Add --ignore-certificate-errors-spki-list switch and UMA histogram.

net/http/http_stream_factory_impl_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl_job.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/feature_list.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/trace_event/trace_event.h"
 #include "base/values.h"
 #include "build/build_config.h"
+#include "crypto/sha2.h"
 #include "net/base/port_util.h"
 #include "net/base/proxy_delegate.h"
 #include "net/base/trace_constants.h"
+#include "net/cert/asn1_util.h"
 #include "net/cert/cert_verifier.h"
 #include "net/http/bidirectional_stream_impl.h"
 #include "net/http/http_basic_stream.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_proxy_client_socket.h"
 #include "net/http/http_proxy_client_socket_pool.h"
 #include "net/http/http_request_info.h"
 #include "net/http/http_server_properties.h"
 #include "net/http/http_stream_factory.h"
 #include "net/http/http_stream_factory_impl_request.h"
@@ skipping 1482 matching lines @@
   // RestartIgnoringLastError(). And the user will be asked interactively
   // before RestartIgnoringLastError() is ever called.
   server_ssl_config_.allowed_bad_certs.emplace_back(ssl_info_.cert,
                                                     ssl_info_.cert_status);
 
   int load_flags = request_info_.load_flags;
   if (session_->params().ignore_certificate_errors)
     load_flags |= LOAD_IGNORE_ALL_CERT_ERRORS;
   if (ssl_socket->IgnoreCertError(error, load_flags))
     return OK;
+
+  // Ignore errors for certificates that chain up to switch-whitelisted certs.
+  if (!session_->params().ignore_certificate_error_spki_set.empty()) {
+    base::flat_set<SHA256HashValue, SHA256HashValueLessThan> hashes;
+    std::string certDer;
+    base::StringPiece spki;
+    SHA256HashValue hash;
+    if (X509Certificate::GetDEREncoded(
+            ssl_info_.unverified_cert->os_cert_handle(), &certDer) &&
+        asn1::ExtractSPKIFromDERCert(certDer, &spki)) {
+      crypto::SHA256HashString(spki, &hash, sizeof(SHA256HashValue));
+      hashes.insert(hash);
+    }
+    for (const net::X509Certificate::OSCertHandle& intermediate :
+         ssl_info_.unverified_cert->GetIntermediateCertificates()) {
+      if (X509Certificate::GetDEREncoded(intermediate, &certDer) &&
+          asn1::ExtractSPKIFromDERCert(certDer, &spki)) {
+        crypto::SHA256HashString(spki, &hash, sizeof(SHA256HashValue));
+        hashes.insert(hash);
+      }
+    }
+
+    // Try to intersect SPKIs from the chain with the switch whitelist.
+    auto a = session_->params().ignore_certificate_error_spki_set.begin();
+    auto aEnd = session_->params().ignore_certificate_error_spki_set.end();
+    auto b = hashes.begin();
+    auto bEnd = hashes.end();
+    static const net::SHA256HashValueLessThan sha256_lt;
+    while (a != aEnd && b != bEnd) {
+      if (sha256_lt(*a, *b))
+        ++a;
+      else if (sha256_lt(*b, *a))
+        ++b;
+      else
+        return OK;
+    }
+  }
+
   return error;
 }
 
 ClientSocketPoolManager::SocketGroupType
 HttpStreamFactoryImpl::Job::GetSocketGroup() const {
   std::string scheme = origin_url_.scheme();
   if (scheme == url::kHttpsScheme || scheme == url::kWssScheme)
     return ClientSocketPoolManager::SSL_GROUP;
 
   if (scheme == url::kFtpScheme)
@@ skipping 14 matching lines @@
 
   ConnectionAttempts socket_attempts = connection_->connection_attempts();
   if (connection_->socket()) {
     connection_->socket()->GetConnectionAttempts(&socket_attempts);
   }
 
   delegate_->AddConnectionAttemptsToRequest(this, socket_attempts);
 }
 
 }  // namespace net