PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
896eecc4d47bbb241a531663a3d88df433a12612
cromite/build/patches/Enable-Certificate-Transparency.patch
T
Carmelo Messina 804473e164 v106
2022-09-22 11:05:02 +02:00

199 lines
9.5 KiB
Diff
Raw Blame History

From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Fri, 10 Jun 2022 14:20:02 +0200
Subject: Enable Certificate Transparency
Reporting/auditing functionalities are disabled; a flag is exposed.
License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
---
chrome/browser/about_flags.cc | 5 +++++
chrome/browser/browser_features.cc | 2 +-
chrome/browser/flag_descriptions.cc | 4 ++++
chrome/browser/flag_descriptions.h | 3 +++
chrome/browser/net/system_network_context_manager.cc | 4 ----
chrome/browser/ssl/sct_reporting_service.cc | 5 +++++
chrome/common/chrome_features.cc | 6 +++---
net/http/transport_security_state.cc | 5 +++--
net/url_request/report_sender.cc | 3 ++-
services/network/network_context.cc | 2 +-
services/network/sct_auditing/sct_auditing_handler.cc | 2 ++
11 files changed, 29 insertions(+), 12 deletions(-)
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -8654,6 +8654,11 @@ const FeatureEntry kFeatureEntries[] = {
flag_descriptions::kWebMidiDescription, kOsAll,
FEATURE_VALUE_TYPE(features::kWebMidi)},
#if BUILDFLAG(IS_ANDROID)
+ {"certificate-transparency-enabled",
+ flag_descriptions::kCTEnabledName,
+ flag_descriptions::kCTEnabledDescription, kOsAndroid,
+ FEATURE_VALUE_TYPE(features::kCertificateTransparencyAndroid)},
+
{"use-real-color-space-for-android-video",
flag_descriptions::kUseRealColorSpaceForAndroidVideoName,
flag_descriptions::kUseRealColorSpaceForAndroidVideoDescription,
diff --git a/chrome/browser/browser_features.cc b/chrome/browser/browser_features.cc
--- a/chrome/browser/browser_features.cc
+++ b/chrome/browser/browser_features.cc
@@ -143,7 +143,7 @@ const base::Feature kWebUsbDeviceDetection{"WebUsbDeviceDetection",
#if BUILDFLAG(IS_ANDROID)
// Enables Certificate Transparency on Android.
const base::Feature kCertificateTransparencyAndroid{
- "CertificateTransparencyAndroid", base::FEATURE_ENABLED_BY_DEFAULT};
+ "CertificateTransparencyAndroid", base::FEATURE_ENABLED_BY_DEFAULT}; // enabled by default in Bromite
#endif
const base::Feature kLargeFaviconFromGoogle{"LargeFaviconFromGoogle",
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -6499,6 +6499,10 @@ const char kAutofillCreditCardUploadDescription[] =
#endif // defined(TOOLKIT_VIEWS) || BUILDFLAG(IS_ANDROID)
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_ANDROID)
+const char kCTEnabledName[] = "Enable Certificate Transparency";
+const char kCTEnabledDescription[] =
+ "Enables compliance against the Certificate Transparency Policy, with reporting disabled.";
+
const char kElasticOverscrollName[] = "Elastic Overscroll";
const char kElasticOverscrollDescription[] =
"Enables Elastic Overscrolling on touchscreens and precision touchpads.";
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -3764,6 +3764,9 @@ extern const char kAutofillCreditCardUploadDescription[];
#endif // defined(TOOLKIT_VIEWS) || BUILDFLAG(IS_ANDROID)
#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_ANDROID)
+extern const char kCTEnabledName[];
+extern const char kCTEnabledDescription[];
+
extern const char kElasticOverscrollName[];
extern const char kElasticOverscrollDescription[];
#endif // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_ANDROID)
diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
--- a/chrome/browser/net/system_network_context_manager.cc
+++ b/chrome/browser/net/system_network_context_manager.cc
@@ -914,7 +914,6 @@ void SystemNetworkContextManager::SetEnableCertificateTransparencyForTesting(
bool SystemNetworkContextManager::IsCertificateTransparencyEnabled() {
if (certificate_transparency_enabled_for_testing_.has_value())
return certificate_transparency_enabled_for_testing_.value();
-#if BUILDFLAG(GOOGLE_CHROME_BRANDING) && defined(OFFICIAL_BUILD)
// TODO(carlosil): Figure out if we can/should remove the OFFICIAL_BUILD and
// GOOGLE_CHROME_BRANDING checks now that enforcement does not rely on build
// dates, and allow embedders to enforce.
@@ -928,9 +927,6 @@ bool SystemNetworkContextManager::IsCertificateTransparencyEnabled() {
#else
return true;
#endif // BUILDFLAG(IS_ANDROID)
-#else
- return false;
-#endif // BUILDFLAG(GOOGLE_CHROME_BRANDING) && defined(OFFICIAL_BUILD)
}
network::mojom::NetworkContextParamsPtr
diff --git a/chrome/browser/ssl/sct_reporting_service.cc b/chrome/browser/ssl/sct_reporting_service.cc
--- a/chrome/browser/ssl/sct_reporting_service.cc
+++ b/chrome/browser/ssl/sct_reporting_service.cc
@@ -211,6 +211,11 @@ void SetSCTAuditingEnabledForStoragePartition(
} // namespace
network::mojom::SCTAuditingMode SCTReportingService::GetReportingMode() {
+ if ((true)) {
+ // always disabled in Bromite
+ return network::mojom::SCTAuditingMode::kDisabled;
+ }
+
if (profile_->IsOffTheRecord() ||
!base::FeatureList::IsEnabled(features::kSCTAuditing)) {
return network::mojom::SCTAuditingMode::kDisabled;
diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc
@@ -822,9 +822,9 @@ const base::Feature kSchedulerConfiguration{"SchedulerConfiguration",
// Controls whether SCT audit reports are queued and the rate at which they
// should be sampled. Default sampling rate is 1/10,000 certificates.
-#if BUILDFLAG(IS_ANDROID)
-const base::Feature kSCTAuditing{"SCTAuditing",
- base::FEATURE_DISABLED_BY_DEFAULT};
+#if BUILDFLAG(IS_ANDROID) // SCT auditing
+const base::Feature kSCTAuditing{"SCTAuditing", // must be always
+ base::FEATURE_DISABLED_BY_DEFAULT}; // disabled in Bromite
#else
const base::Feature kSCTAuditing{"SCTAuditing",
base::FEATURE_ENABLED_BY_DEFAULT};
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
@@ -338,6 +338,7 @@ class HSTSPreloadDecoder : public net::extras::PreloadDecoder {
bool DecodeHSTSPreload(const std::string& search_hostname, PreloadResult* out) {
#if !BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST)
+#error "BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST) must be enabled"
if (g_hsts_source == nullptr)
return false;
#endif
@@ -383,11 +384,11 @@ bool DecodeHSTSPreload(const std::string& search_hostname, PreloadResult* out) {
// static
const base::Feature TransportSecurityState::kDynamicExpectCTFeature{
- "DynamicExpectCT", base::FEATURE_ENABLED_BY_DEFAULT};
+ "DynamicExpectCT", base::FEATURE_DISABLED_BY_DEFAULT}; // disabled in Bromite
// static
const base::Feature TransportSecurityState::kCertificateTransparencyEnforcement{
- "CertificateTransparencyEnforcement", base::FEATURE_ENABLED_BY_DEFAULT};
+ "CertificateTransparencyEnforcement", base::FEATURE_ENABLED_BY_DEFAULT}; // always enabled in Bromite
void SetTransportSecurityStateSourceForTesting(
const TransportSecurityStateSource* source) {
diff --git a/net/url_request/report_sender.cc b/net/url_request/report_sender.cc
--- a/net/url_request/report_sender.cc
+++ b/net/url_request/report_sender.cc
@@ -86,7 +86,8 @@ void ReportSender::Send(const GURL& report_uri,
URLRequest* raw_url_request = url_request.get();
inflight_requests_[raw_url_request] = std::move(url_request);
- raw_url_request->Start();
+ // pretend that request completed
+ OnResponseStarted(raw_url_request, OK);
}
void ReportSender::OnResponseStarted(URLRequest* request, int net_error) {
diff --git a/services/network/network_context.cc b/services/network/network_context.cc
--- a/services/network/network_context.cc
+++ b/services/network/network_context.cc
@@ -2658,7 +2658,7 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
// TransportSecurityState. Since no requests have been made yet, safe to do
// this even after the call to Build().
- if (params_->enable_certificate_reporting) {
+ if ((false) /* params_->enable_certificate_reporting*/) {
net::NetworkTrafficAnnotationTag traffic_annotation =
net::DefineNetworkTrafficAnnotation("domain_security_policy", R"(
semantics {
diff --git a/services/network/sct_auditing/sct_auditing_handler.cc b/services/network/sct_auditing/sct_auditing_handler.cc
--- a/services/network/sct_auditing/sct_auditing_handler.cc
+++ b/services/network/sct_auditing/sct_auditing_handler.cc
@@ -115,6 +115,7 @@ void SCTAuditingHandler::MaybeEnqueueReport(
if (mode_ == mojom::SCTAuditingMode::kDisabled) {
return;
}
+ if ((true)) return;
// Only audit valid SCTs. This ensures that they come from a known log, have
// a valid signature, and thus are expected to be public certificates. If
@@ -330,6 +331,7 @@ void SCTAuditingHandler::AddReporter(
if (mode_ == mojom::SCTAuditingMode::kDisabled) {
return;
}
+ if ((true)) return;
auto reporter = std::make_unique<SCTAuditingReporter>(
owner_network_context_, reporter_key, std::move(report),
--
2.25.1
Reference in New Issue View Git Blame Copy Permalink