net: reject all CloudFlare certificates issued prior to April 2nd.

net/cert/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include "base/metrics/histogram.h"
 #include "base/sha1.h"
 #include "base/strings/stringprintf.h"
 #include "build/build_config.h"
@@ skipping 323 matching lines @@
   if (serial.size() == kComodoSerialBytes) {
     for (unsigned i = 0; i < arraysize(kComodoSerials); i++) {
       if (memcmp(kComodoSerials[i], serial.data(), kComodoSerialBytes) == 0) {
         UMA_HISTOGRAM_ENUMERATION("Net.SSLCertBlacklisted", i,
                                   arraysize(kComodoSerials) + 1);
         return true;
       }
     }
   }
 
+  /* CloudFlare revoked all certificates issued prior to April 2nd, 2014. Thus

[wtc, 2014/05/02 21:21:16]

We should also note when these certificates will all expire. That'll allow us to
determine when we can remove this from the blacklist.

[agl, 2014/05/02 23:17:49]

Done.

+   * all certificates where the CN ends with ".cloudflare.com" with a prior
+   * issuance date are rejected. */
+  const std::string& cn = cert->subject().common_name;
+  const std::string kCloudFlareCNSuffix(".cloudflare.com");

[Ryan Sleevi, 2014/05/02 22:11:33]

static const char[] kCloudFlareCNSuffix = ".cloudflare.com";

[agl, 2014/05/02 23:17:49]

Done.

+  if (cn.size() > kCloudFlareCNSuffix.size() &&
+      cn.compare(cn.size() - kCloudFlareCNSuffix.size(),
+                 kCloudFlareCNSuffix.size(),

[Ryan Sleevi, 2014/05/02 22:11:33]

arraysize(kCloudFlareCNSuffix);

[agl, 2014/05/02 23:17:49]

Done.

+                 kCloudFlareCNSuffix) == 0) {
+    base::Time::Exploded epoch = {0};
+    epoch.year = 2014;
+    epoch.month = 4;
+    epoch.day_of_month = 2;
+
+    if (cert->valid_start() < base::Time::FromUTCExploded(epoch)) {

[Ryan Sleevi, 2014/05/02 22:11:33]

Could be more efficient using FromInternalValue() here, if we wanted to treat
this as perf-critical.

[agl, 2014/05/02 23:17:49]

Done.

+      return true;
+    }

[Ryan Sleevi, 2014/05/02 22:11:33]

no braces (consistent with the rest of the file for one-liners)

[agl, 2014/05/02 23:17:49]

Kept braces because now it's a single if with a multi-line conditional, and
omitting braces for that is a little too aggressive I feel. Don't really care
either way, however.

+  }
+
   return false;
 }
 
 // static
 // NOTE: This implementation assumes and enforces that the hashes are SHA1.
 bool CertVerifyProc::IsPublicKeyBlacklisted(
     const HashValueVector& public_key_hashes) {
   static const unsigned kNumHashes = 14;
   static const uint8 kHashes[kNumHashes][base::kSHA1Length] = {
     // Subject: CN=DigiNotar Root CA
@@ skipping 181 matching lines @@
             return true;
         }
       }
     }
   }
 
   return false;
 }
 
 }  // namespace net