123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175 |
- #ifndef UPDATE_ENGINE_CERTIFICATE_CHECKER_H_
- #define UPDATE_ENGINE_CERTIFICATE_CHECKER_H_
- #include <curl/curl.h>
- #include <openssl/ssl.h>
- #include <string>
- #include <base/macros.h>
- #include <gtest/gtest_prod.h> // for FRIEND_TEST
- namespace chromeos_update_engine {
- class PrefsInterface;
- class OpenSSLWrapper {
- public:
- OpenSSLWrapper() = default;
- virtual ~OpenSSLWrapper() = default;
-
-
-
-
-
-
-
-
-
-
- virtual bool GetCertificateDigest(X509_STORE_CTX* x509_ctx,
- int* out_depth,
- unsigned int* out_digest_length,
- uint8_t* out_digest) const;
- private:
- DISALLOW_COPY_AND_ASSIGN(OpenSSLWrapper);
- };
- enum class CertificateCheckResult {
-
-
- kValid,
-
-
- kValidChanged,
-
- kFailed,
-
- kNumConstants
- };
- enum class ServerToCheck {
- kUpdate = 0,
- kDownload,
-
- kNone,
- };
- class CertificateChecker {
- public:
- class Observer {
- public:
- virtual ~Observer() = default;
-
-
- virtual void CertificateChecked(ServerToCheck server_to_check,
- CertificateCheckResult result) = 0;
- };
- CertificateChecker(PrefsInterface* prefs, OpenSSLWrapper* openssl_wrapper);
- ~CertificateChecker();
-
-
-
-
- static CURLcode ProcessSSLContext(CURL* curl_handle,
- SSL_CTX* ssl_ctx,
- void* cert_checker);
-
-
-
- void Init();
-
-
-
- void SetObserver(Observer* observer) { observer_ = observer; }
- private:
- FRIEND_TEST(CertificateCheckerTest, NewCertificate);
- FRIEND_TEST(CertificateCheckerTest, SameCertificate);
- FRIEND_TEST(CertificateCheckerTest, ChangedCertificate);
- FRIEND_TEST(CertificateCheckerTest, FailedCertificate);
-
-
-
-
-
-
-
-
- static int VerifySSLCallbackDownload(int preverify_ok,
- X509_STORE_CTX* x509_ctx);
- static int VerifySSLCallbackUpdate(int preverify_ok,
- X509_STORE_CTX* x509_ctx);
- static int VerifySSLCallback(int preverify_ok,
- X509_STORE_CTX* x509_ctx,
- ServerToCheck server_to_check);
-
-
-
-
-
- bool CheckCertificateChange(int preverify_ok,
- X509_STORE_CTX* x509_ctx,
- ServerToCheck server_to_check);
-
- void NotifyCertificateChecked(ServerToCheck server_to_check,
- CertificateCheckResult result);
-
- static CertificateChecker* cert_checker_singleton_;
-
- PrefsInterface* prefs_;
-
- OpenSSLWrapper* openssl_wrapper_;
-
- Observer* observer_{nullptr};
- DISALLOW_COPY_AND_ASSIGN(CertificateChecker);
- };
- }
- #endif
|