| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef NET_BASE_TRANSPORT_SECURITY_STATE_H_ | |
| 6 #define NET_BASE_TRANSPORT_SECURITY_STATE_H_ | |
| 7 | |
| 8 #include <map> | |
| 9 #include <string> | |
| 10 #include <utility> | |
| 11 #include <vector> | |
| 12 | |
| 13 #include "base/basictypes.h" | |
| 14 #include "base/gtest_prod_util.h" | |
| 15 #include "base/threading/non_thread_safe.h" | |
| 16 #include "base/time.h" | |
| 17 #include "net/base/net_export.h" | |
| 18 #include "net/base/x509_certificate.h" | |
| 19 #include "net/base/x509_cert_types.h" | |
| 20 | |
| 21 namespace net { | |
| 22 | |
| 23 class SSLInfo; | |
| 24 | |
| 25 // Tracks which hosts have enabled strict transport security and/or public | |
| 26 // key pins. | |
| 27 // | |
| 28 // This object manages the in-memory store. Register a Delegate with | |
| 29 // |SetDelegate| to persist the state to disk. | |
| 30 // | |
| 31 // HTTP strict transport security (HSTS) is defined in | |
| 32 // http://tools.ietf.org/html/ietf-websec-strict-transport-sec, and | |
| 33 // HTTP-based dynamic public key pinning (HPKP) is defined in | |
| 34 // http://tools.ietf.org/html/ietf-websec-key-pinning. | |
| 35 class NET_EXPORT TransportSecurityState | |
| 36 : NON_EXPORTED_BASE(public base::NonThreadSafe) { | |
| 37 public: | |
| 38 class Delegate { | |
| 39 public: | |
| 40 // This function may not block and may be called with internal locks held. | |
| 41 // Thus it must not reenter the TransportSecurityState object. | |
| 42 virtual void StateIsDirty(TransportSecurityState* state) = 0; | |
| 43 | |
| 44 protected: | |
| 45 virtual ~Delegate() {} | |
| 46 }; | |
| 47 | |
| 48 TransportSecurityState(); | |
| 49 ~TransportSecurityState(); | |
| 50 | |
| 51 // A DomainState describes the transport security state (required upgrade | |
| 52 // to HTTPS, and/or any public key pins). | |
| 53 class NET_EXPORT DomainState { | |
| 54 public: | |
| 55 enum UpgradeMode { | |
| 56 // These numbers must match those in hsts_view.js, function modeToString. | |
| 57 MODE_FORCE_HTTPS = 0, | |
| 58 MODE_DEFAULT = 1, | |
| 59 }; | |
| 60 | |
| 61 DomainState(); | |
| 62 ~DomainState(); | |
| 63 | |
| 64 // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if: | |
| 65 // 1) |bad_static_spki_hashes| does not intersect |hashes|; AND | |
| 66 // 2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty | |
| 67 // or at least one of them intersects |hashes|. | |
| 68 // | |
| 69 // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes, | |
| 70 // any one of which is sufficient to validate the certificate chain in | |
| 71 // question. The public keys could be of a root CA, intermediate CA, or | |
| 72 // leaf certificate, depending on the security vs. disaster recovery | |
| 73 // tradeoff selected. (Pinning only to leaf certifiates increases | |
| 74 // security because you no longer trust any CAs, but it hampers disaster | |
| 75 // recovery because you can't just get a new certificate signed by the | |
| 76 // CA.) | |
| 77 // | |
| 78 // |bad_static_spki_hashes| contains public keys that we don't want to | |
| 79 // trust. | |
| 80 bool CheckPublicKeyPins(const HashValueVector& hashes) const; | |
| 81 | |
| 82 // Returns true if any of the HashValueVectors |static_spki_hashes|, | |
| 83 // |bad_static_spki_hashes|, or |dynamic_spki_hashes| contains any | |
| 84 // items. | |
| 85 bool HasPublicKeyPins() const; | |
| 86 | |
| 87 // ShouldUpgradeToSSL returns true iff, given the |mode| of this | |
| 88 // DomainState, HTTP requests should be internally redirected to HTTPS | |
| 89 // (also if the "ws" WebSocket request should be upgraded to "wss") | |
| 90 bool ShouldUpgradeToSSL() const; | |
| 91 | |
| 92 // ShouldSSLErrorsBeFatal returns true iff HTTPS errors should cause | |
| 93 // hard-fail behavior (e.g. if HSTS is set for the domain) | |
| 94 bool ShouldSSLErrorsBeFatal() const; | |
| 95 | |
| 96 bool Equals(const DomainState& other) const; | |
| 97 | |
| 98 UpgradeMode upgrade_mode; | |
| 99 | |
| 100 // The absolute time (UTC) when this DomainState was first created. | |
| 101 // | |
| 102 // Static entries do not have a created time. | |
| 103 base::Time created; | |
| 104 | |
| 105 // The absolute time (UTC) when the |upgrade_mode|, if set to | |
| 106 // UPGRADE_ALWAYS, downgrades to UPGRADE_NEVER. | |
| 107 base::Time upgrade_expiry; | |
| 108 | |
| 109 // Are subdomains subject to this DomainState? | |
| 110 // | |
| 111 // TODO(palmer): Decide if we should have separate |pin_subdomains| and | |
| 112 // |upgrade_subdomains|. Alternately, and perhaps better, is to separate | |
| 113 // DomainState into UpgradeState and PinState (requiring also changing the | |
| 114 // serialization format?). | |
| 115 bool include_subdomains; | |
| 116 | |
| 117 // Optional; hashes of static pinned SubjectPublicKeyInfos. Unless both | |
| 118 // are empty, at least one of |static_spki_hashes| and | |
| 119 // |dynamic_spki_hashes| MUST intersect with the set of SPKIs in the TLS | |
| 120 // server's certificate chain. | |
| 121 // | |
| 122 // |dynamic_spki_hashes| take precedence over |static_spki_hashes|. | |
| 123 // That is, |IsChainOfPublicKeysPermitted| first checks dynamic pins and | |
| 124 // then checks static pins. | |
| 125 HashValueVector static_spki_hashes; | |
| 126 | |
| 127 // Optional; hashes of dynamically pinned SubjectPublicKeyInfos. | |
| 128 HashValueVector dynamic_spki_hashes; | |
| 129 | |
| 130 // The absolute time (UTC) when the |dynamic_spki_hashes| expire. | |
| 131 base::Time dynamic_spki_hashes_expiry; | |
| 132 | |
| 133 // Optional; hashes of static known-bad SubjectPublicKeyInfos which | |
| 134 // MUST NOT intersect with the set of SPKIs in the TLS server's | |
| 135 // certificate chain. | |
| 136 HashValueVector bad_static_spki_hashes; | |
| 137 | |
| 138 // The following members are not valid when stored in |enabled_hosts_|: | |
| 139 | |
| 140 // The domain which matched during a search for this DomainState entry. | |
| 141 // Updated by |GetDomainState| and |GetStaticDomainState|. | |
| 142 std::string domain; | |
| 143 }; | |
| 144 | |
| 145 class NET_EXPORT Iterator { | |
| 146 public: | |
| 147 explicit Iterator(const TransportSecurityState& state); | |
| 148 ~Iterator(); | |
| 149 | |
| 150 bool HasNext() const { return iterator_ != end_; } | |
| 151 void Advance() { ++iterator_; } | |
| 152 const std::string& hostname() const { return iterator_->first; } | |
| 153 const DomainState& domain_state() const { return iterator_->second; } | |
| 154 | |
| 155 private: | |
| 156 std::map<std::string, DomainState>::const_iterator iterator_; | |
| 157 std::map<std::string, DomainState>::const_iterator end_; | |
| 158 }; | |
| 159 | |
| 160 // Assign a |Delegate| for persisting the transport security state. If | |
| 161 // |NULL|, state will not be persisted. The caller retains | |
| 162 // ownership of |delegate|. | |
| 163 // Note: This is only used for serializing/deserializing the | |
| 164 // TransportSecurityState. | |
| 165 void SetDelegate(Delegate* delegate); | |
| 166 | |
| 167 // Clears all dynamic data (e.g. HSTS and HPKP data). | |
| 168 // | |
| 169 // Does NOT persist changes using the Delegate, as this function is only | |
| 170 // used to clear any dynamic data prior to re-loading it from a file. | |
| 171 // Note: This is only used for serializing/deserializing the | |
| 172 // TransportSecurityState. | |
| 173 void ClearDynamicData(); | |
| 174 | |
| 175 // Inserts |state| into |enabled_hosts_| under the key |hashed_host|. | |
| 176 // |hashed_host| is already in the internal representation | |
| 177 // HashHost(CanonicalizeHost(host)). | |
| 178 // Note: This is only used for serializing/deserializing the | |
| 179 // TransportSecurityState. | |
| 180 void AddOrUpdateEnabledHosts(const std::string& hashed_host, | |
| 181 const DomainState& state); | |
| 182 | |
| 183 // Inserts |state| into |forced_hosts_| under the key |hashed_host|. | |
| 184 // |hashed_host| is already in the internal representation | |
| 185 // HashHost(CanonicalizeHost(host)). | |
| 186 // Note: This is only used for serializing/deserializing the | |
| 187 // TransportSecurityState. | |
| 188 void AddOrUpdateForcedHosts(const std::string& hashed_host, | |
| 189 const DomainState& state); | |
| 190 | |
| 191 // Deletes all dynamic data (e.g. HSTS or HPKP data) created since a given | |
| 192 // time. | |
| 193 // | |
| 194 // If any entries are deleted, the new state will be persisted through | |
| 195 // the Delegate (if any). | |
| 196 void DeleteAllDynamicDataSince(const base::Time& time); | |
| 197 | |
| 198 // Deletes any dynamic data stored for |host| (e.g. HSTS or HPKP data). | |
| 199 // If |host| doesn't have an exact entry then no action is taken. Does | |
| 200 // not delete static (i.e. preloaded) data. Returns true iff an entry | |
| 201 // was deleted. | |
| 202 // | |
| 203 // If an entry is deleted, the new state will be persisted through | |
| 204 // the Delegate (if any). | |
| 205 bool DeleteDynamicDataForHost(const std::string& host); | |
| 206 | |
| 207 // Returns true and updates |*result| iff there is a DomainState for | |
| 208 // |host|. | |
| 209 // | |
| 210 // If |sni_enabled| is true, searches the static pins defined for | |
| 211 // SNI-using hosts as well as the rest of the pins. | |
| 212 // | |
| 213 // If |host| matches both an exact entry and is a subdomain of another | |
| 214 // entry, the exact match determines the return value. | |
| 215 // | |
| 216 // Note that this method is not const because it opportunistically removes | |
| 217 // entries that have expired. | |
| 218 bool GetDomainState(const std::string& host, | |
| 219 bool sni_enabled, | |
| 220 DomainState* result); | |
| 221 | |
| 222 // Processes an HSTS header value from the host, adding entries to | |
| 223 // dynamic state if necessary. | |
| 224 bool AddHSTSHeader(const std::string& host, const std::string& value); | |
| 225 | |
| 226 // Processes an HPKP header value from the host, adding entries to | |
| 227 // dynamic state if necessary. ssl_info is used to check that | |
| 228 // the specified pins overlap with the certificate chain. | |
| 229 bool AddHPKPHeader(const std::string& host, const std::string& value, | |
| 230 const SSLInfo& ssl_info); | |
| 231 | |
| 232 // Adds explicitly-specified data as if it was processed from an | |
| 233 // HSTS header (used for net-internals and unit tests). | |
| 234 bool AddHSTS(const std::string& host, const base::Time& expiry, | |
| 235 bool include_subdomains); | |
| 236 | |
| 237 // Adds explicitly-specified data as if it was processed from an | |
| 238 // HPKP header (used for net-internals and unit tests). | |
| 239 bool AddHPKP(const std::string& host, const base::Time& expiry, | |
| 240 bool include_subdomains, const HashValueVector& hashes); | |
| 241 | |
| 242 // Returns true iff we have any static public key pins for the |host| and | |
| 243 // iff its set of required pins is the set we expect for Google | |
| 244 // properties. | |
| 245 // | |
| 246 // If |sni_enabled| is true, searches the static pins defined for | |
| 247 // SNI-using hosts as well as the rest of the pins. | |
| 248 // | |
| 249 // If |host| matches both an exact entry and is a subdomain of another | |
| 250 // entry, the exact match determines the return value. | |
| 251 static bool IsGooglePinnedProperty(const std::string& host, | |
| 252 bool sni_enabled); | |
| 253 | |
| 254 // The maximum number of seconds for which we'll cache an HSTS request. | |
| 255 static const long int kMaxHSTSAgeSecs; | |
| 256 | |
| 257 // Send an UMA report on pin validation failure, if the host is in a | |
| 258 // statically-defined list of domains. | |
| 259 // | |
| 260 // TODO(palmer): This doesn't really belong here, and should be moved into | |
| 261 // the exactly one call site. This requires unifying |struct HSTSPreload| | |
| 262 // (an implementation detail of this class) with a more generic | |
| 263 // representation of first-class DomainStates, and exposing the preloads | |
| 264 // to the caller with |GetStaticDomainState|. | |
| 265 static void ReportUMAOnPinFailure(const std::string& host); | |
| 266 | |
| 267 // IsBuildTimely returns true if the current build is new enough ensure that | |
| 268 // built in security information (i.e. HSTS preloading and pinning | |
| 269 // information) is timely. | |
| 270 static bool IsBuildTimely(); | |
| 271 | |
| 272 private: | |
| 273 friend class TransportSecurityStateTest; | |
| 274 | |
| 275 typedef std::map<std::string, DomainState> DomainStateMap; | |
| 276 | |
| 277 // If a Delegate is present, notify it that the internal state has | |
| 278 // changed. | |
| 279 void DirtyNotify(); | |
| 280 | |
| 281 // Enable TransportSecurity for |host|. |state| supercedes any previous | |
| 282 // state for the |host|, including static entries. | |
| 283 // | |
| 284 // The new state for |host| is persisted using the Delegate (if any). | |
| 285 void EnableHost(const std::string& host, const DomainState& state); | |
| 286 | |
| 287 // Converts |hostname| from dotted form ("www.google.com") to the form | |
| 288 // used in DNS: "\x03www\x06google\x03com", lowercases that, and returns | |
| 289 // the result. | |
| 290 static std::string CanonicalizeHost(const std::string& hostname); | |
| 291 | |
| 292 // Returns true and updates |*result| iff there is a static DomainState for | |
| 293 // |host|. | |
| 294 // | |
| 295 // |GetStaticDomainState| is identical to |GetDomainState| except that it | |
| 296 // searches only the statically-defined transport security state, ignoring | |
| 297 // all dynamically-added DomainStates. | |
| 298 // | |
| 299 // If |sni_enabled| is true, searches the static pins defined for | |
| 300 // SNI-using hosts as well as the rest of the pins. | |
| 301 // | |
| 302 // If |host| matches both an exact entry and is a subdomain of another | |
| 303 // entry, the exact match determines the return value. | |
| 304 // | |
| 305 // Note that this method is not const because it opportunistically removes | |
| 306 // entries that have expired. | |
| 307 bool GetStaticDomainState(const std::string& host, | |
| 308 bool sni_enabled, | |
| 309 DomainState* result); | |
| 310 | |
| 311 // The set of hosts that have enabled TransportSecurity. | |
| 312 DomainStateMap enabled_hosts_; | |
| 313 | |
| 314 // Extra entries, provided by the user at run-time, to treat as if they | |
| 315 // were static. | |
| 316 DomainStateMap forced_hosts_; | |
| 317 | |
| 318 Delegate* delegate_; | |
| 319 | |
| 320 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); | |
| 321 }; | |
| 322 | |
| 323 } // namespace net | |
| 324 | |
| 325 #endif // NET_BASE_TRANSPORT_SECURITY_STATE_H_ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 12680003:
net: split net/ssl out of net/base (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src