net: reject all CloudFlare certificates issued prior to April 2nd.

net/cert/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include "base/metrics/histogram.h"

[Ryan Sleevi, 2014/05/03 00:08:59]

IYWU - add base/basictypes.h to the include list.

[agl, 2014/05/05 18:50:19]

Done.

 #include "base/sha1.h"
 #include "base/strings/stringprintf.h"
 #include "build/build_config.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/crl_set.h"
@@ skipping 316 matching lines @@
   if (serial.size() == kComodoSerialBytes) {
     for (unsigned i = 0; i < arraysize(kComodoSerials); i++) {
       if (memcmp(kComodoSerials[i], serial.data(), kComodoSerialBytes) == 0) {
         UMA_HISTOGRAM_ENUMERATION("Net.SSLCertBlacklisted", i,
                                   arraysize(kComodoSerials) + 1);
         return true;
       }
     }
   }
 
+  // CloudFlare revoked all certificates issued prior to April 2nd, 2014. Thus
+  // all certificates where the CN ends with ".cloudflare.com" with a prior
+  // issuance date are rejected.
+  //
+  // The old certs had a lifetime of five years, so this can be removed April
+  // 2nd, 2019.
+  const std::string& cn = cert->subject().common_name;
+  static const char kCloudFlareCNSuffix[] = ".cloudflare.com";
+  // kCloudFlareEpoch is the base::Time internal value for midnight at the
+  // beginning of April 2nd, 2014, UTC.
+  static const int64 kCloudFlareEpoch = 13040870400000000ull;

[Ryan Sleevi, 2014/05/03 00:08:59]

because arraysize is a constexpr, you could also "static const size_t
kCloudFlareCnSuffixLen = arraysize(kCloudFlareCNSuffix) -1", if you wanted (to
reduce the duplication of the three lines)

[Ryan Sleevi, 2014/05/03 00:08:59]

You declare the var as ULL, except it's an int64. 

However, this is still wrong - use INT64_C(value), which will ensure L/LL as
appropriate for LP64/LLP64

[agl, 2014/05/05 18:50:19]

(Oh joy, another build config.)

Thanks for that.

+  if (cn.size() > arraysize(kCloudFlareCNSuffix) - 1 &&
+      cn.compare(cn.size() - (arraysize(kCloudFlareCNSuffix) - 1),
+                 arraysize(kCloudFlareCNSuffix) - 1,
+                 kCloudFlareCNSuffix) == 0 &&
+      cert->valid_start() < base::Time::FromInternalValue(kCloudFlareEpoch)) {
+    return true;
+  }
+
   return false;
 }
 
 // static
 // NOTE: This implementation assumes and enforces that the hashes are SHA1.
 bool CertVerifyProc::IsPublicKeyBlacklisted(
     const HashValueVector& public_key_hashes) {
   static const unsigned kNumHashes = 14;
   static const uint8 kHashes[kNumHashes][base::kSHA1Length] = {
     // Subject: CN=DigiNotar Root CA
@@ skipping 181 matching lines @@
             return true;
         }
       }
     }
   }
 
   return false;
 }
 
 }  // namespace net