OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
8 | 8 |
9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
(...skipping 1153 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1164 FROM_HERE, | 1164 FROM_HERE, |
1165 base::Bind(IgnoreResult(&Core::Connect), this, callback)); | 1165 base::Bind(IgnoreResult(&Core::Connect), this, callback)); |
1166 return posted ? ERR_IO_PENDING : ERR_ABORTED; | 1166 return posted ? ERR_IO_PENDING : ERR_ABORTED; |
1167 } | 1167 } |
1168 | 1168 |
1169 DCHECK(OnNSSTaskRunner()); | 1169 DCHECK(OnNSSTaskRunner()); |
1170 DCHECK_EQ(STATE_NONE, next_handshake_state_); | 1170 DCHECK_EQ(STATE_NONE, next_handshake_state_); |
1171 DCHECK(user_read_callback_.is_null()); | 1171 DCHECK(user_read_callback_.is_null()); |
1172 DCHECK(user_write_callback_.is_null()); | 1172 DCHECK(user_write_callback_.is_null()); |
1173 DCHECK(user_connect_callback_.is_null()); | 1173 DCHECK(user_connect_callback_.is_null()); |
1174 DCHECK(!user_read_buf_); | 1174 DCHECK(!user_read_buf_.get()); |
1175 DCHECK(!user_write_buf_); | 1175 DCHECK(!user_write_buf_.get()); |
1176 | 1176 |
1177 next_handshake_state_ = STATE_HANDSHAKE; | 1177 next_handshake_state_ = STATE_HANDSHAKE; |
1178 int rv = DoHandshakeLoop(OK); | 1178 int rv = DoHandshakeLoop(OK); |
1179 if (rv == ERR_IO_PENDING) { | 1179 if (rv == ERR_IO_PENDING) { |
1180 user_connect_callback_ = callback; | 1180 user_connect_callback_ = callback; |
1181 } else if (rv > OK) { | 1181 } else if (rv > OK) { |
1182 rv = OK; | 1182 rv = OK; |
1183 } | 1183 } |
1184 if (rv != ERR_IO_PENDING && !OnNetworkTaskRunner()) { | 1184 if (rv != ERR_IO_PENDING && !OnNetworkTaskRunner()) { |
1185 PostOrRunCallback(FROM_HERE, base::Bind(callback, rv)); | 1185 PostOrRunCallback(FROM_HERE, base::Bind(callback, rv)); |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1217 base::Bind(IgnoreResult(&Core::Read), this, make_scoped_refptr(buf), | 1217 base::Bind(IgnoreResult(&Core::Read), this, make_scoped_refptr(buf), |
1218 buf_len, callback)); | 1218 buf_len, callback)); |
1219 return posted ? ERR_IO_PENDING : ERR_ABORTED; | 1219 return posted ? ERR_IO_PENDING : ERR_ABORTED; |
1220 } | 1220 } |
1221 | 1221 |
1222 DCHECK(OnNSSTaskRunner()); | 1222 DCHECK(OnNSSTaskRunner()); |
1223 DCHECK(handshake_callback_called_); | 1223 DCHECK(handshake_callback_called_); |
1224 DCHECK_EQ(STATE_NONE, next_handshake_state_); | 1224 DCHECK_EQ(STATE_NONE, next_handshake_state_); |
1225 DCHECK(user_read_callback_.is_null()); | 1225 DCHECK(user_read_callback_.is_null()); |
1226 DCHECK(user_connect_callback_.is_null()); | 1226 DCHECK(user_connect_callback_.is_null()); |
1227 DCHECK(!user_read_buf_); | 1227 DCHECK(!user_read_buf_.get()); |
1228 DCHECK(nss_bufs_); | 1228 DCHECK(nss_bufs_); |
1229 | 1229 |
1230 user_read_buf_ = buf; | 1230 user_read_buf_ = buf; |
1231 user_read_buf_len_ = buf_len; | 1231 user_read_buf_len_ = buf_len; |
1232 | 1232 |
1233 int rv = DoReadLoop(OK); | 1233 int rv = DoReadLoop(OK); |
1234 if (rv == ERR_IO_PENDING) { | 1234 if (rv == ERR_IO_PENDING) { |
1235 user_read_callback_ = callback; | 1235 user_read_callback_ = callback; |
1236 } else { | 1236 } else { |
1237 user_read_buf_ = NULL; | 1237 user_read_buf_ = NULL; |
(...skipping 21 matching lines...) Expand all Loading... |
1259 buf_len, callback)); | 1259 buf_len, callback)); |
1260 int rv = posted ? ERR_IO_PENDING : ERR_ABORTED; | 1260 int rv = posted ? ERR_IO_PENDING : ERR_ABORTED; |
1261 return rv; | 1261 return rv; |
1262 } | 1262 } |
1263 | 1263 |
1264 DCHECK(OnNSSTaskRunner()); | 1264 DCHECK(OnNSSTaskRunner()); |
1265 DCHECK(handshake_callback_called_); | 1265 DCHECK(handshake_callback_called_); |
1266 DCHECK_EQ(STATE_NONE, next_handshake_state_); | 1266 DCHECK_EQ(STATE_NONE, next_handshake_state_); |
1267 DCHECK(user_write_callback_.is_null()); | 1267 DCHECK(user_write_callback_.is_null()); |
1268 DCHECK(user_connect_callback_.is_null()); | 1268 DCHECK(user_connect_callback_.is_null()); |
1269 DCHECK(!user_write_buf_); | 1269 DCHECK(!user_write_buf_.get()); |
1270 DCHECK(nss_bufs_); | 1270 DCHECK(nss_bufs_); |
1271 | 1271 |
1272 user_write_buf_ = buf; | 1272 user_write_buf_ = buf; |
1273 user_write_buf_len_ = buf_len; | 1273 user_write_buf_len_ = buf_len; |
1274 | 1274 |
1275 int rv = DoWriteLoop(OK); | 1275 int rv = DoWriteLoop(OK); |
1276 if (rv == ERR_IO_PENDING) { | 1276 if (rv == ERR_IO_PENDING) { |
1277 user_write_callback_ = callback; | 1277 user_write_callback_ = callback; |
1278 } else { | 1278 } else { |
1279 user_write_buf_ = NULL; | 1279 user_write_buf_ = NULL; |
(...skipping 391 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1671 FROM_HERE, | 1671 FROM_HERE, |
1672 base::Bind(&AddLogEvent, core->weak_net_log_, | 1672 base::Bind(&AddLogEvent, core->weak_net_log_, |
1673 NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED)); | 1673 NetLog::TYPE_SSL_CLIENT_CERT_REQUESTED)); |
1674 | 1674 |
1675 // Regular client certificate requested. | 1675 // Regular client certificate requested. |
1676 core->client_auth_cert_needed_ = !core->ssl_config_.send_client_cert; | 1676 core->client_auth_cert_needed_ = !core->ssl_config_.send_client_cert; |
1677 void* wincx = SSL_RevealPinArg(socket); | 1677 void* wincx = SSL_RevealPinArg(socket); |
1678 | 1678 |
1679 // Second pass: a client certificate should have been selected. | 1679 // Second pass: a client certificate should have been selected. |
1680 if (core->ssl_config_.send_client_cert) { | 1680 if (core->ssl_config_.send_client_cert) { |
1681 if (core->ssl_config_.client_cert) { | 1681 if (core->ssl_config_.client_cert.get()) { |
1682 CERTCertificate* cert = CERT_DupCertificate( | 1682 CERTCertificate* cert = CERT_DupCertificate( |
1683 core->ssl_config_.client_cert->os_cert_handle()); | 1683 core->ssl_config_.client_cert->os_cert_handle()); |
1684 SECKEYPrivateKey* privkey = PK11_FindKeyByAnyCert(cert, wincx); | 1684 SECKEYPrivateKey* privkey = PK11_FindKeyByAnyCert(cert, wincx); |
1685 if (privkey) { | 1685 if (privkey) { |
1686 // TODO(jsorianopastor): We should wait for server certificate | 1686 // TODO(jsorianopastor): We should wait for server certificate |
1687 // verification before sending our credentials. See | 1687 // verification before sending our credentials. See |
1688 // http://crbug.com/13934. | 1688 // http://crbug.com/13934. |
1689 *result_certificate = cert; | 1689 *result_certificate = cert; |
1690 *result_private_key = privkey; | 1690 *result_private_key = privkey; |
1691 // A cert_count of -1 means the number of certificates is unknown. | 1691 // A cert_count of -1 means the number of certificates is unknown. |
(...skipping 504 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2196 | 2196 |
2197 char* buf; | 2197 char* buf; |
2198 int nb = memio_GetReadParams(nss_bufs_, &buf); | 2198 int nb = memio_GetReadParams(nss_bufs_, &buf); |
2199 int rv; | 2199 int rv; |
2200 if (!nb) { | 2200 if (!nb) { |
2201 // buffer too full to read into, so no I/O possible at moment | 2201 // buffer too full to read into, so no I/O possible at moment |
2202 rv = ERR_IO_PENDING; | 2202 rv = ERR_IO_PENDING; |
2203 } else { | 2203 } else { |
2204 scoped_refptr<IOBuffer> read_buffer(new IOBuffer(nb)); | 2204 scoped_refptr<IOBuffer> read_buffer(new IOBuffer(nb)); |
2205 if (OnNetworkTaskRunner()) { | 2205 if (OnNetworkTaskRunner()) { |
2206 rv = DoBufferRecv(read_buffer, nb); | 2206 rv = DoBufferRecv(read_buffer.get(), nb); |
2207 } else { | 2207 } else { |
2208 bool posted = network_task_runner_->PostTask( | 2208 bool posted = network_task_runner_->PostTask( |
2209 FROM_HERE, | 2209 FROM_HERE, |
2210 base::Bind(IgnoreResult(&Core::DoBufferRecv), this, read_buffer, | 2210 base::Bind(IgnoreResult(&Core::DoBufferRecv), this, read_buffer, |
2211 nb)); | 2211 nb)); |
2212 rv = posted ? ERR_IO_PENDING : ERR_ABORTED; | 2212 rv = posted ? ERR_IO_PENDING : ERR_ABORTED; |
2213 } | 2213 } |
2214 | 2214 |
2215 if (rv == ERR_IO_PENDING) { | 2215 if (rv == ERR_IO_PENDING) { |
2216 transport_recv_busy_ = true; | 2216 transport_recv_busy_ = true; |
(...skipping 24 matching lines...) Expand all Loading... |
2241 memio_GetWriteParams(nss_bufs_, &buf1, &len1, &buf2, &len2); | 2241 memio_GetWriteParams(nss_bufs_, &buf1, &len1, &buf2, &len2); |
2242 const unsigned int len = len1 + len2; | 2242 const unsigned int len = len1 + len2; |
2243 | 2243 |
2244 int rv = 0; | 2244 int rv = 0; |
2245 if (len) { | 2245 if (len) { |
2246 scoped_refptr<IOBuffer> send_buffer(new IOBuffer(len)); | 2246 scoped_refptr<IOBuffer> send_buffer(new IOBuffer(len)); |
2247 memcpy(send_buffer->data(), buf1, len1); | 2247 memcpy(send_buffer->data(), buf1, len1); |
2248 memcpy(send_buffer->data() + len1, buf2, len2); | 2248 memcpy(send_buffer->data() + len1, buf2, len2); |
2249 | 2249 |
2250 if (OnNetworkTaskRunner()) { | 2250 if (OnNetworkTaskRunner()) { |
2251 rv = DoBufferSend(send_buffer, len); | 2251 rv = DoBufferSend(send_buffer.get(), len); |
2252 } else { | 2252 } else { |
2253 bool posted = network_task_runner_->PostTask( | 2253 bool posted = network_task_runner_->PostTask( |
2254 FROM_HERE, | 2254 FROM_HERE, |
2255 base::Bind(IgnoreResult(&Core::DoBufferSend), this, send_buffer, | 2255 base::Bind(IgnoreResult(&Core::DoBufferSend), this, send_buffer, |
2256 len)); | 2256 len)); |
2257 rv = posted ? ERR_IO_PENDING : ERR_ABORTED; | 2257 rv = posted ? ERR_IO_PENDING : ERR_ABORTED; |
2258 } | 2258 } |
2259 | 2259 |
2260 if (rv == ERR_IO_PENDING) { | 2260 if (rv == ERR_IO_PENDING) { |
2261 transport_send_busy_ = true; | 2261 transport_send_busy_ = true; |
2262 } else { | 2262 } else { |
2263 memio_PutWriteResult(nss_bufs_, MapErrorToNSS(rv)); | 2263 memio_PutWriteResult(nss_bufs_, MapErrorToNSS(rv)); |
2264 } | 2264 } |
2265 } | 2265 } |
2266 | 2266 |
2267 return rv; | 2267 return rv; |
2268 } | 2268 } |
2269 | 2269 |
2270 void SSLClientSocketNSS::Core::OnRecvComplete(int result) { | 2270 void SSLClientSocketNSS::Core::OnRecvComplete(int result) { |
2271 DCHECK(OnNSSTaskRunner()); | 2271 DCHECK(OnNSSTaskRunner()); |
2272 | 2272 |
2273 if (next_handshake_state_ == STATE_HANDSHAKE) { | 2273 if (next_handshake_state_ == STATE_HANDSHAKE) { |
2274 OnHandshakeIOComplete(result); | 2274 OnHandshakeIOComplete(result); |
2275 return; | 2275 return; |
2276 } | 2276 } |
2277 | 2277 |
2278 // Network layer received some data, check if client requested to read | 2278 // Network layer received some data, check if client requested to read |
2279 // decrypted data. | 2279 // decrypted data. |
2280 if (!user_read_buf_) | 2280 if (!user_read_buf_.get()) |
2281 return; | 2281 return; |
2282 | 2282 |
2283 int rv = DoReadLoop(result); | 2283 int rv = DoReadLoop(result); |
2284 if (rv != ERR_IO_PENDING) | 2284 if (rv != ERR_IO_PENDING) |
2285 DoReadCallback(rv); | 2285 DoReadCallback(rv); |
2286 } | 2286 } |
2287 | 2287 |
2288 void SSLClientSocketNSS::Core::OnSendComplete(int result) { | 2288 void SSLClientSocketNSS::Core::OnSendComplete(int result) { |
2289 DCHECK(OnNSSTaskRunner()); | 2289 DCHECK(OnNSSTaskRunner()); |
2290 | 2290 |
2291 if (next_handshake_state_ == STATE_HANDSHAKE) { | 2291 if (next_handshake_state_ == STATE_HANDSHAKE) { |
2292 OnHandshakeIOComplete(result); | 2292 OnHandshakeIOComplete(result); |
2293 return; | 2293 return; |
2294 } | 2294 } |
2295 | 2295 |
2296 // OnSendComplete may need to call DoPayloadRead while the renegotiation | 2296 // OnSendComplete may need to call DoPayloadRead while the renegotiation |
2297 // handshake is in progress. | 2297 // handshake is in progress. |
2298 int rv_read = ERR_IO_PENDING; | 2298 int rv_read = ERR_IO_PENDING; |
2299 int rv_write = ERR_IO_PENDING; | 2299 int rv_write = ERR_IO_PENDING; |
2300 bool network_moved; | 2300 bool network_moved; |
2301 do { | 2301 do { |
2302 if (user_read_buf_) | 2302 if (user_read_buf_.get()) |
2303 rv_read = DoPayloadRead(); | 2303 rv_read = DoPayloadRead(); |
2304 if (user_write_buf_) | 2304 if (user_write_buf_.get()) |
2305 rv_write = DoPayloadWrite(); | 2305 rv_write = DoPayloadWrite(); |
2306 network_moved = DoTransportIO(); | 2306 network_moved = DoTransportIO(); |
2307 } while (rv_read == ERR_IO_PENDING && | 2307 } while (rv_read == ERR_IO_PENDING && |
2308 rv_write == ERR_IO_PENDING && | 2308 rv_write == ERR_IO_PENDING && |
2309 (user_read_buf_ || user_write_buf_) && | 2309 (user_read_buf_.get() || user_write_buf_.get()) && |
2310 network_moved); | 2310 network_moved); |
2311 | 2311 |
2312 if (user_read_buf_ && rv_read != ERR_IO_PENDING) | 2312 if (user_read_buf_.get() && rv_read != ERR_IO_PENDING) |
2313 DoReadCallback(rv_read); | 2313 DoReadCallback(rv_read); |
2314 if (user_write_buf_ && rv_write != ERR_IO_PENDING) | 2314 if (user_write_buf_.get() && rv_write != ERR_IO_PENDING) |
2315 DoWriteCallback(rv_write); | 2315 DoWriteCallback(rv_write); |
2316 } | 2316 } |
2317 | 2317 |
2318 // As part of Connect(), the SSLClientSocketNSS object performs an SSL | 2318 // As part of Connect(), the SSLClientSocketNSS object performs an SSL |
2319 // handshake. This requires network IO, which in turn calls | 2319 // handshake. This requires network IO, which in turn calls |
2320 // BufferRecvComplete() with a non-zero byte count. This byte count eventually | 2320 // BufferRecvComplete() with a non-zero byte count. This byte count eventually |
2321 // winds its way through the state machine and ends up being passed to the | 2321 // winds its way through the state machine and ends up being passed to the |
2322 // callback. For Read() and Write(), that's what we want. But for Connect(), | 2322 // callback. For Read() and Write(), that's what we want. But for Connect(), |
2323 // the caller expects OK (i.e. 0) for success. | 2323 // the caller expects OK (i.e. 0) for success. |
2324 void SSLClientSocketNSS::Core::DoConnectCallback(int rv) { | 2324 void SSLClientSocketNSS::Core::DoConnectCallback(int rv) { |
2325 DCHECK(OnNSSTaskRunner()); | 2325 DCHECK(OnNSSTaskRunner()); |
(...skipping 127 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2453 return ERR_INVALID_ARGUMENT; | 2453 return ERR_INVALID_ARGUMENT; |
2454 } | 2454 } |
2455 | 2455 |
2456 return OK; | 2456 return OK; |
2457 } | 2457 } |
2458 | 2458 |
2459 void SSLClientSocketNSS::Core::UpdateServerCert() { | 2459 void SSLClientSocketNSS::Core::UpdateServerCert() { |
2460 nss_handshake_state_.server_cert_chain.Reset(nss_fd_); | 2460 nss_handshake_state_.server_cert_chain.Reset(nss_fd_); |
2461 nss_handshake_state_.server_cert = X509Certificate::CreateFromDERCertChain( | 2461 nss_handshake_state_.server_cert = X509Certificate::CreateFromDERCertChain( |
2462 nss_handshake_state_.server_cert_chain.AsStringPieceVector()); | 2462 nss_handshake_state_.server_cert_chain.AsStringPieceVector()); |
2463 if (nss_handshake_state_.server_cert) { | 2463 if (nss_handshake_state_.server_cert.get()) { |
2464 // Since this will be called asynchronously on another thread, it needs to | 2464 // Since this will be called asynchronously on another thread, it needs to |
2465 // own a reference to the certificate. | 2465 // own a reference to the certificate. |
2466 NetLog::ParametersCallback net_log_callback = | 2466 NetLog::ParametersCallback net_log_callback = |
2467 base::Bind(&NetLogX509CertificateCallback, | 2467 base::Bind(&NetLogX509CertificateCallback, |
2468 nss_handshake_state_.server_cert); | 2468 nss_handshake_state_.server_cert); |
2469 PostOrRunCallback( | 2469 PostOrRunCallback( |
2470 FROM_HERE, | 2470 FROM_HERE, |
2471 base::Bind(&AddLogEventWithCallback, weak_net_log_, | 2471 base::Bind(&AddLogEventWithCallback, weak_net_log_, |
2472 NetLog::TYPE_SSL_CERTIFICATES_RECEIVED, | 2472 NetLog::TYPE_SSL_CERTIFICATES_RECEIVED, |
2473 net_log_callback)); | 2473 net_log_callback)); |
(...skipping 334 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2808 ssl_info->connection_status = | 2808 ssl_info->connection_status = |
2809 core_->state().ssl_connection_status; | 2809 core_->state().ssl_connection_status; |
2810 ssl_info->public_key_hashes = server_cert_verify_result_.public_key_hashes; | 2810 ssl_info->public_key_hashes = server_cert_verify_result_.public_key_hashes; |
2811 for (HashValueVector::const_iterator i = side_pinned_public_keys_.begin(); | 2811 for (HashValueVector::const_iterator i = side_pinned_public_keys_.begin(); |
2812 i != side_pinned_public_keys_.end(); ++i) { | 2812 i != side_pinned_public_keys_.end(); ++i) { |
2813 ssl_info->public_key_hashes.push_back(*i); | 2813 ssl_info->public_key_hashes.push_back(*i); |
2814 } | 2814 } |
2815 ssl_info->is_issued_by_known_root = | 2815 ssl_info->is_issued_by_known_root = |
2816 server_cert_verify_result_.is_issued_by_known_root; | 2816 server_cert_verify_result_.is_issued_by_known_root; |
2817 ssl_info->client_cert_sent = | 2817 ssl_info->client_cert_sent = |
2818 ssl_config_.send_client_cert && ssl_config_.client_cert; | 2818 ssl_config_.send_client_cert && ssl_config_.client_cert.get(); |
2819 ssl_info->channel_id_sent = WasChannelIDSent(); | 2819 ssl_info->channel_id_sent = WasChannelIDSent(); |
2820 | 2820 |
2821 PRUint16 cipher_suite = SSLConnectionStatusToCipherSuite( | 2821 PRUint16 cipher_suite = SSLConnectionStatusToCipherSuite( |
2822 core_->state().ssl_connection_status); | 2822 core_->state().ssl_connection_status); |
2823 SSLCipherSuiteInfo cipher_info; | 2823 SSLCipherSuiteInfo cipher_info; |
2824 SECStatus ok = SSL_GetCipherSuiteInfo(cipher_suite, | 2824 SECStatus ok = SSL_GetCipherSuiteInfo(cipher_suite, |
2825 &cipher_info, sizeof(cipher_info)); | 2825 &cipher_info, sizeof(cipher_info)); |
2826 if (ok == SECSuccess) { | 2826 if (ok == SECSuccess) { |
2827 ssl_info->security_bits = cipher_info.effectiveKeyBits; | 2827 ssl_info->security_bits = cipher_info.effectiveKeyBits; |
2828 } else { | 2828 } else { |
(...skipping 259 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3088 // X509Certificate::Verify() runs on a worker thread of CertVerifier. | 3088 // X509Certificate::Verify() runs on a worker thread of CertVerifier. |
3089 EnsureNSSHttpIOInit(); | 3089 EnsureNSSHttpIOInit(); |
3090 } | 3090 } |
3091 #endif | 3091 #endif |
3092 | 3092 |
3093 LeaveFunction(""); | 3093 LeaveFunction(""); |
3094 return OK; | 3094 return OK; |
3095 } | 3095 } |
3096 | 3096 |
3097 void SSLClientSocketNSS::InitCore() { | 3097 void SSLClientSocketNSS::InitCore() { |
3098 core_ = new Core(base::ThreadTaskRunnerHandle::Get(), nss_task_runner_, | 3098 core_ = |
3099 transport_.get(), host_and_port_, ssl_config_, &net_log_, | 3099 new Core( |
3100 server_bound_cert_service_); | 3100 base::ThreadTaskRunnerHandle::Get().get(), nss_task_runner_.get(), |
| 3101 transport_.get(), host_and_port_, ssl_config_, &net_log_, |
| 3102 server_bound_cert_service_); |
3101 } | 3103 } |
3102 | 3104 |
3103 int SSLClientSocketNSS::InitializeSSLOptions() { | 3105 int SSLClientSocketNSS::InitializeSSLOptions() { |
3104 // Transport connected, now hook it up to nss | 3106 // Transport connected, now hook it up to nss |
3105 nss_fd_ = memio_CreateIOLayer(kRecvBufferSize, kSendBufferSize); | 3107 nss_fd_ = memio_CreateIOLayer(kRecvBufferSize, kSendBufferSize); |
3106 if (nss_fd_ == NULL) { | 3108 if (nss_fd_ == NULL) { |
3107 return ERR_OUT_OF_MEMORY; // TODO(port): map NSPR error code. | 3109 return ERR_OUT_OF_MEMORY; // TODO(port): map NSPR error code. |
3108 } | 3110 } |
3109 | 3111 |
3110 // Grab pointer to buffers | 3112 // Grab pointer to buffers |
(...skipping 284 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3395 DCHECK(start_cert_verification_time_.is_null()); | 3397 DCHECK(start_cert_verification_time_.is_null()); |
3396 VLOG(1) << "Received an expected bad cert with status: " << cert_status; | 3398 VLOG(1) << "Received an expected bad cert with status: " << cert_status; |
3397 server_cert_verify_result_.Reset(); | 3399 server_cert_verify_result_.Reset(); |
3398 server_cert_verify_result_.cert_status = cert_status; | 3400 server_cert_verify_result_.cert_status = cert_status; |
3399 server_cert_verify_result_.verified_cert = core_->state().server_cert; | 3401 server_cert_verify_result_.verified_cert = core_->state().server_cert; |
3400 return OK; | 3402 return OK; |
3401 } | 3403 } |
3402 | 3404 |
3403 // We may have failed to create X509Certificate object if we are | 3405 // We may have failed to create X509Certificate object if we are |
3404 // running inside sandbox. | 3406 // running inside sandbox. |
3405 if (!core_->state().server_cert) { | 3407 if (!core_->state().server_cert.get()) { |
3406 server_cert_verify_result_.Reset(); | 3408 server_cert_verify_result_.Reset(); |
3407 server_cert_verify_result_.cert_status = CERT_STATUS_INVALID; | 3409 server_cert_verify_result_.cert_status = CERT_STATUS_INVALID; |
3408 return ERR_CERT_INVALID; | 3410 return ERR_CERT_INVALID; |
3409 } | 3411 } |
3410 | 3412 |
3411 start_cert_verification_time_ = base::TimeTicks::Now(); | 3413 start_cert_verification_time_ = base::TimeTicks::Now(); |
3412 | 3414 |
3413 int flags = 0; | 3415 int flags = 0; |
3414 if (ssl_config_.rev_checking_enabled) | 3416 if (ssl_config_.rev_checking_enabled) |
3415 flags |= CertVerifier::VERIFY_REV_CHECKING_ENABLED; | 3417 flags |= CertVerifier::VERIFY_REV_CHECKING_ENABLED; |
3416 if (ssl_config_.verify_ev_cert) | 3418 if (ssl_config_.verify_ev_cert) |
3417 flags |= CertVerifier::VERIFY_EV_CERT; | 3419 flags |= CertVerifier::VERIFY_EV_CERT; |
3418 if (ssl_config_.cert_io_enabled) | 3420 if (ssl_config_.cert_io_enabled) |
3419 flags |= CertVerifier::VERIFY_CERT_IO_ENABLED; | 3421 flags |= CertVerifier::VERIFY_CERT_IO_ENABLED; |
3420 verifier_.reset(new SingleRequestCertVerifier(cert_verifier_)); | 3422 verifier_.reset(new SingleRequestCertVerifier(cert_verifier_)); |
3421 return verifier_->Verify( | 3423 return verifier_->Verify( |
3422 core_->state().server_cert, host_and_port_.host(), flags, | 3424 core_->state().server_cert.get(), host_and_port_.host(), flags, |
3423 SSLConfigService::GetCRLSet(), &server_cert_verify_result_, | 3425 SSLConfigService::GetCRLSet().get(), &server_cert_verify_result_, |
3424 base::Bind(&SSLClientSocketNSS::OnHandshakeIOComplete, | 3426 base::Bind(&SSLClientSocketNSS::OnHandshakeIOComplete, |
3425 base::Unretained(this)), | 3427 base::Unretained(this)), |
3426 net_log_); | 3428 net_log_); |
3427 } | 3429 } |
3428 | 3430 |
3429 // Derived from AuthCertificateCallback() in | 3431 // Derived from AuthCertificateCallback() in |
3430 // mozilla/source/security/manager/ssl/src/nsNSSCallbacks.cpp. | 3432 // mozilla/source/security/manager/ssl/src/nsNSSCallbacks.cpp. |
3431 int SSLClientSocketNSS::DoVerifyCertComplete(int result) { | 3433 int SSLClientSocketNSS::DoVerifyCertComplete(int result) { |
3432 verifier_.reset(); | 3434 verifier_.reset(); |
3433 | 3435 |
(...skipping 117 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3551 EnsureThreadIdAssigned(); | 3553 EnsureThreadIdAssigned(); |
3552 base::AutoLock auto_lock(lock_); | 3554 base::AutoLock auto_lock(lock_); |
3553 return valid_thread_id_ == base::PlatformThread::CurrentId(); | 3555 return valid_thread_id_ == base::PlatformThread::CurrentId(); |
3554 } | 3556 } |
3555 | 3557 |
3556 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const { | 3558 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const { |
3557 return server_bound_cert_service_; | 3559 return server_bound_cert_service_; |
3558 } | 3560 } |
3559 | 3561 |
3560 } // namespace net | 3562 } // namespace net |
OLD | NEW |