Add enterprise policy to exempt hosts from Certificate Transparency

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <memory>
 #include <utility>
 #include <vector>
@@ skipping 23 matching lines @@
 namespace net {
 
 namespace {
 
 #include "net/http/transport_security_state_static.h"
 
 const size_t kMaxHPKPReportCacheEntries = 50;
 const int kTimeToRememberHPKPReportsMins = 60;
 const size_t kReportCacheKeyLength = 16;
 
+// Override for ShouldRequireCT() for unit tests. Possible values:
+//  -1: Unless a delegate says otherwise, do not require CT.
+//   0: Use the default implementation (e.g. production)
+//   1: Unless a delegate says otherwise, require CT.
+int g_ct_required_for_testing = 0;
+
 void RecordUMAForHPKPReportFailure(const GURL& report_uri, int net_error) {
   UMA_HISTOGRAM_SPARSE_SLOWLY("Net.PublicKeyPinReportSendingFailure",
                               net_error);
 }
 
 std::string TimeToISO8601(const base::Time& t) {
   base::Time::Exploded exploded;
   t.UTCExplode(&exploded);
   return base::StringPrintf(
       "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", exploded.year, exploded.month,
@@ skipping 651 matching lines @@
     const X509Certificate* validated_certificate_chain,
     const HashValueVector& public_key_hashes) {
   using CTRequirementLevel = RequireCTDelegate::CTRequirementLevel;
 
   CTRequirementLevel ct_required = CTRequirementLevel::DEFAULT;
   if (require_ct_delegate_)
     ct_required = require_ct_delegate_->IsCTRequiredForHost(hostname);
   if (ct_required != CTRequirementLevel::DEFAULT)
     return ct_required == CTRequirementLevel::REQUIRED;
 
+  // Allow unittests to override the default result.
+  if (g_ct_required_for_testing)
+    return g_ct_required_for_testing == 1;
+
   return false;
 }
 
 void TransportSecurityState::SetDelegate(
     TransportSecurityState::Delegate* delegate) {
   DCHECK(CalledOnValidThread());
   delegate_ = delegate;
 }
 
 void TransportSecurityState::SetReportSender(
@@ skipping 403 matching lines @@
     return;
   }
 
   DCHECK(result.domain_id != DOMAIN_NOT_PINNED);
 
   UMA_HISTOGRAM_SPARSE_SLOWLY(
       "Net.PublicKeyPinFailureDomain", result.domain_id);
 }
 
 // static
+void TransportSecurityState::SetShouldRequireCTForTesting(bool* required) {
+  if (!required) {
+    g_ct_required_for_testing = 0;
+    return;
+  }
+  g_ct_required_for_testing = *required ? 1 : -1;
+}
+
+// static
 bool TransportSecurityState::IsBuildTimely() {
   const base::Time build_time = base::GetBuildTime();
   // We consider built-in information to be timely for 10 weeks.
   return (base::Time::Now() - build_time).InDays() < 70 /* 10 weeks */;
 }
 
 TransportSecurityState::PKPStatus
 TransportSecurityState::CheckPublicKeyPinsImpl(
     const HostPortPair& host_port_pair,
     bool is_issued_by_known_root,
@@ skipping 269 matching lines @@
 TransportSecurityState::PKPStateIterator::PKPStateIterator(
     const TransportSecurityState& state)
     : iterator_(state.enabled_pkp_hosts_.begin()),
       end_(state.enabled_pkp_hosts_.end()) {
 }
 
 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
 }
 
 }  // namespace