Changeset 285838 in webkit

Timestamp:

Nov 15, 2021, 2:44:13 PM (5 years ago)

Author:

Takashi.Komori@sony.com

Message:

[Curl] Security information sometimes do not appear in inspector network tab
​https://bugs.webkit.org/show_bug.cgi?id=232971

Reviewed by Fujii Hironori.

Get certificate information from SSL context when CurlSSLVerifier is empty.

No tests yet.

• platform/network/curl/CertificateInfo.h:
• platform/network/curl/CurlContext.cpp:

(WebCore:: const):
(WebCore::CurlHandle::addExtraNetworkLoadMetrics):
(WebCore::CurlHandle::certificateInfo const):

• platform/network/curl/CurlContext.h:
• platform/network/curl/OpenSSLHelper.cpp:

(OpenSSL::StackOfX509::StackOfX509):
(OpenSSL::StackOfX509::~StackOfX509):
(OpenSSL::pemDataFromCtx):
(OpenSSL::createCertificateInfo):

• platform/network/curl/OpenSSLHelper.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/network/curl/CertificateInfo.h (modified) (1 diff)
• platform/network/curl/CurlContext.cpp (modified) (3 diffs)
• platform/network/curl/CurlContext.h (modified) (3 diffs)
• platform/network/curl/OpenSSLHelper.cpp (modified) (6 diffs)
• platform/network/curl/OpenSSLHelper.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-15  Takashi Komori  <Takashi.Komori@sony.com>
+
+        [Curl] Security information sometimes do not appear in inspector network tab
+        https://bugs.webkit.org/show_bug.cgi?id=232971
+
+        Reviewed by Fujii Hironori.
+
+        Get certificate information from SSL context when CurlSSLVerifier is empty.
+
+        No tests yet.
+
+        * platform/network/curl/CertificateInfo.h:
+        * platform/network/curl/CurlContext.cpp:
+        (WebCore:: const):
+        (WebCore::CurlHandle::addExtraNetworkLoadMetrics):
+        (WebCore::CurlHandle::certificateInfo const):
+        * platform/network/curl/CurlContext.h:
+        * platform/network/curl/OpenSSLHelper.cpp:
+        (OpenSSL::StackOfX509::StackOfX509):
+        (OpenSSL::StackOfX509::~StackOfX509):
+        (OpenSSL::pemDataFromCtx):
+        (OpenSSL::createCertificateInfo):
+        * platform/network/curl/OpenSSLHelper.h:
+
 2021-11-15  Kiet Ho  <tho22@apple.com>
 

trunk/Source/WebCore/platform/network/curl/CertificateInfo.h

@@ -36 +36 @@
 
 class CertificateInfo {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     using Certificate = Vector<uint8_t>;

trunk/Source/WebCore/platform/network/curl/CurlContext.cpp

@@ -777 +777 @@
 }
 
+std::optional<SSL*> CurlHandle::sslConnection() const
+{
+    curl_tlssessioninfo* info = nullptr;
+
+    auto errorCode = curl_easy_getinfo(m_handle, CURLINFO_TLS_SSL_PTR, &info);
+    if (errorCode != CURLE_OK)
+        return std::nullopt;
+
+    if (!info || info->backend != CURLSSLBACKEND_OPENSSL || !info->internals)
+        return std::nullopt;
+
+    return static_cast<SSL*>(info->internals);
+}
+
 std::optional<NetworkLoadMetrics> CurlHandle::getNetworkLoadMetrics(MonotonicTime startTime)
 {
@@ -872 +886 @@
     auto additionalMetrics = AdditionalNetworkLoadMetricsForWebInspector::create();
     if (!m_tlsConnectionInfo) {
-        curl_tlssessioninfo* info = nullptr;
-
-        errorCode = curl_easy_getinfo(m_handle, CURLINFO_TLS_SSL_PTR, &info);
-        if (errorCode != CURLE_OK)
-            return;
-
-        if (info && info->backend == CURLSSLBACKEND_OPENSSL && info->internals) {
-            auto ssl = static_cast<SSL*>(info->internals);
-
+        if (auto ssl = sslConnection()) {
             m_tlsConnectionInfo = makeUnique<TLSConnectionInfo>();
-            m_tlsConnectionInfo->protocol = OpenSSL::tlsVersion(ssl);
-            m_tlsConnectionInfo->cipher = OpenSSL::tlsCipherName(ssl);
+            m_tlsConnectionInfo->protocol = OpenSSL::tlsVersion(*ssl);
+            m_tlsConnectionInfo->cipher = OpenSSL::tlsCipherName(*ssl);
         }
     }
@@ -907 +913 @@
 std::optional<CertificateInfo> CurlHandle::certificateInfo() const
 {
-    if (!m_sslVerifier)
-        return std::nullopt;
-
-    return m_sslVerifier->certificateInfo();
+    if (m_sslVerifier && !m_sslVerifier->certificateInfo().isEmpty())
+        return m_sslVerifier->certificateInfo();
+
+    // If you use an existing HTTP/2 connection, SSLVerifier does not exist.
+    if (m_certificateInfo)
+        return *m_certificateInfo;
+
+    if (auto ssl = sslConnection()) {
+        if (auto certificateInfo = OpenSSL::createCertificateInfo(*ssl)) {
+            m_certificateInfo = WTFMove(certificateInfo);
+            return *m_certificateInfo;
+        }
+    }
+
+    return std::nullopt;
 }
 

trunk/Source/WebCore/platform/network/curl/CurlContext.h

@@ -27 +27 @@
 #pragma once
 
+#include "CertificateInfo.h"
 #include "CurlProxySettings.h"
 #include "CurlSSLHandle.h"
@@ -331 +332 @@
     CURLcode willSetupSslCtx(void* sslCtx);
 
+    std::optional<SSL*> sslConnection() const;
+
     CURL* m_handle { nullptr };
     char m_errorBuffer[CURL_ERROR_SIZE] { };
@@ -339 +342 @@
     std::unique_ptr<CurlSSLVerifier> m_sslVerifier;
     std::unique_ptr<TLSConnectionInfo> m_tlsConnectionInfo;
+    mutable std::unique_ptr<CertificateInfo> m_certificateInfo;
 };
 

trunk/Source/WebCore/platform/network/curl/OpenSSLHelper.cpp

@@ -68 +68 @@
 class StackOfX509 {
 public:
+    StackOfX509(STACK_OF(X509)* certs)
+        : m_certs { certs }
+        , m_owner { false }
+    {
+    }
+
     StackOfX509(X509_STORE_CTX* ctx)
         : m_certs { X509_STORE_CTX_get1_chain(ctx) }
+        , m_owner { true }
     {
     }
@@ -75 +82 @@
     ~StackOfX509()
     {
-        if (m_certs)
+        if (m_certs && m_owner)
             sk_X509_pop_free(m_certs, X509_free);
     }
@@ -83 +90 @@
 
 private:
-    STACK_OF(X509)* m_certs { nullptr };
+    STACK_OF(X509)* m_certs;
+    bool m_owner;
 };
 
@@ -142 +150 @@
 
 
-static Vector<WebCore::CertificateInfo::Certificate> pemDataFromCtx(X509_STORE_CTX* ctx)
+static Vector<WebCore::CertificateInfo::Certificate> pemDataFromCtx(StackOfX509&& certs)
 {
     Vector<WebCore::CertificateInfo::Certificate> result;
-    StackOfX509 certs { ctx };
 
     for (int i = 0; i < certs.count(); i++) {
@@ -159 +166 @@
 }
 
+std::unique_ptr<WebCore::CertificateInfo> createCertificateInfo(SSL* ssl)
+{
+    if (!ssl)
+        return nullptr;
+
+    auto certChain = SSL_get_peer_cert_chain(ssl);
+
+    return makeUnique<WebCore::CertificateInfo>(X509_V_OK, pemDataFromCtx(StackOfX509(certChain)));
+}
+
 std::optional<WebCore::CertificateInfo> createCertificateInfo(X509_STORE_CTX* ctx)
 {
@@ -164 +181 @@
         return std::nullopt;
 
-    return WebCore::CertificateInfo(X509_STORE_CTX_get_error(ctx), pemDataFromCtx(ctx));
+    return WebCore::CertificateInfo(X509_STORE_CTX_get_error(ctx), pemDataFromCtx(StackOfX509(ctx)));
 }
 

trunk/Source/WebCore/platform/network/curl/OpenSSLHelper.h

@@ -32 +32 @@
 namespace OpenSSL {
 
+std::unique_ptr<WebCore::CertificateInfo> createCertificateInfo(SSL*);
 std::optional<WebCore::CertificateInfo> createCertificateInfo(X509_STORE_CTX*);
 std::optional<WebCore::CertificateSummary> createSummaryInfo(const Vector<uint8_t>& pem);