dc24656e5e
WebRTC is currently using the SSL_CTX_set_verify callback. This configures a callback for use with X509_STORE_CTX_set_verify_cb. See https://www.openssl.org/docs/man1.0.2/crypto/X509_STORE_CTX_set_verify_cb.html This callback does not override certificate verification. Rather, it allows EACH failure in OpenSSL's built-in certificate verification, as well as the final success, to be overridden (that's why there's an ok parameter). It still runs the usual OpenSSL certificate verification (which will never succeed). The upshot is that the callback is called multiple times and OpenSSLStreamAdapter does a ton of redundant work and checks the hash at least twice, or more for certificates with other errors. Instead, use SSL_CTX_set_cert_verify_callback. This short-circuits the OpenSSL behavior entirely and uses a caller-supplied one. https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CTX_set_cert_verify_callback https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_cert_verify_callback(3) (This also removes the SSL_CTX_set_verify_depth call which is ignored with SSL_CTX_set_cert_verify_callback. It didn't do anything before either---it tells OpenSSL to reject chains that are too short, but the rejection was overwritten by the callback anyway.) (Later on, we'll need to switch this to the BoringSSL-only SSL_CTX_set_custom_verify and CRYPTO_BUFFER APIs to fix WebRTC's contribution to Chrome's binary size, but I've left that alone for the time being.) Bug: none Change-Id: I9320a367d0961935836df63dc6f0868b069f0af0 Reviewed-on: https://webrtc-review.googlesource.com/4581 Commit-Queue: David Benjamin <davidben@webrtc.org> Reviewed-by: Taylor Brandstetter <deadbeef@webrtc.org> Cr-Commit-Position: refs/heads/master@{#20053}
WebRTC is a free, open software project that provides browsers and mobile applications with Real-Time Communications (RTC) capabilities via simple APIs. The WebRTC components have been optimized to best serve this purpose.
Our mission: To enable rich, high-quality RTC applications to be developed for the browser, mobile platforms, and IoT devices, and allow them all to communicate via a common set of protocols.
The WebRTC initiative is a project supported by Google, Mozilla and Opera, amongst others.
Development
See http://www.webrtc.org/native-code/development for instructions on how to get started developing with the native code.
More info
- Official web site: http://www.webrtc.org
- Master source code repo: https://webrtc.googlesource.com/src
- Samples and reference apps: https://github.com/webrtc
- Mailing list: http://groups.google.com/group/discuss-webrtc
- Continuous build: http://build.chromium.org/p/client.webrtc
- Coding style guide
- Code of conduct