1 // Copyright 2011 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_X509_UTIL_NSS_H_ 6 #define NET_CERT_X509_UTIL_NSS_H_ 7 8 #include <stddef.h> 9 10 #include <string> 11 #include <vector> 12 13 #include "crypto/scoped_nss_types.h" 14 #include "net/base/net_export.h" 15 #include "net/cert/cert_type.h" 16 #include "net/cert/scoped_nss_types.h" 17 #include "net/cert/x509_certificate.h" 18 19 typedef struct CERTCertificateStr CERTCertificate; 20 typedef struct CERTNameStr CERTName; 21 typedef struct PK11SlotInfoStr PK11SlotInfo; 22 typedef struct SECItemStr SECItem; 23 24 namespace net::x509_util { 25 26 // Returns true if two certificate handles refer to identical certificates. 27 NET_EXPORT bool IsSameCertificate(CERTCertificate* a, CERTCertificate* b); 28 NET_EXPORT bool IsSameCertificate(CERTCertificate* a, const X509Certificate* b); 29 NET_EXPORT bool IsSameCertificate(const X509Certificate* a, CERTCertificate* b); 30 NET_EXPORT bool IsSameCertificate(CERTCertificate* a, const CRYPTO_BUFFER* b); 31 NET_EXPORT bool IsSameCertificate(const CRYPTO_BUFFER* a, CERTCertificate* b); 32 33 // Returns a CERTCertificate handle from the DER-encoded representation. The 34 // returned value may reference an already existing CERTCertificate object. 35 // Returns NULL on failure. 36 NET_EXPORT ScopedCERTCertificate 37 CreateCERTCertificateFromBytes(base::span<const uint8_t> data); 38 39 // Returns a CERTCertificate handle from |cert|. The returned value may 40 // reference an already existing CERTCertificate object. Returns NULL on 41 // failure. 42 NET_EXPORT ScopedCERTCertificate 43 CreateCERTCertificateFromX509Certificate(const X509Certificate* cert); 44 45 // Returns a vector of CERTCertificates corresponding to |cert| and its 46 // intermediates (if any). Returns an empty vector on failure. 47 NET_EXPORT ScopedCERTCertificateList 48 CreateCERTCertificateListFromX509Certificate(const X509Certificate* cert); 49 50 // Specify behavior if an intermediate certificate fails CERTCertificate 51 // parsing. kFail means the function should return a failure result 52 // immediately. kIgnore means the invalid intermediate is not added to the 53 // output container. 54 enum class InvalidIntermediateBehavior { kFail, kIgnore }; 55 56 // Returns a vector of CERTCertificates corresponding to |cert| and its 57 // intermediates (if any). Returns an empty vector if the certificate could not 58 // be converted. |invalid_intermediate_behavior| specifies behavior if 59 // intermediates of |cert| could not be converted. 60 NET_EXPORT ScopedCERTCertificateList 61 CreateCERTCertificateListFromX509Certificate( 62 const X509Certificate* cert, 63 InvalidIntermediateBehavior invalid_intermediate_behavior); 64 65 // Parses all of the certificates possible from |data|. |format| is a 66 // bit-wise OR of X509Certificate::Format, indicating the possible formats the 67 // certificates may have been serialized as. If an error occurs, an empty 68 // collection will be returned. 69 NET_EXPORT ScopedCERTCertificateList 70 CreateCERTCertificateListFromBytes(const char* data, size_t length, int format); 71 72 // Increments the refcount of |cert| and returns a handle for that reference. 73 NET_EXPORT ScopedCERTCertificate DupCERTCertificate(CERTCertificate* cert); 74 75 // Increments the refcount of each element in |cerst| and returns a list of 76 // handles for them. 77 NET_EXPORT ScopedCERTCertificateList 78 DupCERTCertificateList(const ScopedCERTCertificateList& certs); 79 80 // Creates an X509Certificate from |cert|, with intermediates from |chain|. 81 // Returns NULL on failure. 82 NET_EXPORT scoped_refptr<X509Certificate> 83 CreateX509CertificateFromCERTCertificate( 84 CERTCertificate* cert, 85 const std::vector<CERTCertificate*>& chain); 86 87 // Creates an X509Certificate with non-standard parsing options. 88 // Do not use without consulting //net owners. 89 NET_EXPORT scoped_refptr<X509Certificate> 90 CreateX509CertificateFromCERTCertificate( 91 CERTCertificate* cert, 92 const std::vector<CERTCertificate*>& chain, 93 X509Certificate::UnsafeCreateOptions options); 94 95 // Creates an X509Certificate from |cert|, with no intermediates. 96 // Returns NULL on failure. 97 NET_EXPORT scoped_refptr<X509Certificate> 98 CreateX509CertificateFromCERTCertificate(CERTCertificate* cert); 99 100 // Creates an X509Certificate for each element in |certs|. 101 // Returns an empty list on failure. 102 NET_EXPORT CertificateList CreateX509CertificateListFromCERTCertificates( 103 const ScopedCERTCertificateList& certs); 104 105 // Obtains the DER encoded certificate data for |cert|. On success, returns 106 // true and writes the DER encoded certificate to |*der_encoded|. 107 NET_EXPORT bool GetDEREncoded(CERTCertificate* cert, std::string* der_encoded); 108 109 // Obtains the PEM encoded certificate data for |cert|. On success, returns 110 // true and writes the PEM encoded certificate to |*pem_encoded|. 111 NET_EXPORT bool GetPEMEncoded(CERTCertificate* cert, std::string* pem_encoded); 112 113 // Stores the values of all rfc822Name subjectAltNames from |cert_handle| 114 // into |names|. If no names are present, clears |names|. 115 // WARNING: This method does not validate that the rfc822Name is 116 // properly encoded; it MAY contain embedded NULs or other illegal 117 // characters; care should be taken to validate the well-formedness 118 // before using. 119 NET_EXPORT void GetRFC822SubjectAltNames(CERTCertificate* cert_handle, 120 std::vector<std::string>* names); 121 122 // Stores the values of all Microsoft UPN subjectAltNames from |cert_handle| 123 // into |names|. If no names are present, clears |names|. 124 // 125 // A "Microsoft UPN subjectAltName" is an OtherName value whose type-id 126 // is equal to 1.3.6.1.4.1.311.20.2.3 (known as either id-ms-san-sc-logon-upn, 127 // as described in RFC 4556, or as szOID_NT_PRINCIPAL_NAME, as 128 // documented in Microsoft KB287547). 129 // The value field is a UTF8String literal. 130 // For more information: 131 // https://www.ietf.org/mail-archive/web/pkix/current/msg03145.html 132 // https://www.ietf.org/proceedings/65/slides/pkix-4/sld1.htm 133 // https://tools.ietf.org/html/rfc4556 134 // 135 // WARNING: This method does not validate that the name is 136 // properly encoded; it MAY contain embedded NULs or other illegal 137 // characters; care should be taken to validate the well-formedness 138 // before using. 139 NET_EXPORT void GetUPNSubjectAltNames(CERTCertificate* cert_handle, 140 std::vector<std::string>* names); 141 142 // Generates a unique nickname for |nss_cert| based on the |type| and |slot|. 143 NET_EXPORT std::string GetDefaultUniqueNickname(CERTCertificate* nss_cert, 144 CertType type, 145 PK11SlotInfo* slot); 146 147 // Returns a name that can be used to represent the principal. It tries in 148 // this order: CN, O and OU and returns the first non-empty one found. 149 // This mirrors net::CertPrincipal::GetDisplayName. 150 NET_EXPORT std::string GetCERTNameDisplayName(CERTName* name); 151 152 // Stores the notBefore and notAfter times from |cert| into |*not_before| and 153 // |*not_after|, returning true if successful. |not_before| or |not_after| may 154 // be null. 155 NET_EXPORT bool GetValidityTimes(CERTCertificate* cert, 156 base::Time* not_before, 157 base::Time* not_after); 158 159 // Calculates the SHA-256 fingerprint of the certificate. Returns an empty 160 // (all zero) fingerprint on failure. 161 NET_EXPORT SHA256HashValue CalculateFingerprint256(CERTCertificate* cert); 162 163 // Prefer using NSSCertDatabase::ImportUserCert. Temporary public for Kcer. 164 // Import a user certificate. The private key for the user certificate must 165 // already be installed, the cert will be installed on the same slot, otherwise 166 // returns ERR_NO_PRIVATE_KEY_FOR_CERT. If the key exists on multiple slots, 167 // prioritizes the `preferred_slot`. Returns OK or a network error code. 168 NET_EXPORT int ImportUserCert(CERTCertificate* cert, 169 crypto::ScopedPK11Slot preferred_slot); 170 171 } // namespace net::x509_util 172 173 #endif // NET_CERT_X509_UTIL_NSS_H_ 174