| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/internal/verify_certificate_chain.h" | 5 #include "net/cert/internal/verify_certificate_chain.h" |
| 6 | 6 |
| 7 #include "base/logging.h" | 7 #include "base/logging.h" |
| 8 #include "net/cert/internal/parse_certificate.h" | 8 #include "net/cert/internal/parse_certificate.h" |
| 9 #include "net/cert/internal/signature_algorithm.h" | 9 #include "net/cert/internal/signature_algorithm.h" |
| 10 #include "net/cert/internal/signature_policy.h" | 10 #include "net/cert/internal/signature_policy.h" |
| (...skipping 211 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 222 // In practice however there are certificates which use different encodings for | 222 // In practice however there are certificates which use different encodings for |
| 223 // specifying RSA with SHA1 (different OIDs). This is special-cased for | 223 // specifying RSA with SHA1 (different OIDs). This is special-cased for |
| 224 // compatibility sake. | 224 // compatibility sake. |
| 225 WARN_UNUSED_RESULT bool VerifySignatureAlgorithmsMatch( | 225 WARN_UNUSED_RESULT bool VerifySignatureAlgorithmsMatch( |
| 226 const FullyParsedCert& cert) { | 226 const FullyParsedCert& cert) { |
| 227 const der::Input& alg1_tlv = cert.cert.signature_algorithm_tlv; | 227 const der::Input& alg1_tlv = cert.cert.signature_algorithm_tlv; |
| 228 const der::Input& alg2_tlv = cert.tbs.signature_algorithm_tlv; | 228 const der::Input& alg2_tlv = cert.tbs.signature_algorithm_tlv; |
| 229 | 229 |
| 230 // Ensure that the two DER-encoded signature algorithms are byte-for-byte | 230 // Ensure that the two DER-encoded signature algorithms are byte-for-byte |
| 231 // equal, but make a compatibility concession for RSA with SHA1. | 231 // equal, but make a compatibility concession for RSA with SHA1. |
| 232 return alg1_tlv.Equals(alg2_tlv) || | 232 return alg1_tlv == alg2_tlv || (IsRsaWithSha1SignatureAlgorithm(alg1_tlv) && |
| 233 (IsRsaWithSha1SignatureAlgorithm(alg1_tlv) && | 233 IsRsaWithSha1SignatureAlgorithm(alg2_tlv)); |
| 234 IsRsaWithSha1SignatureAlgorithm(alg2_tlv)); | |
| 235 } | 234 } |
| 236 | 235 |
| 237 // This function corresponds to RFC 5280 section 6.1.3's "Basic Certificate | 236 // This function corresponds to RFC 5280 section 6.1.3's "Basic Certificate |
| 238 // Processing" procedure. | 237 // Processing" procedure. |
| 239 WARN_UNUSED_RESULT bool BasicCertificateProcessing( | 238 WARN_UNUSED_RESULT bool BasicCertificateProcessing( |
| 240 const FullyParsedCert& cert, | 239 const FullyParsedCert& cert, |
| 241 const SignaturePolicy* signature_policy, | 240 const SignaturePolicy* signature_policy, |
| 242 const der::GeneralizedTime& time, | 241 const der::GeneralizedTime& time, |
| 243 const der::Input& working_spki, | 242 const der::Input& working_spki, |
| 244 const der::Input& working_issuer_name) { | 243 const der::Input& working_issuer_name) { |
| (...skipping 295 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 540 | 539 |
| 541 // TODO(eroman): RFC 5280 forbids duplicate certificates per section 6.1: | 540 // TODO(eroman): RFC 5280 forbids duplicate certificates per section 6.1: |
| 542 // | 541 // |
| 543 // A certificate MUST NOT appear more than once in a prospective | 542 // A certificate MUST NOT appear more than once in a prospective |
| 544 // certification path. | 543 // certification path. |
| 545 | 544 |
| 546 return true; | 545 return true; |
| 547 } | 546 } |
| 548 | 547 |
| 549 } // namespace net | 548 } // namespace net |
| OLD | NEW |