Update Token Binding code to match latest draft draft-ietf-tokbind-protocol-04

net/ssl/token_binding_openssl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/token_binding.h"
 
 #include <openssl/bytestring.h>
 #include <openssl/ec.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
 
 #include "base/stl_util.h"
 #include "crypto/scoped_openssl_types.h"
 #include "net/base/net_errors.h"
 #include "net/ssl/ssl_config.h"
 
 namespace net {
 
 namespace {
 
 enum TokenBindingType {
   TB_TYPE_PROVIDED = 0,
   TB_TYPE_REFERRED = 1,
 };
 
-bool BuildTokenBindingID(TokenBindingType type,
-                         crypto::ECPrivateKey* key,
-                         CBB* out) {
+bool BuildTokenBindingID(crypto::ECPrivateKey* key, CBB* out) {
   CBB ec_point;
-  if (!CBB_add_u8(out, type) || !CBB_add_u8(out, TB_PARAM_ECDSAP256) ||
+  if (!CBB_add_u8(out, TB_PARAM_ECDSAP256) ||
       !CBB_add_u8_length_prefixed(out, &ec_point)) {
     return false;
   }
 
   EVP_PKEY* pkey = key->key();
   static const int kExpectedKeyLength = 65;
   uint8_t* buf;
   // TODO(nharper): Replace i2o_ECPublicKey with EC_POINT_point2cbb.
   if (pkey->type != EVP_PKEY_EC ||
       i2o_ECPublicKey(pkey->pkey.ec, nullptr) != kExpectedKeyLength ||
       !CBB_add_space(&ec_point, &buf, kExpectedKeyLength) ||
       i2o_ECPublicKey(pkey->pkey.ec, &buf) != kExpectedKeyLength ||
       !CBB_flush(out)) {
     return false;
   }
   return true;
 }
 
+Error BuildTokenBinding(TokenBindingType type,
+                        crypto::ECPrivateKey* key,
+                        const std::vector<uint8_t>& signed_ekm,
+                        std::string* out) {
+  uint8_t* out_data;
+  size_t out_len;
+  CBB token_binding;
+  if (!CBB_init(&token_binding, 0) || !CBB_add_u8(&token_binding, type) ||
+      !BuildTokenBindingID(key, &token_binding) ||
+      !CBB_add_u16(&token_binding, signed_ekm.size()) ||
+      !CBB_add_bytes(&token_binding, signed_ekm.data(), signed_ekm.size()) ||
+      // 0-length extensions
+      !CBB_add_u16(&token_binding, 0) ||
+      !CBB_finish(&token_binding, &out_data, &out_len)) {
+    CBB_cleanup(&token_binding);
+    return ERR_FAILED;
+  }
+  out->assign(reinterpret_cast<char*>(out_data), out_len);
+  OPENSSL_free(out_data);
+  return OK;
+}
+
 }  // namespace
 
 Error BuildTokenBindingMessageFromTokenBindings(
     const std::vector<base::StringPiece>& token_bindings,
     std::string* out) {
   CBB tb_message, child;
   if (!CBB_init(&tb_message, 0) ||
       !CBB_add_u16_length_prefixed(&tb_message, &child)) {
     CBB_cleanup(&tb_message);
     return ERR_FAILED;
@@ skipping 14 matching lines @@
     return ERR_FAILED;
   }
   out->assign(reinterpret_cast<char*>(out_data), out_len);
   OPENSSL_free(out_data);
   return OK;
 }
 
 Error BuildProvidedTokenBinding(crypto::ECPrivateKey* key,
                                 const std::vector<uint8_t>& signed_ekm,
                                 std::string* out) {
-  uint8_t* out_data;
-  size_t out_len;
-  CBB token_binding;
-  if (!CBB_init(&token_binding, 0) ||
-      !BuildTokenBindingID(TB_TYPE_PROVIDED, key, &token_binding) ||
-      !CBB_add_u16(&token_binding, signed_ekm.size()) ||
-      !CBB_add_bytes(&token_binding, signed_ekm.data(), signed_ekm.size()) ||
-      // 0-length extensions
-      !CBB_add_u16(&token_binding, 0) ||
-      !CBB_finish(&token_binding, &out_data, &out_len)) {
-    CBB_cleanup(&token_binding);
-    return ERR_FAILED;
-  }
-  out->assign(reinterpret_cast<char*>(out_data), out_len);
-  OPENSSL_free(out_data);
-  return OK;
+  return BuildTokenBinding(TB_TYPE_PROVIDED, key, signed_ekm, out);
 }
 
 bool ParseTokenBindingMessage(base::StringPiece token_binding_message,
                               base::StringPiece* ec_point_out,
                               base::StringPiece* signature_out) {
   CBS tb_message, tb, ec_point, signature;
   uint8_t tb_type, tb_param;
   CBS_init(&tb_message,
            reinterpret_cast<const uint8_t*>(token_binding_message.data()),
            token_binding_message.size());
@@ skipping 29 matching lines @@
       !EVP_PKEY_verify(
           pctx.get(), reinterpret_cast<const uint8_t*>(signature.data()),
           signature.size(), reinterpret_cast<const uint8_t*>(ekm.data()),
           ekm.size())) {
     return false;
   }
   return true;
 }
 
 }  // namespace net