OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/cert_verify_proc_android.h" | 5 #include "net/cert/cert_verify_proc_android.h" |
6 | 6 |
7 #include <string> | 7 #include <string> |
8 #include <vector> | 8 #include <vector> |
9 | 9 |
10 #include "base/logging.h" | 10 #include "base/logging.h" |
(...skipping 14 matching lines...) Expand all Loading... |
25 | 25 |
26 // Returns true if the certificate verification call was successful (regardless | 26 // Returns true if the certificate verification call was successful (regardless |
27 // of its result), i.e. if |verify_result| was set. Otherwise returns false. | 27 // of its result), i.e. if |verify_result| was set. Otherwise returns false. |
28 bool VerifyFromAndroidTrustManager(const std::vector<std::string>& cert_bytes, | 28 bool VerifyFromAndroidTrustManager(const std::vector<std::string>& cert_bytes, |
29 const std::string& hostname, | 29 const std::string& hostname, |
30 CertVerifyResult* verify_result) { | 30 CertVerifyResult* verify_result) { |
31 android::CertVerifyStatusAndroid status; | 31 android::CertVerifyStatusAndroid status; |
32 std::vector<std::string> verified_chain; | 32 std::vector<std::string> verified_chain; |
33 | 33 |
34 // TODO(joth): Fetch the authentication type from SSL rather than hardcode. | 34 // TODO(joth): Fetch the authentication type from SSL rather than hardcode. |
35 android::VerifyX509CertChain(cert_bytes, "RSA", hostname, | 35 android::VerifyX509CertChain(cert_bytes, |
36 &status, &verify_result->is_issued_by_known_root, | 36 "RSA", |
| 37 hostname, |
| 38 &status, |
| 39 &verify_result->is_issued_by_known_root, |
37 &verified_chain); | 40 &verified_chain); |
38 switch (status) { | 41 switch (status) { |
39 case android::VERIFY_FAILED: | 42 case android::VERIFY_FAILED: |
40 return false; | 43 return false; |
41 case android::VERIFY_OK: | 44 case android::VERIFY_OK: |
42 break; | 45 break; |
43 case android::VERIFY_NO_TRUSTED_ROOT: | 46 case android::VERIFY_NO_TRUSTED_ROOT: |
44 verify_result->cert_status |= CERT_STATUS_AUTHORITY_INVALID; | 47 verify_result->cert_status |= CERT_STATUS_AUTHORITY_INVALID; |
45 break; | 48 break; |
46 case android::VERIFY_EXPIRED: | 49 case android::VERIFY_EXPIRED: |
(...skipping 25 matching lines...) Expand all Loading... |
72 } | 75 } |
73 | 76 |
74 // Extract the public key hashes. | 77 // Extract the public key hashes. |
75 for (size_t i = 0; i < verified_chain.size(); i++) { | 78 for (size_t i = 0; i < verified_chain.size(); i++) { |
76 base::StringPiece spki_bytes; | 79 base::StringPiece spki_bytes; |
77 if (!asn1::ExtractSPKIFromDERCert(verified_chain[i], &spki_bytes)) | 80 if (!asn1::ExtractSPKIFromDERCert(verified_chain[i], &spki_bytes)) |
78 continue; | 81 continue; |
79 | 82 |
80 HashValue sha1(HASH_VALUE_SHA1); | 83 HashValue sha1(HASH_VALUE_SHA1); |
81 base::SHA1HashBytes(reinterpret_cast<const uint8*>(spki_bytes.data()), | 84 base::SHA1HashBytes(reinterpret_cast<const uint8*>(spki_bytes.data()), |
82 spki_bytes.size(), sha1.data()); | 85 spki_bytes.size(), |
| 86 sha1.data()); |
83 verify_result->public_key_hashes.push_back(sha1); | 87 verify_result->public_key_hashes.push_back(sha1); |
84 | 88 |
85 HashValue sha256(HASH_VALUE_SHA256); | 89 HashValue sha256(HASH_VALUE_SHA256); |
86 crypto::SHA256HashString(spki_bytes, sha256.data(), crypto::kSHA256Length); | 90 crypto::SHA256HashString(spki_bytes, sha256.data(), crypto::kSHA256Length); |
87 verify_result->public_key_hashes.push_back(sha256); | 91 verify_result->public_key_hashes.push_back(sha256); |
88 } | 92 } |
89 | 93 |
90 return true; | 94 return true; |
91 } | 95 } |
92 | 96 |
93 bool GetChainDEREncodedBytes(X509Certificate* cert, | 97 bool GetChainDEREncodedBytes(X509Certificate* cert, |
94 std::vector<std::string>* chain_bytes) { | 98 std::vector<std::string>* chain_bytes) { |
95 X509Certificate::OSCertHandle cert_handle = cert->os_cert_handle(); | 99 X509Certificate::OSCertHandle cert_handle = cert->os_cert_handle(); |
96 X509Certificate::OSCertHandles cert_handles = | 100 X509Certificate::OSCertHandles cert_handles = |
97 cert->GetIntermediateCertificates(); | 101 cert->GetIntermediateCertificates(); |
98 | 102 |
99 // Make sure the peer's own cert is the first in the chain, if it's not | 103 // Make sure the peer's own cert is the first in the chain, if it's not |
100 // already there. | 104 // already there. |
101 if (cert_handles.empty() || cert_handles[0] != cert_handle) | 105 if (cert_handles.empty() || cert_handles[0] != cert_handle) |
102 cert_handles.insert(cert_handles.begin(), cert_handle); | 106 cert_handles.insert(cert_handles.begin(), cert_handle); |
103 | 107 |
104 chain_bytes->reserve(cert_handles.size()); | 108 chain_bytes->reserve(cert_handles.size()); |
105 for (X509Certificate::OSCertHandles::const_iterator it = | 109 for (X509Certificate::OSCertHandles::const_iterator it = cert_handles.begin(); |
106 cert_handles.begin(); it != cert_handles.end(); ++it) { | 110 it != cert_handles.end(); |
| 111 ++it) { |
107 std::string cert_bytes; | 112 std::string cert_bytes; |
108 if(!X509Certificate::GetDEREncoded(*it, &cert_bytes)) | 113 if (!X509Certificate::GetDEREncoded(*it, &cert_bytes)) |
109 return false; | 114 return false; |
110 chain_bytes->push_back(cert_bytes); | 115 chain_bytes->push_back(cert_bytes); |
111 } | 116 } |
112 return true; | 117 return true; |
113 } | 118 } |
114 | 119 |
115 } // namespace | 120 } // namespace |
116 | 121 |
117 CertVerifyProcAndroid::CertVerifyProcAndroid() {} | 122 CertVerifyProcAndroid::CertVerifyProcAndroid() { |
| 123 } |
118 | 124 |
119 CertVerifyProcAndroid::~CertVerifyProcAndroid() {} | 125 CertVerifyProcAndroid::~CertVerifyProcAndroid() { |
| 126 } |
120 | 127 |
121 bool CertVerifyProcAndroid::SupportsAdditionalTrustAnchors() const { | 128 bool CertVerifyProcAndroid::SupportsAdditionalTrustAnchors() const { |
122 return false; | 129 return false; |
123 } | 130 } |
124 | 131 |
125 int CertVerifyProcAndroid::VerifyInternal( | 132 int CertVerifyProcAndroid::VerifyInternal( |
126 X509Certificate* cert, | 133 X509Certificate* cert, |
127 const std::string& hostname, | 134 const std::string& hostname, |
128 int flags, | 135 int flags, |
129 CRLSet* crl_set, | 136 CRLSet* crl_set, |
(...skipping 11 matching lines...) Expand all Loading... |
141 NOTREACHED(); | 148 NOTREACHED(); |
142 return ERR_FAILED; | 149 return ERR_FAILED; |
143 } | 150 } |
144 if (IsCertStatusError(verify_result->cert_status)) | 151 if (IsCertStatusError(verify_result->cert_status)) |
145 return MapCertStatusToNetError(verify_result->cert_status); | 152 return MapCertStatusToNetError(verify_result->cert_status); |
146 | 153 |
147 return OK; | 154 return OK; |
148 } | 155 } |
149 | 156 |
150 } // namespace net | 157 } // namespace net |
OLD | NEW |