x509_util_nss.h 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_X509_UTIL_NSS_H_
  5. #define NET_CERT_X509_UTIL_NSS_H_
  6. #include <stddef.h>
  7. #include <string>
  8. #include <vector>
  9. #include "net/base/net_export.h"
  10. #include "net/cert/cert_type.h"
  11. #include "net/cert/scoped_nss_types.h"
  12. #include "net/cert/x509_certificate.h"
  13. typedef struct CERTCertificateStr CERTCertificate;
  14. typedef struct CERTNameStr CERTName;
  15. typedef struct PK11SlotInfoStr PK11SlotInfo;
  16. typedef struct SECItemStr SECItem;
  17. namespace net::x509_util {
  18. // Returns true if two certificate handles refer to identical certificates.
  19. NET_EXPORT bool IsSameCertificate(CERTCertificate* a, CERTCertificate* b);
  20. NET_EXPORT bool IsSameCertificate(CERTCertificate* a, const X509Certificate* b);
  21. NET_EXPORT bool IsSameCertificate(const X509Certificate* a, CERTCertificate* b);
  22. // Returns a CERTCertificate handle from the DER-encoded representation. The
  23. // returned value may reference an already existing CERTCertificate object.
  24. // Returns NULL on failure.
  25. NET_EXPORT ScopedCERTCertificate
  26. CreateCERTCertificateFromBytes(const uint8_t* data, size_t length);
  27. // Returns a CERTCertificate handle from |cert|. The returned value may
  28. // reference an already existing CERTCertificate object. Returns NULL on
  29. // failure.
  30. NET_EXPORT ScopedCERTCertificate
  31. CreateCERTCertificateFromX509Certificate(const X509Certificate* cert);
  32. // Returns a vector of CERTCertificates corresponding to |cert| and its
  33. // intermediates (if any). Returns an empty vector on failure.
  34. NET_EXPORT ScopedCERTCertificateList
  35. CreateCERTCertificateListFromX509Certificate(const X509Certificate* cert);
  36. // Specify behavior if an intermediate certificate fails CERTCertificate
  37. // parsing. kFail means the function should return a failure result
  38. // immediately. kIgnore means the invalid intermediate is not added to the
  39. // output container.
  40. enum class InvalidIntermediateBehavior { kFail, kIgnore };
  41. // Returns a vector of CERTCertificates corresponding to |cert| and its
  42. // intermediates (if any). Returns an empty vector if the certificate could not
  43. // be converted. |invalid_intermediate_behavior| specifies behavior if
  44. // intermediates of |cert| could not be converted.
  45. NET_EXPORT ScopedCERTCertificateList
  46. CreateCERTCertificateListFromX509Certificate(
  47. const X509Certificate* cert,
  48. InvalidIntermediateBehavior invalid_intermediate_behavior);
  49. // Parses all of the certificates possible from |data|. |format| is a
  50. // bit-wise OR of X509Certificate::Format, indicating the possible formats the
  51. // certificates may have been serialized as. If an error occurs, an empty
  52. // collection will be returned.
  53. NET_EXPORT ScopedCERTCertificateList
  54. CreateCERTCertificateListFromBytes(const char* data, size_t length, int format);
  55. // Increments the refcount of |cert| and returns a handle for that reference.
  56. NET_EXPORT ScopedCERTCertificate DupCERTCertificate(CERTCertificate* cert);
  57. // Increments the refcount of each element in |cerst| and returns a list of
  58. // handles for them.
  59. NET_EXPORT ScopedCERTCertificateList
  60. DupCERTCertificateList(const ScopedCERTCertificateList& certs);
  61. // Creates an X509Certificate from |cert|, with intermediates from |chain|.
  62. // Returns NULL on failure.
  63. NET_EXPORT scoped_refptr<X509Certificate>
  64. CreateX509CertificateFromCERTCertificate(
  65. CERTCertificate* cert,
  66. const std::vector<CERTCertificate*>& chain);
  67. // Creates an X509Certificate with non-standard parsing options.
  68. // Do not use without consulting //net owners.
  69. NET_EXPORT scoped_refptr<X509Certificate>
  70. CreateX509CertificateFromCERTCertificate(
  71. CERTCertificate* cert,
  72. const std::vector<CERTCertificate*>& chain,
  73. X509Certificate::UnsafeCreateOptions options);
  74. // Creates an X509Certificate from |cert|, with no intermediates.
  75. // Returns NULL on failure.
  76. NET_EXPORT scoped_refptr<X509Certificate>
  77. CreateX509CertificateFromCERTCertificate(CERTCertificate* cert);
  78. // Creates an X509Certificate for each element in |certs|.
  79. // Returns an empty list on failure.
  80. NET_EXPORT CertificateList CreateX509CertificateListFromCERTCertificates(
  81. const ScopedCERTCertificateList& certs);
  82. // Obtains the DER encoded certificate data for |cert|. On success, returns
  83. // true and writes the DER encoded certificate to |*der_encoded|.
  84. NET_EXPORT bool GetDEREncoded(CERTCertificate* cert, std::string* der_encoded);
  85. // Obtains the PEM encoded certificate data for |cert|. On success, returns
  86. // true and writes the PEM encoded certificate to |*pem_encoded|.
  87. NET_EXPORT bool GetPEMEncoded(CERTCertificate* cert, std::string* pem_encoded);
  88. // Stores the values of all rfc822Name subjectAltNames from |cert_handle|
  89. // into |names|. If no names are present, clears |names|.
  90. // WARNING: This method does not validate that the rfc822Name is
  91. // properly encoded; it MAY contain embedded NULs or other illegal
  92. // characters; care should be taken to validate the well-formedness
  93. // before using.
  94. NET_EXPORT void GetRFC822SubjectAltNames(CERTCertificate* cert_handle,
  95. std::vector<std::string>* names);
  96. // Stores the values of all Microsoft UPN subjectAltNames from |cert_handle|
  97. // into |names|. If no names are present, clears |names|.
  98. //
  99. // A "Microsoft UPN subjectAltName" is an OtherName value whose type-id
  100. // is equal to 1.3.6.1.4.1.311.20.2.3 (known as either id-ms-san-sc-logon-upn,
  101. // as described in RFC 4556, or as szOID_NT_PRINCIPAL_NAME, as
  102. // documented in Microsoft KB287547).
  103. // The value field is a UTF8String literal.
  104. // For more information:
  105. // https://www.ietf.org/mail-archive/web/pkix/current/msg03145.html
  106. // https://www.ietf.org/proceedings/65/slides/pkix-4/sld1.htm
  107. // https://tools.ietf.org/html/rfc4556
  108. //
  109. // WARNING: This method does not validate that the name is
  110. // properly encoded; it MAY contain embedded NULs or other illegal
  111. // characters; care should be taken to validate the well-formedness
  112. // before using.
  113. NET_EXPORT void GetUPNSubjectAltNames(CERTCertificate* cert_handle,
  114. std::vector<std::string>* names);
  115. // Generates a unique nickname for |nss_cert| based on the |type| and |slot|.
  116. NET_EXPORT std::string GetDefaultUniqueNickname(CERTCertificate* nss_cert,
  117. CertType type,
  118. PK11SlotInfo* slot);
  119. // Returns a name that can be used to represent the principal. It tries in
  120. // this order: CN, O and OU and returns the first non-empty one found.
  121. // This mirrors net::CertPrincipal::GetDisplayName.
  122. NET_EXPORT std::string GetCERTNameDisplayName(CERTName* name);
  123. // Stores the notBefore and notAfter times from |cert| into |*not_before| and
  124. // |*not_after|, returning true if successful. |not_before| or |not_after| may
  125. // be null.
  126. NET_EXPORT bool GetValidityTimes(CERTCertificate* cert,
  127. base::Time* not_before,
  128. base::Time* not_after);
  129. // Calculates the SHA-256 fingerprint of the certificate. Returns an empty
  130. // (all zero) fingerprint on failure.
  131. NET_EXPORT SHA256HashValue CalculateFingerprint256(CERTCertificate* cert);
  132. } // namespace net::x509_util
  133. #endif // NET_CERT_X509_UTIL_NSS_H_