OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
8 | 8 |
9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
(...skipping 3109 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
3120 // Note that this is a completely synchronous operation: The CT Log Verifier | 3120 // Note that this is a completely synchronous operation: The CT Log Verifier |
3121 // gets all the data it needs for SCT verification and does not do any | 3121 // gets all the data it needs for SCT verification and does not do any |
3122 // external communication. | 3122 // external communication. |
3123 cert_transparency_verifier_->Verify( | 3123 cert_transparency_verifier_->Verify( |
3124 server_cert_verify_result_.verified_cert.get(), | 3124 server_cert_verify_result_.verified_cert.get(), |
3125 core_->state().stapled_ocsp_response, | 3125 core_->state().stapled_ocsp_response, |
3126 core_->state().sct_list_from_tls_extension, &ct_verify_result_, net_log_); | 3126 core_->state().sct_list_from_tls_extension, &ct_verify_result_, net_log_); |
3127 // TODO(ekasper): wipe stapled_ocsp_response and sct_list_from_tls_extension | 3127 // TODO(ekasper): wipe stapled_ocsp_response and sct_list_from_tls_extension |
3128 // from the state after verification is complete, to conserve memory. | 3128 // from the state after verification is complete, to conserve memory. |
3129 | 3129 |
3130 if (!policy_enforcer_) { | 3130 if (policy_enforcer_) { |
3131 server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; | |
3132 } else { | |
3133 if (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV) { | 3131 if (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV) { |
Ryan Sleevi
2015/06/26 14:16:17
Can consolidate to one conditional
| |
3134 scoped_refptr<ct::EVCertsWhitelist> ev_whitelist = | 3132 scoped_refptr<ct::EVCertsWhitelist> ev_whitelist = |
3135 SSLConfigService::GetEVCertsWhitelist(); | 3133 SSLConfigService::GetEVCertsWhitelist(); |
3136 if (!policy_enforcer_->DoesConformToCTEVPolicy( | 3134 if (!policy_enforcer_->DoesConformToCTEVPolicy( |
3137 server_cert_verify_result_.verified_cert.get(), | 3135 server_cert_verify_result_.verified_cert.get(), |
3138 ev_whitelist.get(), ct_verify_result_, net_log_)) { | 3136 ev_whitelist.get(), ct_verify_result_, net_log_)) { |
3139 // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766 | 3137 // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766 |
3140 VLOG(1) << "EV certificate for " | 3138 VLOG(1) << "EV certificate for " |
3141 << server_cert_verify_result_.verified_cert->subject() | 3139 << server_cert_verify_result_.verified_cert->subject() |
3142 .GetDisplayName() | 3140 .GetDisplayName() |
3143 << " does not conform to CT policy, removing EV status."; | 3141 << " does not conform to CT policy, removing EV status."; |
(...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
3186 return channel_id_service_; | 3184 return channel_id_service_; |
3187 } | 3185 } |
3188 | 3186 |
3189 SSLFailureState SSLClientSocketNSS::GetSSLFailureState() const { | 3187 SSLFailureState SSLClientSocketNSS::GetSSLFailureState() const { |
3190 if (completed_handshake_) | 3188 if (completed_handshake_) |
3191 return SSL_FAILURE_NONE; | 3189 return SSL_FAILURE_NONE; |
3192 return SSL_FAILURE_UNKNOWN; | 3190 return SSL_FAILURE_UNKNOWN; |
3193 } | 3191 } |
3194 | 3192 |
3195 } // namespace net | 3193 } // namespace net |
OLD | NEW |