| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/cert/x509_util.h" | |
| 6 | |
| 7 #include "base/basictypes.h" | |
| 8 #include "base/memory/scoped_ptr.h" | |
| 9 #include "base/time/time.h" | |
| 10 #include "crypto/ec_private_key.h" | |
| 11 #include "crypto/rsa_private_key.h" | |
| 12 #include "net/cert/x509_certificate.h" | |
| 13 | |
| 14 namespace net { | |
| 15 | |
| 16 namespace x509_util { | |
| 17 | |
| 18 // RSA keys created by CreateKeyAndSelfSignedCert will be of this length. | |
| 19 static const uint16 kRSAKeyLength = 1024; | |
| 20 | |
| 21 // Certificates made by CreateKeyAndSelfSignedCert and | |
| 22 // CreateKeyAndChannelIDEC will be signed using this digest algorithm. | |
| 23 static const DigestAlgorithm kSignatureDigestAlgorithm = DIGEST_SHA256; | |
| 24 | |
| 25 ClientCertSorter::ClientCertSorter() : now_(base::Time::Now()) {} | |
| 26 | |
| 27 bool ClientCertSorter::operator()( | |
| 28 const scoped_refptr<X509Certificate>& a, | |
| 29 const scoped_refptr<X509Certificate>& b) const { | |
| 30 // Certificates that are null are sorted last. | |
| 31 if (!a.get() || !b.get()) | |
| 32 return a.get() && !b.get(); | |
| 33 | |
| 34 // Certificates that are expired/not-yet-valid are sorted last. | |
| 35 bool a_is_valid = now_ >= a->valid_start() && now_ <= a->valid_expiry(); | |
| 36 bool b_is_valid = now_ >= b->valid_start() && now_ <= b->valid_expiry(); | |
| 37 if (a_is_valid != b_is_valid) | |
| 38 return a_is_valid && !b_is_valid; | |
| 39 | |
| 40 // Certificates with longer expirations appear as higher priority (less | |
| 41 // than) certificates with shorter expirations. | |
| 42 if (a->valid_expiry() != b->valid_expiry()) | |
| 43 return a->valid_expiry() > b->valid_expiry(); | |
| 44 | |
| 45 // If the expiration dates are equivalent, certificates that were issued | |
| 46 // more recently should be prioritized over older certificates. | |
| 47 if (a->valid_start() != b->valid_start()) | |
| 48 return a->valid_start() > b->valid_start(); | |
| 49 | |
| 50 // Otherwise, prefer client certificates with shorter chains. | |
| 51 const X509Certificate::OSCertHandles& a_intermediates = | |
| 52 a->GetIntermediateCertificates(); | |
| 53 const X509Certificate::OSCertHandles& b_intermediates = | |
| 54 b->GetIntermediateCertificates(); | |
| 55 return a_intermediates.size() < b_intermediates.size(); | |
| 56 } | |
| 57 | |
| 58 bool CreateKeyAndChannelIDEC(const std::string& domain, | |
| 59 uint32 serial_number, | |
| 60 base::Time not_valid_before, | |
| 61 base::Time not_valid_after, | |
| 62 scoped_ptr<crypto::ECPrivateKey>* key, | |
| 63 std::string* der_cert) { | |
| 64 scoped_ptr<crypto::ECPrivateKey> new_key(crypto::ECPrivateKey::Create()); | |
| 65 if (!new_key.get()) | |
| 66 return false; | |
| 67 | |
| 68 bool success = CreateChannelIDEC(new_key.get(), | |
| 69 kSignatureDigestAlgorithm, | |
| 70 domain, | |
| 71 serial_number, | |
| 72 not_valid_before, | |
| 73 not_valid_after, | |
| 74 der_cert); | |
| 75 if (success) | |
| 76 key->reset(new_key.release()); | |
| 77 | |
| 78 return success; | |
| 79 } | |
| 80 | |
| 81 bool CreateKeyAndSelfSignedCert(const std::string& subject, | |
| 82 uint32 serial_number, | |
| 83 base::Time not_valid_before, | |
| 84 base::Time not_valid_after, | |
| 85 scoped_ptr<crypto::RSAPrivateKey>* key, | |
| 86 std::string* der_cert) { | |
| 87 scoped_ptr<crypto::RSAPrivateKey> new_key( | |
| 88 crypto::RSAPrivateKey::Create(kRSAKeyLength)); | |
| 89 if (!new_key.get()) | |
| 90 return false; | |
| 91 | |
| 92 bool success = CreateSelfSignedCert(new_key.get(), | |
| 93 kSignatureDigestAlgorithm, | |
| 94 subject, | |
| 95 serial_number, | |
| 96 not_valid_before, | |
| 97 not_valid_after, | |
| 98 der_cert); | |
| 99 if (success) | |
| 100 key->reset(new_key.release()); | |
| 101 | |
| 102 return success; | |
| 103 } | |
| 104 | |
| 105 } // namespace x509_util | |
| 106 | |
| 107 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master