| Index: net/http/transport_security_state.cc
|
| diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
|
| index 609c233a3ea43d02d0f2997afcf1541cf79a6673..798e74407317c8d05c21e49c337233698a007b74 100644
|
| --- a/net/http/transport_security_state.cc
|
| +++ b/net/http/transport_security_state.cc
|
| @@ -62,8 +62,7 @@ std::string HashHost(const std::string& canonicalized_host) {
|
|
|
| // Returns true if the intersection of |a| and |b| is not empty. If either
|
| // |a| or |b| is empty, returns false.
|
| -bool HashesIntersect(const HashValueVector& a,
|
| - const HashValueVector& b) {
|
| +bool HashesIntersect(const HashValueVector& a, const HashValueVector& b) {
|
| for (HashValueVector::const_iterator i = a.begin(); i != a.end(); ++i) {
|
| HashValueVector::const_iterator j =
|
| std::find_if(b.begin(), b.end(), HashValuesEqual(*i));
|
| @@ -73,8 +72,7 @@ bool HashesIntersect(const HashValueVector& a,
|
| return false;
|
| }
|
|
|
| -bool AddHash(const char* sha1_hash,
|
| - HashValueVector* out) {
|
| +bool AddHash(const char* sha1_hash, HashValueVector* out) {
|
| HashValue hash(HASH_VALUE_SHA1);
|
| memcpy(hash.data(), sha1_hash, hash.size());
|
| out->push_back(hash);
|
| @@ -83,8 +81,7 @@ bool AddHash(const char* sha1_hash,
|
|
|
| } // namespace
|
|
|
| -TransportSecurityState::TransportSecurityState()
|
| - : delegate_(NULL) {
|
| +TransportSecurityState::TransportSecurityState() : delegate_(NULL) {
|
| DCHECK(CalledOnValidThread());
|
| }
|
|
|
| @@ -93,7 +90,8 @@ TransportSecurityState::Iterator::Iterator(const TransportSecurityState& state)
|
| end_(state.enabled_hosts_.end()) {
|
| }
|
|
|
| -TransportSecurityState::Iterator::~Iterator() {}
|
| +TransportSecurityState::Iterator::~Iterator() {
|
| +}
|
|
|
| void TransportSecurityState::SetDelegate(
|
| TransportSecurityState::Delegate* delegate) {
|
| @@ -125,8 +123,8 @@ bool TransportSecurityState::DeleteDynamicDataForHost(const std::string& host) {
|
| if (canonicalized_host.empty())
|
| return false;
|
|
|
| - DomainStateMap::iterator i = enabled_hosts_.find(
|
| - HashHost(canonicalized_host));
|
| + DomainStateMap::iterator i =
|
| + enabled_hosts_.find(HashHost(canonicalized_host));
|
| if (i != enabled_hosts_.end()) {
|
| enabled_hosts_.erase(i);
|
| DirtyNotify();
|
| @@ -145,8 +143,8 @@ bool TransportSecurityState::GetDomainState(const std::string& host,
|
| if (canonicalized_host.empty())
|
| return false;
|
|
|
| - bool has_preload = GetStaticDomainState(canonicalized_host, sni_enabled,
|
| - &state);
|
| + bool has_preload =
|
| + GetStaticDomainState(canonicalized_host, sni_enabled, &state);
|
| std::string canonicalized_preload = CanonicalizeHost(state.domain);
|
| GetDynamicDomainState(host, &state);
|
|
|
| @@ -161,8 +159,7 @@ bool TransportSecurityState::GetDomainState(const std::string& host,
|
| return true;
|
| }
|
|
|
| - DomainStateMap::iterator j =
|
| - enabled_hosts_.find(HashHost(host_sub_chunk));
|
| + DomainStateMap::iterator j = enabled_hosts_.find(HashHost(host_sub_chunk));
|
| if (j == enabled_hosts_.end())
|
| continue;
|
|
|
| @@ -265,7 +262,6 @@ std::string TransportSecurityState::CanonicalizeHost(const std::string& host) {
|
| // domains at the END of the listing (but before DOMAIN_NUM_EVENTS).
|
| enum SecondLevelDomainName {
|
| DOMAIN_NOT_PINNED,
|
| -
|
| DOMAIN_GOOGLE_COM,
|
| DOMAIN_ANDROID_COM,
|
| DOMAIN_GOOGLE_ANALYTICS_COM,
|
| @@ -283,16 +279,11 @@ enum SecondLevelDomainName {
|
| DOMAIN_GMAIL_COM,
|
| DOMAIN_GOOGLEMAIL_COM,
|
| DOMAIN_GOOGLEGROUPS_COM,
|
| -
|
| DOMAIN_TORPROJECT_ORG,
|
| -
|
| DOMAIN_TWITTER_COM,
|
| DOMAIN_TWIMG_COM,
|
| -
|
| DOMAIN_AKAMAIHD_NET,
|
| -
|
| DOMAIN_TOR2WEB_ORG,
|
| -
|
| DOMAIN_YOUTU_BE,
|
| DOMAIN_GOOGLECOMMERCE_COM,
|
| DOMAIN_URCHIN_COM,
|
| @@ -515,12 +506,9 @@ enum SecondLevelDomainName {
|
| DOMAIN_GOOGLE_VG,
|
| DOMAIN_GOOGLE_VU,
|
| DOMAIN_GOOGLE_WS,
|
| -
|
| DOMAIN_CHROMIUM_ORG,
|
| -
|
| DOMAIN_CRYPTO_CAT,
|
| DOMAIN_LAVABIT_COM,
|
| -
|
| DOMAIN_GOOGLETAGMANAGER_COM,
|
| DOMAIN_GOOGLETAGSERVICES_COM,
|
|
|
| @@ -545,12 +533,16 @@ struct HSTSPreload {
|
| SecondLevelDomainName second_level_domain_name;
|
| };
|
|
|
| -static bool HasPreload(const struct HSTSPreload* entries, size_t num_entries,
|
| - const std::string& canonicalized_host, size_t i,
|
| - TransportSecurityState::DomainState* out, bool* ret) {
|
| +static bool HasPreload(const struct HSTSPreload* entries,
|
| + size_t num_entries,
|
| + const std::string& canonicalized_host,
|
| + size_t i,
|
| + TransportSecurityState::DomainState* out,
|
| + bool* ret) {
|
| for (size_t j = 0; j < num_entries; j++) {
|
| if (entries[j].length == canonicalized_host.size() - i &&
|
| - memcmp(entries[j].dns_name, &canonicalized_host[i],
|
| + memcmp(entries[j].dns_name,
|
| + &canonicalized_host[i],
|
| entries[j].length) == 0) {
|
| if (!entries[j].include_subdomains && i != 0) {
|
| *ret = false;
|
| @@ -641,8 +633,10 @@ bool TransportSecurityState::AddHPKPHeader(const std::string& host,
|
| base::TimeDelta max_age;
|
| TransportSecurityState::DomainState domain_state;
|
| GetDynamicDomainState(host, &domain_state);
|
| - if (ParseHPKPHeader(value, ssl_info.public_key_hashes,
|
| - &max_age, &domain_state.pkp_include_subdomains,
|
| + if (ParseHPKPHeader(value,
|
| + ssl_info.public_key_hashes,
|
| + &max_age,
|
| + &domain_state.pkp_include_subdomains,
|
| &domain_state.dynamic_spki_hashes)) {
|
| // TODO(palmer): http://crbug.com/243865 handle max-age == 0.
|
| domain_state.pkp_observed = now;
|
| @@ -662,8 +656,7 @@ bool TransportSecurityState::AddHSTS(const std::string& host,
|
| TransportSecurityState::DomainState domain_state;
|
| const std::string canonicalized_host = CanonicalizeHost(host);
|
| const std::string hashed_host = HashHost(canonicalized_host);
|
| - DomainStateMap::const_iterator i = enabled_hosts_.find(
|
| - hashed_host);
|
| + DomainStateMap::const_iterator i = enabled_hosts_.find(hashed_host);
|
| if (i != enabled_hosts_.end())
|
| domain_state = i->second;
|
|
|
| @@ -685,8 +678,7 @@ bool TransportSecurityState::AddHPKP(const std::string& host,
|
| TransportSecurityState::DomainState domain_state;
|
| const std::string canonicalized_host = CanonicalizeHost(host);
|
| const std::string hashed_host = HashHost(canonicalized_host);
|
| - DomainStateMap::const_iterator i = enabled_hosts_.find(
|
| - hashed_host);
|
| + DomainStateMap::const_iterator i = enabled_hosts_.find(hashed_host);
|
| if (i != enabled_hosts_.end())
|
| domain_state = i->second;
|
|
|
| @@ -709,8 +701,8 @@ bool TransportSecurityState::IsGooglePinnedProperty(const std::string& host,
|
| return true;
|
|
|
| if (sni_enabled) {
|
| - entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS,
|
| - kNumPreloadedSNISTS);
|
| + entry = GetHSTSPreload(
|
| + canonicalized_host, kPreloadedSNISTS, kNumPreloadedSNISTS);
|
| if (entry && entry->pins.required_hashes == kGoogleAcceptableCerts)
|
| return true;
|
| }
|
| @@ -726,8 +718,8 @@ void TransportSecurityState::ReportUMAOnPinFailure(const std::string& host) {
|
| GetHSTSPreload(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS);
|
|
|
| if (!entry) {
|
| - entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS,
|
| - kNumPreloadedSNISTS);
|
| + entry = GetHSTSPreload(
|
| + canonicalized_host, kPreloadedSNISTS, kNumPreloadedSNISTS);
|
| }
|
|
|
| if (!entry) {
|
| @@ -740,7 +732,8 @@ void TransportSecurityState::ReportUMAOnPinFailure(const std::string& host) {
|
| DCHECK(entry->second_level_domain_name != DOMAIN_NOT_PINNED);
|
|
|
| UMA_HISTOGRAM_ENUMERATION("Net.PublicKeyPinFailureDomain",
|
| - entry->second_level_domain_name, DOMAIN_NUM_EVENTS);
|
| + entry->second_level_domain_name,
|
| + DOMAIN_NUM_EVENTS);
|
| }
|
|
|
| // static
|
| @@ -767,15 +760,20 @@ bool TransportSecurityState::GetStaticDomainState(
|
| canonicalized_host.size() - i);
|
| out->domain = DNSDomainToString(host_sub_chunk);
|
| bool ret;
|
| - if (is_build_timely &&
|
| - HasPreload(kPreloadedSTS, kNumPreloadedSTS, canonicalized_host, i, out,
|
| - &ret)) {
|
| + if (is_build_timely && HasPreload(kPreloadedSTS,
|
| + kNumPreloadedSTS,
|
| + canonicalized_host,
|
| + i,
|
| + out,
|
| + &ret)) {
|
| return ret;
|
| }
|
| - if (sni_enabled &&
|
| - is_build_timely &&
|
| - HasPreload(kPreloadedSNISTS, kNumPreloadedSNISTS, canonicalized_host, i,
|
| - out, &ret)) {
|
| + if (sni_enabled && is_build_timely && HasPreload(kPreloadedSNISTS,
|
| + kNumPreloadedSNISTS,
|
| + canonicalized_host,
|
| + i,
|
| + out,
|
| + &ret)) {
|
| return ret;
|
| }
|
| }
|
| @@ -797,8 +795,7 @@ bool TransportSecurityState::GetDynamicDomainState(const std::string& host,
|
| for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) {
|
| std::string host_sub_chunk(&canonicalized_host[i],
|
| canonicalized_host.size() - i);
|
| - DomainStateMap::iterator j =
|
| - enabled_hosts_.find(HashHost(host_sub_chunk));
|
| + DomainStateMap::iterator j = enabled_hosts_.find(HashHost(host_sub_chunk));
|
| if (j == enabled_hosts_.end())
|
| continue;
|
|
|
| @@ -826,9 +823,9 @@ bool TransportSecurityState::GetDynamicDomainState(const std::string& host,
|
| return false;
|
| }
|
|
|
| -
|
| void TransportSecurityState::AddOrUpdateEnabledHosts(
|
| - const std::string& hashed_host, const DomainState& state) {
|
| + const std::string& hashed_host,
|
| + const DomainState& state) {
|
| DCHECK(CalledOnValidThread());
|
| enabled_hosts_[hashed_host] = state;
|
| }
|
| @@ -846,13 +843,16 @@ TransportSecurityState::DomainState::~DomainState() {
|
| }
|
|
|
| bool TransportSecurityState::DomainState::CheckPublicKeyPins(
|
| - const HashValueVector& hashes, std::string* failure_log) const {
|
| + const HashValueVector& hashes,
|
| + std::string* failure_log) const {
|
| // Validate that hashes is not empty. By the time this code is called (in
|
| // production), that should never happen, but it's good to be defensive.
|
| // And, hashes *can* be empty in some test scenarios.
|
| if (hashes.empty()) {
|
| - *failure_log = "Rejecting empty public key chain for public-key-pinned "
|
| - "domains: " + domain;
|
| + *failure_log =
|
| + "Rejecting empty public key chain for public-key-pinned "
|
| + "domains: " +
|
| + domain;
|
| return false;
|
| }
|
|
|
| @@ -889,8 +889,7 @@ bool TransportSecurityState::DomainState::ShouldSSLErrorsBeFatal() const {
|
| }
|
|
|
| bool TransportSecurityState::DomainState::HasPublicKeyPins() const {
|
| - return static_spki_hashes.size() > 0 ||
|
| - bad_static_spki_hashes.size() > 0 ||
|
| + return static_spki_hashes.size() > 0 || bad_static_spki_hashes.size() > 0 ||
|
| dynamic_spki_hashes.size() > 0;
|
| }
|
|
|
|
|