components/packed_ct_ev_whitelist/packed_ct_ev_whitelist.cc

// Copyright 2014 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "components/packed_ct_ev_whitelist/packed_ct_ev_whitelist.h"

#include <string.h>

#include <algorithm>

#include "base/big_endian.h"
#include "base/files/file_util.h"
#include "base/lazy_instance.h"
#include "base/logging.h"
#include "components/packed_ct_ev_whitelist/bit_stream_reader.h"
#include "content/public/browser/browser_thread.h"
#include "net/ssl/ssl_config_service.h"

namespace {
const uint8_t kCertHashLengthBits = 64;  // 8 bytes
const uint8_t kCertHashLength = kCertHashLengthBits / 8;
const uint64_t kGolombMParameterBits = 47;  // 2^47

void SetEVWhitelistInSSLConfigService(
    const scoped_refptr<net::ct::EVCertsWhitelist>& new_whitelist) {
  VLOG(1) << "Setting new EV Certs whitelist.";
  net::SSLConfigService::SetEVCertsWhitelist(new_whitelist);
}

int TruncatedHashesComparator(const void* v1, const void* v2) {
  const uint64_t& h1(*(static_cast<const uint64_t*>(v1)));
  const uint64_t& h2(*(static_cast<const uint64_t*>(v2)));
  if (h1 < h2)
    return -1;
  else if (h1 > h2)
    return 1;
  return 0;
}
}  // namespace

namespace packed_ct_ev_whitelist {

void SetEVCertsWhitelist(scoped_refptr<net::ct::EVCertsWhitelist> whitelist) {
  if (!whitelist->IsValid()) {
    VLOG(1) << "EV Certs whitelist is not valid, not setting.";
    return;
  }

  base::Closure assign_cb =
      base::Bind(SetEVWhitelistInSSLConfigService, whitelist);
  content::BrowserThread::PostTask(
      content::BrowserThread::IO, FROM_HERE, assign_cb);
}

bool PackedEVCertsWhitelist::UncompressEVWhitelist(
    const std::string& compressed_whitelist,
    std::vector<uint64_t>* uncompressed_list) {
  internal::BitStreamReader reader(base::StringPiece(
      compressed_whitelist.data(), compressed_whitelist.size()));
  std::vector<uint64_t> result;
  // Reserve exactly the right amount of memory to avoid reallocs. The size
  // changes very rarely and if it does change the code will still be correct,
  // just slightly less efficient.
  result.reserve(110610);

  VLOG(1) << "Uncompressing EV whitelist of size "
          << compressed_whitelist.size();
  uint64_t curr_hash(0);
  if (!reader.ReadBits(kCertHashLengthBits, &curr_hash)) {
    VLOG(1) << "Failed reading first hash.";
    return false;
  }
  result.push_back(curr_hash);
  // M is the tunable parameter used by the Golomb coding.
  static const uint64_t kGolombParameterM = static_cast<uint64_t>(1)
                                            << kGolombMParameterBits;

  while (reader.BitsLeft() > kGolombMParameterBits) {
    uint64_t read_prefix = 0;
    if (!reader.ReadUnaryEncoding(&read_prefix)) {
      VLOG(1) << "Failed reading unary-encoded prefix.";
      return false;
    }
    if (read_prefix > (UINT64_MAX / kGolombParameterM)) {
      VLOG(1) << "Received value that would cause overflow: " << read_prefix;
      return false;
    }

    uint64_t r = 0;
    if (!reader.ReadBits(kGolombMParameterBits, &r)) {
      VLOG(1) << "Failed reading " << kGolombMParameterBits << " bits.";
      return false;
    }
    DCHECK_LT(r, kGolombParameterM);

    uint64_t curr_diff = read_prefix * kGolombParameterM + r;
    curr_hash += curr_diff;

    result.push_back(curr_hash);
  }

  // If there is excess capacity then trim it.
  if (result.size() < result.capacity()) {
    std::vector<uint64_t> temp(result.size());
    memcpy(&temp[0], &result[0], result.size() * sizeof(result[0]));

    // Swap the right-sized vector with the over-sized vector.
    result.swap(temp);
  }

  // Make sure our size trimming code worked.
  DCHECK(result.size() == result.capacity());

  uncompressed_list->swap(result);
  return true;
}

PackedEVCertsWhitelist::PackedEVCertsWhitelist(
    const std::string& compressed_whitelist,
    const base::Version& version)
    : version_(version) {
  if (!UncompressEVWhitelist(compressed_whitelist, &whitelist_)) {
    whitelist_.clear();
    return;
  }
}

PackedEVCertsWhitelist::~PackedEVCertsWhitelist() {
}

bool PackedEVCertsWhitelist::ContainsCertificateHash(
    const std::string& certificate_hash) const {
  DCHECK(!whitelist_.empty());
  uint64_t hash_to_lookup;

  base::ReadBigEndian(certificate_hash.data(), &hash_to_lookup);
  return bsearch(&hash_to_lookup,
                 &whitelist_[0],
                 whitelist_.size(),
                 kCertHashLength,
                 TruncatedHashesComparator) != NULL;
}

bool PackedEVCertsWhitelist::IsValid() const {
  return whitelist_.size() > 0;
}

base::Version PackedEVCertsWhitelist::Version() const {
  return version_;
}

}  // namespace packed_ct_ev_whitelist