Add some policy controls for VerifySignedData().

net/cert/internal/verify_signed_data.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_signed_data.h"
 
 #include "base/logging.h"
 
 // TODO(eroman): There is no intention to implement this for non-OpenSSL. Remove
 // this branch once the migration is complete. This could have been done as a
 // conditional file (_openssl.cc) in the build file instead, but that is likely
 // not worth the effort at this point.
 
 #if !defined(USE_OPENSSL)
 
 namespace net {
 
 bool VerifySignedData(const SignatureAlgorithm& signature_algorithm,
                       const der::Input& signed_data,
                       const der::Input& signature_value_bit_string,
-                      const der::Input& public_key) {
+                      const der::Input& public_key,
+                      const SignaturePolicy* policy) {
   NOTIMPLEMENTED();
   return false;
 }
 
 }  // namespace net
 
 #else
 
 #include <openssl/digest.h>
 #include <openssl/ec.h>
 #include <openssl/ec_key.h>
 #include <openssl/evp.h>
 #include <openssl/rsa.h>
 #include <openssl/x509.h>
 
 #include "base/compiler_specific.h"
 #include "crypto/openssl_util.h"
 #include "crypto/scoped_openssl_types.h"
 #include "net/cert/internal/signature_algorithm.h"
+#include "net/cert/internal/signature_policy.h"
 #include "net/der/input.h"
 #include "net/der/parser.h"
 
 namespace net {
 
 namespace {
 
 // Converts a DigestAlgorithm to an equivalent EVP_MD*.
 WARN_UNUSED_RESULT bool GetDigest(DigestAlgorithm digest, const EVP_MD** out) {
   *out = nullptr;
@@ skipping 102 matching lines @@
 // COMPATIBILITY NOTE: RFC 5912 and RFC 3279 are in disagreement on the value
 // of parameters for rsaEncryption. Whereas RFC 5912 says they must be absent,
 // RFC 3279 says they must be NULL:
 //
 //     The rsaEncryption OID is intended to be used in the algorithm field
 //     of a value of type AlgorithmIdentifier.  The parameters field MUST
 //     have ASN.1 type NULL for this algorithm identifier.
 //
 // Following RFC 3279 in this case.
 WARN_UNUSED_RESULT bool ParseRsaKeyFromSpki(const der::Input& public_key_spki,
-                                            crypto::ScopedEVP_PKEY* pkey) {
-  return ImportPkeyFromSpki(public_key_spki, EVP_PKEY_RSA, pkey);
+                                            crypto::ScopedEVP_PKEY* pkey,
+                                            const SignaturePolicy* policy) {
+  if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_RSA, pkey))
+    return false;
+
+  // Extract the modulus length from the key.
+  crypto::ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey->get()));
+  if (!rsa.get())
+    return false;
+  unsigned int modulus_length_bits = BN_num_bits(rsa.get()->n);

[Ryan Sleevi, 2015/08/01 01:42:50]

ScopedRSA is just a ScopedOpenSSL aka a scoped_ptr

So shouldn't this just be

BN_num_bits(rsa->n);

[eroman, 2015/08/01 02:20:44]

Done (copy paste sloppyiness)

+
+  return policy->IsAcceptableModulusLengthForRsa(modulus_length_bits);
 }
 
 // Does signature verification using either RSA or ECDSA.
 //
 // Note that the |signature_value| input is expected to be a byte string (and
 // not a DER-encoded BIT STRING)
 WARN_UNUSED_RESULT bool DoVerify(const SignatureAlgorithm& algorithm,
                                  const der::Input& signed_data,
                                  const der::Input& signature_value,
                                  EVP_PKEY* public_key) {
@@ skipping 21 matching lines @@
 
   if (!EVP_DigestVerifyUpdate(ctx.get(), signed_data.UnsafeData(),
                               signed_data.Length())) {
     return false;
   }
 
   return 1 == EVP_DigestVerifyFinal(ctx.get(), signature_value.UnsafeData(),
                                     signature_value.Length());
 }
 
-// Returns true if the given curve is allowed for ECDSA. The input is a
-// BoringSSL NID.
-//
-// TODO(eroman): Extract policy decisions such as allowed curves, hashes, RSA
-// modulus size, to somewhere more central.
-WARN_UNUSED_RESULT bool IsAllowedCurveName(int curve_nid) {
-  switch (curve_nid) {
-    case NID_X9_62_prime256v1:
-    case NID_secp384r1:
-    case NID_secp521r1:
-      return true;
-  }
-  return false;
-}
-
 // Parses an EC public key from SPKI to an EVP_PKEY.
 //
 // Returns true on success.
 //
 // RFC 5912 describes all the ECDSA signature algorithms as requiring a public
 // key of type "pk-ec":
 //
 //     pk-ec PUBLIC-KEY ::= {
 //      IDENTIFIER id-ecPublicKey
 //      KEY ECPoint
@@ skipping 25 matching lines @@
 //
 //     NamedCurve CURVE ::= {
 //     { ID secp192r1 } | { ID sect163k1 } | { ID sect163r2 } |
 //     { ID secp224r1 } | { ID sect233k1 } | { ID sect233r1 } |
 //     { ID secp256r1 } | { ID sect283k1 } | { ID sect283r1 } |
 //     { ID secp384r1 } | { ID sect409k1 } | { ID sect409r1 } |
 //     { ID secp521r1 } | { ID sect571k1 } | { ID sect571r1 },
 //     ... -- Extensible
 //     }
 WARN_UNUSED_RESULT bool ParseEcKeyFromSpki(const der::Input& public_key_spki,
-                                           crypto::ScopedEVP_PKEY* pkey) {
+                                           crypto::ScopedEVP_PKEY* pkey,
+                                           const SignaturePolicy* policy) {
   if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_EC, pkey))
     return false;
 
-  // Enforce policy on allowed curves in case ImportPkeyFromSpki() were to
-  // recognize and allow use of a weak curve.
+  // Extract the curve name.
   crypto::ScopedEC_KEY ec(EVP_PKEY_get1_EC_KEY(pkey->get()));
   if (!ec.get())
     return false;  // Unexpected.
+  int curve_nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec.get()));
 
-  int curve_nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec.get()));
-  return IsAllowedCurveName(curve_nid);
+  return policy->IsAcceptableCurveForEcdsa(curve_nid);
 }
 
 }  // namespace
 
 bool VerifySignedData(const SignatureAlgorithm& signature_algorithm,
                       const der::Input& signed_data,
                       const der::Input& signature_value_bit_string,
-                      const der::Input& public_key_spki) {
+                      const der::Input& public_key_spki,
+                      const SignaturePolicy* policy) {
+  if (!policy->IsAcceptableSignatureAlgorithm(signature_algorithm))
+    return false;
+
   crypto::ScopedEVP_PKEY public_key;
 
   // Parse the SPKI to an EVP_PKEY appropriate for the signature algorithm.
   switch (signature_algorithm.algorithm()) {
     case SignatureAlgorithmId::RsaPkcs1:
     case SignatureAlgorithmId::RsaPss:
-      if (!ParseRsaKeyFromSpki(public_key_spki, &public_key))
+      if (!ParseRsaKeyFromSpki(public_key_spki, &public_key, policy))
         return false;
       break;
     case SignatureAlgorithmId::Ecdsa:
-      if (!ParseEcKeyFromSpki(public_key_spki, &public_key))
+      if (!ParseEcKeyFromSpki(public_key_spki, &public_key, policy))
         return false;
       break;
   }
 
   // Extract the bytes of the signature_value. Assume that the BIT STRING has
   // no unused bits (in other words, is a multiple of 8 bits), since that is the
   // case for all of the currently supported algorithms.
   der::Input signature_value;
   der::Parser parser(signature_value_bit_string);
   if (!parser.ReadBitStringNoUnusedBits(&signature_value))
     return false;
   // By definition signature_value_bit_string must be a single BIT STRING.
   if (parser.HasMore())
     return false;
 
   return DoVerify(signature_algorithm, signed_data, signature_value,
                   public_key.get());
 }
 
 }  // namespace net
 
 #endif