OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/cert_verify_proc_win.h" | 5 #include "net/cert/cert_verify_proc_win.h" |
6 | 6 |
7 #include <string> | 7 #include <string> |
8 #include <vector> | 8 #include <vector> |
9 | 9 |
10 #include "base/memory/scoped_ptr.h" | 10 #include "base/memory/scoped_ptr.h" |
(...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
54 struct FreeCertContextFunctor { | 54 struct FreeCertContextFunctor { |
55 void operator()(PCCERT_CONTEXT context) const { | 55 void operator()(PCCERT_CONTEXT context) const { |
56 if (context) | 56 if (context) |
57 CertFreeCertificateContext(context); | 57 CertFreeCertificateContext(context); |
58 } | 58 } |
59 }; | 59 }; |
60 | 60 |
61 typedef crypto::ScopedCAPIHandle<HCERTCHAINENGINE, FreeChainEngineFunctor> | 61 typedef crypto::ScopedCAPIHandle<HCERTCHAINENGINE, FreeChainEngineFunctor> |
62 ScopedHCERTCHAINENGINE; | 62 ScopedHCERTCHAINENGINE; |
63 | 63 |
64 typedef scoped_ptr_malloc<const CERT_CHAIN_CONTEXT, | 64 typedef scoped_ptr<const CERT_CHAIN_CONTEXT, FreeCertChainContextFunctor> |
65 FreeCertChainContextFunctor> | |
66 ScopedPCCERT_CHAIN_CONTEXT; | 65 ScopedPCCERT_CHAIN_CONTEXT; |
67 | 66 |
68 typedef scoped_ptr_malloc<const CERT_CONTEXT, | 67 typedef scoped_ptr<const CERT_CONTEXT, FreeCertContextFunctor> |
69 FreeCertContextFunctor> ScopedPCCERT_CONTEXT; | 68 ScopedPCCERT_CONTEXT; |
70 | 69 |
71 //----------------------------------------------------------------------------- | 70 //----------------------------------------------------------------------------- |
72 | 71 |
73 int MapSecurityError(SECURITY_STATUS err) { | 72 int MapSecurityError(SECURITY_STATUS err) { |
74 // There are numerous security error codes, but these are the ones we thus | 73 // There are numerous security error codes, but these are the ones we thus |
75 // far find interesting. | 74 // far find interesting. |
76 switch (err) { | 75 switch (err) { |
77 case SEC_E_WRONG_PRINCIPAL: // Schannel | 76 case SEC_E_WRONG_PRINCIPAL: // Schannel |
78 case CERT_E_CN_NO_MATCH: // CryptoAPI | 77 case CERT_E_CN_NO_MATCH: // CryptoAPI |
79 return ERR_CERT_COMMON_NAME_INVALID; | 78 return ERR_CERT_COMMON_NAME_INVALID; |
(...skipping 113 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
193 BOOL rv; | 192 BOOL rv; |
194 rv = CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, | 193 rv = CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, |
195 X509_NAME, | 194 X509_NAME, |
196 cert->pCertInfo->Subject.pbData, | 195 cert->pCertInfo->Subject.pbData, |
197 cert->pCertInfo->Subject.cbData, | 196 cert->pCertInfo->Subject.cbData, |
198 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, | 197 CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG, |
199 &decode_para, | 198 &decode_para, |
200 &name_info, | 199 &name_info, |
201 &name_info_size); | 200 &name_info_size); |
202 if (rv) { | 201 if (rv) { |
203 scoped_ptr_malloc<CERT_NAME_INFO> scoped_name_info(name_info); | 202 scoped_ptr<CERT_NAME_INFO, base::FreeDeleter> scoped_name_info(name_info); |
204 | 203 |
205 // The Subject field may have multiple common names. According to the | 204 // The Subject field may have multiple common names. According to the |
206 // "PKI Layer Cake" paper, CryptoAPI uses every common name in the | 205 // "PKI Layer Cake" paper, CryptoAPI uses every common name in the |
207 // Subject field, so we inspect every common name. | 206 // Subject field, so we inspect every common name. |
208 // | 207 // |
209 // From RFC 5280: | 208 // From RFC 5280: |
210 // X520CommonName ::= CHOICE { | 209 // X520CommonName ::= CHOICE { |
211 // teletexString TeletexString (SIZE (1..ub-common-name)), | 210 // teletexString TeletexString (SIZE (1..ub-common-name)), |
212 // printableString PrintableString (SIZE (1..ub-common-name)), | 211 // printableString PrintableString (SIZE (1..ub-common-name)), |
213 // universalString UniversalString (SIZE (1..ub-common-name)), | 212 // universalString UniversalString (SIZE (1..ub-common-name)), |
(...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
342 // Add the root certificate, if present, as it was not added above. | 341 // Add the root certificate, if present, as it was not added above. |
343 if (has_root_ca) | 342 if (has_root_ca) |
344 verified_chain.push_back(element[num_elements]->pCertContext); | 343 verified_chain.push_back(element[num_elements]->pCertContext); |
345 verify_result->verified_cert = | 344 verify_result->verified_cert = |
346 X509Certificate::CreateFromHandle(verified_cert, verified_chain); | 345 X509Certificate::CreateFromHandle(verified_cert, verified_chain); |
347 } | 346 } |
348 } | 347 } |
349 | 348 |
350 // Decodes the cert's certificatePolicies extension into a CERT_POLICIES_INFO | 349 // Decodes the cert's certificatePolicies extension into a CERT_POLICIES_INFO |
351 // structure and stores it in *output. | 350 // structure and stores it in *output. |
352 void GetCertPoliciesInfo(PCCERT_CONTEXT cert, | 351 void GetCertPoliciesInfo( |
353 scoped_ptr_malloc<CERT_POLICIES_INFO>* output) { | 352 PCCERT_CONTEXT cert, |
| 353 scoped_ptr<CERT_POLICIES_INFO, base::FreeDeleter>* output) { |
354 PCERT_EXTENSION extension = CertFindExtension(szOID_CERT_POLICIES, | 354 PCERT_EXTENSION extension = CertFindExtension(szOID_CERT_POLICIES, |
355 cert->pCertInfo->cExtension, | 355 cert->pCertInfo->cExtension, |
356 cert->pCertInfo->rgExtension); | 356 cert->pCertInfo->rgExtension); |
357 if (!extension) | 357 if (!extension) |
358 return; | 358 return; |
359 | 359 |
360 CRYPT_DECODE_PARA decode_para; | 360 CRYPT_DECODE_PARA decode_para; |
361 decode_para.cbSize = sizeof(decode_para); | 361 decode_para.cbSize = sizeof(decode_para); |
362 decode_para.pfnAlloc = crypto::CryptAlloc; | 362 decode_para.pfnAlloc = crypto::CryptAlloc; |
363 decode_para.pfnFree = crypto::CryptFree; | 363 decode_para.pfnFree = crypto::CryptFree; |
(...skipping 199 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
563 szOID_PKIX_KP_SERVER_AUTH, | 563 szOID_PKIX_KP_SERVER_AUTH, |
564 szOID_SERVER_GATED_CRYPTO, | 564 szOID_SERVER_GATED_CRYPTO, |
565 szOID_SGC_NETSCAPE | 565 szOID_SGC_NETSCAPE |
566 }; | 566 }; |
567 chain_para.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR; | 567 chain_para.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR; |
568 chain_para.RequestedUsage.Usage.cUsageIdentifier = arraysize(usage); | 568 chain_para.RequestedUsage.Usage.cUsageIdentifier = arraysize(usage); |
569 chain_para.RequestedUsage.Usage.rgpszUsageIdentifier = | 569 chain_para.RequestedUsage.Usage.rgpszUsageIdentifier = |
570 const_cast<LPSTR*>(usage); | 570 const_cast<LPSTR*>(usage); |
571 | 571 |
572 // Get the certificatePolicies extension of the certificate. | 572 // Get the certificatePolicies extension of the certificate. |
573 scoped_ptr_malloc<CERT_POLICIES_INFO> policies_info; | 573 scoped_ptr<CERT_POLICIES_INFO, base::FreeDeleter> policies_info; |
574 LPSTR ev_policy_oid = NULL; | 574 LPSTR ev_policy_oid = NULL; |
575 if (flags & CertVerifier::VERIFY_EV_CERT) { | 575 if (flags & CertVerifier::VERIFY_EV_CERT) { |
576 GetCertPoliciesInfo(cert_handle, &policies_info); | 576 GetCertPoliciesInfo(cert_handle, &policies_info); |
577 if (policies_info.get()) { | 577 if (policies_info.get()) { |
578 EVRootCAMetadata* metadata = EVRootCAMetadata::GetInstance(); | 578 EVRootCAMetadata* metadata = EVRootCAMetadata::GetInstance(); |
579 for (DWORD i = 0; i < policies_info->cPolicyInfo; ++i) { | 579 for (DWORD i = 0; i < policies_info->cPolicyInfo; ++i) { |
580 LPSTR policy_oid = policies_info->rgPolicyInfo[i].pszPolicyIdentifier; | 580 LPSTR policy_oid = policies_info->rgPolicyInfo[i].pszPolicyIdentifier; |
581 if (metadata->IsEVPolicyOID(policy_oid)) { | 581 if (metadata->IsEVPolicyOID(policy_oid)) { |
582 ev_policy_oid = policy_oid; | 582 ev_policy_oid = policy_oid; |
583 chain_para.RequestedIssuancePolicy.dwType = USAGE_MATCH_TYPE_AND; | 583 chain_para.RequestedIssuancePolicy.dwType = USAGE_MATCH_TYPE_AND; |
(...skipping 200 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
784 return MapCertStatusToNetError(verify_result->cert_status); | 784 return MapCertStatusToNetError(verify_result->cert_status); |
785 | 785 |
786 if (ev_policy_oid && | 786 if (ev_policy_oid && |
787 CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) { | 787 CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) { |
788 verify_result->cert_status |= CERT_STATUS_IS_EV; | 788 verify_result->cert_status |= CERT_STATUS_IS_EV; |
789 } | 789 } |
790 return OK; | 790 return OK; |
791 } | 791 } |
792 | 792 |
793 } // namespace net | 793 } // namespace net |
OLD | NEW |