1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set sw=2 ts=8 et tw=80 : */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "VerifySSLServerCertChild.h"
#include "CertVerifier.h"
#include "mozilla/ipc/BackgroundChild.h"
#include "mozilla/ipc/PBackgroundChild.h"
#include "nsNSSIOLayer.h"
#include "nsSerializationHelper.h"
#include "secerr.h"
extern mozilla::LazyLogModule gPIPNSSLog;
namespace mozilla {
namespace psm {
VerifySSLServerCertChild::VerifySSLServerCertChild(
SSLServerCertVerificationResult* aResultTask,
nsTArray<nsTArray<uint8_t>>&& aPeerCertChain, uint32_t aProviderFlags)
: mResultTask(aResultTask),
mPeerCertChain(std::move(aPeerCertChain)),
mProviderFlags(aProviderFlags) {}
ipc::IPCResult VerifySSLServerCertChild::RecvOnVerifiedSSLServerCertSuccess(
nsTArray<ByteArray>&& aBuiltCertChain,
const uint16_t& aCertTransparencyStatus, const uint8_t& aEVStatus,
const bool& aIsBuiltCertChainRootBuiltInRoot,
const bool& aMadeOCSPRequests) {
MOZ_LOG(gPIPNSSLog, LogLevel::Debug,
("[%p] VerifySSLServerCertChild::RecvOnVerifiedSSLServerCertSuccess",
this));
nsTArray<nsTArray<uint8_t>> certBytesArray;
for (auto& cert : aBuiltCertChain) {
certBytesArray.AppendElement(std::move(cert.data()));
}
mResultTask->Dispatch(
std::move(certBytesArray), std::move(mPeerCertChain),
aCertTransparencyStatus, static_cast<EVStatus>(aEVStatus), true, 0,
nsITransportSecurityInfo::OverridableErrorCategory::ERROR_UNSET,
aIsBuiltCertChainRootBuiltInRoot, mProviderFlags, aMadeOCSPRequests);
return IPC_OK();
}
ipc::IPCResult VerifySSLServerCertChild::RecvOnVerifiedSSLServerCertFailure(
const int32_t& aFinalError, const uint32_t& aOverridableErrorCategory,
const bool& aMadeOCSPRequests) {
mResultTask->Dispatch(
nsTArray<nsTArray<uint8_t>>(), std::move(mPeerCertChain),
nsITransportSecurityInfo::CERTIFICATE_TRANSPARENCY_NOT_APPLICABLE,
EVStatus::NotEV, false, aFinalError,
static_cast<nsITransportSecurityInfo::OverridableErrorCategory>(
aOverridableErrorCategory),
false, mProviderFlags, aMadeOCSPRequests);
return IPC_OK();
}
SECStatus RemoteProcessCertVerification(
nsTArray<nsTArray<uint8_t>>&& aPeerCertChain, const nsACString& aHostName,
int32_t aPort, const OriginAttributes& aOriginAttributes,
Maybe<nsTArray<uint8_t>>& aStapledOCSPResponse,
Maybe<nsTArray<uint8_t>>& aSctsFromTLSExtension,
Maybe<DelegatedCredentialInfo>& aDcInfo, uint32_t aProviderFlags,
uint32_t aCertVerifierFlags, SSLServerCertVerificationResult* aResultTask) {
if (!aResultTask) {
PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
return SECFailure;
}
nsTArray<ByteArray> peerCertBytes;
for (auto& certBytes : aPeerCertChain) {
peerCertBytes.AppendElement(ByteArray(certBytes));
}
Maybe<ByteArray> stapledOCSPResponse;
if (aStapledOCSPResponse) {
stapledOCSPResponse.emplace();
stapledOCSPResponse->data().Assign(*aStapledOCSPResponse);
}
Maybe<ByteArray> sctsFromTLSExtension;
if (aSctsFromTLSExtension) {
sctsFromTLSExtension.emplace();
sctsFromTLSExtension->data().Assign(*aSctsFromTLSExtension);
}
Maybe<DelegatedCredentialInfoArg> dcInfo;
if (aDcInfo) {
dcInfo.emplace();
dcInfo.ref().scheme() = static_cast<uint32_t>(aDcInfo->scheme);
dcInfo.ref().authKeyBits() = static_cast<uint32_t>(aDcInfo->authKeyBits);
}
mozilla::ipc::PBackgroundChild* actorChild = mozilla::ipc::BackgroundChild::
GetOrCreateForSocketParentBridgeForCurrentThread();
if (!actorChild) {
PR_SetError(SEC_ERROR_LIBRARY_FAILURE, 0);
return SECFailure;
}
RefPtr<VerifySSLServerCertChild> authCert = new VerifySSLServerCertChild(
aResultTask, std::move(aPeerCertChain), aProviderFlags);
if (!actorChild->SendPVerifySSLServerCertConstructor(
authCert, peerCertBytes, PromiseFlatCString(aHostName), aPort,
aOriginAttributes, stapledOCSPResponse, sctsFromTLSExtension, dcInfo,
aProviderFlags, aCertVerifierFlags)) {
PR_SetError(SEC_ERROR_LIBRARY_FAILURE, 0);
return SECFailure;
}
PR_SetError(PR_WOULD_BLOCK_ERROR, 0);
return SECWouldBlock;
}
} // namespace psm
} // namespace mozilla
|
