1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
|
/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
var EXPORTED_SYMBOLS = ["CertUtils"];
const Ce = Components.Exception;
const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm");
/**
* Reads a set of expected certificate attributes from preferences. The returned
* array can be passed to validateCert or checkCert to validate that a
* certificate matches the expected attributes. The preferences should look like
* this:
* prefix.1.attribute1
* prefix.1.attribute2
* prefix.2.attribute1
* etc.
* Each numeric branch contains a set of required attributes for a single
* certificate. Having multiple numeric branches means that multiple
* certificates would be accepted by validateCert.
*
* @param aPrefBranch
* The prefix for all preferences, should end with a ".".
* @return An array of JS objects with names / values corresponding to the
* expected certificate's attribute names / values.
*/
function readCertPrefs(aPrefBranch) {
if (!Services.prefs.getBranch(aPrefBranch).getChildList("").length) {
return null;
}
let certs = [];
let counter = 1;
while (true) {
let prefBranchCert = Services.prefs.getBranch(aPrefBranch + counter + ".");
let prefCertAttrs = prefBranchCert.getChildList("");
if (!prefCertAttrs.length) {
break;
}
let certAttrs = {};
for (let prefCertAttr of prefCertAttrs) {
certAttrs[prefCertAttr] = prefBranchCert.getCharPref(prefCertAttr);
}
certs.push(certAttrs);
counter++;
}
return certs;
}
/**
* Verifies that an nsIX509Cert matches the expected certificate attribute
* values.
*
* @param aCertificate
* The nsIX509Cert to compare to the expected attributes.
* @param aCerts
* An array of JS objects with names / values corresponding to the
* expected certificate's attribute names / values. If this is null or
* an empty array then no checks are performed.
* @throws NS_ERROR_ILLEGAL_VALUE if a certificate attribute name from the
* aCerts param does not exist or the value for a certificate attribute
* from the aCerts param is different than the expected value or
* aCertificate wasn't specified and aCerts is not null or an empty
* array.
*/
function validateCert(aCertificate, aCerts) {
// If there are no certificate requirements then just exit
if (!aCerts || !aCerts.length) {
return;
}
if (!aCertificate) {
const missingCertErr = "A required certificate was not present.";
Cu.reportError(missingCertErr);
throw new Ce(missingCertErr, Cr.NS_ERROR_ILLEGAL_VALUE);
}
var errors = [];
for (var i = 0; i < aCerts.length; ++i) {
var error = false;
var certAttrs = aCerts[i];
for (var name in certAttrs) {
if (!(name in aCertificate)) {
error = true;
errors.push(
"Expected attribute '" + name + "' not present in certificate."
);
break;
}
if (aCertificate[name] != certAttrs[name]) {
error = true;
errors.push(
"Expected certificate attribute '" +
name +
"' " +
"value incorrect, expected: '" +
certAttrs[name] +
"', got: '" +
aCertificate[name] +
"'."
);
break;
}
}
if (!error) {
break;
}
}
if (error) {
errors.forEach(Cu.reportError.bind(Cu));
const certCheckErr =
"Certificate checks failed. See previous errors for details.";
Cu.reportError(certCheckErr);
throw new Ce(certCheckErr, Cr.NS_ERROR_ILLEGAL_VALUE);
}
}
/**
* Checks if the connection must be HTTPS and if so, only allows built-in
* certificates and validates application specified certificate attribute
* values.
* See bug 340198 and bug 544442.
*
* @param aChannel
* The nsIChannel that will have its certificate checked.
* @param aAllowNonBuiltInCerts (optional)
* When true certificates that aren't builtin are allowed. When false
* or not specified the certificate must be a builtin certificate.
* @param aCerts (optional)
* An array of JS objects with names / values corresponding to the
* channel's expected certificate's attribute names / values. If it
* isn't null or not specified the the scheme for the channel's
* originalURI must be https.
* @throws NS_ERROR_UNEXPECTED if a certificate is expected and the URI scheme
* is not https.
* NS_ERROR_ILLEGAL_VALUE if a certificate attribute name from the
* aCerts param does not exist or the value for a certificate attribute
* from the aCerts param is different than the expected value.
* NS_ERROR_ABORT if the certificate issuer is not built-in.
*/
function checkCert(aChannel, aAllowNonBuiltInCerts, aCerts) {
if (!aChannel.originalURI.schemeIs("https")) {
// Require https if there are certificate values to verify
if (aCerts) {
throw new Ce(
"SSL is required and URI scheme is not https.",
Cr.NS_ERROR_UNEXPECTED
);
}
return;
}
let secInfo = aChannel.securityInfo.QueryInterface(
Ci.nsITransportSecurityInfo
);
let cert = secInfo.serverCert;
validateCert(cert, aCerts);
if (aAllowNonBuiltInCerts === true) {
return;
}
let issuerCert = null;
if (secInfo.succeededCertChain.length) {
issuerCert =
secInfo.succeededCertChain[secInfo.succeededCertChain.length - 1];
}
const certNotBuiltInErr = "Certificate issuer is not built-in.";
if (!issuerCert) {
throw new Ce(certNotBuiltInErr, Cr.NS_ERROR_ABORT);
}
if (!issuerCert.isBuiltInRoot) {
throw new Ce(certNotBuiltInErr, Cr.NS_ERROR_ABORT);
}
}
/**
* This class implements nsIChannelEventSink. Its job is to perform extra checks
* on the certificates used for some connections when those connections
* redirect.
*
* @param aAllowNonBuiltInCerts (optional)
* When true certificates that aren't builtin are allowed. When false
* or not specified the certificate must be a builtin certificate.
*/
function BadCertHandler(aAllowNonBuiltInCerts) {
this.allowNonBuiltInCerts = aAllowNonBuiltInCerts;
}
BadCertHandler.prototype = {
// nsIChannelEventSink
asyncOnChannelRedirect(oldChannel, newChannel, flags, callback) {
if (this.allowNonBuiltInCerts) {
callback.onRedirectVerifyCallback(Cr.NS_OK);
return;
}
// make sure the certificate of the old channel checks out before we follow
// a redirect from it. See bug 340198.
// Don't call checkCert for internal redirects. See bug 569648.
if (!(flags & Ci.nsIChannelEventSink.REDIRECT_INTERNAL)) {
checkCert(oldChannel);
}
callback.onRedirectVerifyCallback(Cr.NS_OK);
},
// nsIInterfaceRequestor
getInterface(iid) {
return this.QueryInterface(iid);
},
// nsISupports
QueryInterface: ChromeUtils.generateQI([
"nsIChannelEventSink",
"nsIInterfaceRequestor",
]),
};
var CertUtils = {
BadCertHandler,
checkCert,
readCertPrefs,
validateCert,
};
|
