| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/cert/cert_verify_proc_nss.h" | |
| 6 | |
| 7 #include <string> | |
| 8 #include <vector> | |
| 9 | |
| 10 #include <cert.h> | |
| 11 #include <nss.h> | |
| 12 #include <prerror.h> | |
| 13 #include <secerr.h> | |
| 14 #include <sechash.h> | |
| 15 #include <sslerr.h> | |
| 16 | |
| 17 #include "base/logging.h" | |
| 18 #include "crypto/nss_util.h" | |
| 19 #include "crypto/scoped_nss_types.h" | |
| 20 #include "crypto/sha2.h" | |
| 21 #include "net/base/net_errors.h" | |
| 22 #include "net/cert/asn1_util.h" | |
| 23 #include "net/cert/cert_status_flags.h" | |
| 24 #include "net/cert/cert_verifier.h" | |
| 25 #include "net/cert/cert_verify_result.h" | |
| 26 #include "net/cert/crl_set.h" | |
| 27 #include "net/cert/ev_root_ca_metadata.h" | |
| 28 #include "net/cert/x509_certificate.h" | |
| 29 #include "net/cert/x509_util_nss.h" | |
| 30 | |
| 31 #if defined(OS_IOS) | |
| 32 #include <CommonCrypto/CommonDigest.h> | |
| 33 #include "net/cert/x509_util_ios.h" | |
| 34 #endif // defined(OS_IOS) | |
| 35 | |
| 36 namespace net { | |
| 37 | |
| 38 namespace { | |
| 39 | |
| 40 typedef scoped_ptr< | |
| 41 CERTCertificatePolicies, | |
| 42 crypto::NSSDestroyer<CERTCertificatePolicies, | |
| 43 CERT_DestroyCertificatePoliciesExtension> > | |
| 44 ScopedCERTCertificatePolicies; | |
| 45 | |
| 46 typedef scoped_ptr< | |
| 47 CERTCertList, | |
| 48 crypto::NSSDestroyer<CERTCertList, CERT_DestroyCertList> > | |
| 49 ScopedCERTCertList; | |
| 50 | |
| 51 // ScopedCERTValOutParam manages destruction of values in the CERTValOutParam | |
| 52 // array that cvout points to. cvout must be initialized as passed to | |
| 53 // CERT_PKIXVerifyCert, so that the array must be terminated with | |
| 54 // cert_po_end type. | |
| 55 // When it goes out of scope, it destroys values of cert_po_trustAnchor | |
| 56 // and cert_po_certList types, but doesn't release the array itself. | |
| 57 class ScopedCERTValOutParam { | |
| 58 public: | |
| 59 explicit ScopedCERTValOutParam(CERTValOutParam* cvout) : cvout_(cvout) {} | |
| 60 | |
| 61 ~ScopedCERTValOutParam() { | |
| 62 Clear(); | |
| 63 } | |
| 64 | |
| 65 // Free the internal resources, but do not release the array itself. | |
| 66 void Clear() { | |
| 67 if (cvout_ == NULL) | |
| 68 return; | |
| 69 for (CERTValOutParam *p = cvout_; p->type != cert_po_end; p++) { | |
| 70 switch (p->type) { | |
| 71 case cert_po_trustAnchor: | |
| 72 if (p->value.pointer.cert) { | |
| 73 CERT_DestroyCertificate(p->value.pointer.cert); | |
| 74 p->value.pointer.cert = NULL; | |
| 75 } | |
| 76 break; | |
| 77 case cert_po_certList: | |
| 78 if (p->value.pointer.chain) { | |
| 79 CERT_DestroyCertList(p->value.pointer.chain); | |
| 80 p->value.pointer.chain = NULL; | |
| 81 } | |
| 82 break; | |
| 83 default: | |
| 84 break; | |
| 85 } | |
| 86 } | |
| 87 } | |
| 88 | |
| 89 private: | |
| 90 CERTValOutParam* cvout_; | |
| 91 | |
| 92 DISALLOW_COPY_AND_ASSIGN(ScopedCERTValOutParam); | |
| 93 }; | |
| 94 | |
| 95 // Map PORT_GetError() return values to our network error codes. | |
| 96 int MapSecurityError(int err) { | |
| 97 switch (err) { | |
| 98 case PR_DIRECTORY_LOOKUP_ERROR: // DNS lookup error. | |
| 99 return ERR_NAME_NOT_RESOLVED; | |
| 100 case SEC_ERROR_INVALID_ARGS: | |
| 101 return ERR_INVALID_ARGUMENT; | |
| 102 case SSL_ERROR_BAD_CERT_DOMAIN: | |
| 103 return ERR_CERT_COMMON_NAME_INVALID; | |
| 104 case SEC_ERROR_INVALID_TIME: | |
| 105 case SEC_ERROR_EXPIRED_CERTIFICATE: | |
| 106 case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE: | |
| 107 return ERR_CERT_DATE_INVALID; | |
| 108 case SEC_ERROR_UNKNOWN_ISSUER: | |
| 109 case SEC_ERROR_UNTRUSTED_ISSUER: | |
| 110 case SEC_ERROR_CA_CERT_INVALID: | |
| 111 case SEC_ERROR_APPLICATION_CALLBACK_ERROR: // Rejected by | |
| 112 // chain_verify_callback. | |
| 113 return ERR_CERT_AUTHORITY_INVALID; | |
| 114 // TODO(port): map ERR_CERT_NO_REVOCATION_MECHANISM. | |
| 115 case SEC_ERROR_OCSP_BAD_HTTP_RESPONSE: | |
| 116 case SEC_ERROR_OCSP_SERVER_ERROR: | |
| 117 return ERR_CERT_UNABLE_TO_CHECK_REVOCATION; | |
| 118 case SEC_ERROR_REVOKED_CERTIFICATE: | |
| 119 case SEC_ERROR_UNTRUSTED_CERT: // Treat as revoked. | |
| 120 return ERR_CERT_REVOKED; | |
| 121 case SEC_ERROR_CERT_NOT_IN_NAME_SPACE: | |
| 122 return ERR_CERT_NAME_CONSTRAINT_VIOLATION; | |
| 123 case SEC_ERROR_BAD_DER: | |
| 124 case SEC_ERROR_BAD_SIGNATURE: | |
| 125 case SEC_ERROR_CERT_NOT_VALID: | |
| 126 // TODO(port): add an ERR_CERT_WRONG_USAGE error code. | |
| 127 case SEC_ERROR_CERT_USAGES_INVALID: | |
| 128 case SEC_ERROR_INADEQUATE_KEY_USAGE: // Key usage. | |
| 129 case SEC_ERROR_INADEQUATE_CERT_TYPE: // Extended key usage and whether | |
| 130 // the certificate is a CA. | |
| 131 case SEC_ERROR_POLICY_VALIDATION_FAILED: | |
| 132 case SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID: | |
| 133 case SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION: | |
| 134 case SEC_ERROR_EXTENSION_VALUE_INVALID: | |
| 135 return ERR_CERT_INVALID; | |
| 136 case SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED: | |
| 137 return ERR_CERT_WEAK_SIGNATURE_ALGORITHM; | |
| 138 default: | |
| 139 LOG(WARNING) << "Unknown error " << err << " mapped to net::ERR_FAILED"; | |
| 140 return ERR_FAILED; | |
| 141 } | |
| 142 } | |
| 143 | |
| 144 // Map PORT_GetError() return values to our cert status flags. | |
| 145 CertStatus MapCertErrorToCertStatus(int err) { | |
| 146 int net_error = MapSecurityError(err); | |
| 147 return MapNetErrorToCertStatus(net_error); | |
| 148 } | |
| 149 | |
| 150 // Saves some information about the certificate chain cert_list in | |
| 151 // *verify_result. The caller MUST initialize *verify_result before calling | |
| 152 // this function. | |
| 153 // Note that cert_list[0] is the end entity certificate. | |
| 154 void GetCertChainInfo(CERTCertList* cert_list, | |
| 155 CERTCertificate* root_cert, | |
| 156 CertVerifyResult* verify_result) { | |
| 157 DCHECK(cert_list); | |
| 158 | |
| 159 CERTCertificate* verified_cert = NULL; | |
| 160 std::vector<CERTCertificate*> verified_chain; | |
| 161 int i = 0; | |
| 162 for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list); | |
| 163 !CERT_LIST_END(node, cert_list); | |
| 164 node = CERT_LIST_NEXT(node), ++i) { | |
| 165 if (i == 0) { | |
| 166 verified_cert = node->cert; | |
| 167 } else { | |
| 168 // Because of an NSS bug, CERT_PKIXVerifyCert may chain a self-signed | |
| 169 // certificate of a root CA to another certificate of the same root CA | |
| 170 // key. Detect that error and ignore the root CA certificate. | |
| 171 // See https://bugzilla.mozilla.org/show_bug.cgi?id=721288. | |
| 172 if (node->cert->isRoot) { | |
| 173 // NOTE: isRoot doesn't mean the certificate is a trust anchor. It | |
| 174 // means the certificate is self-signed. Here we assume isRoot only | |
| 175 // implies the certificate is self-issued. | |
| 176 CERTCertListNode* next_node = CERT_LIST_NEXT(node); | |
| 177 CERTCertificate* next_cert; | |
| 178 if (!CERT_LIST_END(next_node, cert_list)) { | |
| 179 next_cert = next_node->cert; | |
| 180 } else { | |
| 181 next_cert = root_cert; | |
| 182 } | |
| 183 // Test that |node->cert| is actually a self-signed certificate | |
| 184 // whose key is equal to |next_cert|, and not a self-issued | |
| 185 // certificate signed by another key of the same CA. | |
| 186 if (next_cert && SECITEM_ItemsAreEqual(&node->cert->derPublicKey, | |
| 187 &next_cert->derPublicKey)) { | |
| 188 continue; | |
| 189 } | |
| 190 } | |
| 191 verified_chain.push_back(node->cert); | |
| 192 } | |
| 193 | |
| 194 SECAlgorithmID& signature = node->cert->signature; | |
| 195 SECOidTag oid_tag = SECOID_FindOIDTag(&signature.algorithm); | |
| 196 switch (oid_tag) { | |
| 197 case SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION: | |
| 198 verify_result->has_md5 = true; | |
| 199 break; | |
| 200 case SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION: | |
| 201 verify_result->has_md2 = true; | |
| 202 break; | |
| 203 case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION: | |
| 204 verify_result->has_md4 = true; | |
| 205 break; | |
| 206 case SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION: | |
| 207 case SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE: | |
| 208 case SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST: | |
| 209 case SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE: | |
| 210 verify_result->has_sha1 = true; | |
| 211 break; | |
| 212 default: | |
| 213 break; | |
| 214 } | |
| 215 } | |
| 216 | |
| 217 if (root_cert) | |
| 218 verified_chain.push_back(root_cert); | |
| 219 #if defined(OS_IOS) | |
| 220 verify_result->verified_cert = | |
| 221 x509_util_ios::CreateCertFromNSSHandles(verified_cert, verified_chain); | |
| 222 #else | |
| 223 verify_result->verified_cert = | |
| 224 X509Certificate::CreateFromHandle(verified_cert, verified_chain); | |
| 225 #endif // defined(OS_IOS) | |
| 226 } | |
| 227 | |
| 228 // IsKnownRoot returns true if the given certificate is one that we believe | |
| 229 // is a standard (as opposed to user-installed) root. | |
| 230 bool IsKnownRoot(CERTCertificate* root) { | |
| 231 if (!root || !root->slot) | |
| 232 return false; | |
| 233 | |
| 234 // This magic name is taken from | |
| 235 // http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ckfw/b
uiltins/constants.c&rev=1.13&mark=86,89#79 | |
| 236 return 0 == strcmp(PK11_GetSlotName(root->slot), | |
| 237 "NSS Builtin Objects"); | |
| 238 } | |
| 239 | |
| 240 // Returns true if the given certificate is one of the additional trust anchors. | |
| 241 bool IsAdditionalTrustAnchor(CERTCertList* additional_trust_anchors, | |
| 242 CERTCertificate* root) { | |
| 243 if (!additional_trust_anchors || !root) | |
| 244 return false; | |
| 245 for (CERTCertListNode* node = CERT_LIST_HEAD(additional_trust_anchors); | |
| 246 !CERT_LIST_END(node, additional_trust_anchors); | |
| 247 node = CERT_LIST_NEXT(node)) { | |
| 248 if (CERT_CompareCerts(node->cert, root)) | |
| 249 return true; | |
| 250 } | |
| 251 return false; | |
| 252 } | |
| 253 | |
| 254 enum CRLSetResult { | |
| 255 kCRLSetOk, | |
| 256 kCRLSetRevoked, | |
| 257 kCRLSetUnknown, | |
| 258 }; | |
| 259 | |
| 260 // CheckRevocationWithCRLSet attempts to check each element of |cert_list| | |
| 261 // against |crl_set|. It returns: | |
| 262 // kCRLSetRevoked: if any element of the chain is known to have been revoked. | |
| 263 // kCRLSetUnknown: if there is no fresh information about the leaf | |
| 264 // certificate in the chain or if the CRLSet has expired. | |
| 265 // | |
| 266 // Only the leaf certificate is considered for coverage because some | |
| 267 // intermediates have CRLs with no revocations (after filtering) and | |
| 268 // those CRLs are pruned from the CRLSet at generation time. This means | |
| 269 // that some EV sites would otherwise take the hit of an OCSP lookup for | |
| 270 // no reason. | |
| 271 // kCRLSetOk: otherwise. | |
| 272 CRLSetResult CheckRevocationWithCRLSet(CERTCertList* cert_list, | |
| 273 CERTCertificate* root, | |
| 274 CRLSet* crl_set) { | |
| 275 std::vector<CERTCertificate*> certs; | |
| 276 | |
| 277 if (cert_list) { | |
| 278 for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list); | |
| 279 !CERT_LIST_END(node, cert_list); | |
| 280 node = CERT_LIST_NEXT(node)) { | |
| 281 certs.push_back(node->cert); | |
| 282 } | |
| 283 } | |
| 284 if (root) | |
| 285 certs.push_back(root); | |
| 286 | |
| 287 // error is set to true if any errors are found. It causes such chains to be | |
| 288 // considered as not covered. | |
| 289 bool error = false; | |
| 290 // last_covered is set to the coverage state of the previous certificate. The | |
| 291 // certificates are iterated over backwards thus, after the iteration, | |
| 292 // |last_covered| contains the coverage state of the leaf certificate. | |
| 293 bool last_covered = false; | |
| 294 | |
| 295 // We iterate from the root certificate down to the leaf, keeping track of | |
| 296 // the issuer's SPKI at each step. | |
| 297 std::string issuer_spki_hash; | |
| 298 for (std::vector<CERTCertificate*>::reverse_iterator i = certs.rbegin(); | |
| 299 i != certs.rend(); ++i) { | |
| 300 CERTCertificate* cert = *i; | |
| 301 | |
| 302 base::StringPiece der(reinterpret_cast<char*>(cert->derCert.data), | |
| 303 cert->derCert.len); | |
| 304 | |
| 305 base::StringPiece spki; | |
| 306 if (!asn1::ExtractSPKIFromDERCert(der, &spki)) { | |
| 307 NOTREACHED(); | |
| 308 error = true; | |
| 309 continue; | |
| 310 } | |
| 311 const std::string spki_hash = crypto::SHA256HashString(spki); | |
| 312 | |
| 313 base::StringPiece serial_number = base::StringPiece( | |
| 314 reinterpret_cast<char*>(cert->serialNumber.data), | |
| 315 cert->serialNumber.len); | |
| 316 | |
| 317 CRLSet::Result result = crl_set->CheckSPKI(spki_hash); | |
| 318 | |
| 319 if (result != CRLSet::REVOKED && !issuer_spki_hash.empty()) | |
| 320 result = crl_set->CheckSerial(serial_number, issuer_spki_hash); | |
| 321 | |
| 322 issuer_spki_hash = spki_hash; | |
| 323 | |
| 324 switch (result) { | |
| 325 case CRLSet::REVOKED: | |
| 326 return kCRLSetRevoked; | |
| 327 case CRLSet::UNKNOWN: | |
| 328 last_covered = false; | |
| 329 continue; | |
| 330 case CRLSet::GOOD: | |
| 331 last_covered = true; | |
| 332 continue; | |
| 333 default: | |
| 334 NOTREACHED(); | |
| 335 error = true; | |
| 336 continue; | |
| 337 } | |
| 338 } | |
| 339 | |
| 340 if (error || !last_covered || crl_set->IsExpired()) | |
| 341 return kCRLSetUnknown; | |
| 342 return kCRLSetOk; | |
| 343 } | |
| 344 | |
| 345 // Forward declarations. | |
| 346 SECStatus RetryPKIXVerifyCertWithWorkarounds( | |
| 347 CERTCertificate* cert_handle, int num_policy_oids, | |
| 348 bool cert_io_enabled, std::vector<CERTValInParam>* cvin, | |
| 349 CERTValOutParam* cvout); | |
| 350 SECOidTag GetFirstCertPolicy(CERTCertificate* cert_handle); | |
| 351 | |
| 352 // Call CERT_PKIXVerifyCert for the cert_handle. | |
| 353 // Verification results are stored in an array of CERTValOutParam. | |
| 354 // If |hard_fail| is true, and no policy_oids are supplied (eg: EV is NOT being | |
| 355 // checked), then the failure to obtain valid CRL/OCSP information for all | |
| 356 // certificates that contain CRL/OCSP URLs will cause the certificate to be | |
| 357 // treated as if it was revoked. Since failures may be caused by transient | |
| 358 // network failures or by malicious attackers, in general, hard_fail should be | |
| 359 // false. | |
| 360 // If policy_oids is not NULL and num_policy_oids is positive, policies | |
| 361 // are also checked. | |
| 362 // additional_trust_anchors is an optional list of certificates that can be | |
| 363 // trusted as anchors when building a certificate chain. | |
| 364 // Caller must initialize cvout before calling this function. | |
| 365 SECStatus PKIXVerifyCert(CERTCertificate* cert_handle, | |
| 366 bool check_revocation, | |
| 367 bool hard_fail, | |
| 368 bool cert_io_enabled, | |
| 369 const SECOidTag* policy_oids, | |
| 370 int num_policy_oids, | |
| 371 CERTCertList* additional_trust_anchors, | |
| 372 CERTChainVerifyCallback* chain_verify_callback, | |
| 373 CERTValOutParam* cvout) { | |
| 374 bool use_crl = check_revocation; | |
| 375 bool use_ocsp = check_revocation; | |
| 376 | |
| 377 PRUint64 revocation_method_flags = | |
| 378 CERT_REV_M_DO_NOT_TEST_USING_THIS_METHOD | | |
| 379 CERT_REV_M_ALLOW_NETWORK_FETCHING | | |
| 380 CERT_REV_M_IGNORE_IMPLICIT_DEFAULT_SOURCE | | |
| 381 CERT_REV_M_IGNORE_MISSING_FRESH_INFO | | |
| 382 CERT_REV_M_STOP_TESTING_ON_FRESH_INFO; | |
| 383 PRUint64 revocation_method_independent_flags = | |
| 384 CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST; | |
| 385 if (check_revocation && policy_oids && num_policy_oids > 0) { | |
| 386 // EV verification requires revocation checking. Consider the certificate | |
| 387 // revoked if we don't have revocation info. | |
| 388 // TODO(wtc): Add a bool parameter to expressly specify we're doing EV | |
| 389 // verification or we want strict revocation flags. | |
| 390 revocation_method_flags |= CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE; | |
| 391 revocation_method_independent_flags |= | |
| 392 CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE; | |
| 393 } else if (check_revocation && hard_fail) { | |
| 394 revocation_method_flags |= CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO; | |
| 395 revocation_method_independent_flags |= | |
| 396 CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE; | |
| 397 } else { | |
| 398 revocation_method_flags |= CERT_REV_M_SKIP_TEST_ON_MISSING_SOURCE; | |
| 399 revocation_method_independent_flags |= | |
| 400 CERT_REV_MI_NO_OVERALL_INFO_REQUIREMENT; | |
| 401 } | |
| 402 PRUint64 method_flags[2]; | |
| 403 method_flags[cert_revocation_method_crl] = revocation_method_flags; | |
| 404 method_flags[cert_revocation_method_ocsp] = revocation_method_flags; | |
| 405 | |
| 406 if (use_crl) { | |
| 407 method_flags[cert_revocation_method_crl] |= | |
| 408 CERT_REV_M_TEST_USING_THIS_METHOD; | |
| 409 } | |
| 410 if (use_ocsp) { | |
| 411 method_flags[cert_revocation_method_ocsp] |= | |
| 412 CERT_REV_M_TEST_USING_THIS_METHOD; | |
| 413 } | |
| 414 | |
| 415 CERTRevocationMethodIndex preferred_revocation_methods[1]; | |
| 416 if (use_ocsp) { | |
| 417 preferred_revocation_methods[0] = cert_revocation_method_ocsp; | |
| 418 } else { | |
| 419 preferred_revocation_methods[0] = cert_revocation_method_crl; | |
| 420 } | |
| 421 | |
| 422 CERTRevocationFlags revocation_flags; | |
| 423 revocation_flags.leafTests.number_of_defined_methods = | |
| 424 arraysize(method_flags); | |
| 425 revocation_flags.leafTests.cert_rev_flags_per_method = method_flags; | |
| 426 revocation_flags.leafTests.number_of_preferred_methods = | |
| 427 arraysize(preferred_revocation_methods); | |
| 428 revocation_flags.leafTests.preferred_methods = preferred_revocation_methods; | |
| 429 revocation_flags.leafTests.cert_rev_method_independent_flags = | |
| 430 revocation_method_independent_flags; | |
| 431 | |
| 432 revocation_flags.chainTests.number_of_defined_methods = | |
| 433 arraysize(method_flags); | |
| 434 revocation_flags.chainTests.cert_rev_flags_per_method = method_flags; | |
| 435 revocation_flags.chainTests.number_of_preferred_methods = | |
| 436 arraysize(preferred_revocation_methods); | |
| 437 revocation_flags.chainTests.preferred_methods = preferred_revocation_methods; | |
| 438 revocation_flags.chainTests.cert_rev_method_independent_flags = | |
| 439 revocation_method_independent_flags; | |
| 440 | |
| 441 | |
| 442 std::vector<CERTValInParam> cvin; | |
| 443 cvin.reserve(7); | |
| 444 CERTValInParam in_param; | |
| 445 in_param.type = cert_pi_revocationFlags; | |
| 446 in_param.value.pointer.revocation = &revocation_flags; | |
| 447 cvin.push_back(in_param); | |
| 448 if (policy_oids && num_policy_oids > 0) { | |
| 449 in_param.type = cert_pi_policyOID; | |
| 450 in_param.value.arraySize = num_policy_oids; | |
| 451 in_param.value.array.oids = policy_oids; | |
| 452 cvin.push_back(in_param); | |
| 453 } | |
| 454 if (additional_trust_anchors) { | |
| 455 in_param.type = cert_pi_trustAnchors; | |
| 456 in_param.value.pointer.chain = additional_trust_anchors; | |
| 457 cvin.push_back(in_param); | |
| 458 in_param.type = cert_pi_useOnlyTrustAnchors; | |
| 459 in_param.value.scalar.b = PR_FALSE; | |
| 460 cvin.push_back(in_param); | |
| 461 } | |
| 462 if (chain_verify_callback) { | |
| 463 in_param.type = cert_pi_chainVerifyCallback; | |
| 464 in_param.value.pointer.chainVerifyCallback = chain_verify_callback; | |
| 465 cvin.push_back(in_param); | |
| 466 } | |
| 467 in_param.type = cert_pi_end; | |
| 468 cvin.push_back(in_param); | |
| 469 | |
| 470 SECStatus rv = CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer, | |
| 471 &cvin[0], cvout, NULL); | |
| 472 if (rv != SECSuccess) { | |
| 473 rv = RetryPKIXVerifyCertWithWorkarounds(cert_handle, num_policy_oids, | |
| 474 cert_io_enabled, &cvin, cvout); | |
| 475 } | |
| 476 return rv; | |
| 477 } | |
| 478 | |
| 479 // PKIXVerifyCert calls this function to work around some bugs in | |
| 480 // CERT_PKIXVerifyCert. All the arguments of this function are either the | |
| 481 // arguments or local variables of PKIXVerifyCert. | |
| 482 SECStatus RetryPKIXVerifyCertWithWorkarounds( | |
| 483 CERTCertificate* cert_handle, int num_policy_oids, | |
| 484 bool cert_io_enabled, std::vector<CERTValInParam>* cvin, | |
| 485 CERTValOutParam* cvout) { | |
| 486 // We call this function when the first CERT_PKIXVerifyCert call in | |
| 487 // PKIXVerifyCert failed, so we initialize |rv| to SECFailure. | |
| 488 SECStatus rv = SECFailure; | |
| 489 int nss_error = PORT_GetError(); | |
| 490 CERTValInParam in_param; | |
| 491 | |
| 492 // If we get SEC_ERROR_UNKNOWN_ISSUER, we may be missing an intermediate | |
| 493 // CA certificate, so we retry with cert_pi_useAIACertFetch. | |
| 494 // cert_pi_useAIACertFetch has several bugs in its error handling and | |
| 495 // error reporting (NSS bug 528743), so we don't use it by default. | |
| 496 // Note: When building a certificate chain, CERT_PKIXVerifyCert may | |
| 497 // incorrectly pick a CA certificate with the same subject name as the | |
| 498 // missing intermediate CA certificate, and fail with the | |
| 499 // SEC_ERROR_BAD_SIGNATURE error (NSS bug 524013), so we also retry with | |
| 500 // cert_pi_useAIACertFetch on SEC_ERROR_BAD_SIGNATURE. | |
| 501 if (cert_io_enabled && | |
| 502 (nss_error == SEC_ERROR_UNKNOWN_ISSUER || | |
| 503 nss_error == SEC_ERROR_BAD_SIGNATURE)) { | |
| 504 DCHECK_EQ(cvin->back().type, cert_pi_end); | |
| 505 cvin->pop_back(); | |
| 506 in_param.type = cert_pi_useAIACertFetch; | |
| 507 in_param.value.scalar.b = PR_TRUE; | |
| 508 cvin->push_back(in_param); | |
| 509 in_param.type = cert_pi_end; | |
| 510 cvin->push_back(in_param); | |
| 511 rv = CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer, | |
| 512 &(*cvin)[0], cvout, NULL); | |
| 513 if (rv == SECSuccess) | |
| 514 return rv; | |
| 515 int new_nss_error = PORT_GetError(); | |
| 516 if (new_nss_error == SEC_ERROR_INVALID_ARGS || | |
| 517 new_nss_error == SEC_ERROR_UNKNOWN_AIA_LOCATION_TYPE || | |
| 518 new_nss_error == SEC_ERROR_BAD_INFO_ACCESS_LOCATION || | |
| 519 new_nss_error == SEC_ERROR_BAD_HTTP_RESPONSE || | |
| 520 new_nss_error == SEC_ERROR_BAD_LDAP_RESPONSE || | |
| 521 !IS_SEC_ERROR(new_nss_error)) { | |
| 522 // Use the original error code because of cert_pi_useAIACertFetch's | |
| 523 // bad error reporting. | |
| 524 PORT_SetError(nss_error); | |
| 525 return rv; | |
| 526 } | |
| 527 nss_error = new_nss_error; | |
| 528 } | |
| 529 | |
| 530 // If an intermediate CA certificate has requireExplicitPolicy in its | |
| 531 // policyConstraints extension, CERT_PKIXVerifyCert fails with | |
| 532 // SEC_ERROR_POLICY_VALIDATION_FAILED because we didn't specify any | |
| 533 // certificate policy (NSS bug 552775). So we retry with the certificate | |
| 534 // policy found in the server certificate. | |
| 535 if (nss_error == SEC_ERROR_POLICY_VALIDATION_FAILED && | |
| 536 num_policy_oids == 0) { | |
| 537 SECOidTag policy = GetFirstCertPolicy(cert_handle); | |
| 538 if (policy != SEC_OID_UNKNOWN) { | |
| 539 DCHECK_EQ(cvin->back().type, cert_pi_end); | |
| 540 cvin->pop_back(); | |
| 541 in_param.type = cert_pi_policyOID; | |
| 542 in_param.value.arraySize = 1; | |
| 543 in_param.value.array.oids = &policy; | |
| 544 cvin->push_back(in_param); | |
| 545 in_param.type = cert_pi_end; | |
| 546 cvin->push_back(in_param); | |
| 547 rv = CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer, | |
| 548 &(*cvin)[0], cvout, NULL); | |
| 549 if (rv != SECSuccess) { | |
| 550 // Use the original error code. | |
| 551 PORT_SetError(nss_error); | |
| 552 } | |
| 553 } | |
| 554 } | |
| 555 | |
| 556 return rv; | |
| 557 } | |
| 558 | |
| 559 // Decodes the certificatePolicies extension of the certificate. Returns | |
| 560 // NULL if the certificate doesn't have the extension or the extension can't | |
| 561 // be decoded. The returned value must be freed with a | |
| 562 // CERT_DestroyCertificatePoliciesExtension call. | |
| 563 CERTCertificatePolicies* DecodeCertPolicies( | |
| 564 CERTCertificate* cert_handle) { | |
| 565 SECItem policy_ext; | |
| 566 SECStatus rv = CERT_FindCertExtension(cert_handle, | |
| 567 SEC_OID_X509_CERTIFICATE_POLICIES, | |
| 568 &policy_ext); | |
| 569 if (rv != SECSuccess) | |
| 570 return NULL; | |
| 571 CERTCertificatePolicies* policies = | |
| 572 CERT_DecodeCertificatePoliciesExtension(&policy_ext); | |
| 573 SECITEM_FreeItem(&policy_ext, PR_FALSE); | |
| 574 return policies; | |
| 575 } | |
| 576 | |
| 577 // Returns the OID tag for the first certificate policy in the certificate's | |
| 578 // certificatePolicies extension. Returns SEC_OID_UNKNOWN if the certificate | |
| 579 // has no certificate policy. | |
| 580 SECOidTag GetFirstCertPolicy(CERTCertificate* cert_handle) { | |
| 581 ScopedCERTCertificatePolicies policies(DecodeCertPolicies(cert_handle)); | |
| 582 if (!policies.get()) | |
| 583 return SEC_OID_UNKNOWN; | |
| 584 | |
| 585 CERTPolicyInfo* policy_info = policies->policyInfos[0]; | |
| 586 if (!policy_info) | |
| 587 return SEC_OID_UNKNOWN; | |
| 588 if (policy_info->oid != SEC_OID_UNKNOWN) | |
| 589 return policy_info->oid; | |
| 590 | |
| 591 // The certificate policy is unknown to NSS. We need to create a dynamic | |
| 592 // OID tag for the policy. | |
| 593 SECOidData od; | |
| 594 od.oid.len = policy_info->policyID.len; | |
| 595 od.oid.data = policy_info->policyID.data; | |
| 596 od.offset = SEC_OID_UNKNOWN; | |
| 597 // NSS doesn't allow us to pass an empty description, so I use a hardcoded, | |
| 598 // default description here. The description doesn't need to be unique for | |
| 599 // each OID. | |
| 600 od.desc = "a certificate policy"; | |
| 601 od.mechanism = CKM_INVALID_MECHANISM; | |
| 602 od.supportedExtension = INVALID_CERT_EXTENSION; | |
| 603 return SECOID_AddEntry(&od); | |
| 604 } | |
| 605 | |
| 606 HashValue CertPublicKeyHashSHA1(CERTCertificate* cert) { | |
| 607 HashValue hash(HASH_VALUE_SHA1); | |
| 608 #if defined(OS_IOS) | |
| 609 CC_SHA1(cert->derPublicKey.data, cert->derPublicKey.len, hash.data()); | |
| 610 #else | |
| 611 SECStatus rv = HASH_HashBuf(HASH_AlgSHA1, hash.data(), | |
| 612 cert->derPublicKey.data, cert->derPublicKey.len); | |
| 613 DCHECK_EQ(SECSuccess, rv); | |
| 614 #endif | |
| 615 return hash; | |
| 616 } | |
| 617 | |
| 618 HashValue CertPublicKeyHashSHA256(CERTCertificate* cert) { | |
| 619 HashValue hash(HASH_VALUE_SHA256); | |
| 620 #if defined(OS_IOS) | |
| 621 CC_SHA256(cert->derPublicKey.data, cert->derPublicKey.len, hash.data()); | |
| 622 #else | |
| 623 SECStatus rv = HASH_HashBuf(HASH_AlgSHA256, hash.data(), | |
| 624 cert->derPublicKey.data, cert->derPublicKey.len); | |
| 625 DCHECK_EQ(rv, SECSuccess); | |
| 626 #endif | |
| 627 return hash; | |
| 628 } | |
| 629 | |
| 630 void AppendPublicKeyHashes(CERTCertList* cert_list, | |
| 631 CERTCertificate* root_cert, | |
| 632 HashValueVector* hashes) { | |
| 633 for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list); | |
| 634 !CERT_LIST_END(node, cert_list); | |
| 635 node = CERT_LIST_NEXT(node)) { | |
| 636 hashes->push_back(CertPublicKeyHashSHA1(node->cert)); | |
| 637 hashes->push_back(CertPublicKeyHashSHA256(node->cert)); | |
| 638 } | |
| 639 if (root_cert) { | |
| 640 hashes->push_back(CertPublicKeyHashSHA1(root_cert)); | |
| 641 hashes->push_back(CertPublicKeyHashSHA256(root_cert)); | |
| 642 } | |
| 643 } | |
| 644 | |
| 645 // Returns true if |cert_handle| contains a policy OID that is an EV policy | |
| 646 // OID according to |metadata|, storing the resulting policy OID in | |
| 647 // |*ev_policy_oid|. A true return is not sufficient to establish that a | |
| 648 // certificate is EV, but a false return is sufficient to establish the | |
| 649 // certificate cannot be EV. | |
| 650 bool IsEVCandidate(EVRootCAMetadata* metadata, | |
| 651 CERTCertificate* cert_handle, | |
| 652 SECOidTag* ev_policy_oid) { | |
| 653 DCHECK(cert_handle); | |
| 654 ScopedCERTCertificatePolicies policies(DecodeCertPolicies(cert_handle)); | |
| 655 if (!policies.get()) | |
| 656 return false; | |
| 657 | |
| 658 CERTPolicyInfo** policy_infos = policies->policyInfos; | |
| 659 while (*policy_infos != NULL) { | |
| 660 CERTPolicyInfo* policy_info = *policy_infos++; | |
| 661 // If the Policy OID is unknown, that implicitly means it has not been | |
| 662 // registered as an EV policy. | |
| 663 if (policy_info->oid == SEC_OID_UNKNOWN) | |
| 664 continue; | |
| 665 if (metadata->IsEVPolicyOID(policy_info->oid)) { | |
| 666 *ev_policy_oid = policy_info->oid; | |
| 667 return true; | |
| 668 } | |
| 669 } | |
| 670 | |
| 671 return false; | |
| 672 } | |
| 673 | |
| 674 // Studied Mozilla's code (esp. security/manager/ssl/src/nsIdentityChecking.cpp | |
| 675 // and nsNSSCertHelper.cpp) to learn how to verify EV certificate. | |
| 676 // TODO(wtc): A possible optimization is that we get the trust anchor from | |
| 677 // the first PKIXVerifyCert call. We look up the EV policy for the trust | |
| 678 // anchor. If the trust anchor has no EV policy, we know the cert isn't EV. | |
| 679 // Otherwise, we pass just that EV policy (as opposed to all the EV policies) | |
| 680 // to the second PKIXVerifyCert call. | |
| 681 bool VerifyEV(CERTCertificate* cert_handle, | |
| 682 int flags, | |
| 683 CRLSet* crl_set, | |
| 684 bool rev_checking_enabled, | |
| 685 EVRootCAMetadata* metadata, | |
| 686 SECOidTag ev_policy_oid, | |
| 687 CERTCertList* additional_trust_anchors, | |
| 688 CERTChainVerifyCallback* chain_verify_callback) { | |
| 689 CERTValOutParam cvout[3]; | |
| 690 int cvout_index = 0; | |
| 691 cvout[cvout_index].type = cert_po_certList; | |
| 692 cvout[cvout_index].value.pointer.chain = NULL; | |
| 693 int cvout_cert_list_index = cvout_index; | |
| 694 cvout_index++; | |
| 695 cvout[cvout_index].type = cert_po_trustAnchor; | |
| 696 cvout[cvout_index].value.pointer.cert = NULL; | |
| 697 int cvout_trust_anchor_index = cvout_index; | |
| 698 cvout_index++; | |
| 699 cvout[cvout_index].type = cert_po_end; | |
| 700 ScopedCERTValOutParam scoped_cvout(cvout); | |
| 701 | |
| 702 SECStatus status = PKIXVerifyCert( | |
| 703 cert_handle, | |
| 704 rev_checking_enabled, | |
| 705 true, /* hard fail is implied in EV. */ | |
| 706 flags & CertVerifier::VERIFY_CERT_IO_ENABLED, | |
| 707 &ev_policy_oid, | |
| 708 1, | |
| 709 additional_trust_anchors, | |
| 710 chain_verify_callback, | |
| 711 cvout); | |
| 712 if (status != SECSuccess) | |
| 713 return false; | |
| 714 | |
| 715 CERTCertificate* root_ca = | |
| 716 cvout[cvout_trust_anchor_index].value.pointer.cert; | |
| 717 if (root_ca == NULL) | |
| 718 return false; | |
| 719 | |
| 720 // This second PKIXVerifyCert call could have found a different certification | |
| 721 // path and one or more of the certificates on this new path, that weren't on | |
| 722 // the old path, might have been revoked. | |
| 723 if (crl_set) { | |
| 724 CRLSetResult crl_set_result = CheckRevocationWithCRLSet( | |
| 725 cvout[cvout_cert_list_index].value.pointer.chain, | |
| 726 cvout[cvout_trust_anchor_index].value.pointer.cert, | |
| 727 crl_set); | |
| 728 if (crl_set_result == kCRLSetRevoked) | |
| 729 return false; | |
| 730 } | |
| 731 | |
| 732 #if defined(OS_IOS) | |
| 733 SHA1HashValue fingerprint = x509_util_ios::CalculateFingerprintNSS(root_ca); | |
| 734 #else | |
| 735 SHA1HashValue fingerprint = | |
| 736 X509Certificate::CalculateFingerprint(root_ca); | |
| 737 #endif | |
| 738 return metadata->HasEVPolicyOID(fingerprint, ev_policy_oid); | |
| 739 } | |
| 740 | |
| 741 CERTCertList* CertificateListToCERTCertList(const CertificateList& list) { | |
| 742 CERTCertList* result = CERT_NewCertList(); | |
| 743 for (size_t i = 0; i < list.size(); ++i) { | |
| 744 #if defined(OS_IOS) | |
| 745 // X509Certificate::os_cert_handle() on iOS is a SecCertificateRef; convert | |
| 746 // it to an NSS CERTCertificate. | |
| 747 CERTCertificate* cert = x509_util_ios::CreateNSSCertHandleFromOSHandle( | |
| 748 list[i]->os_cert_handle()); | |
| 749 #else | |
| 750 CERTCertificate* cert = list[i]->os_cert_handle(); | |
| 751 #endif | |
| 752 CERT_AddCertToListTail(result, CERT_DupCertificate(cert)); | |
| 753 } | |
| 754 return result; | |
| 755 } | |
| 756 | |
| 757 } // namespace | |
| 758 | |
| 759 CertVerifyProcNSS::CertVerifyProcNSS() {} | |
| 760 | |
| 761 CertVerifyProcNSS::~CertVerifyProcNSS() {} | |
| 762 | |
| 763 bool CertVerifyProcNSS::SupportsAdditionalTrustAnchors() const { | |
| 764 return true; | |
| 765 } | |
| 766 | |
| 767 int CertVerifyProcNSS::VerifyInternalImpl( | |
| 768 X509Certificate* cert, | |
| 769 const std::string& hostname, | |
| 770 int flags, | |
| 771 CRLSet* crl_set, | |
| 772 const CertificateList& additional_trust_anchors, | |
| 773 CERTChainVerifyCallback* chain_verify_callback, | |
| 774 CertVerifyResult* verify_result) { | |
| 775 #if defined(OS_IOS) | |
| 776 // For iOS, the entire chain must be loaded into NSS's in-memory certificate | |
| 777 // store. | |
| 778 x509_util_ios::NSSCertChain scoped_chain(cert); | |
| 779 CERTCertificate* cert_handle = scoped_chain.cert_handle(); | |
| 780 #else | |
| 781 CERTCertificate* cert_handle = cert->os_cert_handle(); | |
| 782 #endif // defined(OS_IOS) | |
| 783 | |
| 784 if (!cert->VerifyNameMatch(hostname, | |
| 785 &verify_result->common_name_fallback_used)) { | |
| 786 verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID; | |
| 787 } | |
| 788 | |
| 789 // Make sure that the cert is valid now. | |
| 790 SECCertTimeValidity validity = CERT_CheckCertValidTimes( | |
| 791 cert_handle, PR_Now(), PR_TRUE); | |
| 792 if (validity != secCertTimeValid) | |
| 793 verify_result->cert_status |= CERT_STATUS_DATE_INVALID; | |
| 794 | |
| 795 CERTValOutParam cvout[3]; | |
| 796 int cvout_index = 0; | |
| 797 cvout[cvout_index].type = cert_po_certList; | |
| 798 cvout[cvout_index].value.pointer.chain = NULL; | |
| 799 int cvout_cert_list_index = cvout_index; | |
| 800 cvout_index++; | |
| 801 cvout[cvout_index].type = cert_po_trustAnchor; | |
| 802 cvout[cvout_index].value.pointer.cert = NULL; | |
| 803 int cvout_trust_anchor_index = cvout_index; | |
| 804 cvout_index++; | |
| 805 cvout[cvout_index].type = cert_po_end; | |
| 806 ScopedCERTValOutParam scoped_cvout(cvout); | |
| 807 | |
| 808 EVRootCAMetadata* metadata = EVRootCAMetadata::GetInstance(); | |
| 809 SECOidTag ev_policy_oid = SEC_OID_UNKNOWN; | |
| 810 bool is_ev_candidate = | |
| 811 (flags & CertVerifier::VERIFY_EV_CERT) && | |
| 812 IsEVCandidate(metadata, cert_handle, &ev_policy_oid); | |
| 813 bool cert_io_enabled = flags & CertVerifier::VERIFY_CERT_IO_ENABLED; | |
| 814 bool check_revocation = | |
| 815 cert_io_enabled && | |
| 816 (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED); | |
| 817 if (check_revocation) | |
| 818 verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED; | |
| 819 | |
| 820 ScopedCERTCertList trust_anchors; | |
| 821 if (!additional_trust_anchors.empty()) { | |
| 822 trust_anchors.reset( | |
| 823 CertificateListToCERTCertList(additional_trust_anchors)); | |
| 824 } | |
| 825 | |
| 826 SECStatus status = PKIXVerifyCert(cert_handle, | |
| 827 check_revocation, | |
| 828 false, | |
| 829 cert_io_enabled, | |
| 830 NULL, | |
| 831 0, | |
| 832 trust_anchors.get(), | |
| 833 chain_verify_callback, | |
| 834 cvout); | |
| 835 | |
| 836 if (status == SECSuccess && | |
| 837 (flags & CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS) && | |
| 838 !IsKnownRoot(cvout[cvout_trust_anchor_index].value.pointer.cert)) { | |
| 839 // TODO(rsleevi): Optimize this by supplying the constructed chain to | |
| 840 // libpkix via cvin. Omitting for now, due to lack of coverage in upstream | |
| 841 // NSS tests for that feature. | |
| 842 scoped_cvout.Clear(); | |
| 843 verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED; | |
| 844 status = PKIXVerifyCert(cert_handle, | |
| 845 true, | |
| 846 true, | |
| 847 cert_io_enabled, | |
| 848 NULL, | |
| 849 0, | |
| 850 trust_anchors.get(), | |
| 851 chain_verify_callback, | |
| 852 cvout); | |
| 853 } | |
| 854 | |
| 855 if (status == SECSuccess) { | |
| 856 AppendPublicKeyHashes(cvout[cvout_cert_list_index].value.pointer.chain, | |
| 857 cvout[cvout_trust_anchor_index].value.pointer.cert, | |
| 858 &verify_result->public_key_hashes); | |
| 859 | |
| 860 verify_result->is_issued_by_known_root = | |
| 861 IsKnownRoot(cvout[cvout_trust_anchor_index].value.pointer.cert); | |
| 862 verify_result->is_issued_by_additional_trust_anchor = | |
| 863 IsAdditionalTrustAnchor( | |
| 864 trust_anchors.get(), | |
| 865 cvout[cvout_trust_anchor_index].value.pointer.cert); | |
| 866 | |
| 867 GetCertChainInfo(cvout[cvout_cert_list_index].value.pointer.chain, | |
| 868 cvout[cvout_trust_anchor_index].value.pointer.cert, | |
| 869 verify_result); | |
| 870 } | |
| 871 | |
| 872 CRLSetResult crl_set_result = kCRLSetUnknown; | |
| 873 if (crl_set) { | |
| 874 crl_set_result = CheckRevocationWithCRLSet( | |
| 875 cvout[cvout_cert_list_index].value.pointer.chain, | |
| 876 cvout[cvout_trust_anchor_index].value.pointer.cert, | |
| 877 crl_set); | |
| 878 if (crl_set_result == kCRLSetRevoked) { | |
| 879 PORT_SetError(SEC_ERROR_REVOKED_CERTIFICATE); | |
| 880 status = SECFailure; | |
| 881 } | |
| 882 } | |
| 883 | |
| 884 if (status != SECSuccess) { | |
| 885 int err = PORT_GetError(); | |
| 886 LOG(ERROR) << "CERT_PKIXVerifyCert for " << hostname | |
| 887 << " failed err=" << err; | |
| 888 // CERT_PKIXVerifyCert rerports the wrong error code for | |
| 889 // expired certificates (NSS bug 491174) | |
| 890 if (err == SEC_ERROR_CERT_NOT_VALID && | |
| 891 (verify_result->cert_status & CERT_STATUS_DATE_INVALID)) | |
| 892 err = SEC_ERROR_EXPIRED_CERTIFICATE; | |
| 893 CertStatus cert_status = MapCertErrorToCertStatus(err); | |
| 894 if (cert_status) { | |
| 895 verify_result->cert_status |= cert_status; | |
| 896 return MapCertStatusToNetError(verify_result->cert_status); | |
| 897 } | |
| 898 // |err| is not a certificate error. | |
| 899 return MapSecurityError(err); | |
| 900 } | |
| 901 | |
| 902 if (IsCertStatusError(verify_result->cert_status)) | |
| 903 return MapCertStatusToNetError(verify_result->cert_status); | |
| 904 | |
| 905 if ((flags & CertVerifier::VERIFY_EV_CERT) && is_ev_candidate) { | |
| 906 check_revocation |= | |
| 907 crl_set_result != kCRLSetOk && | |
| 908 cert_io_enabled && | |
| 909 (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED_EV_ONLY); | |
| 910 if (check_revocation) | |
| 911 verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED; | |
| 912 | |
| 913 if (VerifyEV(cert_handle, | |
| 914 flags, | |
| 915 crl_set, | |
| 916 check_revocation, | |
| 917 metadata, | |
| 918 ev_policy_oid, | |
| 919 trust_anchors.get(), | |
| 920 chain_verify_callback)) { | |
| 921 verify_result->cert_status |= CERT_STATUS_IS_EV; | |
| 922 } | |
| 923 } | |
| 924 | |
| 925 return OK; | |
| 926 } | |
| 927 | |
| 928 int CertVerifyProcNSS::VerifyInternal( | |
| 929 X509Certificate* cert, | |
| 930 const std::string& hostname, | |
| 931 int flags, | |
| 932 CRLSet* crl_set, | |
| 933 const CertificateList& additional_trust_anchors, | |
| 934 CertVerifyResult* verify_result) { | |
| 935 return VerifyInternalImpl(cert, | |
| 936 hostname, | |
| 937 flags, | |
| 938 crl_set, | |
| 939 additional_trust_anchors, | |
| 940 NULL, // chain_verify_callback | |
| 941 verify_result); | |
| 942 } | |
| 943 | |
| 944 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master