OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/base/dnssec_keyset.h" | 5 #include "net/base/dnssec_keyset.h" |
6 | 6 |
7 #include <cryptohi.h> | 7 #include <cryptohi.h> |
8 #include <cryptoht.h> | 8 #include <cryptoht.h> |
9 #include <keyhi.h> | 9 #include <keyhi.h> |
10 | 10 |
11 #include "base/logging.h" | 11 #include "base/logging.h" |
12 #include "base/memory/scoped_ptr.h" | 12 #include "base/memory/scoped_ptr.h" |
13 #include "base/nss_util.h" | |
14 #include "base/time.h" | 13 #include "base/time.h" |
| 14 #include "crypto/nss_util.h" |
15 #include "net/base/dns_util.h" | 15 #include "net/base/dns_util.h" |
16 | 16 |
17 namespace { | 17 namespace { |
18 | 18 |
19 // These are encoded AlgorithmIdentifiers for the given signature algorithm. | 19 // These are encoded AlgorithmIdentifiers for the given signature algorithm. |
20 const unsigned char kRSAWithSHA1[] = { | 20 const unsigned char kRSAWithSHA1[] = { |
21 0x30, 0xd, 0x6, 0x9, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0xd, 0x1, 0x1, 0x5, 5, 0 | 21 0x30, 0xd, 0x6, 0x9, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0xd, 0x1, 0x1, 0x5, 5, 0 |
22 }; | 22 }; |
23 | 23 |
24 const unsigned char kRSAWithSHA256[] = { | 24 const unsigned char kRSAWithSHA256[] = { |
(...skipping 161 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
186 void DNSSECKeySet::IgnoreTimestamps() { | 186 void DNSSECKeySet::IgnoreTimestamps() { |
187 ignore_timestamps_ = true; | 187 ignore_timestamps_ = true; |
188 } | 188 } |
189 | 189 |
190 bool DNSSECKeySet::VerifySignature( | 190 bool DNSSECKeySet::VerifySignature( |
191 base::StringPiece signature_algorithm, | 191 base::StringPiece signature_algorithm, |
192 base::StringPiece signature, | 192 base::StringPiece signature, |
193 base::StringPiece public_key, | 193 base::StringPiece public_key, |
194 base::StringPiece signed_data) { | 194 base::StringPiece signed_data) { |
195 // This code is largely a copy-and-paste from | 195 // This code is largely a copy-and-paste from |
196 // base/crypto/signature_verifier_nss.cc. We can't change | 196 // crypto/signature_verifier_nss.cc. We can't change |
197 // base::SignatureVerifier to always use NSS because we want the ability to | 197 // crypto::SignatureVerifier to always use NSS because we want the ability to |
198 // be FIPS 140-2 compliant. However, we can't use base::SignatureVerifier | 198 // be FIPS 140-2 compliant. However, we can't use crypto::SignatureVerifier |
199 // here because some platforms don't support SHA256 signatures. Therefore, we | 199 // here because some platforms don't support SHA256 signatures. Therefore, we |
200 // use NSS directly. | 200 // use NSS directly. |
201 | 201 |
202 base::EnsureNSSInit(); | 202 crypto::EnsureNSSInit(); |
203 | 203 |
204 CERTSubjectPublicKeyInfo* spki = NULL; | 204 CERTSubjectPublicKeyInfo* spki = NULL; |
205 SECItem spki_der; | 205 SECItem spki_der; |
206 spki_der.type = siBuffer; | 206 spki_der.type = siBuffer; |
207 spki_der.data = (uint8*) public_key.data(); | 207 spki_der.data = (uint8*) public_key.data(); |
208 spki_der.len = public_key.size(); | 208 spki_der.len = public_key.size(); |
209 spki = SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_der); | 209 spki = SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_der); |
210 if (!spki) | 210 if (!spki) |
211 return false; | 211 return false; |
212 SECKEYPublicKey* pub_key = SECKEY_ExtractPublicKey(spki); | 212 SECKEYPublicKey* pub_key = SECKEY_ExtractPublicKey(spki); |
(...skipping 238 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
451 out[j++] = exp >> (8 * i); | 451 out[j++] = exp >> (8 * i); |
452 length--; | 452 length--; |
453 } | 453 } |
454 | 454 |
455 DCHECK_EQ(0u, length); | 455 DCHECK_EQ(0u, length); |
456 | 456 |
457 return std::string(reinterpret_cast<char*>(out.get()), j); | 457 return std::string(reinterpret_cast<char*>(out.get()), j); |
458 } | 458 } |
459 | 459 |
460 } // namespace net | 460 } // namespace net |
OLD | NEW |