PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
90486fde89fcad64330b61ba644bf77d67b67a6e
cromite/build/patches/Enable-Certificate-Transparency.patch
T
CarlandGitHub 73886eac62 Patches for v100 (#1930) 
* Patches for v100

* Remove unused patches
2022-03-29 15:58:56 +02:00

266 lines
12 KiB
Diff
Raw Blame History

From: uazo <uazo@users.noreply.github.com>
Date: Tue, 18 Jan 2022 16:02:06 +0000
Subject: Enable Certificate Transparency
Disable CT reporting
---
chrome/browser/about_flags.cc | 5 +++++
chrome/browser/browser_features.cc | 2 +-
.../pki_metadata_component_installer.cc | 3 ++-
chrome/browser/flag_descriptions.cc | 4 ++++
chrome/browser/flag_descriptions.h | 3 +++
chrome/browser/net/system_network_context_manager.cc | 4 ----
chrome/browser/ssl/sct_reporting_service.cc | 3 +++
chrome/common/chrome_features.cc | 2 +-
net/http/transport_security_state.cc | 12 +++++-------
net/url_request/report_sender.cc | 2 +-
services/network/network_context.cc | 10 +++++++---
services/network/public/cpp/features.gni | 2 +-
.../network/sct_auditing/sct_auditing_handler.cc | 6 ++++++
13 files changed, 39 insertions(+), 19 deletions(-)
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -7902,6 +7902,11 @@ const FeatureEntry kFeatureEntries[] = {
flag_descriptions::kWebBluetoothBondOnDemandDescription, kOsWin | kOsLinux,
FEATURE_VALUE_TYPE(features::kWebBluetoothBondOnDemand)},
+ {"certificate-transparency-enabled",
+ flag_descriptions::kCTEnabledName,
+ flag_descriptions::kCTEnabledDescription, kOsAndroid,
+ FEATURE_VALUE_TYPE(features::kCertificateTransparencyAndroid)},
+
#if BUILDFLAG(IS_CHROMEOS_ASH)
{"enable-libinput-to-handle-touchpad",
flag_descriptions::kEnableLibinputToHandleTouchpadName,
diff --git a/chrome/browser/browser_features.cc b/chrome/browser/browser_features.cc
--- a/chrome/browser/browser_features.cc
+++ b/chrome/browser/browser_features.cc
@@ -142,7 +142,7 @@ const base::Feature kWebUsbDeviceDetection{"WebUsbDeviceDetection",
#if BUILDFLAG(IS_ANDROID)
// Enables Certificate Transparency on Android.
const base::Feature kCertificateTransparencyAndroid{
- "CertificateTransparencyAndroid", base::FEATURE_DISABLED_BY_DEFAULT};
+ "CertificateTransparencyAndroid", base::FEATURE_ENABLED_BY_DEFAULT};
#endif
const base::Feature kLargeFaviconFromGoogle{"LargeFaviconFromGoogle",
diff --git a/chrome/browser/component_updater/pki_metadata_component_installer.cc b/chrome/browser/component_updater/pki_metadata_component_installer.cc
--- a/chrome/browser/component_updater/pki_metadata_component_installer.cc
+++ b/chrome/browser/component_updater/pki_metadata_component_installer.cc
@@ -48,7 +48,8 @@ const char kGoogleOperatorName[] = "Google";
// The extension id is: efniojlnjndmcbiieegkicadnoecjjef
const uint8_t kPKIMetadataPublicKeySHA256[32] = {
0x45, 0xd8, 0xe9, 0xbd, 0x9d, 0x3c, 0x21, 0x88, 0x44, 0x6a, 0x82,
- 0x03, 0xde, 0x42, 0x99, 0x45, 0x66, 0x25, 0xfe, 0xb3, 0xd1, 0xf8,
+ // this is changed on purpose in Bromite
+ 0x01, 0x02, 0x03, 0x04, 0x05, 0x66, 0x25, 0xfe, 0xb3, 0xd1, 0xf8,
0x11, 0x65, 0xb4, 0x6f, 0xd3, 0x1b, 0x21, 0x89, 0xbe, 0x9c};
const base::FilePath::CharType kCTConfigProtoFileName[] =
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -5762,6 +5762,10 @@ const char kUIDebugToolsDescription[] =
"Enables additional keyboard shortcuts to help debugging.";
#endif
+const char kCTEnabledName[] = "Enable Certificate Transparency";
+const char kCTEnabledDescription[] =
+ "Enables compliance against the Certificate Transparency Policy, without any reports being issued.";
+
#if defined(WEBRTC_USE_PIPEWIRE)
const char kWebrtcPipeWireCapturerName[] = "WebRTC PipeWire support";
const char kWebrtcPipeWireCapturerDescription[] =
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -3357,6 +3357,9 @@ extern const char kUIDebugToolsName[];
extern const char kUIDebugToolsDescription[];
#endif
+extern const char kCTEnabledName[];
+extern const char kCTEnabledDescription[];
+
#if defined(WEBRTC_USE_PIPEWIRE)
extern const char kWebrtcPipeWireCapturerName[];
extern const char kWebrtcPipeWireCapturerDescription[];
diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
--- a/chrome/browser/net/system_network_context_manager.cc
+++ b/chrome/browser/net/system_network_context_manager.cc
@@ -791,7 +791,6 @@ void SystemNetworkContextManager::SetEnableCertificateTransparencyForTesting(
bool SystemNetworkContextManager::IsCertificateTransparencyEnabled() {
if (certificate_transparency_enabled_for_testing_.has_value())
return certificate_transparency_enabled_for_testing_.value();
-#if BUILDFLAG(GOOGLE_CHROME_BRANDING) && defined(OFFICIAL_BUILD)
// TODO(carlosil): Figure out if we can/should remove the OFFICIAL_BUILD and
// GOOGLE_CHROME_BRANDING checks now that enforcement does not rely on build
// dates, and allow embedders to enforce.
@@ -805,9 +804,6 @@ bool SystemNetworkContextManager::IsCertificateTransparencyEnabled() {
#else
return true;
#endif
-#else
- return false;
-#endif
}
network::mojom::NetworkContextParamsPtr
diff --git a/chrome/browser/ssl/sct_reporting_service.cc b/chrome/browser/ssl/sct_reporting_service.cc
--- a/chrome/browser/ssl/sct_reporting_service.cc
+++ b/chrome/browser/ssl/sct_reporting_service.cc
@@ -193,6 +193,9 @@ void SetSCTAuditingEnabledForStoragePartition(
} // namespace
network::mojom::SCTAuditingMode SCTReportingService::GetReportingMode() {
+ if ((true)) {
+ return network::mojom::SCTAuditingMode::kDisabled;
+ }
if (profile_->IsOffTheRecord() ||
!base::FeatureList::IsEnabled(features::kSCTAuditing)) {
return network::mojom::SCTAuditingMode::kDisabled;
diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc
@@ -892,7 +892,7 @@ const base::Feature kSchedulerConfiguration{"SchedulerConfiguration",
// should be sampled. Default sampling rate is 1/10,000 certificates.
#if BUILDFLAG(IS_ANDROID)
const base::Feature kSCTAuditing{"SCTAuditing",
- base::FEATURE_DISABLED_BY_DEFAULT};
+ base::FEATURE_DISABLED_BY_DEFAULT}; // Bromite: guard against enabling this
#else
const base::Feature kSCTAuditing{"SCTAuditing",
base::FEATURE_ENABLED_BY_DEFAULT};
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
@@ -340,6 +340,7 @@ bool DecodeHSTSPreload(const std::string& search_hostname, PreloadResult* out) {
#if !BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST)
if (g_hsts_source == nullptr)
return false;
+#error "BUILDFLAG(INCLUDE_TRANSPORT_SECURITY_STATE_PRELOAD_LIST) must be enabled"
#endif
bool found = false;
@@ -383,11 +384,11 @@ bool DecodeHSTSPreload(const std::string& search_hostname, PreloadResult* out) {
// static
const base::Feature TransportSecurityState::kDynamicExpectCTFeature{
- "DynamicExpectCT", base::FEATURE_ENABLED_BY_DEFAULT};
+ "DynamicExpectCT", base::FEATURE_DISABLED_BY_DEFAULT};
// static
const base::Feature TransportSecurityState::kCertificateTransparencyEnforcement{
- "CertificateTransparencyEnforcement", base::FEATURE_ENABLED_BY_DEFAULT};
+ "CertificateTransparencyEnforcement", base::FEATURE_ENABLED_BY_DEFAULT}; // Bromite: guard against disabling this
void SetTransportSecurityStateSourceForTesting(
const TransportSecurityStateSource* source) {
@@ -413,11 +414,6 @@ TransportSecurityState::TransportSecurityState(
features::kPartitionExpectCTStateByNetworkIsolationKey)) {
// Static pinning is only enabled for official builds to make sure that
// others don't end up with pins that cannot be easily updated.
-#if !BUILDFLAG(GOOGLE_CHROME_BRANDING) || BUILDFLAG(IS_ANDROID) || \
- BUILDFLAG(IS_IOS)
- enable_static_pins_ = false;
- enable_static_expect_ct_ = false;
-#endif
// Check that there no invalid entries in the static HSTS bypass list.
for (auto& host : hsts_host_bypass_list) {
DCHECK(host.find('.') == std::string::npos);
@@ -472,6 +468,8 @@ TransportSecurityState::PKPStatus TransportSecurityState::CheckPublicKeyPins(
if (!HasPublicKeyPins(host_port_pair.host())) {
return PKPStatus::OK;
}
+ if (ct_emergency_disable_)
+ return PKPStatus::OK;
PKPStatus pin_validity = CheckPublicKeyPinsImpl(
host_port_pair, is_issued_by_known_root, public_key_hashes,
diff --git a/net/url_request/report_sender.cc b/net/url_request/report_sender.cc
--- a/net/url_request/report_sender.cc
+++ b/net/url_request/report_sender.cc
@@ -87,7 +87,7 @@ void ReportSender::Send(const GURL& report_uri,
URLRequest* raw_url_request = url_request.get();
inflight_requests_[raw_url_request] = std::move(url_request);
- raw_url_request->Start();
+ OnResponseStarted(raw_url_request, OK);
}
void ReportSender::OnResponseStarted(URLRequest* request, int net_error) {
diff --git a/services/network/network_context.cc b/services/network/network_context.cc
--- a/services/network/network_context.cc
+++ b/services/network/network_context.cc
@@ -2551,7 +2551,7 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
// TransportSecurityState. Since no requests have been made yet, safe to do
// this even after the call to Build().
- if (params_->enable_certificate_reporting) {
+ if ((false /*params_->enable_certificate_reporting*/)) {
net::NetworkTrafficAnnotationTag traffic_annotation =
net::DefineNetworkTrafficAnnotation("domain_security_policy", R"(
semantics {
@@ -2592,7 +2592,7 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
#endif // BUILDFLAG(IS_ANDROID)
#if BUILDFLAG(IS_CT_SUPPORTED)
- if (params_->enable_expect_ct_reporting) {
+ if ((false)/*params_->enable_expect_ct_reporting*/) {
LazyCreateExpectCTReporter(result.url_request_context.get());
result.url_request_context->transport_security_state()->SetExpectCTReporter(
expect_ct_reporter_.get());
@@ -2604,9 +2604,13 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
result.url_request_context->transport_security_state()
->SetRequireCTDelegate(require_ct_delegate_.get());
}
+ else {
+ result.url_request_context->transport_security_state()
+ ->SetCTEmergencyDisabled(true);
+ }
#endif // BUILDFLAG(IS_CT_SUPPORTED)
- if (params_->enable_domain_reliability) {
+ if ((false)/*params_->enable_domain_reliability*/) {
domain_reliability_monitor_ =
std::make_unique<domain_reliability::DomainReliabilityMonitor>(
result.url_request_context.get(),
diff --git a/services/network/public/cpp/features.gni b/services/network/public/cpp/features.gni
--- a/services/network/public/cpp/features.gni
+++ b/services/network/public/cpp/features.gni
@@ -7,7 +7,7 @@ import("//build/config/features.gni")
declare_args() {
# Certificate transparency is not supported on iOS.
# TODO(mmenke): It's actually not supported on Android, either.
- is_ct_supported = !is_ios
+ is_ct_supported = true
# Controls whether P2P is exposed by the network service.
# Optional to reduce avoid having Chrome on iOS depends on
diff --git a/services/network/sct_auditing/sct_auditing_handler.cc b/services/network/sct_auditing/sct_auditing_handler.cc
--- a/services/network/sct_auditing/sct_auditing_handler.cc
+++ b/services/network/sct_auditing/sct_auditing_handler.cc
@@ -106,6 +106,9 @@ void SCTAuditingHandler::MaybeEnqueueReport(
const net::X509Certificate* validated_certificate_chain,
const net::SignedCertificateTimestampAndStatusList&
signed_certificate_timestamps) {
+ if ((true)) {
+ return;
+ }
if (mode_ == mojom::SCTAuditingMode::kDisabled) {
return;
}
@@ -297,6 +300,9 @@ void SCTAuditingHandler::AddReporter(
absl::optional<SCTAuditingReporter::SCTHashdanceMetadata> sct_metadata,
std::unique_ptr<net::BackoffEntry> backoff_entry) {
DCHECK(foreground_runner_->RunsTasksInCurrentSequence());
+ if ((true)) {
+ return;
+ }
if (mode_ == mojom::SCTAuditingMode::kDisabled) {
return;
}
--
2.25.1
Reference in New Issue View Git Blame Copy Permalink