| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/common/extensions/api/networking_private/networking_private_cry
pto.h" | 5 #include "chrome/common/extensions/api/networking_private/networking_private_cry
pto.h" |
| 6 | 6 |
| 7 #include <openssl/digest.h> | 7 #include <openssl/digest.h> |
| 8 #include <openssl/evp.h> | 8 #include <openssl/evp.h> |
| 9 #include <openssl/rsa.h> | 9 #include <openssl/rsa.h> |
| 10 #include <openssl/x509.h> | 10 #include <openssl/x509.h> |
| (...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 44 } // namespace | 44 } // namespace |
| 45 | 45 |
| 46 namespace networking_private_crypto { | 46 namespace networking_private_crypto { |
| 47 | 47 |
| 48 bool VerifyCredentials( | 48 bool VerifyCredentials( |
| 49 const std::string& certificate, | 49 const std::string& certificate, |
| 50 const std::vector<std::string>& intermediate_certificates, | 50 const std::vector<std::string>& intermediate_certificates, |
| 51 const std::string& signature, | 51 const std::string& signature, |
| 52 const std::string& data, | 52 const std::string& data, |
| 53 const std::string& connected_mac) { | 53 const std::string& connected_mac) { |
| 54 base::Time now = base::Time::Now(); | 54 base::Time::Exploded now; |
| 55 base::Time::Now().UTCExplode(&now); |
| 55 return VerifyCredentialsAtTime(certificate, intermediate_certificates, | 56 return VerifyCredentialsAtTime(certificate, intermediate_certificates, |
| 56 signature, data, connected_mac, now); | 57 signature, data, connected_mac, now); |
| 57 } | 58 } |
| 58 | 59 |
| 59 bool VerifyCredentialsAtTime( | 60 bool VerifyCredentialsAtTime( |
| 60 const std::string& certificate, | 61 const std::string& certificate, |
| 61 const std::vector<std::string>& intermediate_certificates, | 62 const std::vector<std::string>& intermediate_certificates, |
| 62 const std::string& signature, | 63 const std::string& signature, |
| 63 const std::string& data, | 64 const std::string& data, |
| 64 const std::string& connected_mac, | 65 const std::string& connected_mac, |
| 65 const base::Time& time) { | 66 const base::Time::Exploded& time) { |
| 66 static const char kErrorPrefix[] = "Device verification failed. "; | 67 static const char kErrorPrefix[] = "Device verification failed. "; |
| 67 | 68 |
| 68 std::vector<std::string> headers; | 69 std::vector<std::string> headers; |
| 69 headers.push_back("CERTIFICATE"); | 70 headers.push_back("CERTIFICATE"); |
| 70 | 71 |
| 71 // Convert certificate from PEM to raw DER | 72 // Convert certificate from PEM to raw DER |
| 72 net::PEMTokenizer pem_tokenizer(certificate, headers); | 73 net::PEMTokenizer pem_tokenizer(certificate, headers); |
| 73 if (!pem_tokenizer.GetNext()) { | 74 if (!pem_tokenizer.GetNext()) { |
| 74 LOG(ERROR) << kErrorPrefix << "Failed to parse device certificate."; | 75 LOG(ERROR) << kErrorPrefix << "Failed to parse device certificate."; |
| 75 return false; | 76 return false; |
| (...skipping 13 matching lines...) Expand all Loading... |
| 89 LOG(WARNING) << "Failed to parse intermediate certificates."; | 90 LOG(WARNING) << "Failed to parse intermediate certificates."; |
| 90 } | 91 } |
| 91 } | 92 } |
| 92 | 93 |
| 93 // Note that the device certificate's policy is not enforced here. The goal | 94 // Note that the device certificate's policy is not enforced here. The goal |
| 94 // is simply to verify that the device belongs to the Cast ecosystem. | 95 // is simply to verify that the device belongs to the Cast ecosystem. |
| 95 cast_crypto::CastDeviceCertPolicy unused_policy; | 96 cast_crypto::CastDeviceCertPolicy unused_policy; |
| 96 | 97 |
| 97 std::unique_ptr<cast_crypto::CertVerificationContext> verification_context; | 98 std::unique_ptr<cast_crypto::CertVerificationContext> verification_context; |
| 98 if (!cast_crypto::VerifyDeviceCert(certs, time, &verification_context, | 99 if (!cast_crypto::VerifyDeviceCert(certs, time, &verification_context, |
| 99 &unused_policy, nullptr, | 100 &unused_policy)) { |
| 100 cast_crypto::CRLPolicy::CRL_OPTIONAL)) { | |
| 101 LOG(ERROR) << kErrorPrefix << "Failed verifying cast device cert"; | 101 LOG(ERROR) << kErrorPrefix << "Failed verifying cast device cert"; |
| 102 return false; | 102 return false; |
| 103 } | 103 } |
| 104 | 104 |
| 105 // Check that the device listed in the certificate is correct. | 105 // Check that the device listed in the certificate is correct. |
| 106 // Something like evt_e161 001a11ffacdf | 106 // Something like evt_e161 001a11ffacdf |
| 107 std::string common_name = verification_context->GetCommonName(); | 107 std::string common_name = verification_context->GetCommonName(); |
| 108 std::string translated_mac; | 108 std::string translated_mac; |
| 109 base::RemoveChars(connected_mac, ":", &translated_mac); | 109 base::RemoveChars(connected_mac, ":", &translated_mac); |
| 110 if (!base::EndsWith(common_name, translated_mac, | 110 if (!base::EndsWith(common_name, translated_mac, |
| (...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 179 rsa.get(), RSA_PKCS1_PADDING); | 179 rsa.get(), RSA_PKCS1_PADDING); |
| 180 if (output_length < 0) { | 180 if (output_length < 0) { |
| 181 LOG(ERROR) << "Error during decryption."; | 181 LOG(ERROR) << "Error during decryption."; |
| 182 return false; | 182 return false; |
| 183 } | 183 } |
| 184 decrypted_output->resize(output_length); | 184 decrypted_output->resize(output_length); |
| 185 return true; | 185 return true; |
| 186 } | 186 } |
| 187 | 187 |
| 188 } // namespace networking_private_crypto | 188 } // namespace networking_private_crypto |
| OLD | NEW |