| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/cert_verify_proc.h" | 5 #include "net/cert/cert_verify_proc.h" |
| 6 | 6 |
| 7 #include "base/metrics/histogram.h" | 7 #include "base/metrics/histogram.h" |
| 8 #include "base/sha1.h" | 8 #include "base/sha1.h" |
| 9 #include "build/build_config.h" | 9 #include "build/build_config.h" |
| 10 #include "net/base/net_errors.h" | 10 #include "net/base/net_errors.h" |
| 11 #include "net/base/net_util.h" | 11 #include "net/base/net_util.h" |
| 12 #include "net/base/registry_controlled_domains/registry_controlled_domain.h" | |
| 13 #include "net/cert/cert_status_flags.h" | 12 #include "net/cert/cert_status_flags.h" |
| 14 #include "net/cert/cert_verifier.h" | 13 #include "net/cert/cert_verifier.h" |
| 15 #include "net/cert/cert_verify_result.h" | 14 #include "net/cert/cert_verify_result.h" |
| 16 #include "net/cert/crl_set.h" | 15 #include "net/cert/crl_set.h" |
| 17 #include "net/cert/x509_certificate.h" | 16 #include "net/cert/x509_certificate.h" |
| 18 #include "url/url_canon.h" | |
| 19 | 17 |
| 20 #if defined(USE_NSS) || defined(OS_IOS) | 18 #if defined(USE_NSS) || defined(OS_IOS) |
| 21 #include "net/cert/cert_verify_proc_nss.h" | 19 #include "net/cert/cert_verify_proc_nss.h" |
| 22 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID) | 20 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID) |
| 23 #include "net/cert/cert_verify_proc_openssl.h" | 21 #include "net/cert/cert_verify_proc_openssl.h" |
| 24 #elif defined(OS_ANDROID) | 22 #elif defined(OS_ANDROID) |
| 25 #include "net/cert/cert_verify_proc_android.h" | 23 #include "net/cert/cert_verify_proc_android.h" |
| 26 #elif defined(OS_MACOSX) | 24 #elif defined(OS_MACOSX) |
| 27 #include "net/cert/cert_verify_proc_mac.h" | 25 #include "net/cert/cert_verify_proc_mac.h" |
| 28 #elif defined(OS_WIN) | 26 #elif defined(OS_WIN) |
| (...skipping 261 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 290 if (j->tag == HASH_VALUE_SHA1 && | 288 if (j->tag == HASH_VALUE_SHA1 && |
| 291 memcmp(j->data(), kHashes[i], base::kSHA1Length) == 0) { | 289 memcmp(j->data(), kHashes[i], base::kSHA1Length) == 0) { |
| 292 return true; | 290 return true; |
| 293 } | 291 } |
| 294 } | 292 } |
| 295 } | 293 } |
| 296 | 294 |
| 297 return false; | 295 return false; |
| 298 } | 296 } |
| 299 | 297 |
| 300 // static | |
| 301 bool CertVerifyProc::IsHostnameNonUnique(const std::string& hostname) { | |
| 302 // CanonicalizeHost requires surrounding brackets to parse an IPv6 address. | |
| 303 const std::string host_or_ip = hostname.find(':') != std::string::npos ? | |
| 304 "[" + hostname + "]" : hostname; | |
| 305 url_canon::CanonHostInfo host_info; | |
| 306 std::string canonical_name = CanonicalizeHost(host_or_ip, &host_info); | |
| 307 | |
| 308 // If canonicalization fails, then the input is truly malformed. However, | |
| 309 // to avoid mis-reporting bad inputs as "non-unique", treat them as unique. | |
| 310 if (canonical_name.empty()) | |
| 311 return false; | |
| 312 | |
| 313 // If |hostname| is an IP address, presume it's unique. | |
| 314 // TODO(rsleevi): In the future, this should also reject IP addresses in | |
| 315 // IANA-reserved ranges, since those are also non-unique among publicly | |
| 316 // trusted CAs. | |
| 317 if (host_info.IsIPAddress()) | |
| 318 return false; | |
| 319 | |
| 320 // Check for a registry controlled portion of |hostname|, ignoring private | |
| 321 // registries, as they already chain to ICANN-administered registries, | |
| 322 // and explicitly ignoring unknown registries. | |
| 323 // | |
| 324 // Note: This means that as new gTLDs are introduced on the Internet, they | |
| 325 // will be treated as non-unique until the registry controlled domain list | |
| 326 // is updated. However, because gTLDs are expected to provide significant | |
| 327 // advance notice to deprecate older versions of this code, this an | |
| 328 // acceptable tradeoff. | |
| 329 return 0 == registry_controlled_domains::GetRegistryLength( | |
| 330 canonical_name, | |
| 331 registry_controlled_domains::EXCLUDE_UNKNOWN_REGISTRIES, | |
| 332 registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); | |
| 333 } | |
| 334 | |
| 335 } // namespace net | 298 } // namespace net |
| OLD | NEW |