123 lines
5.9 KiB
Diff
123 lines
5.9 KiB
Diff
From: csagan5 <32685696+csagan5@users.noreply.github.com>
|
|
Date: Fri, 10 Jun 2022 14:20:02 +0200
|
|
Subject: Enable Certificate Transparency
|
|
|
|
Reporting/auditing functionalities are disabled; a flag is exposed.
|
|
Add guard to make sure that certificate transparency stays enabled
|
|
by default.
|
|
|
|
License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
|
|
---
|
|
chrome/browser/browser_features.h | 1 +
|
|
chrome/browser/net/system_network_context_manager.cc | 2 +-
|
|
chrome/browser/ssl/sct_reporting_service.cc | 4 ++++
|
|
.../about_flags_cc/Enable-Certificate-Transparency.inc | 9 +++++++++
|
|
.../Enable-Certificate-Transparency.inc | 6 ++++++
|
|
.../Enable-Certificate-Transparency.inc | 1 +
|
|
net/http/transport_security_state.cc | 1 +
|
|
services/network/sct_auditing/sct_auditing_handler.cc | 2 ++
|
|
8 files changed, 25 insertions(+), 1 deletion(-)
|
|
create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Enable-Certificate-Transparency.inc
|
|
create mode 100644 cromite_flags/chrome/browser/browser_features_cc/Enable-Certificate-Transparency.inc
|
|
create mode 100644 cromite_flags/chrome/common/chrome_features_cc/Enable-Certificate-Transparency.inc
|
|
|
|
diff --git a/chrome/browser/browser_features.h b/chrome/browser/browser_features.h
|
|
--- a/chrome/browser/browser_features.h
|
|
+++ b/chrome/browser/browser_features.h
|
|
@@ -37,6 +37,7 @@ BASE_DECLARE_FEATURE(kBookmarksTreeView);
|
|
BASE_DECLARE_FEATURE(kBookmarkTriggerForPrerender2KillSwitch);
|
|
BASE_DECLARE_FEATURE(kBookmarkTriggerForPreconnect);
|
|
BASE_DECLARE_FEATURE(kBookmarkTriggerForPrefetch);
|
|
+BASE_DECLARE_FEATURE(kCertificateTransparency);
|
|
BASE_DECLARE_FEATURE(kCertificateTransparencyAskBeforeEnabling);
|
|
BASE_DECLARE_FEATURE(kCertVerificationNetworkTime);
|
|
BASE_DECLARE_FEATURE(kClearUserDataUponProfileDestruction);
|
|
diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
|
|
--- a/chrome/browser/net/system_network_context_manager.cc
|
|
+++ b/chrome/browser/net/system_network_context_manager.cc
|
|
@@ -1139,7 +1139,7 @@ bool SystemNetworkContextManager::IsCertificateTransparencyEnabled() {
|
|
// - on an opt-in basis for other builds and embedders, controlled with the
|
|
// kCertificateTransparencyAskBeforeEnabling flag
|
|
return base::FeatureList::IsEnabled(
|
|
- features::kCertificateTransparencyAskBeforeEnabling);
|
|
+ features::kCertificateTransparency);
|
|
}
|
|
|
|
network::mojom::NetworkContextParamsPtr
|
|
diff --git a/chrome/browser/ssl/sct_reporting_service.cc b/chrome/browser/ssl/sct_reporting_service.cc
|
|
--- a/chrome/browser/ssl/sct_reporting_service.cc
|
|
+++ b/chrome/browser/ssl/sct_reporting_service.cc
|
|
@@ -215,6 +215,10 @@ SCTReportingService::SCTReportingService(
|
|
SCTReportingService::~SCTReportingService() = default;
|
|
|
|
network::mojom::SCTAuditingMode SCTReportingService::GetReportingMode() {
|
|
+ if ((true)) {
|
|
+ // always disabled in Bromite
|
|
+ return network::mojom::SCTAuditingMode::kDisabled;
|
|
+ }
|
|
bool is_sct_auditing_enabled = false;
|
|
#if !BUILDFLAG(IS_ANDROID)
|
|
is_sct_auditing_enabled =
|
|
diff --git a/cromite_flags/chrome/browser/about_flags_cc/Enable-Certificate-Transparency.inc b/cromite_flags/chrome/browser/about_flags_cc/Enable-Certificate-Transparency.inc
|
|
new file mode 100644
|
|
--- /dev/null
|
|
+++ b/cromite_flags/chrome/browser/about_flags_cc/Enable-Certificate-Transparency.inc
|
|
@@ -0,0 +1,9 @@
|
|
+#ifdef FLAG_SECTION
|
|
+
|
|
+ {"certificate-transparency-enabled",
|
|
+ "Enable Certificate Transparency",
|
|
+ "Enables compliance against the Certificate Transparency "
|
|
+ "Policy, with reporting disabled.", kOsAll,
|
|
+ FEATURE_VALUE_TYPE(features::kCertificateTransparency)},
|
|
+
|
|
+#endif
|
|
diff --git a/cromite_flags/chrome/browser/browser_features_cc/Enable-Certificate-Transparency.inc b/cromite_flags/chrome/browser/browser_features_cc/Enable-Certificate-Transparency.inc
|
|
new file mode 100644
|
|
--- /dev/null
|
|
+++ b/cromite_flags/chrome/browser/browser_features_cc/Enable-Certificate-Transparency.inc
|
|
@@ -0,0 +1,6 @@
|
|
+SET_CROMITE_FEATURE_ENABLED(kCertificateTransparencyAskBeforeEnabling);
|
|
+
|
|
+// Enables Certificate Transparency
|
|
+CROMITE_FEATURE(kCertificateTransparency,
|
|
+ "CertificateTransparency",
|
|
+ base::FEATURE_ENABLED_BY_DEFAULT);
|
|
diff --git a/cromite_flags/chrome/common/chrome_features_cc/Enable-Certificate-Transparency.inc b/cromite_flags/chrome/common/chrome_features_cc/Enable-Certificate-Transparency.inc
|
|
new file mode 100644
|
|
--- /dev/null
|
|
+++ b/cromite_flags/chrome/common/chrome_features_cc/Enable-Certificate-Transparency.inc
|
|
@@ -0,0 +1 @@
|
|
+SET_CROMITE_FEATURE_DISABLED(kSCTAuditingHashdance);
|
|
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
|
|
--- a/net/http/transport_security_state.cc
|
|
+++ b/net/http/transport_security_state.cc
|
|
@@ -169,6 +169,7 @@ class HSTSPreloadDecoder : public extras::PreloadDecoder {
|
|
|
|
bool DecodeHSTSPreload(std::string_view search_hostname, PreloadResult* out) {
|
|
#if !BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST)
|
|
+#error "BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST) must be enabled"
|
|
if (g_hsts_source == nullptr)
|
|
return false;
|
|
#endif
|
|
diff --git a/services/network/sct_auditing/sct_auditing_handler.cc b/services/network/sct_auditing/sct_auditing_handler.cc
|
|
--- a/services/network/sct_auditing/sct_auditing_handler.cc
|
|
+++ b/services/network/sct_auditing/sct_auditing_handler.cc
|
|
@@ -110,6 +110,7 @@ void SCTAuditingHandler::MaybeEnqueueReport(
|
|
if (mode_ == mojom::SCTAuditingMode::kDisabled) {
|
|
return;
|
|
}
|
|
+ if ((true)) return;
|
|
|
|
// Only audit valid SCTs. This ensures that they come from a known log, have
|
|
// a valid signature, and thus are expected to be public certificates. If
|
|
@@ -320,6 +321,7 @@ void SCTAuditingHandler::AddReporter(
|
|
if (mode_ == mojom::SCTAuditingMode::kDisabled) {
|
|
return;
|
|
}
|
|
+ if ((true)) return;
|
|
|
|
auto reporter = std::make_unique<SCTAuditingReporter>(
|
|
owner_network_context_, reporter_key, std::move(report),
|
|
--
|