Route OCSP stapling through CertVerifier.

net/cert/multi_threaded_cert_verifier.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_threaded_cert_verifier.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/profiler/scoped_tracker.h"
+#include "base/sha1.h"
 #include "base/stl_util.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/worker_pool.h"
 #include "base/time/time.h"
 #include "base/values.h"
 #include "net/base/hash_value.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_trust_anchor_provider.h"
 #include "net/cert/cert_verify_proc.h"
 #include "net/cert/crl_set.h"
@@ skipping 186 matching lines @@
 
 
 // CertVerifierWorker runs on a worker thread and takes care of the blocking
 // process of performing the certificate verification.  Deletes itself
 // eventually if Start() succeeds.
 class CertVerifierWorker {
  public:
   CertVerifierWorker(CertVerifyProc* verify_proc,
                      X509Certificate* cert,
                      const std::string& hostname,
+                     const std::string& ocsp_response,
                      int flags,
                      CRLSet* crl_set,
                      const CertificateList& additional_trust_anchors,
                      MultiThreadedCertVerifier* cert_verifier)
       : verify_proc_(verify_proc),
         cert_(cert),
         hostname_(hostname),
+        ocsp_response_(ocsp_response),
         flags_(flags),
         crl_set_(crl_set),
         additional_trust_anchors_(additional_trust_anchors),
         origin_loop_(base::MessageLoop::current()),
         cert_verifier_(cert_verifier),
         canceled_(false),
-        error_(ERR_FAILED) {
-  }
+        error_(ERR_FAILED) {}
 
   // Returns the certificate being verified. May only be called /before/
   // Start() is called.
   X509Certificate* certificate() const { return cert_.get(); }
 
   bool Start() {
     DCHECK_EQ(base::MessageLoop::current(), origin_loop_);
 
     return base::WorkerPool::PostTask(
         FROM_HERE, base::Bind(&CertVerifierWorker::Run, base::Unretained(this)),
         true /* task is slow */);
   }
 
   // Cancel is called from the origin loop when the MultiThreadedCertVerifier is
   // getting deleted.
   void Cancel() {
     DCHECK_EQ(base::MessageLoop::current(), origin_loop_);
     base::AutoLock locked(lock_);
     canceled_ = true;
   }
 
  private:
   void Run() {
     // Runs on a worker thread.
-    error_ = verify_proc_->Verify(cert_.get(),
-                                  hostname_,
-                                  flags_,
-                                  crl_set_.get(),
-                                  additional_trust_anchors_,
-                                  &verify_result_);
+    error_ = verify_proc_->Verify(cert_.get(), hostname_, ocsp_response_,
+                                  flags_, crl_set_.get(),
+                                  additional_trust_anchors_, &verify_result_);
 #if defined(USE_NSS_CERTS) || defined(OS_IOS)
     // Detach the thread from NSPR.
     // Calling NSS functions attaches the thread to NSPR, which stores
     // the NSPR thread ID in thread-specific data.
     // The threads in our thread pool terminate after we have called
     // PR_Cleanup.  Unless we detach them from NSPR, net_unittests gets
     // segfaults on shutdown when the threads' thread-specific data
     // destructors run.
     PR_DetachThread();
 #endif
     Finish();
   }
 
   // DoReply runs on the origin thread.
   void DoReply() {
     // TODO(pkasting): Remove ScopedTracker below once crbug.com/477117 is
     // fixed.
     tracked_objects::ScopedTracker tracking_profile(
         FROM_HERE_WITH_EXPLICIT_FUNCTION("477117 CertVerifierWorker::DoReply"));
     DCHECK_EQ(base::MessageLoop::current(), origin_loop_);
     {
       // We lock here because the worker thread could still be in Finished,
       // after the PostTask, but before unlocking |lock_|. If we do not lock in
       // this case, we will end up deleting a locked Lock, which can lead to
       // memory leaks or worse errors.
       base::AutoLock locked(lock_);
       if (!canceled_) {
-        cert_verifier_->HandleResult(cert_.get(),
-                                     hostname_,
-                                     flags_,
-                                     additional_trust_anchors_,
-                                     error_,
+        cert_verifier_->HandleResult(cert_.get(), hostname_, ocsp_response_,
+                                     flags_, additional_trust_anchors_, error_,
                                      verify_result_);
       }
     }
     delete this;
   }
 
   void Finish() {
     // Runs on the worker thread.
     // We assume that the origin loop outlives the MultiThreadedCertVerifier. If
     // the MultiThreadedCertVerifier is deleted, it will call Cancel on us. If
@@ skipping 16 matching lines @@
       }
     }
 
     if (canceled)
       delete this;
   }
 
   scoped_refptr<CertVerifyProc> verify_proc_;
   scoped_refptr<X509Certificate> cert_;
   const std::string hostname_;
+  const std::string ocsp_response_;
   const int flags_;
   scoped_refptr<CRLSet> crl_set_;
   const CertificateList additional_trust_anchors_;
   base::MessageLoop* const origin_loop_;
   MultiThreadedCertVerifier* const cert_verifier_;
 
   // lock_ protects canceled_.
   base::Lock lock_;
 
   // If canceled_ is true,
@@ skipping 109 matching lines @@
 }
 
 void MultiThreadedCertVerifier::SetCertTrustAnchorProvider(
     CertTrustAnchorProvider* trust_anchor_provider) {
   DCHECK(CalledOnValidThread());
   trust_anchor_provider_ = trust_anchor_provider;
 }
 
 int MultiThreadedCertVerifier::Verify(X509Certificate* cert,
                                       const std::string& hostname,
+                                      const std::string& ocsp_response,
                                       int flags,
                                       CRLSet* crl_set,
                                       CertVerifyResult* verify_result,
                                       const CompletionCallback& callback,
                                       RequestHandle* out_req,
                                       const BoundNetLog& net_log) {
   DCHECK(CalledOnValidThread());
 
   if (callback.is_null() || !verify_result || hostname.empty()) {
     *out_req = NULL;
     return ERR_INVALID_ARGUMENT;
   }
 
   requests_++;
 
   const CertificateList empty_cert_list;
   const CertificateList& additional_trust_anchors =
       trust_anchor_provider_ ?
           trust_anchor_provider_->GetAdditionalTrustAnchors() : empty_cert_list;
 
-  const RequestParams key(cert->fingerprint(), cert->ca_fingerprint(),
-                          hostname, flags, additional_trust_anchors);
+  const RequestParams key(cert->fingerprint(), cert->ca_fingerprint(), hostname,
+                          ocsp_response, flags, additional_trust_anchors);
   const CertVerifierCache::value_type* cached_entry =
       cache_.Get(key, CacheValidityPeriod(base::Time::Now()));
   if (cached_entry) {
     ++cache_hits_;
     *out_req = NULL;
     *verify_result = cached_entry->result;
     return cached_entry->error;
   }
 
   // No cache hit. See if an identical request is currently in flight.
   CertVerifierJob* job;
   std::map<RequestParams, CertVerifierJob*>::const_iterator j;
   j = inflight_.find(key);
   if (j != inflight_.end()) {
     // An identical request is in flight already. We'll just attach our
     // callback.
     inflight_joins_++;
     job = j->second;
   } else {
     // Need to make a new request.
-    CertVerifierWorker* worker =
-        new CertVerifierWorker(verify_proc_.get(),
-                               cert,
-                               hostname,
-                               flags,
-                               crl_set,
-                               additional_trust_anchors,
-                               this);
+    CertVerifierWorker* worker = new CertVerifierWorker(
+        verify_proc_.get(), cert, hostname, ocsp_response, flags, crl_set,
+        additional_trust_anchors, this);
     job = new CertVerifierJob(
         worker,
         BoundNetLog::Make(net_log.net_log(), NetLog::SOURCE_CERT_VERIFIER_JOB));
     if (!worker->Start()) {
       delete job;
       delete worker;
       *out_req = NULL;
       // TODO(wtc): log to the NetLog.
       LOG(ERROR) << "CertVerifierWorker couldn't be started.";
       return ERR_INSUFFICIENT_RESOURCES;  // Just a guess.
@@ skipping 11 matching lines @@
   *out_req = request;
   return ERR_IO_PENDING;
 }
 
 void MultiThreadedCertVerifier::CancelRequest(RequestHandle req) {
   DCHECK(CalledOnValidThread());
   CertVerifierRequest* request = reinterpret_cast<CertVerifierRequest*>(req);
   request->Cancel();
 }
 
+bool MultiThreadedCertVerifier::SupportsOCSPStapling() {
+  return verify_proc_->SupportsOCSPStapling();
+}
+
 MultiThreadedCertVerifier::RequestParams::RequestParams(
     const SHA1HashValue& cert_fingerprint_arg,
     const SHA1HashValue& ca_fingerprint_arg,
     const std::string& hostname_arg,
+    const std::string& ocsp_response_arg,
     int flags_arg,
     const CertificateList& additional_trust_anchors)
-    : hostname(hostname_arg),
-      flags(flags_arg) {
-  hash_values.reserve(2 + additional_trust_anchors.size());
+    : hostname(hostname_arg), flags(flags_arg) {
+  hash_values.reserve(3 + additional_trust_anchors.size());
+  SHA1HashValue ocsp_hash;
+  base::SHA1HashBytes(
+      reinterpret_cast<const unsigned char*>(ocsp_response_arg.data()),
+      ocsp_response_arg.size(), ocsp_hash.data);
+  hash_values.push_back(ocsp_hash);
   hash_values.push_back(cert_fingerprint_arg);
   hash_values.push_back(ca_fingerprint_arg);
   for (size_t i = 0; i < additional_trust_anchors.size(); ++i)
     hash_values.push_back(additional_trust_anchors[i]->fingerprint());
 }
 
 MultiThreadedCertVerifier::RequestParams::~RequestParams() {}
 
 bool MultiThreadedCertVerifier::RequestParams::operator<(
     const RequestParams& other) const {
-  // |flags| is compared before |cert_fingerprint|, |ca_fingerprint|, and
-  // |hostname| under assumption that integer comparisons are faster than
-  // memory and string comparisons.
+  // |flags| is compared before |cert_fingerprint|, |ca_fingerprint|,
+  // |hostname|, and |ocsp_response|, under assumption that integer comparisons
+  // are faster than memory and string comparisons.
   if (flags != other.flags)
     return flags < other.flags;
   if (hostname != other.hostname)
     return hostname < other.hostname;
   return std::lexicographical_compare(
       hash_values.begin(), hash_values.end(), other.hash_values.begin(),
       other.hash_values.end(), SHA1HashValueLessThan());
 }
 
 // HandleResult is called by CertVerifierWorker on the origin message loop.
 // It deletes CertVerifierJob.
 void MultiThreadedCertVerifier::HandleResult(
     X509Certificate* cert,
     const std::string& hostname,
+    const std::string& ocsp_response,
     int flags,
     const CertificateList& additional_trust_anchors,
     int error,
     const CertVerifyResult& verify_result) {
   DCHECK(CalledOnValidThread());
 
-  const RequestParams key(cert->fingerprint(), cert->ca_fingerprint(),
-                          hostname, flags, additional_trust_anchors);
+  const RequestParams key(cert->fingerprint(), cert->ca_fingerprint(), hostname,
+                          ocsp_response, flags, additional_trust_anchors);
 
   CachedResult cached_result;
   cached_result.error = error;
   cached_result.result = verify_result;
   base::Time now = base::Time::Now();
   cache_.Put(
       key, cached_result, CacheValidityPeriod(now),
       CacheValidityPeriod(now, now + base::TimeDelta::FromSeconds(kTTLSecs)));
 
   std::map<RequestParams, CertVerifierJob*>::iterator j;
@@ skipping 16 matching lines @@
 
 void MultiThreadedCertVerifier::OnCACertChanged(
     const X509Certificate* cert) {
   DCHECK(CalledOnValidThread());
 
   ClearCache();
 }
 
 }  // namespace net