Implement a skeleton version of Expect CT reports

chrome/browser/net/chrome_network_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/chrome_network_delegate.h"
 
 #include <stddef.h>
 #include <stdlib.h>
 
 #include <vector>
@@ skipping 16 matching lines @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/content_settings/cookie_settings_factory.h"
 #include "chrome/browser/content_settings/tab_specific_content_settings.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry.h"
 #include "chrome/browser/net/chrome_extensions_network_delegate.h"
 #include "chrome/browser/net/connect_interceptor.h"
+#include "chrome/browser/net/expect_ct_monitor.h"
 #include "chrome/browser/net/request_source_bandwidth_histograms.h"
 #include "chrome/browser/net/safe_search_util.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/task_management/task_manager_interface.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/features.h"
 #include "chrome/common/pref_names.h"
 #include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/data_usage/core/data_use_aggregator.h"
 #include "components/domain_reliability/monitor.h"
@@ skipping 285 matching lines @@
       new chrome_browser_net::ConnectInterceptor(predictor));
 }
 
 void ChromeNetworkDelegate::set_data_use_aggregator(
     data_usage::DataUseAggregator* data_use_aggregator,
     bool is_data_usage_off_the_record) {
   data_use_aggregator_ = data_use_aggregator;
   is_data_usage_off_the_record_ = is_data_usage_off_the_record;
 }
 
+void ChromeNetworkDelegate::set_expect_ct_monitor(
+    ExpectCTMonitor* expect_ct_monitor) {
+  expect_ct_monitor_ = expect_ct_monitor;
+}
+
 // static
 void ChromeNetworkDelegate::InitializePrefsOnUIThread(
     BooleanPrefMember* enable_referrers,
     BooleanPrefMember* enable_do_not_track,
     BooleanPrefMember* force_google_safe_search,
     BooleanPrefMember* force_youtube_safety_mode,
     PrefService* pref_service) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   enable_referrers->Init(prefs::kEnableReferrers, pref_service);
   enable_referrers->MoveToThread(
@@ skipping 131 matching lines @@
 }
 
 void ChromeNetworkDelegate::OnBeforeRedirect(net::URLRequest* request,
                                              const GURL& new_location) {
 // Recording data use of request on redirects.
 #if !defined(OS_IOS)
   data_use_measurement_.ReportDataUseUMA(request);
 #endif
   if (domain_reliability_monitor_)
     domain_reliability_monitor_->OnBeforeRedirect(request);
+  if (expect_ct_monitor_ &&
+      (request->ssl_info().cert_status &
+       net::CERT_STATUS_CT_COMPLIANCE_FAILED) != 0) {
+    expect_ct_monitor_->OnCTComplianceFailed(request);
+  }

[Ryan Sleevi, 2016/01/12 04:41:20]

This feels like a weird place to put this.

Is there a reason you don't see yourself super-classing
CTPolicyEnforcer/CertPolicyEnforcer and applying the checks there? Why do you
track by |request| versus, say, connection?

Just trying to think about the timing and implications, since this may result in
significantly more reports for a single connection (since they may be re-used,
and each and every connection will be invalid), and it's different than how,
say, we handle HPKP (which is enforced at socket connect time)

I'm just curious why this implementation wouldn't follow the same basic skeleton
of HPKP & reporting.

[estark, 2016/01/12 05:05:23]

This feature is more like PKP-Report-Only: we have to send CT reports at the
time that we process HTTP headers rather than socket connect time, because we
want to check for the `Expect-CT: preload` header before sending a report. So I
don't think we can do the whole thing inside
CertPolicyEnforcer::DoesConformToCTEVPolicy() (or whatever its name will change
to) because we don't know the response headers at the time that that's called.

   extensions_delegate_->OnBeforeRedirect(request, new_location);
 }
 
 
 void ChromeNetworkDelegate::OnResponseStarted(net::URLRequest* request) {
+  if (expect_ct_monitor_ &&
+      (request->ssl_info().cert_status &
+       net::CERT_STATUS_CT_COMPLIANCE_FAILED) != 0) {
+    expect_ct_monitor_->OnCTComplianceFailed(request);
+  }
   extensions_delegate_->OnResponseStarted(request);
 }
 
 void ChromeNetworkDelegate::OnNetworkBytesReceived(net::URLRequest* request,
                                                    int64_t bytes_received) {
 #if defined(ENABLE_TASK_MANAGER)
   // Note: Currently, OnNetworkBytesReceived is only implemented for HTTP jobs,
   // not FTP or other types, so those kinds of bytes will not be reported here.
   task_management::TaskManagerInterface::OnRawBytesRead(*request,
                                                         bytes_received);
@@ skipping 244 matching lines @@
   if (!data_use_aggregator_)
     return;
 
   if (is_data_usage_off_the_record_) {
     data_use_aggregator_->ReportOffTheRecordDataUse(tx_bytes, rx_bytes);
     return;
   }
 
   data_use_aggregator_->ReportDataUse(request, tx_bytes, rx_bytes);
 }