Allow Cast certificates to have serial numbers greater than 20 bytes, as well as non-minimal INTEGE…

components/cast_certificate/cast_cert_validator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_cert_validator.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 146 matching lines @@
 
 // Returns true if the extended key usage list |ekus| contains client auth.
 bool HasClientAuth(const std::vector<net::der::Input>& ekus) {
   for (const auto& oid : ekus) {
     if (oid == net::ClientAuth())
       return true;
   }
   return false;
 }
 
+// Returns the parsing options used for Cast certificates.
+net::ParseCertificateOptions GetCertParsingOptions() {
+  net::ParseCertificateOptions options;
+
+  // Some cast intermediate certificates contain serial numbers that are
+  // 21 octets long, and might also not use valid DER encoding for an
+  // INTEGER (non-minimal encoding).
+  //
+  // Allow these sorts of serial numbers.
+  //
+  // TODO(eroman): At some point in the future this workaround will no longer be
+  // necessary. Should revisit this for removal in 2017 if not earlier.
+  options.allow_invalid_serial_numbers = true;
+  return options;
+}
+
 // Checks properties on the target certificate.
 //
 //   * The Key Usage must include Digital Signature
 //   * THe Extended Key Usage must includ TLS Client Auth
 //   * May have the policy 1.3.6.1.4.1.11129.2.5.2 to indicate it
 //     is an audio-only device.
 WARN_UNUSED_RESULT bool CheckTargetCertificate(
     const net::der::Input& cert_der,
     std::unique_ptr<CertVerificationContext>* context,
     CastDeviceCertPolicy* policy) {
   // TODO(eroman): Simplify this. The certificate chain verification
   // function already parses this stuff, awkward to re-do it here.
 
   net::der::Input tbs_certificate_tlv;
   net::der::Input signature_algorithm_tlv;
   net::der::BitString signature_value;
   if (!net::ParseCertificate(cert_der, &tbs_certificate_tlv,
                              &signature_algorithm_tlv, &signature_value))
     return false;
 
   net::ParsedTbsCertificate tbs;
-  if (!net::ParseTbsCertificate(tbs_certificate_tlv, &tbs))
+  if (!net::ParseTbsCertificate(tbs_certificate_tlv, GetCertParsingOptions(),
+                                &tbs))
     return false;
 
   // Get the extensions.
   if (!tbs.has_extensions)
     return false;
   ExtensionsMap extensions;
   if (!net::ParseExtensions(tbs.extensions_tlv, &extensions))
     return false;
 
   net::der::Input extension_value;
@@ skipping 67 matching lines @@
   // der::Input, so wrap the data in it (cheap).
   std::vector<net::der::Input> input_chain;
   for (const auto& cert : certs)
     input_chain.push_back(net::der::Input(&cert));
 
   // Use a signature policy compatible with Cast's PKI.
   auto signature_policy = CreateCastSignaturePolicy();
 
   // Do RFC 5280 compatible certificate verification using the two Cast
   // trust anchors and Cast signature policy.
-  if (!net::VerifyCertificateChain(input_chain, CastTrustStore::Get(),
-                                   signature_policy.get(),
-                                   ConvertExplodedTime(time))) {
+  if (!net::VerifyCertificateChain(
+          input_chain, GetCertParsingOptions(), CastTrustStore::Get(),
+          signature_policy.get(), ConvertExplodedTime(time))) {
     return false;
   }
 
   // Check properties of the leaf certificate (key usage, policy), and construct
   // a CertVerificationContext that uses its public key.
   return CheckTargetCertificate(input_chain[0], context, policy);
 }
 
 std::unique_ptr<CertVerificationContext> CertVerificationContextImplForTest(
     const base::StringPiece& spki) {
   // Use a bogus CommonName, since this is just exposed for testing signature
   // verification by unittests.
   return base::WrapUnique(
       new CertVerificationContextImpl(net::der::Input(spki), "CommonName"));
 }
 
 bool AddTrustAnchorForTest(const uint8_t* data, size_t length) {
   return CastTrustStore::Get().AddTrustedCertificateWithoutCopying(data,
                                                                    length);
 }
 
 }  // namespace cast_certificate