OLD | NEW |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/internal/parsed_certificate.h" | 5 #include "net/cert/internal/parsed_certificate.h" |
6 | 6 |
7 #include "net/cert/internal/name_constraints.h" | 7 #include "net/cert/internal/name_constraints.h" |
8 #include "net/cert/internal/signature_algorithm.h" | 8 #include "net/cert/internal/signature_algorithm.h" |
9 #include "net/cert/internal/verify_name_match.h" | 9 #include "net/cert/internal/verify_name_match.h" |
10 #include "net/der/parser.h" | 10 #include "net/der/parser.h" |
(...skipping 86 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
97 &result->signature_value_, errors)) { | 97 &result->signature_value_, errors)) { |
98 return nullptr; | 98 return nullptr; |
99 } | 99 } |
100 | 100 |
101 if (!ParseTbsCertificate(result->tbs_certificate_tlv_, options, &result->tbs_, | 101 if (!ParseTbsCertificate(result->tbs_certificate_tlv_, options, &result->tbs_, |
102 errors)) { | 102 errors)) { |
103 return nullptr; | 103 return nullptr; |
104 } | 104 } |
105 | 105 |
106 // Attempt to parse the signature algorithm contained in the Certificate. | 106 // Attempt to parse the signature algorithm contained in the Certificate. |
107 // Do not give up on failure here, since SignatureAlgorithm::CreateFromDer | 107 // Do not give up on failure here, since SignatureAlgorithm::Create |
108 // will fail on valid but unsupported signature algorithms. | 108 // will fail on valid but unsupported signature algorithms. |
109 // TODO(mattm): should distinguish between unsupported algorithms and parsing | 109 // TODO(mattm): should distinguish between unsupported algorithms and parsing |
110 // errors. | 110 // errors. |
111 result->signature_algorithm_ = | 111 result->signature_algorithm_ = |
112 SignatureAlgorithm::Create(result->signature_algorithm_tlv_, errors); | 112 SignatureAlgorithm::Create(result->signature_algorithm_tlv_, errors); |
113 | 113 |
114 der::Input subject_value; | 114 der::Input subject_value; |
115 if (!GetSequenceValue(result->tbs_.subject_tlv, &subject_value) || | 115 if (!GetSequenceValue(result->tbs_.subject_tlv, &subject_value) || |
116 !NormalizeName(subject_value, &result->normalized_subject_)) { | 116 !NormalizeName(subject_value, &result->normalized_subject_)) { |
117 return nullptr; | 117 return nullptr; |
(...skipping 30 matching lines...) Expand all Loading... |
148 result->has_key_usage_ = true; | 148 result->has_key_usage_ = true; |
149 if (!ParseKeyUsage(extension.value, &result->key_usage_)) | 149 if (!ParseKeyUsage(extension.value, &result->key_usage_)) |
150 return nullptr; | 150 return nullptr; |
151 } | 151 } |
152 | 152 |
153 // Subject alternative name. | 153 // Subject alternative name. |
154 if (ConsumeExtension(SubjectAltNameOid(), &result->unparsed_extensions_, | 154 if (ConsumeExtension(SubjectAltNameOid(), &result->unparsed_extensions_, |
155 &result->subject_alt_names_extension_)) { | 155 &result->subject_alt_names_extension_)) { |
156 // RFC 5280 section 4.2.1.6: | 156 // RFC 5280 section 4.2.1.6: |
157 // SubjectAltName ::= GeneralNames | 157 // SubjectAltName ::= GeneralNames |
158 result->subject_alt_names_ = GeneralNames::CreateFromDer( | 158 result->subject_alt_names_ = |
159 result->subject_alt_names_extension_.value); | 159 GeneralNames::Create(result->subject_alt_names_extension_.value); |
160 if (!result->subject_alt_names_) | 160 if (!result->subject_alt_names_) |
161 return nullptr; | 161 return nullptr; |
162 // RFC 5280 section 4.1.2.6: | 162 // RFC 5280 section 4.1.2.6: |
163 // If subject naming information is present only in the subjectAltName | 163 // If subject naming information is present only in the subjectAltName |
164 // extension (e.g., a key bound only to an email address or URI), then the | 164 // extension (e.g., a key bound only to an email address or URI), then the |
165 // subject name MUST be an empty sequence and the subjectAltName extension | 165 // subject name MUST be an empty sequence and the subjectAltName extension |
166 // MUST be critical. | 166 // MUST be critical. |
167 if (subject_value.Length() == 0 && | 167 if (subject_value.Length() == 0 && |
168 !result->subject_alt_names_extension_.critical) { | 168 !result->subject_alt_names_extension_.critical) { |
169 return nullptr; | 169 return nullptr; |
170 } | 170 } |
171 } | 171 } |
172 | 172 |
173 // Name constraints. | 173 // Name constraints. |
174 if (ConsumeExtension(NameConstraintsOid(), &result->unparsed_extensions_, | 174 if (ConsumeExtension(NameConstraintsOid(), &result->unparsed_extensions_, |
175 &extension)) { | 175 &extension)) { |
176 result->name_constraints_ = | 176 result->name_constraints_ = |
177 NameConstraints::CreateFromDer(extension.value, extension.critical); | 177 NameConstraints::Create(extension.value, extension.critical); |
178 if (!result->name_constraints_) | 178 if (!result->name_constraints_) |
179 return nullptr; | 179 return nullptr; |
180 } | 180 } |
181 | 181 |
182 // Authority information access. | 182 // Authority information access. |
183 if (ConsumeExtension(AuthorityInfoAccessOid(), | 183 if (ConsumeExtension(AuthorityInfoAccessOid(), |
184 &result->unparsed_extensions_, | 184 &result->unparsed_extensions_, |
185 &result->authority_info_access_extension_)) { | 185 &result->authority_info_access_extension_)) { |
186 result->has_authority_info_access_ = true; | 186 result->has_authority_info_access_ = true; |
187 if (!ParseAuthorityInfoAccess( | 187 if (!ParseAuthorityInfoAccess( |
188 result->authority_info_access_extension_.value, | 188 result->authority_info_access_extension_.value, |
189 &result->ca_issuers_uris_, &result->ocsp_uris_)) | 189 &result->ca_issuers_uris_, &result->ocsp_uris_)) |
190 return nullptr; | 190 return nullptr; |
191 } | 191 } |
192 | 192 |
193 // NOTE: if additional extensions are consumed here, the verification code | 193 // NOTE: if additional extensions are consumed here, the verification code |
194 // must be updated to process those extensions, since the | 194 // must be updated to process those extensions, since the |
195 // VerifyNoUnconsumedCriticalExtensions uses the unparsed_extensions_ | 195 // VerifyNoUnconsumedCriticalExtensions uses the unparsed_extensions_ |
196 // variable to tell which extensions were processed. | 196 // variable to tell which extensions were processed. |
197 } | 197 } |
198 | 198 |
199 return result; | 199 return result; |
200 } | 200 } |
201 | 201 |
202 } // namespace net | 202 } // namespace net |
OLD | NEW |