Reject certificates that contain unknown policy qualifiers if the

net/cert/internal/certificate_policies.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "net/cert/internal/certificate_policies.h"
 
 #include "net/der/input.h"
 #include "net/der/parse_values.h"
@@ skipping 21 matching lines @@
 // In dotted decimal form: 1.3.6.1.5.5.7.2.2
 const der::Input UserNoticeId() {
   static const uint8_t user_notice_id[] = {0x2b, 0x06, 0x01, 0x05,
                                            0x05, 0x07, 0x02, 0x02};
   return der::Input(user_notice_id);
 }
 
 // Ignores the policyQualifiers, but does some minimal correctness checking.
 // TODO(mattm): parse and return the policyQualifiers, since the cert viewer
 // still needs to display them.
-bool ParsePolicyQualifiers(const der::Input& policy_oid,
+bool ParsePolicyQualifiers(bool restrict_to_known_qualifiers,
                            der::Parser* policy_qualifiers_sequence_parser) {
   // If it is present, the policyQualifiers sequence should have at least 1
   // element.
   if (!policy_qualifiers_sequence_parser->HasMore())
     return false;
   while (policy_qualifiers_sequence_parser->HasMore()) {
     der::Parser policy_information_parser;
     if (!policy_qualifiers_sequence_parser->ReadSequence(
             &policy_information_parser)) {
       return false;
     }
     der::Input qualifier_oid;
     if (!policy_information_parser.ReadTag(der::kOid, &qualifier_oid))
       return false;
-    // RFC 5280 section 4.2.1.4: When qualifiers are used with the special
-    // policy anyPolicy, they MUST be limited to the qualifiers identified in
-    // this section.
-    if (policy_oid == AnyPolicy() && qualifier_oid != CpsPointerId() &&
+    if (restrict_to_known_qualifiers && qualifier_oid != CpsPointerId() &&
         qualifier_oid != UserNoticeId()) {
       return false;
     }
     der::Tag tag;
     der::Input value;
     if (!policy_information_parser.ReadTagAndValue(&tag, &value))
       return false;
     // Should not have trailing data after qualifier.
     if (policy_information_parser.HasMore())
       return false;
@@ skipping 65 matching lines @@
 // NoticeReference ::= SEQUENCE {
 //      organization     DisplayText,
 //      noticeNumbers    SEQUENCE OF INTEGER }
 //
 // DisplayText ::= CHOICE {
 //      ia5String        IA5String      (SIZE (1..200)),
 //      visibleString    VisibleString  (SIZE (1..200)),
 //      bmpString        BMPString      (SIZE (1..200)),
 //      utf8String       UTF8String     (SIZE (1..200)) }
 bool ParseCertificatePoliciesExtension(const der::Input& extension_value,
+                                       bool fail_parsing_unknown_qualifier_oids,
                                        std::vector<der::Input>* policies) {
   der::Parser extension_parser(extension_value);
   der::Parser policies_sequence_parser;
   if (!extension_parser.ReadSequence(&policies_sequence_parser))
     return false;
   // Should not have trailing data after certificatePolicies sequence.
   if (extension_parser.HasMore())
     return false;
   // The certificatePolicies sequence should have at least 1 element.
   if (!policies_sequence_parser.HasMore())
@@ skipping 25 matching lines @@
       continue;
 
     der::Parser policy_qualifiers_sequence_parser;
     if (!policy_information_parser.ReadSequence(
             &policy_qualifiers_sequence_parser)) {
       return false;
     }
     // Should not have trailing data after policyQualifiers sequence.
     if (policy_information_parser.HasMore())
       return false;
-    if (!ParsePolicyQualifiers(policy_oid, &policy_qualifiers_sequence_parser))
+
+    // RFC 5280 section 4.2.1.4: When qualifiers are used with the special
+    // policy anyPolicy, they MUST be limited to the qualifiers identified in
+    // this section.
+    if (!ParsePolicyQualifiers(
+            fail_parsing_unknown_qualifier_oids || policy_oid == AnyPolicy(),
+            &policy_qualifiers_sequence_parser)) {
       return false;
+    }
   }
 
   return true;
 }
 
 // From RFC 5280:
 //
 //   PolicyConstraints ::= SEQUENCE {
 //        requireExplicitPolicy           [0] SkipCerts OPTIONAL,
 //        inhibitPolicyMapping            [1] SkipCerts OPTIONAL }
@@ skipping 115 matching lines @@
   }
 
   // There shouldn't be extra unconsumed data.
   if (parser.HasMore())
     return false;
 
   return true;
 }
 
 }  // namespace net