Add support for certificate name checking

net/base/x509_certificate_openssl.cc

-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs7.h>
@@ skipping 86 matching lines @@
   if (!alt_name_ext)
     return;
 
   ScopedSSL<GENERAL_NAMES, GENERAL_NAMES_free> alt_names(
       reinterpret_cast<GENERAL_NAMES*>(X509V3_EXT_d2i(alt_name_ext)));
   if (!alt_names.get())
     return;
 
   for (int i = 0; i < sk_GENERAL_NAME_num(alt_names.get()); ++i) {
     const GENERAL_NAME* name = sk_GENERAL_NAME_value(alt_names.get(), i);
     if (name->type == GEN_DNS) {

[wtc, 2010/11/16 00:15:21]

The ParseSubjectAltNames function only includes DNS names,
so it will also need to be enhanced to include IP addresses.

[joth, 2010/11/16 14:01:10]

Yes. Hopefully my TODO on line 382, plus details in the linked bug, should cover
this.

       unsigned char* dns_name = ASN1_STRING_data(name->d.dNSName);
       if (!dns_name)
         continue;
       int dns_name_len = ASN1_STRING_length(name->d.dNSName);
       dns_names->push_back(
           std::string(reinterpret_cast<char*>(dns_name), dns_name_len));
     }
   }
 }
 
@@ skipping 253 matching lines @@
 
   if (dns_names->empty())
     dns_names->push_back(subject_.common_name);
 }
 
 int X509Certificate::Verify(const std::string& hostname,
                             int flags,
                             CertVerifyResult* verify_result) const {
   verify_result->Reset();
 
+  // TODO(joth): We should fetch the subjectAltNames directly rather than via
+  // GetDNSNames, so we can apply special handling for IP addresses vs DNS
+  // names, etc. See http://crbug.com/62973.
+  std::vector<std::string> cert_names;
+  GetDNSNames(&cert_names);
+  if (!x509_openssl_util::VerifyHostname(hostname, cert_names))
+    verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
+
   ScopedSSL<X509_STORE_CTX, X509_STORE_CTX_free> ctx(X509_STORE_CTX_new());
 
   ScopedSSL<STACK_OF(X509), sk_X509_free_fn> intermediates(sk_X509_new_null());
   if (!intermediates.get())
     return ERR_OUT_OF_MEMORY;
 
   for (OSCertHandles::const_iterator it = intermediate_ca_certs_.begin();
        it != intermediate_ca_certs_.end(); ++it) {
     if (!sk_X509_push(intermediates.get(), *it))
       return ERR_OUT_OF_MEMORY;
@@ skipping 30 matching lines @@
   // cache the DER (if not already cached via X509_set_ex_data).
   DERCache der_cache_a, der_cache_b;
 
   return GetDERAndCacheIfNeeded(a, &der_cache_a) &&
       GetDERAndCacheIfNeeded(b, &der_cache_b) &&
       der_cache_a.data_length == der_cache_b.data_length &&
       memcmp(der_cache_a.data, der_cache_b.data, der_cache_a.data_length) == 0;
 }
 
 } // namespace net