Add new functions to handle UPN and email addresses

net/cert/x509_util_nss_certs.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>  // Must be included before certdb.h
 #include <certdb.h>
 #include <cryptohi.h>
 #include <nss.h>
 #include <pk11pub.h>
 #include <prerror.h>
@@ skipping 15 matching lines @@
 #include "crypto/scoped_nss_types.h"
 #include "crypto/third_party/nss/chromium-nss.h"
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util.h"
 #include "net/cert/x509_util_nss.h"
 
 namespace net {
 
 namespace {
 
+// Microsoft User Principal Name: 1.3.6.1.4.1.311.20.2.3
+const uint8_t kUpnOid[] = {0x2b, 0x6,  0x1,  0x4, 0x1,
+                           0x82, 0x37, 0x14, 0x2, 0x3};
+
 // Callback for CERT_DecodeCertPackage(), used in
 // CreateOSCertHandlesFromBytes().
 SECStatus PR_CALLBACK
 CollectCertsCallback(void* arg, SECItem** certs, int num_certs) {
   X509Certificate::OSCertHandles* results =
       reinterpret_cast<X509Certificate::OSCertHandles*>(arg);
 
   for (int i = 0; i < num_certs; ++i) {
     X509Certificate::OSCertHandle handle =
         X509Certificate::CreateOSCertHandleFromBytes(
@@ skipping 147 matching lines @@
           std::string(reinterpret_cast<char*>(name->name.other.data),
                       name->name.other.len));
     }
     name = CERT_GetNextGeneralName(name);
     if (name == alt_name_list)
       break;
   }
   PORT_FreeArena(arena, PR_FALSE);
 }
 
+CERTGeneralNameTypeEnum SANTypeToGeneralNameType(SubjectAltNameType type) {
+  switch (type) {
+    case SAN_RFC822_NAME:
+      return certRFC822Name;
+    case SAN_DNS_NAME:
+      return certDNSName;
+    case SAN_URI:
+      return certURI;
+    case SAN_IP_ADDRESS:
+      return certIPAddress;
+    case SAN_UPN:
+      return certOtherName;
+  }
+  NOTREACHED();
+  return certOtherName;
+}
+
+void GetSubjectAltNameByType(CERTCertificate* cert_handle,
+                             SubjectAltNameType type,
+                             std::vector<std::string>* names) {
+  crypto::ScopedSECItem alt_name(SECITEM_AllocItem(NULL, NULL, 0));
+  DCHECK(alt_name.get());
+
+  SECStatus rv = CERT_FindCertExtension(
+      cert_handle, SEC_OID_X509_SUBJECT_ALT_NAME, alt_name.get());
+  if (rv != SECSuccess)
+    return;
+
+  crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
+  DCHECK(arena.get());
+
+  CERTGeneralName* alt_name_list;
+  alt_name_list = CERT_DecodeAltNameExtension(arena.get(), alt_name.get());
+
+  CERTGeneralName* name = alt_name_list;
+  while (name) {
+    if (name->type == SANTypeToGeneralNameType(type)) {
+      switch (type) {
+        case SAN_RFC822_NAME:
+        case SAN_DNS_NAME:
+        case SAN_URI:
+        case SAN_IP_ADDRESS:
+          names->push_back(
+              std::string(reinterpret_cast<char*>(name->name.other.data),
+                          name->name.other.len));
+          break;
+        case SAN_UPN:
+          OtherName* on = &name->name.OthName;
+          if (on->oid.len == sizeof(kUpnOid) &&
+              !memcmp(on->oid.data, kUpnOid, sizeof(kUpnOid))) {

[Ryan Sleevi, 2016/03/01 00:28:29]

The use of ! for values that return <0,0,>0 has been a huge source of bugs, both
security and otherwise.

if (on->oid.len == sizeof(kUpnOid) &&
    memcmp(...) == 0) {
}

[Kevin Cernekee, 2016/03/01 19:28:01]

Done.

+            SECItem decoded;
+            if (SEC_ASN1DecodeItem(arena.get(), &decoded,

[Ryan Sleevi, 2016/03/01 00:28:28]

SECURITY: DO *not* use this function in any way whatsoever. It is NOT safe to
use!

The idiomatic NSS way is SEC_QuickDERDecodeItem(...); alternatively, we've been
updating code to use //net/der (as seen in //net/cert/internal/parse_name). For
now, use QuickDER

[Kevin Cernekee, 2016/03/01 19:28:01]

Done.

+                                   SEC_ASN1_GET(SEC_UTF8StringTemplate),
+                                   &name->name.OthName.name) == SECSuccess) {
+              names->push_back(std::string(
+                  reinterpret_cast<char*>(decoded.data), decoded.len));
+            }
+          }
+          break;
+      }
+    }
+    name = CERT_GetNextGeneralName(name);
+    if (name == alt_name_list)
+      break;
+  }
+}
+
 X509Certificate::OSCertHandles CreateOSCertHandlesFromBytes(
     const char* data,
     size_t length,
     X509Certificate::Format format) {
   X509Certificate::OSCertHandles results;
 
   crypto::EnsureNSSInit();
 
   if (!NSS_IsInitialized())
     return results;
@@ skipping 124 matching lines @@
     base::SStringPrintf(&new_name, "%s #%d", nickname.c_str(), index++);
     temp_nickname = token_name + new_name;
   }
 
   return new_name;
 }
 
 }  // namespace x509_util
 
 }  // namespace net