Do not send repeated Expect-CT reports to the same host+port

net/http/transport_security_state.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 554 matching lines @@
   void ProcessExpectCTHeader(const std::string& value,
                              const HostPortPair& host_port_pair,
                              const SSLInfo& ssl_info);
 
   // For unit tests only. Causes CheckCTRequirements() to return
   // CT_REQUIREMENTS_NOT_MET (if |*required| is true) or CT_REQUIREMENTS_MET (if
   // |*required| is false) for non-compliant connections by default (that is,
   // unless a RequireCTDelegate overrides). Set to nullptr to reset.
   static void SetShouldRequireCTForTesting(bool* required);
 
+  // For unit tests only. Clears the caches that deduplicate sent HPKP and
+  // Expect-CT reports.
+  void ClearReportCachesForTesting();
+
  private:
   friend class TransportSecurityStateTest;
   friend class TransportSecurityStateStaticFuzzer;
   FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly);
   FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPMaxAge0);
   FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, NoClobberPins);
   FRIEND_TEST_ALL_PREFIXES(URLRequestTestHTTP, ExpectCTHeader);
 
   typedef std::map<std::string, STSState> STSStateMap;
   typedef std::map<std::string, PKPState> PKPStateMap;
   typedef std::map<std::string, ExpectCTState> ExpectCTStateMap;
+  typedef ExpiringCache<std::string,
+                        bool,
+                        base::TimeTicks,
+                        std::less<base::TimeTicks>>
+      ReportCache;
 
   // IsBuildTimely returns true if the current build is new enough ensure that
   // built in security information (i.e. HSTS preloading and pinning
   // information) is timely.
   static bool IsBuildTimely();
 
   // Helper method for actually checking pins.
   PKPStatus CheckPublicKeyPinsImpl(
       const HostPortPair& host_port_pair,
       bool is_issued_by_known_root,
@@ skipping 59 matching lines @@
                               ExpectCTState* expect_ct_result) const;
 
   // Returns true and updates |*expect_staple_result| iff there is a static
   // (built-in) state for |host| with expect_staple=true, or if |host| is a
   // subdomain of another domain with expect_staple=true and
   // include_subdomains_for_expect_staple=true.
   bool GetStaticExpectStapleState(
       const std::string& host,
       ExpectStapleState* expect_staple_result) const;
 
+  void MaybeNotifyExpectCTFailed(
+      const HostPortPair& host_port_pair,
+      const GURL& report_uri,
+      const X509Certificate* validated_certificate_chain,
+      const X509Certificate* served_certificate_chain,
+      const SignedCertificateTimestampAndStatusList&
+          signed_certificate_timestamps);
+
   // The sets of hosts that have enabled TransportSecurity. |domain| will always
   // be empty for a STSState, PKPState, or ExpectCTState in these maps; the
   // domain comes from the map keys instead. In addition, |upgrade_mode| in the
   // STSState is never MODE_DEFAULT and |HasPublicKeyPins| in the PKPState
   // always returns true.
   STSStateMap enabled_sts_hosts_;
   PKPStateMap enabled_pkp_hosts_;
   ExpectCTStateMap enabled_expect_ct_hosts_;
 
   Delegate* delegate_ = nullptr;
@@ skipping 11 matching lines @@
 
   // True if public key pinning bypass is enabled for local trust anchors.
   bool enable_pkp_bypass_for_local_trust_anchors_;
 
   ExpectCTReporter* expect_ct_reporter_ = nullptr;
 
   RequireCTDelegate* require_ct_delegate_ = nullptr;
 
   // Keeps track of reports that have been sent recently for
   // rate-limiting.
-  ExpiringCache<std::string, bool, base::TimeTicks, std::less<base::TimeTicks>>
-      sent_reports_cache_;
+  ReportCache sent_hpkp_reports_cache_;
+  ReportCache sent_expect_ct_reports_cache_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_TRANSPORT_SECURITY_STATE_H_