Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(81)

Side by Side Diff: net/socket/ssl_client_socket_openssl.cc

Issue 1213783005: Send HPKP violation reports when a pin check fails (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 5 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // OpenSSL binding for SSLClientSocket. The class layout and general principle 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle
6 // of operation is derived from SSLClientSocketNSS. 6 // of operation is derived from SSLClientSocketNSS.
7 7
8 #include "net/socket/ssl_client_socket_openssl.h" 8 #include "net/socket/ssl_client_socket_openssl.h"
9 9
10 #include <errno.h> 10 #include <errno.h>
(...skipping 1134 matching lines...) Expand 10 before | Expand all | Expand 10 after
1145 } 1145 }
1146 } 1146 }
1147 1147
1148 const CertStatus cert_status = server_cert_verify_result_.cert_status; 1148 const CertStatus cert_status = server_cert_verify_result_.cert_status;
1149 if (transport_security_state_ && 1149 if (transport_security_state_ &&
1150 (result == OK || 1150 (result == OK ||
1151 (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) && 1151 (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) &&
1152 !transport_security_state_->CheckPublicKeyPins( 1152 !transport_security_state_->CheckPublicKeyPins(
1153 host_and_port_.host(), 1153 host_and_port_.host(),
1154 server_cert_verify_result_.is_issued_by_known_root, 1154 server_cert_verify_result_.is_issued_by_known_root,
1155 server_cert_verify_result_.public_key_hashes, 1155 server_cert_verify_result_.public_key_hashes, host_and_port_.port(),
1156 server_cert_, server_cert_verify_result_.verified_cert,
1157 TransportSecurityState::SEND_PUBLIC_KEY_PIN_REPORT,
1156 &pinning_failure_log_)) { 1158 &pinning_failure_log_)) {
1157 result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN; 1159 result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
1158 } 1160 }
1159 1161
1160 if (result == OK) { 1162 if (result == OK) {
1161 // Only check Certificate Transparency if there were no other errors with 1163 // Only check Certificate Transparency if there were no other errors with
1162 // the connection. 1164 // the connection.
1163 VerifyCT(); 1165 VerifyCT();
1164 1166
1165 DCHECK(!certificate_verified_); 1167 DCHECK(!certificate_verified_);
(...skipping 755 matching lines...) Expand 10 before | Expand all | Expand 10 after
1921 1923
1922 NextProto next_proto = NextProtoFromString(npn_proto_); 1924 NextProto next_proto = NextProtoFromString(npn_proto_);
1923 for (NextProto allowed : ssl_config_.renego_allowed_for_protos) { 1925 for (NextProto allowed : ssl_config_.renego_allowed_for_protos) {
1924 if (next_proto == allowed) 1926 if (next_proto == allowed)
1925 return true; 1927 return true;
1926 } 1928 }
1927 return false; 1929 return false;
1928 } 1930 }
1929 1931
1930 } // namespace net 1932 } // namespace net
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698