Optional Native SSL impl. for Minimo on Windows CE.
This commit is contained in:
dougt%meer.net
Родитель
eb7ef2472a
Коммит
1cddf80598
|
|
@ -0,0 +1,97 @@
|
|||
# ***** BEGIN LICENSE BLOCK *****
|
||||
# Version: MPL 1.1/GPL 2.0/LGPL 2.1
|
||||
#
|
||||
# The contents of this file are subject to the Mozilla Public License Version
|
||||
# 1.1 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
# http://www.mozilla.org/MPL/
|
||||
#
|
||||
# Software distributed under the License is distributed on an "AS IS" basis,
|
||||
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
||||
# for the specific language governing rights and limitations under the
|
||||
# License.
|
||||
#
|
||||
# The Original Code is Minimo.
|
||||
#
|
||||
# The Initial Developer of the Original Code is
|
||||
# Doug Turner <dougt@meer.net>.
|
||||
# Portions created by the Initial Developer are Copyright (C) 2005
|
||||
# the Initial Developer. All Rights Reserved.
|
||||
#
|
||||
# Contributor(s):
|
||||
#
|
||||
# Alternatively, the contents of this file may be used under the terms of
|
||||
# either the GNU General Public License Version 2 or later (the "GPL"), or
|
||||
# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
|
||||
# in which case the provisions of the GPL or the LGPL are applicable instead
|
||||
# of those above. If you wish to allow use of your version of this file only
|
||||
# under the terms of either the GPL or the LGPL, and not to allow others to
|
||||
# use your version of this file under the terms of the MPL, indicate your
|
||||
# decision by deleting the provisions above and replace them with the notice
|
||||
# and other provisions required by the GPL or the LGPL. If you do not delete
|
||||
# the provisions above, a recipient may use your version of this file under
|
||||
# the terms of any one of the MPL, the GPL or the LGPL.
|
||||
#
|
||||
# ***** END LICENSE BLOCK *****
|
||||
|
||||
|
||||
DEPTH = ../../..
|
||||
topsrcdir = @top_srcdir@
|
||||
srcdir = @srcdir@
|
||||
VPATH = @srcdir@
|
||||
|
||||
include $(DEPTH)/config/autoconf.mk
|
||||
|
||||
MODULE_NAME = native_ssl
|
||||
MODULE = native_ssl
|
||||
LIBRARY_NAME = native_ssl
|
||||
|
||||
IS_COMPONENT = 1
|
||||
EXPORT_LIBRARY = 1
|
||||
MOZILLA_INTERNAL_API = 1
|
||||
|
||||
REQUIRES = xpcom \
|
||||
appshell \
|
||||
string \
|
||||
embed_base \
|
||||
webbrwsr \
|
||||
webshell \
|
||||
windowwatcher \
|
||||
profile \
|
||||
necko \
|
||||
docshell \
|
||||
dom \
|
||||
widget \
|
||||
uriloader \
|
||||
shistory \
|
||||
webbrowserpersist \
|
||||
gfx \
|
||||
layout \
|
||||
content \
|
||||
profdirserviceprovider \
|
||||
pref \
|
||||
pipnss \
|
||||
intl \
|
||||
embedcomponents \
|
||||
appcomps \
|
||||
phone \
|
||||
pipboot \
|
||||
$(NULL)
|
||||
|
||||
|
||||
|
||||
LOCAL_INCLUDES = -I$(srcdir) -I$(topsrcdir)/security/manager/boot/src
|
||||
|
||||
CPPSRCS = nsSecureBrowserUIImpl.cpp nsNativeSSL.cpp
|
||||
|
||||
EXTRA_DSO_LDOPTS += $(MOZ_COMPONENT_LIBS)
|
||||
|
||||
ifdef WINCE
|
||||
OS_LIBS += $(call EXPAND_LIBNAME, aygshell cellcore)
|
||||
endif
|
||||
|
||||
include $(topsrcdir)/config/rules.mk
|
||||
|
||||
export::
|
||||
$(NSINSTALL) $(topsrcdir)/security/manager/boot/src/nsSecureBrowserUIImpl.cpp .
|
||||
|
||||
|
|
@ -0,0 +1,312 @@
|
|||
#include "nsIServiceManager.h"
|
||||
#include "nsIGenericFactory.h"
|
||||
|
||||
#include "nsCOMPtr.h"
|
||||
#include "nsNetError.h"
|
||||
#include "nsNetCID.h"
|
||||
|
||||
#include "nspr.h"
|
||||
#include "private/pprio.h"
|
||||
#include "nsString.h"
|
||||
#include "nsCRT.h"
|
||||
|
||||
#include "nsISocketProvider.h"
|
||||
#include "nsITransportSecurityInfo.h"
|
||||
#include "nsISSLStatusProvider.h"
|
||||
#include "nsIStringBundle.h"
|
||||
|
||||
#include "nsIWebProgressListener.h"
|
||||
|
||||
#include "nsSecureBrowserUIImpl.h"
|
||||
|
||||
#include <Winsock2.h>
|
||||
#include <sslsock.h>
|
||||
#include <Wincrypt.h>
|
||||
#include <schnlsp.h>
|
||||
|
||||
#define MINIMO_PROPERTIES_URL "chrome://minimo/locale/minimo.properties"
|
||||
|
||||
static SSL_CRACK_CERTIFICATE_FN gSslCrackCertificate = 0 ;
|
||||
static SSL_FREE_CERTIFICATE_FN gSslFreeCertificate = 0 ;
|
||||
static HINSTANCE gSchannel = NULL ;
|
||||
|
||||
class nsWINCESSLSocketProvider : public nsISocketProvider
|
||||
{
|
||||
public:
|
||||
NS_DECL_ISUPPORTS
|
||||
NS_DECL_NSISOCKETPROVIDER
|
||||
|
||||
nsWINCESSLSocketProvider() {};
|
||||
virtual ~nsWINCESSLSocketProvider() {}
|
||||
};
|
||||
|
||||
|
||||
class nsWINCESSLSocketInfo : public nsITransportSecurityInfo
|
||||
{
|
||||
public:
|
||||
nsWINCESSLSocketInfo()
|
||||
{
|
||||
mSecurityState = nsIWebProgressListener::STATE_IS_BROKEN;
|
||||
mUserAcceptedSSLProblem = PR_FALSE;
|
||||
}
|
||||
|
||||
virtual ~nsWINCESSLSocketInfo() {}
|
||||
|
||||
NS_DECL_ISUPPORTS
|
||||
NS_DECL_NSITRANSPORTSECURITYINFO
|
||||
|
||||
void Init(const char *destinationHost, const char *proxyHost, PRInt32 proxyPort)
|
||||
{
|
||||
mDestinationHost = destinationHost;
|
||||
mProxyHost = proxyHost;
|
||||
mProxyPort = proxyPort;
|
||||
};
|
||||
|
||||
nsCString mDestinationHost;
|
||||
nsCString mProxyHost;
|
||||
PRInt32 mProxyPort;
|
||||
|
||||
PRUint32 mSecurityState;
|
||||
|
||||
PRBool mUserAcceptedSSLProblem;
|
||||
|
||||
};
|
||||
|
||||
NS_IMPL_THREADSAFE_ISUPPORTS1(nsWINCESSLSocketInfo, nsITransportSecurityInfo)
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsWINCESSLSocketInfo::GetSecurityState(PRUint32* state)
|
||||
{
|
||||
*state = mSecurityState;
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsWINCESSLSocketInfo::GetShortSecurityDescription(PRUnichar** aText)
|
||||
{
|
||||
*aText = nsnull;
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
static int DisplaySSLProblemDialog(nsWINCESSLSocketInfo* info, PRUnichar* type)
|
||||
{
|
||||
if (info->mUserAcceptedSSLProblem)
|
||||
return IDYES;
|
||||
|
||||
nsCOMPtr<nsIStringBundleService> bundleService = do_GetService(NS_STRINGBUNDLE_CONTRACTID);
|
||||
if (!bundleService)
|
||||
return IDNO;
|
||||
|
||||
nsCOMPtr<nsIStringBundle> bundle;
|
||||
bundleService->CreateBundle(MINIMO_PROPERTIES_URL, getter_AddRefs(bundle));
|
||||
|
||||
if (!bundle)
|
||||
return IDNO;
|
||||
|
||||
nsXPIDLString message;
|
||||
nsXPIDLString title;
|
||||
bundle->GetStringFromName(type, getter_Copies(message));
|
||||
bundle->GetStringFromName(NS_LITERAL_STRING("securityWarningTitle").get(), getter_Copies(title));
|
||||
|
||||
int result = MessageBoxW(0, message.get(), title.get(), MB_YESNO | MB_ICONWARNING | MB_APPLMODAL | MB_TOPMOST | MB_SETFOREGROUND );
|
||||
|
||||
if (result == IDYES)
|
||||
info->mUserAcceptedSSLProblem = PR_TRUE;
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
static int SSLValidationHook(DWORD dwType, LPVOID pvArg, DWORD dwChainLen, LPBLOB pCertChain, DWORD dwFlags )
|
||||
{
|
||||
nsWINCESSLSocketInfo* info = (nsWINCESSLSocketInfo*)pvArg;
|
||||
info->mSecurityState = nsIWebProgressListener::STATE_IS_BROKEN;
|
||||
|
||||
if ( SSL_CERT_X509 != dwType )
|
||||
return SSL_ERR_BAD_DATA;
|
||||
|
||||
if ( SSL_CERT_FLAG_ISSUER_UNKNOWN & dwFlags )
|
||||
{
|
||||
if (DisplaySSLProblemDialog(info, L"confirmUnknownIssuer") != IDYES)
|
||||
return SSL_ERR_CERT_UNKNOWN;
|
||||
}
|
||||
|
||||
// see:
|
||||
// http://groups.google.com/groups?q=SslCrackCertificate&hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=uQf1VcLWBHA.1632%40tkmsftngp05&rnum=3
|
||||
|
||||
if (!gSslCrackCertificate)
|
||||
{
|
||||
gSchannel = LoadLibrary ( "schannel.dll" ) ;
|
||||
if ( NULL != gSchannel )
|
||||
{
|
||||
gSslCrackCertificate = (SSL_CRACK_CERTIFICATE_FN)GetProcAddress ( gSchannel, SSL_CRACK_CERTIFICATE_NAME ) ;
|
||||
gSslFreeCertificate = (SSL_FREE_CERTIFICATE_FN )GetProcAddress ( gSchannel, SSL_FREE_CERTIFICATE_NAME ) ;
|
||||
}
|
||||
|
||||
if (!gSslCrackCertificate || !gSslFreeCertificate)
|
||||
return SSL_ERR_BAD_DATA;
|
||||
}
|
||||
|
||||
X509Certificate * cert = 0;
|
||||
if ( !gSslCrackCertificate( pCertChain->pBlobData, pCertChain->cbSize, TRUE, &cert ) )
|
||||
return SSL_ERR_BAD_DATA;
|
||||
|
||||
|
||||
// all we have to do is compare the name in the cert to
|
||||
// what the hostname was when we created this socket.
|
||||
|
||||
char* subject = strstr(cert->pszSubject, "CN=");
|
||||
if (!subject)
|
||||
return SSL_ERR_BAD_DATA;
|
||||
|
||||
subject = subject+3; // pass CN=
|
||||
|
||||
// check to see if the common name has any ws
|
||||
char* end = strpbrk(subject, "' \t,");
|
||||
char save;
|
||||
if (end)
|
||||
{
|
||||
save = end[0];
|
||||
end[0] = '\0';
|
||||
}
|
||||
|
||||
char* destinationHost = (char*) info->mDestinationHost.get();
|
||||
|
||||
// if we run across a cert with a *, pass the machine name, and find the host name.
|
||||
if (subject[0] == '*')
|
||||
{
|
||||
destinationHost = strchr(destinationHost, '.');
|
||||
if (destinationHost)
|
||||
destinationHost++;
|
||||
|
||||
subject = subject + 2; // pass the *.
|
||||
}
|
||||
|
||||
// do the check
|
||||
int res = SSL_ERR_CERT_UNKNOWN;
|
||||
|
||||
if (! _stricmp (destinationHost, subject))
|
||||
{
|
||||
info->mSecurityState = nsIWebProgressListener::STATE_IS_SECURE | nsIWebProgressListener.STATE_SECURE_HIGH;
|
||||
res = SSL_ERR_OKAY;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (DisplaySSLProblemDialog(info, L"confirmMismatch") == IDYES)
|
||||
res = SSL_ERR_OKAY;
|
||||
}
|
||||
|
||||
if (end)
|
||||
end[0] = save;
|
||||
|
||||
gSslFreeCertificate ( cert ) ;
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
NS_IMPL_THREADSAFE_ISUPPORTS1(nsWINCESSLSocketProvider, nsISocketProvider)
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsWINCESSLSocketProvider::NewSocket(PRInt32 family,
|
||||
const char *host,
|
||||
PRInt32 port,
|
||||
const char *proxyHost,
|
||||
PRInt32 proxyPort,
|
||||
PRUint32 flags,
|
||||
PRFileDesc **result,
|
||||
nsISupports **socksInfo)
|
||||
{
|
||||
SOCKET s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
|
||||
|
||||
if (!s)
|
||||
return NS_ERROR_SOCKET_CREATE_FAILED;
|
||||
|
||||
nsWINCESSLSocketInfo * infoObject = new nsWINCESSLSocketInfo();
|
||||
if (!infoObject)
|
||||
{
|
||||
closesocket(s);
|
||||
return NS_ERROR_FAILURE;
|
||||
}
|
||||
NS_ADDREF(infoObject);
|
||||
|
||||
infoObject->Init(host, proxyHost, proxyPort);
|
||||
|
||||
// set the socket to secure mode
|
||||
DWORD dwFlag = SO_SEC_SSL ;
|
||||
if ( setsockopt (s, SOL_SOCKET, SO_SECURE, (char *)&dwFlag, sizeof(dwFlag)) )
|
||||
goto loser;
|
||||
|
||||
// set the certificate validation callback.
|
||||
SSLVALIDATECERTHOOK sslHook ;
|
||||
sslHook.HookFunc = SSLValidationHook;
|
||||
|
||||
NS_ADDREF(infoObject);
|
||||
sslHook.pvArg = (void *) infoObject; // XXXX Leak! what is the lifespan of this?
|
||||
|
||||
if ( WSAIoctl (s, SO_SSL_SET_VALIDATE_CERT_HOOK, &sslHook, sizeof sslHook, NULL, 0, NULL, NULL, NULL) )
|
||||
goto loser;
|
||||
|
||||
*result = PR_ImportTCPSocket(s);
|
||||
|
||||
if (!*result)
|
||||
goto loser;
|
||||
|
||||
*socksInfo = (nsISupports*) (nsITransportSecurityInfo*) infoObject;
|
||||
return NS_OK;
|
||||
|
||||
loser:
|
||||
closesocket(s);
|
||||
NS_RELEASE(infoObject);
|
||||
return NS_ERROR_SOCKET_CREATE_FAILED;
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsWINCESSLSocketProvider::AddToSocket(PRInt32 family,
|
||||
const char *host,
|
||||
PRInt32 port,
|
||||
const char *proxyHost,
|
||||
PRInt32 proxyPort,
|
||||
PRUint32 flags,
|
||||
PRFileDesc *sock,
|
||||
nsISupports **socksInfo)
|
||||
{
|
||||
return NS_ERROR_SOCKET_CREATE_FAILED;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
// XPCOM REGISTRATION BELOW
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
|
||||
#define NS_WINCESSLSOCKETPROVIDER_CID \
|
||||
{ /* 40f0fb5a-9819-4a48-bca9-da8170fd8b58 */ \
|
||||
0x40f0fb5a, \
|
||||
0x9819, \
|
||||
0x4a48, \
|
||||
{0xbc, 0xa9, 0xda, 0x81, 0x70, 0xfd, 0x8b, 0x58} \
|
||||
}
|
||||
|
||||
NS_GENERIC_FACTORY_CONSTRUCTOR(nsWINCESSLSocketProvider)
|
||||
NS_GENERIC_FACTORY_CONSTRUCTOR(nsSecureBrowserUIImpl)
|
||||
|
||||
static const nsModuleComponentInfo components[] =
|
||||
{
|
||||
{ "nsWINCESSLSocketProvider",
|
||||
NS_WINCESSLSOCKETPROVIDER_CID,
|
||||
NS_SSLSOCKETPROVIDER_CONTRACTID,
|
||||
nsWINCESSLSocketProviderConstructor
|
||||
},
|
||||
|
||||
{
|
||||
NS_SECURE_BROWSER_UI_CLASSNAME,
|
||||
NS_SECURE_BROWSER_UI_CID,
|
||||
NS_SECURE_BROWSER_UI_CONTRACTID,
|
||||
nsSecureBrowserUIImplConstructor
|
||||
},
|
||||
|
||||
};
|
||||
|
||||
NS_IMPL_NSGETMODULE(nsNativeSSLModule, components)
|
||||
Загрузка…
Ссылка в новой задаче