Experiment with a compact mode for simple preloaded entries.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <memory>
 #include <utility>
 #include <vector>
 
@@ skipping 376 matching lines @@
   }
 
  private:
   const uint8_t* const tree_;
   const size_t tree_bytes_;
 };
 
 // PreloadResult is the result of resolving a specific name in the preloaded
 // data.
 struct PreloadResult {
-  uint32_t pinset_id;
+  uint32_t pinset_id = 0;
   // hostname_offset contains the number of bytes from the start of the given
   // hostname where the name of the matching entry starts.
-  size_t hostname_offset;
-  bool sts_include_subdomains;
-  bool pkp_include_subdomains;
-  bool force_https;
-  bool has_pins;
-  bool expect_ct;
-  uint32_t expect_ct_report_uri_id;
-  bool expect_staple;
-  bool expect_staple_include_subdomains;
-  uint32_t expect_staple_report_uri_id;
+  size_t hostname_offset = 0;
+  bool sts_include_subdomains = false;
+  bool pkp_include_subdomains = false;
+  bool force_https = false;
+  bool has_pins = false;
+  bool expect_ct = false;
+  uint32_t expect_ct_report_uri_id = 0;
+  bool expect_staple = false;
+  bool expect_staple_include_subdomains = false;
+  uint32_t expect_staple_report_uri_id = 0;
 };
 
 // DecodeHSTSPreloadRaw resolves |hostname| in the preloaded data. It returns
 // false on internal error and true otherwise. After a successful return,
 // |*out_found| is true iff a relevant entry has been found. If so, |*out|
 // contains the details.
 //
 // Don't call this function, call DecodeHSTSPreload, below.
 //
 // Although this code should be robust, it never processes attacker-controlled
@@ skipping 93 matching lines @@
       if (!huffman.Decode(&reader, &c)) {
         return false;
       }
       if (c == kEndOfTable) {
         // No exact match.
         return true;
       }
 
       if (c == kEndOfString) {
         PreloadResult tmp;
-        if (!reader.Next(&tmp.sts_include_subdomains) ||
-            !reader.Next(&tmp.force_https) || !reader.Next(&tmp.has_pins)) {
+        bool is_simple_entry;
+        if (!reader.Next(&is_simple_entry)) {
           return false;
         }
 
-        tmp.pkp_include_subdomains = tmp.sts_include_subdomains;
+        // Simple entries only configure HSTS with IncludeSubdomains and use a
+        // compact serialization format where the other policy flags are
+        // omitted. The omitted flags are assumed to be 0 and the associated
+        // policies are disabled.
+        if (is_simple_entry) {
+          tmp.force_https = true;
+          tmp.sts_include_subdomains = true;
+        } else {
+          if (!reader.Next(&tmp.sts_include_subdomains) ||
+              !reader.Next(&tmp.force_https) || !reader.Next(&tmp.has_pins)) {
+            return false;
+          }
 
-        if (tmp.has_pins) {
-          if (!reader.Read(4, &tmp.pinset_id) ||
-              (!tmp.sts_include_subdomains &&
-               !reader.Next(&tmp.pkp_include_subdomains))) {
+          tmp.pkp_include_subdomains = tmp.sts_include_subdomains;
+
+          if (tmp.has_pins) {
+            if (!reader.Read(4, &tmp.pinset_id) ||
+                (!tmp.sts_include_subdomains &&
+                 !reader.Next(&tmp.pkp_include_subdomains))) {
+              return false;
+            }
+          }
+
+          if (!reader.Next(&tmp.expect_ct))
             return false;
+
+          if (tmp.expect_ct) {
+            if (!reader.Read(4, &tmp.expect_ct_report_uri_id))
+              return false;
+          }
+
+          if (!reader.Next(&tmp.expect_staple))
+            return false;
+          tmp.expect_staple_include_subdomains = false;
+          if (tmp.expect_staple) {
+            if (!reader.Next(&tmp.expect_staple_include_subdomains))
+              return false;
+            if (!reader.Read(4, &tmp.expect_staple_report_uri_id))
+              return false;
           }
         }
 
-        if (!reader.Next(&tmp.expect_ct))
-          return false;
-
-        if (tmp.expect_ct) {
-          if (!reader.Read(4, &tmp.expect_ct_report_uri_id))
-            return false;
-        }
-
-        if (!reader.Next(&tmp.expect_staple))
-          return false;
-        tmp.expect_staple_include_subdomains = false;
-        if (tmp.expect_staple) {
-          if (!reader.Next(&tmp.expect_staple_include_subdomains))
-            return false;
-          if (!reader.Read(4, &tmp.expect_staple_report_uri_id))
-            return false;
-        }
-
         tmp.hostname_offset = hostname_offset;
 
         if (hostname_offset == 0 || hostname[hostname_offset - 1] == '.') {
           *out_found = tmp.sts_include_subdomains ||
                        tmp.pkp_include_subdomains ||
                        tmp.expect_staple_include_subdomains;
           *out = tmp;
 
           if (hostname_offset > 0) {
             out->force_https &= tmp.sts_include_subdomains;
@@ skipping 1266 matching lines @@
 TransportSecurityState::PKPStateIterator::PKPStateIterator(
     const TransportSecurityState& state)
     : iterator_(state.enabled_pkp_hosts_.begin()),
       end_(state.enabled_pkp_hosts_.end()) {
 }
 
 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
 }
 
 }  // namespace net