Turn off Expect-Staple reporting for private roots

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <memory>
 #include <utility>
 #include <vector>
@@ skipping 663 matching lines @@
     case OCSPRevocationStatus::UNKNOWN:
       return "UNKNOWN";
   }
   return std::string();
 }
 
 bool SerializeExpectStapleReport(const HostPortPair& host_port_pair,
                                  const SSLInfo& ssl_info,
                                  const std::string& ocsp_response,
                                  std::string* out_serialized_report) {
+  DCHECK(ssl_info.is_issued_by_known_root);
   base::DictionaryValue report;
   report.SetString("date-time", TimeToISO8601(base::Time::Now()));
   report.SetString("hostname", host_port_pair.host());
   report.SetInteger("port", host_port_pair.port());
   report.SetString("response-status",
                    SerializeExpectStapleResponseStatus(
                        ssl_info.ocsp_result.response_status));
 
   if (!ocsp_response.empty()) {
     std::string encoded_ocsp_response;
     base::Base64Encode(ocsp_response, &encoded_ocsp_response);
     report.SetString("ocsp-response", encoded_ocsp_response);
   }
   if (ssl_info.ocsp_result.response_status == OCSPVerifyResult::PROVIDED) {
     report.SetString("cert-status",
                      SerializeExpectStapleRevocationStatus(
                          ssl_info.ocsp_result.revocation_status));
   }
-  if (ssl_info.is_issued_by_known_root) {
-    report.Set("served-certificate-chain",
-               GetPEMEncodedChainAsList(ssl_info.unverified_cert.get()));
-    report.Set("validated-certificate-chain",
-               GetPEMEncodedChainAsList(ssl_info.cert.get()));
-  }
+
+  report.Set("served-certificate-chain",
+             GetPEMEncodedChainAsList(ssl_info.unverified_cert.get()));
+  report.Set("validated-certificate-chain",
+             GetPEMEncodedChainAsList(ssl_info.cert.get()));
 
   if (!base::JSONWriter::Write(report, out_serialized_report))
     return false;
   return true;
 }
 
 }  // namespace
 
 TransportSecurityState::TransportSecurityState()
     : enable_static_pins_(true),
@@ skipping 67 matching lines @@
   UMA_HISTOGRAM_BOOLEAN("Net.PublicKeyPinSuccess",
                         pin_validity == PKPStatus::OK);
   return pin_validity;
 }
 
 void TransportSecurityState::CheckExpectStaple(
     const HostPortPair& host_port_pair,
     const SSLInfo& ssl_info,
     const std::string& ocsp_response) {
   DCHECK(CalledOnValidThread());
-  if (!enable_static_expect_staple_ || !report_sender_)
+  if (!enable_static_expect_staple_ || !report_sender_ ||
+      !ssl_info.is_issued_by_known_root) {
     return;
+  }
 
   // Determine if the host is on the Expect-Staple preload list. If the build is
   // not timely (i.e. the preload list is not fresh), this will fail and return
   // false.
   ExpectStapleState expect_staple_state;
   if (!GetStaticExpectStapleState(host_port_pair.host(), &expect_staple_state))
     return;
 
   // No report needed if a stapled OCSP response was provided.
   if (ssl_info.ocsp_result.response_status == OCSPVerifyResult::PROVIDED &&
@@ skipping 850 matching lines @@
 TransportSecurityState::PKPStateIterator::PKPStateIterator(
     const TransportSecurityState& state)
     : iterator_(state.enabled_pkp_hosts_.begin()),
       end_(state.enabled_pkp_hosts_.end()) {
 }
 
 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
 }
 
 }  // namespace