chrome/browser/net/packed_ct_ev_whitelist.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/net/packed_ct_ev_whitelist.h"
   6
   7 #include <string.h>
   8
   9 #include <algorithm>
  10
  11 #include "base/big_endian.h"
  12 #include "base/files/file_util.h"
  13 #include "base/lazy_instance.h"
  14 #include "base/logging.h"
  15 #include "chrome/browser/net/bit_stream_reader.h"
  16 #include "content/public/browser/browser_thread.h"
  17 #include "net/ssl/ssl_config_service.h"
  18
  19 namespace {
  20 const uint8_t kCertHashLengthBits = 64;  // 8 bytes
  21 const uint8_t kCertHashLength = kCertHashLengthBits / 8;
  22 const uint64_t kGolombMParameterBits = 47;  // 2^47
  23
  24 void SetNewEVWhitelistInSSLConfigService(
  25     const scoped_refptr<net::ct::EVCertsWhitelist>& new_whitelist) {
  26   net::SSLConfigService::SetEVCertsWhitelist(new_whitelist);
  27 }
  28
  29 int TruncatedHashesComparator(const void* v1, const void* v2) {
  30   const uint64_t& h1(*(static_cast<const uint64_t*>(v1)));
  31   const uint64_t& h2(*(static_cast<const uint64_t*>(v2)));
  32   if (h1 < h2)
  33     return -1;
  34   else if (h1 > h2)
  35     return 1;
  36   return 0;
  37 }
  38 }  // namespace
  39
  40 void SetEVWhitelistFromFile(const base::FilePath& compressed_whitelist_file) {
  41   VLOG(1) << "Setting EV whitelist from file: "
  42           << compressed_whitelist_file.value();
  43   std::string compressed_list;
  44   if (!base::ReadFileToString(compressed_whitelist_file, &compressed_list)) {
  45     VLOG(1) << "Failed reading from " << compressed_whitelist_file.value();
  46     return;
  47   }
  48
  49   scoped_refptr<net::ct::EVCertsWhitelist> new_whitelist(
  50       new PackedEVCertsWhitelist(compressed_list));
  51   if (!new_whitelist->IsValid()) {
  52     VLOG(1) << "Failed uncompressing EV certs whitelist.";
  53     return;
  54   }
  55
  56   base::Closure assign_cb =
  57       base::Bind(SetNewEVWhitelistInSSLConfigService, new_whitelist);
  58   content::BrowserThread::PostTask(
  59       content::BrowserThread::IO, FROM_HERE, assign_cb);
  60 }
  61
  62 bool PackedEVCertsWhitelist::UncompressEVWhitelist(
  63     const std::string& compressed_whitelist,
  64     std::vector<uint64_t>* uncompressed_list) {
  65   internal::BitStreamReader reader(base::StringPiece(
  66       compressed_whitelist.data(), compressed_whitelist.size()));
  67   std::vector<uint64_t> result;
  68
  69   VLOG(1) << "Uncompressing EV whitelist of size "
  70           << compressed_whitelist.size();
  71   uint64_t curr_hash(0);
  72   if (!reader.ReadBits(kCertHashLengthBits, &curr_hash)) {
  73     VLOG(1) << "Failed reading first hash.";
  74     return false;
  75   }
  76   result.push_back(curr_hash);
  77   // M is the tunable parameter used by the Golomb coding.
  78   static const uint64_t kGolombParameterM = static_cast<uint64_t>(1)
  79                                             << kGolombMParameterBits;
  80
  81   while (reader.BitsLeft() > kGolombMParameterBits) {
  82     uint64_t read_prefix = 0;
  83     if (!reader.ReadUnaryEncoding(&read_prefix)) {
  84       VLOG(1) << "Failed reading unary-encoded prefix.";
  85       return false;
  86     }
  87     if (read_prefix > (UINT64_MAX / kGolombParameterM)) {
  88       VLOG(1) << "Received value that would cause overflow: " << read_prefix;
  89       return false;
  90     }
  91
  92     uint64_t r = 0;
  93     if (!reader.ReadBits(kGolombMParameterBits, &r)) {
  94       VLOG(1) << "Failed reading " << kGolombMParameterBits << " bits.";
  95       return false;
  96     }
  97     DCHECK_LT(r, kGolombParameterM);
  98
  99     uint64_t curr_diff = read_prefix * kGolombParameterM + r;
 100     curr_hash += curr_diff;
 101
 102     result.push_back(curr_hash);
 103   }
 104
 105   uncompressed_list->swap(result);
 106   return true;
 107 }
 108
 109 PackedEVCertsWhitelist::PackedEVCertsWhitelist(
 110     const std::string& compressed_whitelist) {
 111   if (!UncompressEVWhitelist(compressed_whitelist, &whitelist_)) {
 112     whitelist_.clear();
 113     return;
 114   }
 115 }
 116
 117 PackedEVCertsWhitelist::~PackedEVCertsWhitelist() {
 118 }
 119
 120 bool PackedEVCertsWhitelist::ContainsCertificateHash(
 121     const std::string& certificate_hash) const {
 122   DCHECK(!whitelist_.empty());
 123   uint64_t hash_to_lookup;
 124
 125   base::ReadBigEndian(certificate_hash.data(), &hash_to_lookup);
 126   return bsearch(&hash_to_lookup,
 127                  &whitelist_[0],
 128                  whitelist_.size(),
 129                  kCertHashLength,
 130                  TruncatedHashesComparator) != NULL;
 131 }
 132
 133 bool PackedEVCertsWhitelist::IsValid() const {
 134   return whitelist_.size() > 0;
 135 }