From: uazo Date: Mon, 26 Apr 2021 13:28:24 +0000 Subject: Add AllowUserCertificates flag Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html --- .../chromium/chrome/browser/app/ChromeActivity.java | 3 +++ chrome/browser/flags/android/chrome_feature_list.cc | 1 + .../chrome/browser/flags/ChromeFeatureList.java | 4 ++++ .../Add-AllowUserCertificates-flag.inc | 13 +++++++++++++ .../Add-AllowUserCertificates-flag.inc | 3 +++ .../Add-AllowUserCertificates-flag.inc | 1 + net/android/java/src/org/chromium/net/X509Util.java | 5 +++++ 7 files changed, 30 insertions(+) create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-AllowUserCertificates-flag.inc create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-AllowUserCertificates-flag.inc create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_h/Add-AllowUserCertificates-flag.inc diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java @@ -233,6 +233,7 @@ import org.chromium.content_public.browser.LoadUrlParams; import org.chromium.content_public.browser.SelectionPopupController; import org.chromium.content_public.browser.WebContents; import org.chromium.content_public.common.ContentSwitches; +import org.chromium.net.X509Util; import org.chromium.printing.PrintManagerDelegateImpl; import org.chromium.printing.PrintingController; import org.chromium.printing.PrintingControllerImpl; @@ -981,6 +982,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity super.onStartWithNative(); ChromeActivitySessionTracker.getInstance().onStartWithNative(getProfileProviderSupplier()); + X509Util.AllowUserCertificates = ChromeFeatureList.isEnabled( + ChromeFeatureList.ALLOW_USER_CERTIFICATES); // postDeferredStartupIfNeeded() is called in TabModelSelectorTabObsever#onLoadStopped(), // #onPageLoadFinished() and #onCrash(). If we are not actively loading a tab (e.g. diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc --- a/chrome/browser/flags/android/chrome_feature_list.cc +++ b/chrome/browser/flags/android/chrome_feature_list.cc @@ -169,6 +169,7 @@ const base::Feature* const kFeaturesExposedToJava[] = { &feed::kFeedPerformanceStudy, &feed::kFeedShowSignInCommand, &feed::kFeedSignedOutViewDemotion, + &kAllowUserCertificates, &feed::kFeedRecyclerBinderUnmountOnDetach, &feed::kInterestFeedV2, &feed::kWebFeedAwareness, diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java @@ -162,6 +162,7 @@ public abstract class ChromeFeatureList { "AccountForSuppressedKeyboardInsets"; public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_CUSTOMIZATION_V2 = "AdaptiveButtonInTopToolbarCustomizationV2"; + public static final String ALLOW_USER_CERTIFICATES = "AllowUserCertificates"; public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_PAGE_SUMMARY = "AdaptiveButtonInTopToolbarPageSummary"; public static final String ALLOW_TAB_CLOSING_UPON_MINIMIZATION = @@ -680,6 +681,8 @@ public abstract class ChromeFeatureList { public static final CachedFlag sAndroidWindowPopupLargeScreen = newCachedFlag(ANDROID_WINDOW_POPUP_LARGE_SCREEN, false); public static final CachedFlag sAppSpecificHistory = newCachedFlag(APP_SPECIFIC_HISTORY, true); + public static final CachedFlag sAllowUserCertificates = + newCachedFlag(ALLOW_USER_CERTIFICATES, false); public static final CachedFlag sAsyncNotificationManager = newCachedFlag(ASYNC_NOTIFICATION_MANAGER, false, true); public static final CachedFlag sAsyncNotificationManagerForDownload = @@ -941,6 +944,7 @@ public abstract class ChromeFeatureList { sAccountForSuppressedKeyboardInsets, sAllowTabClosingUponMinimization, sAndroidAppIntegration, + sAllowUserCertificates, sAndroidAppIntegrationModule, sAndroidAppIntegrationMultiDataSource, sAndroidAppIntegrationV2, diff --git a/cromite_flags/chrome/browser/about_flags_cc/Add-AllowUserCertificates-flag.inc b/cromite_flags/chrome/browser/about_flags_cc/Add-AllowUserCertificates-flag.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/chrome/browser/about_flags_cc/Add-AllowUserCertificates-flag.inc @@ -0,0 +1,13 @@ +#ifdef FLAG_SECTION + +#if BUILDFLAG(IS_ANDROID) + + {"allow-user-certificates", + "Allow user certificates", + "Allow user CA certificates during " + "validation of the certificate chain", kOsAndroid, + FEATURE_VALUE_TYPE(chrome::android::kAllowUserCertificates)}, + +#endif + +#endif diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-AllowUserCertificates-flag.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-AllowUserCertificates-flag.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-AllowUserCertificates-flag.inc @@ -0,0 +1,3 @@ +CROMITE_FEATURE(kAllowUserCertificates, + "AllowUserCertificates", + base::FEATURE_DISABLED_BY_DEFAULT); diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_h/Add-AllowUserCertificates-flag.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_h/Add-AllowUserCertificates-flag.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_h/Add-AllowUserCertificates-flag.inc @@ -0,0 +1 @@ +BASE_DECLARE_FEATURE(kAllowUserCertificates); diff --git a/net/android/java/src/org/chromium/net/X509Util.java b/net/android/java/src/org/chromium/net/X509Util.java --- a/net/android/java/src/org/chromium/net/X509Util.java +++ b/net/android/java/src/org/chromium/net/X509Util.java @@ -537,6 +537,8 @@ public class X509Util { return userRootBytes.toArray(new byte[0][]); } + public static boolean AllowUserCertificates = false; + public static AndroidCertVerifyResult verifyServerCertificates( byte[][] certChain, String authType, @@ -637,6 +639,9 @@ public class X509Util { X509Certificate root = verifiedChain.get(verifiedChain.size() - 1); isIssuedByKnownRoot = isKnownRoot(root); } + if (AllowUserCertificates == false && isIssuedByKnownRoot == false) + return new AndroidCertVerifyResult(CertVerifyStatusAndroid.NO_TRUSTED_ROOT); + return new AndroidCertVerifyResult( CertVerifyStatusAndroid.OK, isIssuedByKnownRoot, verifiedChain); } --