security/manager/ssl/VerifySSLServerCertParent.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set sw=2 ts=8 et tw=80 : */
   3
   4 /* This Source Code Form is subject to the terms of the Mozilla Public
   5  * License, v. 2.0. If a copy of the MPL was not distributed with this
   6  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   7
   8 #include "VerifySSLServerCertParent.h"
   9
  10 #include "cert.h"
  11 #include "nsNSSComponent.h"
  12 #include "secerr.h"
  13 #include "SharedCertVerifier.h"
  14 #include "NSSCertDBTrustDomain.h"
  15 #include "SSLServerCertVerification.h"
  16 #include "nsNSSIOLayer.h"
  17 #include "nsISocketProvider.h"
  18 #include "mozilla/Unused.h"
  19
  20 extern mozilla::LazyLogModule gPIPNSSLog;
  21
  22 using namespace mozilla::pkix;
  23
  24 namespace mozilla {
  25 namespace psm {
  26
  27 VerifySSLServerCertParent::VerifySSLServerCertParent() {}
  28
  29 void VerifySSLServerCertParent::OnVerifiedSSLServerCert(
  30     const nsTArray<ByteArray>& aBuiltCertChain,
  31     uint16_t aCertificateTransparencyStatus, EVStatus aEVStatus,
  32     bool aSucceeded, PRErrorCode aFinalError,
  33     nsITransportSecurityInfo::OverridableErrorCategory
  34         aOverridableErrorCategory,
  35     bool aIsBuiltCertChainRootBuiltInRoot, bool aMadeOCSPRequests) {
  36   if (!CanSend()) {
  37     return;
  38   }
  39
  40   Unused << SendOnVerifySSLServerCertFinished(
  41       aBuiltCertChain, aCertificateTransparencyStatus, aEVStatus, aSucceeded,
  42       aFinalError, aOverridableErrorCategory, aIsBuiltCertChainRootBuiltInRoot,
  43       aMadeOCSPRequests);
  44
  45   Close();
  46 }
  47
  48 namespace {
  49
  50 class IPCServerCertVerificationResult final
  51     : public BaseSSLServerCertVerificationResult {
  52  public:
  53   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(IPCServerCertVerificationResult,
  54                                         override)
  55
  56   IPCServerCertVerificationResult(nsIEventTarget* aTarget,
  57                                   VerifySSLServerCertParent* aParent)
  58       : mTarget(aTarget), mParent(aParent) {}
  59
  60   [[nodiscard]] nsresult Dispatch(
  61       nsTArray<nsTArray<uint8_t>>&& aBuiltChain,
  62       nsTArray<nsTArray<uint8_t>>&& aPeerCertChain,
  63       uint16_t aCertificateTransparencyStatus, EVStatus aEVStatus,
  64       bool aSucceeded, PRErrorCode aFinalError,
  65       nsITransportSecurityInfo::OverridableErrorCategory
  66           aOverridableErrorCategory,
  67       bool aIsBuiltCertChainRootBuiltInRoot, uint32_t aProviderFlags,
  68       bool aMadeOCSPRequests) override;
  69
  70  private:
  71   ~IPCServerCertVerificationResult() = default;
  72
  73   nsCOMPtr<nsIEventTarget> mTarget;
  74   RefPtr<VerifySSLServerCertParent> mParent;
  75 };
  76
  77 nsresult IPCServerCertVerificationResult::Dispatch(
  78     nsTArray<nsTArray<uint8_t>>&& aBuiltChain,
  79     nsTArray<nsTArray<uint8_t>>&& aPeerCertChain,
  80     uint16_t aCertificateTransparencyStatus, EVStatus aEVStatus,
  81     bool aSucceeded, PRErrorCode aFinalError,
  82     nsITransportSecurityInfo::OverridableErrorCategory
  83         aOverridableErrorCategory,
  84     bool aIsBuiltCertChainRootBuiltInRoot, uint32_t aProviderFlags,
  85     bool aMadeOCSPRequests) {
  86   nsTArray<ByteArray> builtCertChain;
  87   if (aSucceeded) {
  88     for (auto& cert : aBuiltChain) {
  89       builtCertChain.AppendElement(ByteArray(cert));
  90     }
  91   }
  92
  93   nsresult rv = mTarget->Dispatch(
  94       NS_NewRunnableFunction(
  95           "psm::VerifySSLServerCertParent::OnVerifiedSSLServerCert",
  96           [parent(mParent), builtCertChain{std::move(builtCertChain)},
  97            aCertificateTransparencyStatus, aEVStatus, aSucceeded, aFinalError,
  98            aOverridableErrorCategory, aIsBuiltCertChainRootBuiltInRoot,
  99            aMadeOCSPRequests]() {
 100             parent->OnVerifiedSSLServerCert(
 101                 builtCertChain, aCertificateTransparencyStatus, aEVStatus,
 102                 aSucceeded, aFinalError, aOverridableErrorCategory,
 103                 aIsBuiltCertChainRootBuiltInRoot, aMadeOCSPRequests);
 104           }),
 105       NS_DISPATCH_NORMAL);
 106   MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));
 107   return rv;
 108 }
 109
 110 }  // anonymous namespace
 111
 112 bool VerifySSLServerCertParent::Dispatch(
 113     nsTArray<ByteArray>&& aPeerCertChain, const nsACString& aHostName,
 114     const int32_t& aPort, const OriginAttributes& aOriginAttributes,
 115     const Maybe<ByteArray>& aStapledOCSPResponse,
 116     const Maybe<ByteArray>& aSctsFromTLSExtension,
 117     const Maybe<DelegatedCredentialInfoArg>& aDcInfo,
 118     const uint32_t& aProviderFlags, const uint32_t& aCertVerifierFlags) {
 119   MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("VerifySSLServerCertParent::Dispatch"));
 120
 121   mBackgroundThread = GetCurrentSerialEventTarget();
 122
 123   nsTArray<nsTArray<uint8_t>> peerCertBytes;
 124   for (auto& certBytes : aPeerCertChain) {
 125     nsTArray<uint8_t> bytes;
 126     peerCertBytes.AppendElement(std::move(certBytes.data()));
 127   }
 128
 129   Maybe<nsTArray<uint8_t>> stapledOCSPResponse;
 130   if (aStapledOCSPResponse) {
 131     stapledOCSPResponse.emplace(aStapledOCSPResponse->data().Clone());
 132   }
 133
 134   Maybe<nsTArray<uint8_t>> sctsFromTLSExtension;
 135   if (aSctsFromTLSExtension) {
 136     sctsFromTLSExtension.emplace(aSctsFromTLSExtension->data().Clone());
 137   }
 138
 139   Maybe<DelegatedCredentialInfo> dcInfo;
 140   if (aDcInfo) {
 141     dcInfo.emplace();
 142     dcInfo->scheme = static_cast<SSLSignatureScheme>(aDcInfo->scheme());
 143     dcInfo->authKeyBits = aDcInfo->authKeyBits();
 144   }
 145
 146   RefPtr<IPCServerCertVerificationResult> resultTask =
 147       new IPCServerCertVerificationResult(mBackgroundThread, this);
 148   SECStatus status = SSLServerCertVerificationJob::Dispatch(
 149       0, nullptr, std::move(peerCertBytes), aHostName, aPort, aOriginAttributes,
 150       stapledOCSPResponse, sctsFromTLSExtension, dcInfo, aProviderFlags, Now(),
 151       aCertVerifierFlags, resultTask);
 152
 153   if (status != SECWouldBlock) {
 154     MOZ_LOG(gPIPNSSLog, LogLevel::Debug,
 155             ("VerifySSLServerCertParent::Dispatch - dispatch failed"));
 156     return false;
 157   }
 158
 159   return true;
 160 }
 161
 162 void VerifySSLServerCertParent::ActorDestroy(ActorDestroyReason aWhy) {}
 163
 164 VerifySSLServerCertParent::~VerifySSLServerCertParent() = default;
 165
 166 }  // namespace psm
 167 }  // namespace mozilla