net: move HSTS preloaded and pinning info out of code.

net/base/hsts_preloaded.json

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file contains the HSTS preloaded list in a machine readable format.
+
+// The top-level element is a dictionary with two keys: "pinsets" maps details
+// of certificate pinning to a name and "entries" contains the HSTS details for
+// each host.
+//
+// "pinsets" is a list of objects. Each object has the following members:
+//   name: (string) the name of the pinset
+//   include: (list of strings) the set of allowed SPKIs hashes
+//   exclude: (optional list of strings) the set of forbidden SPKIs hashes
+//
+// For a given pinset, a certifiacte is accepted if at least one of the
+// "include" SPKIs is found in the chain and none of the "exclude" SPKIs are.
+// SPKIs are specified as names, which must match up with the file of
+// certificates.
+//
+// "entries" is a list of objects. Each object has the following members:
+//   name: (string) the DNS name of the host in question
+//   subdomains: (optional bool) whether subdomains of |name| are also covered
+//   https: (optional bool) whether the covered names should require HTTPS
+//   pins: (optional string) the |name| member of an object in |pinsets|
+
+{
+  "pinsets": [
+    {
+      "name": "test",
+      "include": [
+        "TestSPKI"
+      ]
+    },
+    {
+      "name": "google",
+      "include": [
+        "VeriSignClass3",
+        "VeriSignClass3_G3",
+        "Google1024",
+        "Google2048",
+        "EquifaxSecureCA"
+      ],
+      "exclude": [
+        "Aetna",
+        "Intel",
+        "TCTrustCenter",
+        "Vodafone"
+      ]
+    },
+    {
+      "name": "tor",
+      "include": [
+        "RapidSSL",
+        "DigiCertEVRoot",
+        "Tor1",
+        "Tor2",
+        "Tor3"
+      ]
+    },
+    {
+      "name": "twitterCom",
+      "include": [
+        "VeriSignClass1",
+        "VeriSignClass3",
+        "VeriSignClass3_G4",
+        "VeriSignClass4_G3",
+        "VeriSignClass3_G3",
+        "VeriSignClass1_G3",
+        "VeriSignClass2_G3",
+        "VeriSignClass3_G2",
+        "VeriSignClass2_G2",
+        "VeriSignClass3_G5",
+        "VeriSignUniversal",
+        "GeoTrustGlobal",
+        "GeoTrustGlobal2",
+        "GeoTrustUniversal",
+        "GeoTrustUniversal2",
+        "GeoTrustPrimary",
+        "GeoTrustPrimary_G2",
+        "GeoTrustPrimary_G3",
+        "Twitter1"
+      ]
+    },
+    {
+      "name": "twitterCDN",
+      "include": [
+        "VeriSignClass1",
+        "VeriSignClass3",
+        "VeriSignClass3_G4",
+        "VeriSignClass4_G3",
+        "VeriSignClass3_G3",
+        "VeriSignClass1_G3",
+        "VeriSignClass2_G3",
+        "VeriSignClass3_G2",
+        "VeriSignClass2_G2",
+        "VeriSignClass3_G5",
+        "VeriSignUniversal",
+        "GeoTrustGlobal",
+        "GeoTrustGlobal2",
+        "GeoTrustUniversal",
+        "GeoTrustUniversal2",
+        "GeoTrustPrimary",
+        "GeoTrustPrimary_G2",
+        "GeoTrustPrimary_G3",
+        "Twitter1",
+
+        "Entrust_2048",
+        "Entrust_EV",
+        "Entrust_G2",
+        "Entrust_SSL",
+        "AAACertificateServices",
+        "AddTrustClass1CARoot",
+        "AddTrustExternalCARoot",
+        "AddTrustPublicCARoot",
+        "AddTrustQualifiedCARoot",
+        "COMODOCertificationAuthority",
+        "SecureCertificateServices",
+        "TrustedCertificateServices",
+        "UTNDATACorpSGC",
+        "UTNUSERFirstClientAuthenticationandEmail",
+        "UTNUSERFirstHardware",
+        "UTNUSERFirstObject",
+        "GTECyberTrustGlobalRoot"
+      ]
+    }
+  ],
+
+  "entries": [
+    // Dummy entry to test certificate pinning.
+    { "name": "pinningtest.appspot.com", "subdomains": true, "pins": "test" },

[palmer, 2012/03/26 23:40:21]

Can we use the same key names as I use in the TSS refactor? I document them in
chrome/browser/transport_security_persister.h in my TSS refactor CL
(http://codereview.chromium.org/9415040/). The more harmonized these names are,
the less confusing it will be for the poor maintainers that come after us.

One difference that I think would be ok is to have "static_spki_hashes" have a
string (the name of the array of pins from the JSON above this) instead of a
literal array of base64'd SPKI hashes, as they are in the persisted TSS data
file. I.e. I am just asking you to change these names; your new value semantics
are OK.

+
+    // (*.)google.com, iff using SSL, must use an acceptable certificate.
+    { "name": "google.com", "subdomains": true, "pins": "google" },
+
+    // Now we force HTTPS for subtrees of google.com.
+    { "name": "health.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "checkout.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "chrome.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "docs.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "sites.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "spreadsheets.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "appengine.google.com", "https": true, "pins": "google" },
+    { "name": "encrypted.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "accounts.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "profiles.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "mail.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "talkgadget.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "talk.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "hostedtalkgadget.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "plus.google.com", "subdomains": true, "https": true, "pins": "google" },
+
+    // Other Google related domain that must use HTTPS.
+    { "name": "market.android.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "ssl.google-analytics.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "drive.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "googleplex.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "groups.google.com", "subdomains": true, "https": true, "pins": "google" },
+    { "name": "apis.google.com", "subdomains": true, "https": true, "pins": "google" },
+
+    // chart.apis.google.com is *not* HSTS because the certificate doesn't match
+    // and there are lots of links out there that still use the name. The correct
+    // hostname for this is chart.googleapis.com.
+    { "name": "chart.apis.google.com", "subdomains": true, "pins": "google" },
+
+    // Other Google-related domains that must use an acceptable certificate
+    // iff using SSL.
+    { "name": "ytimg.com", "subdomains": true, "pins": "google" },
+    { "name": "googleusercontent.com", "subdomains": true, "pins": "google" },
+    { "name": "youtube.com", "subdomains": true, "pins": "google" },
+    { "name": "googleapis.com", "subdomains": true, "pins": "google" },
+    { "name": "googleadservices.com", "subdomains": true, "pins": "google" },
+    { "name": "googlecode.com", "subdomains": true, "pins": "google" },
+    { "name": "appspot.com", "subdomains": true, "pins": "google" },
+    { "name": "googlesyndication.com", "subdomains": true, "pins": "google" },
+    { "name": "doubleclick.net", "subdomains": true, "pins": "google" },
+    { "name": "ssl.gstatic.com", "subdomains": true, "pins": "google" },
+    // Exclude the learn.doubleclick.net subdomain because it uses a different
+    // CA.
+    { "name": "learn.doubleclick.net", "subdomains": true },
+
+    // Force HTTPS for sites that have requested it.
+    { "name": "www.paypal.com", "https": true },
+    { "name": "www.elanex.biz", "https": true },
+    { "name": "jottit.com", "subdomains": true, "https": true },
+    { "name": "sunshinepress.org", "subdomains": true, "https": true },
+    { "name": "www.noisebridge.net", "https": true },
+    { "name": "neg9.org", "https": true },
+    { "name": "riseup.net", "subdomains": true, "https": true },
+    { "name": "factor.cc", "https": true },
+    { "name": "members.mayfirst.org", "https": true },
+    { "name": "support.mayfirst.org", "https": true },
+    { "name": "id.mayfirst.org", "https": true },
+    { "name": "lists.mayfirst.org", "https": true },
+    { "name": "splendidbacon.com", "subdomains": true, "https": true },
+    { "name": "aladdinschools.appspot.com", "https": true },
+    { "name": "ottospora.nl", "subdomains": true, "https": true },
+    { "name": "www.paycheckrecords.com", "https": true },
+    { "name": "lastpass.com", "https": true },
+    { "name": "www.lastpass.com", "https": true },
+    { "name": "keyerror.com", "subdomains": true, "https": true },
+    { "name": "entropia.de", "https": true },
+    { "name": "www.entropia.de", "https": true },
+    { "name": "romab.com", "subdomains": true, "https": true },
+    { "name": "logentries.com", "https": true },
+    { "name": "www.logentries.com", "https": true },
+    { "name": "stripe.com", "subdomains": true, "https": true },
+    { "name": "cloudsecurityalliance.org", "subdomains": true, "https": true },
+    { "name": "login.sapo.pt", "subdomains": true, "https": true },
+    { "name": "mattmccutchen.net", "subdomains": true, "https": true },
+    { "name": "betnet.fr", "subdomains": true, "https": true },
+    { "name": "uprotect.it", "subdomains": true, "https": true },
+    { "name": "squareup.com", "https": true },
+    { "name": "cert.se", "subdomains": true, "https": true },
+    { "name": "crypto.is", "subdomains": true, "https": true },
+    { "name": "simon.butcher.name", "subdomains": true, "https": true },
+    { "name": "linx.net", "subdomains": true, "https": true },
+    { "name": "dropcam.com", "https": true },
+    { "name": "www.dropcam.com", "https": true },
+    { "name": "ebanking.indovinabank.com.vn", "subdomains": true, "https": true },
+    { "name": "epoxate.com", "https": true },
+    { "name": "torproject.org", "https": true, "pins": "tor" },
+    { "name": "blog.torproject.org", "subdomains": true, "https": true, "pins": "tor" },
+    { "name": "check.torproject.org", "subdomains": true, "https": true, "pins": "tor" },
+    { "name": "www.torproject.org", "subdomains": true, "https": true, "pins": "tor" },
+    { "name": "www.moneybookers.com", "subdomains": true, "https": true },
+    { "name": "ledgerscope.net", "https": true },
+    { "name": "www.ledgerscope.net", "https": true },
+    { "name": "kyps.net", "https": true },
+    { "name": "www.kyps.net", "https": true },
+    { "name": "app.recurly.com", "subdomains": true, "https": true },
+    { "name": "api.recurly.com", "subdomains": true, "https": true },
+    { "name": "greplin.com", "https": true },
+    { "name": "www.greplin.com", "https": true },
+    { "name": "luneta.nearbuysystems.com", "subdomains": true, "https": true },
+    { "name": "ubertt.org", "subdomains": true, "https": true },
+    { "name": "pixi.me", "subdomains": true, "https": true },
+    { "name": "grepular.com", "subdomains": true, "https": true },
+    { "name": "mydigipass.com", "https": true },
+    { "name": "www.mydigipass.com", "https": true },
+    { "name": "developer.mydigipass.com", "https": true },
+    { "name": "www.developer.mydigipass.com", "https": true },
+    { "name": "sandbox.mydigipass.com", "https": true },
+    { "name": "www.sandbox.mydigipass.com", "https": true },
+    { "name": "crypto.cat", "subdomains": true, "https": true },
+    { "name": "bigshinylock.minazo.net", "subdomains": true, "https": true },
+    { "name": "crate.io", "subdomains": true, "https": true },
+    { "name": "twitter.com", "pins": "twitterCom" },
+    { "name": "www.twitter.com", "subdomains": true, "pins": "twitterCom" },
+    { "name": "api.twitter.com", "subdomains": true, "pins": "twitterCDN" },
+    { "name": "oauth.twitter.com", "subdomains": true, "pins": "twitterCom" },
+    { "name": "mobile.twitter.com", "subdomains": true, "pins": "twitterCom" },
+    { "name": "dev.twitter.com", "subdomains": true, "pins": "twitterCom" },
+    { "name": "business.twitter.com", "subdomains": true, "pins": "twitterCom" },
+    { "name": "platform.twitter.com", "subdomains": true, "pins": "twitterCDN" },
+    { "name": "si0.twimg.com", "subdomains": true, "pins": "twitterCDN" },
+    { "name": "twimg0-a.akamaihd.net", "subdomains": true, "pins": "twitterCDN" },
+
+    // Entries that are only valid if the client supports SNI.
+    { "name": "gmail.com", "https": true, "pins": "google", "snionly": true },
+    { "name": "googlemail.com", "https": true, "pins": "google", "snionly": true },
+    { "name": "www.gmail.com", "https": true, "pins": "google", "snionly": true },
+    { "name": "www.googlemail.com", "https": true, "pins": "google", "snionly": true },
+    { "name": "google-analytics.com", "subdomains": true, "pins": "google", "snionly": true },
+    { "name": "googlegroups.com", "subdomains": true, "pins": "google", "snionly": true }
+  ]
+}