OLD | NEW |
1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/base/keygen_handler.h" | 5 #include "net/base/keygen_handler.h" |
6 | 6 |
7 #include <windows.h> | 7 #include <windows.h> |
8 #include <wincrypt.h> | 8 #include <wincrypt.h> |
9 #pragma comment(lib, "crypt32.lib") | 9 #pragma comment(lib, "crypt32.lib") |
10 #include <rpc.h> | 10 #include <rpc.h> |
11 #pragma comment(lib, "rpcrt4.lib") | 11 #pragma comment(lib, "rpcrt4.lib") |
12 | 12 |
13 #include <list> | 13 #include <list> |
14 #include <string> | 14 #include <string> |
15 #include <vector> | 15 #include <vector> |
16 | 16 |
17 #include "base/base64.h" | 17 #include "base/base64.h" |
18 #include "base/basictypes.h" | 18 #include "base/basictypes.h" |
19 #include "base/crypto/capi_util.h" | |
20 #include "base/crypto/scoped_capi_types.h" | |
21 #include "base/logging.h" | 19 #include "base/logging.h" |
22 #include "base/string_piece.h" | 20 #include "base/string_piece.h" |
23 #include "base/string_util.h" | 21 #include "base/string_util.h" |
24 #include "base/utf_string_conversions.h" | 22 #include "base/utf_string_conversions.h" |
| 23 #include "crypto/capi_util.h" |
| 24 #include "crypto/scoped_capi_types.h" |
| 25 |
25 | 26 |
26 namespace net { | 27 namespace net { |
27 | 28 |
28 // Assigns the contents of a CERT_PUBLIC_KEY_INFO structure for the signing | 29 // Assigns the contents of a CERT_PUBLIC_KEY_INFO structure for the signing |
29 // key in |prov| to |output|. Returns true if encoding was successful. | 30 // key in |prov| to |output|. Returns true if encoding was successful. |
30 bool GetSubjectPublicKeyInfo(HCRYPTPROV prov, std::vector<BYTE>* output) { | 31 bool GetSubjectPublicKeyInfo(HCRYPTPROV prov, std::vector<BYTE>* output) { |
31 BOOL ok; | 32 BOOL ok; |
32 DWORD size = 0; | 33 DWORD size = 0; |
33 | 34 |
34 // From the private key stored in HCRYPTPROV, obtain the public key, stored | 35 // From the private key stored in HCRYPTPROV, obtain the public key, stored |
(...skipping 101 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
136 struct KeyContainer { | 137 struct KeyContainer { |
137 public: | 138 public: |
138 explicit KeyContainer(bool delete_keyset) | 139 explicit KeyContainer(bool delete_keyset) |
139 : delete_keyset_(delete_keyset) {} | 140 : delete_keyset_(delete_keyset) {} |
140 | 141 |
141 ~KeyContainer() { | 142 ~KeyContainer() { |
142 if (provider_) { | 143 if (provider_) { |
143 provider_.reset(); | 144 provider_.reset(); |
144 if (delete_keyset_ && !key_id_.empty()) { | 145 if (delete_keyset_ && !key_id_.empty()) { |
145 HCRYPTPROV provider; | 146 HCRYPTPROV provider; |
146 base::CryptAcquireContextLocked(&provider, key_id_.c_str(), NULL, | 147 crypto::CryptAcquireContextLocked(&provider, key_id_.c_str(), NULL, |
147 PROV_RSA_FULL, CRYPT_SILENT | CRYPT_DELETEKEYSET); | 148 PROV_RSA_FULL, CRYPT_SILENT | CRYPT_DELETEKEYSET); |
148 } | 149 } |
149 } | 150 } |
150 } | 151 } |
151 | 152 |
152 base::ScopedHCRYPTPROV provider_; | 153 crypto::ScopedHCRYPTPROV provider_; |
153 std::wstring key_id_; | 154 std::wstring key_id_; |
154 | 155 |
155 private: | 156 private: |
156 bool delete_keyset_; | 157 bool delete_keyset_; |
157 }; | 158 }; |
158 | 159 |
159 std::string KeygenHandler::GenKeyAndSignChallenge() { | 160 std::string KeygenHandler::GenKeyAndSignChallenge() { |
160 KeyContainer key_container(!stores_key_); | 161 KeyContainer key_container(!stores_key_); |
161 | 162 |
162 // TODO(rsleevi): Have the user choose which provider they should use, which | 163 // TODO(rsleevi): Have the user choose which provider they should use, which |
163 // needs to be filtered by those providers which can provide the key type | 164 // needs to be filtered by those providers which can provide the key type |
164 // requested or the key size requested. This is especially important for | 165 // requested or the key size requested. This is especially important for |
165 // generating certificates that will be stored on smart cards. | 166 // generating certificates that will be stored on smart cards. |
166 const int kMaxAttempts = 5; | 167 const int kMaxAttempts = 5; |
167 int attempt; | 168 int attempt; |
168 for (attempt = 0; attempt < kMaxAttempts; ++attempt) { | 169 for (attempt = 0; attempt < kMaxAttempts; ++attempt) { |
169 // Per MSDN documentation for CryptAcquireContext, if applications will be | 170 // Per MSDN documentation for CryptAcquireContext, if applications will be |
170 // creating their own keys, they should ensure unique naming schemes to | 171 // creating their own keys, they should ensure unique naming schemes to |
171 // prevent overlap with any other applications or consumers of CSPs, and | 172 // prevent overlap with any other applications or consumers of CSPs, and |
172 // *should not* store new keys within the default, NULL key container. | 173 // *should not* store new keys within the default, NULL key container. |
173 key_container.key_id_ = GetNewKeyContainerId(); | 174 key_container.key_id_ = GetNewKeyContainerId(); |
174 if (key_container.key_id_.empty()) | 175 if (key_container.key_id_.empty()) |
175 return std::string(); | 176 return std::string(); |
176 | 177 |
177 // Only create new key containers, so that existing key containers are not | 178 // Only create new key containers, so that existing key containers are not |
178 // overwritten. | 179 // overwritten. |
179 if (base::CryptAcquireContextLocked(key_container.provider_.receive(), | 180 if (crypto::CryptAcquireContextLocked(key_container.provider_.receive(), |
180 key_container.key_id_.c_str(), NULL, PROV_RSA_FULL, | 181 key_container.key_id_.c_str(), NULL, PROV_RSA_FULL, |
181 CRYPT_SILENT | CRYPT_NEWKEYSET)) | 182 CRYPT_SILENT | CRYPT_NEWKEYSET)) |
182 break; | 183 break; |
183 | 184 |
184 if (GetLastError() != NTE_BAD_KEYSET) { | 185 if (GetLastError() != NTE_BAD_KEYSET) { |
185 LOG(ERROR) << "Keygen failed: Couldn't acquire a CryptoAPI provider " | 186 LOG(ERROR) << "Keygen failed: Couldn't acquire a CryptoAPI provider " |
186 "context: " << GetLastError(); | 187 "context: " << GetLastError(); |
187 return std::string(); | 188 return std::string(); |
188 } | 189 } |
189 } | 190 } |
190 if (attempt == kMaxAttempts) { | 191 if (attempt == kMaxAttempts) { |
191 LOG(ERROR) << "Keygen failed: Couldn't acquire a CryptoAPI provider " | 192 LOG(ERROR) << "Keygen failed: Couldn't acquire a CryptoAPI provider " |
192 "context: Max retries exceeded"; | 193 "context: Max retries exceeded"; |
193 return std::string(); | 194 return std::string(); |
194 } | 195 } |
195 | 196 |
196 { | 197 { |
197 base::ScopedHCRYPTKEY key; | 198 crypto::ScopedHCRYPTKEY key; |
198 if (!CryptGenKey(key_container.provider_, CALG_RSA_KEYX, | 199 if (!CryptGenKey(key_container.provider_, CALG_RSA_KEYX, |
199 (key_size_in_bits_ << 16) | CRYPT_EXPORTABLE, key.receive())) { | 200 (key_size_in_bits_ << 16) | CRYPT_EXPORTABLE, key.receive())) { |
200 LOG(ERROR) << "Keygen failed: Couldn't generate an RSA key"; | 201 LOG(ERROR) << "Keygen failed: Couldn't generate an RSA key"; |
201 return std::string(); | 202 return std::string(); |
202 } | 203 } |
203 | 204 |
204 std::string spkac; | 205 std::string spkac; |
205 if (!GetSignedPublicKeyAndChallenge(key_container.provider_, challenge_, | 206 if (!GetSignedPublicKeyAndChallenge(key_container.provider_, challenge_, |
206 &spkac)) { | 207 &spkac)) { |
207 LOG(ERROR) << "Keygen failed: Couldn't generate the signed public key " | 208 LOG(ERROR) << "Keygen failed: Couldn't generate the signed public key " |
208 "and challenge"; | 209 "and challenge"; |
209 return std::string(); | 210 return std::string(); |
210 } | 211 } |
211 | 212 |
212 std::string result; | 213 std::string result; |
213 if (!base::Base64Encode(spkac, &result)) { | 214 if (!base::Base64Encode(spkac, &result)) { |
214 LOG(ERROR) << "Keygen failed: Couldn't convert signed key into base64"; | 215 LOG(ERROR) << "Keygen failed: Couldn't convert signed key into base64"; |
215 return std::string(); | 216 return std::string(); |
216 } | 217 } |
217 | 218 |
218 VLOG(1) << "Keygen succeeded"; | 219 VLOG(1) << "Keygen succeeded"; |
219 return result; | 220 return result; |
220 } | 221 } |
221 } | 222 } |
222 | 223 |
223 } // namespace net | 224 } // namespace net |
OLD | NEW |