OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/quic/crypto/proof_verifier_chromium.h" | 5 #include "net/quic/crypto/proof_verifier_chromium.h" |
6 | 6 |
7 #include "base/bind.h" | 7 #include "base/bind.h" |
8 #include "base/bind_helpers.h" | 8 #include "base/bind_helpers.h" |
9 #include "base/callback_helpers.h" | 9 #include "base/callback_helpers.h" |
10 #include "base/compiler_specific.h" | 10 #include "base/compiler_specific.h" |
11 #include "base/logging.h" | 11 #include "base/logging.h" |
| 12 #include "base/macros.h" |
12 #include "base/metrics/histogram_macros.h" | 13 #include "base/metrics/histogram_macros.h" |
13 #include "base/stl_util.h" | 14 #include "base/stl_util.h" |
14 #include "base/strings/stringprintf.h" | 15 #include "base/strings/stringprintf.h" |
15 #include "crypto/signature_verifier.h" | 16 #include "crypto/signature_verifier.h" |
16 #include "net/base/host_port_pair.h" | 17 #include "net/base/host_port_pair.h" |
17 #include "net/base/net_errors.h" | 18 #include "net/base/net_errors.h" |
18 #include "net/cert/asn1_util.h" | 19 #include "net/cert/asn1_util.h" |
19 #include "net/cert/cert_policy_enforcer.h" | 20 #include "net/cert/cert_policy_enforcer.h" |
20 #include "net/cert/cert_status_flags.h" | 21 #include "net/cert/cert_status_flags.h" |
21 #include "net/cert/cert_verifier.h" | 22 #include "net/cert/cert_verifier.h" |
(...skipping 297 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
319 X509Certificate::PublicKeyType type; | 320 X509Certificate::PublicKeyType type; |
320 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, &type); | 321 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, &type); |
321 if (type == X509Certificate::kPublicKeyTypeRSA) { | 322 if (type == X509Certificate::kPublicKeyTypeRSA) { |
322 crypto::SignatureVerifier::HashAlgorithm hash_alg = | 323 crypto::SignatureVerifier::HashAlgorithm hash_alg = |
323 crypto::SignatureVerifier::SHA256; | 324 crypto::SignatureVerifier::SHA256; |
324 crypto::SignatureVerifier::HashAlgorithm mask_hash_alg = hash_alg; | 325 crypto::SignatureVerifier::HashAlgorithm mask_hash_alg = hash_alg; |
325 unsigned int hash_len = 32; // 32 is the length of a SHA-256 hash. | 326 unsigned int hash_len = 32; // 32 is the length of a SHA-256 hash. |
326 | 327 |
327 bool ok = verifier.VerifyInitRSAPSS( | 328 bool ok = verifier.VerifyInitRSAPSS( |
328 hash_alg, mask_hash_alg, hash_len, | 329 hash_alg, mask_hash_alg, hash_len, |
329 reinterpret_cast<const uint8*>(signature.data()), signature.size(), | 330 reinterpret_cast<const uint8_t*>(signature.data()), signature.size(), |
330 reinterpret_cast<const uint8*>(spki.data()), spki.size()); | 331 reinterpret_cast<const uint8_t*>(spki.data()), spki.size()); |
331 if (!ok) { | 332 if (!ok) { |
332 DLOG(WARNING) << "VerifyInitRSAPSS failed"; | 333 DLOG(WARNING) << "VerifyInitRSAPSS failed"; |
333 return false; | 334 return false; |
334 } | 335 } |
335 } else if (type == X509Certificate::kPublicKeyTypeECDSA) { | 336 } else if (type == X509Certificate::kPublicKeyTypeECDSA) { |
336 // This is the algorithm ID for ECDSA with SHA-256. Parameters are ABSENT. | 337 // This is the algorithm ID for ECDSA with SHA-256. Parameters are ABSENT. |
337 // RFC 5758: | 338 // RFC 5758: |
338 // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) | 339 // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) |
339 // us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } | 340 // us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } |
340 // ... | 341 // ... |
341 // When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or | 342 // When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or |
342 // ecdsa-with-SHA512 algorithm identifier appears in the algorithm field | 343 // ecdsa-with-SHA512 algorithm identifier appears in the algorithm field |
343 // as an AlgorithmIdentifier, the encoding MUST omit the parameters | 344 // as an AlgorithmIdentifier, the encoding MUST omit the parameters |
344 // field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one | 345 // field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one |
345 // component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with- | 346 // component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with- |
346 // SHA384, or ecdsa-with-SHA512. | 347 // SHA384, or ecdsa-with-SHA512. |
347 // See also RFC 5480, Appendix A. | 348 // See also RFC 5480, Appendix A. |
348 static const uint8 kECDSAWithSHA256AlgorithmID[] = { | 349 static const uint8_t kECDSAWithSHA256AlgorithmID[] = { |
349 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, | 350 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, |
350 }; | 351 }; |
351 | 352 |
352 if (!verifier.VerifyInit( | 353 if (!verifier.VerifyInit( |
353 kECDSAWithSHA256AlgorithmID, sizeof(kECDSAWithSHA256AlgorithmID), | 354 kECDSAWithSHA256AlgorithmID, sizeof(kECDSAWithSHA256AlgorithmID), |
354 reinterpret_cast<const uint8*>(signature.data()), signature.size(), | 355 reinterpret_cast<const uint8_t*>(signature.data()), |
355 reinterpret_cast<const uint8*>(spki.data()), spki.size())) { | 356 signature.size(), reinterpret_cast<const uint8_t*>(spki.data()), |
| 357 spki.size())) { |
356 DLOG(WARNING) << "VerifyInit failed"; | 358 DLOG(WARNING) << "VerifyInit failed"; |
357 return false; | 359 return false; |
358 } | 360 } |
359 } else { | 361 } else { |
360 LOG(ERROR) << "Unsupported public key type " << type; | 362 LOG(ERROR) << "Unsupported public key type " << type; |
361 return false; | 363 return false; |
362 } | 364 } |
363 | 365 |
364 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(kProofSignatureLabel), | 366 verifier.VerifyUpdate(reinterpret_cast<const uint8_t*>(kProofSignatureLabel), |
365 sizeof(kProofSignatureLabel)); | 367 sizeof(kProofSignatureLabel)); |
366 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(signed_data.data()), | 368 verifier.VerifyUpdate(reinterpret_cast<const uint8_t*>(signed_data.data()), |
367 signed_data.size()); | 369 signed_data.size()); |
368 | 370 |
369 if (!verifier.VerifyFinal()) { | 371 if (!verifier.VerifyFinal()) { |
370 DLOG(WARNING) << "VerifyFinal failed"; | 372 DLOG(WARNING) << "VerifyFinal failed"; |
371 return false; | 373 return false; |
372 } | 374 } |
373 | 375 |
374 DVLOG(1) << "VerifyFinal success"; | 376 DVLOG(1) << "VerifyFinal success"; |
375 return true; | 377 return true; |
376 } | 378 } |
(...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
417 } | 419 } |
418 return status; | 420 return status; |
419 } | 421 } |
420 | 422 |
421 void ProofVerifierChromium::OnJobComplete(Job* job) { | 423 void ProofVerifierChromium::OnJobComplete(Job* job) { |
422 active_jobs_.erase(job); | 424 active_jobs_.erase(job); |
423 delete job; | 425 delete job; |
424 } | 426 } |
425 | 427 |
426 } // namespace net | 428 } // namespace net |
OLD | NEW |