Rename net/ _openssl files

net/cert/ct_log_verifier.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/ct_log_verifier.h"
 
 #include <string.h>
+#include <openssl/bytestring.h>
+#include <openssl/evp.h>
 
 #include "base/logging.h"
+#include "crypto/openssl_util.h"
+#include "crypto/scoped_openssl_types.h"
+#include "crypto/sha2.h"
 #include "net/cert/ct_log_verifier_util.h"
 #include "net/cert/ct_serialization.h"
 #include "net/cert/merkle_consistency_proof.h"
 #include "net/cert/signed_tree_head.h"
 
 namespace net {
 
 namespace {
 
 // The SHA-256 hash of the empty string.
 const unsigned char kSHA256EmptyStringHash[ct::kSthRootHashLength] = {
     0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4,
     0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b,
     0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55};
 
 bool IsPowerOfTwo(uint64_t n) {
   return n != 0 && (n & (n - 1)) == 0;
 }
 
+const EVP_MD* GetEvpAlg(ct::DigitallySigned::HashAlgorithm alg) {
+  switch (alg) {
+    case ct::DigitallySigned::HASH_ALGO_MD5:
+      return EVP_md5();
+    case ct::DigitallySigned::HASH_ALGO_SHA1:
+      return EVP_sha1();
+    case ct::DigitallySigned::HASH_ALGO_SHA224:
+      return EVP_sha224();
+    case ct::DigitallySigned::HASH_ALGO_SHA256:
+      return EVP_sha256();
+    case ct::DigitallySigned::HASH_ALGO_SHA384:
+      return EVP_sha384();
+    case ct::DigitallySigned::HASH_ALGO_SHA512:
+      return EVP_sha512();
+    case ct::DigitallySigned::HASH_ALGO_NONE:
+    default:
+      NOTREACHED();
+      return NULL;
+  }
+}
+
 }  // namespace
 
 // static
 scoped_refptr<const CTLogVerifier> CTLogVerifier::Create(
     const base::StringPiece& public_key,
     const base::StringPiece& description,
     const base::StringPiece& url) {
   GURL log_url(url.as_string());
   if (!log_url.is_valid())
     return nullptr;
@@ skipping 166 matching lines @@
     sn >>= 1;
   }
 
   // 6. After completing iterating through the "consistency_path" array as
   // described above, verify that the "fr" calculated is equal to the
   // "first_hash" supplied, that the "sr" calculated is equal to the
   // "second_hash" supplied and that "sn" is 0.
   return fr == old_tree_hash && sr == new_tree_hash && sn == 0;
 }
 
+CTLogVerifier::~CTLogVerifier() {
+  crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
+
+  if (public_key_)
+    EVP_PKEY_free(public_key_);
+}
+
+bool CTLogVerifier::Init(const base::StringPiece& public_key) {
+  crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
+
+  CBS cbs;
+  CBS_init(&cbs, reinterpret_cast<const uint8_t*>(public_key.data()),
+           public_key.size());
+  public_key_ = EVP_parse_public_key(&cbs);
+  if (!public_key_ || CBS_len(&cbs) != 0)
+    return false;
+
+  key_id_ = crypto::SHA256HashString(public_key);
+
+  // Right now, only RSASSA-PKCS1v15 with SHA-256 and ECDSA with SHA-256 are
+  // supported.
+  switch (EVP_PKEY_type(public_key_->type)) {
+    case EVP_PKEY_RSA:
+      hash_algorithm_ = ct::DigitallySigned::HASH_ALGO_SHA256;
+      signature_algorithm_ = ct::DigitallySigned::SIG_ALGO_RSA;
+      break;
+    case EVP_PKEY_EC:
+      hash_algorithm_ = ct::DigitallySigned::HASH_ALGO_SHA256;
+      signature_algorithm_ = ct::DigitallySigned::SIG_ALGO_ECDSA;
+      break;
+    default:
+      DVLOG(1) << "Unsupported key type: " << EVP_PKEY_type(public_key_->type);
+      return false;
+  }
+
+  // Extra sanity check: Require RSA keys of at least 2048 bits.
+  // EVP_PKEY_size returns the size in bytes. 256 = 2048-bit RSA key.
+  if (signature_algorithm_ == ct::DigitallySigned::SIG_ALGO_RSA &&
+      EVP_PKEY_size(public_key_) < 256) {
+    DVLOG(1) << "Too small a public key.";
+    return false;
+  }
+
+  return true;
+}
+
+bool CTLogVerifier::VerifySignature(const base::StringPiece& data_to_sign,
+                                    const base::StringPiece& signature) const {
+  crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
+
+  const EVP_MD* hash_alg = GetEvpAlg(hash_algorithm_);
+  if (hash_alg == NULL)
+    return false;
+
+  EVP_MD_CTX ctx;
+  EVP_MD_CTX_init(&ctx);
+
+  bool ok =
+      (1 == EVP_DigestVerifyInit(&ctx, NULL, hash_alg, NULL, public_key_) &&
+       1 == EVP_DigestVerifyUpdate(&ctx, data_to_sign.data(),
+                                   data_to_sign.size()) &&
+       1 == EVP_DigestVerifyFinal(
+                &ctx, reinterpret_cast<const uint8_t*>(signature.data()),
+                signature.size()));
+
+  EVP_MD_CTX_cleanup(&ctx);
+  return ok;
+}
+
 }  // namespace net