OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/x509_cert_types.h" | 5 #include "net/cert/x509_cert_types.h" |
6 | 6 |
7 #include <cstdlib> | 7 #include <cstdlib> |
8 #include <cstring> | 8 #include <cstring> |
9 | 9 |
10 #include "base/logging.h" | 10 #include "base/logging.h" |
11 #include "base/strings/string_number_conversions.h" | 11 #include "base/strings/string_number_conversions.h" |
12 #include "base/strings/string_piece.h" | 12 #include "base/strings/string_piece.h" |
13 #include "base/time/time.h" | 13 #include "base/time/time.h" |
14 #include "net/cert/x509_certificate.h" | 14 #include "net/cert/x509_certificate.h" |
15 | 15 |
16 namespace net { | 16 namespace net { |
17 | 17 |
18 namespace { | 18 namespace { |
19 | 19 |
20 // Helper for ParseCertificateDate. |*field| must contain at least | 20 // Helper for ParseCertificateDate. |*field| must contain at least |
21 // |field_len| characters. |*field| will be advanced by |field_len| on exit. | 21 // |field_len| characters. |*field| will be advanced by |field_len| on exit. |
22 // |*ok| is set to false if there is an error in parsing the number, but left | 22 // |*ok| is set to false if there is an error in parsing the number, but left |
23 // untouched otherwise. Returns the parsed integer. | 23 // untouched otherwise. Returns the parsed integer. |
24 int ParseIntAndAdvance(const char** field, size_t field_len, bool* ok) { | 24 int ParseIntAndAdvance(const char** field, size_t field_len, bool* ok) { |
25 int result = 0; | 25 int result = 0; |
26 *ok &= base::StringToInt(base::StringPiece(*field, field_len), &result); | 26 *ok &= base::StringToInt(base::StringPiece(*field, field_len), &result); |
27 *field += field_len; | 27 *field += field_len; |
28 return result; | 28 return result; |
29 } | 29 } |
30 | |
31 } | 30 } |
32 | 31 |
33 CertPrincipal::CertPrincipal() { | 32 CertPrincipal::CertPrincipal() { |
34 } | 33 } |
35 | 34 |
36 CertPrincipal::CertPrincipal(const std::string& name) : common_name(name) {} | 35 CertPrincipal::CertPrincipal(const std::string& name) : common_name(name) { |
| 36 } |
37 | 37 |
38 CertPrincipal::~CertPrincipal() { | 38 CertPrincipal::~CertPrincipal() { |
39 } | 39 } |
40 | 40 |
41 std::string CertPrincipal::GetDisplayName() const { | 41 std::string CertPrincipal::GetDisplayName() const { |
42 if (!common_name.empty()) | 42 if (!common_name.empty()) |
43 return common_name; | 43 return common_name; |
44 if (!organization_names.empty()) | 44 if (!organization_names.empty()) |
45 return organization_names[0]; | 45 return organization_names[0]; |
46 if (!organization_unit_names.empty()) | 46 if (!organization_unit_names.empty()) |
47 return organization_unit_names[0]; | 47 return organization_unit_names[0]; |
48 | 48 |
49 return std::string(); | 49 return std::string(); |
50 } | 50 } |
51 | 51 |
52 CertPolicy::CertPolicy() { | 52 CertPolicy::CertPolicy() { |
53 } | 53 } |
54 | 54 |
55 CertPolicy::~CertPolicy() { | 55 CertPolicy::~CertPolicy() { |
56 } | 56 } |
57 | 57 |
58 // For a denial, we consider a given |cert| to be a match to a saved denied | 58 // For a denial, we consider a given |cert| to be a match to a saved denied |
59 // cert if the |error| intersects with the saved error status. For an | 59 // cert if the |error| intersects with the saved error status. For an |
60 // allowance, we consider a given |cert| to be a match to a saved allowed | 60 // allowance, we consider a given |cert| to be a match to a saved allowed |
61 // cert if the |error| is an exact match to or subset of the errors in the | 61 // cert if the |error| is an exact match to or subset of the errors in the |
62 // saved CertStatus. | 62 // saved CertStatus. |
63 CertPolicy::Judgment CertPolicy::Check( | 63 CertPolicy::Judgment CertPolicy::Check(X509Certificate* cert, |
64 X509Certificate* cert, CertStatus error) const { | 64 CertStatus error) const { |
65 // It shouldn't matter which set we check first, but we check denied first | 65 // It shouldn't matter which set we check first, but we check denied first |
66 // in case something strange has happened. | 66 // in case something strange has happened. |
67 bool denied = false; | 67 bool denied = false; |
68 std::map<SHA1HashValue, CertStatus, SHA1HashValueLessThan>::const_iterator | 68 std::map<SHA1HashValue, CertStatus, SHA1HashValueLessThan>::const_iterator |
69 denied_iter = denied_.find(cert->fingerprint()); | 69 denied_iter = denied_.find(cert->fingerprint()); |
70 if ((denied_iter != denied_.end()) && (denied_iter->second & error)) | 70 if ((denied_iter != denied_.end()) && (denied_iter->second & error)) |
71 denied = true; | 71 denied = true; |
72 | 72 |
73 std::map<SHA1HashValue, CertStatus, SHA1HashValueLessThan>::const_iterator | 73 std::map<SHA1HashValue, CertStatus, SHA1HashValueLessThan>::const_iterator |
74 allowed_iter = allowed_.find(cert->fingerprint()); | 74 allowed_iter = allowed_.find(cert->fingerprint()); |
75 if ((allowed_iter != allowed_.end()) && | 75 if ((allowed_iter != allowed_.end()) && (allowed_iter->second & error) && |
76 (allowed_iter->second & error) && | |
77 !(~(allowed_iter->second & error) ^ ~error)) { | 76 !(~(allowed_iter->second & error) ^ ~error)) { |
78 DCHECK(!denied); | 77 DCHECK(!denied); |
79 return ALLOWED; | 78 return ALLOWED; |
80 } | 79 } |
81 | 80 |
82 if (denied) | 81 if (denied) |
83 return DENIED; | 82 return DENIED; |
84 return UNKNOWN; // We don't have a policy for this cert. | 83 return UNKNOWN; // We don't have a policy for this cert. |
85 } | 84 } |
86 | 85 |
(...skipping 27 matching lines...) Expand all Loading... |
114 base::Time* time) { | 113 base::Time* time) { |
115 size_t year_length = format == CERT_DATE_FORMAT_UTC_TIME ? 2 : 4; | 114 size_t year_length = format == CERT_DATE_FORMAT_UTC_TIME ? 2 : 4; |
116 | 115 |
117 if (raw_date.length() < 11 + year_length) | 116 if (raw_date.length() < 11 + year_length) |
118 return false; | 117 return false; |
119 | 118 |
120 const char* field = raw_date.data(); | 119 const char* field = raw_date.data(); |
121 bool valid = true; | 120 bool valid = true; |
122 base::Time::Exploded exploded = {0}; | 121 base::Time::Exploded exploded = {0}; |
123 | 122 |
124 exploded.year = ParseIntAndAdvance(&field, year_length, &valid); | 123 exploded.year = ParseIntAndAdvance(&field, year_length, &valid); |
125 exploded.month = ParseIntAndAdvance(&field, 2, &valid); | 124 exploded.month = ParseIntAndAdvance(&field, 2, &valid); |
126 exploded.day_of_month = ParseIntAndAdvance(&field, 2, &valid); | 125 exploded.day_of_month = ParseIntAndAdvance(&field, 2, &valid); |
127 exploded.hour = ParseIntAndAdvance(&field, 2, &valid); | 126 exploded.hour = ParseIntAndAdvance(&field, 2, &valid); |
128 exploded.minute = ParseIntAndAdvance(&field, 2, &valid); | 127 exploded.minute = ParseIntAndAdvance(&field, 2, &valid); |
129 exploded.second = ParseIntAndAdvance(&field, 2, &valid); | 128 exploded.second = ParseIntAndAdvance(&field, 2, &valid); |
130 if (valid && year_length == 2) | 129 if (valid && year_length == 2) |
131 exploded.year += exploded.year < 50 ? 2000 : 1900; | 130 exploded.year += exploded.year < 50 ? 2000 : 1900; |
132 | 131 |
133 valid &= exploded.HasValidValues(); | 132 valid &= exploded.HasValidValues(); |
134 | 133 |
135 if (!valid) | 134 if (!valid) |
136 return false; | 135 return false; |
137 | 136 |
138 *time = base::Time::FromUTCExploded(exploded); | 137 *time = base::Time::FromUTCExploded(exploded); |
139 return true; | 138 return true; |
140 } | 139 } |
141 | 140 |
142 } // namespace net | 141 } // namespace net |
OLD | NEW |