Handle max-age in HPKP.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ecdsa.h>
 #include <openssl/ssl.h>
 #else  // !defined(USE_OPENSSL)
@@ skipping 608 matching lines @@
 
 bool TransportSecurityState::AddHSTSHeader(const std::string& host,
                                            const std::string& value) {
   DCHECK(CalledOnValidThread());
 
   base::Time now = base::Time::Now();
   base::TimeDelta max_age;
   TransportSecurityState::DomainState domain_state;
   GetDynamicDomainState(host, &domain_state);
   if (ParseHSTSHeader(value, &max_age, &domain_state.sts.include_subdomains)) {
-    // Handle max-age == 0
+    // Handle max-age == 0.
     if (max_age.InSeconds() == 0)
       domain_state.sts.upgrade_mode = DomainState::MODE_DEFAULT;
     else
       domain_state.sts.upgrade_mode = DomainState::MODE_FORCE_HTTPS;
     domain_state.sts.last_observed = now;
     domain_state.sts.expiry = now + max_age;
     EnableHost(host, domain_state);
     return true;
   }
   return false;
 }
 
 bool TransportSecurityState::AddHPKPHeader(const std::string& host,
                                            const std::string& value,
                                            const SSLInfo& ssl_info) {
   DCHECK(CalledOnValidThread());
 
   base::Time now = base::Time::Now();
   base::TimeDelta max_age;
   TransportSecurityState::DomainState domain_state;
   GetDynamicDomainState(host, &domain_state);
   if (ParseHPKPHeader(value,
                       ssl_info.public_key_hashes,
                       &max_age,
                       &domain_state.pkp.include_subdomains,
                       &domain_state.pkp.spki_hashes)) {
-    // TODO(palmer): http://crbug.com/243865 handle max-age == 0.
+    // Handle max-age == 0.
+    if (max_age.InSeconds() == 0)
+      domain_state.pkp.spki_hashes.clear();
     domain_state.pkp.last_observed = now;
     domain_state.pkp.expiry = now + max_age;
     EnableHost(host, domain_state);
     return true;
   }
   return false;
 }
 
 bool TransportSecurityState::AddHSTS(const std::string& host,
                                      const base::Time& expiry,
@@ skipping 230 matching lines @@
   return pkp.spki_hashes.size() > 0 || pkp.bad_spki_hashes.size() > 0;
 }
 
 TransportSecurityState::DomainState::PKPState::PKPState() {
 }
 
 TransportSecurityState::DomainState::PKPState::~PKPState() {
 }
 
 }  // namespace