| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle | 5 // OpenSSL binding for SSLClientSocket. The class layout and general principle |
| 6 // of operation is derived from SSLClientSocketNSS. | 6 // of operation is derived from SSLClientSocketNSS. |
| 7 | 7 |
| 8 #include "net/socket/ssl_client_socket_openssl.h" | 8 #include "net/socket/ssl_client_socket_openssl.h" |
| 9 | 9 |
| 10 #include <errno.h> | 10 #include <errno.h> |
| (...skipping 1082 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1093 if (!start_cert_verification_time_.is_null()) { | 1093 if (!start_cert_verification_time_.is_null()) { |
| 1094 base::TimeDelta verify_time = | 1094 base::TimeDelta verify_time = |
| 1095 base::TimeTicks::Now() - start_cert_verification_time_; | 1095 base::TimeTicks::Now() - start_cert_verification_time_; |
| 1096 if (result == OK) { | 1096 if (result == OK) { |
| 1097 UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTime", verify_time); | 1097 UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTime", verify_time); |
| 1098 } else { | 1098 } else { |
| 1099 UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTimeError", verify_time); | 1099 UMA_HISTOGRAM_TIMES("Net.SSLCertVerificationTimeError", verify_time); |
| 1100 } | 1100 } |
| 1101 } | 1101 } |
| 1102 | 1102 |
| 1103 bool sni_available = ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1 || | |
| 1104 ssl_config_.version_fallback; | |
| 1105 const CertStatus cert_status = server_cert_verify_result_.cert_status; | 1103 const CertStatus cert_status = server_cert_verify_result_.cert_status; |
| 1106 if (transport_security_state_ && | 1104 if (transport_security_state_ && |
| 1107 (result == OK || | 1105 (result == OK || |
| 1108 (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) && | 1106 (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) && |
| 1109 !transport_security_state_->CheckPublicKeyPins( | 1107 !transport_security_state_->CheckPublicKeyPins( |
| 1110 host_and_port_.host(), | 1108 host_and_port_.host(), |
| 1111 sni_available, | |
| 1112 server_cert_verify_result_.is_issued_by_known_root, | 1109 server_cert_verify_result_.is_issued_by_known_root, |
| 1113 server_cert_verify_result_.public_key_hashes, | 1110 server_cert_verify_result_.public_key_hashes, |
| 1114 &pinning_failure_log_)) { | 1111 &pinning_failure_log_)) { |
| 1115 result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN; | 1112 result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN; |
| 1116 } | 1113 } |
| 1117 | 1114 |
| 1118 if (result == OK) { | 1115 if (result == OK) { |
| 1119 // Only check Certificate Transparency if there were no other errors with | 1116 // Only check Certificate Transparency if there were no other errors with |
| 1120 // the connection. | 1117 // the connection. |
| 1121 VerifyCT(); | 1118 VerifyCT(); |
| (...skipping 651 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1773 ct::SCT_STATUS_LOG_UNKNOWN)); | 1770 ct::SCT_STATUS_LOG_UNKNOWN)); |
| 1774 } | 1771 } |
| 1775 } | 1772 } |
| 1776 | 1773 |
| 1777 scoped_refptr<X509Certificate> | 1774 scoped_refptr<X509Certificate> |
| 1778 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { | 1775 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const { |
| 1779 return server_cert_; | 1776 return server_cert_; |
| 1780 } | 1777 } |
| 1781 | 1778 |
| 1782 } // namespace net | 1779 } // namespace net |
| OLD | NEW |