net: add ability to distinguish user-added root CAs.

net/base/x509_certificate_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <cert.h>
 #include <cryptohi.h>
 #include <keyhi.h>
 #include <nss.h>
@@ skipping 185 matching lines @@
         break;
       case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION:
         verify_result->has_md4 = true;
         break;
       default:
         break;
     }
   }
 }
 
+// IsKnownRoot returns true if the given certificate is one that we believe is
+// a standard (as opposed to user-installed) root.
+static bool IsKnownRoot(CERTCertificate* root) {

[wtc, 2011/04/06 04:28:38]

Remove 'static', because this is in the unnamed namespace.

It's better to name this function IsBuiltinRoot.  ("Built-in"
is what NSS calls these roots.)

[agl, 2011/04/06 19:02:02]

Done.

+  if (!root->slot)
+    return false;
+
+  // This magic name is taken from
+  // http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ckfw/builtins/constants.c&rev=1.13&mark=86,89#79
+  return 0 == strcmp(PK11_GetSlotName(root->slot),
+                     "NSS Builtin Objects");
+}
+
 typedef char* (*CERTGetNameFunc)(CERTName* name);
 
 void ParsePrincipal(CERTName* name,
                     CertPrincipal* principal) {
   // TODO(jcampan): add business_category and serial_number.
   // TODO(wtc): NSS has the CERT_GetOrgName, CERT_GetOrgUnitName, and
   // CERT_GetDomainComponentName functions, but they return only the most
   // general (the first) RDN.  NSS doesn't have a function for the street
   // address.
   static const SECOidTag kOIDs[] = {
@@ skipping 546 matching lines @@
     verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
 
   // Make sure that the cert is valid now.
   SECCertTimeValidity validity = CERT_CheckCertValidTimes(
       cert_handle_, PR_Now(), PR_TRUE);
   if (validity != secCertTimeValid)
     verify_result->cert_status |= CERT_STATUS_DATE_INVALID;
 
   CERTValOutParam cvout[3];
   int cvout_index = 0;
   // We don't need the trust anchor for the first PKIXVerifyCert call.

[wtc, 2011/04/06 04:28:38]

Delete this comment because it's no longer true.

[agl, 2011/04/06 19:02:02]

Done.

   cvout[cvout_index].type = cert_po_certList;
   cvout[cvout_index].value.pointer.chain = NULL;
   int cvout_cert_list_index = cvout_index;
   cvout_index++;
+  cvout[cvout_index].type = cert_po_trustAnchor;
+  cvout[cvout_index].value.pointer.cert = NULL;
+  int cvout_trust_anchor_index = cvout_index;
+  cvout_index++;
   cvout[cvout_index].type = cert_po_end;
   ScopedCERTValOutParam scoped_cvout(cvout);
 
   bool check_revocation = (flags & VERIFY_REV_CHECKING_ENABLED);
   if (check_revocation) {
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
   } else {
     // EV requires revocation checking.
     flags &= ~VERIFY_EV_CERT;
   }
@@ skipping 14 matching lines @@
     }
     // |err| is not a certificate error.
     return MapSecurityError(err);
   }
 
   GetCertChainInfo(cvout[cvout_cert_list_index].value.pointer.chain,
                    verify_result);
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
+  verify_result->is_probably_mitm_cert =
+      !IsKnownRoot(cvout[cvout_trust_anchor_index].value.pointer.cert);
+
   if ((flags & VERIFY_EV_CERT) && VerifyEV())
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
 }
 
 bool X509Certificate::VerifyNameMatch(const std::string& hostname) const {
   return CERT_VerifyCertName(cert_handle_, hostname.c_str()) == SECSuccess;
 }
 
 // Studied Mozilla's code (esp. security/manager/ssl/src/nsIdentityChecking.cpp
@@ skipping 137 matching lines @@
   DCHECK(0 != cert->derCert.len);
 
   SECStatus rv = HASH_HashBuf(HASH_AlgSHA1, sha1.data,
                               cert->derCert.data, cert->derCert.len);
   DCHECK(rv == SECSuccess);
 
   return sha1;
 }
 
 }  // namespace net