OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/quic/chromium/crypto/proof_verifier_chromium.h" | 5 #include "net/quic/chromium/crypto/proof_verifier_chromium.h" |
6 | 6 |
7 #include <utility> | 7 #include <utility> |
8 | 8 |
9 #include "base/bind.h" | 9 #include "base/bind.h" |
10 #include "base/bind_helpers.h" | 10 #include "base/bind_helpers.h" |
11 #include "base/callback_helpers.h" | 11 #include "base/callback_helpers.h" |
12 #include "base/logging.h" | 12 #include "base/logging.h" |
13 #include "base/memory/ptr_util.h" | 13 #include "base/memory/ptr_util.h" |
14 #include "base/metrics/histogram_macros.h" | 14 #include "base/metrics/histogram_macros.h" |
15 #include "base/strings/stringprintf.h" | 15 #include "base/strings/stringprintf.h" |
16 #include "crypto/signature_verifier.h" | 16 #include "crypto/signature_verifier.h" |
17 #include "net/base/host_port_pair.h" | 17 #include "net/base/host_port_pair.h" |
18 #include "net/base/net_errors.h" | 18 #include "net/base/net_errors.h" |
19 #include "net/cert/asn1_util.h" | 19 #include "net/cert/asn1_util.h" |
20 #include "net/cert/cert_status_flags.h" | 20 #include "net/cert/cert_status_flags.h" |
21 #include "net/cert/cert_verifier.h" | 21 #include "net/cert/cert_verifier.h" |
22 #include "net/cert/ct_policy_enforcer.h" | 22 #include "net/cert/ct_policy_enforcer.h" |
23 #include "net/cert/ct_policy_status.h" | 23 #include "net/cert/ct_policy_status.h" |
24 #include "net/cert/ct_verifier.h" | 24 #include "net/cert/ct_verifier.h" |
25 #include "net/cert/x509_util.h" | 25 #include "net/cert/x509_util.h" |
26 #include "net/http/transport_security_state.h" | 26 #include "net/http/transport_security_state.h" |
27 #include "net/quic/core/crypto/crypto_protocol.h" | 27 #include "net/quic/core/crypto/crypto_protocol.h" |
28 #include "net/ssl/ssl_config_service.h" | 28 #include "net/ssl/ssl_config_service.h" |
29 | 29 |
30 using base::StringPiece; | |
31 using base::StringPrintf; | 30 using base::StringPrintf; |
32 using std::string; | 31 using std::string; |
33 | 32 |
34 namespace net { | 33 namespace net { |
35 | 34 |
36 ProofVerifyDetailsChromium::ProofVerifyDetailsChromium() | 35 ProofVerifyDetailsChromium::ProofVerifyDetailsChromium() |
37 : pkp_bypassed(false) {} | 36 : pkp_bypassed(false) {} |
38 | 37 |
39 ProofVerifyDetailsChromium::~ProofVerifyDetailsChromium() {} | 38 ProofVerifyDetailsChromium::~ProofVerifyDetailsChromium() {} |
40 | 39 |
(...skipping 21 matching lines...) Expand all Loading... |
62 const NetLogWithSource& net_log); | 61 const NetLogWithSource& net_log); |
63 ~Job(); | 62 ~Job(); |
64 | 63 |
65 // Starts the proof verification. If |QUIC_PENDING| is returned, then | 64 // Starts the proof verification. If |QUIC_PENDING| is returned, then |
66 // |callback| will be invoked asynchronously when the verification completes. | 65 // |callback| will be invoked asynchronously when the verification completes. |
67 QuicAsyncStatus VerifyProof( | 66 QuicAsyncStatus VerifyProof( |
68 const std::string& hostname, | 67 const std::string& hostname, |
69 const uint16_t port, | 68 const uint16_t port, |
70 const std::string& server_config, | 69 const std::string& server_config, |
71 QuicVersion quic_version, | 70 QuicVersion quic_version, |
72 base::StringPiece chlo_hash, | 71 QuicStringPiece chlo_hash, |
73 const std::vector<std::string>& certs, | 72 const std::vector<std::string>& certs, |
74 const std::string& cert_sct, | 73 const std::string& cert_sct, |
75 const std::string& signature, | 74 const std::string& signature, |
76 std::string* error_details, | 75 std::string* error_details, |
77 std::unique_ptr<ProofVerifyDetails>* verify_details, | 76 std::unique_ptr<ProofVerifyDetails>* verify_details, |
78 std::unique_ptr<ProofVerifierCallback> callback); | 77 std::unique_ptr<ProofVerifierCallback> callback); |
79 | 78 |
80 // Starts the certificate chain verification of |certs|. If |QUIC_PENDING| is | 79 // Starts the certificate chain verification of |certs|. If |QUIC_PENDING| is |
81 // returned, then |callback| will be invoked asynchronously when the | 80 // returned, then |callback| will be invoked asynchronously when the |
82 // verification completes. | 81 // verification completes. |
(...skipping 24 matching lines...) Expand all Loading... |
107 std::unique_ptr<ProofVerifyDetails>* verify_details, | 106 std::unique_ptr<ProofVerifyDetails>* verify_details, |
108 std::unique_ptr<ProofVerifierCallback> callback); | 107 std::unique_ptr<ProofVerifierCallback> callback); |
109 | 108 |
110 int DoLoop(int last_io_result); | 109 int DoLoop(int last_io_result); |
111 void OnIOComplete(int result); | 110 void OnIOComplete(int result); |
112 int DoVerifyCert(int result); | 111 int DoVerifyCert(int result); |
113 int DoVerifyCertComplete(int result); | 112 int DoVerifyCertComplete(int result); |
114 | 113 |
115 bool VerifySignature(const std::string& signed_data, | 114 bool VerifySignature(const std::string& signed_data, |
116 QuicVersion quic_version, | 115 QuicVersion quic_version, |
117 StringPiece chlo_hash, | 116 QuicStringPiece chlo_hash, |
118 const std::string& signature, | 117 const std::string& signature, |
119 const std::string& cert); | 118 const std::string& cert); |
120 | 119 |
121 // Proof verifier to notify when this jobs completes. | 120 // Proof verifier to notify when this jobs completes. |
122 ProofVerifierChromium* proof_verifier_; | 121 ProofVerifierChromium* proof_verifier_; |
123 | 122 |
124 // The underlying verifier used for verifying certificates. | 123 // The underlying verifier used for verifying certificates. |
125 CertVerifier* verifier_; | 124 CertVerifier* verifier_; |
126 std::unique_ptr<CertVerifier::Request> cert_verifier_request_; | 125 std::unique_ptr<CertVerifier::Request> cert_verifier_request_; |
127 | 126 |
(...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
193 UMA_HISTOGRAM_TIMES("Net.QuicSession.VerifyProofTime.google", | 192 UMA_HISTOGRAM_TIMES("Net.QuicSession.VerifyProofTime.google", |
194 end_time - start_time_); | 193 end_time - start_time_); |
195 } | 194 } |
196 } | 195 } |
197 | 196 |
198 QuicAsyncStatus ProofVerifierChromium::Job::VerifyProof( | 197 QuicAsyncStatus ProofVerifierChromium::Job::VerifyProof( |
199 const string& hostname, | 198 const string& hostname, |
200 const uint16_t port, | 199 const uint16_t port, |
201 const string& server_config, | 200 const string& server_config, |
202 QuicVersion quic_version, | 201 QuicVersion quic_version, |
203 StringPiece chlo_hash, | 202 QuicStringPiece chlo_hash, |
204 const std::vector<string>& certs, | 203 const std::vector<string>& certs, |
205 const std::string& cert_sct, | 204 const std::string& cert_sct, |
206 const string& signature, | 205 const string& signature, |
207 std::string* error_details, | 206 std::string* error_details, |
208 std::unique_ptr<ProofVerifyDetails>* verify_details, | 207 std::unique_ptr<ProofVerifyDetails>* verify_details, |
209 std::unique_ptr<ProofVerifierCallback> callback) { | 208 std::unique_ptr<ProofVerifierCallback> callback) { |
210 DCHECK(error_details); | 209 DCHECK(error_details); |
211 DCHECK(verify_details); | 210 DCHECK(verify_details); |
212 DCHECK(callback); | 211 DCHECK(callback); |
213 | 212 |
(...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
285 std::unique_ptr<ProofVerifyDetails>* verify_details) { | 284 std::unique_ptr<ProofVerifyDetails>* verify_details) { |
286 if (certs.empty()) { | 285 if (certs.empty()) { |
287 *error_details = "Failed to create certificate chain. Certs are empty."; | 286 *error_details = "Failed to create certificate chain. Certs are empty."; |
288 DLOG(WARNING) << *error_details; | 287 DLOG(WARNING) << *error_details; |
289 verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID; | 288 verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID; |
290 *verify_details = std::move(verify_details_); | 289 *verify_details = std::move(verify_details_); |
291 return false; | 290 return false; |
292 } | 291 } |
293 | 292 |
294 // Convert certs to X509Certificate. | 293 // Convert certs to X509Certificate. |
295 std::vector<StringPiece> cert_pieces(certs.size()); | 294 std::vector<QuicStringPiece> cert_pieces(certs.size()); |
296 for (unsigned i = 0; i < certs.size(); i++) { | 295 for (unsigned i = 0; i < certs.size(); i++) { |
297 cert_pieces[i] = base::StringPiece(certs[i]); | 296 cert_pieces[i] = QuicStringPiece(certs[i]); |
298 } | 297 } |
299 cert_ = X509Certificate::CreateFromDERCertChain(cert_pieces); | 298 cert_ = X509Certificate::CreateFromDERCertChain(cert_pieces); |
300 if (!cert_.get()) { | 299 if (!cert_.get()) { |
301 *error_details = "Failed to create certificate chain"; | 300 *error_details = "Failed to create certificate chain"; |
302 DLOG(WARNING) << *error_details; | 301 DLOG(WARNING) << *error_details; |
303 verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID; | 302 verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID; |
304 *verify_details = std::move(verify_details_); | 303 *verify_details = std::move(verify_details_); |
305 return false; | 304 return false; |
306 } | 305 } |
307 return true; | 306 return true; |
(...skipping 157 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
465 DLOG(WARNING) << error_details_; | 464 DLOG(WARNING) << error_details_; |
466 } | 465 } |
467 | 466 |
468 // Exit DoLoop and return the result to the caller to VerifyProof. | 467 // Exit DoLoop and return the result to the caller to VerifyProof. |
469 DCHECK_EQ(STATE_NONE, next_state_); | 468 DCHECK_EQ(STATE_NONE, next_state_); |
470 return result; | 469 return result; |
471 } | 470 } |
472 | 471 |
473 bool ProofVerifierChromium::Job::VerifySignature(const string& signed_data, | 472 bool ProofVerifierChromium::Job::VerifySignature(const string& signed_data, |
474 QuicVersion quic_version, | 473 QuicVersion quic_version, |
475 StringPiece chlo_hash, | 474 QuicStringPiece chlo_hash, |
476 const string& signature, | 475 const string& signature, |
477 const string& cert) { | 476 const string& cert) { |
478 StringPiece spki; | 477 QuicStringPiece spki; |
479 if (!asn1::ExtractSPKIFromDERCert(cert, &spki)) { | 478 if (!asn1::ExtractSPKIFromDERCert(cert, &spki)) { |
480 DLOG(WARNING) << "ExtractSPKIFromDERCert failed"; | 479 DLOG(WARNING) << "ExtractSPKIFromDERCert failed"; |
481 return false; | 480 return false; |
482 } | 481 } |
483 | 482 |
484 crypto::SignatureVerifier verifier; | 483 crypto::SignatureVerifier verifier; |
485 | 484 |
486 size_t size_bits; | 485 size_t size_bits; |
487 X509Certificate::PublicKeyType type; | 486 X509Certificate::PublicKeyType type; |
488 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, &type); | 487 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, &type); |
(...skipping 60 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
549 } | 548 } |
550 | 549 |
551 ProofVerifierChromium::~ProofVerifierChromium() { | 550 ProofVerifierChromium::~ProofVerifierChromium() { |
552 } | 551 } |
553 | 552 |
554 QuicAsyncStatus ProofVerifierChromium::VerifyProof( | 553 QuicAsyncStatus ProofVerifierChromium::VerifyProof( |
555 const std::string& hostname, | 554 const std::string& hostname, |
556 const uint16_t port, | 555 const uint16_t port, |
557 const std::string& server_config, | 556 const std::string& server_config, |
558 QuicVersion quic_version, | 557 QuicVersion quic_version, |
559 base::StringPiece chlo_hash, | 558 QuicStringPiece chlo_hash, |
560 const std::vector<std::string>& certs, | 559 const std::vector<std::string>& certs, |
561 const std::string& cert_sct, | 560 const std::string& cert_sct, |
562 const std::string& signature, | 561 const std::string& signature, |
563 const ProofVerifyContext* verify_context, | 562 const ProofVerifyContext* verify_context, |
564 std::string* error_details, | 563 std::string* error_details, |
565 std::unique_ptr<ProofVerifyDetails>* verify_details, | 564 std::unique_ptr<ProofVerifyDetails>* verify_details, |
566 std::unique_ptr<ProofVerifierCallback> callback) { | 565 std::unique_ptr<ProofVerifierCallback> callback) { |
567 if (!verify_context) { | 566 if (!verify_context) { |
568 *error_details = "Missing context"; | 567 *error_details = "Missing context"; |
569 return QUIC_FAILURE; | 568 return QUIC_FAILURE; |
(...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
608 active_jobs_[job_ptr] = std::move(job); | 607 active_jobs_[job_ptr] = std::move(job); |
609 } | 608 } |
610 return status; | 609 return status; |
611 } | 610 } |
612 | 611 |
613 void ProofVerifierChromium::OnJobComplete(Job* job) { | 612 void ProofVerifierChromium::OnJobComplete(Job* job) { |
614 active_jobs_.erase(job); | 613 active_jobs_.erase(job); |
615 } | 614 } |
616 | 615 |
617 } // namespace net | 616 } // namespace net |
OLD | NEW |