OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
6 | 6 |
7 #include <stdint.h> | 7 #include <stdint.h> |
8 | 8 |
9 #include <algorithm> | 9 #include <algorithm> |
10 #include <memory> | 10 #include <memory> |
(...skipping 10 matching lines...) Expand all Loading... |
21 #include "base/values.h" | 21 #include "base/values.h" |
22 #include "base/version.h" | 22 #include "base/version.h" |
23 #include "net/cert/ct_ev_whitelist.h" | 23 #include "net/cert/ct_ev_whitelist.h" |
24 #include "net/cert/ct_known_logs.h" | 24 #include "net/cert/ct_known_logs.h" |
25 #include "net/cert/ct_policy_status.h" | 25 #include "net/cert/ct_policy_status.h" |
26 #include "net/cert/ct_verify_result.h" | 26 #include "net/cert/ct_verify_result.h" |
27 #include "net/cert/signed_certificate_timestamp.h" | 27 #include "net/cert/signed_certificate_timestamp.h" |
28 #include "net/cert/x509_certificate.h" | 28 #include "net/cert/x509_certificate.h" |
29 #include "net/cert/x509_certificate_net_log_param.h" | 29 #include "net/cert/x509_certificate_net_log_param.h" |
30 #include "net/log/net_log.h" | 30 #include "net/log/net_log.h" |
| 31 #include "net/log/net_log_event_type.h" |
31 | 32 |
32 namespace net { | 33 namespace net { |
33 | 34 |
34 namespace { | 35 namespace { |
35 | 36 |
36 // Returns true if the current build is recent enough to ensure that | 37 // Returns true if the current build is recent enough to ensure that |
37 // built-in security information (e.g. CT Logs) is fresh enough. | 38 // built-in security information (e.g. CT Logs) is fresh enough. |
38 // TODO(eranm): Move to base or net/base | 39 // TODO(eranm): Move to base or net/base |
39 bool IsBuildTimely() { | 40 bool IsBuildTimely() { |
40 const base::Time build_time = base::GetBuildTime(); | 41 const base::Time build_time = base::GetBuildTime(); |
(...skipping 368 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
409 if (!build_timely) { | 410 if (!build_timely) { |
410 compliance = ct::CertPolicyCompliance::CERT_POLICY_BUILD_NOT_TIMELY; | 411 compliance = ct::CertPolicyCompliance::CERT_POLICY_BUILD_NOT_TIMELY; |
411 } else { | 412 } else { |
412 compliance = CheckCertPolicyCompliance(*cert, verified_scts); | 413 compliance = CheckCertPolicyCompliance(*cert, verified_scts); |
413 } | 414 } |
414 | 415 |
415 NetLog::ParametersCallback net_log_callback = | 416 NetLog::ParametersCallback net_log_callback = |
416 base::Bind(&NetLogCertComplianceCheckResultCallback, | 417 base::Bind(&NetLogCertComplianceCheckResultCallback, |
417 base::Unretained(cert), build_timely, compliance); | 418 base::Unretained(cert), build_timely, compliance); |
418 | 419 |
419 net_log.AddEvent(NetLog::TYPE_CERT_CT_COMPLIANCE_CHECKED, net_log_callback); | 420 net_log.AddEvent(NetLogEventType::CERT_CT_COMPLIANCE_CHECKED, |
| 421 net_log_callback); |
420 | 422 |
421 return compliance; | 423 return compliance; |
422 } | 424 } |
423 | 425 |
424 ct::EVPolicyCompliance CTPolicyEnforcer::DoesConformToCTEVPolicy( | 426 ct::EVPolicyCompliance CTPolicyEnforcer::DoesConformToCTEVPolicy( |
425 X509Certificate* cert, | 427 X509Certificate* cert, |
426 const ct::EVCertsWhitelist* ev_whitelist, | 428 const ct::EVCertsWhitelist* ev_whitelist, |
427 const ct::SCTList& verified_scts, | 429 const ct::SCTList& verified_scts, |
428 const BoundNetLog& net_log) { | 430 const BoundNetLog& net_log) { |
429 EVComplianceDetails details; | 431 EVComplianceDetails details; |
430 // If the build is not timely, no certificate is considered compliant | 432 // If the build is not timely, no certificate is considered compliant |
431 // with EV policy. The reasoning is that, for example, a log might | 433 // with EV policy. The reasoning is that, for example, a log might |
432 // have been pulled and is no longer considered valid; thus, a client | 434 // have been pulled and is no longer considered valid; thus, a client |
433 // needs up-to-date information about logs to consider certificates to | 435 // needs up-to-date information about logs to consider certificates to |
434 // be compliant with policy. | 436 // be compliant with policy. |
435 details.build_timely = IsBuildTimely(); | 437 details.build_timely = IsBuildTimely(); |
436 if (!details.build_timely) { | 438 if (!details.build_timely) { |
437 details.status = ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY; | 439 details.status = ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY; |
438 } else { | 440 } else { |
439 CheckCTEVPolicyCompliance(cert, ev_whitelist, verified_scts, net_log, | 441 CheckCTEVPolicyCompliance(cert, ev_whitelist, verified_scts, net_log, |
440 &details); | 442 &details); |
441 } | 443 } |
442 | 444 |
443 NetLog::ParametersCallback net_log_callback = | 445 NetLog::ParametersCallback net_log_callback = |
444 base::Bind(&NetLogEVComplianceCheckResultCallback, base::Unretained(cert), | 446 base::Bind(&NetLogEVComplianceCheckResultCallback, base::Unretained(cert), |
445 base::Unretained(&details)); | 447 base::Unretained(&details)); |
446 | 448 |
447 net_log.AddEvent(NetLog::TYPE_EV_CERT_CT_COMPLIANCE_CHECKED, | 449 net_log.AddEvent(NetLogEventType::EV_CERT_CT_COMPLIANCE_CHECKED, |
448 net_log_callback); | 450 net_log_callback); |
449 | 451 |
450 if (!details.build_timely) | 452 if (!details.build_timely) |
451 return ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY; | 453 return ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY; |
452 | 454 |
453 LogEVPolicyComplianceToUMA(details.status, ev_whitelist); | 455 LogEVPolicyComplianceToUMA(details.status, ev_whitelist); |
454 | 456 |
455 return details.status; | 457 return details.status; |
456 } | 458 } |
457 | 459 |
458 } // namespace net | 460 } // namespace net |
OLD | NEW |