| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/cert/internal/verify_signed_data.h" | 5 #include "net/cert/internal/verify_signed_data.h" |
| 6 | 6 |
| 7 #include <openssl/bytestring.h> | 7 #include <openssl/bytestring.h> |
| 8 #include <openssl/digest.h> | 8 #include <openssl/digest.h> |
| 9 #include <openssl/ec.h> | 9 #include <openssl/ec.h> |
| 10 #include <openssl/ec_key.h> | 10 #include <openssl/ec_key.h> |
| (...skipping 149 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 160 if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_RSA, pkey)) | 160 if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_RSA, pkey)) |
| 161 return false; | 161 return false; |
| 162 | 162 |
| 163 // Extract the modulus length from the key. | 163 // Extract the modulus length from the key. |
| 164 crypto::ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey->get())); | 164 crypto::ScopedRSA rsa(EVP_PKEY_get1_RSA(pkey->get())); |
| 165 if (!rsa) | 165 if (!rsa) |
| 166 return false; | 166 return false; |
| 167 unsigned int modulus_length_bits = BN_num_bits(rsa->n); | 167 unsigned int modulus_length_bits = BN_num_bits(rsa->n); |
| 168 | 168 |
| 169 if (!policy->IsAcceptableModulusLengthForRsa(modulus_length_bits, errors)) { | 169 if (!policy->IsAcceptableModulusLengthForRsa(modulus_length_bits, errors)) { |
| 170 errors->Add(kUnacceptableRsaModulusLength); | 170 errors->AddError(kUnacceptableRsaModulusLength); |
| 171 return false; | 171 return false; |
| 172 } | 172 } |
| 173 | 173 |
| 174 return true; | 174 return true; |
| 175 } | 175 } |
| 176 | 176 |
| 177 // Does signature verification using either RSA or ECDSA. | 177 // Does signature verification using either RSA or ECDSA. |
| 178 WARN_UNUSED_RESULT bool DoVerify(const SignatureAlgorithm& algorithm, | 178 WARN_UNUSED_RESULT bool DoVerify(const SignatureAlgorithm& algorithm, |
| 179 const der::Input& signed_data, | 179 const der::Input& signed_data, |
| 180 const der::BitString& signature_value, | 180 const der::BitString& signature_value, |
| (...skipping 88 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 269 if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_EC, pkey)) | 269 if (!ImportPkeyFromSpki(public_key_spki, EVP_PKEY_EC, pkey)) |
| 270 return false; | 270 return false; |
| 271 | 271 |
| 272 // Extract the curve name. | 272 // Extract the curve name. |
| 273 crypto::ScopedEC_KEY ec(EVP_PKEY_get1_EC_KEY(pkey->get())); | 273 crypto::ScopedEC_KEY ec(EVP_PKEY_get1_EC_KEY(pkey->get())); |
| 274 if (!ec.get()) | 274 if (!ec.get()) |
| 275 return false; // Unexpected. | 275 return false; // Unexpected. |
| 276 int curve_nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec.get())); | 276 int curve_nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec.get())); |
| 277 | 277 |
| 278 if (!policy->IsAcceptableCurveForEcdsa(curve_nid, errors)) { | 278 if (!policy->IsAcceptableCurveForEcdsa(curve_nid, errors)) { |
| 279 errors->Add(kUnacceptableEcdsaCurve); | 279 errors->AddError(kUnacceptableEcdsaCurve); |
| 280 return false; | 280 return false; |
| 281 } | 281 } |
| 282 | 282 |
| 283 return true; | 283 return true; |
| 284 } | 284 } |
| 285 | 285 |
| 286 } // namespace | 286 } // namespace |
| 287 | 287 |
| 288 bool VerifySignedData(const SignatureAlgorithm& signature_algorithm, | 288 bool VerifySignedData(const SignatureAlgorithm& signature_algorithm, |
| 289 const der::Input& signed_data, | 289 const der::Input& signed_data, |
| 290 const der::BitString& signature_value, | 290 const der::BitString& signature_value, |
| 291 const der::Input& public_key_spki, | 291 const der::Input& public_key_spki, |
| 292 const SignaturePolicy* policy, | 292 const SignaturePolicy* policy, |
| 293 CertErrors* errors) { | 293 CertErrors* errors) { |
| 294 if (!policy->IsAcceptableSignatureAlgorithm(signature_algorithm, errors)) { | 294 if (!policy->IsAcceptableSignatureAlgorithm(signature_algorithm, errors)) { |
| 295 errors->Add(kUnacceptableSignatureAlgorithm); | 295 errors->AddError(kUnacceptableSignatureAlgorithm); |
| 296 return false; | 296 return false; |
| 297 } | 297 } |
| 298 | 298 |
| 299 crypto::ScopedEVP_PKEY public_key; | 299 crypto::ScopedEVP_PKEY public_key; |
| 300 | 300 |
| 301 // Parse the SPKI to an EVP_PKEY appropriate for the signature algorithm. | 301 // Parse the SPKI to an EVP_PKEY appropriate for the signature algorithm. |
| 302 switch (signature_algorithm.algorithm()) { | 302 switch (signature_algorithm.algorithm()) { |
| 303 case SignatureAlgorithmId::RsaPkcs1: | 303 case SignatureAlgorithmId::RsaPkcs1: |
| 304 case SignatureAlgorithmId::RsaPss: | 304 case SignatureAlgorithmId::RsaPss: |
| 305 if (!ParseRsaKeyFromSpki(public_key_spki, &public_key, policy, errors)) | 305 if (!ParseRsaKeyFromSpki(public_key_spki, &public_key, policy, errors)) |
| 306 return false; | 306 return false; |
| 307 break; | 307 break; |
| 308 case SignatureAlgorithmId::Ecdsa: | 308 case SignatureAlgorithmId::Ecdsa: |
| 309 if (!ParseEcKeyFromSpki(public_key_spki, &public_key, policy, errors)) | 309 if (!ParseEcKeyFromSpki(public_key_spki, &public_key, policy, errors)) |
| 310 return false; | 310 return false; |
| 311 break; | 311 break; |
| 312 } | 312 } |
| 313 | 313 |
| 314 if (!DoVerify(signature_algorithm, signed_data, signature_value, | 314 if (!DoVerify(signature_algorithm, signed_data, signature_value, |
| 315 public_key.get())) { | 315 public_key.get())) { |
| 316 errors->Add(kSignatureVerificationFailed); | 316 errors->AddError(kSignatureVerificationFailed); |
| 317 return false; | 317 return false; |
| 318 } | 318 } |
| 319 | 319 |
| 320 return true; | 320 return true; |
| 321 } | 321 } |
| 322 | 322 |
| 323 } // namespace net | 323 } // namespace net |
| OLD | NEW |