OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/ct_policy_enforcer.h" | 5 #include "net/cert/ct_policy_enforcer.h" |
6 | 6 |
7 #include <stdint.h> | 7 #include <stdint.h> |
8 | 8 |
9 #include <algorithm> | 9 #include <algorithm> |
10 #include <memory> | 10 #include <memory> |
11 #include <utility> | 11 #include <utility> |
12 | 12 |
13 #include "base/bind.h" | 13 #include "base/bind.h" |
14 #include "base/build_time.h" | 14 #include "base/build_time.h" |
15 #include "base/callback_helpers.h" | 15 #include "base/callback_helpers.h" |
16 #include "base/metrics/field_trial.h" | 16 #include "base/metrics/field_trial.h" |
17 #include "base/metrics/histogram_macros.h" | 17 #include "base/metrics/histogram_macros.h" |
18 #include "base/numerics/safe_conversions.h" | 18 #include "base/numerics/safe_conversions.h" |
19 #include "base/strings/string_number_conversions.h" | 19 #include "base/strings/string_number_conversions.h" |
20 #include "base/time/time.h" | 20 #include "base/time/time.h" |
21 #include "base/values.h" | 21 #include "base/values.h" |
22 #include "base/version.h" | 22 #include "base/version.h" |
23 #include "net/cert/ct_ev_whitelist.h" | 23 #include "net/cert/ct_ev_whitelist.h" |
24 #include "net/cert/ct_known_logs.h" | 24 #include "net/cert/ct_known_logs.h" |
25 #include "net/cert/ct_policy_status.h" | 25 #include "net/cert/ct_policy_status.h" |
26 #include "net/cert/ct_verify_result.h" | 26 #include "net/cert/ct_verify_result.h" |
27 #include "net/cert/signed_certificate_timestamp.h" | 27 #include "net/cert/signed_certificate_timestamp.h" |
28 #include "net/cert/x509_certificate.h" | 28 #include "net/cert/x509_certificate.h" |
29 #include "net/cert/x509_certificate_net_log_param.h" | 29 #include "net/cert/x509_certificate_net_log_param.h" |
30 #include "net/log/net_log.h" | 30 #include "net/log/net_log_capture_mode.h" |
31 #include "net/log/net_log_event_type.h" | 31 #include "net/log/net_log_event_type.h" |
| 32 #include "net/log/net_log_parameters_callback.h" |
| 33 #include "net/log/net_log_with_source.h" |
32 | 34 |
33 namespace net { | 35 namespace net { |
34 | 36 |
35 namespace { | 37 namespace { |
36 | 38 |
37 // Returns true if the current build is recent enough to ensure that | 39 // Returns true if the current build is recent enough to ensure that |
38 // built-in security information (e.g. CT Logs) is fresh enough. | 40 // built-in security information (e.g. CT Logs) is fresh enough. |
39 // TODO(eranm): Move to base or net/base | 41 // TODO(eranm): Move to base or net/base |
40 bool IsBuildTimely() { | 42 bool IsBuildTimely() { |
41 const base::Time build_time = base::GetBuildTime(); | 43 const base::Time build_time = base::GetBuildTime(); |
(...skipping 364 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
406 // needs up-to-date information about logs to consider certificates to | 408 // needs up-to-date information about logs to consider certificates to |
407 // be compliant with policy. | 409 // be compliant with policy. |
408 bool build_timely = IsBuildTimely(); | 410 bool build_timely = IsBuildTimely(); |
409 ct::CertPolicyCompliance compliance; | 411 ct::CertPolicyCompliance compliance; |
410 if (!build_timely) { | 412 if (!build_timely) { |
411 compliance = ct::CertPolicyCompliance::CERT_POLICY_BUILD_NOT_TIMELY; | 413 compliance = ct::CertPolicyCompliance::CERT_POLICY_BUILD_NOT_TIMELY; |
412 } else { | 414 } else { |
413 compliance = CheckCertPolicyCompliance(*cert, verified_scts); | 415 compliance = CheckCertPolicyCompliance(*cert, verified_scts); |
414 } | 416 } |
415 | 417 |
416 NetLog::ParametersCallback net_log_callback = | 418 NetLogParametersCallback net_log_callback = |
417 base::Bind(&NetLogCertComplianceCheckResultCallback, | 419 base::Bind(&NetLogCertComplianceCheckResultCallback, |
418 base::Unretained(cert), build_timely, compliance); | 420 base::Unretained(cert), build_timely, compliance); |
419 | 421 |
420 net_log.AddEvent(NetLogEventType::CERT_CT_COMPLIANCE_CHECKED, | 422 net_log.AddEvent(NetLogEventType::CERT_CT_COMPLIANCE_CHECKED, |
421 net_log_callback); | 423 net_log_callback); |
422 | 424 |
423 return compliance; | 425 return compliance; |
424 } | 426 } |
425 | 427 |
426 ct::EVPolicyCompliance CTPolicyEnforcer::DoesConformToCTEVPolicy( | 428 ct::EVPolicyCompliance CTPolicyEnforcer::DoesConformToCTEVPolicy( |
427 X509Certificate* cert, | 429 X509Certificate* cert, |
428 const ct::EVCertsWhitelist* ev_whitelist, | 430 const ct::EVCertsWhitelist* ev_whitelist, |
429 const ct::SCTList& verified_scts, | 431 const ct::SCTList& verified_scts, |
430 const NetLogWithSource& net_log) { | 432 const NetLogWithSource& net_log) { |
431 EVComplianceDetails details; | 433 EVComplianceDetails details; |
432 // If the build is not timely, no certificate is considered compliant | 434 // If the build is not timely, no certificate is considered compliant |
433 // with EV policy. The reasoning is that, for example, a log might | 435 // with EV policy. The reasoning is that, for example, a log might |
434 // have been pulled and is no longer considered valid; thus, a client | 436 // have been pulled and is no longer considered valid; thus, a client |
435 // needs up-to-date information about logs to consider certificates to | 437 // needs up-to-date information about logs to consider certificates to |
436 // be compliant with policy. | 438 // be compliant with policy. |
437 details.build_timely = IsBuildTimely(); | 439 details.build_timely = IsBuildTimely(); |
438 if (!details.build_timely) { | 440 if (!details.build_timely) { |
439 details.status = ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY; | 441 details.status = ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY; |
440 } else { | 442 } else { |
441 CheckCTEVPolicyCompliance(cert, ev_whitelist, verified_scts, net_log, | 443 CheckCTEVPolicyCompliance(cert, ev_whitelist, verified_scts, net_log, |
442 &details); | 444 &details); |
443 } | 445 } |
444 | 446 |
445 NetLog::ParametersCallback net_log_callback = | 447 NetLogParametersCallback net_log_callback = |
446 base::Bind(&NetLogEVComplianceCheckResultCallback, base::Unretained(cert), | 448 base::Bind(&NetLogEVComplianceCheckResultCallback, base::Unretained(cert), |
447 base::Unretained(&details)); | 449 base::Unretained(&details)); |
448 | 450 |
449 net_log.AddEvent(NetLogEventType::EV_CERT_CT_COMPLIANCE_CHECKED, | 451 net_log.AddEvent(NetLogEventType::EV_CERT_CT_COMPLIANCE_CHECKED, |
450 net_log_callback); | 452 net_log_callback); |
451 | 453 |
452 if (!details.build_timely) | 454 if (!details.build_timely) |
453 return ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY; | 455 return ct::EVPolicyCompliance::EV_POLICY_BUILD_NOT_TIMELY; |
454 | 456 |
455 LogEVPolicyComplianceToUMA(details.status, ev_whitelist); | 457 LogEVPolicyComplianceToUMA(details.status, ev_whitelist); |
456 | 458 |
457 return details.status; | 459 return details.status; |
458 } | 460 } |
459 | 461 |
460 } // namespace net | 462 } // namespace net |
OLD | NEW |