net/ssl/client_cert_store_mac.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/ssl/client_cert_store_mac.h"
   6
   7 #include <CommonCrypto/CommonDigest.h>
   8 #include <CoreFoundation/CFArray.h>
   9 #include <CoreServices/CoreServices.h>
  10 #include <Security/SecBase.h>
  11 #include <Security/Security.h>
  12
  13 #include <algorithm>
  14 #include <string>
  15
  16 #include "base/callback.h"
  17 #include "base/logging.h"
  18 #include "base/mac/mac_logging.h"
  19 #include "base/mac/scoped_cftyperef.h"
  20 #include "base/strings/sys_string_conversions.h"
  21 #include "base/synchronization/lock.h"
  22 #include "crypto/mac_security_services_lock.h"
  23 #include "net/base/host_port_pair.h"
  24 #include "net/cert/x509_util.h"
  25 #include "net/cert/x509_util_mac.h"
  26
  27 using base::ScopedCFTypeRef;
  28
  29 namespace net {
  30
  31 namespace {
  32
  33 // Gets the issuer for a given cert, starting with the cert itself and
  34 // including the intermediate and finally root certificates (if any).
  35 // This function calls SecTrust but doesn't actually pay attention to the trust
  36 // result: it shouldn't be used to determine trust, just to traverse the chain.
  37 // Caller is responsible for releasing the value stored into *out_cert_chain.
  38 OSStatus CopyCertChain(SecCertificateRef cert_handle,
  39                        CFArrayRef* out_cert_chain) {
  40   DCHECK(cert_handle);
  41   DCHECK(out_cert_chain);
  42
  43   // Create an SSL policy ref configured for client cert evaluation.
  44   SecPolicyRef ssl_policy;
  45   OSStatus result = x509_util::CreateSSLClientPolicy(&ssl_policy);
  46   if (result)
  47     return result;
  48   ScopedCFTypeRef<SecPolicyRef> scoped_ssl_policy(ssl_policy);
  49
  50   // Create a SecTrustRef.
  51   ScopedCFTypeRef<CFArrayRef> input_certs(CFArrayCreate(
  52       NULL, const_cast<const void**>(reinterpret_cast<void**>(&cert_handle)),
  53       1, &kCFTypeArrayCallBacks));
  54   SecTrustRef trust_ref = NULL;
  55   {
  56     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
  57     result = SecTrustCreateWithCertificates(input_certs, ssl_policy,
  58                                             &trust_ref);
  59   }
  60   if (result)
  61     return result;
  62   ScopedCFTypeRef<SecTrustRef> trust(trust_ref);
  63
  64   // Evaluate trust, which creates the cert chain.
  65   SecTrustResultType status;
  66   CSSM_TP_APPLE_EVIDENCE_INFO* status_chain;
  67   {
  68     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
  69     result = SecTrustEvaluate(trust, &status);
  70   }
  71   if (result)
  72     return result;
  73   {
  74     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
  75     result = SecTrustGetResult(trust, &status, out_cert_chain, &status_chain);
  76   }
  77   return result;
  78 }
  79
  80 // Returns true if |*cert| is issued by an authority in |valid_issuers|
  81 // according to Keychain Services, rather than using |cert|'s intermediate
  82 // certificates. If it is, |*cert| is updated to point to the completed
  83 // certificate
  84 bool IsIssuedByInKeychain(const std::vector<std::string>& valid_issuers,
  85                           scoped_refptr<X509Certificate>* cert) {
  86   DCHECK(cert);
  87   DCHECK(cert->get());
  88
  89   X509Certificate::OSCertHandle cert_handle = (*cert)->os_cert_handle();
  90   CFArrayRef cert_chain = NULL;
  91   OSStatus result = CopyCertChain(cert_handle, &cert_chain);
  92   if (result) {
  93     OSSTATUS_LOG(ERROR, result) << "CopyCertChain error";
  94     return false;
  95   }
  96
  97   if (!cert_chain)
  98     return false;
  99
 100   X509Certificate::OSCertHandles intermediates;
 101   for (CFIndex i = 1, chain_count = CFArrayGetCount(cert_chain);
 102        i < chain_count; ++i) {
 103     SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(
 104         const_cast<void*>(CFArrayGetValueAtIndex(cert_chain, i)));
 105     intermediates.push_back(cert);
 106   }
 107
 108   scoped_refptr<X509Certificate> new_cert(X509Certificate::CreateFromHandle(
 109       cert_handle, intermediates));
 110   CFRelease(cert_chain);  // Also frees |intermediates|.
 111
 112   if (!new_cert->IsIssuedByEncoded(valid_issuers))
 113     return false;
 114
 115   cert->swap(new_cert);
 116   return true;
 117 }
 118
 119 // Examines the certificates in |preferred_cert| and |regular_certs| to find
 120 // all certificates that match the client certificate request in |request|,
 121 // storing the matching certificates in |selected_certs|.
 122 // If |query_keychain| is true, Keychain Services will be queried to construct
 123 // full certificate chains. If it is false, only the the certificates and their
 124 // intermediates (available via X509Certificate::GetIntermediateCertificates())
 125 // will be considered.
 126 void GetClientCertsImpl(const scoped_refptr<X509Certificate>& preferred_cert,
 127                         const CertificateList& regular_certs,
 128                         const SSLCertRequestInfo& request,
 129                         bool query_keychain,
 130                         CertificateList* selected_certs) {
 131   CertificateList preliminary_list;
 132   if (preferred_cert.get())
 133     preliminary_list.push_back(preferred_cert);
 134   preliminary_list.insert(preliminary_list.end(), regular_certs.begin(),
 135                           regular_certs.end());
 136
 137   selected_certs->clear();
 138   for (size_t i = 0; i < preliminary_list.size(); ++i) {
 139     scoped_refptr<X509Certificate>& cert = preliminary_list[i];
 140     if (cert->HasExpired() || !cert->SupportsSSLClientAuth())
 141       continue;
 142
 143     // Skip duplicates (a cert may be in multiple keychains).
 144     const SHA1HashValue& fingerprint = cert->fingerprint();
 145     size_t pos;
 146     for (pos = 0; pos < selected_certs->size(); ++pos) {
 147       if ((*selected_certs)[pos]->fingerprint().Equals(fingerprint))
 148         break;
 149     }
 150     if (pos < selected_certs->size())
 151       continue;
 152
 153     // Check if the certificate issuer is allowed by the server.
 154     if (request.cert_authorities.empty() ||
 155         cert->IsIssuedByEncoded(request.cert_authorities) ||
 156         (query_keychain &&
 157          IsIssuedByInKeychain(request.cert_authorities, &cert))) {
 158       selected_certs->push_back(cert);
 159     }
 160   }
 161
 162   // Preferred cert should appear first in the ui, so exclude it from the
 163   // sorting.
 164   CertificateList::iterator sort_begin = selected_certs->begin();
 165   CertificateList::iterator sort_end = selected_certs->end();
 166   if (preferred_cert.get() && sort_begin != sort_end &&
 167       sort_begin->get() == preferred_cert.get()) {
 168     ++sort_begin;
 169   }
 170   sort(sort_begin, sort_end, x509_util::ClientCertSorter());
 171 }
 172
 173 }  // namespace
 174
 175 ClientCertStoreMac::ClientCertStoreMac() {}
 176
 177 ClientCertStoreMac::~ClientCertStoreMac() {}
 178
 179 void ClientCertStoreMac::GetClientCerts(const SSLCertRequestInfo& request,
 180                                          CertificateList* selected_certs,
 181                                          const base::Closure& callback) {
 182   std::string server_domain = request.host_and_port.host();
 183
 184   ScopedCFTypeRef<SecIdentityRef> preferred_identity;
 185   if (!server_domain.empty()) {
 186     // See if there's an identity preference for this domain:
 187     ScopedCFTypeRef<CFStringRef> domain_str(
 188         base::SysUTF8ToCFStringRef("https://" + server_domain));
 189     SecIdentityRef identity = NULL;
 190     // While SecIdentityCopyPreferences appears to take a list of CA issuers
 191     // to restrict the identity search to, within Security.framework the
 192     // argument is ignored and filtering unimplemented. See
 193     // SecIdentity.cpp in libsecurity_keychain, specifically
 194     // _SecIdentityCopyPreferenceMatchingName().
 195     {
 196       base::AutoLock lock(crypto::GetMacSecurityServicesLock());
 197       if (SecIdentityCopyPreference(domain_str, 0, NULL, &identity) == noErr)
 198         preferred_identity.reset(identity);
 199     }
 200   }
 201
 202   // Now enumerate the identities in the available keychains.
 203   scoped_refptr<X509Certificate> preferred_cert = NULL;
 204   CertificateList regular_certs;
 205
 206   SecIdentitySearchRef search = NULL;
 207   OSStatus err;
 208   {
 209     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
 210     err = SecIdentitySearchCreate(NULL, CSSM_KEYUSE_SIGN, &search);
 211   }
 212   if (err) {
 213     selected_certs->clear();
 214     callback.Run();
 215     return;
 216   }
 217   ScopedCFTypeRef<SecIdentitySearchRef> scoped_search(search);
 218   while (!err) {
 219     SecIdentityRef identity = NULL;
 220     {
 221       base::AutoLock lock(crypto::GetMacSecurityServicesLock());
 222       err = SecIdentitySearchCopyNext(search, &identity);
 223     }
 224     if (err)
 225       break;
 226     ScopedCFTypeRef<SecIdentityRef> scoped_identity(identity);
 227
 228     SecCertificateRef cert_handle;
 229     err = SecIdentityCopyCertificate(identity, &cert_handle);
 230     if (err != noErr)
 231       continue;
 232     ScopedCFTypeRef<SecCertificateRef> scoped_cert_handle(cert_handle);
 233
 234     scoped_refptr<X509Certificate> cert(
 235         X509Certificate::CreateFromHandle(cert_handle,
 236                                           X509Certificate::OSCertHandles()));
 237
 238     if (preferred_identity && CFEqual(preferred_identity, identity)) {
 239       // Only one certificate should match.
 240       DCHECK(!preferred_cert.get());
 241       preferred_cert = cert;
 242     } else {
 243       regular_certs.push_back(cert);
 244     }
 245   }
 246
 247   if (err != errSecItemNotFound) {
 248     OSSTATUS_LOG(ERROR, err) << "SecIdentitySearch error";
 249     selected_certs->clear();
 250     callback.Run();
 251     return;
 252   }
 253
 254   GetClientCertsImpl(preferred_cert, regular_certs, request, true,
 255                      selected_certs);
 256   callback.Run();
 257 }
 258
 259 bool ClientCertStoreMac::SelectClientCertsForTesting(
 260     const CertificateList& input_certs,
 261     const SSLCertRequestInfo& request,
 262     CertificateList* selected_certs) {
 263   GetClientCertsImpl(NULL, input_certs, request, false, selected_certs);
 264   return true;
 265 }
 266
 267 bool ClientCertStoreMac::SelectClientCertsGivenPreferredForTesting(
 268     const scoped_refptr<X509Certificate>& preferred_cert,
 269     const CertificateList& regular_certs,
 270     const SSLCertRequestInfo& request,
 271     CertificateList* selected_certs) {
 272   GetClientCertsImpl(
 273       preferred_cert, regular_certs, request, false, selected_certs);
 274   return true;
 275 }
 276
 277 }  // namespace net