OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
8 | 8 |
9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
(...skipping 3112 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3123 cert_transparency_verifier_->Verify( | 3123 cert_transparency_verifier_->Verify( |
3124 server_cert_verify_result_.verified_cert.get(), | 3124 server_cert_verify_result_.verified_cert.get(), |
3125 core_->state().stapled_ocsp_response, | 3125 core_->state().stapled_ocsp_response, |
3126 core_->state().sct_list_from_tls_extension, &ct_verify_result_, net_log_); | 3126 core_->state().sct_list_from_tls_extension, &ct_verify_result_, net_log_); |
3127 // TODO(ekasper): wipe stapled_ocsp_response and sct_list_from_tls_extension | 3127 // TODO(ekasper): wipe stapled_ocsp_response and sct_list_from_tls_extension |
3128 // from the state after verification is complete, to conserve memory. | 3128 // from the state after verification is complete, to conserve memory. |
3129 | 3129 |
3130 ct_verify_result_.ct_policies_applied = (policy_enforcer_ != nullptr); | 3130 ct_verify_result_.ct_policies_applied = (policy_enforcer_ != nullptr); |
3131 ct_verify_result_.ev_policy_compliance = | 3131 ct_verify_result_.ev_policy_compliance = |
3132 ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY; | 3132 ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY; |
3133 if (policy_enforcer_ && | 3133 if (policy_enforcer_) { |
3134 (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV)) { | 3134 if ((server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV)) { |
3135 scoped_refptr<ct::EVCertsWhitelist> ev_whitelist = | 3135 scoped_refptr<ct::EVCertsWhitelist> ev_whitelist = |
3136 SSLConfigService::GetEVCertsWhitelist(); | 3136 SSLConfigService::GetEVCertsWhitelist(); |
3137 ct::EVPolicyCompliance ev_policy_compliance = | 3137 ct::EVPolicyCompliance ev_policy_compliance = |
3138 policy_enforcer_->DoesConformToCTEVPolicy( | 3138 policy_enforcer_->DoesConformToCTEVPolicy( |
3139 server_cert_verify_result_.verified_cert.get(), ev_whitelist.get(), | 3139 server_cert_verify_result_.verified_cert.get(), |
| 3140 ev_whitelist.get(), ct_verify_result_.verified_scts, net_log_); |
| 3141 ct_verify_result_.ev_policy_compliance = ev_policy_compliance; |
| 3142 if (ev_policy_compliance != |
| 3143 ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY && |
| 3144 ev_policy_compliance != |
| 3145 ct::EVPolicyCompliance::EV_POLICY_COMPLIES_VIA_WHITELIST && |
| 3146 ev_policy_compliance != |
| 3147 ct::EVPolicyCompliance::EV_POLICY_COMPLIES_VIA_SCTS) { |
| 3148 // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766 |
| 3149 VLOG(1) << "EV certificate for " |
| 3150 << server_cert_verify_result_.verified_cert->subject() |
| 3151 .GetDisplayName() |
| 3152 << " does not conform to CT policy, removing EV status."; |
| 3153 server_cert_verify_result_.cert_status |= |
| 3154 CERT_STATUS_CT_COMPLIANCE_FAILED; |
| 3155 server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; |
| 3156 } |
| 3157 } |
| 3158 ct_verify_result_.cert_policy_compliance = |
| 3159 policy_enforcer_->DoesConformToCertPolicy( |
| 3160 server_cert_verify_result_.verified_cert.get(), |
3140 ct_verify_result_.verified_scts, net_log_); | 3161 ct_verify_result_.verified_scts, net_log_); |
3141 ct_verify_result_.ev_policy_compliance = ev_policy_compliance; | |
3142 if (ev_policy_compliance != | |
3143 ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY && | |
3144 ev_policy_compliance != | |
3145 ct::EVPolicyCompliance::EV_POLICY_COMPLIES_VIA_WHITELIST && | |
3146 ev_policy_compliance != | |
3147 ct::EVPolicyCompliance::EV_POLICY_COMPLIES_VIA_SCTS) { | |
3148 // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766 | |
3149 VLOG(1) << "EV certificate for " | |
3150 << server_cert_verify_result_.verified_cert->subject() | |
3151 .GetDisplayName() | |
3152 << " does not conform to CT policy, removing EV status."; | |
3153 server_cert_verify_result_.cert_status |= | |
3154 CERT_STATUS_CT_COMPLIANCE_FAILED; | |
3155 server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; | |
3156 } | |
3157 } | 3162 } |
3158 } | 3163 } |
3159 | 3164 |
3160 void SSLClientSocketNSS::EnsureThreadIdAssigned() const { | 3165 void SSLClientSocketNSS::EnsureThreadIdAssigned() const { |
3161 base::AutoLock auto_lock(lock_); | 3166 base::AutoLock auto_lock(lock_); |
3162 if (valid_thread_id_ != base::kInvalidThreadId) | 3167 if (valid_thread_id_ != base::kInvalidThreadId) |
3163 return; | 3168 return; |
3164 valid_thread_id_ = base::PlatformThread::CurrentId(); | 3169 valid_thread_id_ = base::PlatformThread::CurrentId(); |
3165 } | 3170 } |
3166 | 3171 |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3198 return ERR_NOT_IMPLEMENTED; | 3203 return ERR_NOT_IMPLEMENTED; |
3199 } | 3204 } |
3200 | 3205 |
3201 SSLFailureState SSLClientSocketNSS::GetSSLFailureState() const { | 3206 SSLFailureState SSLClientSocketNSS::GetSSLFailureState() const { |
3202 if (completed_handshake_) | 3207 if (completed_handshake_) |
3203 return SSL_FAILURE_NONE; | 3208 return SSL_FAILURE_NONE; |
3204 return SSL_FAILURE_UNKNOWN; | 3209 return SSL_FAILURE_UNKNOWN; |
3205 } | 3210 } |
3206 | 3211 |
3207 } // namespace net | 3212 } // namespace net |
OLD | NEW |