| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/android/keystore_openssl.h" | 5 #include "net/android/keystore_openssl.h" |
| 6 | 6 |
| 7 #include <jni.h> | 7 #include <jni.h> |
| 8 #include <openssl/bn.h> | 8 #include <openssl/bn.h> |
| 9 #include <openssl/dsa.h> | 9 #include <openssl/dsa.h> |
| 10 #include <openssl/ec.h> | 10 #include <openssl/ec.h> |
| 11 #include <openssl/engine.h> | 11 #include <openssl/engine.h> |
| 12 #include <openssl/err.h> | 12 #include <openssl/err.h> |
| 13 #include <openssl/evp.h> | 13 #include <openssl/evp.h> |
| 14 #include <openssl/rsa.h> | 14 #include <openssl/rsa.h> |
| 15 #include <openssl/x509.h> | 15 #include <openssl/x509.h> |
| 16 #include <stdint.h> |
| 16 | 17 |
| 17 #include "base/android/build_info.h" | 18 #include "base/android/build_info.h" |
| 18 #include "base/android/jni_android.h" | 19 #include "base/android/jni_android.h" |
| 19 #include "base/android/scoped_java_ref.h" | 20 #include "base/android/scoped_java_ref.h" |
| 20 #include "base/basictypes.h" | |
| 21 #include "base/lazy_instance.h" | 21 #include "base/lazy_instance.h" |
| 22 #include "base/logging.h" | 22 #include "base/logging.h" |
| 23 #include "crypto/openssl_util.h" | 23 #include "crypto/openssl_util.h" |
| 24 #include "net/android/keystore.h" | 24 #include "net/android/keystore.h" |
| 25 #include "net/android/legacy_openssl.h" | 25 #include "net/android/legacy_openssl.h" |
| 26 #include "net/ssl/scoped_openssl_types.h" | 26 #include "net/ssl/scoped_openssl_types.h" |
| 27 #include "net/ssl/ssl_client_cert_type.h" | 27 #include "net/ssl/ssl_client_cert_type.h" |
| 28 | 28 |
| 29 // IMPORTANT NOTE: The following code will currently only work when used | 29 // IMPORTANT NOTE: The following code will currently only work when used |
| 30 // to implement client certificate support with OpenSSL. That's because | 30 // to implement client certificate support with OpenSSL. That's because |
| (...skipping 114 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 145 const int ec_key_index_; | 145 const int ec_key_index_; |
| 146 ENGINE* const engine_; | 146 ENGINE* const engine_; |
| 147 }; | 147 }; |
| 148 | 148 |
| 149 base::LazyInstance<BoringSSLEngine>::Leaky global_boringssl_engine = | 149 base::LazyInstance<BoringSSLEngine>::Leaky global_boringssl_engine = |
| 150 LAZY_INSTANCE_INITIALIZER; | 150 LAZY_INSTANCE_INITIALIZER; |
| 151 | 151 |
| 152 | 152 |
| 153 // VectorBignumSize returns the number of bytes needed to represent the bignum | 153 // VectorBignumSize returns the number of bytes needed to represent the bignum |
| 154 // given in |v|, i.e. the length of |v| less any leading zero bytes. | 154 // given in |v|, i.e. the length of |v| less any leading zero bytes. |
| 155 size_t VectorBignumSize(const std::vector<uint8>& v) { | 155 size_t VectorBignumSize(const std::vector<uint8_t>& v) { |
| 156 size_t size = v.size(); | 156 size_t size = v.size(); |
| 157 // Ignore any leading zero bytes. | 157 // Ignore any leading zero bytes. |
| 158 for (size_t i = 0; i < v.size() && v[i] == 0; i++) { | 158 for (size_t i = 0; i < v.size() && v[i] == 0; i++) { |
| 159 size--; | 159 size--; |
| 160 } | 160 } |
| 161 return size; | 161 return size; |
| 162 } | 162 } |
| 163 | 163 |
| 164 KeyExData* RsaGetExData(const RSA* rsa) { | 164 KeyExData* RsaGetExData(const RSA* rsa) { |
| 165 return reinterpret_cast<KeyExData*>( | 165 return reinterpret_cast<KeyExData*>( |
| (...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 225 // through Java, it's difficult to get a handle on a system OpenSSL | 225 // through Java, it's difficult to get a handle on a system OpenSSL |
| 226 // function; dlopen loads a second copy.) | 226 // function; dlopen loads a second copy.) |
| 227 OPENSSL_PUT_ERROR(RSA, sign_raw, ERR_R_INTERNAL_ERROR); | 227 OPENSSL_PUT_ERROR(RSA, sign_raw, ERR_R_INTERNAL_ERROR); |
| 228 return 0; | 228 return 0; |
| 229 } | 229 } |
| 230 *out_len = ret; | 230 *out_len = ret; |
| 231 return 1; | 231 return 1; |
| 232 } | 232 } |
| 233 | 233 |
| 234 base::StringPiece from_piece(reinterpret_cast<const char*>(in), in_len); | 234 base::StringPiece from_piece(reinterpret_cast<const char*>(in), in_len); |
| 235 std::vector<uint8> result; | 235 std::vector<uint8_t> result; |
| 236 // For RSA keys, this function behaves as RSA_private_encrypt with | 236 // For RSA keys, this function behaves as RSA_private_encrypt with |
| 237 // PKCS#1 padding. | 237 // PKCS#1 padding. |
| 238 if (!RawSignDigestWithPrivateKey(ex_data->private_key, from_piece, &result)) { | 238 if (!RawSignDigestWithPrivateKey(ex_data->private_key, from_piece, &result)) { |
| 239 LOG(WARNING) << "Could not sign message in RsaMethodSignRaw!"; | 239 LOG(WARNING) << "Could not sign message in RsaMethodSignRaw!"; |
| 240 OPENSSL_PUT_ERROR(RSA, sign_raw, ERR_R_INTERNAL_ERROR); | 240 OPENSSL_PUT_ERROR(RSA, sign_raw, ERR_R_INTERNAL_ERROR); |
| 241 return 0; | 241 return 0; |
| 242 } | 242 } |
| 243 | 243 |
| 244 size_t expected_size = static_cast<size_t>(RSA_size(rsa)); | 244 size_t expected_size = static_cast<size_t>(RSA_size(rsa)); |
| 245 if (result.size() > expected_size) { | 245 if (result.size() > expected_size) { |
| (...skipping 81 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 327 crypto::ScopedRSA rsa( | 327 crypto::ScopedRSA rsa( |
| 328 RSA_new_method(global_boringssl_engine.Get().engine())); | 328 RSA_new_method(global_boringssl_engine.Get().engine())); |
| 329 | 329 |
| 330 ScopedJavaGlobalRef<jobject> global_key; | 330 ScopedJavaGlobalRef<jobject> global_key; |
| 331 global_key.Reset(NULL, private_key); | 331 global_key.Reset(NULL, private_key); |
| 332 if (global_key.is_null()) { | 332 if (global_key.is_null()) { |
| 333 LOG(ERROR) << "Could not create global JNI reference"; | 333 LOG(ERROR) << "Could not create global JNI reference"; |
| 334 return crypto::ScopedEVP_PKEY(); | 334 return crypto::ScopedEVP_PKEY(); |
| 335 } | 335 } |
| 336 | 336 |
| 337 std::vector<uint8> modulus; | 337 std::vector<uint8_t> modulus; |
| 338 if (!GetRSAKeyModulus(private_key, &modulus)) { | 338 if (!GetRSAKeyModulus(private_key, &modulus)) { |
| 339 LOG(ERROR) << "Failed to get private key modulus"; | 339 LOG(ERROR) << "Failed to get private key modulus"; |
| 340 return crypto::ScopedEVP_PKEY(); | 340 return crypto::ScopedEVP_PKEY(); |
| 341 } | 341 } |
| 342 | 342 |
| 343 KeyExData* ex_data = new KeyExData; | 343 KeyExData* ex_data = new KeyExData; |
| 344 ex_data->private_key = global_key.Release(); | 344 ex_data->private_key = global_key.Release(); |
| 345 ex_data->legacy_rsa = legacy_rsa; | 345 ex_data->legacy_rsa = legacy_rsa; |
| 346 ex_data->cached_size = VectorBignumSize(modulus); | 346 ex_data->cached_size = VectorBignumSize(modulus); |
| 347 RSA_set_ex_data( | 347 RSA_set_ex_data( |
| (...skipping 124 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 472 uint8_t* sig, | 472 uint8_t* sig, |
| 473 unsigned int* sig_len, | 473 unsigned int* sig_len, |
| 474 EC_KEY* ec_key) { | 474 EC_KEY* ec_key) { |
| 475 // Retrieve private key JNI reference. | 475 // Retrieve private key JNI reference. |
| 476 jobject private_key = EcKeyGetKey(ec_key); | 476 jobject private_key = EcKeyGetKey(ec_key); |
| 477 if (!private_key) { | 477 if (!private_key) { |
| 478 LOG(WARNING) << "Null JNI reference passed to EcdsaMethodSign!"; | 478 LOG(WARNING) << "Null JNI reference passed to EcdsaMethodSign!"; |
| 479 return 0; | 479 return 0; |
| 480 } | 480 } |
| 481 // Sign message with it through JNI. | 481 // Sign message with it through JNI. |
| 482 std::vector<uint8> signature; | 482 std::vector<uint8_t> signature; |
| 483 base::StringPiece digest_sp(reinterpret_cast<const char*>(digest), | 483 base::StringPiece digest_sp(reinterpret_cast<const char*>(digest), |
| 484 digest_len); | 484 digest_len); |
| 485 if (!RawSignDigestWithPrivateKey(private_key, digest_sp, &signature)) { | 485 if (!RawSignDigestWithPrivateKey(private_key, digest_sp, &signature)) { |
| 486 LOG(WARNING) << "Could not sign message in EcdsaMethodSign!"; | 486 LOG(WARNING) << "Could not sign message in EcdsaMethodSign!"; |
| 487 return 0; | 487 return 0; |
| 488 } | 488 } |
| 489 | 489 |
| 490 // Note: With ECDSA, the actual signature may be smaller than | 490 // Note: With ECDSA, the actual signature may be smaller than |
| 491 // ECDSA_size(). | 491 // ECDSA_size(). |
| 492 size_t max_expected_size = ECDSA_size(ec_key); | 492 size_t max_expected_size = ECDSA_size(ec_key); |
| (...skipping 30 matching lines...) Expand all Loading... |
| 523 crypto::ScopedEC_KEY ec_key( | 523 crypto::ScopedEC_KEY ec_key( |
| 524 EC_KEY_new_method(global_boringssl_engine.Get().engine())); | 524 EC_KEY_new_method(global_boringssl_engine.Get().engine())); |
| 525 | 525 |
| 526 ScopedJavaGlobalRef<jobject> global_key; | 526 ScopedJavaGlobalRef<jobject> global_key; |
| 527 global_key.Reset(NULL, private_key); | 527 global_key.Reset(NULL, private_key); |
| 528 if (global_key.is_null()) { | 528 if (global_key.is_null()) { |
| 529 LOG(ERROR) << "Can't create global JNI reference"; | 529 LOG(ERROR) << "Can't create global JNI reference"; |
| 530 return crypto::ScopedEVP_PKEY(); | 530 return crypto::ScopedEVP_PKEY(); |
| 531 } | 531 } |
| 532 | 532 |
| 533 std::vector<uint8> order; | 533 std::vector<uint8_t> order; |
| 534 if (!GetECKeyOrder(private_key, &order)) { | 534 if (!GetECKeyOrder(private_key, &order)) { |
| 535 LOG(ERROR) << "Can't extract order parameter from EC private key"; | 535 LOG(ERROR) << "Can't extract order parameter from EC private key"; |
| 536 return crypto::ScopedEVP_PKEY(); | 536 return crypto::ScopedEVP_PKEY(); |
| 537 } | 537 } |
| 538 | 538 |
| 539 KeyExData* ex_data = new KeyExData; | 539 KeyExData* ex_data = new KeyExData; |
| 540 ex_data->private_key = global_key.Release(); | 540 ex_data->private_key = global_key.Release(); |
| 541 ex_data->legacy_rsa = NULL; | 541 ex_data->legacy_rsa = NULL; |
| 542 ex_data->cached_size = VectorBignumSize(order); | 542 ex_data->cached_size = VectorBignumSize(order); |
| 543 | 543 |
| (...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 579 return GetEcdsaPkeyWrapper(private_key); | 579 return GetEcdsaPkeyWrapper(private_key); |
| 580 default: | 580 default: |
| 581 LOG(WARNING) | 581 LOG(WARNING) |
| 582 << "GetOpenSSLPrivateKeyWrapper() called with invalid key type"; | 582 << "GetOpenSSLPrivateKeyWrapper() called with invalid key type"; |
| 583 return nullptr; | 583 return nullptr; |
| 584 } | 584 } |
| 585 } | 585 } |
| 586 | 586 |
| 587 } // namespace android | 587 } // namespace android |
| 588 } // namespace net | 588 } // namespace net |
| OLD | NEW |