known_roots_mac.cc 3.0 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. // Copyright (c) 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/known_roots_mac.h"
  5. #include <Security/Security.h>
  6. #include <algorithm>
  7. #include <vector>
  8. #include "base/lazy_instance.h"
  9. #include "base/logging.h"
  10. #include "crypto/mac_security_services_lock.h"
  11. #include "net/cert/x509_util_apple.h"
  12. using base::ScopedCFTypeRef;
  13. namespace net {
  14. namespace {
  15. // Helper class for managing the set of OS X Known Roots. This is only safe
  16. // to initialize while the crypto::GetMacSecurityServicesLock() is held, due
  17. // to calling into Security.framework functions; however, once initialized,
  18. // it can be called at any time.
  19. // In practice, due to lazy initialization, it's best to just always guard
  20. // accesses with the lock.
  21. class OSXKnownRootHelper {
  22. public:
  23. bool IsKnownRoot(SecCertificateRef cert) {
  24. // If there are no known roots, then an API failure occurred. For safety,
  25. // assume that all certificates are issued by known roots.
  26. if (known_roots_.empty())
  27. return true;
  28. HashValue hash(x509_util::CalculateFingerprint256(cert));
  29. return IsSHA256HashInSortedArray(hash, known_roots_);
  30. }
  31. bool IsKnownRoot(const HashValue& cert_sha256) {
  32. // If there are no known roots, then an API failure occurred. For safety,
  33. // assume that all certificates are issued by known roots.
  34. if (known_roots_.empty())
  35. return true;
  36. return IsSHA256HashInSortedArray(cert_sha256, known_roots_);
  37. }
  38. private:
  39. friend struct base::LazyInstanceTraitsBase<OSXKnownRootHelper>;
  40. OSXKnownRootHelper() {
  41. crypto::GetMacSecurityServicesLock().AssertAcquired();
  42. CFArrayRef cert_array = nullptr;
  43. OSStatus rv = SecTrustSettingsCopyCertificates(
  44. kSecTrustSettingsDomainSystem, &cert_array);
  45. if (rv != noErr) {
  46. LOG(ERROR) << "Unable to determine trusted roots; assuming all roots are "
  47. << "trusted! Error " << rv;
  48. return;
  49. }
  50. base::ScopedCFTypeRef<CFArrayRef> scoped_array(cert_array);
  51. known_roots_.reserve(CFArrayGetCount(cert_array));
  52. for (CFIndex i = 0, size = CFArrayGetCount(cert_array); i < size; ++i) {
  53. SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(
  54. const_cast<void*>(CFArrayGetValueAtIndex(cert_array, i)));
  55. known_roots_.push_back(x509_util::CalculateFingerprint256(cert));
  56. }
  57. std::sort(known_roots_.begin(), known_roots_.end());
  58. }
  59. ~OSXKnownRootHelper() = default;
  60. std::vector<SHA256HashValue> known_roots_;
  61. };
  62. base::LazyInstance<OSXKnownRootHelper>::Leaky g_known_roots =
  63. LAZY_INSTANCE_INITIALIZER;
  64. } // namespace
  65. bool IsKnownRoot(SecCertificateRef cert) {
  66. return g_known_roots.Get().IsKnownRoot(cert);
  67. }
  68. bool IsKnownRoot(const HashValue& cert_sha256) {
  69. return g_known_roots.Get().IsKnownRoot(cert_sha256);
  70. }
  71. void InitializeKnownRoots() {
  72. base::AutoLock lock(crypto::GetMacSecurityServicesLock());
  73. g_known_roots.Get();
  74. }
  75. } // namespace net