| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/cert_verify_proc_android.h" | 5 #include "net/cert/cert_verify_proc_android.h" |
| 6 | 6 |
| 7 #include <openssl/x509v3.h> | 7 #include <openssl/x509v3.h> |
| 8 | 8 |
| 9 #include <string> | 9 #include <string> |
| 10 #include <vector> | 10 #include <vector> |
| (...skipping 20 matching lines...) Expand all Loading... |
| 31 const std::string& hostname, | 31 const std::string& hostname, |
| 32 CertVerifyResult* verify_result) { | 32 CertVerifyResult* verify_result) { |
| 33 android::CertVerifyStatusAndroid status; | 33 android::CertVerifyStatusAndroid status; |
| 34 std::vector<std::string> verified_chain; | 34 std::vector<std::string> verified_chain; |
| 35 | 35 |
| 36 // TODO(joth): Fetch the authentication type from SSL rather than hardcode. | 36 // TODO(joth): Fetch the authentication type from SSL rather than hardcode. |
| 37 android::VerifyX509CertChain(cert_bytes, "RSA", hostname, | 37 android::VerifyX509CertChain(cert_bytes, "RSA", hostname, |
| 38 &status, &verify_result->is_issued_by_known_root, | 38 &status, &verify_result->is_issued_by_known_root, |
| 39 &verified_chain); | 39 &verified_chain); |
| 40 switch (status) { | 40 switch (status) { |
| 41 case android::VERIFY_FAILED: | 41 case android::CERT_VERIFY_STATUS_ANDROID_FAILED: |
| 42 return false; | 42 return false; |
| 43 case android::VERIFY_OK: | 43 case android::CERT_VERIFY_STATUS_ANDROID_OK: |
| 44 break; | 44 break; |
| 45 case android::VERIFY_NO_TRUSTED_ROOT: | 45 case android::CERT_VERIFY_STATUS_ANDROID_NO_TRUSTED_ROOT: |
| 46 verify_result->cert_status |= CERT_STATUS_AUTHORITY_INVALID; | 46 verify_result->cert_status |= CERT_STATUS_AUTHORITY_INVALID; |
| 47 break; | 47 break; |
| 48 case android::VERIFY_EXPIRED: | 48 case android::CERT_VERIFY_STATUS_ANDROID_EXPIRED: |
| 49 case android::VERIFY_NOT_YET_VALID: | 49 case android::CERT_VERIFY_STATUS_ANDROID_NOT_YET_VALID: |
| 50 verify_result->cert_status |= CERT_STATUS_DATE_INVALID; | 50 verify_result->cert_status |= CERT_STATUS_DATE_INVALID; |
| 51 break; | 51 break; |
| 52 case android::VERIFY_UNABLE_TO_PARSE: | 52 case android::CERT_VERIFY_STATUS_ANDROID_UNABLE_TO_PARSE: |
| 53 verify_result->cert_status |= CERT_STATUS_INVALID; | 53 verify_result->cert_status |= CERT_STATUS_INVALID; |
| 54 break; | 54 break; |
| 55 case android::VERIFY_INCORRECT_KEY_USAGE: | 55 case android::CERT_VERIFY_STATUS_ANDROID_INCORRECT_KEY_USAGE: |
| 56 verify_result->cert_status |= CERT_STATUS_INVALID; | 56 verify_result->cert_status |= CERT_STATUS_INVALID; |
| 57 break; | 57 break; |
| 58 default: | 58 default: |
| 59 NOTREACHED(); | 59 NOTREACHED(); |
| 60 verify_result->cert_status |= CERT_STATUS_INVALID; | 60 verify_result->cert_status |= CERT_STATUS_INVALID; |
| 61 break; | 61 break; |
| 62 } | 62 } |
| 63 | 63 |
| 64 // Save the verified chain. | 64 // Save the verified chain. |
| 65 if (!verified_chain.empty()) { | 65 if (!verified_chain.empty()) { |
| (...skipping 12 matching lines...) Expand all Loading... |
| 78 const X509Certificate::OSCertHandles& intermediates = | 78 const X509Certificate::OSCertHandles& intermediates = |
| 79 verify_result->verified_cert->GetIntermediateCertificates(); | 79 verify_result->verified_cert->GetIntermediateCertificates(); |
| 80 chain.push_back(verify_result->verified_cert->os_cert_handle()); | 80 chain.push_back(verify_result->verified_cert->os_cert_handle()); |
| 81 chain.insert(chain.end(), intermediates.begin(), intermediates.end()); | 81 chain.insert(chain.end(), intermediates.begin(), intermediates.end()); |
| 82 | 82 |
| 83 // If the chain successfully verified, ignore the trust anchor (the last | 83 // If the chain successfully verified, ignore the trust anchor (the last |
| 84 // certificate). Otherwise, assume the chain is partial. This is not entirely | 84 // certificate). Otherwise, assume the chain is partial. This is not entirely |
| 85 // correct, as a full chain may have been constructed and then failed to | 85 // correct, as a full chain may have been constructed and then failed to |
| 86 // validate. However, if that is the case, the more serious error will | 86 // validate. However, if that is the case, the more serious error will |
| 87 // override any SHA-1 considerations. | 87 // override any SHA-1 considerations. |
| 88 size_t correction_for_root = (status == android::VERIFY_OK) ? 1 : 0; | 88 size_t correction_for_root = |
| 89 (status == android::CERT_VERIFY_STATUS_ANDROID_OK) ? 1 : 0; |
| 89 for (size_t i = 0; i < chain.size() - correction_for_root; ++i) { | 90 for (size_t i = 0; i < chain.size() - correction_for_root; ++i) { |
| 90 int sig_alg = OBJ_obj2nid(chain[i]->sig_alg->algorithm); | 91 int sig_alg = OBJ_obj2nid(chain[i]->sig_alg->algorithm); |
| 91 if (sig_alg == NID_md2WithRSAEncryption) { | 92 if (sig_alg == NID_md2WithRSAEncryption) { |
| 92 verify_result->has_md2 = true; | 93 verify_result->has_md2 = true; |
| 93 } else if (sig_alg == NID_md4WithRSAEncryption) { | 94 } else if (sig_alg == NID_md4WithRSAEncryption) { |
| 94 verify_result->has_md4 = true; | 95 verify_result->has_md4 = true; |
| 95 } else if (sig_alg == NID_md5WithRSAEncryption || | 96 } else if (sig_alg == NID_md5WithRSAEncryption || |
| 96 sig_alg == NID_md5WithRSA) { | 97 sig_alg == NID_md5WithRSA) { |
| 97 verify_result->has_md5 = true; | 98 verify_result->has_md5 = true; |
| 98 } else if (sig_alg == NID_sha1WithRSAEncryption || | 99 } else if (sig_alg == NID_sha1WithRSAEncryption || |
| (...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 173 NOTREACHED(); | 174 NOTREACHED(); |
| 174 return ERR_FAILED; | 175 return ERR_FAILED; |
| 175 } | 176 } |
| 176 if (IsCertStatusError(verify_result->cert_status)) | 177 if (IsCertStatusError(verify_result->cert_status)) |
| 177 return MapCertStatusToNetError(verify_result->cert_status); | 178 return MapCertStatusToNetError(verify_result->cert_status); |
| 178 | 179 |
| 179 return OK; | 180 return OK; |
| 180 } | 181 } |
| 181 | 182 |
| 182 } // namespace net | 183 } // namespace net |
| OLD | NEW |