Centralize the logic for checking public key pins

net/http/transport_security_state.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 
 #include <map>
 #include <string>
 #include <utility>
@@ skipping 234 matching lines @@
   // Adds explicitly-specified data as if it was processed from an
   // HSTS header (used for net-internals and unit tests).
   bool AddHSTS(const std::string& host, const base::Time& expiry,
                bool include_subdomains);
 
   // Adds explicitly-specified data as if it was processed from an
   // HPKP header (used for net-internals and unit tests).
   bool AddHPKP(const std::string& host, const base::Time& expiry,
                bool include_subdomains, const HashValueVector& hashes);
 
+  // Returns true if |public_key_hashes| meets the pinning constrains of

[palmer, 2014/08/07 18:50:50]

typo: "constraints"

Can we call it |ValidatePins| or |ValidatePinning|? "Validate" is the verb I use
in the HPKP spec and it'd be good to be consistent.

[Ryan Hamilton, 2014/08/07 22:07:11]

Acknowledged.

+  // |host|, or if the build is out of date, or if the root is not a
+  // built-in trusted root. |pinning_failure_log| is written to in the
+  // case of a pinning failure.
+  bool VerifyPinning(const HashValueVector& public_key_hashes,
+                     bool is_issued_by_known_root,

[palmer, 2014/08/07 18:50:50]

If the caller knows |is_issued_by_known_root|, then they already know what value
this function call will return. So does it make sense to pass it?

[Ryan Hamilton, 2014/08/07 22:07:11]

Personally, I think it does because it focuses the logic into this class. We'll
end up with a few callers of this method, and I'd prefer to not duplicate any
logic since that's just an opportunity to do it incorrectly :> This API forces
the caller to figure out if the cert had a known root as opposed to simply
ignoring this fact and causing problems later.

+                     bool sni_available,
+                     const std::string& host,
+                     std::string* pinning_failure_log);
+
   // Returns true iff we have any static public key pins for the |host| and
   // iff its set of required pins is the set we expect for Google
   // properties.
   //
   // If |sni_enabled| is true, searches the static pins defined for
   // SNI-using hosts as well as the rest of the pins.
   //
   // If |host| matches both an exact entry and is a subdomain of another
   // entry, the exact match determines the return value.
   static bool IsGooglePinnedProperty(const std::string& host,
@@ skipping 43 matching lines @@
   DomainStateMap enabled_hosts_;
 
   Delegate* delegate_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_TRANSPORT_SECURITY_STATE_H_