Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(269)

Side by Side Diff: net/http/transport_security_state.cc

Issue 2867693004: Snapshot of all changes to get jumbo in blink and content.
Patch Set: Exclude certain files from jumbo because of a Windows problem Created 3 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/http/transport_security_state.h" 5 #include "net/http/transport_security_state.h"
6 6
7 #include <memory> 7 #include <memory>
8 #include <utility> 8 #include <utility>
9 #include <vector> 9 #include <vector>
10 10
(...skipping 209 matching lines...) Expand 10 before | Expand all | Expand 10 after
220 } 220 }
221 221
222 std::string HashHost(const std::string& canonicalized_host) { 222 std::string HashHost(const std::string& canonicalized_host) {
223 char hashed[crypto::kSHA256Length]; 223 char hashed[crypto::kSHA256Length];
224 crypto::SHA256HashString(canonicalized_host, hashed, sizeof(hashed)); 224 crypto::SHA256HashString(canonicalized_host, hashed, sizeof(hashed));
225 return std::string(hashed, sizeof(hashed)); 225 return std::string(hashed, sizeof(hashed));
226 } 226 }
227 227
228 // Returns true if the intersection of |a| and |b| is not empty. If either 228 // Returns true if the intersection of |a| and |b| is not empty. If either
229 // |a| or |b| is empty, returns false. 229 // |a| or |b| is empty, returns false.
230 bool HashesIntersect(const HashValueVector& a, 230 bool HashesIntersect2(const HashValueVector& a,
231 const HashValueVector& b) { 231 const HashValueVector& b) {
232 for (const auto& hash : a) { 232 for (const auto& hash : a) {
233 if (base::ContainsValue(b, hash)) 233 if (base::ContainsValue(b, hash))
234 return true; 234 return true;
235 } 235 }
236 return false; 236 return false;
237 } 237 }
238 238
239 bool AddHash(const char* sha256_hash, HashValueVector* out) { 239 bool AddHash(const char* sha256_hash, HashValueVector* out) {
240 HashValue hash(HASH_VALUE_SHA256); 240 HashValue hash(HASH_VALUE_SHA256);
(...skipping 1579 matching lines...) Expand 10 before | Expand all | Expand 10 after
1820 // Validate that hashes is not empty. By the time this code is called (in 1820 // Validate that hashes is not empty. By the time this code is called (in
1821 // production), that should never happen, but it's good to be defensive. 1821 // production), that should never happen, but it's good to be defensive.
1822 // And, hashes *can* be empty in some test scenarios. 1822 // And, hashes *can* be empty in some test scenarios.
1823 if (hashes.empty()) { 1823 if (hashes.empty()) {
1824 failure_log->append( 1824 failure_log->append(
1825 "Rejecting empty public key chain for public-key-pinned domains: " + 1825 "Rejecting empty public key chain for public-key-pinned domains: " +
1826 domain); 1826 domain);
1827 return false; 1827 return false;
1828 } 1828 }
1829 1829
1830 if (HashesIntersect(bad_spki_hashes, hashes)) { 1830 if (HashesIntersect2(bad_spki_hashes, hashes)) {
1831 failure_log->append("Rejecting public key chain for domain " + domain + 1831 failure_log->append("Rejecting public key chain for domain " + domain +
1832 ". Validated chain: " + HashesToBase64String(hashes) + 1832 ". Validated chain: " + HashesToBase64String(hashes) +
1833 ", matches one or more bad hashes: " + 1833 ", matches one or more bad hashes: " +
1834 HashesToBase64String(bad_spki_hashes)); 1834 HashesToBase64String(bad_spki_hashes));
1835 return false; 1835 return false;
1836 } 1836 }
1837 1837
1838 // If there are no pins, then any valid chain is acceptable. 1838 // If there are no pins, then any valid chain is acceptable.
1839 if (spki_hashes.empty()) 1839 if (spki_hashes.empty())
1840 return true; 1840 return true;
1841 1841
1842 if (HashesIntersect(spki_hashes, hashes)) { 1842 if (HashesIntersect2(spki_hashes, hashes)) {
1843 return true; 1843 return true;
1844 } 1844 }
1845 1845
1846 failure_log->append("Rejecting public key chain for domain " + domain + 1846 failure_log->append("Rejecting public key chain for domain " + domain +
1847 ". Validated chain: " + HashesToBase64String(hashes) + 1847 ". Validated chain: " + HashesToBase64String(hashes) +
1848 ", expected: " + HashesToBase64String(spki_hashes)); 1848 ", expected: " + HashesToBase64String(spki_hashes));
1849 return false; 1849 return false;
1850 } 1850 }
1851 1851
1852 bool TransportSecurityState::PKPState::HasPublicKeyPins() const { 1852 bool TransportSecurityState::PKPState::HasPublicKeyPins() const {
1853 return spki_hashes.size() > 0 || bad_spki_hashes.size() > 0; 1853 return spki_hashes.size() > 0 || bad_spki_hashes.size() > 0;
1854 } 1854 }
1855 1855
1856 TransportSecurityState::PKPStateIterator::PKPStateIterator( 1856 TransportSecurityState::PKPStateIterator::PKPStateIterator(
1857 const TransportSecurityState& state) 1857 const TransportSecurityState& state)
1858 : iterator_(state.enabled_pkp_hosts_.begin()), 1858 : iterator_(state.enabled_pkp_hosts_.begin()),
1859 end_(state.enabled_pkp_hosts_.end()) { 1859 end_(state.enabled_pkp_hosts_.end()) {
1860 } 1860 }
1861 1861
1862 TransportSecurityState::PKPStateIterator::~PKPStateIterator() { 1862 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
1863 } 1863 }
1864 1864
1865 } // namespace net 1865 } // namespace net
OLDNEW
« no previous file with comments | « net/http/transport_security_persister.cc ('k') | net/quic/chromium/quic_chromium_client_session.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698