From: uazo Date: Tue, 18 Jan 2022 16:02:06 +0000 Subject: Enable Certificate Transparency Disable CT reporting --- chrome/browser/about_flags.cc | 5 +++++ chrome/browser/browser_features.cc | 2 +- .../pki_metadata_component_installer.cc | 3 ++- chrome/browser/flag_descriptions.cc | 4 ++++ chrome/browser/flag_descriptions.h | 3 +++ chrome/browser/net/system_network_context_manager.cc | 4 ---- chrome/browser/ssl/sct_reporting_service.cc | 3 +++ chrome/common/chrome_features.cc | 2 +- net/http/transport_security_state.cc | 12 +++++------- net/url_request/report_sender.cc | 2 +- services/network/network_context.cc | 10 +++++++--- services/network/public/cpp/features.gni | 2 +- .../network/sct_auditing/sct_auditing_handler.cc | 6 ++++++ 13 files changed, 39 insertions(+), 19 deletions(-) diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc --- a/chrome/browser/about_flags.cc +++ b/chrome/browser/about_flags.cc @@ -7902,6 +7902,11 @@ const FeatureEntry kFeatureEntries[] = { flag_descriptions::kWebBluetoothBondOnDemandDescription, kOsWin | kOsLinux, FEATURE_VALUE_TYPE(features::kWebBluetoothBondOnDemand)}, + {"certificate-transparency-enabled", + flag_descriptions::kCTEnabledName, + flag_descriptions::kCTEnabledDescription, kOsAndroid, + FEATURE_VALUE_TYPE(features::kCertificateTransparencyAndroid)}, + #if BUILDFLAG(IS_CHROMEOS_ASH) {"enable-libinput-to-handle-touchpad", flag_descriptions::kEnableLibinputToHandleTouchpadName, diff --git a/chrome/browser/browser_features.cc b/chrome/browser/browser_features.cc --- a/chrome/browser/browser_features.cc +++ b/chrome/browser/browser_features.cc @@ -142,7 +142,7 @@ const base::Feature kWebUsbDeviceDetection{"WebUsbDeviceDetection", #if BUILDFLAG(IS_ANDROID) // Enables Certificate Transparency on Android. const base::Feature kCertificateTransparencyAndroid{ - "CertificateTransparencyAndroid", base::FEATURE_DISABLED_BY_DEFAULT}; + "CertificateTransparencyAndroid", base::FEATURE_ENABLED_BY_DEFAULT}; #endif const base::Feature kLargeFaviconFromGoogle{"LargeFaviconFromGoogle", diff --git a/chrome/browser/component_updater/pki_metadata_component_installer.cc b/chrome/browser/component_updater/pki_metadata_component_installer.cc --- a/chrome/browser/component_updater/pki_metadata_component_installer.cc +++ b/chrome/browser/component_updater/pki_metadata_component_installer.cc @@ -48,7 +48,8 @@ const char kGoogleOperatorName[] = "Google"; // The extension id is: efniojlnjndmcbiieegkicadnoecjjef const uint8_t kPKIMetadataPublicKeySHA256[32] = { 0x45, 0xd8, 0xe9, 0xbd, 0x9d, 0x3c, 0x21, 0x88, 0x44, 0x6a, 0x82, - 0x03, 0xde, 0x42, 0x99, 0x45, 0x66, 0x25, 0xfe, 0xb3, 0xd1, 0xf8, + // this is changed on purpose in Bromite + 0x01, 0x02, 0x03, 0x04, 0x05, 0x66, 0x25, 0xfe, 0xb3, 0xd1, 0xf8, 0x11, 0x65, 0xb4, 0x6f, 0xd3, 0x1b, 0x21, 0x89, 0xbe, 0x9c}; const base::FilePath::CharType kCTConfigProtoFileName[] = diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc --- a/chrome/browser/flag_descriptions.cc +++ b/chrome/browser/flag_descriptions.cc @@ -5762,6 +5762,10 @@ const char kUIDebugToolsDescription[] = "Enables additional keyboard shortcuts to help debugging."; #endif +const char kCTEnabledName[] = "Enable Certificate Transparency"; +const char kCTEnabledDescription[] = + "Enables compliance against the Certificate Transparency Policy, without any reports being issued."; + #if defined(WEBRTC_USE_PIPEWIRE) const char kWebrtcPipeWireCapturerName[] = "WebRTC PipeWire support"; const char kWebrtcPipeWireCapturerDescription[] = diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h --- a/chrome/browser/flag_descriptions.h +++ b/chrome/browser/flag_descriptions.h @@ -3357,6 +3357,9 @@ extern const char kUIDebugToolsName[]; extern const char kUIDebugToolsDescription[]; #endif +extern const char kCTEnabledName[]; +extern const char kCTEnabledDescription[]; + #if defined(WEBRTC_USE_PIPEWIRE) extern const char kWebrtcPipeWireCapturerName[]; extern const char kWebrtcPipeWireCapturerDescription[]; diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc --- a/chrome/browser/net/system_network_context_manager.cc +++ b/chrome/browser/net/system_network_context_manager.cc @@ -791,7 +791,6 @@ void SystemNetworkContextManager::SetEnableCertificateTransparencyForTesting( bool SystemNetworkContextManager::IsCertificateTransparencyEnabled() { if (certificate_transparency_enabled_for_testing_.has_value()) return certificate_transparency_enabled_for_testing_.value(); -#if BUILDFLAG(GOOGLE_CHROME_BRANDING) && defined(OFFICIAL_BUILD) // TODO(carlosil): Figure out if we can/should remove the OFFICIAL_BUILD and // GOOGLE_CHROME_BRANDING checks now that enforcement does not rely on build // dates, and allow embedders to enforce. @@ -805,9 +804,6 @@ bool SystemNetworkContextManager::IsCertificateTransparencyEnabled() { #else return true; #endif -#else - return false; -#endif } network::mojom::NetworkContextParamsPtr diff --git a/chrome/browser/ssl/sct_reporting_service.cc b/chrome/browser/ssl/sct_reporting_service.cc --- a/chrome/browser/ssl/sct_reporting_service.cc +++ b/chrome/browser/ssl/sct_reporting_service.cc @@ -193,6 +193,9 @@ void SetSCTAuditingEnabledForStoragePartition( } // namespace network::mojom::SCTAuditingMode SCTReportingService::GetReportingMode() { + if ((true)) { + return network::mojom::SCTAuditingMode::kDisabled; + } if (profile_->IsOffTheRecord() || !base::FeatureList::IsEnabled(features::kSCTAuditing)) { return network::mojom::SCTAuditingMode::kDisabled; diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc --- a/chrome/common/chrome_features.cc +++ b/chrome/common/chrome_features.cc @@ -892,7 +892,7 @@ const base::Feature kSchedulerConfiguration{"SchedulerConfiguration", // should be sampled. Default sampling rate is 1/10,000 certificates. #if BUILDFLAG(IS_ANDROID) const base::Feature kSCTAuditing{"SCTAuditing", - base::FEATURE_DISABLED_BY_DEFAULT}; + base::FEATURE_DISABLED_BY_DEFAULT}; // Bromite: guard against enabling this #else const base::Feature kSCTAuditing{"SCTAuditing", base::FEATURE_ENABLED_BY_DEFAULT}; diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc --- a/net/http/transport_security_state.cc +++ b/net/http/transport_security_state.cc @@ -340,6 +340,7 @@ bool DecodeHSTSPreload(const std::string& search_hostname, PreloadResult* out) { #if !BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST) if (g_hsts_source == nullptr) return false; +#error "BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST) must be enabled" #endif bool found = false; @@ -383,11 +384,11 @@ bool DecodeHSTSPreload(const std::string& search_hostname, PreloadResult* out) { // static const base::Feature TransportSecurityState::kDynamicExpectCTFeature{ - "DynamicExpectCT", base::FEATURE_ENABLED_BY_DEFAULT}; + "DynamicExpectCT", base::FEATURE_DISABLED_BY_DEFAULT}; // static const base::Feature TransportSecurityState::kCertificateTransparencyEnforcement{ - "CertificateTransparencyEnforcement", base::FEATURE_ENABLED_BY_DEFAULT}; + "CertificateTransparencyEnforcement", base::FEATURE_ENABLED_BY_DEFAULT}; // Bromite: guard against disabling this void SetTransportSecurityStateSourceForTesting( const TransportSecurityStateSource* source) { @@ -413,11 +414,6 @@ TransportSecurityState::TransportSecurityState( features::kPartitionExpectCTStateByNetworkIsolationKey)) { // Static pinning is only enabled for official builds to make sure that // others don't end up with pins that cannot be easily updated. -#if !BUILDFLAG(GOOGLE_CHROME_BRANDING) || BUILDFLAG(IS_ANDROID) || \ - BUILDFLAG(IS_IOS) - enable_static_pins_ = false; - enable_static_expect_ct_ = false; -#endif // Check that there no invalid entries in the static HSTS bypass list. for (auto& host : hsts_host_bypass_list) { DCHECK(host.find('.') == std::string::npos); @@ -472,6 +468,8 @@ TransportSecurityState::PKPStatus TransportSecurityState::CheckPublicKeyPins( if (!HasPublicKeyPins(host_port_pair.host())) { return PKPStatus::OK; } + if (ct_emergency_disable_) + return PKPStatus::OK; PKPStatus pin_validity = CheckPublicKeyPinsImpl( host_port_pair, is_issued_by_known_root, public_key_hashes, diff --git a/net/url_request/report_sender.cc b/net/url_request/report_sender.cc --- a/net/url_request/report_sender.cc +++ b/net/url_request/report_sender.cc @@ -87,7 +87,7 @@ void ReportSender::Send(const GURL& report_uri, URLRequest* raw_url_request = url_request.get(); inflight_requests_[raw_url_request] = std::move(url_request); - raw_url_request->Start(); + OnResponseStarted(raw_url_request, OK); } void ReportSender::OnResponseStarted(URLRequest* request, int net_error) { diff --git a/services/network/network_context.cc b/services/network/network_context.cc --- a/services/network/network_context.cc +++ b/services/network/network_context.cc @@ -2551,7 +2551,7 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext( // TransportSecurityState. Since no requests have been made yet, safe to do // this even after the call to Build(). - if (params_->enable_certificate_reporting) { + if ((false /*params_->enable_certificate_reporting*/)) { net::NetworkTrafficAnnotationTag traffic_annotation = net::DefineNetworkTrafficAnnotation("domain_security_policy", R"( semantics { @@ -2592,7 +2592,7 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext( #endif // BUILDFLAG(IS_ANDROID) #if BUILDFLAG(IS_CT_SUPPORTED) - if (params_->enable_expect_ct_reporting) { + if ((false)/*params_->enable_expect_ct_reporting*/) { LazyCreateExpectCTReporter(result.url_request_context.get()); result.url_request_context->transport_security_state()->SetExpectCTReporter( expect_ct_reporter_.get()); @@ -2604,9 +2604,13 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext( result.url_request_context->transport_security_state() ->SetRequireCTDelegate(require_ct_delegate_.get()); } + else { + result.url_request_context->transport_security_state() + ->SetCTEmergencyDisabled(true); + } #endif // BUILDFLAG(IS_CT_SUPPORTED) - if (params_->enable_domain_reliability) { + if ((false)/*params_->enable_domain_reliability*/) { domain_reliability_monitor_ = std::make_unique( result.url_request_context.get(), diff --git a/services/network/public/cpp/features.gni b/services/network/public/cpp/features.gni --- a/services/network/public/cpp/features.gni +++ b/services/network/public/cpp/features.gni @@ -7,7 +7,7 @@ import("//build/config/features.gni") declare_args() { # Certificate transparency is not supported on iOS. # TODO(mmenke): It's actually not supported on Android, either. - is_ct_supported = !is_ios + is_ct_supported = true # Controls whether P2P is exposed by the network service. # Optional to reduce avoid having Chrome on iOS depends on diff --git a/services/network/sct_auditing/sct_auditing_handler.cc b/services/network/sct_auditing/sct_auditing_handler.cc --- a/services/network/sct_auditing/sct_auditing_handler.cc +++ b/services/network/sct_auditing/sct_auditing_handler.cc @@ -106,6 +106,9 @@ void SCTAuditingHandler::MaybeEnqueueReport( const net::X509Certificate* validated_certificate_chain, const net::SignedCertificateTimestampAndStatusList& signed_certificate_timestamps) { + if ((true)) { + return; + } if (mode_ == mojom::SCTAuditingMode::kDisabled) { return; } @@ -297,6 +300,9 @@ void SCTAuditingHandler::AddReporter( absl::optional sct_metadata, std::unique_ptr backoff_entry) { DCHECK(foreground_runner_->RunsTasksInCurrentSequence()); + if ((true)) { + return; + } if (mode_ == mojom::SCTAuditingMode::kDisabled) { return; } -- 2.25.1