| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/x509_util_openssl.h" | 5 #include "net/cert/x509_util_openssl.h" |
| 6 | 6 |
| 7 #include <algorithm> | 7 #include <algorithm> |
| 8 #include <openssl/asn1.h> | 8 #include <openssl/asn1.h> |
| 9 | 9 |
| 10 #include "base/lazy_instance.h" | 10 #include "base/lazy_instance.h" |
| (...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 81 LOG(ERROR) << "Common name too long"; | 81 LOG(ERROR) << "Common name too long"; |
| 82 return NULL; | 82 return NULL; |
| 83 } | 83 } |
| 84 unsigned char* common_name_str = | 84 unsigned char* common_name_str = |
| 85 reinterpret_cast<unsigned char*>(const_cast<char*>(common_name.data())) + | 85 reinterpret_cast<unsigned char*>(const_cast<char*>(common_name.data())) + |
| 86 kCommonNamePrefixLen; | 86 kCommonNamePrefixLen; |
| 87 int common_name_len = | 87 int common_name_len = |
| 88 static_cast<int>(common_name.size() - kCommonNamePrefixLen); | 88 static_cast<int>(common_name.size() - kCommonNamePrefixLen); |
| 89 | 89 |
| 90 crypto::ScopedOpenSSL<X509_NAME, X509_NAME_free> name(X509_NAME_new()); | 90 crypto::ScopedOpenSSL<X509_NAME, X509_NAME_free> name(X509_NAME_new()); |
| 91 if (!name.get() || !X509_NAME_add_entry_by_NID(name.get(), | 91 if (!name.get() || |
| 92 NID_commonName, | 92 !X509_NAME_add_entry_by_NID(name.get(), |
| 93 MBSTRING_ASC, | 93 NID_commonName, |
| 94 common_name_str, | 94 MBSTRING_ASC, |
| 95 common_name_len, | 95 common_name_str, |
| 96 -1, | 96 common_name_len, |
| 97 0)) { | 97 -1, |
| 98 0)) { |
| 98 LOG(ERROR) << "Can't parse common name: " << common_name.c_str(); | 99 LOG(ERROR) << "Can't parse common name: " << common_name.c_str(); |
| 99 return NULL; | 100 return NULL; |
| 100 } | 101 } |
| 101 | 102 |
| 102 // Now create certificate and populate it. | 103 // Now create certificate and populate it. |
| 103 crypto::ScopedOpenSSL<X509, X509_free> cert(X509_new()); | 104 crypto::ScopedOpenSSL<X509, X509_free> cert(X509_new()); |
| 104 if (!cert.get() || !X509_set_version(cert.get(), 2L) /* i.e. version 3 */ || | 105 if (!cert.get() || !X509_set_version(cert.get(), 2L) /* i.e. version 3 */ || |
| 105 !X509_set_pubkey(cert.get(), key) || | 106 !X509_set_pubkey(cert.get(), key) || |
| 106 !X509_set_serialNumber(cert.get(), asn1_serial.get()) || | 107 !X509_set_serialNumber(cert.get(), asn1_serial.get()) || |
| 107 !X509_set_notBefore(cert.get(), asn1_not_before_time.get()) || | 108 !X509_set_notBefore(cert.get(), asn1_not_before_time.get()) || |
| (...skipping 84 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 192 // | 193 // |
| 193 // from datetime import date as D | 194 // from datetime import date as D |
| 194 // print (D(1970,1,1)-D(1,1,1)) # -> 719162 days | 195 // print (D(1970,1,1)-D(1,1,1)) # -> 719162 days |
| 195 // print (D(9999,12,31)-D(1970,1,1)) # -> 2932896 days | 196 // print (D(9999,12,31)-D(1970,1,1)) # -> 2932896 days |
| 196 // | 197 // |
| 197 // Note: This ignores leap seconds, but should be enough in practice. | 198 // Note: This ignores leap seconds, but should be enough in practice. |
| 198 // | 199 // |
| 199 const int64 kDaysFromYear0001ToUnixEpoch = 719162; | 200 const int64 kDaysFromYear0001ToUnixEpoch = 719162; |
| 200 const int64 kDaysFromUnixEpochToYear10000 = 2932896 + 1; | 201 const int64 kDaysFromUnixEpochToYear10000 = 2932896 + 1; |
| 201 const base::Time kEpoch = base::Time::UnixEpoch(); | 202 const base::Time kEpoch = base::Time::UnixEpoch(); |
| 202 const base::Time kYear0001 = kEpoch - | 203 const base::Time kYear0001 = |
| 203 base::TimeDelta::FromDays(kDaysFromYear0001ToUnixEpoch); | 204 kEpoch - base::TimeDelta::FromDays(kDaysFromYear0001ToUnixEpoch); |
| 204 const base::Time kYear10000 = kEpoch + | 205 const base::Time kYear10000 = |
| 205 base::TimeDelta::FromDays(kDaysFromUnixEpochToYear10000); | 206 kEpoch + base::TimeDelta::FromDays(kDaysFromUnixEpochToYear10000); |
| 206 | 207 |
| 207 if (not_valid_before < kYear0001 || not_valid_before >= kYear10000 || | 208 if (not_valid_before < kYear0001 || not_valid_before >= kYear10000 || |
| 208 not_valid_after < kYear0001 || not_valid_after >= kYear10000) | 209 not_valid_after < kYear0001 || not_valid_after >= kYear10000) |
| 209 return false; | 210 return false; |
| 210 | 211 |
| 211 return true; | 212 return true; |
| 212 } | 213 } |
| 213 | 214 |
| 214 bool CreateDomainBoundCertEC( | 215 bool CreateDomainBoundCertEC(crypto::ECPrivateKey* key, |
| 215 crypto::ECPrivateKey* key, | 216 DigestAlgorithm alg, |
| 216 DigestAlgorithm alg, | 217 const std::string& domain, |
| 217 const std::string& domain, | 218 uint32 serial_number, |
| 218 uint32 serial_number, | 219 base::Time not_valid_before, |
| 219 base::Time not_valid_before, | 220 base::Time not_valid_after, |
| 220 base::Time not_valid_after, | 221 std::string* der_cert) { |
| 221 std::string* der_cert) { | |
| 222 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 222 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 223 // Create certificate. | 223 // Create certificate. |
| 224 crypto::ScopedOpenSSL<X509, X509_free> cert( | 224 crypto::ScopedOpenSSL<X509, X509_free> cert( |
| 225 CreateCertificate(key->key(), | 225 CreateCertificate(key->key(), |
| 226 alg, | 226 alg, |
| 227 "CN=anonymous.invalid", | 227 "CN=anonymous.invalid", |
| 228 serial_number, | 228 serial_number, |
| 229 not_valid_before, | 229 not_valid_before, |
| 230 not_valid_after)); | 230 not_valid_after)); |
| 231 if (!cert.get()) | 231 if (!cert.get()) |
| (...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 323 | 323 |
| 324 bool ParsePrincipalValueByNID(X509_NAME* name, int nid, std::string* value) { | 324 bool ParsePrincipalValueByNID(X509_NAME* name, int nid, std::string* value) { |
| 325 int index = X509_NAME_get_index_by_NID(name, nid, -1); | 325 int index = X509_NAME_get_index_by_NID(name, nid, -1); |
| 326 if (index < 0) | 326 if (index < 0) |
| 327 return false; | 327 return false; |
| 328 | 328 |
| 329 return ParsePrincipalValueByIndex(name, index, value); | 329 return ParsePrincipalValueByIndex(name, index, value); |
| 330 } | 330 } |
| 331 | 331 |
| 332 bool ParseDate(ASN1_TIME* x509_time, base::Time* time) { | 332 bool ParseDate(ASN1_TIME* x509_time, base::Time* time) { |
| 333 if (!x509_time || | 333 if (!x509_time || (x509_time->type != V_ASN1_UTCTIME && |
| 334 (x509_time->type != V_ASN1_UTCTIME && | 334 x509_time->type != V_ASN1_GENERALIZEDTIME)) |
| 335 x509_time->type != V_ASN1_GENERALIZEDTIME)) | |
| 336 return false; | 335 return false; |
| 337 | 336 |
| 338 base::StringPiece str_date(reinterpret_cast<const char*>(x509_time->data), | 337 base::StringPiece str_date(reinterpret_cast<const char*>(x509_time->data), |
| 339 x509_time->length); | 338 x509_time->length); |
| 340 | 339 |
| 341 CertDateFormat format = x509_time->type == V_ASN1_UTCTIME ? | 340 CertDateFormat format = x509_time->type == V_ASN1_UTCTIME |
| 342 CERT_DATE_FORMAT_UTC_TIME : CERT_DATE_FORMAT_GENERALIZED_TIME; | 341 ? CERT_DATE_FORMAT_UTC_TIME |
| 342 : CERT_DATE_FORMAT_GENERALIZED_TIME; |
| 343 return ParseCertificateDate(str_date, format, time); | 343 return ParseCertificateDate(str_date, format, time); |
| 344 } | 344 } |
| 345 | 345 |
| 346 } // namespace x509_util | 346 } // namespace x509_util |
| 347 | 347 |
| 348 } // namespace net | 348 } // namespace net |
| OLD | NEW |