Add enterprise policy to exempt hosts from Certificate Transparency

chrome/browser/profiles/profile_io_data.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile_io_data.h"
 
 #include <stddef.h>
 
 #include <string>
 #include <utility>
@@ skipping 40 matching lines @@
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ssl/chrome_expect_ct_reporter.h"
 #include "chrome/browser/ui/search/new_tab_page_interceptor_service.h"
 #include "chrome/browser/ui/search/new_tab_page_interceptor_service_factory.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/features.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "components/about_handler/about_protocol_handler.h"
+#include "components/certificate_transparency/ct_policy_manager.h"
 #include "components/certificate_transparency/tree_state_tracker.h"
 #include "components/content_settings/core/browser/content_settings_provider.h"
 #include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/cookie_config/cookie_store_util.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_io_data.h"
 #include "components/dom_distiller/core/url_constants.h"
 #include "components/metrics/metrics_pref_names.h"
 #include "components/metrics/metrics_service.h"
 #include "components/net_log/chrome_net_log.h"
@@ skipping 451 matching lines @@
   policy::URLBlacklist::SegmentURLCallback callback =
       static_cast<policy::URLBlacklist::SegmentURLCallback>(
           url_formatter::SegmentURL);
   base::SequencedWorkerPool* pool = BrowserThread::GetBlockingPool();
   scoped_refptr<base::SequencedTaskRunner> background_task_runner =
       pool->GetSequencedTaskRunner(pool->GetSequenceToken());
   url_blacklist_manager_.reset(new policy::URLBlacklistManager(
       pref_service, background_task_runner, io_task_runner, callback,
       base::Bind(policy::OverrideBlacklistForURL)));
 
+  // The CTPolicyManager shares the same constraints of needing to be cleaned
+  // up on the UI thread.
+  ct_policy_manager_.reset(new certificate_transparency::CTPolicyManager(
+      pref_service, io_task_runner));
+
   if (!IsOffTheRecord()) {
     // Add policy headers for non-incognito requests.
     policy::PolicyHeaderService* policy_header_service =
         policy::PolicyHeaderServiceFactory::GetForBrowserContext(profile);
     if (policy_header_service) {
       policy_header_helper_ =
           policy_header_service->CreatePolicyHeaderIOHelper(io_task_runner);
     }
   }
 
@@ skipping 126 matching lines @@
   // Destroy certificate_report_sender_ before main_request_context_,
   // since the former has a reference to the latter.
   if (transport_security_state_)
     transport_security_state_->SetReportSender(nullptr);
   certificate_report_sender_.reset();
 
   if (transport_security_state_)
     transport_security_state_->SetExpectCTReporter(nullptr);
   expect_ct_reporter_.reset();
 
+  if (transport_security_state_)
+    transport_security_state_->SetRequireCTDelegate(nullptr);
+
   // TODO(ajwong): These AssertNoURLRequests() calls are unnecessary since they
   // are already done in the URLRequestContext destructor.
   if (main_request_context_)
     main_request_context_->AssertNoURLRequests();
   if (extensions_request_context_)
     extensions_request_context_->AssertNoURLRequests();
 
   current_context = 0;
   for (URLRequestContextMap::iterator it = app_request_context_map_.begin();
        it != app_request_context_map_.end(); ++it) {
@@ skipping 396 matching lines @@
           IsOffTheRecord()));
 
   certificate_report_sender_.reset(new net::ReportSender(
       main_request_context_.get(), net::ReportSender::DO_NOT_SEND_COOKIES));
   transport_security_state_->SetReportSender(certificate_report_sender_.get());
 
   expect_ct_reporter_.reset(
       new ChromeExpectCTReporter(main_request_context_.get()));
   transport_security_state_->SetExpectCTReporter(expect_ct_reporter_.get());
 
+  transport_security_state_->SetRequireCTDelegate(
+      ct_policy_manager_->GetDelegate());
+
   // Take ownership over these parameters.
   cookie_settings_ = profile_params_->cookie_settings;
   host_content_settings_map_ = profile_params_->host_content_settings_map;
 #if defined(ENABLE_EXTENSIONS)
   extension_info_map_ = profile_params_->extension_info_map;
 #endif
 
   resource_context_->host_resolver_ = io_thread_globals->host_resolver.get();
   resource_context_->request_context_ = main_request_context_.get();
 
@@ skipping 174 matching lines @@
   enable_metrics_.Destroy();
   safe_browsing_enabled_.Destroy();
   sync_disabled_.Destroy();
   signin_allowed_.Destroy();
   network_prediction_options_.Destroy();
   if (media_device_id_salt_.get())
     media_device_id_salt_->ShutdownOnUIThread();
   session_startup_pref_.Destroy();
   if (url_blacklist_manager_)
     url_blacklist_manager_->ShutdownOnUIThread();
+  if (ct_policy_manager_)
+    ct_policy_manager_->Shutdown();
   if (chrome_http_user_agent_settings_)
     chrome_http_user_agent_settings_->CleanupOnUIThread();
   incognito_availibility_pref_.Destroy();
 
   if (!context_getters->empty()) {
     if (BrowserThread::IsMessageLoopValid(BrowserThread::IO)) {
       BrowserThread::PostTask(
           BrowserThread::IO, FROM_HERE,
           base::Bind(&NotifyContextGettersOfShutdownOnIO,
               base::Passed(&context_getters)));
@@ skipping 63 matching lines @@
 void ProfileIOData::SetCookieSettingsForTesting(
     content_settings::CookieSettings* cookie_settings) {
   DCHECK(!cookie_settings_.get());
   cookie_settings_ = cookie_settings;
 }
 
 policy::URLBlacklist::URLBlacklistState ProfileIOData::GetURLBlacklistState(
     const GURL& url) const {
   return url_blacklist_manager_->GetURLBlacklistState(url);
 }