1 // Copyright 2012 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_X509_UTIL_H_ 6 #define NET_CERT_X509_UTIL_H_ 7 8 #include <stdint.h> 9 10 #include <memory> 11 #include <string> 12 #include <string_view> 13 #include <vector> 14 15 #include "base/containers/span.h" 16 #include "base/memory/raw_span.h" 17 #include "base/memory/scoped_refptr.h" 18 #include "base/time/time.h" 19 #include "crypto/signature_verifier.h" 20 #include "net/base/hash_value.h" 21 #include "net/base/net_export.h" 22 #include "net/cert/x509_certificate.h" 23 #include "third_party/boringssl/src/include/openssl/base.h" 24 #include "third_party/boringssl/src/include/openssl/pool.h" 25 #include "third_party/boringssl/src/pki/parsed_certificate.h" 26 27 namespace crypto { 28 class RSAPrivateKey; 29 } 30 31 namespace net { 32 33 namespace x509_util { 34 35 // Convert a vector of bytes into X509Certificate objects. 36 // This will silently drop all input that does not parse, so be careful using 37 // this. 38 NET_EXPORT net::CertificateList ConvertToX509CertificatesIgnoreErrors( 39 const std::vector<std::vector<uint8_t>>& certs_bytes); 40 41 // Parse all certificiates with default parsing options. Return those that 42 // parse. 43 // This will silently drop all certs with parsing errors, so be careful using 44 // this. 45 NET_EXPORT bssl::ParsedCertificateList ParseAllValidCerts( 46 const CertificateList& x509_certs); 47 48 // Supported digest algorithms for signing certificates. 49 enum DigestAlgorithm { DIGEST_SHA256 }; 50 51 // Adds a RFC 5280 Time value to the given CBB. 52 NET_EXPORT bool CBBAddTime(CBB* cbb, base::Time time); 53 54 // Adds an X.509 name to |cbb|. The name is determined by parsing |name| as 55 // a comma-separated list of type=value pairs, such as "O=Organization, 56 // CN=Common Name". 57 // 58 // WARNING: This function does not implement the full RFC 4514 syntax for 59 // distinguished names. It should only be used if |name| is a constant 60 // value, rather than programmatically constructed. If programmatic support 61 // is needed, this input should be replaced with a richer type. 62 NET_EXPORT bool AddName(CBB* cbb, std::string_view name); 63 64 // Generate a 'tls-server-end-point' channel binding based on the specified 65 // certificate. Channel bindings are based on RFC 5929. 66 NET_EXPORT_PRIVATE bool GetTLSServerEndPointChannelBinding( 67 const X509Certificate& certificate, 68 std::string* token); 69 70 // Creates a public-private keypair and a self-signed certificate. 71 // Subject, serial number and validity period are given as parameters. 72 // The certificate is signed by the private key in |key|. The key length and 73 // signature algorithm may be updated periodically to match best practices. 74 // 75 // |subject| specifies the subject and issuer names as in AddName() 76 // 77 // SECURITY WARNING 78 // 79 // Using self-signed certificates has the following security risks: 80 // 1. Encryption without authentication and thus vulnerable to 81 // man-in-the-middle attacks. 82 // 2. Self-signed certificates cannot be revoked. 83 // 84 // Use this certificate only after the above risks are acknowledged. 85 NET_EXPORT bool CreateKeyAndSelfSignedCert( 86 std::string_view subject, 87 uint32_t serial_number, 88 base::Time not_valid_before, 89 base::Time not_valid_after, 90 std::unique_ptr<crypto::RSAPrivateKey>* key, 91 std::string* der_cert); 92 93 struct NET_EXPORT Extension { 94 Extension(base::span<const uint8_t> oid, 95 bool critical, 96 base::span<const uint8_t> contents); 97 ~Extension(); 98 Extension(const Extension&); 99 100 base::raw_span<const uint8_t> oid; 101 bool critical; 102 base::raw_span<const uint8_t> contents; 103 }; 104 105 // Create a certificate signed by |issuer_key| and write it to |der_encoded|. 106 // 107 // |subject| and |issuer| specify names as in AddName(). If you want to create 108 // a self-signed certificate, see |CreateSelfSignedCert|. 109 NET_EXPORT bool CreateCert(EVP_PKEY* subject_key, 110 DigestAlgorithm digest_alg, 111 std::string_view subject, 112 uint32_t serial_number, 113 base::Time not_valid_before, 114 base::Time not_valid_after, 115 const std::vector<Extension>& extension_specs, 116 std::string_view issuer, 117 EVP_PKEY* issuer_key, 118 std::string* der_encoded); 119 120 // Creates a self-signed certificate from a provided key, using the specified 121 // hash algorithm. 122 // 123 // |subject| specifies the subject and issuer names as in AddName(). 124 NET_EXPORT bool CreateSelfSignedCert( 125 EVP_PKEY* key, 126 DigestAlgorithm alg, 127 std::string_view subject, 128 uint32_t serial_number, 129 base::Time not_valid_before, 130 base::Time not_valid_after, 131 const std::vector<Extension>& extension_specs, 132 std::string* der_cert); 133 134 // Returns a CRYPTO_BUFFER_POOL for deduplicating certificates. 135 NET_EXPORT CRYPTO_BUFFER_POOL* GetBufferPool(); 136 137 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool. 138 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 139 base::span<const uint8_t> data); 140 141 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool. 142 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 143 std::string_view data); 144 145 // Overload with no definition, to disallow creating a CRYPTO_BUFFER from a 146 // char* due to std::string_view implicit ctor. 147 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 148 const char* invalid_data); 149 150 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool backed by 151 // |data| without copying. |data| must be immutable and last for the lifetime 152 // of the address space. 153 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> 154 CreateCryptoBufferFromStaticDataUnsafe(base::span<const uint8_t> data); 155 156 // Compares two CRYPTO_BUFFERs and returns true if they have the same contents. 157 NET_EXPORT bool CryptoBufferEqual(const CRYPTO_BUFFER* a, 158 const CRYPTO_BUFFER* b); 159 160 // Returns a std::string_view pointing to the data in |buffer|. 161 NET_EXPORT std::string_view CryptoBufferAsStringPiece( 162 const CRYPTO_BUFFER* buffer); 163 164 // Returns a span pointing to the data in |buffer|. 165 NET_EXPORT base::span<const uint8_t> CryptoBufferAsSpan( 166 const CRYPTO_BUFFER* buffer); 167 168 // Creates a new X509Certificate from the chain in |buffers|, which must have at 169 // least one element. 170 NET_EXPORT scoped_refptr<X509Certificate> CreateX509CertificateFromBuffers( 171 const STACK_OF(CRYPTO_BUFFER) * buffers); 172 173 // Parses certificates from a PKCS#7 SignedData structure, appending them to 174 // |handles|. Returns true on success (in which case zero or more elements were 175 // added to |handles|) and false on error (in which case |handles| is 176 // unmodified). 177 NET_EXPORT bool CreateCertBuffersFromPKCS7Bytes( 178 base::span<const uint8_t> data, 179 std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>* handles); 180 181 // Returns the default ParseCertificateOptions for the net stack. 182 NET_EXPORT bssl::ParseCertificateOptions DefaultParseCertificateOptions(); 183 184 // On success, returns true and updates |hash| to be the SHA-256 hash of the 185 // subjectPublicKeyInfo of the certificate in |buffer|. If |buffer| is not a 186 // valid certificate, returns false and |hash| is in an undefined state. 187 [[nodiscard]] NET_EXPORT bool CalculateSha256SpkiHash( 188 const CRYPTO_BUFFER* buffer, 189 HashValue* hash); 190 191 // Calls |verifier->VerifyInit|, using the public key from |certificate|, 192 // checking if the digitalSignature key usage bit is present, and returns true 193 // on success or false on error. 194 NET_EXPORT bool SignatureVerifierInitWithCertificate( 195 crypto::SignatureVerifier* verifier, 196 crypto::SignatureVerifier::SignatureAlgorithm signature_algorithm, 197 base::span<const uint8_t> signature, 198 const CRYPTO_BUFFER* certificate); 199 200 // Returns true if the signature on the certificate is RSASSA-PKCS1-v1_5 with 201 // SHA-1. 202 NET_EXPORT_PRIVATE bool HasRsaPkcs1Sha1Signature( 203 const CRYPTO_BUFFER* cert_buffer); 204 205 } // namespace x509_util 206 207 } // namespace net 208 209 #endif // NET_CERT_X509_UTIL_H_ 210