OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
7 | 7 |
8 #include <stdint.h> | 8 #include <stdint.h> |
9 | 9 |
10 #include <map> | 10 #include <map> |
11 #include <string> | 11 #include <string> |
12 #include <utility> | 12 #include <utility> |
13 #include <vector> | 13 #include <vector> |
14 | 14 |
15 #include "base/callback.h" | 15 #include "base/callback.h" |
16 #include "base/gtest_prod_util.h" | 16 #include "base/gtest_prod_util.h" |
17 #include "base/macros.h" | 17 #include "base/macros.h" |
18 #include "base/threading/non_thread_safe.h" | 18 #include "base/threading/non_thread_safe.h" |
19 #include "base/time/time.h" | 19 #include "base/time/time.h" |
20 #include "net/base/expiring_cache.h" | 20 #include "net/base/expiring_cache.h" |
21 #include "net/base/net_export.h" | 21 #include "net/base/net_export.h" |
22 #include "net/cert/x509_cert_types.h" | 22 #include "net/cert/x509_cert_types.h" |
23 #include "net/cert/x509_certificate.h" | 23 #include "net/cert/x509_certificate.h" |
24 #include "url/gurl.h" | 24 #include "url/gurl.h" |
25 | 25 |
26 class GURL; | 26 class GURL; |
27 | 27 |
28 namespace net { | 28 namespace net { |
29 | 29 |
30 class ExpectStapleReport; | |
30 class HostPortPair; | 31 class HostPortPair; |
31 class SSLInfo; | 32 class SSLInfo; |
32 | 33 |
33 // Tracks which hosts have enabled strict transport security and/or public | 34 // Tracks which hosts have enabled strict transport security and/or public |
34 // key pins. | 35 // key pins. |
35 // | 36 // |
36 // This object manages the in-memory store. Register a Delegate with | 37 // This object manages the in-memory store. Register a Delegate with |
37 // |SetDelegate| to persist the state to disk. | 38 // |SetDelegate| to persist the state to disk. |
38 // | 39 // |
39 // HTTP strict transport security (HSTS) is defined in | 40 // HTTP strict transport security (HSTS) is defined in |
(...skipping 338 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
378 // 1. The header value is "preload", indicating that the site wants to | 379 // 1. The header value is "preload", indicating that the site wants to |
379 // be opted in to Expect CT. | 380 // be opted in to Expect CT. |
380 // 2. The given host is present on the Expect CT preload list with a | 381 // 2. The given host is present on the Expect CT preload list with a |
381 // valid report-uri, and the build is timely (i.e. preload list is fresh). | 382 // valid report-uri, and the build is timely (i.e. preload list is fresh). |
382 // 3. |ssl_info| indicates that the connection violated the Expect CT policy. | 383 // 3. |ssl_info| indicates that the connection violated the Expect CT policy. |
383 // 4. An Expect CT reporter has been provided with SetExpectCTReporter(). | 384 // 4. An Expect CT reporter has been provided with SetExpectCTReporter(). |
384 void ProcessExpectCTHeader(const std::string& value, | 385 void ProcessExpectCTHeader(const std::string& value, |
385 const HostPortPair& host_port_pair, | 386 const HostPortPair& host_port_pair, |
386 const SSLInfo& ssl_info); | 387 const SSLInfo& ssl_info); |
387 | 388 |
389 // Checks to see if the given |host_port_pair| is in the Expect-Staple preload | |
390 // list. If the host is preloaded, this parses |ocsp_response|, validates | |
391 // it against |verified_certificate|, and ensures the OCSP response is valid | |
392 // at |verify_time| and is no older than |max_age|. If the OCSP response fails | |
393 // validation, this sends an Expect-Staple report to the preloaded report URI. | |
394 // The report will contain |unverified_certificate| iff | |
395 // |is_issued_by_known_root| is true. | |
Ryan Sleevi
2016/06/16 21:49:29
This also seems a big "SRP" concern. This doesn't
| |
396 void CheckExpectStaple(const HostPortPair& host_port_pair, | |
397 const X509Certificate& verified_certificate, | |
398 const X509Certificate& unverified_certificate, | |
399 bool is_issued_by_known_root, | |
400 const base::Time& verify_time, | |
401 const base::TimeDelta& max_age, | |
402 const std::string& ocsp_response); | |
403 | |
388 private: | 404 private: |
389 friend class TransportSecurityStateTest; | 405 friend class TransportSecurityStateTest; |
406 friend class ExpectStapleTest; | |
Ryan Sleevi
2016/06/16 21:49:29
I block the addition of friends because I'm a terr
dadrian
2016/06/17 17:26:55
This is a derived class of this files tester. The
| |
390 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly); | 407 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly); |
391 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPMaxAge0); | 408 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPMaxAge0); |
392 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, NoClobberPins); | 409 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, NoClobberPins); |
393 FRIEND_TEST_ALL_PREFIXES(URLRequestTestHTTP, ExpectCTHeader); | 410 FRIEND_TEST_ALL_PREFIXES(URLRequestTestHTTP, ExpectCTHeader); |
394 | 411 |
395 typedef std::map<std::string, STSState> STSStateMap; | 412 typedef std::map<std::string, STSState> STSStateMap; |
396 typedef std::map<std::string, PKPState> PKPStateMap; | 413 typedef std::map<std::string, PKPState> PKPStateMap; |
397 | 414 |
398 // Send an UMA report on pin validation failure, if the host is in a | 415 // Send an UMA report on pin validation failure, if the host is in a |
399 // statically-defined list of domains. | 416 // statically-defined list of domains. |
400 // | 417 // |
401 // TODO(palmer): This doesn't really belong here, and should be moved into | 418 // TODO(palmer): This doesn't really belong here, and should be moved into |
402 // the exactly one call site. This requires unifying |struct HSTSPreload| | 419 // the exactly one call site. This requires unifying |struct HSTSPreload| |
403 // (an implementation detail of this class) with a more generic | 420 // (an implementation detail of this class) with a more generic |
404 // representation of first-class DomainStates, and exposing the preloads | 421 // representation of first-class DomainStates, and exposing the preloads |
405 // to the caller with |GetStaticDomainState|. | 422 // to the caller with |GetStaticDomainState|. |
406 static void ReportUMAOnPinFailure(const std::string& host); | 423 static void ReportUMAOnPinFailure(const std::string& host); |
407 | 424 |
408 // IsBuildTimely returns true if the current build is new enough ensure that | 425 // IsBuildTimely returns true if the current build is new enough ensure that |
409 // built in security information (i.e. HSTS preloading and pinning | 426 // built in security information (i.e. HSTS preloading and pinning |
410 // information) is timely. | 427 // information) is timely. |
411 static bool IsBuildTimely(); | 428 static bool IsBuildTimely(); |
412 | 429 |
430 // Helper method for serializing an ExpectStaple report. | |
431 static bool SerializeExpectStapleReport( | |
Ryan Sleevi
2016/06/17 16:19:56
DESIGN: Static privates are a design anti-pattern,
dadrian
2016/06/17 17:26:55
It's currently structured like this to be able to
| |
432 const HostPortPair& host_port_pair, | |
433 const X509Certificate& unverified_certificate, | |
434 bool is_issued_by_known_root, | |
435 const ExpectStapleReport& report, | |
436 std::string* serialized_report); | |
437 | |
413 // Helper method for actually checking pins. | 438 // Helper method for actually checking pins. |
414 bool CheckPublicKeyPinsImpl( | 439 bool CheckPublicKeyPinsImpl( |
415 const HostPortPair& host_port_pair, | 440 const HostPortPair& host_port_pair, |
416 bool is_issued_by_known_root, | 441 bool is_issued_by_known_root, |
417 const HashValueVector& hashes, | 442 const HashValueVector& hashes, |
418 const X509Certificate* served_certificate_chain, | 443 const X509Certificate* served_certificate_chain, |
419 const X509Certificate* validated_certificate_chain, | 444 const X509Certificate* validated_certificate_chain, |
420 const PublicKeyPinReportStatus report_status, | 445 const PublicKeyPinReportStatus report_status, |
421 std::string* failure_log); | 446 std::string* failure_log); |
422 | 447 |
(...skipping 79 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
502 // rate-limiting. | 527 // rate-limiting. |
503 ExpiringCache<std::string, bool, base::TimeTicks, std::less<base::TimeTicks>> | 528 ExpiringCache<std::string, bool, base::TimeTicks, std::less<base::TimeTicks>> |
504 sent_reports_cache_; | 529 sent_reports_cache_; |
505 | 530 |
506 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); | 531 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); |
507 }; | 532 }; |
508 | 533 |
509 } // namespace net | 534 } // namespace net |
510 | 535 |
511 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 536 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
OLD | NEW |