chrome_ct_policy_enforcer.h 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_CHROME_CT_POLICY_ENFORCER_H_
  5. #define COMPONENTS_CERTIFICATE_TRANSPARENCY_CHROME_CT_POLICY_ENFORCER_H_
  6. #include <map>
  7. #include <string>
  8. #include <utility>
  9. #include <vector>
  10. #include "base/component_export.h"
  11. #include "base/gtest_prod_util.h"
  12. #include "base/memory/raw_ptr.h"
  13. #include "base/time/clock.h"
  14. #include "base/time/time.h"
  15. #include "net/cert/ct_policy_enforcer.h"
  16. #include "third_party/abseil-cpp/absl/types/optional.h"
  17. namespace certificate_transparency {
  18. struct COMPONENT_EXPORT(CERTIFICATE_TRANSPARENCY) OperatorHistoryEntry {
  19. // Name of the current operator for the log.
  20. std::string current_operator_;
  21. // Vector of previous operators (if any) for the log, represented as pairs of
  22. // operator name and time when they stopped operating the log.
  23. std::vector<std::pair<std::string, base::Time>> previous_operators_;
  24. OperatorHistoryEntry();
  25. ~OperatorHistoryEntry();
  26. OperatorHistoryEntry(const OperatorHistoryEntry& other);
  27. };
  28. // A CTPolicyEnforcer that enforces the "Certificate Transparency in Chrome"
  29. // policies detailed at
  30. // https://github.com/chromium/ct-policy/blob/master/ct_policy.md
  31. //
  32. // This should only be used when there is a reliable, rapid update mechanism
  33. // for the set of known, qualified logs - either through a reliable binary
  34. // updating mechanism or through out-of-band delivery. See
  35. // //net/docs/certificate-transparency.md for more details.
  36. class COMPONENT_EXPORT(CERTIFICATE_TRANSPARENCY) ChromeCTPolicyEnforcer
  37. : public net::CTPolicyEnforcer {
  38. public:
  39. // |logs| is a list of Certificate Transparency logs. Data about each log is
  40. // needed to apply Chrome's policies. |disqualified_logs| is a map of log ID
  41. // to disqualification date. |operated_by_google_logs| is a list of log IDs
  42. // operated by Google. (Log IDs are the SHA-256 hash of the log's DER-encoded
  43. // SubjectPublicKeyInfo.) |log_list_date| is the time at which the other two
  44. // arguments were generated. Both lists of logs must be sorted by log ID.
  45. ChromeCTPolicyEnforcer(
  46. base::Time log_list_date,
  47. std::vector<std::pair<std::string, base::Time>> disqualified_logs,
  48. std::vector<std::string> operated_by_google_logs,
  49. std::map<std::string, OperatorHistoryEntry> log_operator_history);
  50. ~ChromeCTPolicyEnforcer() override;
  51. net::ct::CTPolicyCompliance CheckCompliance(
  52. net::X509Certificate* cert,
  53. const net::ct::SCTList& verified_scts,
  54. const net::NetLogWithSource& net_log) override;
  55. // Updates the list of logs used for compliance checks. |disqualified_logs| is
  56. // a map of log ID to disqualification date. |operated_by_google_logs| is a
  57. // list of log IDs operated by Google
  58. void UpdateCTLogList(
  59. base::Time update_time,
  60. std::vector<std::pair<std::string, base::Time>> disqualified_logs,
  61. std::vector<std::string> operated_by_google_logs,
  62. std::map<std::string, OperatorHistoryEntry> log_operator_history);
  63. void SetClockForTesting(const base::Clock* clock) { clock_ = clock; }
  64. // TODO(https://crbug.com/999240): These are exposed to allow end-to-end
  65. // testing by higher layers (i.e. that the ChromeCTPolicyEnforcer is
  66. // correctly constructed). When either this issue or https://crbug.com/848277
  67. // are fixed, the configuration can be tested independently, and these can
  68. // be removed.
  69. const std::vector<std::string>& operated_by_google_logs_for_testing() {
  70. return operated_by_google_logs_;
  71. }
  72. const std::vector<std::pair<std::string, base::Time>>&
  73. disqualified_logs_for_testing() {
  74. return disqualified_logs_;
  75. }
  76. const std::map<std::string, OperatorHistoryEntry>&
  77. operator_history_for_testing() {
  78. return log_operator_history_;
  79. }
  80. void SetCTLogListAlwaysTimelyForTesting(bool always_timely) {
  81. ct_log_list_always_timely_for_testing_ = always_timely;
  82. }
  83. void SetOperatorHistoryForTesting(
  84. std::map<std::string, OperatorHistoryEntry> log_operator_history) {
  85. log_operator_history_ = std::move(log_operator_history);
  86. }
  87. void SetValidGoogleLogForTesting(const std::string& google_log) {
  88. valid_google_log_for_testing_ = google_log;
  89. }
  90. void SetDisqualifiedLogForTesting(
  91. const std::pair<std::string, base::Time>& disqualified_log) {
  92. disqualified_log_for_testing_ = disqualified_log;
  93. }
  94. private:
  95. FRIEND_TEST_ALL_PREFIXES(ChromeCTPolicyEnforcerTestBothPolicies,
  96. IsLogDisqualifiedTimestamp);
  97. FRIEND_TEST_ALL_PREFIXES(ChromeCTPolicyEnforcerTestBothPolicies,
  98. IsLogDisqualifiedReturnsFalseOnUnknownLog);
  99. // Returns true if the log identified by |log_id| (the SHA-256 hash of the
  100. // log's DER-encoded SPKI) has been disqualified, and sets
  101. // |*disqualification_date| to the date of disqualification. Any SCTs that
  102. // are embedded in certificates issued after |*disqualification_date| should
  103. // not be trusted, nor contribute to any uniqueness or freshness
  104. bool IsLogDisqualified(base::StringPiece log_id,
  105. base::Time* disqualification_date) const;
  106. // Returns true if the log identified by |log_id| (the SHA-256 hash of the
  107. // log's DER-encoded SPKI) is operated by Google.
  108. bool IsLogOperatedByGoogle(base::StringPiece log_id) const;
  109. // Returns true if the supplied log data are fresh enough.
  110. bool IsLogDataTimely() const;
  111. net::ct::CTPolicyCompliance CheckCTPolicyCompliance(
  112. const net::X509Certificate& cert,
  113. const net::ct::SCTList& verified_scts) const;
  114. std::string GetOperatorForLog(std::string log_id, base::Time timestamp) const;
  115. // Map of SHA-256(SPKI) to log disqualification date.
  116. std::vector<std::pair<std::string, base::Time>> disqualified_logs_;
  117. // List of SHA-256(SPKI) for logs operated by Google.
  118. std::vector<std::string> operated_by_google_logs_;
  119. std::map<std::string, OperatorHistoryEntry> log_operator_history_;
  120. raw_ptr<const base::Clock> clock_;
  121. // The time at which |disqualified_logs_| and |operated_by_google_logs_| were
  122. // generated.
  123. base::Time log_list_date_;
  124. // If set, the CT log list will be considered timely regardless of its last
  125. // update time.
  126. bool ct_log_list_always_timely_for_testing_ = false;
  127. // If set, this log ID will be considered a valid, Google operated log.
  128. // Calling UpdateCTLogList clears this value if set.
  129. absl::optional<std::string> valid_google_log_for_testing_;
  130. // If set, this log ID will be considered a disqualified log, effective at the
  131. // specified time.
  132. // Calling UpdateCTLogList clears this value if set.
  133. absl::optional<std::pair<std::string, base::Time>>
  134. disqualified_log_for_testing_;
  135. };
  136. } // namespace certificate_transparency
  137. #endif // COMPONENTS_CERTIFICATE_TRANSPARENCY_CHROME_CT_POLICY_ENFORCER_H_