| OLD | NEW | 
|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be | 
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. | 
| 4 | 4 | 
| 5 #include "net/cert/cert_verify_proc.h" | 5 #include "net/cert/cert_verify_proc.h" | 
| 6 | 6 | 
| 7 #include "base/metrics/histogram.h" | 7 #include "base/metrics/histogram.h" | 
| 8 #include "base/sha1.h" | 8 #include "base/sha1.h" | 
| 9 #include "build/build_config.h" | 9 #include "build/build_config.h" | 
| 10 #include "net/base/net_errors.h" | 10 #include "net/base/net_errors.h" | 
| 11 #include "net/base/net_util.h" | 11 #include "net/base/net_util.h" | 
| 12 #include "net/base/registry_controlled_domains/registry_controlled_domain.h" |  | 
| 13 #include "net/cert/cert_status_flags.h" | 12 #include "net/cert/cert_status_flags.h" | 
| 14 #include "net/cert/cert_verifier.h" | 13 #include "net/cert/cert_verifier.h" | 
| 15 #include "net/cert/cert_verify_result.h" | 14 #include "net/cert/cert_verify_result.h" | 
| 16 #include "net/cert/crl_set.h" | 15 #include "net/cert/crl_set.h" | 
| 17 #include "net/cert/x509_certificate.h" | 16 #include "net/cert/x509_certificate.h" | 
| 18 #include "url/url_canon.h" |  | 
| 19 | 17 | 
| 20 #if defined(USE_NSS) || defined(OS_IOS) | 18 #if defined(USE_NSS) || defined(OS_IOS) | 
| 21 #include "net/cert/cert_verify_proc_nss.h" | 19 #include "net/cert/cert_verify_proc_nss.h" | 
| 22 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID) | 20 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID) | 
| 23 #include "net/cert/cert_verify_proc_openssl.h" | 21 #include "net/cert/cert_verify_proc_openssl.h" | 
| 24 #elif defined(OS_ANDROID) | 22 #elif defined(OS_ANDROID) | 
| 25 #include "net/cert/cert_verify_proc_android.h" | 23 #include "net/cert/cert_verify_proc_android.h" | 
| 26 #elif defined(OS_MACOSX) | 24 #elif defined(OS_MACOSX) | 
| 27 #include "net/cert/cert_verify_proc_mac.h" | 25 #include "net/cert/cert_verify_proc_mac.h" | 
| 28 #elif defined(OS_WIN) | 26 #elif defined(OS_WIN) | 
| (...skipping 261 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
| 290       if (j->tag == HASH_VALUE_SHA1 && | 288       if (j->tag == HASH_VALUE_SHA1 && | 
| 291           memcmp(j->data(), kHashes[i], base::kSHA1Length) == 0) { | 289           memcmp(j->data(), kHashes[i], base::kSHA1Length) == 0) { | 
| 292         return true; | 290         return true; | 
| 293       } | 291       } | 
| 294     } | 292     } | 
| 295   } | 293   } | 
| 296 | 294 | 
| 297   return false; | 295   return false; | 
| 298 } | 296 } | 
| 299 | 297 | 
| 300 // static |  | 
| 301 bool CertVerifyProc::IsHostnameNonUnique(const std::string& hostname) { |  | 
| 302   // CanonicalizeHost requires surrounding brackets to parse an IPv6 address. |  | 
| 303   const std::string host_or_ip = hostname.find(':') != std::string::npos ? |  | 
| 304       "[" + hostname + "]" : hostname; |  | 
| 305   url_canon::CanonHostInfo host_info; |  | 
| 306   std::string canonical_name = CanonicalizeHost(host_or_ip, &host_info); |  | 
| 307 |  | 
| 308   // If canonicalization fails, then the input is truly malformed. However, |  | 
| 309   // to avoid mis-reporting bad inputs as "non-unique", treat them as unique. |  | 
| 310   if (canonical_name.empty()) |  | 
| 311     return false; |  | 
| 312 |  | 
| 313   // If |hostname| is an IP address, presume it's unique. |  | 
| 314   // TODO(rsleevi): In the future, this should also reject IP addresses in |  | 
| 315   // IANA-reserved ranges, since those are also non-unique among publicly |  | 
| 316   // trusted CAs. |  | 
| 317   if (host_info.IsIPAddress()) |  | 
| 318     return false; |  | 
| 319 |  | 
| 320   // Check for a registry controlled portion of |hostname|, ignoring private |  | 
| 321   // registries, as they already chain to ICANN-administered registries, |  | 
| 322   // and explicitly ignoring unknown registries. |  | 
| 323   // |  | 
| 324   // Note: This means that as new gTLDs are introduced on the Internet, they |  | 
| 325   // will be treated as non-unique until the registry controlled domain list |  | 
| 326   // is updated. However, because gTLDs are expected to provide significant |  | 
| 327   // advance notice to deprecate older versions of this code, this an |  | 
| 328   // acceptable tradeoff. |  | 
| 329   return 0 == registry_controlled_domains::GetRegistryLength( |  | 
| 330                   canonical_name, |  | 
| 331                   registry_controlled_domains::EXCLUDE_UNKNOWN_REGISTRIES, |  | 
| 332                   registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); |  | 
| 333 } |  | 
| 334 |  | 
| 335 }  // namespace net | 298 }  // namespace net | 
| OLD | NEW | 
|---|