Clang format slam.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ecdsa.h>
 #include <openssl/ssl.h>
 #else  // !defined(USE_OPENSSL)
@@ skipping 44 matching lines @@
 }
 
 std::string HashHost(const std::string& canonicalized_host) {
   char hashed[crypto::kSHA256Length];
   crypto::SHA256HashString(canonicalized_host, hashed, sizeof(hashed));
   return std::string(hashed, sizeof(hashed));
 }
 
 // Returns true if the intersection of |a| and |b| is not empty. If either
 // |a| or |b| is empty, returns false.
-bool HashesIntersect(const HashValueVector& a,
-                     const HashValueVector& b) {
+bool HashesIntersect(const HashValueVector& a, const HashValueVector& b) {
   for (HashValueVector::const_iterator i = a.begin(); i != a.end(); ++i) {
     HashValueVector::const_iterator j =
         std::find_if(b.begin(), b.end(), HashValuesEqual(*i));
     if (j != b.end())
       return true;
   }
   return false;
 }
 
-bool AddHash(const char* sha1_hash,
-             HashValueVector* out) {
+bool AddHash(const char* sha1_hash, HashValueVector* out) {
   HashValue hash(HASH_VALUE_SHA1);
   memcpy(hash.data(), sha1_hash, hash.size());
   out->push_back(hash);
   return true;
 }
 
 }  // namespace
 
-TransportSecurityState::TransportSecurityState()
-  : delegate_(NULL) {
+TransportSecurityState::TransportSecurityState() : delegate_(NULL) {
   DCHECK(CalledOnValidThread());
 }
 
 TransportSecurityState::Iterator::Iterator(const TransportSecurityState& state)
     : iterator_(state.enabled_hosts_.begin()),
       end_(state.enabled_hosts_.end()) {
 }
 
-TransportSecurityState::Iterator::~Iterator() {}
+TransportSecurityState::Iterator::~Iterator() {
+}
 
 void TransportSecurityState::SetDelegate(
     TransportSecurityState::Delegate* delegate) {
   DCHECK(CalledOnValidThread());
   delegate_ = delegate;
 }
 
 void TransportSecurityState::EnableHost(const std::string& host,
                                         const DomainState& state) {
   DCHECK(CalledOnValidThread());
@@ skipping 11 matching lines @@
   DirtyNotify();
 }
 
 bool TransportSecurityState::DeleteDynamicDataForHost(const std::string& host) {
   DCHECK(CalledOnValidThread());
 
   const std::string canonicalized_host = CanonicalizeHost(host);
   if (canonicalized_host.empty())
     return false;
 
-  DomainStateMap::iterator i = enabled_hosts_.find(
-      HashHost(canonicalized_host));
+  DomainStateMap::iterator i =
+      enabled_hosts_.find(HashHost(canonicalized_host));
   if (i != enabled_hosts_.end()) {
     enabled_hosts_.erase(i);
     DirtyNotify();
     return true;
   }
   return false;
 }
 
 bool TransportSecurityState::GetDomainState(const std::string& host,
                                             bool sni_enabled,
                                             DomainState* result) {
   DCHECK(CalledOnValidThread());
 
   DomainState state;
   const std::string canonicalized_host = CanonicalizeHost(host);
   if (canonicalized_host.empty())
     return false;
 
-  bool has_preload = GetStaticDomainState(canonicalized_host, sni_enabled,
-                                          &state);
+  bool has_preload =
+      GetStaticDomainState(canonicalized_host, sni_enabled, &state);
   std::string canonicalized_preload = CanonicalizeHost(state.domain);
   GetDynamicDomainState(host, &state);
 
   base::Time current_time(base::Time::Now());
 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     std::string host_sub_chunk(&canonicalized_host[i],
                                canonicalized_host.size() - i);
     // Exact match of a preload always wins.
     if (has_preload && host_sub_chunk == canonicalized_preload) {
       *result = state;
       return true;
     }
 
-    DomainStateMap::iterator j =
-        enabled_hosts_.find(HashHost(host_sub_chunk));
+    DomainStateMap::iterator j = enabled_hosts_.find(HashHost(host_sub_chunk));
     if (j == enabled_hosts_.end())
       continue;
 
     if (current_time > j->second.upgrade_expiry &&
         current_time > j->second.dynamic_spki_hashes_expiry) {
       enabled_hosts_.erase(j);
       DirtyNotify();
       continue;
     }
 
@@ skipping 82 matching lines @@
   return new_host;
 }
 
 // |ReportUMAOnPinFailure| uses these to report which domain was associated
 // with the public key pinning failure.
 //
 // DO NOT CHANGE THE ORDERING OF THESE NAMES OR REMOVE ANY OF THEM. Add new
 // domains at the END of the listing (but before DOMAIN_NUM_EVENTS).
 enum SecondLevelDomainName {
   DOMAIN_NOT_PINNED,
-
   DOMAIN_GOOGLE_COM,
   DOMAIN_ANDROID_COM,
   DOMAIN_GOOGLE_ANALYTICS_COM,
   DOMAIN_GOOGLEPLEX_COM,
   DOMAIN_YTIMG_COM,
   DOMAIN_GOOGLEUSERCONTENT_COM,
   DOMAIN_YOUTUBE_COM,
   DOMAIN_GOOGLEAPIS_COM,
   DOMAIN_GOOGLEADSERVICES_COM,
   DOMAIN_GOOGLECODE_COM,
   DOMAIN_APPSPOT_COM,
   DOMAIN_GOOGLESYNDICATION_COM,
   DOMAIN_DOUBLECLICK_NET,
   DOMAIN_GSTATIC_COM,
   DOMAIN_GMAIL_COM,
   DOMAIN_GOOGLEMAIL_COM,
   DOMAIN_GOOGLEGROUPS_COM,
-
   DOMAIN_TORPROJECT_ORG,
-
   DOMAIN_TWITTER_COM,
   DOMAIN_TWIMG_COM,
-
   DOMAIN_AKAMAIHD_NET,
-
   DOMAIN_TOR2WEB_ORG,
-
   DOMAIN_YOUTU_BE,
   DOMAIN_GOOGLECOMMERCE_COM,
   DOMAIN_URCHIN_COM,
   DOMAIN_GOO_GL,
   DOMAIN_G_CO,
   DOMAIN_GOOGLE_AC,
   DOMAIN_GOOGLE_AD,
   DOMAIN_GOOGLE_AE,
   DOMAIN_GOOGLE_AF,
   DOMAIN_GOOGLE_AG,
@@ skipping 202 matching lines @@
   DOMAIN_GOOGLE_TM,
   DOMAIN_GOOGLE_TN,
   DOMAIN_GOOGLE_TO,
   DOMAIN_GOOGLE_TP,
   DOMAIN_GOOGLE_TT,
   DOMAIN_GOOGLE_US,
   DOMAIN_GOOGLE_UZ,
   DOMAIN_GOOGLE_VG,
   DOMAIN_GOOGLE_VU,
   DOMAIN_GOOGLE_WS,
-
   DOMAIN_CHROMIUM_ORG,
-
   DOMAIN_CRYPTO_CAT,
   DOMAIN_LAVABIT_COM,
-
   DOMAIN_GOOGLETAGMANAGER_COM,
   DOMAIN_GOOGLETAGSERVICES_COM,
 
   // Boundary value for UMA_HISTOGRAM_ENUMERATION:
   DOMAIN_NUM_EVENTS
 };
 
 // PublicKeyPins contains a number of SubjectPublicKeyInfo hashes for a site.
 // The validated certificate chain for the site must not include any of
 // |excluded_hashes| and must include one or more of |required_hashes|.
 struct PublicKeyPins {
   const char* const* required_hashes;
   const char* const* excluded_hashes;
 };
 
 struct HSTSPreload {
   uint8 length;
   bool include_subdomains;
   char dns_name[38];
   bool https_required;
   PublicKeyPins pins;
   SecondLevelDomainName second_level_domain_name;
 };
 
-static bool HasPreload(const struct HSTSPreload* entries, size_t num_entries,
-                       const std::string& canonicalized_host, size_t i,
-                       TransportSecurityState::DomainState* out, bool* ret) {
+static bool HasPreload(const struct HSTSPreload* entries,
+                       size_t num_entries,
+                       const std::string& canonicalized_host,
+                       size_t i,
+                       TransportSecurityState::DomainState* out,
+                       bool* ret) {
   for (size_t j = 0; j < num_entries; j++) {
     if (entries[j].length == canonicalized_host.size() - i &&
-        memcmp(entries[j].dns_name, &canonicalized_host[i],
+        memcmp(entries[j].dns_name,
+               &canonicalized_host[i],
                entries[j].length) == 0) {
       if (!entries[j].include_subdomains && i != 0) {
         *ret = false;
       } else {
         out->sts_include_subdomains = entries[j].include_subdomains;
         out->pkp_include_subdomains = entries[j].include_subdomains;
         *ret = true;
         if (!entries[j].https_required)
           out->upgrade_mode = TransportSecurityState::DomainState::MODE_DEFAULT;
         if (entries[j].pins.required_hashes) {
@@ skipping 70 matching lines @@
 
 bool TransportSecurityState::AddHPKPHeader(const std::string& host,
                                            const std::string& value,
                                            const SSLInfo& ssl_info) {
   DCHECK(CalledOnValidThread());
 
   base::Time now = base::Time::Now();
   base::TimeDelta max_age;
   TransportSecurityState::DomainState domain_state;
   GetDynamicDomainState(host, &domain_state);
-  if (ParseHPKPHeader(value, ssl_info.public_key_hashes,
-                      &max_age, &domain_state.pkp_include_subdomains,
+  if (ParseHPKPHeader(value,
+                      ssl_info.public_key_hashes,
+                      &max_age,
+                      &domain_state.pkp_include_subdomains,
                       &domain_state.dynamic_spki_hashes)) {
     // TODO(palmer): http://crbug.com/243865 handle max-age == 0.
     domain_state.pkp_observed = now;
     domain_state.dynamic_spki_hashes_expiry = now + max_age;
     EnableHost(host, domain_state);
     return true;
   }
   return false;
 }
 
 bool TransportSecurityState::AddHSTS(const std::string& host,
                                      const base::Time& expiry,
                                      bool include_subdomains) {
   DCHECK(CalledOnValidThread());
 
   // Copy-and-modify the existing DomainState for this host (if any).
   TransportSecurityState::DomainState domain_state;
   const std::string canonicalized_host = CanonicalizeHost(host);
   const std::string hashed_host = HashHost(canonicalized_host);
-  DomainStateMap::const_iterator i = enabled_hosts_.find(
-      hashed_host);
+  DomainStateMap::const_iterator i = enabled_hosts_.find(hashed_host);
   if (i != enabled_hosts_.end())
     domain_state = i->second;
 
   domain_state.sts_observed = base::Time::Now();
   domain_state.sts_include_subdomains = include_subdomains;
   domain_state.upgrade_expiry = expiry;
   domain_state.upgrade_mode = DomainState::MODE_FORCE_HTTPS;
   EnableHost(host, domain_state);
   return true;
 }
 
 bool TransportSecurityState::AddHPKP(const std::string& host,
                                      const base::Time& expiry,
                                      bool include_subdomains,
                                      const HashValueVector& hashes) {
   DCHECK(CalledOnValidThread());
 
   // Copy-and-modify the existing DomainState for this host (if any).
   TransportSecurityState::DomainState domain_state;
   const std::string canonicalized_host = CanonicalizeHost(host);
   const std::string hashed_host = HashHost(canonicalized_host);
-  DomainStateMap::const_iterator i = enabled_hosts_.find(
-      hashed_host);
+  DomainStateMap::const_iterator i = enabled_hosts_.find(hashed_host);
   if (i != enabled_hosts_.end())
     domain_state = i->second;
 
   domain_state.pkp_observed = base::Time::Now();
   domain_state.pkp_include_subdomains = include_subdomains;
   domain_state.dynamic_spki_hashes_expiry = expiry;
   domain_state.dynamic_spki_hashes = hashes;
   EnableHost(host, domain_state);
   return true;
 }
 
 // static
 bool TransportSecurityState::IsGooglePinnedProperty(const std::string& host,
                                                     bool sni_enabled) {
   std::string canonicalized_host = CanonicalizeHost(host);
   const struct HSTSPreload* entry =
       GetHSTSPreload(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS);
 
   if (entry && entry->pins.required_hashes == kGoogleAcceptableCerts)
     return true;
 
   if (sni_enabled) {
-    entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS,
-                           kNumPreloadedSNISTS);
+    entry = GetHSTSPreload(
+        canonicalized_host, kPreloadedSNISTS, kNumPreloadedSNISTS);
     if (entry && entry->pins.required_hashes == kGoogleAcceptableCerts)
       return true;
   }
 
   return false;
 }
 
 // static
 void TransportSecurityState::ReportUMAOnPinFailure(const std::string& host) {
   std::string canonicalized_host = CanonicalizeHost(host);
 
   const struct HSTSPreload* entry =
       GetHSTSPreload(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS);
 
   if (!entry) {
-    entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS,
-                           kNumPreloadedSNISTS);
+    entry = GetHSTSPreload(
+        canonicalized_host, kPreloadedSNISTS, kNumPreloadedSNISTS);
   }
 
   if (!entry) {
     // We don't care to report pin failures for dynamic pins.
     return;
   }
 
   DCHECK(entry);
   DCHECK(entry->pins.required_hashes);
   DCHECK(entry->second_level_domain_name != DOMAIN_NOT_PINNED);
 
   UMA_HISTOGRAM_ENUMERATION("Net.PublicKeyPinFailureDomain",
-                            entry->second_level_domain_name, DOMAIN_NUM_EVENTS);
+                            entry->second_level_domain_name,
+                            DOMAIN_NUM_EVENTS);
 }
 
 // static
 bool TransportSecurityState::IsBuildTimely() {
   const base::Time build_time = base::GetBuildTime();
   // We consider built-in information to be timely for 10 weeks.
   return (base::Time::Now() - build_time).InDays() < 70 /* 10 weeks */;
 }
 
 bool TransportSecurityState::GetStaticDomainState(
     const std::string& canonicalized_host,
     bool sni_enabled,
     DomainState* out) {
   DCHECK(CalledOnValidThread());
 
   out->upgrade_mode = DomainState::MODE_FORCE_HTTPS;
   out->sts_include_subdomains = false;
   out->pkp_include_subdomains = false;
 
   const bool is_build_timely = IsBuildTimely();
 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     std::string host_sub_chunk(&canonicalized_host[i],
                                canonicalized_host.size() - i);
     out->domain = DNSDomainToString(host_sub_chunk);
     bool ret;
-    if (is_build_timely &&
-        HasPreload(kPreloadedSTS, kNumPreloadedSTS, canonicalized_host, i, out,
-                   &ret)) {
+    if (is_build_timely && HasPreload(kPreloadedSTS,
+                                      kNumPreloadedSTS,
+                                      canonicalized_host,
+                                      i,
+                                      out,
+                                      &ret)) {
       return ret;
     }
-    if (sni_enabled &&
-        is_build_timely &&
-        HasPreload(kPreloadedSNISTS, kNumPreloadedSNISTS, canonicalized_host, i,
-                   out, &ret)) {
+    if (sni_enabled && is_build_timely && HasPreload(kPreloadedSNISTS,
+                                                     kNumPreloadedSNISTS,
+                                                     canonicalized_host,
+                                                     i,
+                                                     out,
+                                                     &ret)) {
       return ret;
     }
   }
 
   return false;
 }
 
 bool TransportSecurityState::GetDynamicDomainState(const std::string& host,
                                                    DomainState* result) {
   DCHECK(CalledOnValidThread());
 
   DomainState state;
   const std::string canonicalized_host = CanonicalizeHost(host);
   if (canonicalized_host.empty())
     return false;
 
   base::Time current_time(base::Time::Now());
 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     std::string host_sub_chunk(&canonicalized_host[i],
                                canonicalized_host.size() - i);
-    DomainStateMap::iterator j =
-        enabled_hosts_.find(HashHost(host_sub_chunk));
+    DomainStateMap::iterator j = enabled_hosts_.find(HashHost(host_sub_chunk));
     if (j == enabled_hosts_.end())
       continue;
 
     if (current_time > j->second.upgrade_expiry &&
         current_time > j->second.dynamic_spki_hashes_expiry) {
       enabled_hosts_.erase(j);
       DirtyNotify();
       continue;
     }
 
     state = j->second;
     state.domain = DNSDomainToString(host_sub_chunk);
 
     // Succeed if we matched the domain exactly or if subdomain matches are
     // allowed.
     if (i == 0 || j->second.sts_include_subdomains ||
         j->second.pkp_include_subdomains) {
       *result = state;
       return true;
     }
 
     return false;
   }
 
   return false;
 }
 
-
 void TransportSecurityState::AddOrUpdateEnabledHosts(
-    const std::string& hashed_host, const DomainState& state) {
+    const std::string& hashed_host,
+    const DomainState& state) {
   DCHECK(CalledOnValidThread());
   enabled_hosts_[hashed_host] = state;
 }
 
 TransportSecurityState::DomainState::DomainState()
     : upgrade_mode(MODE_DEFAULT),
       sts_include_subdomains(false),
       pkp_include_subdomains(false) {
   base::Time now(base::Time::Now());
   sts_observed = now;
   pkp_observed = now;
 }
 
 TransportSecurityState::DomainState::~DomainState() {
 }
 
 bool TransportSecurityState::DomainState::CheckPublicKeyPins(
-    const HashValueVector& hashes, std::string* failure_log) const {
+    const HashValueVector& hashes,
+    std::string* failure_log) const {
   // Validate that hashes is not empty. By the time this code is called (in
   // production), that should never happen, but it's good to be defensive.
   // And, hashes *can* be empty in some test scenarios.
   if (hashes.empty()) {
-    *failure_log = "Rejecting empty public key chain for public-key-pinned "
-                   "domains: " + domain;
+    *failure_log =
+        "Rejecting empty public key chain for public-key-pinned "
+        "domains: " +
+        domain;
     return false;
   }
 
   if (HashesIntersect(bad_static_spki_hashes, hashes)) {
     *failure_log = "Rejecting public key chain for domain " + domain +
                    ". Validated chain: " + HashesToBase64String(hashes) +
                    ", matches one or more bad hashes: " +
                    HashesToBase64String(bad_static_spki_hashes);
     return false;
   }
@@ skipping 16 matching lines @@
 
 bool TransportSecurityState::DomainState::ShouldUpgradeToSSL() const {
   return upgrade_mode == MODE_FORCE_HTTPS;
 }
 
 bool TransportSecurityState::DomainState::ShouldSSLErrorsBeFatal() const {
   return true;
 }
 
 bool TransportSecurityState::DomainState::HasPublicKeyPins() const {
-  return static_spki_hashes.size() > 0 ||
-         bad_static_spki_hashes.size() > 0 ||
+  return static_spki_hashes.size() > 0 || bad_static_spki_hashes.size() > 0 ||
          dynamic_spki_hashes.size() > 0;
 }
 
 }  // namespace