| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/internal/verify_certificate_chain.h" | 5 #include "net/cert/internal/verify_certificate_chain.h" |
| 6 | 6 |
| 7 #include <memory> | 7 #include <memory> |
| 8 | 8 |
| 9 #include "base/logging.h" | 9 #include "base/logging.h" |
| 10 #include "net/cert/internal/name_constraints.h" | 10 #include "net/cert/internal/name_constraints.h" |
| (...skipping 151 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 162 } | 162 } |
| 163 } | 163 } |
| 164 | 164 |
| 165 // TODO(eroman): Steps d-f are omitted, as policy constraints are not yet | 165 // TODO(eroman): Steps d-f are omitted, as policy constraints are not yet |
| 166 // implemented. | 166 // implemented. |
| 167 | 167 |
| 168 return true; | 168 return true; |
| 169 } | 169 } |
| 170 | 170 |
| 171 // This function corresponds to RFC 5280 section 6.1.4's "Preparation for | 171 // This function corresponds to RFC 5280 section 6.1.4's "Preparation for |
| 172 // Certificate i+1" procedure. |cert| is expected to be an intermediary. | 172 // Certificate i+1" procedure. |cert| is expected to be an intermediate. |
| 173 WARN_UNUSED_RESULT bool PrepareForNextCertificate( | 173 WARN_UNUSED_RESULT bool PrepareForNextCertificate( |
| 174 const ParsedCertificate& cert, | 174 const ParsedCertificate& cert, |
| 175 size_t* max_path_length_ptr, | 175 size_t* max_path_length_ptr, |
| 176 der::Input* working_spki, | 176 der::Input* working_spki, |
| 177 der::Input* working_normalized_issuer_name, | 177 der::Input* working_normalized_issuer_name, |
| 178 std::vector<const NameConstraints*>* name_constraints_list) { | 178 std::vector<const NameConstraints*>* name_constraints_list) { |
| 179 // TODO(eroman): Steps a-b are omitted, as policy constraints are not yet | 179 // TODO(eroman): Steps a-b are omitted, as policy constraints are not yet |
| 180 // implemented. | 180 // implemented. |
| 181 | 181 |
| 182 // From RFC 5280 section 6.1.4 step c: | 182 // From RFC 5280 section 6.1.4 step c: |
| (...skipping 21 matching lines...) Expand all Loading... |
| 204 // | 204 // |
| 205 // If certificate i is a version 3 certificate, verify that the | 205 // If certificate i is a version 3 certificate, verify that the |
| 206 // basicConstraints extension is present and that cA is set to | 206 // basicConstraints extension is present and that cA is set to |
| 207 // TRUE. (If certificate i is a version 1 or version 2 | 207 // TRUE. (If certificate i is a version 1 or version 2 |
| 208 // certificate, then the application MUST either verify that | 208 // certificate, then the application MUST either verify that |
| 209 // certificate i is a CA certificate through out-of-band means | 209 // certificate i is a CA certificate through out-of-band means |
| 210 // or reject the certificate. Conforming implementations may | 210 // or reject the certificate. Conforming implementations may |
| 211 // choose to reject all version 1 and version 2 intermediate | 211 // choose to reject all version 1 and version 2 intermediate |
| 212 // certificates.) | 212 // certificates.) |
| 213 // | 213 // |
| 214 // This code implicitly rejects non version 3 intermediaries, since they | 214 // This code implicitly rejects non version 3 intermediates, since they |
| 215 // can't contain a BasicConstraints extension. | 215 // can't contain a BasicConstraints extension. |
| 216 if (!cert.has_basic_constraints() || !cert.basic_constraints().is_ca) | 216 if (!cert.has_basic_constraints() || !cert.basic_constraints().is_ca) |
| 217 return false; | 217 return false; |
| 218 | 218 |
| 219 // From RFC 5280 section 6.1.4 step l: | 219 // From RFC 5280 section 6.1.4 step l: |
| 220 // | 220 // |
| 221 // If the certificate was not self-issued, verify that | 221 // If the certificate was not self-issued, verify that |
| 222 // max_path_length is greater than zero and decrement | 222 // max_path_length is greater than zero and decrement |
| 223 // max_path_length by 1. | 223 // max_path_length by 1. |
| 224 if (!IsSelfIssued(cert)) { | 224 if (!IsSelfIssued(cert)) { |
| (...skipping 215 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 440 | 440 |
| 441 // TODO(eroman): RFC 5280 forbids duplicate certificates per section 6.1: | 441 // TODO(eroman): RFC 5280 forbids duplicate certificates per section 6.1: |
| 442 // | 442 // |
| 443 // A certificate MUST NOT appear more than once in a prospective | 443 // A certificate MUST NOT appear more than once in a prospective |
| 444 // certification path. | 444 // certification path. |
| 445 | 445 |
| 446 return true; | 446 return true; |
| 447 } | 447 } |
| 448 | 448 |
| 449 } // namespace net | 449 } // namespace net |
| OLD | NEW |