Implement Expect-Staple

net/http/transport_security_state.h

Index: net/http/transport_security_state.h
diff --git a/net/http/transport_security_state.h b/net/http/transport_security_state.h
index b74b78d64fdb60664dfd3de3b0c2cd41e420b0dc..a02c420b10ffff2ccbdd77f80c275bbb89638bec 100644
--- a/net/http/transport_security_state.h
+++ b/net/http/transport_security_state.h
@@ -384,6 +384,19 @@ class NET_EXPORT TransportSecurityState
                              const HostPortPair& host_port_pair,
                              const SSLInfo& ssl_info);
 
+  void CheckExpectStaple(const HostPortPair& host_port_pair,

[estark, 2016/06/09 21:24:14]

prob needs some documentation

Also (having not read anything else but this header file so far), why does this
method take an ExpectStapleState as the argument? That seems different than the
other similar functions, like CheckPublicKeyPins(0.

[dadrian, 2016/06/10 01:05:52]

It could probably just take the report URI.

+                         const ExpectStapleState& expect_state_state,
+                         const X509Certificate& certificate,
+                         const std::string& ocsp_response);
+
+  // Returns true and updates |*expect_staple_result| iff there is a static
+  // (built-in) state for |host| with expect_staple=true, or if |host| is a
+  // subdomain of another domain with expect_staple=true and
+  // include_subdomains_for_expect_staple=true.
+  bool GetStaticExpectStapleState(

[estark, 2016/06/09 21:24:15]

Why's this public when its compatriots (GetStaticExpectCTState, etc.) are
private?

[dadrian, 2016/06/10 01:05:53]

Because we only parse OCSP responses if the host is in the preload list.

[svaldez, 2016/06/13 14:03:04]

Would it make more sense to have CheckExpectStaple wrap a call to
GetStaticExpectStapleState, or have another wrapper around the combined call?

[dadrian, 2016/06/13 23:03:32]

Done.

+      const std::string& host,
+      ExpectStapleState* expect_staple_result) const;
+
  private:
   friend class TransportSecurityStateTest;
   FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly);
@@ -464,14 +477,6 @@ class NET_EXPORT TransportSecurityState
   bool GetStaticExpectCTState(const std::string& host,
                               ExpectCTState* expect_ct_result) const;
 
-  // Returns true and updates |*expect_staple_result| iff there is a static
-  // (built-in) state for |host| with expect_staple=true, or if |host| is a
-  // subdomain of another domain with expect_staple=true and
-  // include_subdomains_for_expect_staple=true.
-  bool GetStaticExpectStapleState(
-      const std::string& host,
-      ExpectStapleState* expect_staple_result) const;
-
   // The sets of hosts that have enabled TransportSecurity. |domain| will always
   // be empty for a STSState or PKPState in these maps; the domain
   // comes from the map keys instead. In addition, |upgrade_mode| in the
@@ -490,11 +495,11 @@ class NET_EXPORT TransportSecurityState
   // True if static expect-CT state should be used.
   bool enable_static_expect_ct_;
 
+  ExpectCTReporter* expect_ct_reporter_;
+

[estark, 2016/06/09 21:24:15]

any reason for this change?

[dadrian, 2016/06/10 01:05:52]

No idea. I'll try to figure out where this came from.

[dadrian, 2016/06/13 23:03:32]

Just a formatting snafu. Reverted.

   // True if static expect-staple state should be used.
   bool enable_static_expect_staple_;
 
-  ExpectCTReporter* expect_ct_reporter_;
-
   // Keeps track of reports that have been sent recently for
   // rate-limiting.
   ExpiringCache<std::string, bool, base::TimeTicks, std::less<base::TimeTicks>>