net/ocsp/nss_ocsp.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/ocsp/nss_ocsp.h"
   6
   7 #include <certt.h>
   8 #include <certdb.h>
   9 #include <ocsp.h>
  10 #include <nspr.h>
  11 #include <nss.h>
  12 #include <pthread.h>
  13 #include <secerr.h>
  14
  15 #include <algorithm>
  16 #include <string>
  17
  18 #include "base/basictypes.h"
  19 #include "base/callback.h"
  20 #include "base/compiler_specific.h"
  21 #include "base/lazy_instance.h"
  22 #include "base/logging.h"
  23 #include "base/message_loop/message_loop.h"
  24 #include "base/metrics/histogram.h"
  25 #include "base/stl_util.h"
  26 #include "base/strings/string_util.h"
  27 #include "base/strings/stringprintf.h"
  28 #include "base/synchronization/condition_variable.h"
  29 #include "base/synchronization/lock.h"
  30 #include "base/threading/thread_checker.h"
  31 #include "base/time/time.h"
  32 #include "net/base/host_port_pair.h"
  33 #include "net/base/io_buffer.h"
  34 #include "net/base/load_flags.h"
  35 #include "net/base/request_priority.h"
  36 #include "net/base/upload_bytes_element_reader.h"
  37 #include "net/base/upload_data_stream.h"
  38 #include "net/http/http_request_headers.h"
  39 #include "net/http/http_response_headers.h"
  40 #include "net/url_request/url_request.h"
  41 #include "net/url_request/url_request_context.h"
  42 #include "url/gurl.h"
  43
  44 namespace net {
  45
  46 namespace {
  47
  48 // Protects |g_request_context|.
  49 pthread_mutex_t g_request_context_lock = PTHREAD_MUTEX_INITIALIZER;
  50 URLRequestContext* g_request_context = NULL;
  51
  52 // The default timeout for network fetches in NSS is 60 seconds. Choose a
  53 // saner upper limit for OCSP/CRL/AIA fetches.
  54 const int kNetworkFetchTimeoutInSecs = 15;
  55
  56 class OCSPRequestSession;
  57
  58 class OCSPIOLoop {
  59  public:
  60   void StartUsing() {
  61     base::AutoLock autolock(lock_);
  62     used_ = true;
  63     io_loop_ = base::MessageLoopForIO::current();
  64     DCHECK(io_loop_);
  65   }
  66
  67   // Called on IO loop.
  68   void Shutdown();
  69
  70   bool used() const {
  71     base::AutoLock autolock(lock_);
  72     return used_;
  73   }
  74
  75   // Called from worker thread.
  76   void PostTaskToIOLoop(const tracked_objects::Location& from_here,
  77                         const base::Closure& task);
  78
  79   void EnsureIOLoop();
  80
  81   void AddRequest(OCSPRequestSession* request);
  82   void RemoveRequest(OCSPRequestSession* request);
  83
  84   // Clears internal state and calls |StartUsing()|. Should be called only in
  85   // the context of testing.
  86   void ReuseForTesting() {
  87     {
  88       base::AutoLock autolock(lock_);
  89       DCHECK(base::MessageLoopForIO::current());
  90       thread_checker_.DetachFromThread();
  91
  92       // CalledOnValidThread is the only available API to reassociate
  93       // thread_checker_ with the current thread. Result ignored intentionally.
  94       ignore_result(thread_checker_.CalledOnValidThread());
  95       shutdown_ = false;
  96       used_ = false;
  97     }
  98     StartUsing();
  99   }
 100
 101  private:
 102   friend struct base::DefaultLazyInstanceTraits<OCSPIOLoop>;
 103
 104   OCSPIOLoop();
 105   ~OCSPIOLoop();
 106
 107   void CancelAllRequests();
 108
 109   mutable base::Lock lock_;
 110   bool shutdown_;  // Protected by |lock_|.
 111   std::set<OCSPRequestSession*> requests_;  // Protected by |lock_|.
 112   bool used_;  // Protected by |lock_|.
 113   // This should not be modified after |used_|.
 114   base::MessageLoopForIO* io_loop_;  // Protected by |lock_|.
 115   base::ThreadChecker thread_checker_;
 116
 117   DISALLOW_COPY_AND_ASSIGN(OCSPIOLoop);
 118 };
 119
 120 base::LazyInstance<OCSPIOLoop>::Leaky
 121     g_ocsp_io_loop = LAZY_INSTANCE_INITIALIZER;
 122
 123 const int kRecvBufferSize = 4096;
 124
 125 // All OCSP handlers should be called in the context of
 126 // CertVerifier's thread (i.e. worker pool, not on the I/O thread).
 127 // It supports blocking mode only.
 128
 129 SECStatus OCSPCreateSession(const char* host, PRUint16 portnum,
 130                             SEC_HTTP_SERVER_SESSION* pSession);
 131 SECStatus OCSPKeepAliveSession(SEC_HTTP_SERVER_SESSION session,
 132                                PRPollDesc **pPollDesc);
 133 SECStatus OCSPFreeSession(SEC_HTTP_SERVER_SESSION session);
 134
 135 SECStatus OCSPCreate(SEC_HTTP_SERVER_SESSION session,
 136                      const char* http_protocol_variant,
 137                      const char* path_and_query_string,
 138                      const char* http_request_method,
 139                      const PRIntervalTime timeout,
 140                      SEC_HTTP_REQUEST_SESSION* pRequest);
 141 SECStatus OCSPSetPostData(SEC_HTTP_REQUEST_SESSION request,
 142                           const char* http_data,
 143                           const PRUint32 http_data_len,
 144                           const char* http_content_type);
 145 SECStatus OCSPAddHeader(SEC_HTTP_REQUEST_SESSION request,
 146                         const char* http_header_name,
 147                         const char* http_header_value);
 148 SECStatus OCSPTrySendAndReceive(SEC_HTTP_REQUEST_SESSION request,
 149                                 PRPollDesc** pPollDesc,
 150                                 PRUint16* http_response_code,
 151                                 const char** http_response_content_type,
 152                                 const char** http_response_headers,
 153                                 const char** http_response_data,
 154                                 PRUint32* http_response_data_len);
 155 SECStatus OCSPFree(SEC_HTTP_REQUEST_SESSION request);
 156
 157 char* GetAlternateOCSPAIAInfo(CERTCertificate *cert);
 158
 159 class OCSPNSSInitialization {
 160  private:
 161   friend struct base::DefaultLazyInstanceTraits<OCSPNSSInitialization>;
 162
 163   OCSPNSSInitialization();
 164   ~OCSPNSSInitialization();
 165
 166   SEC_HttpClientFcn client_fcn_;
 167
 168   DISALLOW_COPY_AND_ASSIGN(OCSPNSSInitialization);
 169 };
 170
 171 base::LazyInstance<OCSPNSSInitialization> g_ocsp_nss_initialization =
 172     LAZY_INSTANCE_INITIALIZER;
 173
 174 // Concrete class for SEC_HTTP_REQUEST_SESSION.
 175 // Public methods except virtual methods of URLRequest::Delegate
 176 // (On* methods) run on certificate verifier thread (worker thread).
 177 // Virtual methods of URLRequest::Delegate and private methods run
 178 // on IO thread.
 179 class OCSPRequestSession
 180     : public base::RefCountedThreadSafe<OCSPRequestSession>,
 181       public URLRequest::Delegate {
 182  public:
 183   OCSPRequestSession(const GURL& url,
 184                      const char* http_request_method,
 185                      base::TimeDelta timeout)
 186       : url_(url),
 187         http_request_method_(http_request_method),
 188         timeout_(timeout),
 189         request_(NULL),
 190         buffer_(new IOBuffer(kRecvBufferSize)),
 191         response_code_(-1),
 192         cv_(&lock_),
 193         io_loop_(NULL),
 194         finished_(false) {}
 195
 196   void SetPostData(const char* http_data, PRUint32 http_data_len,
 197                    const char* http_content_type) {
 198     // |upload_content_| should not be modified if |request_| is active.
 199     DCHECK(!request_);
 200     upload_content_.assign(http_data, http_data_len);
 201     upload_content_type_.assign(http_content_type);
 202   }
 203
 204   void AddHeader(const char* http_header_name, const char* http_header_value) {
 205     extra_request_headers_.SetHeader(http_header_name,
 206                                      http_header_value);
 207   }
 208
 209   void Start() {
 210     // At this point, it runs on worker thread.
 211     // |io_loop_| was initialized to be NULL in constructor, and
 212     // set only in StartURLRequest, so no need to lock |lock_| here.
 213     DCHECK(!io_loop_);
 214     g_ocsp_io_loop.Get().PostTaskToIOLoop(
 215         FROM_HERE,
 216         base::Bind(&OCSPRequestSession::StartURLRequest, this));
 217   }
 218
 219   bool Started() const {
 220     return request_ != NULL;
 221   }
 222
 223   void Cancel() {
 224     // IO thread may set |io_loop_| to NULL, so protect by |lock_|.
 225     base::AutoLock autolock(lock_);
 226     CancelLocked();
 227   }
 228
 229   bool Finished() const {
 230     base::AutoLock autolock(lock_);
 231     return finished_;
 232   }
 233
 234   bool Wait() {
 235     base::TimeDelta timeout = timeout_;
 236     base::AutoLock autolock(lock_);
 237     while (!finished_) {
 238       base::TimeTicks last_time = base::TimeTicks::Now();
 239       cv_.TimedWait(timeout);
 240       // Check elapsed time
 241       base::TimeDelta elapsed_time = base::TimeTicks::Now() - last_time;
 242       timeout -= elapsed_time;
 243       if (timeout < base::TimeDelta()) {
 244         VLOG(1) << "OCSP Timed out";
 245         if (!finished_)
 246           CancelLocked();
 247         break;
 248       }
 249     }
 250     return finished_;
 251   }
 252
 253   const GURL& url() const {
 254     return url_;
 255   }
 256
 257   const std::string& http_request_method() const {
 258     return http_request_method_;
 259   }
 260
 261   base::TimeDelta timeout() const {
 262     return timeout_;
 263   }
 264
 265   PRUint16 http_response_code() const {
 266     DCHECK(finished_);
 267     return response_code_;
 268   }
 269
 270   const std::string& http_response_content_type() const {
 271     DCHECK(finished_);
 272     return response_content_type_;
 273   }
 274
 275   const std::string& http_response_headers() const {
 276     DCHECK(finished_);
 277     return response_headers_->raw_headers();
 278   }
 279
 280   const std::string& http_response_data() const {
 281     DCHECK(finished_);
 282     return data_;
 283   }
 284
 285   virtual void OnReceivedRedirect(URLRequest* request,
 286                                   const GURL& new_url,
 287                                   bool* defer_redirect) OVERRIDE {
 288     DCHECK_EQ(request, request_);
 289     DCHECK_EQ(base::MessageLoopForIO::current(), io_loop_);
 290
 291     if (!new_url.SchemeIs("http")) {
 292       // Prevent redirects to non-HTTP schemes, including HTTPS. This matches
 293       // the initial check in OCSPServerSession::CreateRequest().
 294       CancelURLRequest();
 295     }
 296   }
 297
 298   virtual void OnResponseStarted(URLRequest* request) OVERRIDE {
 299     DCHECK_EQ(request, request_);
 300     DCHECK_EQ(base::MessageLoopForIO::current(), io_loop_);
 301
 302     int bytes_read = 0;
 303     if (request->status().is_success()) {
 304       response_code_ = request_->GetResponseCode();
 305       response_headers_ = request_->response_headers();
 306       response_headers_->GetMimeType(&response_content_type_);
 307       request_->Read(buffer_.get(), kRecvBufferSize, &bytes_read);
 308     }
 309     OnReadCompleted(request_, bytes_read);
 310   }
 311
 312   virtual void OnReadCompleted(URLRequest* request,
 313                                int bytes_read) OVERRIDE {
 314     DCHECK_EQ(request, request_);
 315     DCHECK_EQ(base::MessageLoopForIO::current(), io_loop_);
 316
 317     do {
 318       if (!request_->status().is_success() || bytes_read <= 0)
 319         break;
 320       data_.append(buffer_->data(), bytes_read);
 321     } while (request_->Read(buffer_.get(), kRecvBufferSize, &bytes_read));
 322
 323     if (!request_->status().is_io_pending()) {
 324       delete request_;
 325       request_ = NULL;
 326       g_ocsp_io_loop.Get().RemoveRequest(this);
 327       {
 328         base::AutoLock autolock(lock_);
 329         finished_ = true;
 330         io_loop_ = NULL;
 331       }
 332       cv_.Signal();
 333       Release();  // Balanced with StartURLRequest().
 334     }
 335   }
 336
 337   // Must be called on the IO loop thread.
 338   void CancelURLRequest() {
 339 #ifndef NDEBUG
 340     {
 341       base::AutoLock autolock(lock_);
 342       if (io_loop_)
 343         DCHECK_EQ(base::MessageLoopForIO::current(), io_loop_);
 344     }
 345 #endif
 346     if (request_) {
 347       request_->Cancel();
 348       delete request_;
 349       request_ = NULL;
 350       g_ocsp_io_loop.Get().RemoveRequest(this);
 351       {
 352         base::AutoLock autolock(lock_);
 353         finished_ = true;
 354         io_loop_ = NULL;
 355       }
 356       cv_.Signal();
 357       Release();  // Balanced with StartURLRequest().
 358     }
 359   }
 360
 361  private:
 362   friend class base::RefCountedThreadSafe<OCSPRequestSession>;
 363
 364   virtual ~OCSPRequestSession() {
 365     // When this destructor is called, there should be only one thread that has
 366     // a reference to this object, and so that thread doesn't need to lock
 367     // |lock_| here.
 368     DCHECK(!request_);
 369     DCHECK(!io_loop_);
 370   }
 371
 372   // Must call this method while holding |lock_|.
 373   void CancelLocked() {
 374     lock_.AssertAcquired();
 375     if (io_loop_) {
 376       io_loop_->PostTask(
 377           FROM_HERE,
 378           base::Bind(&OCSPRequestSession::CancelURLRequest, this));
 379     }
 380   }
 381
 382   // Runs on |g_ocsp_io_loop|'s IO loop.
 383   void StartURLRequest() {
 384     DCHECK(!request_);
 385
 386     pthread_mutex_lock(&g_request_context_lock);
 387     URLRequestContext* url_request_context = g_request_context;
 388     pthread_mutex_unlock(&g_request_context_lock);
 389
 390     if (url_request_context == NULL)
 391       return;
 392
 393     {
 394       base::AutoLock autolock(lock_);
 395       DCHECK(!io_loop_);
 396       io_loop_ = base::MessageLoopForIO::current();
 397       g_ocsp_io_loop.Get().AddRequest(this);
 398     }
 399
 400     request_ =
 401         new URLRequest(url_, DEFAULT_PRIORITY, this, url_request_context);
 402     // To meet the privacy requirements of incognito mode.
 403     request_->SetLoadFlags(LOAD_DISABLE_CACHE | LOAD_DO_NOT_SAVE_COOKIES |
 404                            LOAD_DO_NOT_SEND_COOKIES);
 405
 406     if (http_request_method_ == "POST") {
 407       DCHECK(!upload_content_.empty());
 408       DCHECK(!upload_content_type_.empty());
 409
 410       request_->set_method("POST");
 411       extra_request_headers_.SetHeader(
 412           HttpRequestHeaders::kContentType, upload_content_type_);
 413
 414       scoped_ptr<UploadElementReader> reader(new UploadBytesElementReader(
 415           upload_content_.data(), upload_content_.size()));
 416       request_->set_upload(make_scoped_ptr(
 417           UploadDataStream::CreateWithReader(reader.Pass(), 0)));
 418     }
 419     if (!extra_request_headers_.IsEmpty())
 420       request_->SetExtraRequestHeaders(extra_request_headers_);
 421
 422     request_->Start();
 423     AddRef();  // Release after |request_| deleted.
 424   }
 425
 426   GURL url_;                      // The URL we eventually wound up at
 427   std::string http_request_method_;
 428   base::TimeDelta timeout_;       // The timeout for OCSP
 429   URLRequest* request_;           // The actual request this wraps
 430   scoped_refptr<IOBuffer> buffer_;  // Read buffer
 431   HttpRequestHeaders extra_request_headers_;
 432
 433   // HTTP POST payload. |request_| reads bytes from this.
 434   std::string upload_content_;
 435   std::string upload_content_type_;  // MIME type of POST payload
 436
 437   int response_code_;             // HTTP status code for the request
 438   std::string response_content_type_;
 439   scoped_refptr<HttpResponseHeaders> response_headers_;
 440   std::string data_;              // Results of the request
 441
 442   // |lock_| protects |finished_| and |io_loop_|.
 443   mutable base::Lock lock_;
 444   base::ConditionVariable cv_;
 445
 446   base::MessageLoop* io_loop_;  // Message loop of the IO thread
 447   bool finished_;
 448
 449   DISALLOW_COPY_AND_ASSIGN(OCSPRequestSession);
 450 };
 451
 452 // Concrete class for SEC_HTTP_SERVER_SESSION.
 453 class OCSPServerSession {
 454  public:
 455   OCSPServerSession(const char* host, PRUint16 port)
 456       : host_and_port_(host, port) {}
 457   ~OCSPServerSession() {}
 458
 459   OCSPRequestSession* CreateRequest(const char* http_protocol_variant,
 460                                     const char* path_and_query_string,
 461                                     const char* http_request_method,
 462                                     const PRIntervalTime timeout) {
 463     // We dont' support "https" because we haven't thought about
 464     // whether it's safe to re-enter this code from talking to an OCSP
 465     // responder over SSL.
 466     if (strcmp(http_protocol_variant, "http") != 0) {
 467       PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
 468       return NULL;
 469     }
 470
 471     std::string url_string(base::StringPrintf(
 472         "%s://%s%s",
 473         http_protocol_variant,
 474         host_and_port_.ToString().c_str(),
 475         path_and_query_string));
 476     VLOG(1) << "URL [" << url_string << "]";
 477     GURL url(url_string);
 478
 479     // NSS does not expose public functions to adjust the fetch timeout when
 480     // using libpkix, so hardcode the upper limit for network fetches.
 481     base::TimeDelta actual_timeout = std::min(
 482         base::TimeDelta::FromSeconds(kNetworkFetchTimeoutInSecs),
 483         base::TimeDelta::FromMilliseconds(PR_IntervalToMilliseconds(timeout)));
 484
 485     return new OCSPRequestSession(url, http_request_method, actual_timeout);
 486   }
 487
 488
 489  private:
 490   HostPortPair host_and_port_;
 491
 492   DISALLOW_COPY_AND_ASSIGN(OCSPServerSession);
 493 };
 494
 495 OCSPIOLoop::OCSPIOLoop()
 496     : shutdown_(false),
 497       used_(false),
 498       io_loop_(NULL) {
 499 }
 500
 501 OCSPIOLoop::~OCSPIOLoop() {
 502   // IO thread was already deleted before the singleton is deleted
 503   // in AtExitManager.
 504   {
 505     base::AutoLock autolock(lock_);
 506     DCHECK(!io_loop_);
 507     DCHECK(!used_);
 508     DCHECK(shutdown_);
 509   }
 510
 511   pthread_mutex_lock(&g_request_context_lock);
 512   DCHECK(!g_request_context);
 513   pthread_mutex_unlock(&g_request_context_lock);
 514 }
 515
 516 void OCSPIOLoop::Shutdown() {
 517   // Safe to read outside lock since we only write on IO thread anyway.
 518   DCHECK(thread_checker_.CalledOnValidThread());
 519
 520   // Prevent the worker thread from trying to access |io_loop_|.
 521   {
 522     base::AutoLock autolock(lock_);
 523     io_loop_ = NULL;
 524     used_ = false;
 525     shutdown_ = true;
 526   }
 527
 528   CancelAllRequests();
 529
 530   pthread_mutex_lock(&g_request_context_lock);
 531   g_request_context = NULL;
 532   pthread_mutex_unlock(&g_request_context_lock);
 533 }
 534
 535 void OCSPIOLoop::PostTaskToIOLoop(
 536     const tracked_objects::Location& from_here, const base::Closure& task) {
 537   base::AutoLock autolock(lock_);
 538   if (io_loop_)
 539     io_loop_->PostTask(from_here, task);
 540 }
 541
 542 void OCSPIOLoop::EnsureIOLoop() {
 543   base::AutoLock autolock(lock_);
 544   DCHECK_EQ(base::MessageLoopForIO::current(), io_loop_);
 545 }
 546
 547 void OCSPIOLoop::AddRequest(OCSPRequestSession* request) {
 548   DCHECK(!ContainsKey(requests_, request));
 549   requests_.insert(request);
 550 }
 551
 552 void OCSPIOLoop::RemoveRequest(OCSPRequestSession* request) {
 553   DCHECK(ContainsKey(requests_, request));
 554   requests_.erase(request);
 555 }
 556
 557 void OCSPIOLoop::CancelAllRequests() {
 558   // CancelURLRequest() always removes the request from the requests_
 559   // set synchronously.
 560   while (!requests_.empty())
 561     (*requests_.begin())->CancelURLRequest();
 562 }
 563
 564 OCSPNSSInitialization::OCSPNSSInitialization() {
 565   // NSS calls the functions in the function table to download certificates
 566   // or CRLs or talk to OCSP responders over HTTP.  These functions must
 567   // set an NSS/NSPR error code when they fail.  Otherwise NSS will get the
 568   // residual error code from an earlier failed function call.
 569   client_fcn_.version = 1;
 570   SEC_HttpClientFcnV1Struct *ft = &client_fcn_.fcnTable.ftable1;
 571   ft->createSessionFcn = OCSPCreateSession;
 572   ft->keepAliveSessionFcn = OCSPKeepAliveSession;
 573   ft->freeSessionFcn = OCSPFreeSession;
 574   ft->createFcn = OCSPCreate;
 575   ft->setPostDataFcn = OCSPSetPostData;
 576   ft->addHeaderFcn = OCSPAddHeader;
 577   ft->trySendAndReceiveFcn = OCSPTrySendAndReceive;
 578   ft->cancelFcn = NULL;
 579   ft->freeFcn = OCSPFree;
 580   SECStatus status = SEC_RegisterDefaultHttpClient(&client_fcn_);
 581   if (status != SECSuccess) {
 582     NOTREACHED() << "Error initializing OCSP: " << PR_GetError();
 583   }
 584
 585   // Work around NSS bugs 524013 and 564334.  NSS incorrectly thinks the
 586   // CRLs for Network Solutions Certificate Authority have bad signatures,
 587   // which causes certificates issued by that CA to be reported as revoked.
 588   // By using OCSP for those certificates, which don't have AIA extensions,
 589   // we can work around these bugs.  See http://crbug.com/41730.
 590   CERT_StringFromCertFcn old_callback = NULL;
 591   status = CERT_RegisterAlternateOCSPAIAInfoCallBack(
 592       GetAlternateOCSPAIAInfo, &old_callback);
 593   if (status == SECSuccess) {
 594     DCHECK(!old_callback);
 595   } else {
 596     NOTREACHED() << "Error initializing OCSP: " << PR_GetError();
 597   }
 598 }
 599
 600 OCSPNSSInitialization::~OCSPNSSInitialization() {
 601   SECStatus status = CERT_RegisterAlternateOCSPAIAInfoCallBack(NULL, NULL);
 602   if (status != SECSuccess) {
 603     LOG(ERROR) << "Error unregistering OCSP: " << PR_GetError();
 604   }
 605 }
 606
 607
 608 // OCSP Http Client functions.
 609 // Our Http Client functions operate in blocking mode.
 610 SECStatus OCSPCreateSession(const char* host, PRUint16 portnum,
 611                             SEC_HTTP_SERVER_SESSION* pSession) {
 612   VLOG(1) << "OCSP create session: host=" << host << " port=" << portnum;
 613   pthread_mutex_lock(&g_request_context_lock);
 614   URLRequestContext* request_context = g_request_context;
 615   pthread_mutex_unlock(&g_request_context_lock);
 616   if (request_context == NULL) {
 617     LOG(ERROR) << "No URLRequestContext for NSS HTTP handler. host: " << host;
 618     // The application failed to call SetURLRequestContextForNSSHttpIO or
 619     // has already called ShutdownNSSHttpIO, so we can't create and use
 620     // URLRequest.  PR_NOT_IMPLEMENTED_ERROR is not an accurate error
 621     // code for these error conditions, but is close enough.
 622     PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
 623     return SECFailure;
 624   }
 625   *pSession = new OCSPServerSession(host, portnum);
 626   return SECSuccess;
 627 }
 628
 629 SECStatus OCSPKeepAliveSession(SEC_HTTP_SERVER_SESSION session,
 630                                PRPollDesc **pPollDesc) {
 631   VLOG(1) << "OCSP keep alive";
 632   if (pPollDesc)
 633     *pPollDesc = NULL;
 634   return SECSuccess;
 635 }
 636
 637 SECStatus OCSPFreeSession(SEC_HTTP_SERVER_SESSION session) {
 638   VLOG(1) << "OCSP free session";
 639   delete reinterpret_cast<OCSPServerSession*>(session);
 640   return SECSuccess;
 641 }
 642
 643 SECStatus OCSPCreate(SEC_HTTP_SERVER_SESSION session,
 644                      const char* http_protocol_variant,
 645                      const char* path_and_query_string,
 646                      const char* http_request_method,
 647                      const PRIntervalTime timeout,
 648                      SEC_HTTP_REQUEST_SESSION* pRequest) {
 649   VLOG(1) << "OCSP create protocol=" << http_protocol_variant
 650           << " path_and_query=" << path_and_query_string
 651           << " http_request_method=" << http_request_method
 652           << " timeout=" << timeout;
 653   OCSPServerSession* ocsp_session =
 654       reinterpret_cast<OCSPServerSession*>(session);
 655
 656   OCSPRequestSession* req = ocsp_session->CreateRequest(http_protocol_variant,
 657                                                         path_and_query_string,
 658                                                         http_request_method,
 659                                                         timeout);
 660   SECStatus rv = SECFailure;
 661   if (req) {
 662     req->AddRef();  // Release in OCSPFree().
 663     rv = SECSuccess;
 664   }
 665   *pRequest = req;
 666   return rv;
 667 }
 668
 669 SECStatus OCSPSetPostData(SEC_HTTP_REQUEST_SESSION request,
 670                           const char* http_data,
 671                           const PRUint32 http_data_len,
 672                           const char* http_content_type) {
 673   VLOG(1) << "OCSP set post data len=" << http_data_len;
 674   OCSPRequestSession* req = reinterpret_cast<OCSPRequestSession*>(request);
 675
 676   req->SetPostData(http_data, http_data_len, http_content_type);
 677   return SECSuccess;
 678 }
 679
 680 SECStatus OCSPAddHeader(SEC_HTTP_REQUEST_SESSION request,
 681                         const char* http_header_name,
 682                         const char* http_header_value) {
 683   VLOG(1) << "OCSP add header name=" << http_header_name
 684           << " value=" << http_header_value;
 685   OCSPRequestSession* req = reinterpret_cast<OCSPRequestSession*>(request);
 686
 687   req->AddHeader(http_header_name, http_header_value);
 688   return SECSuccess;
 689 }
 690
 691 // Sets response of |req| in the output parameters.
 692 // It is helper routine for OCSP trySendAndReceiveFcn.
 693 // |http_response_data_len| could be used as input parameter.  If it has
 694 // non-zero value, it is considered as maximum size of |http_response_data|.
 695 SECStatus OCSPSetResponse(OCSPRequestSession* req,
 696                           PRUint16* http_response_code,
 697                           const char** http_response_content_type,
 698                           const char** http_response_headers,
 699                           const char** http_response_data,
 700                           PRUint32* http_response_data_len) {
 701   DCHECK(req->Finished());
 702   const std::string& data = req->http_response_data();
 703   if (http_response_data_len && *http_response_data_len) {
 704     if (*http_response_data_len < data.size()) {
 705       LOG(ERROR) << "response body too large: " << *http_response_data_len
 706                  << " < " << data.size();
 707       *http_response_data_len = data.size();
 708       PORT_SetError(SEC_ERROR_BAD_HTTP_RESPONSE);
 709       return SECFailure;
 710     }
 711   }
 712   VLOG(1) << "OCSP response "
 713           << " response_code=" << req->http_response_code()
 714           << " content_type=" << req->http_response_content_type()
 715           << " header=" << req->http_response_headers()
 716           << " data_len=" << data.size();
 717   if (http_response_code)
 718     *http_response_code = req->http_response_code();
 719   if (http_response_content_type)
 720     *http_response_content_type = req->http_response_content_type().c_str();
 721   if (http_response_headers)
 722     *http_response_headers = req->http_response_headers().c_str();
 723   if (http_response_data)
 724     *http_response_data = data.data();
 725   if (http_response_data_len)
 726     *http_response_data_len = data.size();
 727   return SECSuccess;
 728 }
 729
 730 SECStatus OCSPTrySendAndReceive(SEC_HTTP_REQUEST_SESSION request,
 731                                 PRPollDesc** pPollDesc,
 732                                 PRUint16* http_response_code,
 733                                 const char** http_response_content_type,
 734                                 const char** http_response_headers,
 735                                 const char** http_response_data,
 736                                 PRUint32* http_response_data_len) {
 737   if (http_response_data_len) {
 738     // We must always set an output value, even on failure.  The output value 0
 739     // means the failure was unrelated to the acceptable response data length.
 740     *http_response_data_len = 0;
 741   }
 742
 743   VLOG(1) << "OCSP try send and receive";
 744   OCSPRequestSession* req = reinterpret_cast<OCSPRequestSession*>(request);
 745   // We support blocking mode only.
 746   if (pPollDesc)
 747     *pPollDesc = NULL;
 748
 749   if (req->Started() || req->Finished()) {
 750     // We support blocking mode only, so this function shouldn't be called
 751     // again when req has stareted or finished.
 752     NOTREACHED();
 753     PORT_SetError(SEC_ERROR_BAD_HTTP_RESPONSE);  // Simple approximation.
 754     return SECFailure;
 755   }
 756
 757   const base::Time start_time = base::Time::Now();
 758   bool request_ok = true;
 759   req->Start();
 760   if (!req->Wait() || req->http_response_code() == static_cast<PRUint16>(-1)) {
 761     // If the response code is -1, the request failed and there is no response.
 762     request_ok = false;
 763   }
 764   const base::TimeDelta duration = base::Time::Now() - start_time;
 765
 766   // For metrics, we want to know if the request was 'successful' or not.
 767   // |request_ok| determines if we'll pass the response back to NSS and |ok|
 768   // keep track of if we think the response was good.
 769   bool ok = true;
 770   if (!request_ok ||
 771       (req->http_response_code() >= 400 && req->http_response_code() < 600) ||
 772       req->http_response_data().size() == 0 ||
 773       // 0x30 is the ASN.1 DER encoding of a SEQUENCE. All valid OCSP/CRL/CRT
 774       // responses must start with this. If we didn't check for this then a
 775       // captive portal could provide an HTML reply that we would count as a
 776       // 'success' (although it wouldn't count in NSS, of course).
 777       req->http_response_data().data()[0] != 0x30) {
 778     ok = false;
 779   }
 780
 781   // We want to know if this was:
 782   //   1) An OCSP request
 783   //   2) A CRL request
 784   //   3) A request for a missing intermediate certificate
 785   // There's no sure way to do this, so we use heuristics like MIME type and
 786   // URL.
 787   const char* mime_type = "";
 788   if (ok)
 789     mime_type = req->http_response_content_type().c_str();
 790   bool is_ocsp =
 791       strcasecmp(mime_type, "application/ocsp-response") == 0;
 792   bool is_crl = strcasecmp(mime_type, "application/x-pkcs7-crl") == 0 ||
 793                 strcasecmp(mime_type, "application/x-x509-crl") == 0 ||
 794                 strcasecmp(mime_type, "application/pkix-crl") == 0;
 795   bool is_cert =
 796       strcasecmp(mime_type, "application/x-x509-ca-cert") == 0 ||
 797       strcasecmp(mime_type, "application/x-x509-server-cert") == 0 ||
 798       strcasecmp(mime_type, "application/pkix-cert") == 0 ||
 799       strcasecmp(mime_type, "application/pkcs7-mime") == 0;
 800
 801   if (!is_cert && !is_crl && !is_ocsp) {
 802     // We didn't get a hint from the MIME type, so do the best that we can.
 803     const std::string path = req->url().path();
 804     const std::string host = req->url().host();
 805     is_crl = strcasestr(path.c_str(), ".crl") != NULL;
 806     is_cert = strcasestr(path.c_str(), ".crt") != NULL ||
 807               strcasestr(path.c_str(), ".p7c") != NULL ||
 808               strcasestr(path.c_str(), ".cer") != NULL;
 809     is_ocsp = strcasestr(host.c_str(), "ocsp") != NULL ||
 810               req->http_request_method() == "POST";
 811   }
 812
 813   if (is_ocsp) {
 814     if (ok) {
 815       UMA_HISTOGRAM_TIMES("Net.OCSPRequestTimeMs", duration);
 816       UMA_HISTOGRAM_BOOLEAN("Net.OCSPRequestSuccess", true);
 817     } else {
 818       UMA_HISTOGRAM_TIMES("Net.OCSPRequestFailedTimeMs", duration);
 819       UMA_HISTOGRAM_BOOLEAN("Net.OCSPRequestSuccess", false);
 820     }
 821   } else if (is_crl) {
 822     if (ok) {
 823       UMA_HISTOGRAM_TIMES("Net.CRLRequestTimeMs", duration);
 824       UMA_HISTOGRAM_BOOLEAN("Net.CRLRequestSuccess", true);
 825     } else {
 826       UMA_HISTOGRAM_TIMES("Net.CRLRequestFailedTimeMs", duration);
 827       UMA_HISTOGRAM_BOOLEAN("Net.CRLRequestSuccess", false);
 828     }
 829   } else if (is_cert) {
 830     if (ok)
 831       UMA_HISTOGRAM_TIMES("Net.CRTRequestTimeMs", duration);
 832   } else {
 833     if (ok)
 834       UMA_HISTOGRAM_TIMES("Net.UnknownTypeRequestTimeMs", duration);
 835   }
 836
 837   if (!request_ok) {
 838     PORT_SetError(SEC_ERROR_BAD_HTTP_RESPONSE);  // Simple approximation.
 839     return SECFailure;
 840   }
 841
 842   return OCSPSetResponse(
 843       req, http_response_code,
 844       http_response_content_type,
 845       http_response_headers,
 846       http_response_data,
 847       http_response_data_len);
 848 }
 849
 850 SECStatus OCSPFree(SEC_HTTP_REQUEST_SESSION request) {
 851   VLOG(1) << "OCSP free";
 852   OCSPRequestSession* req = reinterpret_cast<OCSPRequestSession*>(request);
 853   req->Cancel();
 854   req->Release();
 855   return SECSuccess;
 856 }
 857
 858 // Data for GetAlternateOCSPAIAInfo.
 859
 860 // CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
 861 //
 862 // There are two CAs with this name.  Their key IDs are listed next.
 863 const unsigned char network_solutions_ca_name[] = {
 864   0x30, 0x62, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
 865   0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x21, 0x30, 0x1f, 0x06,
 866   0x03, 0x55, 0x04, 0x0a, 0x13, 0x18, 0x4e, 0x65, 0x74, 0x77,
 867   0x6f, 0x72, 0x6b, 0x20, 0x53, 0x6f, 0x6c, 0x75, 0x74, 0x69,
 868   0x6f, 0x6e, 0x73, 0x20, 0x4c, 0x2e, 0x4c, 0x2e, 0x43, 0x2e,
 869   0x31, 0x30, 0x30, 0x2e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
 870   0x27, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x20, 0x53,
 871   0x6f, 0x6c, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x20, 0x43,
 872   0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
 873   0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79
 874 };
 875 const unsigned int network_solutions_ca_name_len = 100;
 876
 877 // This CA is an intermediate CA, subordinate to UTN-USERFirst-Hardware.
 878 const unsigned char network_solutions_ca_key_id[] = {
 879   0x3c, 0x41, 0xe2, 0x8f, 0x08, 0x08, 0xa9, 0x4c, 0x25, 0x89,
 880   0x8d, 0x6d, 0xc5, 0x38, 0xd0, 0xfc, 0x85, 0x8c, 0x62, 0x17
 881 };
 882 const unsigned int network_solutions_ca_key_id_len = 20;
 883
 884 // This CA is a root CA.  It is also cross-certified by
 885 // UTN-USERFirst-Hardware.
 886 const unsigned char network_solutions_ca_key_id2[] = {
 887   0x21, 0x30, 0xc9, 0xfb, 0x00, 0xd7, 0x4e, 0x98, 0xda, 0x87,
 888   0xaa, 0x2a, 0xd0, 0xa7, 0x2e, 0xb1, 0x40, 0x31, 0xa7, 0x4c
 889 };
 890 const unsigned int network_solutions_ca_key_id2_len = 20;
 891
 892 // An entry in our OCSP responder table.  |issuer| and |issuer_key_id| are
 893 // the key.  |ocsp_url| is the value.
 894 struct OCSPResponderTableEntry {
 895   SECItem issuer;
 896   SECItem issuer_key_id;
 897   const char *ocsp_url;
 898 };
 899
 900 const OCSPResponderTableEntry g_ocsp_responder_table[] = {
 901   {
 902     {
 903       siBuffer,
 904       const_cast<unsigned char*>(network_solutions_ca_name),
 905       network_solutions_ca_name_len
 906     },
 907     {
 908       siBuffer,
 909       const_cast<unsigned char*>(network_solutions_ca_key_id),
 910       network_solutions_ca_key_id_len
 911     },
 912     "http://ocsp.netsolssl.com"
 913   },
 914   {
 915     {
 916       siBuffer,
 917       const_cast<unsigned char*>(network_solutions_ca_name),
 918       network_solutions_ca_name_len
 919     },
 920     {
 921       siBuffer,
 922       const_cast<unsigned char*>(network_solutions_ca_key_id2),
 923       network_solutions_ca_key_id2_len
 924     },
 925     "http://ocsp.netsolssl.com"
 926   }
 927 };
 928
 929 char* GetAlternateOCSPAIAInfo(CERTCertificate *cert) {
 930   if (cert && !cert->isRoot && cert->authKeyID) {
 931     for (unsigned int i=0; i < arraysize(g_ocsp_responder_table); i++) {
 932       if (SECITEM_CompareItem(&g_ocsp_responder_table[i].issuer,
 933                               &cert->derIssuer) == SECEqual &&
 934           SECITEM_CompareItem(&g_ocsp_responder_table[i].issuer_key_id,
 935                               &cert->authKeyID->keyID) == SECEqual) {
 936         return PORT_Strdup(g_ocsp_responder_table[i].ocsp_url);
 937       }
 938     }
 939   }
 940
 941   return NULL;
 942 }
 943
 944 }  // anonymous namespace
 945
 946 void SetMessageLoopForNSSHttpIO() {
 947   // Must have a MessageLoopForIO.
 948   DCHECK(base::MessageLoopForIO::current());
 949
 950   bool used = g_ocsp_io_loop.Get().used();
 951
 952   // Should not be called when g_ocsp_io_loop has already been used.
 953   DCHECK(!used);
 954 }
 955
 956 void EnsureNSSHttpIOInit() {
 957   g_ocsp_io_loop.Get().StartUsing();
 958   g_ocsp_nss_initialization.Get();
 959 }
 960
 961 void ShutdownNSSHttpIO() {
 962   g_ocsp_io_loop.Get().Shutdown();
 963 }
 964
 965 void ResetNSSHttpIOForTesting() {
 966   g_ocsp_io_loop.Get().ReuseForTesting();
 967 }
 968
 969 // This function would be called before NSS initialization.
 970 void SetURLRequestContextForNSSHttpIO(URLRequestContext* request_context) {
 971   pthread_mutex_lock(&g_request_context_lock);
 972   if (request_context) {
 973     DCHECK(!g_request_context);
 974   }
 975   g_request_context = request_context;
 976   pthread_mutex_unlock(&g_request_context_lock);
 977 }
 978
 979 }  // namespace net