net: add ability to distinguish user-added root CAs.

net/base/x509_certificate_mac.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <Security/Security.h>
 #include <time.h>
 
 #include <vector>
 
 #include "base/crypto/cssm_init.h"
 #include "base/crypto/rsa_private_key.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
+#include "base/mac/scoped_cftyperef.h"
 #include "base/memory/singleton.h"
 #include "base/nss_util.h"
 #include "base/pickle.h"
-#include "base/mac/scoped_cftyperef.h"
+#include "base/sha1.h"
 #include "base/sys_string_conversions.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_root_certs.h"
+#include "net/base/x509_certificate_mac_known_hashes.h"
 #include "third_party/nss/mozilla/security/nss/lib/certdb/cert.h"
 
 using base::mac::ScopedCFTypeRef;
 using base::Time;
 
 namespace net {
 
 namespace {
 
 typedef OSStatus (*SecTrustCopyExtendedResultFuncPtr)(SecTrustRef,
@@ skipping 471 matching lines @@
 
   GetCertDateForOID(cert_handle_, CSSMOID_X509V1ValidityNotBefore,
                     &valid_start_);
   GetCertDateForOID(cert_handle_, CSSMOID_X509V1ValidityNotAfter,
                     &valid_expiry_);
 
   fingerprint_ = CalculateFingerprint(cert_handle_);
   serial_number_ = GetCertSerialNumber(cert_handle_);
 }
 
+// IsIssuedByKnownRoot returns true if the given chain is rooted at a root CA
+// that we recognise as a standard root.
+bool X509Certificate::IsIssuedByKnownRoot(CFArrayRef chain) {
+  int n = CFArrayGetCount(chain);
+  if (n < 1)
+    return true;
+  SecCertificateRef root_ref = reinterpret_cast<SecCertificateRef>(
+      const_cast<void*>(CFArrayGetValueAtIndex(chain, n - 1)));
+  SHA1Fingerprint hash = X509Certificate::CalculateFingerprint(root_ref);
+  return X509Certificate::IsSHA1HashInSortedArray(

[wtc, 2011/04/07 05:01:54]

Can we omit X509Certificate:: in this method?

[agl, 2011/04/07 15:02:49]

Done.

+      hash, &kKnownRootCertSHA1Hashes[0][0], sizeof(kKnownRootCertSHA1Hashes));
+}
+
 // static
 X509Certificate* X509Certificate::CreateFromPickle(const Pickle& pickle,
                                                    void** pickle_iter) {
   const char* data;
   int length;
   if (!pickle.ReadData(pickle_iter, &data, &length))
     return NULL;
 
   return CreateFromBytes(data, length);
 }
@@ skipping 255 matching lines @@
   if (status)
     return NetErrorFromOSStatus(status);
   CFArrayRef completed_chain = NULL;
   CSSM_TP_APPLE_EVIDENCE_INFO* chain_info;
   status = SecTrustGetResult(trust_ref, &trust_result, &completed_chain,
                              &chain_info);
   if (status)
     return NetErrorFromOSStatus(status);
   ScopedCFTypeRef<CFArrayRef> scoped_completed_chain(completed_chain);
 
+  verify_result->is_issued_by_known_root = IsIssuedByKnownRoot(completed_chain);
+
   // Evaluate the results
   OSStatus cssm_result;
   bool got_certificate_error = false;
   switch (trust_result) {
     case kSecTrustResultUnspecified:
     case kSecTrustResultProceed:
       // Certificate chain is valid and trusted ("unspecified" indicates that
       // the user has not explicitly set a trust setting)
       break;
 
@@ skipping 98 matching lines @@
           // server certificate, which we don't need at this point (and we
           // have other ways to access, anyway). All we care is that
           // SecTrustCopyExtendedResult() returned noErr and a non-NULL
           // dictionary.
           CFRelease(ev_dict);
           verify_result->cert_status |= CERT_STATUS_IS_EV;
         }
       }
     }
   }
 

[wtc, 2011/04/07 05:01:54]

It seems better to set verify_result->is_issued_by_known_root
here, as you did before, or at line 899-900 above, when we
know the certificate is good.  I believe |completed_chain|
is still in scope.

   return OK;
 }
 
 bool X509Certificate::GetDEREncoded(std::string* encoded) {
   encoded->clear();
   CSSM_DATA der_data;
   if(SecCertificateGetData(cert_handle_, &der_data) == noErr) {
     encoded->append(reinterpret_cast<char*>(der_data.Data),
                     der_data.Length);
     return true;
@@ skipping 286 matching lines @@
       CFArrayAppendArray(chain,
                          cert_chain,
                          CFRangeMake(1, chain_count - 1));
     }
   }
 
   return chain.release();
 }
 
 }  // namespace net