OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
8 | 8 |
9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
(...skipping 92 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
103 #include "net/cert_net/nss_ocsp.h" | 103 #include "net/cert_net/nss_ocsp.h" |
104 #include "net/http/transport_security_state.h" | 104 #include "net/http/transport_security_state.h" |
105 #include "net/log/net_log.h" | 105 #include "net/log/net_log.h" |
106 #include "net/socket/client_socket_handle.h" | 106 #include "net/socket/client_socket_handle.h" |
107 #include "net/socket/nss_ssl_util.h" | 107 #include "net/socket/nss_ssl_util.h" |
108 #include "net/ssl/ssl_cert_request_info.h" | 108 #include "net/ssl/ssl_cert_request_info.h" |
109 #include "net/ssl/ssl_cipher_suite_names.h" | 109 #include "net/ssl/ssl_cipher_suite_names.h" |
110 #include "net/ssl/ssl_connection_status_flags.h" | 110 #include "net/ssl/ssl_connection_status_flags.h" |
111 #include "net/ssl/ssl_info.h" | 111 #include "net/ssl/ssl_info.h" |
112 | 112 |
113 #if defined(USE_NSS) | 113 #if defined(USE_NSS_CERTS) |
114 #include <dlfcn.h> | 114 #include <dlfcn.h> |
115 #endif | 115 #endif |
116 | 116 |
117 namespace net { | 117 namespace net { |
118 | 118 |
119 // State machines are easier to debug if you log state transitions. | 119 // State machines are easier to debug if you log state transitions. |
120 // Enable these if you want to see what's going on. | 120 // Enable these if you want to see what's going on. |
121 #if 1 | 121 #if 1 |
122 #define EnterFunction(x) | 122 #define EnterFunction(x) |
123 #define LeaveFunction(x) | 123 #define LeaveFunction(x) |
(...skipping 28 matching lines...) Expand all Loading... |
152 // entire SSL record. | 152 // entire SSL record. |
153 const int kRecvBufferSize = 17 * 1024; | 153 const int kRecvBufferSize = 17 * 1024; |
154 const int kSendBufferSize = 17 * 1024; | 154 const int kSendBufferSize = 17 * 1024; |
155 | 155 |
156 // Used by SSLClientSocketNSS::Core to indicate there is no read result | 156 // Used by SSLClientSocketNSS::Core to indicate there is no read result |
157 // obtained by a previous operation waiting to be returned to the caller. | 157 // obtained by a previous operation waiting to be returned to the caller. |
158 // This constant can be any non-negative/non-zero value (eg: it does not | 158 // This constant can be any non-negative/non-zero value (eg: it does not |
159 // overlap with any value of the net::Error range, including net::OK). | 159 // overlap with any value of the net::Error range, including net::OK). |
160 const int kNoPendingReadResult = 1; | 160 const int kNoPendingReadResult = 1; |
161 | 161 |
162 #if defined(USE_NSS) | 162 #if defined(USE_NSS_CERTS) |
163 typedef SECStatus | 163 typedef SECStatus |
164 (*CacheOCSPResponseFromSideChannelFunction)( | 164 (*CacheOCSPResponseFromSideChannelFunction)( |
165 CERTCertDBHandle *handle, CERTCertificate *cert, PRTime time, | 165 CERTCertDBHandle *handle, CERTCertificate *cert, PRTime time, |
166 SECItem *encodedResponse, void *pwArg); | 166 SECItem *encodedResponse, void *pwArg); |
167 | 167 |
168 // On Linux, we dynamically link against the system version of libnss3.so. In | 168 // On Linux, we dynamically link against the system version of libnss3.so. In |
169 // order to continue working on systems without up-to-date versions of NSS we | 169 // order to continue working on systems without up-to-date versions of NSS we |
170 // lookup CERT_CacheOCSPResponseFromSideChannel with dlsym. | 170 // lookup CERT_CacheOCSPResponseFromSideChannel with dlsym. |
171 | 171 |
172 // RuntimeLibNSSFunctionPointers is a singleton which caches the results of any | 172 // RuntimeLibNSSFunctionPointers is a singleton which caches the results of any |
(...skipping 1891 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2064 if (ocsp_requested) | 2064 if (ocsp_requested) |
2065 UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_responses_present); | 2065 UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_responses_present); |
2066 if (!ocsp_responses_present) | 2066 if (!ocsp_responses_present) |
2067 return; | 2067 return; |
2068 | 2068 |
2069 nss_handshake_state_.stapled_ocsp_response = std::string( | 2069 nss_handshake_state_.stapled_ocsp_response = std::string( |
2070 reinterpret_cast<char*>(ocsp_responses->items[0].data), | 2070 reinterpret_cast<char*>(ocsp_responses->items[0].data), |
2071 ocsp_responses->items[0].len); | 2071 ocsp_responses->items[0].len); |
2072 | 2072 |
2073 if (IsOCSPStaplingSupported()) { | 2073 if (IsOCSPStaplingSupported()) { |
2074 #if defined(USE_NSS) | 2074 #if defined(USE_NSS_CERTS) |
2075 CacheOCSPResponseFromSideChannelFunction cache_ocsp_response = | 2075 CacheOCSPResponseFromSideChannelFunction cache_ocsp_response = |
2076 GetCacheOCSPResponseFromSideChannelFunction(); | 2076 GetCacheOCSPResponseFromSideChannelFunction(); |
2077 | 2077 |
2078 cache_ocsp_response( | 2078 cache_ocsp_response( |
2079 CERT_GetDefaultCertDB(), | 2079 CERT_GetDefaultCertDB(), |
2080 nss_handshake_state_.server_cert_chain[0], PR_Now(), | 2080 nss_handshake_state_.server_cert_chain[0], PR_Now(), |
2081 &ocsp_responses->items[0], NULL); | 2081 &ocsp_responses->items[0], NULL); |
2082 #endif | 2082 #endif |
2083 } | 2083 } |
2084 } | 2084 } |
(...skipping 647 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2732 return transport_->socket()->SetSendBufferSize(size); | 2732 return transport_->socket()->SetSendBufferSize(size); |
2733 } | 2733 } |
2734 | 2734 |
2735 int SSLClientSocketNSS::Init() { | 2735 int SSLClientSocketNSS::Init() { |
2736 EnterFunction(""); | 2736 EnterFunction(""); |
2737 // Initialize the NSS SSL library in a threadsafe way. This also | 2737 // Initialize the NSS SSL library in a threadsafe way. This also |
2738 // initializes the NSS base library. | 2738 // initializes the NSS base library. |
2739 EnsureNSSSSLInit(); | 2739 EnsureNSSSSLInit(); |
2740 if (!NSS_IsInitialized()) | 2740 if (!NSS_IsInitialized()) |
2741 return ERR_UNEXPECTED; | 2741 return ERR_UNEXPECTED; |
2742 #if defined(USE_NSS) || defined(OS_IOS) | 2742 #if defined(USE_NSS_CERTS) || defined(OS_IOS) |
2743 if (ssl_config_.cert_io_enabled) { | 2743 if (ssl_config_.cert_io_enabled) { |
2744 // We must call EnsureNSSHttpIOInit() here, on the IO thread, to get the IO | 2744 // We must call EnsureNSSHttpIOInit() here, on the IO thread, to get the IO |
2745 // loop by MessageLoopForIO::current(). | 2745 // loop by MessageLoopForIO::current(). |
2746 // X509Certificate::Verify() runs on a worker thread of CertVerifier. | 2746 // X509Certificate::Verify() runs on a worker thread of CertVerifier. |
2747 EnsureNSSHttpIOInit(); | 2747 EnsureNSSHttpIOInit(); |
2748 } | 2748 } |
2749 #endif | 2749 #endif |
2750 | 2750 |
2751 LeaveFunction(""); | 2751 LeaveFunction(""); |
2752 return OK; | 2752 return OK; |
(...skipping 485 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3238 scoped_refptr<X509Certificate> | 3238 scoped_refptr<X509Certificate> |
3239 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const { | 3239 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const { |
3240 return core_->state().server_cert.get(); | 3240 return core_->state().server_cert.get(); |
3241 } | 3241 } |
3242 | 3242 |
3243 ChannelIDService* SSLClientSocketNSS::GetChannelIDService() const { | 3243 ChannelIDService* SSLClientSocketNSS::GetChannelIDService() const { |
3244 return channel_id_service_; | 3244 return channel_id_service_; |
3245 } | 3245 } |
3246 | 3246 |
3247 } // namespace net | 3247 } // namespace net |
OLD | NEW |