net/cert/x509_certificate_ios.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/cert/x509_certificate.h"
   6
   7 #include <CommonCrypto/CommonDigest.h>
   8 #include <Security/Security.h>
   9
  10 #include <cert.h>
  11 #include <cryptohi.h>
  12 #include <keyhi.h>
  13 #include <nss.h>
  14 #include <pk11pub.h>
  15 #include <prerror.h>
  16 #include <prtime.h>
  17 #include <prtypes.h>
  18 #include <secder.h>
  19 #include <secerr.h>
  20 #include <sslerr.h>
  21
  22 #include <vector>
  23
  24 #include "base/logging.h"
  25 #include "base/mac/scoped_cftyperef.h"
  26 #include "base/memory/scoped_ptr.h"
  27 #include "base/pickle.h"
  28 #include "base/time.h"
  29 #include "crypto/nss_util.h"
  30 #include "crypto/scoped_nss_types.h"
  31 #include "net/base/net_errors.h"
  32 #include "net/cert/asn1_util.h"
  33 #include "net/cert/cert_status_flags.h"
  34 #include "net/cert/cert_verify_result.h"
  35 #include "net/cert/ev_root_ca_metadata.h"
  36 #include "net/cert/x509_util_ios.h"
  37 #include "net/cert/x509_util_nss.h"
  38
  39 using base::mac::ScopedCFTypeRef;
  40
  41 namespace net {
  42 namespace {
  43 // Returns true if a given |cert_handle| is actually a valid X.509 certificate
  44 // handle.
  45 //
  46 // SecCertificateCreateFromData() does not always force the immediate parsing of
  47 // the certificate, and as such, may return a SecCertificateRef for an
  48 // invalid/unparsable certificate. Force parsing to occur to ensure that the
  49 // SecCertificateRef is correct. On later versions where
  50 // SecCertificateCreateFromData() immediately parses, rather than lazily, this
  51 // call is cheap, as the subject is cached.
  52 bool IsValidOSCertHandle(SecCertificateRef cert_handle) {
  53   ScopedCFTypeRef<CFStringRef> sanity_check(
  54       SecCertificateCopySubjectSummary(cert_handle));
  55   return sanity_check != NULL;
  56 }
  57 }  // namespace
  58
  59 void X509Certificate::Initialize() {
  60   x509_util_ios::NSSCertificate nss_cert(cert_handle_);
  61   CERTCertificate* cert_handle = nss_cert.cert_handle();
  62   if (cert_handle) {
  63     x509_util::ParsePrincipal(&cert_handle->subject, &subject_);
  64     x509_util::ParsePrincipal(&cert_handle->issuer, &issuer_);
  65     x509_util::ParseDate(&cert_handle->validity.notBefore, &valid_start_);
  66     x509_util::ParseDate(&cert_handle->validity.notAfter, &valid_expiry_);
  67     serial_number_ = x509_util::ParseSerialNumber(cert_handle);
  68   }
  69   fingerprint_ = CalculateFingerprint(cert_handle_);
  70   ca_fingerprint_ = CalculateCAFingerprint(intermediate_ca_certs_);
  71 }
  72
  73 bool X509Certificate::IsIssuedByEncoded(
  74     const std::vector<std::string>& valid_issuers) {
  75   x509_util_ios::NSSCertChain nss_chain(this);
  76   // Convert to scoped CERTName* list.
  77   std::vector<CERTName*> issuers;
  78   crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
  79   if (!x509_util::GetIssuersFromEncodedList(valid_issuers,
  80                                             arena.get(),
  81                                             &issuers)) {
  82     return false;
  83   }
  84   return x509_util::IsCertificateIssuedBy(
  85       nss_chain.cert_chain(), issuers);
  86 }
  87
  88 // static
  89 X509Certificate* X509Certificate::CreateSelfSigned(
  90     crypto::RSAPrivateKey* key,
  91     const std::string& subject,
  92     uint32 serial_number,
  93     base::TimeDelta valid_duration) {
  94   DCHECK(key);
  95   DCHECK(!subject.empty());
  96   NOTIMPLEMENTED();
  97   return NULL;
  98 }
  99
 100 void X509Certificate::GetSubjectAltName(
 101     std::vector<std::string>* dns_names,
 102     std::vector<std::string>* ip_addrs) const {
 103   x509_util_ios::NSSCertificate nss_cert(cert_handle_);
 104   CERTCertificate* cert_handle = nss_cert.cert_handle();
 105   if (!cert_handle) {
 106     if (dns_names)
 107       dns_names->clear();
 108     if (ip_addrs)
 109       ip_addrs->clear();
 110     return;
 111   }
 112   x509_util::GetSubjectAltName(cert_handle, dns_names, ip_addrs);
 113 }
 114
 115 // static
 116 bool X509Certificate::GetDEREncoded(OSCertHandle cert_handle,
 117                                     std::string* encoded) {
 118   ScopedCFTypeRef<CFDataRef> der_data(SecCertificateCopyData(cert_handle));
 119   if (!der_data)
 120     return false;
 121   encoded->assign(reinterpret_cast<const char*>(CFDataGetBytePtr(der_data)),
 122                   CFDataGetLength(der_data));
 123   return true;
 124 }
 125
 126 // static
 127 bool X509Certificate::IsSameOSCert(X509Certificate::OSCertHandle a,
 128                                    X509Certificate::OSCertHandle b) {
 129   DCHECK(a && b);
 130   if (a == b)
 131     return true;
 132   if (CFEqual(a, b))
 133     return true;
 134   ScopedCFTypeRef<CFDataRef> a_data(SecCertificateCopyData(a));
 135   ScopedCFTypeRef<CFDataRef> b_data(SecCertificateCopyData(b));
 136   return a_data && b_data &&
 137          CFDataGetLength(a_data) == CFDataGetLength(b_data) &&
 138          memcmp(CFDataGetBytePtr(a_data), CFDataGetBytePtr(b_data),
 139                 CFDataGetLength(a_data)) == 0;
 140 }
 141
 142 // static
 143 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes(
 144     const char* data, int length) {
 145   ScopedCFTypeRef<CFDataRef> cert_data(CFDataCreateWithBytesNoCopy(
 146       kCFAllocatorDefault, reinterpret_cast<const UInt8 *>(data), length,
 147       kCFAllocatorNull));
 148   if (!cert_data)
 149     return NULL;
 150   OSCertHandle cert_handle = SecCertificateCreateWithData(NULL, cert_data);
 151   if (!cert_handle)
 152     return NULL;
 153   if (!IsValidOSCertHandle(cert_handle)) {
 154     CFRelease(cert_handle);
 155     return NULL;
 156   }
 157   return cert_handle;
 158 }
 159
 160 // static
 161 X509Certificate::OSCertHandles X509Certificate::CreateOSCertHandlesFromBytes(
 162     const char* data,
 163     int length,
 164     Format format) {
 165   return x509_util::CreateOSCertHandlesFromBytes(data, length, format);
 166 }
 167
 168 // static
 169 X509Certificate::OSCertHandle X509Certificate::DupOSCertHandle(
 170     OSCertHandle handle) {
 171   if (!handle)
 172     return NULL;
 173   return reinterpret_cast<OSCertHandle>(const_cast<void*>(CFRetain(handle)));
 174 }
 175
 176 // static
 177 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
 178   CFRelease(cert_handle);
 179 }
 180
 181 // static
 182 SHA1HashValue X509Certificate::CalculateFingerprint(
 183     OSCertHandle cert) {
 184   SHA1HashValue sha1;
 185   memset(sha1.data, 0, sizeof(sha1.data));
 186
 187   ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert));
 188   if (!cert_data)
 189     return sha1;
 190   DCHECK(CFDataGetBytePtr(cert_data));
 191   DCHECK_NE(0, CFDataGetLength(cert_data));
 192   CC_SHA1(CFDataGetBytePtr(cert_data), CFDataGetLength(cert_data), sha1.data);
 193
 194   return sha1;
 195 }
 196
 197 // static
 198 SHA1HashValue X509Certificate::CalculateCAFingerprint(
 199     const OSCertHandles& intermediates) {
 200   SHA1HashValue sha1;
 201   memset(sha1.data, 0, sizeof(sha1.data));
 202
 203   // The CC_SHA(3cc) man page says all CC_SHA1_xxx routines return 1, so
 204   // we don't check their return values.
 205   CC_SHA1_CTX sha1_ctx;
 206   CC_SHA1_Init(&sha1_ctx);
 207   for (size_t i = 0; i < intermediates.size(); ++i) {
 208     ScopedCFTypeRef<CFDataRef>
 209         cert_data(SecCertificateCopyData(intermediates[i]));
 210     if (!cert_data)
 211       return sha1;
 212     CC_SHA1_Update(&sha1_ctx,
 213                    CFDataGetBytePtr(cert_data),
 214                    CFDataGetLength(cert_data));
 215   }
 216   CC_SHA1_Final(sha1.data, &sha1_ctx);
 217   return sha1;
 218 }
 219
 220 // static
 221 X509Certificate::OSCertHandle
 222 X509Certificate::ReadOSCertHandleFromPickle(PickleIterator* pickle_iter) {
 223   return x509_util::ReadOSCertHandleFromPickle(pickle_iter);
 224 }
 225
 226 // static
 227 bool X509Certificate::WriteOSCertHandleToPickle(OSCertHandle cert_handle,
 228                                                 Pickle* pickle) {
 229   ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert_handle));
 230   if (!cert_data)
 231     return false;
 232
 233   return pickle->WriteData(
 234       reinterpret_cast<const char*>(CFDataGetBytePtr(cert_data)),
 235       CFDataGetLength(cert_data));
 236 }
 237
 238 // static
 239 void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
 240                                        size_t* size_bits,
 241                                        PublicKeyType* type) {
 242   x509_util_ios::NSSCertificate nss_cert(cert_handle);
 243   x509_util::GetPublicKeyInfo(nss_cert.cert_handle(), size_bits, type);
 244 }
 245
 246 }  // namespace net