Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.

BUG=685826
Review-Url: https://codereview.chromium.org/2613833002
Cr-Commit-Position: refs/heads/master@{#446501}
Committed: https://chromium.googlesource.com/chromium/src/+/a4912183cbef2f2e76654467db74cf7d79b5052e

[svaldez, 2017-01-26 20:54:47]

svaldez@chromium.org changed reviewers:
+ svaldez@chromium.org

[svaldez, 2017-01-26 20:54:48]

https://codereview.chromium.org/2613833002/diff/20001/net/cert/cert_verify_pr...
File net/cert/cert_verify_proc_whitelist.cc (right):

https://codereview.chromium.org/2613833002/diff/20001/net/cert/cert_verify_pr...
net/cert/cert_verify_proc_whitelist.cc:9: #include "base/logging.h"
Extra include?

https://codereview.chromium.org/2613833002/diff/20001/net/cert/cert_verify_pr...
File net/cert/cert_verify_proc_whitelist_unittest.cc (right):

https://codereview.chromium.org/2613833002/diff/20001/net/cert/cert_verify_pr...
net/cert/cert_verify_proc_whitelist_unittest.cc:17: namespace test1 {
Slightly ugly of a namespace for test data, though probably fine.

https://codereview.chromium.org/2613833002/diff/20001/net/cert/cert_verify_pr...
net/cert/cert_verify_proc_whitelist_unittest.cc:24: const char
kWhitelistedDomain[] = "005.tv";
Add a sanity check for a nonwhitelisted domain from the wosign set.

https://codereview.chromium.org/2613833002/diff/20001/net/cert/cert_verify_pr...
net/cert/cert_verify_proc_whitelist_unittest.cc:66: 
Add tests for pre/postfix of whitelisted domains. (bar.jp, example.bar.jp.junk,
foo.example.bar.jp.junk).

https://codereview.chromium.org/2613833002/diff/20001/net/data/ssl/wosign/BUI...
File net/data/ssl/wosign/BUILD.gn (right):

https://codereview.chromium.org/2613833002/diff/20001/net/data/ssl/wosign/BUI...
net/data/ssl/wosign/BUILD.gn:1: # Copyright (c) 2016 The Chromium Authors. All
rights reserved.
*2017

https://codereview.chromium.org/2613833002/diff/20001/net/data/ssl/wosign/wos...
File net/data/ssl/wosign/wosign_domains.gperf (right):

https://codereview.chromium.org/2613833002/diff/20001/net/data/ssl/wosign/wos...
net/data/ssl/wosign/wosign_domains.gperf:2: // Copyright 2016 The Chromium
Authors. All rights reserved.
2017?

https://codereview.chromium.org/2613833002/diff/20001/net/data/ssl/wosign/wos...
net/data/ssl/wosign/wosign_domains.gperf:14: int type;  // flags: 1: exception,
2: wildcard, 4: private
From the test case it looks like we allow subdomains by default? Might want to
note that here.

[svaldez, 2017-01-26 22:33:05]

lgtm

[Ryan Sleevi, 2017-01-26 22:36:12]

The CQ bit was checked by rsleevi@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-26 22:36:50]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[mattm, 2017-01-26 22:48:32]

mattm@chromium.org changed reviewers:
+ mattm@chromium.org

[mattm, 2017-01-26 22:48:32]

Update or remove the BUG and TEST todos in the description?

otherwise, LGTM stamping.

[Ryan Sleevi, 2017-01-26 22:59:48]

Description was changed from

==========
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.

BUG=TODO
TEST=TODO
==========

to

==========
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.

BUG=TODO
==========

[Ryan Sleevi, 2017-01-26 23:01:59]

Description was changed from

==========
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.

BUG=TODO
==========

to

==========
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.

BUG=685826
==========

[commit-bot: I haz the power, 2017-01-26 23:47:52]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-26 23:47:53]

Dry run: This issue passed the CQ dry run.

[Ryan Sleevi, 2017-01-26 23:50:38]

The CQ bit was checked by rsleevi@chromium.org

[commit-bot: I haz the power, 2017-01-26 23:51:40]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-27 00:38:29]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1485474638116800,
"parent_rev": "c3de81a0ca86c816b61189978d1c875875baafd5", "commit_rev":
"a4912183cbef2f2e76654467db74cf7d79b5052e"}

[commit-bot: I haz the power, 2017-01-27 00:39:04]

Description was changed from

==========
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.

BUG=685826
==========

to

==========
Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

Restrict the set of domains for which WoSign/StartCom certificates
are trusted to the set of domains intersecting the Alexa Top 1M
whose certificates are unexpired and unrevoked.

BUG=685826

Review-Url: https://codereview.chromium.org/2613833002
Cr-Commit-Position: refs/heads/master@{#446501}
Committed:
https://chromium.googlesource.com/chromium/src/+/a4912183cbef2f2e76654467db74...
==========

[commit-bot: I haz the power, 2017-01-27 00:39:07]

Committed patchset #3 (id:40001) as
https://chromium.googlesource.com/chromium/src/+/a4912183cbef2f2e76654467db74...