| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/test_root_certs.h" | 5 #include "net/cert/test_root_certs.h" |
| 6 | 6 |
| 7 #include <Security/Security.h> | 7 #include <Security/Security.h> |
| 8 | 8 |
| 9 #include "base/logging.h" | 9 #include "base/logging.h" |
| 10 #include "base/mac/mac_util.h" | 10 #include "base/mac/mac_util.h" |
| (...skipping 21 matching lines...) Expand all Loading... |
| 32 } | 32 } |
| 33 | 33 |
| 34 void ReleaseWrapper(CFAllocatorRef unused, const void* value) { | 34 void ReleaseWrapper(CFAllocatorRef unused, const void* value) { |
| 35 CFRelease(value); | 35 CFRelease(value); |
| 36 } | 36 } |
| 37 | 37 |
| 38 // CFEqual prior to 10.6 only performed pointer checks on SecCertificateRefs, | 38 // CFEqual prior to 10.6 only performed pointer checks on SecCertificateRefs, |
| 39 // rather than checking if they were the same (logical) certificate, so a | 39 // rather than checking if they were the same (logical) certificate, so a |
| 40 // custom structure is used for the array callbacks. | 40 // custom structure is used for the array callbacks. |
| 41 const CFArrayCallBacks kCertArrayCallbacks = { | 41 const CFArrayCallBacks kCertArrayCallbacks = { |
| 42 0, // version | 42 0, // version |
| 43 RetainWrapper, | 43 RetainWrapper, ReleaseWrapper, CFCopyDescription, OurSecCertificateEqual, |
| 44 ReleaseWrapper, | |
| 45 CFCopyDescription, | |
| 46 OurSecCertificateEqual, | |
| 47 }; | 44 }; |
| 48 | 45 |
| 49 } // namespace | 46 } // namespace |
| 50 | 47 |
| 51 bool TestRootCerts::Add(X509Certificate* certificate) { | 48 bool TestRootCerts::Add(X509Certificate* certificate) { |
| 52 if (CFArrayContainsValue(temporary_roots_, | 49 if (CFArrayContainsValue(temporary_roots_, |
| 53 CFRangeMake(0, CFArrayGetCount(temporary_roots_)), | 50 CFRangeMake(0, CFArrayGetCount(temporary_roots_)), |
| 54 certificate->os_cert_handle())) | 51 certificate->os_cert_handle())) |
| 55 return true; | 52 return true; |
| 56 CFArrayAppendValue(temporary_roots_, certificate->os_cert_handle()); | 53 CFArrayAppendValue(temporary_roots_, certificate->os_cert_handle()); |
| 57 return true; | 54 return true; |
| 58 } | 55 } |
| 59 | 56 |
| 60 void TestRootCerts::Clear() { | 57 void TestRootCerts::Clear() { |
| 61 CFArrayRemoveAllValues(temporary_roots_); | 58 CFArrayRemoveAllValues(temporary_roots_); |
| 62 } | 59 } |
| 63 | 60 |
| 64 bool TestRootCerts::IsEmpty() const { | 61 bool TestRootCerts::IsEmpty() const { |
| 65 return CFArrayGetCount(temporary_roots_) == 0; | 62 return CFArrayGetCount(temporary_roots_) == 0; |
| 66 } | 63 } |
| 67 | 64 |
| 68 OSStatus TestRootCerts::FixupSecTrustRef(SecTrustRef trust_ref) const { | 65 OSStatus TestRootCerts::FixupSecTrustRef(SecTrustRef trust_ref) const { |
| 69 if (IsEmpty()) | 66 if (IsEmpty()) |
| 70 return noErr; | 67 return noErr; |
| 71 | 68 |
| 72 // Despite SecTrustSetAnchorCertificatesOnly existing in OS X 10.6, and | 69 // Despite SecTrustSetAnchorCertificatesOnly existing in OS X 10.6, and |
| 73 // being documented as available, it is not actually implemented. On 10.7+, | 70 // being documented as available, it is not actually implemented. On 10.7+, |
| 74 // however, it always works. | 71 // however, it always works. |
| 75 if (base::mac::IsOSLionOrLater()) { | 72 if (base::mac::IsOSLionOrLater()) { |
| 76 OSStatus status = SecTrustSetAnchorCertificates(trust_ref, | 73 OSStatus status = |
| 77 temporary_roots_); | 74 SecTrustSetAnchorCertificates(trust_ref, temporary_roots_); |
| 78 if (status) | 75 if (status) |
| 79 return status; | 76 return status; |
| 80 return SecTrustSetAnchorCertificatesOnly(trust_ref, !allow_system_trust_); | 77 return SecTrustSetAnchorCertificatesOnly(trust_ref, !allow_system_trust_); |
| 81 } | 78 } |
| 82 | 79 |
| 83 if (!allow_system_trust_) { | 80 if (!allow_system_trust_) { |
| 84 // Avoid any copying if system roots are not to be trusted. This acts as | 81 // Avoid any copying if system roots are not to be trusted. This acts as |
| 85 // an exclusive list on 10.6, replacing the built-ins. | 82 // an exclusive list on 10.6, replacing the built-ins. |
| 86 return SecTrustSetAnchorCertificates(trust_ref, temporary_roots_); | 83 return SecTrustSetAnchorCertificates(trust_ref, temporary_roots_); |
| 87 } | 84 } |
| 88 | 85 |
| 89 // Otherwise, both system trust and temporary_roots_ must be trusted. | 86 // Otherwise, both system trust and temporary_roots_ must be trusted. |
| 90 // Emulate the functionality of SecTrustSetAnchorCertificatesOnly by | 87 // Emulate the functionality of SecTrustSetAnchorCertificatesOnly by |
| 91 // creating a copy of the system roots and merging with temporary_roots_. | 88 // creating a copy of the system roots and merging with temporary_roots_. |
| 92 CFArrayRef system_roots = NULL; | 89 CFArrayRef system_roots = NULL; |
| 93 OSStatus status = SecTrustCopyAnchorCertificates(&system_roots); | 90 OSStatus status = SecTrustCopyAnchorCertificates(&system_roots); |
| 94 if (status) | 91 if (status) |
| 95 return status; | 92 return status; |
| 96 | 93 |
| 97 base::ScopedCFTypeRef<CFArrayRef> scoped_system_roots(system_roots); | 94 base::ScopedCFTypeRef<CFArrayRef> scoped_system_roots(system_roots); |
| 98 base::ScopedCFTypeRef<CFMutableArrayRef> scoped_roots( | 95 base::ScopedCFTypeRef<CFMutableArrayRef> scoped_roots( |
| 99 CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, scoped_system_roots)); | 96 CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, scoped_system_roots)); |
| 100 CFArrayAppendArray(scoped_roots, temporary_roots_, | 97 CFArrayAppendArray(scoped_roots, |
| 98 temporary_roots_, |
| 101 CFRangeMake(0, CFArrayGetCount(temporary_roots_))); | 99 CFRangeMake(0, CFArrayGetCount(temporary_roots_))); |
| 102 return SecTrustSetAnchorCertificates(trust_ref, scoped_roots); | 100 return SecTrustSetAnchorCertificates(trust_ref, scoped_roots); |
| 103 } | 101 } |
| 104 | 102 |
| 105 void TestRootCerts::SetAllowSystemTrust(bool allow_system_trust) { | 103 void TestRootCerts::SetAllowSystemTrust(bool allow_system_trust) { |
| 106 allow_system_trust_ = allow_system_trust; | 104 allow_system_trust_ = allow_system_trust; |
| 107 } | 105 } |
| 108 | 106 |
| 109 TestRootCerts::~TestRootCerts() {} | 107 TestRootCerts::~TestRootCerts() { |
| 108 } |
| 110 | 109 |
| 111 void TestRootCerts::Init() { | 110 void TestRootCerts::Init() { |
| 112 temporary_roots_.reset(CFArrayCreateMutable(kCFAllocatorDefault, 0, | 111 temporary_roots_.reset( |
| 113 &kCertArrayCallbacks)); | 112 CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCertArrayCallbacks)); |
| 114 allow_system_trust_ = true; | 113 allow_system_trust_ = true; |
| 115 } | 114 } |
| 116 | 115 |
| 117 } // namespace net | 116 } // namespace net |
| OLD | NEW |