| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/x509_cert_types.h" | 5 #include "net/cert/x509_cert_types.h" |
| 6 | 6 |
| 7 #include <cstdlib> | 7 #include <cstdlib> |
| 8 #include <cstring> | 8 #include <cstring> |
| 9 | 9 |
| 10 #include "base/logging.h" | 10 #include "base/logging.h" |
| 11 #include "base/strings/string_number_conversions.h" | 11 #include "base/strings/string_number_conversions.h" |
| 12 #include "base/strings/string_piece.h" | 12 #include "base/strings/string_piece.h" |
| 13 #include "base/time/time.h" | 13 #include "base/time/time.h" |
| 14 #include "net/cert/x509_certificate.h" | 14 #include "net/cert/x509_certificate.h" |
| 15 | 15 |
| 16 namespace net { | 16 namespace net { |
| 17 | 17 |
| 18 namespace { | 18 namespace { |
| 19 | 19 |
| 20 // Helper for ParseCertificateDate. |*field| must contain at least | 20 // Helper for ParseCertificateDate. |*field| must contain at least |
| 21 // |field_len| characters. |*field| will be advanced by |field_len| on exit. | 21 // |field_len| characters. |*field| will be advanced by |field_len| on exit. |
| 22 // |*ok| is set to false if there is an error in parsing the number, but left | 22 // |*ok| is set to false if there is an error in parsing the number, but left |
| 23 // untouched otherwise. Returns the parsed integer. | 23 // untouched otherwise. Returns the parsed integer. |
| 24 int ParseIntAndAdvance(const char** field, size_t field_len, bool* ok) { | 24 int ParseIntAndAdvance(const char** field, size_t field_len, bool* ok) { |
| 25 int result = 0; | 25 int result = 0; |
| 26 *ok &= base::StringToInt(base::StringPiece(*field, field_len), &result); | 26 *ok &= base::StringToInt(base::StringPiece(*field, field_len), &result); |
| 27 *field += field_len; | 27 *field += field_len; |
| 28 return result; | 28 return result; |
| 29 } | 29 } |
| 30 | |
| 31 } | 30 } |
| 32 | 31 |
| 33 CertPrincipal::CertPrincipal() { | 32 CertPrincipal::CertPrincipal() { |
| 34 } | 33 } |
| 35 | 34 |
| 36 CertPrincipal::CertPrincipal(const std::string& name) : common_name(name) {} | 35 CertPrincipal::CertPrincipal(const std::string& name) : common_name(name) { |
| 36 } |
| 37 | 37 |
| 38 CertPrincipal::~CertPrincipal() { | 38 CertPrincipal::~CertPrincipal() { |
| 39 } | 39 } |
| 40 | 40 |
| 41 std::string CertPrincipal::GetDisplayName() const { | 41 std::string CertPrincipal::GetDisplayName() const { |
| 42 if (!common_name.empty()) | 42 if (!common_name.empty()) |
| 43 return common_name; | 43 return common_name; |
| 44 if (!organization_names.empty()) | 44 if (!organization_names.empty()) |
| 45 return organization_names[0]; | 45 return organization_names[0]; |
| 46 if (!organization_unit_names.empty()) | 46 if (!organization_unit_names.empty()) |
| 47 return organization_unit_names[0]; | 47 return organization_unit_names[0]; |
| 48 | 48 |
| 49 return std::string(); | 49 return std::string(); |
| 50 } | 50 } |
| 51 | 51 |
| 52 CertPolicy::CertPolicy() { | 52 CertPolicy::CertPolicy() { |
| 53 } | 53 } |
| 54 | 54 |
| 55 CertPolicy::~CertPolicy() { | 55 CertPolicy::~CertPolicy() { |
| 56 } | 56 } |
| 57 | 57 |
| 58 // For a denial, we consider a given |cert| to be a match to a saved denied | 58 // For a denial, we consider a given |cert| to be a match to a saved denied |
| 59 // cert if the |error| intersects with the saved error status. For an | 59 // cert if the |error| intersects with the saved error status. For an |
| 60 // allowance, we consider a given |cert| to be a match to a saved allowed | 60 // allowance, we consider a given |cert| to be a match to a saved allowed |
| 61 // cert if the |error| is an exact match to or subset of the errors in the | 61 // cert if the |error| is an exact match to or subset of the errors in the |
| 62 // saved CertStatus. | 62 // saved CertStatus. |
| 63 CertPolicy::Judgment CertPolicy::Check( | 63 CertPolicy::Judgment CertPolicy::Check(X509Certificate* cert, |
| 64 X509Certificate* cert, CertStatus error) const { | 64 CertStatus error) const { |
| 65 // It shouldn't matter which set we check first, but we check denied first | 65 // It shouldn't matter which set we check first, but we check denied first |
| 66 // in case something strange has happened. | 66 // in case something strange has happened. |
| 67 bool denied = false; | 67 bool denied = false; |
| 68 std::map<SHA1HashValue, CertStatus, SHA1HashValueLessThan>::const_iterator | 68 std::map<SHA1HashValue, CertStatus, SHA1HashValueLessThan>::const_iterator |
| 69 denied_iter = denied_.find(cert->fingerprint()); | 69 denied_iter = denied_.find(cert->fingerprint()); |
| 70 if ((denied_iter != denied_.end()) && (denied_iter->second & error)) | 70 if ((denied_iter != denied_.end()) && (denied_iter->second & error)) |
| 71 denied = true; | 71 denied = true; |
| 72 | 72 |
| 73 std::map<SHA1HashValue, CertStatus, SHA1HashValueLessThan>::const_iterator | 73 std::map<SHA1HashValue, CertStatus, SHA1HashValueLessThan>::const_iterator |
| 74 allowed_iter = allowed_.find(cert->fingerprint()); | 74 allowed_iter = allowed_.find(cert->fingerprint()); |
| 75 if ((allowed_iter != allowed_.end()) && | 75 if ((allowed_iter != allowed_.end()) && (allowed_iter->second & error) && |
| 76 (allowed_iter->second & error) && | |
| 77 !(~(allowed_iter->second & error) ^ ~error)) { | 76 !(~(allowed_iter->second & error) ^ ~error)) { |
| 78 DCHECK(!denied); | 77 DCHECK(!denied); |
| 79 return ALLOWED; | 78 return ALLOWED; |
| 80 } | 79 } |
| 81 | 80 |
| 82 if (denied) | 81 if (denied) |
| 83 return DENIED; | 82 return DENIED; |
| 84 return UNKNOWN; // We don't have a policy for this cert. | 83 return UNKNOWN; // We don't have a policy for this cert. |
| 85 } | 84 } |
| 86 | 85 |
| (...skipping 27 matching lines...) Expand all Loading... |
| 114 base::Time* time) { | 113 base::Time* time) { |
| 115 size_t year_length = format == CERT_DATE_FORMAT_UTC_TIME ? 2 : 4; | 114 size_t year_length = format == CERT_DATE_FORMAT_UTC_TIME ? 2 : 4; |
| 116 | 115 |
| 117 if (raw_date.length() < 11 + year_length) | 116 if (raw_date.length() < 11 + year_length) |
| 118 return false; | 117 return false; |
| 119 | 118 |
| 120 const char* field = raw_date.data(); | 119 const char* field = raw_date.data(); |
| 121 bool valid = true; | 120 bool valid = true; |
| 122 base::Time::Exploded exploded = {0}; | 121 base::Time::Exploded exploded = {0}; |
| 123 | 122 |
| 124 exploded.year = ParseIntAndAdvance(&field, year_length, &valid); | 123 exploded.year = ParseIntAndAdvance(&field, year_length, &valid); |
| 125 exploded.month = ParseIntAndAdvance(&field, 2, &valid); | 124 exploded.month = ParseIntAndAdvance(&field, 2, &valid); |
| 126 exploded.day_of_month = ParseIntAndAdvance(&field, 2, &valid); | 125 exploded.day_of_month = ParseIntAndAdvance(&field, 2, &valid); |
| 127 exploded.hour = ParseIntAndAdvance(&field, 2, &valid); | 126 exploded.hour = ParseIntAndAdvance(&field, 2, &valid); |
| 128 exploded.minute = ParseIntAndAdvance(&field, 2, &valid); | 127 exploded.minute = ParseIntAndAdvance(&field, 2, &valid); |
| 129 exploded.second = ParseIntAndAdvance(&field, 2, &valid); | 128 exploded.second = ParseIntAndAdvance(&field, 2, &valid); |
| 130 if (valid && year_length == 2) | 129 if (valid && year_length == 2) |
| 131 exploded.year += exploded.year < 50 ? 2000 : 1900; | 130 exploded.year += exploded.year < 50 ? 2000 : 1900; |
| 132 | 131 |
| 133 valid &= exploded.HasValidValues(); | 132 valid &= exploded.HasValidValues(); |
| 134 | 133 |
| 135 if (!valid) | 134 if (!valid) |
| 136 return false; | 135 return false; |
| 137 | 136 |
| 138 *time = base::Time::FromUTCExploded(exploded); | 137 *time = base::Time::FromUTCExploded(exploded); |
| 139 return true; | 138 return true; |
| 140 } | 139 } |
| 141 | 140 |
| 142 } // namespace net | 141 } // namespace net |
| OLD | NEW |