Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Issue 2160: Proxy requests for CRLSets through crlsets[n].brave.com #920

Merged
merged 1 commit into from
Nov 27, 2018
Merged

Issue 2160: Proxy requests for CRLSets through crlsets[n].brave.com #920

merged 1 commit into from
Nov 27, 2018

Conversation

jumde
Copy link
Contributor

@jumde jumde commented Nov 16, 2018 •
edited
Loading

fixes brave/brave-browser#2160

Submitter Checklist:

  • Submitted a ticket for my issue if one did not already exist.
  • Used Github auto-closing keywords in the commit message.
  • Added/updated tests for this change (for new code or code which already has tests).
  • Verified that these changes build without errors on
    • Windows
    • macOS
    • Linux
  • Verified that these changes pass automated tests (npm test brave_unit_tests && npm test brave_browser_tests) on
    • Windows
    • macOS
    • Linux
  • Ran git rebase master (if needed).
  • Ran git rebase -i to squash commits (if needed).
  • Tagged reviewers and labelled the pull request as needed.
  • Request a security/privacy review as needed.
  • Add appropriate QA labels (QA/Yes or QA/No) to include the closed issue in milestone

Test Plan:

  1. Delete the user data directory
  2. Start brave and start network monitor like Little Snitch
  3. Verify no connections are made to dl.google.com or *.gvt.com for fetching CRLSets
  4. Verify if CRLSets exist in <data-dir>/CertificateRevocation/
  5. Navigate to revoked.badssl.com to verify certificate error is displayed.

Reviewer Checklist:

  • New files have MPL-2.0 license header.
  • Request a security/privacy review as needed.
  • Adequate test coverage exists to prevent regressions
  • Verify test plan is specified in PR before merging to source

@jumde jumde force-pushed the crlset_proxies branch 3 times, most recently from 52efedb to 808d1b5 Compare November 21, 2018 03:05
diracdeltas
diracdeltas reviewed Nov 21, 2018
View reviewed changes
common/network_constants.cc Outdated
@@ -14,6 +14,8 @@ const char kEmptyImageDataURI[] = "data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP/
const char kJSDataURLPrefix[] = "data:application/javascript;base64,";
const char kGeoLocationsPattern[] = "https://www.googleapis.com/geolocation/v1/geolocate?key=*";
const char kSafeBrowsingPrefix[] = "https://safebrowsing.googleapis.com/";
const char kCRLSetPrefix1[] = "http://dl.google.com/release2/chrome_component/*crl-set*";
const char kCRLSetPrefix2[] = "http://*.gvt1.com/edgedl/release2/chrome_component/*crl-set*";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are you sure these are never sent over HTTPS instead of HTTP?

diracdeltas
diracdeltas reviewed Nov 21, 2018
View reviewed changes
browser/net/brave_static_redirect_network_delegate_helper.cc

if (crlSet_pattern2.MatchesHost(ctx->request_url)) {
replacements.SetSchemeStr("https");
replacements.SetHostStr("crlsets2.brave.com");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

eventually i think it would be good to move all these proxy endpoints to a single endpoint like proxy.brave.com instead of having one endpoint for every google host. that way, people who use little snitch or other firewalls will only have to whitelist one host and new proxied requests will not trigger alerts.

@diracdeltas
Copy link
Member

please add some kind of test for this

@jumde jumde force-pushed the crlset_proxies branch 2 times, most recently from ebbf462 to bdb6031 Compare November 21, 2018 06:57
@jumde
Copy link
Contributor Author

jumde commented Nov 21, 2018

please add some kind of test for this

https://github.com/brave/brave-core/pull/920/files#diff-58c3b6971fd1539fa4e2376e5933752eR104

@diracdeltas
Copy link
Member

@jumde sorry, i meant an automated test that runs as part of the test suite to check that these URLs are being rewritten as expected

@jumde
Copy link
Contributor Author

jumde commented Nov 21, 2018

@jumde sorry, i meant an automated test that runs as part of the test suite to check that these URLs are being rewritten as expected

https://github.com/brave/brave-core/pull/920/files#diff-f31851c38d55f93616f9233f6874e556R71

pilgrim-brave
pilgrim-brave reviewed Nov 26, 2018
View reviewed changes
browser/net/brave_static_redirect_network_delegate_helper.cc Outdated
return false;
});
DCHECK(!is_url_blacklisted) << gurl.spec();

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we should enforce a blacklist here. If the URL remapping logic is solid (and backed by tests, thank you), then this check is unnecessary anyway.

pilgrim-brave
pilgrim-brave reviewed Nov 26, 2018
View reviewed changes
browser/net/brave_static_redirect_network_delegate_helper_unittest.cc
EXPECT_EQ(before_url_context->new_url_spec, expected_url);
EXPECT_EQ(ret, net::OK);
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tests LGTM

@diracdeltas
Copy link
Member

note to the merger: this should be uplift-requested to the same release that #652 is in since it fixes an issue caused by that PR. currently it is requested to be in 0.57

@diracdeltas
Copy link
Member

@pilgrim-brave ready for re-review

@diracdeltas
Copy link
Member

merging and adding uplift to 0.57 request

@diracdeltas diracdeltas merged commit f8f2b2e into master Nov 27, 2018
@diracdeltas diracdeltas deleted the crlset_proxies branch November 27, 2018 21:05
@kjozwiak
Copy link
Member

Because we're planning on migrating muon users during the 0.57.x release and security issues like these tend to be a bit more riskier as any regression(s) that might spawn from this will most likely require an immediate hotfix. This might complicate things during the muon migration. I proposed skipping 0.57.x and getting this into 0.58.x which will be released on Dec 20th. I double checked and made sure @diracdeltas was okay with this as well.

@jumde can you merge this into 0.58.x before Dec 4th so it gets included when 0.58.x moves into beta? BTW, there's no approval needed to land things into the dev channel for now 👍.

jumde pushed a commit that referenced this pull request Nov 28, 2018
@diracdeltas @jumde
Merge pull request #920 from brave/crlset_proxies
dac0881 
Issue 2160: Proxy requests for CRLSets through crlsets[n].brave.com
@jumde
Copy link
Contributor Author

jumde commented Nov 28, 2018

0.58.x - dac0881

@bbondy
Copy link
Member

bbondy commented Nov 28, 2018

master: f8f2b2e

jumde added a commit that referenced this pull request Nov 29, 2018
@jumde
Revert "Merge pull request #920 from brave/crlset_proxies"
c88e7ad 
This reverts commit f8f2b2e, reversing
changes made to e4bc857.
@jumde
Copy link
Contributor Author

jumde commented Nov 29, 2018

Reverted: #986 (master and 0.58.x)

@jumde jumde mentioned this pull request Dec 4, 2018
Merged
18 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@diracdeltas diracdeltas diracdeltas left review comments

@pilgrim-brave pilgrim-brave pilgrim-brave approved these changes

Assignees
No one assigned
Labels
merged/none
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Proxy requests for CRLSets through crlsets[n].brave.com
5 participants
@jumde @diracdeltas @kjozwiak @bbondy @pilgrim-brave