| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/cert_verify_proc_mac.h" | 5 #include "net/cert/cert_verify_proc_mac.h" |
| 6 | 6 |
| 7 #include <CommonCrypto/CommonDigest.h> | 7 #include <CommonCrypto/CommonDigest.h> |
| 8 #include <CoreServices/CoreServices.h> | 8 #include <CoreServices/CoreServices.h> |
| 9 #include <Security/Security.h> | 9 #include <Security/Security.h> |
| 10 | 10 |
| (...skipping 660 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 671 index < chain_count; ++index) { | 671 index < chain_count; ++index) { |
| 672 if (chain_info[index].StatusBits & CSSM_CERT_STATUS_EXPIRED || | 672 if (chain_info[index].StatusBits & CSSM_CERT_STATUS_EXPIRED || |
| 673 chain_info[index].StatusBits & CSSM_CERT_STATUS_NOT_VALID_YET) | 673 chain_info[index].StatusBits & CSSM_CERT_STATUS_NOT_VALID_YET) |
| 674 verify_result->cert_status |= CERT_STATUS_DATE_INVALID; | 674 verify_result->cert_status |= CERT_STATUS_DATE_INVALID; |
| 675 if (!IsCertStatusError(verify_result->cert_status) && | 675 if (!IsCertStatusError(verify_result->cert_status) && |
| 676 chain_info[index].NumStatusCodes == 0) { | 676 chain_info[index].NumStatusCodes == 0) { |
| 677 LOG(WARNING) << "chain_info[" << index << "].NumStatusCodes is 0" | 677 LOG(WARNING) << "chain_info[" << index << "].NumStatusCodes is 0" |
| 678 ", chain_info[" << index << "].StatusBits is " | 678 ", chain_info[" << index << "].StatusBits is " |
| 679 << chain_info[index].StatusBits; | 679 << chain_info[index].StatusBits; |
| 680 } | 680 } |
| 681 for (uint32 status_code_index = 0; | 681 for (uint32_t status_code_index = 0; |
| 682 status_code_index < chain_info[index].NumStatusCodes; | 682 status_code_index < chain_info[index].NumStatusCodes; |
| 683 ++status_code_index) { | 683 ++status_code_index) { |
| 684 // As of OS X 10.9, attempting to verify a certificate chain that | 684 // As of OS X 10.9, attempting to verify a certificate chain that |
| 685 // contains a weak signature algorithm (MD2, MD5) in an intermediate | 685 // contains a weak signature algorithm (MD2, MD5) in an intermediate |
| 686 // or leaf cert will be treated as a (recoverable) policy validation | 686 // or leaf cert will be treated as a (recoverable) policy validation |
| 687 // failure, with the status code CSSMERR_TP_INVALID_CERTIFICATE | 687 // failure, with the status code CSSMERR_TP_INVALID_CERTIFICATE |
| 688 // added to the Status Codes. Don't treat this code as an invalid | 688 // added to the Status Codes. Don't treat this code as an invalid |
| 689 // certificate; instead, map it to a weak key. Any truly invalid | 689 // certificate; instead, map it to a weak key. Any truly invalid |
| 690 // certificates will have the major error (cssm_result) set to | 690 // certificates will have the major error (cssm_result) set to |
| 691 // CSSMERR_TP_INVALID_CERTIFICATE, rather than | 691 // CSSMERR_TP_INVALID_CERTIFICATE, rather than |
| (...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 783 } | 783 } |
| 784 } | 784 } |
| 785 } | 785 } |
| 786 } | 786 } |
| 787 } | 787 } |
| 788 | 788 |
| 789 return OK; | 789 return OK; |
| 790 } | 790 } |
| 791 | 791 |
| 792 } // namespace net | 792 } // namespace net |
| OLD | NEW |