net/http/transport_security_persister.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/http/transport_security_persister.h"
   6
   7 #include "base/base64.h"
   8 #include "base/bind.h"
   9 #include "base/files/file_path.h"
  10 #include "base/files/file_util.h"
  11 #include "base/json/json_reader.h"
  12 #include "base/json/json_writer.h"
  13 #include "base/location.h"
  14 #include "base/sequenced_task_runner.h"
  15 #include "base/task_runner_util.h"
  16 #include "base/thread_task_runner_handle.h"
  17 #include "base/values.h"
  18 #include "crypto/sha2.h"
  19 #include "net/cert/x509_certificate.h"
  20 #include "net/http/transport_security_state.h"
  21
  22 namespace net {
  23
  24 namespace {
  25
  26 base::ListValue* SPKIHashesToListValue(const HashValueVector& hashes) {
  27   base::ListValue* pins = new base::ListValue;
  28   for (size_t i = 0; i != hashes.size(); i++)
  29     pins->Append(new base::StringValue(hashes[i].ToString()));
  30   return pins;
  31 }
  32
  33 void SPKIHashesFromListValue(const base::ListValue& pins,
  34                              HashValueVector* hashes) {
  35   size_t num_pins = pins.GetSize();
  36   for (size_t i = 0; i < num_pins; ++i) {
  37     std::string type_and_base64;
  38     HashValue fingerprint;
  39     if (pins.GetString(i, &type_and_base64) &&
  40         fingerprint.FromString(type_and_base64)) {
  41       hashes->push_back(fingerprint);
  42     }
  43   }
  44 }
  45
  46 // This function converts the binary hashes to a base64 string which we can
  47 // include in a JSON file.
  48 std::string HashedDomainToExternalString(const std::string& hashed) {
  49   std::string out;
  50   base::Base64Encode(hashed, &out);
  51   return out;
  52 }
  53
  54 // This inverts |HashedDomainToExternalString|, above. It turns an external
  55 // string (from a JSON file) into an internal (binary) string.
  56 std::string ExternalStringToHashedDomain(const std::string& external) {
  57   std::string out;
  58   if (!base::Base64Decode(external, &out) ||
  59       out.size() != crypto::kSHA256Length) {
  60     return std::string();
  61   }
  62
  63   return out;
  64 }
  65
  66 const char kIncludeSubdomains[] = "include_subdomains";
  67 const char kStsIncludeSubdomains[] = "sts_include_subdomains";
  68 const char kPkpIncludeSubdomains[] = "pkp_include_subdomains";
  69 const char kMode[] = "mode";
  70 const char kExpiry[] = "expiry";
  71 const char kDynamicSPKIHashesExpiry[] = "dynamic_spki_hashes_expiry";
  72 const char kDynamicSPKIHashes[] = "dynamic_spki_hashes";
  73 const char kForceHTTPS[] = "force-https";
  74 const char kStrict[] = "strict";
  75 const char kDefault[] = "default";
  76 const char kPinningOnly[] = "pinning-only";
  77 const char kCreated[] = "created";
  78 const char kStsObserved[] = "sts_observed";
  79 const char kPkpObserved[] = "pkp_observed";
  80
  81 std::string LoadState(const base::FilePath& path) {
  82   std::string result;
  83   if (!base::ReadFileToString(path, &result)) {
  84     return "";
  85   }
  86   return result;
  87 }
  88
  89 }  // namespace
  90
  91 TransportSecurityPersister::TransportSecurityPersister(
  92     TransportSecurityState* state,
  93     const base::FilePath& profile_path,
  94     const scoped_refptr<base::SequencedTaskRunner>& background_runner,
  95     bool readonly)
  96     : transport_security_state_(state),
  97       writer_(profile_path.AppendASCII("TransportSecurity"), background_runner),
  98       foreground_runner_(base::ThreadTaskRunnerHandle::Get()),
  99       background_runner_(background_runner),
 100       readonly_(readonly),
 101       weak_ptr_factory_(this) {
 102   transport_security_state_->SetDelegate(this);
 103
 104   base::PostTaskAndReplyWithResult(
 105       background_runner_.get(), FROM_HERE,
 106       base::Bind(&LoadState, writer_.path()),
 107       base::Bind(&TransportSecurityPersister::CompleteLoad,
 108                  weak_ptr_factory_.GetWeakPtr()));
 109 }
 110
 111 TransportSecurityPersister::~TransportSecurityPersister() {
 112   DCHECK(foreground_runner_->RunsTasksOnCurrentThread());
 113
 114   if (writer_.HasPendingWrite())
 115     writer_.DoScheduledWrite();
 116
 117   transport_security_state_->SetDelegate(NULL);
 118 }
 119
 120 void TransportSecurityPersister::StateIsDirty(
 121     TransportSecurityState* state) {
 122   DCHECK(foreground_runner_->RunsTasksOnCurrentThread());
 123   DCHECK_EQ(transport_security_state_, state);
 124
 125   if (!readonly_)
 126     writer_.ScheduleWrite(this);
 127 }
 128
 129 bool TransportSecurityPersister::SerializeData(std::string* output) {
 130   DCHECK(foreground_runner_->RunsTasksOnCurrentThread());
 131
 132   base::DictionaryValue toplevel;
 133   base::Time now = base::Time::Now();
 134
 135   // TODO(davidben): Fix the serialization format by splitting the on-disk
 136   // representation of the STS and PKP states. https://crbug.com/470295.
 137   TransportSecurityState::STSStateIterator sts_iterator(
 138       *transport_security_state_);
 139   for (; sts_iterator.HasNext(); sts_iterator.Advance()) {
 140     const std::string& hostname = sts_iterator.hostname();
 141     const TransportSecurityState::STSState& sts_state =
 142         sts_iterator.domain_state();
 143
 144     const std::string key = HashedDomainToExternalString(hostname);
 145     scoped_ptr<base::DictionaryValue> serialized(new base::DictionaryValue);
 146     PopulateEntryWithDefaults(serialized.get());
 147
 148     serialized->SetBoolean(kStsIncludeSubdomains, sts_state.include_subdomains);
 149     serialized->SetDouble(kStsObserved, sts_state.last_observed.ToDoubleT());
 150     serialized->SetDouble(kExpiry, sts_state.expiry.ToDoubleT());
 151
 152     switch (sts_state.upgrade_mode) {
 153       case TransportSecurityState::STSState::MODE_FORCE_HTTPS:
 154         serialized->SetString(kMode, kForceHTTPS);
 155         break;
 156       case TransportSecurityState::STSState::MODE_DEFAULT:
 157         serialized->SetString(kMode, kDefault);
 158         break;
 159       default:
 160         NOTREACHED() << "STSState with unknown mode";
 161         continue;
 162     }
 163
 164     toplevel.Set(key, serialized.Pass());
 165   }
 166
 167   TransportSecurityState::PKPStateIterator pkp_iterator(
 168       *transport_security_state_);
 169   for (; pkp_iterator.HasNext(); pkp_iterator.Advance()) {
 170     const std::string& hostname = pkp_iterator.hostname();
 171     const TransportSecurityState::PKPState& pkp_state =
 172         pkp_iterator.domain_state();
 173
 174     // See if the current |hostname| already has STS state and, if so, update
 175     // that entry.
 176     const std::string key = HashedDomainToExternalString(hostname);
 177     base::DictionaryValue* serialized = nullptr;
 178     if (!toplevel.GetDictionary(key, &serialized)) {
 179       scoped_ptr<base::DictionaryValue> serialized_scoped(
 180           new base::DictionaryValue);
 181       serialized = serialized_scoped.get();
 182       PopulateEntryWithDefaults(serialized);
 183       toplevel.Set(key, serialized_scoped.Pass());
 184     }
 185
 186     serialized->SetBoolean(kPkpIncludeSubdomains, pkp_state.include_subdomains);
 187     serialized->SetDouble(kPkpObserved, pkp_state.last_observed.ToDoubleT());
 188     serialized->SetDouble(kDynamicSPKIHashesExpiry,
 189                           pkp_state.expiry.ToDoubleT());
 190
 191     if (now < pkp_state.expiry) {
 192       serialized->Set(kDynamicSPKIHashes,
 193                       SPKIHashesToListValue(pkp_state.spki_hashes));
 194     }
 195   }
 196
 197   base::JSONWriter::WriteWithOptions(
 198       toplevel, base::JSONWriter::OPTIONS_PRETTY_PRINT, output);
 199   return true;
 200 }
 201
 202 bool TransportSecurityPersister::LoadEntries(const std::string& serialized,
 203                                              bool* dirty) {
 204   DCHECK(foreground_runner_->RunsTasksOnCurrentThread());
 205
 206   transport_security_state_->ClearDynamicData();
 207   return Deserialize(serialized, dirty, transport_security_state_);
 208 }
 209
 210 // static
 211 bool TransportSecurityPersister::Deserialize(const std::string& serialized,
 212                                              bool* dirty,
 213                                              TransportSecurityState* state) {
 214   scoped_ptr<base::Value> value = base::JSONReader::Read(serialized);
 215   base::DictionaryValue* dict_value = NULL;
 216   if (!value.get() || !value->GetAsDictionary(&dict_value))
 217     return false;
 218
 219   const base::Time current_time(base::Time::Now());
 220   bool dirtied = false;
 221
 222   for (base::DictionaryValue::Iterator i(*dict_value);
 223        !i.IsAtEnd(); i.Advance()) {
 224     const base::DictionaryValue* parsed = NULL;
 225     if (!i.value().GetAsDictionary(&parsed)) {
 226       LOG(WARNING) << "Could not parse entry " << i.key() << "; skipping entry";
 227       continue;
 228     }
 229
 230     TransportSecurityState::STSState sts_state;
 231     TransportSecurityState::PKPState pkp_state;
 232
 233     // kIncludeSubdomains is a legacy synonym for kStsIncludeSubdomains and
 234     // kPkpIncludeSubdomains. Parse at least one of these properties,
 235     // preferably the new ones.
 236     bool include_subdomains = false;
 237     bool parsed_include_subdomains = parsed->GetBoolean(kIncludeSubdomains,
 238                                                         &include_subdomains);
 239     sts_state.include_subdomains = include_subdomains;
 240     pkp_state.include_subdomains = include_subdomains;
 241     if (parsed->GetBoolean(kStsIncludeSubdomains, &include_subdomains)) {
 242       sts_state.include_subdomains = include_subdomains;
 243       parsed_include_subdomains = true;
 244     }
 245     if (parsed->GetBoolean(kPkpIncludeSubdomains, &include_subdomains)) {
 246       pkp_state.include_subdomains = include_subdomains;
 247       parsed_include_subdomains = true;
 248     }
 249
 250     std::string mode_string;
 251     double expiry = 0;
 252     if (!parsed_include_subdomains ||
 253         !parsed->GetString(kMode, &mode_string) ||
 254         !parsed->GetDouble(kExpiry, &expiry)) {
 255       LOG(WARNING) << "Could not parse some elements of entry " << i.key()
 256                    << "; skipping entry";
 257       continue;
 258     }
 259
 260     // Don't fail if this key is not present.
 261     double dynamic_spki_hashes_expiry = 0;
 262     parsed->GetDouble(kDynamicSPKIHashesExpiry,
 263                       &dynamic_spki_hashes_expiry);
 264
 265     const base::ListValue* pins_list = NULL;
 266     if (parsed->GetList(kDynamicSPKIHashes, &pins_list)) {
 267       SPKIHashesFromListValue(*pins_list, &pkp_state.spki_hashes);
 268     }
 269
 270     if (mode_string == kForceHTTPS || mode_string == kStrict) {
 271       sts_state.upgrade_mode =
 272           TransportSecurityState::STSState::MODE_FORCE_HTTPS;
 273     } else if (mode_string == kDefault || mode_string == kPinningOnly) {
 274       sts_state.upgrade_mode = TransportSecurityState::STSState::MODE_DEFAULT;
 275     } else {
 276       LOG(WARNING) << "Unknown TransportSecurityState mode string "
 277                    << mode_string << " found for entry " << i.key()
 278                    << "; skipping entry";
 279       continue;
 280     }
 281
 282     sts_state.expiry = base::Time::FromDoubleT(expiry);
 283     pkp_state.expiry = base::Time::FromDoubleT(dynamic_spki_hashes_expiry);
 284
 285     double sts_observed;
 286     double pkp_observed;
 287     if (parsed->GetDouble(kStsObserved, &sts_observed)) {
 288       sts_state.last_observed = base::Time::FromDoubleT(sts_observed);
 289     } else if (parsed->GetDouble(kCreated, &sts_observed)) {
 290       // kCreated is a legacy synonym for both kStsObserved and kPkpObserved.
 291       sts_state.last_observed = base::Time::FromDoubleT(sts_observed);
 292     } else {
 293       // We're migrating an old entry with no observation date. Make sure we
 294       // write the new date back in a reasonable time frame.
 295       dirtied = true;
 296       sts_state.last_observed = base::Time::Now();
 297     }
 298     if (parsed->GetDouble(kPkpObserved, &pkp_observed)) {
 299       pkp_state.last_observed = base::Time::FromDoubleT(pkp_observed);
 300     } else if (parsed->GetDouble(kCreated, &pkp_observed)) {
 301       pkp_state.last_observed = base::Time::FromDoubleT(pkp_observed);
 302     } else {
 303       dirtied = true;
 304       pkp_state.last_observed = base::Time::Now();
 305     }
 306
 307     bool has_sts =
 308         sts_state.expiry > current_time && sts_state.ShouldUpgradeToSSL();
 309     bool has_pkp =
 310         pkp_state.expiry > current_time && pkp_state.HasPublicKeyPins();
 311     if (!has_sts && !has_pkp) {
 312       // Make sure we dirty the state if we drop an entry. The entries can only
 313       // be dropped when both the STS and PKP states are expired or invalid.
 314       dirtied = true;
 315       continue;
 316     }
 317
 318     std::string hashed = ExternalStringToHashedDomain(i.key());
 319     if (hashed.empty()) {
 320       dirtied = true;
 321       continue;
 322     }
 323
 324     // Until the on-disk storage is split, there will always be 'null' entries.
 325     // We only register entries that have actual state.
 326     if (has_sts)
 327       state->AddOrUpdateEnabledSTSHosts(hashed, sts_state);
 328     if (has_pkp)
 329       state->AddOrUpdateEnabledPKPHosts(hashed, pkp_state);
 330   }
 331
 332   *dirty = dirtied;
 333   return true;
 334 }
 335
 336 void TransportSecurityPersister::PopulateEntryWithDefaults(
 337     base::DictionaryValue* host) {
 338   host->Clear();
 339
 340   // STS default values.
 341   host->SetBoolean(kStsIncludeSubdomains, false);
 342   host->SetDouble(kStsObserved, 0.0);
 343   host->SetDouble(kExpiry, 0.0);
 344   host->SetString(kMode, kDefault);
 345
 346   // PKP default values.
 347   host->SetBoolean(kPkpIncludeSubdomains, false);
 348   host->SetDouble(kPkpObserved, 0.0);
 349   host->SetDouble(kDynamicSPKIHashesExpiry, 0.0);
 350 }
 351
 352 void TransportSecurityPersister::CompleteLoad(const std::string& state) {
 353   DCHECK(foreground_runner_->RunsTasksOnCurrentThread());
 354
 355   if (state.empty())
 356     return;
 357
 358   bool dirty = false;
 359   if (!LoadEntries(state, &dirty)) {
 360     LOG(ERROR) << "Failed to deserialize state: " << state;
 361     return;
 362   }
 363   if (dirty)
 364     StateIsDirty(transport_security_state_);
 365 }
 366
 367 }  // namespace net