| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
| |
This may fix bug 72041.
R=wtc
BUG=72041
TEST=covered by existing net_unittests
Review URL: http://codereview.chromium.org/6458023
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@74254 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
returned key type to use a PCERT_KEY_CONTEXT allocated via NSS's PORT_Alloc(), rather than an HCRYPTPROV, for native client certificate authentication.
There are two reasons for doing this; first, a PCERT_KEY_CONTEXT lets us transmit a dwKeySpec, indicating whether to use the AT_KEYEXCHANGE or AT_SIGNATURE key for CryptoAPI keys. Second, a small piece of syntactic fluff, a PCERT_KEY_CONTEXT easily supports CNG keys for Vista+, which though not presently supported, is a TODO.
R=wtc
BUG=37560, 71748
TEST=Perform SSL client auth on Windows.
Review URL: http://codereview.chromium.org/4670004
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@73913 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
handshake and an error signing with the certificate private key is encountered, rather than using ERR_FAILED/ERR_SSL_PROTOCOL_ERROR.
BUG=69609
TEST=none
Review URL: http://codereview.chromium.org/6371014
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@73891 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
This was based off of davidben's WIP cl http://codereview.chromium.org/3186021/show.
BUG=42073
TEST=add password to NSS DB with "certutil -d sql:.pki/nssdb -W", try client auth, <keygen>, cert manager
Review URL: http://codereview.chromium.org/5686002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@71281 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This enforces that the Singleton<T> pattern can only be used within classes which want singleton-ness.
As part of this CL I have also fixed up files which got missed in my previous CLs to use a GetInstance() method and use Singleton<T> from the source file.
There are a small number of places where I have also switched to LazyInstance as that was more appropriate for types used in a single source file.
BUG=65298
TEST=all existing tests should continue to pass.
Review URL: http://codereview.chromium.org/5682008
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@69107 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
singleton type. This enforces that the Singleton<T> pattern can only be used within classes which want singleton-ness.
As part of this CL I have also fixed up files which got missed in my previous CLs to use a GetInstance() method and use Singleton<T> from the source file.
There are a small number of places where I have also switched to LazyInstance as that was more appropriate for types used in a single source file.
BUG=65298
TEST=all existing tests should continue to pass.
Review URL: http://codereview.chromium.org/5682008
TBR=satish@chromium.org
Review URL: http://codereview.chromium.org/5721005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@68936 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This enforces that the Singleton<T> pattern can only be used within classes which want singleton-ness.
As part of this CL I have also fixed up files which got missed in my previous CLs to use a GetInstance() method and use Singleton<T> from the source file.
There are a small number of places where I have also switched to LazyInstance as that was more appropriate for types used in a single source file.
BUG=65298
TEST=all existing tests should continue to pass.
Review URL: http://codereview.chromium.org/5682008
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@68932 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Certificate/CertificateVerify messages unless the peer sends a CertificateRequest, requesting client auth.
This would happen if the following conditions were true:
- In the initial/previous handshake, the peer requests client authentication.
- The client chooses a certificate, versus declining to provide one.
- A (EC-)DHE cipher suite is negotiated.
- The peer requests (secure) renegotiation.
- The peer does NOT request a client certificate during the renegotiated handshake.
R=wtc
BUG=62027
TEST=none
Review URL: http://codereview.chromium.org/5611005
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@68829 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds support in libssl for requesting and storing OCSP
stapled responses.
BUG=none
TEST=none (yet)
http://codereview.chromium.org/5045001
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@67005 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
unnecessary includes and marking platform-specific implementations as such. Also clearly document that CertPrincipal::Matches() is not suitable for security-relevant name checks.
In addition, because x509_cert_types.h no longer includes base/singleton.h, fix all the classes that broke because they weren't including what they used.
BUG=none
TEST=existing
Review URL: http://codereview.chromium.org/5162001
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@66941 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
| |
actual signature length rather than the estimated
signature length.
R=rsleevi
BUG=37560,45369,62027
TEST=none
Review URL: http://codereview.chromium.org/4825003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@65979 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously, if we predicted a ServerHello (because we were snap
startting), then serverHelloPredictionData was set and we wouldn't
record the actual ServerHello contents in the event of a misprediction.
This meant that we couldn't recover from a misprediction because we
would record the same prediction again.
With this patch, we'll always write to serverHelloPredictionData, even
if we made a prediction.
BUG=none
TEST=snap_start_unittests
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@65947 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
TBR=rsleevi
BUG=37560,45369
TEST=none
Review URL: http://codereview.chromium.org/4488002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@65084 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
auth.
Known Limitations:
- Only SSL3/TLS1.0 handshakes are supported. It's unlikely
SSLv2 will/should ever be implemented. NSS does not yet
support TLS1.1/1.2.
- On Windows, only CryptoAPI keys are supported. Keys that
can only be accessed via CNG will fail.
Technical Notes:
Windows:
- Only the AT_KEYEXCHANGE key is used, per
http://msdn.microsoft.com/en-us/library/aa387461(VS.85).aspx
- CryptSetHashParam is used to directly set the hash value.
This *should* be supported by all CSPs that are compatible
with RSA/SChannel, AFAICT, but testing is needed.
NSS:
- The define NSS_PLATFORM_CLIENT_AUTH is used to guard all
of the new/patched code. The primary implementation
details are in sslplatf.c.
Patch author: Ryan Sleevi <rsleevi@chromium.org>
Original review URL: http://codereview.chromium.org/2828002
BUG=148,37560,45369
TEST=Attempt to authenticate with a site that requires SSL
client authentication (e.g., https://foaf.me/simpleLogin.php
with a FOAF+SSL client certificate).
Review URL: http://codereview.chromium.org/3455019
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@65064 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This CL causes Snap Start to only trigger if the certificate
verification has completed by the time we are ready to send out the
handshake message.
It also adds a couple of NetLog entries and histograms around the Snap
Start code.
BUG=none
TEST=none
http://codereview.chromium.org/4408001
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@64986 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The Snap Start code in NSS worked like the prototype implementation in
tlsclient. This had the library take care of resending the application
data in the event of a mispredict. However, that was safe because it did
certificate verification as the message was received.
However, in Chrome, it's possible that a mispret could be triggered by
the server having a different certificate and NSS would resend the
application data before Chrome verified the certificate.
This change removes that behaviour from NSS and makes the retransmission
the job of ssl_client_socket_nss.cc.
BUG=none
TEST=none
http://codereview.chromium.org/4213003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@64953 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
BUG=19991
TEST=cert manager no longer has a "people" tab, any certs that were there are now in "other" tab.
Review URL: http://codereview.chromium.org/4310004
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@64866 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
| |
SSL_PeerCertificatesChain returns the intermediate certificates as
presented by a TLS server. Previously, we have been extracting chains
built by validation, which may differ from the chain presented by the
server.
BUG=none
TEST=none
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@63750 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
in the right order.
R=agl
BUG=none
TEST=none
Review URL: http://codereview.chromium.org/3984003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@63366 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add a file in the patches/ directory which contains the contents of
our current Snap Start patch.
No code changes.
BUG=none
TEST=none
Review URL: http://codereview.chromium.org/3922002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@63206 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
| |
Also converts COOKIE_DLOG (since VLOG can be toggled on a granular basis), removes some unneeded "endl"s and {}s, aligns "<<"s per style guide, and changes KeygenHandler::GenKeyAndSignChallenge() to avoid using "goto".
BUG=none
TEST=none
Review URL: http://codereview.chromium.org/3846001
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@62831 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
BUG=19991
TEST=net_unittests
Review URL: http://codereview.chromium.org/3576016
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@62228 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Snap Start now works with NPN.
In the case that the server doesn't support Snap Start,
SSL_GetPredictedServerHelloData will no longer return any data to
allow the application not to cache Snap Start information for servers
that don't support it.
Previously Snap Start wasn't filling in the certificates in all cases.
(Test cases didn't check the certificates on the socket; but
Chrome noticed.)
BUG=none
TEST=nsstests (not in tree)
http://codereview.chromium.org/3430007/show
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@59957 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously, we wouldn't call the handshake callback if both False
Start and Snap Start were enabled on a connection.
BUG=none
TEST=none, because we haven't got the Snap Start code in yet.
http://codereview.chromium.org/3247006
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@59371 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
s/ImportCertResult/ImportCertFailure/
BUG=19991
TEST=none
Review URL: http://codereview.chromium.org/3351002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@59318 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
BUG=19991
TEST=net/base/cert_database_nss_unittest.cc
Review URL: http://codereview.chromium.org/3106028
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@58077 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
SSL_HandshakeNegotiatedExtension to be called as soon as a false
start handshake is done.
R=agl
BUG=53366
TEST=Visit any HTTPS sites, especially sites with certificate
errors. The SSL InfoBubble should not say "your connection to
www.example.com is not encrypted."
Review URL: http://codereview.chromium.org/3233001
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@57691 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds NSS support for Snap Start, an experimental TLS
extension for zero round trip handshakes. This change does not enable
Snap Start.
BUG=none
TEST=External unittests (not in tree)
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@57325 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Use ScopedPK11Slot.
Move common test functionality into functions.
Move common test conditions into SetUp/TearDown.
Move common test variables into attributes of the test class.
BUG=19991
TEST=tests still pass
Review URL: http://codereview.chromium.org/3189014
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@56801 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
BUG=19991
TEST=builds
Review URL: http://codereview.chromium.org/3104022
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@56799 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This will make them browsing them easier in Keychain Access and certutil.
It also gives them a more useful name in Keychain permission dialogs.
The friendly name is currently just the hostname which requested
the key. It would be nice to have some surrounding text with
localization, but this works for now.
BUG=none
TEST=none
Review URL: http://codereview.chromium.org/2806045
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@56774 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add the new error code ERR_SSL_WEAK_SERVER_KEY for these
broken servers.
Use the new SSL_RENEGOTIATE_TRANSITIONAL option. On the
client side it is equivalent to SSL_RENEGOTIATE_UNRESTRICTED.
R=agl
BUG=51694
TEST=Visit https://portal-plumprod.cgc.enbridge.com and
https://www.citylink.com.au. The network error page
should display the error message:
Error 129 (net::ERR_SSL_WEAK_SERVER_KEY): Unknown error.
Review URL: http://codereview.chromium.org/3149012
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@56283 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
R=agl
BUG=51694
TEST=No build errors or test failures.
Review URL: http://codereview.chromium.org/3177012
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@56042 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
Use sql: prefix when opening NSS UserDB (this will affect existing Chromeos installations, which had been using the old berkelydb format.)
BUG=19991,51327,51328,51330,51332
TEST=net/base/cert_database_nss_unittest.cc
Review URL: http://codereview.chromium.org/3018038
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55916 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
| |
failed compile on chromeos.
This reverts commit r55798.
BUG=19991,51327,51328,51330,51332
Review URL: http://codereview.chromium.org/3169007
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55804 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
Use sql: prefix when opening NSS UserDB (this will affect existing Chromeos installations, which had been using the old berkelydb format.)
BUG=19991,51327,51328,51330,51332
TEST=net/base/cert_database_nss_unittest.cc
Review URL: http://codereview.chromium.org/3018038
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55798 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
TLS_RSA_WITH_AES_256_CBC_SHA in ClientHello so that we
communicate securely with some servers that use 256-bit
DH keys.
The proper fix is to upgrade to NSS 3.12.7 to pick up
the DH key size checks. This is just a workaround.
R=agl
BUG=51694
TEST=none
Review URL: http://codereview.chromium.org/3118002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55580 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
TEST=net_unittests
BUG=none
http://codereview.chromium.org/3074008
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55226 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
in ssl.h. Add comments to ssl3con.c to make it clear that
we call the handshakeCallback only once. Fix incorrect -h
option in new test cases in sslstress.txt.
R=agl
BUG=none
TEST=none
Review URL: http://codereview.chromium.org/2808075
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@54146 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
* Add a patch for r50960 (Cache the peer's intermediate CA certificates...)
No code changes.
TEST=none
BUG=none
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@51859 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
they're available when we resume a session. Right now when we resume
a session, only the server certificate is available, so we may have an
incomplete certificate chain.
TBR=agl
BUG=47181
TEST=no "certificate not trusted" error on the Mac after using Chrome
for a long time.
Review URL: http://codereview.chromium.org/2855025
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@50960 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
| |
We'll want some semblance of thread-safety when we make keygen asynchronous.
R=wtc,mattm
BUG=148
TEST=unit test
Review URL: http://codereview.chromium.org/2838010
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@50903 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
| |
certificate that has a private key, regardless of where it was generated, rather than restricting it to keys generated via <keygen> in the current browsing session.
BUG=148
TEST=None
R=wtc
Review URL: http://codereview.chromium.org/2874002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@50695 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
DER_Encode will copy it. Document the GenKeyAndSignChallenge function.
R=mattm,davidben
BUG=148
TEST=none
Review URL: http://codereview.chromium.org/2866011
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@50682 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
to the new net/third_party/mozilla_security_manager directory.
Fix nits.
R=mattm,davidben
BUG=148
TEST=none
Review URL: http://codereview.chromium.org/2824014
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@50259 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
BUG=33033.
TEST=None.
Review URL: http://codereview.chromium.org/2682006
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@49414 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
SSLClientSocketMac. Specify the --use-nss-for-ssl command-line
option to use SSLClientSocketNSS.
The nss.gyp in src/net/third_party/nss is renamed ssl.gyp to avoid
a naming conflict with the nss.gyp in src/third_party/nss. The
GYP generator for Xcode project files disallows same-named .gyp files.
SSL client authentication doesn't work yet.
R=mark
BUG=30689
TEST=No build and test failures on Mac and Windows.
Review URL: http://codereview.chromium.org/2322008
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@48650 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
Moved to net/third_party.
BUG=None.
TEST=None.
Review URL: http://codereview.chromium.org/2011013
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@47563 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
| |
Review URL: http://codereview.chromium.org/1480002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@47327 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Modified license-checker script to allow pruning directories
we know to be ok.
Still need to do a bit of third_party/* , as well as
file a bunch of bugs on pieces where the licenses aren't clear,
but I'm running out of energy.
Review URL: http://codereview.chromium.org/1100003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@42045 0039d316-1c4b-4281-b951-d872f2087c98
|