OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/base/cert_verify_proc.h" | 5 #include "net/base/cert_verify_proc.h" |
6 | 6 |
7 #include "base/metrics/histogram.h" | 7 #include "base/metrics/histogram.h" |
8 #include "base/sha1.h" | 8 #include "base/sha1.h" |
9 #include "build/build_config.h" | 9 #include "build/build_config.h" |
10 #include "net/base/cert_status_flags.h" | 10 #include "net/base/cert_status_flags.h" |
| 11 #include "net/base/cert_verifier.h" |
11 #include "net/base/cert_verify_result.h" | 12 #include "net/base/cert_verify_result.h" |
12 #include "net/base/crl_set.h" | 13 #include "net/base/crl_set.h" |
13 #include "net/base/net_errors.h" | 14 #include "net/base/net_errors.h" |
14 #include "net/base/x509_certificate.h" | 15 #include "net/base/x509_certificate.h" |
15 | 16 |
16 #if defined(USE_NSS) | 17 #if defined(USE_NSS) |
17 #include "net/base/cert_verify_proc_nss.h" | 18 #include "net/base/cert_verify_proc_nss.h" |
18 #elif defined(USE_OPENSSL) | 19 #elif defined(USE_OPENSSL) |
19 #include "net/base/cert_verify_proc_openssl.h" | 20 #include "net/base/cert_verify_proc_openssl.h" |
20 #elif defined(OS_MACOSX) | 21 #elif defined(OS_MACOSX) |
(...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
77 verify_result->cert_status |= CERT_STATUS_REVOKED; | 78 verify_result->cert_status |= CERT_STATUS_REVOKED; |
78 return ERR_CERT_REVOKED; | 79 return ERR_CERT_REVOKED; |
79 } | 80 } |
80 | 81 |
81 // If EV verification was requested and no CRLSet is present, or if the | 82 // If EV verification was requested and no CRLSet is present, or if the |
82 // CRLSet has expired, then enable online revocation checks. If the online | 83 // CRLSet has expired, then enable online revocation checks. If the online |
83 // check fails, EV status won't be shown. | 84 // check fails, EV status won't be shown. |
84 // | 85 // |
85 // TODO(rsleevi): http://crbug.com/142974 - Allow preferences to fully | 86 // TODO(rsleevi): http://crbug.com/142974 - Allow preferences to fully |
86 // disable revocation checking. | 87 // disable revocation checking. |
87 if ((flags & X509Certificate::VERIFY_EV_CERT) && | 88 if ((flags & CertVerifier::VERIFY_EV_CERT) && |
88 (!crl_set || crl_set->IsExpired())) { | 89 (!crl_set || crl_set->IsExpired())) { |
89 flags |= X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY; | 90 flags |= CertVerifier::VERIFY_REV_CHECKING_ENABLED_EV_ONLY; |
90 } | 91 } |
91 | 92 |
92 int rv = VerifyInternal(cert, hostname, flags, crl_set, verify_result); | 93 int rv = VerifyInternal(cert, hostname, flags, crl_set, verify_result); |
93 | 94 |
94 // This check is done after VerifyInternal so that VerifyInternal can fill | 95 // This check is done after VerifyInternal so that VerifyInternal can fill |
95 // in the list of public key hashes. | 96 // in the list of public key hashes. |
96 if (IsPublicKeyBlacklisted(verify_result->public_key_hashes)) { | 97 if (IsPublicKeyBlacklisted(verify_result->public_key_hashes)) { |
97 verify_result->cert_status |= CERT_STATUS_REVOKED; | 98 verify_result->cert_status |= CERT_STATUS_REVOKED; |
98 rv = MapCertStatusToNetError(verify_result->cert_status); | 99 rv = MapCertStatusToNetError(verify_result->cert_status); |
99 } | 100 } |
(...skipping 167 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
267 j = public_key_hashes.begin(); j != public_key_hashes.end(); ++j) { | 268 j = public_key_hashes.begin(); j != public_key_hashes.end(); ++j) { |
268 if (memcmp(j->data, kHashes[i], base::kSHA1Length) == 0) | 269 if (memcmp(j->data, kHashes[i], base::kSHA1Length) == 0) |
269 return true; | 270 return true; |
270 } | 271 } |
271 } | 272 } |
272 | 273 |
273 return false; | 274 return false; |
274 } | 275 } |
275 | 276 |
276 } // namespace net | 277 } // namespace net |
OLD | NEW |