| OLD | NEW |
| (Empty) |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "ios/web/net/cert_verifier_block_adapter.h" | |
| 6 | |
| 7 #include <utility> | |
| 8 | |
| 9 #include "base/mac/bind_objc_block.h" | |
| 10 #include "net/base/net_errors.h" | |
| 11 #include "net/cert/crl_set.h" | |
| 12 #include "net/cert/x509_certificate.h" | |
| 13 #include "net/log/net_log.h" | |
| 14 | |
| 15 namespace web { | |
| 16 | |
| 17 namespace { | |
| 18 | |
| 19 // Resource manager which keeps CertVerifyResult, X509Certificate, | |
| 20 // CertVerifier::Request and BoundNetLog alive until verification is completed. | |
| 21 // This class is refcounted so it can be captured by a block, keeping its | |
| 22 // members alive. | |
| 23 struct VerificationContext | |
| 24 : public base::RefCountedThreadSafe<VerificationContext> { | |
| 25 VerificationContext(scoped_refptr<net::X509Certificate> cert, | |
| 26 net::NetLog* net_log) | |
| 27 : request(nullptr), | |
| 28 cert(std::move(cert)), | |
| 29 net_log(net::BoundNetLog::Make( | |
| 30 net_log, | |
| 31 net::NetLog::SOURCE_IOS_WEB_VIEW_CERT_VERIFIER)) {} | |
| 32 | |
| 33 // Stores the current verification request. The request must outlive the | |
| 34 // VerificationContext and the CertVerifierBlockAdapter, so that the | |
| 35 // verification request is not cancelled. CertVerifierBlockAdapter::Verify | |
| 36 // guarantees its completion handler to be called, which will not happen if | |
| 37 // verification request is cancelled. | |
| 38 scoped_ptr<net::CertVerifier::Request> request; | |
| 39 // The result of certificate verification. | |
| 40 net::CertVerifyResult result; | |
| 41 // Certificate being verified. | |
| 42 scoped_refptr<net::X509Certificate> cert; | |
| 43 // BoundNetLog required by CertVerifier. | |
| 44 net::BoundNetLog net_log; | |
| 45 | |
| 46 private: | |
| 47 friend class base::RefCountedThreadSafe<VerificationContext>; | |
| 48 VerificationContext() = delete; | |
| 49 ~VerificationContext() {} | |
| 50 }; | |
| 51 } | |
| 52 | |
| 53 CertVerifierBlockAdapter::CertVerifierBlockAdapter( | |
| 54 net::CertVerifier* cert_verifier, | |
| 55 net::NetLog* net_log) | |
| 56 : cert_verifier_(cert_verifier), net_log_(net_log) { | |
| 57 DCHECK(cert_verifier_); | |
| 58 } | |
| 59 | |
| 60 CertVerifierBlockAdapter::~CertVerifierBlockAdapter() { | |
| 61 DCHECK(thread_checker_.CalledOnValidThread()); | |
| 62 } | |
| 63 | |
| 64 CertVerifierBlockAdapter::Params::Params( | |
| 65 const scoped_refptr<net::X509Certificate>& cert, | |
| 66 const std::string& hostname) | |
| 67 : cert(cert), hostname(hostname), flags(0) {} | |
| 68 | |
| 69 CertVerifierBlockAdapter::Params::~Params() { | |
| 70 } | |
| 71 | |
| 72 void CertVerifierBlockAdapter::Verify( | |
| 73 const Params& params, | |
| 74 void (^completion_handler)(net::CertVerifyResult, int)) { | |
| 75 DCHECK(thread_checker_.CalledOnValidThread()); | |
| 76 DCHECK(completion_handler); | |
| 77 if (!params.cert || params.hostname.empty()) { | |
| 78 completion_handler(net::CertVerifyResult(), net::ERR_INVALID_ARGUMENT); | |
| 79 return; | |
| 80 } | |
| 81 | |
| 82 scoped_refptr<VerificationContext> context( | |
| 83 new VerificationContext(params.cert, net_log_)); | |
| 84 net::CompletionCallback callback = base::BindBlock(^(int error) { | |
| 85 completion_handler(context->result, error); | |
| 86 }); | |
| 87 scoped_ptr<net::CertVerifier::Request> request; | |
| 88 int error = cert_verifier_->Verify(params.cert.get(), params.hostname, | |
| 89 params.ocsp_response, params.flags, | |
| 90 params.crl_set.get(), &(context->result), | |
| 91 callback, &request, context->net_log); | |
| 92 if (error == net::ERR_IO_PENDING) { | |
| 93 // Keep the |net::CertVerifier::Request| alive until verification completes. | |
| 94 // Because |context| is kept alive by |callback| (through base::BindBlock), | |
| 95 // this means that the cert verification request cannot be cancelled. | |
| 96 // However, it guarantees that |callback| - and thus |completion_handler| - | |
| 97 // will always be called, which is a necessary part of the API contract of | |
| 98 // |CertVerifierBlockAdapter::Verify()|. | |
| 99 context->request = std::move(request); | |
| 100 // Completion handler will be called from |callback| when verification | |
| 101 // request is completed. | |
| 102 return; | |
| 103 } | |
| 104 | |
| 105 // Verification has either failed or result was retrieved from the cache. | |
| 106 completion_handler(context->result, error); | |
| 107 } | |
| 108 | |
| 109 } // namespace web | |
| OLD | NEW |