OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <secerr.h> | 5 #include <secerr.h> |
6 | 6 |
7 #include "base/numerics/safe_math.h" | 7 #include "base/numerics/safe_math.h" |
8 #include "content/child/webcrypto/crypto_data.h" | 8 #include "content/child/webcrypto/crypto_data.h" |
9 #include "content/child/webcrypto/nss/aes_algorithm_nss.h" | 9 #include "content/child/webcrypto/nss/aes_algorithm_nss.h" |
10 #include "content/child/webcrypto/nss/key_nss.h" | 10 #include "content/child/webcrypto/nss/key_nss.h" |
(...skipping 30 matching lines...) Expand all Loading... |
41 crypto::ScopedSECItem param_item( | 41 crypto::ScopedSECItem param_item( |
42 PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP, &iv_item)); | 42 PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP, &iv_item)); |
43 if (!param_item) | 43 if (!param_item) |
44 return Status::ErrorUnexpected(); | 44 return Status::ErrorUnexpected(); |
45 | 45 |
46 SECItem cipher_text = MakeSECItemForBuffer(wrapped_key_data); | 46 SECItem cipher_text = MakeSECItemForBuffer(wrapped_key_data); |
47 | 47 |
48 // The plaintext length is always 64 bits less than the data size. | 48 // The plaintext length is always 64 bits less than the data size. |
49 const unsigned int plaintext_length = wrapped_key_data.byte_length() - 8; | 49 const unsigned int plaintext_length = wrapped_key_data.byte_length() - 8; |
50 | 50 |
51 #if defined(USE_NSS) | 51 #if defined(USE_NSS_CERTS) |
52 // Part of workaround for | 52 // Part of workaround for |
53 // https://bugzilla.mozilla.org/show_bug.cgi?id=981170. See the explanation | 53 // https://bugzilla.mozilla.org/show_bug.cgi?id=981170. See the explanation |
54 // later in this function. | 54 // later in this function. |
55 PORT_SetError(0); | 55 PORT_SetError(0); |
56 #endif | 56 #endif |
57 | 57 |
58 crypto::ScopedPK11SymKey new_key(PK11_UnwrapSymKeyWithFlags( | 58 crypto::ScopedPK11SymKey new_key(PK11_UnwrapSymKeyWithFlags( |
59 wrapping_key, CKM_NSS_AES_KEY_WRAP, param_item.get(), &cipher_text, | 59 wrapping_key, CKM_NSS_AES_KEY_WRAP, param_item.get(), &cipher_text, |
60 mechanism, CKA_FLAGS_ONLY, plaintext_length, flags)); | 60 mechanism, CKA_FLAGS_ONLY, plaintext_length, flags)); |
61 | 61 |
62 // TODO(padolph): Use NSS PORT_GetError() and friends to report a more | 62 // TODO(padolph): Use NSS PORT_GetError() and friends to report a more |
63 // accurate error, providing if doesn't leak any information to web pages | 63 // accurate error, providing if doesn't leak any information to web pages |
64 // about other web crypto users, key details, etc. | 64 // about other web crypto users, key details, etc. |
65 if (!new_key) | 65 if (!new_key) |
66 return Status::OperationError(); | 66 return Status::OperationError(); |
67 | 67 |
68 #if defined(USE_NSS) | 68 #if defined(USE_NSS_CERTS) |
69 // Workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=981170 | 69 // Workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=981170 |
70 // which was fixed in NSS 3.16.0. | 70 // which was fixed in NSS 3.16.0. |
71 // If unwrap fails, NSS nevertheless returns a valid-looking PK11SymKey, | 71 // If unwrap fails, NSS nevertheless returns a valid-looking PK11SymKey, |
72 // with a reasonable length but with key data pointing to uninitialized | 72 // with a reasonable length but with key data pointing to uninitialized |
73 // memory. | 73 // memory. |
74 // To understand this workaround see the fix for 981170: | 74 // To understand this workaround see the fix for 981170: |
75 // https://hg.mozilla.org/projects/nss/rev/753bb69e543c | 75 // https://hg.mozilla.org/projects/nss/rev/753bb69e543c |
76 if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA) | 76 if (!NSS_VersionCheck("3.16") && PORT_GetError() == SEC_ERROR_BAD_DATA) |
77 return Status::OperationError(); | 77 return Status::OperationError(); |
78 #endif | 78 #endif |
(...skipping 102 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
181 | 181 |
182 } // namespace | 182 } // namespace |
183 | 183 |
184 AlgorithmImplementation* CreatePlatformAesKwImplementation() { | 184 AlgorithmImplementation* CreatePlatformAesKwImplementation() { |
185 return new AesKwCryptoAlgorithmNss; | 185 return new AesKwCryptoAlgorithmNss; |
186 } | 186 } |
187 | 187 |
188 } // namespace webcrypto | 188 } // namespace webcrypto |
189 | 189 |
190 } // namespace content | 190 } // namespace content |
OLD | NEW |