OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/cert_verify_proc_mac.h" | 5 #include "net/cert/cert_verify_proc_mac.h" |
6 | 6 |
7 #include <CommonCrypto/CommonDigest.h> | 7 #include <CommonCrypto/CommonDigest.h> |
8 #include <CoreServices/CoreServices.h> | 8 #include <CoreServices/CoreServices.h> |
9 #include <Security/Security.h> | 9 #include <Security/Security.h> |
10 | 10 |
(...skipping 970 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
981 if (status) | 981 if (status) |
982 return NetErrorFromOSStatus(status); | 982 return NetErrorFromOSStatus(status); |
983 verify_result->cert_status |= CertStatusFromOSStatus(cssm_result); | 983 verify_result->cert_status |= CertStatusFromOSStatus(cssm_result); |
984 if (!IsCertStatusError(verify_result->cert_status)) { | 984 if (!IsCertStatusError(verify_result->cert_status)) { |
985 LOG(WARNING) << "trust_result=" << trust_result; | 985 LOG(WARNING) << "trust_result=" << trust_result; |
986 verify_result->cert_status |= CERT_STATUS_INVALID; | 986 verify_result->cert_status |= CERT_STATUS_INVALID; |
987 } | 987 } |
988 break; | 988 break; |
989 } | 989 } |
990 | 990 |
991 // Perform hostname verification independent of SecTrustEvaluate. In order to | |
992 // do so, mask off any reported name errors first. | |
993 verify_result->cert_status &= ~CERT_STATUS_COMMON_NAME_INVALID; | |
994 | |
995 // TODO(wtc): Suppress CERT_STATUS_NO_REVOCATION_MECHANISM for now to be | 991 // TODO(wtc): Suppress CERT_STATUS_NO_REVOCATION_MECHANISM for now to be |
996 // compatible with Windows, which in turn implements this behavior to be | 992 // compatible with Windows, which in turn implements this behavior to be |
997 // compatible with WinHTTP, which doesn't report this error (bug 3004). | 993 // compatible with WinHTTP, which doesn't report this error (bug 3004). |
998 verify_result->cert_status &= ~CERT_STATUS_NO_REVOCATION_MECHANISM; | 994 verify_result->cert_status &= ~CERT_STATUS_NO_REVOCATION_MECHANISM; |
999 | 995 |
1000 AppendPublicKeyHashes(completed_chain, &verify_result->public_key_hashes); | 996 AppendPublicKeyHashes(completed_chain, &verify_result->public_key_hashes); |
1001 verify_result->is_issued_by_known_root = | 997 verify_result->is_issued_by_known_root = |
1002 g_known_roots.Get().IsIssuedByKnownRoot(completed_chain); | 998 g_known_roots.Get().IsIssuedByKnownRoot(completed_chain); |
1003 | 999 |
1000 // Hostname validation is handled by CertVerifyProc, so mask off any errors | |
1001 // that SecTrustEvaluate may have set, as its results are not used. | |
1002 verify_result->cert_status &= ~CERT_STATUS_COMMON_NAME_INVALID; | |
mattm
2017/03/01 23:56:47
Is moving this down significant? (Not a big deal I
Ryan Sleevi
2017/03/02 00:18:55
Eh, it was an artifact of the previous build in wh
| |
1003 | |
1004 if (IsCertStatusError(verify_result->cert_status)) | 1004 if (IsCertStatusError(verify_result->cert_status)) |
1005 return MapCertStatusToNetError(verify_result->cert_status); | 1005 return MapCertStatusToNetError(verify_result->cert_status); |
1006 | 1006 |
1007 return OK; | 1007 return OK; |
1008 } | 1008 } |
1009 | 1009 |
1010 } // namespace | 1010 } // namespace |
1011 | 1011 |
1012 CertVerifyProcMac::CertVerifyProcMac() {} | 1012 CertVerifyProcMac::CertVerifyProcMac() {} |
1013 | 1013 |
(...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1073 // EV cert and it was covered by CRLSets or revocation checking passed. | 1073 // EV cert and it was covered by CRLSets or revocation checking passed. |
1074 verify_result->cert_status |= CERT_STATUS_IS_EV; | 1074 verify_result->cert_status |= CERT_STATUS_IS_EV; |
1075 } | 1075 } |
1076 | 1076 |
1077 return OK; | 1077 return OK; |
1078 } | 1078 } |
1079 | 1079 |
1080 } // namespace net | 1080 } // namespace net |
1081 | 1081 |
1082 #pragma clang diagnostic pop // "-Wdeprecated-declarations" | 1082 #pragma clang diagnostic pop // "-Wdeprecated-declarations" |
OLD | NEW |