1 // Copyright 2012 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_X509_UTIL_H_ 6 #define NET_CERT_X509_UTIL_H_ 7 8 #include <stdint.h> 9 10 #include <memory> 11 #include <string> 12 #include <string_view> 13 #include <vector> 14 15 #include "base/containers/span.h" 16 #include "base/memory/scoped_refptr.h" 17 #include "base/time/time.h" 18 #include "crypto/signature_verifier.h" 19 #include "net/base/hash_value.h" 20 #include "net/base/net_export.h" 21 #include "net/cert/x509_certificate.h" 22 #include "third_party/boringssl/src/include/openssl/base.h" 23 #include "third_party/boringssl/src/include/openssl/pool.h" 24 #include "third_party/boringssl/src/pki/parsed_certificate.h" 25 26 namespace crypto { 27 class RSAPrivateKey; 28 } 29 30 namespace net { 31 32 namespace x509_util { 33 34 // Convert a vector of bytes into X509Certificate objects. 35 // This will silently drop all input that does not parse, so be careful using 36 // this. 37 NET_EXPORT net::CertificateList ConvertToX509CertificatesIgnoreErrors( 38 const std::vector<std::vector<uint8_t>>& certs_bytes); 39 40 // Parse all certificiates with default parsing options. Return those that 41 // parse. 42 // This will silently drop all certs with parsing errors, so be careful using 43 // this. 44 NET_EXPORT bssl::ParsedCertificateList ParseAllValidCerts( 45 const CertificateList& x509_certs); 46 47 // Supported digest algorithms for signing certificates. 48 enum DigestAlgorithm { DIGEST_SHA256 }; 49 50 // Adds a RFC 5280 Time value to the given CBB. 51 NET_EXPORT bool CBBAddTime(CBB* cbb, base::Time time); 52 53 // Adds an X.509 name to |cbb|. The name is determined by parsing |name| as 54 // a comma-separated list of type=value pairs, such as "O=Organization, 55 // CN=Common Name". 56 // 57 // WARNING: This function does not implement the full RFC 4514 syntax for 58 // distinguished names. It should only be used if |name| is a constant 59 // value, rather than programmatically constructed. If programmatic support 60 // is needed, this input should be replaced with a richer type. 61 NET_EXPORT bool AddName(CBB* cbb, std::string_view name); 62 63 // Generate a 'tls-server-end-point' channel binding based on the specified 64 // certificate. Channel bindings are based on RFC 5929. 65 NET_EXPORT_PRIVATE bool GetTLSServerEndPointChannelBinding( 66 const X509Certificate& certificate, 67 std::string* token); 68 69 // Creates a public-private keypair and a self-signed certificate. 70 // Subject, serial number and validity period are given as parameters. 71 // The certificate is signed by the private key in |key|. The key length and 72 // signature algorithm may be updated periodically to match best practices. 73 // 74 // |subject| specifies the subject and issuer names as in AddName() 75 // 76 // SECURITY WARNING 77 // 78 // Using self-signed certificates has the following security risks: 79 // 1. Encryption without authentication and thus vulnerable to 80 // man-in-the-middle attacks. 81 // 2. Self-signed certificates cannot be revoked. 82 // 83 // Use this certificate only after the above risks are acknowledged. 84 NET_EXPORT bool CreateKeyAndSelfSignedCert( 85 std::string_view subject, 86 uint32_t serial_number, 87 base::Time not_valid_before, 88 base::Time not_valid_after, 89 std::unique_ptr<crypto::RSAPrivateKey>* key, 90 std::string* der_cert); 91 92 struct NET_EXPORT Extension { 93 Extension(base::span<const uint8_t> oid, 94 bool critical, 95 base::span<const uint8_t> contents); 96 ~Extension(); 97 Extension(const Extension&); 98 99 base::span<const uint8_t> oid; 100 bool critical; 101 base::span<const uint8_t> contents; 102 }; 103 104 // Create a certificate signed by |issuer_key| and write it to |der_encoded|. 105 // 106 // |subject| and |issuer| specify names as in AddName(). If you want to create 107 // a self-signed certificate, see |CreateSelfSignedCert|. 108 NET_EXPORT bool CreateCert(EVP_PKEY* subject_key, 109 DigestAlgorithm digest_alg, 110 std::string_view subject, 111 uint32_t serial_number, 112 base::Time not_valid_before, 113 base::Time not_valid_after, 114 const std::vector<Extension>& extension_specs, 115 std::string_view issuer, 116 EVP_PKEY* issuer_key, 117 std::string* der_encoded); 118 119 // Creates a self-signed certificate from a provided key, using the specified 120 // hash algorithm. 121 // 122 // |subject| specifies the subject and issuer names as in AddName(). 123 NET_EXPORT bool CreateSelfSignedCert( 124 EVP_PKEY* key, 125 DigestAlgorithm alg, 126 std::string_view subject, 127 uint32_t serial_number, 128 base::Time not_valid_before, 129 base::Time not_valid_after, 130 const std::vector<Extension>& extension_specs, 131 std::string* der_cert); 132 133 // Returns a CRYPTO_BUFFER_POOL for deduplicating certificates. 134 NET_EXPORT CRYPTO_BUFFER_POOL* GetBufferPool(); 135 136 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool. 137 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 138 base::span<const uint8_t> data); 139 140 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool. 141 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 142 std::string_view data); 143 144 // Overload with no definition, to disallow creating a CRYPTO_BUFFER from a 145 // char* due to StringPiece implicit ctor. 146 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer( 147 const char* invalid_data); 148 149 // Creates a CRYPTO_BUFFER in the same pool returned by GetBufferPool backed by 150 // |data| without copying. |data| must be immutable and last for the lifetime 151 // of the address space. 152 NET_EXPORT bssl::UniquePtr<CRYPTO_BUFFER> 153 CreateCryptoBufferFromStaticDataUnsafe(base::span<const uint8_t> data); 154 155 // Compares two CRYPTO_BUFFERs and returns true if they have the same contents. 156 NET_EXPORT bool CryptoBufferEqual(const CRYPTO_BUFFER* a, 157 const CRYPTO_BUFFER* b); 158 159 // Returns a StringPiece pointing to the data in |buffer|. 160 NET_EXPORT std::string_view CryptoBufferAsStringPiece( 161 const CRYPTO_BUFFER* buffer); 162 163 // Returns a span pointing to the data in |buffer|. 164 NET_EXPORT base::span<const uint8_t> CryptoBufferAsSpan( 165 const CRYPTO_BUFFER* buffer); 166 167 // Creates a new X509Certificate from the chain in |buffers|, which must have at 168 // least one element. 169 NET_EXPORT scoped_refptr<X509Certificate> CreateX509CertificateFromBuffers( 170 const STACK_OF(CRYPTO_BUFFER) * buffers); 171 172 // Parses certificates from a PKCS#7 SignedData structure, appending them to 173 // |handles|. Returns true on success (in which case zero or more elements were 174 // added to |handles|) and false on error (in which case |handles| is 175 // unmodified). 176 NET_EXPORT bool CreateCertBuffersFromPKCS7Bytes( 177 base::span<const uint8_t> data, 178 std::vector<bssl::UniquePtr<CRYPTO_BUFFER>>* handles); 179 180 // Returns the default ParseCertificateOptions for the net stack. 181 NET_EXPORT bssl::ParseCertificateOptions DefaultParseCertificateOptions(); 182 183 // On success, returns true and updates |hash| to be the SHA-256 hash of the 184 // subjectPublicKeyInfo of the certificate in |buffer|. If |buffer| is not a 185 // valid certificate, returns false and |hash| is in an undefined state. 186 [[nodiscard]] NET_EXPORT bool CalculateSha256SpkiHash( 187 const CRYPTO_BUFFER* buffer, 188 HashValue* hash); 189 190 // Calls |verifier->VerifyInit|, using the public key from |certificate|, 191 // checking if the digitalSignature key usage bit is present, and returns true 192 // on success or false on error. 193 NET_EXPORT bool SignatureVerifierInitWithCertificate( 194 crypto::SignatureVerifier* verifier, 195 crypto::SignatureVerifier::SignatureAlgorithm signature_algorithm, 196 base::span<const uint8_t> signature, 197 const CRYPTO_BUFFER* certificate); 198 199 // Returns true if the signature on the certificate is RSASSA-PKCS1-v1_5 with 200 // SHA-1. 201 NET_EXPORT_PRIVATE bool HasRsaPkcs1Sha1Signature( 202 const CRYPTO_BUFFER* cert_buffer); 203 204 } // namespace x509_util 205 206 } // namespace net 207 208 #endif // NET_CERT_X509_UTIL_H_ 209