| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/quic/crypto/proof_verifier_chromium.h" | 5 #include "net/quic/crypto/proof_verifier_chromium.h" |
| 6 | 6 |
| 7 #include "base/bind.h" | 7 #include "base/bind.h" |
| 8 #include "base/bind_helpers.h" | 8 #include "base/bind_helpers.h" |
| 9 #include "base/callback_helpers.h" | 9 #include "base/callback_helpers.h" |
| 10 #include "base/compiler_specific.h" | 10 #include "base/compiler_specific.h" |
| (...skipping 190 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 201 callback->Run(rv == OK, error_details_, &verify_details); | 201 callback->Run(rv == OK, error_details_, &verify_details); |
| 202 // Will delete |this|. | 202 // Will delete |this|. |
| 203 proof_verifier_->OnJobComplete(this); | 203 proof_verifier_->OnJobComplete(this); |
| 204 } | 204 } |
| 205 } | 205 } |
| 206 | 206 |
| 207 int ProofVerifierChromium::Job::DoVerifyCert(int result) { | 207 int ProofVerifierChromium::Job::DoVerifyCert(int result) { |
| 208 next_state_ = STATE_VERIFY_CERT_COMPLETE; | 208 next_state_ = STATE_VERIFY_CERT_COMPLETE; |
| 209 | 209 |
| 210 int flags = 0; | 210 int flags = 0; |
| 211 return verifier_->Verify( | 211 return verifier_->Verify(cert_.get(), |
| 212 cert_.get(), | 212 hostname_, |
| 213 hostname_, | 213 flags, |
| 214 flags, | 214 SSLConfigService::GetCRLSet().get(), |
| 215 SSLConfigService::GetCRLSet().get(), | 215 &verify_details_->cert_verify_result, |
| 216 &verify_details_->cert_verify_result, | 216 base::Bind(&ProofVerifierChromium::Job::OnIOComplete, |
| 217 base::Bind(&ProofVerifierChromium::Job::OnIOComplete, | 217 base::Unretained(this)), |
| 218 base::Unretained(this)), | 218 net_log_); |
| 219 net_log_); | |
| 220 } | 219 } |
| 221 | 220 |
| 222 int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) { | 221 int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) { |
| 223 verifier_.reset(); | 222 verifier_.reset(); |
| 224 | 223 |
| 225 if (result <= ERR_FAILED) { | 224 if (result <= ERR_FAILED) { |
| 226 error_details_ = StringPrintf("Failed to verify certificate chain: %s", | 225 error_details_ = StringPrintf("Failed to verify certificate chain: %s", |
| 227 ErrorToString(result)); | 226 ErrorToString(result)); |
| 228 DLOG(WARNING) << error_details_; | 227 DLOG(WARNING) << error_details_; |
| 229 result = ERR_FAILED; | 228 result = ERR_FAILED; |
| 230 } | 229 } |
| 231 | 230 |
| 232 // Exit DoLoop and return the result to the caller to VerifyProof. | 231 // Exit DoLoop and return the result to the caller to VerifyProof. |
| 233 DCHECK_EQ(STATE_NONE, next_state_); | 232 DCHECK_EQ(STATE_NONE, next_state_); |
| 234 return result; | 233 return result; |
| 235 } | 234 } |
| 236 | 235 |
| 237 bool ProofVerifierChromium::Job::VerifySignature(const string& signed_data, | 236 bool ProofVerifierChromium::Job::VerifySignature(const string& signed_data, |
| 238 const string& signature, | 237 const string& signature, |
| 239 const string& cert) { | 238 const string& cert) { |
| 240 StringPiece spki; | 239 StringPiece spki; |
| 241 if (!asn1::ExtractSPKIFromDERCert(cert, &spki)) { | 240 if (!asn1::ExtractSPKIFromDERCert(cert, &spki)) { |
| 242 DLOG(WARNING) << "ExtractSPKIFromDERCert failed"; | 241 DLOG(WARNING) << "ExtractSPKIFromDERCert failed"; |
| 243 return false; | 242 return false; |
| 244 } | 243 } |
| 245 | 244 |
| 246 crypto::SignatureVerifier verifier; | 245 crypto::SignatureVerifier verifier; |
| 247 | 246 |
| 248 size_t size_bits; | 247 size_t size_bits; |
| 249 X509Certificate::PublicKeyType type; | 248 X509Certificate::PublicKeyType type; |
| 250 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, | 249 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, &type); |
| 251 &type); | |
| 252 if (type == X509Certificate::kPublicKeyTypeRSA) { | 250 if (type == X509Certificate::kPublicKeyTypeRSA) { |
| 253 crypto::SignatureVerifier::HashAlgorithm hash_alg = | 251 crypto::SignatureVerifier::HashAlgorithm hash_alg = |
| 254 crypto::SignatureVerifier::SHA256; | 252 crypto::SignatureVerifier::SHA256; |
| 255 crypto::SignatureVerifier::HashAlgorithm mask_hash_alg = hash_alg; | 253 crypto::SignatureVerifier::HashAlgorithm mask_hash_alg = hash_alg; |
| 256 unsigned int hash_len = 32; // 32 is the length of a SHA-256 hash. | 254 unsigned int hash_len = 32; // 32 is the length of a SHA-256 hash. |
| 257 | 255 |
| 258 bool ok = verifier.VerifyInitRSAPSS( | 256 bool ok = verifier.VerifyInitRSAPSS( |
| 259 hash_alg, mask_hash_alg, hash_len, | 257 hash_alg, |
| 260 reinterpret_cast<const uint8*>(signature.data()), signature.size(), | 258 mask_hash_alg, |
| 261 reinterpret_cast<const uint8*>(spki.data()), spki.size()); | 259 hash_len, |
| 260 reinterpret_cast<const uint8*>(signature.data()), |
| 261 signature.size(), |
| 262 reinterpret_cast<const uint8*>(spki.data()), |
| 263 spki.size()); |
| 262 if (!ok) { | 264 if (!ok) { |
| 263 DLOG(WARNING) << "VerifyInitRSAPSS failed"; | 265 DLOG(WARNING) << "VerifyInitRSAPSS failed"; |
| 264 return false; | 266 return false; |
| 265 } | 267 } |
| 266 } else if (type == X509Certificate::kPublicKeyTypeECDSA) { | 268 } else if (type == X509Certificate::kPublicKeyTypeECDSA) { |
| 267 // This is the algorithm ID for ECDSA with SHA-256. Parameters are ABSENT. | 269 // This is the algorithm ID for ECDSA with SHA-256. Parameters are ABSENT. |
| 268 // RFC 5758: | 270 // RFC 5758: |
| 269 // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) | 271 // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) |
| 270 // us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } | 272 // us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } |
| 271 // ... | 273 // ... |
| 272 // When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or | 274 // When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or |
| 273 // ecdsa-with-SHA512 algorithm identifier appears in the algorithm field | 275 // ecdsa-with-SHA512 algorithm identifier appears in the algorithm field |
| 274 // as an AlgorithmIdentifier, the encoding MUST omit the parameters | 276 // as an AlgorithmIdentifier, the encoding MUST omit the parameters |
| 275 // field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one | 277 // field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one |
| 276 // component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with- | 278 // component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with- |
| 277 // SHA384, or ecdsa-with-SHA512. | 279 // SHA384, or ecdsa-with-SHA512. |
| 278 // See also RFC 5480, Appendix A. | 280 // See also RFC 5480, Appendix A. |
| 279 static const uint8 kECDSAWithSHA256AlgorithmID[] = { | 281 static const uint8 kECDSAWithSHA256AlgorithmID[] = { |
| 280 0x30, 0x0a, | 282 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, |
| 281 0x06, 0x08, | |
| 282 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, | |
| 283 }; | 283 }; |
| 284 | 284 |
| 285 if (!verifier.VerifyInit( | 285 if (!verifier.VerifyInit(kECDSAWithSHA256AlgorithmID, |
| 286 kECDSAWithSHA256AlgorithmID, sizeof(kECDSAWithSHA256AlgorithmID), | 286 sizeof(kECDSAWithSHA256AlgorithmID), |
| 287 reinterpret_cast<const uint8*>(signature.data()), | 287 reinterpret_cast<const uint8*>(signature.data()), |
| 288 signature.size(), | 288 signature.size(), |
| 289 reinterpret_cast<const uint8*>(spki.data()), | 289 reinterpret_cast<const uint8*>(spki.data()), |
| 290 spki.size())) { | 290 spki.size())) { |
| 291 DLOG(WARNING) << "VerifyInit failed"; | 291 DLOG(WARNING) << "VerifyInit failed"; |
| 292 return false; | 292 return false; |
| 293 } | 293 } |
| 294 } else { | 294 } else { |
| 295 LOG(ERROR) << "Unsupported public key type " << type; | 295 LOG(ERROR) << "Unsupported public key type " << type; |
| 296 return false; | 296 return false; |
| 297 } | 297 } |
| 298 | 298 |
| 299 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(kProofSignatureLabel), | 299 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(kProofSignatureLabel), |
| 300 sizeof(kProofSignatureLabel)); | 300 sizeof(kProofSignatureLabel)); |
| 301 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(signed_data.data()), | 301 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(signed_data.data()), |
| 302 signed_data.size()); | 302 signed_data.size()); |
| 303 | 303 |
| 304 if (!verifier.VerifyFinal()) { | 304 if (!verifier.VerifyFinal()) { |
| 305 DLOG(WARNING) << "VerifyFinal failed"; | 305 DLOG(WARNING) << "VerifyFinal failed"; |
| 306 return false; | 306 return false; |
| 307 } | 307 } |
| 308 | 308 |
| 309 DVLOG(1) << "VerifyFinal success"; | 309 DVLOG(1) << "VerifyFinal success"; |
| 310 return true; | 310 return true; |
| 311 } | 311 } |
| 312 | 312 |
| 313 ProofVerifierChromium::ProofVerifierChromium(CertVerifier* cert_verifier) | 313 ProofVerifierChromium::ProofVerifierChromium(CertVerifier* cert_verifier) |
| 314 : cert_verifier_(cert_verifier) {} | 314 : cert_verifier_(cert_verifier) { |
| 315 } |
| 315 | 316 |
| 316 ProofVerifierChromium::~ProofVerifierChromium() { | 317 ProofVerifierChromium::~ProofVerifierChromium() { |
| 317 STLDeleteElements(&active_jobs_); | 318 STLDeleteElements(&active_jobs_); |
| 318 } | 319 } |
| 319 | 320 |
| 320 ProofVerifierChromium::Status ProofVerifierChromium::VerifyProof( | 321 ProofVerifierChromium::Status ProofVerifierChromium::VerifyProof( |
| 321 const std::string& hostname, | 322 const std::string& hostname, |
| 322 const std::string& server_config, | 323 const std::string& server_config, |
| 323 const std::vector<std::string>& certs, | 324 const std::vector<std::string>& certs, |
| 324 const std::string& signature, | 325 const std::string& signature, |
| 325 const ProofVerifyContext* verify_context, | 326 const ProofVerifyContext* verify_context, |
| 326 std::string* error_details, | 327 std::string* error_details, |
| 327 scoped_ptr<ProofVerifyDetails>* verify_details, | 328 scoped_ptr<ProofVerifyDetails>* verify_details, |
| 328 ProofVerifierCallback* callback) { | 329 ProofVerifierCallback* callback) { |
| 329 if (!verify_context) { | 330 if (!verify_context) { |
| 330 *error_details = "Missing context"; | 331 *error_details = "Missing context"; |
| 331 return FAILURE; | 332 return FAILURE; |
| 332 } | 333 } |
| 333 const ProofVerifyContextChromium* chromium_context = | 334 const ProofVerifyContextChromium* chromium_context = |
| 334 reinterpret_cast<const ProofVerifyContextChromium*>(verify_context); | 335 reinterpret_cast<const ProofVerifyContextChromium*>(verify_context); |
| 335 scoped_ptr<Job> job(new Job(this, cert_verifier_, chromium_context->net_log)); | 336 scoped_ptr<Job> job(new Job(this, cert_verifier_, chromium_context->net_log)); |
| 336 Status status = job->VerifyProof(hostname, server_config, certs, signature, | 337 Status status = job->VerifyProof(hostname, |
| 337 error_details, verify_details, callback); | 338 server_config, |
| 339 certs, |
| 340 signature, |
| 341 error_details, |
| 342 verify_details, |
| 343 callback); |
| 338 if (status == PENDING) { | 344 if (status == PENDING) { |
| 339 active_jobs_.insert(job.release()); | 345 active_jobs_.insert(job.release()); |
| 340 } | 346 } |
| 341 return status; | 347 return status; |
| 342 } | 348 } |
| 343 | 349 |
| 344 void ProofVerifierChromium::OnJobComplete(Job* job) { | 350 void ProofVerifierChromium::OnJobComplete(Job* job) { |
| 345 active_jobs_.erase(job); | 351 active_jobs_.erase(job); |
| 346 delete job; | 352 delete job; |
| 347 } | 353 } |
| 348 | 354 |
| 349 } // namespace net | 355 } // namespace net |
| OLD | NEW |