Remove residual support for SHA-1 public key pins.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <memory>
 #include <utility>
 #include <vector>
 
 #include "base/base64.h"
 #include "base/build_time.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
-#include "base/sha1.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "build/build_config.h"
 #include "crypto/sha2.h"
 #include "net/base/host_port_pair.h"
 #include "net/cert/ct_policy_status.h"
@@ skipping 117 matching lines @@
              std::move(served_certificate_chain_list));
   report.Set("validated-certificate-chain",
              std::move(validated_certificate_chain_list));
 
   std::unique_ptr<base::ListValue> known_pin_list(new base::ListValue());
   for (const auto& hash_value : pkp_state.spki_hashes) {
     std::string known_pin;
 
     switch (hash_value.tag) {
       case HASH_VALUE_SHA1:
-        known_pin += "pin-sha1=";
-        break;
+        continue;

[davidben, 2017/06/22 21:33:47]

This is just removing a bit in the reporting side of things, right? It looks
like we'd still enforce any SHA-1 pins we have lying around in the user's
profile directory; there's still residual code in HashValue::FromString (used by
the parser) and CertVerifyProc continues to produce SHA-1 hashes.

We probably want to unwind all of that (which I'm all for doing) before taking
this piece out. I bet we can even take HASH_VALUE_SHA1 out altogether. I see
net/cert/internal/parse_ocsp.cc uses it, but not in any useful away as far as I
can tell. (I can unwind that part if you like.)

[davidben, 2017/06/22 21:51:43]

Here's taking it out of parse_ocsp.cc:
https://chromium-review.googlesource.com/545017

[palmer, 2017/06/26 21:32:59]

Oh, OK, great. I didn't know if you'd want me to remove it from CertVerifyProc,
too; I saw it but hesitated to touch it. I'll put up another patchset with that
removed.

       case HASH_VALUE_SHA256:
         known_pin += "pin-sha256=";
         break;
     }
 
     std::string base64_value;
     base::Base64Encode(
         base::StringPiece(reinterpret_cast<const char*>(hash_value.data()),
                           hash_value.size()),
         &base64_value);
@@ skipping 1677 matching lines @@
 TransportSecurityState::PKPStateIterator::PKPStateIterator(
     const TransportSecurityState& state)
     : iterator_(state.enabled_pkp_hosts_.begin()),
       end_(state.enabled_pkp_hosts_.end()) {
 }
 
 TransportSecurityState::PKPStateIterator::~PKPStateIterator() {
 }
 
 }  // namespace net