OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_BASE_TRANSPORT_SECURITY_STATE_H_ | 5 #ifndef NET_BASE_TRANSPORT_SECURITY_STATE_H_ |
6 #define NET_BASE_TRANSPORT_SECURITY_STATE_H_ | 6 #define NET_BASE_TRANSPORT_SECURITY_STATE_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <utility> | 10 #include <utility> |
(...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
54 public: | 54 public: |
55 enum UpgradeMode { | 55 enum UpgradeMode { |
56 // These numbers must match those in hsts_view.js, function modeToString. | 56 // These numbers must match those in hsts_view.js, function modeToString. |
57 MODE_FORCE_HTTPS = 0, | 57 MODE_FORCE_HTTPS = 0, |
58 MODE_DEFAULT = 1, | 58 MODE_DEFAULT = 1, |
59 }; | 59 }; |
60 | 60 |
61 DomainState(); | 61 DomainState(); |
62 ~DomainState(); | 62 ~DomainState(); |
63 | 63 |
64 // Parses |value| as a Public-Key-Pins header. If successful, returns true | |
65 // and updates the |dynamic_spki_hashes| and |dynamic_spki_hashes_expiry| | |
66 // fields; otherwise, returns false without updating any fields. | |
67 // Interprets the max-age directive relative to |now|. | |
68 bool ParsePinsHeader(const base::Time& now, | |
69 const std::string& value, | |
70 const SSLInfo& ssl_info); | |
71 | |
72 // Parses |value| as a Strict-Transport-Security header. If successful, | |
73 // returns true and updates the |upgrade_mode|, |upgrade_expiry| and | |
74 // |include_subdomains| fields; otherwise, returns false without updating | |
75 // any fields. Interprets the max-age directive relative to |now|. | |
76 bool ParseSTSHeader(const base::Time& now, const std::string& value); | |
77 | |
78 // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if: | 64 // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if: |
79 // 1) |bad_static_spki_hashes| does not intersect |hashes|; AND | 65 // 1) |bad_static_spki_hashes| does not intersect |hashes|; AND |
80 // 2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty | 66 // 2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty |
81 // or at least one of them intersects |hashes|. | 67 // or at least one of them intersects |hashes|. |
82 // | 68 // |
83 // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes, | 69 // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes, |
84 // any one of which is sufficient to validate the certificate chain in | 70 // any one of which is sufficient to validate the certificate chain in |
85 // question. The public keys could be of a root CA, intermediate CA, or | 71 // question. The public keys could be of a root CA, intermediate CA, or |
86 // leaf certificate, depending on the security vs. disaster recovery | 72 // leaf certificate, depending on the security vs. disaster recovery |
87 // tradeoff selected. (Pinning only to leaf certifiates increases | 73 // tradeoff selected. (Pinning only to leaf certifiates increases |
(...skipping 142 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
230 void AddOrUpdateEnabledHosts(const std::string& hashed_host, | 216 void AddOrUpdateEnabledHosts(const std::string& hashed_host, |
231 const DomainState& state); | 217 const DomainState& state); |
232 | 218 |
233 // Inserts |state| into |forced_hosts_| under the key |hashed_host|. | 219 // Inserts |state| into |forced_hosts_| under the key |hashed_host|. |
234 // |hashed_host| is already in the internal representation | 220 // |hashed_host| is already in the internal representation |
235 // HashHost(CanonicalizeHost(host)); thus, most callers will use | 221 // HashHost(CanonicalizeHost(host)); thus, most callers will use |
236 // |EnableHost|. | 222 // |EnableHost|. |
237 void AddOrUpdateForcedHosts(const std::string& hashed_host, | 223 void AddOrUpdateForcedHosts(const std::string& hashed_host, |
238 const DomainState& state); | 224 const DomainState& state); |
239 | 225 |
| 226 // Processes an HSTS header value from the host, adding entries to |
| 227 // dynamic state if necessary. |
| 228 bool AddHSTSHeader(const std::string& host, const std::string& value); |
| 229 |
| 230 // Processes an HPKP header value from the host, adding entries to |
| 231 // dynamic state if necessary. ssl_info is used to check that |
| 232 // the specified pins overlap with the certificate chain. |
| 233 bool AddHPKPHeader(const std::string& host, const std::string& value, |
| 234 const SSLInfo& ssl_info); |
| 235 |
240 // Returns true iff we have any static public key pins for the |host| and | 236 // Returns true iff we have any static public key pins for the |host| and |
241 // iff its set of required pins is the set we expect for Google | 237 // iff its set of required pins is the set we expect for Google |
242 // properties. | 238 // properties. |
243 // | 239 // |
244 // If |sni_enabled| is true, searches the static pins defined for | 240 // If |sni_enabled| is true, searches the static pins defined for |
245 // SNI-using hosts as well as the rest of the pins. | 241 // SNI-using hosts as well as the rest of the pins. |
246 // | 242 // |
247 // If |host| matches both an exact entry and is a subdomain of another | 243 // If |host| matches both an exact entry and is a subdomain of another |
248 // entry, the exact match determines the return value. | 244 // entry, the exact match determines the return value. |
249 static bool IsGooglePinnedProperty(const std::string& host, | 245 static bool IsGooglePinnedProperty(const std::string& host, |
250 bool sni_enabled); | 246 bool sni_enabled); |
251 | 247 |
252 // Decodes a pin string |value| (e.g. "sha1/hvfkN/qlp/zhXR3cuerq6jd2Z7g="). | |
253 // If parsing succeeded, updates |*out| and returns true; otherwise returns | |
254 // false without updating |*out|. | |
255 static bool ParsePin(const std::string& value, HashValue* out); | |
256 | |
257 // The maximum number of seconds for which we'll cache an HSTS request. | 248 // The maximum number of seconds for which we'll cache an HSTS request. |
258 static const long int kMaxHSTSAgeSecs; | 249 static const long int kMaxHSTSAgeSecs; |
259 | 250 |
260 // Converts |hostname| from dotted form ("www.google.com") to the form | 251 // Converts |hostname| from dotted form ("www.google.com") to the form |
261 // used in DNS: "\x03www\x06google\x03com", lowercases that, and returns | 252 // used in DNS: "\x03www\x06google\x03com", lowercases that, and returns |
262 // the result. | 253 // the result. |
263 static std::string CanonicalizeHost(const std::string& hostname); | 254 static std::string CanonicalizeHost(const std::string& hostname); |
264 | 255 |
265 // Send an UMA report on pin validation failure, if the host is in a | 256 // Send an UMA report on pin validation failure, if the host is in a |
266 // statically-defined list of domains. | 257 // statically-defined list of domains. |
(...skipping 20 matching lines...) Expand all Loading... |
287 std::map<std::string, DomainState> forced_hosts_; | 278 std::map<std::string, DomainState> forced_hosts_; |
288 | 279 |
289 Delegate* delegate_; | 280 Delegate* delegate_; |
290 | 281 |
291 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); | 282 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); |
292 }; | 283 }; |
293 | 284 |
294 } // namespace net | 285 } // namespace net |
295 | 286 |
296 #endif // NET_BASE_TRANSPORT_SECURITY_STATE_H_ | 287 #endif // NET_BASE_TRANSPORT_SECURITY_STATE_H_ |
OLD | NEW |