Reject certificates that contain unknown policy qualifiers if the

net/cert/internal/verify_certificate_chain.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
 #include <algorithm>
 #include <memory>
 
 #include "base/logging.h"
@@ skipping 50 matching lines @@
 DEFINE_CERT_ERROR_ID(kEkuLacksServerAuth,
                      "The extended key usage does not include server auth");
 DEFINE_CERT_ERROR_ID(kEkuLacksClientAuth,
                      "The extended key usage does not include client auth");
 DEFINE_CERT_ERROR_ID(kCertIsNotTrustAnchor,
                      "Certificate is not a trust anchor");
 DEFINE_CERT_ERROR_ID(kNoValidPolicy, "No valid policy");
 DEFINE_CERT_ERROR_ID(kPolicyMappingAnyPolicy,
                      "PolicyMappings must not map anyPolicy");
 
-bool IsHandledCriticalExtensionOid(const der::Input& oid) {
-  if (oid == BasicConstraintsOid())
+bool IsHandledCriticalExtension(const ParsedExtension& extension) {
+  if (extension.oid == BasicConstraintsOid())
     return true;
   // Key Usage is NOT processed for end-entity certificates (this is the
   // responsibility of callers), however it is considered "handled" here in
   // order to allow being marked as critical.
-  if (oid == KeyUsageOid())
+  if (extension.oid == KeyUsageOid())
     return true;
-  if (oid == ExtKeyUsageOid())
+  if (extension.oid == ExtKeyUsageOid())
     return true;
-  if (oid == NameConstraintsOid())
+  if (extension.oid == NameConstraintsOid())
     return true;
-  if (oid == SubjectAltNameOid())
+  if (extension.oid == SubjectAltNameOid())
     return true;
-  // TODO(eroman): The policy qualifiers are not processed (or in some cases
-  // even parsed). This is fine when the policies extension is non-critical,
-  // however if it is critical the code should also ensure that the policy
-  // qualifiers are only recognized ones (CPS and User Notice).
-  if (oid == CertificatePoliciesOid())
+  if (extension.oid == CertificatePoliciesOid()) {
+    // Policy qualifiers are skipped during processing, so if the
+    // extension is marked critical need to ensure there weren't any
+    // qualifiers other than User Notice / CPS.
+    //
+    // This follows from RFC 5280 section 4.2.1.4:
+    //
+    //   If this extension is critical, the path validation software MUST
+    //   be able to interpret this extension (including the optional
+    //   qualifier), or MUST reject the certificate.
+    std::vector<der::Input> unused_policies;
+    return ParseCertificatePoliciesExtension(
+        extension.value, true /*fail_parsing_unknown_qualifier_oids*/,
+        &unused_policies);
+
+    // TODO(eroman): Give a better error message.
+  }
+  if (extension.oid == PolicyMappingsOid())
     return true;
-  if (oid == PolicyMappingsOid())
+  if (extension.oid == PolicyConstraintsOid())
     return true;
-  if (oid == PolicyConstraintsOid())
-    return true;
-  if (oid == InhibitAnyPolicyOid())
+  if (extension.oid == InhibitAnyPolicyOid())
     return true;
 
   return false;
 }
 
 // Adds errors to |errors| if the certificate contains unconsumed _critical_
 // extensions.
 void VerifyNoUnconsumedCriticalExtensions(const ParsedCertificate& cert,
                                           CertErrors* errors) {
   for (const auto& it : cert.extensions()) {
     const ParsedExtension& extension = it.second;
-    if (extension.critical && !IsHandledCriticalExtensionOid(extension.oid)) {
+    if (extension.critical && !IsHandledCriticalExtension(extension)) {
       errors->AddError(kUnconsumedCriticalExtension,
                        CreateCertErrorParams2Der("oid", extension.oid, "value",
                                                  extension.value));
     }
   }
 }
 
 // Returns true if |cert| was self-issued. The definition of self-issuance
 // comes from RFC 5280 section 6.1:
 //
@@ skipping 1130 matching lines @@
     std::set<der::Input>* user_constrained_policy_set,
     CertPathErrors* errors) {
   PathVerifier verifier;
   verifier.Run(certs, last_cert_trust, signature_policy, time,
                required_key_purpose, initial_explicit_policy,
                user_initial_policy_set, initial_policy_mapping_inhibit,
                initial_any_policy_inhibit, user_constrained_policy_set, errors);
 }
 
 }  // namespace net