| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/x509_certificate.h" | 5 #include "net/cert/x509_certificate.h" |
| 6 | 6 |
| 7 #include <CommonCrypto/CommonDigest.h> | 7 #include <CommonCrypto/CommonDigest.h> |
| 8 #include <Security/Security.h> | 8 #include <Security/Security.h> |
| 9 | 9 |
| 10 #include <cert.h> | 10 #include <cert.h> |
| (...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 69 fingerprint_ = CalculateFingerprint(cert_handle_); | 69 fingerprint_ = CalculateFingerprint(cert_handle_); |
| 70 ca_fingerprint_ = CalculateCAFingerprint(intermediate_ca_certs_); | 70 ca_fingerprint_ = CalculateCAFingerprint(intermediate_ca_certs_); |
| 71 } | 71 } |
| 72 | 72 |
| 73 bool X509Certificate::IsIssuedByEncoded( | 73 bool X509Certificate::IsIssuedByEncoded( |
| 74 const std::vector<std::string>& valid_issuers) { | 74 const std::vector<std::string>& valid_issuers) { |
| 75 x509_util_ios::NSSCertChain nss_chain(this); | 75 x509_util_ios::NSSCertChain nss_chain(this); |
| 76 // Convert to scoped CERTName* list. | 76 // Convert to scoped CERTName* list. |
| 77 std::vector<CERTName*> issuers; | 77 std::vector<CERTName*> issuers; |
| 78 crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE)); | 78 crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE)); |
| 79 if (!x509_util::GetIssuersFromEncodedList(valid_issuers, | 79 if (!x509_util::GetIssuersFromEncodedList( |
| 80 arena.get(), | 80 valid_issuers, arena.get(), &issuers)) { |
| 81 &issuers)) { | |
| 82 return false; | 81 return false; |
| 83 } | 82 } |
| 84 return x509_util::IsCertificateIssuedBy( | 83 return x509_util::IsCertificateIssuedBy(nss_chain.cert_chain(), issuers); |
| 85 nss_chain.cert_chain(), issuers); | |
| 86 } | 84 } |
| 87 | 85 |
| 88 void X509Certificate::GetSubjectAltName( | 86 void X509Certificate::GetSubjectAltName( |
| 89 std::vector<std::string>* dns_names, | 87 std::vector<std::string>* dns_names, |
| 90 std::vector<std::string>* ip_addrs) const { | 88 std::vector<std::string>* ip_addrs) const { |
| 91 x509_util_ios::NSSCertificate nss_cert(cert_handle_); | 89 x509_util_ios::NSSCertificate nss_cert(cert_handle_); |
| 92 CERTCertificate* cert_handle = nss_cert.cert_handle(); | 90 CERTCertificate* cert_handle = nss_cert.cert_handle(); |
| 93 if (!cert_handle) { | 91 if (!cert_handle) { |
| 94 if (dns_names) | 92 if (dns_names) |
| 95 dns_names->clear(); | 93 dns_names->clear(); |
| (...skipping 20 matching lines...) Expand all Loading... |
| 116 X509Certificate::OSCertHandle b) { | 114 X509Certificate::OSCertHandle b) { |
| 117 DCHECK(a && b); | 115 DCHECK(a && b); |
| 118 if (a == b) | 116 if (a == b) |
| 119 return true; | 117 return true; |
| 120 if (CFEqual(a, b)) | 118 if (CFEqual(a, b)) |
| 121 return true; | 119 return true; |
| 122 ScopedCFTypeRef<CFDataRef> a_data(SecCertificateCopyData(a)); | 120 ScopedCFTypeRef<CFDataRef> a_data(SecCertificateCopyData(a)); |
| 123 ScopedCFTypeRef<CFDataRef> b_data(SecCertificateCopyData(b)); | 121 ScopedCFTypeRef<CFDataRef> b_data(SecCertificateCopyData(b)); |
| 124 return a_data && b_data && | 122 return a_data && b_data && |
| 125 CFDataGetLength(a_data) == CFDataGetLength(b_data) && | 123 CFDataGetLength(a_data) == CFDataGetLength(b_data) && |
| 126 memcmp(CFDataGetBytePtr(a_data), CFDataGetBytePtr(b_data), | 124 memcmp(CFDataGetBytePtr(a_data), |
| 125 CFDataGetBytePtr(b_data), |
| 127 CFDataGetLength(a_data)) == 0; | 126 CFDataGetLength(a_data)) == 0; |
| 128 } | 127 } |
| 129 | 128 |
| 130 // static | 129 // static |
| 131 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes( | 130 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes( |
| 132 const char* data, int length) { | 131 const char* data, |
| 133 ScopedCFTypeRef<CFDataRef> cert_data(CFDataCreateWithBytesNoCopy( | 132 int length) { |
| 134 kCFAllocatorDefault, reinterpret_cast<const UInt8 *>(data), length, | 133 ScopedCFTypeRef<CFDataRef> cert_data( |
| 135 kCFAllocatorNull)); | 134 CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, |
| 135 reinterpret_cast<const UInt8*>(data), |
| 136 length, |
| 137 kCFAllocatorNull)); |
| 136 if (!cert_data) | 138 if (!cert_data) |
| 137 return NULL; | 139 return NULL; |
| 138 OSCertHandle cert_handle = SecCertificateCreateWithData(NULL, cert_data); | 140 OSCertHandle cert_handle = SecCertificateCreateWithData(NULL, cert_data); |
| 139 if (!cert_handle) | 141 if (!cert_handle) |
| 140 return NULL; | 142 return NULL; |
| 141 if (!IsValidOSCertHandle(cert_handle)) { | 143 if (!IsValidOSCertHandle(cert_handle)) { |
| 142 CFRelease(cert_handle); | 144 CFRelease(cert_handle); |
| 143 return NULL; | 145 return NULL; |
| 144 } | 146 } |
| 145 return cert_handle; | 147 return cert_handle; |
| (...skipping 14 matching lines...) Expand all Loading... |
| 160 return NULL; | 162 return NULL; |
| 161 return reinterpret_cast<OSCertHandle>(const_cast<void*>(CFRetain(handle))); | 163 return reinterpret_cast<OSCertHandle>(const_cast<void*>(CFRetain(handle))); |
| 162 } | 164 } |
| 163 | 165 |
| 164 // static | 166 // static |
| 165 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) { | 167 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) { |
| 166 CFRelease(cert_handle); | 168 CFRelease(cert_handle); |
| 167 } | 169 } |
| 168 | 170 |
| 169 // static | 171 // static |
| 170 SHA1HashValue X509Certificate::CalculateFingerprint( | 172 SHA1HashValue X509Certificate::CalculateFingerprint(OSCertHandle cert) { |
| 171 OSCertHandle cert) { | |
| 172 SHA1HashValue sha1; | 173 SHA1HashValue sha1; |
| 173 memset(sha1.data, 0, sizeof(sha1.data)); | 174 memset(sha1.data, 0, sizeof(sha1.data)); |
| 174 | 175 |
| 175 ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert)); | 176 ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert)); |
| 176 if (!cert_data) | 177 if (!cert_data) |
| 177 return sha1; | 178 return sha1; |
| 178 DCHECK(CFDataGetBytePtr(cert_data)); | 179 DCHECK(CFDataGetBytePtr(cert_data)); |
| 179 DCHECK_NE(0, CFDataGetLength(cert_data)); | 180 DCHECK_NE(0, CFDataGetLength(cert_data)); |
| 180 CC_SHA1(CFDataGetBytePtr(cert_data), CFDataGetLength(cert_data), sha1.data); | 181 CC_SHA1(CFDataGetBytePtr(cert_data), CFDataGetLength(cert_data), sha1.data); |
| 181 | 182 |
| 182 return sha1; | 183 return sha1; |
| 183 } | 184 } |
| 184 | 185 |
| 185 // static | 186 // static |
| 186 SHA1HashValue X509Certificate::CalculateCAFingerprint( | 187 SHA1HashValue X509Certificate::CalculateCAFingerprint( |
| 187 const OSCertHandles& intermediates) { | 188 const OSCertHandles& intermediates) { |
| 188 SHA1HashValue sha1; | 189 SHA1HashValue sha1; |
| 189 memset(sha1.data, 0, sizeof(sha1.data)); | 190 memset(sha1.data, 0, sizeof(sha1.data)); |
| 190 | 191 |
| 191 // The CC_SHA(3cc) man page says all CC_SHA1_xxx routines return 1, so | 192 // The CC_SHA(3cc) man page says all CC_SHA1_xxx routines return 1, so |
| 192 // we don't check their return values. | 193 // we don't check their return values. |
| 193 CC_SHA1_CTX sha1_ctx; | 194 CC_SHA1_CTX sha1_ctx; |
| 194 CC_SHA1_Init(&sha1_ctx); | 195 CC_SHA1_Init(&sha1_ctx); |
| 195 for (size_t i = 0; i < intermediates.size(); ++i) { | 196 for (size_t i = 0; i < intermediates.size(); ++i) { |
| 196 ScopedCFTypeRef<CFDataRef> | 197 ScopedCFTypeRef<CFDataRef> cert_data( |
| 197 cert_data(SecCertificateCopyData(intermediates[i])); | 198 SecCertificateCopyData(intermediates[i])); |
| 198 if (!cert_data) | 199 if (!cert_data) |
| 199 return sha1; | 200 return sha1; |
| 200 CC_SHA1_Update(&sha1_ctx, | 201 CC_SHA1_Update( |
| 201 CFDataGetBytePtr(cert_data), | 202 &sha1_ctx, CFDataGetBytePtr(cert_data), CFDataGetLength(cert_data)); |
| 202 CFDataGetLength(cert_data)); | |
| 203 } | 203 } |
| 204 CC_SHA1_Final(sha1.data, &sha1_ctx); | 204 CC_SHA1_Final(sha1.data, &sha1_ctx); |
| 205 return sha1; | 205 return sha1; |
| 206 } | 206 } |
| 207 | 207 |
| 208 // static | 208 // static |
| 209 X509Certificate::OSCertHandle | 209 X509Certificate::OSCertHandle X509Certificate::ReadOSCertHandleFromPickle( |
| 210 X509Certificate::ReadOSCertHandleFromPickle(PickleIterator* pickle_iter) { | 210 PickleIterator* pickle_iter) { |
| 211 return x509_util::ReadOSCertHandleFromPickle(pickle_iter); | 211 return x509_util::ReadOSCertHandleFromPickle(pickle_iter); |
| 212 } | 212 } |
| 213 | 213 |
| 214 // static | 214 // static |
| 215 bool X509Certificate::WriteOSCertHandleToPickle(OSCertHandle cert_handle, | 215 bool X509Certificate::WriteOSCertHandleToPickle(OSCertHandle cert_handle, |
| 216 Pickle* pickle) { | 216 Pickle* pickle) { |
| 217 ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert_handle)); | 217 ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert_handle)); |
| 218 if (!cert_data) | 218 if (!cert_data) |
| 219 return false; | 219 return false; |
| 220 | 220 |
| 221 return pickle->WriteData( | 221 return pickle->WriteData( |
| 222 reinterpret_cast<const char*>(CFDataGetBytePtr(cert_data)), | 222 reinterpret_cast<const char*>(CFDataGetBytePtr(cert_data)), |
| 223 CFDataGetLength(cert_data)); | 223 CFDataGetLength(cert_data)); |
| 224 } | 224 } |
| 225 | 225 |
| 226 // static | 226 // static |
| 227 void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle, | 227 void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle, |
| 228 size_t* size_bits, | 228 size_t* size_bits, |
| 229 PublicKeyType* type) { | 229 PublicKeyType* type) { |
| 230 x509_util_ios::NSSCertificate nss_cert(cert_handle); | 230 x509_util_ios::NSSCertificate nss_cert(cert_handle); |
| 231 x509_util::GetPublicKeyInfo(nss_cert.cert_handle(), size_bits, type); | 231 x509_util::GetPublicKeyInfo(nss_cert.cert_handle(), size_bits, type); |
| 232 } | 232 } |
| 233 | 233 |
| 234 } // namespace net | 234 } // namespace net |
| OLD | NEW |