1 // Copyright 2016 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "trust_store_in_memory.h"
6
7 namespace bssl {
8
9 TrustStoreInMemory::TrustStoreInMemory() = default;
10 TrustStoreInMemory::~TrustStoreInMemory() = default;
11
IsEmpty() const12 bool TrustStoreInMemory::IsEmpty() const { return entries_.empty(); }
13
Clear()14 void TrustStoreInMemory::Clear() { entries_.clear(); }
15
AddTrustAnchor(std::shared_ptr<const ParsedCertificate> cert)16 void TrustStoreInMemory::AddTrustAnchor(
17 std::shared_ptr<const ParsedCertificate> cert) {
18 AddCertificate(std::move(cert), CertificateTrust::ForTrustAnchor());
19 }
20
AddTrustAnchorWithExpiration(std::shared_ptr<const ParsedCertificate> cert)21 void TrustStoreInMemory::AddTrustAnchorWithExpiration(
22 std::shared_ptr<const ParsedCertificate> cert) {
23 AddCertificate(std::move(cert),
24 CertificateTrust::ForTrustAnchor().WithEnforceAnchorExpiry());
25 }
26
AddTrustAnchorWithConstraints(std::shared_ptr<const ParsedCertificate> cert)27 void TrustStoreInMemory::AddTrustAnchorWithConstraints(
28 std::shared_ptr<const ParsedCertificate> cert) {
29 AddCertificate(
30 std::move(cert),
31 CertificateTrust::ForTrustAnchor().WithEnforceAnchorConstraints());
32 }
33
AddDistrustedCertificateForTest(std::shared_ptr<const ParsedCertificate> cert)34 void TrustStoreInMemory::AddDistrustedCertificateForTest(
35 std::shared_ptr<const ParsedCertificate> cert) {
36 AddCertificate(std::move(cert), CertificateTrust::ForDistrusted());
37 }
38
AddDistrustedCertificateBySPKI(std::string spki)39 void TrustStoreInMemory::AddDistrustedCertificateBySPKI(std::string spki) {
40 distrusted_spkis_.insert(std::move(spki));
41 }
42
AddCertificateWithUnspecifiedTrust(std::shared_ptr<const ParsedCertificate> cert)43 void TrustStoreInMemory::AddCertificateWithUnspecifiedTrust(
44 std::shared_ptr<const ParsedCertificate> cert) {
45 AddCertificate(std::move(cert), CertificateTrust::ForUnspecified());
46 }
47
SyncGetIssuersOf(const ParsedCertificate * cert,ParsedCertificateList * issuers)48 void TrustStoreInMemory::SyncGetIssuersOf(const ParsedCertificate *cert,
49 ParsedCertificateList *issuers) {
50 auto range =
51 entries_.equal_range(BytesAsStringView(cert->normalized_issuer()));
52 for (auto it = range.first; it != range.second; ++it) {
53 issuers->push_back(it->second.cert);
54 }
55 }
56
GetTrust(const ParsedCertificate * cert)57 CertificateTrust TrustStoreInMemory::GetTrust(const ParsedCertificate *cert) {
58 // Check SPKI distrust first.
59 if (distrusted_spkis_.find(BytesAsStringView(cert->tbs().spki_tlv)) !=
60 distrusted_spkis_.end()) {
61 return CertificateTrust::ForDistrusted();
62 }
63
64 const Entry *entry = GetEntry(cert);
65 return entry ? entry->trust : CertificateTrust::ForUnspecified();
66 }
67
Contains(const ParsedCertificate * cert) const68 bool TrustStoreInMemory::Contains(const ParsedCertificate *cert) const {
69 return GetEntry(cert) != nullptr;
70 }
71
72 TrustStoreInMemory::Entry::Entry() = default;
73 TrustStoreInMemory::Entry::Entry(const Entry &other) = default;
74 TrustStoreInMemory::Entry::~Entry() = default;
75
AddCertificate(std::shared_ptr<const ParsedCertificate> cert,const CertificateTrust & trust)76 void TrustStoreInMemory::AddCertificate(
77 std::shared_ptr<const ParsedCertificate> cert,
78 const CertificateTrust &trust) {
79 Entry entry;
80 entry.cert = std::move(cert);
81 entry.trust = trust;
82
83 // TODO(mattm): should this check for duplicate certificates?
84 entries_.emplace(BytesAsStringView(entry.cert->normalized_subject()), entry);
85 }
86
GetEntry(const ParsedCertificate * cert) const87 const TrustStoreInMemory::Entry *TrustStoreInMemory::GetEntry(
88 const ParsedCertificate *cert) const {
89 auto range =
90 entries_.equal_range(BytesAsStringView(cert->normalized_subject()));
91 for (auto it = range.first; it != range.second; ++it) {
92 if (cert == it->second.cert.get() ||
93 cert->der_cert() == it->second.cert->der_cert()) {
94 // NOTE: ambiguity when there are duplicate entries.
95 return &it->second;
96 }
97 }
98 return nullptr;
99 }
100
101 } // namespace bssl
102