| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/cert_verify_proc_win.h" | 5 #include "net/cert/cert_verify_proc_win.h" |
| 6 | 6 |
| 7 #include <memory> | 7 #include <memory> |
| 8 #include <string> | 8 #include <string> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| 11 #include "base/debug/crash_logging.h" | |
| 12 #include "base/debug/dump_without_crashing.h" | |
| 13 #include "base/memory/free_deleter.h" | 11 #include "base/memory/free_deleter.h" |
| 14 #include "base/metrics/histogram_macros.h" | 12 #include "base/metrics/histogram_macros.h" |
| 15 #include "base/sha1.h" | 13 #include "base/sha1.h" |
| 16 #include "base/strings/string_number_conversions.h" | |
| 17 #include "base/strings/string_util.h" | 14 #include "base/strings/string_util.h" |
| 18 #include "base/strings/utf_string_conversions.h" | 15 #include "base/strings/utf_string_conversions.h" |
| 19 #include "base/threading/thread_local.h" | 16 #include "base/threading/thread_local.h" |
| 20 #include "base/time/time.h" | |
| 21 #include "crypto/capi_util.h" | 17 #include "crypto/capi_util.h" |
| 22 #include "crypto/scoped_capi_types.h" | 18 #include "crypto/scoped_capi_types.h" |
| 23 #include "crypto/sha2.h" | 19 #include "crypto/sha2.h" |
| 24 #include "net/base/net_errors.h" | 20 #include "net/base/net_errors.h" |
| 25 #include "net/cert/asn1_util.h" | 21 #include "net/cert/asn1_util.h" |
| 26 #include "net/cert/cert_status_flags.h" | 22 #include "net/cert/cert_status_flags.h" |
| 27 #include "net/cert/cert_verifier.h" | 23 #include "net/cert/cert_verifier.h" |
| 28 #include "net/cert/cert_verify_result.h" | 24 #include "net/cert/cert_verify_result.h" |
| 29 #include "net/cert/crl_set.h" | 25 #include "net/cert/crl_set.h" |
| 30 #include "net/cert/ev_root_ca_metadata.h" | 26 #include "net/cert/ev_root_ca_metadata.h" |
| (...skipping 861 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 892 } | 888 } |
| 893 | 889 |
| 894 class ScopedThreadLocalCRLSet { | 890 class ScopedThreadLocalCRLSet { |
| 895 public: | 891 public: |
| 896 explicit ScopedThreadLocalCRLSet(CRLSet* crl_set) { | 892 explicit ScopedThreadLocalCRLSet(CRLSet* crl_set) { |
| 897 g_revocation_injector.Get().SetCRLSet(crl_set); | 893 g_revocation_injector.Get().SetCRLSet(crl_set); |
| 898 } | 894 } |
| 899 ~ScopedThreadLocalCRLSet() { g_revocation_injector.Get().SetCRLSet(nullptr); } | 895 ~ScopedThreadLocalCRLSet() { g_revocation_injector.Get().SetCRLSet(nullptr); } |
| 900 }; | 896 }; |
| 901 | 897 |
| 902 // Sends a crash dump (without actually crashing) when the system time | |
| 903 // falls within the validity period of every certificate in | |
| 904 // |verified_cert|'s chain. This is to investigate reports of odd | |
| 905 // certificate errors that report ERR_CERT_DATE_INVALID when the | |
| 906 // certificate chain's dates appear to be valid. | |
| 907 // | |
| 908 // TODO(estark): remove this after obtaining diagnostic data from | |
| 909 // Canary. https://crbug.com/672906 | |
| 910 void MaybeDumpCertificateDateError( | |
| 911 const scoped_refptr<X509Certificate>& verified_cert, | |
| 912 DWORD error_status, | |
| 913 DWORD info_status) { | |
| 914 const base::Time now = base::Time::NowFromSystemTime(); | |
| 915 // If the leaf certificate is expired or not yet valid, nothing is odd. | |
| 916 if (now >= verified_cert->valid_expiry() || | |
| 917 now <= verified_cert->valid_start()) { | |
| 918 return; | |
| 919 } | |
| 920 // Repeat the check for the rest of the certificates in the chain; if | |
| 921 // any of them is expired or not yet valid, nothing is odd. | |
| 922 X509Certificate::OSCertHandles intermediates = | |
| 923 verified_cert->GetIntermediateCertificates(); | |
| 924 for (const auto& intermediate : intermediates) { | |
| 925 base::Time valid_start = | |
| 926 base::Time::FromFileTime(intermediate->pCertInfo->NotBefore); | |
| 927 base::Time valid_expiry = | |
| 928 base::Time::FromFileTime(intermediate->pCertInfo->NotAfter); | |
| 929 if (now >= valid_expiry || now <= valid_start) | |
| 930 return; | |
| 931 } | |
| 932 // None of the certificates in the chain appear to be expired or | |
| 933 // not-yet-valid, so send a crash dump for diagnostics. | |
| 934 base::debug::ScopedCrashKey error_status_crash_key( | |
| 935 "cert_verify_proc_win_date_error_error_status", | |
| 936 base::IntToString(error_status)); | |
| 937 base::debug::ScopedCrashKey info_status_crash_key( | |
| 938 "cert_verify_proc_win_date_error_info_status", | |
| 939 base::IntToString(info_status)); | |
| 940 base::debug::DumpWithoutCrashing(); | |
| 941 } | |
| 942 | |
| 943 } // namespace | 898 } // namespace |
| 944 | 899 |
| 945 CertVerifyProcWin::CertVerifyProcWin() {} | 900 CertVerifyProcWin::CertVerifyProcWin() {} |
| 946 | 901 |
| 947 CertVerifyProcWin::~CertVerifyProcWin() {} | 902 CertVerifyProcWin::~CertVerifyProcWin() {} |
| 948 | 903 |
| 949 bool CertVerifyProcWin::SupportsAdditionalTrustAnchors() const { | 904 bool CertVerifyProcWin::SupportsAdditionalTrustAnchors() const { |
| 950 return false; | 905 return false; |
| 951 } | 906 } |
| 952 | 907 |
| (...skipping 255 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1208 CERT_TRUST_IS_OFFLINE_REVOCATION) { | 1163 CERT_TRUST_IS_OFFLINE_REVOCATION) { |
| 1209 verify_result->cert_status |= CERT_STATUS_REVOKED; | 1164 verify_result->cert_status |= CERT_STATUS_REVOKED; |
| 1210 } | 1165 } |
| 1211 } | 1166 } |
| 1212 | 1167 |
| 1213 ScopedPCCERT_CHAIN_CONTEXT scoped_chain_context(chain_context); | 1168 ScopedPCCERT_CHAIN_CONTEXT scoped_chain_context(chain_context); |
| 1214 | 1169 |
| 1215 verify_result->cert_status |= MapCertChainErrorStatusToCertStatus( | 1170 verify_result->cert_status |= MapCertChainErrorStatusToCertStatus( |
| 1216 chain_context->TrustStatus.dwErrorStatus); | 1171 chain_context->TrustStatus.dwErrorStatus); |
| 1217 | 1172 |
| 1218 // Send some diagnostic data in the event of certificate date errors | |
| 1219 // that occur on chains with validity periods that are valid according | |
| 1220 // to the system clock. | |
| 1221 // TODO(estark): remove this after obtaining diagnostic data from | |
| 1222 // Canary. https://crbug.com/672906 | |
| 1223 if (verify_result->cert_status & CERT_STATUS_DATE_INVALID) { | |
| 1224 MaybeDumpCertificateDateError(verify_result->verified_cert, | |
| 1225 chain_context->TrustStatus.dwErrorStatus, | |
| 1226 chain_context->TrustStatus.dwInfoStatus); | |
| 1227 } | |
| 1228 | |
| 1229 // Flag certificates that have a Subject common name with a NULL character. | 1173 // Flag certificates that have a Subject common name with a NULL character. |
| 1230 if (CertSubjectCommonNameHasNull(cert_handle)) | 1174 if (CertSubjectCommonNameHasNull(cert_handle)) |
| 1231 verify_result->cert_status |= CERT_STATUS_INVALID; | 1175 verify_result->cert_status |= CERT_STATUS_INVALID; |
| 1232 | 1176 |
| 1233 base::string16 hostname16 = base::ASCIIToUTF16(hostname); | 1177 base::string16 hostname16 = base::ASCIIToUTF16(hostname); |
| 1234 | 1178 |
| 1235 SSL_EXTRA_CERT_CHAIN_POLICY_PARA extra_policy_para; | 1179 SSL_EXTRA_CERT_CHAIN_POLICY_PARA extra_policy_para; |
| 1236 memset(&extra_policy_para, 0, sizeof(extra_policy_para)); | 1180 memset(&extra_policy_para, 0, sizeof(extra_policy_para)); |
| 1237 extra_policy_para.cbSize = sizeof(extra_policy_para); | 1181 extra_policy_para.cbSize = sizeof(extra_policy_para); |
| 1238 extra_policy_para.dwAuthType = AUTHTYPE_SERVER; | 1182 extra_policy_para.dwAuthType = AUTHTYPE_SERVER; |
| (...skipping 53 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1292 return MapCertStatusToNetError(verify_result->cert_status); | 1236 return MapCertStatusToNetError(verify_result->cert_status); |
| 1293 | 1237 |
| 1294 if (ev_policy_oid && | 1238 if (ev_policy_oid && |
| 1295 CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) { | 1239 CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) { |
| 1296 verify_result->cert_status |= CERT_STATUS_IS_EV; | 1240 verify_result->cert_status |= CERT_STATUS_IS_EV; |
| 1297 } | 1241 } |
| 1298 return OK; | 1242 return OK; |
| 1299 } | 1243 } |
| 1300 | 1244 |
| 1301 } // namespace net | 1245 } // namespace net |
| OLD | NEW |