OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <utility> | 10 #include <utility> |
(...skipping 206 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
217 bool sni_enabled, | 217 bool sni_enabled, |
218 DomainState* result); | 218 DomainState* result); |
219 | 219 |
220 // Processes an HSTS header value from the host, adding entries to | 220 // Processes an HSTS header value from the host, adding entries to |
221 // dynamic state if necessary. | 221 // dynamic state if necessary. |
222 bool AddHSTSHeader(const std::string& host, const std::string& value); | 222 bool AddHSTSHeader(const std::string& host, const std::string& value); |
223 | 223 |
224 // Processes an HPKP header value from the host, adding entries to | 224 // Processes an HPKP header value from the host, adding entries to |
225 // dynamic state if necessary. ssl_info is used to check that | 225 // dynamic state if necessary. ssl_info is used to check that |
226 // the specified pins overlap with the certificate chain. | 226 // the specified pins overlap with the certificate chain. |
227 bool AddHPKPHeader(const std::string& host, const std::string& value, | 227 bool AddHPKPHeader(const std::string& host, |
| 228 const std::string& value, |
228 const SSLInfo& ssl_info); | 229 const SSLInfo& ssl_info); |
229 | 230 |
230 // Adds explicitly-specified data as if it was processed from an | 231 // Adds explicitly-specified data as if it was processed from an |
231 // HSTS header (used for net-internals and unit tests). | 232 // HSTS header (used for net-internals and unit tests). |
232 bool AddHSTS(const std::string& host, const base::Time& expiry, | 233 bool AddHSTS(const std::string& host, |
| 234 const base::Time& expiry, |
233 bool include_subdomains); | 235 bool include_subdomains); |
234 | 236 |
235 // Adds explicitly-specified data as if it was processed from an | 237 // Adds explicitly-specified data as if it was processed from an |
236 // HPKP header (used for net-internals and unit tests). | 238 // HPKP header (used for net-internals and unit tests). |
237 bool AddHPKP(const std::string& host, const base::Time& expiry, | 239 bool AddHPKP(const std::string& host, |
238 bool include_subdomains, const HashValueVector& hashes); | 240 const base::Time& expiry, |
| 241 bool include_subdomains, |
| 242 const HashValueVector& hashes); |
239 | 243 |
240 // Returns true iff we have any static public key pins for the |host| and | 244 // Returns true iff we have any static public key pins for the |host| and |
241 // iff its set of required pins is the set we expect for Google | 245 // iff its set of required pins is the set we expect for Google |
242 // properties. | 246 // properties. |
243 // | 247 // |
244 // If |sni_enabled| is true, searches the static pins defined for | 248 // If |sni_enabled| is true, searches the static pins defined for |
245 // SNI-using hosts as well as the rest of the pins. | 249 // SNI-using hosts as well as the rest of the pins. |
246 // | 250 // |
247 // If |host| matches both an exact entry and is a subdomain of another | 251 // If |host| matches both an exact entry and is a subdomain of another |
248 // entry, the exact match determines the return value. | 252 // entry, the exact match determines the return value. |
249 static bool IsGooglePinnedProperty(const std::string& host, | 253 static bool IsGooglePinnedProperty(const std::string& host, bool sni_enabled); |
250 bool sni_enabled); | |
251 | 254 |
252 // The maximum number of seconds for which we'll cache an HSTS request. | 255 // The maximum number of seconds for which we'll cache an HSTS request. |
253 static const long int kMaxHSTSAgeSecs; | 256 static const long int kMaxHSTSAgeSecs; |
254 | 257 |
255 // Send an UMA report on pin validation failure, if the host is in a | 258 // Send an UMA report on pin validation failure, if the host is in a |
256 // statically-defined list of domains. | 259 // statically-defined list of domains. |
257 // | 260 // |
258 // TODO(palmer): This doesn't really belong here, and should be moved into | 261 // TODO(palmer): This doesn't really belong here, and should be moved into |
259 // the exactly one call site. This requires unifying |struct HSTSPreload| | 262 // the exactly one call site. This requires unifying |struct HSTSPreload| |
260 // (an implementation detail of this class) with a more generic | 263 // (an implementation detail of this class) with a more generic |
261 // representation of first-class DomainStates, and exposing the preloads | 264 // representation of first-class DomainStates, and exposing the preloads |
262 // to the caller with |GetStaticDomainState|. | 265 // to the caller with |GetStaticDomainState|. |
263 static void ReportUMAOnPinFailure(const std::string& host); | 266 static void ReportUMAOnPinFailure(const std::string& host); |
264 | 267 |
265 // IsBuildTimely returns true if the current build is new enough ensure that | 268 // IsBuildTimely returns true if the current build is new enough ensure that |
266 // built in security information (i.e. HSTS preloading and pinning | 269 // built in security information (i.e. HSTS preloading and pinning |
267 // information) is timely. | 270 // information) is timely. |
268 static bool IsBuildTimely(); | 271 static bool IsBuildTimely(); |
269 | 272 |
270 private: | 273 private: |
271 friend class TransportSecurityStateTest; | 274 friend class TransportSecurityStateTest; |
272 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, | 275 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly); |
273 UpdateDynamicPKPOnly); | |
274 | 276 |
275 typedef std::map<std::string, DomainState> DomainStateMap; | 277 typedef std::map<std::string, DomainState> DomainStateMap; |
276 | 278 |
277 // If a Delegate is present, notify it that the internal state has | 279 // If a Delegate is present, notify it that the internal state has |
278 // changed. | 280 // changed. |
279 void DirtyNotify(); | 281 void DirtyNotify(); |
280 | 282 |
281 // Enable TransportSecurity for |host|. |state| supercedes any previous | 283 // Enable TransportSecurity for |host|. |state| supercedes any previous |
282 // state for the |host|, including static entries. | 284 // state for the |host|, including static entries. |
283 // | 285 // |
(...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
326 DomainStateMap enabled_hosts_; | 328 DomainStateMap enabled_hosts_; |
327 | 329 |
328 Delegate* delegate_; | 330 Delegate* delegate_; |
329 | 331 |
330 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); | 332 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); |
331 }; | 333 }; |
332 | 334 |
333 } // namespace net | 335 } // namespace net |
334 | 336 |
335 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | 337 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ |
OLD | NEW |