Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(20)

Side by Side Diff: webrtc/base/openssladapter.cc

Issue 2685783014: Replace NULL with nullptr in all C++ files. (Closed)
Patch Set: Fixing android. Created 3 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright 2008 The WebRTC Project Authors. All rights reserved. 2 * Copyright 2008 The WebRTC Project Authors. All rights reserved.
3 * 3 *
4 * Use of this source code is governed by a BSD-style license 4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source 5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found 6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may 7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree. 8 * be found in the AUTHORS file in the root of the source tree.
9 */ 9 */
10 10
(...skipping 23 matching lines...) Expand all
34 #include "webrtc/base/sslroots.h" 34 #include "webrtc/base/sslroots.h"
35 #include "webrtc/base/stringutils.h" 35 #include "webrtc/base/stringutils.h"
36 #include "webrtc/base/thread.h" 36 #include "webrtc/base/thread.h"
37 37
38 #ifndef OPENSSL_IS_BORINGSSL 38 #ifndef OPENSSL_IS_BORINGSSL
39 39
40 // TODO: Use a nicer abstraction for mutex. 40 // TODO: Use a nicer abstraction for mutex.
41 41
42 #if defined(WEBRTC_WIN) 42 #if defined(WEBRTC_WIN)
43 #define MUTEX_TYPE HANDLE 43 #define MUTEX_TYPE HANDLE
44 #define MUTEX_SETUP(x) (x) = CreateMutex(NULL, FALSE, NULL) 44 #define MUTEX_SETUP(x) (x) = CreateMutex(nullptr, FALSE, nullptr)
45 #define MUTEX_CLEANUP(x) CloseHandle(x) 45 #define MUTEX_CLEANUP(x) CloseHandle(x)
46 #define MUTEX_LOCK(x) WaitForSingleObject((x), INFINITE) 46 #define MUTEX_LOCK(x) WaitForSingleObject((x), INFINITE)
47 #define MUTEX_UNLOCK(x) ReleaseMutex(x) 47 #define MUTEX_UNLOCK(x) ReleaseMutex(x)
48 #define THREAD_ID GetCurrentThreadId() 48 #define THREAD_ID GetCurrentThreadId()
49 #elif defined(WEBRTC_POSIX) 49 #elif defined(WEBRTC_POSIX)
50 #define MUTEX_TYPE pthread_mutex_t 50 #define MUTEX_TYPE pthread_mutex_t
51 #define MUTEX_SETUP(x) pthread_mutex_init(&(x), NULL) 51 #define MUTEX_SETUP(x) pthread_mutex_init(&(x), nullptr)
52 #define MUTEX_CLEANUP(x) pthread_mutex_destroy(&(x)) 52 #define MUTEX_CLEANUP(x) pthread_mutex_destroy(&(x))
53 #define MUTEX_LOCK(x) pthread_mutex_lock(&(x)) 53 #define MUTEX_LOCK(x) pthread_mutex_lock(&(x))
54 #define MUTEX_UNLOCK(x) pthread_mutex_unlock(&(x)) 54 #define MUTEX_UNLOCK(x) pthread_mutex_unlock(&(x))
55 #define THREAD_ID pthread_self() 55 #define THREAD_ID pthread_self()
56 #else 56 #else
57 #error You must define mutex operations appropriate for your platform! 57 #error You must define mutex operations appropriate for your platform!
58 #endif 58 #endif
59 59
60 struct CRYPTO_dynlock_value { 60 struct CRYPTO_dynlock_value {
61 MUTEX_TYPE mutex; 61 MUTEX_TYPE mutex;
62 }; 62 };
63 63
64 #endif // #ifndef OPENSSL_IS_BORINGSSL 64 #endif // #ifndef OPENSSL_IS_BORINGSSL
65 65
66 ////////////////////////////////////////////////////////////////////// 66 //////////////////////////////////////////////////////////////////////
67 // SocketBIO 67 // SocketBIO
68 ////////////////////////////////////////////////////////////////////// 68 //////////////////////////////////////////////////////////////////////
69 69
70 static int socket_write(BIO* h, const char* buf, int num); 70 static int socket_write(BIO* h, const char* buf, int num);
71 static int socket_read(BIO* h, char* buf, int size); 71 static int socket_read(BIO* h, char* buf, int size);
72 static int socket_puts(BIO* h, const char* str); 72 static int socket_puts(BIO* h, const char* str);
73 static long socket_ctrl(BIO* h, int cmd, long arg1, void* arg2); 73 static long socket_ctrl(BIO* h, int cmd, long arg1, void* arg2);
74 static int socket_new(BIO* h); 74 static int socket_new(BIO* h);
75 static int socket_free(BIO* data); 75 static int socket_free(BIO* data);
76 76
77 // TODO(davidben): This should be const once BoringSSL is assumed. 77 // TODO(davidben): This should be const once BoringSSL is assumed.
78 static BIO_METHOD methods_socket = { 78 static BIO_METHOD methods_socket = {
79 BIO_TYPE_BIO, 79 BIO_TYPE_BIO, "socket", socket_write, socket_read, socket_puts, 0,
80 "socket", 80 socket_ctrl, socket_new, socket_free, nullptr,
81 socket_write,
82 socket_read,
83 socket_puts,
84 0,
85 socket_ctrl,
86 socket_new,
87 socket_free,
88 NULL,
89 }; 81 };
90 82
91 static BIO_METHOD* BIO_s_socket2() { return(&methods_socket); } 83 static BIO_METHOD* BIO_s_socket2() { return(&methods_socket); }
92 84
93 static BIO* BIO_new_socket(rtc::AsyncSocket* socket) { 85 static BIO* BIO_new_socket(rtc::AsyncSocket* socket) {
94 BIO* ret = BIO_new(BIO_s_socket2()); 86 BIO* ret = BIO_new(BIO_s_socket2());
95 if (ret == NULL) { 87 if (ret == nullptr) {
96 return NULL; 88 return nullptr;
97 } 89 }
98 ret->ptr = socket; 90 ret->ptr = socket;
99 return ret; 91 return ret;
100 } 92 }
101 93
102 static int socket_new(BIO* b) { 94 static int socket_new(BIO* b) {
103 b->shutdown = 0; 95 b->shutdown = 0;
104 b->init = 1; 96 b->init = 1;
105 b->num = 0; // 1 means socket closed 97 b->num = 0; // 1 means socket closed
106 b->ptr = 0; 98 b->ptr = 0;
107 return 1; 99 return 1;
108 } 100 }
109 101
110 static int socket_free(BIO* b) { 102 static int socket_free(BIO* b) {
111 if (b == NULL) 103 if (b == nullptr)
112 return 0; 104 return 0;
113 return 1; 105 return 1;
114 } 106 }
115 107
116 static int socket_read(BIO* b, char* out, int outl) { 108 static int socket_read(BIO* b, char* out, int outl) {
117 if (!out) 109 if (!out)
118 return -1; 110 return -1;
119 rtc::AsyncSocket* socket = static_cast<rtc::AsyncSocket*>(b->ptr); 111 rtc::AsyncSocket* socket = static_cast<rtc::AsyncSocket*>(b->ptr);
120 BIO_clear_retry_flags(b); 112 BIO_clear_retry_flags(b);
121 int result = socket->Recv(out, outl, nullptr); 113 int result = socket->Recv(out, outl, nullptr);
(...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after
168 160
169 ///////////////////////////////////////////////////////////////////////////// 161 /////////////////////////////////////////////////////////////////////////////
170 // OpenSSLAdapter 162 // OpenSSLAdapter
171 ///////////////////////////////////////////////////////////////////////////// 163 /////////////////////////////////////////////////////////////////////////////
172 164
173 namespace rtc { 165 namespace rtc {
174 166
175 #ifndef OPENSSL_IS_BORINGSSL 167 #ifndef OPENSSL_IS_BORINGSSL
176 168
177 // This array will store all of the mutexes available to OpenSSL. 169 // This array will store all of the mutexes available to OpenSSL.
178 static MUTEX_TYPE* mutex_buf = NULL; 170 static MUTEX_TYPE* mutex_buf = nullptr;
179 171
180 static void locking_function(int mode, int n, const char * file, int line) { 172 static void locking_function(int mode, int n, const char * file, int line) {
181 if (mode & CRYPTO_LOCK) { 173 if (mode & CRYPTO_LOCK) {
182 MUTEX_LOCK(mutex_buf[n]); 174 MUTEX_LOCK(mutex_buf[n]);
183 } else { 175 } else {
184 MUTEX_UNLOCK(mutex_buf[n]); 176 MUTEX_UNLOCK(mutex_buf[n]);
185 } 177 }
186 } 178 }
187 179
188 static unsigned long id_function() { // NOLINT 180 static unsigned long id_function() { // NOLINT
189 // Use old-style C cast because THREAD_ID's type varies with the platform, 181 // Use old-style C cast because THREAD_ID's type varies with the platform,
190 // in some cases requiring static_cast, and in others requiring 182 // in some cases requiring static_cast, and in others requiring
191 // reinterpret_cast. 183 // reinterpret_cast.
192 return (unsigned long)THREAD_ID; // NOLINT 184 return (unsigned long)THREAD_ID; // NOLINT
193 } 185 }
194 186
195 static CRYPTO_dynlock_value* dyn_create_function(const char* file, int line) { 187 static CRYPTO_dynlock_value* dyn_create_function(const char* file, int line) {
196 CRYPTO_dynlock_value* value = new CRYPTO_dynlock_value; 188 CRYPTO_dynlock_value* value = new CRYPTO_dynlock_value;
197 if (!value) 189 if (!value)
198 return NULL; 190 return nullptr;
199 MUTEX_SETUP(value->mutex); 191 MUTEX_SETUP(value->mutex);
200 return value; 192 return value;
201 } 193 }
202 194
203 static void dyn_lock_function(int mode, CRYPTO_dynlock_value* l, 195 static void dyn_lock_function(int mode, CRYPTO_dynlock_value* l,
204 const char* file, int line) { 196 const char* file, int line) {
205 if (mode & CRYPTO_LOCK) { 197 if (mode & CRYPTO_LOCK) {
206 MUTEX_LOCK(l->mutex); 198 MUTEX_LOCK(l->mutex);
207 } else { 199 } else {
208 MUTEX_UNLOCK(l->mutex); 200 MUTEX_UNLOCK(l->mutex);
209 } 201 }
210 } 202 }
211 203
212 static void dyn_destroy_function(CRYPTO_dynlock_value* l, 204 static void dyn_destroy_function(CRYPTO_dynlock_value* l,
213 const char* file, int line) { 205 const char* file, int line) {
214 MUTEX_CLEANUP(l->mutex); 206 MUTEX_CLEANUP(l->mutex);
215 delete l; 207 delete l;
216 } 208 }
217 209
218 #endif // #ifndef OPENSSL_IS_BORINGSSL 210 #endif // #ifndef OPENSSL_IS_BORINGSSL
219 211
220 VerificationCallback OpenSSLAdapter::custom_verify_callback_ = NULL; 212 VerificationCallback OpenSSLAdapter::custom_verify_callback_ = nullptr;
221 213
222 bool OpenSSLAdapter::InitializeSSL(VerificationCallback callback) { 214 bool OpenSSLAdapter::InitializeSSL(VerificationCallback callback) {
223 if (!InitializeSSLThread() || !SSL_library_init()) 215 if (!InitializeSSLThread() || !SSL_library_init())
224 return false; 216 return false;
225 #if !defined(ADDRESS_SANITIZER) || !defined(WEBRTC_MAC) || defined(WEBRTC_IOS) 217 #if !defined(ADDRESS_SANITIZER) || !defined(WEBRTC_MAC) || defined(WEBRTC_IOS)
226 // Loading the error strings crashes mac_asan. Omit this debugging aid there. 218 // Loading the error strings crashes mac_asan. Omit this debugging aid there.
227 SSL_load_error_strings(); 219 SSL_load_error_strings();
228 #endif 220 #endif
229 ERR_load_BIO_strings(); 221 ERR_load_BIO_strings();
230 OpenSSL_add_all_algorithms(); 222 OpenSSL_add_all_algorithms();
(...skipping 20 matching lines...) Expand all
251 CRYPTO_set_dynlock_lock_callback(dyn_lock_function); 243 CRYPTO_set_dynlock_lock_callback(dyn_lock_function);
252 CRYPTO_set_dynlock_destroy_callback(dyn_destroy_function); 244 CRYPTO_set_dynlock_destroy_callback(dyn_destroy_function);
253 #endif // #ifndef OPENSSL_IS_BORINGSSL 245 #endif // #ifndef OPENSSL_IS_BORINGSSL
254 return true; 246 return true;
255 } 247 }
256 248
257 bool OpenSSLAdapter::CleanupSSL() { 249 bool OpenSSLAdapter::CleanupSSL() {
258 #ifndef OPENSSL_IS_BORINGSSL 250 #ifndef OPENSSL_IS_BORINGSSL
259 if (!mutex_buf) 251 if (!mutex_buf)
260 return false; 252 return false;
261 CRYPTO_set_id_callback(NULL); 253 CRYPTO_set_id_callback(nullptr);
262 CRYPTO_set_locking_callback(NULL); 254 CRYPTO_set_locking_callback(nullptr);
263 CRYPTO_set_dynlock_create_callback(NULL); 255 CRYPTO_set_dynlock_create_callback(nullptr);
264 CRYPTO_set_dynlock_lock_callback(NULL); 256 CRYPTO_set_dynlock_lock_callback(nullptr);
265 CRYPTO_set_dynlock_destroy_callback(NULL); 257 CRYPTO_set_dynlock_destroy_callback(nullptr);
266 for (int i = 0; i < CRYPTO_num_locks(); ++i) 258 for (int i = 0; i < CRYPTO_num_locks(); ++i)
267 MUTEX_CLEANUP(mutex_buf[i]); 259 MUTEX_CLEANUP(mutex_buf[i]);
268 delete [] mutex_buf; 260 delete [] mutex_buf;
269 mutex_buf = NULL; 261 mutex_buf = nullptr;
270 #endif // #ifndef OPENSSL_IS_BORINGSSL 262 #endif // #ifndef OPENSSL_IS_BORINGSSL
271 return true; 263 return true;
272 } 264 }
273 265
274 OpenSSLAdapter::OpenSSLAdapter(AsyncSocket* socket) 266 OpenSSLAdapter::OpenSSLAdapter(AsyncSocket* socket)
275 : SSLAdapter(socket), 267 : SSLAdapter(socket),
276 state_(SSL_NONE), 268 state_(SSL_NONE),
277 ssl_read_needs_write_(false), 269 ssl_read_needs_write_(false),
278 ssl_write_needs_read_(false), 270 ssl_write_needs_read_(false),
279 restartable_(false), 271 restartable_(false),
280 ssl_(NULL), ssl_ctx_(NULL), 272 ssl_(nullptr),
281 ssl_mode_(SSL_MODE_TLS), 273 ssl_ctx_(nullptr),
282 custom_verification_succeeded_(false) { 274 ssl_mode_(SSL_MODE_TLS),
283 } 275 custom_verification_succeeded_(false) {}
284 276
285 OpenSSLAdapter::~OpenSSLAdapter() { 277 OpenSSLAdapter::~OpenSSLAdapter() {
286 Cleanup(); 278 Cleanup();
287 } 279 }
288 280
289 void 281 void
290 OpenSSLAdapter::SetMode(SSLMode mode) { 282 OpenSSLAdapter::SetMode(SSLMode mode) {
291 RTC_DCHECK(state_ == SSL_NONE); 283 RTC_DCHECK(state_ == SSL_NONE);
292 ssl_mode_ = mode; 284 ssl_mode_ = mode;
293 } 285 }
(...skipping 19 matching lines...) Expand all
313 305
314 return 0; 306 return 0;
315 } 307 }
316 308
317 int 309 int
318 OpenSSLAdapter::BeginSSL() { 310 OpenSSLAdapter::BeginSSL() {
319 LOG(LS_INFO) << "BeginSSL: " << ssl_host_name_; 311 LOG(LS_INFO) << "BeginSSL: " << ssl_host_name_;
320 RTC_DCHECK(state_ == SSL_CONNECTING); 312 RTC_DCHECK(state_ == SSL_CONNECTING);
321 313
322 int err = 0; 314 int err = 0;
323 BIO* bio = NULL; 315 BIO* bio = nullptr;
324 316
325 // First set up the context 317 // First set up the context
326 if (!ssl_ctx_) 318 if (!ssl_ctx_)
327 ssl_ctx_ = SetupSSLContext(); 319 ssl_ctx_ = SetupSSLContext();
328 320
329 if (!ssl_ctx_) { 321 if (!ssl_ctx_) {
330 err = -1; 322 err = -1;
331 goto ssl_error; 323 goto ssl_error;
332 } 324 }
333 325
334 bio = BIO_new_socket(socket_); 326 bio = BIO_new_socket(socket_);
335 if (!bio) { 327 if (!bio) {
336 err = -1; 328 err = -1;
337 goto ssl_error; 329 goto ssl_error;
338 } 330 }
339 331
340 ssl_ = SSL_new(ssl_ctx_); 332 ssl_ = SSL_new(ssl_ctx_);
341 if (!ssl_) { 333 if (!ssl_) {
342 err = -1; 334 err = -1;
343 goto ssl_error; 335 goto ssl_error;
344 } 336 }
345 337
346 SSL_set_app_data(ssl_, this); 338 SSL_set_app_data(ssl_, this);
347 339
348 SSL_set_bio(ssl_, bio, bio); 340 SSL_set_bio(ssl_, bio, bio);
349 SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE | 341 SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE |
350 SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER); 342 SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
351 343
352 // the SSL object owns the bio now 344 // the SSL object owns the bio now
353 bio = NULL; 345 bio = nullptr;
354 346
355 // Do the connect 347 // Do the connect
356 err = ContinueSSL(); 348 err = ContinueSSL();
357 if (err != 0) 349 if (err != 0)
358 goto ssl_error; 350 goto ssl_error;
359 351
360 return err; 352 return err;
361 353
362 ssl_error: 354 ssl_error:
363 Cleanup(); 355 Cleanup();
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after
434 OpenSSLAdapter::Cleanup() { 426 OpenSSLAdapter::Cleanup() {
435 LOG(LS_INFO) << "Cleanup"; 427 LOG(LS_INFO) << "Cleanup";
436 428
437 state_ = SSL_NONE; 429 state_ = SSL_NONE;
438 ssl_read_needs_write_ = false; 430 ssl_read_needs_write_ = false;
439 ssl_write_needs_read_ = false; 431 ssl_write_needs_read_ = false;
440 custom_verification_succeeded_ = false; 432 custom_verification_succeeded_ = false;
441 433
442 if (ssl_) { 434 if (ssl_) {
443 SSL_free(ssl_); 435 SSL_free(ssl_);
444 ssl_ = NULL; 436 ssl_ = nullptr;
445 } 437 }
446 438
447 if (ssl_ctx_) { 439 if (ssl_ctx_) {
448 SSL_CTX_free(ssl_ctx_); 440 SSL_CTX_free(ssl_ctx_);
449 ssl_ctx_ = NULL; 441 ssl_ctx_ = nullptr;
450 } 442 }
451 443
452 // Clear the DTLS timer 444 // Clear the DTLS timer
453 Thread::Current()->Clear(this, MSG_TIMEOUT); 445 Thread::Current()->Clear(this, MSG_TIMEOUT);
454 } 446 }
455 447
456 // 448 //
457 // AsyncSocket Implementation 449 // AsyncSocket Implementation
458 // 450 //
459 451
(...skipping 247 matching lines...) Expand 10 before | Expand all | Expand 10 after
707 // This code is taken from the "Network Security with OpenSSL" 699 // This code is taken from the "Network Security with OpenSSL"
708 // sample in chapter 5 700 // sample in chapter 5
709 701
710 bool OpenSSLAdapter::VerifyServerName(SSL* ssl, const char* host, 702 bool OpenSSLAdapter::VerifyServerName(SSL* ssl, const char* host,
711 bool ignore_bad_cert) { 703 bool ignore_bad_cert) {
712 if (!host) 704 if (!host)
713 return false; 705 return false;
714 706
715 // Checking the return from SSL_get_peer_certificate here is not strictly 707 // Checking the return from SSL_get_peer_certificate here is not strictly
716 // necessary. With our setup, it is not possible for it to return 708 // necessary. With our setup, it is not possible for it to return
717 // NULL. However, it is good form to check the return. 709 // null. However, it is good form to check the return.
718 X509* certificate = SSL_get_peer_certificate(ssl); 710 X509* certificate = SSL_get_peer_certificate(ssl);
719 if (!certificate) 711 if (!certificate)
720 return false; 712 return false;
721 713
722 // Logging certificates is extremely verbose. So it is disabled by default. 714 // Logging certificates is extremely verbose. So it is disabled by default.
723 #ifdef LOG_CERTIFICATES 715 #ifdef LOG_CERTIFICATES
724 { 716 {
725 LOG(LS_INFO) << "Certificate from server:"; 717 LOG(LS_INFO) << "Certificate from server:";
726 BIO* mem = BIO_new(BIO_s_mem()); 718 BIO* mem = BIO_new(BIO_s_mem());
727 X509_print_ex(mem, certificate, XN_FLAG_SEP_CPLUS_SPC, X509_FLAG_NO_HEADER); 719 X509_print_ex(mem, certificate, XN_FLAG_SEP_CPLUS_SPC, X509_FLAG_NO_HEADER);
728 BIO_write(mem, "\0", 1); 720 BIO_write(mem, "\0", 1);
729 char* buffer; 721 char* buffer;
730 BIO_get_mem_data(mem, &buffer); 722 BIO_get_mem_data(mem, &buffer);
731 LOG(LS_INFO) << buffer; 723 LOG(LS_INFO) << buffer;
732 BIO_free(mem); 724 BIO_free(mem);
733 725
734 char* cipher_description = 726 char* cipher_description =
735 SSL_CIPHER_description(SSL_get_current_cipher(ssl), NULL, 128); 727 SSL_CIPHER_description(SSL_get_current_cipher(ssl), nullptr, 128);
736 LOG(LS_INFO) << "Cipher: " << cipher_description; 728 LOG(LS_INFO) << "Cipher: " << cipher_description;
737 OPENSSL_free(cipher_description); 729 OPENSSL_free(cipher_description);
738 } 730 }
739 #endif 731 #endif
740 732
741 bool ok = false; 733 bool ok = false;
742 int extension_count = X509_get_ext_count(certificate); 734 int extension_count = X509_get_ext_count(certificate);
743 for (int i = 0; i < extension_count; ++i) { 735 for (int i = 0; i < extension_count; ++i) {
744 X509_EXTENSION* extension = X509_get_ext(certificate, i); 736 X509_EXTENSION* extension = X509_get_ext(certificate, i);
745 int extension_nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension)); 737 int extension_nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension));
746 738
747 if (extension_nid == NID_subject_alt_name) { 739 if (extension_nid == NID_subject_alt_name) {
748 const X509V3_EXT_METHOD* meth = X509V3_EXT_get(extension); 740 const X509V3_EXT_METHOD* meth = X509V3_EXT_get(extension);
749 if (!meth) 741 if (!meth)
750 break; 742 break;
751 743
752 void* ext_str = NULL; 744 void* ext_str = nullptr;
753 745
754 // We assign this to a local variable, instead of passing the address 746 // We assign this to a local variable, instead of passing the address
755 // directly to ASN1_item_d2i. 747 // directly to ASN1_item_d2i.
756 // See http://readlist.com/lists/openssl.org/openssl-users/0/4761.html. 748 // See http://readlist.com/lists/openssl.org/openssl-users/0/4761.html.
757 unsigned char* ext_value_data = extension->value->data; 749 unsigned char* ext_value_data = extension->value->data;
758 750
759 const unsigned char **ext_value_data_ptr = 751 const unsigned char **ext_value_data_ptr =
760 (const_cast<const unsigned char **>(&ext_value_data)); 752 (const_cast<const unsigned char **>(&ext_value_data));
761 753
762 if (meth->it) { 754 if (meth->it) {
763 ext_str = ASN1_item_d2i(NULL, ext_value_data_ptr, 755 ext_str =
764 extension->value->length, 756 ASN1_item_d2i(nullptr, ext_value_data_ptr, extension->value->length,
765 ASN1_ITEM_ptr(meth->it)); 757 ASN1_ITEM_ptr(meth->it));
766 } else { 758 } else {
767 ext_str = meth->d2i(NULL, ext_value_data_ptr, extension->value->length); 759 ext_str =
760 meth->d2i(nullptr, ext_value_data_ptr, extension->value->length);
768 } 761 }
769 762
770 STACK_OF(CONF_VALUE)* value = meth->i2v(meth, ext_str, NULL); 763 STACK_OF(CONF_VALUE)* value = meth->i2v(meth, ext_str, nullptr);
771 764
772 // Cast to size_t to be compilable for both OpenSSL and BoringSSL. 765 // Cast to size_t to be compilable for both OpenSSL and BoringSSL.
773 for (size_t j = 0; j < static_cast<size_t>(sk_CONF_VALUE_num(value)); 766 for (size_t j = 0; j < static_cast<size_t>(sk_CONF_VALUE_num(value));
774 ++j) { 767 ++j) {
775 CONF_VALUE* nval = sk_CONF_VALUE_value(value, j); 768 CONF_VALUE* nval = sk_CONF_VALUE_value(value, j);
776 // The value for nval can contain wildcards 769 // The value for nval can contain wildcards
777 if (!strcmp(nval->name, "DNS") && string_match(host, nval->value)) { 770 if (!strcmp(nval->name, "DNS") && string_match(host, nval->value)) {
778 ok = true; 771 ok = true;
779 break; 772 break;
780 } 773 }
781 } 774 }
782 sk_CONF_VALUE_pop_free(value, X509V3_conf_free); 775 sk_CONF_VALUE_pop_free(value, X509V3_conf_free);
783 value = NULL; 776 value = nullptr;
784 777
785 if (meth->it) { 778 if (meth->it) {
786 ASN1_item_free(reinterpret_cast<ASN1_VALUE*>(ext_str), 779 ASN1_item_free(reinterpret_cast<ASN1_VALUE*>(ext_str),
787 ASN1_ITEM_ptr(meth->it)); 780 ASN1_ITEM_ptr(meth->it));
788 } else { 781 } else {
789 meth->ext_free(ext_str); 782 meth->ext_free(ext_str);
790 } 783 }
791 ext_str = NULL; 784 ext_str = nullptr;
792 } 785 }
793 if (ok) 786 if (ok)
794 break; 787 break;
795 } 788 }
796 789
797 char data[256]; 790 char data[256];
798 X509_NAME* subject; 791 X509_NAME* subject;
799 if (!ok 792 if (!ok && ((subject = X509_get_subject_name(certificate)) != nullptr) &&
800 && ((subject = X509_get_subject_name(certificate)) != NULL) 793 (X509_NAME_get_text_by_NID(subject, NID_commonName, data, sizeof(data)) >
801 && (X509_NAME_get_text_by_NID(subject, NID_commonName, 794 0)) {
802 data, sizeof(data)) > 0)) {
803 data[sizeof(data)-1] = 0; 795 data[sizeof(data)-1] = 0;
804 if (_stricmp(data, host) == 0) 796 if (_stricmp(data, host) == 0)
805 ok = true; 797 ok = true;
806 } 798 }
807 799
808 X509_free(certificate); 800 X509_free(certificate);
809 801
810 // This should only ever be turned on for debugging and development. 802 // This should only ever be turned on for debugging and development.
811 if (!ok && ignore_bad_cert) { 803 if (!ok && ignore_bad_cert) {
812 LOG(LS_WARNING) << "TLS certificate check FAILED. " 804 LOG(LS_WARNING) << "TLS certificate check FAILED. "
(...skipping 96 matching lines...) Expand 10 before | Expand all | Expand 10 after
909 901
910 return ok; 902 return ok;
911 } 903 }
912 904
913 bool OpenSSLAdapter::ConfigureTrustedRootCertificates(SSL_CTX* ctx) { 905 bool OpenSSLAdapter::ConfigureTrustedRootCertificates(SSL_CTX* ctx) {
914 // Add the root cert that we care about to the SSL context 906 // Add the root cert that we care about to the SSL context
915 int count_of_added_certs = 0; 907 int count_of_added_certs = 0;
916 for (size_t i = 0; i < arraysize(kSSLCertCertificateList); i++) { 908 for (size_t i = 0; i < arraysize(kSSLCertCertificateList); i++) {
917 const unsigned char* cert_buffer = kSSLCertCertificateList[i]; 909 const unsigned char* cert_buffer = kSSLCertCertificateList[i];
918 size_t cert_buffer_len = kSSLCertCertificateSizeList[i]; 910 size_t cert_buffer_len = kSSLCertCertificateSizeList[i];
919 X509* cert = d2i_X509(NULL, &cert_buffer, 911 X509* cert =
920 checked_cast<long>(cert_buffer_len)); 912 d2i_X509(nullptr, &cert_buffer, checked_cast<long>(cert_buffer_len));
921 if (cert) { 913 if (cert) {
922 int return_value = X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), cert); 914 int return_value = X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), cert);
923 if (return_value == 0) { 915 if (return_value == 0) {
924 LOG(LS_WARNING) << "Unable to add certificate."; 916 LOG(LS_WARNING) << "Unable to add certificate.";
925 } else { 917 } else {
926 count_of_added_certs++; 918 count_of_added_certs++;
927 } 919 }
928 X509_free(cert); 920 X509_free(cert);
929 } 921 }
930 } 922 }
931 return count_of_added_certs > 0; 923 return count_of_added_certs > 0;
932 } 924 }
933 925
934 SSL_CTX* 926 SSL_CTX*
935 OpenSSLAdapter::SetupSSLContext() { 927 OpenSSLAdapter::SetupSSLContext() {
936 SSL_CTX* ctx = SSL_CTX_new(ssl_mode_ == SSL_MODE_DTLS ? 928 SSL_CTX* ctx = SSL_CTX_new(ssl_mode_ == SSL_MODE_DTLS ?
937 DTLSv1_client_method() : TLSv1_client_method()); 929 DTLSv1_client_method() : TLSv1_client_method());
938 if (ctx == NULL) { 930 if (ctx == nullptr) {
939 unsigned long error = ERR_get_error(); // NOLINT: type used by OpenSSL. 931 unsigned long error = ERR_get_error(); // NOLINT: type used by OpenSSL.
940 LOG(LS_WARNING) << "SSL_CTX creation failed: " 932 LOG(LS_WARNING) << "SSL_CTX creation failed: "
941 << '"' << ERR_reason_error_string(error) << "\" " 933 << '"' << ERR_reason_error_string(error) << "\" "
942 << "(error=" << error << ')'; 934 << "(error=" << error << ')';
943 return NULL; 935 return nullptr;
944 } 936 }
945 if (!ConfigureTrustedRootCertificates(ctx)) { 937 if (!ConfigureTrustedRootCertificates(ctx)) {
946 SSL_CTX_free(ctx); 938 SSL_CTX_free(ctx);
947 return NULL; 939 return nullptr;
948 } 940 }
949 941
950 #if !defined(NDEBUG) 942 #if !defined(NDEBUG)
951 SSL_CTX_set_info_callback(ctx, SSLInfoCallback); 943 SSL_CTX_set_info_callback(ctx, SSLInfoCallback);
952 #endif 944 #endif
953 945
954 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, SSLVerifyCallback); 946 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, SSLVerifyCallback);
955 SSL_CTX_set_verify_depth(ctx, 4); 947 SSL_CTX_set_verify_depth(ctx, 4);
956 SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"); 948 SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
957 949
958 if (ssl_mode_ == SSL_MODE_DTLS) { 950 if (ssl_mode_ == SSL_MODE_DTLS) {
959 SSL_CTX_set_read_ahead(ctx, 1); 951 SSL_CTX_set_read_ahead(ctx, 1);
960 } 952 }
961 953
962 return ctx; 954 return ctx;
963 } 955 }
964 956
965 } // namespace rtc 957 } // namespace rtc
OLDNEW
« webrtc/base/event.cc ('K') | « webrtc/base/network.cc ('k') | webrtc/base/openssldigest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698