net: block Cyberoam CA with leaked private key.

net/base/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_verify_proc.h"
 
 #include "base/metrics/histogram.h"
 #include "base/sha1.h"
 #include "build/build_config.h"
 #include "net/base/cert_status_flags.h"
@@ skipping 201 matching lines @@
       }
     }
   }
 
   return false;
 }
 
 // static
 bool CertVerifyProc::IsPublicKeyBlacklisted(
     const std::vector<SHA1Fingerprint>& public_key_hashes) {
-  static const unsigned kNumHashes = 8;
+  static const unsigned kNumHashes = 9;
   static const uint8 kHashes[kNumHashes][base::kSHA1Length] = {
     // Subject: CN=DigiNotar Root CA
     // Issuer: CN=Entrust.net x2 and self-signed
     {0x41, 0x0f, 0x36, 0x36, 0x32, 0x58, 0xf3, 0x0b, 0x34, 0x7d,
      0x12, 0xce, 0x48, 0x63, 0xe4, 0x33, 0x43, 0x78, 0x06, 0xa8},
     // Subject: CN=DigiNotar Cyber CA
     // Issuer: CN=GTE CyberTrust Global Root
     {0xc4, 0xf9, 0x66, 0x37, 0x16, 0xcd, 0x5e, 0x71, 0xd6, 0x95,
      0x0b, 0x5f, 0x33, 0xce, 0x04, 0x1c, 0x95, 0xb4, 0x35, 0xd1},
     // Subject: CN=DigiNotar Services 1024 CA
@@ skipping 16 matching lines @@
     // Subject: O=Digicert Sdn. Bhd.
     // Issuer: CN=Entrust.net Certification Authority (2048)
     // Expires: Jul 16 17:53:37 2015 GMT
     {0xd3, 0x3c, 0x5b, 0x41, 0xe4, 0x5c, 0xc4, 0xb3, 0xbe, 0x9a,
      0xd6, 0x95, 0x2c, 0x4e, 0xcc, 0x25, 0x28, 0x03, 0x29, 0x81},
     // Issuer: CN=Trustwave Organization Issuing CA, Level 2
     // Covers two certificates, the latter of which expires Apr 15 21:09:30
     // 2021 GMT.
     {0xe1, 0x2d, 0x89, 0xf5, 0x6d, 0x22, 0x76, 0xf8, 0x30, 0xe6,
      0xce, 0xaf, 0xa6, 0x6c, 0x72, 0x5c, 0x0b, 0x41, 0xa9, 0x32},
+    // Cyberoam CA certificate. Private key leaked, but this certificate would
+    // only have been installed by Cyberoam customers. The certificate expires
+    // in 2036, but we can probably remove in a couple of years (2014).
+    {0xd9, 0xf5, 0xc6, 0xce, 0x57, 0xff, 0xaa, 0x39, 0xcc, 0x7e,
+     0xd1, 0x72, 0xbd, 0x53, 0xe0, 0xd3, 0x07, 0x83, 0x4b, 0xd1},
   };
 
   for (unsigned i = 0; i < kNumHashes; i++) {
     for (std::vector<SHA1Fingerprint>::const_iterator
          j = public_key_hashes.begin(); j != public_key_hashes.end(); ++j) {
       if (memcmp(j->data, kHashes[i], base::kSHA1Length) == 0)
         return true;
     }
   }
 
   return false;
 }
 
 }  // namespace net