123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439 |
- // Copyright 2015 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include "net/cert/x509_util_nss.h"
- #include <cert.h> // Must be included before certdb.h
- #include <certdb.h>
- #include <cryptohi.h>
- #include <nss.h>
- #include <pk11pub.h>
- #include <prerror.h>
- #include <secder.h>
- #include <sechash.h>
- #include <secmod.h>
- #include <secport.h>
- #include <string.h>
- #include "base/logging.h"
- #include "base/strings/stringprintf.h"
- #include "crypto/nss_util.h"
- #include "crypto/scoped_nss_types.h"
- #include "third_party/boringssl/src/include/openssl/pool.h"
- namespace net::x509_util {
- namespace {
- // Microsoft User Principal Name: 1.3.6.1.4.1.311.20.2.3
- const uint8_t kUpnOid[] = {0x2b, 0x6, 0x1, 0x4, 0x1,
- 0x82, 0x37, 0x14, 0x2, 0x3};
- std::string DecodeAVAValue(CERTAVA* ava) {
- SECItem* decode_item = CERT_DecodeAVAValue(&ava->value);
- if (!decode_item)
- return std::string();
- std::string value(reinterpret_cast<char*>(decode_item->data),
- decode_item->len);
- SECITEM_FreeItem(decode_item, PR_TRUE);
- return value;
- }
- // Generates a unique nickname for |slot|, returning |nickname| if it is
- // already unique.
- //
- // Note: The nickname returned will NOT include the token name, thus the
- // token name must be prepended if calling an NSS function that expects
- // <token>:<nickname>.
- // TODO(gspencer): Internationalize this: it's wrong to hard-code English.
- std::string GetUniqueNicknameForSlot(const std::string& nickname,
- const SECItem* subject,
- PK11SlotInfo* slot) {
- int index = 2;
- std::string new_name = nickname;
- std::string temp_nickname = new_name;
- std::string token_name;
- if (!slot)
- return new_name;
- if (!PK11_IsInternalKeySlot(slot)) {
- token_name.assign(PK11_GetTokenName(slot));
- token_name.append(":");
- temp_nickname = token_name + new_name;
- }
- while (SEC_CertNicknameConflict(temp_nickname.c_str(),
- const_cast<SECItem*>(subject),
- CERT_GetDefaultCertDB())) {
- base::SStringPrintf(&new_name, "%s #%d", nickname.c_str(), index++);
- temp_nickname = token_name + new_name;
- }
- return new_name;
- }
- // The default nickname of the certificate, based on the certificate type
- // passed in.
- std::string GetDefaultNickname(CERTCertificate* nss_cert, CertType type) {
- std::string result;
- if (type == USER_CERT && nss_cert->slot) {
- // Find the private key for this certificate and see if it has a
- // nickname. If there is a private key, and it has a nickname, then
- // return that nickname.
- SECKEYPrivateKey* private_key = PK11_FindPrivateKeyFromCert(
- nss_cert->slot, nss_cert, nullptr /*wincx*/);
- if (private_key) {
- char* private_key_nickname = PK11_GetPrivateKeyNickname(private_key);
- if (private_key_nickname) {
- result = private_key_nickname;
- PORT_Free(private_key_nickname);
- SECKEY_DestroyPrivateKey(private_key);
- return result;
- }
- SECKEY_DestroyPrivateKey(private_key);
- }
- }
- switch (type) {
- case CA_CERT: {
- char* nickname = CERT_MakeCANickname(nss_cert);
- result = nickname;
- PORT_Free(nickname);
- break;
- }
- case USER_CERT: {
- std::string subject_name = GetCERTNameDisplayName(&nss_cert->subject);
- if (subject_name.empty()) {
- const char* email = CERT_GetFirstEmailAddress(nss_cert);
- if (email)
- subject_name = email;
- }
- // TODO(gspencer): Internationalize this. It's wrong to assume English
- // here.
- result =
- base::StringPrintf("%s's %s ID", subject_name.c_str(),
- GetCERTNameDisplayName(&nss_cert->issuer).c_str());
- break;
- }
- case SERVER_CERT: {
- result = GetCERTNameDisplayName(&nss_cert->subject);
- break;
- }
- case OTHER_CERT:
- default:
- break;
- }
- return result;
- }
- } // namespace
- bool IsSameCertificate(CERTCertificate* a, CERTCertificate* b) {
- DCHECK(a && b);
- if (a == b)
- return true;
- return a->derCert.len == b->derCert.len &&
- memcmp(a->derCert.data, b->derCert.data, a->derCert.len) == 0;
- }
- bool IsSameCertificate(CERTCertificate* a, const X509Certificate* b) {
- return a->derCert.len == CRYPTO_BUFFER_len(b->cert_buffer()) &&
- memcmp(a->derCert.data, CRYPTO_BUFFER_data(b->cert_buffer()),
- a->derCert.len) == 0;
- }
- bool IsSameCertificate(const X509Certificate* a, CERTCertificate* b) {
- return IsSameCertificate(b, a);
- }
- ScopedCERTCertificate CreateCERTCertificateFromBytes(const uint8_t* data,
- size_t length) {
- crypto::EnsureNSSInit();
- if (!NSS_IsInitialized())
- return nullptr;
- SECItem der_cert;
- der_cert.data = const_cast<uint8_t*>(data);
- der_cert.len = base::checked_cast<unsigned>(length);
- der_cert.type = siDERCertBuffer;
- // Parse into a certificate structure.
- return ScopedCERTCertificate(CERT_NewTempCertificate(
- CERT_GetDefaultCertDB(), &der_cert, nullptr /* nickname */,
- PR_FALSE /* is_perm */, PR_TRUE /* copyDER */));
- }
- ScopedCERTCertificate CreateCERTCertificateFromX509Certificate(
- const X509Certificate* cert) {
- return CreateCERTCertificateFromBytes(CRYPTO_BUFFER_data(cert->cert_buffer()),
- CRYPTO_BUFFER_len(cert->cert_buffer()));
- }
- ScopedCERTCertificateList CreateCERTCertificateListFromX509Certificate(
- const X509Certificate* cert) {
- return x509_util::CreateCERTCertificateListFromX509Certificate(
- cert, InvalidIntermediateBehavior::kFail);
- }
- ScopedCERTCertificateList CreateCERTCertificateListFromX509Certificate(
- const X509Certificate* cert,
- InvalidIntermediateBehavior invalid_intermediate_behavior) {
- ScopedCERTCertificateList nss_chain;
- nss_chain.reserve(1 + cert->intermediate_buffers().size());
- ScopedCERTCertificate nss_cert =
- CreateCERTCertificateFromX509Certificate(cert);
- if (!nss_cert)
- return {};
- nss_chain.push_back(std::move(nss_cert));
- for (const auto& intermediate : cert->intermediate_buffers()) {
- ScopedCERTCertificate nss_intermediate =
- CreateCERTCertificateFromBytes(CRYPTO_BUFFER_data(intermediate.get()),
- CRYPTO_BUFFER_len(intermediate.get()));
- if (!nss_intermediate) {
- if (invalid_intermediate_behavior == InvalidIntermediateBehavior::kFail)
- return {};
- LOG(WARNING) << "error parsing intermediate";
- continue;
- }
- nss_chain.push_back(std::move(nss_intermediate));
- }
- return nss_chain;
- }
- ScopedCERTCertificateList CreateCERTCertificateListFromBytes(const char* data,
- size_t length,
- int format) {
- CertificateList certs = X509Certificate::CreateCertificateListFromBytes(
- base::as_bytes(base::make_span(data, length)), format);
- ScopedCERTCertificateList nss_chain;
- nss_chain.reserve(certs.size());
- for (const scoped_refptr<X509Certificate>& cert : certs) {
- ScopedCERTCertificate nss_cert =
- CreateCERTCertificateFromX509Certificate(cert.get());
- if (!nss_cert)
- return {};
- nss_chain.push_back(std::move(nss_cert));
- }
- return nss_chain;
- }
- ScopedCERTCertificate DupCERTCertificate(CERTCertificate* cert) {
- return ScopedCERTCertificate(CERT_DupCertificate(cert));
- }
- ScopedCERTCertificateList DupCERTCertificateList(
- const ScopedCERTCertificateList& certs) {
- ScopedCERTCertificateList result;
- result.reserve(certs.size());
- for (const ScopedCERTCertificate& cert : certs)
- result.push_back(DupCERTCertificate(cert.get()));
- return result;
- }
- scoped_refptr<X509Certificate> CreateX509CertificateFromCERTCertificate(
- CERTCertificate* nss_cert,
- const std::vector<CERTCertificate*>& nss_chain) {
- return CreateX509CertificateFromCERTCertificate(nss_cert, nss_chain, {});
- }
- scoped_refptr<X509Certificate> CreateX509CertificateFromCERTCertificate(
- CERTCertificate* nss_cert,
- const std::vector<CERTCertificate*>& nss_chain,
- X509Certificate::UnsafeCreateOptions options) {
- if (!nss_cert || !nss_cert->derCert.len)
- return nullptr;
- bssl::UniquePtr<CRYPTO_BUFFER> cert_handle(
- X509Certificate::CreateCertBufferFromBytes(
- base::make_span(nss_cert->derCert.data, nss_cert->derCert.len)));
- if (!cert_handle)
- return nullptr;
- std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
- intermediates.reserve(nss_chain.size());
- for (const CERTCertificate* nss_intermediate : nss_chain) {
- if (!nss_intermediate || !nss_intermediate->derCert.len)
- return nullptr;
- bssl::UniquePtr<CRYPTO_BUFFER> intermediate_cert_handle(
- X509Certificate::CreateCertBufferFromBytes(base::make_span(
- nss_intermediate->derCert.data, nss_intermediate->derCert.len)));
- if (!intermediate_cert_handle)
- return nullptr;
- intermediates.push_back(std::move(intermediate_cert_handle));
- }
- scoped_refptr<X509Certificate> result(
- X509Certificate::CreateFromBufferUnsafeOptions(
- std::move(cert_handle), std::move(intermediates), options));
- return result;
- }
- scoped_refptr<X509Certificate> CreateX509CertificateFromCERTCertificate(
- CERTCertificate* cert) {
- return CreateX509CertificateFromCERTCertificate(
- cert, std::vector<CERTCertificate*>());
- }
- CertificateList CreateX509CertificateListFromCERTCertificates(
- const ScopedCERTCertificateList& certs) {
- CertificateList result;
- result.reserve(certs.size());
- for (const ScopedCERTCertificate& cert : certs) {
- scoped_refptr<X509Certificate> x509_cert(
- CreateX509CertificateFromCERTCertificate(cert.get()));
- if (!x509_cert)
- return {};
- result.push_back(std::move(x509_cert));
- }
- return result;
- }
- bool GetDEREncoded(CERTCertificate* cert, std::string* der_encoded) {
- if (!cert || !cert->derCert.len)
- return false;
- der_encoded->assign(reinterpret_cast<char*>(cert->derCert.data),
- cert->derCert.len);
- return true;
- }
- bool GetPEMEncoded(CERTCertificate* cert, std::string* pem_encoded) {
- if (!cert || !cert->derCert.len)
- return false;
- std::string der(reinterpret_cast<char*>(cert->derCert.data),
- cert->derCert.len);
- return X509Certificate::GetPEMEncodedFromDER(der, pem_encoded);
- }
- void GetRFC822SubjectAltNames(CERTCertificate* cert_handle,
- std::vector<std::string>* names) {
- crypto::ScopedSECItem alt_name(SECITEM_AllocItem(nullptr, nullptr, 0));
- DCHECK(alt_name.get());
- names->clear();
- SECStatus rv = CERT_FindCertExtension(
- cert_handle, SEC_OID_X509_SUBJECT_ALT_NAME, alt_name.get());
- if (rv != SECSuccess)
- return;
- crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
- DCHECK(arena.get());
- CERTGeneralName* alt_name_list;
- alt_name_list = CERT_DecodeAltNameExtension(arena.get(), alt_name.get());
- CERTGeneralName* name = alt_name_list;
- while (name) {
- if (name->type == certRFC822Name) {
- names->push_back(
- std::string(reinterpret_cast<char*>(name->name.other.data),
- name->name.other.len));
- }
- name = CERT_GetNextGeneralName(name);
- if (name == alt_name_list)
- break;
- }
- }
- void GetUPNSubjectAltNames(CERTCertificate* cert_handle,
- std::vector<std::string>* names) {
- crypto::ScopedSECItem alt_name(SECITEM_AllocItem(nullptr, nullptr, 0));
- DCHECK(alt_name.get());
- names->clear();
- SECStatus rv = CERT_FindCertExtension(
- cert_handle, SEC_OID_X509_SUBJECT_ALT_NAME, alt_name.get());
- if (rv != SECSuccess)
- return;
- crypto::ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
- DCHECK(arena.get());
- CERTGeneralName* alt_name_list;
- alt_name_list = CERT_DecodeAltNameExtension(arena.get(), alt_name.get());
- CERTGeneralName* name = alt_name_list;
- while (name) {
- if (name->type == certOtherName) {
- OtherName* on = &name->name.OthName;
- if (on->oid.len == sizeof(kUpnOid) &&
- memcmp(on->oid.data, kUpnOid, sizeof(kUpnOid)) == 0) {
- SECItem decoded;
- if (SEC_QuickDERDecodeItem(arena.get(), &decoded,
- SEC_ASN1_GET(SEC_UTF8StringTemplate),
- &name->name.OthName.name) == SECSuccess) {
- names->push_back(
- std::string(reinterpret_cast<char*>(decoded.data), decoded.len));
- }
- }
- }
- name = CERT_GetNextGeneralName(name);
- if (name == alt_name_list)
- break;
- }
- }
- std::string GetDefaultUniqueNickname(CERTCertificate* nss_cert,
- CertType type,
- PK11SlotInfo* slot) {
- return GetUniqueNicknameForSlot(GetDefaultNickname(nss_cert, type),
- &nss_cert->derSubject, slot);
- }
- std::string GetCERTNameDisplayName(CERTName* name) {
- // Search for attributes in the Name, in this order: CN, O and OU.
- CERTAVA* ou_ava = nullptr;
- CERTAVA* o_ava = nullptr;
- CERTRDN** rdns = name->rdns;
- for (size_t rdn = 0; rdns[rdn]; ++rdn) {
- CERTAVA** avas = rdns[rdn]->avas;
- for (size_t pair = 0; avas[pair] != nullptr; ++pair) {
- SECOidTag tag = CERT_GetAVATag(avas[pair]);
- if (tag == SEC_OID_AVA_COMMON_NAME) {
- // If CN is found, return immediately.
- return DecodeAVAValue(avas[pair]);
- }
- // If O or OU is found, save the first one of each so that it can be
- // returned later if no CN attribute is found.
- if (tag == SEC_OID_AVA_ORGANIZATION_NAME && !o_ava)
- o_ava = avas[pair];
- if (tag == SEC_OID_AVA_ORGANIZATIONAL_UNIT_NAME && !ou_ava)
- ou_ava = avas[pair];
- }
- }
- if (o_ava)
- return DecodeAVAValue(o_ava);
- if (ou_ava)
- return DecodeAVAValue(ou_ava);
- return std::string();
- }
- bool GetValidityTimes(CERTCertificate* cert,
- base::Time* not_before,
- base::Time* not_after) {
- PRTime pr_not_before, pr_not_after;
- if (CERT_GetCertTimes(cert, &pr_not_before, &pr_not_after) == SECSuccess) {
- if (not_before)
- *not_before = crypto::PRTimeToBaseTime(pr_not_before);
- if (not_after)
- *not_after = crypto::PRTimeToBaseTime(pr_not_after);
- return true;
- }
- return false;
- }
- SHA256HashValue CalculateFingerprint256(CERTCertificate* cert) {
- SHA256HashValue sha256;
- memset(sha256.data, 0, sizeof(sha256.data));
- DCHECK(cert->derCert.data);
- DCHECK_NE(0U, cert->derCert.len);
- SECStatus rv = HASH_HashBuf(HASH_AlgSHA256, sha256.data, cert->derCert.data,
- cert->derCert.len);
- DCHECK_EQ(SECSuccess, rv);
- return sha256;
- }
- } // namespace net::x509_util
|