| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/base/cert_verify_proc_win.h" | 5 #include "net/base/cert_verify_proc_win.h" |
| 6 | 6 |
| 7 #include "base/memory/scoped_ptr.h" | 7 #include "base/memory/scoped_ptr.h" |
| 8 #include "base/sha1.h" | 8 #include "base/sha1.h" |
| 9 #include "base/string_util.h" | 9 #include "base/string_util.h" |
| 10 #include "base/utf_string_conversions.h" | 10 #include "base/utf_string_conversions.h" |
| 11 #include "crypto/capi_util.h" | 11 #include "crypto/capi_util.h" |
| 12 #include "crypto/scoped_capi_types.h" | 12 #include "crypto/scoped_capi_types.h" |
| 13 #include "crypto/sha2.h" | 13 #include "crypto/sha2.h" |
| 14 #include "net/base/asn1_util.h" | 14 #include "net/base/asn1_util.h" |
| 15 #include "net/base/cert_status_flags.h" | 15 #include "net/base/cert_status_flags.h" |
| 16 #include "net/base/cert_verifier.h" |
| 16 #include "net/base/cert_verify_result.h" | 17 #include "net/base/cert_verify_result.h" |
| 17 #include "net/base/crl_set.h" | 18 #include "net/base/crl_set.h" |
| 18 #include "net/base/ev_root_ca_metadata.h" | 19 #include "net/base/ev_root_ca_metadata.h" |
| 19 #include "net/base/net_errors.h" | 20 #include "net/base/net_errors.h" |
| 20 #include "net/base/test_root_certs.h" | 21 #include "net/base/test_root_certs.h" |
| 21 #include "net/base/x509_certificate.h" | 22 #include "net/base/x509_certificate.h" |
| 22 #include "net/base/x509_certificate_known_roots_win.h" | 23 #include "net/base/x509_certificate_known_roots_win.h" |
| 23 | 24 |
| 24 #pragma comment(lib, "crypt32.lib") | 25 #pragma comment(lib, "crypt32.lib") |
| 25 | 26 |
| (...skipping 512 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 538 szOID_SGC_NETSCAPE | 539 szOID_SGC_NETSCAPE |
| 539 }; | 540 }; |
| 540 chain_para.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR; | 541 chain_para.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR; |
| 541 chain_para.RequestedUsage.Usage.cUsageIdentifier = arraysize(usage); | 542 chain_para.RequestedUsage.Usage.cUsageIdentifier = arraysize(usage); |
| 542 chain_para.RequestedUsage.Usage.rgpszUsageIdentifier = | 543 chain_para.RequestedUsage.Usage.rgpszUsageIdentifier = |
| 543 const_cast<LPSTR*>(usage); | 544 const_cast<LPSTR*>(usage); |
| 544 | 545 |
| 545 // Get the certificatePolicies extension of the certificate. | 546 // Get the certificatePolicies extension of the certificate. |
| 546 scoped_ptr_malloc<CERT_POLICIES_INFO> policies_info; | 547 scoped_ptr_malloc<CERT_POLICIES_INFO> policies_info; |
| 547 LPSTR ev_policy_oid = NULL; | 548 LPSTR ev_policy_oid = NULL; |
| 548 if (flags & X509Certificate::VERIFY_EV_CERT) { | 549 if (flags & CertVerifier::VERIFY_EV_CERT) { |
| 549 GetCertPoliciesInfo(cert_handle, &policies_info); | 550 GetCertPoliciesInfo(cert_handle, &policies_info); |
| 550 if (policies_info.get()) { | 551 if (policies_info.get()) { |
| 551 EVRootCAMetadata* metadata = EVRootCAMetadata::GetInstance(); | 552 EVRootCAMetadata* metadata = EVRootCAMetadata::GetInstance(); |
| 552 for (DWORD i = 0; i < policies_info->cPolicyInfo; ++i) { | 553 for (DWORD i = 0; i < policies_info->cPolicyInfo; ++i) { |
| 553 LPSTR policy_oid = policies_info->rgPolicyInfo[i].pszPolicyIdentifier; | 554 LPSTR policy_oid = policies_info->rgPolicyInfo[i].pszPolicyIdentifier; |
| 554 if (metadata->IsEVPolicyOID(policy_oid)) { | 555 if (metadata->IsEVPolicyOID(policy_oid)) { |
| 555 ev_policy_oid = policy_oid; | 556 ev_policy_oid = policy_oid; |
| 556 chain_para.RequestedIssuancePolicy.dwType = USAGE_MATCH_TYPE_AND; | 557 chain_para.RequestedIssuancePolicy.dwType = USAGE_MATCH_TYPE_AND; |
| 557 chain_para.RequestedIssuancePolicy.Usage.cUsageIdentifier = 1; | 558 chain_para.RequestedIssuancePolicy.Usage.cUsageIdentifier = 1; |
| 558 chain_para.RequestedIssuancePolicy.Usage.rgpszUsageIdentifier = | 559 chain_para.RequestedIssuancePolicy.Usage.rgpszUsageIdentifier = |
| 559 &ev_policy_oid; | 560 &ev_policy_oid; |
| 560 break; | 561 break; |
| 561 } | 562 } |
| 562 } | 563 } |
| 563 } | 564 } |
| 564 } | 565 } |
| 565 | 566 |
| 566 // We can set CERT_CHAIN_RETURN_LOWER_QUALITY_CONTEXTS to get more chains. | 567 // We can set CERT_CHAIN_RETURN_LOWER_QUALITY_CONTEXTS to get more chains. |
| 567 DWORD chain_flags = CERT_CHAIN_CACHE_END_CERT | | 568 DWORD chain_flags = CERT_CHAIN_CACHE_END_CERT | |
| 568 CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT; | 569 CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT; |
| 569 const bool rev_checking_enabled = | 570 const bool rev_checking_enabled = |
| 570 (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED) || | 571 (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED) || |
| 571 (ev_policy_oid != NULL && | 572 (ev_policy_oid != NULL && |
| 572 (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY)); | 573 (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED_EV_ONLY)); |
| 573 | 574 |
| 574 if (rev_checking_enabled) { | 575 if (rev_checking_enabled) { |
| 575 verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED; | 576 verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED; |
| 576 } else { | 577 } else { |
| 577 chain_flags |= CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY; | 578 chain_flags |= CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY; |
| 578 } | 579 } |
| 579 | 580 |
| 580 // For non-test scenarios, use the default HCERTCHAINENGINE, NULL, which | 581 // For non-test scenarios, use the default HCERTCHAINENGINE, NULL, which |
| 581 // corresponds to HCCE_CURRENT_USER and is is initialized as needed by | 582 // corresponds to HCCE_CURRENT_USER and is is initialized as needed by |
| 582 // crypt32. However, when testing, it is necessary to create a new | 583 // crypt32. However, when testing, it is necessary to create a new |
| (...skipping 153 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 736 verify_result->is_issued_by_known_root = IsIssuedByKnownRoot(chain_context); | 737 verify_result->is_issued_by_known_root = IsIssuedByKnownRoot(chain_context); |
| 737 | 738 |
| 738 if (ev_policy_oid && | 739 if (ev_policy_oid && |
| 739 CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) { | 740 CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) { |
| 740 verify_result->cert_status |= CERT_STATUS_IS_EV; | 741 verify_result->cert_status |= CERT_STATUS_IS_EV; |
| 741 } | 742 } |
| 742 return OK; | 743 return OK; |
| 743 } | 744 } |
| 744 | 745 |
| 745 } // namespace net | 746 } // namespace net |
| OLD | NEW |