Resolve certificate references in ONC by PEM.

chromeos/network/certificate_pattern_matcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/certificate_pattern_matcher.h"
 
 #include <cert.h>
 #include <pk11pub.h>
 
 #include <list>
@@ skipping 77 matching lines @@
  public:
   explicit PrivateKeyFilter(net::CertDatabase* cert_db) : cert_db_(cert_db) {}
   bool operator()(const scoped_refptr<net::X509Certificate>& cert) const {
     return cert_db_->CheckUserCert(cert.get()) != net::OK;
   }
  private:
   net::CertDatabase* cert_db_;
 };
 
 // Functor to filter out certs that don't have an issuer in the associated
-// IssuerCARef list.
-class IssuerCaRefFilter {
+// IssuerCAPEMs list.
+class IssuerCaFilter {
  public:
-  explicit IssuerCaRefFilter(const std::vector<std::string>& issuer_ca_ref_list)
-    : issuer_ca_ref_list_(issuer_ca_ref_list) {}
+  explicit IssuerCaFilter(const std::vector<std::string>& issuer_ca_pems)
+    : issuer_ca_pems_(issuer_ca_pems) {}
   bool operator()(const scoped_refptr<net::X509Certificate>& cert) const {
     // Find the certificate issuer for each certificate.
     // TODO(gspencer): this functionality should be available from
     // X509Certificate or NSSCertDatabase.
     CERTCertificate* issuer_cert = CERT_FindCertIssuer(
         cert.get()->os_cert_handle(), PR_Now(), certUsageAnyCA);
 
-    if (issuer_cert && issuer_cert->nickname) {
-      // Separate the nickname stored in the certificate at the colon, since
-      // NSS likes to store it as token:nickname.
-      const char* delimiter = ::strchr(issuer_cert->nickname, ':');
-      if (delimiter) {
-        delimiter++;  // move past the colon.
-        std::vector<std::string>::const_iterator pat_iter =
-            issuer_ca_ref_list_.begin();
-        while (pat_iter != issuer_ca_ref_list_.end()) {
-          if (*pat_iter == delimiter)
-            return false;
-          ++pat_iter;
-        }
-      }
+    if (!issuer_cert)
+      return true;
+
+    std::string pem_encoded;
+    if (!net::X509Certificate::GetPEMEncoded(issuer_cert, &pem_encoded)) {
+      LOG(ERROR) << "Couldn't PEM-encode certificate.";
+      return true;
     }
-    return true;
+
+    return (std::find(issuer_ca_pems_.begin(), issuer_ca_pems_.end(),
+                      pem_encoded) ==
+            issuer_ca_pems_.end());
   }
  private:
-  const std::vector<std::string>& issuer_ca_ref_list_;
+  const std::vector<std::string>& issuer_ca_pems_;
 };
 
 }  // namespace
 
 namespace certificate_pattern {
 
 scoped_refptr<net::X509Certificate> GetCertificateMatch(
     const CertificatePattern& pattern) {
   typedef std::list<scoped_refptr<net::X509Certificate> > CertificateStlList;
 
@@ skipping 16 matching lines @@
     if (matching_certs.empty())
       return NULL;
   }
 
   if (!pattern.subject().Empty()) {
     matching_certs.remove_if(SubjectFilter(pattern.subject()));
     if (matching_certs.empty())
       return NULL;
   }
 
-  if (!pattern.issuer_ca_ref_list().empty()) {
-    matching_certs.remove_if(IssuerCaRefFilter(pattern.issuer_ca_ref_list()));
+  if (!pattern.issuer_ca_pems().empty()) {
+    matching_certs.remove_if(IssuerCaFilter(pattern.issuer_ca_pems()));
     if (matching_certs.empty())
       return NULL;
   }
 
   // Eliminate any certs that don't have private keys associated with
   // them.  The CheckUserCert call in the filter is a little slow (because of
   // underlying PKCS11 calls), so we do this last to reduce the number of times
   // we have to call it.
   PrivateKeyFilter private_filter(net::CertDatabase::GetInstance());
   matching_certs.remove_if(private_filter);
@@ skipping 11 matching lines @@
     if (!latest.get() || (*iter)->valid_start() > latest->valid_start())
       latest = *iter;
   }
 
   return latest;
 }
 
 }  // namespace certificate_pattern
 
 }  // namespace chromeos