Add support for built-in certificate pins, and add a pin list suitable for

net/base/transport_security_state.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 
 #include "base/base64.h"
 #include "base/command_line.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
@@ skipping 318 matching lines @@
   base::JSONWriter::Write(&toplevel, true /* pretty print */, output);
   return true;
 }
 
 bool TransportSecurityState::LoadEntries(const std::string& input,
                                          bool* dirty) {
   enabled_hosts_.clear();
   return Deserialise(input, dirty, &enabled_hosts_);
 }
 
+static void AddHash(const std::string& type_and_base64,
+                    std::vector<SHA1Fingerprint>* out) {
+  std::string hash_str;
+  if (type_and_base64.find("sha1/") == 0 &&
+      base::Base64Decode(type_and_base64.substr(5, type_and_base64.size() - 5),
+                         &hash_str) &&
+      hash_str.size() == base::SHA1_LENGTH) {
+    SHA1Fingerprint hash;
+    memcpy(hash.data, hash_str.data(), sizeof(hash.data));
+    out->push_back(hash);
+  }

[abarth-chromium, 2011/04/22 18:26:59]

Should we NOTREACHED() here?

[Chris Evans, 2011/04/22 21:47:55]

Probably not. The original client doesn't want it. I asked agl@ the same
question, but he made the point that an older browser might open the
TransportSecurity of a newer profile, and encounter e.g. some sha256 hashes.

If you think it's worth it, we could return a bool and have IsPreloadedSTS()
DCHECK() the result.

+}
+
 // static
 bool TransportSecurityState::Deserialise(
     const std::string& input,
     bool* dirty,
     std::map<std::string, DomainState>* out) {
   scoped_ptr<Value> value(
       base::JSONReader::Read(input, false /* do not allow trailing commas */));
   if (!value.get() || !value->IsType(Value::TYPE_DICTIONARY))
     return false;
 
@@ skipping 17 matching lines @@
         !state->GetDouble("expiry", &expiry)) {
       continue;
     }
 
     ListValue* pins_list = NULL;
     std::vector<SHA1Fingerprint> public_key_hashes;
     if (state->GetList("public_key_hashes", &pins_list)) {
       size_t num_pins = pins_list->GetSize();
       for (size_t i = 0; i < num_pins; ++i) {
         std::string type_and_base64;
-        std::string hash_str;
-        SHA1Fingerprint hash;
-        if (pins_list->GetString(i, &type_and_base64) &&
-            type_and_base64.find("sha1/") == 0 &&
-            base::Base64Decode(
-                type_and_base64.substr(5, type_and_base64.size() - 5),
-                &hash_str) &&
-            hash_str.size() == base::SHA1_LENGTH) {
-          memcpy(hash.data, hash_str.data(), sizeof(hash.data));
-          public_key_hashes.push_back(hash);
-        }
+        if (pins_list->GetString(i, &type_and_base64))
+          AddHash(type_and_base64, &public_key_hashes);
       }
     }
 
     DomainState::Mode mode;
     if (mode_string == "strict") {
       mode = DomainState::MODE_STRICT;
     } else if (mode_string == "opportunistic") {
       mode = DomainState::MODE_OPPORTUNISTIC;
     } else if (mode_string == "spdy-only") {
       mode = DomainState::MODE_SPDY_ONLY;
@@ skipping 78 matching lines @@
     // step 3(b)
     if (new_host[i + 1] == '-' ||
         new_host[i + label_length] == '-') {
       return std::string();
     }
   }
 
   return new_host;
 }
 
+struct HSTSPreload {
+  uint8 length;
+  bool include_subdomains;
+  char dns_name[30];
+  bool mandatory;

[abarth-chromium, 2011/04/22 18:26:59]

mandatory is a confusing name.  Maybe require_tls ?

[Chris Evans, 2011/04/22 21:47:55]

Done.

Yes, poor name. I went for "https_required" if that's ok?

+  const char** required_hashes;
+};
+
+static bool HasPreload(const struct HSTSPreload* entries, size_t num_entries,
+                       const std::string& canonicalized_host, size_t i,
+                       TransportSecurityState::DomainState* out, bool* ret) {
+  for (size_t j = 0; j < num_entries; j++) {
+    if (entries[j].length == canonicalized_host.size() - i &&
+        memcmp(entries[j].dns_name, &canonicalized_host[i],
+               entries[j].length) == 0) {
+      if (!entries[j].include_subdomains && i != 0) {
+        *ret = false;
+      } else {
+        out->include_subdomains = entries[j].include_subdomains;
+        *ret = true;
+        if (!entries[j].mandatory)
+          out->mode = TransportSecurityState::DomainState::MODE_NONE;
+        if (entries[j].required_hashes) {
+          const char** hash = entries[j].required_hashes;
+          while (*hash) {
+            AddHash(*hash, &out->public_key_hashes);
+            hash++;
+          }
+        }
+      }
+      return true;
+    }
+  }
+  return false;
+}
+
 // IsPreloadedSTS returns true if the canonicalized hostname should always be
 // considered to have STS enabled.
 // static
 bool TransportSecurityState::IsPreloadedSTS(
     const std::string& canonicalized_host,
     bool sni_available,
     DomainState* out) {
   out->preloaded = true;
   out->mode = DomainState::MODE_STRICT;
   out->created = base::Time::FromTimeT(0);
   out->expiry = out->created;
   out->include_subdomains = false;
 
   std::map<std::string, DomainState> hosts;
   std::string cmd_line_hsts =
       CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
           switches::kHstsHosts);
   if (!cmd_line_hsts.empty()) {
     bool dirty;
     Deserialise(cmd_line_hsts, &dirty, &hosts);
   }
 
+  // These hashes are base64 encodings of SHA1 hashes for cert public keys.
+  static const char* kCertPKHashVerisignClass3 =
+      "sha1/4n972HfV354KP560yw4uqe/baXc=";
+  static const char* kCertPKHashVerisignClass3G3 =
+      "sha1/IvGeLsbqzPxdI0b0wuj2xVTdXgc=";
+  static const char* kCertPKHashGoogle1024 =
+      "sha1/QMVAHW+MuvCLAO3vse6H0AWzuc0=";
+  static const char* kCertPKHashGoogle2048 =
+      "sha1/AbkhxY0L343gKf+cki7NVWp+ozk=";
+  static const char* kCertPKHashEquifaxSecureCA =
+      "sha1/SOZo+SvSspXXR9gjIBBPM5iQn9Q=";
+  static const char* kCertPKHashGeoTrustGlobalCA =
+      "sha1/wHqYaI2J+6sFZAwRfap9ZbjKzE4=";
+  static const char* kGoogleAcceptableCerts[] = {
+    kCertPKHashVerisignClass3,
+    kCertPKHashVerisignClass3G3,
+    kCertPKHashGoogle1024,
+    kCertPKHashGoogle2048,
+    kCertPKHashEquifaxSecureCA,
+    kCertPKHashGeoTrustGlobalCA,
+    0,
+  };
+
   // In the medium term this list is likely to just be hardcoded here. This,
   // slightly odd, form removes the need for additional relocations records.
-  static const struct {
-    uint8 length;
-    bool include_subdomains;
-    char dns_name[30];
-  } kPreloadedSTS[] = {
-    {16, false, "\003www\006paypal\003com"},
-    {16, false, "\003www\006elanex\003biz"},
-    {12, true,  "\006jottit\003com"},
-    {19, true,  "\015sunshinepress\003org"},
-    {21, false, "\003www\013noisebridge\003net"},
-    {10, false, "\004neg9\003org"},
-    {12, true, "\006riseup\003net"},
-    {11, false, "\006factor\002cc"},
-    {22, false, "\007members\010mayfirst\003org"},
-    {22, false, "\007support\010mayfirst\003org"},
-    {17, false, "\002id\010mayfirst\003org"},
-    {20, false, "\005lists\010mayfirst\003org"},
-    {19, true, "\015splendidbacon\003com"},
-    {19, true, "\006health\006google\003com"},
-    {21, true, "\010checkout\006google\003com"},
-    {19, true, "\006chrome\006google\003com"},
-    {26, false, "\006latest\006chrome\006google\003com"},
-    {28, false, "\016aladdinschools\007appspot\003com"},
-    {14, true, "\011ottospora\002nl"},
-    {17, true, "\004docs\006google\003com"},
-    {18, true, "\005sites\006google\003com"},
-    {25, true, "\014spreadsheets\006google\003com"},
-    {22, false, "\011appengine\006google\003com"},
-    {25, false, "\003www\017paycheckrecords\003com"},
-    {20, true, "\006market\007android\003com"},
-    {14, false, "\010lastpass\003com"},
-    {18, false, "\003www\010lastpass\003com"},
-    {14, true, "\010keyerror\003com"},
-    {22, true, "\011encrypted\006google\003com"},
-    {13, false, "\010entropia\002de"},
-    {17, false, "\003www\010entropia\002de"},
-    {21, true, "\010accounts\006google\003com"},
+  static const struct HSTSPreload kPreloadedSTS[] = {
+    {16, false, "\003www\006paypal\003com", true, 0 },
+    {16, false, "\003www\006elanex\003biz", true, 0 },
+    {12, true,  "\006jottit\003com", true, 0 },
+    {19, true,  "\015sunshinepress\003org", true, 0 },
+    {21, false, "\003www\013noisebridge\003net", true, 0 },
+    {10, false, "\004neg9\003org", true, 0 },
+    {12, true, "\006riseup\003net", true, 0 },
+    {11, false, "\006factor\002cc", true, 0 },
+    {22, false, "\007members\010mayfirst\003org", true, 0 },
+    {22, false, "\007support\010mayfirst\003org", true, 0 },
+    {17, false, "\002id\010mayfirst\003org", true, 0 },
+    {20, false, "\005lists\010mayfirst\003org", true, 0 },
+    {19, true, "\015splendidbacon\003com", true, 0 },
+    {19, true, "\006health\006google\003com", true, 0 },
+    {21, true, "\010checkout\006google\003com", true, 0 },
+    {19, true, "\006chrome\006google\003com", true, kGoogleAcceptableCerts },
+    {26, false, "\006latest\006chrome\006google\003com", true, 0 },
+    {28, false, "\016aladdinschools\007appspot\003com", true, 0 },
+    {14, true, "\011ottospora\002nl", true, 0 },
+    {17, true, "\004docs\006google\003com", true, 0 },
+    {18, true, "\005sites\006google\003com", true, 0 },
+    {25, true, "\014spreadsheets\006google\003com", true, 0 },
+    {22, false, "\011appengine\006google\003com", true, 0 },
+    {25, false, "\003www\017paycheckrecords\003com", true, 0 },
+    {20, true, "\006market\007android\003com", true, 0 },
+    {14, false, "\010lastpass\003com", true, 0 },
+    {18, false, "\003www\010lastpass\003com", true, 0 },
+    {14, true, "\010keyerror\003com", true, 0 },
+    {22, true, "\011encrypted\006google\003com", true, 0 },
+    {13, false, "\010entropia\002de", true, 0 },
+    {17, false, "\003www\010entropia\002de", true, 0 },
+    {21, true, "\010accounts\006google\003com", true, 0 },
 #if defined(OS_CHROMEOS)
-    {17, true, "\004mail\006google\003com"},
-    {13, false, "\007twitter\003com"},
-    {17, false, "\003www\007twitter\003com"},
-    {17, false, "\003api\007twitter\003com"},
-    {17, false, "\003dev\007twitter\003com"},
-    {22, false, "\010business\007twitter\003com"},
+    {17, true, "\004mail\006google\003com", true, 0 },
+    {13, false, "\007twitter\003com", true, 0 },
+    {17, false, "\003www\007twitter\003com", true, 0 },
+    {17, false, "\003api\007twitter\003com", true, 0 },
+    {17, false, "\003dev\007twitter\003com", true, 0},
+    {22, false, "\010business\007twitter\003com", true, 0 },
 #endif
   };
   static const size_t kNumPreloadedSTS = ARRAYSIZE_UNSAFE(kPreloadedSTS);
 
-  static const struct {
-    uint8 length;
-    bool include_subdomains;
-    char dns_name[30];
-  } kPreloadedSNISTS[] = {
-    {11, true, "\005gmail\003com"},
-    {16, true, "\012googlemail\003com"},
+  static const struct HSTSPreload kPreloadedSNISTS[] = {
+    {11, true, "\005gmail\003com", true, 0 },
+    {16, true, "\012googlemail\003com", true, 0 },
   };
   static const size_t kNumPreloadedSNISTS = ARRAYSIZE_UNSAFE(kPreloadedSNISTS);
 
   for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
     std::string host_sub_chunk(&canonicalized_host[i],
                                canonicalized_host.size() - i);
     out->domain = DNSDomainToString(host_sub_chunk);
     std::string hashed_host(HashHost(host_sub_chunk));
     if (hosts.find(hashed_host) != hosts.end()) {
       *out = hosts[hashed_host];
       out->domain = DNSDomainToString(host_sub_chunk);
       out->preloaded = true;
       return true;
     }
-    for (size_t j = 0; j < kNumPreloadedSTS; j++) {
-      if (kPreloadedSTS[j].length == canonicalized_host.size() - i &&
-          memcmp(kPreloadedSTS[j].dns_name, &canonicalized_host[i],
-                 kPreloadedSTS[j].length) == 0) {
-        if (!kPreloadedSTS[j].include_subdomains && i != 0)
-          return false;
-        out->include_subdomains = kPreloadedSTS[j].include_subdomains;
-        return true;
-      }
-    }
-    if (sni_available) {
-      for (size_t j = 0; j < kNumPreloadedSNISTS; j++) {
-        if (kPreloadedSNISTS[j].length == canonicalized_host.size() - i &&
-            memcmp(kPreloadedSNISTS[j].dns_name, &canonicalized_host[i],
-                   kPreloadedSNISTS[j].length) == 0) {
-          if (!kPreloadedSNISTS[j].include_subdomains && i != 0)
-            return false;
-          out->include_subdomains = kPreloadedSNISTS[j].include_subdomains;
-          return true;
-        }
-      }
-    }
+    bool ret;
+    if (HasPreload(kPreloadedSTS, kNumPreloadedSTS, canonicalized_host, i, out,
+                   &ret))
+      return ret;
+    if (sni_available &&
+        HasPreload(kPreloadedSNISTS, kNumPreloadedSNISTS, canonicalized_host, i,
+                   out, &ret))
+      return ret;
   }
 
   return false;
 }
 
 static std::string HashesToBase64String(
     const std::vector<net::SHA1Fingerprint>& hashes) {
   std::vector<std::string> hashes_strs;
   for (std::vector<net::SHA1Fingerprint>::const_iterator
        i = hashes.begin(); i != hashes.end(); i++) {
@@ skipping 32 matching lines @@
   }
 
   LOG(ERROR) << "Rejecting public key chain for domain " << domain
              << ". Validated chain: " << HashesToBase64String(hashes)
              << ", expected: " << HashesToBase64String(public_key_hashes);
 
   return false;
 }
 
 }  // namespace