Index: net/quic/crypto/aes_128_gcm_12_decrypter_nss.cc |
diff --git a/net/quic/crypto/aes_128_gcm_12_decrypter_nss.cc b/net/quic/crypto/aes_128_gcm_12_decrypter_nss.cc |
index 0ba82698a86677a6e3e8f9fbd6f6588bc31e59ea..6d1d139d2a1cf293036272a81b9b337e3c4f55a0 100644 |
--- a/net/quic/crypto/aes_128_gcm_12_decrypter_nss.cc |
+++ b/net/quic/crypto/aes_128_gcm_12_decrypter_nss.cc |
@@ -32,9 +32,7 @@ const size_t kNoncePrefixSize = 4; |
// resolution of PK11_Decrypt. |
class GcmSupportChecker { |
public: |
- static PK11_DecryptFunction pk11_decrypt_func() { |
- return pk11_decrypt_func_; |
- } |
+ static PK11_DecryptFunction pk11_decrypt_func() { return pk11_decrypt_func_; } |
private: |
friend struct base::DefaultLazyInstanceTraits<GcmSupportChecker>; |
@@ -49,8 +47,8 @@ class GcmSupportChecker { |
// If PK11_Decrypt() was successfully resolved, then NSS will support |
// AES-GCM directly. This was introduced in NSS 3.15. |
- pk11_decrypt_func_ = (PK11_DecryptFunction)dlsym(RTLD_DEFAULT, |
- "PK11_Decrypt"); |
+ pk11_decrypt_func_ = |
+ (PK11_DecryptFunction)dlsym(RTLD_DEFAULT, "PK11_Decrypt"); |
#endif |
} |
@@ -79,8 +77,8 @@ SECStatus My_Decrypt(PK11SymKey* key, |
PK11_DecryptFunction pk11_decrypt_func = |
GcmSupportChecker::pk11_decrypt_func(); |
if (pk11_decrypt_func != NULL) { |
- return pk11_decrypt_func(key, mechanism, param, out, out_len, max_len, enc, |
- enc_len); |
+ return pk11_decrypt_func( |
+ key, mechanism, param, out, out_len, max_len, enc, enc_len); |
} |
// Otherwise, the user has an older version of NSS. Regrettably, NSS 3.14.x |
@@ -104,19 +102,23 @@ SECStatus My_Decrypt(PK11SymKey* key, |
return SECFailure; |
} |
- SECItem my_param = { siBuffer, NULL, 0 }; |
+ SECItem my_param = {siBuffer, NULL, 0}; |
// Step 2. Let H = CIPH_K(128 '0' bits). |
unsigned char ghash_key[16] = {0}; |
- crypto::ScopedPK11Context ctx(PK11_CreateContextBySymKey( |
- CKM_AES_ECB, CKA_ENCRYPT, key, &my_param)); |
+ crypto::ScopedPK11Context ctx( |
+ PK11_CreateContextBySymKey(CKM_AES_ECB, CKA_ENCRYPT, key, &my_param)); |
if (!ctx) { |
DVLOG(1) << "PK11_CreateContextBySymKey failed"; |
return SECFailure; |
} |
int output_len; |
- if (PK11_CipherOp(ctx.get(), ghash_key, &output_len, sizeof(ghash_key), |
- ghash_key, sizeof(ghash_key)) != SECSuccess) { |
+ if (PK11_CipherOp(ctx.get(), |
+ ghash_key, |
+ &output_len, |
+ sizeof(ghash_key), |
+ ghash_key, |
+ sizeof(ghash_key)) != SECSuccess) { |
DVLOG(1) << "PK11_CipherOp failed"; |
return SECFailure; |
} |
@@ -142,8 +144,8 @@ SECStatus My_Decrypt(PK11SymKey* key, |
my_param.data = reinterpret_cast<unsigned char*>(&ctr_params); |
my_param.len = sizeof(ctr_params); |
- ctx.reset(PK11_CreateContextBySymKey(CKM_AES_CTR, CKA_ENCRYPT, key, |
- &my_param)); |
+ ctx.reset( |
+ PK11_CreateContextBySymKey(CKM_AES_CTR, CKA_ENCRYPT, key, &my_param)); |
if (!ctx) { |
DVLOG(1) << "PK11_CreateContextBySymKey failed"; |
return SECFailure; |
@@ -151,8 +153,12 @@ SECStatus My_Decrypt(PK11SymKey* key, |
// Step 6. Calculate the encryption mask of GCTR_K(J0, ...). |
unsigned char tag_mask[16] = {0}; |
- if (PK11_CipherOp(ctx.get(), tag_mask, &output_len, sizeof(tag_mask), |
- tag_mask, sizeof(tag_mask)) != SECSuccess) { |
+ if (PK11_CipherOp(ctx.get(), |
+ tag_mask, |
+ &output_len, |
+ sizeof(tag_mask), |
+ tag_mask, |
+ sizeof(tag_mask)) != SECSuccess) { |
DVLOG(1) << "PK11_CipherOp failed"; |
return SECFailure; |
} |
@@ -170,9 +176,13 @@ SECStatus My_Decrypt(PK11SymKey* key, |
// The const_cast for |enc| can be removed if system NSS libraries are |
// NSS 3.14.1 or later (NSS bug |
// https://bugzilla.mozilla.org/show_bug.cgi?id=808218). |
- if (PK11_CipherOp(ctx.get(), out, &output_len, max_len, |
- const_cast<unsigned char*>(enc), |
- enc_len - Aes128Gcm12Decrypter::kAuthTagSize) != SECSuccess) { |
+ if (PK11_CipherOp(ctx.get(), |
+ out, |
+ &output_len, |
+ max_len, |
+ const_cast<unsigned char*>(enc), |
+ enc_len - Aes128Gcm12Decrypter::kAuthTagSize) != |
+ SECSuccess) { |
DVLOG(1) << "PK11_CipherOp failed"; |
return SECFailure; |
} |
@@ -195,7 +205,8 @@ SECStatus My_Decrypt(PK11SymKey* key, |
auth_tag[i] ^= tag_mask[i]; |
} |
- if (NSS_SecureMemcmp(auth_tag, enc + output_len, |
+ if (NSS_SecureMemcmp(auth_tag, |
+ enc + output_len, |
Aes128Gcm12Decrypter::kAuthTagSize) != 0) { |
PORT_SetError(SEC_ERROR_BAD_DATA); |
return SECFailure; |
@@ -208,7 +219,10 @@ SECStatus My_Decrypt(PK11SymKey* key, |
} // namespace |
Aes128Gcm12Decrypter::Aes128Gcm12Decrypter() |
- : AeadBaseDecrypter(CKM_AES_GCM, My_Decrypt, kKeySize, kAuthTagSize, |
+ : AeadBaseDecrypter(CKM_AES_GCM, |
+ My_Decrypt, |
+ kKeySize, |
+ kAuthTagSize, |
kNoncePrefixSize) { |
COMPILE_ASSERT(kKeySize <= kMaxKeySize, key_size_too_big); |
COMPILE_ASSERT(kNoncePrefixSize <= kMaxNoncePrefixSize, |
@@ -216,7 +230,8 @@ Aes128Gcm12Decrypter::Aes128Gcm12Decrypter() |
ignore_result(g_gcm_support_checker.Get()); |
} |
-Aes128Gcm12Decrypter::~Aes128Gcm12Decrypter() {} |
+Aes128Gcm12Decrypter::~Aes128Gcm12Decrypter() { |
+} |
void Aes128Gcm12Decrypter::FillAeadParams(StringPiece nonce, |
StringPiece associated_data, |
@@ -224,8 +239,7 @@ void Aes128Gcm12Decrypter::FillAeadParams(StringPiece nonce, |
AeadParams* aead_params) const { |
aead_params->len = sizeof(aead_params->data.gcm_params); |
CK_GCM_PARAMS* gcm_params = &aead_params->data.gcm_params; |
- gcm_params->pIv = |
- reinterpret_cast<CK_BYTE*>(const_cast<char*>(nonce.data())); |
+ gcm_params->pIv = reinterpret_cast<CK_BYTE*>(const_cast<char*>(nonce.data())); |
gcm_params->ulIvLen = nonce.size(); |
gcm_params->pAAD = |
reinterpret_cast<CK_BYTE*>(const_cast<char*>(associated_data.data())); |