Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(516)

Side by Side Diff: net/quic/crypto/proof_verifier_chromium.cc

Issue 266243004: Clang format slam. Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/quic/crypto/proof_verifier_chromium.h" 5 #include "net/quic/crypto/proof_verifier_chromium.h"
6 6
7 #include "base/bind.h" 7 #include "base/bind.h"
8 #include "base/bind_helpers.h" 8 #include "base/bind_helpers.h"
9 #include "base/callback_helpers.h" 9 #include "base/callback_helpers.h"
10 #include "base/compiler_specific.h" 10 #include "base/compiler_specific.h"
(...skipping 190 matching lines...) Expand 10 before | Expand all | Expand 10 after
201 callback->Run(rv == OK, error_details_, &verify_details); 201 callback->Run(rv == OK, error_details_, &verify_details);
202 // Will delete |this|. 202 // Will delete |this|.
203 proof_verifier_->OnJobComplete(this); 203 proof_verifier_->OnJobComplete(this);
204 } 204 }
205 } 205 }
206 206
207 int ProofVerifierChromium::Job::DoVerifyCert(int result) { 207 int ProofVerifierChromium::Job::DoVerifyCert(int result) {
208 next_state_ = STATE_VERIFY_CERT_COMPLETE; 208 next_state_ = STATE_VERIFY_CERT_COMPLETE;
209 209
210 int flags = 0; 210 int flags = 0;
211 return verifier_->Verify( 211 return verifier_->Verify(cert_.get(),
212 cert_.get(), 212 hostname_,
213 hostname_, 213 flags,
214 flags, 214 SSLConfigService::GetCRLSet().get(),
215 SSLConfigService::GetCRLSet().get(), 215 &verify_details_->cert_verify_result,
216 &verify_details_->cert_verify_result, 216 base::Bind(&ProofVerifierChromium::Job::OnIOComplete,
217 base::Bind(&ProofVerifierChromium::Job::OnIOComplete, 217 base::Unretained(this)),
218 base::Unretained(this)), 218 net_log_);
219 net_log_);
220 } 219 }
221 220
222 int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) { 221 int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) {
223 verifier_.reset(); 222 verifier_.reset();
224 223
225 if (result <= ERR_FAILED) { 224 if (result <= ERR_FAILED) {
226 error_details_ = StringPrintf("Failed to verify certificate chain: %s", 225 error_details_ = StringPrintf("Failed to verify certificate chain: %s",
227 ErrorToString(result)); 226 ErrorToString(result));
228 DLOG(WARNING) << error_details_; 227 DLOG(WARNING) << error_details_;
229 result = ERR_FAILED; 228 result = ERR_FAILED;
230 } 229 }
231 230
232 // Exit DoLoop and return the result to the caller to VerifyProof. 231 // Exit DoLoop and return the result to the caller to VerifyProof.
233 DCHECK_EQ(STATE_NONE, next_state_); 232 DCHECK_EQ(STATE_NONE, next_state_);
234 return result; 233 return result;
235 } 234 }
236 235
237 bool ProofVerifierChromium::Job::VerifySignature(const string& signed_data, 236 bool ProofVerifierChromium::Job::VerifySignature(const string& signed_data,
238 const string& signature, 237 const string& signature,
239 const string& cert) { 238 const string& cert) {
240 StringPiece spki; 239 StringPiece spki;
241 if (!asn1::ExtractSPKIFromDERCert(cert, &spki)) { 240 if (!asn1::ExtractSPKIFromDERCert(cert, &spki)) {
242 DLOG(WARNING) << "ExtractSPKIFromDERCert failed"; 241 DLOG(WARNING) << "ExtractSPKIFromDERCert failed";
243 return false; 242 return false;
244 } 243 }
245 244
246 crypto::SignatureVerifier verifier; 245 crypto::SignatureVerifier verifier;
247 246
248 size_t size_bits; 247 size_t size_bits;
249 X509Certificate::PublicKeyType type; 248 X509Certificate::PublicKeyType type;
250 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, 249 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, &type);
251 &type);
252 if (type == X509Certificate::kPublicKeyTypeRSA) { 250 if (type == X509Certificate::kPublicKeyTypeRSA) {
253 crypto::SignatureVerifier::HashAlgorithm hash_alg = 251 crypto::SignatureVerifier::HashAlgorithm hash_alg =
254 crypto::SignatureVerifier::SHA256; 252 crypto::SignatureVerifier::SHA256;
255 crypto::SignatureVerifier::HashAlgorithm mask_hash_alg = hash_alg; 253 crypto::SignatureVerifier::HashAlgorithm mask_hash_alg = hash_alg;
256 unsigned int hash_len = 32; // 32 is the length of a SHA-256 hash. 254 unsigned int hash_len = 32; // 32 is the length of a SHA-256 hash.
257 255
258 bool ok = verifier.VerifyInitRSAPSS( 256 bool ok = verifier.VerifyInitRSAPSS(
259 hash_alg, mask_hash_alg, hash_len, 257 hash_alg,
260 reinterpret_cast<const uint8*>(signature.data()), signature.size(), 258 mask_hash_alg,
261 reinterpret_cast<const uint8*>(spki.data()), spki.size()); 259 hash_len,
260 reinterpret_cast<const uint8*>(signature.data()),
261 signature.size(),
262 reinterpret_cast<const uint8*>(spki.data()),
263 spki.size());
262 if (!ok) { 264 if (!ok) {
263 DLOG(WARNING) << "VerifyInitRSAPSS failed"; 265 DLOG(WARNING) << "VerifyInitRSAPSS failed";
264 return false; 266 return false;
265 } 267 }
266 } else if (type == X509Certificate::kPublicKeyTypeECDSA) { 268 } else if (type == X509Certificate::kPublicKeyTypeECDSA) {
267 // This is the algorithm ID for ECDSA with SHA-256. Parameters are ABSENT. 269 // This is the algorithm ID for ECDSA with SHA-256. Parameters are ABSENT.
268 // RFC 5758: 270 // RFC 5758:
269 // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) 271 // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
270 // us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } 272 // us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 }
271 // ... 273 // ...
272 // When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or 274 // When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or
273 // ecdsa-with-SHA512 algorithm identifier appears in the algorithm field 275 // ecdsa-with-SHA512 algorithm identifier appears in the algorithm field
274 // as an AlgorithmIdentifier, the encoding MUST omit the parameters 276 // as an AlgorithmIdentifier, the encoding MUST omit the parameters
275 // field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one 277 // field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one
276 // component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with- 278 // component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-
277 // SHA384, or ecdsa-with-SHA512. 279 // SHA384, or ecdsa-with-SHA512.
278 // See also RFC 5480, Appendix A. 280 // See also RFC 5480, Appendix A.
279 static const uint8 kECDSAWithSHA256AlgorithmID[] = { 281 static const uint8 kECDSAWithSHA256AlgorithmID[] = {
280 0x30, 0x0a, 282 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02,
281 0x06, 0x08,
282 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02,
283 }; 283 };
284 284
285 if (!verifier.VerifyInit( 285 if (!verifier.VerifyInit(kECDSAWithSHA256AlgorithmID,
286 kECDSAWithSHA256AlgorithmID, sizeof(kECDSAWithSHA256AlgorithmID), 286 sizeof(kECDSAWithSHA256AlgorithmID),
287 reinterpret_cast<const uint8*>(signature.data()), 287 reinterpret_cast<const uint8*>(signature.data()),
288 signature.size(), 288 signature.size(),
289 reinterpret_cast<const uint8*>(spki.data()), 289 reinterpret_cast<const uint8*>(spki.data()),
290 spki.size())) { 290 spki.size())) {
291 DLOG(WARNING) << "VerifyInit failed"; 291 DLOG(WARNING) << "VerifyInit failed";
292 return false; 292 return false;
293 } 293 }
294 } else { 294 } else {
295 LOG(ERROR) << "Unsupported public key type " << type; 295 LOG(ERROR) << "Unsupported public key type " << type;
296 return false; 296 return false;
297 } 297 }
298 298
299 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(kProofSignatureLabel), 299 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(kProofSignatureLabel),
300 sizeof(kProofSignatureLabel)); 300 sizeof(kProofSignatureLabel));
301 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(signed_data.data()), 301 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(signed_data.data()),
302 signed_data.size()); 302 signed_data.size());
303 303
304 if (!verifier.VerifyFinal()) { 304 if (!verifier.VerifyFinal()) {
305 DLOG(WARNING) << "VerifyFinal failed"; 305 DLOG(WARNING) << "VerifyFinal failed";
306 return false; 306 return false;
307 } 307 }
308 308
309 DVLOG(1) << "VerifyFinal success"; 309 DVLOG(1) << "VerifyFinal success";
310 return true; 310 return true;
311 } 311 }
312 312
313 ProofVerifierChromium::ProofVerifierChromium(CertVerifier* cert_verifier) 313 ProofVerifierChromium::ProofVerifierChromium(CertVerifier* cert_verifier)
314 : cert_verifier_(cert_verifier) {} 314 : cert_verifier_(cert_verifier) {
315 }
315 316
316 ProofVerifierChromium::~ProofVerifierChromium() { 317 ProofVerifierChromium::~ProofVerifierChromium() {
317 STLDeleteElements(&active_jobs_); 318 STLDeleteElements(&active_jobs_);
318 } 319 }
319 320
320 ProofVerifierChromium::Status ProofVerifierChromium::VerifyProof( 321 ProofVerifierChromium::Status ProofVerifierChromium::VerifyProof(
321 const std::string& hostname, 322 const std::string& hostname,
322 const std::string& server_config, 323 const std::string& server_config,
323 const std::vector<std::string>& certs, 324 const std::vector<std::string>& certs,
324 const std::string& signature, 325 const std::string& signature,
325 const ProofVerifyContext* verify_context, 326 const ProofVerifyContext* verify_context,
326 std::string* error_details, 327 std::string* error_details,
327 scoped_ptr<ProofVerifyDetails>* verify_details, 328 scoped_ptr<ProofVerifyDetails>* verify_details,
328 ProofVerifierCallback* callback) { 329 ProofVerifierCallback* callback) {
329 if (!verify_context) { 330 if (!verify_context) {
330 *error_details = "Missing context"; 331 *error_details = "Missing context";
331 return FAILURE; 332 return FAILURE;
332 } 333 }
333 const ProofVerifyContextChromium* chromium_context = 334 const ProofVerifyContextChromium* chromium_context =
334 reinterpret_cast<const ProofVerifyContextChromium*>(verify_context); 335 reinterpret_cast<const ProofVerifyContextChromium*>(verify_context);
335 scoped_ptr<Job> job(new Job(this, cert_verifier_, chromium_context->net_log)); 336 scoped_ptr<Job> job(new Job(this, cert_verifier_, chromium_context->net_log));
336 Status status = job->VerifyProof(hostname, server_config, certs, signature, 337 Status status = job->VerifyProof(hostname,
337 error_details, verify_details, callback); 338 server_config,
339 certs,
340 signature,
341 error_details,
342 verify_details,
343 callback);
338 if (status == PENDING) { 344 if (status == PENDING) {
339 active_jobs_.insert(job.release()); 345 active_jobs_.insert(job.release());
340 } 346 }
341 return status; 347 return status;
342 } 348 }
343 349
344 void ProofVerifierChromium::OnJobComplete(Job* job) { 350 void ProofVerifierChromium::OnJobComplete(Job* job) {
345 active_jobs_.erase(job); 351 active_jobs_.erase(job);
346 delete job; 352 delete job;
347 } 353 }
348 354
349 } // namespace net 355 } // namespace net
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698