1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/ssl/client_cert_identity.h"
6
7 #include <utility>
8
9 #include "base/functional/bind.h"
10 #include "net/cert/x509_util.h"
11 #include "net/ssl/ssl_private_key.h"
12
13 namespace net {
14
15 namespace {
16
IdentityOwningPrivateKeyCallback(std::unique_ptr<ClientCertIdentity> identity,base::OnceCallback<void (scoped_refptr<SSLPrivateKey>)> private_key_callback,scoped_refptr<SSLPrivateKey> private_key)17 void IdentityOwningPrivateKeyCallback(
18 std::unique_ptr<ClientCertIdentity> identity,
19 base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)> private_key_callback,
20 scoped_refptr<SSLPrivateKey> private_key) {
21 std::move(private_key_callback).Run(std::move(private_key));
22 }
23
24 } // namespace
25
ClientCertIdentity(scoped_refptr<net::X509Certificate> cert)26 ClientCertIdentity::ClientCertIdentity(scoped_refptr<net::X509Certificate> cert)
27 : cert_(std::move(cert)) {}
28 ClientCertIdentity::~ClientCertIdentity() = default;
29
30 // static
SelfOwningAcquirePrivateKey(std::unique_ptr<ClientCertIdentity> self,base::OnceCallback<void (scoped_refptr<SSLPrivateKey>)> private_key_callback)31 void ClientCertIdentity::SelfOwningAcquirePrivateKey(
32 std::unique_ptr<ClientCertIdentity> self,
33 base::OnceCallback<void(scoped_refptr<SSLPrivateKey>)>
34 private_key_callback) {
35 ClientCertIdentity* self_ptr = self.get();
36 auto wrapped_private_key_callback =
37 base::BindOnce(&IdentityOwningPrivateKeyCallback, std::move(self),
38 std::move(private_key_callback));
39 self_ptr->AcquirePrivateKey(std::move(wrapped_private_key_callback));
40 }
41
SetIntermediates(std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates)42 void ClientCertIdentity::SetIntermediates(
43 std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates) {
44 // Allow UTF-8 inside PrintableStrings in client certificates. See
45 // crbug.com/770323.
46 // TODO(mattm): Perhaps X509Certificate should have a method to clone the
47 // X509Certificate but with different intermediates, to avoid reparsing here
48 // (and avoid needing to match the parsing options here with where the
49 // X509Certificate was initially created.)
50 X509Certificate::UnsafeCreateOptions options;
51 options.printable_string_is_utf8 = true;
52 cert_ = X509Certificate::CreateFromBufferUnsafeOptions(
53 bssl::UpRef(cert_->cert_buffer()), std::move(intermediates), options);
54 // |cert_->cert_buffer()| was already successfully parsed, so this should
55 // never fail.
56 DCHECK(cert_);
57 }
58
ClientCertIdentitySorter()59 ClientCertIdentitySorter::ClientCertIdentitySorter()
60 : now_(base::Time::Now()) {}
61
operator ()(const std::unique_ptr<ClientCertIdentity> & a_identity,const std::unique_ptr<ClientCertIdentity> & b_identity) const62 bool ClientCertIdentitySorter::operator()(
63 const std::unique_ptr<ClientCertIdentity>& a_identity,
64 const std::unique_ptr<ClientCertIdentity>& b_identity) const {
65 X509Certificate* a = a_identity->certificate();
66 X509Certificate* b = b_identity->certificate();
67 DCHECK(a);
68 DCHECK(b);
69
70 // Certificates that are expired/not-yet-valid are sorted last.
71 bool a_is_valid = now_ >= a->valid_start() && now_ <= a->valid_expiry();
72 bool b_is_valid = now_ >= b->valid_start() && now_ <= b->valid_expiry();
73 if (a_is_valid != b_is_valid)
74 return a_is_valid && !b_is_valid;
75
76 // Certificates with longer expirations appear as higher priority (less
77 // than) certificates with shorter expirations.
78 if (a->valid_expiry() != b->valid_expiry())
79 return a->valid_expiry() > b->valid_expiry();
80
81 // If the expiration dates are equivalent, certificates that were issued
82 // more recently should be prioritized over older certificates.
83 if (a->valid_start() != b->valid_start())
84 return a->valid_start() > b->valid_start();
85
86 // Otherwise, prefer client certificates with shorter chains.
87 const auto& a_intermediates = a->intermediate_buffers();
88 const auto& b_intermediates = b->intermediate_buffers();
89 return a_intermediates.size() < b_intermediates.size();
90 }
91
92 } // namespace net
93