Certificate Transparency: Require SCTs for EV certificates.

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <vector>
 
 #include "base/base64.h"
 #include "base/bind.h"
@@ skipping 35 matching lines @@
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_prefs.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_protocol.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_settings.h"
 #include "components/data_reduction_proxy/core/common/data_reduction_proxy_params.h"
 #include "components/policy/core/common/policy_service.h"
 #include "components/variations/variations_associated_data.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/cookie_store_factory.h"
 #include "net/base/host_mapping_rules.h"
 #include "net/base/net_util.h"
+#include "net/cert/cert_policy_enforcer.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_proc.h"
 #include "net/cert/ct_known_logs.h"
+#include "net/cert/ct_known_logs_static.h"
 #include "net/cert/ct_log_verifier.h"
 #include "net/cert/ct_verifier.h"
 #include "net/cert/multi_log_ct_verifier.h"
 #include "net/cert/multi_threaded_cert_verifier.h"
 #include "net/cookies/cookie_store.h"
 #include "net/dns/host_cache.h"
 #include "net/dns/host_resolver.h"
 #include "net/dns/mapped_host_resolver.h"
 #include "net/ftp/ftp_network_layer.h"
 #include "net/http/http_auth_filter.h"
@@ skipping 165 matching lines @@
 // TODO(willchan): Remove proxy script fetcher context since it's not necessary
 // now that I got rid of refcounting URLRequestContexts.
 // See IOThread::Globals for details.
 net::URLRequestContext*
 ConstructProxyScriptFetcherContext(IOThread::Globals* globals,
                                    net::NetLog* net_log) {
   net::URLRequestContext* context = new net::URLRequestContext;
   context->set_net_log(net_log);
   context->set_host_resolver(globals->host_resolver.get());
   context->set_cert_verifier(globals->cert_verifier.get());
+  context->set_cert_policy_enforcer(globals->cert_policy_enforcer.get());
   context->set_transport_security_state(
       globals->transport_security_state.get());
   context->set_cert_transparency_verifier(
       globals->cert_transparency_verifier.get());
   context->set_http_auth_handler_factory(
       globals->http_auth_handler_factory.get());
   context->set_proxy_service(globals->proxy_script_fetcher_proxy_service.get());
   context->set_http_transaction_factory(
       globals->proxy_script_fetcher_http_transaction_factory.get());
   context->set_job_factory(
@@ skipping 10 matching lines @@
   return context;
 }
 
 net::URLRequestContext*
 ConstructSystemRequestContext(IOThread::Globals* globals,
                               net::NetLog* net_log) {
   net::URLRequestContext* context = new SystemURLRequestContext;
   context->set_net_log(net_log);
   context->set_host_resolver(globals->host_resolver.get());
   context->set_cert_verifier(globals->cert_verifier.get());
+  context->set_cert_policy_enforcer(globals->cert_policy_enforcer.get());
   context->set_transport_security_state(
       globals->transport_security_state.get());
   context->set_cert_transparency_verifier(
       globals->cert_transparency_verifier.get());
   context->set_http_auth_handler_factory(
       globals->http_auth_handler_factory.get());
   context->set_proxy_service(globals->system_proxy_service.get());
   context->set_http_transaction_factory(
       globals->system_http_transaction_factory.get());
   context->set_job_factory(globals->system_url_request_job_factory.get());
@@ skipping 348 matching lines @@
                                &ct_public_key_data))
           << "Unable to decode CT public key.";
       scoped_ptr<net::CTLogVerifier> external_log_verifier(
           net::CTLogVerifier::Create(ct_public_key_data, log_description));
       CHECK(external_log_verifier) << "Unable to parse CT public key.";
       VLOG(1) << "Adding log with description " << log_description;
       ct_verifier->AddLog(external_log_verifier.Pass());
     }
   }
 
+  net::CertPolicyEnforcer* policy_enforcer = NULL;
+  // TODO(eranm): In M41 Certificate Transparency presence will be required
+  // by for EV certificates. Remove this flag for M41.

[Ryan Sleevi, 2014/11/06 00:16:43]

While I know the delays have been due to my review load, this won't make it in
for M40.

So this is for M41, which should remove this flag.

However, you will want to Finch gate it ( http://go/finch ). I can walk you
through that tomorrow morning if you want.

[Eran Messeri, 2014/11/20 11:49:56]

Per our offline discussion, this patch will be immediately followed up by a
patch introducing Finch support, but it would be useful to have this patch land
with the policy enforcement behind a flag so we can tell CAs they can already
test compliance.

+  if (command_line.HasSwitch(switches::kRequireCTForEV)) {
+    policy_enforcer = new net::CertPolicyEnforcer(kNumKnownCTLogs, true);
+  } else {
+    policy_enforcer = new net::CertPolicyEnforcer(kNumKnownCTLogs, false);
+  }
+  globals_->cert_policy_enforcer.reset(policy_enforcer);
+
   globals_->ssl_config_service = GetSSLConfigService();
 
   SetupDataReductionProxy(network_delegate);
 
   globals_->http_auth_handler_factory.reset(CreateDefaultAuthHandlerFactory(
       globals_->host_resolver.get()));
   globals_->http_server_properties.reset(new net::HttpServerPropertiesImpl());
   // For the ProxyScriptFetcher, we use a direct ProxyService.
   globals_->proxy_script_fetcher_proxy_service.reset(
       net::ProxyService::CreateDirectWithNetLog(net_log_));
@@ skipping 336 matching lines @@
     net::HttpNetworkSession::Params* params) {
   InitializeNetworkSessionParamsFromGlobals(*globals_, params);
 }
 
 // static
 void IOThread::InitializeNetworkSessionParamsFromGlobals(
     const IOThread::Globals& globals,
     net::HttpNetworkSession::Params* params) {
   params->host_resolver = globals.host_resolver.get();
   params->cert_verifier = globals.cert_verifier.get();
+  params->cert_policy_enforcer = globals.cert_policy_enforcer.get();
   params->channel_id_service = globals.system_channel_id_service.get();
   params->transport_security_state = globals.transport_security_state.get();
   params->ssl_config_service = globals.ssl_config_service.get();
   params->http_auth_handler_factory = globals.http_auth_handler_factory.get();
   params->http_server_properties =
       globals.http_server_properties->GetWeakPtr();
   params->network_delegate = globals.system_network_delegate.get();
   params->host_mapping_rules = globals.host_mapping_rules.get();
   params->enable_ssl_connect_job_waiting =
       globals.enable_ssl_connect_job_waiting;
@@ skipping 437 matching lines @@
   net::QuicVersionVector supported_versions = net::QuicSupportedVersions();
   for (size_t i = 0; i < supported_versions.size(); ++i) {
     net::QuicVersion version = supported_versions[i];
     if (net::QuicVersionToString(version) == quic_version) {
       return version;
     }
   }
 
   return net::QUIC_VERSION_UNSUPPORTED;
 }