| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
| 6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
| 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
| 8 | 8 |
| 9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
| 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
| (...skipping 92 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 103 #include "net/cert_net/nss_ocsp.h" | 103 #include "net/cert_net/nss_ocsp.h" |
| 104 #include "net/http/transport_security_state.h" | 104 #include "net/http/transport_security_state.h" |
| 105 #include "net/log/net_log.h" | 105 #include "net/log/net_log.h" |
| 106 #include "net/socket/client_socket_handle.h" | 106 #include "net/socket/client_socket_handle.h" |
| 107 #include "net/socket/nss_ssl_util.h" | 107 #include "net/socket/nss_ssl_util.h" |
| 108 #include "net/ssl/ssl_cert_request_info.h" | 108 #include "net/ssl/ssl_cert_request_info.h" |
| 109 #include "net/ssl/ssl_cipher_suite_names.h" | 109 #include "net/ssl/ssl_cipher_suite_names.h" |
| 110 #include "net/ssl/ssl_connection_status_flags.h" | 110 #include "net/ssl/ssl_connection_status_flags.h" |
| 111 #include "net/ssl/ssl_info.h" | 111 #include "net/ssl/ssl_info.h" |
| 112 | 112 |
| 113 #if defined(USE_NSS) | 113 #if defined(USE_NSS_CERTS) |
| 114 #include <dlfcn.h> | 114 #include <dlfcn.h> |
| 115 #endif | 115 #endif |
| 116 | 116 |
| 117 namespace net { | 117 namespace net { |
| 118 | 118 |
| 119 // State machines are easier to debug if you log state transitions. | 119 // State machines are easier to debug if you log state transitions. |
| 120 // Enable these if you want to see what's going on. | 120 // Enable these if you want to see what's going on. |
| 121 #if 1 | 121 #if 1 |
| 122 #define EnterFunction(x) | 122 #define EnterFunction(x) |
| 123 #define LeaveFunction(x) | 123 #define LeaveFunction(x) |
| (...skipping 28 matching lines...) Expand all Loading... |
| 152 // entire SSL record. | 152 // entire SSL record. |
| 153 const int kRecvBufferSize = 17 * 1024; | 153 const int kRecvBufferSize = 17 * 1024; |
| 154 const int kSendBufferSize = 17 * 1024; | 154 const int kSendBufferSize = 17 * 1024; |
| 155 | 155 |
| 156 // Used by SSLClientSocketNSS::Core to indicate there is no read result | 156 // Used by SSLClientSocketNSS::Core to indicate there is no read result |
| 157 // obtained by a previous operation waiting to be returned to the caller. | 157 // obtained by a previous operation waiting to be returned to the caller. |
| 158 // This constant can be any non-negative/non-zero value (eg: it does not | 158 // This constant can be any non-negative/non-zero value (eg: it does not |
| 159 // overlap with any value of the net::Error range, including net::OK). | 159 // overlap with any value of the net::Error range, including net::OK). |
| 160 const int kNoPendingReadResult = 1; | 160 const int kNoPendingReadResult = 1; |
| 161 | 161 |
| 162 #if defined(USE_NSS) | 162 #if defined(USE_NSS_CERTS) |
| 163 typedef SECStatus | 163 typedef SECStatus |
| 164 (*CacheOCSPResponseFromSideChannelFunction)( | 164 (*CacheOCSPResponseFromSideChannelFunction)( |
| 165 CERTCertDBHandle *handle, CERTCertificate *cert, PRTime time, | 165 CERTCertDBHandle *handle, CERTCertificate *cert, PRTime time, |
| 166 SECItem *encodedResponse, void *pwArg); | 166 SECItem *encodedResponse, void *pwArg); |
| 167 | 167 |
| 168 // On Linux, we dynamically link against the system version of libnss3.so. In | 168 // On Linux, we dynamically link against the system version of libnss3.so. In |
| 169 // order to continue working on systems without up-to-date versions of NSS we | 169 // order to continue working on systems without up-to-date versions of NSS we |
| 170 // lookup CERT_CacheOCSPResponseFromSideChannel with dlsym. | 170 // lookup CERT_CacheOCSPResponseFromSideChannel with dlsym. |
| 171 | 171 |
| 172 // RuntimeLibNSSFunctionPointers is a singleton which caches the results of any | 172 // RuntimeLibNSSFunctionPointers is a singleton which caches the results of any |
| (...skipping 1891 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2064 if (ocsp_requested) | 2064 if (ocsp_requested) |
| 2065 UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_responses_present); | 2065 UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_responses_present); |
| 2066 if (!ocsp_responses_present) | 2066 if (!ocsp_responses_present) |
| 2067 return; | 2067 return; |
| 2068 | 2068 |
| 2069 nss_handshake_state_.stapled_ocsp_response = std::string( | 2069 nss_handshake_state_.stapled_ocsp_response = std::string( |
| 2070 reinterpret_cast<char*>(ocsp_responses->items[0].data), | 2070 reinterpret_cast<char*>(ocsp_responses->items[0].data), |
| 2071 ocsp_responses->items[0].len); | 2071 ocsp_responses->items[0].len); |
| 2072 | 2072 |
| 2073 if (IsOCSPStaplingSupported()) { | 2073 if (IsOCSPStaplingSupported()) { |
| 2074 #if defined(USE_NSS) | 2074 #if defined(USE_NSS_CERTS) |
| 2075 CacheOCSPResponseFromSideChannelFunction cache_ocsp_response = | 2075 CacheOCSPResponseFromSideChannelFunction cache_ocsp_response = |
| 2076 GetCacheOCSPResponseFromSideChannelFunction(); | 2076 GetCacheOCSPResponseFromSideChannelFunction(); |
| 2077 | 2077 |
| 2078 cache_ocsp_response( | 2078 cache_ocsp_response( |
| 2079 CERT_GetDefaultCertDB(), | 2079 CERT_GetDefaultCertDB(), |
| 2080 nss_handshake_state_.server_cert_chain[0], PR_Now(), | 2080 nss_handshake_state_.server_cert_chain[0], PR_Now(), |
| 2081 &ocsp_responses->items[0], NULL); | 2081 &ocsp_responses->items[0], NULL); |
| 2082 #endif | 2082 #endif |
| 2083 } | 2083 } |
| 2084 } | 2084 } |
| (...skipping 647 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2732 return transport_->socket()->SetSendBufferSize(size); | 2732 return transport_->socket()->SetSendBufferSize(size); |
| 2733 } | 2733 } |
| 2734 | 2734 |
| 2735 int SSLClientSocketNSS::Init() { | 2735 int SSLClientSocketNSS::Init() { |
| 2736 EnterFunction(""); | 2736 EnterFunction(""); |
| 2737 // Initialize the NSS SSL library in a threadsafe way. This also | 2737 // Initialize the NSS SSL library in a threadsafe way. This also |
| 2738 // initializes the NSS base library. | 2738 // initializes the NSS base library. |
| 2739 EnsureNSSSSLInit(); | 2739 EnsureNSSSSLInit(); |
| 2740 if (!NSS_IsInitialized()) | 2740 if (!NSS_IsInitialized()) |
| 2741 return ERR_UNEXPECTED; | 2741 return ERR_UNEXPECTED; |
| 2742 #if defined(USE_NSS) || defined(OS_IOS) | 2742 #if defined(USE_NSS_CERTS) || defined(OS_IOS) |
| 2743 if (ssl_config_.cert_io_enabled) { | 2743 if (ssl_config_.cert_io_enabled) { |
| 2744 // We must call EnsureNSSHttpIOInit() here, on the IO thread, to get the IO | 2744 // We must call EnsureNSSHttpIOInit() here, on the IO thread, to get the IO |
| 2745 // loop by MessageLoopForIO::current(). | 2745 // loop by MessageLoopForIO::current(). |
| 2746 // X509Certificate::Verify() runs on a worker thread of CertVerifier. | 2746 // X509Certificate::Verify() runs on a worker thread of CertVerifier. |
| 2747 EnsureNSSHttpIOInit(); | 2747 EnsureNSSHttpIOInit(); |
| 2748 } | 2748 } |
| 2749 #endif | 2749 #endif |
| 2750 | 2750 |
| 2751 LeaveFunction(""); | 2751 LeaveFunction(""); |
| 2752 return OK; | 2752 return OK; |
| (...skipping 485 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 3238 scoped_refptr<X509Certificate> | 3238 scoped_refptr<X509Certificate> |
| 3239 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const { | 3239 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const { |
| 3240 return core_->state().server_cert.get(); | 3240 return core_->state().server_cert.get(); |
| 3241 } | 3241 } |
| 3242 | 3242 |
| 3243 ChannelIDService* SSLClientSocketNSS::GetChannelIDService() const { | 3243 ChannelIDService* SSLClientSocketNSS::GetChannelIDService() const { |
| 3244 return channel_id_service_; | 3244 return channel_id_service_; |
| 3245 } | 3245 } |
| 3246 | 3246 |
| 3247 } // namespace net | 3247 } // namespace net |
| OLD | NEW |