| // Copyright 2016 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "net/cert/internal/trust_store_nss.h" |
| |
| #include <cert.h> |
| #include <certdb.h> |
| #include <certt.h> |
| #include <pk11pub.h> |
| #include <pkcs11n.h> |
| #include <pkcs11t.h> |
| #include <seccomon.h> |
| #include <secmod.h> |
| #include <secmodt.h> |
| |
| #include "base/hash/sha1.h" |
| #include "base/logging.h" |
| #include "base/notreached.h" |
| #include "base/strings/string_number_conversions.h" |
| #include "crypto/nss_util.h" |
| #include "crypto/nss_util_internal.h" |
| #include "crypto/scoped_nss_types.h" |
| #include "net/base/features.h" |
| #include "net/cert/internal/trust_store_features.h" |
| #include "net/cert/known_roots_nss.h" |
| #include "net/cert/pki/cert_errors.h" |
| #include "net/cert/pki/parsed_certificate.h" |
| #include "net/cert/pki/trust_store.h" |
| #include "net/cert/scoped_nss_types.h" |
| #include "net/cert/x509_util.h" |
| #include "net/cert/x509_util_nss.h" |
| |
| namespace net { |
| |
| namespace { |
| |
| const void* kResultDebugDataKey = &kResultDebugDataKey; |
| |
| TrustStoreNSS::ResultDebugData::SlotFilterType GetSlotFilterType( |
| const TrustStoreNSS::UserSlotTrustSetting& user_slot_trust_setting) { |
| if (absl::holds_alternative<TrustStoreNSS::UseTrustFromAllUserSlots>( |
| user_slot_trust_setting)) { |
| return TrustStoreNSS::ResultDebugData::SlotFilterType::kDontFilter; |
| } |
| if (absl::get<crypto::ScopedPK11Slot>(user_slot_trust_setting) == nullptr) { |
| return TrustStoreNSS::ResultDebugData::SlotFilterType::kDoNotAllowUserSlots; |
| } |
| return TrustStoreNSS::ResultDebugData::SlotFilterType:: |
| kAllowSpecifiedUserSlot; |
| } |
| |
| struct FreePK11GenericObjects { |
| void operator()(PK11GenericObject* x) const { |
| if (x) { |
| PK11_DestroyGenericObjects(x); |
| } |
| } |
| }; |
| using ScopedPK11GenericObjects = |
| std::unique_ptr<PK11GenericObject, FreePK11GenericObjects>; |
| |
| // Get the list of all slots `nss_cert` is present in, along with the object |
| // handle of the cert in each of those slots. |
| // |
| // (Note that there is a PK11_GetAllSlotsForCert function that *seems* like it |
| // would be useful here, however it does not actually return all relevant |
| // slots.) |
| std::vector<std::pair<crypto::ScopedPK11Slot, CK_OBJECT_HANDLE>> |
| GetAllSlotsAndHandlesForCert(CERTCertificate* nss_cert) { |
| std::vector<std::pair<crypto::ScopedPK11Slot, CK_OBJECT_HANDLE>> r; |
| crypto::AutoSECMODListReadLock lock_id; |
| for (const SECMODModuleList* item = SECMOD_GetDefaultModuleList(); |
| item != nullptr; item = item->next) { |
| for (int i = 0; i < item->module->slotCount; ++i) { |
| PK11SlotInfo* slot = item->module->slots[i]; |
| if (PK11_IsPresent(slot)) { |
| CK_OBJECT_HANDLE handle = PK11_FindCertInSlot(slot, nss_cert, nullptr); |
| if (handle != CK_INVALID_HANDLE) { |
| r.emplace_back(PK11_ReferenceSlot(slot), handle); |
| } |
| } |
| } |
| } |
| return r; |
| } |
| |
| bool IsMozillaCaPolicyProvided(PK11SlotInfo* slot, |
| CK_OBJECT_HANDLE cert_handle) { |
| return PK11_HasRootCerts(slot) && |
| PK11_HasAttributeSet(slot, cert_handle, CKA_NSS_MOZILLA_CA_POLICY, |
| /*haslock=*/PR_FALSE) == CK_TRUE; |
| } |
| |
| bool IsCertOnlyInNSSRoots(CERTCertificate* cert) { |
| std::vector<std::pair<crypto::ScopedPK11Slot, CK_OBJECT_HANDLE>> |
| slots_and_handles_for_cert = GetAllSlotsAndHandlesForCert(cert); |
| for (const auto& [slot, handle] : slots_and_handles_for_cert) { |
| if (IsMozillaCaPolicyProvided(slot.get(), handle)) { |
| // Cert is an NSS root. Continue looking to see if it also is present in |
| // another slot. |
| continue; |
| } |
| // Found cert in a non-NSS roots slot. |
| return false; |
| } |
| // Cert was only found in NSS roots (or was not in any slots, but that |
| // shouldn't happen.) |
| return true; |
| } |
| |
| } // namespace |
| |
| TrustStoreNSS::ResultDebugData::ResultDebugData( |
| bool ignore_system_trust_settings, |
| SlotFilterType slot_filter_type) |
| : ignore_system_trust_settings_(ignore_system_trust_settings), |
| slot_filter_type_(slot_filter_type) {} |
| |
| // static |
| const TrustStoreNSS::ResultDebugData* TrustStoreNSS::ResultDebugData::Get( |
| const base::SupportsUserData* debug_data) { |
| return static_cast<ResultDebugData*>( |
| debug_data->GetUserData(kResultDebugDataKey)); |
| } |
| |
| // static |
| void TrustStoreNSS::ResultDebugData::Create( |
| bool ignore_system_trust_settings, |
| SlotFilterType slot_filter_type, |
| base::SupportsUserData* debug_data) { |
| debug_data->SetUserData(kResultDebugDataKey, |
| std::make_unique<ResultDebugData>( |
| ignore_system_trust_settings, slot_filter_type)); |
| } |
| |
| std::unique_ptr<base::SupportsUserData::Data> |
| TrustStoreNSS::ResultDebugData::Clone() { |
| return std::make_unique<ResultDebugData>(*this); |
| } |
| |
| TrustStoreNSS::ListCertsResult::ListCertsResult(ScopedCERTCertificate cert, |
| CertificateTrust trust) |
| : cert(std::move(cert)), trust(trust) {} |
| TrustStoreNSS::ListCertsResult::~ListCertsResult() = default; |
| |
| TrustStoreNSS::ListCertsResult::ListCertsResult(ListCertsResult&& other) = |
| default; |
| TrustStoreNSS::ListCertsResult& TrustStoreNSS::ListCertsResult::operator=( |
| ListCertsResult&& other) = default; |
| |
| TrustStoreNSS::TrustStoreNSS(SystemTrustSetting system_trust_setting, |
| UserSlotTrustSetting user_slot_trust_setting) |
| : ignore_system_trust_settings_(system_trust_setting == kIgnoreSystemTrust), |
| user_slot_trust_setting_(std::move(user_slot_trust_setting)) {} |
| |
| TrustStoreNSS::~TrustStoreNSS() = default; |
| |
| void TrustStoreNSS::SyncGetIssuersOf(const ParsedCertificate* cert, |
| ParsedCertificateList* issuers) { |
| crypto::EnsureNSSInit(); |
| |
| SECItem name; |
| // Use the original issuer value instead of the normalized version. NSS does a |
| // less extensive normalization in its Name comparisons, so our normalized |
| // version may not match the unnormalized version. |
| name.len = cert->tbs().issuer_tlv.Length(); |
| name.data = const_cast<uint8_t*>(cert->tbs().issuer_tlv.UnsafeData()); |
| // |validOnly| in CERT_CreateSubjectCertList controls whether to return only |
| // certs that are valid at |sorttime|. Expiration isn't meaningful for trust |
| // anchors, so request all the matches. |
| crypto::ScopedCERTCertList found_certs(CERT_CreateSubjectCertList( |
| nullptr /* certList */, CERT_GetDefaultCertDB(), &name, |
| PR_Now() /* sorttime */, PR_FALSE /* validOnly */)); |
| if (!found_certs) |
| return; |
| |
| for (CERTCertListNode* node = CERT_LIST_HEAD(found_certs); |
| !CERT_LIST_END(node, found_certs); node = CERT_LIST_NEXT(node)) { |
| CertErrors parse_errors; |
| std::shared_ptr<const ParsedCertificate> cur_cert = |
| ParsedCertificate::Create( |
| x509_util::CreateCryptoBuffer(base::make_span( |
| node->cert->derCert.data, node->cert->derCert.len)), |
| {}, &parse_errors); |
| |
| if (!cur_cert) { |
| // TODO(crbug.com/634443): return errors better. |
| LOG(ERROR) << "Error parsing issuer certificate:\n" |
| << parse_errors.ToDebugString(); |
| continue; |
| } |
| |
| issuers->push_back(std::move(cur_cert)); |
| } |
| } |
| |
| CertificateTrust TrustStoreNSS::GetTrust(const ParsedCertificate* cert, |
| base::SupportsUserData* debug_data) { |
| crypto::EnsureNSSInit(); |
| if (debug_data) { |
| ResultDebugData::Create(ignore_system_trust_settings_, |
| GetSlotFilterType(user_slot_trust_setting_), |
| debug_data); |
| } |
| // In theory we could also do better multi-profile slot filtering using a |
| // similar approach as GetTrustIgnoringSystemTrust, however it makes the |
| // logic more complicated and isn't really worth doing since we'll be |
| // removing the old path entirely. Also keeping the old path unmodified is |
| // better for ensuring that the temporary fallback policy actually falls back |
| // to the same old behavior. |
| if (ignore_system_trust_settings_) { |
| return GetTrustIgnoringSystemTrust(cert, debug_data); |
| } else { |
| return GetTrustWithSystemTrust(cert, debug_data); |
| } |
| } |
| |
| std::vector<TrustStoreNSS::ListCertsResult> |
| TrustStoreNSS::ListCertsIgnoringNSSRoots() { |
| std::vector<TrustStoreNSS::ListCertsResult> results; |
| crypto::ScopedCERTCertList cert_list; |
| if (absl::holds_alternative<crypto::ScopedPK11Slot>( |
| user_slot_trust_setting_)) { |
| if (absl::get<crypto::ScopedPK11Slot>(user_slot_trust_setting_) == |
| nullptr) { |
| return results; |
| } |
| cert_list.reset(PK11_ListCertsInSlot( |
| absl::get<crypto::ScopedPK11Slot>(user_slot_trust_setting_).get())); |
| } else { |
| cert_list.reset(PK11_ListCerts(PK11CertListUnique, nullptr)); |
| } |
| // PK11_ListCerts[InSlot] can return nullptr, e.g. because the PKCS#11 token |
| // that was backing the specified slot is not available anymore. |
| // Treat it as no certificates being present on the slot. |
| if (!cert_list) { |
| LOG(WARNING) << (absl::holds_alternative<crypto::ScopedPK11Slot>( |
| user_slot_trust_setting_) |
| ? "PK11_ListCertsInSlot" |
| : "PK11_ListCerts") |
| << " returned null"; |
| return results; |
| } |
| |
| CERTCertListNode* node; |
| for (node = CERT_LIST_HEAD(cert_list); !CERT_LIST_END(node, cert_list); |
| node = CERT_LIST_NEXT(node)) { |
| if (IsCertOnlyInNSSRoots(node->cert)) { |
| continue; |
| } |
| results.emplace_back(x509_util::DupCERTCertificate(node->cert), |
| GetTrustIgnoringSystemTrust(node->cert, nullptr)); |
| } |
| |
| return results; |
| } |
| |
| // TODO(https://crbug.com/1340420): add histograms? (how often hits fast vs |
| // medium vs slow path, timing of fast/medium/slow path/all, etc?) |
| |
| // TODO(https://crbug.com/1340420): NSS also seemingly has some magical |
| // trusting of any self-signed cert with CKA_ID=0, if it doesn't have a |
| // matching trust object. Do we need to do that too? (this pk11_isID0 thing: |
| // https://searchfox.org/nss/source/lib/pk11wrap/pk11cert.c#357) |
| |
| CertificateTrust TrustStoreNSS::GetTrustIgnoringSystemTrust( |
| const ParsedCertificate* cert, |
| base::SupportsUserData* debug_data) const { |
| // If trust settings are only being used from a specified slot, and that slot |
| // is nullptr, there's nothing to do. This corresponds to the case where we |
| // wanted to get the builtin roots from NSS still but not user-added roots. |
| // Since the built-in roots are now coming from Chrome Root Store in this |
| // case, there is nothing to do here. |
| // |
| // (This ignores slots that would have been allowed by the "read-only |
| // internal slots" part of IsCertAllowedForTrust, I don't think that actually |
| // matters though.) |
| // |
| // TODO(https://crbug.com/1412591): once the non-CRS paths have been removed, |
| // perhaps remove this entirely and just have the caller not create a |
| // TrustStoreNSS at all in this case (or does it still need the |
| // SyncGetIssuersOf to find NSS temp certs in that case?) |
| if (absl::holds_alternative<crypto::ScopedPK11Slot>( |
| user_slot_trust_setting_) && |
| absl::get<crypto::ScopedPK11Slot>(user_slot_trust_setting_) == nullptr) { |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| SECItem der_cert; |
| der_cert.data = const_cast<uint8_t*>(cert->der_cert().UnsafeData()); |
| der_cert.len = base::checked_cast<unsigned>(cert->der_cert().Length()); |
| der_cert.type = siDERCertBuffer; |
| |
| // Find a matching NSS certificate object, if any. Note that NSS trust |
| // objects can also be keyed on issuer+serial and match any such cert. This |
| // is only used for distrust and apparently only in the NSS builtin roots |
| // certs module. Therefore, it should be safe to use the more efficient |
| // CERT_FindCertByDERCert to avoid having to have NSS parse the certificate |
| // and create a structure for it if the cert doesn't already exist in any of |
| // the loaded NSS databases. |
| ScopedCERTCertificate nss_cert( |
| CERT_FindCertByDERCert(CERT_GetDefaultCertDB(), &der_cert)); |
| if (!nss_cert) { |
| DVLOG(1) << "skipped cert that has no CERTCertificate already"; |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| return GetTrustIgnoringSystemTrust(nss_cert.get(), debug_data); |
| } |
| |
| CertificateTrust TrustStoreNSS::GetTrustIgnoringSystemTrust( |
| CERTCertificate* nss_cert, |
| base::SupportsUserData* debug_data) const { |
| // See if NSS has any trust settings for the certificate at all. If not, |
| // there is no point in doing further work. |
| CERTCertTrust nss_cert_trust; |
| if (CERT_GetCertTrust(nss_cert, &nss_cert_trust) != SECSuccess) { |
| DVLOG(1) << "skipped cert that has no trust settings"; |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| // If there were trust settings, we may not be able to use the NSS calculated |
| // trust settings directly, since we don't know which slot those settings |
| // came from. Do a more careful check to only honor trust settings from slots |
| // we care about. |
| |
| std::vector<std::pair<crypto::ScopedPK11Slot, CK_OBJECT_HANDLE>> |
| slots_and_handles_for_cert = GetAllSlotsAndHandlesForCert(nss_cert); |
| |
| // Generally this shouldn't happen, though it is possible (ex, a builtin |
| // distrust record with no matching cert in the builtin trust store could |
| // match a NSS temporary cert that doesn't exist in any slot. Ignoring that |
| // is okay. Theoretically there maybe could be trust records with no matching |
| // cert in user slots? I don't know how that can actually happen though.) |
| if (slots_and_handles_for_cert.empty()) { |
| DVLOG(1) << "skipped cert that has no slots"; |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| // List of trustOrder, slot pairs. |
| std::vector<std::pair<int, PK11SlotInfo*>> slots_to_check; |
| |
| for (const auto& [slotref, handle] : slots_and_handles_for_cert) { |
| PK11SlotInfo* slot = slotref.get(); |
| DVLOG(1) << "found cert in slot:" << PK11_GetSlotName(slot) |
| << " token:" << PK11_GetTokenName(slot) |
| << " module trustOrder: " << PK11_GetModule(slot)->trustOrder; |
| if (absl::holds_alternative<crypto::ScopedPK11Slot>( |
| user_slot_trust_setting_) && |
| slot != |
| absl::get<crypto::ScopedPK11Slot>(user_slot_trust_setting_).get()) { |
| DVLOG(1) << "skipping slot " << PK11_GetSlotName(slot) |
| << ", it's not user_slot_trust_setting_"; |
| continue; |
| } |
| if (IsMozillaCaPolicyProvided(slot, handle)) { |
| DVLOG(1) << "skipping slot " << PK11_GetSlotName(slot) |
| << ", this is mozilla ca policy provided"; |
| continue; |
| } |
| int trust_order = PK11_GetModule(slot)->trustOrder; |
| slots_to_check.emplace_back(trust_order, slot); |
| } |
| if (slots_to_check.size() == slots_and_handles_for_cert.size()) { |
| DVLOG(1) << "cert is only in allowed slots, using NSS calculated trust"; |
| return GetTrustForNSSTrust(nss_cert_trust); |
| } |
| if (slots_to_check.empty()) { |
| DVLOG(1) << "cert is only in disallowed slots, skipping"; |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| DVLOG(1) << "cert is in both allowed and disallowed slots, doing manual " |
| "trust calculation"; |
| |
| // Use PK11_FindGenericObjects + PK11_ReadRawAttribute to calculate the trust |
| // using only the slots we care about. (Some example code: |
| // https://searchfox.org/nss/source/gtests/pk11_gtest/pk11_import_unittest.cc#131) |
| // |
| // TODO(https://crbug.com/1340420): consider adding caching here if metrics |
| // show a need. If caching is added, note that NSS has no change notification |
| // APIs so we'd at least want to listen for CertDatabase notifications to |
| // clear the cache. (There are multiple approaches possible, could cache the |
| // hash->trust mappings on a per-slot basis, or just cache the end result for |
| // each cert, etc.) |
| base::SHA1Digest cert_sha1 = base::SHA1HashSpan( |
| base::make_span(nss_cert->derCert.data, nss_cert->derCert.len)); |
| |
| // Check the slots in trustOrder ordering. Lower trustOrder values are higher |
| // priority, so we can return as soon as we find a matching trust object. |
| std::sort(slots_to_check.begin(), slots_to_check.end()); |
| |
| for (const auto& [_, slot] : slots_to_check) { |
| DVLOG(1) << "looking for trust in slot " << PK11_GetSlotName(slot) |
| << " token " << PK11_GetTokenName(slot); |
| |
| ScopedPK11GenericObjects objs(PK11_FindGenericObjects(slot, CKO_NSS_TRUST)); |
| if (!objs) { |
| DVLOG(1) << "no trust objects in slot"; |
| continue; |
| } |
| for (PK11GenericObject* obj = objs.get(); obj != nullptr; |
| obj = PK11_GetNextGenericObject(obj)) { |
| crypto::ScopedSECItem sha1_hash_attr(SECITEM_AllocItem(/*arena=*/nullptr, |
| /*item=*/nullptr, |
| /*len=*/0)); |
| SECStatus rv = PK11_ReadRawAttribute( |
| PK11_TypeGeneric, obj, CKA_CERT_SHA1_HASH, sha1_hash_attr.get()); |
| if (rv != SECSuccess) { |
| DVLOG(1) << "trust object has no CKA_CERT_SHA1_HASH attr"; |
| continue; |
| } |
| base::span<const uint8_t> trust_obj_sha1 = base::make_span( |
| sha1_hash_attr->data, sha1_hash_attr->data + sha1_hash_attr->len); |
| DVLOG(1) << "found trust object for sha1 " |
| << base::HexEncode(trust_obj_sha1); |
| |
| if (!std::equal(trust_obj_sha1.begin(), trust_obj_sha1.end(), |
| cert_sha1.begin(), cert_sha1.end())) { |
| DVLOG(1) << "trust object does not match target cert hash, skipping"; |
| continue; |
| } |
| DVLOG(1) << "trust object matches target cert hash"; |
| |
| crypto::ScopedSECItem trust_attr(SECITEM_AllocItem(/*arena=*/nullptr, |
| /*item=*/nullptr, |
| /*len=*/0)); |
| rv = PK11_ReadRawAttribute(PK11_TypeGeneric, obj, CKA_TRUST_SERVER_AUTH, |
| trust_attr.get()); |
| if (rv != SECSuccess) { |
| DVLOG(1) << "trust object for " << base::HexEncode(trust_obj_sha1) |
| << "has no CKA_TRUST_x attr"; |
| continue; |
| } |
| DVLOG(1) << "trust " |
| << base::HexEncode(base::make_span( |
| trust_attr->data, trust_attr->data + trust_attr->len)) |
| << " for sha1 " << base::HexEncode(trust_obj_sha1); |
| |
| CK_TRUST trust; |
| if (trust_attr->len != sizeof(trust)) { |
| DVLOG(1) << "trust is wrong size? skipping"; |
| continue; |
| } |
| |
| // This matches how pk11_GetTrustField in NSS converts the raw trust |
| // object to a CK_TRUST (actually an unsigned long). |
| // https://searchfox.org/nss/source/lib/pk11wrap/pk11nobj.c#37 |
| memcpy(&trust, trust_attr->data, trust_attr->len); |
| |
| // This doesn't handle the "TrustAnchorOrLeaf" combination, it's unclear |
| // how that is represented. But it doesn't really matter since the only |
| // case that would come up is if someone took one of the NSS builtin |
| // roots and then also locally marked it as trusted as both a CA and a |
| // leaf, which is non-sensical. Testing shows that will end up marked as |
| // CKT_NSS_TRUSTED_DELEGATOR, which is fine. |
| switch (trust) { |
| case CKT_NSS_TRUSTED: |
| if (base::FeatureList::IsEnabled( |
| features::kTrustStoreTrustedLeafSupport)) { |
| DVLOG(1) << "CKT_NSS_TRUSTED -> trusted leaf"; |
| return CertificateTrust::ForTrustedLeaf(); |
| } else { |
| DVLOG(1) << "CKT_NSS_TRUSTED -> unspecified"; |
| return CertificateTrust::ForUnspecified(); |
| } |
| case CKT_NSS_TRUSTED_DELEGATOR: { |
| DVLOG(1) << "CKT_NSS_TRUSTED_DELEGATOR -> trust anchor"; |
| const bool enforce_anchor_constraints = |
| IsLocalAnchorConstraintsEnforcementEnabled(); |
| return CertificateTrust::ForTrustAnchor() |
| .WithEnforceAnchorConstraints(enforce_anchor_constraints) |
| .WithEnforceAnchorExpiry(enforce_anchor_constraints); |
| } |
| case CKT_NSS_MUST_VERIFY_TRUST: |
| case CKT_NSS_VALID_DELEGATOR: |
| DVLOG(1) << "CKT_NSS_MUST_VERIFY_TRUST or CKT_NSS_VALID_DELEGATOR -> " |
| "unspecified"; |
| return CertificateTrust::ForUnspecified(); |
| case CKT_NSS_NOT_TRUSTED: |
| DVLOG(1) << "CKT_NSS_NOT_TRUSTED -> distrusted"; |
| return CertificateTrust::ForDistrusted(); |
| case CKT_NSS_TRUST_UNKNOWN: |
| DVLOG(1) << "CKT_NSS_TRUST_UNKNOWN trust value - skip"; |
| break; |
| default: |
| DVLOG(1) << "unhandled trust value - skip"; |
| break; |
| } |
| } |
| } |
| |
| DVLOG(1) << "no suitable NSS trust record found"; |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| CertificateTrust TrustStoreNSS::GetTrustWithSystemTrust( |
| const ParsedCertificate* cert, |
| base::SupportsUserData* debug_data) const { |
| // TODO(eroman): Inefficient -- path building will convert between |
| // CERTCertificate and ParsedCertificate representations multiple times |
| // (when getting the issuers, and again here). |
| |
| // Note that trust records in NSS are keyed on issuer + serial, and there |
| // exist builtin distrust records for which a matching certificate is not |
| // included in the builtin cert list. Therefore, create a temp NSS cert even |
| // if no existing cert matches. (Eg, this uses CERT_NewTempCertificate, not |
| // CERT_FindCertByDERCert.) |
| ScopedCERTCertificate nss_cert(x509_util::CreateCERTCertificateFromBytes( |
| cert->der_cert().UnsafeData(), cert->der_cert().Length())); |
| if (!nss_cert) { |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| if (!IsCertAllowedForTrust(nss_cert.get())) { |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| // Determine the trustedness of the matched certificate. |
| CERTCertTrust nss_trust; |
| if (CERT_GetCertTrust(nss_cert.get(), &nss_trust) != SECSuccess) { |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| CertificateTrust trust = GetTrustForNSSTrust(nss_trust); |
| if (trust.enforce_anchor_constraints && IsKnownRoot(nss_cert.get())) { |
| trust.enforce_anchor_constraints = false; |
| trust.enforce_anchor_expiry = false; |
| } |
| return trust; |
| } |
| |
| CertificateTrust TrustStoreNSS::GetTrustForNSSTrust( |
| const CERTCertTrust& trust) const { |
| unsigned int trust_flags = SEC_GET_TRUST_FLAGS(&trust, trustSSL); |
| |
| // Determine if the certificate is distrusted. |
| if ((trust_flags & (CERTDB_TERMINAL_RECORD | CERTDB_TRUSTED_CA | |
| CERTDB_TRUSTED)) == CERTDB_TERMINAL_RECORD) { |
| return CertificateTrust::ForDistrusted(); |
| } |
| |
| bool is_trusted_ca = false; |
| bool is_trusted_leaf = false; |
| const bool enforce_anchor_constraints = |
| IsLocalAnchorConstraintsEnforcementEnabled(); |
| |
| // Determine if the certificate is a trust anchor. |
| if ((trust_flags & CERTDB_TRUSTED_CA) == CERTDB_TRUSTED_CA) { |
| is_trusted_ca = true; |
| } |
| |
| if (base::FeatureList::IsEnabled(features::kTrustStoreTrustedLeafSupport)) { |
| constexpr unsigned int kTrustedPeerBits = |
| CERTDB_TERMINAL_RECORD | CERTDB_TRUSTED; |
| if ((trust_flags & kTrustedPeerBits) == kTrustedPeerBits) { |
| is_trusted_leaf = true; |
| } |
| } |
| |
| if (is_trusted_ca && is_trusted_leaf) { |
| return CertificateTrust::ForTrustAnchorOrLeaf() |
| .WithEnforceAnchorConstraints(enforce_anchor_constraints) |
| .WithEnforceAnchorExpiry(enforce_anchor_constraints); |
| } else if (is_trusted_ca) { |
| return CertificateTrust::ForTrustAnchor() |
| .WithEnforceAnchorConstraints(enforce_anchor_constraints) |
| .WithEnforceAnchorExpiry(enforce_anchor_constraints); |
| } else if (is_trusted_leaf) { |
| return CertificateTrust::ForTrustedLeaf(); |
| } |
| |
| return CertificateTrust::ForUnspecified(); |
| } |
| |
| bool TrustStoreNSS::IsCertAllowedForTrust(CERTCertificate* cert) const { |
| if (absl::holds_alternative<UseTrustFromAllUserSlots>( |
| user_slot_trust_setting_)) { |
| return true; |
| } |
| |
| crypto::ScopedPK11SlotList slots_for_cert( |
| PK11_GetAllSlotsForCert(cert, nullptr)); |
| if (!slots_for_cert) |
| return false; |
| |
| for (PK11SlotListElement* slot_element = |
| PK11_GetFirstSafe(slots_for_cert.get()); |
| slot_element; |
| slot_element = PK11_GetNextSafe(slots_for_cert.get(), slot_element, |
| /*restart=*/PR_FALSE)) { |
| PK11SlotInfo* slot = slot_element->slot; |
| bool allow_slot = |
| // Allow the root certs module. |
| PK11_HasRootCerts(slot) || |
| // Allow read-only internal slots. |
| (PK11_IsInternal(slot) && !PK11_IsRemovable(slot)) || |
| // Allow configured user slot if specified. |
| (absl::holds_alternative<crypto::ScopedPK11Slot>( |
| user_slot_trust_setting_) && |
| slot == |
| absl::get<crypto::ScopedPK11Slot>(user_slot_trust_setting_).get()); |
| |
| if (allow_slot) { |
| PK11_FreeSlotListElement(slots_for_cert.get(), slot_element); |
| return true; |
| } |
| } |
| |
| return false; |
| } |
| |
| } // namespace net |
