Certificate Transparency: Threading the CT verifier into the SSL client socket.

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <vector>
 
+#include "base/base64.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/debug/leak_tracker.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
 #include "base/metrics/field_trial.h"
 #include "base/prefs/pref_registry_simple.h"
 #include "base/prefs/pref_service.h"
@@ skipping 24 matching lines @@
 #include "chrome/browser/policy/policy_service.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_thread.h"
 #include "net/base/host_mapping_rules.h"
 #include "net/base/net_util.h"
 #include "net/base/network_time_notifier.h"
 #include "net/base/sdch_manager.h"
 #include "net/cert/cert_verifier.h"
+#include "net/cert/ct_known_logs_keys.h"
+#include "net/cert/ct_verifier.h"
 #include "net/cookies/cookie_monster.h"
 #include "net/dns/host_cache.h"
 #include "net/dns/host_resolver.h"
 #include "net/dns/mapped_host_resolver.h"
 #include "net/ftp/ftp_network_layer.h"
 #include "net/http/http_auth_filter.h"
 #include "net/http/http_auth_handler_factory.h"
 #include "net/http/http_network_layer.h"
 #include "net/http/http_server_properties_impl.h"
 #include "net/proxy/proxy_config_service.h"
@@ skipping 12 matching lines @@
 #include "net/websockets/websocket_job.h"
 
 #if defined(OS_WIN)
 #include "win8/util/win8_util.h"
 #endif
 
 #if defined(ENABLE_CONFIGURATION_POLICY)
 #include "policy/policy_constants.h"
 #endif
 
+#if !defined(USE_OPENSSL)
+#include "net/cert/ct_log_verifier.h"
+#include "net/cert/multi_log_ct_verifier.h"
+#endif
+
 #if defined(USE_NSS) || defined(OS_IOS)
 #include "net/ocsp/nss_ocsp.h"
 #endif
 
 #if !defined(OS_IOS) && !defined(OS_ANDROID)
 #include "net/proxy/proxy_resolver_v8.h"
 #endif
 
 #if defined(OS_ANDROID) || defined(OS_IOS)
 #include "chrome/browser/net/spdyproxy/data_reduction_proxy_settings.h"
@@ skipping 102 matching lines @@
 // See IOThread::Globals for details.
 net::URLRequestContext*
 ConstructProxyScriptFetcherContext(IOThread::Globals* globals,
                                    net::NetLog* net_log) {
   net::URLRequestContext* context = new net::URLRequestContext;
   context->set_net_log(net_log);
   context->set_host_resolver(globals->host_resolver.get());
   context->set_cert_verifier(globals->cert_verifier.get());
   context->set_transport_security_state(
       globals->transport_security_state.get());
+  context->set_cert_transparency_verifier(
+      globals->cert_transparency_verifier.get());
   context->set_http_auth_handler_factory(
       globals->http_auth_handler_factory.get());
   context->set_proxy_service(globals->proxy_script_fetcher_proxy_service.get());
   context->set_http_transaction_factory(
       globals->proxy_script_fetcher_http_transaction_factory.get());
   context->set_job_factory(
       globals->proxy_script_fetcher_url_request_job_factory.get());
   context->set_cookie_store(globals->system_cookie_store.get());
   context->set_server_bound_cert_service(
       globals->system_server_bound_cert_service.get());
   context->set_network_delegate(globals->system_network_delegate.get());
   context->set_http_user_agent_settings(
       globals->http_user_agent_settings.get());
   // TODO(rtenneti): We should probably use HttpServerPropertiesManager for the
   // system URLRequestContext too. There's no reason this should be tied to a
   // profile.
   return context;
 }
 
 net::URLRequestContext*
 ConstructSystemRequestContext(IOThread::Globals* globals,
                               net::NetLog* net_log) {
   net::URLRequestContext* context = new SystemURLRequestContext;
   context->set_net_log(net_log);
   context->set_host_resolver(globals->host_resolver.get());
   context->set_cert_verifier(globals->cert_verifier.get());
   context->set_transport_security_state(
       globals->transport_security_state.get());
+  context->set_cert_transparency_verifier(
+      globals->cert_transparency_verifier.get());
   context->set_http_auth_handler_factory(
       globals->http_auth_handler_factory.get());
   context->set_proxy_service(globals->system_proxy_service.get());
   context->set_http_transaction_factory(
       globals->system_http_transaction_factory.get());
   context->set_cookie_store(globals->system_cookie_store.get());
   context->set_server_bound_cert_service(
       globals->system_server_bound_cert_service.get());
   context->set_throttler_manager(globals->throttler_manager.get());
   context->set_network_delegate(globals->system_network_delegate.get());
@@ skipping 275 matching lines @@
                                 &system_enable_referrers_);
   if (command_line.HasSwitch(switches::kEnableClientHints))
     network_delegate->SetEnableClientHints();
   if (command_line.HasSwitch(switches::kDisableExtensionsHttpThrottling))
     network_delegate->NeverThrottleRequests();
   globals_->system_network_delegate.reset(network_delegate);
   globals_->host_resolver = CreateGlobalHostResolver(net_log_);
   UpdateDnsClientEnabled();
   globals_->cert_verifier.reset(net::CertVerifier::CreateDefault());
   globals_->transport_security_state.reset(new net::TransportSecurityState());
+#if !defined(USE_OPENSSL)
+  // For now, Certificate Transparency is only implemented for platforms
+  // that use NSS.
+  net::MultiLogCTVerifier* ct_verifier = new net::MultiLogCTVerifier();
+  globals_->cert_transparency_verifier.reset(ct_verifier);
+  // Add built-in logs
+  base::StringPiece google_pilot_log_key(
+      net::kGooglePilotLogKey, net::kGooglePilotLogKeyLength);
+  scoped_ptr<net::CTLogVerifier> google_pilot_log(
+      net::CTLogVerifier::Create(
+        google_pilot_log_key, net::kGooglePilotLogName));
+  ct_verifier->AddLog(google_pilot_log.Pass());
+
+  base::StringPiece google_test_log_key(
+      net::kGoogleTestLogKey, net::kGoogleTestLogKeyLength);
+  scoped_ptr<net::CTLogVerifier> google_test_log(
+      net::CTLogVerifier::Create(
+        google_test_log_key, net::kGoogleTestLogName));
+  ct_verifier->AddLog(google_test_log.Pass());
+#endif
   globals_->ssl_config_service = GetSSLConfigService();
 #if defined(OS_ANDROID) || defined(OS_IOS)
   if (DataReductionProxySettings::IsDataReductionProxyAllowed()) {
     spdyproxy_auth_origins_ =
         DataReductionProxySettings::GetDataReductionProxies();
   }
 #endif  // defined(OS_ANDROID) || defined(OS_IOS)
+#if !defined(USE_OPENSSL)
+  if (command_line.HasSwitch(switches::kCertificateTransparencyLog)) {
+    std::string switch_value = command_line.GetSwitchValueASCII(
+        switches::kCertificateTransparencyLog);
+    size_t delim_pos = switch_value.find(":");
+    if (delim_pos == std::string::npos) {
+      LOG(DFATAL) << "CT log description not provided (switch format" <<
+                  " is 'description:base64_key')";

[Ryan Sleevi, 2013/11/25 06:49:31]

The DFATAL seems inappropriate here. The people most likely to get it wrong are
end users, and this won't really do anything special.

It seems like there are two possible behaviours here for invalid switches:
1) Ignore; fall back to default log. Let this be surfaced through net-internals,
and if logged, always at a LOG(ERROR).
2) Crash (aka CHECK), so indicate they've supplied the wrong value.

[Eran M. (Google), 2013/11/25 17:18:33]

I thought DFATAL crashes? 

+    }
+    std::string log_description(switch_value.substr(0, delim_pos));
+    std::string ct_public_key_data;
+    if (!base::Base64Decode(switch_value.substr(delim_pos + 1),
+                            &ct_public_key_data)) {
+      LOG(DFATAL) << "Unable to decode CT public key.";
+    } else {
+      scoped_ptr<net::CTLogVerifier> external_log_verifier(
+          net::CTLogVerifier::Create(ct_public_key_data, log_description));
+      if (!external_log_verifier) {
+        LOG(DFATAL) << "Unable to parse CT public key.";
+      } else {
+        LOG(INFO) << "Using Certificate Transparency log: " << log_description;

[Ryan Sleevi, 2013/11/25 06:49:31]

There's a push against LOG(INFO) in Chrome code, and reasonably so. Since this
is (or is going to be) surfaced through chrome://net-internals, let's drop this
entirely.

[Eran M. (Google), 2013/11/25 17:18:33]

Done.

+        ct_verifier->AddLog(external_log_verifier.Pass());
+      }
+    }
+  }
+#else
+  if (command_line.HasSwitch(switches::kCertificateTransparencyLog)) {
+    LOG(DFATAL) << "Certificate Transparency is not yet supported in Chrome "
+                << "builds using OpenSSL".
+  }
+#endif
   globals_->http_auth_handler_factory.reset(CreateDefaultAuthHandlerFactory(
       globals_->host_resolver.get()));
   globals_->http_server_properties.reset(new net::HttpServerPropertiesImpl());
   // For the ProxyScriptFetcher, we use a direct ProxyService.
   globals_->proxy_script_fetcher_proxy_service.reset(
       net::ProxyService::CreateDirectWithNetLog(net_log_));
   // In-memory cookie store.
   globals_->system_cookie_store = new net::CookieMonster(NULL, NULL);
   // In-memory server bound cert store.
   globals_->system_server_bound_cert_service.reset(
@@ skipping 481 matching lines @@
   if (command_line.HasSwitch(switches::kDisableQuicHttps))
     return false;
 
   if (command_line.HasSwitch(switches::kEnableQuicHttps))
     return true;
 
   // HTTPS over QUIC should only be enabled if we are in the https
   // field trial group.
   return quic_trial_group == kQuicFieldTrialHttpsEnabledGroupName;
 }