| OLD | NEW |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/internal/parsed_certificate.h" | 5 #include "net/cert/internal/parsed_certificate.h" |
| 6 | 6 |
| 7 #include "net/cert/internal/name_constraints.h" | 7 #include "net/cert/internal/name_constraints.h" |
| 8 #include "net/cert/internal/signature_algorithm.h" | 8 #include "net/cert/internal/signature_algorithm.h" |
| 9 #include "net/cert/internal/verify_name_match.h" | 9 #include "net/cert/internal/verify_name_match.h" |
| 10 #include "net/der/parser.h" | 10 #include "net/der/parser.h" |
| (...skipping 86 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 97 &result->signature_value_, errors)) { | 97 &result->signature_value_, errors)) { |
| 98 return nullptr; | 98 return nullptr; |
| 99 } | 99 } |
| 100 | 100 |
| 101 if (!ParseTbsCertificate(result->tbs_certificate_tlv_, options, &result->tbs_, | 101 if (!ParseTbsCertificate(result->tbs_certificate_tlv_, options, &result->tbs_, |
| 102 errors)) { | 102 errors)) { |
| 103 return nullptr; | 103 return nullptr; |
| 104 } | 104 } |
| 105 | 105 |
| 106 // Attempt to parse the signature algorithm contained in the Certificate. | 106 // Attempt to parse the signature algorithm contained in the Certificate. |
| 107 // Do not give up on failure here, since SignatureAlgorithm::CreateFromDer | 107 // Do not give up on failure here, since SignatureAlgorithm::Create |
| 108 // will fail on valid but unsupported signature algorithms. | 108 // will fail on valid but unsupported signature algorithms. |
| 109 // TODO(mattm): should distinguish between unsupported algorithms and parsing | 109 // TODO(mattm): should distinguish between unsupported algorithms and parsing |
| 110 // errors. | 110 // errors. |
| 111 result->signature_algorithm_ = | 111 result->signature_algorithm_ = |
| 112 SignatureAlgorithm::Create(result->signature_algorithm_tlv_, errors); | 112 SignatureAlgorithm::Create(result->signature_algorithm_tlv_, errors); |
| 113 | 113 |
| 114 der::Input subject_value; | 114 der::Input subject_value; |
| 115 if (!GetSequenceValue(result->tbs_.subject_tlv, &subject_value) || | 115 if (!GetSequenceValue(result->tbs_.subject_tlv, &subject_value) || |
| 116 !NormalizeName(subject_value, &result->normalized_subject_)) { | 116 !NormalizeName(subject_value, &result->normalized_subject_)) { |
| 117 return nullptr; | 117 return nullptr; |
| (...skipping 30 matching lines...) Expand all Loading... |
| 148 result->has_key_usage_ = true; | 148 result->has_key_usage_ = true; |
| 149 if (!ParseKeyUsage(extension.value, &result->key_usage_)) | 149 if (!ParseKeyUsage(extension.value, &result->key_usage_)) |
| 150 return nullptr; | 150 return nullptr; |
| 151 } | 151 } |
| 152 | 152 |
| 153 // Subject alternative name. | 153 // Subject alternative name. |
| 154 if (ConsumeExtension(SubjectAltNameOid(), &result->unparsed_extensions_, | 154 if (ConsumeExtension(SubjectAltNameOid(), &result->unparsed_extensions_, |
| 155 &result->subject_alt_names_extension_)) { | 155 &result->subject_alt_names_extension_)) { |
| 156 // RFC 5280 section 4.2.1.6: | 156 // RFC 5280 section 4.2.1.6: |
| 157 // SubjectAltName ::= GeneralNames | 157 // SubjectAltName ::= GeneralNames |
| 158 result->subject_alt_names_ = GeneralNames::CreateFromDer( | 158 result->subject_alt_names_ = |
| 159 result->subject_alt_names_extension_.value); | 159 GeneralNames::Create(result->subject_alt_names_extension_.value); |
| 160 if (!result->subject_alt_names_) | 160 if (!result->subject_alt_names_) |
| 161 return nullptr; | 161 return nullptr; |
| 162 // RFC 5280 section 4.1.2.6: | 162 // RFC 5280 section 4.1.2.6: |
| 163 // If subject naming information is present only in the subjectAltName | 163 // If subject naming information is present only in the subjectAltName |
| 164 // extension (e.g., a key bound only to an email address or URI), then the | 164 // extension (e.g., a key bound only to an email address or URI), then the |
| 165 // subject name MUST be an empty sequence and the subjectAltName extension | 165 // subject name MUST be an empty sequence and the subjectAltName extension |
| 166 // MUST be critical. | 166 // MUST be critical. |
| 167 if (subject_value.Length() == 0 && | 167 if (subject_value.Length() == 0 && |
| 168 !result->subject_alt_names_extension_.critical) { | 168 !result->subject_alt_names_extension_.critical) { |
| 169 return nullptr; | 169 return nullptr; |
| 170 } | 170 } |
| 171 } | 171 } |
| 172 | 172 |
| 173 // Name constraints. | 173 // Name constraints. |
| 174 if (ConsumeExtension(NameConstraintsOid(), &result->unparsed_extensions_, | 174 if (ConsumeExtension(NameConstraintsOid(), &result->unparsed_extensions_, |
| 175 &extension)) { | 175 &extension)) { |
| 176 result->name_constraints_ = | 176 result->name_constraints_ = |
| 177 NameConstraints::CreateFromDer(extension.value, extension.critical); | 177 NameConstraints::Create(extension.value, extension.critical); |
| 178 if (!result->name_constraints_) | 178 if (!result->name_constraints_) |
| 179 return nullptr; | 179 return nullptr; |
| 180 } | 180 } |
| 181 | 181 |
| 182 // Authority information access. | 182 // Authority information access. |
| 183 if (ConsumeExtension(AuthorityInfoAccessOid(), | 183 if (ConsumeExtension(AuthorityInfoAccessOid(), |
| 184 &result->unparsed_extensions_, | 184 &result->unparsed_extensions_, |
| 185 &result->authority_info_access_extension_)) { | 185 &result->authority_info_access_extension_)) { |
| 186 result->has_authority_info_access_ = true; | 186 result->has_authority_info_access_ = true; |
| 187 if (!ParseAuthorityInfoAccess( | 187 if (!ParseAuthorityInfoAccess( |
| 188 result->authority_info_access_extension_.value, | 188 result->authority_info_access_extension_.value, |
| 189 &result->ca_issuers_uris_, &result->ocsp_uris_)) | 189 &result->ca_issuers_uris_, &result->ocsp_uris_)) |
| 190 return nullptr; | 190 return nullptr; |
| 191 } | 191 } |
| 192 | 192 |
| 193 // NOTE: if additional extensions are consumed here, the verification code | 193 // NOTE: if additional extensions are consumed here, the verification code |
| 194 // must be updated to process those extensions, since the | 194 // must be updated to process those extensions, since the |
| 195 // VerifyNoUnconsumedCriticalExtensions uses the unparsed_extensions_ | 195 // VerifyNoUnconsumedCriticalExtensions uses the unparsed_extensions_ |
| 196 // variable to tell which extensions were processed. | 196 // variable to tell which extensions were processed. |
| 197 } | 197 } |
| 198 | 198 |
| 199 return result; | 199 return result; |
| 200 } | 200 } |
| 201 | 201 |
| 202 } // namespace net | 202 } // namespace net |
| OLD | NEW |