OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "extensions/common/cast/cast_cert_validator.h" | 5 #include "extensions/common/cast/cast_cert_validator.h" |
6 | 6 |
7 #include <stddef.h> | 7 #include <stddef.h> |
8 #include <stdint.h> | 8 #include <stdint.h> |
| 9 |
9 #include <algorithm> | 10 #include <algorithm> |
| 11 #include <memory> |
10 #include <utility> | 12 #include <utility> |
11 | 13 |
| 14 #include "base/memory/ptr_util.h" |
12 #include "base/memory/singleton.h" | 15 #include "base/memory/singleton.h" |
13 #include "net/cert/internal/certificate_policies.h" | 16 #include "net/cert/internal/certificate_policies.h" |
14 #include "net/cert/internal/extended_key_usage.h" | 17 #include "net/cert/internal/extended_key_usage.h" |
15 #include "net/cert/internal/parse_certificate.h" | 18 #include "net/cert/internal/parse_certificate.h" |
16 #include "net/cert/internal/parse_name.h" | 19 #include "net/cert/internal/parse_name.h" |
17 #include "net/cert/internal/signature_algorithm.h" | 20 #include "net/cert/internal/signature_algorithm.h" |
18 #include "net/cert/internal/signature_policy.h" | 21 #include "net/cert/internal/signature_policy.h" |
19 #include "net/cert/internal/verify_certificate_chain.h" | 22 #include "net/cert/internal/verify_certificate_chain.h" |
20 #include "net/cert/internal/verify_signed_data.h" | 23 #include "net/cert/internal/verify_signed_data.h" |
21 #include "net/der/input.h" | 24 #include "net/der/input.h" |
(...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
90 // The following signature policy specifies which signature algorithms (and key | 93 // The following signature policy specifies which signature algorithms (and key |
91 // sizes) are acceptable. It is used when verifying a chain of certificates, as | 94 // sizes) are acceptable. It is used when verifying a chain of certificates, as |
92 // well as when verifying digital signature using the target certificate's | 95 // well as when verifying digital signature using the target certificate's |
93 // SPKI. | 96 // SPKI. |
94 // | 97 // |
95 // This particular policy allows for: | 98 // This particular policy allows for: |
96 // * ECDSA, RSA-SSA, and RSA-PSS | 99 // * ECDSA, RSA-SSA, and RSA-PSS |
97 // * Supported EC curves: P-256, P-384, P-521. | 100 // * Supported EC curves: P-256, P-384, P-521. |
98 // * Hashes: All SHA hashes including SHA-1 (despite being known weak). | 101 // * Hashes: All SHA hashes including SHA-1 (despite being known weak). |
99 // * RSA keys must have a modulus at least 2048-bits long. | 102 // * RSA keys must have a modulus at least 2048-bits long. |
100 scoped_ptr<net::SignaturePolicy> CreateCastSignaturePolicy() { | 103 std::unique_ptr<net::SignaturePolicy> CreateCastSignaturePolicy() { |
101 return make_scoped_ptr(new net::SimpleSignaturePolicy(2048)); | 104 return base::WrapUnique(new net::SimpleSignaturePolicy(2048)); |
102 } | 105 } |
103 | 106 |
104 class CertVerificationContextImpl : public CertVerificationContext { | 107 class CertVerificationContextImpl : public CertVerificationContext { |
105 public: | 108 public: |
106 // Save a copy of the passed in public key (DER) and common name (text). | 109 // Save a copy of the passed in public key (DER) and common name (text). |
107 CertVerificationContextImpl(const net::der::Input& spki, | 110 CertVerificationContextImpl(const net::der::Input& spki, |
108 const base::StringPiece& common_name) | 111 const base::StringPiece& common_name) |
109 : spki_(spki.AsString()), common_name_(common_name.as_string()) {} | 112 : spki_(spki.AsString()), common_name_(common_name.as_string()) {} |
110 | 113 |
111 bool VerifySignatureOverData(const base::StringPiece& signature, | 114 bool VerifySignatureOverData(const base::StringPiece& signature, |
(...skipping 52 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
164 } | 167 } |
165 | 168 |
166 // Checks properties on the target certificate. | 169 // Checks properties on the target certificate. |
167 // | 170 // |
168 // * The Key Usage must include Digital Signature | 171 // * The Key Usage must include Digital Signature |
169 // * THe Extended Key Usage must includ TLS Client Auth | 172 // * THe Extended Key Usage must includ TLS Client Auth |
170 // * May have the policy 1.3.6.1.4.1.11129.2.5.2 to indicate it | 173 // * May have the policy 1.3.6.1.4.1.11129.2.5.2 to indicate it |
171 // is an audio-only device. | 174 // is an audio-only device. |
172 WARN_UNUSED_RESULT bool CheckTargetCertificate( | 175 WARN_UNUSED_RESULT bool CheckTargetCertificate( |
173 const net::der::Input& cert_der, | 176 const net::der::Input& cert_der, |
174 scoped_ptr<CertVerificationContext>* context, | 177 std::unique_ptr<CertVerificationContext>* context, |
175 CastDeviceCertPolicy* policy) { | 178 CastDeviceCertPolicy* policy) { |
176 // TODO(eroman): Simplify this. The certificate chain verification | 179 // TODO(eroman): Simplify this. The certificate chain verification |
177 // function already parses this stuff, awkward to re-do it here. | 180 // function already parses this stuff, awkward to re-do it here. |
178 | 181 |
179 net::ParsedCertificate cert; | 182 net::ParsedCertificate cert; |
180 if (!net::ParseCertificate(cert_der, &cert)) | 183 if (!net::ParseCertificate(cert_der, &cert)) |
181 return false; | 184 return false; |
182 | 185 |
183 net::ParsedTbsCertificate tbs; | 186 net::ParsedTbsCertificate tbs; |
184 if (!net::ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs)) | 187 if (!net::ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs)) |
(...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
250 result.hours = exploded.hour; | 253 result.hours = exploded.hour; |
251 result.minutes = exploded.minute; | 254 result.minutes = exploded.minute; |
252 result.seconds = exploded.second; | 255 result.seconds = exploded.second; |
253 return result; | 256 return result; |
254 } | 257 } |
255 | 258 |
256 } // namespace | 259 } // namespace |
257 | 260 |
258 bool VerifyDeviceCert(const std::vector<std::string>& certs, | 261 bool VerifyDeviceCert(const std::vector<std::string>& certs, |
259 const base::Time::Exploded& time, | 262 const base::Time::Exploded& time, |
260 scoped_ptr<CertVerificationContext>* context, | 263 std::unique_ptr<CertVerificationContext>* context, |
261 CastDeviceCertPolicy* policy) { | 264 CastDeviceCertPolicy* policy) { |
262 // The underlying verification function expects a sequence of | 265 // The underlying verification function expects a sequence of |
263 // der::Input, so wrap the data in it (cheap). | 266 // der::Input, so wrap the data in it (cheap). |
264 std::vector<net::der::Input> input_chain; | 267 std::vector<net::der::Input> input_chain; |
265 for (const auto& cert : certs) | 268 for (const auto& cert : certs) |
266 input_chain.push_back(net::der::Input(&cert)); | 269 input_chain.push_back(net::der::Input(&cert)); |
267 | 270 |
268 // Use a signature policy compatible with Cast's PKI. | 271 // Use a signature policy compatible with Cast's PKI. |
269 auto signature_policy = CreateCastSignaturePolicy(); | 272 auto signature_policy = CreateCastSignaturePolicy(); |
270 | 273 |
271 // Do RFC 5280 compatible certificate verification using the two Cast | 274 // Do RFC 5280 compatible certificate verification using the two Cast |
272 // trust anchors and Cast signature policy. | 275 // trust anchors and Cast signature policy. |
273 if (!net::VerifyCertificateChain(input_chain, CastTrustStore::Get(), | 276 if (!net::VerifyCertificateChain(input_chain, CastTrustStore::Get(), |
274 signature_policy.get(), | 277 signature_policy.get(), |
275 ConvertExplodedTime(time))) { | 278 ConvertExplodedTime(time))) { |
276 return false; | 279 return false; |
277 } | 280 } |
278 | 281 |
279 // Check properties of the leaf certificate (key usage, policy), and construct | 282 // Check properties of the leaf certificate (key usage, policy), and construct |
280 // a CertVerificationContext that uses its public key. | 283 // a CertVerificationContext that uses its public key. |
281 return CheckTargetCertificate(input_chain[0], context, policy); | 284 return CheckTargetCertificate(input_chain[0], context, policy); |
282 } | 285 } |
283 | 286 |
284 scoped_ptr<CertVerificationContext> CertVerificationContextImplForTest( | 287 std::unique_ptr<CertVerificationContext> CertVerificationContextImplForTest( |
285 const base::StringPiece& spki) { | 288 const base::StringPiece& spki) { |
286 // Use a bogus CommonName, since this is just exposed for testing signature | 289 // Use a bogus CommonName, since this is just exposed for testing signature |
287 // verification by unittests. | 290 // verification by unittests. |
288 return make_scoped_ptr( | 291 return base::WrapUnique( |
289 new CertVerificationContextImpl(net::der::Input(spki), "CommonName")); | 292 new CertVerificationContextImpl(net::der::Input(spki), "CommonName")); |
290 } | 293 } |
291 | 294 |
292 } // namespace cast_crypto | 295 } // namespace cast_crypto |
293 } // namespace api | 296 } // namespace api |
294 } // namespace extensions | 297 } // namespace extensions |
OLD | NEW |