| OLD | NEW |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
| 6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
| 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
| 8 | 8 |
| 9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
| 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
| (...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 58 #include <sechash.h> | 58 #include <sechash.h> |
| 59 #include <ssl.h> | 59 #include <ssl.h> |
| 60 #include <sslerr.h> | 60 #include <sslerr.h> |
| 61 #include <sslproto.h> | 61 #include <sslproto.h> |
| 62 | 62 |
| 63 #include <algorithm> | 63 #include <algorithm> |
| 64 #include <limits> | 64 #include <limits> |
| 65 #include <map> | 65 #include <map> |
| 66 | 66 |
| 67 #include "base/bind.h" | 67 #include "base/bind.h" |
| 68 #include "base/bind_helpers.h" |
| 68 #include "base/compiler_specific.h" | 69 #include "base/compiler_specific.h" |
| 69 #include "base/logging.h" | 70 #include "base/logging.h" |
| 70 #include "base/memory/singleton.h" | 71 #include "base/memory/singleton.h" |
| 71 #include "base/metrics/histogram.h" | 72 #include "base/metrics/histogram.h" |
| 72 #include "base/string_number_conversions.h" | 73 #include "base/string_number_conversions.h" |
| 73 #include "base/string_util.h" | 74 #include "base/string_util.h" |
| 74 #include "base/stringprintf.h" | 75 #include "base/stringprintf.h" |
| 75 #include "base/threading/thread_restrictions.h" | 76 #include "base/threading/thread_restrictions.h" |
| 76 #include "base/values.h" | 77 #include "base/values.h" |
| 77 #include "crypto/rsa_private_key.h" | 78 #include "crypto/rsa_private_key.h" |
| (...skipping 354 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 432 SSLHostInfo* ssl_host_info, | 433 SSLHostInfo* ssl_host_info, |
| 433 const SSLClientSocketContext& context) | 434 const SSLClientSocketContext& context) |
| 434 : ALLOW_THIS_IN_INITIALIZER_LIST(buffer_send_callback_( | 435 : ALLOW_THIS_IN_INITIALIZER_LIST(buffer_send_callback_( |
| 435 this, &SSLClientSocketNSS::BufferSendComplete)), | 436 this, &SSLClientSocketNSS::BufferSendComplete)), |
| 436 ALLOW_THIS_IN_INITIALIZER_LIST(buffer_recv_callback_( | 437 ALLOW_THIS_IN_INITIALIZER_LIST(buffer_recv_callback_( |
| 437 this, &SSLClientSocketNSS::BufferRecvComplete)), | 438 this, &SSLClientSocketNSS::BufferRecvComplete)), |
| 438 transport_send_busy_(false), | 439 transport_send_busy_(false), |
| 439 transport_recv_busy_(false), | 440 transport_recv_busy_(false), |
| 440 corked_(false), | 441 corked_(false), |
| 441 ALLOW_THIS_IN_INITIALIZER_LIST(handshake_io_callback_( | 442 ALLOW_THIS_IN_INITIALIZER_LIST(handshake_io_callback_( |
| 442 this, &SSLClientSocketNSS::OnHandshakeIOComplete)), | 443 base::Bind(&SSLClientSocketNSS::OnHandshakeIOComplete, |
| 444 base::Unretained(this)))), |
| 443 transport_(transport_socket), | 445 transport_(transport_socket), |
| 444 host_and_port_(host_and_port), | 446 host_and_port_(host_and_port), |
| 445 ssl_config_(ssl_config), | 447 ssl_config_(ssl_config), |
| 446 user_connect_callback_(NULL), | 448 user_connect_callback_(NULL), |
| 447 user_read_callback_(NULL), | 449 user_read_callback_(NULL), |
| 448 user_write_callback_(NULL), | 450 user_write_callback_(NULL), |
| 449 user_read_buf_len_(0), | 451 user_read_buf_len_(0), |
| 450 user_write_buf_len_(0), | 452 user_write_buf_len_(0), |
| 451 server_cert_nss_(NULL), | 453 server_cert_nss_(NULL), |
| 452 server_cert_verify_result_(NULL), | 454 server_cert_verify_result_(NULL), |
| (...skipping 926 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1379 | 1381 |
| 1380 rv = SSL_SetPredictedPeerCertificates(nss_fd_, certs.get(), certs_in.size()); | 1382 rv = SSL_SetPredictedPeerCertificates(nss_fd_, certs.get(), certs_in.size()); |
| 1381 DestroyCertificates(&certs[0], certs_in.size()); | 1383 DestroyCertificates(&certs[0], certs_in.size()); |
| 1382 DCHECK_EQ(SECSuccess, rv); | 1384 DCHECK_EQ(SECSuccess, rv); |
| 1383 | 1385 |
| 1384 return true; | 1386 return true; |
| 1385 } | 1387 } |
| 1386 | 1388 |
| 1387 int SSLClientSocketNSS::DoLoadSSLHostInfo() { | 1389 int SSLClientSocketNSS::DoLoadSSLHostInfo() { |
| 1388 EnterFunction(""); | 1390 EnterFunction(""); |
| 1389 int rv = ssl_host_info_->WaitForDataReady(&handshake_io_callback_); | 1391 int rv = ssl_host_info_->WaitForDataReady(handshake_io_callback_); |
| 1390 GotoState(STATE_HANDSHAKE); | 1392 GotoState(STATE_HANDSHAKE); |
| 1391 | 1393 |
| 1392 if (rv == OK) { | 1394 if (rv == OK) { |
| 1393 if (!LoadSSLHostInfo()) | 1395 if (!LoadSSLHostInfo()) |
| 1394 LOG(WARNING) << "LoadSSLHostInfo failed: " << host_and_port_.ToString(); | 1396 LOG(WARNING) << "LoadSSLHostInfo failed: " << host_and_port_.ToString(); |
| 1395 } else { | 1397 } else { |
| 1396 DCHECK_EQ(ERR_IO_PENDING, rv); | 1398 DCHECK_EQ(ERR_IO_PENDING, rv); |
| 1397 GotoState(STATE_LOAD_SSL_HOST_INFO); | 1399 GotoState(STATE_LOAD_SSL_HOST_INFO); |
| 1398 } | 1400 } |
| 1399 | 1401 |
| (...skipping 260 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1660 // chain. So, if the prediction was correct, we should wait for that | 1662 // chain. So, if the prediction was correct, we should wait for that |
| 1661 // verification to finish rather than start our own. | 1663 // verification to finish rather than start our own. |
| 1662 net_log_.AddEvent(NetLog::TYPE_SSL_VERIFICATION_MERGED, NULL); | 1664 net_log_.AddEvent(NetLog::TYPE_SSL_VERIFICATION_MERGED, NULL); |
| 1663 UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 1 /* true */, 2); | 1665 UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 1 /* true */, 2); |
| 1664 base::TimeTicks end_time = ssl_host_info_->verification_end_time(); | 1666 base::TimeTicks end_time = ssl_host_info_->verification_end_time(); |
| 1665 if (end_time.is_null()) | 1667 if (end_time.is_null()) |
| 1666 end_time = base::TimeTicks::Now(); | 1668 end_time = base::TimeTicks::Now(); |
| 1667 UMA_HISTOGRAM_TIMES("Net.SSLVerificationMergedMsSaved", | 1669 UMA_HISTOGRAM_TIMES("Net.SSLVerificationMergedMsSaved", |
| 1668 end_time - ssl_host_info_->verification_start_time()); | 1670 end_time - ssl_host_info_->verification_start_time()); |
| 1669 server_cert_verify_result_ = &ssl_host_info_->cert_verify_result(); | 1671 server_cert_verify_result_ = &ssl_host_info_->cert_verify_result(); |
| 1670 return ssl_host_info_->WaitForCertVerification(&handshake_io_callback_); | 1672 return ssl_host_info_->WaitForCertVerification(handshake_io_callback_); |
| 1671 } else { | 1673 } else { |
| 1672 UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 0 /* false */, 2); | 1674 UMA_HISTOGRAM_ENUMERATION("Net.SSLVerificationMerged", 0 /* false */, 2); |
| 1673 } | 1675 } |
| 1674 | 1676 |
| 1675 int flags = 0; | 1677 int flags = 0; |
| 1676 if (ssl_config_.rev_checking_enabled) | 1678 if (ssl_config_.rev_checking_enabled) |
| 1677 flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED; | 1679 flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED; |
| 1678 if (ssl_config_.verify_ev_cert) | 1680 if (ssl_config_.verify_ev_cert) |
| 1679 flags |= X509Certificate::VERIFY_EV_CERT; | 1681 flags |= X509Certificate::VERIFY_EV_CERT; |
| 1680 verifier_.reset(new SingleRequestCertVerifier(cert_verifier_)); | 1682 verifier_.reset(new SingleRequestCertVerifier(cert_verifier_)); |
| (...skipping 187 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1868 } | 1870 } |
| 1869 | 1871 |
| 1870 // SaveSSLHostInfo saves the certificate chain of the connection so that we can | 1872 // SaveSSLHostInfo saves the certificate chain of the connection so that we can |
| 1871 // start verification faster in the future. | 1873 // start verification faster in the future. |
| 1872 void SSLClientSocketNSS::SaveSSLHostInfo() { | 1874 void SSLClientSocketNSS::SaveSSLHostInfo() { |
| 1873 if (!ssl_host_info_.get()) | 1875 if (!ssl_host_info_.get()) |
| 1874 return; | 1876 return; |
| 1875 | 1877 |
| 1876 // If the SSLHostInfo hasn't managed to load from disk yet then we can't save | 1878 // If the SSLHostInfo hasn't managed to load from disk yet then we can't save |
| 1877 // anything. | 1879 // anything. |
| 1878 if (ssl_host_info_->WaitForDataReady(NULL) != OK) | 1880 if (ssl_host_info_->WaitForDataReady(net::CompletionCallback()) != OK) |
| 1879 return; | 1881 return; |
| 1880 | 1882 |
| 1881 SSLHostInfo::State* state = ssl_host_info_->mutable_state(); | 1883 SSLHostInfo::State* state = ssl_host_info_->mutable_state(); |
| 1882 | 1884 |
| 1883 state->certs.clear(); | 1885 state->certs.clear(); |
| 1884 PeerCertificateChain certs(nss_fd_); | 1886 PeerCertificateChain certs(nss_fd_); |
| 1885 for (unsigned i = 0; i < certs.size(); i++) { | 1887 for (unsigned i = 0; i < certs.size(); i++) { |
| 1886 if (certs[i]->derCert.len > std::numeric_limits<uint16>::max()) | 1888 if (certs[i]->derCert.len > std::numeric_limits<uint16>::max()) |
| 1887 return; | 1889 return; |
| 1888 | 1890 |
| (...skipping 727 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2616 valid_thread_id_ = base::PlatformThread::CurrentId(); | 2618 valid_thread_id_ = base::PlatformThread::CurrentId(); |
| 2617 } | 2619 } |
| 2618 | 2620 |
| 2619 bool SSLClientSocketNSS::CalledOnValidThread() const { | 2621 bool SSLClientSocketNSS::CalledOnValidThread() const { |
| 2620 EnsureThreadIdAssigned(); | 2622 EnsureThreadIdAssigned(); |
| 2621 base::AutoLock auto_lock(lock_); | 2623 base::AutoLock auto_lock(lock_); |
| 2622 return valid_thread_id_ == base::PlatformThread::CurrentId(); | 2624 return valid_thread_id_ == base::PlatformThread::CurrentId(); |
| 2623 } | 2625 } |
| 2624 | 2626 |
| 2625 } // namespace net | 2627 } // namespace net |
| OLD | NEW |