Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(291)

Side by Side Diff: net/cert/cert_verify_proc_openssl.cc

Issue 266243004: Clang format slam. Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/cert/cert_verify_proc_openssl.h" 5 #include "net/cert/cert_verify_proc_openssl.h"
6 6
7 #include <openssl/x509v3.h> 7 #include <openssl/x509v3.h>
8 8
9 #include <string> 9 #include <string>
10 #include <vector> 10 #include <vector>
(...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after
84 case X509_V_ERR_APPLICATION_VERIFICATION: 84 case X509_V_ERR_APPLICATION_VERIFICATION:
85 return CERT_STATUS_INVALID; 85 return CERT_STATUS_INVALID;
86 default: 86 default:
87 NOTREACHED() << "Invalid X509 err " << err; 87 NOTREACHED() << "Invalid X509 err " << err;
88 return CERT_STATUS_INVALID; 88 return CERT_STATUS_INVALID;
89 } 89 }
90 } 90 }
91 91
92 // sk_X509_free is a function-style macro, so can't be used as a template 92 // sk_X509_free is a function-style macro, so can't be used as a template
93 // param directly. 93 // param directly.
94 void sk_X509_free_fn(STACK_OF(X509)* st) { 94 void sk_X509_free_fn(STACK_OF(X509) * st) {
95 sk_X509_free(st); 95 sk_X509_free(st);
96 } 96 }
97 97
98 void GetCertChainInfo(X509_STORE_CTX* store_ctx, 98 void GetCertChainInfo(X509_STORE_CTX* store_ctx,
99 CertVerifyResult* verify_result) { 99 CertVerifyResult* verify_result) {
100 STACK_OF(X509)* chain = X509_STORE_CTX_get_chain(store_ctx); 100 STACK_OF(X509)* chain = X509_STORE_CTX_get_chain(store_ctx);
101 X509* verified_cert = NULL; 101 X509* verified_cert = NULL;
102 std::vector<X509*> verified_chain; 102 std::vector<X509*> verified_chain;
103 for (int i = 0; i < sk_X509_num(chain); ++i) { 103 for (int i = 0; i < sk_X509_num(chain); ++i) {
104 X509* cert = sk_X509_value(chain, i); 104 X509* cert = sk_X509_value(chain, i);
(...skipping 30 matching lines...) Expand all
135 verify_result->is_issued_by_known_root = true; 135 verify_result->is_issued_by_known_root = true;
136 if (TestRootCerts::HasInstance()) { 136 if (TestRootCerts::HasInstance()) {
137 X509* root = NULL; 137 X509* root = NULL;
138 if (verified_chain.empty()) { 138 if (verified_chain.empty()) {
139 root = verified_cert; 139 root = verified_cert;
140 } else { 140 } else {
141 root = verified_chain.back(); 141 root = verified_chain.back();
142 } 142 }
143 TestRootCerts* root_certs = TestRootCerts::GetInstance(); 143 TestRootCerts* root_certs = TestRootCerts::GetInstance();
144 if (root_certs->Contains(root)) 144 if (root_certs->Contains(root))
145 verify_result->is_issued_by_known_root = false; 145 verify_result->is_issued_by_known_root = false;
146 } 146 }
147 } 147 }
148 } 148 }
149 149
150 void AppendPublicKeyHashes(X509_STORE_CTX* store_ctx, 150 void AppendPublicKeyHashes(X509_STORE_CTX* store_ctx, HashValueVector* hashes) {
151 HashValueVector* hashes) {
152 STACK_OF(X509)* chain = X509_STORE_CTX_get_chain(store_ctx); 151 STACK_OF(X509)* chain = X509_STORE_CTX_get_chain(store_ctx);
153 for (int i = 0; i < sk_X509_num(chain); ++i) { 152 for (int i = 0; i < sk_X509_num(chain); ++i) {
154 X509* cert = sk_X509_value(chain, i); 153 X509* cert = sk_X509_value(chain, i);
155 154
156 std::string der_data; 155 std::string der_data;
157 if (!X509Certificate::GetDEREncoded(cert, &der_data)) 156 if (!X509Certificate::GetDEREncoded(cert, &der_data))
158 continue; 157 continue;
159 158
160 base::StringPiece der_bytes(der_data); 159 base::StringPiece der_bytes(der_data);
161 base::StringPiece spki_bytes; 160 base::StringPiece spki_bytes;
162 if (!asn1::ExtractSPKIFromDERCert(der_bytes, &spki_bytes)) 161 if (!asn1::ExtractSPKIFromDERCert(der_bytes, &spki_bytes))
163 continue; 162 continue;
164 163
165 HashValue sha1(HASH_VALUE_SHA1); 164 HashValue sha1(HASH_VALUE_SHA1);
166 base::SHA1HashBytes(reinterpret_cast<const uint8*>(spki_bytes.data()), 165 base::SHA1HashBytes(reinterpret_cast<const uint8*>(spki_bytes.data()),
167 spki_bytes.size(), sha1.data()); 166 spki_bytes.size(),
167 sha1.data());
168 hashes->push_back(sha1); 168 hashes->push_back(sha1);
169 169
170 HashValue sha256(HASH_VALUE_SHA256); 170 HashValue sha256(HASH_VALUE_SHA256);
171 crypto::SHA256HashString(spki_bytes, sha256.data(), crypto::kSHA256Length); 171 crypto::SHA256HashString(spki_bytes, sha256.data(), crypto::kSHA256Length);
172 hashes->push_back(sha256); 172 hashes->push_back(sha256);
173 } 173 }
174 } 174 }
175 175
176 } // namespace 176 } // namespace
177 177
178 CertVerifyProcOpenSSL::CertVerifyProcOpenSSL() {} 178 CertVerifyProcOpenSSL::CertVerifyProcOpenSSL() {
179 }
179 180
180 CertVerifyProcOpenSSL::~CertVerifyProcOpenSSL() {} 181 CertVerifyProcOpenSSL::~CertVerifyProcOpenSSL() {
182 }
181 183
182 bool CertVerifyProcOpenSSL::SupportsAdditionalTrustAnchors() const { 184 bool CertVerifyProcOpenSSL::SupportsAdditionalTrustAnchors() const {
183 return false; 185 return false;
184 } 186 }
185 187
186 int CertVerifyProcOpenSSL::VerifyInternal( 188 int CertVerifyProcOpenSSL::VerifyInternal(
187 X509Certificate* cert, 189 X509Certificate* cert,
188 const std::string& hostname, 190 const std::string& hostname,
189 int flags, 191 int flags,
190 CRLSet* crl_set, 192 CRLSet* crl_set,
(...skipping 10 matching lines...) Expand all
201 X509_STORE_CTX_new()); 203 X509_STORE_CTX_new());
202 204
203 crypto::ScopedOpenSSL<STACK_OF(X509), sk_X509_free_fn> intermediates( 205 crypto::ScopedOpenSSL<STACK_OF(X509), sk_X509_free_fn> intermediates(
204 sk_X509_new_null()); 206 sk_X509_new_null());
205 if (!intermediates.get()) 207 if (!intermediates.get())
206 return ERR_OUT_OF_MEMORY; 208 return ERR_OUT_OF_MEMORY;
207 209
208 const X509Certificate::OSCertHandles& os_intermediates = 210 const X509Certificate::OSCertHandles& os_intermediates =
209 cert->GetIntermediateCertificates(); 211 cert->GetIntermediateCertificates();
210 for (X509Certificate::OSCertHandles::const_iterator it = 212 for (X509Certificate::OSCertHandles::const_iterator it =
211 os_intermediates.begin(); it != os_intermediates.end(); ++it) { 213 os_intermediates.begin();
214 it != os_intermediates.end();
215 ++it) {
212 if (!sk_X509_push(intermediates.get(), *it)) 216 if (!sk_X509_push(intermediates.get(), *it))
213 return ERR_OUT_OF_MEMORY; 217 return ERR_OUT_OF_MEMORY;
214 } 218 }
215 if (X509_STORE_CTX_init(ctx.get(), X509Certificate::cert_store(), 219 if (X509_STORE_CTX_init(ctx.get(),
216 cert->os_cert_handle(), intermediates.get()) != 1) { 220 X509Certificate::cert_store(),
221 cert->os_cert_handle(),
222 intermediates.get()) != 1) {
217 NOTREACHED(); 223 NOTREACHED();
218 return ERR_FAILED; 224 return ERR_FAILED;
219 } 225 }
220 226
221 if (X509_verify_cert(ctx.get()) != 1) { 227 if (X509_verify_cert(ctx.get()) != 1) {
222 int x509_error = X509_STORE_CTX_get_error(ctx.get()); 228 int x509_error = X509_STORE_CTX_get_error(ctx.get());
223 CertStatus cert_status = MapCertErrorToCertStatus(x509_error); 229 CertStatus cert_status = MapCertErrorToCertStatus(x509_error);
224 LOG(ERROR) << "X509 Verification error " 230 LOG(ERROR) << "X509 Verification error "
225 << X509_verify_cert_error_string(x509_error) 231 << X509_verify_cert_error_string(x509_error) << " : "
226 << " : " << x509_error 232 << x509_error << " : "
227 << " : " << X509_STORE_CTX_get_error_depth(ctx.get()) 233 << X509_STORE_CTX_get_error_depth(ctx.get()) << " : "
228 << " : " << cert_status; 234 << cert_status;
229 verify_result->cert_status |= cert_status; 235 verify_result->cert_status |= cert_status;
230 } 236 }
231 237
232 GetCertChainInfo(ctx.get(), verify_result); 238 GetCertChainInfo(ctx.get(), verify_result);
233 AppendPublicKeyHashes(ctx.get(), &verify_result->public_key_hashes); 239 AppendPublicKeyHashes(ctx.get(), &verify_result->public_key_hashes);
234 if (IsCertStatusError(verify_result->cert_status)) 240 if (IsCertStatusError(verify_result->cert_status))
235 return MapCertStatusToNetError(verify_result->cert_status); 241 return MapCertStatusToNetError(verify_result->cert_status);
236 242
237 return OK; 243 return OK;
238 } 244 }
239 245
240 } // namespace net 246 } // namespace net
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698