/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-

 *

 * This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

// For connections that are not processed on the socket transport thread, we do

// NOT use the async logic described below. Instead, we authenticate the

// certificate on the thread that the connection's I/O happens on,

// synchronously. This allows us to do certificate verification for blocking

// (not non-blocking) sockets and sockets that have their I/O processed on a

// thread other than the socket transport service thread. Also, we DO NOT

// support blocking sockets on the socket transport service thread at all.

//

// During certificate authentication, we call CERT_PKIXVerifyCert or

// CERT_VerifyCert. These functions may make zero or more HTTP requests

// for OCSP responses, CRLs, intermediate certificates, etc. Our fetching logic

// for these requests processes them on the socket transport service thread.

//

// If the connection for which we are verifying the certificate is happening

// on the socket transport thread (the usually case, at least for HTTP), then

// if our cert auth hook were to call the CERT_*Verify* functions directly,

// there would be a deadlock: The CERT_*Verify* function would cause an event

// to be asynchronously posted to the socket transport thread, and then it

// would block the socket transport thread waiting to be notified of the HTTP

// response. However, the HTTP request would never actually be processed

// because the socket transport thread would be blocked and so it wouldn't be

// able process HTTP requests. (i.e. Deadlock.)

//

// Consequently, when we are asked to verify a certificate on the socket

// transport service thread, we must always call the CERT_*Verify* cert

// functions on another thread. To accomplish this, our auth cert hook

// dispatches a SSLServerCertVerificationJob to a pool of background threads,

// and then immediately returns SECWouldBlock to libssl. These jobs are where

// the CERT_*Verify* functions are actually called.

//

// When our auth cert hook returns SECWouldBlock, libssl will carry on the

// handshake while we validate the certificate. This will free up the socket

// transport thread so that HTTP requests--in particular, the OCSP/CRL/cert

// requests needed for cert verification as mentioned above--can be processed.

//

// Once the CERT_*Verify* function returns, the cert verification job

// dispatches a SSLServerCertVerificationResult to the socket transport thread;

// the SSLServerCertVerificationResult will notify libssl that the certificate

// authentication is complete. Once libssl is notified that the authentication

// is complete, it will continue the SSL handshake (if it hasn't already

// finished) and it will begin allowing us to send/receive data on the

// connection.

//

// Timeline of events (for connections managed by the socket transport service):

//

//    * libssl calls SSLServerCertVerificationJob::Dispatch on the socket

//      transport thread.

//    * SSLServerCertVerificationJob::Dispatch queues a job

//      (instance of SSLServerCertVerificationJob) to its background thread

//      pool and returns.

//    * One of the background threads calls CERT_*Verify*, which may enqueue

//      some HTTP request(s) onto the socket transport thread, and then

//      blocks that background thread waiting for the responses and/or timeouts

//      or errors for those requests.

//    * Once those HTTP responses have all come back or failed, the

//      CERT_*Verify* function returns a result indicating that the validation

//      succeeded or failed.

//    * If the validation succeeded, then a SSLServerCertVerificationResult

//      event is posted to the socket transport thread, and the cert

//      verification thread becomes free to verify other certificates.

//    * Otherwise, a CertErrorRunnable is posted to the socket transport thread

//      and then to the main thread (blocking both, see CertErrorRunnable) to

//      do cert override processing and bad cert listener notification. Then

//      the cert verification thread becomes free to verify other certificates.

//    * After processing cert overrides, the CertErrorRunnable will dispatch a

//      SSLServerCertVerificationResult event to the socket transport thread to

//      notify it of the result of the override processing; then it returns,

//      freeing up the main thread.

//    * The SSLServerCertVerificationResult event will either wake up the

//      socket (using SSL_RestartHandshakeAfterServerCert) if validation

//      succeeded or there was an error override, or it will set an error flag

//      so that the next I/O operation on the socket will fail, causing the

//      socket transport thread to close the connection.

//

// Cert override processing must happen on the main thread because it accesses

// the nsICertOverrideService, and that service must be accessed on the main

// thread because some extensions (Selenium, in particular) replace it with a

// Javascript implementation, and chrome JS must always be run on the main

// thread.

//

// SSLServerCertVerificationResult must be dispatched to the socket transport

// thread because we must only call SSL_* functions on the socket transport

// thread since they may do I/O, because many parts of nsNSSSocketInfo (the

// subclass of TransportSecurityInfo used when validating certificates during

// an SSL handshake) and the PSM NSS I/O layer are not thread-safe, and because

// we need the event to interrupt the PR_Poll that may waiting for I/O on the

// socket for which we are validating the cert.

#include "SSLServerCertVerification.h"

#include <cstring>

#include "BRNameMatchingPolicy.h"

#include "CertVerifier.h"

#include "CryptoTask.h"

#include "ExtendedValidation.h"

#include "NSSCertDBTrustDomain.h"

#include "PSMRunnable.h"

#include "RootCertificateTelemetryUtils.h"

#include "ScopedNSSTypes.h"

#include "SharedCertVerifier.h"

#include "SharedSSLState.h"

#include "TransportSecurityInfo.h" // For RememberCertErrorsTable

#include "cert.h"

#include "mozilla/Assertions.h"

#include "mozilla/Casting.h"

#include "mozilla/RefPtr.h"

#include "mozilla/Telemetry.h"

#include "mozilla/UniquePtr.h"

#include "mozilla/Unused.h"

#include "mozilla/net/DNS.h"

#include "nsComponentManagerUtils.h"

#include "nsContentUtils.h"

#include "nsIBadCertListener2.h"

#include "nsICertOverrideService.h"

#include "nsISiteSecurityService.h"

#include "nsISocketProvider.h"

#include "nsThreadPool.h"

#include "nsNetUtil.h"

#include "nsNSSCertificate.h"

#include "nsNSSComponent.h"

#include "nsNSSIOLayer.h"

#include "nsServiceManagerUtils.h"

#include "nsString.h"

#include "nsURLHelper.h"

#include "nsXPCOMCIDInternal.h"

#include "pkix/pkix.h"

#include "pkix/pkixnss.h"

#include "secerr.h"

#include "secoidt.h"

#include "secport.h"

#include "ssl.h"

#include "sslerr.h"

extern mozilla::LazyLogModule gPIPNSSLog;

using namespace mozilla::pkix;

namespace mozilla { namespace psm {

namespace {

// do not use a nsCOMPtr to avoid static initializer/destructor

nsIThreadPool* gCertVerificationThreadPool = nullptr;

} // unnamed namespace

// Called when the socket transport thread starts, to initialize the SSL cert

// verification thread pool. By tying the thread pool startup/shutdown directly

// to the STS thread's lifetime, we ensure that they are *always* available for

// SSL connections and that there are no races during startup and especially

// shutdown. (Previously, we have had multiple problems with races in PSM

// background threads, and the race-prevention/shutdown logic used there is

// brittle. Since this service is critical to things like downloading updates,

// we take no chances.) Also, by doing things this way, we avoid the need for

// locks, since gCertVerificationThreadPool is only ever accessed on the socket

// transport thread.

void

InitializeSSLServerCertVerificationThreads()

{

  // TODO: tuning, make parameters preferences

  gCertVerificationThreadPool = new nsThreadPool();

  NS_ADDREF(gCertVerificationThreadPool);

  (void) gCertVerificationThreadPool->SetIdleThreadLimit(5);

  (void) gCertVerificationThreadPool->SetIdleThreadTimeout(30 * 1000);

  (void) gCertVerificationThreadPool->SetThreadLimit(5);

  (void) gCertVerificationThreadPool->SetName(NS_LITERAL_CSTRING("SSL Cert"));

}

// Called when the socket transport thread finishes, to destroy the thread

// pool. Since the socket transport service has stopped processing events, it

// will not attempt any more SSL I/O operations, so it is clearly safe to shut

// down the SSL cert verification infrastructure. Also, the STS will not

// dispatch many SSL verification result events at this point, so any pending

// cert verifications will (correctly) fail at the point they are dispatched.

//

// The other shutdown race condition that is possible is a race condition with

// shutdown of the nsNSSComponent service. We use the

// nsNSSShutdownPreventionLock where needed (not here) to prevent that.

void StopSSLServerCertVerificationThreads()

{

  if (gCertVerificationThreadPool) {

    gCertVerificationThreadPool->Shutdown();

    NS_RELEASE(gCertVerificationThreadPool);

  }

}

namespace {

// Dispatched to the STS thread to notify the infoObject of the verification

// result.

//

// This will cause the PR_Poll in the STS thread to return, so things work

// correctly even if the STS thread is blocked polling (only) on the file

// descriptor that is waiting for this result.

class SSLServerCertVerificationResult : public Runnable

{

public:

  NS_DECL_NSIRUNNABLE

  SSLServerCertVerificationResult(nsNSSSocketInfo* infoObject,

                                  PRErrorCode errorCode,

                                  Telemetry::HistogramID telemetryID = Telemetry::HistogramCount,

                                  uint32_t telemetryValue = -1);

  void Dispatch();

private:

  const RefPtr<nsNSSSocketInfo> mInfoObject;

public:

  const PRErrorCode mErrorCode;

  const Telemetry::HistogramID mTelemetryID;

  const uint32_t mTelemetryValue;

};

class CertErrorRunnable : public SyncRunnableBase

{

 public:

  CertErrorRunnable(const void* fdForLogging,

                    nsIX509Cert* cert,

                    nsNSSSocketInfo* infoObject,

                    PRErrorCode defaultErrorCodeToReport,

                    uint32_t collectedErrors,

                    PRErrorCode errorCodeTrust,

                    PRErrorCode errorCodeMismatch,

                    PRErrorCode errorCodeTime,

                    uint32_t providerFlags)

    : mFdForLogging(fdForLogging), mCert(cert), mInfoObject(infoObject),

      mDefaultErrorCodeToReport(defaultErrorCodeToReport),

      mCollectedErrors(collectedErrors),

      mErrorCodeTrust(errorCodeTrust),

      mErrorCodeMismatch(errorCodeMismatch),

      mErrorCodeTime(errorCodeTime),

      mProviderFlags(providerFlags)

  {

  }

  virtual void RunOnTargetThread() override;

  RefPtr<SSLServerCertVerificationResult> mResult; // out

private:

  SSLServerCertVerificationResult* CheckCertOverrides();

  nsresult OverrideAllowedForHost(/*out*/ bool& overrideAllowed);

  const void* const mFdForLogging; // may become an invalid pointer; do not dereference

  const nsCOMPtr<nsIX509Cert> mCert;

  const RefPtr<nsNSSSocketInfo> mInfoObject;

  const PRErrorCode mDefaultErrorCodeToReport;

  const uint32_t mCollectedErrors;

  const PRErrorCode mErrorCodeTrust;

  const PRErrorCode mErrorCodeMismatch;

  const PRErrorCode mErrorCodeTime;

  const uint32_t mProviderFlags;

};

// A probe value of 1 means "no error".

uint32_t

MapOverridableErrorToProbeValue(PRErrorCode errorCode)

{

  switch (errorCode)

  {

    case SEC_ERROR_UNKNOWN_ISSUER:                     return  2;

    case SEC_ERROR_CA_CERT_INVALID:                    return  3;

    case SEC_ERROR_UNTRUSTED_ISSUER:                   return  4;

    case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:         return  5;

    case SEC_ERROR_UNTRUSTED_CERT:                     return  6;

    case SEC_ERROR_INADEQUATE_KEY_USAGE:               return  7;

    case SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED:  return  8;

    case SSL_ERROR_BAD_CERT_DOMAIN:                    return  9;

    case SEC_ERROR_EXPIRED_CERTIFICATE:                return 10;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY: return 11;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_V1_CERT_USED_AS_CA: return 12;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE: return 13;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE: return 14;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_NOT_YET_VALID_ISSUER_CERTIFICATE:

      return 15;

    case SEC_ERROR_INVALID_TIME: return 16;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_EMPTY_ISSUER_NAME: return 17;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED:

      return 18;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT: return 19;

    case mozilla::pkix::MOZILLA_PKIX_ERROR_MITM_DETECTED: return 20;

  }

  NS_WARNING("Unknown certificate error code. Does MapOverridableErrorToProbeValue "

             "handle everything in DetermineCertOverrideErrors?");

  return 0;

}

static uint32_t

MapCertErrorToProbeValue(PRErrorCode errorCode)

{

  uint32_t probeValue;

  switch (errorCode)

  {

    // see security/pkix/include/pkix/Result.h

#define MOZILLA_PKIX_MAP(name, value, nss_name) case nss_name: probeValue = value; break;

    MOZILLA_PKIX_MAP_LIST

#undef MOZILLA_PKIX_MAP

    default: return 0;

  }

  // Since FATAL_ERROR_FLAG is 0x800, fatal error values are much larger than

  // non-fatal error values. To conserve space, we remap these so they start at

  // (decimal) 90 instead of 0x800. Currently there are ~50 non-fatal errors

  // mozilla::pkix might return, so saving space for 90 should be sufficient

  // (similarly, there are 4 fatal errors, so saving space for 10 should also

  // be sufficient).

  static_assert(FATAL_ERROR_FLAG == 0x800,

                "mozilla::pkix::FATAL_ERROR_FLAG is not what we were expecting");

  if (probeValue & FATAL_ERROR_FLAG) {

    probeValue ^= FATAL_ERROR_FLAG;

    probeValue += 90;

  }

  return probeValue;

}

SECStatus

DetermineCertOverrideErrors(const UniqueCERTCertificate& cert,

                            const nsACString& hostName,

                            PRTime now, PRErrorCode defaultErrorCodeToReport,

                            /*out*/ uint32_t& collectedErrors,

                            /*out*/ PRErrorCode& errorCodeTrust,

                            /*out*/ PRErrorCode& errorCodeMismatch,

                            /*out*/ PRErrorCode& errorCodeTime)

{

  MOZ_ASSERT(cert);

  MOZ_ASSERT(collectedErrors == 0);

  MOZ_ASSERT(errorCodeTrust == 0);

  MOZ_ASSERT(errorCodeMismatch == 0);

  MOZ_ASSERT(errorCodeTime == 0);

  // Assumes the error prioritization described in mozilla::pkix's

  // BuildForward function. Also assumes that CheckCertHostname was only

  // called if CertVerifier::VerifyCert succeeded.

  switch (defaultErrorCodeToReport) {

    case SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED:

    case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:

    case SEC_ERROR_UNKNOWN_ISSUER:

    case SEC_ERROR_CA_CERT_INVALID:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_EMPTY_ISSUER_NAME:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_MITM_DETECTED:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_NOT_YET_VALID_ISSUER_CERTIFICATE:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_V1_CERT_USED_AS_CA:

    {

      collectedErrors = nsICertOverrideService::ERROR_UNTRUSTED;

      errorCodeTrust = defaultErrorCodeToReport;

      SECCertTimeValidity validity = CERT_CheckCertValidTimes(cert.get(), now,

                                                              false);

      if (validity == secCertTimeUndetermined) {

        // This only happens if cert is null. CERT_CheckCertValidTimes will

        // have set the error code to SEC_ERROR_INVALID_ARGS. We should really

        // be using mozilla::pkix here anyway.

        MOZ_ASSERT(PR_GetError() == SEC_ERROR_INVALID_ARGS);

        return SECFailure;

      }

      if (validity == secCertTimeExpired) {

        collectedErrors |= nsICertOverrideService::ERROR_TIME;

        errorCodeTime = SEC_ERROR_EXPIRED_CERTIFICATE;

      } else if (validity == secCertTimeNotValidYet) {

        collectedErrors |= nsICertOverrideService::ERROR_TIME;

        errorCodeTime =

          mozilla::pkix::MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE;

      }

      break;

    }

    case SEC_ERROR_INVALID_TIME:

    case SEC_ERROR_EXPIRED_CERTIFICATE:

    case mozilla::pkix::MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE:

      collectedErrors = nsICertOverrideService::ERROR_TIME;

      errorCodeTime = defaultErrorCodeToReport;

      break;

    case SSL_ERROR_BAD_CERT_DOMAIN:

      collectedErrors = nsICertOverrideService::ERROR_MISMATCH;

      errorCodeMismatch = SSL_ERROR_BAD_CERT_DOMAIN;

      break;

    case 0:

      NS_ERROR("No error code set during certificate validation failure.");

      PR_SetError(PR_INVALID_STATE_ERROR, 0);

      return SECFailure;

    default:

      PR_SetError(defaultErrorCodeToReport, 0);

      return SECFailure;

  }

  if (defaultErrorCodeToReport != SSL_ERROR_BAD_CERT_DOMAIN) {

    Input certInput;

    if (certInput.Init(cert->derCert.data, cert->derCert.len) != Success) {

      PR_SetError(SEC_ERROR_BAD_DER, 0);

      return SECFailure;

    }

    Input hostnameInput;

    Result result = hostnameInput.Init(

      BitwiseCast<const uint8_t*, const char*>(hostName.BeginReading()),

      hostName.Length());

    if (result != Success) {

      PR_SetError(SEC_ERROR_INVALID_ARGS, 0);

      return SECFailure;

    }

    // Use a lax policy so as to not generate potentially spurious name

    // mismatch "hints".

    BRNameMatchingPolicy nameMatchingPolicy(

      BRNameMatchingPolicy::Mode::DoNotEnforce);

    // CheckCertHostname expects that its input represents a certificate that

    // has already been successfully validated by BuildCertChain. This is

    // obviously not the case, however, because we're in the error path of

    // certificate verification. Thus, this is problematic. In the future, it

    // would be nice to remove this optimistic additional error checking and

    // simply punt to the front-end, which can more easily (and safely) perform

    // extra checks to give the user hints as to why verification failed.

    result = CheckCertHostname(certInput, hostnameInput, nameMatchingPolicy);

    // Treat malformed name information as a domain mismatch.

    if (result == Result::ERROR_BAD_DER ||

        result == Result::ERROR_BAD_CERT_DOMAIN) {

      collectedErrors |= nsICertOverrideService::ERROR_MISMATCH;

      errorCodeMismatch = SSL_ERROR_BAD_CERT_DOMAIN;

    } else if (IsFatalError(result)) {

      // Because its input has not been validated by BuildCertChain,

      // CheckCertHostname can return an error that is less important than the

      // original certificate verification error. Only return an error result

      // from this function if we've encountered a fatal error.

      PR_SetError(MapResultToPRErrorCode(result), 0);

      return SECFailure;

    }

  }

  return SECSuccess;

}

// Helper function to determine if overrides are allowed for this host.

// Overrides are not allowed for known HSTS or HPKP hosts. However, an IP

// address is never considered an HSTS or HPKP host.

nsresult

CertErrorRunnable::OverrideAllowedForHost(/*out*/ bool& overrideAllowed)

{

  overrideAllowed = false;

  // If this is an IP address, overrides are allowed, because an IP address is

  // never an HSTS or HPKP host. nsISiteSecurityService takes this into account

  // already, but the real problem here is that calling NS_NewURI with an IPv6

  // address fails. We do this to avoid that. A more comprehensive fix would be

  // to have Necko provide an nsIURI to PSM and to use that here (and

  // everywhere). However, that would be a wide-spanning change.

  const nsACString& hostname = mInfoObject->GetHostName();

  if (net_IsValidIPv6Addr(hostname.BeginReading(), hostname.Length())) {

    overrideAllowed = true;

    return NS_OK;

  }

  // If this is an HTTP Strict Transport Security host or a pinned host and the

  // certificate is bad, don't allow overrides (RFC 6797 section 12.1,

  // HPKP draft spec section 2.6).

  bool strictTransportSecurityEnabled = false;

  bool hasPinningInformation = false;

  nsCOMPtr<nsISiteSecurityService> sss(do_GetService(NS_SSSERVICE_CONTRACTID));

  if (!sss) {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

            ("[%p][%p] couldn't get nsISiteSecurityService to check HSTS/HPKP",

            mFdForLogging, this));

    return NS_ERROR_FAILURE;

  }

  nsCOMPtr<nsIURI> uri;

  nsresult rv = NS_NewURI(getter_AddRefs(uri),

                          NS_LITERAL_CSTRING("https://") + hostname);

  if (NS_FAILED(rv)) {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

            ("[%p][%p] Creating new URI failed", mFdForLogging, this));

    return rv;

  }

  rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS,

                        uri,

                        mProviderFlags,

                        mInfoObject->GetOriginAttributes(),

                        nullptr,

                        nullptr,

                        &strictTransportSecurityEnabled);

  if (NS_FAILED(rv)) {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

            ("[%p][%p] checking for HSTS failed", mFdForLogging, this));

    return rv;

  }

  rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HPKP,

                        uri,

                        mProviderFlags,

                        mInfoObject->GetOriginAttributes(),

                        nullptr,

                        nullptr,

                        &hasPinningInformation);

  if (NS_FAILED(rv)) {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

            ("[%p][%p] checking for HPKP failed", mFdForLogging, this));

    return rv;

  }

  overrideAllowed = !strictTransportSecurityEnabled && !hasPinningInformation;

  return NS_OK;

}

SSLServerCertVerificationResult*

CertErrorRunnable::CheckCertOverrides()

{

  MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("[%p][%p] top of CheckCertOverrides\n",

                                    mFdForLogging, this));

  // "Use" mFdForLogging in non-PR_LOGGING builds, too, to suppress

  // clang's -Wunused-private-field build warning for this variable:

  Unused << mFdForLogging;

  if (!NS_IsMainThread()) {

    NS_ERROR("CertErrorRunnable::CheckCertOverrides called off main thread");

    return new SSLServerCertVerificationResult(mInfoObject,

                                               mDefaultErrorCodeToReport);

  }

  int32_t port = mInfoObject->GetPort();

  nsAutoCString hostWithPortString(mInfoObject->GetHostName());

  hostWithPortString.Append(':');

  hostWithPortString.AppendInt(port);

  uint32_t remaining_display_errors = mCollectedErrors;

  bool overrideAllowed;

  if (NS_FAILED(OverrideAllowedForHost(overrideAllowed))) {

    return new SSLServerCertVerificationResult(mInfoObject,

                                               mDefaultErrorCodeToReport);

  }

  if (overrideAllowed) {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

           ("[%p][%p] no HSTS or HPKP - overrides allowed\n",

            mFdForLogging, this));

    nsCOMPtr<nsICertOverrideService> overrideService =

      do_GetService(NS_CERTOVERRIDE_CONTRACTID);

    // it is fine to continue without the nsICertOverrideService

    uint32_t overrideBits = 0;

    if (overrideService) {

      bool haveOverride;

      bool isTemporaryOverride; // we don't care

      const nsACString& hostString(mInfoObject->GetHostName());

      nsresult rv = overrideService->HasMatchingOverride(hostString, port,

                                                         mCert,

                                                         &overrideBits,

                                                         &isTemporaryOverride,

                                                         &haveOverride);

      if (NS_SUCCEEDED(rv) && haveOverride) {

       // remove the errors that are already overriden

        remaining_display_errors &= ~overrideBits;

      }

    }

    if (!remaining_display_errors) {

      // This can double- or triple-count one certificate with multiple

      // different types of errors. Since this is telemetry and we just

      // want a ballpark answer, we don't care.

      if (mErrorCodeTrust != 0) {

        uint32_t probeValue = MapOverridableErrorToProbeValue(mErrorCodeTrust);

        Telemetry::Accumulate(Telemetry::SSL_CERT_ERROR_OVERRIDES, probeValue);

      }

      if (mErrorCodeMismatch != 0) {

        uint32_t probeValue = MapOverridableErrorToProbeValue(mErrorCodeMismatch);

        Telemetry::Accumulate(Telemetry::SSL_CERT_ERROR_OVERRIDES, probeValue);

      }

      if (mErrorCodeTime != 0) {

        uint32_t probeValue = MapOverridableErrorToProbeValue(mErrorCodeTime);

        Telemetry::Accumulate(Telemetry::SSL_CERT_ERROR_OVERRIDES, probeValue);

      }

      // all errors are covered by override rules, so let's accept the cert

      MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

             ("[%p][%p] All errors covered by override rules\n",

             mFdForLogging, this));

      return new SSLServerCertVerificationResult(mInfoObject, 0);

    }

  } else {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

           ("[%p][%p] HSTS or HPKP - no overrides allowed\n",

            mFdForLogging, this));

  }

  MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

         ("[%p][%p] Certificate error was not overridden\n",

         mFdForLogging, this));

  // Ok, this is a full stop.

  // First, deliver the technical details of the broken SSL status.

  // Try to get a nsIBadCertListener2 implementation from the socket consumer.

  nsCOMPtr<nsISSLSocketControl> sslSocketControl = do_QueryInterface(

    NS_ISUPPORTS_CAST(nsITransportSecurityInfo*, mInfoObject));

  if (sslSocketControl) {

    nsCOMPtr<nsIInterfaceRequestor> cb;

    sslSocketControl->GetNotificationCallbacks(getter_AddRefs(cb));

    if (cb) {

      nsCOMPtr<nsIBadCertListener2> bcl = do_GetInterface(cb);

      if (bcl) {

        nsIInterfaceRequestor* csi

          = static_cast<nsIInterfaceRequestor*>(mInfoObject);

        bool suppressMessage = false; // obsolete, ignored

        Unused << bcl->NotifyCertProblem(csi, mInfoObject,

                                         hostWithPortString, &suppressMessage);

      }

    }

  }

  // pick the error code to report by priority

  PRErrorCode errorCodeToReport = mErrorCodeTrust    ? mErrorCodeTrust

                                : mErrorCodeMismatch ? mErrorCodeMismatch

                                : mErrorCodeTime     ? mErrorCodeTime

                                : mDefaultErrorCodeToReport;

  SSLServerCertVerificationResult* result =

    new SSLServerCertVerificationResult(mInfoObject,

                                        errorCodeToReport,

                                        Telemetry::HistogramCount,

                                        -1);

  return result;

}

void

CertErrorRunnable::RunOnTargetThread()

{

  MOZ_ASSERT(NS_IsMainThread());

  mResult = CheckCertOverrides();

  MOZ_ASSERT(mResult);

}

// Returns null with the error code (PR_GetError()) set if it does not create

// the CertErrorRunnable.

CertErrorRunnable*

CreateCertErrorRunnable(CertVerifier& certVerifier,

                        PRErrorCode defaultErrorCodeToReport,

                        nsNSSSocketInfo* infoObject,

                        const UniqueCERTCertificate& cert,

                        const void* fdForLogging,

                        uint32_t providerFlags,

                        PRTime now)

{

  MOZ_ASSERT(infoObject);

  MOZ_ASSERT(cert);

  uint32_t probeValue = MapCertErrorToProbeValue(defaultErrorCodeToReport);

  Telemetry::Accumulate(Telemetry::SSL_CERT_VERIFICATION_ERRORS, probeValue);

  uint32_t collected_errors = 0;

  PRErrorCode errorCodeTrust = 0;

  PRErrorCode errorCodeMismatch = 0;

  PRErrorCode errorCodeTime = 0;

  if (DetermineCertOverrideErrors(cert, infoObject->GetHostName(), now,

                                  defaultErrorCodeToReport, collected_errors,

                                  errorCodeTrust, errorCodeMismatch,

                                  errorCodeTime) != SECSuccess) {

    // Attempt to enforce that if DetermineCertOverrideErrors failed,

    // PR_SetError was set with a non-overridable error. This is because if we

    // return from CreateCertErrorRunnable without calling

    // infoObject->SetStatusErrorBits, we won't have the required information

    // to actually add a certificate error override. This results in a broken

    // UI which is annoying but not a security disaster.

    MOZ_ASSERT(!ErrorIsOverridable(PR_GetError()));

    return nullptr;

  }

  RefPtr<nsNSSCertificate> nssCert(nsNSSCertificate::Create(cert.get()));

  if (!nssCert) {

    NS_ERROR("nsNSSCertificate::Create failed");

    PR_SetError(SEC_ERROR_NO_MEMORY, 0);

    return nullptr;

  }

  if (!collected_errors) {

    // This will happen when CERT_*Verify* only returned error(s) that are

    // not on our whitelist of overridable certificate errors.

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("[%p] !collected_errors: %d\n",

           fdForLogging, static_cast<int>(defaultErrorCodeToReport)));

    PR_SetError(defaultErrorCodeToReport, 0);

    return nullptr;

  }

  infoObject->SetStatusErrorBits(nssCert, collected_errors);

  return new CertErrorRunnable(fdForLogging,

                               static_cast<nsIX509Cert*>(nssCert.get()),

                               infoObject, defaultErrorCodeToReport,

                               collected_errors, errorCodeTrust,

                               errorCodeMismatch, errorCodeTime,

                               providerFlags);

}

// When doing async cert processing, we dispatch one of these runnables to the

// socket transport service thread, which blocks the socket transport

// service thread while it waits for the inner CertErrorRunnable to execute

// CheckCertOverrides on the main thread. CheckCertOverrides must block events

// on both of these threads because it calls TransportSecurityInfo::GetInterface(),

// which may call nsHttpConnection::GetInterface() through

// TransportSecurityInfo::mCallbacks. nsHttpConnection::GetInterface must always

// execute on the main thread, with the socket transport service thread

// blocked.

class CertErrorRunnableRunnable : public Runnable

{

public:

  explicit CertErrorRunnableRunnable(CertErrorRunnable* certErrorRunnable)

    : Runnable("psm::CertErrorRunnableRunnable")

    , mCertErrorRunnable(certErrorRunnable)

  {

  }

private:

  NS_IMETHOD Run() override

  {

    nsresult rv = mCertErrorRunnable->DispatchToMainThreadAndWait();

    // The result must run on the socket transport thread, which we are already

    // on, so we can just run it directly, instead of dispatching it.

    if (NS_SUCCEEDED(rv)) {

      rv = mCertErrorRunnable->mResult ? mCertErrorRunnable->mResult->Run()

                                       : NS_ERROR_UNEXPECTED;

    }

    return rv;

  }

  RefPtr<CertErrorRunnable> mCertErrorRunnable;

};

class SSLServerCertVerificationJob : public Runnable

{

public:

  // Must be called only on the socket transport thread

  static SECStatus Dispatch(const RefPtr<SharedCertVerifier>& certVerifier,

                            const void* fdForLogging,

                            nsNSSSocketInfo* infoObject,

                            const UniqueCERTCertificate& serverCert,

                            const UniqueCERTCertList& peerCertChain,

                            const SECItem* stapledOCSPResponse,

                            const SECItem* sctsFromTLSExtension,

                            uint32_t providerFlags,

                            Time time,

                            PRTime prtime);

private:

  NS_DECL_NSIRUNNABLE

  // Must be called only on the socket transport thread

  SSLServerCertVerificationJob(const RefPtr<SharedCertVerifier>& certVerifier,

                               const void* fdForLogging,

                               nsNSSSocketInfo* infoObject,

                               const UniqueCERTCertificate& cert,

                               UniqueCERTCertList peerCertChain,

                               const SECItem* stapledOCSPResponse,

                               const SECItem* sctsFromTLSExtension,

                               uint32_t providerFlags,

                               Time time,

                               PRTime prtime);

  const RefPtr<SharedCertVerifier> mCertVerifier;

  const void* const mFdForLogging;

  const RefPtr<nsNSSSocketInfo> mInfoObject;

  const UniqueCERTCertificate mCert;

  UniqueCERTCertList mPeerCertChain;

  const uint32_t mProviderFlags;

  const Time mTime;

  const PRTime mPRTime;

  const TimeStamp mJobStartTime;

  const UniqueSECItem mStapledOCSPResponse;

  const UniqueSECItem mSCTsFromTLSExtension;

};

SSLServerCertVerificationJob::SSLServerCertVerificationJob(

  const RefPtr<SharedCertVerifier>& certVerifier,

  const void* fdForLogging,

  nsNSSSocketInfo* infoObject,

  const UniqueCERTCertificate& cert,

  UniqueCERTCertList peerCertChain,

  const SECItem* stapledOCSPResponse,

  const SECItem* sctsFromTLSExtension,

  uint32_t providerFlags,

  Time time,

  PRTime prtime)

  : Runnable("psm::SSLServerCertVerificationJob")

  , mCertVerifier(certVerifier)

  , mFdForLogging(fdForLogging)

  , mInfoObject(infoObject)

  , mCert(CERT_DupCertificate(cert.get()))

  , mPeerCertChain(std::move(peerCertChain))

  , mProviderFlags(providerFlags)

  , mTime(time)

  , mPRTime(prtime)

  , mJobStartTime(TimeStamp::Now())

  , mStapledOCSPResponse(SECITEM_DupItem(stapledOCSPResponse))

  , mSCTsFromTLSExtension(SECITEM_DupItem(sctsFromTLSExtension))

{

}

// This function assumes that we will only use the SPDY connection coalescing

// feature on connections where we have negotiated SPDY using NPN. If we ever

// talk SPDY without having negotiated it with SPDY, this code will give wrong

// and perhaps unsafe results.

//

// Returns SECSuccess on the initial handshake of all connections, on

// renegotiations for any connections where we did not negotiate SPDY, or on any

// SPDY connection where the server's certificate did not change.

//

// Prohibit changing the server cert only if we negotiated SPDY,

// in order to support SPDY's cross-origin connection pooling.

static SECStatus

BlockServerCertChangeForSpdy(nsNSSSocketInfo* infoObject,

                             const UniqueCERTCertificate& serverCert)

{

  // Get the existing cert. If there isn't one, then there is

  // no cert change to worry about.

  nsCOMPtr<nsIX509Cert> cert;

  if (!infoObject->IsHandshakeCompleted()) {

    // first handshake on this connection, not a

    // renegotiation.

    return SECSuccess;

  }

  infoObject->GetServerCert(getter_AddRefs(cert));

  if (!cert) {

    MOZ_ASSERT_UNREACHABLE(

             "TransportSecurityInfo must have a cert implementing nsIX509Cert");

    PR_SetError(SEC_ERROR_LIBRARY_FAILURE, 0);

    return SECFailure;

  }

  // Filter out sockets that did not neogtiate SPDY via NPN

  nsAutoCString negotiatedNPN;

  nsresult rv = infoObject->GetNegotiatedNPN(negotiatedNPN);

  MOZ_ASSERT(NS_SUCCEEDED(rv), "GetNegotiatedNPN() failed during renegotiation");

  if (NS_SUCCEEDED(rv) && !StringBeginsWith(negotiatedNPN,

                                            NS_LITERAL_CSTRING("spdy/"))) {

    return SECSuccess;

  }

  // If GetNegotiatedNPN() failed we will assume spdy for safety's safe

  if (NS_FAILED(rv)) {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

           ("BlockServerCertChangeForSpdy failed GetNegotiatedNPN() call."

            " Assuming spdy.\n"));

  }

  // Check to see if the cert has actually changed

  UniqueCERTCertificate c(cert->GetCert());

  MOZ_ASSERT(c, "Somehow couldn't get underlying cert from nsIX509Cert");

  bool sameCert = CERT_CompareCerts(c.get(), serverCert.get());

  if (sameCert) {

    return SECSuccess;

  }

  // Report an error - changed cert is confirmed

  MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

         ("SPDY Refused to allow new cert during renegotiation\n"));

  PR_SetError(SSL_ERROR_RENEGOTIATION_NOT_ALLOWED, 0);

  return SECFailure;

}

void

AccumulateSubjectCommonNameTelemetry(const char* commonName,

                                     bool commonNameInSubjectAltNames)

{

  if (!commonName) {

    // 1 means no common name present

    Telemetry::Accumulate(Telemetry::BR_9_2_2_SUBJECT_COMMON_NAME, 1);

  } else if (!commonNameInSubjectAltNames) {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

           ("BR telemetry: common name '%s' not in subject alt. names "

            "(or the subject alt. names extension is not present)\n",

            commonName));

    // 2 means the common name is not present in subject alt names

    Telemetry::Accumulate(Telemetry::BR_9_2_2_SUBJECT_COMMON_NAME, 2);

  } else {

    // 0 means the common name is present in subject alt names

    Telemetry::Accumulate(Telemetry::BR_9_2_2_SUBJECT_COMMON_NAME, 0);

  }

}

// Returns true if and only if commonName ends with altName (minus its leading

// "*"). altName has already been checked to be of the form "*.<something>".

// commonName may be NULL.

static bool

TryMatchingWildcardSubjectAltName(const char* commonName,

                                  const nsACString& altName)

{

  return commonName &&

         StringEndsWith(nsDependentCString(commonName), Substring(altName, 1));

}

// Gathers telemetry on Baseline Requirements 9.2.1 (Subject Alternative

// Names Extension) and 9.2.2 (Subject Common Name Field).

// Specifically:

//  - whether or not the subject common name field is present

//  - whether or not the subject alternative names extension is present

//  - if there is a malformed entry in the subject alt. names extension

//  - if there is an entry in the subject alt. names extension corresponding

//    to the subject common name

// Telemetry is only gathered for certificates that chain to a trusted root

// in Mozilla's Root CA program.

// certList consists of a validated certificate chain. The end-entity

// certificate is first and the root (trust anchor) is last.

void

GatherBaselineRequirementsTelemetry(const UniqueCERTCertList& certList)

{

  CERTCertListNode* endEntityNode = CERT_LIST_HEAD(certList);

  CERTCertListNode* rootNode = CERT_LIST_TAIL(certList);

  MOZ_ASSERT(!(CERT_LIST_END(endEntityNode, certList) ||

               CERT_LIST_END(rootNode, certList)));

  if (CERT_LIST_END(endEntityNode, certList) ||

      CERT_LIST_END(rootNode, certList)) {

    return;

  }

  CERTCertificate* cert = endEntityNode->cert;

  MOZ_ASSERT(cert);

  if (!cert) {

    return;

  }

  UniquePORTString commonName(CERT_GetCommonName(&cert->subject));

  // This only applies to certificates issued by authorities in our root

  // program.

  CERTCertificate* rootCert = rootNode->cert;

  MOZ_ASSERT(rootCert);

  if (!rootCert) {

    return;

  }

  bool isBuiltIn = false;

  Result result = IsCertBuiltInRoot(rootCert, isBuiltIn);

  if (result != Success || !isBuiltIn) {

    MOZ_LOG(gPIPNSSLog, LogLevel::Debug,

           ("BR telemetry: root certificate for '%s' is not a built-in root "

            "(or IsCertBuiltInRoot failed)\n", commonName.get()));

    return;

  }