Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(141)

Side by Side Diff: chrome/common/extensions/api/networking_private/networking_private_crypto.cc

Issue 2181013002: Revert of Cast device revocation checking. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2014 The Chromium Authors. All rights reserved. 1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "chrome/common/extensions/api/networking_private/networking_private_cry pto.h" 5 #include "chrome/common/extensions/api/networking_private/networking_private_cry pto.h"
6 6
7 #include <openssl/digest.h> 7 #include <openssl/digest.h>
8 #include <openssl/evp.h> 8 #include <openssl/evp.h>
9 #include <openssl/rsa.h> 9 #include <openssl/rsa.h>
10 #include <openssl/x509.h> 10 #include <openssl/x509.h>
(...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after
44 } // namespace 44 } // namespace
45 45
46 namespace networking_private_crypto { 46 namespace networking_private_crypto {
47 47
48 bool VerifyCredentials( 48 bool VerifyCredentials(
49 const std::string& certificate, 49 const std::string& certificate,
50 const std::vector<std::string>& intermediate_certificates, 50 const std::vector<std::string>& intermediate_certificates,
51 const std::string& signature, 51 const std::string& signature,
52 const std::string& data, 52 const std::string& data,
53 const std::string& connected_mac) { 53 const std::string& connected_mac) {
54 base::Time now = base::Time::Now(); 54 base::Time::Exploded now;
55 base::Time::Now().UTCExplode(&now);
55 return VerifyCredentialsAtTime(certificate, intermediate_certificates, 56 return VerifyCredentialsAtTime(certificate, intermediate_certificates,
56 signature, data, connected_mac, now); 57 signature, data, connected_mac, now);
57 } 58 }
58 59
59 bool VerifyCredentialsAtTime( 60 bool VerifyCredentialsAtTime(
60 const std::string& certificate, 61 const std::string& certificate,
61 const std::vector<std::string>& intermediate_certificates, 62 const std::vector<std::string>& intermediate_certificates,
62 const std::string& signature, 63 const std::string& signature,
63 const std::string& data, 64 const std::string& data,
64 const std::string& connected_mac, 65 const std::string& connected_mac,
65 const base::Time& time) { 66 const base::Time::Exploded& time) {
66 static const char kErrorPrefix[] = "Device verification failed. "; 67 static const char kErrorPrefix[] = "Device verification failed. ";
67 68
68 std::vector<std::string> headers; 69 std::vector<std::string> headers;
69 headers.push_back("CERTIFICATE"); 70 headers.push_back("CERTIFICATE");
70 71
71 // Convert certificate from PEM to raw DER 72 // Convert certificate from PEM to raw DER
72 net::PEMTokenizer pem_tokenizer(certificate, headers); 73 net::PEMTokenizer pem_tokenizer(certificate, headers);
73 if (!pem_tokenizer.GetNext()) { 74 if (!pem_tokenizer.GetNext()) {
74 LOG(ERROR) << kErrorPrefix << "Failed to parse device certificate."; 75 LOG(ERROR) << kErrorPrefix << "Failed to parse device certificate.";
75 return false; 76 return false;
(...skipping 13 matching lines...) Expand all
89 LOG(WARNING) << "Failed to parse intermediate certificates."; 90 LOG(WARNING) << "Failed to parse intermediate certificates.";
90 } 91 }
91 } 92 }
92 93
93 // Note that the device certificate's policy is not enforced here. The goal 94 // Note that the device certificate's policy is not enforced here. The goal
94 // is simply to verify that the device belongs to the Cast ecosystem. 95 // is simply to verify that the device belongs to the Cast ecosystem.
95 cast_crypto::CastDeviceCertPolicy unused_policy; 96 cast_crypto::CastDeviceCertPolicy unused_policy;
96 97
97 std::unique_ptr<cast_crypto::CertVerificationContext> verification_context; 98 std::unique_ptr<cast_crypto::CertVerificationContext> verification_context;
98 if (!cast_crypto::VerifyDeviceCert(certs, time, &verification_context, 99 if (!cast_crypto::VerifyDeviceCert(certs, time, &verification_context,
99 &unused_policy, nullptr, 100 &unused_policy)) {
100 cast_crypto::CRLPolicy::CRL_OPTIONAL)) {
101 LOG(ERROR) << kErrorPrefix << "Failed verifying cast device cert"; 101 LOG(ERROR) << kErrorPrefix << "Failed verifying cast device cert";
102 return false; 102 return false;
103 } 103 }
104 104
105 // Check that the device listed in the certificate is correct. 105 // Check that the device listed in the certificate is correct.
106 // Something like evt_e161 001a11ffacdf 106 // Something like evt_e161 001a11ffacdf
107 std::string common_name = verification_context->GetCommonName(); 107 std::string common_name = verification_context->GetCommonName();
108 std::string translated_mac; 108 std::string translated_mac;
109 base::RemoveChars(connected_mac, ":", &translated_mac); 109 base::RemoveChars(connected_mac, ":", &translated_mac);
110 if (!base::EndsWith(common_name, translated_mac, 110 if (!base::EndsWith(common_name, translated_mac,
(...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after
179 rsa.get(), RSA_PKCS1_PADDING); 179 rsa.get(), RSA_PKCS1_PADDING);
180 if (output_length < 0) { 180 if (output_length < 0) {
181 LOG(ERROR) << "Error during decryption."; 181 LOG(ERROR) << "Error during decryption.";
182 return false; 182 return false;
183 } 183 }
184 decrypted_output->resize(output_length); 184 decrypted_output->resize(output_length);
185 return true; 185 return true;
186 } 186 }
187 187
188 } // namespace networking_private_crypto 188 } // namespace networking_private_crypto
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698