Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/x509_util.h" | 5 #include "net/cert/x509_util.h" |
| 6 #include "net/cert/x509_util_nss.h" | 6 #include "net/cert/x509_util_nss.h" |
| 7 | 7 |
| 8 #include <cert.h> // Must be included before certdb.h | 8 #include <cert.h> // Must be included before certdb.h |
| 9 #include <certdb.h> | 9 #include <certdb.h> |
| 10 #include <cryptohi.h> | 10 #include <cryptohi.h> |
| (...skipping 15 matching lines...) Expand all Loading... | |
| 26 #include "crypto/nss_util_internal.h" | 26 #include "crypto/nss_util_internal.h" |
| 27 #include "crypto/rsa_private_key.h" | 27 #include "crypto/rsa_private_key.h" |
| 28 #include "crypto/scoped_nss_types.h" | 28 #include "crypto/scoped_nss_types.h" |
| 29 #include "crypto/third_party/nss/chromium-nss.h" | 29 #include "crypto/third_party/nss/chromium-nss.h" |
| 30 #include "net/cert/x509_certificate.h" | 30 #include "net/cert/x509_certificate.h" |
| 31 | 31 |
| 32 namespace net { | 32 namespace net { |
| 33 | 33 |
| 34 namespace { | 34 namespace { |
| 35 | 35 |
| 36 class DomainBoundCertOIDWrapper { | 36 class ChannelIDOIDWrapper { |
| 37 public: | 37 public: |
| 38 static DomainBoundCertOIDWrapper* GetInstance() { | 38 static ChannelIDOIDWrapper* GetInstance() { |
| 39 // Instantiated as a leaky singleton to allow the singleton to be | 39 // Instantiated as a leaky singleton to allow the singleton to be |
| 40 // constructed on a worker thead that is not joined when a process | 40 // constructed on a worker thead that is not joined when a process |
| 41 // shuts down. | 41 // shuts down. |
| 42 return Singleton<DomainBoundCertOIDWrapper, | 42 return Singleton<ChannelIDOIDWrapper, |
| 43 LeakySingletonTraits<DomainBoundCertOIDWrapper> >::get(); | 43 LeakySingletonTraits<ChannelIDOIDWrapper> >::get(); |
| 44 } | 44 } |
| 45 | 45 |
| 46 SECOidTag domain_bound_cert_oid_tag() const { | 46 SECOidTag domain_bound_cert_oid_tag() const { |
| 47 return domain_bound_cert_oid_tag_; | 47 return domain_bound_cert_oid_tag_; |
| 48 } | 48 } |
| 49 | 49 |
| 50 private: | 50 private: |
| 51 friend struct DefaultSingletonTraits<DomainBoundCertOIDWrapper>; | 51 friend struct DefaultSingletonTraits<ChannelIDOIDWrapper>; |
| 52 | 52 |
| 53 DomainBoundCertOIDWrapper(); | 53 ChannelIDOIDWrapper(); |
| 54 | 54 |
| 55 SECOidTag domain_bound_cert_oid_tag_; | 55 SECOidTag domain_bound_cert_oid_tag_; |
|
wtc
2014/07/01 19:50:52
Note: it is fine to not rename this member because
Ryan Hamilton
2014/07/21 19:12:08
Acknowledged.
| |
| 56 | 56 |
| 57 DISALLOW_COPY_AND_ASSIGN(DomainBoundCertOIDWrapper); | 57 DISALLOW_COPY_AND_ASSIGN(ChannelIDOIDWrapper); |
| 58 }; | 58 }; |
| 59 | 59 |
| 60 DomainBoundCertOIDWrapper::DomainBoundCertOIDWrapper() | 60 ChannelIDOIDWrapper::ChannelIDOIDWrapper() |
| 61 : domain_bound_cert_oid_tag_(SEC_OID_UNKNOWN) { | 61 : domain_bound_cert_oid_tag_(SEC_OID_UNKNOWN) { |
| 62 // 1.3.6.1.4.1.11129.2.1.6 | 62 // 1.3.6.1.4.1.11129.2.1.6 |
| 63 // (iso.org.dod.internet.private.enterprises.google.googleSecurity. | 63 // (iso.org.dod.internet.private.enterprises.google.googleSecurity. |
| 64 // certificateExtensions.originBoundCertificate) | 64 // certificateExtensions.originBoundCertificate) |
| 65 static const uint8 kObCertOID[] = { | 65 static const uint8 kObCertOID[] = { |
| 66 0x2b, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x01, 0x06 | 66 0x2b, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x01, 0x06 |
| 67 }; | 67 }; |
| 68 SECOidData oid_data; | 68 SECOidData oid_data; |
| 69 memset(&oid_data, 0, sizeof(oid_data)); | 69 memset(&oid_data, 0, sizeof(oid_data)); |
| 70 oid_data.oid.data = const_cast<uint8*>(kObCertOID); | 70 oid_data.oid.data = const_cast<uint8*>(kObCertOID); |
| (...skipping 213 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 284 crypto::BaseTimeToPRTime(not_valid_before), | 284 crypto::BaseTimeToPRTime(not_valid_before), |
| 285 crypto::BaseTimeToPRTime(not_valid_after)); | 285 crypto::BaseTimeToPRTime(not_valid_after)); |
| 286 | 286 |
| 287 if (!validity) | 287 if (!validity) |
| 288 return false; | 288 return false; |
| 289 | 289 |
| 290 CERT_DestroyValidity(validity); | 290 CERT_DestroyValidity(validity); |
| 291 return true; | 291 return true; |
| 292 } | 292 } |
| 293 | 293 |
| 294 bool CreateDomainBoundCertEC(crypto::ECPrivateKey* key, | 294 bool CreateChannelIDEC(crypto::ECPrivateKey* key, |
| 295 DigestAlgorithm alg, | 295 DigestAlgorithm alg, |
| 296 const std::string& domain, | 296 const std::string& domain, |
| 297 uint32 serial_number, | 297 uint32 serial_number, |
| 298 base::Time not_valid_before, | 298 base::Time not_valid_before, |
| 299 base::Time not_valid_after, | 299 base::Time not_valid_after, |
| 300 std::string* der_cert) { | 300 std::string* der_cert) { |
|
wtc
2014/07/01 19:50:52
Fix the indentation of the parameters.
Ryan Hamilton
2014/07/21 19:12:08
Done.
| |
| 301 DCHECK(key); | 301 DCHECK(key); |
| 302 | 302 |
| 303 CERTCertificate* cert = CreateCertificate(key->public_key(), | 303 CERTCertificate* cert = CreateCertificate(key->public_key(), |
| 304 "CN=anonymous.invalid", | 304 "CN=anonymous.invalid", |
| 305 serial_number, | 305 serial_number, |
| 306 not_valid_before, | 306 not_valid_before, |
| 307 not_valid_after); | 307 not_valid_after); |
| 308 | 308 |
| 309 if (!cert) | 309 if (!cert) |
| 310 return false; | 310 return false; |
| (...skipping 20 matching lines...) Expand all Loading... | |
| 331 if (asn1_domain_string == NULL) { | 331 if (asn1_domain_string == NULL) { |
| 332 LOG(ERROR) << "Unable to get ASN1 encoding for domain in domain_bound_cert" | 332 LOG(ERROR) << "Unable to get ASN1 encoding for domain in domain_bound_cert" |
| 333 " extension"; | 333 " extension"; |
| 334 CERT_DestroyCertificate(cert); | 334 CERT_DestroyCertificate(cert); |
| 335 return false; | 335 return false; |
| 336 } | 336 } |
| 337 | 337 |
| 338 // Add the extension to the opaque handle | 338 // Add the extension to the opaque handle |
| 339 if (CERT_AddExtension( | 339 if (CERT_AddExtension( |
| 340 cert_handle, | 340 cert_handle, |
| 341 DomainBoundCertOIDWrapper::GetInstance()->domain_bound_cert_oid_tag(), | 341 ChannelIDOIDWrapper::GetInstance()->domain_bound_cert_oid_tag(), |
| 342 asn1_domain_string, | 342 asn1_domain_string, |
| 343 PR_TRUE, | 343 PR_TRUE, |
| 344 PR_TRUE) != SECSuccess){ | 344 PR_TRUE) != SECSuccess){ |
| 345 LOG(ERROR) << "Unable to add domain bound cert extension to opaque handle"; | 345 LOG(ERROR) << "Unable to add domain bound cert extension to opaque handle"; |
| 346 CERT_DestroyCertificate(cert); | 346 CERT_DestroyCertificate(cert); |
| 347 return false; | 347 return false; |
| 348 } | 348 } |
| 349 | 349 |
| 350 // Copy extension into x509 cert | 350 // Copy extension into x509 cert |
| 351 if (CERT_FinishExtensions(cert_handle) != SECSuccess){ | 351 if (CERT_FinishExtensions(cert_handle) != SECSuccess){ |
| (...skipping 277 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 629 } | 629 } |
| 630 | 630 |
| 631 return new_name; | 631 return new_name; |
| 632 } | 632 } |
| 633 | 633 |
| 634 #endif // defined(USE_NSS) || defined(OS_IOS) | 634 #endif // defined(USE_NSS) || defined(OS_IOS) |
| 635 | 635 |
| 636 } // namespace x509_util | 636 } // namespace x509_util |
| 637 | 637 |
| 638 } // namespace net | 638 } // namespace net |
| OLD | NEW |