| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | |
| 6 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | |
| 7 | |
| 8 #include <map> | |
| 9 #include <string> | |
| 10 #include <utility> | |
| 11 #include <vector> | |
| 12 | |
| 13 #include "base/basictypes.h" | |
| 14 #include "base/gtest_prod_util.h" | |
| 15 #include "base/threading/non_thread_safe.h" | |
| 16 #include "base/time/time.h" | |
| 17 #include "net/base/net_export.h" | |
| 18 #include "net/cert/x509_cert_types.h" | |
| 19 #include "net/cert/x509_certificate.h" | |
| 20 | |
| 21 namespace net { | |
| 22 | |
| 23 class SSLInfo; | |
| 24 | |
| 25 // Tracks which hosts have enabled strict transport security and/or public | |
| 26 // key pins. | |
| 27 // | |
| 28 // This object manages the in-memory store. Register a Delegate with | |
| 29 // |SetDelegate| to persist the state to disk. | |
| 30 // | |
| 31 // HTTP strict transport security (HSTS) is defined in | |
| 32 // http://tools.ietf.org/html/ietf-websec-strict-transport-sec, and | |
| 33 // HTTP-based dynamic public key pinning (HPKP) is defined in | |
| 34 // http://tools.ietf.org/html/ietf-websec-key-pinning. | |
| 35 class NET_EXPORT TransportSecurityState | |
| 36 : NON_EXPORTED_BASE(public base::NonThreadSafe) { | |
| 37 public: | |
| 38 class NET_EXPORT Delegate { | |
| 39 public: | |
| 40 // This function may not block and may be called with internal locks held. | |
| 41 // Thus it must not reenter the TransportSecurityState object. | |
| 42 virtual void StateIsDirty(TransportSecurityState* state) = 0; | |
| 43 | |
| 44 protected: | |
| 45 virtual ~Delegate() {} | |
| 46 }; | |
| 47 | |
| 48 TransportSecurityState(); | |
| 49 ~TransportSecurityState(); | |
| 50 | |
| 51 // A DomainState describes the transport security state (required upgrade | |
| 52 // to HTTPS, and/or any public key pins). | |
| 53 // | |
| 54 // TODO(davidben): STSState and PKPState are queried and processed | |
| 55 // independently (with the exception of ShouldSSLErrorsBeFatal triggering on | |
| 56 // both and on-disk storage). DomainState should be split into the two. | |
| 57 class NET_EXPORT DomainState { | |
| 58 public: | |
| 59 enum UpgradeMode { | |
| 60 // These numbers must match those in hsts_view.js, function modeToString. | |
| 61 MODE_FORCE_HTTPS = 0, | |
| 62 MODE_DEFAULT = 1, | |
| 63 }; | |
| 64 | |
| 65 DomainState(); | |
| 66 ~DomainState(); | |
| 67 | |
| 68 struct STSState { | |
| 69 STSState(); | |
| 70 ~STSState(); | |
| 71 | |
| 72 // The absolute time (UTC) when the |upgrade_mode| (and other state) was | |
| 73 // observed. | |
| 74 base::Time last_observed; | |
| 75 | |
| 76 // The absolute time (UTC) when the |upgrade_mode|, if set to | |
| 77 // MODE_FORCE_HTTPS, downgrades to MODE_DEFAULT. | |
| 78 base::Time expiry; | |
| 79 | |
| 80 UpgradeMode upgrade_mode; | |
| 81 | |
| 82 // Are subdomains subject to this policy state? | |
| 83 bool include_subdomains; | |
| 84 | |
| 85 // The domain which matched during a search for this DomainState entry. | |
| 86 // Updated by |GetDynamicDomainState| and |GetStaticDomainState|. | |
| 87 std::string domain; | |
| 88 }; | |
| 89 | |
| 90 struct PKPState { | |
| 91 PKPState(); | |
| 92 ~PKPState(); | |
| 93 | |
| 94 // The absolute time (UTC) when the |spki_hashes| (and other state) were | |
| 95 // observed. | |
| 96 base::Time last_observed; | |
| 97 | |
| 98 // The absolute time (UTC) when the |spki_hashes| expire. | |
| 99 base::Time expiry; | |
| 100 | |
| 101 // Optional; hashes of pinned SubjectPublicKeyInfos. | |
| 102 HashValueVector spki_hashes; | |
| 103 | |
| 104 // Optional; hashes of static known-bad SubjectPublicKeyInfos which MUST | |
| 105 // NOT intersect with the set of SPKIs in the TLS server's certificate | |
| 106 // chain. | |
| 107 HashValueVector bad_spki_hashes; | |
| 108 | |
| 109 // Are subdomains subject to this policy state? | |
| 110 bool include_subdomains; | |
| 111 | |
| 112 // The domain which matched during a search for this DomainState entry. | |
| 113 // Updated by |GetDynamicDomainState| and |GetStaticDomainState|. | |
| 114 std::string domain; | |
| 115 }; | |
| 116 | |
| 117 // Takes a set of SubjectPublicKeyInfo |hashes| and returns true if: | |
| 118 // 1) |bad_static_spki_hashes| does not intersect |hashes|; AND | |
| 119 // 2) Both |static_spki_hashes| and |dynamic_spki_hashes| are empty | |
| 120 // or at least one of them intersects |hashes|. | |
| 121 // | |
| 122 // |{dynamic,static}_spki_hashes| contain trustworthy public key hashes, | |
| 123 // any one of which is sufficient to validate the certificate chain in | |
| 124 // question. The public keys could be of a root CA, intermediate CA, or | |
| 125 // leaf certificate, depending on the security vs. disaster recovery | |
| 126 // tradeoff selected. (Pinning only to leaf certifiates increases | |
| 127 // security because you no longer trust any CAs, but it hampers disaster | |
| 128 // recovery because you can't just get a new certificate signed by the | |
| 129 // CA.) | |
| 130 // | |
| 131 // |bad_static_spki_hashes| contains public keys that we don't want to | |
| 132 // trust. | |
| 133 bool CheckPublicKeyPins(const HashValueVector& hashes, | |
| 134 std::string* failure_log) const; | |
| 135 | |
| 136 // Returns true if any of the HashValueVectors |static_spki_hashes|, | |
| 137 // |bad_static_spki_hashes|, or |dynamic_spki_hashes| contains any | |
| 138 // items. | |
| 139 bool HasPublicKeyPins() const; | |
| 140 | |
| 141 // ShouldUpgradeToSSL returns true iff HTTP requests should be internally | |
| 142 // redirected to HTTPS (also if WS should be upgraded to WSS). | |
| 143 bool ShouldUpgradeToSSL() const; | |
| 144 | |
| 145 // ShouldSSLErrorsBeFatal returns true iff HTTPS errors should cause | |
| 146 // hard-fail behavior (e.g. if HSTS is set for the domain). | |
| 147 bool ShouldSSLErrorsBeFatal() const; | |
| 148 | |
| 149 STSState sts; | |
| 150 PKPState pkp; | |
| 151 }; | |
| 152 | |
| 153 class NET_EXPORT Iterator { | |
| 154 public: | |
| 155 explicit Iterator(const TransportSecurityState& state); | |
| 156 ~Iterator(); | |
| 157 | |
| 158 bool HasNext() const { return iterator_ != end_; } | |
| 159 void Advance() { ++iterator_; } | |
| 160 const std::string& hostname() const { return iterator_->first; } | |
| 161 const DomainState& domain_state() const { return iterator_->second; } | |
| 162 | |
| 163 private: | |
| 164 std::map<std::string, DomainState>::const_iterator iterator_; | |
| 165 std::map<std::string, DomainState>::const_iterator end_; | |
| 166 }; | |
| 167 | |
| 168 // These functions search for static and dynamic DomainStates, and invoke the | |
| 169 // functions of the same name on them. These functions are the primary public | |
| 170 // interface; direct access to DomainStates is best left to tests. | |
| 171 bool ShouldSSLErrorsBeFatal(const std::string& host); | |
| 172 bool ShouldUpgradeToSSL(const std::string& host); | |
| 173 bool CheckPublicKeyPins(const std::string& host, | |
| 174 bool is_issued_by_known_root, | |
| 175 const HashValueVector& hashes, | |
| 176 std::string* failure_log); | |
| 177 bool HasPublicKeyPins(const std::string& host); | |
| 178 | |
| 179 // Assign a |Delegate| for persisting the transport security state. If | |
| 180 // |NULL|, state will not be persisted. The caller retains | |
| 181 // ownership of |delegate|. | |
| 182 // Note: This is only used for serializing/deserializing the | |
| 183 // TransportSecurityState. | |
| 184 void SetDelegate(Delegate* delegate); | |
| 185 | |
| 186 // Clears all dynamic data (e.g. HSTS and HPKP data). | |
| 187 // | |
| 188 // Does NOT persist changes using the Delegate, as this function is only | |
| 189 // used to clear any dynamic data prior to re-loading it from a file. | |
| 190 // Note: This is only used for serializing/deserializing the | |
| 191 // TransportSecurityState. | |
| 192 void ClearDynamicData(); | |
| 193 | |
| 194 // Inserts |state| into |enabled_hosts_| under the key |hashed_host|. | |
| 195 // |hashed_host| is already in the internal representation | |
| 196 // HashHost(CanonicalizeHost(host)). | |
| 197 // Note: This is only used for serializing/deserializing the | |
| 198 // TransportSecurityState. | |
| 199 void AddOrUpdateEnabledHosts(const std::string& hashed_host, | |
| 200 const DomainState& state); | |
| 201 | |
| 202 // Deletes all dynamic data (e.g. HSTS or HPKP data) created since a given | |
| 203 // time. | |
| 204 // | |
| 205 // If any entries are deleted, the new state will be persisted through | |
| 206 // the Delegate (if any). | |
| 207 void DeleteAllDynamicDataSince(const base::Time& time); | |
| 208 | |
| 209 // Deletes any dynamic data stored for |host| (e.g. HSTS or HPKP data). | |
| 210 // If |host| doesn't have an exact entry then no action is taken. Does | |
| 211 // not delete static (i.e. preloaded) data. Returns true iff an entry | |
| 212 // was deleted. | |
| 213 // | |
| 214 // If an entry is deleted, the new state will be persisted through | |
| 215 // the Delegate (if any). | |
| 216 bool DeleteDynamicDataForHost(const std::string& host); | |
| 217 | |
| 218 // Returns true and updates |*result| iff there is a static (built-in) | |
| 219 // DomainState for |host|. If multiple entries match |host|, the most specific | |
| 220 // match determines the return value. | |
| 221 bool GetStaticDomainState(const std::string& host, DomainState* result) const; | |
| 222 | |
| 223 // Returns true and updates |*result| iff |host| has HSTS or HPKP state (or | |
| 224 // both). The two are queried independently and combined into a single | |
| 225 // DomainState. If multiple HSTS (respectively, HPKP) entries match |host|, | |
| 226 // the most specific match determines the HSTS (respectively, HPKP) portion of | |
| 227 // the return value. | |
| 228 // | |
| 229 // Note that this method is not const because it opportunistically removes | |
| 230 // entries that have expired. | |
| 231 // | |
| 232 // TODO(davidben): STSState and PKPState should be queried independently at | |
| 233 // the API level too. | |
| 234 bool GetDynamicDomainState(const std::string& host, DomainState* result); | |
| 235 | |
| 236 // Processes an HSTS header value from the host, adding entries to | |
| 237 // dynamic state if necessary. | |
| 238 bool AddHSTSHeader(const std::string& host, const std::string& value); | |
| 239 | |
| 240 // Processes an HPKP header value from the host, adding entries to | |
| 241 // dynamic state if necessary. ssl_info is used to check that | |
| 242 // the specified pins overlap with the certificate chain. | |
| 243 bool AddHPKPHeader(const std::string& host, const std::string& value, | |
| 244 const SSLInfo& ssl_info); | |
| 245 | |
| 246 // Adds explicitly-specified data as if it was processed from an | |
| 247 // HSTS header (used for net-internals and unit tests). | |
| 248 void AddHSTS(const std::string& host, | |
| 249 const base::Time& expiry, | |
| 250 bool include_subdomains); | |
| 251 | |
| 252 // Adds explicitly-specified data as if it was processed from an | |
| 253 // HPKP header (used for net-internals and unit tests). | |
| 254 void AddHPKP(const std::string& host, | |
| 255 const base::Time& expiry, | |
| 256 bool include_subdomains, | |
| 257 const HashValueVector& hashes); | |
| 258 | |
| 259 // Returns true iff we have any static public key pins for the |host| and | |
| 260 // iff its set of required pins is the set we expect for Google | |
| 261 // properties. | |
| 262 // | |
| 263 // If |host| matches both an exact entry and is a subdomain of another | |
| 264 // entry, the exact match determines the return value. | |
| 265 static bool IsGooglePinnedProperty(const std::string& host); | |
| 266 | |
| 267 // The maximum number of seconds for which we'll cache an HSTS request. | |
| 268 static const long int kMaxHSTSAgeSecs; | |
| 269 | |
| 270 private: | |
| 271 friend class TransportSecurityStateTest; | |
| 272 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPOnly); | |
| 273 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, UpdateDynamicPKPMaxAge0); | |
| 274 FRIEND_TEST_ALL_PREFIXES(HttpSecurityHeadersTest, NoClobberPins); | |
| 275 | |
| 276 typedef std::map<std::string, DomainState> DomainStateMap; | |
| 277 | |
| 278 // Send an UMA report on pin validation failure, if the host is in a | |
| 279 // statically-defined list of domains. | |
| 280 // | |
| 281 // TODO(palmer): This doesn't really belong here, and should be moved into | |
| 282 // the exactly one call site. This requires unifying |struct HSTSPreload| | |
| 283 // (an implementation detail of this class) with a more generic | |
| 284 // representation of first-class DomainStates, and exposing the preloads | |
| 285 // to the caller with |GetStaticDomainState|. | |
| 286 static void ReportUMAOnPinFailure(const std::string& host); | |
| 287 | |
| 288 // IsBuildTimely returns true if the current build is new enough ensure that | |
| 289 // built in security information (i.e. HSTS preloading and pinning | |
| 290 // information) is timely. | |
| 291 static bool IsBuildTimely(); | |
| 292 | |
| 293 // Helper method for actually checking pins. | |
| 294 bool CheckPublicKeyPinsImpl(const std::string& host, | |
| 295 const HashValueVector& hashes, | |
| 296 std::string* failure_log); | |
| 297 | |
| 298 // If a Delegate is present, notify it that the internal state has | |
| 299 // changed. | |
| 300 void DirtyNotify(); | |
| 301 | |
| 302 // Adds HSTS state to |host|. | |
| 303 void AddHSTSInternal(const std::string& host, | |
| 304 DomainState::UpgradeMode upgrade_mode, | |
| 305 const base::Time& expiry, | |
| 306 bool include_subdomains); | |
| 307 | |
| 308 // Adds HPKP state to |host|. | |
| 309 void AddHPKPInternal(const std::string& host, | |
| 310 const base::Time& last_observed, | |
| 311 const base::Time& expiry, | |
| 312 bool include_subdomains, | |
| 313 const HashValueVector& hashes); | |
| 314 | |
| 315 // Enable TransportSecurity for |host|. |state| supercedes any previous | |
| 316 // state for the |host|, including static entries. | |
| 317 // | |
| 318 // The new state for |host| is persisted using the Delegate (if any). | |
| 319 void EnableHost(const std::string& host, const DomainState& state); | |
| 320 | |
| 321 // Converts |hostname| from dotted form ("www.google.com") to the form | |
| 322 // used in DNS: "\x03www\x06google\x03com", lowercases that, and returns | |
| 323 // the result. | |
| 324 static std::string CanonicalizeHost(const std::string& hostname); | |
| 325 | |
| 326 // The set of hosts that have enabled TransportSecurity. |sts.domain| and | |
| 327 // |pkp.domain| will always be empty for a DomainState in this map; the domain | |
| 328 // comes from the map key instead. | |
| 329 DomainStateMap enabled_hosts_; | |
| 330 | |
| 331 Delegate* delegate_; | |
| 332 | |
| 333 // True if static pins should be used. | |
| 334 bool enable_static_pins_; | |
| 335 | |
| 336 DISALLOW_COPY_AND_ASSIGN(TransportSecurityState); | |
| 337 }; | |
| 338 | |
| 339 } // namespace net | |
| 340 | |
| 341 #endif // NET_HTTP_TRANSPORT_SECURITY_STATE_H_ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master