OLD | NEW |
| (Empty) |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "ios/web/net/cert_verifier_block_adapter.h" | |
6 | |
7 #include <utility> | |
8 | |
9 #include "base/mac/bind_objc_block.h" | |
10 #include "net/base/net_errors.h" | |
11 #include "net/cert/crl_set.h" | |
12 #include "net/cert/x509_certificate.h" | |
13 #include "net/log/net_log.h" | |
14 | |
15 namespace web { | |
16 | |
17 namespace { | |
18 | |
19 // Resource manager which keeps CertVerifyResult, X509Certificate, | |
20 // CertVerifier::Request and BoundNetLog alive until verification is completed. | |
21 // This class is refcounted so it can be captured by a block, keeping its | |
22 // members alive. | |
23 struct VerificationContext | |
24 : public base::RefCountedThreadSafe<VerificationContext> { | |
25 VerificationContext(scoped_refptr<net::X509Certificate> cert, | |
26 net::NetLog* net_log) | |
27 : request(nullptr), | |
28 cert(std::move(cert)), | |
29 net_log(net::BoundNetLog::Make( | |
30 net_log, | |
31 net::NetLog::SOURCE_IOS_WEB_VIEW_CERT_VERIFIER)) {} | |
32 | |
33 // Stores the current verification request. The request must outlive the | |
34 // VerificationContext and the CertVerifierBlockAdapter, so that the | |
35 // verification request is not cancelled. CertVerifierBlockAdapter::Verify | |
36 // guarantees its completion handler to be called, which will not happen if | |
37 // verification request is cancelled. | |
38 scoped_ptr<net::CertVerifier::Request> request; | |
39 // The result of certificate verification. | |
40 net::CertVerifyResult result; | |
41 // Certificate being verified. | |
42 scoped_refptr<net::X509Certificate> cert; | |
43 // BoundNetLog required by CertVerifier. | |
44 net::BoundNetLog net_log; | |
45 | |
46 private: | |
47 friend class base::RefCountedThreadSafe<VerificationContext>; | |
48 VerificationContext() = delete; | |
49 ~VerificationContext() {} | |
50 }; | |
51 } | |
52 | |
53 CertVerifierBlockAdapter::CertVerifierBlockAdapter( | |
54 net::CertVerifier* cert_verifier, | |
55 net::NetLog* net_log) | |
56 : cert_verifier_(cert_verifier), net_log_(net_log) { | |
57 DCHECK(cert_verifier_); | |
58 } | |
59 | |
60 CertVerifierBlockAdapter::~CertVerifierBlockAdapter() { | |
61 DCHECK(thread_checker_.CalledOnValidThread()); | |
62 } | |
63 | |
64 CertVerifierBlockAdapter::Params::Params( | |
65 const scoped_refptr<net::X509Certificate>& cert, | |
66 const std::string& hostname) | |
67 : cert(cert), hostname(hostname), flags(0) {} | |
68 | |
69 CertVerifierBlockAdapter::Params::~Params() { | |
70 } | |
71 | |
72 void CertVerifierBlockAdapter::Verify( | |
73 const Params& params, | |
74 void (^completion_handler)(net::CertVerifyResult, int)) { | |
75 DCHECK(thread_checker_.CalledOnValidThread()); | |
76 DCHECK(completion_handler); | |
77 if (!params.cert || params.hostname.empty()) { | |
78 completion_handler(net::CertVerifyResult(), net::ERR_INVALID_ARGUMENT); | |
79 return; | |
80 } | |
81 | |
82 scoped_refptr<VerificationContext> context( | |
83 new VerificationContext(params.cert, net_log_)); | |
84 net::CompletionCallback callback = base::BindBlock(^(int error) { | |
85 completion_handler(context->result, error); | |
86 }); | |
87 scoped_ptr<net::CertVerifier::Request> request; | |
88 int error = cert_verifier_->Verify(params.cert.get(), params.hostname, | |
89 params.ocsp_response, params.flags, | |
90 params.crl_set.get(), &(context->result), | |
91 callback, &request, context->net_log); | |
92 if (error == net::ERR_IO_PENDING) { | |
93 // Keep the |net::CertVerifier::Request| alive until verification completes. | |
94 // Because |context| is kept alive by |callback| (through base::BindBlock), | |
95 // this means that the cert verification request cannot be cancelled. | |
96 // However, it guarantees that |callback| - and thus |completion_handler| - | |
97 // will always be called, which is a necessary part of the API contract of | |
98 // |CertVerifierBlockAdapter::Verify()|. | |
99 context->request = std::move(request); | |
100 // Completion handler will be called from |callback| when verification | |
101 // request is completed. | |
102 return; | |
103 } | |
104 | |
105 // Verification has either failed or result was retrieved from the cache. | |
106 completion_handler(context->result, error); | |
107 } | |
108 | |
109 } // namespace web | |
OLD | NEW |