The Tor Browser: security/manager/ssl/src/SharedSSLState.cpp@6474c204b198 (annotated)

security/manager/ssl/src/SharedSSLState.cpp@6474c204b198 (annotated)

security/manager/ssl/src/SharedSSLState.cpp

Wed, 31 Dec 2014 06:09:35 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Wed, 31 Dec 2014 06:09:35 +0100
changeset 0: 6474c204b198
permissions: -rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "SharedSSLState.h"
 #include "nsClientAuthRemember.h"
 #include "nsComponentManagerUtils.h"
 #include "nsICertOverrideService.h"
 #include "nsIObserverService.h"
 #include "mozilla/Services.h"
 #include "nsThreadUtils.h"
 #include "nsCRT.h"
 #include "nsServiceManagerUtils.h"
 #include "nsRecentBadCerts.h"
 #include "PSMRunnable.h"
 #include "PublicSSL.h"
 #include "ssl.h"
 #include "nsNetCID.h"
 #include "mozilla/Atomics.h"
 #include "mozilla/unused.h"
 using mozilla::psm::SyncRunnableBase;
 using mozilla::Atomic;
 using mozilla::unused;
 namespace {
 static Atomic<bool> sCertOverrideSvcExists(false);
 static Atomic<bool> sCertDBExists(false);
 class MainThreadClearer : public SyncRunnableBase
 {
 public:
   MainThreadClearer() : mShouldClearSessionCache(false) {}
   void RunOnTargetThread() {
     // In some cases it's possible to cause PSM/NSS to initialize while XPCOM shutdown
     // is in progress. We want to avoid this, since they do not handle the situation well,
     // hence the flags to avoid instantiating the services if they don't already exist.
     bool certOverrideSvcExists = sCertOverrideSvcExists.exchange(false);
     if (certOverrideSvcExists) {
       sCertOverrideSvcExists = true;
       nsCOMPtr<nsICertOverrideService> icos = do_GetService(NS_CERTOVERRIDE_CONTRACTID);
       if (icos) {
         icos->ClearValidityOverride(
           NS_LITERAL_CSTRING("all:temporary-certificates"),
 );
       }
     }
     bool certDBExists = sCertDBExists.exchange(false);
     if (certDBExists) {
       sCertDBExists = true;
       nsCOMPtr<nsIX509CertDB> certdb = do_GetService(NS_X509CERTDB_CONTRACTID);
       if (certdb) {
         nsCOMPtr<nsIRecentBadCerts> badCerts;
         certdb->GetRecentBadCerts(true, getter_AddRefs(badCerts));
         if (badCerts) {
           badCerts->ResetStoredCerts();
         }
       }
     }
     // This needs to be checked on the main thread to avoid racing with NSS
     // initialization.
     mShouldClearSessionCache = mozilla::psm::PrivateSSLState() &&
                                mozilla::psm::PrivateSSLState()->SocketCreated();
   }
   bool mShouldClearSessionCache;
 };
 } // anonymous namespace
 namespace mozilla {
 void ClearPrivateSSLState()
 {
   // This only works if it is called on the socket transport
   // service thread immediately after closing all private SSL
   // connections.
 #ifdef DEBUG
   nsresult rv;
   nsCOMPtr<nsIEventTarget> sts
     = do_GetService(NS_SOCKETTRANSPORTSERVICE_CONTRACTID, &rv);
   MOZ_ASSERT(NS_SUCCEEDED(rv));
   bool onSTSThread;
   rv = sts->IsOnCurrentThread(&onSTSThread);
   MOZ_ASSERT(NS_SUCCEEDED(rv) && onSTSThread);
 #endif
   RefPtr<MainThreadClearer> runnable = new MainThreadClearer;
   runnable->DispatchToMainThreadAndWait();
   // If NSS isn't initialized, this throws an assertion. We guard it by checking if
   // the session cache might even have anything worth clearing.
   if (runnable->mShouldClearSessionCache) {
     SSL_ClearSessionCache();
   }
 }
 namespace psm {
 namespace {
 class PrivateBrowsingObserver : public nsIObserver {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIOBSERVER
   PrivateBrowsingObserver(SharedSSLState* aOwner) : mOwner(aOwner) {}
   virtual ~PrivateBrowsingObserver() {}
 private:
   SharedSSLState* mOwner;
 };
 SharedSSLState* gPublicState;
 SharedSSLState* gPrivateState;
 } // anonymous namespace
 NS_IMPL_ISUPPORTS(PrivateBrowsingObserver, nsIObserver)
 NS_IMETHODIMP
 PrivateBrowsingObserver::Observe(nsISupports     *aSubject,
                                  const char      *aTopic,
                                  const char16_t *aData)
 {
   if (!nsCRT::strcmp(aTopic, "last-pb-context-exited")) {
     mOwner->ResetStoredData();
   }
   return NS_OK;
 }
 SharedSSLState::SharedSSLState()
 : mClientAuthRemember(new nsClientAuthRememberService)
 , mMutex("SharedSSLState::mMutex")
 , mSocketCreated(false)
 , mOCSPStaplingEnabled(false)
 {
   mIOLayerHelpers.Init();
   mClientAuthRemember->Init();
 }
 SharedSSLState::~SharedSSLState()
 {
 }
 void
 SharedSSLState::NotePrivateBrowsingStatus()
 {
   MOZ_ASSERT(NS_IsMainThread(), "Not on main thread");
   mObserver = new PrivateBrowsingObserver(this);
   nsCOMPtr<nsIObserverService> obsSvc = mozilla::services::GetObserverService();
   obsSvc->AddObserver(mObserver, "last-pb-context-exited", false);
 }
 void
 SharedSSLState::ResetStoredData()
 {
   MOZ_ASSERT(NS_IsMainThread(), "Not on main thread");
   mClientAuthRemember->ClearRememberedDecisions();
   mIOLayerHelpers.clearStoredData();
 }
 void
 SharedSSLState::NoteSocketCreated()
 {
   MutexAutoLock lock(mMutex);
   mSocketCreated = true;
 }
 bool
 SharedSSLState::SocketCreated()
 {
   MutexAutoLock lock(mMutex);
   return mSocketCreated;
 }
 /*static*/ void
 SharedSSLState::GlobalInit()
 {
   MOZ_ASSERT(NS_IsMainThread(), "Not on main thread");
   gPublicState = new SharedSSLState();
   gPrivateState = new SharedSSLState();
   gPrivateState->NotePrivateBrowsingStatus();
 }
 /*static*/ void
 SharedSSLState::GlobalCleanup()
 {
   MOZ_ASSERT(NS_IsMainThread(), "Not on main thread");
   if (gPrivateState) {
     gPrivateState->Cleanup();
     delete gPrivateState;
     gPrivateState = nullptr;
   }
   if (gPublicState) {
     gPublicState->Cleanup();
     delete gPublicState;
     gPublicState = nullptr;
   }
 }
 /*static*/ void
 SharedSSLState::NoteCertOverrideServiceInstantiated()
 {
   sCertOverrideSvcExists = true;
 }
 /*static*/ void
 SharedSSLState::NoteCertDBServiceInstantiated()
 {
   sCertDBExists = true;
 }
 void
 SharedSSLState::Cleanup()
 {
   mIOLayerHelpers.Cleanup();
 }
 SharedSSLState*
 PublicSSLState()
 {
   return gPublicState;
 }
 SharedSSLState*
 PrivateSSLState()
 {
   return gPrivateState;
 }
 } // namespace psm
 } // namespace mozilla

The Tor Browser / annotate

security/manager/ssl/src/SharedSSLState.cpp@6474c204b198 (annotated)

security/manager/ssl/src/SharedSSLState.cpp