Distinguish STS observation times from PKP observation times.

net/http/transport_security_persister.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_persister.h"
 
 #include "base/base64.h"
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
@@ skipping 61 matching lines @@
 const char kExpiry[] = "expiry";
 const char kDynamicSPKIHashesExpiry[] = "dynamic_spki_hashes_expiry";
 const char kStaticSPKIHashes[] = "static_spki_hashes";
 const char kPreloadedSPKIHashes[] = "preloaded_spki_hashes";
 const char kDynamicSPKIHashes[] = "dynamic_spki_hashes";
 const char kForceHTTPS[] = "force-https";
 const char kStrict[] = "strict";
 const char kDefault[] = "default";
 const char kPinningOnly[] = "pinning-only";
 const char kCreated[] = "created";
+const char kStsObserved[] = "sts_observed";
+const char kPkpObserved[] = "pkp_observed";
 
 std::string LoadState(const base::FilePath& path) {
   std::string result;
   if (!base::ReadFileToString(path, &result)) {
     return "";
   }
   return result;
 }
 
 }  // namespace
@@ skipping 49 matching lines @@
   for (; state.HasNext(); state.Advance()) {
     const std::string& hostname = state.hostname();
     const TransportSecurityState::DomainState& domain_state =
         state.domain_state();
 
     DictionaryValue* serialized = new DictionaryValue;
     serialized->SetBoolean(kStsIncludeSubdomains,
                            domain_state.sts_include_subdomains);
     serialized->SetBoolean(kPkpIncludeSubdomains,
                            domain_state.pkp_include_subdomains);
-    serialized->SetDouble(kCreated, domain_state.created.ToDoubleT());
+    serialized->SetDouble(kStsObserved, domain_state.sts_observed.ToDoubleT());
+    serialized->SetDouble(kPkpObserved, domain_state.pkp_observed.ToDoubleT());
     serialized->SetDouble(kExpiry, domain_state.upgrade_expiry.ToDoubleT());
     serialized->SetDouble(kDynamicSPKIHashesExpiry,
                           domain_state.dynamic_spki_hashes_expiry.ToDoubleT());
 
     switch (domain_state.upgrade_mode) {
       case TransportSecurityState::DomainState::MODE_FORCE_HTTPS:
         serialized->SetString(kMode, kForceHTTPS);
         break;
       case TransportSecurityState::DomainState::MODE_DEFAULT:
         serialized->SetString(kMode, kDefault);
@@ skipping 42 matching lines @@
   bool dirtied = false;
 
   for (DictionaryValue::Iterator i(*dict_value); !i.IsAtEnd(); i.Advance()) {
     const DictionaryValue* parsed = NULL;
     if (!i.value().GetAsDictionary(&parsed)) {
       LOG(WARNING) << "Could not parse entry " << i.key() << "; skipping entry";
       continue;
     }
 
     std::string mode_string;
-    double created;
     double expiry;
     double dynamic_spki_hashes_expiry = 0.0;
     TransportSecurityState::DomainState domain_state;
 
     // kIncludeSubdomains is a legacy synonym for kStsIncludeSubdomains and
     // kPkpIncludeSubdomains. Parse at least one of these properties,
     // preferably the new ones.
     bool include_subdomains = false;
     bool parsed_include_subdomains = parsed->GetBoolean(kIncludeSubdomains,
                                                         &include_subdomains);
@@ skipping 39 matching lines @@
     } else {
       LOG(WARNING) << "Unknown TransportSecurityState mode string "
                    << mode_string << " found for entry " << i.key()
                    << "; skipping entry";
       continue;
     }
 
     domain_state.upgrade_expiry = base::Time::FromDoubleT(expiry);
     domain_state.dynamic_spki_hashes_expiry =
         base::Time::FromDoubleT(dynamic_spki_hashes_expiry);
-    if (parsed->GetDouble(kCreated, &created)) {
-      domain_state.created = base::Time::FromDoubleT(created);
+
+    double sts_observed;
+    double pkp_observed;
+    if (parsed->GetDouble(kStsObserved, &sts_observed)) {
+      domain_state.sts_observed = base::Time::FromDoubleT(sts_observed);
+    } else if (parsed->GetDouble(kCreated, &sts_observed)) {
+      // kCreated is a legacy synonym for both kStsObserved and kPkpObserved.
+      domain_state.sts_observed = base::Time::FromDoubleT(sts_observed);
     } else {
-      // We're migrating an old entry with no creation date. Make sure we
+      // We're migrating an old entry with no observation date. Make sure we
       // write the new date back in a reasonable time frame.
       dirtied = true;
-      domain_state.created = base::Time::Now();
+      domain_state.sts_observed = base::Time::Now();
+    }
+    if (parsed->GetDouble(kPkpObserved, &pkp_observed)) {
+      domain_state.pkp_observed = base::Time::FromDoubleT(pkp_observed);
+    } else if (parsed->GetDouble(kCreated, &pkp_observed)) {
+      domain_state.pkp_observed = base::Time::FromDoubleT(pkp_observed);
+    } else {
+      dirtied = true;
+      domain_state.pkp_observed = base::Time::Now();
     }
 
     if (domain_state.upgrade_expiry <= current_time &&
         domain_state.dynamic_spki_hashes_expiry <= current_time) {
       // Make sure we dirty the state if we drop an entry.
       dirtied = true;
       continue;
     }
 
     std::string hashed = ExternalStringToHashedDomain(i.key());
@@ skipping 18 matching lines @@
   bool dirty = false;
   if (!LoadEntries(state, &dirty)) {
     LOG(ERROR) << "Failed to deserialize state: " << state;
     return;
   }
   if (dirty)
     StateIsDirty(transport_security_state_);
 }
 
 }  // namespace net