Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1346)

Unified Diff: components/certificate_transparency/single_tree_tracker.h

Issue 2668803004: Certificate Transparency: Discard entries pending auditing on network change (Closed)
Patch Set: Created 3 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: components/certificate_transparency/single_tree_tracker.h
diff --git a/components/certificate_transparency/single_tree_tracker.h b/components/certificate_transparency/single_tree_tracker.h
index eb9cd7f8ca0f178e894cc1a90444e7c84335070b..cf9ca88f612190aff8963aed43f91e89eb65744c 100644
--- a/components/certificate_transparency/single_tree_tracker.h
+++ b/components/certificate_transparency/single_tree_tracker.h
@@ -14,6 +14,7 @@
#include "base/memory/ref_counted.h"
#include "base/memory/weak_ptr.h"
#include "net/base/hash_value.h"
+#include "net/base/network_change_notifier.h"
#include "net/cert/ct_verifier.h"
#include "net/cert/signed_tree_head.h"
#include "net/cert/sth_observer.h"
@@ -55,8 +56,10 @@ class LogDnsClient;
// new STHs are observed (which it does by implementing net::ct::STHObserver).
// Once connected to sources providing that data, the status for a given SCT
// can be queried by calling GetLogEntryInclusionCheck.
-class SingleTreeTracker : public net::CTVerifier::Observer,
- public net::ct::STHObserver {
+class SingleTreeTracker
+ : public net::CTVerifier::Observer,
+ public net::ct::STHObserver,
+ public net::NetworkChangeNotifier::NetworkChangeObserver {
Ryan Sleevi 2017/02/01 22:26:58 nit: I'm not going to block this CL, but one thing
Eran Messeri 2017/02/02 14:54:40 Done - adopted your suggestion of having a private
public:
enum SCTInclusionStatus {
// SCT was not observed by this class and is not currently pending
@@ -99,6 +102,14 @@ class SingleTreeTracker : public net::CTVerifier::Observer,
// Must only be called for STHs issued by the log this instance tracks.
void NewSTHObserved(const net::ct::SignedTreeHead& sth) override;
+ // net::NetworkChangeNotifier::NetworkChangeObserver implementation.
+ // Discards all entries pending inclusion check on network change.
+ // That is done to prevent the client looking up inclusion proofs for
+ // certificates received from one network, on another network, thus
+ // leaking state between networks.
+ void OnNetworkChanged(
+ net::NetworkChangeNotifier::ConnectionType type) override;
+
// Returns the status of a given log entry that is assembled from
// |cert| and |sct|. If |cert| and |sct| were not previously observed,
// |sct| is not an SCT for |cert| or |sct| is not for this log,

Powered by Google App Engine
This is Rietveld 408576698