1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
|
// Copyright 2015 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "components/certificate_reporting/error_reporter.h"
#include <stddef.h>
#include <set>
#include <utility>
#include "base/logging.h"
#include "base/memory/ptr_util.h"
#include "base/metrics/histogram_macros.h"
#include "base/metrics/sparse_histogram.h"
#include "components/certificate_reporting/encrypted_cert_logger.pb.h"
#include "crypto/aead.h"
#include "crypto/curve25519.h"
#include "crypto/hkdf.h"
#include "crypto/random.h"
#include "net/url_request/report_sender.h"
namespace certificate_reporting {
namespace {
// Constants used for crypto. The corresponding private key is used by
// the SafeBrowsing client-side detection server to decrypt reports.
static const uint8_t kServerPublicKey[] = {
0x51, 0xcc, 0x52, 0x67, 0x42, 0x47, 0x3b, 0x10, 0xe8, 0x63, 0x18,
0x3c, 0x61, 0xa7, 0x96, 0x76, 0x86, 0x91, 0x40, 0x71, 0x39, 0x5f,
0x31, 0x1a, 0x39, 0x5b, 0x76, 0xb1, 0x6b, 0x3d, 0x6a, 0x2b};
static const uint32_t kServerPublicKeyVersion = 1;
static const char kHkdfLabel[] = "certificate report";
bool GetHkdfSubkeySecret(size_t subkey_length,
const uint8_t* private_key,
const uint8_t* public_key,
std::string* secret) {
uint8_t shared_secret[crypto::curve25519::kBytes];
if (!crypto::curve25519::ScalarMult(private_key, public_key, shared_secret))
return false;
// By mistake, the HKDF label here ends up with an extra null byte on
// the end, due to using sizeof(kHkdfLabel) in the StringPiece
// constructor instead of strlen(kHkdfLabel). Ideally this code should
// be just passing kHkdfLabel directly into the HKDF constructor.
//
// TODO(estark): fix this in coordination with the server-side code --
// perhaps by rolling the public key version forward and using the
// version to decide whether to use the extra-null-byte version of the
// label. https://crbug.com/517746
crypto::HKDF hkdf(base::StringPiece(reinterpret_cast<char*>(shared_secret),
sizeof(shared_secret)),
"" /* salt */,
base::StringPiece(kHkdfLabel, sizeof(kHkdfLabel)),
0 /* key bytes */, 0 /* iv bytes */, subkey_length);
*secret = hkdf.subkey_secret().as_string();
return true;
}
bool EncryptSerializedReport(const uint8_t* server_public_key,
uint32_t server_public_key_version,
const std::string& report,
EncryptedCertLoggerRequest* encrypted_report) {
// Generate an ephemeral key pair to generate a shared secret.
uint8_t public_key[crypto::curve25519::kBytes];
uint8_t private_key[crypto::curve25519::kScalarBytes];
crypto::RandBytes(private_key, sizeof(private_key));
crypto::curve25519::ScalarBaseMult(private_key, public_key);
crypto::Aead aead(crypto::Aead::AES_128_CTR_HMAC_SHA256);
std::string key;
if (!GetHkdfSubkeySecret(aead.KeyLength(), private_key,
reinterpret_cast<const uint8_t*>(server_public_key),
&key)) {
LOG(ERROR) << "Error getting subkey secret.";
return false;
}
aead.Init(&key);
// Use an all-zero nonce because the key is random per-message.
std::string nonce(aead.NonceLength(), '\0');
std::string ciphertext;
if (!aead.Seal(report, nonce, std::string(), &ciphertext)) {
LOG(ERROR) << "Error sealing certificate report.";
return false;
}
encrypted_report->set_encrypted_report(ciphertext);
encrypted_report->set_server_public_key_version(server_public_key_version);
encrypted_report->set_client_public_key(reinterpret_cast<char*>(public_key),
sizeof(public_key));
encrypted_report->set_algorithm(
EncryptedCertLoggerRequest::AEAD_ECDH_AES_128_CTR_HMAC_SHA256);
return true;
}
// Records an UMA histogram of the net errors when certificate reports
// fail to send.
void RecordUMAOnFailure(const GURL& report_uri, int net_error) {
UMA_HISTOGRAM_SPARSE_SLOWLY("SSL.CertificateErrorReportFailure", -net_error);
}
} // namespace
ErrorReporter::ErrorReporter(
net::URLRequestContext* request_context,
const GURL& upload_url,
net::ReportSender::CookiesPreference cookies_preference)
: ErrorReporter(
upload_url,
kServerPublicKey,
kServerPublicKeyVersion,
base::MakeUnique<net::ReportSender>(request_context,
cookies_preference,
base::Bind(RecordUMAOnFailure))) {
}
ErrorReporter::ErrorReporter(
const GURL& upload_url,
const uint8_t server_public_key[/* 32 */],
const uint32_t server_public_key_version,
std::unique_ptr<net::ReportSender> certificate_report_sender)
: certificate_report_sender_(std::move(certificate_report_sender)),
upload_url_(upload_url),
server_public_key_(server_public_key),
server_public_key_version_(server_public_key_version) {
DCHECK(certificate_report_sender_);
DCHECK(!upload_url.is_empty());
}
ErrorReporter::~ErrorReporter() {}
void ErrorReporter::SendExtendedReportingReport(
const std::string& serialized_report) {
if (upload_url_.SchemeIsCryptographic()) {
certificate_report_sender_->Send(upload_url_, "application/octet-stream",
serialized_report);
} else {
EncryptedCertLoggerRequest encrypted_report;
if (!EncryptSerializedReport(server_public_key_, server_public_key_version_,
serialized_report, &encrypted_report)) {
LOG(ERROR) << "Failed to encrypt serialized report.";
return;
}
std::string serialized_encrypted_report;
encrypted_report.SerializeToString(&serialized_encrypted_report);
certificate_report_sender_->Send(upload_url_, "application/octet-stream",
serialized_encrypted_report);
}
}
// Used only by tests.
bool ErrorReporter::DecryptErrorReport(
const uint8_t server_private_key[32],
const EncryptedCertLoggerRequest& encrypted_report,
std::string* decrypted_serialized_report) {
crypto::Aead aead(crypto::Aead::AES_128_CTR_HMAC_SHA256);
std::string key;
if (!GetHkdfSubkeySecret(aead.KeyLength(), server_private_key,
reinterpret_cast<const uint8_t*>(
encrypted_report.client_public_key().data()),
&key)) {
LOG(ERROR) << "Error getting subkey secret.";
return false;
}
aead.Init(&key);
// Use an all-zero nonce because the key is random per-message.
std::string nonce(aead.NonceLength(), 0);
return aead.Open(encrypted_report.encrypted_report(), nonce, std::string(),
decrypted_serialized_report);
}
} // namespace certificate_reporting
|
