Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(706)

Side by Side Diff: webrtc/base/openssladapter.cc

Issue 2718663005: Replace NULL with nullptr or null in webrtc/base/. (Closed)
Patch Set: Fixing Windows and formatting issues. Created 3 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « webrtc/base/network.cc ('k') | webrtc/base/openssldigest.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright 2008 The WebRTC Project Authors. All rights reserved. 2 * Copyright 2008 The WebRTC Project Authors. All rights reserved.
3 * 3 *
4 * Use of this source code is governed by a BSD-style license 4 * Use of this source code is governed by a BSD-style license
5 * that can be found in the LICENSE file in the root of the source 5 * that can be found in the LICENSE file in the root of the source
6 * tree. An additional intellectual property rights grant can be found 6 * tree. An additional intellectual property rights grant can be found
7 * in the file PATENTS. All contributing project authors may 7 * in the file PATENTS. All contributing project authors may
8 * be found in the AUTHORS file in the root of the source tree. 8 * be found in the AUTHORS file in the root of the source tree.
9 */ 9 */
10 10
(...skipping 22 matching lines...) Expand all
33 #include "webrtc/base/sslroots.h" 33 #include "webrtc/base/sslroots.h"
34 #include "webrtc/base/stringutils.h" 34 #include "webrtc/base/stringutils.h"
35 #include "webrtc/base/thread.h" 35 #include "webrtc/base/thread.h"
36 36
37 #ifndef OPENSSL_IS_BORINGSSL 37 #ifndef OPENSSL_IS_BORINGSSL
38 38
39 // TODO: Use a nicer abstraction for mutex. 39 // TODO: Use a nicer abstraction for mutex.
40 40
41 #if defined(WEBRTC_WIN) 41 #if defined(WEBRTC_WIN)
42 #define MUTEX_TYPE HANDLE 42 #define MUTEX_TYPE HANDLE
43 #define MUTEX_SETUP(x) (x) = CreateMutex(NULL, FALSE, NULL) 43 #define MUTEX_SETUP(x) (x) = CreateMutex(nullptr, FALSE, nullptr)
44 #define MUTEX_CLEANUP(x) CloseHandle(x) 44 #define MUTEX_CLEANUP(x) CloseHandle(x)
45 #define MUTEX_LOCK(x) WaitForSingleObject((x), INFINITE) 45 #define MUTEX_LOCK(x) WaitForSingleObject((x), INFINITE)
46 #define MUTEX_UNLOCK(x) ReleaseMutex(x) 46 #define MUTEX_UNLOCK(x) ReleaseMutex(x)
47 #define THREAD_ID GetCurrentThreadId() 47 #define THREAD_ID GetCurrentThreadId()
48 #elif defined(WEBRTC_POSIX) 48 #elif defined(WEBRTC_POSIX)
49 #define MUTEX_TYPE pthread_mutex_t 49 #define MUTEX_TYPE pthread_mutex_t
50 #define MUTEX_SETUP(x) pthread_mutex_init(&(x), NULL) 50 #define MUTEX_SETUP(x) pthread_mutex_init(&(x), nullptr)
51 #define MUTEX_CLEANUP(x) pthread_mutex_destroy(&(x)) 51 #define MUTEX_CLEANUP(x) pthread_mutex_destroy(&(x))
52 #define MUTEX_LOCK(x) pthread_mutex_lock(&(x)) 52 #define MUTEX_LOCK(x) pthread_mutex_lock(&(x))
53 #define MUTEX_UNLOCK(x) pthread_mutex_unlock(&(x)) 53 #define MUTEX_UNLOCK(x) pthread_mutex_unlock(&(x))
54 #define THREAD_ID pthread_self() 54 #define THREAD_ID pthread_self()
55 #else 55 #else
56 #error You must define mutex operations appropriate for your platform! 56 #error You must define mutex operations appropriate for your platform!
57 #endif 57 #endif
58 58
59 struct CRYPTO_dynlock_value { 59 struct CRYPTO_dynlock_value {
60 MUTEX_TYPE mutex; 60 MUTEX_TYPE mutex;
61 }; 61 };
62 62
63 #endif // #ifndef OPENSSL_IS_BORINGSSL 63 #endif // #ifndef OPENSSL_IS_BORINGSSL
64 64
65 ////////////////////////////////////////////////////////////////////// 65 //////////////////////////////////////////////////////////////////////
66 // SocketBIO 66 // SocketBIO
67 ////////////////////////////////////////////////////////////////////// 67 //////////////////////////////////////////////////////////////////////
68 68
69 static int socket_write(BIO* h, const char* buf, int num); 69 static int socket_write(BIO* h, const char* buf, int num);
70 static int socket_read(BIO* h, char* buf, int size); 70 static int socket_read(BIO* h, char* buf, int size);
71 static int socket_puts(BIO* h, const char* str); 71 static int socket_puts(BIO* h, const char* str);
72 static long socket_ctrl(BIO* h, int cmd, long arg1, void* arg2); 72 static long socket_ctrl(BIO* h, int cmd, long arg1, void* arg2);
73 static int socket_new(BIO* h); 73 static int socket_new(BIO* h);
74 static int socket_free(BIO* data); 74 static int socket_free(BIO* data);
75 75
76 // TODO(davidben): This should be const once BoringSSL is assumed. 76 // TODO(davidben): This should be const once BoringSSL is assumed.
77 static BIO_METHOD methods_socket = { 77 static BIO_METHOD methods_socket = {
78 BIO_TYPE_BIO, 78 BIO_TYPE_BIO, "socket", socket_write, socket_read, socket_puts, 0,
79 "socket", 79 socket_ctrl, socket_new, socket_free, nullptr,
80 socket_write,
81 socket_read,
82 socket_puts,
83 0,
84 socket_ctrl,
85 socket_new,
86 socket_free,
87 NULL,
88 }; 80 };
89 81
90 static BIO_METHOD* BIO_s_socket2() { return(&methods_socket); } 82 static BIO_METHOD* BIO_s_socket2() { return(&methods_socket); }
91 83
92 static BIO* BIO_new_socket(rtc::AsyncSocket* socket) { 84 static BIO* BIO_new_socket(rtc::AsyncSocket* socket) {
93 BIO* ret = BIO_new(BIO_s_socket2()); 85 BIO* ret = BIO_new(BIO_s_socket2());
94 if (ret == NULL) { 86 if (ret == nullptr) {
95 return NULL; 87 return nullptr;
96 } 88 }
97 ret->ptr = socket; 89 ret->ptr = socket;
98 return ret; 90 return ret;
99 } 91 }
100 92
101 static int socket_new(BIO* b) { 93 static int socket_new(BIO* b) {
102 b->shutdown = 0; 94 b->shutdown = 0;
103 b->init = 1; 95 b->init = 1;
104 b->num = 0; // 1 means socket closed 96 b->num = 0; // 1 means socket closed
105 b->ptr = 0; 97 b->ptr = 0;
106 return 1; 98 return 1;
107 } 99 }
108 100
109 static int socket_free(BIO* b) { 101 static int socket_free(BIO* b) {
110 if (b == NULL) 102 if (b == nullptr)
111 return 0; 103 return 0;
112 return 1; 104 return 1;
113 } 105 }
114 106
115 static int socket_read(BIO* b, char* out, int outl) { 107 static int socket_read(BIO* b, char* out, int outl) {
116 if (!out) 108 if (!out)
117 return -1; 109 return -1;
118 rtc::AsyncSocket* socket = static_cast<rtc::AsyncSocket*>(b->ptr); 110 rtc::AsyncSocket* socket = static_cast<rtc::AsyncSocket*>(b->ptr);
119 BIO_clear_retry_flags(b); 111 BIO_clear_retry_flags(b);
120 int result = socket->Recv(out, outl, nullptr); 112 int result = socket->Recv(out, outl, nullptr);
(...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after
164 156
165 ///////////////////////////////////////////////////////////////////////////// 157 /////////////////////////////////////////////////////////////////////////////
166 // OpenSSLAdapter 158 // OpenSSLAdapter
167 ///////////////////////////////////////////////////////////////////////////// 159 /////////////////////////////////////////////////////////////////////////////
168 160
169 namespace rtc { 161 namespace rtc {
170 162
171 #ifndef OPENSSL_IS_BORINGSSL 163 #ifndef OPENSSL_IS_BORINGSSL
172 164
173 // This array will store all of the mutexes available to OpenSSL. 165 // This array will store all of the mutexes available to OpenSSL.
174 static MUTEX_TYPE* mutex_buf = NULL; 166 static MUTEX_TYPE* mutex_buf = nullptr;
175 167
176 static void locking_function(int mode, int n, const char * file, int line) { 168 static void locking_function(int mode, int n, const char * file, int line) {
177 if (mode & CRYPTO_LOCK) { 169 if (mode & CRYPTO_LOCK) {
178 MUTEX_LOCK(mutex_buf[n]); 170 MUTEX_LOCK(mutex_buf[n]);
179 } else { 171 } else {
180 MUTEX_UNLOCK(mutex_buf[n]); 172 MUTEX_UNLOCK(mutex_buf[n]);
181 } 173 }
182 } 174 }
183 175
184 static unsigned long id_function() { // NOLINT 176 static unsigned long id_function() { // NOLINT
185 // Use old-style C cast because THREAD_ID's type varies with the platform, 177 // Use old-style C cast because THREAD_ID's type varies with the platform,
186 // in some cases requiring static_cast, and in others requiring 178 // in some cases requiring static_cast, and in others requiring
187 // reinterpret_cast. 179 // reinterpret_cast.
188 return (unsigned long)THREAD_ID; // NOLINT 180 return (unsigned long)THREAD_ID; // NOLINT
189 } 181 }
190 182
191 static CRYPTO_dynlock_value* dyn_create_function(const char* file, int line) { 183 static CRYPTO_dynlock_value* dyn_create_function(const char* file, int line) {
192 CRYPTO_dynlock_value* value = new CRYPTO_dynlock_value; 184 CRYPTO_dynlock_value* value = new CRYPTO_dynlock_value;
193 if (!value) 185 if (!value)
194 return NULL; 186 return nullptr;
195 MUTEX_SETUP(value->mutex); 187 MUTEX_SETUP(value->mutex);
196 return value; 188 return value;
197 } 189 }
198 190
199 static void dyn_lock_function(int mode, CRYPTO_dynlock_value* l, 191 static void dyn_lock_function(int mode, CRYPTO_dynlock_value* l,
200 const char* file, int line) { 192 const char* file, int line) {
201 if (mode & CRYPTO_LOCK) { 193 if (mode & CRYPTO_LOCK) {
202 MUTEX_LOCK(l->mutex); 194 MUTEX_LOCK(l->mutex);
203 } else { 195 } else {
204 MUTEX_UNLOCK(l->mutex); 196 MUTEX_UNLOCK(l->mutex);
205 } 197 }
206 } 198 }
207 199
208 static void dyn_destroy_function(CRYPTO_dynlock_value* l, 200 static void dyn_destroy_function(CRYPTO_dynlock_value* l,
209 const char* file, int line) { 201 const char* file, int line) {
210 MUTEX_CLEANUP(l->mutex); 202 MUTEX_CLEANUP(l->mutex);
211 delete l; 203 delete l;
212 } 204 }
213 205
214 #endif // #ifndef OPENSSL_IS_BORINGSSL 206 #endif // #ifndef OPENSSL_IS_BORINGSSL
215 207
216 VerificationCallback OpenSSLAdapter::custom_verify_callback_ = NULL; 208 VerificationCallback OpenSSLAdapter::custom_verify_callback_ = nullptr;
217 209
218 bool OpenSSLAdapter::InitializeSSL(VerificationCallback callback) { 210 bool OpenSSLAdapter::InitializeSSL(VerificationCallback callback) {
219 if (!InitializeSSLThread() || !SSL_library_init()) 211 if (!InitializeSSLThread() || !SSL_library_init())
220 return false; 212 return false;
221 #if !defined(ADDRESS_SANITIZER) || !defined(WEBRTC_MAC) || defined(WEBRTC_IOS) 213 #if !defined(ADDRESS_SANITIZER) || !defined(WEBRTC_MAC) || defined(WEBRTC_IOS)
222 // Loading the error strings crashes mac_asan. Omit this debugging aid there. 214 // Loading the error strings crashes mac_asan. Omit this debugging aid there.
223 SSL_load_error_strings(); 215 SSL_load_error_strings();
224 #endif 216 #endif
225 ERR_load_BIO_strings(); 217 ERR_load_BIO_strings();
226 OpenSSL_add_all_algorithms(); 218 OpenSSL_add_all_algorithms();
(...skipping 20 matching lines...) Expand all
247 CRYPTO_set_dynlock_lock_callback(dyn_lock_function); 239 CRYPTO_set_dynlock_lock_callback(dyn_lock_function);
248 CRYPTO_set_dynlock_destroy_callback(dyn_destroy_function); 240 CRYPTO_set_dynlock_destroy_callback(dyn_destroy_function);
249 #endif // #ifndef OPENSSL_IS_BORINGSSL 241 #endif // #ifndef OPENSSL_IS_BORINGSSL
250 return true; 242 return true;
251 } 243 }
252 244
253 bool OpenSSLAdapter::CleanupSSL() { 245 bool OpenSSLAdapter::CleanupSSL() {
254 #ifndef OPENSSL_IS_BORINGSSL 246 #ifndef OPENSSL_IS_BORINGSSL
255 if (!mutex_buf) 247 if (!mutex_buf)
256 return false; 248 return false;
257 CRYPTO_set_id_callback(NULL); 249 CRYPTO_set_id_callback(nullptr);
258 CRYPTO_set_locking_callback(NULL); 250 CRYPTO_set_locking_callback(nullptr);
259 CRYPTO_set_dynlock_create_callback(NULL); 251 CRYPTO_set_dynlock_create_callback(nullptr);
260 CRYPTO_set_dynlock_lock_callback(NULL); 252 CRYPTO_set_dynlock_lock_callback(nullptr);
261 CRYPTO_set_dynlock_destroy_callback(NULL); 253 CRYPTO_set_dynlock_destroy_callback(nullptr);
262 for (int i = 0; i < CRYPTO_num_locks(); ++i) 254 for (int i = 0; i < CRYPTO_num_locks(); ++i)
263 MUTEX_CLEANUP(mutex_buf[i]); 255 MUTEX_CLEANUP(mutex_buf[i]);
264 delete [] mutex_buf; 256 delete [] mutex_buf;
265 mutex_buf = NULL; 257 mutex_buf = nullptr;
266 #endif // #ifndef OPENSSL_IS_BORINGSSL 258 #endif // #ifndef OPENSSL_IS_BORINGSSL
267 return true; 259 return true;
268 } 260 }
269 261
270 OpenSSLAdapter::OpenSSLAdapter(AsyncSocket* socket) 262 OpenSSLAdapter::OpenSSLAdapter(AsyncSocket* socket)
271 : SSLAdapter(socket), 263 : SSLAdapter(socket),
272 state_(SSL_NONE), 264 state_(SSL_NONE),
273 ssl_read_needs_write_(false), 265 ssl_read_needs_write_(false),
274 ssl_write_needs_read_(false), 266 ssl_write_needs_read_(false),
275 restartable_(false), 267 restartable_(false),
276 ssl_(NULL), ssl_ctx_(NULL), 268 ssl_(nullptr),
277 ssl_mode_(SSL_MODE_TLS), 269 ssl_ctx_(nullptr),
278 custom_verification_succeeded_(false) { 270 ssl_mode_(SSL_MODE_TLS),
279 } 271 custom_verification_succeeded_(false) {}
280 272
281 OpenSSLAdapter::~OpenSSLAdapter() { 273 OpenSSLAdapter::~OpenSSLAdapter() {
282 Cleanup(); 274 Cleanup();
283 } 275 }
284 276
285 void 277 void
286 OpenSSLAdapter::SetMode(SSLMode mode) { 278 OpenSSLAdapter::SetMode(SSLMode mode) {
287 RTC_DCHECK(state_ == SSL_NONE); 279 RTC_DCHECK(state_ == SSL_NONE);
288 ssl_mode_ = mode; 280 ssl_mode_ = mode;
289 } 281 }
(...skipping 19 matching lines...) Expand all
309 301
310 return 0; 302 return 0;
311 } 303 }
312 304
313 int 305 int
314 OpenSSLAdapter::BeginSSL() { 306 OpenSSLAdapter::BeginSSL() {
315 LOG(LS_INFO) << "BeginSSL: " << ssl_host_name_; 307 LOG(LS_INFO) << "BeginSSL: " << ssl_host_name_;
316 RTC_DCHECK(state_ == SSL_CONNECTING); 308 RTC_DCHECK(state_ == SSL_CONNECTING);
317 309
318 int err = 0; 310 int err = 0;
319 BIO* bio = NULL; 311 BIO* bio = nullptr;
320 312
321 // First set up the context 313 // First set up the context
322 if (!ssl_ctx_) 314 if (!ssl_ctx_)
323 ssl_ctx_ = SetupSSLContext(); 315 ssl_ctx_ = SetupSSLContext();
324 316
325 if (!ssl_ctx_) { 317 if (!ssl_ctx_) {
326 err = -1; 318 err = -1;
327 goto ssl_error; 319 goto ssl_error;
328 } 320 }
329 321
330 bio = BIO_new_socket(socket_); 322 bio = BIO_new_socket(socket_);
331 if (!bio) { 323 if (!bio) {
332 err = -1; 324 err = -1;
333 goto ssl_error; 325 goto ssl_error;
334 } 326 }
335 327
336 ssl_ = SSL_new(ssl_ctx_); 328 ssl_ = SSL_new(ssl_ctx_);
337 if (!ssl_) { 329 if (!ssl_) {
338 err = -1; 330 err = -1;
339 goto ssl_error; 331 goto ssl_error;
340 } 332 }
341 333
342 SSL_set_app_data(ssl_, this); 334 SSL_set_app_data(ssl_, this);
343 335
344 SSL_set_bio(ssl_, bio, bio); 336 SSL_set_bio(ssl_, bio, bio);
345 SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE | 337 SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE |
346 SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER); 338 SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
347 339
348 // the SSL object owns the bio now 340 // the SSL object owns the bio now
349 bio = NULL; 341 bio = nullptr;
350 342
351 // Do the connect 343 // Do the connect
352 err = ContinueSSL(); 344 err = ContinueSSL();
353 if (err != 0) 345 if (err != 0)
354 goto ssl_error; 346 goto ssl_error;
355 347
356 return err; 348 return err;
357 349
358 ssl_error: 350 ssl_error:
359 Cleanup(); 351 Cleanup();
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after
430 OpenSSLAdapter::Cleanup() { 422 OpenSSLAdapter::Cleanup() {
431 LOG(LS_INFO) << "Cleanup"; 423 LOG(LS_INFO) << "Cleanup";
432 424
433 state_ = SSL_NONE; 425 state_ = SSL_NONE;
434 ssl_read_needs_write_ = false; 426 ssl_read_needs_write_ = false;
435 ssl_write_needs_read_ = false; 427 ssl_write_needs_read_ = false;
436 custom_verification_succeeded_ = false; 428 custom_verification_succeeded_ = false;
437 429
438 if (ssl_) { 430 if (ssl_) {
439 SSL_free(ssl_); 431 SSL_free(ssl_);
440 ssl_ = NULL; 432 ssl_ = nullptr;
441 } 433 }
442 434
443 if (ssl_ctx_) { 435 if (ssl_ctx_) {
444 SSL_CTX_free(ssl_ctx_); 436 SSL_CTX_free(ssl_ctx_);
445 ssl_ctx_ = NULL; 437 ssl_ctx_ = nullptr;
446 } 438 }
447 439
448 // Clear the DTLS timer 440 // Clear the DTLS timer
449 Thread::Current()->Clear(this, MSG_TIMEOUT); 441 Thread::Current()->Clear(this, MSG_TIMEOUT);
450 } 442 }
451 443
452 // 444 //
453 // AsyncSocket Implementation 445 // AsyncSocket Implementation
454 // 446 //
455 447
(...skipping 244 matching lines...) Expand 10 before | Expand all | Expand 10 after
700 AsyncSocketAdapter::OnCloseEvent(socket, err); 692 AsyncSocketAdapter::OnCloseEvent(socket, err);
701 } 693 }
702 694
703 bool OpenSSLAdapter::VerifyServerName(SSL* ssl, const char* host, 695 bool OpenSSLAdapter::VerifyServerName(SSL* ssl, const char* host,
704 bool ignore_bad_cert) { 696 bool ignore_bad_cert) {
705 if (!host) 697 if (!host)
706 return false; 698 return false;
707 699
708 // Checking the return from SSL_get_peer_certificate here is not strictly 700 // Checking the return from SSL_get_peer_certificate here is not strictly
709 // necessary. With our setup, it is not possible for it to return 701 // necessary. With our setup, it is not possible for it to return
710 // NULL. However, it is good form to check the return. 702 // null. However, it is good form to check the return.
711 X509* certificate = SSL_get_peer_certificate(ssl); 703 X509* certificate = SSL_get_peer_certificate(ssl);
712 if (!certificate) 704 if (!certificate)
713 return false; 705 return false;
714 706
715 // Logging certificates is extremely verbose. So it is disabled by default. 707 // Logging certificates is extremely verbose. So it is disabled by default.
716 #ifdef LOG_CERTIFICATES 708 #ifdef LOG_CERTIFICATES
717 { 709 {
718 LOG(LS_INFO) << "Certificate from server:"; 710 LOG(LS_INFO) << "Certificate from server:";
719 BIO* mem = BIO_new(BIO_s_mem()); 711 BIO* mem = BIO_new(BIO_s_mem());
720 X509_print_ex(mem, certificate, XN_FLAG_SEP_CPLUS_SPC, X509_FLAG_NO_HEADER); 712 X509_print_ex(mem, certificate, XN_FLAG_SEP_CPLUS_SPC, X509_FLAG_NO_HEADER);
721 BIO_write(mem, "\0", 1); 713 BIO_write(mem, "\0", 1);
722 char* buffer; 714 char* buffer;
723 BIO_get_mem_data(mem, &buffer); 715 BIO_get_mem_data(mem, &buffer);
724 LOG(LS_INFO) << buffer; 716 LOG(LS_INFO) << buffer;
725 BIO_free(mem); 717 BIO_free(mem);
726 718
727 char* cipher_description = 719 char* cipher_description =
728 SSL_CIPHER_description(SSL_get_current_cipher(ssl), NULL, 128); 720 SSL_CIPHER_description(SSL_get_current_cipher(ssl), nullptr, 128);
729 LOG(LS_INFO) << "Cipher: " << cipher_description; 721 LOG(LS_INFO) << "Cipher: " << cipher_description;
730 OPENSSL_free(cipher_description); 722 OPENSSL_free(cipher_description);
731 } 723 }
732 #endif 724 #endif
733 725
734 bool ok = false; 726 bool ok = false;
735 GENERAL_NAMES* names = reinterpret_cast<GENERAL_NAMES*>( 727 GENERAL_NAMES* names = reinterpret_cast<GENERAL_NAMES*>(
736 X509_get_ext_d2i(certificate, NID_subject_alt_name, nullptr, nullptr)); 728 X509_get_ext_d2i(certificate, NID_subject_alt_name, nullptr, nullptr));
737 if (names) { 729 if (names) {
738 for (size_t i = 0; i < sk_GENERAL_NAME_num(names); i++) { 730 for (size_t i = 0; i < sk_GENERAL_NAME_num(names); i++) {
739 const GENERAL_NAME* name = sk_GENERAL_NAME_value(names, i); 731 const GENERAL_NAME* name = sk_GENERAL_NAME_value(names, i);
740 if (name->type != GEN_DNS) 732 if (name->type != GEN_DNS)
741 continue; 733 continue;
742 std::string value( 734 std::string value(
743 reinterpret_cast<const char*>(ASN1_STRING_data(name->d.dNSName)), 735 reinterpret_cast<const char*>(ASN1_STRING_data(name->d.dNSName)),
744 ASN1_STRING_length(name->d.dNSName)); 736 ASN1_STRING_length(name->d.dNSName));
745 // string_match takes NUL-terminated strings, so check for embedded NULs. 737 // string_match takes NUL-terminated strings, so check for embedded NULs.
746 if (value.find('\0') != std::string::npos) 738 if (value.find('\0') != std::string::npos)
747 continue; 739 continue;
748 if (string_match(host, value.c_str())) { 740 if (string_match(host, value.c_str())) {
749 ok = true; 741 ok = true;
750 break; 742 break;
751 } 743 }
752 } 744 }
753 GENERAL_NAMES_free(names); 745 GENERAL_NAMES_free(names);
754 } 746 }
755 747
756 char data[256]; 748 char data[256];
757 X509_NAME* subject; 749 X509_NAME* subject;
758 if (!ok 750 if (!ok && ((subject = X509_get_subject_name(certificate)) != nullptr) &&
759 && ((subject = X509_get_subject_name(certificate)) != NULL) 751 (X509_NAME_get_text_by_NID(subject, NID_commonName, data, sizeof(data)) >
760 && (X509_NAME_get_text_by_NID(subject, NID_commonName, 752 0)) {
761 data, sizeof(data)) > 0)) {
762 data[sizeof(data)-1] = 0; 753 data[sizeof(data)-1] = 0;
763 if (_stricmp(data, host) == 0) 754 if (_stricmp(data, host) == 0)
764 ok = true; 755 ok = true;
765 } 756 }
766 757
767 X509_free(certificate); 758 X509_free(certificate);
768 759
769 // This should only ever be turned on for debugging and development. 760 // This should only ever be turned on for debugging and development.
770 if (!ok && ignore_bad_cert) { 761 if (!ok && ignore_bad_cert) {
771 LOG(LS_WARNING) << "TLS certificate check FAILED. " 762 LOG(LS_WARNING) << "TLS certificate check FAILED. "
(...skipping 96 matching lines...) Expand 10 before | Expand all | Expand 10 after
868 859
869 return ok; 860 return ok;
870 } 861 }
871 862
872 bool OpenSSLAdapter::ConfigureTrustedRootCertificates(SSL_CTX* ctx) { 863 bool OpenSSLAdapter::ConfigureTrustedRootCertificates(SSL_CTX* ctx) {
873 // Add the root cert that we care about to the SSL context 864 // Add the root cert that we care about to the SSL context
874 int count_of_added_certs = 0; 865 int count_of_added_certs = 0;
875 for (size_t i = 0; i < arraysize(kSSLCertCertificateList); i++) { 866 for (size_t i = 0; i < arraysize(kSSLCertCertificateList); i++) {
876 const unsigned char* cert_buffer = kSSLCertCertificateList[i]; 867 const unsigned char* cert_buffer = kSSLCertCertificateList[i];
877 size_t cert_buffer_len = kSSLCertCertificateSizeList[i]; 868 size_t cert_buffer_len = kSSLCertCertificateSizeList[i];
878 X509* cert = d2i_X509(NULL, &cert_buffer, 869 X509* cert =
879 checked_cast<long>(cert_buffer_len)); 870 d2i_X509(nullptr, &cert_buffer, checked_cast<long>(cert_buffer_len));
880 if (cert) { 871 if (cert) {
881 int return_value = X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), cert); 872 int return_value = X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), cert);
882 if (return_value == 0) { 873 if (return_value == 0) {
883 LOG(LS_WARNING) << "Unable to add certificate."; 874 LOG(LS_WARNING) << "Unable to add certificate.";
884 } else { 875 } else {
885 count_of_added_certs++; 876 count_of_added_certs++;
886 } 877 }
887 X509_free(cert); 878 X509_free(cert);
888 } 879 }
889 } 880 }
890 return count_of_added_certs > 0; 881 return count_of_added_certs > 0;
891 } 882 }
892 883
893 SSL_CTX* 884 SSL_CTX*
894 OpenSSLAdapter::SetupSSLContext() { 885 OpenSSLAdapter::SetupSSLContext() {
895 SSL_CTX* ctx = SSL_CTX_new(ssl_mode_ == SSL_MODE_DTLS ? 886 SSL_CTX* ctx = SSL_CTX_new(ssl_mode_ == SSL_MODE_DTLS ?
896 DTLSv1_client_method() : TLSv1_client_method()); 887 DTLSv1_client_method() : TLSv1_client_method());
897 if (ctx == NULL) { 888 if (ctx == nullptr) {
898 unsigned long error = ERR_get_error(); // NOLINT: type used by OpenSSL. 889 unsigned long error = ERR_get_error(); // NOLINT: type used by OpenSSL.
899 LOG(LS_WARNING) << "SSL_CTX creation failed: " 890 LOG(LS_WARNING) << "SSL_CTX creation failed: "
900 << '"' << ERR_reason_error_string(error) << "\" " 891 << '"' << ERR_reason_error_string(error) << "\" "
901 << "(error=" << error << ')'; 892 << "(error=" << error << ')';
902 return NULL; 893 return nullptr;
903 } 894 }
904 if (!ConfigureTrustedRootCertificates(ctx)) { 895 if (!ConfigureTrustedRootCertificates(ctx)) {
905 SSL_CTX_free(ctx); 896 SSL_CTX_free(ctx);
906 return NULL; 897 return nullptr;
907 } 898 }
908 899
909 #if !defined(NDEBUG) 900 #if !defined(NDEBUG)
910 SSL_CTX_set_info_callback(ctx, SSLInfoCallback); 901 SSL_CTX_set_info_callback(ctx, SSLInfoCallback);
911 #endif 902 #endif
912 903
913 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, SSLVerifyCallback); 904 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, SSLVerifyCallback);
914 SSL_CTX_set_verify_depth(ctx, 4); 905 SSL_CTX_set_verify_depth(ctx, 4);
915 SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"); 906 SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
916 907
917 if (ssl_mode_ == SSL_MODE_DTLS) { 908 if (ssl_mode_ == SSL_MODE_DTLS) {
918 SSL_CTX_set_read_ahead(ctx, 1); 909 SSL_CTX_set_read_ahead(ctx, 1);
919 } 910 }
920 911
921 return ctx; 912 return ctx;
922 } 913 }
923 914
924 } // namespace rtc 915 } // namespace rtc
OLDNEW
« no previous file with comments | « webrtc/base/network.cc ('k') | webrtc/base/openssldigest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698