Block port 443 for all protocols other than HTTPS or WSS.

net/base/net_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/net_util.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <algorithm>
@@ skipping 89 matching lines @@
   113,  // auth
   115,  // sftp
   117,  // uucp-path
   119,  // nntp
   123,  // NTP
   135,  // loc-srv /epmap
   139,  // netbios
   143,  // imap2
   179,  // BGP
   389,  // ldap
+  443,  // https / wss (see https://crbug.com/436451)
   465,  // smtp+ssl
   512,  // print / exec
   513,  // login
   514,  // shell
   515,  // printer
   526,  // tempo
   530,  // courier
   531,  // chat
   532,  // netnews
   540,  // uucp
   556,  // remotefs
   563,  // nntp+ssl
   587,  // stmp?
   601,  // ??
   636,  // ldap+ssl
   993,  // ldap+ssl
   995,  // pop3+ssl

[mmenke, 2014/12/05 21:44:40]

Per discussion on the bug, wonder if we should be more aggressive here, and just
prohibit all ports from 0 to 1024 (1 to 1023?), except for ports explicitly
assigned to the protocol we're checking.

[davidben, 2014/12/05 21:48:07]

That would probably break stuff. I know of at least one deployment that uses
https://blah:444/.

[mmenke, 2014/12/05 21:54:29]

We could have a "This link is in direct violation of RFC 3986, section 7.2."
interstitial, with a "Report violation to the FBI" link.  :)

   2049, // nfs
   3659, // apple-sasl / PasswordServer
   4045, // lockd
   6000, // X11
   6665, // Alternate IRC [Apple addition]
   6666, // Alternate IRC [Apple addition]
   6667, // Standard IRC [Apple addition]
   6668, // Alternate IRC [Apple addition]
   6669, // Alternate IRC [Apple addition]
   0xFFFF, // Used to block all invalid port numbers (see
           // third_party/WebKit/Source/platform/weborigin/KURL.cpp,
           // KURL::port())
 };
 
 // FTP overrides the following restricted ports.
 static const int kAllowedFtpPorts[] = {
   21,   // ftp data
   22,   // ssh
 };
 
+// HTTPS and WSS override the following restricted port.
+static const int kAllowedHttpsOrWssPorts[] = {
+  443,  // https / wss
+};
+
 bool IPNumberPrefixCheck(const IPAddressNumber& ip_number,
                          const unsigned char* ip_prefix,
                          size_t prefix_length_in_bits) {
   // Compare all the bytes that fall entirely within the prefix.
   int num_entire_bytes_in_prefix = prefix_length_in_bits / 8;
   for (int i = 0; i < num_entire_bytes_in_prefix; ++i) {
     if (ip_number[i] != ip_prefix[i])
       return false;
   }
 
@@ skipping 156 matching lines @@
   int array_size = arraysize(kAllowedFtpPorts);
   for (int i = 0; i < array_size; i++) {
     if (kAllowedFtpPorts[i] == port) {
         return true;
     }
   }
   // Port not explicitly allowed by FTP, so return the default restrictions.
   return IsPortAllowedByDefault(port);
 }
 
+bool IsPortAllowedByHttpsOrWss(int port) {
+  int array_size = arraysize(kAllowedHttpsOrWssPorts);

[PhistucK, 2014/12/05 09:02:30]

Just a drive by -
Should this (and similar cases) be size_t instead?

+  for (int i = 0; i < array_size; i++) {
+    if (kAllowedHttpsOrWssPorts[i] == port) {
+        return true;

[mmenke, 2014/12/05 21:44:40]

Indent here is wrong.

+    }
+  }
+  // Port not explicitly allowed by HTTPS or WSS, so return the default
+  // restrictions.
+  return IsPortAllowedByDefault(port);
+}
+
+bool IsEffectivePortAllowedByScheme(const GURL& url) {
+  int port = url.EffectiveIntPort();
+  if (url.SchemeIs("ftp")) {
+    return IsPortAllowedByFtp(port);
+  } else if (url.SchemeIs("https") || url.SchemeIs("wss")) {
+    return IsPortAllowedByHttpsOrWss(port);
+  } else {
+    return IsPortAllowedByDefault(port);
+  }
+}
+
 bool IsPortAllowedByOverride(int port) {
   if (g_explicitly_allowed_ports.Get().empty())
     return false;
 
   return g_explicitly_allowed_ports.Get().count(port) > 0;
 }
 
 int SetNonBlocking(int fd) {
 #if defined(OS_WIN)
   unsigned long no_block = 1;
@@ skipping 723 matching lines @@
 
 unsigned MaskPrefixLength(const IPAddressNumber& mask) {
   IPAddressNumber all_ones(mask.size(), 0xFF);
   return CommonPrefixLength(mask, all_ones);
 }
 
 ScopedWifiOptions::~ScopedWifiOptions() {
 }
 
 }  // namespace net