Index: components/certificate_transparency/single_tree_tracker.h |
diff --git a/components/certificate_transparency/single_tree_tracker.h b/components/certificate_transparency/single_tree_tracker.h |
index eb9cd7f8ca0f178e894cc1a90444e7c84335070b..cf9ca88f612190aff8963aed43f91e89eb65744c 100644 |
--- a/components/certificate_transparency/single_tree_tracker.h |
+++ b/components/certificate_transparency/single_tree_tracker.h |
@@ -14,6 +14,7 @@ |
#include "base/memory/ref_counted.h" |
#include "base/memory/weak_ptr.h" |
#include "net/base/hash_value.h" |
+#include "net/base/network_change_notifier.h" |
#include "net/cert/ct_verifier.h" |
#include "net/cert/signed_tree_head.h" |
#include "net/cert/sth_observer.h" |
@@ -55,8 +56,10 @@ class LogDnsClient; |
// new STHs are observed (which it does by implementing net::ct::STHObserver). |
// Once connected to sources providing that data, the status for a given SCT |
// can be queried by calling GetLogEntryInclusionCheck. |
-class SingleTreeTracker : public net::CTVerifier::Observer, |
- public net::ct::STHObserver { |
+class SingleTreeTracker |
+ : public net::CTVerifier::Observer, |
+ public net::ct::STHObserver, |
+ public net::NetworkChangeNotifier::NetworkChangeObserver { |
Ryan Sleevi
2017/02/01 22:26:58
nit: I'm not going to block this CL, but one thing
Eran Messeri
2017/02/02 14:54:40
Done - adopted your suggestion of having a private
|
public: |
enum SCTInclusionStatus { |
// SCT was not observed by this class and is not currently pending |
@@ -99,6 +102,14 @@ class SingleTreeTracker : public net::CTVerifier::Observer, |
// Must only be called for STHs issued by the log this instance tracks. |
void NewSTHObserved(const net::ct::SignedTreeHead& sth) override; |
+ // net::NetworkChangeNotifier::NetworkChangeObserver implementation. |
+ // Discards all entries pending inclusion check on network change. |
+ // That is done to prevent the client looking up inclusion proofs for |
+ // certificates received from one network, on another network, thus |
+ // leaking state between networks. |
+ void OnNetworkChanged( |
+ net::NetworkChangeNotifier::ConnectionType type) override; |
+ |
// Returns the status of a given log entry that is assembled from |
// |cert| and |sct|. If |cert| and |sct| were not previously observed, |
// |sct| is not an SCT for |cert| or |sct| is not for this log, |