Process Public-Key-Pin-Report-Only headers

net/url_request/url_request_http_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
@@ skipping 865 matching lines @@
   // Only accept HPKP headers on HTTPS connections that have no
   // certificate errors.
   if (!ssl_info.is_valid() || IsCertStatusError(ssl_info.cert_status) ||
       !security_state)
     return;
 
   // Don't accept HSTS headers when the hostname is an IP address.
   if (request_info_.url.HostIsIPAddress())
     return;
 
   // http://tools.ietf.org/html/draft-ietf-websec-key-pinning:

[Ryan Sleevi, 2015/07/30 01:52:17]

While you're here, do you mind updating this to RFC 7469? And any other places
we have this URL? :)

[estark, 2015/07/31 00:49:44]

Done.

   //
   //   If a UA receives more than one PKP header field in an HTTP
   //   response message over secure transport, then the UA MUST process
   //   only the first such header field.
   HttpResponseHeaders* headers = GetResponseHeaders();
   std::string value;
   if (headers->EnumerateHeader(NULL, "Public-Key-Pins", &value))

[Ryan Sleevi, 2015/07/30 01:52:17]

Bonus points for the subtle C++11-ization of changing this and line 895 to
nullptr

[estark, 2015/07/31 00:49:44]

Done.

     security_state->AddHPKPHeader(request_info_.url.host(), value, ssl_info);
+  if (headers->EnumerateHeader(NULL, "Public-Key-Pins-Report-Only", &value)) {
+    security_state->ProcessHPKPReportOnlyHeader(
+        HostPortPair(request_info_.url.host(), request_info_.url.IntPort()),

[Ryan Sleevi, 2015/07/30 01:52:17]

You really want HostPortPair::FromURL(request_info_.url). The BUG here is you're
using IntPort rather than EffectiveIntPort, for example, and also missing the
narrowing cast.

[estark, 2015/07/31 00:49:44]

Done.

+        value, ssl_info);
+  }
 }
 
 void URLRequestHttpJob::OnStartCompleted(int result) {
   RecordTimer();
 
   // If the request was destroyed, then there is no more work to do.
   if (!request_)
     return;
 
   // If the job is done (due to cancellation), can just ignore this
@@ skipping 646 matching lines @@
   return override_response_headers_.get() ?
              override_response_headers_.get() :
              transaction_->GetResponseInfo()->headers.get();
 }
 
 void URLRequestHttpJob::NotifyURLRequestDestroyed() {
   awaiting_callback_ = false;
 }
 
 }  // namespace net