Add command-line control of the HSTS preload list.

net/base/transport_security_state.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 
 #include "base/base64.h"
+#include "base/command_line.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/sha1.h"
 #include "base/string_number_conversions.h"
 #include "base/string_tokenizer.h"
+#include "base/string_split.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
 #include "crypto/sha2.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/dns_util.h"
 
 namespace net {
 
 const long int TransportSecurityState::kMaxHSTSAgeSecs = 86400 * 365;  // 1 year
 
 TransportSecurityState::TransportSecurityState()
     : delegate_(NULL) {
 }
 
 void TransportSecurityState::EnableHost(const std::string& host,
                                         const DomainState& state) {
   const std::string canonicalized_host = CanonicalizeHost(host);
   if (canonicalized_host.empty())
     return;
 
   // TODO(cevans) -- we likely want to permit a host to override a built-in,
   // for at least the case where the override is stricter (i.e. includes
   // subdomains, or includes certificate pinning).
-  bool temp;
+  DomainState temp;
   if (IsPreloadedSTS(canonicalized_host, true, &temp))
     return;
 
   char hashed[crypto::SHA256_LENGTH];
   crypto::SHA256HashString(canonicalized_host, hashed, sizeof(hashed));
 
   // Use the original creation date if we already have this host.
   DomainState state_copy(state);
   DomainState existing_state;
   if (IsEnabledForHost(&existing_state, host, true))
@@ skipping 33 matching lines @@
 
 bool TransportSecurityState::IsEnabledForHost(DomainState* result,
                                               const std::string& host,
                                               bool sni_available) {
   *result = DomainState();
 
   const std::string canonicalized_host = CanonicalizeHost(host);
   if (canonicalized_host.empty())
     return false;
 
-  bool include_subdomains;
-  if (IsPreloadedSTS(canonicalized_host, sni_available, &include_subdomains)) {
-    result->created = result->expiry = base::Time::FromTimeT(0);
-    result->mode = DomainState::MODE_STRICT;
-    result->include_subdomains = include_subdomains;
-    result->preloaded = true;
-    return true;
+  if (IsPreloadedSTS(canonicalized_host, sni_available, result)) {
+    return result->mode != DomainState::MODE_NONE;
   }
 
   result->preloaded = false;
   base::Time current_time(base::Time::Now());
 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     char hashed_domain[crypto::SHA256_LENGTH];
 
     crypto::SHA256HashString(IncludeNUL(&canonicalized_host[i]), &hashed_domain,
                              sizeof(hashed_domain));
@@ skipping 219 matching lines @@
     }
     state->Set("public_key_hashes", pins);
 
     toplevel.Set(HashedDomainToExternalString(i->first), state);
   }
 
   base::JSONWriter::Write(&toplevel, true /* pretty print */, output);
   return true;
 }
 
+static void AddHash(const std::string& hash,
+                    std::vector<SHA1Fingerprint>* out) {
+  std::string hash_str;
+  SHA1Fingerprint raw_hash;
+  if (hash.find("sha1/") == 0 &&
+      base::Base64Decode(hash.substr(5, hash.size() - 5), &hash_str) &&

[abarth-chromium, 2011/04/17 05:39:23]

It would be nicer if 5 wasn't a magic number here.

+      hash_str.size() == base::SHA1_LENGTH) {
+    memcpy(raw_hash.data, hash_str.data(), sizeof(raw_hash.data));
+    out->push_back(raw_hash);
+  }
+}
+
 bool TransportSecurityState::Deserialise(const std::string& input,
                                          bool* dirty) {
   enabled_hosts_.clear();
 
   scoped_ptr<Value> value(
       base::JSONReader::Read(input, false /* do not allow trailing commas */));
   if (!value.get() || !value->IsType(Value::TYPE_DICTIONARY))
     return false;
 
   DictionaryValue* dict_value = reinterpret_cast<DictionaryValue*>(value.get());
@@ skipping 16 matching lines @@
         !state->GetDouble("expiry", &expiry)) {
       continue;
     }
 
     ListValue* pins_list = NULL;
     std::vector<SHA1Fingerprint> public_key_hashes;
     if (state->GetList("public_key_hashes", &pins_list)) {
       size_t num_pins = pins_list->GetSize();
       for (size_t i = 0; i < num_pins; ++i) {
         std::string type_and_base64;
-        std::string hash_str;
-        SHA1Fingerprint hash;
-        if (pins_list->GetString(i, &type_and_base64) &&
-            type_and_base64.find("sha1/") == 0 &&
-            base::Base64Decode(
-                type_and_base64.substr(5, type_and_base64.size() - 5),
-                &hash_str) &&
-            hash_str.size() == base::SHA1_LENGTH) {
-          memcpy(hash.data, hash_str.data(), sizeof(hash.data));
-          public_key_hashes.push_back(hash);
-        }
+        if (pins_list->GetString(i, &type_and_base64))
+          AddHash(type_and_base64, &public_key_hashes);
       }
     }
 
     DomainState::Mode mode;
     if (mode_string == "strict") {
       mode = DomainState::MODE_STRICT;
     } else if (mode_string == "opportunistic") {
       mode = DomainState::MODE_OPPORTUNISTIC;
     } else if (mode_string == "spdy-only") {
       mode = DomainState::MODE_SPDY_ONLY;
@@ skipping 82 matching lines @@
 
   return new_host;
 }
 
 // IsPreloadedSTS returns true if the canonicalized hostname should always be
 // considered to have STS enabled.
 // static
 bool TransportSecurityState::IsPreloadedSTS(
     const std::string& canonicalized_host,
     bool sni_available,
-    bool *include_subdomains) {
+    DomainState* out) {
+  out->preloaded = true;
+  out->mode = DomainState::MODE_STRICT;
+  out->created = out->expiry = base::Time::FromTimeT(0);

[abarth-chromium, 2011/04/17 05:39:23]

I'm not sure this is allowed by the style guide.

+  out->include_subdomains = false;
+
+  std::string cmd_line_hsts =
+      CommandLine::ForCurrentProcess()->GetSwitchValueASCII("hsts-hosts");

[abarth-chromium, 2011/04/17 05:39:23]

Command line constants should be in a switches.cc file.

+  if (!cmd_line_hsts.empty()) {
+    std::vector<std::string> hosts;
+    base::SplitString(cmd_line_hsts, ',', &hosts);
+    for (std::vector<std::string>::const_iterator i = hosts.begin();
+         i != hosts.end();
+         ++i) {

[abarth-chromium, 2011/04/17 05:39:23]

I would merge these last two lines.

+      std::string host_spec = *i;
+      std::vector<std::string> parts;
+      base::SplitString(host_spec, ':', &parts);
+      if (parts.size() != 4)
+        continue;
+      std::string host = CanonicalizeHost(parts[0]);
+      if (host != canonicalized_host)
+        continue;
+      if (parts[1] == "none")
+        out->mode = DomainState::MODE_NONE;
+      else if (parts[1] != "strict")
+        continue;
+      if (parts[2] == "true")

[abarth-chromium, 2011/04/17 05:39:23]

True?  Why not "includeSubdomains" ?

+        out->include_subdomains = true;
+      if (!parts[3].empty()) {
+        std::vector<SHA1Fingerprint> fingerprints;
+        std::vector<std::string> str_fingerprints;
+        base::SplitString(parts[3], '|', &str_fingerprints);

[abarth-chromium, 2011/04/17 05:39:23]

This is getting complicated.

+        std::vector<std::string>::const_iterator j;
+        for (j = str_fingerprints.begin(); j != str_fingerprints.end(); ++j) {
+          AddHash(*j, &fingerprints);
+        }
+        out->public_key_hashes = fingerprints;
+      }
+      return true;
+    }
+  }
+
   // In the medium term this list is likely to just be hardcoded here. This,
   // slightly odd, form removes the need for additional relocations records.
   static const struct {
     uint8 length;
     bool include_subdomains;
     char dns_name[30];
   } kPreloadedSTS[] = {
     {16, false, "\003www\006paypal\003com"},
     {16, false, "\003www\006elanex\003biz"},
     {12, true,  "\006jottit\003com"},
@@ skipping 47 matching lines @@
   };
   static const size_t kNumPreloadedSNISTS = ARRAYSIZE_UNSAFE(kPreloadedSNISTS);
 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     for (size_t j = 0; j < kNumPreloadedSTS; j++) {
       if (kPreloadedSTS[j].length == canonicalized_host.size() - i &&
           memcmp(kPreloadedSTS[j].dns_name, &canonicalized_host[i],
                  kPreloadedSTS[j].length) == 0) {
         if (!kPreloadedSTS[j].include_subdomains && i != 0)
           return false;
-        *include_subdomains = kPreloadedSTS[j].include_subdomains;
+        out->include_subdomains = kPreloadedSTS[j].include_subdomains;
         return true;
       }
     }
     if (sni_available) {
       for (size_t j = 0; j < kNumPreloadedSNISTS; j++) {
         if (kPreloadedSNISTS[j].length == canonicalized_host.size() - i &&
             memcmp(kPreloadedSNISTS[j].dns_name, &canonicalized_host[i],
                    kPreloadedSNISTS[j].length) == 0) {
           if (!kPreloadedSNISTS[j].include_subdomains && i != 0)
             return false;
-          *include_subdomains = kPreloadedSNISTS[j].include_subdomains;
+          out->include_subdomains = kPreloadedSNISTS[j].include_subdomains;
           return true;
         }
       }
     }
   }
 
   return false;
 }
 
 static std::string HashesToBase64String(
@@ skipping 28 matching lines @@
 
   for (std::vector<net::SHA1Fingerprint>::const_iterator
        i = hashes.begin(); i != hashes.end(); ++i) {
     for (std::vector<net::SHA1Fingerprint>::const_iterator
          j = public_key_hashes.begin(); j != public_key_hashes.end(); ++j) {
       if (i->Equals(*j))
         return true;
     }
   }
 
-
   LOG(ERROR) << "Rejecting public key chain for domain " << domain
              << ". Validated chain: " << HashesToBase64String(hashes)
              << ", expected: " << HashesToBase64String(public_key_hashes);
 
   return false;
 }
 
 }  // namespace