| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "components/certificate_reporting/error_reporter.h" | 5 #include "components/certificate_reporting/error_reporter.h" |
| 6 | 6 |
| 7 #include <stddef.h> | 7 #include <stddef.h> |
| 8 | 8 |
| 9 #include <set> | 9 #include <set> |
| 10 #include <utility> | 10 #include <utility> |
| 11 | 11 |
| 12 #include "base/logging.h" | 12 #include "base/logging.h" |
| 13 #include "base/memory/ptr_util.h" | 13 #include "base/memory/ptr_util.h" |
| 14 #include "base/metrics/histogram_macros.h" | |
| 15 #include "base/metrics/sparse_histogram.h" | |
| 16 #include "components/certificate_reporting/encrypted_cert_logger.pb.h" | 14 #include "components/certificate_reporting/encrypted_cert_logger.pb.h" |
| 17 #include "crypto/aead.h" | 15 #include "crypto/aead.h" |
| 18 #include "crypto/curve25519.h" | 16 #include "crypto/curve25519.h" |
| 19 #include "crypto/hkdf.h" | 17 #include "crypto/hkdf.h" |
| 20 #include "crypto/random.h" | 18 #include "crypto/random.h" |
| 21 #include "net/url_request/report_sender.h" | 19 #include "net/url_request/report_sender.h" |
| 22 | 20 |
| 23 namespace certificate_reporting { | 21 namespace certificate_reporting { |
| 24 | 22 |
| 25 namespace { | 23 namespace { |
| (...skipping 67 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 93 | 91 |
| 94 encrypted_report->set_encrypted_report(ciphertext); | 92 encrypted_report->set_encrypted_report(ciphertext); |
| 95 encrypted_report->set_server_public_key_version(server_public_key_version); | 93 encrypted_report->set_server_public_key_version(server_public_key_version); |
| 96 encrypted_report->set_client_public_key(reinterpret_cast<char*>(public_key), | 94 encrypted_report->set_client_public_key(reinterpret_cast<char*>(public_key), |
| 97 sizeof(public_key)); | 95 sizeof(public_key)); |
| 98 encrypted_report->set_algorithm( | 96 encrypted_report->set_algorithm( |
| 99 EncryptedCertLoggerRequest::AEAD_ECDH_AES_128_CTR_HMAC_SHA256); | 97 EncryptedCertLoggerRequest::AEAD_ECDH_AES_128_CTR_HMAC_SHA256); |
| 100 return true; | 98 return true; |
| 101 } | 99 } |
| 102 | 100 |
| 103 // Records an UMA histogram of the net errors when certificate reports | |
| 104 // fail to send. | |
| 105 void RecordUMAOnFailure(const GURL& report_uri, int net_error) { | |
| 106 UMA_HISTOGRAM_SPARSE_SLOWLY("SSL.CertificateErrorReportFailure", -net_error); | |
| 107 } | |
| 108 | |
| 109 } // namespace | 101 } // namespace |
| 110 | 102 |
| 111 ErrorReporter::ErrorReporter( | 103 ErrorReporter::ErrorReporter( |
| 112 net::URLRequestContext* request_context, | 104 net::URLRequestContext* request_context, |
| 113 const GURL& upload_url, | 105 const GURL& upload_url, |
| 114 net::ReportSender::CookiesPreference cookies_preference) | 106 net::ReportSender::CookiesPreference cookies_preference) |
| 115 : ErrorReporter(upload_url, | 107 : ErrorReporter(upload_url, |
| 116 kServerPublicKey, | 108 kServerPublicKey, |
| 117 kServerPublicKeyVersion, | 109 kServerPublicKeyVersion, |
| 118 base::MakeUnique<net::ReportSender>(request_context, | 110 base::MakeUnique<net::ReportSender>(request_context, |
| 119 cookies_preference)) {} | 111 cookies_preference)) {} |
| 120 | 112 |
| 121 ErrorReporter::ErrorReporter( | 113 ErrorReporter::ErrorReporter( |
| 122 const GURL& upload_url, | 114 const GURL& upload_url, |
| 123 const uint8_t server_public_key[/* 32 */], | 115 const uint8_t server_public_key[/* 32 */], |
| 124 const uint32_t server_public_key_version, | 116 const uint32_t server_public_key_version, |
| 125 std::unique_ptr<net::ReportSender> certificate_report_sender) | 117 std::unique_ptr<net::ReportSender> certificate_report_sender) |
| 126 : certificate_report_sender_(std::move(certificate_report_sender)), | 118 : certificate_report_sender_(std::move(certificate_report_sender)), |
| 127 upload_url_(upload_url), | 119 upload_url_(upload_url), |
| 128 server_public_key_(server_public_key), | 120 server_public_key_(server_public_key), |
| 129 server_public_key_version_(server_public_key_version) { | 121 server_public_key_version_(server_public_key_version) { |
| 130 DCHECK(certificate_report_sender_); | 122 DCHECK(certificate_report_sender_); |
| 131 DCHECK(!upload_url.is_empty()); | 123 DCHECK(!upload_url.is_empty()); |
| 132 } | 124 } |
| 133 | 125 |
| 134 ErrorReporter::~ErrorReporter() {} | 126 ErrorReporter::~ErrorReporter() {} |
| 135 | 127 |
| 136 void ErrorReporter::SendExtendedReportingReport( | 128 void ErrorReporter::SendExtendedReportingReport( |
| 137 const std::string& serialized_report) { | 129 const std::string& serialized_report, |
| 130 const base::Callback<void()>& success_callback, |
| 131 const base::Callback<void(const GURL&, int)>& error_callback) { |
| 138 if (upload_url_.SchemeIsCryptographic()) { | 132 if (upload_url_.SchemeIsCryptographic()) { |
| 139 certificate_report_sender_->Send(upload_url_, "application/octet-stream", | 133 certificate_report_sender_->Send(upload_url_, "application/octet-stream", |
| 140 serialized_report, base::Closure(), | 134 serialized_report, success_callback, |
| 141 base::Bind(&RecordUMAOnFailure)); | 135 error_callback); |
| 142 } else { | 136 return; |
| 143 EncryptedCertLoggerRequest encrypted_report; | |
| 144 if (!EncryptSerializedReport(server_public_key_, server_public_key_version_, | |
| 145 serialized_report, &encrypted_report)) { | |
| 146 LOG(ERROR) << "Failed to encrypt serialized report."; | |
| 147 return; | |
| 148 } | |
| 149 std::string serialized_encrypted_report; | |
| 150 encrypted_report.SerializeToString(&serialized_encrypted_report); | |
| 151 certificate_report_sender_->Send( | |
| 152 upload_url_, "application/octet-stream", serialized_encrypted_report, | |
| 153 base::Closure(), base::Bind(&RecordUMAOnFailure)); | |
| 154 } | 137 } |
| 138 EncryptedCertLoggerRequest encrypted_report; |
| 139 if (!EncryptSerializedReport(server_public_key_, server_public_key_version_, |
| 140 serialized_report, &encrypted_report)) { |
| 141 LOG(ERROR) << "Failed to encrypt serialized report."; |
| 142 return; |
| 143 } |
| 144 std::string serialized_encrypted_report; |
| 145 encrypted_report.SerializeToString(&serialized_encrypted_report); |
| 146 certificate_report_sender_->Send(upload_url_, "application/octet-stream", |
| 147 serialized_encrypted_report, |
| 148 success_callback, error_callback); |
| 155 } | 149 } |
| 156 | 150 |
| 157 // Used only by tests. | 151 // Used only by tests. |
| 158 bool ErrorReporter::DecryptErrorReport( | 152 bool ErrorReporter::DecryptErrorReport( |
| 159 const uint8_t server_private_key[32], | 153 const uint8_t server_private_key[32], |
| 160 const EncryptedCertLoggerRequest& encrypted_report, | 154 const EncryptedCertLoggerRequest& encrypted_report, |
| 161 std::string* decrypted_serialized_report) { | 155 std::string* decrypted_serialized_report) { |
| 162 crypto::Aead aead(crypto::Aead::AES_128_CTR_HMAC_SHA256); | 156 crypto::Aead aead(crypto::Aead::AES_128_CTR_HMAC_SHA256); |
| 163 std::string key; | 157 std::string key; |
| 164 if (!GetHkdfSubkeySecret(aead.KeyLength(), server_private_key, | 158 if (!GetHkdfSubkeySecret(aead.KeyLength(), server_private_key, |
| 165 reinterpret_cast<const uint8_t*>( | 159 reinterpret_cast<const uint8_t*>( |
| 166 encrypted_report.client_public_key().data()), | 160 encrypted_report.client_public_key().data()), |
| 167 &key)) { | 161 &key)) { |
| 168 LOG(ERROR) << "Error getting subkey secret."; | 162 LOG(ERROR) << "Error getting subkey secret."; |
| 169 return false; | 163 return false; |
| 170 } | 164 } |
| 171 aead.Init(&key); | 165 aead.Init(&key); |
| 172 | 166 |
| 173 // Use an all-zero nonce because the key is random per-message. | 167 // Use an all-zero nonce because the key is random per-message. |
| 174 std::string nonce(aead.NonceLength(), 0); | 168 std::string nonce(aead.NonceLength(), 0); |
| 175 | 169 |
| 176 return aead.Open(encrypted_report.encrypted_report(), nonce, std::string(), | 170 return aead.Open(encrypted_report.encrypted_report(), nonce, std::string(), |
| 177 decrypted_serialized_report); | 171 decrypted_serialized_report); |
| 178 } | 172 } |
| 179 | 173 |
| 180 } // namespace certificate_reporting | 174 } // namespace certificate_reporting |
| OLD | NEW |