OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/android/keystore_openssl.h" | 5 #include "net/android/keystore_openssl.h" |
6 | 6 |
7 #include <jni.h> | 7 #include <jni.h> |
8 #include <openssl/bn.h> | 8 #include <openssl/bn.h> |
9 #include <openssl/dsa.h> | 9 #include <openssl/dsa.h> |
10 #include <openssl/ec.h> | 10 #include <openssl/ec.h> |
11 #include <openssl/engine.h> | 11 #include <openssl/engine.h> |
12 #include <openssl/err.h> | 12 #include <openssl/err.h> |
13 #include <openssl/evp.h> | 13 #include <openssl/evp.h> |
14 #include <openssl/rsa.h> | 14 #include <openssl/rsa.h> |
15 #include <openssl/x509.h> | 15 #include <openssl/x509.h> |
| 16 #include <stdint.h> |
16 | 17 |
17 #include "base/android/build_info.h" | 18 #include "base/android/build_info.h" |
18 #include "base/android/jni_android.h" | 19 #include "base/android/jni_android.h" |
19 #include "base/android/scoped_java_ref.h" | 20 #include "base/android/scoped_java_ref.h" |
20 #include "base/basictypes.h" | |
21 #include "base/lazy_instance.h" | 21 #include "base/lazy_instance.h" |
22 #include "base/logging.h" | 22 #include "base/logging.h" |
23 #include "crypto/openssl_util.h" | 23 #include "crypto/openssl_util.h" |
24 #include "net/android/keystore.h" | 24 #include "net/android/keystore.h" |
25 #include "net/android/legacy_openssl.h" | 25 #include "net/android/legacy_openssl.h" |
26 #include "net/ssl/scoped_openssl_types.h" | 26 #include "net/ssl/scoped_openssl_types.h" |
27 #include "net/ssl/ssl_client_cert_type.h" | 27 #include "net/ssl/ssl_client_cert_type.h" |
28 | 28 |
29 // IMPORTANT NOTE: The following code will currently only work when used | 29 // IMPORTANT NOTE: The following code will currently only work when used |
30 // to implement client certificate support with OpenSSL. That's because | 30 // to implement client certificate support with OpenSSL. That's because |
(...skipping 114 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
145 const int ec_key_index_; | 145 const int ec_key_index_; |
146 ENGINE* const engine_; | 146 ENGINE* const engine_; |
147 }; | 147 }; |
148 | 148 |
149 base::LazyInstance<BoringSSLEngine>::Leaky global_boringssl_engine = | 149 base::LazyInstance<BoringSSLEngine>::Leaky global_boringssl_engine = |
150 LAZY_INSTANCE_INITIALIZER; | 150 LAZY_INSTANCE_INITIALIZER; |
151 | 151 |
152 | 152 |
153 // VectorBignumSize returns the number of bytes needed to represent the bignum | 153 // VectorBignumSize returns the number of bytes needed to represent the bignum |
154 // given in |v|, i.e. the length of |v| less any leading zero bytes. | 154 // given in |v|, i.e. the length of |v| less any leading zero bytes. |
155 size_t VectorBignumSize(const std::vector<uint8>& v) { | 155 size_t VectorBignumSize(const std::vector<uint8_t>& v) { |
156 size_t size = v.size(); | 156 size_t size = v.size(); |
157 // Ignore any leading zero bytes. | 157 // Ignore any leading zero bytes. |
158 for (size_t i = 0; i < v.size() && v[i] == 0; i++) { | 158 for (size_t i = 0; i < v.size() && v[i] == 0; i++) { |
159 size--; | 159 size--; |
160 } | 160 } |
161 return size; | 161 return size; |
162 } | 162 } |
163 | 163 |
164 KeyExData* RsaGetExData(const RSA* rsa) { | 164 KeyExData* RsaGetExData(const RSA* rsa) { |
165 return reinterpret_cast<KeyExData*>( | 165 return reinterpret_cast<KeyExData*>( |
(...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
225 // through Java, it's difficult to get a handle on a system OpenSSL | 225 // through Java, it's difficult to get a handle on a system OpenSSL |
226 // function; dlopen loads a second copy.) | 226 // function; dlopen loads a second copy.) |
227 OPENSSL_PUT_ERROR(RSA, sign_raw, ERR_R_INTERNAL_ERROR); | 227 OPENSSL_PUT_ERROR(RSA, sign_raw, ERR_R_INTERNAL_ERROR); |
228 return 0; | 228 return 0; |
229 } | 229 } |
230 *out_len = ret; | 230 *out_len = ret; |
231 return 1; | 231 return 1; |
232 } | 232 } |
233 | 233 |
234 base::StringPiece from_piece(reinterpret_cast<const char*>(in), in_len); | 234 base::StringPiece from_piece(reinterpret_cast<const char*>(in), in_len); |
235 std::vector<uint8> result; | 235 std::vector<uint8_t> result; |
236 // For RSA keys, this function behaves as RSA_private_encrypt with | 236 // For RSA keys, this function behaves as RSA_private_encrypt with |
237 // PKCS#1 padding. | 237 // PKCS#1 padding. |
238 if (!RawSignDigestWithPrivateKey(ex_data->private_key, from_piece, &result)) { | 238 if (!RawSignDigestWithPrivateKey(ex_data->private_key, from_piece, &result)) { |
239 LOG(WARNING) << "Could not sign message in RsaMethodSignRaw!"; | 239 LOG(WARNING) << "Could not sign message in RsaMethodSignRaw!"; |
240 OPENSSL_PUT_ERROR(RSA, sign_raw, ERR_R_INTERNAL_ERROR); | 240 OPENSSL_PUT_ERROR(RSA, sign_raw, ERR_R_INTERNAL_ERROR); |
241 return 0; | 241 return 0; |
242 } | 242 } |
243 | 243 |
244 size_t expected_size = static_cast<size_t>(RSA_size(rsa)); | 244 size_t expected_size = static_cast<size_t>(RSA_size(rsa)); |
245 if (result.size() > expected_size) { | 245 if (result.size() > expected_size) { |
(...skipping 81 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
327 crypto::ScopedRSA rsa( | 327 crypto::ScopedRSA rsa( |
328 RSA_new_method(global_boringssl_engine.Get().engine())); | 328 RSA_new_method(global_boringssl_engine.Get().engine())); |
329 | 329 |
330 ScopedJavaGlobalRef<jobject> global_key; | 330 ScopedJavaGlobalRef<jobject> global_key; |
331 global_key.Reset(NULL, private_key); | 331 global_key.Reset(NULL, private_key); |
332 if (global_key.is_null()) { | 332 if (global_key.is_null()) { |
333 LOG(ERROR) << "Could not create global JNI reference"; | 333 LOG(ERROR) << "Could not create global JNI reference"; |
334 return crypto::ScopedEVP_PKEY(); | 334 return crypto::ScopedEVP_PKEY(); |
335 } | 335 } |
336 | 336 |
337 std::vector<uint8> modulus; | 337 std::vector<uint8_t> modulus; |
338 if (!GetRSAKeyModulus(private_key, &modulus)) { | 338 if (!GetRSAKeyModulus(private_key, &modulus)) { |
339 LOG(ERROR) << "Failed to get private key modulus"; | 339 LOG(ERROR) << "Failed to get private key modulus"; |
340 return crypto::ScopedEVP_PKEY(); | 340 return crypto::ScopedEVP_PKEY(); |
341 } | 341 } |
342 | 342 |
343 KeyExData* ex_data = new KeyExData; | 343 KeyExData* ex_data = new KeyExData; |
344 ex_data->private_key = global_key.Release(); | 344 ex_data->private_key = global_key.Release(); |
345 ex_data->legacy_rsa = legacy_rsa; | 345 ex_data->legacy_rsa = legacy_rsa; |
346 ex_data->cached_size = VectorBignumSize(modulus); | 346 ex_data->cached_size = VectorBignumSize(modulus); |
347 RSA_set_ex_data( | 347 RSA_set_ex_data( |
(...skipping 124 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
472 uint8_t* sig, | 472 uint8_t* sig, |
473 unsigned int* sig_len, | 473 unsigned int* sig_len, |
474 EC_KEY* ec_key) { | 474 EC_KEY* ec_key) { |
475 // Retrieve private key JNI reference. | 475 // Retrieve private key JNI reference. |
476 jobject private_key = EcKeyGetKey(ec_key); | 476 jobject private_key = EcKeyGetKey(ec_key); |
477 if (!private_key) { | 477 if (!private_key) { |
478 LOG(WARNING) << "Null JNI reference passed to EcdsaMethodSign!"; | 478 LOG(WARNING) << "Null JNI reference passed to EcdsaMethodSign!"; |
479 return 0; | 479 return 0; |
480 } | 480 } |
481 // Sign message with it through JNI. | 481 // Sign message with it through JNI. |
482 std::vector<uint8> signature; | 482 std::vector<uint8_t> signature; |
483 base::StringPiece digest_sp(reinterpret_cast<const char*>(digest), | 483 base::StringPiece digest_sp(reinterpret_cast<const char*>(digest), |
484 digest_len); | 484 digest_len); |
485 if (!RawSignDigestWithPrivateKey(private_key, digest_sp, &signature)) { | 485 if (!RawSignDigestWithPrivateKey(private_key, digest_sp, &signature)) { |
486 LOG(WARNING) << "Could not sign message in EcdsaMethodSign!"; | 486 LOG(WARNING) << "Could not sign message in EcdsaMethodSign!"; |
487 return 0; | 487 return 0; |
488 } | 488 } |
489 | 489 |
490 // Note: With ECDSA, the actual signature may be smaller than | 490 // Note: With ECDSA, the actual signature may be smaller than |
491 // ECDSA_size(). | 491 // ECDSA_size(). |
492 size_t max_expected_size = ECDSA_size(ec_key); | 492 size_t max_expected_size = ECDSA_size(ec_key); |
(...skipping 30 matching lines...) Expand all Loading... |
523 crypto::ScopedEC_KEY ec_key( | 523 crypto::ScopedEC_KEY ec_key( |
524 EC_KEY_new_method(global_boringssl_engine.Get().engine())); | 524 EC_KEY_new_method(global_boringssl_engine.Get().engine())); |
525 | 525 |
526 ScopedJavaGlobalRef<jobject> global_key; | 526 ScopedJavaGlobalRef<jobject> global_key; |
527 global_key.Reset(NULL, private_key); | 527 global_key.Reset(NULL, private_key); |
528 if (global_key.is_null()) { | 528 if (global_key.is_null()) { |
529 LOG(ERROR) << "Can't create global JNI reference"; | 529 LOG(ERROR) << "Can't create global JNI reference"; |
530 return crypto::ScopedEVP_PKEY(); | 530 return crypto::ScopedEVP_PKEY(); |
531 } | 531 } |
532 | 532 |
533 std::vector<uint8> order; | 533 std::vector<uint8_t> order; |
534 if (!GetECKeyOrder(private_key, &order)) { | 534 if (!GetECKeyOrder(private_key, &order)) { |
535 LOG(ERROR) << "Can't extract order parameter from EC private key"; | 535 LOG(ERROR) << "Can't extract order parameter from EC private key"; |
536 return crypto::ScopedEVP_PKEY(); | 536 return crypto::ScopedEVP_PKEY(); |
537 } | 537 } |
538 | 538 |
539 KeyExData* ex_data = new KeyExData; | 539 KeyExData* ex_data = new KeyExData; |
540 ex_data->private_key = global_key.Release(); | 540 ex_data->private_key = global_key.Release(); |
541 ex_data->legacy_rsa = NULL; | 541 ex_data->legacy_rsa = NULL; |
542 ex_data->cached_size = VectorBignumSize(order); | 542 ex_data->cached_size = VectorBignumSize(order); |
543 | 543 |
(...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
579 return GetEcdsaPkeyWrapper(private_key); | 579 return GetEcdsaPkeyWrapper(private_key); |
580 default: | 580 default: |
581 LOG(WARNING) | 581 LOG(WARNING) |
582 << "GetOpenSSLPrivateKeyWrapper() called with invalid key type"; | 582 << "GetOpenSSLPrivateKeyWrapper() called with invalid key type"; |
583 return nullptr; | 583 return nullptr; |
584 } | 584 } |
585 } | 585 } |
586 | 586 |
587 } // namespace android | 587 } // namespace android |
588 } // namespace net | 588 } // namespace net |
OLD | NEW |