Support SHA-256 in public key pins for HTTPS.

net/base/cert_verify_proc_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_verify_proc_openssl.h"
 
 #include <openssl/x509v3.h>
 
+#include <string>
+#include <vector>
+
 #include "base/logging.h"
 #include "base/sha1.h"
 #include "crypto/openssl_util.h"
+#include "crypto/sha2.h"
 #include "net/base/asn1_util.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/net_errors.h"
 #include "net/base/x509_certificate.h"
 
 #if defined(OS_ANDROID)
 #include "net/android/network_library.h"
 #endif
 
@@ skipping 103 matching lines @@
     }
   }
 
   if (verified_cert) {
     verify_result->verified_cert =
         X509Certificate::CreateFromHandle(verified_cert, verified_chain);
   }
 }
 
 void AppendPublicKeyHashes(X509_STORE_CTX* store_ctx,
-                           std::vector<SHA1Fingerprint>* hashes) {
+                           std::vector<HashValueVector>* hashes) {
   STACK_OF(X509)* chain = X509_STORE_CTX_get_chain(store_ctx);
   for (int i = 0; i < sk_X509_num(chain); ++i) {
     X509* cert = sk_X509_value(chain, i);
 
     std::string der_data;
     if (!X509Certificate::GetDEREncoded(cert, &der_data))
       continue;
 
     base::StringPiece der_bytes(der_data);
     base::StringPiece spki_bytes;
     if (!asn1::ExtractSPKIFromDERCert(der_bytes, &spki_bytes))
       continue;
 
-    SHA1Fingerprint hash;
+    HashValue sha1;
+    sha1.tag = HASH_VALUE_SHA1;
     base::SHA1HashBytes(reinterpret_cast<const uint8*>(spki_bytes.data()),
-                        spki_bytes.size(), hash.data);
-    hashes->push_back(hash);
+                        spki_bytes.size(), sha1.data());
+    (*hashes)[HASH_VALUE_SHA1].push_back(sha1);
+
+    HashValue sha256;
+    sha256.tag = HASH_VALUE_SHA256;
+    crypto::SHA256HashString(spki_bytes, sha1.data(), crypto::kSHA256Length);
+    (*hashes)[HASH_VALUE_SHA256].push_back(sha256);
   }
 }
 
 #if defined(OS_ANDROID)
 // Returns true if we have verification result in |verify_result| from Android
 // Trust Manager. Otherwise returns false.
 bool VerifyFromAndroidTrustManager(const std::vector<std::string>& cert_bytes,
                                    CertVerifyResult* verify_result) {
   // TODO(joth): Fetch the authentication type from SSL rather than hardcode.
   bool verified = true;
@@ skipping 106 matching lines @@
   // TODO(joth): if the motivations described in
   // http://src.chromium.org/viewvc/chrome?view=rev&revision=80778 become an
   // issue on OpenSSL builds, we will need to embed a hardcoded list of well
   // known root CAs, as per the _mac and _win versions.
   verify_result->is_issued_by_known_root = true;
 
   return OK;
 }
 
 }  // namespace net