OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
8 | 8 |
9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
(...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
58 #include <sechash.h> | 58 #include <sechash.h> |
59 #include <ssl.h> | 59 #include <ssl.h> |
60 #include <sslerr.h> | 60 #include <sslerr.h> |
61 #include <sslproto.h> | 61 #include <sslproto.h> |
62 | 62 |
63 #include <algorithm> | 63 #include <algorithm> |
64 #include <limits> | 64 #include <limits> |
65 #include <map> | 65 #include <map> |
66 | 66 |
67 #include "base/bind.h" | 67 #include "base/bind.h" |
| 68 #include "base/bind_helpers.h" |
68 #include "base/compiler_specific.h" | 69 #include "base/compiler_specific.h" |
69 #include "base/logging.h" | 70 #include "base/logging.h" |
70 #include "base/memory/singleton.h" | 71 #include "base/memory/singleton.h" |
71 #include "base/metrics/histogram.h" | 72 #include "base/metrics/histogram.h" |
72 #include "base/string_number_conversions.h" | 73 #include "base/string_number_conversions.h" |
73 #include "base/string_util.h" | 74 #include "base/string_util.h" |
74 #include "base/stringprintf.h" | 75 #include "base/stringprintf.h" |
75 #include "base/threading/thread_restrictions.h" | 76 #include "base/threading/thread_restrictions.h" |
76 #include "base/values.h" | 77 #include "base/values.h" |
77 #include "crypto/rsa_private_key.h" | 78 #include "crypto/rsa_private_key.h" |
(...skipping 354 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
432 SSLHostInfo* ssl_host_info, | 433 SSLHostInfo* ssl_host_info, |
433 const SSLClientSocketContext& context) | 434 const SSLClientSocketContext& context) |
434 : ALLOW_THIS_IN_INITIALIZER_LIST(buffer_send_callback_( | 435 : ALLOW_THIS_IN_INITIALIZER_LIST(buffer_send_callback_( |
435 this, &SSLClientSocketNSS::BufferSendComplete)), | 436 this, &SSLClientSocketNSS::BufferSendComplete)), |
436 ALLOW_THIS_IN_INITIALIZER_LIST(buffer_recv_callback_( | 437 ALLOW_THIS_IN_INITIALIZER_LIST(buffer_recv_callback_( |
437 this, &SSLClientSocketNSS::BufferRecvComplete)), | 438 this, &SSLClientSocketNSS::BufferRecvComplete)), |
438 transport_send_busy_(false), | 439 transport_send_busy_(false), |
439 transport_recv_busy_(false), | 440 transport_recv_busy_(false), |
440 corked_(false), | 441 corked_(false), |
441 ALLOW_THIS_IN_INITIALIZER_LIST(handshake_io_callback_( | 442 ALLOW_THIS_IN_INITIALIZER_LIST(handshake_io_callback_( |
442 this, &SSLClientSocketNSS::OnHandshakeIOComplete)), | 443 base::Bind(&SSLClientSocketNSS::OnHandshakeIOComplete, |
| 444 base::Unretained(this)))), |
443 transport_(transport_socket), | 445 transport_(transport_socket), |
444 host_and_port_(host_and_port), | 446 host_and_port_(host_and_port), |
445 ssl_config_(ssl_config), | 447 ssl_config_(ssl_config), |
446 user_connect_callback_(NULL), | 448 user_connect_callback_(NULL), |
447 user_read_callback_(NULL), | 449 user_read_callback_(NULL), |
448 user_write_callback_(NULL), | 450 user_write_callback_(NULL), |
449 user_read_buf_len_(0), | 451 user_read_buf_len_(0), |
450 user_write_buf_len_(0), | 452 user_write_buf_len_(0), |
451 server_cert_nss_(NULL), | 453 server_cert_nss_(NULL), |
452 server_cert_verify_result_(NULL), | 454 server_cert_verify_result_(NULL), |
(...skipping 926 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1379 | 1381 |
1380 rv = SSL_SetPredictedPeerCertificates(nss_fd_, certs.get(), certs_in.size()); | 1382 rv = SSL_SetPredictedPeerCertificates(nss_fd_, certs.get(), certs_in.size()); |
1381 DestroyCertificates(&certs[0], certs_in.size()); | 1383 DestroyCertificates(&certs[0], certs_in.size()); |
1382 DCHECK_EQ(SECSuccess, rv); | 1384 DCHECK_EQ(SECSuccess, rv); |
1383 | 1385 |
1384 return true; | 1386 return true; |
1385 } | 1387 } |
1386 | 1388 |
1387 int SSLClientSocketNSS::DoLoadSSLHostInfo() { | 1389 int SSLClientSocketNSS::DoLoadSSLHostInfo() { |
1388 EnterFunction(""); | 1390 EnterFunction(""); |
1389 int rv = ssl_host_info_->WaitForDataReady(&handshake_io_callback_); | 1391 int rv = ssl_host_info_->WaitForDataReady(handshake_io_callback_); |
1390 GotoState(STATE_HANDSHAKE); | 1392 GotoState(STATE_HANDSHAKE); |
1391 | 1393 |
1392 if (rv == OK) { | 1394 if (rv == OK) { |
1393 if (!LoadSSLHostInfo()) | 1395 if (!LoadSSLHostInfo()) |
1394 LOG(WARNING) << "LoadSSLHostInfo failed: " << host_and_port_.ToString(); | 1396 LOG(WARNING) << "LoadSSLHostInfo failed: " << host_and_port_.ToString(); |
1395 } else { | 1397 } else { |
1396 DCHECK_EQ(ERR_IO_PENDING, rv); | 1398 DCHECK_EQ(ERR_IO_PENDING, rv); |
1397 GotoState(STATE_LOAD_SSL_HOST_INFO); | 1399 GotoState(STATE_LOAD_SSL_HOST_INFO); |
1398 } | 1400 } |
1399 | 1401 |
(...skipping 260 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1660 // chain. So, if the prediction was correct, we should wait for that | 1662 // chain. So, if the prediction was correct, we should wait for that |
1661 // verification to finish rather than start our own. | 1663 // verification to finish rather than start our own. |
1662 net_log_.AddEvent(NetLog::TYPE_SSL_VERIFICATION_MERGED, NULL); | 1664 net_log_.AddEvent(NetLog::TYPE_SSL_VERIFICATION_MERGED, NULL); |
1663 UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 1 /* true */, 2); | 1665 UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 1 /* true */, 2); |
1664 base::TimeTicks end_time = ssl_host_info_->verification_end_time(); | 1666 base::TimeTicks end_time = ssl_host_info_->verification_end_time(); |
1665 if (end_time.is_null()) | 1667 if (end_time.is_null()) |
1666 end_time = base::TimeTicks::Now(); | 1668 end_time = base::TimeTicks::Now(); |
1667 UMA_HISTOGRAM_TIMES("Net.SSLVerificationMergedMsSaved", | 1669 UMA_HISTOGRAM_TIMES("Net.SSLVerificationMergedMsSaved", |
1668 end_time - ssl_host_info_->verification_start_time()); | 1670 end_time - ssl_host_info_->verification_start_time()); |
1669 server_cert_verify_result_ = &ssl_host_info_->cert_verify_result(); | 1671 server_cert_verify_result_ = &ssl_host_info_->cert_verify_result(); |
1670 return ssl_host_info_->WaitForCertVerification(&handshake_io_callback_); | 1672 return ssl_host_info_->WaitForCertVerification(handshake_io_callback_); |
1671 } else { | 1673 } else { |
1672 UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 0 /* false */, 2); | 1674 UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 0 /* false */, 2); |
1673 } | 1675 } |
1674 | 1676 |
1675 int flags = 0; | 1677 int flags = 0; |
1676 if (ssl_config_.rev_checking_enabled) | 1678 if (ssl_config_.rev_checking_enabled) |
1677 flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED; | 1679 flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED; |
1678 if (ssl_config_.verify_ev_cert) | 1680 if (ssl_config_.verify_ev_cert) |
1679 flags |= X509Certificate::VERIFY_EV_CERT; | 1681 flags |= X509Certificate::VERIFY_EV_CERT; |
1680 verifier_.reset(new SingleRequestCertVerifier(cert_verifier_)); | 1682 verifier_.reset(new SingleRequestCertVerifier(cert_verifier_)); |
(...skipping 187 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1868 } | 1870 } |
1869 | 1871 |
1870 // SaveSSLHostInfo saves the certificate chain of the connection so that we can | 1872 // SaveSSLHostInfo saves the certificate chain of the connection so that we can |
1871 // start verification faster in the future. | 1873 // start verification faster in the future. |
1872 void SSLClientSocketNSS::SaveSSLHostInfo() { | 1874 void SSLClientSocketNSS::SaveSSLHostInfo() { |
1873 if (!ssl_host_info_.get()) | 1875 if (!ssl_host_info_.get()) |
1874 return; | 1876 return; |
1875 | 1877 |
1876 // If the SSLHostInfo hasn't managed to load from disk yet then we can't save | 1878 // If the SSLHostInfo hasn't managed to load from disk yet then we can't save |
1877 // anything. | 1879 // anything. |
1878 if (ssl_host_info_->WaitForDataReady(NULL) != OK) | 1880 if (ssl_host_info_->WaitForDataReady(net::CompletionCallback()) != OK) |
1879 return; | 1881 return; |
1880 | 1882 |
1881 SSLHostInfo::State* state = ssl_host_info_->mutable_state(); | 1883 SSLHostInfo::State* state = ssl_host_info_->mutable_state(); |
1882 | 1884 |
1883 state->certs.clear(); | 1885 state->certs.clear(); |
1884 PeerCertificateChain certs(nss_fd_); | 1886 PeerCertificateChain certs(nss_fd_); |
1885 for (unsigned i = 0; i < certs.size(); i++) { | 1887 for (unsigned i = 0; i < certs.size(); i++) { |
1886 if (certs[i]->derCert.len > std::numeric_limits<uint16>::max()) | 1888 if (certs[i]->derCert.len > std::numeric_limits<uint16>::max()) |
1887 return; | 1889 return; |
1888 | 1890 |
(...skipping 727 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2616 valid_thread_id_ = base::PlatformThread::CurrentId(); | 2618 valid_thread_id_ = base::PlatformThread::CurrentId(); |
2617 } | 2619 } |
2618 | 2620 |
2619 bool SSLClientSocketNSS::CalledOnValidThread() const { | 2621 bool SSLClientSocketNSS::CalledOnValidThread() const { |
2620 EnsureThreadIdAssigned(); | 2622 EnsureThreadIdAssigned(); |
2621 base::AutoLock auto_lock(lock_); | 2623 base::AutoLock auto_lock(lock_); |
2622 return valid_thread_id_ == base::PlatformThread::CurrentId(); | 2624 return valid_thread_id_ == base::PlatformThread::CurrentId(); |
2623 } | 2625 } |
2624 | 2626 |
2625 } // namespace net | 2627 } // namespace net |
OLD | NEW |