Certificate Transparency: Fetching of Signed Tree Heads (DRAFT)

net/cert/ct_log_verifier_openssl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/ct_log_verifier.h"
 
 #include <openssl/evp.h>
 #include <openssl/x509.h>
 
 #include "base/logging.h"
@@ skipping 29 matching lines @@
 
 }  // namespace
 
 CTLogVerifier::~CTLogVerifier() {
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 
   if (public_key_)
     EVP_PKEY_free(public_key_);
 }
 
+CTLogVerifier::CTLogVerifier(const CTLogVerifier& other)
+    : key_id_(other.key_id_),
+      description_(other.description_),
+      url_(url),
+      hash_algorithm_(other.hash_algorithm_),
+      signature_algorithm_(other.signature_algorithm_),
+      public_key_(NULL) {
+  // No direct function for copying EVP_PKEY: Serialize to PEM
+  // and de-serialize.
+  BIO* tbio = BIO_new(BIO_s_mem());
+
+  if (PEM_write_bio_PUBKEY(tbio, other.public_key) == 1) {
+    if (PEM_read_bio_PUBKEY(tbio, &public_key_, 0, 0) == 0) {
+      // Will fail VerifySignature later.
+      public_key_ = NULL;
+    }
+  }
+
+  BIO_free(tbio);
+}
+
 bool CTLogVerifier::Init(const base::StringPiece& public_key) {
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 
   const uint8_t* ptr = reinterpret_cast<const uint8_t*>(public_key.data());
   const uint8_t* end = ptr + public_key.size();
   public_key_ = d2i_PUBKEY(nullptr, &ptr, public_key.size());
   if (!public_key_ || ptr != end)
     return false;
 
   key_id_ = crypto::SHA256HashString(public_key);
@@ skipping 21 matching lines @@
     DVLOG(1) << "Too small a public key.";
     return false;
   }
 
   return true;
 }
 
 bool CTLogVerifier::VerifySignature(const base::StringPiece& data_to_sign,
                                     const base::StringPiece& signature) {
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
+  if (public_key_ == NULL) {

[Ryan Sleevi, 2015/06/29 11:58:13]

if (!public_key_)

+    return false;
+  }
 
   const EVP_MD* hash_alg = GetEvpAlg(hash_algorithm_);
   if (hash_alg == NULL)
     return false;
 
   EVP_MD_CTX ctx;
   EVP_MD_CTX_init(&ctx);
 
   bool ok = (
       1 == EVP_DigestVerifyInit(&ctx, NULL, hash_alg, NULL, public_key_) &&
       1 == EVP_DigestVerifyUpdate(
           &ctx, data_to_sign.data(), data_to_sign.size()) &&
       1 == EVP_DigestVerifyFinal(
           &ctx,
           reinterpret_cast<const uint8_t*>(signature.data()),
           signature.size()));
 
   EVP_MD_CTX_cleanup(&ctx);
   return ok;
 }
 
 }  // namespace net