Remove StartSSLWithServer from SSLStreamAdapter.

webrtc/base/opensslstreamadapter.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 266 matching lines @@
 /////////////////////////////////////////////////////////////////////////////
 
 OpenSSLStreamAdapter::OpenSSLStreamAdapter(StreamInterface* stream)
     : SSLStreamAdapter(stream),
       state_(SSL_NONE),
       role_(SSL_CLIENT),
       ssl_read_needs_write_(false),
       ssl_write_needs_read_(false),
       ssl_(NULL),
       ssl_ctx_(NULL),
-      custom_verification_succeeded_(false),
       ssl_mode_(SSL_MODE_TLS),
       ssl_max_version_(SSL_PROTOCOL_TLS_12) {}
 
 OpenSSLStreamAdapter::~OpenSSLStreamAdapter() {
   Cleanup();
 }
 
 void OpenSSLStreamAdapter::SetIdentity(SSLIdentity* identity) {
   ASSERT(!identity_);
   identity_.reset(static_cast<OpenSSLIdentity*>(identity));
@@ skipping 10 matching lines @@
                            : nullptr;
 }
 
 bool OpenSSLStreamAdapter::SetPeerCertificateDigest(const std::string
                                                     &digest_alg,
                                                     const unsigned char*
                                                     digest_val,
                                                     size_t digest_len) {
   ASSERT(!peer_certificate_);
   ASSERT(peer_certificate_digest_algorithm_.size() == 0);
-  ASSERT(ssl_server_name_.empty());
   size_t expected_len;
 
   if (!OpenSSLDigest::GetDigestSize(digest_alg, &expected_len)) {
     LOG(LS_WARNING) << "Unknown digest algorithm: " << digest_alg;
     return false;
   }
   if (expected_len != digest_len)
     return false;
 
   peer_certificate_digest_value_.SetData(digest_val, digest_len);
@@ skipping 132 matching lines @@
     return false;
 
   *crypto_suite = srtp_profile->id;
   ASSERT(!SrtpCryptoSuiteToName(*crypto_suite).empty());
   return true;
 #else
   return false;
 #endif
 }
 
-int OpenSSLStreamAdapter::StartSSLWithServer(const char* server_name) {
-  ASSERT(server_name != NULL && server_name[0] != '\0');
-  ssl_server_name_ = server_name;
-  return StartSSL();
-}
+int OpenSSLStreamAdapter::StartSSL() {
+  ASSERT(state_ == SSL_NONE);
 
-int OpenSSLStreamAdapter::StartSSLWithPeer() {
-  ASSERT(ssl_server_name_.empty());
-  // It is permitted to specify peer_certificate_ only later.
-  return StartSSL();
+  if (StreamAdapterInterface::GetState() != SS_OPEN) {
+    state_ = SSL_WAIT;
+    return 0;
+  }
+
+  state_ = SSL_CONNECTING;
+  if (int err = BeginSSL()) {
+    Error("BeginSSL", err, false);
+    return err;
+  }
+
+  return 0;
 }
 
 void OpenSSLStreamAdapter::SetMode(SSLMode mode) {
   ASSERT(state_ == SSL_NONE);
   ssl_mode_ = mode;
 }
 
 void OpenSSLStreamAdapter::SetMaxProtocolVersion(SSLProtocolVersion version) {
   ASSERT(ssl_ctx_ == NULL);
   ssl_max_version_ = version;
@@ skipping 232 matching lines @@
     Cleanup();
     events_to_signal |= SE_CLOSE;
     // SE_CLOSE is the only event that uses the final parameter to OnEvent().
     ASSERT(signal_error == 0);
     signal_error = err;
   }
   if (events_to_signal)
     StreamAdapterInterface::OnEvent(stream, events_to_signal, signal_error);
 }
 
-int OpenSSLStreamAdapter::StartSSL() {
-  ASSERT(state_ == SSL_NONE);
-
-  if (StreamAdapterInterface::GetState() != SS_OPEN) {
-    state_ = SSL_WAIT;
-    return 0;
-  }
-
-  state_ = SSL_CONNECTING;
-  if (int err = BeginSSL()) {
-    Error("BeginSSL", err, false);
-    return err;
-  }
-
-  return 0;
-}
-
 int OpenSSLStreamAdapter::BeginSSL() {
   ASSERT(state_ == SSL_CONNECTING);
-  // The underlying stream has open. If we are in peer-to-peer mode
-  // then a peer certificate must have been specified by now.
-  ASSERT(!ssl_server_name_.empty() ||
-         !peer_certificate_digest_algorithm_.empty());
-  LOG(LS_INFO) << "BeginSSL: "
-               << (!ssl_server_name_.empty() ? ssl_server_name_ :
-                                               "with peer");
+  // The underlying stream has opened.
+  // A peer certificate digest must have been specified by now.
+  ASSERT(!peer_certificate_digest_algorithm_.empty());
+  LOG(LS_INFO) << "BeginSSL with peer.";
 
   BIO* bio = NULL;
 
-  // First set up the context
+  // First set up the context.
   ASSERT(ssl_ctx_ == NULL);
   ssl_ctx_ = SetupSSLContext();
   if (!ssl_ctx_)
     return -1;
 
   bio = BIO_new_stream(static_cast<StreamInterface*>(stream()));
   if (!bio)
     return -1;
 
   ssl_ = SSL_new(ssl_ctx_);
@@ skipping 45 matching lines @@
 
   // Clear the DTLS timer
   Thread::Current()->Clear(this, MSG_TIMEOUT);
 
   int code = (role_ == SSL_CLIENT) ? SSL_connect(ssl_) : SSL_accept(ssl_);
   int ssl_error;
   switch (ssl_error = SSL_get_error(ssl_, code)) {
     case SSL_ERROR_NONE:
       LOG(LS_VERBOSE) << " -- success";
 
-      if (!SSLPostConnectionCheck(ssl_, ssl_server_name_.c_str(), NULL,
+      if (!SSLPostConnectionCheck(ssl_, NULL,
                                   peer_certificate_digest_algorithm_)) {
         LOG(LS_ERROR) << "TLS post connection check failed";
         return -1;
       }
 
       state_ = SSL_CONNECTED;
       StreamAdapterInterface::OnEvent(stream(), SE_OPEN|SE_READ|SE_WRITE, 0);
       break;
 
     case SSL_ERROR_WANT_READ: {
@@ skipping 246 matching lines @@
   // Ignore any verification error if the digest matches, since there is no
   // value in checking the validity of a self-signed cert issued by untrusted
   // sources.
   LOG(LS_INFO) << "Accepted peer certificate.";
 
   // Record the peer's certificate.
   stream->peer_certificate_.reset(new OpenSSLCertificate(cert));
   return 1;
 }
 
-// This code is taken from the "Network Security with OpenSSL"
-// sample in chapter 5
 bool OpenSSLStreamAdapter::SSLPostConnectionCheck(SSL* ssl,
-                                                  const char* server_name,
                                                   const X509* peer_cert,
                                                   const std::string
                                                   &peer_digest) {
-  ASSERT(server_name != NULL);
-  bool ok;
-  if (server_name[0] != '\0') {  // traditional mode
-    ok = OpenSSLAdapter::VerifyServerName(ssl, server_name, ignore_bad_cert());
-
-    if (ok) {
-      ok = (SSL_get_verify_result(ssl) == X509_V_OK ||
-            custom_verification_succeeded_);
-    }
-  } else {  // peer-to-peer mode
-    ASSERT((peer_cert != NULL) || (!peer_digest.empty()));
-    // no server name validation
-    ok = true;
-  }
-
-  if (!ok && ignore_bad_cert()) {
-    LOG(LS_ERROR) << "SSL_get_verify_result(ssl) = "
-                  << SSL_get_verify_result(ssl);
-    LOG(LS_INFO) << "Other TLS post connection checks failed.";
-    ok = true;
-  }
-
-  return ok;
+  ASSERT((peer_cert != NULL) || (!peer_digest.empty()));
+  return true;
 }
 
 bool OpenSSLStreamAdapter::HaveDtls() {
   return true;
 }
 
 bool OpenSSLStreamAdapter::HaveDtlsSrtp() {
 #ifdef HAVE_DTLS_SRTP
   return true;
 #else
@@ skipping 84 matching lines @@
         return true;
     }
   }
 
   return false;
 }
 
 }  // namespace rtc
 
 #endif  // HAVE_OPENSSL_SSL_H