diff options
17 files changed, 672 insertions, 6 deletions
diff --git a/chrome/browser/extensions/api/platform_keys/platform_keys_api.cc b/chrome/browser/extensions/api/platform_keys/platform_keys_api.cc index c6301e9..29cce26 100644 --- a/chrome/browser/extensions/api/platform_keys/platform_keys_api.cc +++ b/chrome/browser/extensions/api/platform_keys/platform_keys_api.cc @@ -12,9 +12,11 @@ #include "chrome/browser/chromeos/platform_keys/platform_keys.h" #include "chrome/browser/chromeos/platform_keys/platform_keys_service.h" #include "chrome/browser/chromeos/platform_keys/platform_keys_service_factory.h" +#include "chrome/browser/extensions/api/platform_keys/verify_trust_api.h" #include "chrome/common/extensions/api/platform_keys_internal.h" #include "components/web_modal/popup_manager.h" #include "content/public/browser/browser_thread.h" +#include "net/base/net_errors.h" #include "net/cert/x509_certificate.h" namespace extensions { @@ -27,8 +29,6 @@ namespace { const char kErrorAlgorithmNotSupported[] = "Algorithm not supported."; const char kErrorAlgorithmNotPermittedByCertificate[] = "The requested Algorithm is not permitted by the certificate."; -const char kErrorInvalidX509Cert[] = - "Certificate is not a valid X.509 certificate."; const char kErrorInteractiveCallFromBackground[] = "Interactive calls must happen in the context of a browser tab or a " "window."; @@ -72,6 +72,8 @@ void BuildWebCryptoRSAAlgorithmDictionary(const PublicKeyInfo& key_info, namespace platform_keys { const char kErrorInvalidToken[] = "The token is not valid."; +const char kErrorInvalidX509Cert[] = + "Certificate is not a valid X.509 certificate."; const char kTokenIdUser[] = "user"; const char kTokenIdSystem[] = "system"; @@ -114,12 +116,12 @@ PlatformKeysInternalGetPublicKeyFunction::Run() { const std::vector<char>& cert_der = params->certificate; if (cert_der.empty()) - return RespondNow(Error(kErrorInvalidX509Cert)); + return RespondNow(Error(platform_keys::kErrorInvalidX509Cert)); scoped_refptr<net::X509Certificate> cert_x509 = net::X509Certificate::CreateFromBytes(vector_as_array(&cert_der), cert_der.size()); if (!cert_x509) - return RespondNow(Error(kErrorInvalidX509Cert)); + return RespondNow(Error(platform_keys::kErrorInvalidX509Cert)); PublicKeyInfo key_info; key_info.public_key_spki_der = @@ -208,6 +210,7 @@ void PlatformKeysInternalSelectClientCertificatesFunction:: OnSelectedCertificates(scoped_ptr<net::CertificateList> matches, const std::string& error_message) { DCHECK_CURRENTLY_ON(content::BrowserThread::UI); + if (!error_message.empty()) { Respond(Error(error_message)); return; @@ -297,6 +300,7 @@ void PlatformKeysInternalSignFunction::OnSigned( const std::string& signature, const std::string& error_message) { DCHECK_CURRENTLY_ON(content::BrowserThread::UI); + if (error_message.empty()) Respond(ArgumentList(api_pki::Sign::Results::Create( std::vector<char>(signature.begin(), signature.end())))); @@ -304,4 +308,42 @@ void PlatformKeysInternalSignFunction::OnSigned( Respond(Error(error_message)); } +PlatformKeysVerifyTLSServerCertificateFunction:: + ~PlatformKeysVerifyTLSServerCertificateFunction() { +} + +ExtensionFunction::ResponseAction +PlatformKeysVerifyTLSServerCertificateFunction::Run() { + DCHECK_CURRENTLY_ON(content::BrowserThread::UI); + + scoped_ptr<api_pk::VerifyTLSServerCertificate::Params> params( + api_pk::VerifyTLSServerCertificate::Params::Create(*args_)); + EXTENSION_FUNCTION_VALIDATE(params.get()); + + VerifyTrustAPI::GetFactoryInstance() + ->Get(browser_context()) + ->Verify(params.Pass(), extension_id(), + base::Bind(&PlatformKeysVerifyTLSServerCertificateFunction:: + FinishedVerification, + this)); + + return RespondLater(); +} + +void PlatformKeysVerifyTLSServerCertificateFunction::FinishedVerification( + const std::string& error, + int verify_result_code) { + DCHECK_CURRENTLY_ON(content::BrowserThread::UI); + + if (!error.empty()) { + Respond(Error(error)); + return; + } + + api_pk::VerificationResult result; + result.trusted = verify_result_code == net::OK; + Respond(ArgumentList( + api_pk::VerifyTLSServerCertificate::Results::Create(result))); +} + } // namespace extensions diff --git a/chrome/browser/extensions/api/platform_keys/platform_keys_api.h b/chrome/browser/extensions/api/platform_keys/platform_keys_api.h index 7a4b9ea..aa0fb59 100644 --- a/chrome/browser/extensions/api/platform_keys/platform_keys_api.h +++ b/chrome/browser/extensions/api/platform_keys/platform_keys_api.h @@ -13,12 +13,13 @@ namespace net { class X509Certificate; typedef std::vector<scoped_refptr<X509Certificate>> CertificateList; -} +} // net namespace extensions { namespace platform_keys { extern const char kErrorInvalidToken[]; +extern const char kErrorInvalidX509Cert[]; // Returns whether |token_id| references a known Token. bool ValidateToken(const std::string& token_id, @@ -70,6 +71,18 @@ class PlatformKeysInternalSignFunction PLATFORMKEYSINTERNAL_SIGN); }; +class PlatformKeysVerifyTLSServerCertificateFunction + : public UIThreadExtensionFunction { + private: + ~PlatformKeysVerifyTLSServerCertificateFunction() override; + ResponseAction Run() override; + + void FinishedVerification(const std::string& error, int result); + + DECLARE_EXTENSION_FUNCTION("platformKeys.verifyTLSServerCertificate", + PLATFORMKEYS_VERIFYTLSSERVERCERTIFICATE); +}; + } // namespace extensions #endif // CHROME_BROWSER_EXTENSIONS_API_PLATFORM_KEYS_PLATFORM_KEYS_API_H_ diff --git a/chrome/browser/extensions/api/platform_keys/platform_keys_apitest_nss.cc b/chrome/browser/extensions/api/platform_keys/platform_keys_apitest_nss.cc index 01ff012..8930640 100644 --- a/chrome/browser/extensions/api/platform_keys/platform_keys_apitest_nss.cc +++ b/chrome/browser/extensions/api/platform_keys/platform_keys_apitest_nss.cc @@ -25,6 +25,7 @@ #include "net/base/net_errors.h" #include "net/base/test_data_directory.h" #include "net/cert/nss_cert_database.h" +#include "net/cert/test_root_certs.h" #include "net/test/cert_test_util.h" #include "net/test/url_request/url_request_mock_http_job.h" #include "policy/policy_constants.h" @@ -145,6 +146,12 @@ class PlatformKeysTest : public ExtensionApiTest, private: void SetupTestCerts(const base::Closure& done_callback, net::NSSCertDatabase* cert_db) { + SetupTestClientCerts(cert_db); + SetupTestCACerts(); + done_callback.Run(); + } + + void SetupTestClientCerts(net::NSSCertDatabase* cert_db) { client_cert1_ = net::ImportClientCertAndKeyFromFile( net::GetTestCertsDirectory(), "client_1.pem", "client_1.pk8", cert_db->GetPrivateSlot().get()); @@ -156,8 +163,15 @@ class PlatformKeysTest : public ExtensionApiTest, net::GetTestCertsDirectory(), "client_2.pem", "client_2.pk8", test_system_slot_->slot()); ASSERT_TRUE(client_cert2_.get()); + } - done_callback.Run(); + void SetupTestCACerts() { + net::TestRootCerts* root_certs = net::TestRootCerts::GetInstance(); + // "root_ca_cert.pem" is the issuer of "ok_cert.pem" which is loaded on the + // JS side. Generated by create_test_certs.sh . + base::FilePath extension_path = test_data_dir_.AppendASCII("platform_keys"); + root_certs->AddFromFile( + test_data_dir_.AppendASCII("platform_keys").AppendASCII("root.pem")); } void SetUpTestSystemSlotOnIO(content::ResourceContext* context, diff --git a/chrome/browser/extensions/api/platform_keys/verify_trust_api.cc b/chrome/browser/extensions/api/platform_keys/verify_trust_api.cc new file mode 100644 index 0000000..26bb8f3 --- /dev/null +++ b/chrome/browser/extensions/api/platform_keys/verify_trust_api.cc @@ -0,0 +1,223 @@ +// Copyright 2015 The Chromium Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#include "chrome/browser/extensions/api/platform_keys/verify_trust_api.h" + +#include <algorithm> + +#include "base/lazy_instance.h" +#include "base/macros.h" +#include "base/memory/linked_ptr.h" +#include "base/memory/ref_counted.h" +#include "chrome/browser/extensions/api/platform_keys/platform_keys_api.h" +#include "chrome/common/extensions/api/platform_keys_internal.h" +#include "extensions/browser/extension_registry_factory.h" +#include "net/base/net_errors.h" +#include "net/cert/cert_verifier.h" +#include "net/cert/cert_verify_result.h" +#include "net/cert/x509_certificate.h" +#include "net/log/net_log.h" +#include "net/ssl/ssl_config_service.h" + +namespace extensions { + +namespace { + +base::LazyInstance<BrowserContextKeyedAPIFactory<VerifyTrustAPI>>::Leaky + g_factory = LAZY_INSTANCE_INITIALIZER; + +const char kErrorEmptyCertificateChain[] = + "Server certificate chain must not be empty."; + +} // namespace + +// This class bundles IO data and functions of the VerifyTrustAPI that are to be +// used on the IO thread only. +// It is created on the UI thread and afterwards lives on the IO thread. +class VerifyTrustAPI::IOPart { + public: + ~IOPart(); + + // Verifies the certificate as stated by |params| and calls back |callback| + // with the result (see the declaration of VerifyCallback). + // Will not call back after this object is destructed or the verifier for this + // extension is deleted (see OnExtensionUnloaded). + void Verify(scoped_ptr<Params> params, + const std::string& extension_id, + const VerifyCallback& callback); + + // Must be called when the extension with id |extension_id| is unloaded. + // Deletes the verifier for |extension_id| and cancels all pending + // verifications of this verifier. + void OnExtensionUnloaded(const std::string& extension_id); + + private: + struct RequestState { + RequestState() {} + + scoped_ptr<net::CertVerifier::Request> request; + + private: + DISALLOW_COPY_AND_ASSIGN(RequestState); + }; + + // Calls back |callback| with the result and no error. + void CallBackWithResult(const VerifyCallback& callback, + scoped_ptr<net::CertVerifyResult> verify_result, + RequestState* request_state, + int result); + + // One CertVerifier per extension to verify trust. Each verifier is created on + // first usage and deleted when this IOPart is destructed or the respective + // extension is unloaded. + std::map<std::string, linked_ptr<net::CertVerifier>> extension_to_verifier_; +}; + +// static +BrowserContextKeyedAPIFactory<VerifyTrustAPI>* +VerifyTrustAPI::GetFactoryInstance() { + return g_factory.Pointer(); +} + +template <> +void BrowserContextKeyedAPIFactory< + VerifyTrustAPI>::DeclareFactoryDependencies() { + DependsOn(ExtensionsBrowserClient::Get()->GetExtensionSystemFactory()); + DependsOn(ExtensionRegistryFactory::GetInstance()); +} + +VerifyTrustAPI::VerifyTrustAPI(content::BrowserContext* context) + : io_part_(new IOPart), registry_observer_(this), weak_factory_(this) { + DCHECK_CURRENTLY_ON(content::BrowserThread::UI); + registry_observer_.Add(ExtensionRegistry::Get(context)); +} + +VerifyTrustAPI::~VerifyTrustAPI() { + DCHECK_CURRENTLY_ON(content::BrowserThread::UI); +} + +void VerifyTrustAPI::Verify(scoped_ptr<Params> params, + const std::string& extension_id, + const VerifyCallback& ui_callback) { + DCHECK_CURRENTLY_ON(content::BrowserThread::UI); + + // Call back through the VerifyTrustAPI object on the UIThread. Because of the + // WeakPtr usage, this will ensure that |ui_callback| is not called after the + // API is destroyed. + VerifyCallback finish_callback(base::Bind( + &CallBackOnUI, base::Bind(&VerifyTrustAPI::FinishedVerificationOnUI, + weak_factory_.GetWeakPtr(), ui_callback))); + + content::BrowserThread::PostTask( + content::BrowserThread::IO, FROM_HERE, + base::Bind(&IOPart::Verify, base::Unretained(io_part_.get()), + base::Passed(¶ms), extension_id, finish_callback)); +} + +void VerifyTrustAPI::OnExtensionUnloaded( + content::BrowserContext* browser_context, + const Extension* extension, + UnloadedExtensionInfo::Reason reason) { + content::BrowserThread::PostTask( + content::BrowserThread::IO, FROM_HERE, + base::Bind(&IOPart::OnExtensionUnloaded, base::Unretained(io_part_.get()), + extension->id())); +} + +void VerifyTrustAPI::FinishedVerificationOnUI(const VerifyCallback& ui_callback, + const std::string& error, + int result) { + DCHECK_CURRENTLY_ON(content::BrowserThread::UI); + + ui_callback.Run(error, result); +} + +// static +void VerifyTrustAPI::CallBackOnUI(const VerifyCallback& ui_callback, + const std::string& error, + int result) { + content::BrowserThread::PostTask(content::BrowserThread::UI, FROM_HERE, + base::Bind(ui_callback, error, result)); +} + +VerifyTrustAPI::IOPart::~IOPart() { + DCHECK_CURRENTLY_ON(content::BrowserThread::IO); +} + +void VerifyTrustAPI::IOPart::Verify(scoped_ptr<Params> params, + const std::string& extension_id, + const VerifyCallback& callback) { + DCHECK_CURRENTLY_ON(content::BrowserThread::IO); + + const api::platform_keys::VerificationDetails& details = params->details; + + if (details.server_certificate_chain.empty()) { + callback.Run(kErrorEmptyCertificateChain, 0); + return; + } + + std::vector<base::StringPiece> der_cert_chain; + for (const std::vector<char>& cert_der : details.server_certificate_chain) { + if (cert_der.empty()) { + callback.Run(platform_keys::kErrorInvalidX509Cert, 0); + return; + } + der_cert_chain.push_back(base::StringPiece( + reinterpret_cast<const char*>(vector_as_array(&cert_der)), + cert_der.size())); + } + scoped_refptr<net::X509Certificate> cert_chain( + net::X509Certificate::CreateFromDERCertChain(der_cert_chain)); + if (!cert_chain) { + callback.Run(platform_keys::kErrorInvalidX509Cert, 0); + return; + } + + net::CertVerifier* verifier = nullptr; + if (ContainsKey(extension_to_verifier_, extension_id)) { + verifier = extension_to_verifier_[extension_id].get(); + } else { + verifier = net::CertVerifier::CreateDefault(); + extension_to_verifier_[extension_id] = make_linked_ptr(verifier); + } + + scoped_ptr<net::CertVerifyResult> verify_result(new net::CertVerifyResult); + scoped_ptr<net::BoundNetLog> net_log(new net::BoundNetLog); + const int flags = 0; + + std::string ocsp_response; + net::CertVerifyResult* const verify_result_ptr = verify_result.get(); + + RequestState* request_state = new RequestState(); + base::Callback<void(int)> bound_callback( + base::Bind(&IOPart::CallBackWithResult, base::Unretained(this), callback, + base::Passed(&verify_result), base::Owned(request_state))); + + const int result = verifier->Verify( + cert_chain.get(), details.hostname, ocsp_response, flags, + net::SSLConfigService::GetCRLSet().get(), verify_result_ptr, + bound_callback, &request_state->request, *net_log); + + if (result != net::ERR_IO_PENDING) { + bound_callback.Run(result); + return; + } +} + +void VerifyTrustAPI::IOPart::OnExtensionUnloaded( + const std::string& extension_id) { + extension_to_verifier_.erase(extension_id); +} + +void VerifyTrustAPI::IOPart::CallBackWithResult( + const VerifyCallback& callback, + scoped_ptr<net::CertVerifyResult> verify_result, + RequestState* request_state, + int result) { + DCHECK_CURRENTLY_ON(content::BrowserThread::IO); + + callback.Run(std::string() /* no error message */, result); +} + +} // namespace extensions diff --git a/chrome/browser/extensions/api/platform_keys/verify_trust_api.h b/chrome/browser/extensions/api/platform_keys/verify_trust_api.h new file mode 100644 index 0000000..ac27bad --- /dev/null +++ b/chrome/browser/extensions/api/platform_keys/verify_trust_api.h @@ -0,0 +1,111 @@ +// Copyright 2015 The Chromium Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#ifndef CHROME_BROWSER_EXTENSIONS_API_PLATFORM_KEYS_VERIFY_TRUST_API_H_ +#define CHROME_BROWSER_EXTENSIONS_API_PLATFORM_KEYS_VERIFY_TRUST_API_H_ + +#include <string> + +#include "base/callback.h" +#include "base/macros.h" +#include "base/memory/scoped_ptr.h" +#include "base/memory/weak_ptr.h" +#include "base/scoped_observer.h" +#include "content/public/browser/browser_thread.h" +#include "extensions/browser/browser_context_keyed_api_factory.h" +#include "extensions/browser/extension_registry.h" +#include "extensions/browser/extension_registry_observer.h" + +namespace content { +class BrowserContext; +} // namespace content + +namespace extensions { + +namespace api { +namespace platform_keys { +namespace VerifyTLSServerCertificate { +struct Params; +} // namespace VerifyTLSServerCertificate +} // namespace platform_keys +} // namespace api + +// This keyed service is used by the platformKeys.verifyTLSServerCertificate for +// caching and to reuse objects between multiple API calls (e.g. the +// net::CertVerifier). +class VerifyTrustAPI : public BrowserContextKeyedAPI, + public ExtensionRegistryObserver { + public: + // Will be called with |result| set to the verification result (net::OK if the + // certificate is trusted or a net error code) or if an error occured during + // processing the parameters, |error| is set to an english error message and + // |result| must be ignored. + using VerifyCallback = + base::Callback<void(const std::string& error, int result)>; + using Params = api::platform_keys::VerifyTLSServerCertificate::Params; + + // Consumers should use the factory instead of this constructor. + explicit VerifyTrustAPI(content::BrowserContext* context); + ~VerifyTrustAPI() override; + + // Verifies the server certificate as described by |params| for the + // extension with id |extension_id|. When verification is complete + // (successful or not), the result will be passed to |callback|. + // + // Note: It is safe to delete this object while there are still + // outstanding operations. However, if this happens, |callback| + // will NOT be called. + void Verify(scoped_ptr<Params> params, + const std::string& extension_id, + const VerifyCallback& callback); + + // ExtensionRegistryObserver: + void OnExtensionUnloaded(content::BrowserContext* browser_context, + const Extension* extension, + UnloadedExtensionInfo::Reason reason) override; + + // BrowserContextKeyedAPI: + static BrowserContextKeyedAPIFactory<VerifyTrustAPI>* GetFactoryInstance(); + + protected: + static const bool kServiceRedirectedInIncognito = true; + static const bool kServiceIsCreatedWithBrowserContext = false; + static const bool kServiceIsNULLWhileTesting = true; + + private: + class IOPart; + friend class BrowserContextKeyedAPIFactory<VerifyTrustAPI>; + + // Calls |ui_callback| with the given parameters. + void FinishedVerificationOnUI(const VerifyCallback& ui_callback, + const std::string& error, + int result); + + // Calls |ui_callback| on the UIThread with the given arguments. + static void CallBackOnUI(const VerifyCallback& ui_callback, + const std::string& error, + int result); + + // BrowserContextKeyedAPI implementation. + static const char* service_name() { return "VerifyTrustAPI"; } + + // Created on the UIThread but must be used and destroyed only on the + // IOThread. + scoped_ptr<IOPart, content::BrowserThread::DeleteOnIOThread> io_part_; + + ScopedObserver<ExtensionRegistry, ExtensionRegistryObserver> + registry_observer_; + + base::WeakPtrFactory<VerifyTrustAPI> weak_factory_; + + DISALLOW_COPY_AND_ASSIGN(VerifyTrustAPI); +}; + +template <> +void BrowserContextKeyedAPIFactory< + VerifyTrustAPI>::DeclareFactoryDependencies(); + +} // namespace extensions + +#endif // CHROME_BROWSER_EXTENSIONS_API_PLATFORM_KEYS_VERIFY_TRUST_API_H_ diff --git a/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc b/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc index 8868b38..49869cb 100644 --- a/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc +++ b/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc @@ -116,6 +116,10 @@ #include "chrome/browser/signin/cross_device_promo_factory.h" #endif +#if defined(OS_CHROMEOS) +#include "chrome/browser/extensions/api/platform_keys/verify_trust_api.h" +#endif + #if !defined(OS_ANDROID) #include "chrome/browser/profile_resetter/automatic_profile_resetter_factory.h" #endif @@ -203,6 +207,9 @@ EnsureBrowserContextKeyedServiceFactoriesBuilt() { EasyUnlockServiceFactory::GetInstance(); EnhancedBookmarkKeyServiceFactory::GetInstance(); #endif +#if defined(OS_CHROMEOS) + extensions::VerifyTrustAPI::GetFactoryInstance(); +#endif FaviconServiceFactory::GetInstance(); FindBarStateFactory::GetInstance(); GAIAInfoUpdateServiceFactory::GetInstance(); diff --git a/chrome/chrome_browser_extensions.gypi b/chrome/chrome_browser_extensions.gypi index 8721e77..b5e81fc 100644 --- a/chrome/chrome_browser_extensions.gypi +++ b/chrome/chrome_browser_extensions.gypi @@ -28,6 +28,8 @@ 'browser/extensions/api/networking_private/crypto_verify_impl.h', 'browser/extensions/api/platform_keys/platform_keys_api.cc', 'browser/extensions/api/platform_keys/platform_keys_api.h', + 'browser/extensions/api/platform_keys/verify_trust_api.cc', + 'browser/extensions/api/platform_keys/verify_trust_api.h', 'browser/extensions/api/terminal/terminal_extension_helper.cc', 'browser/extensions/api/terminal/terminal_extension_helper.h', 'browser/extensions/api/terminal/terminal_private_api.cc', diff --git a/chrome/common/extensions/api/platform_keys.idl b/chrome/common/extensions/api/platform_keys.idl index 8627556..3b83923 100644 --- a/chrome/common/extensions/api/platform_keys.idl +++ b/chrome/common/extensions/api/platform_keys.idl @@ -59,6 +59,24 @@ namespace platformKeys { boolean interactive; }; + dictionary VerificationDetails { + // Each chain entry must be the DER encoding of a X.509 certificate, the + // first entry must be the server certificate and each entry must certify + // the entry preceding it. + ArrayBuffer[] serverCertificateChain; + + // The hostname of the server to verify the certificate for, e.g. the server + // that presented the <code>serverCertificateChain</code>. + DOMString hostname; + }; + + dictionary VerificationResult { + // The result of the trust verificaiton: true if trust for the given + // verification details could be established and false if trust is rejected + // for any reason. + boolean trusted; + }; + // |matches|: The list of certificates that match the request, that the // extension has permission for and, if <code>interactive</code> is true, that // were selected by the user. @@ -73,6 +91,8 @@ namespace platformKeys { callback GetKeyPairCallback = void (object publicKey, optional object privateKey); + callback VerificationCallback = void (VerificationResult result); + interface Functions { // This function filters from a list of client certificates the ones that // are known to the platform, match <code>request</code> and for which the @@ -108,6 +128,18 @@ namespace platformKeys { // that allows crypto operations on keys of client certificates that are // available to this extension. [nocompile] static object subtleCrypto(); + + // Checks whether <code>details.serverCertificateChain</code> can be trusted + // for <code>details.serverHostname</code> according to the trust + // settings of the platform. + // Note: The actual behavior of the trust verification is not fully + // specified and might change in the future. + // The API implementation verifies certificate expiration, validates the + // certification path and checks trust by a known CA. + // The implementation is supposed to respect the EKU serverAuth and to + // support subject alternative names. + static void verifyTLSServerCertificate(VerificationDetails details, + VerificationCallback callback); }; }; diff --git a/chrome/test/data/extensions/api_test/platform_keys/basic.js b/chrome/test/data/extensions/api_test/platform_keys/basic.js index e874671..3790e42 100644 --- a/chrome/test/data/extensions/api_test/platform_keys/basic.js +++ b/chrome/test/data/extensions/api_test/platform_keys/basic.js @@ -11,6 +11,7 @@ console.log('[SELECTED TEST SUITE] ' + selectedTestSuite + var assertEq = chrome.test.assertEq; var assertTrue = chrome.test.assertTrue; +var assertFalse = chrome.test.assertFalse; var fail = chrome.test.fail; var succeed = chrome.test.succeed; var callbackPass = chrome.test.callbackPass; @@ -19,6 +20,20 @@ var callbackFail= chrome.test.callbackFail; // Each value is the path to a file in this extension's folder that will be // loaded and replaced by a Uint8Array in the setUp() function below. var data = { + // X.509 certificate in DER encoding issued by 'root.pem' which is set to be + // trusted by the test setup. + // Generated by create_test_certs.sh . + trusted_l1_leaf_cert: 'l1_leaf.der', + + // X.509 intermediate CA certificate in DER encoding issued by 'root.pem' + // which is set to be trusted by the test setup. + // Generated by create_test_certs.sh . + trusted_l1_interm_cert: 'l1_interm.der', + + // X.509 certificate in DER encoding issued by 'l1_interm'. + // Generated by create_test_certs.sh . + trusted_l2_leaf_cert: 'l2_leaf.der', + // X.509 client certificate in DER encoding. // Algorithm in SPKI: rsaEncryption. // openssl x509 -in net/data/ssl/certificates/client_1.pem -outform DER -out @@ -453,6 +468,45 @@ function testBackgroundInteractiveSelect() { })); } +function testVerifyTrusted() { + var details = { + serverCertificateChain: [data.trusted_l1_leaf_cert.buffer], + hostname: "l1_leaf" + }; + chrome.platformKeys.verifyTLSServerCertificate( + details, callbackPass(function(result) { assertTrue(result.trusted); })); +} + +function testVerifyTrustedChain() { + var details = { + serverCertificateChain: + [data.trusted_l2_leaf_cert.buffer, data.trusted_l1_interm_cert.buffer], + hostname: "l2_leaf" + }; + chrome.platformKeys.verifyTLSServerCertificate( + details, callbackPass(function(result) { assertTrue(result.trusted); })); +} + +function testVerifyCommonNameInvalid() { + var details = { + serverCertificateChain: + [data.trusted_l2_leaf_cert.buffer, data.trusted_l1_interm_cert.buffer], + // Use any hostname not matching the common name 'l2_leaf' of the cert. + hostname: "abc.example" + }; + chrome.platformKeys.verifyTLSServerCertificate( + details, callbackPass(function(result) { assertFalse(result.trusted); })); +} + +function testVerifyUntrusted() { + var details = { + serverCertificateChain: [data.client_1.buffer], + hostname: "127.0.0.1" + }; + chrome.platformKeys.verifyTLSServerCertificate( + details, callbackPass(function(result) { assertFalse(result.trusted); })); +} + var testSuites = { // These tests assume already granted permissions for client_1 and client_2. // On interactive selectClientCertificates calls, the simulated user does not @@ -473,6 +527,10 @@ var testSuites = { testGetKeyPair, testSignNoHash, testSignSha1Client1, + testVerifyTrusted, + testVerifyTrustedChain, + testVerifyCommonNameInvalid, + testVerifyUntrusted, ]; chrome.test.runTests(tests); diff --git a/chrome/test/data/extensions/api_test/platform_keys/ca.cnf b/chrome/test/data/extensions/api_test/platform_keys/ca.cnf new file mode 100644 index 0000000..ddac803 --- /dev/null +++ b/chrome/test/data/extensions/api_test/platform_keys/ca.cnf @@ -0,0 +1,57 @@ +[ca] +default_ca = CA_root +preserve = yes + +# The default test root, used to generate certificates and CRLs. +[CA_root] +dir = out +key_size = 2048 +algo = sha256 +cert_type = root +database = $dir/${ENV::CA_ID}-index.txt +new_certs_dir = $dir +serial = $dir/${ENV::CA_ID}-serial +certificate = $dir/${ENV::CA_ID}.pem +private_key = $dir/${ENV::CA_ID}.key +RANDFILE = $dir/.rand +default_days = 3650 +default_crl_days = 30 +default_md = sha256 +policy = policy_anything +unique_subject = no +copy_extensions = copy + +[leaf_cert] +# Extensions to add when signing a request for an leaf cert +basicConstraints = critical, CA:false +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always +extendedKeyUsage = serverAuth, clientAuth + +[ca_cert] +# Extensions to add when signing a request for an intermediate/CA cert +basicConstraints = critical, CA:true +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always +keyUsage = critical, keyCertSign, cRLSign + +[policy_anything] +# Default signing policy +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = optional +emailAddress = optional + +[req] +default_bits = 2048 +default_md = sha256 +string_mask = utf8only +prompt = no +encrypt_key = no +distinguished_name = dn + +[dn] +CN = $ENV::CN diff --git a/chrome/test/data/extensions/api_test/platform_keys/create_test_certs.sh b/chrome/test/data/extensions/api_test/platform_keys/create_test_certs.sh new file mode 100755 index 0000000..85c67f4 --- /dev/null +++ b/chrome/test/data/extensions/api_test/platform_keys/create_test_certs.sh @@ -0,0 +1,86 @@ +#!/bin/bash + +# Copyright 2015 The Chromium Authors. All rights reserved. +# Use of this source code is governed by a BSD-style license that can be +# found in the LICENSE file. + +# Generates the following tree of certificates: +# root (self-signed root) +# \ \ +# \ \--> l1_leaf (end-entity) +# \ +# \----> l1_interm --> l2_leaf (end-entity) + +try() { + "$@" || { + e=$? + echo "*** ERROR $e *** $@ " > /dev/stderr + exit $e + } +} + +# Create a self-signed CA cert with CommonName CN and store it at $1.pem . +root_cert() { + try /bin/sh -c "echo 01 > out/${1}-serial" + try touch out/${1}-index.txt + try openssl genrsa -out out/${1}.key 2048 + + CA_ID=$1 \ + try openssl req \ + -new \ + -key out/${1}.key \ + -out out/${1}.req \ + -config ca.cnf + + CA_ID=$1 \ + try openssl x509 \ + -req -days 3650 \ + -in out/${1}.req \ + -signkey out/${1}.key \ + -extfile ca.cnf \ + -extensions ca_cert > out/${1}.pem + + try cp out/${1}.pem ${1}.pem +} + +# Create a cert with CommonName CN signed by CA_ID and store it at $1.der . +# $2 must either be "leaf_cert" (for a server/user cert) or "ca_cert" (for a +# intermediate CA). +issue_cert() { + if [[ "$2" == "ca_cert" ]] + then + try /bin/sh -c "echo 01 > out/${1}-serial" + try touch out/${1}-index.txt + try openssl genrsa -out out/${1}.key 2048 + fi + try openssl req \ + -new \ + -keyout out/${1}.key \ + -out out/${1}.req \ + -config ca.cnf + + try openssl ca \ + -batch \ + -extensions $2 \ + -in out/${1}.req \ + -out out/${1}.pem \ + -config ca.cnf + + try openssl x509 -in out/${1}.pem -outform DER -out out/${1}.der + try cp out/${1}.der ${1}.der +} + +try rm -rf out +try mkdir out + +CN=root \ + try root_cert root + +CA_ID=root CN=l1_leaf \ + try issue_cert l1_leaf leaf_cert + +CA_ID=root CN=l1_interm \ + try issue_cert l1_interm ca_cert + +CA_ID=l1_interm CN=l2_leaf \ + try issue_cert l2_leaf leaf_cert diff --git a/chrome/test/data/extensions/api_test/platform_keys/l1_interm.der b/chrome/test/data/extensions/api_test/platform_keys/l1_interm.der Binary files differnew file mode 100644 index 0000000..f56ea48 --- /dev/null +++ b/chrome/test/data/extensions/api_test/platform_keys/l1_interm.der diff --git a/chrome/test/data/extensions/api_test/platform_keys/l1_leaf.der b/chrome/test/data/extensions/api_test/platform_keys/l1_leaf.der Binary files differnew file mode 100644 index 0000000..358380c --- /dev/null +++ b/chrome/test/data/extensions/api_test/platform_keys/l1_leaf.der diff --git a/chrome/test/data/extensions/api_test/platform_keys/l2_leaf.der b/chrome/test/data/extensions/api_test/platform_keys/l2_leaf.der Binary files differnew file mode 100644 index 0000000..0477436 --- /dev/null +++ b/chrome/test/data/extensions/api_test/platform_keys/l2_leaf.der diff --git a/chrome/test/data/extensions/api_test/platform_keys/root.pem b/chrome/test/data/extensions/api_test/platform_keys/root.pem new file mode 100644 index 0000000..8681990 --- /dev/null +++ b/chrome/test/data/extensions/api_test/platform_keys/root.pem @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDBDCCAeygAwIBAgIJAPzptz/6abHIMA0GCSqGSIb3DQEBCwUAMA8xDTALBgNV +BAMMBHJvb3QwHhcNMTUwNTE5MDkzMTQwWhcNMjUwNTE2MDkzMTQwWjAPMQ0wCwYD +VQQDDARyb290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqFm0ruJH +FcsiLRY+j1LaW2StdCyKSG0LVqb4RYrzuVi1rPbAC9+L9QP1zQL8iwQSGplpvUR6 +lZW2ykL9OgUroje6BQYl9RkUyHF3a3iG5wqHB1ileUmu69+fcCl1ohUfwgWW3QWf +Kglp1wyThOOaiOclV2K9e/JxEoq8Ng6BvBE4coGr7tHQxajbcjoDkyMC+yXneghn +yyeNS1qZ+kY3Aw3KQVc+wJ5EyuErM3ARDaT1fVOfiyS2kbpRCqFlhYGdCFp8ebuk +PY7FJLFvmPp8A41bEqLXgJ4l9ynGHqyYmf+n7PKg6HChRnWGIrha2SsPaIfDX8Sh +Cf8vaxR3KPAFMwIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRT +t0RZWqsOg9uMi/BtiODSFRcV2DAfBgNVHSMEGDAWgBRTt0RZWqsOg9uMi/BtiODS +FRcV2DAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAFX09PBL4l+T +Wp1GjA/oVYtF8D6ZJ0w9+5bcTk8QlwBbNjKa55b6q6vzyx02kXsldJzcQjMoWWLg +YQ+c1tngd6UoMEdQzGnc93WR2DDNXEZgEGbFfydxRx6PHNtGWN5vRSwANScCG6NA +PEcIDOT3gZ9sXaogYqzwXwpc0bv3r6Ema9ZPO7QzCVnqJVFyDXHdGDSSZ55jDAep +yqTSzGLalPWTfkqCULIzRtOT6aAtYUtbNNp3XbxOtw8EMxfBvmD5Rniy0yw43KMI +raG5YyEDaV72xTKpYs/UDImvT7LgS0XFRP7jH5agqjKkCLy1gBYnue0BAI7qusWA +3CqAWWi3btw= +-----END CERTIFICATE----- diff --git a/extensions/browser/extension_function_histogram_value.h b/extensions/browser/extension_function_histogram_value.h index 8a7081c..e183baf 100644 --- a/extensions/browser/extension_function_histogram_value.h +++ b/extensions/browser/extension_function_histogram_value.h @@ -1099,6 +1099,7 @@ enum HistogramValue { PASSWORDSPRIVATE_REMOVEPASSWORDEXCEPTION, PASSWORDSPRIVATE_GETPLAINTEXTPASSWORD, LAUNCHERPAGE_HIDE, + PLATFORMKEYS_VERIFYTLSSERVERCERTIFICATE, // Last entry: Add new entries above and ensure to update // tools/metrics/histograms/histograms.xml. ENUM_BOUNDARY diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml index be22885..fcbafcc 100644 --- a/tools/metrics/histograms/histograms.xml +++ b/tools/metrics/histograms/histograms.xml @@ -52891,6 +52891,7 @@ Therefore, the affected-histogram name has to have at least one dot in it. <int value="1038" label="PASSWORDSPRIVATE_REMOVEPASSWORDEXCEPTION"/> <int value="1039" label="PASSWORDSPRIVATE_GETPLAINTEXTPASSWORD"/> <int value="1040" label="LAUNCHERPAGE_HIDE"/> + <int value="1041" label="PLATFORMKEYS_VERIFYTLSSERVERCERTIFICATE"/> </enum> <enum name="ExtensionInstallCause" type="int"> |