Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(80)

Side by Side Diff: net/http/transport_security_state.h

Issue 1249823002: Revert of Parse HPKP report-uri and persist in TransportSecurityPersister (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 5 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « net/http/transport_security_persister_unittest.cc ('k') | net/http/transport_security_state.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ 5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_
6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ 6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_
7 7
8 #include <map> 8 #include <map>
9 #include <string> 9 #include <string>
10 #include <utility> 10 #include <utility>
11 #include <vector> 11 #include <vector>
12 12
13 #include "base/basictypes.h" 13 #include "base/basictypes.h"
14 #include "base/gtest_prod_util.h" 14 #include "base/gtest_prod_util.h"
15 #include "base/threading/non_thread_safe.h" 15 #include "base/threading/non_thread_safe.h"
16 #include "base/time/time.h" 16 #include "base/time/time.h"
17 #include "net/base/net_export.h" 17 #include "net/base/net_export.h"
18 #include "net/cert/x509_cert_types.h" 18 #include "net/cert/x509_cert_types.h"
19 #include "net/cert/x509_certificate.h" 19 #include "net/cert/x509_certificate.h"
20 #include "url/gurl.h"
21 20
22 namespace net { 21 namespace net {
23 22
24 class SSLInfo; 23 class SSLInfo;
25 24
26 // Tracks which hosts have enabled strict transport security and/or public 25 // Tracks which hosts have enabled strict transport security and/or public
27 // key pins. 26 // key pins.
28 // 27 //
29 // This object manages the in-memory store. Register a Delegate with 28 // This object manages the in-memory store. Register a Delegate with
30 // |SetDelegate| to persist the state to disk. 29 // |SetDelegate| to persist the state to disk.
(...skipping 93 matching lines...) Expand 10 before | Expand all | Expand 10 after
124 // chain. 123 // chain.
125 HashValueVector bad_spki_hashes; 124 HashValueVector bad_spki_hashes;
126 125
127 // Are subdomains subject to this policy state? 126 // Are subdomains subject to this policy state?
128 bool include_subdomains; 127 bool include_subdomains;
129 128
130 // The domain which matched during a search for this DomainState entry. 129 // The domain which matched during a search for this DomainState entry.
131 // Updated by |GetDynamicPKPState| and |GetStaticDomainState|. 130 // Updated by |GetDynamicPKPState| and |GetStaticDomainState|.
132 std::string domain; 131 std::string domain;
133 132
134 // An optional URI indicating where reports should be sent when this
135 // pin is violated, or empty when omitted.
136 GURL report_uri;
137
138 // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if: 133 // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if:
139 // 1) |bad_static_spki_hashes| does not intersect |hashes|; AND 134 // 1) |bad_static_spki_hashes| does not intersect |hashes|; AND
140 // 2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty 135 // 2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty
141 // or at least one of them intersects |hashes|. 136 // or at least one of them intersects |hashes|.
142 // 137 //
143 // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes, 138 // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes,
144 // any one of which is sufficient to validate the certificate chain in 139 // any one of which is sufficient to validate the certificate chain in
145 // question. The public keys could be of a root CA, intermediate CA, or 140 // question. The public keys could be of a root CA, intermediate CA, or
146 // leaf certificate, depending on the security vs. disaster recovery 141 // leaf certificate, depending on the security vs. disaster recovery
147 // tradeoff selected. (Pinning only to leaf certifiates increases 142 // tradeoff selected. (Pinning only to leaf certifiates increases
(...skipping 118 matching lines...) Expand 10 before | Expand all | Expand 10 after
266 // HSTS header (used for net-internals and unit tests). 261 // HSTS header (used for net-internals and unit tests).
267 void AddHSTS(const std::string& host, 262 void AddHSTS(const std::string& host,
268 const base::Time& expiry, 263 const base::Time& expiry,
269 bool include_subdomains); 264 bool include_subdomains);
270 265
271 // Adds explicitly-specified data as if it was processed from an 266 // Adds explicitly-specified data as if it was processed from an
272 // HPKP header (used for net-internals and unit tests). 267 // HPKP header (used for net-internals and unit tests).
273 void AddHPKP(const std::string& host, 268 void AddHPKP(const std::string& host,
274 const base::Time& expiry, 269 const base::Time& expiry,
275 bool include_subdomains, 270 bool include_subdomains,
276 const HashValueVector& hashes, 271 const HashValueVector& hashes);
277 const GURL& report_uri);
278 272
279 // Returns true iff we have any static public key pins for the |host| and 273 // Returns true iff we have any static public key pins for the |host| and
280 // iff its set of required pins is the set we expect for Google 274 // iff its set of required pins is the set we expect for Google
281 // properties. 275 // properties.
282 // 276 //
283 // If |host| matches both an exact entry and is a subdomain of another 277 // If |host| matches both an exact entry and is a subdomain of another
284 // entry, the exact match determines the return value. 278 // entry, the exact match determines the return value.
285 static bool IsGooglePinnedProperty(const std::string& host); 279 static bool IsGooglePinnedProperty(const std::string& host);
286 280
287 // The maximum number of seconds for which we'll cache an HSTS request. 281 // The maximum number of seconds for which we'll cache an HSTS request.
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after
324 void AddHSTSInternal(const std::string& host, 318 void AddHSTSInternal(const std::string& host,
325 STSState::UpgradeMode upgrade_mode, 319 STSState::UpgradeMode upgrade_mode,
326 const base::Time& expiry, 320 const base::Time& expiry,
327 bool include_subdomains); 321 bool include_subdomains);
328 322
329 // Adds HPKP state to |host|. 323 // Adds HPKP state to |host|.
330 void AddHPKPInternal(const std::string& host, 324 void AddHPKPInternal(const std::string& host,
331 const base::Time& last_observed, 325 const base::Time& last_observed,
332 const base::Time& expiry, 326 const base::Time& expiry,
333 bool include_subdomains, 327 bool include_subdomains,
334 const HashValueVector& hashes, 328 const HashValueVector& hashes);
335 const GURL& report_uri);
336 329
337 // Enable TransportSecurity for |host|. |state| supercedes any previous 330 // Enable TransportSecurity for |host|. |state| supercedes any previous
338 // state for the |host|, including static entries. 331 // state for the |host|, including static entries.
339 // 332 //
340 // The new state for |host| is persisted using the Delegate (if any). 333 // The new state for |host| is persisted using the Delegate (if any).
341 void EnableSTSHost(const std::string& host, const STSState& state); 334 void EnableSTSHost(const std::string& host, const STSState& state);
342 void EnablePKPHost(const std::string& host, const PKPState& state); 335 void EnablePKPHost(const std::string& host, const PKPState& state);
343 336
344 // The sets of hosts that have enabled TransportSecurity. |domain| will always 337 // The sets of hosts that have enabled TransportSecurity. |domain| will always
345 // be empty for a STSState or PKPState in these maps; the domain 338 // be empty for a STSState or PKPState in these maps; the domain
346 // comes from the map keys instead. In addition, |upgrade_mode| in the 339 // comes from the map keys instead. In addition, |upgrade_mode| in the
347 // STSState is never MODE_DEFAULT and |HasPublicKeyPins| in the PKPState 340 // STSState is never MODE_DEFAULT and |HasPublicKeyPins| in the PKPState
348 // always returns true. 341 // always returns true.
349 STSStateMap enabled_sts_hosts_; 342 STSStateMap enabled_sts_hosts_;
350 PKPStateMap enabled_pkp_hosts_; 343 PKPStateMap enabled_pkp_hosts_;
351 344
352 Delegate* delegate_; 345 Delegate* delegate_;
353 346
354 // True if static pins should be used. 347 // True if static pins should be used.
355 bool enable_static_pins_; 348 bool enable_static_pins_;
356 349
357 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); 350 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
358 }; 351 };
359 352
360 } // namespace net 353 } // namespace net
361 354
362 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ 355 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_
OLDNEW
« no previous file with comments | « net/http/transport_security_persister_unittest.cc ('k') | net/http/transport_security_state.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698