[Cronet] Public key pinning for Java API

components/cronet/android/cronet_url_request_context_adapter.cc

Index: components/cronet/android/cronet_url_request_context_adapter.cc
diff --git a/components/cronet/android/cronet_url_request_context_adapter.cc b/components/cronet/android/cronet_url_request_context_adapter.cc
index 67dad4ef35028a612edf1ac88c01348962dbf16f..f9c5753515415efa592f595db88a09f31592422a 100644
--- a/components/cronet/android/cronet_url_request_context_adapter.cc
+++ b/components/cronet/android/cronet_url_request_context_adapter.cc
@@ -10,6 +10,7 @@
 #include "base/android/jni_array.h"
 #include "base/android/jni_string.h"
 #include "base/bind.h"
+#include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
@@ -315,6 +316,12 @@ void CronetURLRequestContextAdapter::InitializeOnNetworkThread(
         http_server_properties_manager.Pass());
   }
 
+  // Explicitly disable the persister for Cronet to avoid persistence
+  // of dynamic HPKP. This is a safety measure in case if somebody will

[pauljensen, 2015/11/17 19:01:23]

in case if somebody will enable->ensuring nobody enables

[kapishnikov, 2015/11/18 00:10:31]

Done.

+  // enable the persistence by specifying transport_security_persister_path
+  // in the future.
+  context_builder.set_transport_security_persister_path(base::FilePath());
+
   context_ = context_builder.Build().Pass();
 
   default_load_flags_ = net::LOAD_DO_NOT_SAVE_COOKIES |
@@ -375,6 +382,27 @@ void CronetURLRequestContextAdapter::InitializeOnNetworkThread(
     }
   }
 
+  // Iterate through HPKP configuration for every host.
+  for (const auto& hpkp : config->hpkp_list) {
+    // Convert the vector of hash strings from the config to
+    // a vector of HashValue objects.
+    net::HashValueVector hash_value_vector;
+    for (const auto& hash : hpkp->pin_hashes) {
+      auto hash_value = net::HashValue(net::HASH_VALUE_SHA256);
+      bool good_hash = hash_value.FromString(*hash);
+      if (good_hash) {
+        hash_value_vector.push_back(hash_value);
+      } else {
+        LOG(WARNING) << "Unable to add hash value " << *hash;
+      }
+    }
+
+    // Add the host pinning.
+    context_->transport_security_state()->AddHPKP(
+        hpkp->host, hpkp->expiration_date, hpkp->include_subdomains,
+        hash_value_vector, GURL::EmptyGURL());
+  }
+
   JNIEnv* env = base::android::AttachCurrentThread();
   jcronet_url_request_context_.Reset(env, jcronet_url_request_context.obj());
   Java_CronetUrlRequestContext_initNetworkThread(