x509_certificate.cc revision 90dce4d38c5ff5333bea97d859d4e484e27edf0c
15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "net/cert/x509_certificate.h" 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <stdlib.h> 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <algorithm> 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <map> 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <string> 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <vector> 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/base64.h" 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/lazy_instance.h" 165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/logging.h" 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/memory/singleton.h" 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/metrics/histogram.h" 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/pickle.h" 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/sha1.h" 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/string_util.h" 22c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "base/strings/string_piece.h" 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/synchronization/lock.h" 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/time.h" 2590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "googleurl/src/url_canon.h" 265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/net_util.h" 2790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "net/base/registry_controlled_domains/registry_controlled_domain.h" 28c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "net/cert/pem_tokenizer.h" 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace net { 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace { 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Indicates the order to use when trying to decode binary data, which is 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// based on (speculation) as to what will be most common -> least common 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const X509Certificate::Format kFormatDecodePriority[] = { 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::FORMAT_SINGLE_CERTIFICATE, 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::FORMAT_PKCS7 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// The PEM block header used for DER certificates 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kCertificateHeader[] = "CERTIFICATE"; 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// The PEM block header used for PKCS#7 data 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)const char kPKCS7Header[] = "PKCS7"; 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// A thread-safe cache for OS certificate handles. 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Within each of the supported underlying crypto libraries, a certificate 505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// handle is represented as a ref-counted object that contains the parsed 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// data for the certificate. In addition, the underlying OS handle may also 525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// contain a copy of the original ASN.1 DER used to constructed the handle. 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// In order to reduce the memory usage when multiple SSL connections exist, 555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// with each connection storing the server's identity certificate plus any 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// intermediates supplied, the certificate handles are cached. Any two 575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// X509Certificates that were created from the same ASN.1 DER data, 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// regardless of where that data came from, will share the same underlying 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// OS certificate handle. 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)class X509CertificateCache { 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) public: 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Performs a compare-and-swap like operation. If an OS certificate handle 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // for the same certificate data as |*cert_handle| already exists in the 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // cache, the original |*cert_handle| will be freed and |cert_handle| 655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // will be updated to point to a duplicated reference to the existing cached 665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // certificate, with the caller taking ownership of this duplicated handle. 675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If an equivalent OS certificate handle is not found, a duplicated 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // reference to |*cert_handle| will be added to the cache. In either case, 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // upon return, the caller fully owns |*cert_handle| and is responsible for 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // calling FreeOSCertHandle(), after first calling Remove(). 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void InsertOrUpdate(X509Certificate::OSCertHandle* cert_handle); 725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Decrements the cache reference count for |cert_handle|, a handle that was 745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // previously obtained by calling InsertOrUpdate(). If this is the last 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // cached reference held, this will remove the handle from the cache. The 765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // caller retains ownership of |cert_handle| and remains responsible for 775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // calling FreeOSCertHandle() to release the underlying OS certificate 785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void Remove(X509Certificate::OSCertHandle cert_handle); 795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) private: 815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A single entry in the cache. Certificates will be keyed by their SHA1 825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // fingerprints, but will not be considered equivalent unless the entire 835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // certificate data matches. 845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) struct Entry { 855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) Entry() : cert_handle(NULL), ref_count(0) {} 865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::OSCertHandle cert_handle; 885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Increased by each call to InsertOrUpdate(), and balanced by each call 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // to Remove(). When it equals 0, all references created by 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // InsertOrUpdate() have been released, so the cache entry will be removed 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the cached OS certificate handle will be freed. 935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int ref_count; 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) }; 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) typedef std::map<SHA1HashValue, Entry, SHA1HashValueLessThan> CertMap; 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Obtain an instance of X509CertificateCache via a LazyInstance. 985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509CertificateCache() {} 995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ~X509CertificateCache() {} 1005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) friend struct base::DefaultLazyInstanceTraits<X509CertificateCache>; 1015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // You must acquire this lock before using any private data of this object 1035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // You must not block while holding this lock. 1045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Lock lock_; 1055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // The certificate cache. You must acquire |lock_| before using |cache_|. 1075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertMap cache_; 1085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DISALLOW_COPY_AND_ASSIGN(X509CertificateCache); 1105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 1115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)base::LazyInstance<X509CertificateCache>::Leaky 1135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_x509_certificate_cache = LAZY_INSTANCE_INITIALIZER; 1145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void X509CertificateCache::InsertOrUpdate( 1165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::OSCertHandle* cert_handle) { 1175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(cert_handle); 1185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SHA1HashValue fingerprint = 1195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::CalculateFingerprint(*cert_handle); 1205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::OSCertHandle old_handle = NULL; 1225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) { 1235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::AutoLock lock(lock_); 1245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertMap::iterator pos = cache_.find(fingerprint); 1255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (pos == cache_.end()) { 1265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A cached entry was not found, so initialize a new entry. The entry 1275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // assumes ownership of the current |*cert_handle|. 1285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) Entry cache_entry; 1295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cache_entry.cert_handle = *cert_handle; 1305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cache_entry.ref_count = 0; 1315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertMap::value_type cache_value(fingerprint, cache_entry); 1325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pos = cache_.insert(cache_value).first; 1335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 1345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool is_same_cert = 1355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::IsSameOSCert(*cert_handle, pos->second.cert_handle); 1365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!is_same_cert) { 1375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Two certificates don't match, due to a SHA1 hash collision. Given 1385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the low probability, the simplest solution is to not cache the 1395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // certificate, which should not affect performance too negatively. 1405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 1415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // A cached entry was found and will be used instead of the caller's 1435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // handle. Ensure the caller's original handle will be freed, since 1445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // ownership is assumed. 1455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) old_handle = *cert_handle; 1465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Whether an existing cached handle or a new handle, increment the 1485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // cache's reference count and return a handle that the caller can own. 1495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ++pos->second.ref_count; 1505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *cert_handle = X509Certificate::DupOSCertHandle(pos->second.cert_handle); 1515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If the caller's handle was replaced with a cached handle, free the 1535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // original handle now. This is done outside of the lock because 1545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // |old_handle| may be the only handle for this particular certificate, so 1555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // freeing it may be complex or resource-intensive and does not need to 1565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // be guarded by the lock. 1575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (old_handle) { 1585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::FreeOSCertHandle(old_handle); 1595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DHISTOGRAM_COUNTS("X509CertificateReuseCount", 1); 1605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void X509CertificateCache::Remove(X509Certificate::OSCertHandle cert_handle) { 1645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SHA1HashValue fingerprint = 1655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::CalculateFingerprint(cert_handle); 1665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::AutoLock lock(lock_); 1675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertMap::iterator pos = cache_.find(fingerprint); 1695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (pos == cache_.end()) 1705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; // A hash collision where the winning cert was already freed. 1715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool is_same_cert = X509Certificate::IsSameOSCert(cert_handle, 1735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pos->second.cert_handle); 1745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!is_same_cert) 1755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; // A hash collision where the winning cert is still around. 1765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (--pos->second.ref_count == 0) { 1785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // The last reference to |cert_handle| has been removed, so release the 1795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Entry's OS handle and remove the Entry. The caller still holds a 1805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // reference to |cert_handle| and is responsible for freeing it. 1815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::FreeOSCertHandle(pos->second.cert_handle); 1825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cache_.erase(pos); 1835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 1845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // !defined(USE_NSS) 1865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// See X509CertificateCache::InsertOrUpdate. NSS has a built-in cache, so there 1885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// is no point in wrapping another cache around it. 1895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void InsertOrUpdateCache(X509Certificate::OSCertHandle* cert_handle) { 1905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 1915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_x509_certificate_cache.Pointer()->InsertOrUpdate(cert_handle); 1925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 1935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 1945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 1955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// See X509CertificateCache::Remove. 1965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void RemoveFromCache(X509Certificate::OSCertHandle cert_handle) { 1975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if !defined(USE_NSS) 1985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) g_x509_certificate_cache.Pointer()->Remove(cert_handle); 1995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif 2005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Utility to split |src| on the first occurrence of |c|, if any. |right| will 2035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// either be empty if |c| was not found, or will contain the remainder of the 2045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// string including the split character itself. 2055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void SplitOnChar(const base::StringPiece& src, 2065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) char c, 2075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece* left, 2085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece* right) { 2095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) size_t pos = src.find(c); 2105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (pos == base::StringPiece::npos) { 2115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *left = src; 2125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) right->clear(); 2135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } else { 2145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *left = src.substr(0, pos); 2155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *right = src.substr(pos); 2165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace 2205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::LessThan::operator()(X509Certificate* lhs, 2225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* rhs) const { 2235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (lhs == rhs) 2245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 2255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int rv = memcmp(lhs->fingerprint_.data, rhs->fingerprint_.data, 2275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) sizeof(lhs->fingerprint_.data)); 2285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (rv != 0) 2295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return rv < 0; 2305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) rv = memcmp(lhs->ca_fingerprint_.data, rhs->ca_fingerprint_.data, 2325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) sizeof(lhs->ca_fingerprint_.data)); 2335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return rv < 0; 2345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate::X509Certificate(const std::string& subject, 2375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& issuer, 2385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Time start_date, 2395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::Time expiration_date) 2405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : subject_(subject), 2415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) issuer_(issuer), 2425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) valid_start_(start_date), 2435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) valid_expiry_(expiration_date), 2445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert_handle_(NULL) { 2455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memset(fingerprint_.data, 0, sizeof(fingerprint_.data)); 2465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memset(ca_fingerprint_.data, 0, sizeof(ca_fingerprint_.data)); 2475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 2505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate* X509Certificate::CreateFromHandle( 2515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle cert_handle, 2525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const OSCertHandles& intermediates) { 2535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(cert_handle); 2545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return new X509Certificate(cert_handle, intermediates); 2555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 2585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate* X509Certificate::CreateFromDERCertChain( 2595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::vector<base::StringPiece>& der_certs) { 2605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (der_certs.empty()) 2615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 2625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate::OSCertHandles intermediate_ca_certs; 2645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 1; i < der_certs.size(); i++) { 2655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle handle = CreateOSCertHandleFromBytes( 2665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const_cast<char*>(der_certs[i].data()), der_certs[i].size()); 2675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!handle) 2685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 2695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) intermediate_ca_certs.push_back(handle); 2705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle handle = NULL; 2735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Return NULL if we failed to parse any of the certs. 2745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (der_certs.size() - 1 == intermediate_ca_certs.size()) { 2755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) handle = CreateOSCertHandleFromBytes( 2765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const_cast<char*>(der_certs[0].data()), der_certs[0].size()); 2775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* cert = NULL; 2805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (handle) { 2815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert = CreateFromHandle(handle, intermediate_ca_certs); 2825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(handle); 2835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 2845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediate_ca_certs.size(); i++) 2865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(intermediate_ca_certs[i]); 2875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return cert; 2895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 2905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 2925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate* X509Certificate::CreateFromBytes(const char* data, 2935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int length) { 2945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle cert_handle = CreateOSCertHandleFromBytes(data, length); 2955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!cert_handle) 2965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 2975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 2985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* cert = CreateFromHandle(cert_handle, OSCertHandles()); 2995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle); 3005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return cert; 3015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 3025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 3045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate* X509Certificate::CreateFromPickle(const Pickle& pickle, 3055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PickleIterator* pickle_iter, 3065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PickleType type) { 3075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (type == PICKLETYPE_CERTIFICATE_CHAIN_V3) { 3085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int chain_length = 0; 3095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle_iter->ReadLength(&chain_length)) 3105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<base::StringPiece> cert_chain; 3135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* data = NULL; 3145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) int data_length = 0; 3155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (int i = 0; i < chain_length; ++i) { 3165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle_iter->ReadData(&data, &data_length)) 3175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert_chain.push_back(base::StringPiece(data, data_length)); 3195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return CreateFromDERCertChain(cert_chain); 3215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Legacy / Migration code. This should eventually be removed once 3245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // sufficient time has passed that all pickles serialized prior to 3255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PICKLETYPE_CERTIFICATE_CHAIN_V3 have been removed. 3265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle cert_handle = ReadOSCertHandleFromPickle(pickle_iter); 3275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!cert_handle) 3285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandles intermediates; 3315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 num_intermediates = 0; 3325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (type != PICKLETYPE_SINGLE_CERTIFICATE) { 3335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle_iter->ReadUInt32(&num_intermediates)) { 3345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle); 3355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#if defined(OS_POSIX) && !defined(OS_MACOSX) && defined(__x86_64__) 3395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // On 64-bit Linux (and any other 64-bit platforms), the intermediate count 3405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // might really be a 64-bit field since we used to use Pickle::WriteSize(), 3415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // which writes either 32 or 64 bits depending on the architecture. Since 3425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // x86-64 is little-endian, if that happens, the next 32 bits will be all 3435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // zeroes (the high bits) and the 32 bits we already read above are the 3445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // correct value (we assume there are never more than 2^32 - 1 intermediate 3455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // certificates in a chain; in practice, more than a dozen or so is 3465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // basically unheard of). Since it's invalid for a certificate to start with 3475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 32 bits of zeroes, we check for that here and skip it if we find it. We 3485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // save a copy of the pickle iterator to restore in case we don't get 32 3495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // bits of zeroes. Now we always write 32 bits, so after a while, these old 3505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // cached pickles will all get replaced. 3515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // TODO(mdm): remove this compatibility code in April 2013 or so. 3525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PickleIterator saved_iter = *pickle_iter; 3535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint32 zero_check = 0; 3545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle_iter->ReadUInt32(&zero_check)) { 3555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This may not be an error. If there are no intermediates, and we're 3565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // reading an old 32-bit pickle, and there's nothing else after this in 3575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the pickle, we should report success. Note that it is technically 3585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // possible for us to skip over zeroes that should have occurred after 3595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // an empty certificate list; to avoid this going forward, only do this 3605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // backward-compatibility stuff for PICKLETYPE_CERTIFICATE_CHAIN_V1 3615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // which comes from the pickle version number in http_response_info.cc. 3625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (num_intermediates) { 3635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle); 3645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 3655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (zero_check) 3685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *pickle_iter = saved_iter; 3695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // defined(OS_POSIX) && !defined(OS_MACOSX) && defined(__x86_64__) 3705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (uint32 i = 0; i < num_intermediates; ++i) { 3725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle intermediate = ReadOSCertHandleFromPickle(pickle_iter); 3735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!intermediate) 3745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 3755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) intermediates.push_back(intermediate); 3765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 3785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* cert = NULL; 3805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (intermediates.size() == num_intermediates) 3815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert = CreateFromHandle(cert_handle, intermediates); 3825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle); 3835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediates.size(); ++i) 3845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(intermediates[i]); 3855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return cert; 3875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 3885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 3905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)CertificateList X509Certificate::CreateCertificateListFromBytes( 3915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char* data, int length, int format) { 3925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandles certificates; 3935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 3945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Check to see if it is in a PEM-encoded form. This check is performed 3955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // first, as both OS X and NSS will both try to convert if they detect 3965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PEM encoding, except they don't do it consistently between the two. 3975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece data_string(data, length); 3985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> pem_headers; 3995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // To maintain compatibility with NSS/Firefox, CERTIFICATE is a universally 4015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // valid PEM block header for any format. 4025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_headers.push_back(kCertificateHeader); 4035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & FORMAT_PKCS7) 4045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_headers.push_back(kPKCS7Header); 4055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) PEMTokenizer pem_tok(data_string, pem_headers); 4075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) while (pem_tok.GetNext()) { 4085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string decoded(pem_tok.data()); 4095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle handle = NULL; 4115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & FORMAT_PEM_CERT_SEQUENCE) 4125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) handle = CreateOSCertHandleFromBytes(decoded.c_str(), decoded.size()); 4135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (handle != NULL) { 4145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Parsed a DER encoded certificate. All PEM blocks that follow must 4155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // also be DER encoded certificates wrapped inside of PEM blocks. 4165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) format = FORMAT_PEM_CERT_SEQUENCE; 4175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) certificates.push_back(handle); 4185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 4195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If the first block failed to parse as a DER certificate, and 4225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // formats other than PEM are acceptable, check to see if the decoded 4235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // data is one of the accepted formats. 4245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & ~FORMAT_PEM_CERT_SEQUENCE) { 4255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; certificates.empty() && 4265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) i < arraysize(kFormatDecodePriority); ++i) { 4275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & kFormatDecodePriority[i]) { 4285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) certificates = CreateOSCertHandlesFromBytes(decoded.c_str(), 4295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) decoded.size(), kFormatDecodePriority[i]); 4305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Stop parsing after the first block for any format but a sequence of 4355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // PEM-encoded DER certificates. The case of FORMAT_PEM_CERT_SEQUENCE 4365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // is handled above, and continues processing until a certificate fails 4375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // to parse. 4385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) break; 4395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Try each of the formats, in order of parse preference, to see if |data| 4425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // contains the binary representation of a Format, if it failed to parse 4435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // as a PEM certificate/chain. 4445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; certificates.empty() && 4455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) i < arraysize(kFormatDecodePriority); ++i) { 4465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (format & kFormatDecodePriority[i]) 4475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) certificates = CreateOSCertHandlesFromBytes(data, length, 4485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) kFormatDecodePriority[i]); 4495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) CertificateList results; 4525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // No certificates parsed. 4535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (certificates.empty()) 4545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return results; 4555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (OSCertHandles::iterator it = certificates.begin(); 4575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) it != certificates.end(); ++it) { 4585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) X509Certificate* result = CreateFromHandle(*it, OSCertHandles()); 4595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) results.push_back(scoped_refptr<X509Certificate>(result)); 4605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(*it); 4615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return results; 4645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void X509Certificate::Persist(Pickle* pickle) { 4675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(cert_handle_); 4685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // This would be an absolutely insane number of intermediates. 4695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (intermediate_ca_certs_.size() > static_cast<size_t>(INT_MAX) - 1) { 4705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NOTREACHED(); 4715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 4725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!pickle->WriteInt( 4745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static_cast<int>(intermediate_ca_certs_.size() + 1)) || 4755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) !WriteOSCertHandleToPickle(cert_handle_, pickle)) { 4765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NOTREACHED(); 4775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 4785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { 4805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!WriteOSCertHandleToPickle(intermediate_ca_certs_[i], pickle)) { 4815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NOTREACHED(); 4825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return; 4835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 4855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)void X509Certificate::GetDNSNames(std::vector<std::string>* dns_names) const { 4885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) GetSubjectAltName(dns_names, NULL); 4895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (dns_names->empty()) 4905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) dns_names->push_back(subject_.common_name); 4915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::HasExpired() const { 4945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return base::Time::Now() > valid_expiry(); 4955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 4965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 4975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::Equals(const X509Certificate* other) const { 4985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return IsSameOSCert(cert_handle_, other->cert_handle_); 4995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 5005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 5025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::VerifyHostname( 5035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& hostname, 5045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string& cert_common_name, 5055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::vector<std::string>& cert_san_dns_names, 5065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::vector<std::string>& cert_san_ip_addrs) { 5075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(!hostname.empty()); 5085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Perform name verification following http://tools.ietf.org/html/rfc6125. 5095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // The terminology used in this method is as per that RFC:- 5105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Reference identifier == the host the local user/agent is intending to 5115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // access, i.e. the thing displayed in the URL bar. 5125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Presented identifier(s) == name(s) the server knows itself as, in its cert. 5135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // CanonicalizeHost requires surrounding brackets to parse an IPv6 address. 5155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::string host_or_ip = hostname.find(':') != std::string::npos ? 5165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "[" + hostname + "]" : hostname; 5175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) url_canon::CanonHostInfo host_info; 5185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string reference_name = CanonicalizeHost(host_or_ip, &host_info); 5195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // CanonicalizeHost does not normalize absolute vs relative DNS names. If 5205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // the input name was absolute (included trailing .), normalize it as if it 5215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // was relative. 5225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!reference_name.empty() && *reference_name.rbegin() == '.') 5235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reference_name.resize(reference_name.size() - 1); 5245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (reference_name.empty()) 5255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 5265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Allow fallback to Common name matching? 5285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const bool common_name_fallback = cert_san_dns_names.empty() && 5295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) cert_san_ip_addrs.empty(); 5305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Fully handle all cases where |hostname| contains an IP address. 5325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (host_info.IsIPAddress()) { 5335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (common_name_fallback && 5345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) host_info.family == url_canon::CanonHostInfo::IPV4) { 5355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Fallback to Common name matching. As this is deprecated and only 5365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // supported for compatibility refuse it for IPv6 addresses. 5375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return reference_name == cert_common_name; 5385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece ip_addr_string( 5405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reinterpret_cast<const char*>(host_info.address), 5415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) host_info.AddressLength()); 5425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return std::find(cert_san_ip_addrs.begin(), cert_san_ip_addrs.end(), 5435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ip_addr_string) != cert_san_ip_addrs.end(); 5445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // |reference_domain| is the remainder of |host| after the leading host 5475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // component is stripped off, but includes the leading dot e.g. 5485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // "www.f.com" -> ".f.com". 5495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // If there is no meaningful domain part to |host| (e.g. it contains no dots) 5505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // then |reference_domain| will be empty. 5515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece reference_host, reference_domain; 5525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SplitOnChar(reference_name, '.', &reference_host, &reference_domain); 5535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) bool allow_wildcards = false; 5545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!reference_domain.empty()) { 5555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DCHECK(reference_domain.starts_with(".")); 55690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 55790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Do not allow wildcards for public/ICANN registry controlled domains - 55890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // that is, prevent *.com or *.co.uk as valid presented names, but do not 55990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // prevent *.appspot.com (a private registry controlled domain). 56090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // In addition, unknown top-level domains (such as 'intranet' domains or 56190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // new TLDs/gTLDs not yet added to the registry controlled domain dataset) 56290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // are also implicitly prevented. 56390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Because |reference_domain| must contain at least one name component that 56490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // is not registry controlled, this ensures that all reference domains 56590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // contain at least three domain components when using wildcards. 56690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) size_t registry_length = 56790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_controlled_domains::GetRegistryLength( 56890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) reference_name, 56990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_controlled_domains::INCLUDE_UNKNOWN_REGISTRIES, 57090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); 57190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 57290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Because |reference_name| was already canonicalized, the following 57390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // should never happen. 57490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) CHECK_NE(std::string::npos, registry_length); 57590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 57690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Account for the leading dot in |reference_domain|. 57790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) bool is_registry_controlled = 57890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_length != 0 && 57990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) registry_length == (reference_domain.size() - 1); 58090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 58190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Additionally, do not attempt wildcard matching for purely numeric 58290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // hostnames. 58390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) allow_wildcards = 58490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) !is_registry_controlled && 5855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reference_name.find_first_not_of("0123456789.") != std::string::npos; 5865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 5875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 5885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Now step through the DNS names doing wild card comparison (if necessary) 5895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // on each against the reference name. If subjectAltName is empty, then 5905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // fallback to use the common name instead. 5915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> common_name_as_vector; 5925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const std::vector<std::string>* presented_names = &cert_san_dns_names; 5935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (common_name_fallback) { 5945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Note: there's a small possibility cert_common_name is an international 5955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // domain name in non-standard encoding (e.g. UTF8String or BMPString 5965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // instead of A-label). As common name fallback is deprecated we're not 5975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // doing anything specific to deal with this. 5985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) common_name_as_vector.push_back(cert_common_name); 5995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) presented_names = &common_name_as_vector; 6005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (std::vector<std::string>::const_iterator it = 6025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) presented_names->begin(); 6035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) it != presented_names->end(); ++it) { 6045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Catch badly corrupt cert names up front. 6055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (it->empty() || it->find('\0') != std::string::npos) { 6065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) DVLOG(1) << "Bad name in cert: " << *it; 6075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string presented_name(StringToLowerASCII(*it)); 6105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Remove trailing dot, if any. 6125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (*presented_name.rbegin() == '.') 6135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) presented_name.resize(presented_name.length() - 1); 6145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // The hostname must be at least as long as the cert name it is matching, 6165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // as we require the wildcard (if present) to match at least one character. 6175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (presented_name.length() > reference_name.length()) 6185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece presented_host, presented_domain; 6215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SplitOnChar(presented_name, '.', &presented_host, &presented_domain); 6225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (presented_domain != reference_domain) 6245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) base::StringPiece pattern_begin, pattern_end; 6275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) SplitOnChar(presented_host, '*', &pattern_begin, &pattern_end); 6285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (pattern_end.empty()) { // No '*' in the presented_host 6305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (presented_host == reference_host) 6315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 6325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pattern_end.remove_prefix(1); // move past the * 6355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!allow_wildcards) 6375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // * must not match a substring of an IDN A label; just a whole fragment. 6405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (reference_host.starts_with("xn--") && 6415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) !(pattern_begin.empty() && pattern_end.empty())) 6425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) continue; 6435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (reference_host.starts_with(pattern_begin) && 6455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) reference_host.ends_with(pattern_end)) 6465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 6475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 6495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::VerifyNameMatch(const std::string& hostname) const { 6525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> dns_names, ip_addrs; 6535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) GetSubjectAltName(&dns_names, &ip_addrs); 6545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return VerifyHostname(hostname, subject_.common_name, dns_names, ip_addrs); 6555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6575821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// static 6585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::GetPEMEncoded(OSCertHandle cert_handle, 6595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string* pem_encoded) { 6605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string der_encoded; 6615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!GetDEREncoded(cert_handle, &der_encoded) || der_encoded.empty()) 6625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 6635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string b64_encoded; 6645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!base::Base64Encode(der_encoded, &b64_encoded) || b64_encoded.empty()) 6655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 6665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) *pem_encoded = "-----BEGIN CERTIFICATE-----\n"; 6675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Divide the Base-64 encoded data into 64-character chunks, as per 6695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // 4.3.2.4 of RFC 1421. 6705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) static const size_t kChunkSize = 64; 6715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) size_t chunks = (b64_encoded.size() + (kChunkSize - 1)) / kChunkSize; 6725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0, chunk_offset = 0; i < chunks; 6735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) ++i, chunk_offset += kChunkSize) { 6745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_encoded->append(b64_encoded, chunk_offset, kChunkSize); 6755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_encoded->append("\n"); 6765821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6775821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_encoded->append("-----END CERTIFICATE-----\n"); 6785821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 6795821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6805821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6815821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)bool X509Certificate::GetPEMEncodedChain( 6825821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string>* pem_encoded) const { 6835821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::vector<std::string> encoded_chain; 6845821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) std::string pem_data; 6855821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!GetPEMEncoded(os_cert_handle(), &pem_data)) 6865821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 6875821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) encoded_chain.push_back(pem_data); 6885821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { 6895821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!GetPEMEncoded(intermediate_ca_certs_[i], &pem_data)) 6905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return false; 6915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) encoded_chain.push_back(pem_data); 6925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 6935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) pem_encoded->swap(encoded_chain); 6945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return true; 6955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 6975821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate::X509Certificate(OSCertHandle cert_handle, 6985821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const OSCertHandles& intermediates) 6995821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) : cert_handle_(DupOSCertHandle(cert_handle)) { 7005821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) InsertOrUpdateCache(&cert_handle_); 7015821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediates.size(); ++i) { 7025821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Duplicate the incoming certificate, as the caller retains ownership 7035821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // of |intermediates|. 7045821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) OSCertHandle intermediate = DupOSCertHandle(intermediates[i]); 7055821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Update the cache, which will assume ownership of the duplicated 7065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // handle and return a suitable equivalent, potentially from the cache. 7075821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) InsertOrUpdateCache(&intermediate); 7085821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) intermediate_ca_certs_.push_back(intermediate); 7095821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) // Platform-specific initialization. 7115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) Initialize(); 7125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)X509Certificate::~X509Certificate() { 7155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (cert_handle_) { 7165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) RemoveFromCache(cert_handle_); 7175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(cert_handle_); 7185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) { 7205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) RemoveFromCache(intermediate_ca_certs_[i]); 7215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) FreeOSCertHandle(intermediate_ca_certs_[i]); 7225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) } 7235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 7245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 7255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace net 726