PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
create-pull-request/patch-b8df90d
cromite/build/patches/Warning-message-for-unsupported-hardware-aes.patch
T
Carmelo Messina b937cb60ec v123 patches
2024-03-15 16:24:42 +01:00

172 lines
8.1 KiB
Diff
Raw Permalink Blame History

From: uazo <uazo@users.noreply.github.com>
Date: Fri, 24 Mar 2023 07:50:59 +0000
Subject: Warning message for unsupported hardware aes
In boringssl the lack of support for native aes instructions in the cpu
leads to a change in the order of the encryption methods in the
tls1.3 stack and thus to an additional fingerprint bit.
The use of software aes is discouraged due to possible side channel
attacks, so it is better to warn the user of the presence of an
unsupported device.
you can remove the message by going to chrome://flags/#no-hw-aes-warning
---
base/base_switches.cc | 2 ++
base/base_switches.h | 1 +
chrome/BUILD.gn | 3 +++
chrome/app/chrome_main_delegate.cc | 10 ++++++++++
chrome/app/generated_resources.grd | 4 ++++
chrome/browser/ui/startup/bad_flags_prompt.cc | 9 +++++++++
.../browser/renderer_host/render_process_host_impl.cc | 1 +
.../Warning-message-for-unsupported-hardware-aes.inc | 9 +++++++++
.../Warning-message-for-unsupported-hardware-aes.inc | 4 ++++
.../Warning-message-for-unsupported-hardware-aes.inc | 1 +
10 files changed, 44 insertions(+)
create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Warning-message-for-unsupported-hardware-aes.inc
create mode 100644 cromite_flags/content/public/common/content_features_cc/Warning-message-for-unsupported-hardware-aes.inc
create mode 100644 cromite_flags/content/public/common/content_features_h/Warning-message-for-unsupported-hardware-aes.inc
diff --git a/base/base_switches.cc b/base/base_switches.cc
--- a/base/base_switches.cc
+++ b/base/base_switches.cc
@@ -178,6 +178,8 @@ const char kPackageVersionCode[] = "package-version-code";
const char kDesktopModeViewportMetaEnabled[] = "dm-viewport-meta-enabled";
+const char kNoAESHardware[] = "no-aes-hardware";
+
#if BUILDFLAG(IS_CHROMEOS)
// Override the default scheduling boosting value for urgent tasks.
// This can be adjusted if a specific chromeos device shows better perf/power
diff --git a/base/base_switches.h b/base/base_switches.h
--- a/base/base_switches.h
+++ b/base/base_switches.h
@@ -35,6 +35,7 @@ extern const char kTraceToFileName[];
extern const char kV[];
extern const char kVModule[];
extern const char kWaitForDebugger[];
+extern const char kNoAESHardware[];
#if BUILDFLAG(IS_WIN)
extern const char kDisableHighResTimer[];
diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
--- a/chrome/BUILD.gn
+++ b/chrome/BUILD.gn
@@ -429,6 +429,7 @@ if (is_win) {
"//components/policy:generated",
"//content/public/app",
"//crypto",
+ "//third_party/boringssl",
"//headless:headless_non_renderer",
"//headless:headless_shell_browser_lib",
"//net:net_resources",
@@ -1669,6 +1670,8 @@ if (is_android) {
"//chrome/common/profiler",
"//chrome/gpu",
"//chrome/renderer",
+ "//crypto",
+ "//third_party/boringssl",
"//components/minidump_uploader",
"//components/safe_browsing:buildflags",
"//components/safe_browsing/android:safe_browsing_api_handler",
diff --git a/chrome/app/chrome_main_delegate.cc b/chrome/app/chrome_main_delegate.cc
--- a/chrome/app/chrome_main_delegate.cc
+++ b/chrome/app/chrome_main_delegate.cc
@@ -100,6 +100,9 @@
#include "ui/base/resource/resource_bundle.h"
#include "ui/base/resource/scoped_startup_resource_bundle.h"
#include "ui/base/ui_base_switches.h"
+#include "base/base_switches.h"
+#include "crypto/openssl_util.h"
+#include "third_party/boringssl/src/include/openssl/ssl.h"
#if BUILDFLAG(IS_WIN)
#include <malloc.h>
@@ -1251,6 +1254,13 @@ std::optional<int> ChromeMainDelegate::BasicStartupComplete() {
return chrome::RESULT_CODE_INVALID_SANDBOX_STATE;
#endif
+if (!command_line.HasSwitch(switches::kProcessType)) {
+ crypto::EnsureOpenSSLInit();
+ if (EVP_has_aes_hardware() == 0) {
+ base::CommandLine::ForCurrentProcess()->AppendSwitch(switches::kNoAESHardware);
+ }
+}
+
#if BUILDFLAG(IS_MAC)
// Give the browser process a longer treadmill, since crashes
// there have more impact.
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -7212,6 +7212,10 @@ Keep your key file in a safe place. You will need it to create new versions of y
You are using an unsupported feature flag: <ph name="BAD_FLAG">$1<ex>SignedHTTPExchange</ex></ph>. Stability and security will suffer.
</message>
+ <message name="IDS_UNSUPPORTED_AES_HARDWARE" desc="Message shown when an unsupported hardware">
+ Your device does not support hardware aes, so it is easier to track you at the network level.
+ </message>
+
<!-- Bad Environment Variables Infobar-->
<message name="IDS_BAD_ENVIRONMENT_VARIABLES_WARNING_MESSAGE" desc="Message shown when an unsupported environment variable is used [Keep it short so it fits in the infobar.]">
You are using an unsupported environment variable: <ph name="BAD_VAR">$1<ex>SSLKEYLOGFILE</ex></ph>. Stability and security will suffer.
diff --git a/chrome/browser/ui/startup/bad_flags_prompt.cc b/chrome/browser/ui/startup/bad_flags_prompt.cc
--- a/chrome/browser/ui/startup/bad_flags_prompt.cc
+++ b/chrome/browser/ui/startup/bad_flags_prompt.cc
@@ -239,6 +239,15 @@ void ShowBadFlagsPrompt(content::WebContents* web_contents) {
return;
}
}
+
+ if (base::FeatureList::IsEnabled(features::kNoAESHardwareMessage) &&
+ base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kNoAESHardware)) {
+ CreateSimpleAlertInfoBar(
+ infobars::ContentInfoBarManager::FromWebContents(web_contents),
+ infobars::InfoBarDelegate::BAD_FLAGS_INFOBAR_DELEGATE, nullptr,
+ l10n_util::GetStringUTF16(IDS_UNSUPPORTED_AES_HARDWARE),
+ /*auto_expire=*/false, /*should_animate=*/false);
+ }
}
void ShowBadFlagsInfoBar(content::WebContents* web_contents,
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -3582,6 +3582,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
switches::kLacrosUseChromeosProtectedAv1,
#endif
switches::kDesktopModeViewportMetaEnabled,
+ switches::kNoAESHardware,
};
renderer_cmd->CopySwitchesFrom(browser_cmd, kSwitchNames);
diff --git a/cromite_flags/chrome/browser/about_flags_cc/Warning-message-for-unsupported-hardware-aes.inc b/cromite_flags/chrome/browser/about_flags_cc/Warning-message-for-unsupported-hardware-aes.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/chrome/browser/about_flags_cc/Warning-message-for-unsupported-hardware-aes.inc
@@ -0,0 +1,9 @@
+
+#ifdef FLAG_SECTION
+
+ {"no-hw-aes-warning",
+ "Enable no aes warning message",
+ "Displays a warning message if the device does not have aes support in the hardware", kOsDesktop | kOsAndroid,
+ FEATURE_VALUE_TYPE(features::kNoAESHardwareMessage)},
+
+#endif
diff --git a/cromite_flags/content/public/common/content_features_cc/Warning-message-for-unsupported-hardware-aes.inc b/cromite_flags/content/public/common/content_features_cc/Warning-message-for-unsupported-hardware-aes.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_cc/Warning-message-for-unsupported-hardware-aes.inc
@@ -0,0 +1,4 @@
+// Show a warning message to user if aes hardware is not found
+CROMITE_FEATURE(kNoAESHardwareMessage,
+ "NoAESHardwareMessage",
+ base::FEATURE_ENABLED_BY_DEFAULT);
diff --git a/cromite_flags/content/public/common/content_features_h/Warning-message-for-unsupported-hardware-aes.inc b/cromite_flags/content/public/common/content_features_h/Warning-message-for-unsupported-hardware-aes.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_h/Warning-message-for-unsupported-hardware-aes.inc
@@ -0,0 +1 @@
+CONTENT_EXPORT BASE_DECLARE_FEATURE(kNoAESHardwareMessage);
--
Reference in New Issue View Git Blame Copy Permalink