OLD | NEW |
1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/base/x509_certificate.h" | 5 #include "net/base/x509_certificate.h" |
6 | 6 |
7 #include <CommonCrypto/CommonDigest.h> | 7 #include <CommonCrypto/CommonDigest.h> |
8 #include <Security/Security.h> | 8 #include <Security/Security.h> |
9 #include <time.h> | 9 #include <time.h> |
10 | 10 |
(...skipping 673 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
684 return NULL; | 684 return NULL; |
685 return reinterpret_cast<OSCertHandle>(const_cast<void*>(CFRetain(handle))); | 685 return reinterpret_cast<OSCertHandle>(const_cast<void*>(CFRetain(handle))); |
686 } | 686 } |
687 | 687 |
688 // static | 688 // static |
689 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) { | 689 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) { |
690 CFRelease(cert_handle); | 690 CFRelease(cert_handle); |
691 } | 691 } |
692 | 692 |
693 // static | 693 // static |
694 X509Certificate::Fingerprint X509Certificate::CalculateFingerprint( | 694 SHA1Fingerprint X509Certificate::CalculateFingerprint( |
695 OSCertHandle cert) { | 695 OSCertHandle cert) { |
696 Fingerprint sha1; | 696 SHA1Fingerprint sha1; |
697 memset(sha1.data, 0, sizeof(sha1.data)); | 697 memset(sha1.data, 0, sizeof(sha1.data)); |
698 | 698 |
699 CSSM_DATA cert_data; | 699 CSSM_DATA cert_data; |
700 OSStatus status = SecCertificateGetData(cert, &cert_data); | 700 OSStatus status = SecCertificateGetData(cert, &cert_data); |
701 if (status) | 701 if (status) |
702 return sha1; | 702 return sha1; |
703 | 703 |
704 DCHECK(NULL != cert_data.Data); | 704 DCHECK(NULL != cert_data.Data); |
705 DCHECK(0 != cert_data.Length); | 705 DCHECK(0 != cert_data.Length); |
706 | 706 |
(...skipping 77 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
784 }; | 784 }; |
785 return CreatePolicy(&CSSMOID_APPLE_TP_SSL, | 785 return CreatePolicy(&CSSMOID_APPLE_TP_SSL, |
786 &tp_ssl_options, | 786 &tp_ssl_options, |
787 sizeof(tp_ssl_options), | 787 sizeof(tp_ssl_options), |
788 out_policy); | 788 out_policy); |
789 } | 789 } |
790 | 790 |
791 // static | 791 // static |
792 bool X509Certificate::GetSSLClientCertificates ( | 792 bool X509Certificate::GetSSLClientCertificates ( |
793 const std::string& server_domain, | 793 const std::string& server_domain, |
794 const std::vector<Principal>& valid_issuers, | 794 const std::vector<CertPrincipal>& valid_issuers, |
795 std::vector<scoped_refptr<X509Certificate> >* certs) { | 795 std::vector<scoped_refptr<X509Certificate> >* certs) { |
796 scoped_cftyperef<SecIdentityRef> preferred_identity; | 796 scoped_cftyperef<SecIdentityRef> preferred_identity; |
797 if (!server_domain.empty()) { | 797 if (!server_domain.empty()) { |
798 // See if there's an identity preference for this domain: | 798 // See if there's an identity preference for this domain: |
799 scoped_cftyperef<CFStringRef> domain_str( | 799 scoped_cftyperef<CFStringRef> domain_str( |
800 base::SysUTF8ToCFStringRef("https://" + server_domain)); | 800 base::SysUTF8ToCFStringRef("https://" + server_domain)); |
801 SecIdentityRef identity = NULL; | 801 SecIdentityRef identity = NULL; |
802 if (SecIdentityCopyPreference(domain_str, | 802 if (SecIdentityCopyPreference(domain_str, |
803 0, | 803 0, |
804 NULL, // validIssuers argument is ignored :( | 804 NULL, // validIssuers argument is ignored :( |
(...skipping 14 matching lines...) Expand all Loading... |
819 | 819 |
820 SecCertificateRef cert_handle; | 820 SecCertificateRef cert_handle; |
821 err = SecIdentityCopyCertificate(identity, &cert_handle); | 821 err = SecIdentityCopyCertificate(identity, &cert_handle); |
822 if (err != noErr) | 822 if (err != noErr) |
823 continue; | 823 continue; |
824 scoped_cftyperef<SecCertificateRef> scoped_cert_handle(cert_handle); | 824 scoped_cftyperef<SecCertificateRef> scoped_cert_handle(cert_handle); |
825 | 825 |
826 scoped_refptr<X509Certificate> cert( | 826 scoped_refptr<X509Certificate> cert( |
827 CreateFromHandle(cert_handle, SOURCE_LONE_CERT_IMPORT, | 827 CreateFromHandle(cert_handle, SOURCE_LONE_CERT_IMPORT, |
828 OSCertHandles())); | 828 OSCertHandles())); |
829 // cert_handle is adoped by cert, so I don't need to release it myself. | |
830 if (cert->HasExpired() || !cert->SupportsSSLClientAuth()) | 829 if (cert->HasExpired() || !cert->SupportsSSLClientAuth()) |
831 continue; | 830 continue; |
832 | 831 |
833 // Skip duplicates (a cert may be in multiple keychains). | 832 // Skip duplicates (a cert may be in multiple keychains). |
834 X509Certificate::Fingerprint fingerprint = cert->fingerprint(); | 833 const SHA1Fingerprint& fingerprint = cert->fingerprint(); |
835 unsigned i; | 834 unsigned i; |
836 for (i = 0; i < certs->size(); ++i) { | 835 for (i = 0; i < certs->size(); ++i) { |
837 if ((*certs)[i]->fingerprint().Equals(fingerprint)) | 836 if ((*certs)[i]->fingerprint().Equals(fingerprint)) |
838 break; | 837 break; |
839 } | 838 } |
840 if (i < certs->size()) | 839 if (i < certs->size()) |
841 continue; | 840 continue; |
842 | 841 |
843 bool is_preferred = preferred_identity && | 842 bool is_preferred = preferred_identity && |
844 CFEqual(preferred_identity, identity); | 843 CFEqual(preferred_identity, identity); |
(...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
894 } | 893 } |
895 CFRelease(cert_chain); | 894 CFRelease(cert_chain); |
896 } | 895 } |
897 exit: | 896 exit: |
898 if (result) | 897 if (result) |
899 LOG(ERROR) << "CreateIdentityCertificateChain error " << result; | 898 LOG(ERROR) << "CreateIdentityCertificateChain error " << result; |
900 return chain.release(); | 899 return chain.release(); |
901 } | 900 } |
902 | 901 |
903 } // namespace net | 902 } // namespace net |
OLD | NEW |