Add support for parsing certificate formats other than raw, DER-encoded cert...

net/base/x509_certificate.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #if defined(OS_MACOSX)
 #include <Security/Security.h>
 #elif defined(USE_NSS)
 #include <cert.h>
 #endif
 
 #include <map>
 
 #include "base/histogram.h"
 #include "base/logging.h"
 #include "base/singleton.h"
+#include "base/string_piece.h"
 #include "base/time.h"
+#include "net/base/pem_tokenizer.h"
 
 namespace net {
 
 namespace {
 
 // Returns true if this cert fingerprint is the null (all zero) fingerprint.
 // We use this as a bogus fingerprint value.
 bool IsNullFingerprint(const SHA1Fingerprint& fingerprint) {
   for (size_t i = 0; i < arraysize(fingerprint.data); ++i) {
     if (fingerprint.data[i] != 0)
       return false;
   }
   return true;
 }
 
+// Indicates the order to use when trying to decode binary data, which is
+// based on (speculation) as to what will be most common -> least common
+const X509Certificate::Format kFormatDecodePriority[] = {
+  X509Certificate::FORMAT_SINGLE_CERTIFICATE,
+  X509Certificate::FORMAT_PKCS7
+};
+
+// The PEM block header used for DER certificates
+const char kCertificateHeader[] = "CERTIFICATE";
+// The PEM block header used for PKCS#7 data
+const char kPKCS7Header[] = "PKCS7";
+
 }  // namespace
 
 // static
 bool X509Certificate::IsSameOSCert(X509Certificate::OSCertHandle a,
                                    X509Certificate::OSCertHandle b) {
   DCHECK(a && b);
   if (a == b)
     return true;
 #if defined(OS_WIN)
   return a->cbCertEncoded == b->cbCertEncoded &&
@@ skipping 135 matching lines @@
   if (!cert_handle)
     return NULL;
 
   X509Certificate* cert = CreateFromHandle(cert_handle,
                                            SOURCE_LONE_CERT_IMPORT,
                                            OSCertHandles());
   FreeOSCertHandle(cert_handle);
   return cert;
 }
 
+CertificateList X509Certificate::CreateCertificateListFromBytes(
+    const char* data, int length, int format) {
+  OSCertHandles certificates;
+
+  // Try each of the formats, in order of parse preference, to see if |data|
+  // contains the binary representation of a Format.
+  for (size_t i = 0; certificates.empty() &&
+       i < arraysize(kFormatDecodePriority); ++i) {
+    if (format & kFormatDecodePriority[i])
+      certificates = CreateOSCertHandlesFromBytes(data, length,
+                                                  kFormatDecodePriority[i]);
+  }
+
+  // No certs were read. Check to see if it is in a PEM-encoded form.
+  if (certificates.empty()) {
+    base::StringPiece data_string(data, length);
+    std::vector<std::string> pem_headers;
+
+    // To maintain compatibility with NSS/Firefox, CERTIFICATE is a universally
+    // valid PEM block header for any format.
+    pem_headers.push_back(kCertificateHeader);
+    if (format & FORMAT_PKCS7)
+      pem_headers.push_back(kPKCS7Header);
+
+    PEMTokenizer pem_tok(data_string, pem_headers);
+    while (pem_tok.GetNext()) {
+      std::string decoded(pem_tok.data());
+
+      OSCertHandle handle = NULL;
+      if (format & FORMAT_PEM_CERT_SEQUENCE)
+        handle = CreateOSCertHandleFromBytes(decoded.c_str(), decoded.size());
+      if (handle != NULL) {
+        // Parsed a DER encoded certificate. All PEM blocks that follow must
+        // also be DER encoded certificates wrapped inside of PEM blocks.
+        format = FORMAT_PEM_CERT_SEQUENCE;
+        certificates.push_back(handle);
+        continue;
+      }
+
+      // If the first block failed to parse as a DER certificate, and
+      // formats other than PEM are acceptable, check to see if the decoded
+      // data is one of the accepted formats.
+      if (format & ~FORMAT_PEM_CERT_SEQUENCE) {
+        for (size_t i = 0; certificates.empty() &&
+             i < arraysize(kFormatDecodePriority); ++i) {
+          if (format & kFormatDecodePriority[i]) {
+            certificates = CreateOSCertHandlesFromBytes(decoded.c_str(),
+                decoded.size(), kFormatDecodePriority[i]);
+          }
+        }
+      }
+
+      // Stop parsing after the first block for any format but a sequence of
+      // PEM-encoded DER certificates. The case of FORMAT_PEM_CERT_SEQUENCE
+      // is handled above, and continues processing until a certificate fails
+      // to parse.
+      break;
+    }
+  }
+
+  CertificateList results;
+  // No certificates parsed.
+  if (certificates.empty())
+    return results;
+
+  for (OSCertHandles::iterator it = certificates.begin();
+       it != certificates.end(); ++it) {
+    X509Certificate* result = CreateFromHandle(*it, SOURCE_LONE_CERT_IMPORT,
+                                               OSCertHandles());
+    results.push_back(scoped_refptr<X509Certificate>(result));
+    FreeOSCertHandle(*it);
+  }
+
+  return results;
+}
+
 X509Certificate::X509Certificate(OSCertHandle cert_handle,
                                  Source source,
                                  const OSCertHandles& intermediates)
     : cert_handle_(DupOSCertHandle(cert_handle)),
       source_(source) {
 #if defined(OS_MACOSX) || defined(OS_WIN)
   // Copy/retain the intermediate cert handles.
   for (size_t i = 0; i < intermediates.size(); ++i)
     intermediate_ca_certs_.push_back(DupOSCertHandle(intermediates[i]));
 #endif
@@ skipping 43 matching lines @@
 
 bool X509Certificate::HasIntermediateCertificates(const OSCertHandles& certs) {
   for (size_t i = 0; i < certs.size(); ++i) {
     if (!HasIntermediateCertificate(certs[i]))
       return false;
   }
   return true;
 }
 
 }  // namespace net