OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/cert/x509_certificate.h" | 5 #include "net/cert/x509_certificate.h" |
6 | 6 |
7 #include <CommonCrypto/CommonDigest.h> | 7 #include <CommonCrypto/CommonDigest.h> |
8 #include <CoreServices/CoreServices.h> | 8 #include <CoreServices/CoreServices.h> |
9 #include <Security/Security.h> | 9 #include <Security/Security.h> |
10 | 10 |
(...skipping 198 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
209 return true; | 209 return true; |
210 | 210 |
211 for (OSCertHandles::iterator it = intermediate_ca_certs_.begin(); | 211 for (OSCertHandles::iterator it = intermediate_ca_certs_.begin(); |
212 it != intermediate_ca_certs_.end(); ++it) { | 212 it != intermediate_ca_certs_.end(); ++it) { |
213 if (IsCertIssuerInEncodedList(*it, valid_issuers)) | 213 if (IsCertIssuerInEncodedList(*it, valid_issuers)) |
214 return true; | 214 return true; |
215 } | 215 } |
216 return false; | 216 return false; |
217 } | 217 } |
218 | 218 |
219 void X509Certificate::GetSubjectAltName( | 219 bool X509Certificate::GetSubjectAltName( |
220 std::vector<std::string>* dns_names, | 220 std::vector<std::string>* dns_names, |
221 std::vector<std::string>* ip_addrs) const { | 221 std::vector<std::string>* ip_addrs) const { |
222 if (dns_names) | 222 if (dns_names) |
223 dns_names->clear(); | 223 dns_names->clear(); |
eroman
2017/03/21 21:09:54
Note the openssl implementations differ, and do a
Ryan Sleevi
2017/03/21 21:48:43
No, they reset in the GetSubjectAltName and then a
| |
224 if (ip_addrs) | 224 if (ip_addrs) |
225 ip_addrs->clear(); | 225 ip_addrs->clear(); |
226 | 226 |
227 x509_util::CSSMCachedCertificate cached_cert; | 227 x509_util::CSSMCachedCertificate cached_cert; |
228 OSStatus status = cached_cert.Init(cert_handle_); | 228 OSStatus status = cached_cert.Init(cert_handle_); |
229 if (status) | 229 if (status) |
230 return; | 230 return false; |
231 | |
231 x509_util::CSSMFieldValue subject_alt_name; | 232 x509_util::CSSMFieldValue subject_alt_name; |
232 status = cached_cert.GetField(&CSSMOID_SubjectAltName, &subject_alt_name); | 233 status = cached_cert.GetField(&CSSMOID_SubjectAltName, &subject_alt_name); |
233 if (status || !subject_alt_name.field()) | 234 if (status || !subject_alt_name.field()) |
234 return; | 235 return false; |
236 | |
235 const CSSM_X509_EXTENSION* cssm_ext = | 237 const CSSM_X509_EXTENSION* cssm_ext = |
236 subject_alt_name.GetAs<CSSM_X509_EXTENSION>(); | 238 subject_alt_name.GetAs<CSSM_X509_EXTENSION>(); |
237 if (!cssm_ext || !cssm_ext->value.parsedValue) | 239 if (!cssm_ext || !cssm_ext->value.parsedValue) |
238 return; | 240 return false; |
239 const CE_GeneralNames* alt_name = | 241 const CE_GeneralNames* alt_name = |
240 reinterpret_cast<const CE_GeneralNames*>(cssm_ext->value.parsedValue); | 242 reinterpret_cast<const CE_GeneralNames*>(cssm_ext->value.parsedValue); |
241 | 243 |
244 bool has_san = false; | |
242 for (size_t name = 0; name < alt_name->numNames; ++name) { | 245 for (size_t name = 0; name < alt_name->numNames; ++name) { |
243 const CE_GeneralName& name_struct = alt_name->generalName[name]; | 246 const CE_GeneralName& name_struct = alt_name->generalName[name]; |
244 const CSSM_DATA& name_data = name_struct.name; | 247 const CSSM_DATA& name_data = name_struct.name; |
245 // DNSName and IPAddress are encoded as IA5String and OCTET STRINGs | 248 // DNSName and IPAddress are encoded as IA5String and OCTET STRINGs |
246 // respectively, both of which can be byte copied from | 249 // respectively, both of which can be byte copied from |
247 // CSSM_DATA::data into the appropriate output vector. | 250 // CSSM_DATA::data into the appropriate output vector. |
248 if (dns_names && name_struct.nameType == GNT_DNSName) { | 251 if (name_struct.nameType == GNT_DNSName) { |
249 dns_names->push_back(std::string( | 252 has_san = true; |
250 reinterpret_cast<const char*>(name_data.Data), | 253 if (dns_names) { |
251 name_data.Length)); | 254 dns_names->push_back(std::string( |
252 } else if (ip_addrs && name_struct.nameType == GNT_IPAddress) { | 255 reinterpret_cast<const char*>(name_data.Data), name_data.Length)); |
253 ip_addrs->push_back(std::string( | 256 } |
254 reinterpret_cast<const char*>(name_data.Data), | 257 } else if (name_struct.nameType == GNT_IPAddress) { |
255 name_data.Length)); | 258 has_san = true; |
259 if (ip_addrs) { | |
260 ip_addrs->push_back(std::string( | |
261 reinterpret_cast<const char*>(name_data.Data), name_data.Length)); | |
262 } | |
256 } | 263 } |
264 // Fast path: Found at least one subjectAltName and the caller doesn't | |
265 // need the actual values. | |
266 if (has_san && !ip_addrs && !dns_names) | |
267 return true; | |
257 } | 268 } |
269 | |
270 return has_san; | |
258 } | 271 } |
259 | 272 |
260 // static | 273 // static |
261 bool X509Certificate::GetDEREncoded(X509Certificate::OSCertHandle cert_handle, | 274 bool X509Certificate::GetDEREncoded(X509Certificate::OSCertHandle cert_handle, |
262 std::string* encoded) { | 275 std::string* encoded) { |
263 CSSM_DATA der_data; | 276 CSSM_DATA der_data; |
264 if (!cert_handle || SecCertificateGetData(cert_handle, &der_data) != noErr) | 277 if (!cert_handle || SecCertificateGetData(cert_handle, &der_data) != noErr) |
265 return false; | 278 return false; |
266 encoded->assign(reinterpret_cast<char*>(der_data.Data), | 279 encoded->assign(reinterpret_cast<char*>(der_data.Data), |
267 der_data.Length); | 280 der_data.Length); |
(...skipping 225 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
493 return false; | 506 return false; |
494 | 507 |
495 if (CSSM_CL_CertVerify(cl_handle, 0, &cert_data, &cert_data, NULL, 0)) | 508 if (CSSM_CL_CertVerify(cl_handle, 0, &cert_data, &cert_data, NULL, 0)) |
496 return false; | 509 return false; |
497 return true; | 510 return true; |
498 } | 511 } |
499 | 512 |
500 #pragma clang diagnostic pop // "-Wdeprecated-declarations" | 513 #pragma clang diagnostic pop // "-Wdeprecated-declarations" |
501 | 514 |
502 } // namespace net | 515 } // namespace net |
OLD | NEW |