OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
7 | 7 |
8 #include <stdint.h> | 8 #include <stdint.h> |
9 | 9 |
10 #include <map> | 10 #include <map> |
11 #include <string> | 11 #include <string> |
12 #include <utility> | 12 #include <utility> |
13 #include <vector> | 13 #include <vector> |
14 | 14 |
15 #include "base/callback.h" | 15 #include "base/callback.h" |
16 #include "base/gtest_prod_util.h" | 16 #include "base/gtest_prod_util.h" |
17 #include "base/macros.h" | 17 #include "base/macros.h" |
18 #include "base/threading/non_thread_safe.h" | 18 #include "base/threading/non_thread_safe.h" |
19 #include "base/time/time.h" | 19 #include "base/time/time.h" |
20 #include "net/base/expiring_cache.h" | 20 #include "net/base/expiring_cache.h" |
21 #include "net/base/net_export.h" | 21 #include "net/base/net_export.h" |
| 22 #include "net/cert/expect_staple_report.h" |
22 #include "net/cert/x509_cert_types.h" | 23 #include "net/cert/x509_cert_types.h" |
23 #include "net/cert/x509_certificate.h" | 24 #include "net/cert/x509_certificate.h" |
24 #include "url/gurl.h" | 25 #include "url/gurl.h" |
25 | 26 |
26 class GURL; | 27 class GURL; |
27 | 28 |
28 namespace net { | 29 namespace net { |
29 | 30 |
30 class HostPortPair; | 31 class HostPortPair; |
31 class SSLInfo; | 32 class SSLInfo; |
(...skipping 346 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
378 // 1. The header value is "preload", indicating that the site wants to | 379 // 1. The header value is "preload", indicating that the site wants to |
379 // be opted in to Expect CT. | 380 // be opted in to Expect CT. |
380 // 2. The given host is present on the Expect CT preload list with a | 381 // 2. The given host is present on the Expect CT preload list with a |
381 // valid report-uri, and the build is timely (i.e. preload list is fresh). | 382 // valid report-uri, and the build is timely (i.e. preload list is fresh). |
382 // 3. |ssl_info| indicates that the connection violated the Expect CT policy. | 383 // 3. |ssl_info| indicates that the connection violated the Expect CT policy. |
383 // 4. An Expect CT reporter has been provided with SetExpectCTReporter(). | 384 // 4. An Expect CT reporter has been provided with SetExpectCTReporter(). |
384 void ProcessExpectCTHeader(const std::string& value, | 385 void ProcessExpectCTHeader(const std::string& value, |
385 const HostPortPair& host_port_pair, | 386 const HostPortPair& host_port_pair, |
386 const SSLInfo& ssl_info); | 387 const SSLInfo& ssl_info); |
387 | 388 |
| 389 void CheckExpectStaple(const HostPortPair& host_port_pair, |
| 390 const X509Certificate& verified_certificate, |
| 391 const X509Certificate& unverified_certificate, |
| 392 const base::Time& verify_time, |
| 393 const base::TimeDelta& max_age, |
| 394 const std::string& ocsp_response); |
| 395 |
388 private: | 396 private: |
389 friend class TransportSecurityStateTest; | 397 friend class TransportSecurityStateTest; |
| 398 friend class ExpectStapleTest; |
390 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly); | 399 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly); |
391 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPMaxAge0); | 400 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPMaxAge0); |
392 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, NoClobberPins); | 401 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, NoClobberPins); |
393 FRIEND_TEST_ALL_PREFIXES(URLRequestTestHTTP, ExpectCTHeader); | 402 FRIEND_TEST_ALL_PREFIXES(URLRequestTestHTTP, ExpectCTHeader); |
394 | 403 |
395 typedef std::map<std::string, STSState> STSStateMap; | 404 typedef std::map<std::string, STSState> STSStateMap; |
396 typedef std::map<std::string, PKPState> PKPStateMap; | 405 typedef std::map<std::string, PKPState> PKPStateMap; |
397 | 406 |
398 // Send an UMA report on pin validation failure, if the host is in a | 407 // Send an UMA report on pin validation failure, if the host is in a |
399 // statically-defined list of domains. | 408 // statically-defined list of domains. |
400 // | 409 // |
401 // TODO(palmer): This doesn't really belong here, and should be moved into | 410 // TODO(palmer): This doesn't really belong here, and should be moved into |
402 // the exactly one call site. This requires unifying |struct HSTSPreload| | 411 // the exactly one call site. This requires unifying |struct HSTSPreload| |
403 // (an implementation detail of this class) with a more generic | 412 // (an implementation detail of this class) with a more generic |
404 // representation of first-class DomainStates, and exposing the preloads | 413 // representation of first-class DomainStates, and exposing the preloads |
405 // to the caller with |GetStaticDomainState|. | 414 // to the caller with |GetStaticDomainState|. |
406 static void ReportUMAOnPinFailure(const std::string& host); | 415 static void ReportUMAOnPinFailure(const std::string& host); |
407 | 416 |
408 // IsBuildTimely returns true if the current build is new enough ensure that | 417 // IsBuildTimely returns true if the current build is new enough ensure that |
409 // built in security information (i.e. HSTS preloading and pinning | 418 // built in security information (i.e. HSTS preloading and pinning |
410 // information) is timely. | 419 // information) is timely. |
411 static bool IsBuildTimely(); | 420 static bool IsBuildTimely(); |
412 | 421 |
| 422 // Helper method for serializing an ExpectStaple report. |
| 423 static bool SerializeExpectStapleReport( |
| 424 const HostPortPair& host_port_pair, |
| 425 const X509Certificate& unverified_certificate, |
| 426 const ExpectStapleReport& report, |
| 427 std::string* serialized_report); |
| 428 |
413 // Helper method for actually checking pins. | 429 // Helper method for actually checking pins. |
414 bool CheckPublicKeyPinsImpl( | 430 bool CheckPublicKeyPinsImpl( |
415 const HostPortPair& host_port_pair, | 431 const HostPortPair& host_port_pair, |
416 bool is_issued_by_known_root, | 432 bool is_issued_by_known_root, |
417 const HashValueVector& hashes, | 433 const HashValueVector& hashes, |
418 const X509Certificate* served_certificate_chain, | 434 const X509Certificate* served_certificate_chain, |
419 const X509Certificate* validated_certificate_chain, | 435 const X509Certificate* validated_certificate_chain, |
420 const PublicKeyPinReportStatus report_status, | 436 const PublicKeyPinReportStatus report_status, |
421 std::string* failure_log); | 437 std::string* failure_log); |
422 | 438 |
(...skipping 79 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
502 // rate-limiting. | 518 // rate-limiting. |
503 ExpiringCache<std::string, bool, base::TimeTicks, std::less<base::TimeTicks>> | 519 ExpiringCache<std::string, bool, base::TimeTicks, std::less<base::TimeTicks>> |
504 sent_reports_cache_; | 520 sent_reports_cache_; |
505 | 521 |
506 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); | 522 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); |
507 }; | 523 }; |
508 | 524 |
509 } // namespace net | 525 } // namespace net |
510 | 526 |
511 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 527 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
OLD | NEW |