net/cert/x509_cert_types.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/cert/x509_cert_types.h"
   6
   7 #include <cstdlib>
   8 #include <cstring>
   9
  10 #include "base/logging.h"
  11 #include "base/string_number_conversions.h"
  12 #include "base/strings/string_piece.h"
  13 #include "base/time.h"
  14 #include "net/cert/x509_certificate.h"
  15
  16 namespace net {
  17
  18 namespace {
  19
  20 // Helper for ParseCertificateDate. |*field| must contain at least
  21 // |field_len| characters. |*field| will be advanced by |field_len| on exit.
  22 // |*ok| is set to false if there is an error in parsing the number, but left
  23 // untouched otherwise. Returns the parsed integer.
  24 int ParseIntAndAdvance(const char** field, size_t field_len, bool* ok) {
  25   int result = 0;
  26   *ok &= base::StringToInt(base::StringPiece(*field, field_len), &result);
  27   *field += field_len;
  28   return result;
  29 }
  30
  31 }
  32
  33 CertPrincipal::CertPrincipal() {
  34 }
  35
  36 CertPrincipal::CertPrincipal(const std::string& name) : common_name(name) {}
  37
  38 CertPrincipal::~CertPrincipal() {
  39 }
  40
  41 std::string CertPrincipal::GetDisplayName() const {
  42   if (!common_name.empty())
  43     return common_name;
  44   if (!organization_names.empty())
  45     return organization_names[0];
  46   if (!organization_unit_names.empty())
  47     return organization_unit_names[0];
  48
  49   return std::string();
  50 }
  51
  52 CertPolicy::CertPolicy() {
  53 }
  54
  55 CertPolicy::~CertPolicy() {
  56 }
  57
  58 CertPolicy::Judgment CertPolicy::Check(
  59     X509Certificate* cert) const {
  60   // It shouldn't matter which set we check first, but we check denied first
  61   // in case something strange has happened.
  62
  63   if (denied_.find(cert->fingerprint()) != denied_.end()) {
  64     // DCHECK that the order didn't matter.
  65     DCHECK(allowed_.find(cert->fingerprint()) == allowed_.end());
  66     return DENIED;
  67   }
  68
  69   if (allowed_.find(cert->fingerprint()) != allowed_.end()) {
  70     // DCHECK that the order didn't matter.
  71     DCHECK(denied_.find(cert->fingerprint()) == denied_.end());
  72     return ALLOWED;
  73   }
  74
  75   // We don't have a policy for this cert.
  76   return UNKNOWN;
  77 }
  78
  79 void CertPolicy::Allow(X509Certificate* cert) {
  80   // Put the cert in the allowed set and (maybe) remove it from the denied set.
  81   denied_.erase(cert->fingerprint());
  82   allowed_.insert(cert->fingerprint());
  83 }
  84
  85 void CertPolicy::Deny(X509Certificate* cert) {
  86   // Put the cert in the denied set and (maybe) remove it from the allowed set.
  87   allowed_.erase(cert->fingerprint());
  88   denied_.insert(cert->fingerprint());
  89 }
  90
  91 bool CertPolicy::HasAllowedCert() const {
  92   return !allowed_.empty();
  93 }
  94
  95 bool CertPolicy::HasDeniedCert() const {
  96   return !denied_.empty();
  97 }
  98
  99 bool ParseCertificateDate(const base::StringPiece& raw_date,
 100                           CertDateFormat format,
 101                           base::Time* time) {
 102   size_t year_length = format == CERT_DATE_FORMAT_UTC_TIME ? 2 : 4;
 103
 104   if (raw_date.length() < 11 + year_length)
 105     return false;
 106
 107   const char* field = raw_date.data();
 108   bool valid = true;
 109   base::Time::Exploded exploded = {0};
 110
 111   exploded.year =         ParseIntAndAdvance(&field, year_length, &valid);
 112   exploded.month =        ParseIntAndAdvance(&field, 2, &valid);
 113   exploded.day_of_month = ParseIntAndAdvance(&field, 2, &valid);
 114   exploded.hour =         ParseIntAndAdvance(&field, 2, &valid);
 115   exploded.minute =       ParseIntAndAdvance(&field, 2, &valid);
 116   exploded.second =       ParseIntAndAdvance(&field, 2, &valid);
 117   if (valid && year_length == 2)
 118     exploded.year += exploded.year < 50 ? 2000 : 1900;
 119
 120   valid &= exploded.HasValidValues();
 121
 122   if (!valid)
 123     return false;
 124
 125   *time = base::Time::FromUTCExploded(exploded);
 126   return true;
 127 }
 128
 129 }  // namespace net