15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "net/cert/x509_certificate.h" 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <stdlib.h> 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <algorithm> 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <map> 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <string> 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <vector> 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/base64.h" 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/lazy_instance.h" 165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/logging.h" 175f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "base/memory/scoped_ptr.h" 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/memory/singleton.h" 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/metrics/histogram.h" 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/pickle.h" 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/sha1.h" 22c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "base/strings/string_piece.h" 235e3f23d412006dc4db4e659864679f29341e113fTorne (Richard Coles)#include "base/strings/string_util.h" 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/synchronization/lock.h" 25eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch#include "base/time/time.h" 265f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "crypto/secure_hash.h" 275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/net_util.h" 2890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "net/base/registry_controlled_domains/registry_controlled_domain.h" 29c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "net/cert/pem_tokenizer.h" 307dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch#include "url/url_canon.h" 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace net { 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace { 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Indicates the order to use when trying to decode binary data, which is 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// based on (speculation) as to what will be most common -> least common 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const X509Certificate::Format kFormatDecodePriority[] = { 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::FORMAT_SINGLE_CERTIFICATE, 405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::FORMAT_PKCS7 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// The PEM block header used for DER certificates 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kCertificateHeader[] = "CERTIFICATE"; 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// The PEM block header used for PKCS#7 data 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kPKCS7Header[] = "PKCS7"; 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// A thread-safe cache for OS certificate handles. 505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Within each of the supported underlying crypto libraries, a certificate 525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// handle is represented as a ref-counted object that contains the parsed 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// data for the certificate. In addition, the underlying OS handle may also 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// contain a copy of the original ASN.1 DER used to constructed the handle. 555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// In order to reduce the memory usage when multiple SSL connections exist, 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// with each connection storing the server's identity certificate plus any 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// intermediates supplied, the certificate handles are cached. Any two 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// X509Certificates that were created from the same ASN.1 DER data, 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// regardless of where that data came from, will share the same underlying 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// OS certificate handle. 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)class X509CertificateCache { 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) public: 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Performs a compare-and-swap like operation. If an OS certificate handle 655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // for the same certificate data as |*cert_handle| already exists in the 665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // cache, the original |*cert_handle| will be freed and |cert_handle| 675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // will be updated to point to a duplicated reference to the existing cached 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // certificate, with the caller taking ownership of this duplicated handle. 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If an equivalent OS certificate handle is not found, a duplicated 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // reference to |*cert_handle| will be added to the cache. In either case, 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // upon return, the caller fully owns |*cert_handle| and is responsible for 725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // calling FreeOSCertHandle(), after first calling Remove(). 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void InsertOrUpdate(X509Certificate::OSCertHandle* cert_handle); 745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Decrements the cache reference count for |cert_handle|, a handle that was 765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // previously obtained by calling InsertOrUpdate(). If this is the last 775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // cached reference held, this will remove the handle from the cache. The 785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // caller retains ownership of |cert_handle| and remains responsible for 795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // calling FreeOSCertHandle() to release the underlying OS certificate 805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void Remove(X509Certificate::OSCertHandle cert_handle); 815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A single entry in the cache. Certificates will be keyed by their SHA1 845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // fingerprints, but will not be considered equivalent unless the entire 855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // certificate data matches. 865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) struct Entry { 875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) Entry() : cert_handle(NULL), ref_count(0) {} 885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::OSCertHandle cert_handle; 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Increased by each call to InsertOrUpdate(), and balanced by each call 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // to Remove(). When it equals 0, all references created by 935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // InsertOrUpdate() have been released, so the cache entry will be removed 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the cached OS certificate handle will be freed. 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int ref_count; 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) }; 975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) typedef std::map<SHA1HashValue, Entry, SHA1HashValueLessThan> CertMap; 985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Obtain an instance of X509CertificateCache via a LazyInstance. 1005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509CertificateCache() {} 1015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~X509CertificateCache() {} 1025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) friend struct base::DefaultLazyInstanceTraits<X509CertificateCache>; 1035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // You must acquire this lock before using any private data of this object 1055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // You must not block while holding this lock. 1065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Lock lock_; 1075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // The certificate cache. You must acquire |lock_| before using |cache_|. 1095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertMap cache_; 1105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DISALLOW_COPY_AND_ASSIGN(X509CertificateCache); 1125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 1135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::LazyInstance<X509CertificateCache>::Leaky 1155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_x509_certificate_cache = LAZY_INSTANCE_INITIALIZER; 1165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void X509CertificateCache::InsertOrUpdate( 1185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::OSCertHandle* cert_handle) { 1195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(cert_handle); 1205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SHA1HashValue fingerprint = 1215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::CalculateFingerprint(*cert_handle); 1225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::OSCertHandle old_handle = NULL; 1245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) { 1255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::AutoLock lock(lock_); 1265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertMap::iterator pos = cache_.find(fingerprint); 1275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (pos == cache_.end()) { 1285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A cached entry was not found, so initialize a new entry. The entry 1295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // assumes ownership of the current |*cert_handle|. 1305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) Entry cache_entry; 1315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cache_entry.cert_handle = *cert_handle; 1325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cache_entry.ref_count = 0; 1335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertMap::value_type cache_value(fingerprint, cache_entry); 1345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pos = cache_.insert(cache_value).first; 1355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 1365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool is_same_cert = 1375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::IsSameOSCert(*cert_handle, pos->second.cert_handle); 1385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!is_same_cert) { 1395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Two certificates don't match, due to a SHA1 hash collision. Given 1405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the low probability, the simplest solution is to not cache the 1415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // certificate, which should not affect performance too negatively. 1425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 1435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A cached entry was found and will be used instead of the caller's 1455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // handle. Ensure the caller's original handle will be freed, since 1465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // ownership is assumed. 1475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) old_handle = *cert_handle; 1485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Whether an existing cached handle or a new handle, increment the 1505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // cache's reference count and return a handle that the caller can own. 1515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ++pos->second.ref_count; 1525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *cert_handle = X509Certificate::DupOSCertHandle(pos->second.cert_handle); 1535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If the caller's handle was replaced with a cached handle, free the 1555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // original handle now. This is done outside of the lock because 1565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // |old_handle| may be the only handle for this particular certificate, so 1575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // freeing it may be complex or resource-intensive and does not need to 1585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // be guarded by the lock. 1595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (old_handle) { 1605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::FreeOSCertHandle(old_handle); 1611320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci#ifndef NDEBUG 1621320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci LOCAL_HISTOGRAM_BOOLEAN("X509CertificateReuseCount", true); 1631320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci#endif 1645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void X509CertificateCache::Remove(X509Certificate::OSCertHandle cert_handle) { 1685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SHA1HashValue fingerprint = 1695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::CalculateFingerprint(cert_handle); 1705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::AutoLock lock(lock_); 1715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertMap::iterator pos = cache_.find(fingerprint); 1735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (pos == cache_.end()) 1745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; // A hash collision where the winning cert was already freed. 1755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool is_same_cert = X509Certificate::IsSameOSCert(cert_handle, 1775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pos->second.cert_handle); 1785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!is_same_cert) 1795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; // A hash collision where the winning cert is still around. 1805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (--pos->second.ref_count == 0) { 1825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // The last reference to |cert_handle| has been removed, so release the 1835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Entry's OS handle and remove the Entry. The caller still holds a 1845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // reference to |cert_handle| and is responsible for freeing it. 1855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::FreeOSCertHandle(pos->second.cert_handle); 1865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cache_.erase(pos); 1875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // !defined(USE_NSS) 1905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// See X509CertificateCache::InsertOrUpdate. NSS has a built-in cache, so there 1925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// is no point in wrapping another cache around it. 1935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void InsertOrUpdateCache(X509Certificate::OSCertHandle* cert_handle) { 1945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 1955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_x509_certificate_cache.Pointer()->InsertOrUpdate(cert_handle); 1965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 1975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// See X509CertificateCache::Remove. 2005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void RemoveFromCache(X509Certificate::OSCertHandle cert_handle) { 2015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 2025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_x509_certificate_cache.Pointer()->Remove(cert_handle); 2035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 2045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Utility to split |src| on the first occurrence of |c|, if any. |right| will 2075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// either be empty if |c| was not found, or will contain the remainder of the 2085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// string including the split character itself. 2095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void SplitOnChar(const base::StringPiece& src, 2105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) char c, 2115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece* left, 2125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece* right) { 2135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) size_t pos = src.find(c); 2145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (pos == base::StringPiece::npos) { 2155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *left = src; 2165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) right->clear(); 2175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 2185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *left = src.substr(0, pos); 2195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *right = src.substr(pos); 2205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace 2245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 225eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdochbool X509Certificate::LessThan::operator()( 226eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch const scoped_refptr<X509Certificate>& lhs, 227eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch const scoped_refptr<X509Certificate>& rhs) const { 228eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch if (lhs.get() == rhs.get()) 2295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 2305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int rv = memcmp(lhs->fingerprint_.data, rhs->fingerprint_.data, 2325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) sizeof(lhs->fingerprint_.data)); 2335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (rv != 0) 2345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return rv < 0; 2355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) rv = memcmp(lhs->ca_fingerprint_.data, rhs->ca_fingerprint_.data, 2375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) sizeof(lhs->ca_fingerprint_.data)); 2385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return rv < 0; 2395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate::X509Certificate(const std::string& subject, 2425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& issuer, 2435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Time start_date, 2445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Time expiration_date) 2455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : subject_(subject), 2465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) issuer_(issuer), 2475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) valid_start_(start_date), 2485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) valid_expiry_(expiration_date), 2495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert_handle_(NULL) { 2505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memset(fingerprint_.data, 0, sizeof(fingerprint_.data)); 2515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memset(ca_fingerprint_.data, 0, sizeof(ca_fingerprint_.data)); 2525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 2555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate* X509Certificate::CreateFromHandle( 2565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle cert_handle, 2575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const OSCertHandles& intermediates) { 2585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(cert_handle); 2595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return new X509Certificate(cert_handle, intermediates); 2605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 2635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate* X509Certificate::CreateFromDERCertChain( 2645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::vector<base::StringPiece>& der_certs) { 2655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (der_certs.empty()) 2665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 2675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::OSCertHandles intermediate_ca_certs; 2695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 1; i < der_certs.size(); i++) { 2705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle handle = CreateOSCertHandleFromBytes( 2715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const_cast<char*>(der_certs[i].data()), der_certs[i].size()); 2725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!handle) 2735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 2745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) intermediate_ca_certs.push_back(handle); 2755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle handle = NULL; 2785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Return NULL if we failed to parse any of the certs. 2795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (der_certs.size() - 1 == intermediate_ca_certs.size()) { 2805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) handle = CreateOSCertHandleFromBytes( 2815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const_cast<char*>(der_certs[0].data()), der_certs[0].size()); 2825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* cert = NULL; 2855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (handle) { 2865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert = CreateFromHandle(handle, intermediate_ca_certs); 2875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(handle); 2885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediate_ca_certs.size(); i++) 2915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(intermediate_ca_certs[i]); 2925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return cert; 2945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 2975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate* X509Certificate::CreateFromBytes(const char* data, 2985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int length) { 2995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle cert_handle = CreateOSCertHandleFromBytes(data, length); 3005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!cert_handle) 3015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* cert = CreateFromHandle(cert_handle, OSCertHandles()); 3045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle); 3055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return cert; 3065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 3075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 3095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate* X509Certificate::CreateFromPickle(const Pickle& pickle, 3105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PickleIterator* pickle_iter, 3115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PickleType type) { 3125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (type == PICKLETYPE_CERTIFICATE_CHAIN_V3) { 3135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int chain_length = 0; 3145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle_iter->ReadLength(&chain_length)) 3155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<base::StringPiece> cert_chain; 3185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* data = NULL; 3195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int data_length = 0; 3205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (int i = 0; i < chain_length; ++i) { 3215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle_iter->ReadData(&data, &data_length)) 3225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert_chain.push_back(base::StringPiece(data, data_length)); 3245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return CreateFromDERCertChain(cert_chain); 3265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Legacy / Migration code. This should eventually be removed once 3295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // sufficient time has passed that all pickles serialized prior to 3305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PICKLETYPE_CERTIFICATE_CHAIN_V3 have been removed. 3315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle cert_handle = ReadOSCertHandleFromPickle(pickle_iter); 3325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!cert_handle) 3335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandles intermediates; 3365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 num_intermediates = 0; 3375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (type != PICKLETYPE_SINGLE_CERTIFICATE) { 3385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle_iter->ReadUInt32(&num_intermediates)) { 3395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle); 3405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_POSIX) && !defined(OS_MACOSX) && defined(__x86_64__) 3445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // On 64-bit Linux (and any other 64-bit platforms), the intermediate count 3455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // might really be a 64-bit field since we used to use Pickle::WriteSize(), 3465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // which writes either 32 or 64 bits depending on the architecture. Since 3475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // x86-64 is little-endian, if that happens, the next 32 bits will be all 3485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // zeroes (the high bits) and the 32 bits we already read above are the 3495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // correct value (we assume there are never more than 2^32 - 1 intermediate 3505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // certificates in a chain; in practice, more than a dozen or so is 3515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // basically unheard of). Since it's invalid for a certificate to start with 3525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 32 bits of zeroes, we check for that here and skip it if we find it. We 3535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // save a copy of the pickle iterator to restore in case we don't get 32 3545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // bits of zeroes. Now we always write 32 bits, so after a while, these old 3555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // cached pickles will all get replaced. 3565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TODO(mdm): remove this compatibility code in April 2013 or so. 3575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PickleIterator saved_iter = *pickle_iter; 3585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 zero_check = 0; 3595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle_iter->ReadUInt32(&zero_check)) { 3605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This may not be an error. If there are no intermediates, and we're 3615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // reading an old 32-bit pickle, and there's nothing else after this in 3625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the pickle, we should report success. Note that it is technically 3635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // possible for us to skip over zeroes that should have occurred after 3645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // an empty certificate list; to avoid this going forward, only do this 3655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // backward-compatibility stuff for PICKLETYPE_CERTIFICATE_CHAIN_V1 3665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // which comes from the pickle version number in http_response_info.cc. 3675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (num_intermediates) { 3685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle); 3695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (zero_check) 3735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *pickle_iter = saved_iter; 3745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_POSIX) && !defined(OS_MACOSX) && defined(__x86_64__) 3755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (uint32 i = 0; i < num_intermediates; ++i) { 3775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle intermediate = ReadOSCertHandleFromPickle(pickle_iter); 3785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!intermediate) 3795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 3805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) intermediates.push_back(intermediate); 3815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* cert = NULL; 3855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (intermediates.size() == num_intermediates) 3865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert = CreateFromHandle(cert_handle, intermediates); 3875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle); 3885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediates.size(); ++i) 3895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(intermediates[i]); 3905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return cert; 3925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 3935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 3955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)CertificateList X509Certificate::CreateCertificateListFromBytes( 3965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* data, int length, int format) { 3975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandles certificates; 3985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Check to see if it is in a PEM-encoded form. This check is performed 4005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // first, as both OS X and NSS will both try to convert if they detect 4015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PEM encoding, except they don't do it consistently between the two. 4025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece data_string(data, length); 4035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> pem_headers; 4045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // To maintain compatibility with NSS/Firefox, CERTIFICATE is a universally 4065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // valid PEM block header for any format. 4075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_headers.push_back(kCertificateHeader); 4085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & FORMAT_PKCS7) 4095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_headers.push_back(kPKCS7Header); 4105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PEMTokenizer pem_tok(data_string, pem_headers); 4125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) while (pem_tok.GetNext()) { 4135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string decoded(pem_tok.data()); 4145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle handle = NULL; 4165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & FORMAT_PEM_CERT_SEQUENCE) 4175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) handle = CreateOSCertHandleFromBytes(decoded.c_str(), decoded.size()); 4185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (handle != NULL) { 4195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Parsed a DER encoded certificate. All PEM blocks that follow must 4205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // also be DER encoded certificates wrapped inside of PEM blocks. 4215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) format = FORMAT_PEM_CERT_SEQUENCE; 4225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) certificates.push_back(handle); 4235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 4245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If the first block failed to parse as a DER certificate, and 4275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // formats other than PEM are acceptable, check to see if the decoded 4285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // data is one of the accepted formats. 4295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & ~FORMAT_PEM_CERT_SEQUENCE) { 4305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; certificates.empty() && 4315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) i < arraysize(kFormatDecodePriority); ++i) { 4325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & kFormatDecodePriority[i]) { 4335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) certificates = CreateOSCertHandlesFromBytes(decoded.c_str(), 4345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) decoded.size(), kFormatDecodePriority[i]); 4355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Stop parsing after the first block for any format but a sequence of 4405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PEM-encoded DER certificates. The case of FORMAT_PEM_CERT_SEQUENCE 4415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // is handled above, and continues processing until a certificate fails 4425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // to parse. 4435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 4445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Try each of the formats, in order of parse preference, to see if |data| 4475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // contains the binary representation of a Format, if it failed to parse 4485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // as a PEM certificate/chain. 4495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; certificates.empty() && 4505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) i < arraysize(kFormatDecodePriority); ++i) { 4515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & kFormatDecodePriority[i]) 4525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) certificates = CreateOSCertHandlesFromBytes(data, length, 4535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kFormatDecodePriority[i]); 4545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertificateList results; 4575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // No certificates parsed. 4585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (certificates.empty()) 4595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return results; 4605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (OSCertHandles::iterator it = certificates.begin(); 4625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) it != certificates.end(); ++it) { 4635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* result = CreateFromHandle(*it, OSCertHandles()); 4645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) results.push_back(scoped_refptr<X509Certificate>(result)); 4655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(*it); 4665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return results; 4695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void X509Certificate::Persist(Pickle* pickle) { 4725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(cert_handle_); 4735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This would be an absolutely insane number of intermediates. 4745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (intermediate_ca_certs_.size() > static_cast<size_t>(INT_MAX) - 1) { 4755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NOTREACHED(); 4765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 4775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle->WriteInt( 4795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static_cast<int>(intermediate_ca_certs_.size() + 1)) || 4805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) !WriteOSCertHandleToPickle(cert_handle_, pickle)) { 4815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NOTREACHED(); 4825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 4835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { 4855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!WriteOSCertHandleToPickle(intermediate_ca_certs_[i], pickle)) { 4865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NOTREACHED(); 4875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 4885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void X509Certificate::GetDNSNames(std::vector<std::string>* dns_names) const { 4935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) GetSubjectAltName(dns_names, NULL); 4945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (dns_names->empty()) 4955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dns_names->push_back(subject_.common_name); 4965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::HasExpired() const { 4995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return base::Time::Now() > valid_expiry(); 5005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 5015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::Equals(const X509Certificate* other) const { 5035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return IsSameOSCert(cert_handle_, other->cert_handle_); 5045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 5055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 5075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::VerifyHostname( 5085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& hostname, 5095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& cert_common_name, 5105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::vector<std::string>& cert_san_dns_names, 5111e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) const std::vector<std::string>& cert_san_ip_addrs, 5121e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) bool* common_name_fallback_used) { 5135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(!hostname.empty()); 5145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Perform name verification following http://tools.ietf.org/html/rfc6125. 5155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // The terminology used in this method is as per that RFC:- 5165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Reference identifier == the host the local user/agent is intending to 5175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // access, i.e. the thing displayed in the URL bar. 5185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Presented identifier(s) == name(s) the server knows itself as, in its cert. 5195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // CanonicalizeHost requires surrounding brackets to parse an IPv6 address. 5215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string host_or_ip = hostname.find(':') != std::string::npos ? 5225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "[" + hostname + "]" : hostname; 5235c02ac1a9c1b504631c0a3d2b6e737b5d738bae1Bo Liu url::CanonHostInfo host_info; 5245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string reference_name = CanonicalizeHost(host_or_ip, &host_info); 5255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // CanonicalizeHost does not normalize absolute vs relative DNS names. If 5265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the input name was absolute (included trailing .), normalize it as if it 5275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // was relative. 5285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!reference_name.empty() && *reference_name.rbegin() == '.') 5295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reference_name.resize(reference_name.size() - 1); 5305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (reference_name.empty()) 5315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 5325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Allow fallback to Common name matching? 5345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const bool common_name_fallback = cert_san_dns_names.empty() && 5355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert_san_ip_addrs.empty(); 5361e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) *common_name_fallback_used = common_name_fallback; 5375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Fully handle all cases where |hostname| contains an IP address. 5395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (host_info.IsIPAddress()) { 5405c02ac1a9c1b504631c0a3d2b6e737b5d738bae1Bo Liu if (common_name_fallback && host_info.family == url::CanonHostInfo::IPV4) { 5415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Fallback to Common name matching. As this is deprecated and only 5425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // supported for compatibility refuse it for IPv6 addresses. 5435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return reference_name == cert_common_name; 5445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece ip_addr_string( 5465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reinterpret_cast<const char*>(host_info.address), 5475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) host_info.AddressLength()); 5485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return std::find(cert_san_ip_addrs.begin(), cert_san_ip_addrs.end(), 5495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ip_addr_string) != cert_san_ip_addrs.end(); 5505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // |reference_domain| is the remainder of |host| after the leading host 5535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // component is stripped off, but includes the leading dot e.g. 5545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // "www.f.com" -> ".f.com". 5555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If there is no meaningful domain part to |host| (e.g. it contains no dots) 5565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // then |reference_domain| will be empty. 5575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece reference_host, reference_domain; 5585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SplitOnChar(reference_name, '.', &reference_host, &reference_domain); 5595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool allow_wildcards = false; 5605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!reference_domain.empty()) { 5615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(reference_domain.starts_with(".")); 56290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 56390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Do not allow wildcards for public/ICANN registry controlled domains - 56490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // that is, prevent *.com or *.co.uk as valid presented names, but do not 56590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // prevent *.appspot.com (a private registry controlled domain). 56690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // In addition, unknown top-level domains (such as 'intranet' domains or 56790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // new TLDs/gTLDs not yet added to the registry controlled domain dataset) 56890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // are also implicitly prevented. 56990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Because |reference_domain| must contain at least one name component that 57090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // is not registry controlled, this ensures that all reference domains 57190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // contain at least three domain components when using wildcards. 57290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) size_t registry_length = 57390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_controlled_domains::GetRegistryLength( 57490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) reference_name, 57590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_controlled_domains::INCLUDE_UNKNOWN_REGISTRIES, 57690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); 57790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 57890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Because |reference_name| was already canonicalized, the following 57990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // should never happen. 58090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) CHECK_NE(std::string::npos, registry_length); 58190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 58290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Account for the leading dot in |reference_domain|. 58390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) bool is_registry_controlled = 58490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_length != 0 && 58590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_length == (reference_domain.size() - 1); 58690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 58790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Additionally, do not attempt wildcard matching for purely numeric 58890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // hostnames. 58990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) allow_wildcards = 59090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) !is_registry_controlled && 5915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reference_name.find_first_not_of("0123456789.") != std::string::npos; 5925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Now step through the DNS names doing wild card comparison (if necessary) 5955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // on each against the reference name. If subjectAltName is empty, then 5965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // fallback to use the common name instead. 5975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> common_name_as_vector; 5985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::vector<std::string>* presented_names = &cert_san_dns_names; 5995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (common_name_fallback) { 6005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Note: there's a small possibility cert_common_name is an international 6015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // domain name in non-standard encoding (e.g. UTF8String or BMPString 6025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // instead of A-label). As common name fallback is deprecated we're not 6035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // doing anything specific to deal with this. 6045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) common_name_as_vector.push_back(cert_common_name); 6055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) presented_names = &common_name_as_vector; 6065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (std::vector<std::string>::const_iterator it = 6085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) presented_names->begin(); 6095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) it != presented_names->end(); ++it) { 6105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Catch badly corrupt cert names up front. 6115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (it->empty() || it->find('\0') != std::string::npos) { 6125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DVLOG(1) << "Bad name in cert: " << *it; 6135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6156e8cce623b6e4fe0c9e4af605d675dd9d0338c38Torne (Richard Coles) std::string presented_name(base::StringToLowerASCII(*it)); 6165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Remove trailing dot, if any. 6185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (*presented_name.rbegin() == '.') 6195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) presented_name.resize(presented_name.length() - 1); 6205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // The hostname must be at least as long as the cert name it is matching, 6225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // as we require the wildcard (if present) to match at least one character. 6235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (presented_name.length() > reference_name.length()) 6245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece presented_host, presented_domain; 6275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SplitOnChar(presented_name, '.', &presented_host, &presented_domain); 6285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (presented_domain != reference_domain) 6305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece pattern_begin, pattern_end; 6335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SplitOnChar(presented_host, '*', &pattern_begin, &pattern_end); 6345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (pattern_end.empty()) { // No '*' in the presented_host 6365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (presented_host == reference_host) 6375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 6385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pattern_end.remove_prefix(1); // move past the * 6415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!allow_wildcards) 6435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // * must not match a substring of an IDN A label; just a whole fragment. 6465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (reference_host.starts_with("xn--") && 6475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) !(pattern_begin.empty() && pattern_end.empty())) 6485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (reference_host.starts_with(pattern_begin) && 6515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reference_host.ends_with(pattern_end)) 6525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 6535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 6555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6571e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles)bool X509Certificate::VerifyNameMatch(const std::string& hostname, 6581e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) bool* common_name_fallback_used) const { 6595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> dns_names, ip_addrs; 6605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) GetSubjectAltName(&dns_names, &ip_addrs); 6611e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) return VerifyHostname(hostname, subject_.common_name, dns_names, ip_addrs, 6621e9bf3e0803691d0a228da41fc608347b6db4340Torne (Richard Coles) common_name_fallback_used); 6635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 666ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdochbool X509Certificate::GetPEMEncodedFromDER(const std::string& der_encoded, 667ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch std::string* pem_encoded) { 668ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch if (der_encoded.empty()) 6695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 6705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string b64_encoded; 671a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) base::Base64Encode(der_encoded, &b64_encoded); 6725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *pem_encoded = "-----BEGIN CERTIFICATE-----\n"; 6735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Divide the Base-64 encoded data into 64-character chunks, as per 6755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 4.3.2.4 of RFC 1421. 6765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static const size_t kChunkSize = 64; 6775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) size_t chunks = (b64_encoded.size() + (kChunkSize - 1)) / kChunkSize; 6785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0, chunk_offset = 0; i < chunks; 6795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ++i, chunk_offset += kChunkSize) { 6805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_encoded->append(b64_encoded, chunk_offset, kChunkSize); 6815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_encoded->append("\n"); 6825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_encoded->append("-----END CERTIFICATE-----\n"); 6845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 6855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 687ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch// static 688ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdochbool X509Certificate::GetPEMEncoded(OSCertHandle cert_handle, 689ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch std::string* pem_encoded) { 690ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch std::string der_encoded; 691ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch if (!GetDEREncoded(cert_handle, &der_encoded)) 692ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch return false; 693ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch return GetPEMEncodedFromDER(der_encoded, pem_encoded); 694ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch} 695ca12bfac764ba476d6cd062bf1dde12cc64c3f40Ben Murdoch 6965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::GetPEMEncodedChain( 6975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string>* pem_encoded) const { 6985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> encoded_chain; 6995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string pem_data; 7005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!GetPEMEncoded(os_cert_handle(), &pem_data)) 7015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 7025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) encoded_chain.push_back(pem_data); 7035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { 7045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!GetPEMEncoded(intermediate_ca_certs_[i], &pem_data)) 7055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 7065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) encoded_chain.push_back(pem_data); 7075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_encoded->swap(encoded_chain); 7095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 7105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7125f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// static 7135f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)SHA256HashValue X509Certificate::CalculateCAFingerprint256( 7145f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const OSCertHandles& intermediates) { 7155f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) SHA256HashValue sha256; 7165f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) memset(sha256.data, 0, sizeof(sha256.data)); 7175f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 7185f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) scoped_ptr<crypto::SecureHash> hash( 7195f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) crypto::SecureHash::Create(crypto::SecureHash::SHA256)); 7205f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 7215f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) for (size_t i = 0; i < intermediates.size(); ++i) { 7225f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) std::string der_encoded; 7235f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) if (!GetDEREncoded(intermediates[i], &der_encoded)) 7245f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return sha256; 7255f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) hash->Update(der_encoded.data(), der_encoded.length()); 7265f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 7275f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) hash->Finish(sha256.data, sizeof(sha256.data)); 7285f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 7295f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return sha256; 7305f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 7315f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 7325f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)// static 7335f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)SHA256HashValue X509Certificate::CalculateChainFingerprint256( 7345f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) OSCertHandle leaf, 7355f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) const OSCertHandles& intermediates) { 7365f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) OSCertHandles chain; 7375f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) chain.push_back(leaf); 7385f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) chain.insert(chain.end(), intermediates.begin(), intermediates.end()); 7395f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 7405f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return CalculateCAFingerprint256(chain); 7415f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)} 7425f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) 7435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate::X509Certificate(OSCertHandle cert_handle, 7445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const OSCertHandles& intermediates) 7455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : cert_handle_(DupOSCertHandle(cert_handle)) { 7465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) InsertOrUpdateCache(&cert_handle_); 7475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediates.size(); ++i) { 7485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Duplicate the incoming certificate, as the caller retains ownership 7495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // of |intermediates|. 7505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle intermediate = DupOSCertHandle(intermediates[i]); 7515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Update the cache, which will assume ownership of the duplicated 7525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // handle and return a suitable equivalent, potentially from the cache. 7535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) InsertOrUpdateCache(&intermediate); 7545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) intermediate_ca_certs_.push_back(intermediate); 7555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Platform-specific initialization. 7575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) Initialize(); 7585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate::~X509Certificate() { 7615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (cert_handle_) { 7625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) RemoveFromCache(cert_handle_); 7635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle_); 7645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { 7665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) RemoveFromCache(intermediate_ca_certs_[i]); 7675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(intermediate_ca_certs_[i]); 7685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace net 772