1 // Copyright 2012 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_X509_UTIL_H_ 6 #define NET_CERT_X509_UTIL_H_ 7 8 #include <stdint.h> 9 10 #include <memory> 11 #include <string> 12 #include <vector> 13 14 #include "base/containers/span.h" 15 #include "base/memory/scoped_refptr.h" 16 #include "base/strings/string_piece.h" 17 #include "base/time/time.h" 18 #include "crypto/signature_verifier.h" 19 #include "net/base/hash_value.h" 20 #include "net/base/net_export.h" 21 #include "third_party/boringssl/src/include/openssl/base.h" 22 #include "third_party/boringssl/src/include/openssl/pool.h" 23 24 namespace crypto { 25 class RSAPrivateKey; 26 } 27 28 namespace net { 29 30 struct ParseCertificateOptions; 31 class X509Certificate; 32 33 namespace x509_util { 34 35 // Supported digest algorithms for signing certificates. 36 enum DigestAlgorithm { DIGEST_SHA256 }; 37 38 // Adds a RFC 5280 Time value to the given CBB. 39 NET_EXPORT bool CBBAddTime(CBB* cbb, base::Time time); 40 41 // Adds an X.509 name to |cbb|. The name is determined by parsing |name| as 42 // a comma-separated list of type=value pairs, such as "O=Organization, 43 // CN=Common Name". 44 // 45 // WARNING: This function does not implement the full RFC 4514 syntax for 46 // distinguished names. It should only be used if |name| is a constant 47 // value, rather than programmatically constructed. If programmatic support 48 // is needed, this input should be replaced with a richer type. 49 NET_EXPORT bool AddName(CBB* cbb, base::StringPiece name); 50 51 // Generate a 'tls-server-end-point' channel binding based on the specified 52 // certificate. Channel bindings are based on RFC 5929. 53 NET_EXPORT_PRIVATE bool GetTLSServerEndPointChannelBinding( 54 const X509Certificate& certificate, 55 std::string* token); 56 57 // Creates a public-private keypair and a self-signed certificate. 58 // Subject, serial number and validity period are given as parameters. 59 // The certificate is signed by the private key in |key|. The key length and 60 // signature algorithm may be updated periodically to match best practices. 61 // 62 // |subject| specifies the subject and issuer names as in AddName() 63 // 64 // SECURITY WARNING 65 // 66 // Using self-signed certificates has the following security risks: 67 // 1. Encryption without authentication and thus vulnerable to 68 // man-in-the-middle attacks. 69 // 2. Self-signed certificates cannot be revoked. 70 // 71 // Use this certificate only after the above risks are acknowledged. 72 NET_EXPORT bool CreateKeyAndSelfSignedCert( 73 const std::string& subject, 74 uint32_t serial_number, 75 base::Time not_valid_before, 76 base::Time not_valid_after, 77 std::unique_ptr<crypto::RSAPrivateKey>* key, 78 std::string* der_cert); 79 80 struct NET_EXPORT Extension { 81 Extension(base::span<const uint8_t> oid, 82 bool critical, 83 base::span<const uint8_t> contents); 84 ~Extension(); 85 Extension(const Extension&); 86 87 base::span<const uint8_t> oid; 88 bool critical; 89 base::span<const uint8_t> contents; 90 }; 91 92 // Creates a self-signed certificate from a provided key, using the specified 93 // hash algorithm. 94 // 95 // |subject| specifies the subject and issuer names as in AddName(). 96 NET_EXPORT bool CreateSelfSignedCert( 97 EVP_PKEY* key, 98 DigestAlgorithm alg, 99 const std::string& subject, 100 uint32_t serial_number, 101 base::Time not_valid_before, 102 base::Time not_valid_after, 103 const std::vector<Extension>& extension_specs, 104 std::string* der_cert); 105 106 // Returns a CRYPTO_BUFFER_POOL for deduplicating certificates. 107 NET_EXPORT CRYPTO_BUFFER_POOL* GetBufferPool(); 108 109 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool. 110 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 111 base::span<const uint8_t> data); 112 113 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool. 114 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 115 base::StringPiece data); 116 117 // Overload with no definition, to disallow creating a CRYPTO_BUFFER from a 118 // char* due to StringPiece implicit ctor. 119 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 120 const char* invalid_data); 121 122 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool backed by 123 // |data| without copying. |data| must be immutable and last for the lifetime 124 // of the address space. 125 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> 126 CreateCryptoBufferFromStaticDataUnsafe(base::span<const uint8_t> data); 127 128 // Compares two CRYPTO_BUFFERs and returns true if they have the same contents. 129 NET_EXPORT bool CryptoBufferEqual(const CRYPTO_BUFFER* a, 130 const CRYPTO_BUFFER* b); 131 132 // Returns a StringPiece pointing to the data in |buffer|. 133 NET_EXPORT base::StringPiece CryptoBufferAsStringPiece( 134 const CRYPTO_BUFFER* buffer); 135 136 // Returns a span pointing to the data in |buffer|. 137 NET_EXPORT base::span<const uint8_t> CryptoBufferAsSpan( 138 const CRYPTO_BUFFER* buffer); 139 140 // Creates a new X509Certificate from the chain in |buffers|, which must have at 141 // least one element. 142 NET_EXPORT scoped_refptr<X509Certificate> CreateX509CertificateFromBuffers( 143 const STACK_OF(CRYPTO_BUFFER) * buffers); 144 145 // Parses certificates from a PKCS#7 SignedData structure, appending them to 146 // |handles|. Returns true on success (in which case zero or more elements were 147 // added to |handles|) and false on error (in which case |handles| is 148 // unmodified). 149 NET_EXPORT bool CreateCertBuffersFromPKCS7Bytes( 150 base::span<const uint8_t> data, 151 std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>* handles); 152 153 // Returns the default ParseCertificateOptions for the net stack. 154 NET_EXPORT ParseCertificateOptions DefaultParseCertificateOptions(); 155 156 // On success, returns true and updates |hash| to be the SHA-256 hash of the 157 // subjectPublicKeyInfo of the certificate in |buffer|. If |buffer| is not a 158 // valid certificate, returns false and |hash| is in an undefined state. 159 [[nodiscard]] NET_EXPORT bool CalculateSha256SpkiHash( 160 const CRYPTO_BUFFER* buffer, 161 HashValue* hash); 162 163 // Calls |verifier->VerifyInit|, using the public key from |certificate|, 164 // checking if the digitalSignature key usage bit is present, and returns true 165 // on success or false on error. 166 NET_EXPORT bool SignatureVerifierInitWithCertificate( 167 crypto::SignatureVerifier* verifier, 168 crypto::SignatureVerifier::SignatureAlgorithm signature_algorithm, 169 base::span<const uint8_t> signature, 170 const CRYPTO_BUFFER* certificate); 171 172 // Returns true if the signature on the certificate is RSASSA-PKCS1-v1_5 with 173 // SHA-1. 174 NET_EXPORT_PRIVATE bool HasRsaPkcs1Sha1Signature( 175 const CRYPTO_BUFFER* cert_buffer); 176 177 } // namespace x509_util 178 179 } // namespace net 180 181 #endif // NET_CERT_X509_UTIL_H_ 182