Add X509Certificate::IsIssuedByEncoded()

net/base/x509_certificate_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 #include <time.h>
 
 #include <vector>
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/mac/mac_logging.h"
 #include "base/mac/scoped_cftyperef.h"
 #include "base/memory/singleton.h"
 #include "base/pickle.h"
 #include "base/sha1.h"
+#include "base/string_piece.h"
 #include "base/synchronization/lock.h"
 #include "base/sys_string_conversions.h"
 #include "crypto/cssm_init.h"
 #include "crypto/mac_security_services_lock.h"
 #include "crypto/nss_util.h"
 #include "crypto/rsa_private_key.h"
 #include "net/base/x509_util_mac.h"
 #include "third_party/nss/mozilla/security/nss/lib/certdb/cert.h"
 
 using base::mac::ScopedCFTypeRef;
 using base::Time;
 
 namespace net {
 
 namespace {
 
 void GetCertDistinguishedName(
     const x509_util::CSSMCachedCertificate& cached_cert,
     const CSSM_OID* oid,
     CertPrincipal* result) {
   x509_util::CSSMFieldValue distinguished_name;
   OSStatus status = cached_cert.GetField(oid, &distinguished_name);
   if (status || !distinguished_name.field())
     return;
   result->ParseDistinguishedName(distinguished_name.field()->Data,
                                  distinguished_name.field()->Length);
 }
 
+bool IsCertDistinguishedNameInList(
+    OSCertHandle* cert,
+    const CSSM_OID* oid,
+    const std::vector<std::string>& valid_issuers) {
+  x509_util::CSSCachedCertificate cached_cert;
+  if (cached_cert.Init(cert_handle) != CSSM_OK)
+    return false;
+
+  OSStatus status = cached_cert.GetField(oid, &distinguished_name);
+  if (status || !distinguished_name.field())
+    return false;
+
+  base::StringPiece name_piece(
+      distinguished_name.field()->Data,
+      distinguished_name.field()->Length);
+
+  for (std::vector<std::string>::const_iterator it = issuers.begin();
+       it != issuers.end(); ++it) {
+    base::StringPiece issuer_piece(*it);
+    if (name_piece == issuer_piece)
+      return true;
+  }
+
+  return false;
+}
+
 void GetCertDateForOID(const x509_util::CSSMCachedCertificate& cached_cert,
                        const CSSM_OID* oid,
                        Time* result) {
   *result = Time::Time();
 
   x509_util::CSSMFieldValue field;
   OSStatus status = cached_cert.GetField(oid, &field);
   if (status)
     return;
 
@@ skipping 267 matching lines @@
                       &valid_start_);
     GetCertDateForOID(cached_cert, &CSSMOID_X509V1ValidityNotAfter,
                       &valid_expiry_);
     serial_number_ = GetCertSerialNumber(cached_cert);
   }
 
   fingerprint_ = CalculateFingerprint(cert_handle_);
   ca_fingerprint_ = CalculateCAFingerprint(intermediate_ca_certs_);
 }
 
+bool X509Certificate::IsIssuedByEncoded(
+    const std::vector<std::string>& valid_issuers) {
+  {
+  if (IsCertDistinguishedNameInList(cert_handle_,
+                                    &CSSMOID_X509V1IssuerNameStd,
+                                    valid_issuers))

[Ryan Sleevi, 2012/12/13 19:49:05]

STYLE: multi-line conditionals should have braces (also lines 373-375)

BUG: See IOS bug about subject vs ISSUER

[digit1, 2012/12/14 17:54:33]

Done.

+    return true;
+
+  for (OSCertHandles::iterator it = intermediate_ca_certs_.begin();
+       it != intermediate_ca_certs_.end(); ++it) {
+    if (IsCertDistinguishedNameInList(*it, &CSSMOID_X509V1SubjectNameStd,
+                                      valid_issuers))
+      return true;
+  }
+  return false;
+}
+
 // static
 X509Certificate* X509Certificate::CreateSelfSigned(
     crypto::RSAPrivateKey* key,
     const std::string& subject,
     uint32 serial_number,
     base::TimeDelta valid_duration) {
   DCHECK(key);
   DCHECK(!subject.empty());
 
   if (valid_duration.InSeconds() > kuint32max) {
@@ skipping 550 matching lines @@
       *type = kPublicKeyTypeDH;
       break;
     default:
       *type = kPublicKeyTypeUnknown;
       *size_bits = 0;
       break;
   }
 }
 
 }  // namespace net