Implement GetChain for OpenSSLCertificate.

rtc_base/opensslidentity.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 #include "rtc_base/opensslidentity.h"
 
+#include <algorithm>
 #include <memory>
+#include <vector>
 
 // Must be included first before openssl headers.
 #include "rtc_base/win32.h"  // NOLINT
 
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/pem.h>
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 #include <openssl/crypto.h>
@@ skipping 247 matching lines @@
   }
   X509_print_ex(temp_memory_bio, x509, XN_FLAG_SEP_CPLUS_SPC, 0);
   BIO_write(temp_memory_bio, "\0", 1);
   char* buffer;
   BIO_get_mem_data(temp_memory_bio, &buffer);
   LOG(LS_VERBOSE) << buffer;
   BIO_free(temp_memory_bio);
 }
 #endif
 
+OpenSSLCertificate::OpenSSLCertificate(X509* x509) : x509_(x509) {
+  AddReference(x509_);
+}
+
+OpenSSLCertificate::OpenSSLCertificate(STACK_OF(X509) * chain) {
+  x509_ = sk_X509_value(chain, 0);
+  AddReference(x509_);
+  for (size_t i = 1; i < sk_X509_num(chain); ++i) {
+    X509* x509 = sk_X509_value(chain, i);
+    cert_chain_.push_back(new OpenSSLCertificate(x509));
+  }
+}
+
 OpenSSLCertificate* OpenSSLCertificate::Generate(
     OpenSSLKeyPair* key_pair, const SSLIdentityParams& params) {
   SSLIdentityParams actual_params(params);
   if (actual_params.common_name.empty()) {
     // Use a random string, arbitrarily 8chars long.
     actual_params.common_name = CreateRandomString(8);
   }
   X509* x509 = MakeCertificate(key_pair->pkey(), actual_params);
   if (!x509) {
     LogSSLErrors("Generating certificate");
     return nullptr;
   }
 #if !defined(NDEBUG)
   PrintCert(x509);
 #endif
   OpenSSLCertificate* ret = new OpenSSLCertificate(x509);
   X509_free(x509);
   return ret;
 }
 
 OpenSSLCertificate* OpenSSLCertificate::FromPEMString(
     const std::string& pem_string) {
   BIO* bio = BIO_new_mem_buf(const_cast<char*>(pem_string.c_str()), -1);
   if (!bio)
     return nullptr;
   BIO_set_mem_eof_return(bio, 0);
   X509* x509 =
       PEM_read_bio_X509(bio, nullptr, nullptr, const_cast<char*>("\0"));
+  STACK_OF(X509)* x509s = sk_X509_new_null();
+  while (x509 != nullptr) {
+    sk_X509_push(x509s, x509);
+    x509 = PEM_read_bio_X509(bio, nullptr, nullptr, const_cast<char*>("\0"));
+  }
   BIO_free(bio);  // Frees the BIO, but not the pointed-to string.
 
-  if (!x509)
+  if (sk_X509_num(x509s) == 0)
     return nullptr;
 
-  OpenSSLCertificate* ret = new OpenSSLCertificate(x509);
-  X509_free(x509);
+  OpenSSLCertificate* ret = new OpenSSLCertificate(x509s);
+  sk_X509_pop_free(x509s, X509_free);
   return ret;
 }
 
 // NOTE: This implementation only functions correctly after InitializeSSL
 // and before CleanupSSL.
 bool OpenSSLCertificate::GetSignatureDigestAlgorithm(
     std::string* algorithm) const {
   int nid = OBJ_obj2nid(x509_->sig_alg->algorithm);
   switch (nid) {
     case NID_md5WithRSA:
@@ skipping 29 matching lines @@
       // Unknown algorithm.  There are several unhandled options that are less
       // common and more complex.
       LOG(LS_ERROR) << "Unknown signature algorithm NID: " << nid;
       algorithm->clear();
       return false;
   }
   return true;
 }
 
 std::unique_ptr<SSLCertChain> OpenSSLCertificate::GetChain() const {
-  // Chains are not yet supported when using OpenSSL.
-  // OpenSSLStreamAdapter::SSLVerifyCallback currently requires the remote
-  // certificate to be self-signed.
-  return nullptr;
+  if (cert_chain_.empty()) {
+    return nullptr;
+  }
+  std::unique_ptr<SSLCertChain> chain(new SSLCertChain(cert_chain_));
+  return chain;
 }
 
 bool OpenSSLCertificate::ComputeDigest(const std::string& algorithm,
                                        unsigned char* digest,
                                        size_t size,
                                        size_t* length) const {
   return ComputeDigest(x509_, algorithm, digest, size, length);
 }
 
 bool OpenSSLCertificate::ComputeDigest(const X509* x509,
@@ skipping 12 matching lines @@
 
   X509_digest(x509, md, digest, &n);
 
   *length = n;
 
   return true;
 }
 
 OpenSSLCertificate::~OpenSSLCertificate() {
   X509_free(x509_);
+  for (SSLCertificate* cert : cert_chain_) {
+    delete cert;
+  }
+}
+
+X509* OpenSSLCertificate::GetX509Reference() const {
+  if (x509_ != nullptr) {
+    AddReference(x509_);
+  }
+  return x509_;
 }
 
 OpenSSLCertificate* OpenSSLCertificate::GetReference() const {
-  return new OpenSSLCertificate(x509_);
+  STACK_OF(X509)* stack_x509 = sk_X509_new_null();
+  sk_X509_push(stack_x509, x509_);
+  for (auto cert_it = cert_chain_.begin(); cert_it != cert_chain_.end();
+       ++cert_it) {
+    OpenSSLCertificate* cert = reinterpret_cast<OpenSSLCertificate*>(*cert_it);
+    sk_X509_push(stack_x509, cert->x509());
+  }
+  return new OpenSSLCertificate(stack_x509);
 }
 
 std::string OpenSSLCertificate::ToPEMString() const {
   BIO* bio = BIO_new(BIO_s_mem());
   if (!bio) {
     FATAL() << "unreachable code";
   }
   if (!PEM_write_bio_X509(bio, x509_)) {
     BIO_free(bio);
     FATAL() << "unreachable code";
   }
   BIO_write(bio, "\0", 1);
   char* buffer;
   BIO_get_mem_data(bio, &buffer);
   std::string ret(buffer);
   BIO_free(bio);
+  for (size_t i = 0; i < cert_chain_.size(); ++i) {
+    OpenSSLCertificate* cert =
+        reinterpret_cast<OpenSSLCertificate*>(cert_chain_[i]);
+    ret += cert->ToPEMString();
+  }
   return ret;
 }
 
 void OpenSSLCertificate::ToDER(Buffer* der_buffer) const {
   // In case of failure, make sure to leave the buffer empty.
   der_buffer->SetSize(0);
 
   // Calculates the DER representation of the certificate, from scratch.
   BIO* bio = BIO_new(BIO_s_mem());
   if (!bio) {
     FATAL() << "unreachable code";
   }
   if (!i2d_X509_bio(bio, x509_)) {
     BIO_free(bio);
     FATAL() << "unreachable code";
   }
   char* data;
   size_t length = BIO_get_mem_data(bio, &data);
   der_buffer->SetData(data, length);
   BIO_free(bio);
 }
 
-void OpenSSLCertificate::AddReference() const {
-  RTC_DCHECK(x509_ != nullptr);
+void OpenSSLCertificate::AddReference(X509* x509) const {
+  RTC_DCHECK(x509 != nullptr);
 #if defined(OPENSSL_IS_BORINGSSL)
-  X509_up_ref(x509_);
+  X509_up_ref(x509);
 #else
-  CRYPTO_add(&x509_->references, 1, CRYPTO_LOCK_X509);
+  CRYPTO_add(&x509->references, 1, CRYPTO_LOCK_X509);
 #endif
 }
 
 bool OpenSSLCertificate::operator==(const OpenSSLCertificate& other) const {
+  if (this->cert_chain_.size() != other.cert_chain_.size()) {
+    return false;
+  }
+  for (size_t i = 0; i < cert_chain_.size(); ++i) {
+    OpenSSLCertificate* cert =
+        reinterpret_cast<OpenSSLCertificate*>(cert_chain_[i]);
+    OpenSSLCertificate* other_cert =
+        reinterpret_cast<OpenSSLCertificate*>(other.cert_chain_[i]);
+    if (*cert != *other_cert) {
+      return false;
+    }
+  }
   return X509_cmp(this->x509_, other.x509_) == 0;
 }
 
 bool OpenSSLCertificate::operator!=(const OpenSSLCertificate& other) const {
   return !(*this == other);
 }
 
 // Documented in sslidentity.h.
 int64_t OpenSSLCertificate::CertificateExpirationTime() const {
   ASN1_TIME* expire_time = X509_get_notAfter(x509_);
@@ skipping 83 matching lines @@
                              certificate_->GetReference());
 }
 
 bool OpenSSLIdentity::ConfigureIdentity(SSL_CTX* ctx) {
   // 1 is the documented success return code.
   if (SSL_CTX_use_certificate(ctx, certificate_->x509()) != 1 ||
      SSL_CTX_use_PrivateKey(ctx, key_pair_->pkey()) != 1) {
     LogSSLErrors("Configuring key and certificate");
     return false;
   }
+  // If Chains are available, use it.
+  std::unique_ptr<SSLCertChain> cert_chain = certificate_->GetChain();
+  for (size_t i = 0; cert_chain != nullptr && i < cert_chain->GetSize(); ++i) {
+    const OpenSSLCertificate* cert =
+        reinterpret_cast<const OpenSSLCertificate*>(&cert_chain->Get(i));
+    if (!SSL_CTX_add_extra_chain_cert(ctx, cert->GetX509Reference())) {
+      LogSSLErrors("Configuring intermediate certificate");
+      return false;
+    }
+  }
   return true;
 }
 
 std::string OpenSSLIdentity::PrivateKeyToPEMString() const {
   return key_pair_->PrivateKeyToPEMString();
 }
 
 std::string OpenSSLIdentity::PublicKeyToPEMString() const {
   return key_pair_->PublicKeyToPEMString();
 }
 
 bool OpenSSLIdentity::operator==(const OpenSSLIdentity& other) const {
   return *this->key_pair_ == *other.key_pair_ &&
          *this->certificate_ == *other.certificate_;
 }
 
 bool OpenSSLIdentity::operator!=(const OpenSSLIdentity& other) const {
   return !(*this == other);
 }
 
 }  // namespace rtc