Adding iOS OpenSSL Implementation

net/cert/cert_verify_proc_openssl_ios.cc

+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/cert/cert_verify_proc_openssl_ios.h"
+
+#include <CommonCrypto/CommonDigest.h>
+#include <Security/Security.h>
+
+#include "base/logging.h"
+#include "base/mac/scoped_cftyperef.h"
+#include "base/strings/sys_string_conversions.h"
+#include "crypto/sha2.h"
+#include "net/base/net_errors.h"
+#include "net/cert/asn1_util.h"
+#include "net/cert/cert_verify_result.h"
+#include "net/cert/crl_set.h"
+#include "net/cert/test_root_certs.h"
+#include "net/cert/x509_certificate.h"
+#include "net/ssl/openssl_ssl_util.h"
+
+using base::ScopedCFTypeRef;
+
+namespace net {
+
+namespace {
+
+typedef OSStatus (*SecTrustCopyExtendedResultFuncPtr)(SecTrustRef,
+                                                      CFDictionaryRef*);
+
+int NetErrorFromOSStatus(OSStatus status) {
+  switch (status) {
+    case noErr:
+      return OK;
+    case errSecNotAvailable:
+      return ERR_NOT_IMPLEMENTED;
+    case errSecAuthFailed:
+      return ERR_ACCESS_DENIED;
+    default:
+      return ERR_FAILED;
+  }
+}
+
+// Creates a series of SecPolicyRefs to be added to a SecTrustRef used to
+// validate a certificate for an SSL server. |hostname| contains the name of
+// the SSL server that the certificate should be verified against. If
+// successful, returns noErr, and stores the resultant array of SecPolicyRefs
+// in |policies|.
+OSStatus CreateTrustPolicies(const std::string& hostname,

[Ryan Sleevi, 2016/03/24 18:50:24]

unused arg

[svaldez, 2016/03/24 19:46:01]

Done.

+                             ScopedCFTypeRef<CFArrayRef>* policies) {
+  ScopedCFTypeRef<CFMutableArrayRef> local_policies(
+      CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
+  if (!local_policies)
+    return errSecAllocate;
+
+  SecPolicyRef ssl_policy = SecPolicyCreateBasicX509();
+  CFArrayAppendValue(local_policies, ssl_policy);
+  CFRelease(ssl_policy);
+  ssl_policy = SecPolicyCreateSSL(true, NULL);

[Ryan Sleevi, 2016/03/24 18:50:24]

Should this be nullptr? I'm guessing we can't use nil because we're .cc here
(not .mm)

[svaldez, 2016/03/24 19:46:01]

Done.

+  CFArrayAppendValue(local_policies, ssl_policy);
+  CFRelease(ssl_policy);
+
+  policies->reset(local_policies.release());
+  return noErr;
+}
+
+// Builds and evaluates a SecTrustRef for the certificate chain contained
+// in |cert_array|, using the verification policies in |trust_policies|. On
+// success, returns OK, and updates |trust_ref| and |trust_result|. On failure,
+// no output parameters are modified.
+//
+// Note: An OK return does not mean that |cert_array| is trusted, merely that
+// verification was performed successfully.
+int BuildAndEvaluateSecTrustRef(CFArrayRef cert_array,
+                                CFArrayRef trust_policies,
+                                ScopedCFTypeRef<SecTrustRef>* trust_ref,
+                                ScopedCFTypeRef<CFArrayRef>* verified_chain,
+                                SecTrustResultType* trust_result) {
+  SecTrustRef tmp_trust = NULL;
+  OSStatus status =
+      SecTrustCreateWithCertificates(cert_array, trust_policies, &tmp_trust);
+  if (status)
+    return NetErrorFromOSStatus(status);
+  ScopedCFTypeRef<SecTrustRef> scoped_tmp_trust(tmp_trust);
+
+  if (TestRootCerts::HasInstance()) {
+    status = TestRootCerts::GetInstance()->FixupSecTrustRef(tmp_trust);
+    if (status)
+      return NetErrorFromOSStatus(status);
+  }
+
+  SecTrustResultType tmp_trust_result;

[Ryan Sleevi, 2016/03/24 18:50:24]

naming wise, you don't need to keep the tmp_ name anymore, do you? You can just
directly access/set the results, right? (Since there's no iterative looping)

[svaldez, 2016/03/24 19:46:01]

We still need some temporary variables for this since we don't want to update
the arguments unless we succeed to the end.

+  status = SecTrustEvaluate(tmp_trust, &tmp_trust_result);
+  if (status)
+    return NetErrorFromOSStatus(status);
+
+  ScopedCFTypeRef<CFMutableArrayRef> tmp_verified_chain(
+      CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
+  const CFIndex chain_length = SecTrustGetCertificateCount(tmp_trust);
+  for (CFIndex i = 0; i < chain_length; ++i) {
+    SecCertificateRef chain_cert = SecTrustGetCertificateAtIndex(tmp_trust, i);
+    CFArrayAppendValue(tmp_verified_chain, chain_cert);
+  }
+
+  trust_ref->swap(scoped_tmp_trust);
+  *trust_result = tmp_trust_result;
+  verified_chain->reset(tmp_verified_chain.release());
+  return OK;
+}
+
+void GetCertChainInfo(CFArrayRef cert_chain,
+                      CertVerifyResult* verify_result,
+                      bool* leaf_is_weak) {
+  DCHECK_LT(0, CFArrayGetCount(cert_chain));
+
+  *leaf_is_weak = false;
+  verify_result->has_md2 = false;
+  verify_result->has_md4 = false;
+  verify_result->has_md5 = false;
+  verify_result->has_sha1 = false;
+  verify_result->has_sha1_leaf = false;
+
+  SecCertificateRef verified_cert = NULL;
+  std::vector<SecCertificateRef> verified_chain;
+  for (CFIndex i = 0, count = CFArrayGetCount(cert_chain); i < count; ++i) {
+    SecCertificateRef chain_cert = reinterpret_cast<SecCertificateRef>(
+        const_cast<void*>(CFArrayGetValueAtIndex(cert_chain, i)));
+    if (i == 0) {
+      verified_cert = chain_cert;
+    } else {
+      verified_chain.push_back(chain_cert);
+    }
+
+    ScopedX509 x509_cert = OSCertHandleToOpenSSL(chain_cert);
+    int sig_alg = OBJ_obj2nid(x509_cert->sig_alg->algorithm);
+    if (sig_alg == NID_md2WithRSAEncryption) {
+      verify_result->has_md2 = true;
+      if (i == 0)
+        *leaf_is_weak = true;
+    } else if (sig_alg == NID_md4WithRSAEncryption) {
+      verify_result->has_md4 = true;
+      if (i == 0)
+        *leaf_is_weak = true;
+    } else if (sig_alg == NID_md5WithRSAEncryption ||
+               sig_alg == NID_md5WithRSA) {
+      verify_result->has_md5 = true;
+      if (i == 0)
+        *leaf_is_weak = true;
+    } else if (sig_alg == NID_sha1WithRSAEncryption ||
+               sig_alg == NID_dsaWithSHA || sig_alg == NID_dsaWithSHA1 ||
+               sig_alg == NID_dsaWithSHA1_2 || sig_alg == NID_sha1WithRSA ||
+               sig_alg == NID_ecdsa_with_SHA1) {
+      verify_result->has_sha1 = true;
+      if (i == 0) {
+        verify_result->has_sha1_leaf = true;
+        *leaf_is_weak = true;
+      }
+    }
+  }
+  if (!verified_cert) {
+    NOTREACHED();
+    return;
+  }
+
+  verify_result->verified_cert =
+      X509Certificate::CreateFromHandle(verified_cert, verified_chain);
+}
+
+void AppendPublicKeyHashes(CFArrayRef chain, HashValueVector* hashes) {

[Ryan Sleevi, 2016/03/24 18:50:24]

It seems like it makes sense to fold this into GetCertChainInfo, which will
reduce the amount of ASN.1 parsing overall that you have to do, and only iterate
once, not twice.

[svaldez, 2016/03/24 19:46:01]

Done.

+  const CFIndex n = CFArrayGetCount(chain);
+  for (CFIndex i = 0; i < n; i++) {
+    SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(
+        const_cast<void*>(CFArrayGetValueAtIndex(chain, i)));
+
+    std::string der_bytes;
+    if (!X509Certificate::GetDEREncoded(cert, &der_bytes))
+      return;
+    base::StringPiece spki_bytes;
+    if (!asn1::ExtractSPKIFromDERCert(der_bytes, &spki_bytes))
+      continue;
+
+    HashValue sha1(HASH_VALUE_SHA1);
+    CC_SHA1(spki_bytes.data(), spki_bytes.size(), sha1.data());
+    hashes->push_back(sha1);
+
+    HashValue sha256(HASH_VALUE_SHA256);
+    CC_SHA256(spki_bytes.data(), spki_bytes.size(), sha256.data());
+    hashes->push_back(sha256);
+  }
+}
+
+}  // namespace
+
+CertVerifyProcIOS::CertVerifyProcIOS() {}
+
+CertVerifyProcIOS::~CertVerifyProcIOS() {}
+
+bool CertVerifyProcIOS::SupportsAdditionalTrustAnchors() const {
+  return false;
+}
+
+bool CertVerifyProcIOS::SupportsOCSPStapling() const {
+  return false;
+}
+
+int CertVerifyProcIOS::VerifyInternal(
+    X509Certificate* cert,
+    const std::string& hostname,
+    const std::string& ocsp_response,
+    int flags,
+    CRLSet* crl_set,
+    const CertificateList& additional_trust_anchors,
+    CertVerifyResult* verify_result) {
+  ScopedCFTypeRef<CFArrayRef> trust_policies;
+  OSStatus status = CreateTrustPolicies(hostname, &trust_policies);
+  if (status)
+    return NetErrorFromOSStatus(status);
+
+  ScopedCFTypeRef<CFMutableArrayRef> cert_array(
+      cert->CreateOSCertChainForCert());
+  ScopedCFTypeRef<SecTrustRef> trust_ref;
+  SecTrustResultType trust_result = kSecTrustResultDeny;
+  ScopedCFTypeRef<CFArrayRef> final_chain;
+
+  status = BuildAndEvaluateSecTrustRef(cert_array, trust_policies, &trust_ref,
+                                       &final_chain, &trust_result);
+  if (status)
+    return NetErrorFromOSStatus(status);
+
+  if (CFArrayGetCount(final_chain) > 0) {

[Ryan Sleevi, 2016/03/24 18:50:24]

If the final_chain count == 0, we should be failing/erroring fast.

[svaldez, 2016/03/24 19:46:01]

Done.

+    bool unused_leaf_weak;
+    GetCertChainInfo(final_chain, verify_result, &unused_leaf_weak);
+  }
+
+  // TODO(sleevi): Support CRLSet revocation.
+  // TODO(svaldez): Add expiration handling.
+  switch (trust_result) {
+    case kSecTrustResultUnspecified:
+    case kSecTrustResultProceed:
+      break;
+    case kSecTrustResultDeny:
+      verify_result->cert_status |= CERT_STATUS_AUTHORITY_INVALID;
+    default:
+      verify_result->cert_status |= CERT_STATUS_INVALID;
+  }
+
+  // Perform hostname verification independent of SecTrustEvaluate.
+  if (!cert->VerifyNameMatch(hostname,

[Ryan Sleevi, 2016/03/24 18:50:24]

For safety/robustness, even though it should be a noop, you should be using
verify_result->verified_cert->VerifyNameMatch(...)

[svaldez, 2016/03/24 19:46:01]

Done.

+                             &verify_result->common_name_fallback_used)) {
+    verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
+  }
+
+  AppendPublicKeyHashes(final_chain, &verify_result->public_key_hashes);
+  verify_result->is_issued_by_known_root = false;
+
+  if (IsCertStatusError(verify_result->cert_status))
+    return MapCertStatusToNetError(verify_result->cert_status);
+
+  return OK;
+}
+
+}  // namespace net