ssl_config_service_mojo.cc 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "services/network/ssl_config_service_mojo.h"
  5. #include "base/strings/string_piece.h"
  6. #include "base/strings/string_util.h"
  7. #include "mojo/public/cpp/bindings/type_converter.h"
  8. #include "services/network/ssl_config_type_converter.h"
  9. namespace network {
  10. namespace {
  11. // Returns true if |hostname| is a subdomain of |pattern| (including if they are
  12. // equal).
  13. bool IsSubdomain(const base::StringPiece hostname,
  14. const base::StringPiece pattern) {
  15. if (hostname == pattern) {
  16. return true;
  17. }
  18. if (hostname.length() <= (pattern.length() + 1)) {
  19. return false;
  20. }
  21. if (!base::EndsWith(hostname, pattern)) {
  22. return false;
  23. }
  24. return hostname[hostname.length() - pattern.length() - 1] == '.';
  25. }
  26. } // namespace
  27. SSLConfigServiceMojo::SSLConfigServiceMojo(
  28. mojom::SSLConfigPtr initial_config,
  29. mojo::PendingReceiver<mojom::SSLConfigClient> ssl_config_client_receiver,
  30. CRLSetDistributor* crl_set_distributor)
  31. : crl_set_distributor_(crl_set_distributor),
  32. client_cert_pooling_policy_(
  33. initial_config ? initial_config->client_cert_pooling_policy
  34. : std::vector<std::string>()) {
  35. if (initial_config) {
  36. cert_verifier_config_ = MojoSSLConfigToCertVerifierConfig(initial_config);
  37. ssl_context_config_ = MojoSSLConfigToSSLContextConfig(initial_config);
  38. }
  39. if (ssl_config_client_receiver)
  40. receiver_.Bind(std::move(ssl_config_client_receiver));
  41. crl_set_distributor_->AddObserver(this);
  42. cert_verifier_config_.crl_set = crl_set_distributor_->crl_set();
  43. }
  44. SSLConfigServiceMojo::~SSLConfigServiceMojo() {
  45. crl_set_distributor_->RemoveObserver(this);
  46. }
  47. void SSLConfigServiceMojo::SetCertVerifierForConfiguring(
  48. net::CertVerifier* cert_verifier) {
  49. cert_verifier_ = cert_verifier;
  50. if (cert_verifier_) {
  51. cert_verifier_->SetConfig(cert_verifier_config_);
  52. }
  53. }
  54. void SSLConfigServiceMojo::OnSSLConfigUpdated(mojom::SSLConfigPtr ssl_config) {
  55. bool force_notification =
  56. client_cert_pooling_policy_ != ssl_config->client_cert_pooling_policy;
  57. client_cert_pooling_policy_ = ssl_config->client_cert_pooling_policy;
  58. net::SSLContextConfig old_config = ssl_context_config_;
  59. ssl_context_config_ = MojoSSLConfigToSSLContextConfig(ssl_config);
  60. ProcessConfigUpdate(old_config, ssl_context_config_, force_notification);
  61. net::CertVerifier::Config old_cert_verifier_config = cert_verifier_config_;
  62. cert_verifier_config_ = MojoSSLConfigToCertVerifierConfig(ssl_config);
  63. cert_verifier_config_.crl_set = old_cert_verifier_config.crl_set;
  64. if (cert_verifier_ && (old_cert_verifier_config != cert_verifier_config_)) {
  65. cert_verifier_->SetConfig(cert_verifier_config_);
  66. }
  67. }
  68. net::SSLContextConfig SSLConfigServiceMojo::GetSSLContextConfig() {
  69. return ssl_context_config_;
  70. }
  71. bool SSLConfigServiceMojo::CanShareConnectionWithClientCerts(
  72. const std::string& hostname) const {
  73. // Hostnames (and the patterns configured for this class) must be
  74. // canonicalized before comparison, or the comparison will fail.
  75. for (const std::string& pattern : client_cert_pooling_policy_) {
  76. if (pattern.empty()) {
  77. continue;
  78. }
  79. // If the pattern starts with a '.', |hostname| must match it exactly
  80. // (except for the leading dot) for the pattern to be a match.
  81. if (pattern[0] == '.') {
  82. if (pattern.compare(1, std::string::npos, hostname) == 0) {
  83. return true;
  84. } else {
  85. continue;
  86. }
  87. }
  88. // Patterns that don't start with a dot match subdomains as well as an exact
  89. // pattern match. For example, a pattern of "example.com" should match a
  90. // hostname of "example.com", "sub.example.com", but not "notexample.com".
  91. if (IsSubdomain(hostname, pattern)) {
  92. return true;
  93. }
  94. }
  95. return false;
  96. }
  97. void SSLConfigServiceMojo::OnNewCRLSet(scoped_refptr<net::CRLSet> crl_set) {
  98. cert_verifier_config_.crl_set = crl_set;
  99. if (cert_verifier_)
  100. cert_verifier_->SetConfig(cert_verifier_config_);
  101. }
  102. } // namespace network