Changeset 159632 in webkit

Timestamp:

Nov 21, 2013 9:43:06 AM (10 years ago)

Author:

commit-queue@webkit.org

Message:

[curl]Improve ssl certificate storage and check
​https://bugs.webkit.org/show_bug.cgi?id=124569

Patch by Robert Sipka <​sipka@inf.u-szeged.hu> on 2013-11-21
Reviewed by Brent Fulgham.

Storage and check the whole certificate chain, not just the root certificate.

• platform/network/curl/SSLHandle.cpp:

(WebCore::allowsAnyHTTPSCertificateHosts):
(WebCore::sslIgnoreHTTPSCertificate):
(WebCore::pemData):
(WebCore::certVerifyCallback):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/network/curl/SSLHandle.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-11-21  Robert Sipka  <sipka@inf.u-szeged.hu>
+
+        [curl]Improve ssl certificate storage and check
+        https://bugs.webkit.org/show_bug.cgi?id=124569
+
+        Reviewed by Brent Fulgham.
+
+        Storage and check the whole certificate chain, not just the root certificate.
+
+        * platform/network/curl/SSLHandle.cpp:
+        (WebCore::allowsAnyHTTPSCertificateHosts):
+        (WebCore::sslIgnoreHTTPSCertificate):
+        (WebCore::pemData):
+        (WebCore::certVerifyCallback):
+
 2013-11-21  Mihai Maerean  <mmaerean@adobe.com>
 

trunk/Source/WebCore/platform/network/curl/SSLHandle.cpp

@@ -33 +33 @@
 #include <openssl/ssl.h>
 #include <openssl/x509_vfy.h>
+#include <wtf/HashSet.h>
 
 namespace WebCore {
 
-static HashMap<String, String> allowedHosts;
+static HashMap<String, HashSet<String>> allowedHosts;
 
 void allowsAnyHTTPSCertificateHosts(const String& host)
 {
-    HashMap<String, String>::iterator it = allowedHosts.find(host);
-    if (it != allowedHosts.end())
-        it->value = String();
-    else
-        allowedHosts.add(host, String());
-}
-
-bool sslIgnoreHTTPSCertificate(const String& host, const String& cert)
-{
-    HashMap<String, String>::iterator it = allowedHosts.find(host);
+    HashSet<String> certificates;
+    allowedHosts.set(host, certificates);
+}
+
+bool sslIgnoreHTTPSCertificate(const String& host, const HashSet<String>& certificates)
+{
+    HashMap<String, HashSet<String>>::iterator it = allowedHosts.find(host);
     if (it != allowedHosts.end()) {
         if ((it->value).isEmpty()) {
-            it->value = cert;
+            it->value = certificates;
             return true;
         }
-        if (it->value == cert)
-            return true;
+        if (certificates.size() != it->value.size())
+            return false;
+        HashSet<String>::const_iterator certsIter = certificates.begin();
+        HashSet<String>::iterator valueIter = (it->value).begin();
+        for (; valueIter != (it->value).end(); ++valueIter, ++certsIter) {
+            if (*certsIter != *valueIter)
+                return false;
+        }
+        return true;
     }
     return false;
@@ -119 +124 @@
 
 #if !PLATFORM(WIN)
-// success of certificate extraction
-bool pemData(X509_STORE_CTX* ctx, String& certificate)
-{
-    X509* errCert = X509_STORE_CTX_get_current_cert(ctx);
-
-    // get the cert in PEM format
-    BIO* bio = BIO_new(BIO_s_mem());
-
-    int res = PEM_write_bio_X509(bio, errCert);
-    if (!res) {
+// success of certificates extraction
+bool pemData(X509_STORE_CTX* ctx, HashSet<String>& certificates)
+{
+    bool ok = true;
+    STACK_OF(X509)* certs = X509_STORE_CTX_get1_chain(ctx);
+    for (int i = 0; i < sk_X509_num(certs); i++) {
+        X509* uCert = sk_X509_value(certs, i);
+        BIO* bio = BIO_new(BIO_s_mem());
+        int res = PEM_write_bio_X509(bio, uCert);
+        if (!res) {
+            ok = false;
+            BIO_free(bio);
+            break;
+        }
+
+        unsigned char* certificateData;
+        long length = BIO_get_mem_data(bio, &certificateData);
+        if (length < 0) {
+            ok = false;
+            BIO_free(bio);
+            break;
+        }
+
+        certificateData[length] = '\0';
+        String certificate = certificateData;
+        certificates.add(certificate);
         BIO_free(bio);
-        return false;
-    }
-
-    unsigned char* data;
-    long len = BIO_get_mem_data(bio, &data);
-    if (len < 0) {
-        BIO_free(bio);
-        return false;
-    }
-
-    data[len] = '\0';
-    certificate = data;
-    BIO_free(bio);
-    return true;
+    }
+        sk_X509_pop_free(certs, X509_free);
+        return ok;
 }
 #endif
@@ -167 +177 @@
     ok = (it != allowedHosts.end());
 #else
-    String certificate;
-    if (!pemData(ctx, certificate))
+    HashSet<String> certificates;
+    if (!pemData(ctx, certificates))
         return 0;
-    ok = sslIgnoreHTTPSCertificate(host.lower(), certificate);
+    ok = sslIgnoreHTTPSCertificate(host.lower(), certificates);
 #endif