Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(574)

Unified Diff: net/http/transport_security_state.cc

Issue 2016143002: Expose when PKP is bypassed in SSLInfo. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Add test Created 4 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: net/http/transport_security_state.cc
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
index 6bbe0b032a5997b6c90e90898453410dfa7ae138..5b9023a2c9b4104c5f1a0da6e9ea9a35256df111 100644
--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
@@ -648,18 +648,20 @@ bool TransportSecurityState::CheckPublicKeyPins(
const X509Certificate* validated_certificate_chain,
const PublicKeyPinReportStatus report_status,
std::string* pinning_failure_log) {
- // Perform pin validation if, and only if, all these conditions obtain:
- //
- // * the server's certificate chain chains up to a known root (i.e. not a
- // user-installed trust anchor); and
- // * the server actually has public key pins.
- if (!is_issued_by_known_root || !HasPublicKeyPins(host_port_pair.host())) {
+ // Perform pin validation only if the server actually has public key pins.
+ if (!HasPublicKeyPins(host_port_pair.host())) {
return true;
}
bool pins_are_valid = CheckPublicKeyPinsImpl(
- host_port_pair, public_key_hashes, served_certificate_chain,
- validated_certificate_chain, report_status, pinning_failure_log);
+ host_port_pair, is_issued_by_known_root, public_key_hashes,
+ served_certificate_chain, validated_certificate_chain, report_status,
+ pinning_failure_log);
+ // Don't track statistics when a local trust anchor would override the pinning
+ // anyway.
+ if (!is_issued_by_known_root) {
+ return pins_are_valid;
+ }
if (!pins_are_valid) {
LOG(ERROR) << *pinning_failure_log;
ReportUMAOnPinFailure(host_port_pair.host());
@@ -790,6 +792,7 @@ void TransportSecurityState::EnablePKPHost(const std::string& host,
bool TransportSecurityState::CheckPinsAndMaybeSendReport(
const HostPortPair& host_port_pair,
+ bool is_issued_by_known_root,
const TransportSecurityState::PKPState& pkp_state,
const HashValueVector& hashes,
const X509Certificate* served_certificate_chain,
@@ -799,7 +802,7 @@ bool TransportSecurityState::CheckPinsAndMaybeSendReport(
if (pkp_state.CheckPublicKeyPins(hashes, failure_log))
return true;
- if (!report_sender_ ||
+ if (!report_sender_ || !is_issued_by_known_root ||
report_status != TransportSecurityState::ENABLE_PIN_REPORTS ||
pkp_state.report_uri.is_empty()) {
return false;
@@ -1018,14 +1021,10 @@ bool TransportSecurityState::ProcessHPKPReportOnlyHeader(
pkp_state.report_uri = report_uri;
pkp_state.domain = DNSDomainToString(CanonicalizeHost(host_port_pair.host()));
- // Only perform pin validation if the cert chains up to a known root.
- if (!ssl_info.is_issued_by_known_root)
- return true;
-
CheckPinsAndMaybeSendReport(
- host_port_pair, pkp_state, ssl_info.public_key_hashes,
- ssl_info.unverified_cert.get(), ssl_info.cert.get(), ENABLE_PIN_REPORTS,
- &unused_failure_log);
+ host_port_pair, ssl_info.is_issued_by_known_root, pkp_state,
+ ssl_info.public_key_hashes, ssl_info.unverified_cert.get(),
+ ssl_info.cert.get(), ENABLE_PIN_REPORTS, &unused_failure_log);
return true;
}
@@ -1082,6 +1081,7 @@ bool TransportSecurityState::IsBuildTimely() {
bool TransportSecurityState::CheckPublicKeyPinsImpl(
const HostPortPair& host_port_pair,
+ bool is_issued_by_known_root,
const HashValueVector& hashes,
const X509Certificate* served_certificate_chain,
const X509Certificate* validated_certificate_chain,
@@ -1098,8 +1098,9 @@ bool TransportSecurityState::CheckPublicKeyPinsImpl(
}
return CheckPinsAndMaybeSendReport(
- host_port_pair, pkp_state, hashes, served_certificate_chain,
- validated_certificate_chain, report_status, failure_log);
+ host_port_pair, is_issued_by_known_root, pkp_state, hashes,
+ served_certificate_chain, validated_certificate_chain, report_status,
+ failure_log);
}
bool TransportSecurityState::GetStaticDomainState(const std::string& host,

Powered by Google App Engine
This is Rietveld 408576698