Send HPKP violation reports when a pin check fails

net/http/transport_security_state.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 
 #include <map>
 #include <string>
 #include <utility>
@@ skipping 178 matching lines @@
         const scoped_refptr<X509Certificate>& served_certificate_chain,
         const scoped_refptr<X509Certificate>& validated_certificate_chain,
         const HashValueVector& spki_hashes,
         std::string* serialized_report) = 0;
 
     // Sends the given serialized |report| to |report_uri|.
     virtual void SendHPKPReport(const GURL& report_uri,
                                 const std::string& report) = 0;
   };
 
+  // Indicates whether or not a public key pin check should send a
+  // report if a violation is detected.
+  enum PublicKeyPinReportStatus {
+    DO_NOT_SEND_PUBLIC_KEY_PIN_REPORT,
+    SEND_PUBLIC_KEY_PIN_REPORT
+  };
+
   TransportSecurityState();
   ~TransportSecurityState();
 
   // These functions search for static and dynamic DomainStates, and invoke the
   // functions of the same name on them. These functions are the primary public
   // interface; direct access to DomainStates is best left to tests.
   bool ShouldSSLErrorsBeFatal(const std::string& host);
   bool ShouldUpgradeToSSL(const std::string& host);
-  bool CheckPublicKeyPins(const std::string& host,
-                          bool is_issued_by_known_root,
-                          const HashValueVector& hashes,
-                          std::string* failure_log);
+  bool CheckPublicKeyPins(
+      const std::string& host,
+      bool is_issued_by_known_root,
+      const HashValueVector& hashes,
+      uint16_t port,
+      const scoped_refptr<X509Certificate>& served_certificate_chain,
+      const scoped_refptr<X509Certificate>& validated_certificate_chain,
+      const PublicKeyPinReportStatus report_status,

[Ryan Sleevi, 2015/06/26 20:22:19]

same comments re: raw pointers being cool

[estark, 2015/07/09 22:18:41]

Done.

+      std::string* failure_log);
   bool HasPublicKeyPins(const std::string& host);
 
   // Assign a |Delegate| for persisting the transport security state. If
   // |NULL|, state will not be persisted. The caller retains
   // ownership of |delegate|.
   // Note: This is only used for serializing/deserializing the
   // TransportSecurityState.
   void SetDelegate(Delegate* delegate);
 
   void SetReporter(Reporter* reporter);
@@ skipping 99 matching lines @@
   // representation of first-class DomainStates, and exposing the preloads
   // to the caller with |GetStaticDomainState|.
   static void ReportUMAOnPinFailure(const std::string& host);
 
   // IsBuildTimely returns true if the current build is new enough ensure that
   // built in security information (i.e. HSTS preloading and pinning
   // information) is timely.
   static bool IsBuildTimely();
 
   // Helper method for actually checking pins.
-  bool CheckPublicKeyPinsImpl(const std::string& host,
-                              const HashValueVector& hashes,
-                              std::string* failure_log);
+  bool CheckPublicKeyPinsImpl(
+      const std::string& host,
+      const HashValueVector& hashes,
+      uint16_t port,
+      const scoped_refptr<X509Certificate>& served_certificate_chain,
+      const scoped_refptr<X509Certificate>& validated_certificate_chain,
+      const PublicKeyPinReportStatus report_status,

[Ryan Sleevi, 2015/06/26 20:22:19]

ditto

[estark, 2015/07/09 22:18:41]

Done.

+      std::string* failure_log);
 
   // If a Delegate is present, notify it that the internal state has
   // changed.
   void DirtyNotify();
 
   // Adds HSTS state to |host|.
   void AddHSTSInternal(const std::string& host,
                        DomainState::UpgradeMode upgrade_mode,
                        const base::Time& expiry,
                        bool include_subdomains);
@@ skipping 23 matching lines @@
 
   // True if static pins should be used.
   bool enable_static_pins_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_TRANSPORT_SECURITY_STATE_H_