Add X509Certificate::VerifyCertName(string) API. This will be used...

Add X509Certificate::VerifyCertName(string) API.  This will be used
to check if a name matches a cert without doing a full certificate verify.

Use the API provided as part of NSS.  For other platforms, provide a default
implementation based on GetDNSNames.

BUG=none
TEST=X509CertificateTest.WebkitCertParsing


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=76824

[Mike Belshe, 2011-03-03 08:41:41]

I think the NSS implementation is good.  I also took a stab at a cross-platform
implementation, which I'm not sure is good.  I wonder if the MatchPattern would
be too aggressive and match other, inappropriate wildcards?

[Mike Belshe, 2011-03-03 18:11:50]

Updated to use the openssl VerifyHostname() call.  Promoted that function out of
x509_openssl_util into x509_certificate.

Question:  should I just use it for all platforms?  I could remove the ifdef for
NSS if we did.


On 2011/03/03 08:41:41, Mike Belshe wrote:
> I think the NSS implementation is good.  I also took a stab at a
cross-platform
> implementation, which I'm not sure is good.  I wonder if the MatchPattern
would
> be too aggressive and match other, inappropriate wildcards?

[wtc, 2011-03-03 19:38:46]

LGTM.

The USE_NSS case should use CERT_VerifyCertName, which is
better than our VerifyHostname function.

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate.h
File net/base/x509_certificate.h (right):

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate.h#ne...
net/base/x509_certificate.h:293: // Returns true if it matches.
IMPORTANT: Please document that this function may return false
negatives (for example, if |hostname| is an IP address literal)
on some platforms, so it should only be used when false
negatives are acceptable, until this problem is fixed.

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate.h#ne...
net/base/x509_certificate.h:325: // SAN fields of a certificate.

Please document the limitation that this does not work for
IP addresses, so |hostname| must not be an IP address literal.

IMPORTANT: can you make this a private method?

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate_unit...
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate_unit...
net/base/x509_certificate_unittest.cc:300:
EXPECT_TRUE(webkit_cert->VerifyNameMatch("webkit.org"));

IMPORTANT: can you add a test case for "www.foo.webkit.org"?
It should return false.

http://codereview.chromium.org/6612013/diff/12/net/base/x509_openssl_util.cc
File net/base/x509_openssl_util.cc (right):

http://codereview.chromium.org/6612013/diff/12/net/base/x509_openssl_util.cc#...
net/base/x509_openssl_util.cc:11: #include "base/string_util.h"

Nit: Remove this header.

[Mike Belshe, 2011-03-03 23:06:14]

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate.h
File net/base/x509_certificate.h (right):

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate.h#ne...
net/base/x509_certificate.h:293: // Returns true if it matches.
On 2011/03/03 19:38:46, wtc wrote:
> IMPORTANT: Please document that this function may return false
> negatives (for example, if |hostname| is an IP address literal)
> on some platforms, so it should only be used when false
> negatives are acceptable, until this problem is fixed.

Done.

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate.h#ne...
net/base/x509_certificate.h:325: // SAN fields of a certificate.
On 2011/03/03 19:38:46, wtc wrote:
> 
> Please document the limitation that this does not work for
> IP addresses, so |hostname| must not be an IP address literal.
> 
> IMPORTANT: can you make this a private method?

Done.

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate_unit...
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/6612013/diff/12/net/base/x509_certificate_unit...
net/base/x509_certificate_unittest.cc:300:
EXPECT_TRUE(webkit_cert->VerifyNameMatch("webkit.org"));
On 2011/03/03 19:38:46, wtc wrote:
> 
> IMPORTANT: can you add a test case for "www.foo.webkit.org"?
> It should return false.

Done.

http://codereview.chromium.org/6612013/diff/12/net/base/x509_openssl_util.cc
File net/base/x509_openssl_util.cc (right):

http://codereview.chromium.org/6612013/diff/12/net/base/x509_openssl_util.cc#...
net/base/x509_openssl_util.cc:11: #include "base/string_util.h"
On 2011/03/03 19:38:46, wtc wrote:
> 
> Nit: Remove this header.

Done.