OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/x509_certificate.h" | 5 #include "net/cert/x509_certificate.h" |
6 | 6 |
7 #include <stdlib.h> | 7 #include <stdlib.h> |
8 | 8 |
9 #include <algorithm> | 9 #include <algorithm> |
10 #include <map> | 10 #include <map> |
(...skipping 498 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
509 DCHECK(!hostname.empty()); | 509 DCHECK(!hostname.empty()); |
510 // Perform name verification following http://tools.ietf.org/html/rfc6125. | 510 // Perform name verification following http://tools.ietf.org/html/rfc6125. |
511 // The terminology used in this method is as per that RFC:- | 511 // The terminology used in this method is as per that RFC:- |
512 // Reference identifier == the host the local user/agent is intending to | 512 // Reference identifier == the host the local user/agent is intending to |
513 // access, i.e. the thing displayed in the URL bar. | 513 // access, i.e. the thing displayed in the URL bar. |
514 // Presented identifier(s) == name(s) the server knows itself as, in its cert. | 514 // Presented identifier(s) == name(s) the server knows itself as, in its cert. |
515 | 515 |
516 // CanonicalizeHost requires surrounding brackets to parse an IPv6 address. | 516 // CanonicalizeHost requires surrounding brackets to parse an IPv6 address. |
517 const std::string host_or_ip = hostname.find(':') != std::string::npos ? | 517 const std::string host_or_ip = hostname.find(':') != std::string::npos ? |
518 "[" + hostname + "]" : hostname; | 518 "[" + hostname + "]" : hostname; |
519 url_canon::CanonHostInfo host_info; | 519 url::CanonHostInfo host_info; |
520 std::string reference_name = CanonicalizeHost(host_or_ip, &host_info); | 520 std::string reference_name = CanonicalizeHost(host_or_ip, &host_info); |
521 // CanonicalizeHost does not normalize absolute vs relative DNS names. If | 521 // CanonicalizeHost does not normalize absolute vs relative DNS names. If |
522 // the input name was absolute (included trailing .), normalize it as if it | 522 // the input name was absolute (included trailing .), normalize it as if it |
523 // was relative. | 523 // was relative. |
524 if (!reference_name.empty() && *reference_name.rbegin() == '.') | 524 if (!reference_name.empty() && *reference_name.rbegin() == '.') |
525 reference_name.resize(reference_name.size() - 1); | 525 reference_name.resize(reference_name.size() - 1); |
526 if (reference_name.empty()) | 526 if (reference_name.empty()) |
527 return false; | 527 return false; |
528 | 528 |
529 // Allow fallback to Common name matching? | 529 // Allow fallback to Common name matching? |
530 const bool common_name_fallback = cert_san_dns_names.empty() && | 530 const bool common_name_fallback = cert_san_dns_names.empty() && |
531 cert_san_ip_addrs.empty(); | 531 cert_san_ip_addrs.empty(); |
532 *common_name_fallback_used = common_name_fallback; | 532 *common_name_fallback_used = common_name_fallback; |
533 | 533 |
534 // Fully handle all cases where |hostname| contains an IP address. | 534 // Fully handle all cases where |hostname| contains an IP address. |
535 if (host_info.IsIPAddress()) { | 535 if (host_info.IsIPAddress()) { |
536 if (common_name_fallback && | 536 if (common_name_fallback && host_info.family == url::CanonHostInfo::IPV4) { |
537 host_info.family == url_canon::CanonHostInfo::IPV4) { | |
538 // Fallback to Common name matching. As this is deprecated and only | 537 // Fallback to Common name matching. As this is deprecated and only |
539 // supported for compatibility refuse it for IPv6 addresses. | 538 // supported for compatibility refuse it for IPv6 addresses. |
540 return reference_name == cert_common_name; | 539 return reference_name == cert_common_name; |
541 } | 540 } |
542 base::StringPiece ip_addr_string( | 541 base::StringPiece ip_addr_string( |
543 reinterpret_cast<const char*>(host_info.address), | 542 reinterpret_cast<const char*>(host_info.address), |
544 host_info.AddressLength()); | 543 host_info.AddressLength()); |
545 return std::find(cert_san_ip_addrs.begin(), cert_san_ip_addrs.end(), | 544 return std::find(cert_san_ip_addrs.begin(), cert_san_ip_addrs.end(), |
546 ip_addr_string) != cert_san_ip_addrs.end(); | 545 ip_addr_string) != cert_san_ip_addrs.end(); |
547 } | 546 } |
(...skipping 180 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
728 RemoveFromCache(cert_handle_); | 727 RemoveFromCache(cert_handle_); |
729 FreeOSCertHandle(cert_handle_); | 728 FreeOSCertHandle(cert_handle_); |
730 } | 729 } |
731 for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { | 730 for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { |
732 RemoveFromCache(intermediate_ca_certs_[i]); | 731 RemoveFromCache(intermediate_ca_certs_[i]); |
733 FreeOSCertHandle(intermediate_ca_certs_[i]); | 732 FreeOSCertHandle(intermediate_ca_certs_[i]); |
734 } | 733 } |
735 } | 734 } |
736 | 735 |
737 } // namespace net | 736 } // namespace net |
OLD | NEW |