1ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen// Copyright (c) 2011 The Chromium Authors. All rights reserved. 2c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// Use of this source code is governed by a BSD-style license that can be 3c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// found in the LICENSE file. 4c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 5c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott#include "net/base/x509_certificate.h" 6c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 7ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen#include <stdlib.h> 8ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 9c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch#include <map> 10dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen#include <string> 11dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen#include <vector> 12c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 13201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch#include "base/lazy_instance.h" 14c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott#include "base/logging.h" 15ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen#include "base/memory/singleton.h" 16731df977c0511bca2206b5f333555b1205ff1f43Iain Merrick#include "base/metrics/histogram.h" 17ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen#include "base/pickle.h" 18ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen#include "base/sha1.h" 193345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick#include "base/string_piece.h" 20dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen#include "base/string_util.h" 21c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott#include "base/time.h" 223345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick#include "net/base/pem_tokenizer.h" 23c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 24c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottnamespace net { 25c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 26c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottnamespace { 27c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 28c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// Returns true if this cert fingerprint is the null (all zero) fingerprint. 29c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// We use this as a bogus fingerprint value. 30c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdochbool IsNullFingerprint(const SHA1Fingerprint& fingerprint) { 31c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott for (size_t i = 0; i < arraysize(fingerprint.data); ++i) { 32c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott if (fingerprint.data[i] != 0) 33c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return false; 34c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott } 35c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return true; 36c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 37c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 383345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick// Indicates the order to use when trying to decode binary data, which is 393345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick// based on (speculation) as to what will be most common -> least common 403345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrickconst X509Certificate::Format kFormatDecodePriority[] = { 413345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick X509Certificate::FORMAT_SINGLE_CERTIFICATE, 423345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick X509Certificate::FORMAT_PKCS7 433345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick}; 443345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 453345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick// The PEM block header used for DER certificates 463345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrickconst char kCertificateHeader[] = "CERTIFICATE"; 473345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick// The PEM block header used for PKCS#7 data 483345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrickconst char kPKCS7Header[] = "PKCS7"; 493345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 50c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// A thread-safe cache for X509Certificate objects. 51c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// 52c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// The cache does not hold a reference to the certificate objects. The objects 53c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// must |Remove| themselves from the cache upon destruction (or else the cache 54c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// will be holding dead pointers to the objects). 55c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch// TODO(rsleevi): There exists a chance of a use-after-free, due to a race 56c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch// between Find() and Remove(). See http://crbug.com/49377 5795b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon// ANDROID: we removed Remove(), to attempt to fix this. See http://b/6508448 58201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdochclass X509CertificateCache { 59c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch public: 60c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch void Insert(X509Certificate* cert); 6195b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon scoped_refptr<X509Certificate> Find(const SHA1Fingerprint& fingerprint); 62c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 63c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch private: 6495b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon typedef std::map<SHA1Fingerprint, scoped_refptr<X509Certificate>, SHA1FingerprintLessThan> 65c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch CertMap; 66c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 67201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch // Obtain an instance of X509CertificateCache via a LazyInstance. 68201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch X509CertificateCache() {} 69201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch ~X509CertificateCache() {} 70201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch friend struct base::DefaultLazyInstanceTraits<X509CertificateCache>; 71c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 72c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch // You must acquire this lock before using any private data of this object. 73c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch // You must not block while holding this lock. 7472a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen base::Lock lock_; 75c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 76c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch // The certificate cache. You must acquire |lock_| before using |cache_|. 77c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch CertMap cache_; 78c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 79201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch DISALLOW_COPY_AND_ASSIGN(X509CertificateCache); 80c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch}; 81c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 82201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdochbase::LazyInstance<X509CertificateCache, 83201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch base::LeakyLazyInstanceTraits<X509CertificateCache> > 84201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch g_x509_certificate_cache(base::LINKER_INITIALIZED); 85c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 86c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch// Insert |cert| into the cache. The cache does NOT AddRef |cert|. 87c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch// Any existing certificate with the same fingerprint will be replaced. 88201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdochvoid X509CertificateCache::Insert(X509Certificate* cert) { 8972a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen base::AutoLock lock(lock_); 90c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 91c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott DCHECK(!IsNullFingerprint(cert->fingerprint())) << 92c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott "Only insert certs with real fingerprints."; 9395b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon // Sanity test: never cache more than 50 certs 9495b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon while (cache_.size() >= 50) 9595b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon cache_.erase(cache_.begin()); 9695b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon 97c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott cache_[cert->fingerprint()] = cert; 98c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 9995b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon // Trim the cache if there are unused certs remaining. Aim to hold between 10095b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon // 10 and 20 certs in the cache in normal usage. 10195b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon if (cache_.size() <= 20) // high water mark 10295b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon return; 103c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 10495b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon for (CertMap::iterator it = cache_.begin(); it != cache_.end(); ++it) { 10595b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon if (it->second->HasOneRef()) { 10695b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon cache_.erase(it); 10795b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon if (cache_.size() <= 10) // low water mark 10895b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon return; 10995b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon } 11095b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon } 111c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott}; 112c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 113c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// Find a certificate in the cache with the given fingerprint. If one does 114c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// not exist, this method returns NULL. 11595b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixonscoped_refptr<X509Certificate> X509CertificateCache::Find( 116c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch const SHA1Fingerprint& fingerprint) { 11772a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen base::AutoLock lock(lock_); 118c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 119c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott CertMap::iterator pos(cache_.find(fingerprint)); 120c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott if (pos == cache_.end()) 121c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return NULL; 122c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 123c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return pos->second; 124c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott}; 125c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 126ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen// CompareSHA1Hashes is a helper function for using bsearch() with an array of 127ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen// SHA1 hashes. 128ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsenstatic int CompareSHA1Hashes(const void* a, const void* b) { 129ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return memcmp(a, b, base::SHA1_LENGTH); 130ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen} 131ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 132201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch} // namespace 133201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch 134201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdochbool X509Certificate::LessThan::operator()(X509Certificate* lhs, 135201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch X509Certificate* rhs) const { 136201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch if (lhs == rhs) 137201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch return false; 138201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch 139201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch SHA1FingerprintLessThan fingerprint_functor; 140201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch return fingerprint_functor(lhs->fingerprint_, rhs->fingerprint_); 141201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch} 142201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch 14372a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian MonsenX509Certificate::X509Certificate(const std::string& subject, 14472a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen const std::string& issuer, 14572a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen base::Time start_date, 14672a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen base::Time expiration_date) 14772a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen : subject_(subject), 14872a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen issuer_(issuer), 14972a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen valid_start_(start_date), 15072a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen valid_expiry_(expiration_date), 15172a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen cert_handle_(NULL), 15272a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen source_(SOURCE_UNUSED) { 15372a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen memset(fingerprint_.data, 0, sizeof(fingerprint_.data)); 15472a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen} 15572a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen 156c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// static 15795b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixonscoped_refptr<X509Certificate> X509Certificate::CreateFromHandle( 158c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch OSCertHandle cert_handle, 159c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch Source source, 160c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch const OSCertHandles& intermediates) { 161c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott DCHECK(cert_handle); 162c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott DCHECK(source != SOURCE_UNUSED); 163c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 164c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott // Check if we already have this certificate in memory. 165201ade2fbba22bfb27ae029f4d23fca6ded109a0Ben Murdoch X509CertificateCache* cache = g_x509_certificate_cache.Pointer(); 16695b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon scoped_refptr<X509Certificate> cached_cert = 167c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott cache->Find(CalculateFingerprint(cert_handle)); 168c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott if (cached_cert) { 169c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott DCHECK(cached_cert->source_ != SOURCE_UNUSED); 170c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch if (cached_cert->source_ > source || 171c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch (cached_cert->source_ == source && 172c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch cached_cert->HasIntermediateCertificates(intermediates))) { 173c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch // Return the certificate with the same fingerprint from our cache. 174c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott DHISTOGRAM_COUNTS("X509CertificateReuseCount", 1); 175c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return cached_cert; 176c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott } 177c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch // Else the new cert is better and will replace the old one in the cache. 178c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott } 179c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 180c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch // Otherwise, allocate and cache a new object. 18195b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon scoped_refptr<X509Certificate> cert = new X509Certificate(cert_handle, source, 18295b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon intermediates); 183c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch cache->Insert(cert); 184c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch return cert; 185c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 186c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 187513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch#if defined(OS_WIN) 188513209b27ff55e2841eac0e4120199c23acce758Ben Murdochstatic X509Certificate::OSCertHandle CreateOSCert(base::StringPiece der_cert) { 189513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch X509Certificate::OSCertHandle cert_handle = NULL; 190513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch BOOL ok = CertAddEncodedCertificateToStore( 191513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch X509Certificate::cert_store(), X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 192513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch reinterpret_cast<const BYTE*>(der_cert.data()), der_cert.size(), 193513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch CERT_STORE_ADD_USE_EXISTING, &cert_handle); 194513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch return ok ? cert_handle : NULL; 195513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch} 196513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch#else 197513209b27ff55e2841eac0e4120199c23acce758Ben Murdochstatic X509Certificate::OSCertHandle CreateOSCert(base::StringPiece der_cert) { 198513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch return X509Certificate::CreateOSCertHandleFromBytes( 199513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch const_cast<char*>(der_cert.data()), der_cert.size()); 200513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch} 201513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch#endif 202513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch 203513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch// static 20495b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixonscoped_refptr<X509Certificate> X509Certificate::CreateFromDERCertChain( 205513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch const std::vector<base::StringPiece>& der_certs) { 206dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (der_certs.empty()) 207513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch return NULL; 208513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch 209513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch X509Certificate::OSCertHandles intermediate_ca_certs; 210513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch for (size_t i = 1; i < der_certs.size(); i++) { 211513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch OSCertHandle handle = CreateOSCert(der_certs[i]); 212513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch DCHECK(handle); 213513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch intermediate_ca_certs.push_back(handle); 214513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch } 215513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch 216513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch OSCertHandle handle = CreateOSCert(der_certs[0]); 217513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch DCHECK(handle); 21895b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon scoped_refptr<X509Certificate> cert = 219513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch CreateFromHandle(handle, SOURCE_FROM_NETWORK, intermediate_ca_certs); 220513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch FreeOSCertHandle(handle); 221513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch for (size_t i = 0; i < intermediate_ca_certs.size(); i++) 222513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch FreeOSCertHandle(intermediate_ca_certs[i]); 223513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch 224513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch return cert; 225513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch} 226513209b27ff55e2841eac0e4120199c23acce758Ben Murdoch 227c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott// static 22895b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixonscoped_refptr<X509Certificate> X509Certificate::CreateFromBytes(const char* data, 229c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott int length) { 230c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott OSCertHandle cert_handle = CreateOSCertHandleFromBytes(data, length); 231c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott if (!cert_handle) 232c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return NULL; 233c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 23495b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon scoped_refptr<X509Certificate> cert = CreateFromHandle(cert_handle, 235c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch SOURCE_LONE_CERT_IMPORT, 236c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch OSCertHandles()); 237c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch FreeOSCertHandle(cert_handle); 238c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch return cert; 239c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 240c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 241ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen// static 24295b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixonscoped_refptr<X509Certificate> X509Certificate::CreateFromPickle(const Pickle& pickle, 243ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen void** pickle_iter, 244ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen PickleType type) { 245ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen OSCertHandle cert_handle = ReadCertHandleFromPickle(pickle, pickle_iter); 246ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen OSCertHandles intermediates; 247ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 248ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Even if a certificate fails to parse, whether the server certificate in 249ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // |cert_handle| or one of the optional intermediates, continue reading 250ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // the data from |pickle| so that |pickle_iter| is kept in sync for any 251ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // other reads the caller may perform after this method returns. 252ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (type == PICKLETYPE_CERTIFICATE_CHAIN) { 253ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen size_t num_intermediates; 254ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (!pickle.ReadSize(pickle_iter, &num_intermediates)) { 255ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen FreeOSCertHandle(cert_handle); 256ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return NULL; 257ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 258ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 259ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen bool ok = !!cert_handle; 260ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen for (size_t i = 0; i < num_intermediates; ++i) { 261ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen OSCertHandle intermediate = ReadCertHandleFromPickle(pickle, 262ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen pickle_iter); 263ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // If an intermediate fails to load, it and any certificates after it 264ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // will not be added. However, any intermediates that were successfully 265ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // parsed before the failure can be safely returned. 266ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen ok &= !!intermediate; 267ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (ok) { 268ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen intermediates.push_back(intermediate); 269ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } else if (intermediate) { 270ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen FreeOSCertHandle(intermediate); 271ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 272ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 273ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 274ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 275ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (!cert_handle) 276ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return NULL; 27795b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon scoped_refptr<X509Certificate> cert = CreateFromHandle(cert_handle, SOURCE_FROM_CACHE, 278ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen intermediates); 279ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen FreeOSCertHandle(cert_handle); 280ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen for (size_t i = 0; i < intermediates.size(); ++i) 281ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen FreeOSCertHandle(intermediates[i]); 282ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 283ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return cert; 284ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen} 285ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 286ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen// static 2873345a6884c488ff3a535c2c9acdd33d74b37e311Iain MerrickCertificateList X509Certificate::CreateCertificateListFromBytes( 2883345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick const char* data, int length, int format) { 2893345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick OSCertHandles certificates; 2903345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 2913345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // Check to see if it is in a PEM-encoded form. This check is performed 2923345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // first, as both OS X and NSS will both try to convert if they detect 2933345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // PEM encoding, except they don't do it consistently between the two. 2943345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick base::StringPiece data_string(data, length); 2953345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick std::vector<std::string> pem_headers; 2963345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 2973345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // To maintain compatibility with NSS/Firefox, CERTIFICATE is a universally 2983345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // valid PEM block header for any format. 2993345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick pem_headers.push_back(kCertificateHeader); 3003345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick if (format & FORMAT_PKCS7) 3013345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick pem_headers.push_back(kPKCS7Header); 3023345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 3033345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick PEMTokenizer pem_tok(data_string, pem_headers); 3043345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick while (pem_tok.GetNext()) { 3053345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick std::string decoded(pem_tok.data()); 3063345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 3073345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick OSCertHandle handle = NULL; 3083345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick if (format & FORMAT_PEM_CERT_SEQUENCE) 3093345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick handle = CreateOSCertHandleFromBytes(decoded.c_str(), decoded.size()); 3103345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick if (handle != NULL) { 3113345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // Parsed a DER encoded certificate. All PEM blocks that follow must 3123345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // also be DER encoded certificates wrapped inside of PEM blocks. 3133345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick format = FORMAT_PEM_CERT_SEQUENCE; 3143345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick certificates.push_back(handle); 3153345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick continue; 3163345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick } 3173345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 3183345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // If the first block failed to parse as a DER certificate, and 3193345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // formats other than PEM are acceptable, check to see if the decoded 3203345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // data is one of the accepted formats. 3213345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick if (format & ~FORMAT_PEM_CERT_SEQUENCE) { 3223345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick for (size_t i = 0; certificates.empty() && 3233345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick i < arraysize(kFormatDecodePriority); ++i) { 3243345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick if (format & kFormatDecodePriority[i]) { 3253345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick certificates = CreateOSCertHandlesFromBytes(decoded.c_str(), 3263345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick decoded.size(), kFormatDecodePriority[i]); 3273345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick } 3283345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick } 3293345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick } 3303345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 3313345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // Stop parsing after the first block for any format but a sequence of 3323345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // PEM-encoded DER certificates. The case of FORMAT_PEM_CERT_SEQUENCE 3333345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // is handled above, and continues processing until a certificate fails 3343345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // to parse. 3353345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick break; 3363345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick } 3373345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 3383345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // Try each of the formats, in order of parse preference, to see if |data| 3393345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // contains the binary representation of a Format, if it failed to parse 3403345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // as a PEM certificate/chain. 3413345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick for (size_t i = 0; certificates.empty() && 3423345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick i < arraysize(kFormatDecodePriority); ++i) { 3433345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick if (format & kFormatDecodePriority[i]) 3443345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick certificates = CreateOSCertHandlesFromBytes(data, length, 3453345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick kFormatDecodePriority[i]); 3463345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick } 3473345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 3483345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick CertificateList results; 3493345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick // No certificates parsed. 3503345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick if (certificates.empty()) 3513345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick return results; 3523345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 3533345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick for (OSCertHandles::iterator it = certificates.begin(); 3543345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick it != certificates.end(); ++it) { 35595b2bad159f2dbca0555e82f156db8424b75c2b8Jonathan Dixon scoped_refptr<X509Certificate> result = CreateFromHandle(*it, SOURCE_LONE_CERT_IMPORT, 3563345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick OSCertHandles()); 3573345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick results.push_back(scoped_refptr<X509Certificate>(result)); 3583345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick FreeOSCertHandle(*it); 3593345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick } 3603345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 3613345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick return results; 3623345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick} 3633345a6884c488ff3a535c2c9acdd33d74b37e311Iain Merrick 364ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsenvoid X509Certificate::Persist(Pickle* pickle) { 365ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen DCHECK(cert_handle_); 366ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (!WriteCertHandleToPickle(cert_handle_, pickle)) { 367ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen NOTREACHED(); 368ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return; 369ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 370ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 371ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (!pickle->WriteSize(intermediate_ca_certs_.size())) { 372ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen NOTREACHED(); 373ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return; 374ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 375ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 376ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { 377ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (!WriteCertHandleToPickle(intermediate_ca_certs_[i], pickle)) { 378ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen NOTREACHED(); 379ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return; 380ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 381ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 382ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen} 383ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 384c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scottbool X509Certificate::HasExpired() const { 385c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott return base::Time::Now() > valid_expiry(); 386c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} 387c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott 3884a5e2dc747d50c653511c68ccb2cfbfb740bd5a7Ben Murdochbool X509Certificate::Equals(const X509Certificate* other) const { 3894a5e2dc747d50c653511c68ccb2cfbfb740bd5a7Ben Murdoch return IsSameOSCert(cert_handle_, other->cert_handle_); 3904a5e2dc747d50c653511c68ccb2cfbfb740bd5a7Ben Murdoch} 3914a5e2dc747d50c653511c68ccb2cfbfb740bd5a7Ben Murdoch 392c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdochbool X509Certificate::HasIntermediateCertificate(OSCertHandle cert) { 393c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { 394c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch if (IsSameOSCert(cert, intermediate_ca_certs_[i])) 395c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch return true; 396c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch } 397c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch return false; 398c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch} 399c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 400c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdochbool X509Certificate::HasIntermediateCertificates(const OSCertHandles& certs) { 401c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch for (size_t i = 0; i < certs.size(); ++i) { 402c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch if (!HasIntermediateCertificate(certs[i])) 403c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch return false; 404c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch } 405c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch return true; 406c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch} 407c407dc5cd9bdc5668497f21b26b09d988ab439deBen Murdoch 408dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen// static 409dc0f95d653279beabeb9817299e2902918ba123eKristian Monsenbool X509Certificate::VerifyHostname( 410dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen const std::string& hostname, 411dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen const std::vector<std::string>& cert_names) { 412dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen DCHECK(!hostname.empty()); 413dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 414dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // Simple host name validation. A valid domain name must only contain 415dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // alpha, digits, hyphens, and dots. An IP address may have digits and dots, 416dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // and also square braces and colons for IPv6 addresses. 417dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen std::string reference_name; 418dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen reference_name.reserve(hostname.length()); 419dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 420dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen bool found_alpha = false; 421dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen bool found_ip6_chars = false; 422dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen bool found_hyphen = false; 423dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen int dot_count = 0; 424dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 425dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen size_t first_dot_index = std::string::npos; 426dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen for (std::string::const_iterator it = hostname.begin(); 427dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen it != hostname.end(); ++it) { 428dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen char c = *it; 429dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (IsAsciiAlpha(c)) { 430dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen found_alpha = true; 431dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen c = base::ToLowerASCII(c); 432dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } else if (c == '.') { 433dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen ++dot_count; 434dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (first_dot_index == std::string::npos) 435dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen first_dot_index = reference_name.length(); 436dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } else if (c == ':') { 437dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen found_ip6_chars = true; 438dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } else if (c == '-') { 439dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen found_hyphen = true; 440dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } else if (!IsAsciiDigit(c)) { 441dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen LOG(WARNING) << "Invalid char " << c << " in hostname " << hostname; 442dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen return false; 443dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 444dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen reference_name.push_back(c); 445dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 446dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen DCHECK(!reference_name.empty()); 447dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 448dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (found_ip6_chars || !found_alpha) { 449dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // For now we just do simple localhost IP address support, primarily as 450dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // it's needed by the test server. TODO(joth): Replace this with full IP 451dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // address support. See http://crbug.com/62973 452dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (hostname == "127.0.0.1") { 453dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen for (size_t index = 0; index < cert_names.size(); ++index) { 454dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (cert_names[index] == hostname) { 455dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen DVLOG(1) << "Allowing localhost IP certificate: " << hostname; 456dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen return true; 457dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 458dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 459dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 460dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen NOTIMPLEMENTED() << hostname; // See comment above. 461dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen return false; 462dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 463dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 464dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // |wildcard_domain| is the remainder of |host| after the leading host 465dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // component is stripped off, but includes the leading dot e.g. 466dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // "www.f.com" -> ".f.com". 467dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // If there is no meaningful domain part to |host| (e.g. it is an IP address 468dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // or contains no dots) then |wildcard_domain| will be empty. 469dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // We required at least 3 components (i.e. 2 dots) as a basic protection 470dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // against too-broad wild-carding. 471dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen base::StringPiece wildcard_domain; 472dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (found_alpha && !found_ip6_chars && dot_count >= 2) { 473dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen DCHECK(first_dot_index != std::string::npos); 474dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen wildcard_domain = reference_name; 475dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen wildcard_domain.remove_prefix(first_dot_index); 476dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen DCHECK(wildcard_domain.starts_with(".")); 477dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 478dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 479dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen for (std::vector<std::string>::const_iterator it = cert_names.begin(); 480dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen it != cert_names.end(); ++it) { 481dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // Catch badly corrupt cert names up front. 482dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (it->empty() || it->find('\0') != std::string::npos) { 483dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen LOG(WARNING) << "Bad name in cert: " << *it; 484dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen continue; 485dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 486dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen const std::string cert_name_string(StringToLowerASCII(*it)); 487dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen base::StringPiece cert_match(cert_name_string); 488dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 489dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // Remove trailing dot, if any. 490dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (cert_match.ends_with(".")) 491dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen cert_match.remove_suffix(1); 492dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 493dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // The hostname must be at least as long as the cert name it is matching, 494dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // as we require the wildcard (if present) to match at least one character. 495dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (cert_match.length() > reference_name.length()) 496dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen continue; 497dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 498dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (cert_match == reference_name) 499dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen return true; 500dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 501dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // Next see if this cert name starts with a wildcard, so long as the 502dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // hostname we're matching against has a valid 'domain' part to match. 503dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // Note the "-10" version of draft-saintandre-tls-server-id-check allows 504dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // the wildcard to appear anywhere in the leftmost label, rather than 505dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // requiring it to be the only character. See also http://crbug.com/60719 506dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (wildcard_domain.empty() || !cert_match.starts_with("*")) 507dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen continue; 508dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 509dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // Erase the * but not the . from the domain, as we need to include the dot 510dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // in the comparison. 511dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen cert_match.remove_prefix(1); 512dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 513dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // Do character by character comparison on the remainder to see 514dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // if we have a wildcard match. This intentionally does no special handling 515dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // for any other wildcard characters in |domain|; alternatively it could 516dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen // detect these and skip those candidate cert names. 517dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen if (cert_match == wildcard_domain) 518dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen return true; 519dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen } 520dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen DVLOG(1) << "Could not find any match for " << hostname 521dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen << " (canonicalized as " << reference_name 522dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen << ") in cert names " << JoinString(cert_names, '|'); 523dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen return false; 524dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen} 525dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 526dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen#if !defined(USE_NSS) 527dc0f95d653279beabeb9817299e2902918ba123eKristian Monsenbool X509Certificate::VerifyNameMatch(const std::string& hostname) const { 528dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen std::vector<std::string> dns_names; 529dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen GetDNSNames(&dns_names); 530dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen return VerifyHostname(hostname, dns_names); 531dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen} 532dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen#endif 533dc0f95d653279beabeb9817299e2902918ba123eKristian Monsen 53472a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian MonsenX509Certificate::X509Certificate(OSCertHandle cert_handle, 53572a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen Source source, 53672a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen const OSCertHandles& intermediates) 53772a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen : cert_handle_(DupOSCertHandle(cert_handle)), 53872a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen source_(source) { 53972a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen // Copy/retain the intermediate cert handles. 54072a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen for (size_t i = 0; i < intermediates.size(); ++i) 54172a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen intermediate_ca_certs_.push_back(DupOSCertHandle(intermediates[i])); 54272a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen // Platform-specific initialization. 54372a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen Initialize(); 54472a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen} 54572a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen 54672a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian MonsenX509Certificate::~X509Certificate() { 54772a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen // We might not be in the cache, but it is safe to remove ourselves anyway. 54872a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen if (cert_handle_) 54972a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen FreeOSCertHandle(cert_handle_); 55072a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) 55172a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen FreeOSCertHandle(intermediate_ca_certs_[i]); 55272a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen} 55372a454cd3513ac24fbdd0e0cb9ad70b86a99b801Kristian Monsen 554ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsenbool X509Certificate::IsBlacklisted() const { 55594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen static const unsigned kNumSerials = 256; 556ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen static const unsigned kSerialBytes = 16; 557ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen static const uint8 kSerials[kNumSerials][kSerialBytes] = { 558ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Not a real certificate. For testing only. 559ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0x07,0x7a,0x59,0xbc,0xd5,0x34,0x59,0x60,0x1c,0xa6,0x90,0x72,0x67,0xa6,0xdd,0x1c}, 560ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 561ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // The next nine certificates all expire on Fri Mar 14 23:59:59 2014. 562ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Some serial numbers actually have a leading 0x00 byte required to 563ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // encode a positive integer in DER if the most significant bit is 0. 564ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // We omit the leading 0x00 bytes to make all serial numbers 16 bytes. 565ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 566ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=mail.google.com 567ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: mail.google.com, www.mail.google.com 568ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0x04,0x7e,0xcb,0xe9,0xfc,0xa5,0x5f,0x7b,0xd0,0x9e,0xae,0x36,0xe1,0x0c,0xae,0x1e}, 569ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=global trustee 570ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: global trustee 571ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Note: not a CA certificate. 572ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0xd8,0xf3,0x5f,0x4e,0xb7,0x87,0x2b,0x2d,0xab,0x06,0x92,0xe3,0x15,0x38,0x2f,0xb0}, 573ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=login.live.com 574ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: login.live.com, www.login.live.com 575ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0xb0,0xb7,0x13,0x3e,0xd0,0x96,0xf9,0xb5,0x6f,0xae,0x91,0xc8,0x74,0xbd,0x3a,0xc0}, 576ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=addons.mozilla.org 577ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: addons.mozilla.org, www.addons.mozilla.org 578ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0x92,0x39,0xd5,0x34,0x8f,0x40,0xd1,0x69,0x5a,0x74,0x54,0x70,0xe1,0xf2,0x3f,0x43}, 579ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=login.skype.com 580ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: login.skype.com, www.login.skype.com 581ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0xe9,0x02,0x8b,0x95,0x78,0xe4,0x15,0xdc,0x1a,0x71,0x0a,0x2b,0x88,0x15,0x44,0x47}, 582ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=login.yahoo.com 583ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: login.yahoo.com, www.login.yahoo.com 584ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0xd7,0x55,0x8f,0xda,0xf5,0xf1,0x10,0x5b,0xb2,0x13,0x28,0x2b,0x70,0x77,0x29,0xa3}, 585ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=www.google.com 586ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: www.google.com, google.com 587ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0xf5,0xc8,0x6a,0xf3,0x61,0x62,0xf1,0x3a,0x64,0xf5,0x4f,0x6d,0xc9,0x58,0x7c,0x06}, 588ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=login.yahoo.com 589ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: login.yahoo.com 590ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0x39,0x2a,0x43,0x4f,0x0e,0x07,0xdf,0x1f,0x8a,0xa3,0x05,0xde,0x34,0xe0,0xc2,0x29}, 591ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // Subject: CN=login.yahoo.com 592ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen // subjectAltName dNSName: login.yahoo.com 593ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen {0x3e,0x75,0xce,0xd4,0x6b,0x69,0x30,0x21,0x21,0x88,0x30,0xae,0x86,0xa8,0x2a,0x71}, 59494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 59594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen // Bad DigiNotar leaf certificates for non-Google sites. 59694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x95,0x32,0x18,0xb7,0x04,0xcc,0x62,0xb2,0x40,0xa4,0xd0,0x18,0x0e,0x81,0x93,0xf2}, 59794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x5f,0x41,0xfe,0x52,0x93,0x75,0xb1,0x4b,0xd1,0x56,0x37,0x53,0xa2,0xc9,0xc6,0x49}, 59894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x22,0xec,0x36,0x83,0x9f,0x44,0x65,0xe7,0xa1,0x34,0x7b,0xae,0x69,0x2f,0x5d,0x2a}, 59994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x46,0xaf,0xa2,0x75,0x58,0x2e,0x27,0x34,0xe2,0xa5,0x22,0xfc,0x6c,0x2e,0x80,0x55}, 60094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc8,0x63,0x14,0x89,0xc3,0xa6,0xaf,0xde,0xdc,0x70,0xd6,0xc1,0xb5,0x81,0xc0,0x19}, 60194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x26,0xf6,0x2a,0xee,0x2b,0xae,0x06,0xee,0x71,0xe7,0xc4,0x8a,0x2b,0x4d,0x60,0xfe}, 60294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb6,0x73,0x9c,0x1a,0xdd,0x2b,0x52,0x19,0x6c,0x53,0x36,0xef,0xb6,0x7b,0x26,0x0f}, 60394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x9e,0x4e,0x87,0x07,0x55,0xd9,0x4c,0xf5,0xc4,0x67,0x81,0xe6,0x83,0x49,0xe3,0xd3}, 60494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x7e,0x82,0x25,0xf6,0xb4,0xbe,0x3d,0x1c,0x13,0x72,0xbb,0xc3,0x65,0xf5,0xf6,0xb6}, 60594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xff,0x2e,0x1b,0xda,0xa2,0xf4,0xc9,0x51,0x02,0x65,0xf7,0x26,0x11,0xdd,0x0c,0x44}, 60694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x1f,0xe8,0x4c,0xbe,0x99,0xe5,0xd2,0x68,0x4c,0x67,0x8d,0xef,0x7f,0xc0,0xbd,0xaa}, 60794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x4b,0x72,0xe8,0x49,0x97,0x38,0x82,0x99,0xf5,0x83,0xcb,0x37,0x60,0xab,0x1b,0x20}, 60894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xcf,0x61,0x90,0x78,0xde,0x6c,0x9d,0x9a,0x50,0x72,0xb5,0xe3,0xb1,0x3c,0xa9,0x9f}, 60994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xa8,0x22,0xeb,0x37,0xb7,0x35,0xa6,0x3e,0x6c,0xa9,0xa9,0x96,0x80,0x08,0x21,0xfc}, 61094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe3,0xb6,0x00,0xb1,0x07,0x39,0xb0,0x94,0xab,0x47,0x4c,0x88,0x8d,0x97,0x25,0x0d}, 61194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x36,0xe8,0x57,0x1d,0x39,0x46,0x34,0x2c,0x74,0x20,0x81,0xc0,0xfa,0xab,0x34,0x3a}, 61294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x77,0x17,0x07,0x87,0x3d,0xa4,0x91,0xa8,0xd5,0xcc,0x5b,0x07,0xdc,0x50,0x8c,0x72}, 61394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x1e,0x94,0xcf,0x79,0x06,0x58,0x7b,0xdf,0x45,0xc4,0x61,0xfb,0xdd,0x74,0x3e,0x25}, 61494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x58,0x7c,0xd9,0xe3,0xd9,0xa8,0xab,0x10,0xfd,0xb0,0xc7,0x0b,0xcd,0x8a,0xe7,0x28}, 61594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x7e,0xd8,0x0b,0x93,0x20,0x50,0x8d,0xa6,0xcf,0x5d,0x96,0xba,0x53,0x30,0x43,0xd7}, 61694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xf8,0x6d,0x1e,0x22,0xbd,0x20,0x68,0x47,0x1e,0x20,0x13,0x6b,0x30,0x21,0x0e,0xae}, 61794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x2c,0x86,0x94,0x86,0xec,0x04,0x75,0x97,0x82,0x91,0x6e,0x68,0x04,0xdb,0x48,0xfd}, 61894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x35,0x19,0x81,0x98,0xd1,0xbc,0xaf,0xcf,0x43,0x86,0xe6,0xb8,0x87,0xba,0xe6,0x1b}, 61994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x4a,0x66,0x2b,0xa9,0xe4,0x5d,0x06,0xff,0xc5,0x0d,0x1d,0xbb,0xe2,0x25,0xa8,0xbb}, 62094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x89,0x9a,0xe1,0x20,0xcd,0x44,0xfc,0xec,0x0f,0xfc,0xd6,0x2f,0x6f,0xc4,0xbb,0x81}, 62194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x7d,0xd1,0x6c,0x03,0xdf,0x04,0x38,0xb2,0xbe,0x5f,0xc1,0xd3,0xe1,0x9f,0x13,0x8b}, 62294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xaf,0xe2,0x66,0x30,0x8f,0x50,0x1d,0x49,0x37,0xc1,0xaa,0xf0,0x00,0xc5,0x68,0x97}, 62394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x53,0xd9,0xf7,0x50,0x84,0xf2,0x62,0xfb,0x40,0x91,0x27,0xab,0x1e,0x04,0x44,0x2e}, 62494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x35,0xec,0x66,0x4c,0xbd,0x19,0x42,0xa2,0x36,0xc3,0xba,0x0e,0xb2,0xc6,0x81,0x3f}, 62594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x5c,0x94,0xc8,0xbd,0x9d,0x50,0x4a,0xd8,0x8d,0x96,0x59,0x36,0xef,0x5f,0xa0,0x21}, 62694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x88,0x82,0xc0,0xa1,0xd6,0x4b,0xab,0xb7,0xdb,0x82,0x07,0x3e,0xcd,0x77,0x72,0x2f}, 62794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x81,0xc4,0x84,0x5a,0x97,0x2f,0x37,0x4d,0x1c,0xe5,0x83,0x08,0x44,0x54,0xdd,0x50}, 62894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x04,0x1d,0x36,0xbb,0x4d,0xd3,0x9e,0x4a,0xce,0x8c,0x5b,0x4e,0x72,0x27,0x79,0xa4}, 62994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe6,0xc0,0xb6,0x11,0xb2,0x84,0x0a,0xac,0xc4,0x00,0xd0,0x3f,0xf2,0x7c,0x86,0xb7}, 63094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb5,0x94,0xa1,0x02,0xf8,0x9a,0xe2,0x9a,0xf6,0x2d,0x68,0x96,0x5f,0x49,0x0d,0x65}, 63194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xa5,0xbe,0x65,0x4d,0xcc,0xf8,0xaa,0x3b,0xd3,0x15,0x64,0x8d,0x95,0x79,0x12,0x29}, 63294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x5b,0x1d,0xd6,0x43,0xb9,0x80,0xa8,0x17,0xf7,0x86,0x71,0x16,0x97,0xd2,0x84,0x0d}, 63394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x4c,0x06,0x16,0x26,0x9a,0x64,0xa3,0xe5,0x7b,0xe9,0xd0,0xeb,0x9d,0x1b,0x59,0x97}, 63494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x10,0x2c,0x47,0x9d,0x70,0x61,0xdb,0x7e,0xf1,0x55,0xba,0xa6,0x41,0x0b,0x11,0x20}, 63594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd1,0x62,0x65,0x70,0x77,0x9a,0x69,0x32,0x66,0x28,0x2f,0x9f,0xdc,0x5a,0x72,0x3f}, 63694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x0f,0x50,0x0a,0xe6,0x0b,0xf8,0x69,0x67,0x16,0xf2,0x67,0xc8,0x0e,0x13,0xdc,0x09}, 63794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x8b,0x22,0xbf,0xf4,0x66,0xe4,0x15,0x26,0x65,0x8a,0x56,0x8d,0x40,0x00,0x70,0xfd}, 63894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x4e,0xf7,0x05,0xc3,0x1e,0xff,0xc8,0x5a,0x0f,0x6f,0x74,0x52,0x8c,0x84,0xa7,0x72}, 63994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x77,0x1d,0x89,0xbc,0xa1,0xd2,0x53,0xd1,0xb5,0x6a,0x61,0x41,0xcf,0x29,0xe1,0xbb}, 64094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x33,0x73,0x97,0x6f,0xb7,0xe8,0x21,0xdc,0x3d,0x68,0xf9,0x47,0xfa,0xed,0xb2,0xb0}, 64194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x30,0xc2,0x0f,0xff,0x9b,0xe7,0xc3,0xd5,0x82,0xc8,0x0b,0xc2,0xcb,0xeb,0x04,0x62}, 64294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc5,0x2e,0xde,0x8f,0x68,0xb3,0x98,0x38,0x83,0x34,0x44,0x25,0x2c,0xb6,0x4f,0x73}, 64394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x94,0x53,0x95,0x11,0x88,0x67,0x56,0x53,0x13,0xa2,0x66,0x98,0xb9,0x5f,0x1e,0x3e}, 64494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc3,0xac,0x62,0x96,0xff,0x90,0xf0,0x9b,0xf1,0x82,0xfb,0x81,0xf8,0x65,0x00,0xda}, 64594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x92,0x72,0xf9,0x8c,0xfe,0x35,0x00,0x00,0xd6,0xbc,0xaf,0x30,0x63,0x74,0x72,0x98}, 64694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x36,0x9a,0xaa,0x6a,0x97,0x3d,0x0f,0x76,0x32,0x1c,0x53,0x2d,0xed,0xb3,0xbf,0xc6}, 64794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x73,0x02,0x4e,0x7c,0x99,0x8b,0x3d,0xdd,0x24,0x4c,0xfd,0x31,0x3d,0x5e,0x43,0xb6}, 64894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd7,0xfb,0x96,0xe0,0x29,0x1e,0xbe,0x3e,0x01,0x5e,0x93,0xe5,0x86,0xcf,0xc7,0xd1}, 64994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb0,0x1d,0x8c,0x6f,0x2d,0x53,0x73,0xea,0xbf,0x0c,0x00,0x31,0x9e,0x92,0xae,0x95}, 65094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd7,0x06,0x98,0xd2,0x7e,0x7c,0xfa,0xfd,0x81,0x8d,0xe7,0xe2,0xea,0x31,0x9f,0x7f}, 65194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x96,0x43,0x10,0xa7,0xec,0x83,0x47,0x6c,0xcd,0x99,0xd8,0x89,0x63,0x6a,0xc2,0xba}, 65294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x54,0x17,0x57,0xb5,0x43,0x6f,0x1d,0x0b,0x3e,0xea,0x7d,0xce,0x49,0x8f,0x8a,0x0a}, 65394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x89,0x86,0xa0,0xfc,0x6f,0xd1,0xe6,0x1b,0xef,0x2f,0xc7,0x45,0x64,0xa7,0x0b,0x18}, 65494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x57,0x38,0x70,0x4f,0x75,0xa3,0xff,0x3b,0x86,0xa6,0x0a,0x55,0x96,0xed,0x09,0xb3}, 65594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x09,0xe1,0xc3,0xd2,0x6b,0xaf,0x74,0xe6,0xf9,0xa1,0x2f,0x9f,0x3f,0x2d,0xe9,0xa5}, 65694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x81,0xf7,0xb1,0x28,0xcd,0x71,0xbd,0x1a,0x59,0x50,0x74,0x45,0x00,0xc7,0x25,0xd4}, 65794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x26,0xc6,0x83,0xa0,0x88,0x71,0x2b,0x79,0x3f,0xf4,0x1d,0x8a,0x0c,0x0e,0xc0,0x45}, 65894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd0,0x37,0xe2,0x1b,0x2f,0xe6,0xf1,0x9c,0x00,0x74,0x6e,0xb5,0xd6,0x32,0x9a,0xa2}, 65994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x06,0xdb,0x21,0x87,0x57,0x84,0xe5,0x35,0x6a,0x5b,0x97,0x99,0x15,0x0f,0x84,0x4c}, 66094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x2b,0x33,0xcb,0x52,0xae,0xff,0xb2,0x2e,0x23,0x30,0x9d,0x8b,0xc1,0x97,0x66,0x85}, 66194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb9,0xb4,0x53,0x1c,0xf7,0x1c,0xb2,0x60,0x72,0x8e,0x42,0x43,0x85,0xcd,0x5c,0x7e}, 66294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc4,0xfb,0xd4,0xa1,0x4c,0x59,0x5a,0xdf,0xb3,0xd2,0x44,0xfd,0x6d,0x46,0x9a,0x53}, 66394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe6,0x56,0xed,0x4a,0xa2,0x98,0xed,0xb4,0x91,0xb0,0xb7,0x20,0x86,0x8a,0x11,0x2b}, 66494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x75,0x07,0x6e,0xc6,0xa2,0x1d,0x7e,0x4d,0xa8,0x7a,0x30,0x4e,0x9e,0xdd,0x02,0x62}, 66594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x27,0xdf,0x84,0xc1,0x2b,0xf8,0x37,0xac,0x68,0x1f,0xfd,0x26,0x63,0x93,0x88,0xf7}, 66694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x94,0xc7,0x5f,0x32,0xf1,0x00,0xa3,0xc3,0x2d,0x47,0xd0,0x1a,0xa9,0x8c,0xf9,0xa8}, 66794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x83,0x51,0x2c,0xc6,0x89,0x5b,0x44,0x15,0x14,0xa0,0xa4,0x15,0xf3,0x14,0x2a,0x6c}, 66894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x37,0x47,0xfe,0x8b,0x81,0xcb,0x6e,0x65,0x29,0x87,0x2d,0xe5,0x07,0x5c,0x3b,0xcb}, 66994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x33,0x87,0x0a,0xc7,0x1c,0x7a,0x8e,0xc6,0x68,0xcd,0x68,0x65,0xb1,0x15,0x84,0xb6}, 67094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x8a,0xa4,0x4a,0x11,0x84,0xdc,0x25,0xf9,0xa5,0x44,0x2c,0xd6,0xe1,0x39,0x16,0x5d}, 67194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xdc,0x7e,0x23,0xb3,0x8c,0x34,0xea,0x5c,0xd1,0x24,0xc6,0x74,0x00,0x46,0xd4,0x3c}, 67294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xdb,0x8f,0x84,0x41,0x38,0x05,0x89,0xf4,0x49,0xef,0xb9,0xe8,0xf0,0x8e,0x21,0x0c}, 67394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x86,0x63,0x3b,0x95,0x72,0x80,0xbc,0x65,0xa5,0xad,0xfd,0x1d,0x15,0x3b,0xde,0x52}, 67494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb0,0x62,0x55,0xfa,0xe2,0x88,0xba,0xa6,0x6c,0x83,0xcb,0xf0,0x3f,0x5d,0x16,0x09}, 67594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x1a,0x07,0xd8,0xd6,0xdd,0xc7,0xe6,0x23,0xe7,0x12,0x05,0x07,0x4a,0x05,0xce,0xa2}, 67694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x97,0x00,0x4b,0x3d,0x85,0x6f,0x36,0x2c,0x3d,0x7c,0xd6,0x46,0xf6,0x05,0xcf,0xa5}, 67794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x2c,0xd3,0xaa,0x47,0x3e,0x64,0x48,0x1a,0xbd,0x68,0xe0,0xb1,0x0d,0x28,0x70,0xdf}, 67894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x3e,0x83,0x78,0xf1,0xe2,0x48,0x4c,0xe2,0x31,0x91,0x06,0x16,0xe4,0xb9,0x10,0x30}, 67994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd4,0x48,0x44,0xe3,0x38,0xa1,0x02,0x53,0x6c,0x0c,0x23,0x8f,0x76,0xe0,0x7e,0xd2}, 68094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xed,0x52,0x13,0x57,0xb7,0x34,0x2f,0xb6,0xb5,0x6e,0x6b,0x7e,0x03,0xec,0xec,0x21}, 68194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x7f,0x3d,0x39,0x52,0x19,0xc7,0xb9,0xb8,0xc6,0x0e,0x4f,0x52,0xd9,0x33,0x50,0xb2}, 68294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xbe,0x69,0x1e,0x23,0x68,0x70,0xd9,0x01,0x4e,0xda,0x67,0xd3,0x9b,0x3f,0x80,0xa9}, 68394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x4b,0xf3,0x02,0x0d,0x00,0xff,0xb8,0x31,0xf3,0x8a,0xf3,0x1e,0x26,0xb9,0x04,0x9a}, 68494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x44,0x0e,0xea,0x70,0x5a,0x9f,0x79,0x15,0x35,0x60,0xbf,0xc4,0x4a,0x13,0x5d,0x99}, 68594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe9,0x92,0x00,0x82,0x28,0x03,0xad,0x53,0x65,0x27,0xb5,0x90,0x4d,0xac,0x04,0x6f}, 68694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x63,0xf8,0x79,0x61,0x7a,0x3d,0x48,0xc0,0xc9,0x39,0x06,0xb6,0xa5,0xc9,0x99,0x8f}, 68794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd6,0xbe,0x78,0x3f,0x1f,0x34,0x35,0x79,0x63,0x0a,0xa4,0xbe,0x60,0xc8,0xb4,0xc8}, 68894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xbb,0x83,0x3b,0x51,0xa8,0x2f,0x7e,0xb9,0xab,0x5c,0xff,0x4b,0x6f,0x0a,0x58,0x9e}, 68994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x85,0x36,0x66,0x57,0x3c,0xdb,0xc6,0x80,0x74,0x0c,0xad,0x26,0x25,0x05,0x4a,0x22}, 69094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd6,0x2c,0x3d,0x36,0xc3,0xa9,0xa5,0xd8,0xcf,0xcb,0x76,0x0d,0x5b,0xcb,0xb1,0xf2}, 69194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x46,0x0c,0x33,0x8e,0x89,0xba,0xa1,0x45,0x26,0x1f,0x2a,0x06,0x6c,0x56,0x86,0x2e}, 69294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x5d,0x27,0x8c,0x8f,0xcd,0x78,0x9e,0xda,0x9d,0xef,0x09,0x6c,0x91,0xe1,0x15,0xe1}, 69394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xcb,0xae,0xad,0xd5,0x76,0x4b,0x56,0x91,0xa1,0xb0,0xef,0x87,0xae,0x2b,0xb7,0xc6}, 69494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x33,0x1e,0x3c,0x0b,0x5b,0x8e,0xd3,0xac,0xbf,0x72,0x7a,0x27,0x4c,0xf9,0xd4,0x32}, 69594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe5,0x66,0xe1,0x8a,0x28,0xc6,0xc4,0x4c,0xb1,0x29,0x55,0x23,0x9a,0x38,0x08,0xe3}, 69694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x51,0x68,0xf4,0x42,0xbd,0xd4,0xc4,0x24,0x95,0xdb,0xb1,0xd5,0xaf,0x23,0xf5,0xf1}, 69794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb8,0x05,0x89,0x79,0xa8,0x42,0x6d,0x1b,0xbc,0x23,0x3d,0xa0,0xf7,0x6d,0x59,0x88}, 69894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x88,0x60,0xfc,0xbf,0xda,0x75,0xf4,0x3e,0x6f,0x9a,0x1c,0x57,0x6b,0x27,0x23,0x3a}, 69994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x39,0x83,0xdf,0x8b,0x4f,0xc3,0x30,0xb5,0x87,0x32,0x9f,0x62,0xab,0x8a,0xbb,0x13}, 70094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x79,0xc8,0xe8,0xb7,0xde,0x36,0x53,0x9f,0xfc,0x4b,0x2b,0x58,0x25,0x30,0x53,0x24}, 70194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x06,0xcb,0xb1,0xcc,0x51,0x15,0x6c,0x6d,0x46,0x5f,0x14,0x82,0x94,0x53,0xdd,0x68}, 70294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x51,0x49,0xe0,0xbb,0xa2,0xc4,0x69,0x3b,0xde,0xe4,0xfe,0x90,0xc1,0x22,0x76,0x27}, 70394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xf8,0xe5,0xe0,0xe2,0x02,0x50,0x9a,0x1a,0x21,0x7e,0x72,0x2f,0x14,0xd9,0x0e,0xf2}, 70494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x8b,0x10,0x97,0x63,0xa2,0xc5,0x2b,0x0f,0x86,0x04,0x6d,0x18,0xf1,0xba,0x97,0x81}, 70594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x49,0x68,0xf4,0xbd,0x42,0x6a,0x68,0xfa,0xd9,0xde,0x67,0x63,0x9c,0xcc,0x63,0x9a}, 70694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x09,0xf7,0x2a,0x16,0xcf,0x28,0xd8,0x20,0xb5,0x34,0x8f,0x22,0x9e,0x1b,0x9e,0x51}, 70794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x39,0x1d,0xde,0x64,0x85,0x6b,0xee,0xe6,0x9d,0x3b,0x39,0x16,0xcc,0x9a,0x00,0xdb}, 70894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x50,0x6f,0xc2,0xc4,0x67,0x9a,0x8f,0x41,0x07,0x19,0x85,0x1b,0xa5,0xaf,0x10,0x6c}, 70994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xfa,0x8d,0x23,0xab,0x7f,0x1d,0x4e,0x6b,0xbf,0xd5,0x1b,0x11,0x23,0x62,0x8b,0xe0}, 71094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb0,0xf8,0x09,0xbe,0x90,0xab,0xad,0xb2,0x49,0x64,0x5b,0x46,0x33,0x4d,0x46,0xcf}, 71194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x35,0xab,0x29,0xcc,0x8d,0xd8,0xf9,0x5a,0x04,0x75,0x16,0xec,0xbe,0x30,0xa0,0x4f}, 71294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x95,0x59,0xb1,0x04,0x8c,0xcd,0x7f,0xf7,0xbe,0x62,0xb7,0xad,0xc2,0x3c,0xd4,0xf2}, 71394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x64,0xb2,0xfd,0xad,0x1c,0xd1,0xc7,0xcb,0x5a,0x07,0x87,0x4e,0x50,0xc8,0x44,0xf7}, 71494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x2b,0x37,0x47,0x59,0x3e,0x64,0xf7,0xf2,0xfc,0x71,0x37,0x6e,0x94,0x11,0x86,0xd5}, 71594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x94,0xcf,0xf9,0x1e,0x95,0x05,0xcb,0xfc,0x51,0x6c,0xcc,0x58,0xd6,0x7e,0x5c,0x5d}, 71694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x90,0x59,0x1a,0x1f,0xb8,0x9f,0x19,0x3e,0x47,0x5f,0x65,0xe8,0xbf,0x00,0x8e,0x4c}, 71794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe7,0xd6,0x44,0x11,0xac,0x8d,0xc6,0x4c,0x98,0xaa,0x3b,0x50,0x2f,0xe9,0x11,0x37}, 71894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x41,0x5c,0xa8,0xd0,0xe2,0x87,0x10,0x04,0x51,0xc5,0x8e,0xa6,0xf1,0xa9,0xbe,0xb6}, 71994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x3f,0x1b,0x34,0xf0,0x9f,0x8b,0x4a,0x1e,0xad,0xb4,0x90,0xbe,0x47,0xa8,0xd0,0x62}, 72094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x89,0xdb,0xb9,0x5e,0x30,0xdd,0x1f,0xe8,0x37,0xed,0xc5,0x05,0x89,0x7b,0x65,0x02}, 72194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xa4,0x13,0xd7,0x25,0xf5,0x67,0xfa,0xc9,0x93,0x74,0xa6,0x89,0xb6,0xce,0xd8,0x68}, 72294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x8c,0xdd,0xef,0x7b,0x6b,0x7d,0x7c,0xc9,0x2f,0x87,0xee,0x79,0x98,0x10,0x13,0xc1}, 72394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x07,0xfc,0x7a,0x1e,0x11,0x5e,0x83,0xee,0x65,0xd5,0x8d,0x3d,0x81,0x9a,0xb4,0x1e}, 72494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x64,0xdc,0x17,0x7e,0x6d,0xf5,0x33,0x40,0x1e,0x74,0xff,0xe8,0xce,0x4a,0x9f,0x40}, 72594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x81,0x94,0xde,0x4d,0xbc,0xc9,0xe6,0x18,0x00,0x5e,0x5d,0x50,0x27,0x9f,0xfd,0xe9}, 72694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xfd,0x3e,0x6f,0x62,0xbe,0x93,0xf5,0x2a,0x34,0x39,0x67,0x47,0x7a,0x3c,0xe8,0x95}, 72794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb7,0x28,0x7e,0x92,0x5d,0xae,0x57,0x1c,0xb5,0x3a,0xbb,0xa8,0x1c,0xd4,0x72,0x1b}, 72894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x1a,0xc1,0x24,0xbd,0xc1,0x67,0xce,0x45,0x55,0x50,0x40,0xe4,0xfe,0xc1,0x5a,0x85}, 72994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe7,0x44,0xb2,0x33,0xa1,0xfb,0x1e,0x84,0x9b,0x58,0x73,0xca,0x2c,0x6d,0xcd,0x0b}, 73094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x96,0x17,0x8d,0x5a,0x67,0xb1,0x0a,0x91,0x62,0xb2,0x48,0x01,0x96,0x9f,0x21,0xf5}, 73194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x6b,0xcd,0x5f,0xf3,0x5a,0x6c,0x8f,0xbe,0xff,0x86,0x82,0x22,0xbf,0x93,0x93,0x3e}, 73294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x3f,0x2a,0x5e,0xd2,0x6d,0x98,0xd8,0x6b,0x0a,0xe7,0xe8,0x76,0x67,0x11,0xdb,0x80}, 73394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x7c,0x70,0x1a,0x08,0x98,0xd1,0xb2,0xbf,0xe9,0x10,0xde,0xb5,0xec,0x5f,0x90,0x95}, 73494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x4b,0x50,0x25,0xd8,0xdf,0xad,0x34,0x47,0xf1,0x47,0x41,0x9a,0x3f,0x91,0x56,0x1a}, 73594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x03,0x87,0x4a,0x58,0xe3,0x65,0xef,0x78,0x44,0xfb,0x92,0x42,0xb4,0x41,0xe9,0xea}, 73694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x94,0xaf,0xcb,0xaa,0xa3,0x65,0x5c,0xb1,0x4e,0x34,0xc9,0x2b,0xdd,0xa3,0xf7,0x86}, 73794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x13,0x22,0x01,0xd8,0x0c,0x07,0xe9,0xe2,0x99,0xb5,0x3b,0xc3,0x52,0xca,0x15,0x3b}, 73894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc5,0x7f,0x2c,0x1e,0xc6,0xb1,0x34,0x9c,0x6a,0x7e,0x92,0x04,0x43,0xac,0x5e,0x3a}, 73994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x2d,0x2b,0xd9,0x79,0x3e,0xde,0x74,0x82,0x05,0x8d,0xb6,0xf7,0xdf,0xb1,0x25,0x90}, 74094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x6f,0xf9,0xc0,0x8b,0xfc,0x8c,0x81,0xe7,0x05,0x1e,0x07,0xef,0x4f,0xe7,0x26,0x7f}, 74194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x3a,0xa3,0x46,0xa0,0xa7,0xbb,0x0c,0x3d,0xce,0x13,0x16,0x19,0xb5,0x22,0x5d,0x8f}, 74294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x89,0xe6,0xdd,0xfa,0x63,0x34,0xd3,0x32,0xdd,0x7f,0x98,0x48,0xee,0xd8,0x2d,0xf5}, 74394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xed,0xd4,0xae,0x23,0xa3,0x34,0x95,0xcc,0x5d,0x77,0xae,0x7b,0xa7,0x99,0xc0,0x44}, 74494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe4,0x19,0x5f,0x34,0xb8,0x7b,0x27,0xef,0x7e,0x24,0x45,0x67,0x01,0x84,0xb0,0xe9}, 74594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x8f,0x1a,0xf7,0xa6,0xb8,0xd3,0x3a,0x34,0x05,0xcb,0xd4,0x50,0xbd,0x13,0xad,0x75}, 74694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x67,0xd9,0xb8,0x1d,0xe5,0x2d,0x00,0x80,0x0a,0x41,0x9b,0x1f,0x0c,0xe7,0x2b,0x8a}, 74794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x18,0x09,0x91,0xac,0x8e,0xf5,0xbe,0x23,0x5f,0x14,0x5d,0xfb,0xf1,0xc1,0xe1,0x0f}, 74894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x24,0x70,0x94,0xde,0x01,0x5a,0xb4,0xd7,0x66,0xe2,0x09,0x1e,0x4d,0x28,0xfd,0xde}, 74994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x90,0x5d,0x96,0x0b,0xb9,0x2a,0x4e,0x49,0xd9,0xda,0xb2,0xba,0x00,0x85,0x0e,0x3e}, 75094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xce,0x48,0x54,0xb3,0x78,0xd4,0xc3,0xda,0xf0,0x96,0xa5,0xaf,0x24,0x67,0x47,0x6c}, 75194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd7,0xf6,0x3e,0xf0,0x30,0x80,0x17,0x2a,0xd4,0x18,0x2c,0x6d,0xe1,0x18,0x54,0x19}, 75294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x1b,0x95,0x59,0x42,0x14,0x96,0x53,0xee,0xc3,0xf4,0xf0,0x94,0xfa,0x96,0x14,0xbe}, 75394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x4e,0xa9,0x43,0x41,0xaa,0x3f,0x59,0x09,0x10,0xc7,0x5d,0xca,0x63,0x2b,0x40,0x36}, 75494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x1b,0x67,0x00,0xb7,0xc6,0x1d,0x0b,0xe5,0x25,0x47,0xdb,0x19,0x19,0xb7,0xcc,0x0e}, 75594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x9b,0x2a,0x3b,0xaa,0xaa,0x00,0x5c,0xa4,0x8b,0xd1,0x39,0xc3,0xa4,0xb1,0xb9,0x39}, 75694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x88,0x6b,0x5a,0x1e,0x93,0x22,0x84,0xed,0x20,0x37,0x9d,0x37,0xf7,0xef,0x7a,0xa6}, 75794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x89,0x1e,0x8a,0xa7,0x40,0xe0,0x41,0xad,0xe3,0xa2,0xd2,0x20,0x9f,0x0f,0x6c,0x7e}, 75894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb7,0x76,0x75,0x39,0x44,0x08,0x68,0x9d,0xb4,0xb0,0xb7,0x84,0x94,0x5c,0x0f,0xea}, 75994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd6,0x32,0x73,0x2d,0xa5,0x5e,0x9a,0xc7,0x7f,0xfa,0xb9,0x46,0x11,0x35,0x8b,0x9d}, 76094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x12,0xf7,0x4f,0x60,0x7b,0x9a,0xdd,0x06,0x20,0x35,0x31,0xfa,0x47,0xfc,0x03,0xd6}, 76194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc4,0x9b,0x60,0x13,0xc5,0x48,0xcc,0xdc,0x49,0x58,0x0a,0x79,0x55,0xfc,0x2a,0x7e}, 76294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x53,0x1d,0x22,0x6b,0x47,0x88,0x72,0xbd,0x69,0xc0,0xa6,0x5a,0x36,0x4e,0xb0,0x8c}, 76394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x53,0x82,0xcd,0x4c,0xfc,0xe9,0x97,0xc1,0xf4,0x55,0x5f,0x1a,0x08,0x04,0x4d,0x07}, 76494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x10,0x37,0x4c,0x98,0x9e,0x1d,0xf5,0x58,0x53,0x15,0x20,0x71,0x06,0x3e,0x3a,0x73}, 76594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x6c,0x12,0xb4,0x08,0xf7,0xf1,0x6d,0x2c,0x71,0x6b,0x67,0x02,0xd0,0x55,0x7b,0xcd}, 76694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x34,0xd5,0xd1,0x5d,0x36,0x44,0xf5,0x0e,0x0b,0x3e,0xea,0xf0,0x76,0xb5,0xe9,0xee}, 76794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc8,0xa1,0x0c,0xf3,0x34,0xc2,0xae,0x63,0x60,0xb5,0xa3,0x0b,0x3d,0x86,0x41,0x7d}, 76894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xa3,0xdc,0x0f,0x15,0x87,0x65,0x4d,0x4b,0xc5,0x12,0x0f,0x91,0x49,0x64,0xdb,0x48}, 76994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xee,0x4d,0xcf,0xf5,0x83,0xab,0xba,0x8e,0xec,0x61,0x6e,0xaa,0x11,0x1f,0x86,0x0a}, 77094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc3,0x10,0xca,0x83,0x40,0x19,0xf9,0xac,0xa7,0xce,0xad,0x19,0x75,0xc9,0x50,0xb5}, 77194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x79,0x89,0x76,0xb4,0x17,0x6e,0x91,0x66,0xc9,0xdf,0x6b,0xaf,0x07,0xdb,0x4c,0x85}, 77294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xf8,0x4e,0x88,0x6c,0xbc,0x5c,0xc3,0x24,0x27,0x16,0xf1,0xcf,0xb0,0x23,0x93,0xf3}, 77394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x79,0x51,0x2f,0x7c,0xd7,0x0c,0xe4,0xd7,0xb9,0x2e,0x0c,0x65,0xbd,0xda,0xae,0xa4}, 77494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xdb,0xea,0xda,0xdd,0x40,0x68,0x2f,0xb5,0x5d,0x81,0x84,0xfe,0x00,0x73,0xa2,0xd9}, 77594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xf5,0x88,0x10,0x6b,0xaf,0x63,0xc5,0x70,0x11,0xd4,0x63,0x93,0x58,0x71,0xba,0x1c}, 77694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x6f,0xed,0x44,0x67,0x7e,0x59,0x37,0xdc,0xda,0x85,0x57,0x9f,0xc9,0xdd,0x0e,0xb5}, 77794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x32,0x97,0x51,0x8c,0x51,0xd4,0x64,0x5a,0x73,0x50,0xfb,0x90,0xb9,0x3c,0x2d,0xd8}, 77894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe5,0x08,0x0a,0x59,0xb3,0xc4,0xfc,0x10,0x15,0x38,0x35,0xdd,0x45,0xdc,0x55,0x52}, 77994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xfe,0xd3,0x7d,0xda,0xbb,0xb0,0xf5,0x07,0x05,0x1f,0x8d,0x86,0x46,0xf1,0x69,0x43}, 78094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd1,0x60,0x46,0xdc,0x2e,0x78,0xcf,0x18,0xce,0xe0,0x1f,0x1d,0x97,0x0e,0xe4,0xb1}, 78194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x10,0xb0,0xec,0x09,0xea,0x45,0xe9,0xd1,0xd1,0xf8,0x73,0x72,0xe2,0xd4,0xc6,0x4a}, 78294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xf0,0x66,0x18,0xb2,0x79,0x00,0xab,0x31,0x5c,0x8a,0x24,0x6d,0x3c,0xfd,0x11,0x06}, 78394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xaf,0x77,0x28,0xb1,0x4d,0x47,0xa6,0xff,0x74,0x30,0x80,0x74,0xe6,0x7b,0x75,0xdc}, 78494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xab,0x9f,0xfc,0xb0,0xf7,0xc3,0xe2,0xb6,0xaa,0x06,0x32,0xde,0xe9,0x7f,0xf0,0x4e}, 78594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x67,0x91,0x59,0x6f,0x76,0x99,0x7f,0xe1,0xec,0x23,0x53,0xd3,0x21,0xe4,0x3a,0x4a}, 78694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xc2,0xfd,0x99,0x93,0x4b,0x0d,0x76,0x77,0x10,0xd1,0x03,0x9e,0x35,0xec,0xaf,0xc4}, 78794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x2c,0x26,0x15,0x2c,0xf9,0x93,0x38,0x9b,0x02,0x69,0xe5,0xf5,0xb7,0x63,0xc8,0x7d}, 78894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x97,0x6e,0x07,0x58,0xc6,0x22,0x62,0xf5,0x9e,0x97,0xf4,0x20,0x33,0xdc,0x8e,0x1d}, 78994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x8b,0x74,0x09,0xd0,0x97,0x91,0x51,0x4d,0x21,0xd4,0xa6,0xf6,0x91,0xeb,0x76,0x58}, 79094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x0c,0x01,0xdf,0x15,0xc2,0x9d,0xb4,0x8e,0xe2,0xc5,0xf1,0xda,0x3d,0xab,0x74,0x6d}, 79194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xa1,0x79,0x93,0x3b,0x61,0xe9,0x0e,0x45,0xf1,0x32,0xec,0x17,0x80,0x34,0x8f,0x8b}, 79294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x41,0x7d,0x99,0xce,0xab,0xbc,0x1a,0xad,0xe3,0x58,0xbf,0x53,0xe1,0x92,0xa6,0xb4}, 79394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd6,0xf3,0x71,0x0a,0x57,0xac,0x0d,0xa9,0xae,0x72,0xf4,0xb8,0x29,0xbd,0x5f,0xe5}, 79494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xa0,0xae,0x10,0xca,0x41,0x0d,0x93,0x32,0x9b,0x19,0xb7,0x65,0x5a,0xa3,0x18,0xed}, 79594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x91,0xd0,0xa3,0x45,0x4e,0x9d,0xfc,0xeb,0xc4,0xa0,0x3d,0x4c,0xc6,0x67,0x62,0x3b}, 79694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x5a,0xa1,0xa1,0x13,0x62,0x69,0x19,0xbb,0x5b,0x62,0x37,0x08,0xc5,0xb2,0x34,0xca}, 79794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd1,0x0c,0x08,0x0d,0xdf,0x1e,0xca,0xda,0x21,0xa0,0xb9,0xdd,0x4e,0x40,0x17,0x1c}, 79894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x0f,0x87,0x02,0x6f,0x9f,0x9e,0xa5,0xaa,0x24,0xda,0x79,0x18,0x4e,0x46,0xbe,0x95}, 79994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x54,0x32,0xfc,0x98,0x14,0x18,0x83,0xf7,0x80,0x89,0x7b,0xc8,0x29,0xeb,0x90,0x80}, 80094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x57,0x44,0x26,0xc4,0x44,0x01,0x25,0x44,0x6f,0xd2,0xd3,0x04,0xcf,0x13,0x37,0x99}, 80194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x70,0x71,0x2d,0x06,0x80,0x6d,0x26,0x93,0x60,0x7d,0xf9,0x69,0x79,0xa3,0x95,0xf2}, 80294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x0f,0xac,0x31,0x7d,0xd9,0xf9,0x58,0xce,0xac,0x7f,0x42,0xad,0x3c,0xde,0x3e,0x3e}, 80394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x23,0x30,0x77,0xd9,0xfd,0x64,0xf6,0xa7,0xff,0x4b,0xad,0x3f,0xa9,0x61,0xd1,0x4d}, 80494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x38,0x68,0x36,0x7a,0xd1,0x7a,0x77,0x07,0xed,0x7e,0x19,0xb3,0x71,0x56,0x7e,0xdb}, 80594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x0a,0x75,0x86,0x4a,0x93,0xb8,0xaf,0x71,0x09,0xae,0xa3,0x57,0xcc,0x45,0xb6,0x38}, 80694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xed,0x15,0xbc,0xce,0x02,0x64,0x46,0x8a,0x58,0xc2,0xef,0xdb,0xc4,0x57,0xa6,0x0f}, 80794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xd9,0x13,0xc8,0xae,0xf9,0x7a,0xc7,0x62,0x66,0x4f,0xe0,0x91,0xab,0xdb,0x0b,0x5b}, 80894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xa2,0xcb,0xd5,0x32,0xed,0x71,0x07,0x63,0x25,0x59,0xfb,0x06,0xfa,0xb0,0xbd,0x70}, 80994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x6e,0x23,0x5e,0x65,0x9c,0xc6,0xcd,0x89,0xba,0x68,0xa2,0x92,0x28,0xb3,0x74,0x10}, 81094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x50,0x0d,0x88,0x2a,0x93,0x19,0x9b,0xf0,0x97,0x0e,0x96,0x62,0xbe,0x94,0x6d,0x02}, 81194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x0c,0xc7,0x0a,0xc8,0xb1,0xad,0xbf,0xda,0xce,0x8b,0x51,0x34,0x16,0x85,0x8a,0xf2}, 81294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xff,0x78,0x96,0x32,0xb8,0xd4,0xae,0xcd,0x94,0xa0,0xaa,0xb3,0x30,0x74,0xa0,0x58}, 81394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x8a,0xd2,0x35,0xc1,0x09,0x65,0x23,0x39,0xbd,0xea,0x3a,0xc8,0x32,0x55,0xb2,0x88}, 81494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x45,0xcf,0x0b,0x3f,0x9d,0xa8,0xd2,0x17,0x6e,0x5c,0x53,0x0c,0xe2,0xa7,0x4e,0xe6}, 81594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xec,0x35,0x8a,0x4b,0xaa,0x38,0x45,0xeb,0x24,0xaf,0x6c,0x0c,0x34,0xef,0xb2,0xeb}, 81694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x73,0xfd,0xd6,0xc7,0x65,0x3c,0xde,0xdc,0x9a,0xda,0x88,0xc8,0xe9,0x7e,0x5e,0x77}, 81794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xf0,0x88,0x2a,0x36,0x10,0xa5,0xe8,0x5f,0x8a,0x17,0x49,0xb9,0x77,0x9d,0xb7,0x3c}, 81894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xfe,0x73,0x90,0xdb,0x0d,0x7f,0x6c,0x64,0xba,0x20,0xfa,0xb8,0x98,0x6b,0x07,0xac}, 81994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x87,0x07,0x70,0x09,0xd7,0x96,0xf7,0x0f,0xc1,0x79,0xf3,0x98,0xbc,0x94,0x7a,0x0d}, 82094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x44,0x08,0x71,0x99,0x1c,0xf0,0x1e,0x3d,0x7f,0x58,0xc4,0x5e,0x20,0x3e,0xa5,0xed}, 82194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x64,0xd2,0x35,0x96,0x94,0x7a,0xe5,0x1a,0xcb,0xc8,0xa2,0x4f,0xaf,0x22,0xd4,0x83}, 82294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x8b,0x01,0x1d,0xaa,0x9f,0x3b,0x72,0xda,0x93,0x67,0x03,0x6c,0x8a,0x89,0xe8,0x0d}, 82394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x61,0xd3,0x0f,0x6b,0x8a,0x2a,0x10,0x3d,0xcf,0x37,0x1d,0xa4,0xc0,0x04,0x60,0x02}, 82494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x66,0xe4,0x6e,0x5b,0x8d,0x57,0x42,0x81,0xc9,0x35,0xe6,0x34,0x03,0x8e,0x87,0x7b}, 82594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xf8,0x4b,0x75,0xfc,0xe8,0xbd,0x1f,0xf1,0x3f,0xa0,0x79,0xcc,0x39,0xd4,0x51,0x64}, 82694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x62,0xf0,0x91,0x47,0xb1,0xac,0x01,0x4d,0x88,0x92,0xc0,0xf8,0x29,0x4d,0x0b,0x66}, 82794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe7,0xf5,0x86,0x83,0x06,0x61,0x12,0xdc,0x5e,0xb2,0x44,0xfc,0xf2,0x08,0xe8,0x50}, 82894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x97,0x0c,0x55,0xe7,0x2e,0x6a,0x7b,0xfc,0x51,0x12,0xd8,0xa0,0xb5,0x7f,0x2e,0x18}, 82994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x19,0xf1,0xf7,0xdf,0xba,0xfd,0xd3,0xf1,0x20,0x75,0xb0,0xa2,0xfa,0x78,0x84,0x8d}, 83094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x9e,0xaf,0xe6,0xd3,0x83,0x69,0x72,0x39,0x64,0xbe,0x9f,0x4f,0x19,0x8e,0x36,0x16}, 83194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x35,0x80,0x30,0xbc,0x92,0xa9,0x9b,0x61,0xe9,0x6a,0xee,0x63,0x0e,0x32,0xa9,0xc3}, 83294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x2e,0x34,0xe5,0x92,0xca,0xbd,0xe8,0x9b,0xde,0x01,0xe7,0xfb,0xd4,0x25,0xcc,0x93}, 83394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x83,0xef,0x75,0x79,0x05,0xde,0xcd,0x9f,0x97,0x3c,0x60,0x2f,0x4b,0x1e,0x1a,0x96}, 83494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x5b,0xec,0xea,0x91,0x8f,0x7a,0x1a,0xe9,0xe8,0xd7,0xc7,0xa4,0xc0,0x25,0x65,0xe1}, 83594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x32,0x50,0xb9,0xbe,0x0d,0xd0,0x0a,0x10,0x64,0xab,0xc9,0xbf,0xb3,0xba,0x56,0x92}, 83694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x31,0x4b,0xc4,0xfb,0x88,0x16,0x17,0xd7,0x5b,0x7f,0xcc,0x8a,0xbe,0xd1,0xf9,0x19}, 83794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x10,0x34,0x3e,0x96,0x72,0x69,0x92,0x7b,0x5d,0x8f,0x92,0xdc,0xae,0x4b,0xf6,0x55}, 83894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x65,0x7e,0xfa,0xec,0x2e,0xdf,0x76,0x0b,0x9d,0x59,0xe2,0xd0,0x0b,0x1b,0xb9,0x8a}, 83994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xb0,0x31,0x6b,0xd2,0x63,0xb0,0x28,0x79,0xb3,0x64,0x5f,0x45,0xdc,0x98,0x58,0xa0}, 84094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xed,0x1a,0x10,0x08,0x19,0x0a,0x5d,0x16,0x54,0xd1,0x38,0xeb,0x8f,0xd1,0x15,0x4a}, 84194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xad,0x7c,0x7f,0x0c,0xfe,0x66,0x6f,0xbe,0xde,0xf2,0x0a,0xa9,0x5f,0x22,0xf9,0x0b}, 842ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen }; 843ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 844ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (serial_number_.size() == kSerialBytes) { 845ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen for (unsigned i = 0; i < kNumSerials; i++) { 846ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen if (memcmp(kSerials[i], serial_number_.data(), kSerialBytes) == 0) { 84794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen UMA_HISTOGRAM_ENUMERATION("Net.SSLCertBlacklisted", i, kNumSerials + 1); 848ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return true; 849ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 850ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 851ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen } 852ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 85394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen // Special case for DigiNotar: this serial number had a leading 0x00 byte 85494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen static const uint8 kDigiNotarLeadingZero[15] = { 85594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 0x17,0x7f,0xb6,0x53,0x6b,0x98,0xce,0x40,0xd5,0x4b,0x8b,0x24,0xe3,0x16,0x05 85694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen }; 85794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 85894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen if (serial_number_.size() == sizeof(kDigiNotarLeadingZero) && 85994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen memcmp(serial_number_.data(), kDigiNotarLeadingZero, 86094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen sizeof(kDigiNotarLeadingZero)) == 0) { 86194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen UMA_HISTOGRAM_ENUMERATION("Net.SSLCertBlacklisted", kNumSerials, 86294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen kNumSerials + 1); 86394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen return true; 86494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen } 86594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 86694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen return false; 86794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen} 86894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 86994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen// static 87094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsenbool X509Certificate::IsPublicKeyBlacklisted( 87194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen const std::vector<SHA1Fingerprint>& public_key_hashes) { 87294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen static const unsigned kNumHashes = 3; 87394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen static const uint8 kHashes[kNumHashes][base::SHA1_LENGTH] = { 87494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen // Subject: CN=DigiNotar Root CA 87594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen // Issuer: CN=Entrust.net x2 and self-signed 87694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0x41, 0x0f, 0x36, 0x36, 0x32, 0x58, 0xf3, 0x0b, 0x34, 0x7d, 87794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 0x12, 0xce, 0x48, 0x63, 0xe4, 0x33, 0x43, 0x78, 0x06, 0xa8}, 87894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen // Subject: CN=DigiNotar Cyber CA 87994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen // Issuer: CN=GTE CyberTrust Global Root 88094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xba, 0x3e, 0x7b, 0xd3, 0x8c, 0xd7, 0xe1, 0xe6, 0xb9, 0xcd, 88194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 0x4c, 0x21, 0x99, 0x62, 0xe5, 0x9d, 0x7a, 0x2f, 0x4e, 0x37}, 88294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen // Subject: CN=DigiNotar Services 1024 CA 88394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen // Issuer: CN=Entrust.net 88494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen {0xe2, 0x3b, 0x8d, 0x10, 0x5f, 0x87, 0x71, 0x0a, 0x68, 0xd9, 88594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 0x24, 0x80, 0x50, 0xeb, 0xef, 0xc6, 0x27, 0xbe, 0x4c, 0xa6}, 88694ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen }; 88794ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 88894ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen for (unsigned i = 0; i < kNumHashes; i++) { 88994ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen for (std::vector<SHA1Fingerprint>::const_iterator 89094ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen j = public_key_hashes.begin(); j != public_key_hashes.end(); ++j) { 89194ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen if (memcmp(j->data, kHashes[i], base::SHA1_LENGTH) == 0) 89294ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen return true; 89394ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen } 89494ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen } 89594ea77830f08742eaf1760a8ccc858530cb1c36eKristian Monsen 896ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return false; 897ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen} 898ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 899ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen// static 900ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsenbool X509Certificate::IsSHA1HashInSortedArray(const SHA1Fingerprint& hash, 901ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen const uint8* array, 902ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen size_t array_byte_len) { 903ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen DCHECK_EQ(0u, array_byte_len % base::SHA1_LENGTH); 904ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen const unsigned arraylen = array_byte_len / base::SHA1_LENGTH; 905ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen return NULL != bsearch(hash.data, array, arraylen, base::SHA1_LENGTH, 906ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen CompareSHA1Hashes); 907ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen} 908ddb351dbec246cf1fab5ec20d2d5520909041de1Kristian Monsen 909c7f5f8508d98d5952d42ed7648c2a8f30a4da156Patrick Scott} // namespace net 910