| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/http/transport_security_state.h" | 5 #include "net/http/transport_security_state.h" |
| 6 | 6 |
| 7 #include <memory> | 7 #include <memory> |
| 8 #include <utility> | 8 #include <utility> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| (...skipping 209 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 220 } | 220 } |
| 221 | 221 |
| 222 std::string HashHost(const std::string& canonicalized_host) { | 222 std::string HashHost(const std::string& canonicalized_host) { |
| 223 char hashed[crypto::kSHA256Length]; | 223 char hashed[crypto::kSHA256Length]; |
| 224 crypto::SHA256HashString(canonicalized_host, hashed, sizeof(hashed)); | 224 crypto::SHA256HashString(canonicalized_host, hashed, sizeof(hashed)); |
| 225 return std::string(hashed, sizeof(hashed)); | 225 return std::string(hashed, sizeof(hashed)); |
| 226 } | 226 } |
| 227 | 227 |
| 228 // Returns true if the intersection of |a| and |b| is not empty. If either | 228 // Returns true if the intersection of |a| and |b| is not empty. If either |
| 229 // |a| or |b| is empty, returns false. | 229 // |a| or |b| is empty, returns false. |
| 230 bool HashesIntersect(const HashValueVector& a, | 230 bool HashesIntersect2(const HashValueVector& a, |
| 231 const HashValueVector& b) { | 231 const HashValueVector& b) { |
| 232 for (const auto& hash : a) { | 232 for (const auto& hash : a) { |
| 233 if (base::ContainsValue(b, hash)) | 233 if (base::ContainsValue(b, hash)) |
| 234 return true; | 234 return true; |
| 235 } | 235 } |
| 236 return false; | 236 return false; |
| 237 } | 237 } |
| 238 | 238 |
| 239 bool AddHash(const char* sha256_hash, HashValueVector* out) { | 239 bool AddHash(const char* sha256_hash, HashValueVector* out) { |
| 240 HashValue hash(HASH_VALUE_SHA256); | 240 HashValue hash(HASH_VALUE_SHA256); |
| (...skipping 1579 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1820 // Validate that hashes is not empty. By the time this code is called (in | 1820 // Validate that hashes is not empty. By the time this code is called (in |
| 1821 // production), that should never happen, but it's good to be defensive. | 1821 // production), that should never happen, but it's good to be defensive. |
| 1822 // And, hashes *can* be empty in some test scenarios. | 1822 // And, hashes *can* be empty in some test scenarios. |
| 1823 if (hashes.empty()) { | 1823 if (hashes.empty()) { |
| 1824 failure_log->append( | 1824 failure_log->append( |
| 1825 "Rejecting empty public key chain for public-key-pinned domains: " + | 1825 "Rejecting empty public key chain for public-key-pinned domains: " + |
| 1826 domain); | 1826 domain); |
| 1827 return false; | 1827 return false; |
| 1828 } | 1828 } |
| 1829 | 1829 |
| 1830 if (HashesIntersect(bad_spki_hashes, hashes)) { | 1830 if (HashesIntersect2(bad_spki_hashes, hashes)) { |
| 1831 failure_log->append("Rejecting public key chain for domain " + domain + | 1831 failure_log->append("Rejecting public key chain for domain " + domain + |
| 1832 ". Validated chain: " + HashesToBase64String(hashes) + | 1832 ". Validated chain: " + HashesToBase64String(hashes) + |
| 1833 ", matches one or more bad hashes: " + | 1833 ", matches one or more bad hashes: " + |
| 1834 HashesToBase64String(bad_spki_hashes)); | 1834 HashesToBase64String(bad_spki_hashes)); |
| 1835 return false; | 1835 return false; |
| 1836 } | 1836 } |
| 1837 | 1837 |
| 1838 // If there are no pins, then any valid chain is acceptable. | 1838 // If there are no pins, then any valid chain is acceptable. |
| 1839 if (spki_hashes.empty()) | 1839 if (spki_hashes.empty()) |
| 1840 return true; | 1840 return true; |
| 1841 | 1841 |
| 1842 if (HashesIntersect(spki_hashes, hashes)) { | 1842 if (HashesIntersect2(spki_hashes, hashes)) { |
| 1843 return true; | 1843 return true; |
| 1844 } | 1844 } |
| 1845 | 1845 |
| 1846 failure_log->append("Rejecting public key chain for domain " + domain + | 1846 failure_log->append("Rejecting public key chain for domain " + domain + |
| 1847 ". Validated chain: " + HashesToBase64String(hashes) + | 1847 ". Validated chain: " + HashesToBase64String(hashes) + |
| 1848 ", expected: " + HashesToBase64String(spki_hashes)); | 1848 ", expected: " + HashesToBase64String(spki_hashes)); |
| 1849 return false; | 1849 return false; |
| 1850 } | 1850 } |
| 1851 | 1851 |
| 1852 bool TransportSecurityState::PKPState::HasPublicKeyPins() const { | 1852 bool TransportSecurityState::PKPState::HasPublicKeyPins() const { |
| 1853 return spki_hashes.size() > 0 || bad_spki_hashes.size() > 0; | 1853 return spki_hashes.size() > 0 || bad_spki_hashes.size() > 0; |
| 1854 } | 1854 } |
| 1855 | 1855 |
| 1856 TransportSecurityState::PKPStateIterator::PKPStateIterator( | 1856 TransportSecurityState::PKPStateIterator::PKPStateIterator( |
| 1857 const TransportSecurityState& state) | 1857 const TransportSecurityState& state) |
| 1858 : iterator_(state.enabled_pkp_hosts_.begin()), | 1858 : iterator_(state.enabled_pkp_hosts_.begin()), |
| 1859 end_(state.enabled_pkp_hosts_.end()) { | 1859 end_(state.enabled_pkp_hosts_.end()) { |
| 1860 } | 1860 } |
| 1861 | 1861 |
| 1862 TransportSecurityState::PKPStateIterator::~PKPStateIterator() { | 1862 TransportSecurityState::PKPStateIterator::~PKPStateIterator() { |
| 1863 } | 1863 } |
| 1864 | 1864 |
| 1865 } // namespace net | 1865 } // namespace net |
| OLD | NEW |