Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(192)

Side by Side Diff: net/cert/cert_verify_proc_win.cc

Issue 2572553002: Revert of Send crash dumps for odd ERR_CERT_DATE_INVALID cert errors (Closed)
Patch Set: Created 4 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/cert/cert_verify_proc_win.h" 5 #include "net/cert/cert_verify_proc_win.h"
6 6
7 #include <memory> 7 #include <memory>
8 #include <string> 8 #include <string>
9 #include <vector> 9 #include <vector>
10 10
11 #include "base/debug/crash_logging.h"
12 #include "base/debug/dump_without_crashing.h"
13 #include "base/memory/free_deleter.h" 11 #include "base/memory/free_deleter.h"
14 #include "base/metrics/histogram_macros.h" 12 #include "base/metrics/histogram_macros.h"
15 #include "base/sha1.h" 13 #include "base/sha1.h"
16 #include "base/strings/string_number_conversions.h"
17 #include "base/strings/string_util.h" 14 #include "base/strings/string_util.h"
18 #include "base/strings/utf_string_conversions.h" 15 #include "base/strings/utf_string_conversions.h"
19 #include "base/threading/thread_local.h" 16 #include "base/threading/thread_local.h"
20 #include "base/time/time.h"
21 #include "crypto/capi_util.h" 17 #include "crypto/capi_util.h"
22 #include "crypto/scoped_capi_types.h" 18 #include "crypto/scoped_capi_types.h"
23 #include "crypto/sha2.h" 19 #include "crypto/sha2.h"
24 #include "net/base/net_errors.h" 20 #include "net/base/net_errors.h"
25 #include "net/cert/asn1_util.h" 21 #include "net/cert/asn1_util.h"
26 #include "net/cert/cert_status_flags.h" 22 #include "net/cert/cert_status_flags.h"
27 #include "net/cert/cert_verifier.h" 23 #include "net/cert/cert_verifier.h"
28 #include "net/cert/cert_verify_result.h" 24 #include "net/cert/cert_verify_result.h"
29 #include "net/cert/crl_set.h" 25 #include "net/cert/crl_set.h"
30 #include "net/cert/ev_root_ca_metadata.h" 26 #include "net/cert/ev_root_ca_metadata.h"
(...skipping 861 matching lines...) Expand 10 before | Expand all | Expand 10 after
892 } 888 }
893 889
894 class ScopedThreadLocalCRLSet { 890 class ScopedThreadLocalCRLSet {
895 public: 891 public:
896 explicit ScopedThreadLocalCRLSet(CRLSet* crl_set) { 892 explicit ScopedThreadLocalCRLSet(CRLSet* crl_set) {
897 g_revocation_injector.Get().SetCRLSet(crl_set); 893 g_revocation_injector.Get().SetCRLSet(crl_set);
898 } 894 }
899 ~ScopedThreadLocalCRLSet() { g_revocation_injector.Get().SetCRLSet(nullptr); } 895 ~ScopedThreadLocalCRLSet() { g_revocation_injector.Get().SetCRLSet(nullptr); }
900 }; 896 };
901 897
902 // Sends a crash dump (without actually crashing) when the system time
903 // falls within the validity period of every certificate in
904 // |verified_cert|'s chain. This is to investigate reports of odd
905 // certificate errors that report ERR_CERT_DATE_INVALID when the
906 // certificate chain's dates appear to be valid.
907 //
908 // TODO(estark): remove this after obtaining diagnostic data from
909 // Canary. https://crbug.com/672906
910 void MaybeDumpCertificateDateError(
911 const scoped_refptr<X509Certificate>& verified_cert,
912 DWORD error_status,
913 DWORD info_status) {
914 const base::Time now = base::Time::NowFromSystemTime();
915 // If the leaf certificate is expired or not yet valid, nothing is odd.
916 if (now >= verified_cert->valid_expiry() ||
917 now <= verified_cert->valid_start()) {
918 return;
919 }
920 // Repeat the check for the rest of the certificates in the chain; if
921 // any of them is expired or not yet valid, nothing is odd.
922 X509Certificate::OSCertHandles intermediates =
923 verified_cert->GetIntermediateCertificates();
924 for (const auto& intermediate : intermediates) {
925 base::Time valid_start =
926 base::Time::FromFileTime(intermediate->pCertInfo->NotBefore);
927 base::Time valid_expiry =
928 base::Time::FromFileTime(intermediate->pCertInfo->NotAfter);
929 if (now >= valid_expiry || now <= valid_start)
930 return;
931 }
932 // None of the certificates in the chain appear to be expired or
933 // not-yet-valid, so send a crash dump for diagnostics.
934 base::debug::ScopedCrashKey error_status_crash_key(
935 "cert_verify_proc_win_date_error_error_status",
936 base::IntToString(error_status));
937 base::debug::ScopedCrashKey info_status_crash_key(
938 "cert_verify_proc_win_date_error_info_status",
939 base::IntToString(info_status));
940 base::debug::DumpWithoutCrashing();
941 }
942
943 } // namespace 898 } // namespace
944 899
945 CertVerifyProcWin::CertVerifyProcWin() {} 900 CertVerifyProcWin::CertVerifyProcWin() {}
946 901
947 CertVerifyProcWin::~CertVerifyProcWin() {} 902 CertVerifyProcWin::~CertVerifyProcWin() {}
948 903
949 bool CertVerifyProcWin::SupportsAdditionalTrustAnchors() const { 904 bool CertVerifyProcWin::SupportsAdditionalTrustAnchors() const {
950 return false; 905 return false;
951 } 906 }
952 907
(...skipping 255 matching lines...) Expand 10 before | Expand all | Expand 10 after
1208 CERT_TRUST_IS_OFFLINE_REVOCATION) { 1163 CERT_TRUST_IS_OFFLINE_REVOCATION) {
1209 verify_result->cert_status |= CERT_STATUS_REVOKED; 1164 verify_result->cert_status |= CERT_STATUS_REVOKED;
1210 } 1165 }
1211 } 1166 }
1212 1167
1213 ScopedPCCERT_CHAIN_CONTEXT scoped_chain_context(chain_context); 1168 ScopedPCCERT_CHAIN_CONTEXT scoped_chain_context(chain_context);
1214 1169
1215 verify_result->cert_status |= MapCertChainErrorStatusToCertStatus( 1170 verify_result->cert_status |= MapCertChainErrorStatusToCertStatus(
1216 chain_context->TrustStatus.dwErrorStatus); 1171 chain_context->TrustStatus.dwErrorStatus);
1217 1172
1218 // Send some diagnostic data in the event of certificate date errors
1219 // that occur on chains with validity periods that are valid according
1220 // to the system clock.
1221 // TODO(estark): remove this after obtaining diagnostic data from
1222 // Canary. https://crbug.com/672906
1223 if (verify_result->cert_status & CERT_STATUS_DATE_INVALID) {
1224 MaybeDumpCertificateDateError(verify_result->verified_cert,
1225 chain_context->TrustStatus.dwErrorStatus,
1226 chain_context->TrustStatus.dwInfoStatus);
1227 }
1228
1229 // Flag certificates that have a Subject common name with a NULL character. 1173 // Flag certificates that have a Subject common name with a NULL character.
1230 if (CertSubjectCommonNameHasNull(cert_handle)) 1174 if (CertSubjectCommonNameHasNull(cert_handle))
1231 verify_result->cert_status |= CERT_STATUS_INVALID; 1175 verify_result->cert_status |= CERT_STATUS_INVALID;
1232 1176
1233 base::string16 hostname16 = base::ASCIIToUTF16(hostname); 1177 base::string16 hostname16 = base::ASCIIToUTF16(hostname);
1234 1178
1235 SSL_EXTRA_CERT_CHAIN_POLICY_PARA extra_policy_para; 1179 SSL_EXTRA_CERT_CHAIN_POLICY_PARA extra_policy_para;
1236 memset(&extra_policy_para, 0, sizeof(extra_policy_para)); 1180 memset(&extra_policy_para, 0, sizeof(extra_policy_para));
1237 extra_policy_para.cbSize = sizeof(extra_policy_para); 1181 extra_policy_para.cbSize = sizeof(extra_policy_para);
1238 extra_policy_para.dwAuthType = AUTHTYPE_SERVER; 1182 extra_policy_para.dwAuthType = AUTHTYPE_SERVER;
(...skipping 53 matching lines...) Expand 10 before | Expand all | Expand 10 after
1292 return MapCertStatusToNetError(verify_result->cert_status); 1236 return MapCertStatusToNetError(verify_result->cert_status);
1293 1237
1294 if (ev_policy_oid && 1238 if (ev_policy_oid &&
1295 CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) { 1239 CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) {
1296 verify_result->cert_status |= CERT_STATUS_IS_EV; 1240 verify_result->cert_status |= CERT_STATUS_IS_EV;
1297 } 1241 }
1298 return OK; 1242 return OK;
1299 } 1243 }
1300 1244
1301 } // namespace net 1245 } // namespace net
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698