| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/cert/multi_threaded_cert_verifier.h" | |
| 6 | |
| 7 #include <algorithm> | |
| 8 | |
| 9 #include "base/bind.h" | |
| 10 #include "base/bind_helpers.h" | |
| 11 #include "base/compiler_specific.h" | |
| 12 #include "base/message_loop/message_loop.h" | |
| 13 #include "base/metrics/histogram.h" | |
| 14 #include "base/stl_util.h" | |
| 15 #include "base/synchronization/lock.h" | |
| 16 #include "base/threading/worker_pool.h" | |
| 17 #include "base/time/time.h" | |
| 18 #include "base/values.h" | |
| 19 #include "net/base/hash_value.h" | |
| 20 #include "net/base/net_errors.h" | |
| 21 #include "net/base/net_log.h" | |
| 22 #include "net/cert/cert_trust_anchor_provider.h" | |
| 23 #include "net/cert/cert_verify_proc.h" | |
| 24 #include "net/cert/crl_set.h" | |
| 25 #include "net/cert/x509_certificate.h" | |
| 26 #include "net/cert/x509_certificate_net_log_param.h" | |
| 27 | |
| 28 #if defined(USE_NSS) || defined(OS_IOS) | |
| 29 #include <private/pprthred.h> // PR_DetachThread | |
| 30 #endif | |
| 31 | |
| 32 namespace net { | |
| 33 | |
| 34 //////////////////////////////////////////////////////////////////////////// | |
| 35 | |
| 36 // Life of a request: | |
| 37 // | |
| 38 // MultiThreadedCertVerifier CertVerifierJob CertVerifierWorker Request | |
| 39 // | (origin loop) (worker loop) | |
| 40 // | | |
| 41 // Verify() | |
| 42 // |---->-------------------------------------<creates> | |
| 43 // | | |
| 44 // |---->-------------------<creates> | |
| 45 // | | |
| 46 // |---->-------------------------------------------------------<creates> | |
| 47 // | | |
| 48 // |---->---------------------------------------Start | |
| 49 // | | | |
| 50 // | PostTask | |
| 51 // | | |
| 52 // | <starts verifying> | |
| 53 // |---->-------------------AddRequest | | |
| 54 // | | |
| 55 // | | |
| 56 // | | |
| 57 // Finish | |
| 58 // | | |
| 59 // PostTask | |
| 60 // | |
| 61 // | | |
| 62 // DoReply | |
| 63 // |----<-----------------------------------------| | |
| 64 // HandleResult | |
| 65 // | | |
| 66 // |---->------------------HandleResult | |
| 67 // | | |
| 68 // |------>---------------------------Post | |
| 69 // | |
| 70 // | |
| 71 // | |
| 72 // On a cache hit, MultiThreadedCertVerifier::Verify() returns synchronously | |
| 73 // without posting a task to a worker thread. | |
| 74 | |
| 75 namespace { | |
| 76 | |
| 77 // The default value of max_cache_entries_. | |
| 78 const unsigned kMaxCacheEntries = 256; | |
| 79 | |
| 80 // The number of seconds for which we'll cache a cache entry. | |
| 81 const unsigned kTTLSecs = 1800; // 30 minutes. | |
| 82 | |
| 83 base::Value* CertVerifyResultCallback(const CertVerifyResult& verify_result, | |
| 84 NetLog::LogLevel log_level) { | |
| 85 base::DictionaryValue* results = new base::DictionaryValue(); | |
| 86 results->SetBoolean("has_md5", verify_result.has_md5); | |
| 87 results->SetBoolean("has_md2", verify_result.has_md2); | |
| 88 results->SetBoolean("has_md4", verify_result.has_md4); | |
| 89 results->SetBoolean("is_issued_by_known_root", | |
| 90 verify_result.is_issued_by_known_root); | |
| 91 results->SetBoolean("is_issued_by_additional_trust_anchor", | |
| 92 verify_result.is_issued_by_additional_trust_anchor); | |
| 93 results->SetBoolean("common_name_fallback_used", | |
| 94 verify_result.common_name_fallback_used); | |
| 95 results->SetInteger("cert_status", verify_result.cert_status); | |
| 96 results->Set("verified_cert", | |
| 97 NetLogX509CertificateCallback(verify_result.verified_cert.get(), | |
| 98 log_level)); | |
| 99 | |
| 100 base::ListValue* hashes = new base::ListValue(); | |
| 101 for (std::vector<HashValue>::const_iterator it = | |
| 102 verify_result.public_key_hashes.begin(); | |
| 103 it != verify_result.public_key_hashes.end(); | |
| 104 ++it) { | |
| 105 hashes->AppendString(it->ToString()); | |
| 106 } | |
| 107 results->Set("public_key_hashes", hashes); | |
| 108 | |
| 109 return results; | |
| 110 } | |
| 111 | |
| 112 } // namespace | |
| 113 | |
| 114 MultiThreadedCertVerifier::CachedResult::CachedResult() : error(ERR_FAILED) {} | |
| 115 | |
| 116 MultiThreadedCertVerifier::CachedResult::~CachedResult() {} | |
| 117 | |
| 118 MultiThreadedCertVerifier::CacheValidityPeriod::CacheValidityPeriod( | |
| 119 const base::Time& now) | |
| 120 : verification_time(now), | |
| 121 expiration_time(now) { | |
| 122 } | |
| 123 | |
| 124 MultiThreadedCertVerifier::CacheValidityPeriod::CacheValidityPeriod( | |
| 125 const base::Time& now, | |
| 126 const base::Time& expiration) | |
| 127 : verification_time(now), | |
| 128 expiration_time(expiration) { | |
| 129 } | |
| 130 | |
| 131 bool MultiThreadedCertVerifier::CacheExpirationFunctor::operator()( | |
| 132 const CacheValidityPeriod& now, | |
| 133 const CacheValidityPeriod& expiration) const { | |
| 134 // Ensure this functor is being used for expiration only, and not strict | |
| 135 // weak ordering/sorting. |now| should only ever contain a single | |
| 136 // base::Time. | |
| 137 // Note: DCHECK_EQ is not used due to operator<< overloading requirements. | |
| 138 DCHECK(now.verification_time == now.expiration_time); | |
| 139 | |
| 140 // |now| contains only a single time (verification_time), while |expiration| | |
| 141 // contains the validity range - both when the certificate was verified and | |
| 142 // when the verification result should expire. | |
| 143 // | |
| 144 // If the user receives a "not yet valid" message, and adjusts their clock | |
| 145 // foward to the correct time, this will (typically) cause | |
| 146 // now.verification_time to advance past expiration.expiration_time, thus | |
| 147 // treating the cached result as an expired entry and re-verifying. | |
| 148 // If the user receives a "expired" message, and adjusts their clock | |
| 149 // backwards to the correct time, this will cause now.verification_time to | |
| 150 // be less than expiration_verification_time, thus treating the cached | |
| 151 // result as an expired entry and re-verifying. | |
| 152 // If the user receives either of those messages, and does not adjust their | |
| 153 // clock, then the result will be (typically) be cached until the expiration | |
| 154 // TTL. | |
| 155 // | |
| 156 // This algorithm is only problematic if the user consistently keeps | |
| 157 // adjusting their clock backwards in increments smaller than the expiration | |
| 158 // TTL, in which case, cached elements continue to be added. However, | |
| 159 // because the cache has a fixed upper bound, if no entries are expired, a | |
| 160 // 'random' entry will be, thus keeping the memory constraints bounded over | |
| 161 // time. | |
| 162 return now.verification_time >= expiration.verification_time && | |
| 163 now.verification_time < expiration.expiration_time; | |
| 164 }; | |
| 165 | |
| 166 | |
| 167 // Represents the output and result callback of a request. | |
| 168 class CertVerifierRequest { | |
| 169 public: | |
| 170 CertVerifierRequest(const CompletionCallback& callback, | |
| 171 CertVerifyResult* verify_result, | |
| 172 const BoundNetLog& net_log) | |
| 173 : callback_(callback), | |
| 174 verify_result_(verify_result), | |
| 175 net_log_(net_log) { | |
| 176 net_log_.BeginEvent(NetLog::TYPE_CERT_VERIFIER_REQUEST); | |
| 177 } | |
| 178 | |
| 179 ~CertVerifierRequest() { | |
| 180 } | |
| 181 | |
| 182 // Ensures that the result callback will never be made. | |
| 183 void Cancel() { | |
| 184 callback_.Reset(); | |
| 185 verify_result_ = NULL; | |
| 186 net_log_.AddEvent(NetLog::TYPE_CANCELLED); | |
| 187 net_log_.EndEvent(NetLog::TYPE_CERT_VERIFIER_REQUEST); | |
| 188 } | |
| 189 | |
| 190 // Copies the contents of |verify_result| to the caller's | |
| 191 // CertVerifyResult and calls the callback. | |
| 192 void Post(const MultiThreadedCertVerifier::CachedResult& verify_result) { | |
| 193 if (!callback_.is_null()) { | |
| 194 net_log_.EndEvent(NetLog::TYPE_CERT_VERIFIER_REQUEST); | |
| 195 *verify_result_ = verify_result.result; | |
| 196 callback_.Run(verify_result.error); | |
| 197 } | |
| 198 delete this; | |
| 199 } | |
| 200 | |
| 201 bool canceled() const { return callback_.is_null(); } | |
| 202 | |
| 203 const BoundNetLog& net_log() const { return net_log_; } | |
| 204 | |
| 205 private: | |
| 206 CompletionCallback callback_; | |
| 207 CertVerifyResult* verify_result_; | |
| 208 const BoundNetLog net_log_; | |
| 209 }; | |
| 210 | |
| 211 | |
| 212 // CertVerifierWorker runs on a worker thread and takes care of the blocking | |
| 213 // process of performing the certificate verification. Deletes itself | |
| 214 // eventually if Start() succeeds. | |
| 215 class CertVerifierWorker { | |
| 216 public: | |
| 217 CertVerifierWorker(CertVerifyProc* verify_proc, | |
| 218 X509Certificate* cert, | |
| 219 const std::string& hostname, | |
| 220 int flags, | |
| 221 CRLSet* crl_set, | |
| 222 const CertificateList& additional_trust_anchors, | |
| 223 MultiThreadedCertVerifier* cert_verifier) | |
| 224 : verify_proc_(verify_proc), | |
| 225 cert_(cert), | |
| 226 hostname_(hostname), | |
| 227 flags_(flags), | |
| 228 crl_set_(crl_set), | |
| 229 additional_trust_anchors_(additional_trust_anchors), | |
| 230 origin_loop_(base::MessageLoop::current()), | |
| 231 cert_verifier_(cert_verifier), | |
| 232 canceled_(false), | |
| 233 error_(ERR_FAILED) { | |
| 234 } | |
| 235 | |
| 236 // Returns the certificate being verified. May only be called /before/ | |
| 237 // Start() is called. | |
| 238 X509Certificate* certificate() const { return cert_.get(); } | |
| 239 | |
| 240 bool Start() { | |
| 241 DCHECK_EQ(base::MessageLoop::current(), origin_loop_); | |
| 242 | |
| 243 return base::WorkerPool::PostTask( | |
| 244 FROM_HERE, base::Bind(&CertVerifierWorker::Run, base::Unretained(this)), | |
| 245 true /* task is slow */); | |
| 246 } | |
| 247 | |
| 248 // Cancel is called from the origin loop when the MultiThreadedCertVerifier is | |
| 249 // getting deleted. | |
| 250 void Cancel() { | |
| 251 DCHECK_EQ(base::MessageLoop::current(), origin_loop_); | |
| 252 base::AutoLock locked(lock_); | |
| 253 canceled_ = true; | |
| 254 } | |
| 255 | |
| 256 private: | |
| 257 void Run() { | |
| 258 // Runs on a worker thread. | |
| 259 error_ = verify_proc_->Verify(cert_.get(), | |
| 260 hostname_, | |
| 261 flags_, | |
| 262 crl_set_.get(), | |
| 263 additional_trust_anchors_, | |
| 264 &verify_result_); | |
| 265 #if defined(USE_NSS) || defined(OS_IOS) | |
| 266 // Detach the thread from NSPR. | |
| 267 // Calling NSS functions attaches the thread to NSPR, which stores | |
| 268 // the NSPR thread ID in thread-specific data. | |
| 269 // The threads in our thread pool terminate after we have called | |
| 270 // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets | |
| 271 // segfaults on shutdown when the threads' thread-specific data | |
| 272 // destructors run. | |
| 273 PR_DetachThread(); | |
| 274 #endif | |
| 275 Finish(); | |
| 276 } | |
| 277 | |
| 278 // DoReply runs on the origin thread. | |
| 279 void DoReply() { | |
| 280 DCHECK_EQ(base::MessageLoop::current(), origin_loop_); | |
| 281 { | |
| 282 // We lock here because the worker thread could still be in Finished, | |
| 283 // after the PostTask, but before unlocking |lock_|. If we do not lock in | |
| 284 // this case, we will end up deleting a locked Lock, which can lead to | |
| 285 // memory leaks or worse errors. | |
| 286 base::AutoLock locked(lock_); | |
| 287 if (!canceled_) { | |
| 288 cert_verifier_->HandleResult(cert_.get(), | |
| 289 hostname_, | |
| 290 flags_, | |
| 291 additional_trust_anchors_, | |
| 292 error_, | |
| 293 verify_result_); | |
| 294 } | |
| 295 } | |
| 296 delete this; | |
| 297 } | |
| 298 | |
| 299 void Finish() { | |
| 300 // Runs on the worker thread. | |
| 301 // We assume that the origin loop outlives the MultiThreadedCertVerifier. If | |
| 302 // the MultiThreadedCertVerifier is deleted, it will call Cancel on us. If | |
| 303 // it does so before the Acquire, we'll delete ourselves and return. If it's | |
| 304 // trying to do so concurrently, then it'll block on the lock and we'll call | |
| 305 // PostTask while the MultiThreadedCertVerifier (and therefore the | |
| 306 // MessageLoop) is still alive. | |
| 307 // If it does so after this function, we assume that the MessageLoop will | |
| 308 // process pending tasks. In which case we'll notice the |canceled_| flag | |
| 309 // in DoReply. | |
| 310 | |
| 311 bool canceled; | |
| 312 { | |
| 313 base::AutoLock locked(lock_); | |
| 314 canceled = canceled_; | |
| 315 if (!canceled) { | |
| 316 origin_loop_->PostTask( | |
| 317 FROM_HERE, base::Bind( | |
| 318 &CertVerifierWorker::DoReply, base::Unretained(this))); | |
| 319 } | |
| 320 } | |
| 321 | |
| 322 if (canceled) | |
| 323 delete this; | |
| 324 } | |
| 325 | |
| 326 scoped_refptr<CertVerifyProc> verify_proc_; | |
| 327 scoped_refptr<X509Certificate> cert_; | |
| 328 const std::string hostname_; | |
| 329 const int flags_; | |
| 330 scoped_refptr<CRLSet> crl_set_; | |
| 331 const CertificateList additional_trust_anchors_; | |
| 332 base::MessageLoop* const origin_loop_; | |
| 333 MultiThreadedCertVerifier* const cert_verifier_; | |
| 334 | |
| 335 // lock_ protects canceled_. | |
| 336 base::Lock lock_; | |
| 337 | |
| 338 // If canceled_ is true, | |
| 339 // * origin_loop_ cannot be accessed by the worker thread, | |
| 340 // * cert_verifier_ cannot be accessed by any thread. | |
| 341 bool canceled_; | |
| 342 | |
| 343 int error_; | |
| 344 CertVerifyResult verify_result_; | |
| 345 | |
| 346 DISALLOW_COPY_AND_ASSIGN(CertVerifierWorker); | |
| 347 }; | |
| 348 | |
| 349 // A CertVerifierJob is a one-to-one counterpart of a CertVerifierWorker. It | |
| 350 // lives only on the CertVerifier's origin message loop. | |
| 351 class CertVerifierJob { | |
| 352 public: | |
| 353 CertVerifierJob(CertVerifierWorker* worker, | |
| 354 const BoundNetLog& net_log) | |
| 355 : start_time_(base::TimeTicks::Now()), | |
| 356 worker_(worker), | |
| 357 net_log_(net_log) { | |
| 358 net_log_.BeginEvent( | |
| 359 NetLog::TYPE_CERT_VERIFIER_JOB, | |
| 360 base::Bind(&NetLogX509CertificateCallback, | |
| 361 base::Unretained(worker_->certificate()))); | |
| 362 } | |
| 363 | |
| 364 ~CertVerifierJob() { | |
| 365 if (worker_) { | |
| 366 net_log_.AddEvent(NetLog::TYPE_CANCELLED); | |
| 367 net_log_.EndEvent(NetLog::TYPE_CERT_VERIFIER_JOB); | |
| 368 worker_->Cancel(); | |
| 369 DeleteAllCanceled(); | |
| 370 } | |
| 371 } | |
| 372 | |
| 373 void AddRequest(CertVerifierRequest* request) { | |
| 374 request->net_log().AddEvent( | |
| 375 NetLog::TYPE_CERT_VERIFIER_REQUEST_BOUND_TO_JOB, | |
| 376 net_log_.source().ToEventParametersCallback()); | |
| 377 | |
| 378 requests_.push_back(request); | |
| 379 } | |
| 380 | |
| 381 void HandleResult( | |
| 382 const MultiThreadedCertVerifier::CachedResult& verify_result, | |
| 383 bool is_first_job) { | |
| 384 worker_ = NULL; | |
| 385 net_log_.EndEvent( | |
| 386 NetLog::TYPE_CERT_VERIFIER_JOB, | |
| 387 base::Bind(&CertVerifyResultCallback, verify_result.result)); | |
| 388 base::TimeDelta latency = base::TimeTicks::Now() - start_time_; | |
| 389 UMA_HISTOGRAM_CUSTOM_TIMES("Net.CertVerifier_Job_Latency", | |
| 390 latency, | |
| 391 base::TimeDelta::FromMilliseconds(1), | |
| 392 base::TimeDelta::FromMinutes(10), | |
| 393 100); | |
| 394 if (is_first_job) { | |
| 395 UMA_HISTOGRAM_CUSTOM_TIMES("Net.CertVerifier_First_Job_Latency", | |
| 396 latency, | |
| 397 base::TimeDelta::FromMilliseconds(1), | |
| 398 base::TimeDelta::FromMinutes(10), | |
| 399 100); | |
| 400 } | |
| 401 PostAll(verify_result); | |
| 402 } | |
| 403 | |
| 404 private: | |
| 405 void PostAll(const MultiThreadedCertVerifier::CachedResult& verify_result) { | |
| 406 std::vector<CertVerifierRequest*> requests; | |
| 407 requests_.swap(requests); | |
| 408 | |
| 409 for (std::vector<CertVerifierRequest*>::iterator | |
| 410 i = requests.begin(); i != requests.end(); i++) { | |
| 411 (*i)->Post(verify_result); | |
| 412 // Post() causes the CertVerifierRequest to delete itself. | |
| 413 } | |
| 414 } | |
| 415 | |
| 416 void DeleteAllCanceled() { | |
| 417 for (std::vector<CertVerifierRequest*>::iterator | |
| 418 i = requests_.begin(); i != requests_.end(); i++) { | |
| 419 if ((*i)->canceled()) { | |
| 420 delete *i; | |
| 421 } else { | |
| 422 LOG(DFATAL) << "CertVerifierRequest leaked!"; | |
| 423 } | |
| 424 } | |
| 425 } | |
| 426 | |
| 427 const base::TimeTicks start_time_; | |
| 428 std::vector<CertVerifierRequest*> requests_; | |
| 429 CertVerifierWorker* worker_; | |
| 430 const BoundNetLog net_log_; | |
| 431 }; | |
| 432 | |
| 433 MultiThreadedCertVerifier::MultiThreadedCertVerifier( | |
| 434 CertVerifyProc* verify_proc) | |
| 435 : cache_(kMaxCacheEntries), | |
| 436 first_job_(NULL), | |
| 437 requests_(0), | |
| 438 cache_hits_(0), | |
| 439 inflight_joins_(0), | |
| 440 verify_proc_(verify_proc), | |
| 441 trust_anchor_provider_(NULL) { | |
| 442 CertDatabase::GetInstance()->AddObserver(this); | |
| 443 } | |
| 444 | |
| 445 MultiThreadedCertVerifier::~MultiThreadedCertVerifier() { | |
| 446 STLDeleteValues(&inflight_); | |
| 447 CertDatabase::GetInstance()->RemoveObserver(this); | |
| 448 } | |
| 449 | |
| 450 void MultiThreadedCertVerifier::SetCertTrustAnchorProvider( | |
| 451 CertTrustAnchorProvider* trust_anchor_provider) { | |
| 452 DCHECK(CalledOnValidThread()); | |
| 453 trust_anchor_provider_ = trust_anchor_provider; | |
| 454 } | |
| 455 | |
| 456 int MultiThreadedCertVerifier::Verify(X509Certificate* cert, | |
| 457 const std::string& hostname, | |
| 458 int flags, | |
| 459 CRLSet* crl_set, | |
| 460 CertVerifyResult* verify_result, | |
| 461 const CompletionCallback& callback, | |
| 462 RequestHandle* out_req, | |
| 463 const BoundNetLog& net_log) { | |
| 464 DCHECK(CalledOnValidThread()); | |
| 465 | |
| 466 if (callback.is_null() || !verify_result || hostname.empty()) { | |
| 467 *out_req = NULL; | |
| 468 return ERR_INVALID_ARGUMENT; | |
| 469 } | |
| 470 | |
| 471 requests_++; | |
| 472 | |
| 473 const CertificateList empty_cert_list; | |
| 474 const CertificateList& additional_trust_anchors = | |
| 475 trust_anchor_provider_ ? | |
| 476 trust_anchor_provider_->GetAdditionalTrustAnchors() : empty_cert_list; | |
| 477 | |
| 478 const RequestParams key(cert->fingerprint(), cert->ca_fingerprint(), | |
| 479 hostname, flags, additional_trust_anchors); | |
| 480 const CertVerifierCache::value_type* cached_entry = | |
| 481 cache_.Get(key, CacheValidityPeriod(base::Time::Now())); | |
| 482 if (cached_entry) { | |
| 483 ++cache_hits_; | |
| 484 *out_req = NULL; | |
| 485 *verify_result = cached_entry->result; | |
| 486 return cached_entry->error; | |
| 487 } | |
| 488 | |
| 489 // No cache hit. See if an identical request is currently in flight. | |
| 490 CertVerifierJob* job; | |
| 491 std::map<RequestParams, CertVerifierJob*>::const_iterator j; | |
| 492 j = inflight_.find(key); | |
| 493 if (j != inflight_.end()) { | |
| 494 // An identical request is in flight already. We'll just attach our | |
| 495 // callback. | |
| 496 inflight_joins_++; | |
| 497 job = j->second; | |
| 498 } else { | |
| 499 // Need to make a new request. | |
| 500 CertVerifierWorker* worker = | |
| 501 new CertVerifierWorker(verify_proc_.get(), | |
| 502 cert, | |
| 503 hostname, | |
| 504 flags, | |
| 505 crl_set, | |
| 506 additional_trust_anchors, | |
| 507 this); | |
| 508 job = new CertVerifierJob( | |
| 509 worker, | |
| 510 BoundNetLog::Make(net_log.net_log(), NetLog::SOURCE_CERT_VERIFIER_JOB)); | |
| 511 if (!worker->Start()) { | |
| 512 delete job; | |
| 513 delete worker; | |
| 514 *out_req = NULL; | |
| 515 // TODO(wtc): log to the NetLog. | |
| 516 LOG(ERROR) << "CertVerifierWorker couldn't be started."; | |
| 517 return ERR_INSUFFICIENT_RESOURCES; // Just a guess. | |
| 518 } | |
| 519 inflight_.insert(std::make_pair(key, job)); | |
| 520 if (requests_ == 1) { | |
| 521 // Cleared in HandleResult. | |
| 522 first_job_ = job; | |
| 523 } | |
| 524 } | |
| 525 | |
| 526 CertVerifierRequest* request = | |
| 527 new CertVerifierRequest(callback, verify_result, net_log); | |
| 528 job->AddRequest(request); | |
| 529 *out_req = request; | |
| 530 return ERR_IO_PENDING; | |
| 531 } | |
| 532 | |
| 533 void MultiThreadedCertVerifier::CancelRequest(RequestHandle req) { | |
| 534 DCHECK(CalledOnValidThread()); | |
| 535 CertVerifierRequest* request = reinterpret_cast<CertVerifierRequest*>(req); | |
| 536 request->Cancel(); | |
| 537 } | |
| 538 | |
| 539 MultiThreadedCertVerifier::RequestParams::RequestParams( | |
| 540 const SHA1HashValue& cert_fingerprint_arg, | |
| 541 const SHA1HashValue& ca_fingerprint_arg, | |
| 542 const std::string& hostname_arg, | |
| 543 int flags_arg, | |
| 544 const CertificateList& additional_trust_anchors) | |
| 545 : hostname(hostname_arg), | |
| 546 flags(flags_arg) { | |
| 547 hash_values.reserve(2 + additional_trust_anchors.size()); | |
| 548 hash_values.push_back(cert_fingerprint_arg); | |
| 549 hash_values.push_back(ca_fingerprint_arg); | |
| 550 for (size_t i = 0; i < additional_trust_anchors.size(); ++i) | |
| 551 hash_values.push_back(additional_trust_anchors[i]->fingerprint()); | |
| 552 } | |
| 553 | |
| 554 MultiThreadedCertVerifier::RequestParams::~RequestParams() {} | |
| 555 | |
| 556 bool MultiThreadedCertVerifier::RequestParams::operator<( | |
| 557 const RequestParams& other) const { | |
| 558 // |flags| is compared before |cert_fingerprint|, |ca_fingerprint|, and | |
| 559 // |hostname| under assumption that integer comparisons are faster than | |
| 560 // memory and string comparisons. | |
| 561 if (flags != other.flags) | |
| 562 return flags < other.flags; | |
| 563 if (hostname != other.hostname) | |
| 564 return hostname < other.hostname; | |
| 565 return std::lexicographical_compare( | |
| 566 hash_values.begin(), hash_values.end(), | |
| 567 other.hash_values.begin(), other.hash_values.end(), | |
| 568 net::SHA1HashValueLessThan()); | |
| 569 } | |
| 570 | |
| 571 // HandleResult is called by CertVerifierWorker on the origin message loop. | |
| 572 // It deletes CertVerifierJob. | |
| 573 void MultiThreadedCertVerifier::HandleResult( | |
| 574 X509Certificate* cert, | |
| 575 const std::string& hostname, | |
| 576 int flags, | |
| 577 const CertificateList& additional_trust_anchors, | |
| 578 int error, | |
| 579 const CertVerifyResult& verify_result) { | |
| 580 DCHECK(CalledOnValidThread()); | |
| 581 | |
| 582 const RequestParams key(cert->fingerprint(), cert->ca_fingerprint(), | |
| 583 hostname, flags, additional_trust_anchors); | |
| 584 | |
| 585 CachedResult cached_result; | |
| 586 cached_result.error = error; | |
| 587 cached_result.result = verify_result; | |
| 588 base::Time now = base::Time::Now(); | |
| 589 cache_.Put( | |
| 590 key, cached_result, CacheValidityPeriod(now), | |
| 591 CacheValidityPeriod(now, now + base::TimeDelta::FromSeconds(kTTLSecs))); | |
| 592 | |
| 593 std::map<RequestParams, CertVerifierJob*>::iterator j; | |
| 594 j = inflight_.find(key); | |
| 595 if (j == inflight_.end()) { | |
| 596 NOTREACHED(); | |
| 597 return; | |
| 598 } | |
| 599 CertVerifierJob* job = j->second; | |
| 600 inflight_.erase(j); | |
| 601 bool is_first_job = false; | |
| 602 if (first_job_ == job) { | |
| 603 is_first_job = true; | |
| 604 first_job_ = NULL; | |
| 605 } | |
| 606 | |
| 607 job->HandleResult(cached_result, is_first_job); | |
| 608 delete job; | |
| 609 } | |
| 610 | |
| 611 void MultiThreadedCertVerifier::OnCACertChanged( | |
| 612 const X509Certificate* cert) { | |
| 613 DCHECK(CalledOnValidThread()); | |
| 614 | |
| 615 ClearCache(); | |
| 616 } | |
| 617 | |
| 618 } // namespace net | |
| 619 | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master