Add a callback to SecureSocket for certificates that fail to be authenticated.

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
@@ skipping 125 matching lines @@
       ThrowIfError(Dart_GetNativeArgument(args, 1));
   if (!Dart_IsClosure(handshake_complete)) {
     Dart_ThrowException(DartUtils::NewDartArgumentError(
         "Illegal argument to RegisterHandshakeCompleteCallback"));
   }
   GetFilter(args)->RegisterHandshakeCompleteCallback(handshake_complete);
   Dart_ExitScope();
 }
 
 
+void FUNCTION_NAME(SecureSocket_RegisterBadCertificateCallback)(
+    Dart_NativeArguments args) {
+  Dart_EnterScope();
+  Dart_Handle callback =
+      ThrowIfError(Dart_GetNativeArgument(args, 1));
+  if (!Dart_IsClosure(callback) && !Dart_IsNull(callback)) {
+    Dart_ThrowException(DartUtils::NewDartArgumentError(
+        "Illegal argument to RegisterBadCertificateCallback"));
+  }
+  GetFilter(args)->RegisterBadCertificateCallback(callback);
+  Dart_ExitScope();
+}
+
+
 void FUNCTION_NAME(SecureSocket_ProcessBuffer)(Dart_NativeArguments args) {
   Dart_EnterScope();
   Dart_Handle buffer_id_object = ThrowIfError(Dart_GetNativeArgument(args, 1));
   int64_t buffer_id = DartUtils::GetIntegerValue(buffer_id_object);
   if (buffer_id < 0 || buffer_id >= SSLFilter::kNumBuffers) {
     Dart_ThrowException(DartUtils::NewDartArgumentError(
         "Illegal argument to ProcessBuffer"));
   }
 
   intptr_t bytes_read =
@@ skipping 42 matching lines @@
   } else {
     Dart_ThrowException(DartUtils::NewDartArgumentError(
         "UseBuiltinRoots argument to SetCertificateDatabase is not a bool"));
   }
 
   SSLFilter::InitializeLibrary(certificate_database, password, builtin_roots);
   Dart_ExitScope();
 }
 
 
+static bool CallBadCertificateCallback(Dart_Handle callback,
+                                       const char* subject_name,
+                                       const char* issuer_name,
+                                       int64_t start_validity,
+                                       int64_t end_validity) {
+  if (callback == NULL || Dart_IsNull(callback)) return false;
+  Dart_EnterScope();
+  Dart_Handle subject_name_object = DartUtils::NewString(subject_name);
+  Dart_Handle issuer_name_object = DartUtils::NewString(issuer_name);
+  Dart_Handle start_validity_int = Dart_NewInteger(start_validity);
+  Dart_Handle end_validity_int = Dart_NewInteger(end_validity);
+
+  Dart_Handle date_class =
+      DartUtils::GetDartClass(DartUtils::kCoreLibURL, "Date");
+  Dart_Handle from_milliseconds =
+      DartUtils::NewString("fromMillisecondsSinceEpoch");
+
+  Dart_Handle start_validity_date =
+      Dart_New(date_class, from_milliseconds, 1, &start_validity_int);
+  Dart_Handle end_validity_date =
+      Dart_New(date_class, from_milliseconds, 1, &end_validity_int);
+
+  Dart_Handle x509_class =
+      DartUtils::GetDartClass(DartUtils::kIOLibURL, "X509Certificate");
+  Dart_Handle arguments[] = { subject_name_object,
+                              issuer_name_object,
+                              start_validity_date,
+                              end_validity_date };
+  Dart_Handle certificate = Dart_New(x509_class, Dart_Null(), 4, arguments);
+
+  Dart_Handle result =
+      ThrowIfError(Dart_InvokeClosure(callback, 1, &certificate));
+  bool c_result = Dart_IsBoolean(result) && DartUtils::GetBooleanValue(result);
+  Dart_ExitScope();
+  return c_result;
+}
+
+
 void SSLFilter::Init(Dart_Handle dart_this) {
   string_start_ = ThrowIfError(
       Dart_NewPersistentHandle(DartUtils::NewString("start")));
   string_length_ = ThrowIfError(
       Dart_NewPersistentHandle(DartUtils::NewString("length")));
 
   InitializeBuffers(dart_this);
   filter_ = memio_CreateIOLayer(kMemioBufferSize);
 }
 
@@ skipping 27 matching lines @@
   }
 }
 
 
 void SSLFilter::RegisterHandshakeCompleteCallback(Dart_Handle complete) {
   ASSERT(NULL == handshake_complete_);
   handshake_complete_ = ThrowIfError(Dart_NewPersistentHandle(complete));
 }
 
 
+void SSLFilter::RegisterBadCertificateCallback(Dart_Handle complete) {
+  if (NULL != bad_certificate_callback_) {
+    Dart_DeletePersistentHandle(bad_certificate_callback_);
+  }
+  bad_certificate_callback_ = ThrowIfError(Dart_NewPersistentHandle(complete));

[Mads Ager (google), 2012/12/05 13:08:03]

We need to get rid of the last persistent handle somewhere as well to not leak a
closure per filter.

[Bill Hesse, 2012/12/05 14:31:06]

Done - It is freed in the destructor, if it exists.
Done.

+}
+
+
 void SSLFilter::InitializeLibrary(const char* certificate_database,
                                   const char* password,
                                   bool use_builtin_root_certificates) {
   MutexLocker locker(&mutex_);
   if (!library_initialized_) {
     library_initialized_ = true;
     password_ = strdup(password);  // This one copy persists until Dart exits.
     PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
     // TODO(whesse): Verify there are no UTF-8 issues here.
     PRUint32 init_flags = NSS_INIT_READONLY;
@@ skipping 29 matching lines @@
     status = SSL_ConfigServerSessionIDCache(0, 0, 0, NULL);
     if (status != SECSuccess) {
       ThrowPRException("Unsuccessful SSL_ConfigServerSessionIDCache call.");
     }
 
   } else {
     ThrowException("Called SSLFilter::InitializeLibrary more than once");
   }
 }
 
+
 char* PasswordCallback(PK11SlotInfo* slot, PRBool retry, void* arg) {
   if (!retry) {
     return PL_strdup(static_cast<char*>(arg));  // Freed by NSS internals.
   }
   return NULL;
 }
 
+
+SECStatus BadCertificateCallback(void* filter, PRFileDesc* fd) {
+  return static_cast<SSLFilter*>(filter)->HandleBadCertificate(fd);
+}
+
+
+SECStatus SSLFilter::HandleBadCertificate(PRFileDesc* fd) {
+  ASSERT(fd == filter_);
+  CERTCertificate* certificate = SSL_PeerCertificate(fd);
+  PRTime start_validity;
+  PRTime end_validity;
+  SECStatus status =
+      CERT_GetCertTimes(certificate, &start_validity, &end_validity);
+  if (status != SECSuccess) {
+    ThrowPRException("Cannot get validity times from certificate");
+  }
+  int64_t start_epoch_ms = start_validity / PR_USEC_PER_MSEC;
+  int64_t end_epoch_ms = end_validity / PR_USEC_PER_MSEC;
+  bool accept = CallBadCertificateCallback(bad_certificate_callback_,
+                                           certificate->subjectName,
+                                           certificate->issuerName,
+                                           start_epoch_ms,
+                                           end_epoch_ms);
+  return accept ? SECSuccess : SECFailure;
+}
+
+
 void SSLFilter::Connect(const char* host_name,
                         int port,
                         bool is_server,
                         const char* certificate_name) {
   is_server_ = is_server;
   if (in_handshake_) {
     ThrowException("Connect called while already in handshake state.");
   }
 
   filter_ = SSL_ImportFD(NULL, filter_);
@@ skipping 30 matching lines @@
     status = SSL_ConfigSecureServer(filter_, certificate, key, kt_rsa);
     if (status != SECSuccess) {
       ThrowPRException("Unsuccessful SSL_ConfigSecureServer call");
     }
   } else {  // Client.
     if (SSL_SetURL(filter_, host_name) == -1) {
       ThrowPRException("Unsuccessful SetURL call");
     }
   }
 
-  PRBool as_server = is_server ? PR_TRUE : PR_FALSE;  // Convert bool to PRBool.
+  // Install bad certificate callback, and pass 'this' to it if it is called.
+  status = SSL_BadCertHook(filter_,
+                           BadCertificateCallback,
+                           static_cast<void*>(this));
+
+  PRBool as_server = is_server ? PR_TRUE : PR_FALSE;
   status = SSL_ResetHandshake(filter_, as_server);
   if (status != SECSuccess) {
     ThrowPRException("Unsuccessful SSL_ResetHandshake call");
   }
 
   // SetPeerAddress
   PRNetAddr host_address;
   char host_entry_buffer[PR_NETDB_BUF_SIZE];
   PRHostEnt host_entry;
   PRStatus rv = PR_GetHostByName(host_name, host_entry_buffer,
@@ skipping 137 matching lines @@
         if (PR_WOULD_BLOCK_ERROR != pr_error) {
           ThrowPRException("Error reading plaintext from SSLFilter");
         }
         bytes_processed = 0;
       }
       break;
     }
   }
   return bytes_processed;
 }