Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(259)

Side by Side Diff: net/cert/x509_certificate.h

Issue 266243004: Clang format slam. Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef NET_CERT_X509_CERTIFICATE_H_ 5 #ifndef NET_CERT_X509_CERTIFICATE_H_
6 #define NET_CERT_X509_CERTIFICATE_H_ 6 #define NET_CERT_X509_CERTIFICATE_H_
7 7
8 #include <string.h> 8 #include <string.h>
9 9
10 #include <string> 10 #include <string>
(...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after
44 44
45 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; 45 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
46 46
47 // X509Certificate represents a X.509 certificate, which is comprised a 47 // X509Certificate represents a X.509 certificate, which is comprised a
48 // particular identity or end-entity certificate, such as an SSL server 48 // particular identity or end-entity certificate, such as an SSL server
49 // identity or an SSL client certificate, and zero or more intermediate 49 // identity or an SSL client certificate, and zero or more intermediate
50 // certificates that may be used to build a path to a root certificate. 50 // certificates that may be used to build a path to a root certificate.
51 class NET_EXPORT X509Certificate 51 class NET_EXPORT X509Certificate
52 : public base::RefCountedThreadSafe<X509Certificate> { 52 : public base::RefCountedThreadSafe<X509Certificate> {
53 public: 53 public:
54 // An OSCertHandle is a handle to a certificate object in the underlying 54 // An OSCertHandle is a handle to a certificate object in the underlying
55 // crypto library. We assume that OSCertHandle is a pointer type on all 55 // crypto library. We assume that OSCertHandle is a pointer type on all
56 // platforms and that NULL represents an invalid OSCertHandle. 56 // platforms and that NULL represents an invalid OSCertHandle.
57 #if defined(OS_WIN) 57 #if defined(OS_WIN)
58 typedef PCCERT_CONTEXT OSCertHandle; 58 typedef PCCERT_CONTEXT OSCertHandle;
59 #elif defined(OS_MACOSX) 59 #elif defined(OS_MACOSX)
60 typedef SecCertificateRef OSCertHandle; 60 typedef SecCertificateRef OSCertHandle;
61 #elif defined(USE_OPENSSL_CERTS) 61 #elif defined(USE_OPENSSL_CERTS)
62 typedef X509* OSCertHandle; 62 typedef X509* OSCertHandle;
63 #elif defined(USE_NSS) 63 #elif defined(USE_NSS)
64 typedef struct CERTCertificateStr* OSCertHandle; 64 typedef struct CERTCertificateStr* OSCertHandle;
65 #else 65 #else
66 // TODO(ericroman): not implemented 66 // TODO(ericroman): not implemented
(...skipping 29 matching lines...) Expand all
96 // All PEM blocks will be parsed, until the first error is encountered. 96 // All PEM blocks will be parsed, until the first error is encountered.
97 FORMAT_PEM_CERT_SEQUENCE = 1 << 1, 97 FORMAT_PEM_CERT_SEQUENCE = 1 << 1,
98 98
99 // The data contains a PKCS#7 SignedData structure, whose certificates 99 // The data contains a PKCS#7 SignedData structure, whose certificates
100 // member is to be used to initialize the certificate and intermediates. 100 // member is to be used to initialize the certificate and intermediates.
101 // The data may further be encoded using PEM, specifying block names of 101 // The data may further be encoded using PEM, specifying block names of
102 // either "PKCS7" or "CERTIFICATE". 102 // either "PKCS7" or "CERTIFICATE".
103 FORMAT_PKCS7 = 1 << 2, 103 FORMAT_PKCS7 = 1 << 2,
104 104
105 // Automatically detect the format. 105 // Automatically detect the format.
106 FORMAT_AUTO = FORMAT_SINGLE_CERTIFICATE | FORMAT_PEM_CERT_SEQUENCE | 106 FORMAT_AUTO =
107 FORMAT_PKCS7, 107 FORMAT_SINGLE_CERTIFICATE | FORMAT_PEM_CERT_SEQUENCE | FORMAT_PKCS7,
108 }; 108 };
109 109
110 // PickleType is intended for deserializing certificates that were pickled 110 // PickleType is intended for deserializing certificates that were pickled
111 // by previous releases as part of a net::HttpResponseInfo. 111 // by previous releases as part of a net::HttpResponseInfo.
112 // When serializing certificates to a new Pickle, 112 // When serializing certificates to a new Pickle,
113 // PICKLETYPE_CERTIFICATE_CHAIN_V3 is always used. 113 // PICKLETYPE_CERTIFICATE_CHAIN_V3 is always used.
114 enum PickleType { 114 enum PickleType {
115 // When reading a certificate from a Pickle, the Pickle only contains a 115 // When reading a certificate from a Pickle, the Pickle only contains a
116 // single certificate. 116 // single certificate.
117 PICKLETYPE_SINGLE_CERTIFICATE, 117 PICKLETYPE_SINGLE_CERTIFICATE,
118 118
119 // When reading a certificate from a Pickle, the Pickle contains the 119 // When reading a certificate from a Pickle, the Pickle contains the
120 // the certificate plus any certificates that were stored in 120 // the certificate plus any certificates that were stored in
121 // |intermediate_ca_certificates_| at the time it was serialized. 121 // |intermediate_ca_certificates_| at the time it was serialized.
122 // The count of certificates is stored as a size_t, which is either 32 122 // The count of certificates is stored as a size_t, which is either 32
123 // or 64 bits. 123 // or 64 bits.
124 PICKLETYPE_CERTIFICATE_CHAIN_V2, 124 PICKLETYPE_CERTIFICATE_CHAIN_V2,
125 125
126 // The Pickle contains the certificate and any certificates that were 126 // The Pickle contains the certificate and any certificates that were
127 // stored in |intermediate_ca_certs_| at the time it was serialized. 127 // stored in |intermediate_ca_certs_| at the time it was serialized.
128 // The format is [int count], [data - this certificate], 128 // The format is [int count], [data - this certificate],
129 // [data - intermediate1], ... [data - intermediateN]. 129 // [data - intermediate1], ... [data - intermediateN].
130 // All certificates are stored in DER form. 130 // All certificates are stored in DER form.
131 PICKLETYPE_CERTIFICATE_CHAIN_V3, 131 PICKLETYPE_CERTIFICATE_CHAIN_V3,
132 }; 132 };
133 133
134 // Creates a X509Certificate from the ground up. Used by tests that simulate 134 // Creates a X509Certificate from the ground up. Used by tests that simulate
135 // SSL connections. 135 // SSL connections.
136 X509Certificate(const std::string& subject, const std::string& issuer, 136 X509Certificate(const std::string& subject,
137 base::Time start_date, base::Time expiration_date); 137 const std::string& issuer,
138 base::Time start_date,
139 base::Time expiration_date);
138 140
139 // Create an X509Certificate from a handle to the certificate object in the 141 // Create an X509Certificate from a handle to the certificate object in the
140 // underlying crypto library. The returned pointer must be stored in a 142 // underlying crypto library. The returned pointer must be stored in a
141 // scoped_refptr<X509Certificate>. 143 // scoped_refptr<X509Certificate>.
142 static X509Certificate* CreateFromHandle(OSCertHandle cert_handle, 144 static X509Certificate* CreateFromHandle(OSCertHandle cert_handle,
143 const OSCertHandles& intermediates); 145 const OSCertHandles& intermediates);
144 146
145 // Create an X509Certificate from a chain of DER encoded certificates. The 147 // Create an X509Certificate from a chain of DER encoded certificates. The
146 // first certificate in the chain is the end-entity certificate to which a 148 // first certificate in the chain is the end-entity certificate to which a
147 // handle is returned. The other certificates in the chain are intermediate 149 // handle is returned. The other certificates in the chain are intermediate
(...skipping 63 matching lines...) Expand 10 before | Expand all | Expand 10 after
211 // the |valid_expiry| date. 213 // the |valid_expiry| date.
212 // If we were unable to parse either date from the certificate (or if the cert 214 // If we were unable to parse either date from the certificate (or if the cert
213 // lacks either date), the date will be null (i.e., is_null() will be true). 215 // lacks either date), the date will be null (i.e., is_null() will be true).
214 const base::Time& valid_start() const { return valid_start_; } 216 const base::Time& valid_start() const { return valid_start_; }
215 const base::Time& valid_expiry() const { return valid_expiry_; } 217 const base::Time& valid_expiry() const { return valid_expiry_; }
216 218
217 // The fingerprint of this certificate. 219 // The fingerprint of this certificate.
218 const SHA1HashValue& fingerprint() const { return fingerprint_; } 220 const SHA1HashValue& fingerprint() const { return fingerprint_; }
219 221
220 // The fingerprint of the intermediate CA certificates. 222 // The fingerprint of the intermediate CA certificates.
221 const SHA1HashValue& ca_fingerprint() const { 223 const SHA1HashValue& ca_fingerprint() const { return ca_fingerprint_; }
222 return ca_fingerprint_;
223 }
224 224
225 // Gets the DNS names in the certificate. Pursuant to RFC 2818, Section 3.1 225 // Gets the DNS names in the certificate. Pursuant to RFC 2818, Section 3.1
226 // Server Identity, if the certificate has a subjectAltName extension of 226 // Server Identity, if the certificate has a subjectAltName extension of
227 // type dNSName, this method gets the DNS names in that extension. 227 // type dNSName, this method gets the DNS names in that extension.
228 // Otherwise, it gets the common name in the subject field. 228 // Otherwise, it gets the common name in the subject field.
229 void GetDNSNames(std::vector<std::string>* dns_names) const; 229 void GetDNSNames(std::vector<std::string>* dns_names) const;
230 230
231 // Gets the subjectAltName extension field from the certificate, if any. 231 // Gets the subjectAltName extension field from the certificate, if any.
232 // For future extension; currently this only returns those name types that 232 // For future extension; currently this only returns those name types that
233 // are required for HTTP certificate name verification - see VerifyHostname. 233 // are required for HTTP certificate name verification - see VerifyHostname.
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after
314 // Does not verify that the certificate is valid, only that the certificate 314 // Does not verify that the certificate is valid, only that the certificate
315 // matches this host. 315 // matches this host.
316 // Returns true if it matches, and updates |*common_name_fallback_used|, 316 // Returns true if it matches, and updates |*common_name_fallback_used|,
317 // setting it to true if a fallback to the CN was used, rather than 317 // setting it to true if a fallback to the CN was used, rather than
318 // subjectAltName. 318 // subjectAltName.
319 bool VerifyNameMatch(const std::string& hostname, 319 bool VerifyNameMatch(const std::string& hostname,
320 bool* common_name_fallback_used) const; 320 bool* common_name_fallback_used) const;
321 321
322 // Obtains the DER encoded certificate data for |cert_handle|. On success, 322 // Obtains the DER encoded certificate data for |cert_handle|. On success,
323 // returns true and writes the DER encoded certificate to |*der_encoded|. 323 // returns true and writes the DER encoded certificate to |*der_encoded|.
324 static bool GetDEREncoded(OSCertHandle cert_handle, 324 static bool GetDEREncoded(OSCertHandle cert_handle, std::string* der_encoded);
325 std::string* der_encoded);
326 325
327 // Returns the PEM encoded data from a DER encoded certificate. If the return 326 // Returns the PEM encoded data from a DER encoded certificate. If the return
328 // value is true, then the PEM encoded certificate is written to 327 // value is true, then the PEM encoded certificate is written to
329 // |pem_encoded|. 328 // |pem_encoded|.
330 static bool GetPEMEncodedFromDER(const std::string& der_encoded, 329 static bool GetPEMEncodedFromDER(const std::string& der_encoded,
331 std::string* pem_encoded); 330 std::string* pem_encoded);
332 331
333 // Returns the PEM encoded data from an OSCertHandle. If the return value is 332 // Returns the PEM encoded data from an OSCertHandle. If the return value is
334 // true, then the PEM encoded certificate is written to |pem_encoded|. 333 // true, then the PEM encoded certificate is written to |pem_encoded|.
335 static bool GetPEMEncoded(OSCertHandle cert_handle, 334 static bool GetPEMEncoded(OSCertHandle cert_handle, std::string* pem_encoded);
336 std::string* pem_encoded);
337 335
338 // Encodes the entire certificate chain (this certificate and any 336 // Encodes the entire certificate chain (this certificate and any
339 // intermediate certificates stored in |intermediate_ca_certs_|) as a series 337 // intermediate certificates stored in |intermediate_ca_certs_|) as a series
340 // of PEM encoded strings. Returns true if all certificates were encoded, 338 // of PEM encoded strings. Returns true if all certificates were encoded,
341 // storig the result in |*pem_encoded|, with this certificate stored as 339 // storig the result in |*pem_encoded|, with this certificate stored as
342 // the first element. 340 // the first element.
343 bool GetPEMEncodedChain(std::vector<std::string>* pem_encoded) const; 341 bool GetPEMEncodedChain(std::vector<std::string>* pem_encoded) const;
344 342
345 // Sets |*size_bits| to be the length of the public key in bits, and sets 343 // Sets |*size_bits| to be the length of the public key in bits, and sets
346 // |*type| to one of the |PublicKeyType| values. In case of 344 // |*type| to one of the |PublicKeyType| values. In case of
347 // |kPublicKeyTypeUnknown|, |*size_bits| will be set to 0. 345 // |kPublicKeyTypeUnknown|, |*size_bits| will be set to 0.
348 static void GetPublicKeyInfo(OSCertHandle cert_handle, 346 static void GetPublicKeyInfo(OSCertHandle cert_handle,
349 size_t* size_bits, 347 size_t* size_bits,
350 PublicKeyType* type); 348 PublicKeyType* type);
351 349
352 // Returns the OSCertHandle of this object. Because of caching, this may 350 // Returns the OSCertHandle of this object. Because of caching, this may
353 // differ from the OSCertHandle originally supplied during initialization. 351 // differ from the OSCertHandle originally supplied during initialization.
354 // Note: On Windows, CryptoAPI may return unexpected results if this handle 352 // Note: On Windows, CryptoAPI may return unexpected results if this handle
355 // is used across multiple threads. For more details, see 353 // is used across multiple threads. For more details, see
356 // CreateOSCertChainForCert(). 354 // CreateOSCertChainForCert().
357 OSCertHandle os_cert_handle() const { return cert_handle_; } 355 OSCertHandle os_cert_handle() const { return cert_handle_; }
358 356
359 // Returns true if two OSCertHandles refer to identical certificates. 357 // Returns true if two OSCertHandles refer to identical certificates.
360 static bool IsSameOSCert(OSCertHandle a, OSCertHandle b); 358 static bool IsSameOSCert(OSCertHandle a, OSCertHandle b);
361 359
362 // Creates an OS certificate handle from the DER-encoded representation. 360 // Creates an OS certificate handle from the DER-encoded representation.
363 // Returns NULL on failure. 361 // Returns NULL on failure.
364 static OSCertHandle CreateOSCertHandleFromBytes(const char* data, 362 static OSCertHandle CreateOSCertHandleFromBytes(const char* data, int length);
365 int length);
366 363
367 #if defined(USE_NSS) 364 #if defined(USE_NSS)
368 // Creates an OS certificate handle from the DER-encoded representation. 365 // Creates an OS certificate handle from the DER-encoded representation.
369 // Returns NULL on failure. Sets the default nickname if |nickname| is 366 // Returns NULL on failure. Sets the default nickname if |nickname| is
370 // non-NULL. 367 // non-NULL.
371 static OSCertHandle CreateOSCertHandleFromBytesWithNickname( 368 static OSCertHandle CreateOSCertHandleFromBytesWithNickname(
372 const char* data, 369 const char* data,
373 int length, 370 int length,
374 const char* nickname); 371 const char* nickname);
375 #endif 372 #endif
376 373
377 // Creates all possible OS certificate handles from |data| encoded in a 374 // Creates all possible OS certificate handles from |data| encoded in a
378 // specific |format|. Returns an empty collection on failure. 375 // specific |format|. Returns an empty collection on failure.
379 static OSCertHandles CreateOSCertHandlesFromBytes( 376 static OSCertHandles CreateOSCertHandlesFromBytes(const char* data,
380 const char* data, 377 int length,
381 int length, 378 Format format);
382 Format format);
383 379
384 // Duplicates (or adds a reference to) an OS certificate handle. 380 // Duplicates (or adds a reference to) an OS certificate handle.
385 static OSCertHandle DupOSCertHandle(OSCertHandle cert_handle); 381 static OSCertHandle DupOSCertHandle(OSCertHandle cert_handle);
386 382
387 // Frees (or releases a reference to) an OS certificate handle. 383 // Frees (or releases a reference to) an OS certificate handle.
388 static void FreeOSCertHandle(OSCertHandle cert_handle); 384 static void FreeOSCertHandle(OSCertHandle cert_handle);
389 385
390 // Calculates the SHA-1 fingerprint of the certificate. Returns an empty 386 // Calculates the SHA-1 fingerprint of the certificate. Returns an empty
391 // (all zero) fingerprint on failure. 387 // (all zero) fingerprint on failure.
392 static SHA1HashValue CalculateFingerprint(OSCertHandle cert_handle); 388 static SHA1HashValue CalculateFingerprint(OSCertHandle cert_handle);
393 389
394 // Calculates the SHA-1 fingerprint of the intermediate CA certificates. 390 // Calculates the SHA-1 fingerprint of the intermediate CA certificates.
395 // Returns an empty (all zero) fingerprint on failure. 391 // Returns an empty (all zero) fingerprint on failure.
396 static SHA1HashValue CalculateCAFingerprint( 392 static SHA1HashValue CalculateCAFingerprint(
397 const OSCertHandles& intermediates); 393 const OSCertHandles& intermediates);
398 394
399 private: 395 private:
400 friend class base::RefCountedThreadSafe<X509Certificate>; 396 friend class base::RefCountedThreadSafe<X509Certificate>;
401 friend class TestRootCerts; // For unit tests 397 friend class TestRootCerts; // For unit tests
402 398
403 FRIEND_TEST_ALL_PREFIXES(X509CertificateNameVerifyTest, VerifyHostname); 399 FRIEND_TEST_ALL_PREFIXES(X509CertificateNameVerifyTest, VerifyHostname);
404 FRIEND_TEST_ALL_PREFIXES(X509CertificateTest, SerialNumbers); 400 FRIEND_TEST_ALL_PREFIXES(X509CertificateTest, SerialNumbers);
405 401
406 // Construct an X509Certificate from a handle to the certificate object 402 // Construct an X509Certificate from a handle to the certificate object
407 // in the underlying crypto library. 403 // in the underlying crypto library.
408 X509Certificate(OSCertHandle cert_handle, 404 X509Certificate(OSCertHandle cert_handle, const OSCertHandles& intermediates);
409 const OSCertHandles& intermediates);
410 405
411 ~X509Certificate(); 406 ~X509Certificate();
412 407
413 // Common object initialization code. Called by the constructors only. 408 // Common object initialization code. Called by the constructors only.
414 void Initialize(); 409 void Initialize();
415 410
416 #if defined(USE_OPENSSL_CERTS) 411 #if defined(USE_OPENSSL_CERTS)
417 // Resets the store returned by cert_store() to default state. Used by 412 // Resets the store returned by cert_store() to default state. Used by
418 // TestRootCerts to undo modifications. 413 // TestRootCerts to undo modifications.
419 static void ResetCertStore(); 414 static void ResetCertStore();
(...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after
485 // based on the type of the certificate. 480 // based on the type of the certificate.
486 std::string default_nickname_; 481 std::string default_nickname_;
487 #endif 482 #endif
488 483
489 DISALLOW_COPY_AND_ASSIGN(X509Certificate); 484 DISALLOW_COPY_AND_ASSIGN(X509Certificate);
490 }; 485 };
491 486
492 } // namespace net 487 } // namespace net
493 488
494 #endif // NET_CERT_X509_CERTIFICATE_H_ 489 #endif // NET_CERT_X509_CERTIFICATE_H_
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698