OLD | NEW |
(Empty) | |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 #include "chrome/browser/net/packed_ct_ev_whitelist.h" |
| 6 |
| 7 #include <string.h> |
| 8 |
| 9 #include <algorithm> |
| 10 |
| 11 #include "base/big_endian.h" |
| 12 #include "base/files/file_util.h" |
| 13 #include "base/lazy_instance.h" |
| 14 #include "base/logging.h" |
| 15 #include "chrome/browser/net/bit_stream_reader.h" |
| 16 #include "content/public/browser/browser_thread.h" |
| 17 #include "net/ssl/ssl_config_service.h" |
| 18 |
| 19 namespace { |
| 20 const uint8_t kCertHashLengthBits = 64; // 8 bytes |
| 21 const uint8_t kCertHashLength = kCertHashLengthBits / 8; |
| 22 const uint64_t kGolombMParameterBits = 47; // 2^47 |
| 23 |
| 24 void SetNewEVWhitelistInSSLConfigService( |
| 25 const scoped_refptr<net::ct::EVCertsWhitelist>& new_whitelist) { |
| 26 net::SSLConfigService::SetEVCertsWhitelist(new_whitelist); |
| 27 } |
| 28 |
| 29 int TruncatedHashesComparator(const void* v1, const void* v2) { |
| 30 const uint64_t& h1(*(static_cast<const uint64_t*>(v1))); |
| 31 const uint64_t& h2(*(static_cast<const uint64_t*>(v2))); |
| 32 if (h1 < h2) |
| 33 return -1; |
| 34 else if (h1 > h2) |
| 35 return 1; |
| 36 return 0; |
| 37 } |
| 38 } // namespace |
| 39 |
| 40 void SetEVWhitelistFromFile(const base::FilePath& compressed_whitelist_file) { |
| 41 VLOG(1) << "Setting EV whitelist from file: " |
| 42 << compressed_whitelist_file.value(); |
| 43 std::string compressed_list; |
| 44 if (!base::ReadFileToString(compressed_whitelist_file, &compressed_list)) { |
| 45 VLOG(1) << "Failed reading from " << compressed_whitelist_file.value(); |
| 46 return; |
| 47 } |
| 48 |
| 49 scoped_refptr<net::ct::EVCertsWhitelist> new_whitelist( |
| 50 new PackedEVCertsWhitelist(compressed_list)); |
| 51 if (!new_whitelist->IsValid()) { |
| 52 VLOG(1) << "Failed uncompressing EV certs whitelist."; |
| 53 return; |
| 54 } |
| 55 |
| 56 base::Closure assign_cb = |
| 57 base::Bind(SetNewEVWhitelistInSSLConfigService, new_whitelist); |
| 58 content::BrowserThread::PostTask( |
| 59 content::BrowserThread::IO, FROM_HERE, assign_cb); |
| 60 } |
| 61 |
| 62 bool PackedEVCertsWhitelist::UncompressEVWhitelist( |
| 63 const std::string& compressed_whitelist, |
| 64 std::vector<uint64_t>* uncompressed_list) { |
| 65 internal::BitStreamReader reader(base::StringPiece( |
| 66 compressed_whitelist.data(), compressed_whitelist.size())); |
| 67 std::vector<uint64_t> result; |
| 68 |
| 69 VLOG(1) << "Uncompressing EV whitelist of size " |
| 70 << compressed_whitelist.size(); |
| 71 uint64_t curr_hash(0); |
| 72 if (!reader.ReadBits(kCertHashLengthBits, &curr_hash)) { |
| 73 VLOG(1) << "Failed reading first hash."; |
| 74 return false; |
| 75 } |
| 76 result.push_back(curr_hash); |
| 77 // M is the tunable parameter used by the Golomb coding. |
| 78 static const uint64_t kGolombParameterM = static_cast<uint64_t>(1) |
| 79 << kGolombMParameterBits; |
| 80 |
| 81 while (reader.BitsLeft() > kGolombMParameterBits) { |
| 82 uint64_t read_prefix = 0; |
| 83 if (!reader.ReadUnaryEncoding(&read_prefix)) { |
| 84 VLOG(1) << "Failed reading unary-encoded prefix."; |
| 85 return false; |
| 86 } |
| 87 if (read_prefix > (UINT64_MAX / kGolombParameterM)) { |
| 88 VLOG(1) << "Received value that would cause overflow: " << read_prefix; |
| 89 return false; |
| 90 } |
| 91 |
| 92 uint64_t r = 0; |
| 93 if (!reader.ReadBits(kGolombMParameterBits, &r)) { |
| 94 VLOG(1) << "Failed reading " << kGolombMParameterBits << " bits."; |
| 95 return false; |
| 96 } |
| 97 DCHECK_LT(r, kGolombParameterM); |
| 98 |
| 99 uint64_t curr_diff = read_prefix * kGolombParameterM + r; |
| 100 curr_hash += curr_diff; |
| 101 |
| 102 result.push_back(curr_hash); |
| 103 } |
| 104 |
| 105 uncompressed_list->swap(result); |
| 106 return true; |
| 107 } |
| 108 |
| 109 PackedEVCertsWhitelist::PackedEVCertsWhitelist( |
| 110 const std::string& compressed_whitelist) |
| 111 : is_whitelist_valid_(false) { |
| 112 if (!UncompressEVWhitelist(compressed_whitelist, &whitelist_)) { |
| 113 whitelist_.clear(); |
| 114 return; |
| 115 } |
| 116 |
| 117 is_whitelist_valid_ = true; |
| 118 } |
| 119 |
| 120 PackedEVCertsWhitelist::~PackedEVCertsWhitelist() { |
| 121 } |
| 122 |
| 123 bool PackedEVCertsWhitelist::ContainsCertificateHash( |
| 124 const std::string& certificate_hash) const { |
| 125 DCHECK(!whitelist_.empty()); |
| 126 uint64_t hash_to_lookup; |
| 127 |
| 128 base::ReadBigEndian(certificate_hash.data(), &hash_to_lookup); |
| 129 return bsearch(&hash_to_lookup, |
| 130 &whitelist_[0], |
| 131 whitelist_.size(), |
| 132 kCertHashLength, |
| 133 TruncatedHashesComparator) != NULL; |
| 134 } |
| 135 |
| 136 bool PackedEVCertsWhitelist::IsValid() const { |
| 137 return is_whitelist_valid_; |
| 138 } |
OLD | NEW |