRequestContext* context,
+    const GURL& report_uri) {
+  scoped_ptr<URLRequest> request =
+      context->CreateRequest(report_uri, DEFAULT_PRIORITY, this);
+  if (cookies_preference_ != SEND_COOKIES)
+    request->SetLoadFlags(LOAD_DO_NOT_SEND_COOKIES | LOAD_DO_NOT_SAVE_COOKIES);

[Ryan Sleevi, 2015/06/26 20:03:46]

DESIGN: Look through the other load flags to figure out expectations.

One that's come up recently that makes me curious is what should be done with
HTTP auth state - should it be sent or not? (LOAD_DO_NOT_SEND_AUTH_DATA). We
typically disable that for background pings (both privacy and security)

Should this bypass the cache? Do we run into the possibility of cache lock
synchronization if we're sending multiple reports?

What about embedded URL identities - should we allow those? Would this give an
'attacker' more fingerprinting capability?

[estark, 2015/07/07 21:59:28]

I've changed it to be consistent with what other background requests do: no
cookies, no cache, no auth data.

I'm not sure about the embedded URL identities because I don't think I
understand the fingerprinting scenario. Doesn't an attacker have as much
fingerprinting capability as they would ever want by having the whole URL to
play with?

+  return request.Pass();
+}
+
+void CertificateReportSenderImpl::RequestComplete(URLRequest* request) {
+  std::set<URLRequest*>::iterator i = inflight_requests_.find(request);
+  DCHECK(i != inflight_requests_.end());

[Ryan Sleevi, 2015/06/26 20:03:46]

Should this be a CHECK()? I can't recall what evil will happen if i == .end()

[estark, 2015/07/07 21:59:28]

Dereferencing end() is undefined behavior, so I suppose it should be a CHECK.

+  scoped_ptr<URLRequest> url_request(*i);
+  inflight_requests_.erase(i);
+}
+
+}  // namespace net