Index: net/http/transport_security_state.cc |
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc |
index 609c233a3ea43d02d0f2997afcf1541cf79a6673..798e74407317c8d05c21e49c337233698a007b74 100644 |
--- a/net/http/transport_security_state.cc |
+++ b/net/http/transport_security_state.cc |
@@ -62,8 +62,7 @@ std::string HashHost(const std::string& canonicalized_host) { |
// Returns true if the intersection of |a| and |b| is not empty. If either |
// |a| or |b| is empty, returns false. |
-bool HashesIntersect(const HashValueVector& a, |
- const HashValueVector& b) { |
+bool HashesIntersect(const HashValueVector& a, const HashValueVector& b) { |
for (HashValueVector::const_iterator i = a.begin(); i != a.end(); ++i) { |
HashValueVector::const_iterator j = |
std::find_if(b.begin(), b.end(), HashValuesEqual(*i)); |
@@ -73,8 +72,7 @@ bool HashesIntersect(const HashValueVector& a, |
return false; |
} |
-bool AddHash(const char* sha1_hash, |
- HashValueVector* out) { |
+bool AddHash(const char* sha1_hash, HashValueVector* out) { |
HashValue hash(HASH_VALUE_SHA1); |
memcpy(hash.data(), sha1_hash, hash.size()); |
out->push_back(hash); |
@@ -83,8 +81,7 @@ bool AddHash(const char* sha1_hash, |
} // namespace |
-TransportSecurityState::TransportSecurityState() |
- : delegate_(NULL) { |
+TransportSecurityState::TransportSecurityState() : delegate_(NULL) { |
DCHECK(CalledOnValidThread()); |
} |
@@ -93,7 +90,8 @@ TransportSecurityState::Iterator::Iterator(const TransportSecurityState& state) |
end_(state.enabled_hosts_.end()) { |
} |
-TransportSecurityState::Iterator::~Iterator() {} |
+TransportSecurityState::Iterator::~Iterator() { |
+} |
void TransportSecurityState::SetDelegate( |
TransportSecurityState::Delegate* delegate) { |
@@ -125,8 +123,8 @@ bool TransportSecurityState::DeleteDynamicDataForHost(const std::string& host) { |
if (canonicalized_host.empty()) |
return false; |
- DomainStateMap::iterator i = enabled_hosts_.find( |
- HashHost(canonicalized_host)); |
+ DomainStateMap::iterator i = |
+ enabled_hosts_.find(HashHost(canonicalized_host)); |
if (i != enabled_hosts_.end()) { |
enabled_hosts_.erase(i); |
DirtyNotify(); |
@@ -145,8 +143,8 @@ bool TransportSecurityState::GetDomainState(const std::string& host, |
if (canonicalized_host.empty()) |
return false; |
- bool has_preload = GetStaticDomainState(canonicalized_host, sni_enabled, |
- &state); |
+ bool has_preload = |
+ GetStaticDomainState(canonicalized_host, sni_enabled, &state); |
std::string canonicalized_preload = CanonicalizeHost(state.domain); |
GetDynamicDomainState(host, &state); |
@@ -161,8 +159,7 @@ bool TransportSecurityState::GetDomainState(const std::string& host, |
return true; |
} |
- DomainStateMap::iterator j = |
- enabled_hosts_.find(HashHost(host_sub_chunk)); |
+ DomainStateMap::iterator j = enabled_hosts_.find(HashHost(host_sub_chunk)); |
if (j == enabled_hosts_.end()) |
continue; |
@@ -265,7 +262,6 @@ std::string TransportSecurityState::CanonicalizeHost(const std::string& host) { |
// domains at the END of the listing (but before DOMAIN_NUM_EVENTS). |
enum SecondLevelDomainName { |
DOMAIN_NOT_PINNED, |
- |
DOMAIN_GOOGLE_COM, |
DOMAIN_ANDROID_COM, |
DOMAIN_GOOGLE_ANALYTICS_COM, |
@@ -283,16 +279,11 @@ enum SecondLevelDomainName { |
DOMAIN_GMAIL_COM, |
DOMAIN_GOOGLEMAIL_COM, |
DOMAIN_GOOGLEGROUPS_COM, |
- |
DOMAIN_TORPROJECT_ORG, |
- |
DOMAIN_TWITTER_COM, |
DOMAIN_TWIMG_COM, |
- |
DOMAIN_AKAMAIHD_NET, |
- |
DOMAIN_TOR2WEB_ORG, |
- |
DOMAIN_YOUTU_BE, |
DOMAIN_GOOGLECOMMERCE_COM, |
DOMAIN_URCHIN_COM, |
@@ -515,12 +506,9 @@ enum SecondLevelDomainName { |
DOMAIN_GOOGLE_VG, |
DOMAIN_GOOGLE_VU, |
DOMAIN_GOOGLE_WS, |
- |
DOMAIN_CHROMIUM_ORG, |
- |
DOMAIN_CRYPTO_CAT, |
DOMAIN_LAVABIT_COM, |
- |
DOMAIN_GOOGLETAGMANAGER_COM, |
DOMAIN_GOOGLETAGSERVICES_COM, |
@@ -545,12 +533,16 @@ struct HSTSPreload { |
SecondLevelDomainName second_level_domain_name; |
}; |
-static bool HasPreload(const struct HSTSPreload* entries, size_t num_entries, |
- const std::string& canonicalized_host, size_t i, |
- TransportSecurityState::DomainState* out, bool* ret) { |
+static bool HasPreload(const struct HSTSPreload* entries, |
+ size_t num_entries, |
+ const std::string& canonicalized_host, |
+ size_t i, |
+ TransportSecurityState::DomainState* out, |
+ bool* ret) { |
for (size_t j = 0; j < num_entries; j++) { |
if (entries[j].length == canonicalized_host.size() - i && |
- memcmp(entries[j].dns_name, &canonicalized_host[i], |
+ memcmp(entries[j].dns_name, |
+ &canonicalized_host[i], |
entries[j].length) == 0) { |
if (!entries[j].include_subdomains && i != 0) { |
*ret = false; |
@@ -641,8 +633,10 @@ bool TransportSecurityState::AddHPKPHeader(const std::string& host, |
base::TimeDelta max_age; |
TransportSecurityState::DomainState domain_state; |
GetDynamicDomainState(host, &domain_state); |
- if (ParseHPKPHeader(value, ssl_info.public_key_hashes, |
- &max_age, &domain_state.pkp_include_subdomains, |
+ if (ParseHPKPHeader(value, |
+ ssl_info.public_key_hashes, |
+ &max_age, |
+ &domain_state.pkp_include_subdomains, |
&domain_state.dynamic_spki_hashes)) { |
// TODO(palmer): http://crbug.com/243865 handle max-age == 0. |
domain_state.pkp_observed = now; |
@@ -662,8 +656,7 @@ bool TransportSecurityState::AddHSTS(const std::string& host, |
TransportSecurityState::DomainState domain_state; |
const std::string canonicalized_host = CanonicalizeHost(host); |
const std::string hashed_host = HashHost(canonicalized_host); |
- DomainStateMap::const_iterator i = enabled_hosts_.find( |
- hashed_host); |
+ DomainStateMap::const_iterator i = enabled_hosts_.find(hashed_host); |
if (i != enabled_hosts_.end()) |
domain_state = i->second; |
@@ -685,8 +678,7 @@ bool TransportSecurityState::AddHPKP(const std::string& host, |
TransportSecurityState::DomainState domain_state; |
const std::string canonicalized_host = CanonicalizeHost(host); |
const std::string hashed_host = HashHost(canonicalized_host); |
- DomainStateMap::const_iterator i = enabled_hosts_.find( |
- hashed_host); |
+ DomainStateMap::const_iterator i = enabled_hosts_.find(hashed_host); |
if (i != enabled_hosts_.end()) |
domain_state = i->second; |
@@ -709,8 +701,8 @@ bool TransportSecurityState::IsGooglePinnedProperty(const std::string& host, |
return true; |
if (sni_enabled) { |
- entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS, |
- kNumPreloadedSNISTS); |
+ entry = GetHSTSPreload( |
+ canonicalized_host, kPreloadedSNISTS, kNumPreloadedSNISTS); |
if (entry && entry->pins.required_hashes == kGoogleAcceptableCerts) |
return true; |
} |
@@ -726,8 +718,8 @@ void TransportSecurityState::ReportUMAOnPinFailure(const std::string& host) { |
GetHSTSPreload(canonicalized_host, kPreloadedSTS, kNumPreloadedSTS); |
if (!entry) { |
- entry = GetHSTSPreload(canonicalized_host, kPreloadedSNISTS, |
- kNumPreloadedSNISTS); |
+ entry = GetHSTSPreload( |
+ canonicalized_host, kPreloadedSNISTS, kNumPreloadedSNISTS); |
} |
if (!entry) { |
@@ -740,7 +732,8 @@ void TransportSecurityState::ReportUMAOnPinFailure(const std::string& host) { |
DCHECK(entry->second_level_domain_name != DOMAIN_NOT_PINNED); |
UMA_HISTOGRAM_ENUMERATION("Net.PublicKeyPinFailureDomain", |
- entry->second_level_domain_name, DOMAIN_NUM_EVENTS); |
+ entry->second_level_domain_name, |
+ DOMAIN_NUM_EVENTS); |
} |
// static |
@@ -767,15 +760,20 @@ bool TransportSecurityState::GetStaticDomainState( |
canonicalized_host.size() - i); |
out->domain = DNSDomainToString(host_sub_chunk); |
bool ret; |
- if (is_build_timely && |
- HasPreload(kPreloadedSTS, kNumPreloadedSTS, canonicalized_host, i, out, |
- &ret)) { |
+ if (is_build_timely && HasPreload(kPreloadedSTS, |
+ kNumPreloadedSTS, |
+ canonicalized_host, |
+ i, |
+ out, |
+ &ret)) { |
return ret; |
} |
- if (sni_enabled && |
- is_build_timely && |
- HasPreload(kPreloadedSNISTS, kNumPreloadedSNISTS, canonicalized_host, i, |
- out, &ret)) { |
+ if (sni_enabled && is_build_timely && HasPreload(kPreloadedSNISTS, |
+ kNumPreloadedSNISTS, |
+ canonicalized_host, |
+ i, |
+ out, |
+ &ret)) { |
return ret; |
} |
} |
@@ -797,8 +795,7 @@ bool TransportSecurityState::GetDynamicDomainState(const std::string& host, |
for (size_t i = 0; canonicalized_host[i]; i += canonicalized_host[i] + 1) { |
std::string host_sub_chunk(&canonicalized_host[i], |
canonicalized_host.size() - i); |
- DomainStateMap::iterator j = |
- enabled_hosts_.find(HashHost(host_sub_chunk)); |
+ DomainStateMap::iterator j = enabled_hosts_.find(HashHost(host_sub_chunk)); |
if (j == enabled_hosts_.end()) |
continue; |
@@ -826,9 +823,9 @@ bool TransportSecurityState::GetDynamicDomainState(const std::string& host, |
return false; |
} |
- |
void TransportSecurityState::AddOrUpdateEnabledHosts( |
- const std::string& hashed_host, const DomainState& state) { |
+ const std::string& hashed_host, |
+ const DomainState& state) { |
DCHECK(CalledOnValidThread()); |
enabled_hosts_[hashed_host] = state; |
} |
@@ -846,13 +843,16 @@ TransportSecurityState::DomainState::~DomainState() { |
} |
bool TransportSecurityState::DomainState::CheckPublicKeyPins( |
- const HashValueVector& hashes, std::string* failure_log) const { |
+ const HashValueVector& hashes, |
+ std::string* failure_log) const { |
// Validate that hashes is not empty. By the time this code is called (in |
// production), that should never happen, but it's good to be defensive. |
// And, hashes *can* be empty in some test scenarios. |
if (hashes.empty()) { |
- *failure_log = "Rejecting empty public key chain for public-key-pinned " |
- "domains: " + domain; |
+ *failure_log = |
+ "Rejecting empty public key chain for public-key-pinned " |
+ "domains: " + |
+ domain; |
return false; |
} |
@@ -889,8 +889,7 @@ bool TransportSecurityState::DomainState::ShouldSSLErrorsBeFatal() const { |
} |
bool TransportSecurityState::DomainState::HasPublicKeyPins() const { |
- return static_spki_hashes.size() > 0 || |
- bad_static_spki_hashes.size() > 0 || |
+ return static_spki_hashes.size() > 0 || bad_static_spki_hashes.size() > 0 || |
dynamic_spki_hashes.size() > 0; |
} |