OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <utility> | 10 #include <utility> |
(...skipping 112 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
123 // chain. | 123 // chain. |
124 HashValueVector bad_spki_hashes; | 124 HashValueVector bad_spki_hashes; |
125 | 125 |
126 // Are subdomains subject to this policy state? | 126 // Are subdomains subject to this policy state? |
127 bool include_subdomains; | 127 bool include_subdomains; |
128 | 128 |
129 // The domain which matched during a search for this DomainState entry. | 129 // The domain which matched during a search for this DomainState entry. |
130 // Updated by |GetDynamicPKPState| and |GetStaticDomainState|. | 130 // Updated by |GetDynamicPKPState| and |GetStaticDomainState|. |
131 std::string domain; | 131 std::string domain; |
132 | 132 |
133 // Optional; a uri-reference indicating where reports should be | |
134 // sent when this pin is violated. | |
davidben
2015/07/15 22:21:06
Nit: Probably better to say
// A optional uri-
estark
2015/07/16 00:07:01
Done.
| |
135 std::string report_uri; | |
136 | |
133 // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if: | 137 // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if: |
134 // 1) |bad_static_spki_hashes| does not intersect |hashes|; AND | 138 // 1) |bad_static_spki_hashes| does not intersect |hashes|; AND |
135 // 2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty | 139 // 2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty |
136 // or at least one of them intersects |hashes|. | 140 // or at least one of them intersects |hashes|. |
137 // | 141 // |
138 // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes, | 142 // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes, |
139 // any one of which is sufficient to validate the certificate chain in | 143 // any one of which is sufficient to validate the certificate chain in |
140 // question. The public keys could be of a root CA, intermediate CA, or | 144 // question. The public keys could be of a root CA, intermediate CA, or |
141 // leaf certificate, depending on the security vs. disaster recovery | 145 // leaf certificate, depending on the security vs. disaster recovery |
142 // tradeoff selected. (Pinning only to leaf certifiates increases | 146 // tradeoff selected. (Pinning only to leaf certifiates increases |
(...skipping 118 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
261 // HSTS header (used for net-internals and unit tests). | 265 // HSTS header (used for net-internals and unit tests). |
262 void AddHSTS(const std::string& host, | 266 void AddHSTS(const std::string& host, |
263 const base::Time& expiry, | 267 const base::Time& expiry, |
264 bool include_subdomains); | 268 bool include_subdomains); |
265 | 269 |
266 // Adds explicitly-specified data as if it was processed from an | 270 // Adds explicitly-specified data as if it was processed from an |
267 // HPKP header (used for net-internals and unit tests). | 271 // HPKP header (used for net-internals and unit tests). |
268 void AddHPKP(const std::string& host, | 272 void AddHPKP(const std::string& host, |
269 const base::Time& expiry, | 273 const base::Time& expiry, |
270 bool include_subdomains, | 274 bool include_subdomains, |
271 const HashValueVector& hashes); | 275 const HashValueVector& hashes, |
276 const std::string& report_uri); | |
272 | 277 |
273 // Returns true iff we have any static public key pins for the |host| and | 278 // Returns true iff we have any static public key pins for the |host| and |
274 // iff its set of required pins is the set we expect for Google | 279 // iff its set of required pins is the set we expect for Google |
275 // properties. | 280 // properties. |
276 // | 281 // |
277 // If |host| matches both an exact entry and is a subdomain of another | 282 // If |host| matches both an exact entry and is a subdomain of another |
278 // entry, the exact match determines the return value. | 283 // entry, the exact match determines the return value. |
279 static bool IsGooglePinnedProperty(const std::string& host); | 284 static bool IsGooglePinnedProperty(const std::string& host); |
280 | 285 |
281 // The maximum number of seconds for which we'll cache an HSTS request. | 286 // The maximum number of seconds for which we'll cache an HSTS request. |
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
318 void AddHSTSInternal(const std::string& host, | 323 void AddHSTSInternal(const std::string& host, |
319 STSState::UpgradeMode upgrade_mode, | 324 STSState::UpgradeMode upgrade_mode, |
320 const base::Time& expiry, | 325 const base::Time& expiry, |
321 bool include_subdomains); | 326 bool include_subdomains); |
322 | 327 |
323 // Adds HPKP state to |host|. | 328 // Adds HPKP state to |host|. |
324 void AddHPKPInternal(const std::string& host, | 329 void AddHPKPInternal(const std::string& host, |
325 const base::Time& last_observed, | 330 const base::Time& last_observed, |
326 const base::Time& expiry, | 331 const base::Time& expiry, |
327 bool include_subdomains, | 332 bool include_subdomains, |
328 const HashValueVector& hashes); | 333 const HashValueVector& hashes, |
334 const std::string& report_uri); | |
329 | 335 |
330 // Enable TransportSecurity for |host|. |state| supercedes any previous | 336 // Enable TransportSecurity for |host|. |state| supercedes any previous |
331 // state for the |host|, including static entries. | 337 // state for the |host|, including static entries. |
332 // | 338 // |
333 // The new state for |host| is persisted using the Delegate (if any). | 339 // The new state for |host| is persisted using the Delegate (if any). |
334 void EnableSTSHost(const std::string& host, const STSState& state); | 340 void EnableSTSHost(const std::string& host, const STSState& state); |
335 void EnablePKPHost(const std::string& host, const PKPState& state); | 341 void EnablePKPHost(const std::string& host, const PKPState& state); |
336 | 342 |
337 // The sets of hosts that have enabled TransportSecurity. |domain| will always | 343 // The sets of hosts that have enabled TransportSecurity. |domain| will always |
338 // be empty for a STSState or PKPState in these maps; the domain | 344 // be empty for a STSState or PKPState in these maps; the domain |
339 // comes from the map keys instead. In addition, |upgrade_mode| in the | 345 // comes from the map keys instead. In addition, |upgrade_mode| in the |
340 // STSState is never MODE_DEFAULT and |HasPublicKeyPins| in the PKPState | 346 // STSState is never MODE_DEFAULT and |HasPublicKeyPins| in the PKPState |
341 // always returns true. | 347 // always returns true. |
342 STSStateMap enabled_sts_hosts_; | 348 STSStateMap enabled_sts_hosts_; |
343 PKPStateMap enabled_pkp_hosts_; | 349 PKPStateMap enabled_pkp_hosts_; |
344 | 350 |
345 Delegate* delegate_; | 351 Delegate* delegate_; |
346 | 352 |
347 // True if static pins should be used. | 353 // True if static pins should be used. |
348 bool enable_static_pins_; | 354 bool enable_static_pins_; |
349 | 355 |
350 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); | 356 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); |
351 }; | 357 }; |
352 | 358 |
353 } // namespace net | 359 } // namespace net |
354 | 360 |
355 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 361 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
OLD | NEW |