Expose when PKP is bypassed in SSLInfo.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <memory>
 #include <utility>
 
@@ skipping 646 matching lines @@
 }
 
 bool TransportSecurityState::CheckPublicKeyPins(
     const HostPortPair& host_port_pair,
     bool is_issued_by_known_root,
     const HashValueVector& public_key_hashes,
     const X509Certificate* served_certificate_chain,
     const X509Certificate* validated_certificate_chain,
     const PublicKeyPinReportStatus report_status,
     std::string* pinning_failure_log) {
-  // Perform pin validation if, and only if, all these conditions obtain:
-  //
-  // * the server's certificate chain chains up to a known root (i.e. not a
-  //   user-installed trust anchor); and
-  // * the server actually has public key pins.
-  if (!is_issued_by_known_root || !HasPublicKeyPins(host_port_pair.host())) {
+  // Perform pin validation only if the server actually has public key pins.
+  if (!HasPublicKeyPins(host_port_pair.host())) {
     return true;
   }
 
   bool pins_are_valid = CheckPublicKeyPinsImpl(
-      host_port_pair, public_key_hashes, served_certificate_chain,
-      validated_certificate_chain, report_status, pinning_failure_log);
+      host_port_pair, is_issued_by_known_root, public_key_hashes,
+      served_certificate_chain, validated_certificate_chain, report_status,
+      pinning_failure_log);
+  // Don't track statistics when a local trust anchor would override the pinning
+  // anyway.
+  if (!is_issued_by_known_root) {
+    return pins_are_valid;
+  }
   if (!pins_are_valid) {
     LOG(ERROR) << *pinning_failure_log;
     ReportUMAOnPinFailure(host_port_pair.host());
   }
 
   UMA_HISTOGRAM_BOOLEAN("Net.PublicKeyPinSuccess", pins_are_valid);
   return pins_are_valid;
 }
 
 bool TransportSecurityState::HasPublicKeyPins(const std::string& host) {
@@ skipping 110 matching lines @@
   } else {
     const std::string hashed_host = HashHost(canonicalized_host);
     enabled_pkp_hosts_.erase(hashed_host);
   }
 
   DirtyNotify();
 }
 
 bool TransportSecurityState::CheckPinsAndMaybeSendReport(
     const HostPortPair& host_port_pair,
+    bool is_issued_by_known_root,
     const TransportSecurityState::PKPState& pkp_state,
     const HashValueVector& hashes,
     const X509Certificate* served_certificate_chain,
     const X509Certificate* validated_certificate_chain,
     const TransportSecurityState::PublicKeyPinReportStatus report_status,
     std::string* failure_log) {
   if (pkp_state.CheckPublicKeyPins(hashes, failure_log))
     return true;
 
-  if (!report_sender_ ||
+  if (!report_sender_ || !is_issued_by_known_root ||
       report_status != TransportSecurityState::ENABLE_PIN_REPORTS ||
       pkp_state.report_uri.is_empty()) {
     return false;
   }
 
   DCHECK(pkp_state.report_uri.is_valid());
   // Report URIs should not be used if they are the same host as the pin
   // and are HTTPS, to avoid going into a report-sending loop.
   if (!IsReportUriValidForHost(pkp_state.report_uri, host_port_pair.host()))
     return false;
@@ skipping 221 matching lines @@
   }
 
   PKPState pkp_state;
   pkp_state.last_observed = now;
   pkp_state.expiry = now;
   pkp_state.include_subdomains = include_subdomains;
   pkp_state.spki_hashes = spki_hashes;
   pkp_state.report_uri = report_uri;
   pkp_state.domain = DNSDomainToString(CanonicalizeHost(host_port_pair.host()));
 
-  // Only perform pin validation if the cert chains up to a known root.
-  if (!ssl_info.is_issued_by_known_root)
-    return true;
-
   CheckPinsAndMaybeSendReport(
-      host_port_pair, pkp_state, ssl_info.public_key_hashes,
-      ssl_info.unverified_cert.get(), ssl_info.cert.get(), ENABLE_PIN_REPORTS,
-      &unused_failure_log);
+      host_port_pair, ssl_info.is_issued_by_known_root, pkp_state,
+      ssl_info.public_key_hashes, ssl_info.unverified_cert.get(),
+      ssl_info.cert.get(), ENABLE_PIN_REPORTS, &unused_failure_log);
   return true;
 }
 
 void TransportSecurityState::ProcessExpectCTHeader(
     const std::string& value,
     const HostPortPair& host_port_pair,
     const SSLInfo& ssl_info) {
   DCHECK(CalledOnValidThread());
 
   if (!expect_ct_reporter_)
@@ skipping 36 matching lines @@
 
 // static
 bool TransportSecurityState::IsBuildTimely() {
   const base::Time build_time = base::GetBuildTime();
   // We consider built-in information to be timely for 10 weeks.
   return (base::Time::Now() - build_time).InDays() < 70 /* 10 weeks */;
 }
 
 bool TransportSecurityState::CheckPublicKeyPinsImpl(
     const HostPortPair& host_port_pair,
+    bool is_issued_by_known_root,
     const HashValueVector& hashes,
     const X509Certificate* served_certificate_chain,
     const X509Certificate* validated_certificate_chain,
     const PublicKeyPinReportStatus report_status,
     std::string* failure_log) {
   PKPState pkp_state;
   STSState unused;
 
   if (!GetDynamicPKPState(host_port_pair.host(), &pkp_state) &&
       !GetStaticDomainState(host_port_pair.host(), &unused, &pkp_state)) {
     // HasPublicKeyPins should have returned true in order for this method
     // to have been called, so if we fall through to here, it's an error.
     return false;
   }
 
   return CheckPinsAndMaybeSendReport(
-      host_port_pair, pkp_state, hashes, served_certificate_chain,
-      validated_certificate_chain, report_status, failure_log);
+      host_port_pair, is_issued_by_known_root, pkp_state, hashes,
+      served_certificate_chain, validated_certificate_chain, report_status,
+      failure_log);
 }
 
 bool TransportSecurityState::GetStaticDomainState(const std::string& host,
                                                   STSState* sts_state,
                                                   PKPState* pkp_state) const {
   DCHECK(CalledOnValidThread());
 
   sts_state->upgrade_mode = STSState::MODE_FORCE_HTTPS;
   sts_state->include_subdomains = false;
   pkp_state->include_subdomains = false;
@@ skipping 248 matching lines @@
 TransportSecurityState::PKPStateIterator::PKPStateIterator(
     const TransportSecurityState& state)
     : iterator_(state.enabled_pkp_hosts_.begin()),
       end_(state.enabled_pkp_hosts_.end()) {
 }
 
 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
 }
 
 }  // namespace