1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/ssl/client_cert_identity.h"
#include <utility>
#include "base/bind.h"
#include "net/cert/x509_util.h"
#include "net/ssl/ssl_private_key.h"
namespace net {
namespace {
void IdentityOwningPrivateKeyCallback(
std::unique_ptr<ClientCertIdentity> identity,
base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)> private_key_callback,
scoped_refptr<SSLPrivateKey> private_key) {
std::move(private_key_callback).Run(std::move(private_key));
}
} // namespace
ClientCertIdentity::ClientCertIdentity(scoped_refptr<net::X509Certificate> cert)
: cert_(std::move(cert)) {}
ClientCertIdentity::~ClientCertIdentity() = default;
// static
void ClientCertIdentity::SelfOwningAcquirePrivateKey(
std::unique_ptr<ClientCertIdentity> self,
base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)>
private_key_callback) {
ClientCertIdentity* self_ptr = self.get();
auto wrapped_private_key_callback =
base::BindOnce(&IdentityOwningPrivateKeyCallback, std::move(self),
std::move(private_key_callback));
self_ptr->AcquirePrivateKey(std::move(wrapped_private_key_callback));
}
void ClientCertIdentity::SetIntermediates(
std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates) {
// Allow UTF-8 inside PrintableStrings in client certificates. See
// crbug.com/770323.
// TODO(mattm): Perhaps X509Certificate should have a method to clone the
// X509Certificate but with different intermediates, to avoid reparsing here
// (and avoid needing to match the parsing options here with where the
// X509Certificate was initially created.)
X509Certificate::UnsafeCreateOptions options;
options.printable_string_is_utf8 = true;
cert_ = X509Certificate::CreateFromBufferUnsafeOptions(
bssl::UpRef(cert_->cert_buffer()), std::move(intermediates), options);
// |cert_->cert_buffer()| was already successfully parsed, so this should
// never fail.
DCHECK(cert_);
}
ClientCertIdentitySorter::ClientCertIdentitySorter()
: now_(base::Time::Now()) {}
bool ClientCertIdentitySorter::operator()(
const std::unique_ptr<ClientCertIdentity>& a_identity,
const std::unique_ptr<ClientCertIdentity>& b_identity) const {
X509Certificate* a = a_identity->certificate();
X509Certificate* b = b_identity->certificate();
DCHECK(a);
DCHECK(b);
// Certificates that are expired/not-yet-valid are sorted last.
bool a_is_valid = now_ >= a->valid_start() && now_ <= a->valid_expiry();
bool b_is_valid = now_ >= b->valid_start() && now_ <= b->valid_expiry();
if (a_is_valid != b_is_valid)
return a_is_valid && !b_is_valid;
// Certificates with longer expirations appear as higher priority (less
// than) certificates with shorter expirations.
if (a->valid_expiry() != b->valid_expiry())
return a->valid_expiry() > b->valid_expiry();
// If the expiration dates are equivalent, certificates that were issued
// more recently should be prioritized over older certificates.
if (a->valid_start() != b->valid_start())
return a->valid_start() > b->valid_start();
// Otherwise, prefer client certificates with shorter chains.
const auto& a_intermediates = a->intermediate_buffers();
const auto& b_intermediates = b->intermediate_buffers();
return a_intermediates.size() < b_intermediates.size();
}
} // namespace net
|
