1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#ifndef TrustOverrides_h
#define TrustOverrides_h
#include "mozilla/ArrayUtils.h"
#include "mozpkix/pkix.h"
#include "mozpkix/pkixnss.h"
#include "mozpkix/pkixutil.h"
using namespace mozilla;
using namespace mozilla::pkix;
struct DataAndLength {
const uint8_t* data;
uint32_t len;
};
template <size_t T>
static bool CertDNIsInList(const nsTArray<uint8_t>& aCert,
const DataAndLength (&aDnList)[T]) {
Input certInput;
mozilla::pkix::Result rv = certInput.Init(aCert.Elements(), aCert.Length());
if (rv != Success) {
return false;
}
// we don't use the certificate for path building, so this parameter doesn't
// matter
EndEntityOrCA notUsedForPaths = EndEntityOrCA::MustBeEndEntity;
BackCert cert(certInput, notUsedForPaths, nullptr);
rv = cert.Init();
if (rv != Success) {
return false;
}
Input subject(cert.GetSubject());
for (auto& dn : aDnList) {
Input dnInput;
rv = dnInput.Init(dn.data, dn.len);
if (rv != Success) {
return false;
}
if (InputsAreEqual(subject, dnInput)) {
return true;
}
}
return false;
}
template <size_t T>
static bool CertSPKIIsInList(Input aCertInput,
const DataAndLength (&aSpkiList)[T]) {
// we don't use the certificate for path building, so this parameter doesn't
// matter
EndEntityOrCA notUsedForPaths = EndEntityOrCA::MustBeEndEntity;
BackCert cert(aCertInput, notUsedForPaths, nullptr);
mozilla::pkix::Result rv = cert.Init();
if (rv != Success) {
return false;
}
Input publicKey(cert.GetSubjectPublicKeyInfo());
for (auto& spki : aSpkiList) {
Input spkiInput;
rv = spkiInput.Init(spki.data, spki.len);
if (rv != Success) {
return false;
}
if (InputsAreEqual(publicKey, spkiInput)) {
return true;
}
}
return false;
}
template <size_t T, size_t R>
static bool CertMatchesStaticData(const nsTArray<uint8_t>& aCert,
const unsigned char (&subject)[T],
const unsigned char (&spki)[R]) {
Input certInput;
mozilla::pkix::Result rv = certInput.Init(aCert.Elements(), aCert.Length());
if (rv != Success) {
return false;
}
// we don't use the certificate for path building, so this parameter doesn't
// matter
EndEntityOrCA notUsedForPaths = EndEntityOrCA::MustBeEndEntity;
BackCert cert(certInput, notUsedForPaths, nullptr);
rv = cert.Init();
if (rv != Success) {
return false;
}
Input certSubject(cert.GetSubject());
Input certSPKI(cert.GetSubjectPublicKeyInfo());
Input subjectInput;
rv = subjectInput.Init(subject, T);
if (rv != Success) {
return false;
}
Input spkiInput;
rv = spkiInput.Init(spki, R);
if (rv != Success) {
return false;
}
return InputsAreEqual(certSubject, subjectInput) &&
InputsAreEqual(certSPKI, spkiInput);
}
// Implements the graduated Symantec distrust algorithm from Bug 1409257.
// This accepts a pre-segmented certificate chain (e.g. SegmentCertificateChain)
// as |intCerts|, and pre-assumes that the root has been identified
// as being affected (this is to avoid duplicate Segment operations in the
// NSSCertDBTrustDomain). Each of the |intCerts| is evaluated against a
// |allowlist| of SPKI entries, and if a match is found, then this returns
// "not distrusted." Otherwise, due to the precondition holding, the chain is
// "distrusted."
template <size_t T>
static nsresult CheckForSymantecDistrust(const nsTArray<Input>& intCerts,
const DataAndLength (&allowlist)[T],
/* out */ bool& isDistrusted) {
// PRECONDITION: The rootCert is already verified as being one of the
// affected Symantec roots
isDistrusted = true;
for (const auto& cert : intCerts) {
if (CertSPKIIsInList(cert, allowlist)) {
isDistrusted = false;
break;
}
}
return NS_OK;
}
#endif // TrustOverrides_h
|
