net: implement the beginnings of HSTS pinning

net: implement the beginnings of HSTS pinning

(Based on a patch by Chris Evans.)

Doesn't yet actually get the information from the HSTS header, but all the
infrastructure is in place.

BUG=none
TEST=none

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=81584

[agl, 2011-04-13 20:26:08]

There are three places where the format of the pins appears:

1) Our JSON database
2) The HSTS UI
3) The HSTS header

(1) doesn't matter to the world and since we already have base64 values in
there, I used base64 again.

(2) should probably match (3) and, since keeping headers small is important, I
used base64 again. I suspect that this will have to change in the future though.

[Chris Evans, 2011-04-13 21:26:34]

Thx! Mostly nits...

http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
File chrome/browser/ui/webui/net_internals_ui.cc (right):

http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
chrome/browser/ui/webui/net_internals_ui.cc:1077: hashes_str += ",";
I'd be inclined to use JoinString instead of doing it manually.

http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
chrome/browser/ui/webui/net_internals_ui.cc:1122: i = type_and_b64s.begin(); i
!= type_and_b64s.end(); i++) {
Nit: I must admit ignorance to what the style guide says in this case of
80-character for loop overflow, but it reads differently to what I've seen
elsewhere.

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
File net/base/transport_security_state.cc (right):

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
net/base/transport_security_state.cc:324: std::string
hash_str(reinterpret_cast<const char*>(j->data),
I think const_cast might work in this case?

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
net/base/transport_security_state.cc:369: ListValue* pins_list;
Optional: we don't need to, but intializing to NULL might prevent some
hypothetical future linter from complaining.

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
net/base/transport_security_state.cc:385: }
Perhaps add a TODO here, e.g. "consider whether we should drop the whole entry
if we fail to parse a cert pin list"

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
File net/url_request/url_request_http_job.cc (right):

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
net/url_request/url_request_http_job.cc:656: // Take care of any mandates for
certificate locking.
Did you want to add a TODO to take care of the *.example.com connection reuse
vs. foo.example.com SNI situation?

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
net/url_request/url_request_http_job.cc:665: false /* pretend that SNI isn't
available */) &&
You can just use the new static method IsSNIAvailable(context_)

[Chris Evans, 2011-04-14 00:07:11]

On 2011/04/13 21:26:34, Chris Evans wrote:
> Thx! Mostly nits...
> 
>
http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
> File chrome/browser/ui/webui/net_internals_ui.cc (right):
> 
>
http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
> chrome/browser/ui/webui/net_internals_ui.cc:1077: hashes_str += ",";
> I'd be inclined to use JoinString instead of doing it manually.
> 
>
http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
> chrome/browser/ui/webui/net_internals_ui.cc:1122: i = type_and_b64s.begin(); i
> != type_and_b64s.end(); i++) {
> Nit: I must admit ignorance to what the style guide says in this case of
> 80-character for loop overflow, but it reads differently to what I've seen
> elsewhere.
> 
>
http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
> File net/base/transport_security_state.cc (right):
> 
>
http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
> net/base/transport_security_state.cc:324: std::string
> hash_str(reinterpret_cast<const char*>(j->data),
> I think const_cast might work in this case?
> 
>
http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
> net/base/transport_security_state.cc:369: ListValue* pins_list;
> Optional: we don't need to, but intializing to NULL might prevent some
> hypothetical future linter from complaining.
> 
>
http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
> net/base/transport_security_state.cc:385: }
> Perhaps add a TODO here, e.g. "consider whether we should drop the whole entry
> if we fail to parse a cert pin list"
> 
>
http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
> File net/url_request/url_request_http_job.cc (right):
> 
>
http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
> net/url_request/url_request_http_job.cc:656: // Take care of any mandates for
> certificate locking.
> Did you want to add a TODO to take care of the *.example.com connection reuse
> vs. http://foo.example.com SNI situation?
> 
>
http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
> net/url_request/url_request_http_job.cc:665: false /* pretend that SNI isn't
> available */) &&
> You can just use the new static method IsSNIAvailable(context_)

BTW, I'm happy to take care of the suggested TODOs.

[Chris Evans, 2011-04-14 02:31:53]

One more comment and one style nit.

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
File net/url_request/url_request_http_job.cc (right):

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
net/url_request/url_request_http_job.cc:659: ssl_info.is_valid() &&
Ah, did you want to check your new flag is_issued_by_known_root here?

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
net/url_request/url_request_http_job.cc:666:
!domain_state.IsChainOfPublicKeysPermitted(ssl_info.public_key_hashes)){
Nit: missing space after )

[Chris Evans, 2011-04-14 04:02:29]

One final thing. LGTM with the various nits and questions fixed; feel free to
TODO any of them and I can take care of them.

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
File net/base/transport_security_state.cc (right):

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
net/base/transport_security_state.cc:578: }
If we get here, please LOG(ERROR) a string of the concatenation of the incoming
"hashes". It's really useful.

[agl, 2011-04-14 14:31:51]

http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
File chrome/browser/ui/webui/net_internals_ui.cc (right):

http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
chrome/browser/ui/webui/net_internals_ui.cc:1077: hashes_str += ",";
On 2011/04/13 21:26:34, Chris Evans wrote:
> I'd be inclined to use JoinString instead of doing it manually.

Done.

http://codereview.chromium.org/6835033/diff/1/chrome/browser/ui/webui/net_int...
chrome/browser/ui/webui/net_internals_ui.cc:1122: i = type_and_b64s.begin(); i
!= type_and_b64s.end(); i++) {
On 2011/04/13 21:26:34, Chris Evans wrote:
> Nit: I must admit ignorance to what the style guide says in this case of
> 80-character for loop overflow, but it reads differently to what I've seen
> elsewhere.

Really too minor to bother with, but I think that moving the "i =" clause up
looks slightly worse. I don't think the style guide says anything about this.

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
File net/base/transport_security_state.cc (right):

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
net/base/transport_security_state.cc:324: std::string
hash_str(reinterpret_cast<const char*>(j->data),
On 2011/04/13 21:26:34, Chris Evans wrote:
> I think const_cast might work in this case?

Sadly not, |data| is an unsigned char.

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
net/base/transport_security_state.cc:369: ListValue* pins_list;
On 2011/04/13 21:26:34, Chris Evans wrote:
> Optional: we don't need to, but intializing to NULL might prevent some
> hypothetical future linter from complaining.

Done.

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
net/base/transport_security_state.cc:385: }
On 2011/04/13 21:26:34, Chris Evans wrote:
> Perhaps add a TODO here, e.g. "consider whether we should drop the whole entry
> if we fail to parse a cert pin list"

Hmm. We might add hashes in the future and they would fail to parse. I guess it
only affects developers who might go forward and back in versions, although
users switch channels too. I think we're ok as is.

http://codereview.chromium.org/6835033/diff/1/net/base/transport_security_sta...
net/base/transport_security_state.cc:578: }
On 2011/04/14 04:02:30, Chris Evans wrote:
> If we get here, please LOG(ERROR) a string of the concatenation of the
incoming
> "hashes". It's really useful.

Done.

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
File net/url_request/url_request_http_job.cc (right):

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
net/url_request/url_request_http_job.cc:656: // Take care of any mandates for
certificate locking.
On 2011/04/13 21:26:34, Chris Evans wrote:
> Did you want to add a TODO to take care of the *.example.com connection reuse
> vs. http://foo.example.com SNI situation?

Done.

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
net/url_request/url_request_http_job.cc:659: ssl_info.is_valid() &&
On 2011/04/14 02:31:53, Chris Evans wrote:
> Ah, did you want to check your new flag is_issued_by_known_root here?

Yep, noticed that on later review, but thanks!

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
net/url_request/url_request_http_job.cc:665: false /* pretend that SNI isn't
available */) &&
On 2011/04/13 21:26:34, Chris Evans wrote:
> You can just use the new static method IsSNIAvailable(context_)

Done.

http://codereview.chromium.org/6835033/diff/1/net/url_request/url_request_htt...
net/url_request/url_request_http_job.cc:666:
!domain_state.IsChainOfPublicKeysPermitted(ssl_info.public_key_hashes)){
On 2011/04/14 02:31:53, Chris Evans wrote:
> Nit: missing space after )

Doesn't fit on the line otherwise :)