Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(458)

Side by Side Diff: net/http/transport_security_state.cc

Issue 2867693004: Snapshot of all changes to get jumbo in blink and content.
Patch Set: Rebased again Created 3 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/http/transport_security_state.h" 5 #include "net/http/transport_security_state.h"
6 6
7 #include <memory> 7 #include <memory>
8 #include <utility> 8 #include <utility>
9 #include <vector> 9 #include <vector>
10 10
(...skipping 203 matching lines...) Expand 10 before | Expand all | Expand 10 after
214 } 214 }
215 215
216 std::string HashHost(const std::string& canonicalized_host) { 216 std::string HashHost(const std::string& canonicalized_host) {
217 char hashed[crypto::kSHA256Length]; 217 char hashed[crypto::kSHA256Length];
218 crypto::SHA256HashString(canonicalized_host, hashed, sizeof(hashed)); 218 crypto::SHA256HashString(canonicalized_host, hashed, sizeof(hashed));
219 return std::string(hashed, sizeof(hashed)); 219 return std::string(hashed, sizeof(hashed));
220 } 220 }
221 221
222 // Returns true if the intersection of |a| and |b| is not empty. If either 222 // Returns true if the intersection of |a| and |b| is not empty. If either
223 // |a| or |b| is empty, returns false. 223 // |a| or |b| is empty, returns false.
224 bool HashesIntersect(const HashValueVector& a, 224 bool HashesIntersect2(const HashValueVector& a,
225 const HashValueVector& b) { 225 const HashValueVector& b) {
226 for (const auto& hash : a) { 226 for (const auto& hash : a) {
227 if (base::ContainsValue(b, hash)) 227 if (base::ContainsValue(b, hash))
228 return true; 228 return true;
229 } 229 }
230 return false; 230 return false;
231 } 231 }
232 232
233 bool AddHash(const char* sha256_hash, HashValueVector* out) { 233 bool AddHash(const char* sha256_hash, HashValueVector* out) {
234 HashValue hash(HASH_VALUE_SHA256); 234 HashValue hash(HASH_VALUE_SHA256);
(...skipping 1574 matching lines...) Expand 10 before | Expand all | Expand 10 after
1809 // Validate that hashes is not empty. By the time this code is called (in 1809 // Validate that hashes is not empty. By the time this code is called (in
1810 // production), that should never happen, but it's good to be defensive. 1810 // production), that should never happen, but it's good to be defensive.
1811 // And, hashes *can* be empty in some test scenarios. 1811 // And, hashes *can* be empty in some test scenarios.
1812 if (hashes.empty()) { 1812 if (hashes.empty()) {
1813 failure_log->append( 1813 failure_log->append(
1814 "Rejecting empty public key chain for public-key-pinned domains: " + 1814 "Rejecting empty public key chain for public-key-pinned domains: " +
1815 domain); 1815 domain);
1816 return false; 1816 return false;
1817 } 1817 }
1818 1818
1819 if (HashesIntersect(bad_spki_hashes, hashes)) { 1819 if (HashesIntersect2(bad_spki_hashes, hashes)) {
1820 failure_log->append("Rejecting public key chain for domain " + domain + 1820 failure_log->append("Rejecting public key chain for domain " + domain +
1821 ". Validated chain: " + HashesToBase64String(hashes) + 1821 ". Validated chain: " + HashesToBase64String(hashes) +
1822 ", matches one or more bad hashes: " + 1822 ", matches one or more bad hashes: " +
1823 HashesToBase64String(bad_spki_hashes)); 1823 HashesToBase64String(bad_spki_hashes));
1824 return false; 1824 return false;
1825 } 1825 }
1826 1826
1827 // If there are no pins, then any valid chain is acceptable. 1827 // If there are no pins, then any valid chain is acceptable.
1828 if (spki_hashes.empty()) 1828 if (spki_hashes.empty())
1829 return true; 1829 return true;
1830 1830
1831 if (HashesIntersect(spki_hashes, hashes)) { 1831 if (HashesIntersect2(spki_hashes, hashes)) {
1832 return true; 1832 return true;
1833 } 1833 }
1834 1834
1835 failure_log->append("Rejecting public key chain for domain " + domain + 1835 failure_log->append("Rejecting public key chain for domain " + domain +
1836 ". Validated chain: " + HashesToBase64String(hashes) + 1836 ". Validated chain: " + HashesToBase64String(hashes) +
1837 ", expected: " + HashesToBase64String(spki_hashes)); 1837 ", expected: " + HashesToBase64String(spki_hashes));
1838 return false; 1838 return false;
1839 } 1839 }
1840 1840
1841 bool TransportSecurityState::PKPState::HasPublicKeyPins() const { 1841 bool TransportSecurityState::PKPState::HasPublicKeyPins() const {
1842 return spki_hashes.size() > 0 || bad_spki_hashes.size() > 0; 1842 return spki_hashes.size() > 0 || bad_spki_hashes.size() > 0;
1843 } 1843 }
1844 1844
1845 TransportSecurityState::PKPStateIterator::PKPStateIterator( 1845 TransportSecurityState::PKPStateIterator::PKPStateIterator(
1846 const TransportSecurityState& state) 1846 const TransportSecurityState& state)
1847 : iterator_(state.enabled_pkp_hosts_.begin()), 1847 : iterator_(state.enabled_pkp_hosts_.begin()),
1848 end_(state.enabled_pkp_hosts_.end()) { 1848 end_(state.enabled_pkp_hosts_.end()) {
1849 } 1849 }
1850 1850
1851 TransportSecurityState::PKPStateIterator::~PKPStateIterator() { 1851 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
1852 } 1852 }
1853 1853
1854 } // namespace net 1854 } // namespace net
OLDNEW
« no previous file with comments | « net/http/transport_security_persister.cc ('k') | net/quic/chromium/quic_chromium_client_session.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698