Enable OCSP Stapling in TLS requests on Windows Vista+

Enable OCSP Stapling in TLS requests on Windows Vista+

R=agl,wtc
BUG=none
TEST=none

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=74243

[Ryan Sleevi, 2011-01-07 05:00:39]

agl: Are you OK with the renames/shuffling? Naming it specific to the NSS
function seemed a misnomer for the cross-platform case. I also switched it so
that the call to the NSS function is only enabled on platforms where that NSS
function is weakly-linked (eg: OS_LINUX). I also picked up a few lint errors 

wtc: The Windows-specific bits.

It'd help if you two could cross-confirm my test results. I tested on Vista and
7, using a local OCSP responder (roughly similar to setup agl described at
http://www.imperialviolet.org/2009/12/20/setting-up-ocsp.html ), with unknown,
good, and revoked certificates.

[agl, 2011-01-07 14:56:41]

LGTM, although wtc should check the Windows specific parts.

http://codereview.chromium.org/6158003/diff/2001/net/socket/ssl_client_socket...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/6158003/diff/2001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:1: // Copyright (c) 2011 The Chromium
Authors. All rights reserved.
We don't generally bump the copyright years as policy.

http://codereview.chromium.org/6158003/diff/2001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:130: static bool EnableOCSPStapling() {
I agree that this function should be renamed. However, I would expect a function
called "EnableOCSPStapling" to perform an action, not test something. Maybe
"IsOCSPStaplingSupported"?

[wtc, 2011-02-04 02:04:04]

Please address my first comment below.

Other than that, this CL is good.

http://codereview.chromium.org/6158003/diff/9001/net/socket/ssl_client_socket...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/6158003/diff/9001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:187: return
g_ocsp_stapling_helper.Get().enable;
If CertSetCertificateContextProperty(CERT_OCSP_RESPONSE_PROP_ID)
doesn't fail on Windows XP, I'd prefer that IsOCSPStaplingSupported()
returns true.

http://codereview.chromium.org/6158003/diff/9001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:192: // functions. Until then, we act as if
we didn't support OCSP stapling.
This comment should be updated to mention Mac specifically.
("other platforms" referred to Mac and Windows, and this CL
takes care of Windows.)

I think we can just replace it with a TODO comment that says
"figure out if we can plumb the OCSP response into Mac's
system certificate validation functions."

http://codereview.chromium.org/6158003/diff/9001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:2047: // updated for those platforms.
This TODO comment should now read:
  // TODO(agl): figure out how to plumb an OCSP response into the
  // Mac system library and update IsOCSPStaplingSupported for Mac.

http://codereview.chromium.org/6158003/diff/9001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:2067: VLOG(1) << "Failed to set OCSP
response property. "
Nit: use a colon (:) instead of period (.).

http://codereview.chromium.org/6158003/diff/9001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:2072: cache_ocsp_response =
Nit: if you remove 'const', can you fit this on the previous
line?

[Ryan Sleevi, 2011-02-04 05:42:35]

http://codereview.chromium.org/6158003/diff/9001/net/socket/ssl_client_socket...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/6158003/diff/9001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:187: return
g_ocsp_stapling_helper.Get().enable;
On 2011/02/04 02:04:04, wtc wrote:
> If CertSetCertificateContextProperty(CERT_OCSP_RESPONSE_PROP_ID)
> doesn't fail on Windows XP, I'd prefer that IsOCSPStaplingSupported()
> returns true.

Testing in XP SP3 VM, I don't get any errors when I set it, with or without any
dwFlags.

However, I would have thought that the desire would be to not request in the
ClientHello extension if the client isn't going to use it, since requesting can
add latency (from the server fetching) and overhead (from the server sending
it).

I'm fine turning it on always though if that trade-off is acceptable.

[wtc, 2011-02-04 05:49:20]

On 2011/02/04 05:42:35, Ryan Sleevi wrote:
>
> I'm fine turning it on always though if that trade-off is acceptable.

Yes.  Simplicity is good; we can get rid of 20 lines
of code.  The number of Windows XP computers will only
decrease over time.

The server will only fetch its OCSP response once and
cache it.  So the only overhead is from the server
sending the OCSP response.

[Ryan Sleevi, 2011-02-04 06:52:00]

agl: Just a heads up, I've switched the OS_LINUX ifdefs to USE_SYSTEM_SSL. 

This matches the #ifdefs in nss_ssl_util, which also uses dlsym to pull in a
post-NSS 3.12.3 symbol.

The desire here was to make OCSP available for the rest of the OS_POSIX family,
while still excluding OS_MACOSX.

[wtc, 2011-02-04 15:33:59]

It is wrong to switch OS_LINUX to USE_SYSTEM_SSL.

http://codereview.chromium.org/6158003/diff/17004/net/socket/ssl_client_socke...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/6158003/diff/17004/net/socket/ssl_client_socke...
net/socket/ssl_client_socket_nss.cc:99: #if defined(USE_SYSTEM_SSL)
The correct macro is USE_NSS.

USE_SYSTEM_SSL means using the system libssl3.so, instead
of src/net/third_party/nss/ssl.

The USE_SYSTEM_SSL code in this file is no longer here.
I think it's moved to nss_ssl_util.cc.  So the
USE_SYSTEM_SSL test in this file can be simply removed.

Then, change OS_LINUX to USE_NSS or OS_POSIX (if it
excludes OS_MACOSX) to cover the other Unix platforms.

[Ryan Sleevi, 2011-02-09 03:50:07]

On 2011/02/04 15:33:59, wtc wrote:
> It is wrong to switch OS_LINUX to USE_SYSTEM_SSL.
> 
>
http://codereview.chromium.org/6158003/diff/17004/net/socket/ssl_client_socke...
> File net/socket/ssl_client_socket_nss.cc (right):
> 
>
http://codereview.chromium.org/6158003/diff/17004/net/socket/ssl_client_socke...
> net/socket/ssl_client_socket_nss.cc:99: #if defined(USE_SYSTEM_SSL)
> The correct macro is USE_NSS.
> 
> USE_SYSTEM_SSL means using the system libssl3.so, instead
> of src/net/third_party/nss/ssl.
> 
> The USE_SYSTEM_SSL code in this file is no longer here.
> I think it's moved to nss_ssl_util.cc.  So the
> USE_SYSTEM_SSL test in this file can be simply removed.
> 
> Then, change OS_LINUX to USE_NSS or OS_POSIX (if it
> excludes OS_MACOSX) to cover the other Unix platforms.

Sorry about that. I switched to USE_NSS and made sure it's excluded on Mac.
Throwing to commit-bot to land.

[commit-bot: I haz the power, 2011-02-09 04:39:52]

Change committed as 74243