client_cert_identity.cc 3.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/ssl/client_cert_identity.h"
  5. #include <utility>
  6. #include "base/bind.h"
  7. #include "net/cert/x509_util.h"
  8. #include "net/ssl/ssl_private_key.h"
  9. namespace net {
  10. namespace {
  11. void IdentityOwningPrivateKeyCallback(
  12. std::unique_ptr<ClientCertIdentity> identity,
  13. base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)> private_key_callback,
  14. scoped_refptr<SSLPrivateKey> private_key) {
  15. std::move(private_key_callback).Run(std::move(private_key));
  16. }
  17. } // namespace
  18. ClientCertIdentity::ClientCertIdentity(scoped_refptr<net::X509Certificate> cert)
  19. : cert_(std::move(cert)) {}
  20. ClientCertIdentity::~ClientCertIdentity() = default;
  21. // static
  22. void ClientCertIdentity::SelfOwningAcquirePrivateKey(
  23. std::unique_ptr<ClientCertIdentity> self,
  24. base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)>
  25. private_key_callback) {
  26. ClientCertIdentity* self_ptr = self.get();
  27. auto wrapped_private_key_callback =
  28. base::BindOnce(&IdentityOwningPrivateKeyCallback, std::move(self),
  29. std::move(private_key_callback));
  30. self_ptr->AcquirePrivateKey(std::move(wrapped_private_key_callback));
  31. }
  32. void ClientCertIdentity::SetIntermediates(
  33. std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates) {
  34. // Allow UTF-8 inside PrintableStrings in client certificates. See
  35. // crbug.com/770323.
  36. // TODO(mattm): Perhaps X509Certificate should have a method to clone the
  37. // X509Certificate but with different intermediates, to avoid reparsing here
  38. // (and avoid needing to match the parsing options here with where the
  39. // X509Certificate was initially created.)
  40. X509Certificate::UnsafeCreateOptions options;
  41. options.printable_string_is_utf8 = true;
  42. cert_ = X509Certificate::CreateFromBufferUnsafeOptions(
  43. bssl::UpRef(cert_->cert_buffer()), std::move(intermediates), options);
  44. // |cert_->cert_buffer()| was already successfully parsed, so this should
  45. // never fail.
  46. DCHECK(cert_);
  47. }
  48. ClientCertIdentitySorter::ClientCertIdentitySorter()
  49. : now_(base::Time::Now()) {}
  50. bool ClientCertIdentitySorter::operator()(
  51. const std::unique_ptr<ClientCertIdentity>& a_identity,
  52. const std::unique_ptr<ClientCertIdentity>& b_identity) const {
  53. X509Certificate* a = a_identity->certificate();
  54. X509Certificate* b = b_identity->certificate();
  55. DCHECK(a);
  56. DCHECK(b);
  57. // Certificates that are expired/not-yet-valid are sorted last.
  58. bool a_is_valid = now_ >= a->valid_start() && now_ <= a->valid_expiry();
  59. bool b_is_valid = now_ >= b->valid_start() && now_ <= b->valid_expiry();
  60. if (a_is_valid != b_is_valid)
  61. return a_is_valid && !b_is_valid;
  62. // Certificates with longer expirations appear as higher priority (less
  63. // than) certificates with shorter expirations.
  64. if (a->valid_expiry() != b->valid_expiry())
  65. return a->valid_expiry() > b->valid_expiry();
  66. // If the expiration dates are equivalent, certificates that were issued
  67. // more recently should be prioritized over older certificates.
  68. if (a->valid_start() != b->valid_start())
  69. return a->valid_start() > b->valid_start();
  70. // Otherwise, prefer client certificates with shorter chains.
  71. const auto& a_intermediates = a->intermediate_buffers();
  72. const auto& b_intermediates = b->intermediate_buffers();
  73. return a_intermediates.size() < b_intermediates.size();
  74. }
  75. } // namespace net