OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 #include "chrome/browser/net/ssl_config_service_manager.h" | 4 #include "components/ssl_config/ssl_config_service_manager.h" |
5 | 5 |
6 #include <algorithm> | 6 #include <algorithm> |
7 #include <string> | 7 #include <string> |
8 #include <vector> | 8 #include <vector> |
9 | 9 |
10 #include "base/basictypes.h" | 10 #include "base/basictypes.h" |
11 #include "base/bind.h" | 11 #include "base/bind.h" |
12 #include "base/metrics/field_trial.h" | 12 #include "base/metrics/field_trial.h" |
13 #include "base/prefs/pref_change_registrar.h" | 13 #include "base/prefs/pref_change_registrar.h" |
14 #include "base/prefs/pref_member.h" | 14 #include "base/prefs/pref_member.h" |
15 #include "base/prefs/pref_registry_simple.h" | 15 #include "base/prefs/pref_registry_simple.h" |
16 #include "base/prefs/pref_service.h" | 16 #include "base/prefs/pref_service.h" |
17 #include "chrome/browser/chrome_notification_types.h" | 17 #include "base/single_thread_task_runner.h" |
18 #include "chrome/common/chrome_switches.h" | |
19 #include "chrome/common/pref_names.h" | |
20 #include "components/content_settings/core/browser/content_settings_utils.h" | 18 #include "components/content_settings/core/browser/content_settings_utils.h" |
21 #include "components/content_settings/core/common/content_settings.h" | 19 #include "components/content_settings/core/common/content_settings.h" |
22 #include "content/public/browser/browser_thread.h" | 20 #include "components/ssl_config/ssl_config_prefs.h" |
| 21 #include "components/ssl_config/ssl_config_switches.h" |
23 #include "net/ssl/ssl_cipher_suite_names.h" | 22 #include "net/ssl/ssl_cipher_suite_names.h" |
24 #include "net/ssl/ssl_config_service.h" | 23 #include "net/ssl/ssl_config_service.h" |
25 | 24 |
26 using content::BrowserThread; | 25 namespace base { |
| 26 class SingleThreadTaskRunner; |
| 27 } |
27 | 28 |
28 namespace { | 29 namespace { |
29 | 30 |
30 // Converts a ListValue of StringValues into a vector of strings. Any Values | 31 // Converts a ListValue of StringValues into a vector of strings. Any Values |
31 // which cannot be converted will be skipped. | 32 // which cannot be converted will be skipped. |
32 std::vector<std::string> ListValueToStringVector(const base::ListValue* value) { | 33 std::vector<std::string> ListValueToStringVector(const base::ListValue* value) { |
33 std::vector<std::string> results; | 34 std::vector<std::string> results; |
34 results.reserve(value->GetSize()); | 35 results.reserve(value->GetSize()); |
35 std::string s; | 36 std::string s; |
36 for (base::ListValue::const_iterator it = value->begin(); it != value->end(); | 37 for (base::ListValue::const_iterator it = value->begin(); it != value->end(); |
(...skipping 10 matching lines...) Expand all Loading... |
47 // cipher suites will be ignored. | 48 // cipher suites will be ignored. |
48 std::vector<uint16> ParseCipherSuites( | 49 std::vector<uint16> ParseCipherSuites( |
49 const std::vector<std::string>& cipher_strings) { | 50 const std::vector<std::string>& cipher_strings) { |
50 std::vector<uint16> cipher_suites; | 51 std::vector<uint16> cipher_suites; |
51 cipher_suites.reserve(cipher_strings.size()); | 52 cipher_suites.reserve(cipher_strings.size()); |
52 | 53 |
53 for (std::vector<std::string>::const_iterator it = cipher_strings.begin(); | 54 for (std::vector<std::string>::const_iterator it = cipher_strings.begin(); |
54 it != cipher_strings.end(); ++it) { | 55 it != cipher_strings.end(); ++it) { |
55 uint16 cipher_suite = 0; | 56 uint16 cipher_suite = 0; |
56 if (!net::ParseSSLCipherString(*it, &cipher_suite)) { | 57 if (!net::ParseSSLCipherString(*it, &cipher_suite)) { |
57 LOG(ERROR) << "Ignoring unrecognized or unparsable cipher suite: " | 58 LOG(ERROR) << "Ignoring unrecognized or unparsable cipher suite: " << *it; |
58 << *it; | |
59 continue; | 59 continue; |
60 } | 60 } |
61 cipher_suites.push_back(cipher_suite); | 61 cipher_suites.push_back(cipher_suite); |
62 } | 62 } |
63 std::sort(cipher_suites.begin(), cipher_suites.end()); | 63 std::sort(cipher_suites.begin(), cipher_suites.end()); |
64 return cipher_suites; | 64 return cipher_suites; |
65 } | 65 } |
66 | 66 |
67 // Returns the SSL protocol version (as a uint16) represented by a string. | 67 // Returns the SSL protocol version (as a uint16) represented by a string. |
68 // Returns 0 if the string is invalid. | 68 // Returns 0 if the string is invalid. |
(...skipping 12 matching lines...) Expand all Loading... |
81 } // namespace | 81 } // namespace |
82 | 82 |
83 //////////////////////////////////////////////////////////////////////////////// | 83 //////////////////////////////////////////////////////////////////////////////// |
84 // SSLConfigServicePref | 84 // SSLConfigServicePref |
85 | 85 |
86 // An SSLConfigService which stores a cached version of the current SSLConfig | 86 // An SSLConfigService which stores a cached version of the current SSLConfig |
87 // prefs, which are updated by SSLConfigServiceManagerPref when the prefs | 87 // prefs, which are updated by SSLConfigServiceManagerPref when the prefs |
88 // change. | 88 // change. |
89 class SSLConfigServicePref : public net::SSLConfigService { | 89 class SSLConfigServicePref : public net::SSLConfigService { |
90 public: | 90 public: |
91 SSLConfigServicePref() {} | 91 explicit SSLConfigServicePref( |
| 92 const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner); |
92 | 93 |
93 // Store SSL config settings in |config|. Must only be called from IO thread. | 94 // Store SSL config settings in |config|. Must only be called from IO thread. |
94 void GetSSLConfig(net::SSLConfig* config) override; | 95 void GetSSLConfig(net::SSLConfig* config) override; |
95 | 96 |
96 private: | 97 private: |
97 // Allow the pref watcher to update our internal state. | 98 // Allow the pref watcher to update our internal state. |
98 friend class SSLConfigServiceManagerPref; | 99 friend class SSLConfigServiceManagerPref; |
99 | 100 |
100 ~SSLConfigServicePref() override {} | 101 ~SSLConfigServicePref() override {} |
101 | 102 |
102 // This method is posted to the IO thread from the browser thread to carry the | 103 // This method is posted to the IO thread from the browser thread to carry the |
103 // new config information. | 104 // new config information. |
104 void SetNewSSLConfig(const net::SSLConfig& new_config); | 105 void SetNewSSLConfig(const net::SSLConfig& new_config); |
105 | 106 |
106 // Cached value of prefs, should only be accessed from IO thread. | 107 // Cached value of prefs, should only be accessed from IO thread. |
107 net::SSLConfig cached_config_; | 108 net::SSLConfig cached_config_; |
108 | 109 |
| 110 scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_; |
| 111 |
109 DISALLOW_COPY_AND_ASSIGN(SSLConfigServicePref); | 112 DISALLOW_COPY_AND_ASSIGN(SSLConfigServicePref); |
110 }; | 113 }; |
111 | 114 |
| 115 SSLConfigServicePref::SSLConfigServicePref( |
| 116 const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner) |
| 117 : io_task_runner_(io_task_runner) {} |
| 118 |
112 void SSLConfigServicePref::GetSSLConfig(net::SSLConfig* config) { | 119 void SSLConfigServicePref::GetSSLConfig(net::SSLConfig* config) { |
113 DCHECK_CURRENTLY_ON(BrowserThread::IO); | 120 DCHECK(io_task_runner_->BelongsToCurrentThread()); |
114 *config = cached_config_; | 121 *config = cached_config_; |
115 } | 122 } |
116 | 123 |
117 void SSLConfigServicePref::SetNewSSLConfig( | 124 void SSLConfigServicePref::SetNewSSLConfig(const net::SSLConfig& new_config) { |
118 const net::SSLConfig& new_config) { | |
119 net::SSLConfig orig_config = cached_config_; | 125 net::SSLConfig orig_config = cached_config_; |
120 cached_config_ = new_config; | 126 cached_config_ = new_config; |
121 ProcessConfigUpdate(orig_config, new_config); | 127 ProcessConfigUpdate(orig_config, new_config); |
122 } | 128 } |
123 | 129 |
124 //////////////////////////////////////////////////////////////////////////////// | 130 //////////////////////////////////////////////////////////////////////////////// |
125 // SSLConfigServiceManagerPref | 131 // SSLConfigServiceManagerPref |
126 | 132 |
127 // The manager for holding and updating an SSLConfigServicePref instance. | 133 // The manager for holding and updating an SSLConfigServicePref instance. |
128 class SSLConfigServiceManagerPref | 134 class SSLConfigServiceManagerPref : public ssl_config::SSLConfigServiceManager { |
129 : public SSLConfigServiceManager { | |
130 public: | 135 public: |
131 explicit SSLConfigServiceManagerPref(PrefService* local_state); | 136 SSLConfigServiceManagerPref( |
| 137 PrefService* local_state, |
| 138 const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner); |
132 ~SSLConfigServiceManagerPref() override {} | 139 ~SSLConfigServiceManagerPref() override {} |
133 | 140 |
134 // Register local_state SSL preferences. | 141 // Register local_state SSL preferences. |
135 static void RegisterPrefs(PrefRegistrySimple* registry); | 142 static void RegisterPrefs(PrefRegistrySimple* registry); |
136 | 143 |
137 net::SSLConfigService* Get() override; | 144 net::SSLConfigService* Get() override; |
138 | 145 |
139 private: | 146 private: |
140 // Callback for preference changes. This will post the changes to the IO | 147 // Callback for preference changes. This will post the changes to the IO |
141 // thread with SetNewSSLConfig. | 148 // thread with SetNewSSLConfig. |
142 void OnPreferenceChanged(PrefService* prefs, | 149 void OnPreferenceChanged(PrefService* prefs, const std::string& pref_name); |
143 const std::string& pref_name); | |
144 | 150 |
145 // Store SSL config settings in |config|, directly from the preferences. Must | 151 // Store SSL config settings in |config|, directly from the preferences. Must |
146 // only be called from UI thread. | 152 // only be called from UI thread. |
147 void GetSSLConfigFromPrefs(net::SSLConfig* config); | 153 void GetSSLConfigFromPrefs(net::SSLConfig* config); |
148 | 154 |
149 // Processes changes to the disabled cipher suites preference, updating the | 155 // Processes changes to the disabled cipher suites preference, updating the |
150 // cached list of parsed SSL/TLS cipher suites that are disabled. | 156 // cached list of parsed SSL/TLS cipher suites that are disabled. |
151 void OnDisabledCipherSuitesChange(PrefService* local_state); | 157 void OnDisabledCipherSuitesChange(PrefService* local_state); |
152 | 158 |
153 PrefChangeRegistrar local_state_change_registrar_; | 159 PrefChangeRegistrar local_state_change_registrar_; |
154 | 160 |
155 // The local_state prefs (should only be accessed from UI thread) | 161 // The local_state prefs (should only be accessed from UI thread) |
156 BooleanPrefMember rev_checking_enabled_; | 162 BooleanPrefMember rev_checking_enabled_; |
157 BooleanPrefMember rev_checking_required_local_anchors_; | 163 BooleanPrefMember rev_checking_required_local_anchors_; |
158 StringPrefMember ssl_version_min_; | 164 StringPrefMember ssl_version_min_; |
159 StringPrefMember ssl_version_max_; | 165 StringPrefMember ssl_version_max_; |
160 StringPrefMember ssl_version_fallback_min_; | 166 StringPrefMember ssl_version_fallback_min_; |
161 | 167 |
162 // The cached list of disabled SSL cipher suites. | 168 // The cached list of disabled SSL cipher suites. |
163 std::vector<uint16> disabled_cipher_suites_; | 169 std::vector<uint16> disabled_cipher_suites_; |
164 | 170 |
165 scoped_refptr<SSLConfigServicePref> ssl_config_service_; | 171 scoped_refptr<SSLConfigServicePref> ssl_config_service_; |
166 | 172 |
| 173 scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_; |
| 174 |
167 DISALLOW_COPY_AND_ASSIGN(SSLConfigServiceManagerPref); | 175 DISALLOW_COPY_AND_ASSIGN(SSLConfigServiceManagerPref); |
168 }; | 176 }; |
169 | 177 |
170 SSLConfigServiceManagerPref::SSLConfigServiceManagerPref( | 178 SSLConfigServiceManagerPref::SSLConfigServiceManagerPref( |
171 PrefService* local_state) | 179 PrefService* local_state, |
172 : ssl_config_service_(new SSLConfigServicePref()) { | 180 const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner) |
| 181 : ssl_config_service_(new SSLConfigServicePref(io_task_runner)), |
| 182 io_task_runner_(io_task_runner) { |
173 DCHECK(local_state); | 183 DCHECK(local_state); |
174 | 184 |
175 PrefChangeRegistrar::NamedChangeCallback local_state_callback = base::Bind( | 185 PrefChangeRegistrar::NamedChangeCallback local_state_callback = |
176 &SSLConfigServiceManagerPref::OnPreferenceChanged, | 186 base::Bind(&SSLConfigServiceManagerPref::OnPreferenceChanged, |
177 base::Unretained(this), | 187 base::Unretained(this), local_state); |
178 local_state); | |
179 | 188 |
180 rev_checking_enabled_.Init( | 189 rev_checking_enabled_.Init(ssl_config::prefs::kCertRevocationCheckingEnabled, |
181 prefs::kCertRevocationCheckingEnabled, local_state, local_state_callback); | 190 local_state, local_state_callback); |
182 rev_checking_required_local_anchors_.Init( | 191 rev_checking_required_local_anchors_.Init( |
183 prefs::kCertRevocationCheckingRequiredLocalAnchors, | 192 ssl_config::prefs::kCertRevocationCheckingRequiredLocalAnchors, |
184 local_state, | 193 local_state, local_state_callback); |
185 local_state_callback); | 194 ssl_version_min_.Init(ssl_config::prefs::kSSLVersionMin, local_state, |
186 ssl_version_min_.Init( | 195 local_state_callback); |
187 prefs::kSSLVersionMin, local_state, local_state_callback); | 196 ssl_version_max_.Init(ssl_config::prefs::kSSLVersionMax, local_state, |
188 ssl_version_max_.Init( | 197 local_state_callback); |
189 prefs::kSSLVersionMax, local_state, local_state_callback); | 198 ssl_version_fallback_min_.Init(ssl_config::prefs::kSSLVersionFallbackMin, |
190 ssl_version_fallback_min_.Init( | 199 local_state, local_state_callback); |
191 prefs::kSSLVersionFallbackMin, local_state, local_state_callback); | |
192 | 200 |
193 local_state_change_registrar_.Init(local_state); | 201 local_state_change_registrar_.Init(local_state); |
194 local_state_change_registrar_.Add( | 202 local_state_change_registrar_.Add(ssl_config::prefs::kCipherSuiteBlacklist, |
195 prefs::kCipherSuiteBlacklist, local_state_callback); | 203 local_state_callback); |
196 | 204 |
197 OnDisabledCipherSuitesChange(local_state); | 205 OnDisabledCipherSuitesChange(local_state); |
198 | 206 |
199 // Initialize from UI thread. This is okay as there shouldn't be anything on | 207 // Initialize from UI thread. This is okay as there shouldn't be anything on |
200 // the IO thread trying to access it yet. | 208 // the IO thread trying to access it yet. |
201 GetSSLConfigFromPrefs(&ssl_config_service_->cached_config_); | 209 GetSSLConfigFromPrefs(&ssl_config_service_->cached_config_); |
202 } | 210 } |
203 | 211 |
204 // static | 212 // static |
205 void SSLConfigServiceManagerPref::RegisterPrefs(PrefRegistrySimple* registry) { | 213 void SSLConfigServiceManagerPref::RegisterPrefs(PrefRegistrySimple* registry) { |
206 net::SSLConfig default_config; | 214 net::SSLConfig default_config; |
207 registry->RegisterBooleanPref(prefs::kCertRevocationCheckingEnabled, | |
208 default_config.rev_checking_enabled); | |
209 registry->RegisterBooleanPref( | 215 registry->RegisterBooleanPref( |
210 prefs::kCertRevocationCheckingRequiredLocalAnchors, | 216 ssl_config::prefs::kCertRevocationCheckingEnabled, |
| 217 default_config.rev_checking_enabled); |
| 218 registry->RegisterBooleanPref( |
| 219 ssl_config::prefs::kCertRevocationCheckingRequiredLocalAnchors, |
211 default_config.rev_checking_required_local_anchors); | 220 default_config.rev_checking_required_local_anchors); |
212 registry->RegisterStringPref(prefs::kSSLVersionMin, std::string()); | 221 registry->RegisterStringPref(ssl_config::prefs::kSSLVersionMin, |
213 registry->RegisterStringPref(prefs::kSSLVersionMax, std::string()); | 222 std::string()); |
214 registry->RegisterStringPref(prefs::kSSLVersionFallbackMin, std::string()); | 223 registry->RegisterStringPref(ssl_config::prefs::kSSLVersionMax, |
215 registry->RegisterListPref(prefs::kCipherSuiteBlacklist); | 224 std::string()); |
| 225 registry->RegisterStringPref(ssl_config::prefs::kSSLVersionFallbackMin, |
| 226 std::string()); |
| 227 registry->RegisterListPref(ssl_config::prefs::kCipherSuiteBlacklist); |
216 } | 228 } |
217 | 229 |
218 net::SSLConfigService* SSLConfigServiceManagerPref::Get() { | 230 net::SSLConfigService* SSLConfigServiceManagerPref::Get() { |
219 return ssl_config_service_.get(); | 231 return ssl_config_service_.get(); |
220 } | 232 } |
221 | 233 |
222 void SSLConfigServiceManagerPref::OnPreferenceChanged( | 234 void SSLConfigServiceManagerPref::OnPreferenceChanged( |
223 PrefService* prefs, | 235 PrefService* prefs, |
224 const std::string& pref_name_in) { | 236 const std::string& pref_name_in) { |
225 DCHECK_CURRENTLY_ON(BrowserThread::UI); | |
226 DCHECK(prefs); | 237 DCHECK(prefs); |
227 if (pref_name_in == prefs::kCipherSuiteBlacklist) | 238 if (pref_name_in == ssl_config::prefs::kCipherSuiteBlacklist) |
228 OnDisabledCipherSuitesChange(prefs); | 239 OnDisabledCipherSuitesChange(prefs); |
229 | 240 |
230 net::SSLConfig new_config; | 241 net::SSLConfig new_config; |
231 GetSSLConfigFromPrefs(&new_config); | 242 GetSSLConfigFromPrefs(&new_config); |
232 | 243 |
233 // Post a task to |io_loop| with the new configuration, so it can | 244 // Post a task to |io_loop| with the new configuration, so it can |
234 // update |cached_config_|. | 245 // update |cached_config_|. |
235 BrowserThread::PostTask( | 246 io_task_runner_->PostTask(FROM_HERE, |
236 BrowserThread::IO, | 247 base::Bind(&SSLConfigServicePref::SetNewSSLConfig, |
237 FROM_HERE, | 248 ssl_config_service_.get(), new_config)); |
238 base::Bind( | |
239 &SSLConfigServicePref::SetNewSSLConfig, | |
240 ssl_config_service_.get(), | |
241 new_config)); | |
242 } | 249 } |
243 | 250 |
244 void SSLConfigServiceManagerPref::GetSSLConfigFromPrefs( | 251 void SSLConfigServiceManagerPref::GetSSLConfigFromPrefs( |
245 net::SSLConfig* config) { | 252 net::SSLConfig* config) { |
246 // rev_checking_enabled was formerly a user-settable preference, but now | 253 // rev_checking_enabled was formerly a user-settable preference, but now |
247 // it is managed-only. | 254 // it is managed-only. |
248 if (rev_checking_enabled_.IsManaged()) | 255 if (rev_checking_enabled_.IsManaged()) |
249 config->rev_checking_enabled = rev_checking_enabled_.GetValue(); | 256 config->rev_checking_enabled = rev_checking_enabled_.GetValue(); |
250 else | 257 else |
251 config->rev_checking_enabled = false; | 258 config->rev_checking_enabled = false; |
(...skipping 18 matching lines...) Expand all Loading... |
270 } | 277 } |
271 if (version_fallback_min) { | 278 if (version_fallback_min) { |
272 config->version_fallback_min = version_fallback_min; | 279 config->version_fallback_min = version_fallback_min; |
273 } | 280 } |
274 config->disabled_cipher_suites = disabled_cipher_suites_; | 281 config->disabled_cipher_suites = disabled_cipher_suites_; |
275 } | 282 } |
276 | 283 |
277 void SSLConfigServiceManagerPref::OnDisabledCipherSuitesChange( | 284 void SSLConfigServiceManagerPref::OnDisabledCipherSuitesChange( |
278 PrefService* local_state) { | 285 PrefService* local_state) { |
279 const base::ListValue* value = | 286 const base::ListValue* value = |
280 local_state->GetList(prefs::kCipherSuiteBlacklist); | 287 local_state->GetList(ssl_config::prefs::kCipherSuiteBlacklist); |
281 disabled_cipher_suites_ = ParseCipherSuites(ListValueToStringVector(value)); | 288 disabled_cipher_suites_ = ParseCipherSuites(ListValueToStringVector(value)); |
282 } | 289 } |
283 | 290 |
284 //////////////////////////////////////////////////////////////////////////////// | 291 //////////////////////////////////////////////////////////////////////////////// |
285 // SSLConfigServiceManager | 292 // SSLConfigServiceManager |
286 | 293 |
| 294 namespace ssl_config { |
287 // static | 295 // static |
288 SSLConfigServiceManager* SSLConfigServiceManager::CreateDefaultManager( | 296 SSLConfigServiceManager* SSLConfigServiceManager::CreateDefaultManager( |
289 PrefService* local_state) { | 297 PrefService* local_state, |
290 return new SSLConfigServiceManagerPref(local_state); | 298 const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner) { |
| 299 return new SSLConfigServiceManagerPref(local_state, io_task_runner); |
291 } | 300 } |
292 | 301 |
293 // static | 302 // static |
294 void SSLConfigServiceManager::RegisterPrefs(PrefRegistrySimple* registry) { | 303 void SSLConfigServiceManager::RegisterPrefs(PrefRegistrySimple* registry) { |
295 SSLConfigServiceManagerPref::RegisterPrefs(registry); | 304 SSLConfigServiceManagerPref::RegisterPrefs(registry); |
296 } | 305 } |
| 306 } // namespace ssl_config |
OLD | NEW |