Certificate Transparency: Discard entries pending auditing on network change

components/certificate_transparency/single_tree_tracker.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/certificate_transparency/single_tree_tracker.h"
 
 #include <algorithm>
 #include <iterator>
 #include <list>
 #include <utility>
@@ skipping 200 matching lines @@
   // tree size in the proof).
   // To avoid having to re-fetch the inclusion proof if a newer STH is provided
   // to the SingleTreeTracker, the size of the original tree for which the
   // inclusion proof was requested is stored in |proof| and the root hash
   // in |root_hash|.
   std::string root_hash;
 
   explicit EntryAuditState(AuditState state) : state(state) {}
 };
 
+class SingleTreeTracker::NetworkObserver
+    : public net::NetworkChangeNotifier::NetworkChangeObserver {
+ public:
+  explicit NetworkObserver(SingleTreeTracker* parent) : parent_(parent) {
+    net::NetworkChangeNotifier::AddNetworkChangeObserver(this);
+  }
+
+  ~NetworkObserver() override {
+    net::NetworkChangeNotifier::RemoveNetworkChangeObserver(this);
+  }
+
+  // net::NetworkChangeNotifier::NetworkChangeObserver implementation.
+  void OnNetworkChanged(
+      net::NetworkChangeNotifier::ConnectionType type) override {
+    parent_->ResetPendingQueue();
+  }
+
+ private:
+  SingleTreeTracker* parent_;
+};
+
 // Orders entries by the SCT timestamp. In case of tie, which is very unlikely
 // as it requires two SCTs issued from a log at exactly the same time, order
 // by leaf hash.
 bool SingleTreeTracker::OrderByTimestamp::operator()(
     const EntryToAudit& lhs,
     const EntryToAudit& rhs) const {
   if (lhs.sct_timestamp != rhs.sct_timestamp)
     return lhs.sct_timestamp < rhs.sct_timestamp;
 
   return net::SHA256HashValueLessThan()(lhs.leaf_hash, rhs.leaf_hash);
 }
 
 SingleTreeTracker::SingleTreeTracker(
     scoped_refptr<const net::CTLogVerifier> ct_log,
     LogDnsClient* dns_client,
     net::NetLog* net_log)
     : ct_log_(std::move(ct_log)),
       checked_entries_(kCheckedEntriesCacheSize),
       dns_client_(dns_client),
       net_log_(net::NetLogWithSource::Make(
           net_log,
           net::NetLogSourceType::CT_TREE_STATE_TRACKER)),
+      network_observer_(new NetworkObserver(this)),
       weak_factory_(this) {
   memory_pressure_listener_.reset(new base::MemoryPressureListener(base::Bind(
       &SingleTreeTracker::OnMemoryPressure, base::Unretained(this))));
 }
 
-SingleTreeTracker::~SingleTreeTracker() {}
+SingleTreeTracker::~SingleTreeTracker() = default;
 
 void SingleTreeTracker::OnSCTVerified(net::X509Certificate* cert,
                                       const SignedCertificateTimestamp* sct) {
   DCHECK_EQ(ct_log_->key_id(), sct->log_id);
 
   EntryToAudit entry(sct->timestamp);
   if (!GetLogEntryLeafHash(cert, sct, &entry.leaf_hash))
     return;
 
   // Avoid queueing multiple instances of the same entry.
@@ skipping 82 matching lines @@
     DCHECK_EQ(curr_entry->second.state, PENDING_NEWER_STH);
     curr_entry->second.state = PENDING_INCLUSION_PROOF_REQUEST;
   }
 
   if (auditable_entries_begin == auditable_entries_end)
     return;
 
   ProcessPendingEntries();
 }
 
+void SingleTreeTracker::ResetPendingQueue() {
+  pending_entries_.clear();
+}
+
 SingleTreeTracker::SCTInclusionStatus
 SingleTreeTracker::GetLogEntryInclusionStatus(
     net::X509Certificate* cert,
     const SignedCertificateTimestamp* sct) {
   EntryToAudit entry(sct->timestamp);
   if (!GetLogEntryLeafHash(cert, sct, &entry.leaf_hash))
     return SCT_NOT_OBSERVED;
   return GetAuditedEntryInclusionStatus(entry);
 }
 
@@ skipping 123 matching lines @@
                                                bool success) {
   net::NetLogParametersCallback net_log_callback =
       base::Bind(&NetLogEntryAuditingEventCallback, &entry.leaf_hash,
                  ct_log_->key_id(), success);
 
   net_log_.AddEvent(net::NetLogEventType::CT_LOG_ENTRY_AUDITED,
                     net_log_callback);
 }
 
 }  // namespace certificate_transparency