PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
Files
create-pull-request/patch-cdf415c
cromite/build/patches/Warning-message-for-unsupported-hardware-aes.patch
T

160 lines
7.7 KiB
Diff
Raw Permalink Blame History

From: uazo <uazo@users.noreply.github.com>
Date: Fri, 24 Mar 2023 07:50:59 +0000
Subject: Warning message for unsupported hardware aes
In boringssl the lack of support for native aes instructions in the cpu
leads to a change in the order of the encryption methods in the
tls1.3 stack and thus to an additional fingerprint bit.
The use of software aes is discouraged due to possible side channel
attacks, so it is better to warn the user of the presence of an
unsupported device.
you can remove the message by going to chrome://flags/#no-hw-aes-warning
---
base/base_switches.h | 2 ++
chrome/BUILD.gn | 3 +++
chrome/app/chrome_main_delegate.cc | 9 +++++++++
chrome/app/generated_resources.grd | 4 ++++
chrome/browser/ui/startup/bad_flags_prompt.cc | 9 +++++++++
.../browser/renderer_host/render_process_host_impl.cc | 1 +
.../Warning-message-for-unsupported-hardware-aes.inc | 10 ++++++++++
.../Warning-message-for-unsupported-hardware-aes.inc | 4 ++++
.../Warning-message-for-unsupported-hardware-aes.inc | 1 +
9 files changed, 43 insertions(+)
create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Warning-message-for-unsupported-hardware-aes.inc
create mode 100644 cromite_flags/content/public/common/content_features_cc/Warning-message-for-unsupported-hardware-aes.inc
create mode 100644 cromite_flags/content/public/common/content_features_h/Warning-message-for-unsupported-hardware-aes.inc
diff --git a/base/base_switches.h b/base/base_switches.h
--- a/base/base_switches.h
+++ b/base/base_switches.h
@@ -130,6 +130,8 @@ inline constexpr char kWaitForDebugger[] = "wait-for-debugger";
// See flag_descriptions.cc for more details.
inline constexpr char kEnableBenchmarking[] = "enable-benchmarking";
+inline constexpr char kNoAESHardware[] = "no-aes-hardware";
+
#if BUILDFLAG(IS_WIN)
// Disable high-resolution timer on Windows.
inline constexpr char kDisableHighResTimer[] = "disable-highres-timer";
diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
--- a/chrome/BUILD.gn
+++ b/chrome/BUILD.gn
@@ -438,6 +438,7 @@ if (is_win) {
"//components/webapps/isolated_web_apps:scheme",
"//content/public/app",
"//crypto",
+ "//third_party/boringssl",
"//net:net_resources",
"//sandbox/win:sandbox",
"//third_party/cld_3/src/src:cld_3",
@@ -1630,6 +1631,8 @@ if (is_android) {
"//chrome/common/profiler",
"//chrome/gpu",
"//chrome/renderer",
+ "//crypto",
+ "//third_party/boringssl",
"//components/crash/android:crash_android",
"//components/minidump_uploader",
"//components/safe_browsing:buildflags",
diff --git a/chrome/app/chrome_main_delegate.cc b/chrome/app/chrome_main_delegate.cc
--- a/chrome/app/chrome_main_delegate.cc
+++ b/chrome/app/chrome_main_delegate.cc
@@ -101,6 +101,9 @@
#include "ui/base/resource/resource_bundle.h"
#include "ui/base/resource/scoped_startup_resource_bundle.h"
#include "ui/base/ui_base_switches.h"
+#include "base/base_switches.h"
+#include "crypto/openssl_util.h"
+#include "third_party/boringssl/src/include/openssl/ssl.h"
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || \
BUILDFLAG(IS_MAC)
@@ -1104,6 +1107,12 @@ std::optional<int> ChromeMainDelegate::BasicStartupComplete() {
}
#endif
+if (!command_line.HasSwitch(switches::kProcessType)) {
+ if (EVP_has_aes_hardware() == 0) {
+ base::CommandLine::ForCurrentProcess()->AppendSwitch(switches::kNoAESHardware);
+ }
+}
+
#if BUILDFLAG(IS_MAC)
// Give the browser process a longer treadmill, since crashes
// there have more impact.
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -7292,6 +7292,10 @@ Keep your key file in a safe place. You will need it to create new versions of y
Chrome is loading flags from a command-line file. Stability and security may be affected.
</message>
+ <message name="IDS_UNSUPPORTED_AES_HARDWARE" desc="Message shown when an unsupported hardware">
+ Your device does not support hardware aes, so it is easier to track you at the network level.
+ </message>
+
<!-- Bad Environment Variables Infobar-->
<message name="IDS_BAD_ENVIRONMENT_VARIABLES_WARNING_MESSAGE" desc="Message shown when an unsupported environment variable is used [Keep it short so it fits in the infobar.]">
You are using an unsupported environment variable: <ph name="BAD_VAR">$1<ex>SSLKEYLOGFILE</ex></ph>. Stability and security will suffer.
diff --git a/chrome/browser/ui/startup/bad_flags_prompt.cc b/chrome/browser/ui/startup/bad_flags_prompt.cc
--- a/chrome/browser/ui/startup/bad_flags_prompt.cc
+++ b/chrome/browser/ui/startup/bad_flags_prompt.cc
@@ -304,6 +304,15 @@ void ShowBadFlagsPrompt(content::WebContents* web_contents) {
return;
}
}
+
+ if (base::FeatureList::IsEnabled(features::kNoAESHardwareMessage) &&
+ base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kNoAESHardware)) {
+ CreateSimpleAlertInfoBar(
+ infobars::ContentInfoBarManager::FromWebContents(web_contents),
+ infobars::InfoBarDelegate::BAD_FLAGS_INFOBAR_DELEGATE, nullptr,
+ l10n_util::GetStringUTF16(IDS_UNSUPPORTED_AES_HARDWARE),
+ /*auto_expire=*/false, /*should_animate=*/false);
+ }
}
void ShowBadFlagsInfoBar(content::WebContents* web_contents,
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -3894,6 +3894,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
switches::kSchedulerBoostUrgent,
#endif
switches::kDesktopModeViewportMetaEnabled,
+ switches::kNoAESHardware,
};
renderer_cmd->CopySwitchesFrom(browser_cmd, kSwitchNames);
diff --git a/cromite_flags/chrome/browser/about_flags_cc/Warning-message-for-unsupported-hardware-aes.inc b/cromite_flags/chrome/browser/about_flags_cc/Warning-message-for-unsupported-hardware-aes.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/chrome/browser/about_flags_cc/Warning-message-for-unsupported-hardware-aes.inc
@@ -0,0 +1,10 @@
+
+#ifdef FLAG_SECTION
+
+ {"no-hw-aes-warning",
+ "Enable no aes warning message",
+ "Displays a warning message if the device does not have aes support in the hardware. "
+ "The message is not shown with the feature disabled.", kOsDesktop | kOsAndroid,
+ FEATURE_VALUE_TYPE(features::kNoAESHardwareMessage)},
+
+#endif
diff --git a/cromite_flags/content/public/common/content_features_cc/Warning-message-for-unsupported-hardware-aes.inc b/cromite_flags/content/public/common/content_features_cc/Warning-message-for-unsupported-hardware-aes.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_cc/Warning-message-for-unsupported-hardware-aes.inc
@@ -0,0 +1,4 @@
+// Show a warning message to user if aes hardware is not found
+CROMITE_FEATURE(kNoAESHardwareMessage,
+ "NoAESHardwareMessage",
+ base::FEATURE_ENABLED_BY_DEFAULT);
diff --git a/cromite_flags/content/public/common/content_features_h/Warning-message-for-unsupported-hardware-aes.inc b/cromite_flags/content/public/common/content_features_h/Warning-message-for-unsupported-hardware-aes.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_h/Warning-message-for-unsupported-hardware-aes.inc
@@ -0,0 +1 @@
+CONTENT_EXPORT BASE_DECLARE_FEATURE(kNoAESHardwareMessage);
--
Reference in New Issue View Git Blame Copy Permalink