Enable HPKP/expect-CT for brave domains

[jumde]

From: #13 (comment)

Check: enable_static_pins_ and enable_static_expect_ct_ in net/http/transport_security_state.cc

[bbondy]

Can you describe a test case to verify this is working correctly once it is done?

[diracdeltas]

https://pinning-test.badssl.com/ should show cert error

there are 2 subissues here:

1. pin sites that chrome pins by default
2. pin brave domains like the updater, ledger services, etc.

(2) is arguably more important, so we do it in browser-laptop. we don't do (1) because Chrome expressed that embedders should be careful with it.

i would prefer we do both in brave-core, or at least (2)

[diracdeltas]

for beta, we can just make sure the machinery is in place to enable pinning/expect-CT (which might involve just doing #1) and then actually do the pinning in the release milestone when we know the final hostnames of brave-important services.

[jumde]

I am actually a bit concerned about pinning sites that chrome pins by default. If the certs or pins change for any chrome pinned domains we will have to release a hot-fix for the domains to work.

[btlechowski]

https://pinning-test.badssl.com/ test fails. Per above comment this is not expected. I have reported a new issue #1214.

[jumde]

@btlechowski pinning is only enabled for brave domains. See here: https://github.com/brave/brave-core/blob/74fb2a164cdd780a8f074597aabae3eecaf45a24/chromium_src/net/tools/transport_security_state_generator/input_file_parsers.cc#L311

We decided against enabling pinning for all domains due to web-compat reasons: #767 (comment)

[btlechowski]

@jumde thanks for the response. I was referring to the testcase from #767 (comment). Since https://pinning-test.badssl.com/ is not a valid test case how should we test this feature?

[jumde]

Test Plan

1. All the domains listed here - https://github.com/brave/brave-core/blob/74fb2a164cdd780a8f074597aabae3eecaf45a24/chromium_src/net/tools/transport_security_state_generator/input_file_parsers.cc#L311 should work as expected.

For the negative test case, I think it makes sense to spin up a dummy brave domain with SSL cert not part of the brave pins. Thoughts? cc: @diracdeltas @tomlowenthal @w0ts0n

[srirambv]

Verification Passed on

Brave	0.55.6 Chromium: 70.0.3538.16 (Official Build) dev (64-bit)
Revision	16ed95b41bb05e565b11fb66ac33c660b721f778-refs/branch-heads/3538@{#306}
OS	Linux

Verified passed with

Brave	0.55.14 Chromium: 70.0.3538.54 (Official Build) beta(64-bit)
Revision	4f8e578b6680574714e9ed3bb9f02922b4dde40d-refs/branch-heads/3538@{#937}
OS	Mac OS X

• Verified Enable HPKP/expect-CT for brave domains #767 (comment) except for the negative case which is being tracked per Enable HPKP/expect-CT for brave domains #767 (comment) in https://github.com/brave/devops/issues/313

Brave	0.55.14 Chromium: 70.0.3538.54 (Official Build) beta(64-bit)
Revision	4f8e578b6680574714e9ed3bb9f02922b4dde40d-refs/branch-heads/3538@{#937}
OS	Windows 7

• Verified Enable HPKP/expect-CT for brave domains #767 (comment) except for the negative case which is being tracked per Enable HPKP/expect-CT for brave domains #767 (comment) in https://github.com/brave/devops/issues/313

[diracdeltas]

@jumde good idea, please set that up

[LaurenWags]

@jumde is there a negative test case for QA? cc @kjozwiak

[jumde]

Just created an issue for devops. cc: @w0ts0n @RyanJarv https://github.com/brave/devops/issues/313