OLD | NEW |
| (Empty) |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 // TransportSecurityState maintains an in memory database containing the | |
6 // list of hosts that currently have transport security enabled. This | |
7 // singleton object deals with writing that data out to disk as needed and | |
8 // loading it at startup. | |
9 | |
10 // At startup we need to load the transport security state from the | |
11 // disk. For the moment, we don't want to delay startup for this load, so we | |
12 // let the TransportSecurityState run for a while without being loaded. | |
13 // This means that it's possible for pages opened very quickly not to get the | |
14 // correct transport security information. | |
15 // | |
16 // To load the state, we schedule a Task on background_runner, which | |
17 // deserializes and configures the TransportSecurityState. | |
18 // | |
19 // The TransportSecurityState object supports running a callback function | |
20 // when it changes. This object registers the callback, pointing at itself. | |
21 // | |
22 // TransportSecurityState calls... | |
23 // TransportSecurityPersister::StateIsDirty | |
24 // since the callback isn't allowed to block or reenter, we schedule a Task | |
25 // on the file task runner after some small amount of time | |
26 // | |
27 // ... | |
28 // | |
29 // TransportSecurityPersister::SerializeState | |
30 // copies the current state of the TransportSecurityState, serializes | |
31 // and writes to disk. | |
32 | |
33 #ifndef NET_HTTP_TRANSPORT_SECURITY_PERSISTER_H_ | |
34 #define NET_HTTP_TRANSPORT_SECURITY_PERSISTER_H_ | |
35 | |
36 #include <string> | |
37 | |
38 #include "base/files/file_path.h" | |
39 #include "base/files/important_file_writer.h" | |
40 #include "base/memory/ref_counted.h" | |
41 #include "base/memory/weak_ptr.h" | |
42 #include "net/base/net_export.h" | |
43 #include "net/http/transport_security_state.h" | |
44 | |
45 namespace base { | |
46 class SequencedTaskRunner; | |
47 } | |
48 | |
49 namespace net { | |
50 | |
51 // Reads and updates on-disk TransportSecurity state. Clients of this class | |
52 // should create, destroy, and call into it from one thread. | |
53 // | |
54 // background_runner is the task runner this class should use internally to | |
55 // perform file IO, and can optionally be associated with a different thread. | |
56 class NET_EXPORT TransportSecurityPersister | |
57 : public TransportSecurityState::Delegate, | |
58 public base::ImportantFileWriter::DataSerializer { | |
59 public: | |
60 TransportSecurityPersister( | |
61 TransportSecurityState* state, | |
62 const base::FilePath& profile_path, | |
63 const scoped_refptr<base::SequencedTaskRunner>& background_runner, | |
64 bool readonly); | |
65 ~TransportSecurityPersister() override; | |
66 | |
67 // Called by the TransportSecurityState when it changes its state. | |
68 void StateIsDirty(TransportSecurityState*) override; | |
69 | |
70 // ImportantFileWriter::DataSerializer: | |
71 // | |
72 // Serializes |transport_security_state_| into |*output|. Returns true if | |
73 // all DomainStates were serialized correctly. | |
74 // | |
75 // The serialization format is JSON; the JSON represents a dictionary of | |
76 // host:DomainState pairs (host is a string). The DomainState is | |
77 // represented as a dictionary containing the following keys and value | |
78 // types (not all keys will always be present): | |
79 // | |
80 // "sts_include_subdomains": true|false | |
81 // "pkp_include_subdomains": true|false | |
82 // "created": double | |
83 // "expiry": double | |
84 // "dynamic_spki_hashes_expiry": double | |
85 // "mode": "default"|"force-https" | |
86 // legacy value synonyms "strict" = "force-https" | |
87 // "pinning-only" = "default" | |
88 // legacy value "spdy-only" is unused and ignored | |
89 // "static_spki_hashes": list of strings | |
90 // legacy key synonym "preloaded_spki_hashes" | |
91 // "bad_static_spki_hashes": list of strings | |
92 // legacy key synonym "bad_preloaded_spki_hashes" | |
93 // "dynamic_spki_hashes": list of strings | |
94 // | |
95 // The JSON dictionary keys are strings containing | |
96 // Base64(SHA256(TransportSecurityState::CanonicalizeHost(domain))). | |
97 // The reason for hashing them is so that the stored state does not | |
98 // trivially reveal a user's browsing history to an attacker reading the | |
99 // serialized state on disk. | |
100 bool SerializeData(std::string* data) override; | |
101 | |
102 // Clears any existing non-static entries, and then re-populates | |
103 // |transport_security_state_|. | |
104 // | |
105 // Sets |*dirty| to true if the new state differs from the persisted | |
106 // state; false otherwise. | |
107 bool LoadEntries(const std::string& serialized, bool* dirty); | |
108 | |
109 private: | |
110 // Populates |state| from the JSON string |serialized|. Returns true if | |
111 // all entries were parsed and deserialized correctly. | |
112 // | |
113 // Sets |*dirty| to true if the new state differs from the persisted | |
114 // state; false otherwise. | |
115 static bool Deserialize(const std::string& serialized, | |
116 bool* dirty, | |
117 TransportSecurityState* state); | |
118 | |
119 void CompleteLoad(const std::string& state); | |
120 | |
121 TransportSecurityState* transport_security_state_; | |
122 | |
123 // Helper for safely writing the data. | |
124 base::ImportantFileWriter writer_; | |
125 | |
126 scoped_refptr<base::SequencedTaskRunner> foreground_runner_; | |
127 scoped_refptr<base::SequencedTaskRunner> background_runner_; | |
128 | |
129 // Whether or not we're in read-only mode. | |
130 const bool readonly_; | |
131 | |
132 base::WeakPtrFactory<TransportSecurityPersister> weak_ptr_factory_; | |
133 | |
134 DISALLOW_COPY_AND_ASSIGN(TransportSecurityPersister); | |
135 }; | |
136 | |
137 } // namespace net | |
138 | |
139 #endif // NET_HTTP_TRANSPORT_SECURITY_PERSISTER_H_ | |
OLD | NEW |