OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
8 | 8 |
9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
(...skipping 3393 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3404 // is fixed, we need to avoid using the NSS database for non-essential | 3404 // is fixed, we need to avoid using the NSS database for non-essential |
3405 // purposes. See https://bugzilla.mozilla.org/show_bug.cgi?id=508081 and | 3405 // purposes. See https://bugzilla.mozilla.org/show_bug.cgi?id=508081 and |
3406 // http://crbug.com/15630 for more info. | 3406 // http://crbug.com/15630 for more info. |
3407 | 3407 |
3408 // TODO(hclam): Skip logging if server cert was expected to be bad because | 3408 // TODO(hclam): Skip logging if server cert was expected to be bad because |
3409 // |server_cert_verify_result_| doesn't contain all the information about | 3409 // |server_cert_verify_result_| doesn't contain all the information about |
3410 // the cert. | 3410 // the cert. |
3411 if (result == OK) | 3411 if (result == OK) |
3412 LogConnectionTypeMetrics(); | 3412 LogConnectionTypeMetrics(); |
3413 | 3413 |
3414 bool sni_available = ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1 || | |
3415 ssl_config_.version_fallback; | |
3416 const CertStatus cert_status = server_cert_verify_result_.cert_status; | 3414 const CertStatus cert_status = server_cert_verify_result_.cert_status; |
3417 if (transport_security_state_ && | 3415 if (transport_security_state_ && |
3418 (result == OK || | 3416 (result == OK || |
3419 (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) && | 3417 (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) && |
3420 !transport_security_state_->CheckPublicKeyPins( | 3418 !transport_security_state_->CheckPublicKeyPins( |
3421 host_and_port_.host(), | 3419 host_and_port_.host(), |
3422 sni_available, | |
3423 server_cert_verify_result_.is_issued_by_known_root, | 3420 server_cert_verify_result_.is_issued_by_known_root, |
3424 server_cert_verify_result_.public_key_hashes, | 3421 server_cert_verify_result_.public_key_hashes, |
3425 &pinning_failure_log_)) { | 3422 &pinning_failure_log_)) { |
3426 result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN; | 3423 result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN; |
3427 } | 3424 } |
3428 | 3425 |
3429 if (result == OK) { | 3426 if (result == OK) { |
3430 // Only check Certificate Transparency if there were no other errors with | 3427 // Only check Certificate Transparency if there were no other errors with |
3431 // the connection. | 3428 // the connection. |
3432 VerifyCT(); | 3429 VerifyCT(); |
(...skipping 93 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3526 scoped_refptr<X509Certificate> | 3523 scoped_refptr<X509Certificate> |
3527 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const { | 3524 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const { |
3528 return core_->state().server_cert.get(); | 3525 return core_->state().server_cert.get(); |
3529 } | 3526 } |
3530 | 3527 |
3531 ChannelIDService* SSLClientSocketNSS::GetChannelIDService() const { | 3528 ChannelIDService* SSLClientSocketNSS::GetChannelIDService() const { |
3532 return channel_id_service_; | 3529 return channel_id_service_; |
3533 } | 3530 } |
3534 | 3531 |
3535 } // namespace net | 3532 } // namespace net |
OLD | NEW |