1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "net/ssl/client_cert_store_impl.h" 6 7 #include <nss.h> 8 #include <ssl.h> 9 10 #include "base/logging.h" 11 #include "net/cert/x509_util.h" 12 13 namespace net { 14 15 namespace { 16 17 // Examines the certificates in |cert_list| to find all certificates that match 18 // the client certificate request in |request|, storing the matching 19 // certificates in |selected_certs|. 20 // If |query_nssdb| is true, NSS will be queried to construct full certificate 21 // chains. If it is false, only the certificate will be considered. 22 bool GetClientCertsImpl(CERTCertList* cert_list, 23 const SSLCertRequestInfo& request, 24 bool query_nssdb, 25 CertificateList* selected_certs) { 26 DCHECK(cert_list); 27 DCHECK(selected_certs); 28 29 selected_certs->clear(); 30 31 // Create a "fake" CERTDistNames structure. No public API exists to create 32 // one from a list of issuers. 33 CERTDistNames ca_names; 34 ca_names.arena = NULL; 35 ca_names.nnames = 0; 36 ca_names.names = NULL; 37 ca_names.head = NULL; 38 39 std::vector<SECItem> ca_names_items(request.cert_authorities.size()); 40 for (size_t i = 0; i < request.cert_authorities.size(); ++i) { 41 const std::string& authority = request.cert_authorities[i]; 42 ca_names_items[i].type = siBuffer; 43 ca_names_items[i].data = 44 reinterpret_cast<unsigned char*>(const_cast<char*>(authority.data())); 45 ca_names_items[i].len = static_cast<unsigned int>(authority.size()); 46 } 47 ca_names.nnames = static_cast<int>(ca_names_items.size()); 48 if (!ca_names_items.empty()) 49 ca_names.names = &ca_names_items[0]; 50 51 for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list); 52 !CERT_LIST_END(node, cert_list); 53 node = CERT_LIST_NEXT(node)) { 54 // Only offer unexpired certificates. 55 if (CERT_CheckCertValidTimes(node->cert, PR_Now(), PR_TRUE) != 56 secCertTimeValid) { 57 continue; 58 } 59 60 scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle( 61 node->cert, X509Certificate::OSCertHandles()); 62 63 // Check if the certificate issuer is allowed by the server. 64 if (request.cert_authorities.empty() || 65 (!query_nssdb && 66 cert->IsIssuedByEncoded(request.cert_authorities)) || 67 (query_nssdb && 68 NSS_CmpCertChainWCANames(node->cert, &ca_names) == SECSuccess)) { 69 selected_certs->push_back(cert); 70 } 71 } 72 73 std::sort(selected_certs->begin(), selected_certs->end(), 74 x509_util::ClientCertSorter()); 75 return true; 76 } 77 78 } // namespace 79 80 bool ClientCertStoreImpl::GetClientCerts(const SSLCertRequestInfo& request, 81 CertificateList* selected_certs) { 82 CERTCertList* client_certs = CERT_FindUserCertsByUsage( 83 CERT_GetDefaultCertDB(), certUsageSSLClient, 84 PR_FALSE, PR_FALSE, NULL); 85 // It is ok for a user not to have any client certs. 86 if (!client_certs) 87 return true; 88 89 bool rv = GetClientCertsImpl(client_certs, request, true, selected_certs); 90 CERT_DestroyCertList(client_certs); 91 return rv; 92 } 93 94 bool ClientCertStoreImpl::SelectClientCertsForTesting( 95 const CertificateList& input_certs, 96 const SSLCertRequestInfo& request, 97 CertificateList* selected_certs) { 98 CERTCertList* cert_list = CERT_NewCertList(); 99 if (!cert_list) 100 return false; 101 for (size_t i = 0; i < input_certs.size(); ++i) { 102 CERT_AddCertToListTail( 103 cert_list, CERT_DupCertificate(input_certs[i]->os_cert_handle())); 104 } 105 106 bool rv = GetClientCertsImpl(cert_list, request, false, selected_certs); 107 CERT_DestroyCertList(cert_list); 108 return rv; 109 } 110 111 } // namespace net 112