x509_util_apple.cc 5.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cert/x509_util_apple.h"
  5. #include <CommonCrypto/CommonDigest.h>
  6. #include <string>
  7. #include "base/check_op.h"
  8. #include "base/logging.h"
  9. #include "build/build_config.h"
  10. #include "net/cert/x509_certificate.h"
  11. #include "third_party/boringssl/src/include/openssl/pool.h"
  12. namespace net {
  13. namespace x509_util {
  14. namespace {
  15. bssl::UniquePtr<CRYPTO_BUFFER> CertBufferFromSecCertificate(
  16. SecCertificateRef sec_cert) {
  17. if (!sec_cert) {
  18. return nullptr;
  19. }
  20. base::ScopedCFTypeRef<CFDataRef> der_data(SecCertificateCopyData(sec_cert));
  21. if (!der_data) {
  22. return nullptr;
  23. }
  24. return X509Certificate::CreateCertBufferFromBytes(
  25. base::make_span(CFDataGetBytePtr(der_data), CFDataGetLength(der_data)));
  26. }
  27. } // namespace
  28. base::ScopedCFTypeRef<SecCertificateRef> CreateSecCertificateFromBytes(
  29. const uint8_t* data,
  30. size_t length) {
  31. base::ScopedCFTypeRef<CFDataRef> cert_data(
  32. CFDataCreate(kCFAllocatorDefault, reinterpret_cast<const UInt8*>(data),
  33. base::checked_cast<CFIndex>(length)));
  34. if (!cert_data)
  35. return base::ScopedCFTypeRef<SecCertificateRef>();
  36. return base::ScopedCFTypeRef<SecCertificateRef>(
  37. SecCertificateCreateWithData(nullptr, cert_data));
  38. }
  39. base::ScopedCFTypeRef<SecCertificateRef>
  40. CreateSecCertificateFromX509Certificate(const X509Certificate* cert) {
  41. return CreateSecCertificateFromBytes(CRYPTO_BUFFER_data(cert->cert_buffer()),
  42. CRYPTO_BUFFER_len(cert->cert_buffer()));
  43. }
  44. base::ScopedCFTypeRef<CFMutableArrayRef>
  45. CreateSecCertificateArrayForX509Certificate(X509Certificate* cert) {
  46. return CreateSecCertificateArrayForX509Certificate(
  47. cert, InvalidIntermediateBehavior::kFail);
  48. }
  49. base::ScopedCFTypeRef<CFMutableArrayRef>
  50. CreateSecCertificateArrayForX509Certificate(
  51. X509Certificate* cert,
  52. InvalidIntermediateBehavior invalid_intermediate_behavior) {
  53. base::ScopedCFTypeRef<CFMutableArrayRef> cert_list(
  54. CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
  55. if (!cert_list)
  56. return base::ScopedCFTypeRef<CFMutableArrayRef>();
  57. std::string bytes;
  58. base::ScopedCFTypeRef<SecCertificateRef> sec_cert(
  59. CreateSecCertificateFromBytes(CRYPTO_BUFFER_data(cert->cert_buffer()),
  60. CRYPTO_BUFFER_len(cert->cert_buffer())));
  61. if (!sec_cert)
  62. return base::ScopedCFTypeRef<CFMutableArrayRef>();
  63. CFArrayAppendValue(cert_list, sec_cert);
  64. for (const auto& intermediate : cert->intermediate_buffers()) {
  65. base::ScopedCFTypeRef<SecCertificateRef> sec_cert(
  66. CreateSecCertificateFromBytes(CRYPTO_BUFFER_data(intermediate.get()),
  67. CRYPTO_BUFFER_len(intermediate.get())));
  68. if (!sec_cert) {
  69. if (invalid_intermediate_behavior == InvalidIntermediateBehavior::kFail)
  70. return base::ScopedCFTypeRef<CFMutableArrayRef>();
  71. LOG(WARNING) << "error parsing intermediate";
  72. continue;
  73. }
  74. CFArrayAppendValue(cert_list, sec_cert);
  75. }
  76. return cert_list;
  77. }
  78. scoped_refptr<X509Certificate> CreateX509CertificateFromSecCertificate(
  79. base::ScopedCFTypeRef<SecCertificateRef> sec_cert,
  80. const std::vector<base::ScopedCFTypeRef<SecCertificateRef>>& sec_chain) {
  81. return CreateX509CertificateFromSecCertificate(sec_cert, sec_chain, {});
  82. }
  83. scoped_refptr<X509Certificate> CreateX509CertificateFromSecCertificate(
  84. base::ScopedCFTypeRef<SecCertificateRef> sec_cert,
  85. const std::vector<base::ScopedCFTypeRef<SecCertificateRef>>& sec_chain,
  86. X509Certificate::UnsafeCreateOptions options) {
  87. bssl::UniquePtr<CRYPTO_BUFFER> cert_handle =
  88. CertBufferFromSecCertificate(sec_cert);
  89. if (!cert_handle) {
  90. return nullptr;
  91. }
  92. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
  93. for (const auto& sec_intermediate : sec_chain) {
  94. bssl::UniquePtr<CRYPTO_BUFFER> intermediate_cert_handle =
  95. CertBufferFromSecCertificate(sec_intermediate);
  96. if (!intermediate_cert_handle) {
  97. return nullptr;
  98. }
  99. intermediates.push_back(std::move(intermediate_cert_handle));
  100. }
  101. scoped_refptr<X509Certificate> result(
  102. X509Certificate::CreateFromBufferUnsafeOptions(
  103. std::move(cert_handle), std::move(intermediates), options));
  104. return result;
  105. }
  106. SHA256HashValue CalculateFingerprint256(SecCertificateRef cert) {
  107. SHA256HashValue sha256;
  108. memset(sha256.data, 0, sizeof(sha256.data));
  109. base::ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert));
  110. if (!cert_data) {
  111. return sha256;
  112. }
  113. DCHECK(CFDataGetBytePtr(cert_data));
  114. DCHECK_NE(CFDataGetLength(cert_data), 0);
  115. CC_SHA256(CFDataGetBytePtr(cert_data), CFDataGetLength(cert_data),
  116. sha256.data);
  117. return sha256;
  118. }
  119. base::ScopedCFTypeRef<CFArrayRef> CertificateChainFromSecTrust(
  120. SecTrustRef trust) {
  121. if (__builtin_available(macOS 12.0, iOS 15.0, *)) {
  122. return base::ScopedCFTypeRef<CFArrayRef>(
  123. SecTrustCopyCertificateChain(trust));
  124. }
  125. base::ScopedCFTypeRef<CFMutableArrayRef> chain(
  126. CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
  127. const CFIndex chain_length = SecTrustGetCertificateCount(trust);
  128. for (CFIndex i = 0; i < chain_length; ++i) {
  129. CFArrayAppendValue(chain, SecTrustGetCertificateAtIndex(trust, i));
  130. }
  131. return base::ScopedCFTypeRef<CFArrayRef>(chain.release());
  132. }
  133. } // namespace x509_util
  134. } // namespace net