OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_CERT_X509_CERTIFICATE_H_ | 5 #ifndef NET_CERT_X509_CERTIFICATE_H_ |
6 #define NET_CERT_X509_CERTIFICATE_H_ | 6 #define NET_CERT_X509_CERTIFICATE_H_ |
7 | 7 |
8 #include <string.h> | 8 #include <string.h> |
9 | 9 |
10 #include <string> | 10 #include <string> |
(...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
44 | 44 |
45 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; | 45 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; |
46 | 46 |
47 // X509Certificate represents a X.509 certificate, which is comprised a | 47 // X509Certificate represents a X.509 certificate, which is comprised a |
48 // particular identity or end-entity certificate, such as an SSL server | 48 // particular identity or end-entity certificate, such as an SSL server |
49 // identity or an SSL client certificate, and zero or more intermediate | 49 // identity or an SSL client certificate, and zero or more intermediate |
50 // certificates that may be used to build a path to a root certificate. | 50 // certificates that may be used to build a path to a root certificate. |
51 class NET_EXPORT X509Certificate | 51 class NET_EXPORT X509Certificate |
52 : public base::RefCountedThreadSafe<X509Certificate> { | 52 : public base::RefCountedThreadSafe<X509Certificate> { |
53 public: | 53 public: |
54 // An OSCertHandle is a handle to a certificate object in the underlying | 54 // An OSCertHandle is a handle to a certificate object in the underlying |
55 // crypto library. We assume that OSCertHandle is a pointer type on all | 55 // crypto library. We assume that OSCertHandle is a pointer type on all |
56 // platforms and that NULL represents an invalid OSCertHandle. | 56 // platforms and that NULL represents an invalid OSCertHandle. |
57 #if defined(OS_WIN) | 57 #if defined(OS_WIN) |
58 typedef PCCERT_CONTEXT OSCertHandle; | 58 typedef PCCERT_CONTEXT OSCertHandle; |
59 #elif defined(OS_MACOSX) | 59 #elif defined(OS_MACOSX) |
60 typedef SecCertificateRef OSCertHandle; | 60 typedef SecCertificateRef OSCertHandle; |
61 #elif defined(USE_OPENSSL_CERTS) | 61 #elif defined(USE_OPENSSL_CERTS) |
62 typedef X509* OSCertHandle; | 62 typedef X509* OSCertHandle; |
63 #elif defined(USE_NSS) | 63 #elif defined(USE_NSS) |
64 typedef struct CERTCertificateStr* OSCertHandle; | 64 typedef struct CERTCertificateStr* OSCertHandle; |
65 #else | 65 #else |
66 // TODO(ericroman): not implemented | 66 // TODO(ericroman): not implemented |
(...skipping 29 matching lines...) Expand all Loading... |
96 // All PEM blocks will be parsed, until the first error is encountered. | 96 // All PEM blocks will be parsed, until the first error is encountered. |
97 FORMAT_PEM_CERT_SEQUENCE = 1 << 1, | 97 FORMAT_PEM_CERT_SEQUENCE = 1 << 1, |
98 | 98 |
99 // The data contains a PKCS#7 SignedData structure, whose certificates | 99 // The data contains a PKCS#7 SignedData structure, whose certificates |
100 // member is to be used to initialize the certificate and intermediates. | 100 // member is to be used to initialize the certificate and intermediates. |
101 // The data may further be encoded using PEM, specifying block names of | 101 // The data may further be encoded using PEM, specifying block names of |
102 // either "PKCS7" or "CERTIFICATE". | 102 // either "PKCS7" or "CERTIFICATE". |
103 FORMAT_PKCS7 = 1 << 2, | 103 FORMAT_PKCS7 = 1 << 2, |
104 | 104 |
105 // Automatically detect the format. | 105 // Automatically detect the format. |
106 FORMAT_AUTO = FORMAT_SINGLE_CERTIFICATE | FORMAT_PEM_CERT_SEQUENCE | | 106 FORMAT_AUTO = |
107 FORMAT_PKCS7, | 107 FORMAT_SINGLE_CERTIFICATE | FORMAT_PEM_CERT_SEQUENCE | FORMAT_PKCS7, |
108 }; | 108 }; |
109 | 109 |
110 // PickleType is intended for deserializing certificates that were pickled | 110 // PickleType is intended for deserializing certificates that were pickled |
111 // by previous releases as part of a net::HttpResponseInfo. | 111 // by previous releases as part of a net::HttpResponseInfo. |
112 // When serializing certificates to a new Pickle, | 112 // When serializing certificates to a new Pickle, |
113 // PICKLETYPE_CERTIFICATE_CHAIN_V3 is always used. | 113 // PICKLETYPE_CERTIFICATE_CHAIN_V3 is always used. |
114 enum PickleType { | 114 enum PickleType { |
115 // When reading a certificate from a Pickle, the Pickle only contains a | 115 // When reading a certificate from a Pickle, the Pickle only contains a |
116 // single certificate. | 116 // single certificate. |
117 PICKLETYPE_SINGLE_CERTIFICATE, | 117 PICKLETYPE_SINGLE_CERTIFICATE, |
118 | 118 |
119 // When reading a certificate from a Pickle, the Pickle contains the | 119 // When reading a certificate from a Pickle, the Pickle contains the |
120 // the certificate plus any certificates that were stored in | 120 // the certificate plus any certificates that were stored in |
121 // |intermediate_ca_certificates_| at the time it was serialized. | 121 // |intermediate_ca_certificates_| at the time it was serialized. |
122 // The count of certificates is stored as a size_t, which is either 32 | 122 // The count of certificates is stored as a size_t, which is either 32 |
123 // or 64 bits. | 123 // or 64 bits. |
124 PICKLETYPE_CERTIFICATE_CHAIN_V2, | 124 PICKLETYPE_CERTIFICATE_CHAIN_V2, |
125 | 125 |
126 // The Pickle contains the certificate and any certificates that were | 126 // The Pickle contains the certificate and any certificates that were |
127 // stored in |intermediate_ca_certs_| at the time it was serialized. | 127 // stored in |intermediate_ca_certs_| at the time it was serialized. |
128 // The format is [int count], [data - this certificate], | 128 // The format is [int count], [data - this certificate], |
129 // [data - intermediate1], ... [data - intermediateN]. | 129 // [data - intermediate1], ... [data - intermediateN]. |
130 // All certificates are stored in DER form. | 130 // All certificates are stored in DER form. |
131 PICKLETYPE_CERTIFICATE_CHAIN_V3, | 131 PICKLETYPE_CERTIFICATE_CHAIN_V3, |
132 }; | 132 }; |
133 | 133 |
134 // Creates a X509Certificate from the ground up. Used by tests that simulate | 134 // Creates a X509Certificate from the ground up. Used by tests that simulate |
135 // SSL connections. | 135 // SSL connections. |
136 X509Certificate(const std::string& subject, const std::string& issuer, | 136 X509Certificate(const std::string& subject, |
137 base::Time start_date, base::Time expiration_date); | 137 const std::string& issuer, |
| 138 base::Time start_date, |
| 139 base::Time expiration_date); |
138 | 140 |
139 // Create an X509Certificate from a handle to the certificate object in the | 141 // Create an X509Certificate from a handle to the certificate object in the |
140 // underlying crypto library. The returned pointer must be stored in a | 142 // underlying crypto library. The returned pointer must be stored in a |
141 // scoped_refptr<X509Certificate>. | 143 // scoped_refptr<X509Certificate>. |
142 static X509Certificate* CreateFromHandle(OSCertHandle cert_handle, | 144 static X509Certificate* CreateFromHandle(OSCertHandle cert_handle, |
143 const OSCertHandles& intermediates); | 145 const OSCertHandles& intermediates); |
144 | 146 |
145 // Create an X509Certificate from a chain of DER encoded certificates. The | 147 // Create an X509Certificate from a chain of DER encoded certificates. The |
146 // first certificate in the chain is the end-entity certificate to which a | 148 // first certificate in the chain is the end-entity certificate to which a |
147 // handle is returned. The other certificates in the chain are intermediate | 149 // handle is returned. The other certificates in the chain are intermediate |
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
211 // the |valid_expiry| date. | 213 // the |valid_expiry| date. |
212 // If we were unable to parse either date from the certificate (or if the cert | 214 // If we were unable to parse either date from the certificate (or if the cert |
213 // lacks either date), the date will be null (i.e., is_null() will be true). | 215 // lacks either date), the date will be null (i.e., is_null() will be true). |
214 const base::Time& valid_start() const { return valid_start_; } | 216 const base::Time& valid_start() const { return valid_start_; } |
215 const base::Time& valid_expiry() const { return valid_expiry_; } | 217 const base::Time& valid_expiry() const { return valid_expiry_; } |
216 | 218 |
217 // The fingerprint of this certificate. | 219 // The fingerprint of this certificate. |
218 const SHA1HashValue& fingerprint() const { return fingerprint_; } | 220 const SHA1HashValue& fingerprint() const { return fingerprint_; } |
219 | 221 |
220 // The fingerprint of the intermediate CA certificates. | 222 // The fingerprint of the intermediate CA certificates. |
221 const SHA1HashValue& ca_fingerprint() const { | 223 const SHA1HashValue& ca_fingerprint() const { return ca_fingerprint_; } |
222 return ca_fingerprint_; | |
223 } | |
224 | 224 |
225 // Gets the DNS names in the certificate. Pursuant to RFC 2818, Section 3.1 | 225 // Gets the DNS names in the certificate. Pursuant to RFC 2818, Section 3.1 |
226 // Server Identity, if the certificate has a subjectAltName extension of | 226 // Server Identity, if the certificate has a subjectAltName extension of |
227 // type dNSName, this method gets the DNS names in that extension. | 227 // type dNSName, this method gets the DNS names in that extension. |
228 // Otherwise, it gets the common name in the subject field. | 228 // Otherwise, it gets the common name in the subject field. |
229 void GetDNSNames(std::vector<std::string>* dns_names) const; | 229 void GetDNSNames(std::vector<std::string>* dns_names) const; |
230 | 230 |
231 // Gets the subjectAltName extension field from the certificate, if any. | 231 // Gets the subjectAltName extension field from the certificate, if any. |
232 // For future extension; currently this only returns those name types that | 232 // For future extension; currently this only returns those name types that |
233 // are required for HTTP certificate name verification - see VerifyHostname. | 233 // are required for HTTP certificate name verification - see VerifyHostname. |
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
314 // Does not verify that the certificate is valid, only that the certificate | 314 // Does not verify that the certificate is valid, only that the certificate |
315 // matches this host. | 315 // matches this host. |
316 // Returns true if it matches, and updates |*common_name_fallback_used|, | 316 // Returns true if it matches, and updates |*common_name_fallback_used|, |
317 // setting it to true if a fallback to the CN was used, rather than | 317 // setting it to true if a fallback to the CN was used, rather than |
318 // subjectAltName. | 318 // subjectAltName. |
319 bool VerifyNameMatch(const std::string& hostname, | 319 bool VerifyNameMatch(const std::string& hostname, |
320 bool* common_name_fallback_used) const; | 320 bool* common_name_fallback_used) const; |
321 | 321 |
322 // Obtains the DER encoded certificate data for |cert_handle|. On success, | 322 // Obtains the DER encoded certificate data for |cert_handle|. On success, |
323 // returns true and writes the DER encoded certificate to |*der_encoded|. | 323 // returns true and writes the DER encoded certificate to |*der_encoded|. |
324 static bool GetDEREncoded(OSCertHandle cert_handle, | 324 static bool GetDEREncoded(OSCertHandle cert_handle, std::string* der_encoded); |
325 std::string* der_encoded); | |
326 | 325 |
327 // Returns the PEM encoded data from a DER encoded certificate. If the return | 326 // Returns the PEM encoded data from a DER encoded certificate. If the return |
328 // value is true, then the PEM encoded certificate is written to | 327 // value is true, then the PEM encoded certificate is written to |
329 // |pem_encoded|. | 328 // |pem_encoded|. |
330 static bool GetPEMEncodedFromDER(const std::string& der_encoded, | 329 static bool GetPEMEncodedFromDER(const std::string& der_encoded, |
331 std::string* pem_encoded); | 330 std::string* pem_encoded); |
332 | 331 |
333 // Returns the PEM encoded data from an OSCertHandle. If the return value is | 332 // Returns the PEM encoded data from an OSCertHandle. If the return value is |
334 // true, then the PEM encoded certificate is written to |pem_encoded|. | 333 // true, then the PEM encoded certificate is written to |pem_encoded|. |
335 static bool GetPEMEncoded(OSCertHandle cert_handle, | 334 static bool GetPEMEncoded(OSCertHandle cert_handle, std::string* pem_encoded); |
336 std::string* pem_encoded); | |
337 | 335 |
338 // Encodes the entire certificate chain (this certificate and any | 336 // Encodes the entire certificate chain (this certificate and any |
339 // intermediate certificates stored in |intermediate_ca_certs_|) as a series | 337 // intermediate certificates stored in |intermediate_ca_certs_|) as a series |
340 // of PEM encoded strings. Returns true if all certificates were encoded, | 338 // of PEM encoded strings. Returns true if all certificates were encoded, |
341 // storig the result in |*pem_encoded|, with this certificate stored as | 339 // storig the result in |*pem_encoded|, with this certificate stored as |
342 // the first element. | 340 // the first element. |
343 bool GetPEMEncodedChain(std::vector<std::string>* pem_encoded) const; | 341 bool GetPEMEncodedChain(std::vector<std::string>* pem_encoded) const; |
344 | 342 |
345 // Sets |*size_bits| to be the length of the public key in bits, and sets | 343 // Sets |*size_bits| to be the length of the public key in bits, and sets |
346 // |*type| to one of the |PublicKeyType| values. In case of | 344 // |*type| to one of the |PublicKeyType| values. In case of |
347 // |kPublicKeyTypeUnknown|, |*size_bits| will be set to 0. | 345 // |kPublicKeyTypeUnknown|, |*size_bits| will be set to 0. |
348 static void GetPublicKeyInfo(OSCertHandle cert_handle, | 346 static void GetPublicKeyInfo(OSCertHandle cert_handle, |
349 size_t* size_bits, | 347 size_t* size_bits, |
350 PublicKeyType* type); | 348 PublicKeyType* type); |
351 | 349 |
352 // Returns the OSCertHandle of this object. Because of caching, this may | 350 // Returns the OSCertHandle of this object. Because of caching, this may |
353 // differ from the OSCertHandle originally supplied during initialization. | 351 // differ from the OSCertHandle originally supplied during initialization. |
354 // Note: On Windows, CryptoAPI may return unexpected results if this handle | 352 // Note: On Windows, CryptoAPI may return unexpected results if this handle |
355 // is used across multiple threads. For more details, see | 353 // is used across multiple threads. For more details, see |
356 // CreateOSCertChainForCert(). | 354 // CreateOSCertChainForCert(). |
357 OSCertHandle os_cert_handle() const { return cert_handle_; } | 355 OSCertHandle os_cert_handle() const { return cert_handle_; } |
358 | 356 |
359 // Returns true if two OSCertHandles refer to identical certificates. | 357 // Returns true if two OSCertHandles refer to identical certificates. |
360 static bool IsSameOSCert(OSCertHandle a, OSCertHandle b); | 358 static bool IsSameOSCert(OSCertHandle a, OSCertHandle b); |
361 | 359 |
362 // Creates an OS certificate handle from the DER-encoded representation. | 360 // Creates an OS certificate handle from the DER-encoded representation. |
363 // Returns NULL on failure. | 361 // Returns NULL on failure. |
364 static OSCertHandle CreateOSCertHandleFromBytes(const char* data, | 362 static OSCertHandle CreateOSCertHandleFromBytes(const char* data, int length); |
365 int length); | |
366 | 363 |
367 #if defined(USE_NSS) | 364 #if defined(USE_NSS) |
368 // Creates an OS certificate handle from the DER-encoded representation. | 365 // Creates an OS certificate handle from the DER-encoded representation. |
369 // Returns NULL on failure. Sets the default nickname if |nickname| is | 366 // Returns NULL on failure. Sets the default nickname if |nickname| is |
370 // non-NULL. | 367 // non-NULL. |
371 static OSCertHandle CreateOSCertHandleFromBytesWithNickname( | 368 static OSCertHandle CreateOSCertHandleFromBytesWithNickname( |
372 const char* data, | 369 const char* data, |
373 int length, | 370 int length, |
374 const char* nickname); | 371 const char* nickname); |
375 #endif | 372 #endif |
376 | 373 |
377 // Creates all possible OS certificate handles from |data| encoded in a | 374 // Creates all possible OS certificate handles from |data| encoded in a |
378 // specific |format|. Returns an empty collection on failure. | 375 // specific |format|. Returns an empty collection on failure. |
379 static OSCertHandles CreateOSCertHandlesFromBytes( | 376 static OSCertHandles CreateOSCertHandlesFromBytes(const char* data, |
380 const char* data, | 377 int length, |
381 int length, | 378 Format format); |
382 Format format); | |
383 | 379 |
384 // Duplicates (or adds a reference to) an OS certificate handle. | 380 // Duplicates (or adds a reference to) an OS certificate handle. |
385 static OSCertHandle DupOSCertHandle(OSCertHandle cert_handle); | 381 static OSCertHandle DupOSCertHandle(OSCertHandle cert_handle); |
386 | 382 |
387 // Frees (or releases a reference to) an OS certificate handle. | 383 // Frees (or releases a reference to) an OS certificate handle. |
388 static void FreeOSCertHandle(OSCertHandle cert_handle); | 384 static void FreeOSCertHandle(OSCertHandle cert_handle); |
389 | 385 |
390 // Calculates the SHA-1 fingerprint of the certificate. Returns an empty | 386 // Calculates the SHA-1 fingerprint of the certificate. Returns an empty |
391 // (all zero) fingerprint on failure. | 387 // (all zero) fingerprint on failure. |
392 static SHA1HashValue CalculateFingerprint(OSCertHandle cert_handle); | 388 static SHA1HashValue CalculateFingerprint(OSCertHandle cert_handle); |
393 | 389 |
394 // Calculates the SHA-1 fingerprint of the intermediate CA certificates. | 390 // Calculates the SHA-1 fingerprint of the intermediate CA certificates. |
395 // Returns an empty (all zero) fingerprint on failure. | 391 // Returns an empty (all zero) fingerprint on failure. |
396 static SHA1HashValue CalculateCAFingerprint( | 392 static SHA1HashValue CalculateCAFingerprint( |
397 const OSCertHandles& intermediates); | 393 const OSCertHandles& intermediates); |
398 | 394 |
399 private: | 395 private: |
400 friend class base::RefCountedThreadSafe<X509Certificate>; | 396 friend class base::RefCountedThreadSafe<X509Certificate>; |
401 friend class TestRootCerts; // For unit tests | 397 friend class TestRootCerts; // For unit tests |
402 | 398 |
403 FRIEND_TEST_ALL_PREFIXES(X509CertificateNameVerifyTest, VerifyHostname); | 399 FRIEND_TEST_ALL_PREFIXES(X509CertificateNameVerifyTest, VerifyHostname); |
404 FRIEND_TEST_ALL_PREFIXES(X509CertificateTest, SerialNumbers); | 400 FRIEND_TEST_ALL_PREFIXES(X509CertificateTest, SerialNumbers); |
405 | 401 |
406 // Construct an X509Certificate from a handle to the certificate object | 402 // Construct an X509Certificate from a handle to the certificate object |
407 // in the underlying crypto library. | 403 // in the underlying crypto library. |
408 X509Certificate(OSCertHandle cert_handle, | 404 X509Certificate(OSCertHandle cert_handle, const OSCertHandles& intermediates); |
409 const OSCertHandles& intermediates); | |
410 | 405 |
411 ~X509Certificate(); | 406 ~X509Certificate(); |
412 | 407 |
413 // Common object initialization code. Called by the constructors only. | 408 // Common object initialization code. Called by the constructors only. |
414 void Initialize(); | 409 void Initialize(); |
415 | 410 |
416 #if defined(USE_OPENSSL_CERTS) | 411 #if defined(USE_OPENSSL_CERTS) |
417 // Resets the store returned by cert_store() to default state. Used by | 412 // Resets the store returned by cert_store() to default state. Used by |
418 // TestRootCerts to undo modifications. | 413 // TestRootCerts to undo modifications. |
419 static void ResetCertStore(); | 414 static void ResetCertStore(); |
(...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
485 // based on the type of the certificate. | 480 // based on the type of the certificate. |
486 std::string default_nickname_; | 481 std::string default_nickname_; |
487 #endif | 482 #endif |
488 | 483 |
489 DISALLOW_COPY_AND_ASSIGN(X509Certificate); | 484 DISALLOW_COPY_AND_ASSIGN(X509Certificate); |
490 }; | 485 }; |
491 | 486 |
492 } // namespace net | 487 } // namespace net |
493 | 488 |
494 #endif // NET_CERT_X509_CERTIFICATE_H_ | 489 #endif // NET_CERT_X509_CERTIFICATE_H_ |
OLD | NEW |