OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/ssl/ssl_platform_key_android.h" | 5 #include "net/ssl/ssl_platform_key_android.h" |
6 | 6 |
7 #include <strings.h> | 7 #include <strings.h> |
8 | 8 |
9 #include <memory> | 9 #include <memory> |
10 #include <utility> | 10 #include <utility> |
11 #include <vector> | 11 #include <vector> |
12 | 12 |
13 #include "base/android/build_info.h" | 13 #include "base/android/build_info.h" |
14 #include "base/android/scoped_java_ref.h" | 14 #include "base/android/scoped_java_ref.h" |
15 #include "base/lazy_instance.h" | 15 #include "base/lazy_instance.h" |
16 #include "base/logging.h" | 16 #include "base/logging.h" |
17 #include "base/macros.h" | 17 #include "base/macros.h" |
18 #include "base/memory/ptr_util.h" | 18 #include "base/memory/ptr_util.h" |
19 #include "net/android/keystore.h" | 19 #include "net/android/keystore.h" |
20 #include "net/android/legacy_openssl.h" | 20 #include "net/android/legacy_openssl.h" |
21 #include "net/base/net_errors.h" | 21 #include "net/base/net_errors.h" |
22 #include "net/ssl/openssl_client_key_store.h" | 22 #include "net/ssl/openssl_client_key_store.h" |
23 #include "net/ssl/ssl_platform_key.h" | 23 #include "net/ssl/ssl_platform_key.h" |
24 #include "net/ssl/ssl_platform_key_util.h" | 24 #include "net/ssl/ssl_platform_key_util.h" |
25 #include "net/ssl/threaded_ssl_private_key.h" | 25 #include "net/ssl/threaded_ssl_private_key.h" |
26 #include "third_party/boringssl/src/include/openssl/ecdsa.h" | 26 #include "third_party/boringssl/src/include/openssl/ecdsa.h" |
| 27 #include "third_party/boringssl/src/include/openssl/evp.h" |
27 #include "third_party/boringssl/src/include/openssl/mem.h" | 28 #include "third_party/boringssl/src/include/openssl/mem.h" |
28 #include "third_party/boringssl/src/include/openssl/nid.h" | 29 #include "third_party/boringssl/src/include/openssl/nid.h" |
29 #include "third_party/boringssl/src/include/openssl/rsa.h" | 30 #include "third_party/boringssl/src/include/openssl/rsa.h" |
30 | 31 |
31 using base::android::JavaRef; | 32 using base::android::JavaRef; |
32 using base::android::ScopedJavaGlobalRef; | 33 using base::android::ScopedJavaGlobalRef; |
33 using base::android::ScopedJavaLocalRef; | 34 using base::android::ScopedJavaLocalRef; |
34 | 35 |
35 namespace net { | 36 namespace net { |
36 | 37 |
(...skipping 30 matching lines...) Expand all Loading... |
67 }; | 68 }; |
68 | 69 |
69 void LeakEngine(const JavaRef<jobject>& private_key) { | 70 void LeakEngine(const JavaRef<jobject>& private_key) { |
70 static base::LazyInstance<KeystoreEngineWorkaround>::Leaky s_instance = | 71 static base::LazyInstance<KeystoreEngineWorkaround>::Leaky s_instance = |
71 LAZY_INSTANCE_INITIALIZER; | 72 LAZY_INSTANCE_INITIALIZER; |
72 s_instance.Get().LeakEngine(private_key); | 73 s_instance.Get().LeakEngine(private_key); |
73 } | 74 } |
74 | 75 |
75 class SSLPlatformKeyAndroid : public ThreadedSSLPrivateKey::Delegate { | 76 class SSLPlatformKeyAndroid : public ThreadedSSLPrivateKey::Delegate { |
76 public: | 77 public: |
77 SSLPlatformKeyAndroid(SSLPrivateKey::Type type, | 78 SSLPlatformKeyAndroid(int type, |
78 const JavaRef<jobject>& key, | 79 const JavaRef<jobject>& key, |
79 size_t max_length, | 80 size_t max_length, |
80 android::AndroidRSA* legacy_rsa) | 81 android::AndroidRSA* legacy_rsa) |
81 : type_(type), max_length_(max_length), legacy_rsa_(legacy_rsa) { | 82 : type_(type), max_length_(max_length), legacy_rsa_(legacy_rsa) { |
82 key_.Reset(key); | 83 key_.Reset(key); |
83 } | 84 } |
84 | 85 |
85 ~SSLPlatformKeyAndroid() override {} | 86 ~SSLPlatformKeyAndroid() override {} |
86 | 87 |
87 SSLPrivateKey::Type GetType() override { return type_; } | |
88 | |
89 std::vector<SSLPrivateKey::Hash> GetDigestPreferences() override { | 88 std::vector<SSLPrivateKey::Hash> GetDigestPreferences() override { |
90 static const SSLPrivateKey::Hash kHashes[] = { | 89 static const SSLPrivateKey::Hash kHashes[] = { |
91 SSLPrivateKey::Hash::SHA512, SSLPrivateKey::Hash::SHA384, | 90 SSLPrivateKey::Hash::SHA512, SSLPrivateKey::Hash::SHA384, |
92 SSLPrivateKey::Hash::SHA256, SSLPrivateKey::Hash::SHA1}; | 91 SSLPrivateKey::Hash::SHA256, SSLPrivateKey::Hash::SHA1}; |
93 return std::vector<SSLPrivateKey::Hash>(kHashes, | 92 return std::vector<SSLPrivateKey::Hash>(kHashes, |
94 kHashes + arraysize(kHashes)); | 93 kHashes + arraysize(kHashes)); |
95 } | 94 } |
96 | 95 |
97 size_t GetMaxSignatureLengthInBytes() override { return max_length_; } | |
98 | |
99 Error SignDigest(SSLPrivateKey::Hash hash, | 96 Error SignDigest(SSLPrivateKey::Hash hash, |
100 const base::StringPiece& input_in, | 97 const base::StringPiece& input_in, |
101 std::vector<uint8_t>* signature) override { | 98 std::vector<uint8_t>* signature) override { |
102 base::StringPiece input = input_in; | 99 base::StringPiece input = input_in; |
103 | 100 |
104 // Prepend the DigestInfo for RSA. | 101 // Prepend the DigestInfo for RSA. |
105 bssl::UniquePtr<uint8_t> digest_info_storage; | 102 bssl::UniquePtr<uint8_t> digest_info_storage; |
106 if (type_ == SSLPrivateKey::Type::RSA) { | 103 if (type_ == EVP_PKEY_RSA) { |
107 int hash_nid = NID_undef; | 104 int hash_nid = NID_undef; |
108 switch (hash) { | 105 switch (hash) { |
109 case SSLPrivateKey::Hash::MD5_SHA1: | 106 case SSLPrivateKey::Hash::MD5_SHA1: |
110 hash_nid = NID_md5_sha1; | 107 hash_nid = NID_md5_sha1; |
111 break; | 108 break; |
112 case SSLPrivateKey::Hash::SHA1: | 109 case SSLPrivateKey::Hash::SHA1: |
113 hash_nid = NID_sha1; | 110 hash_nid = NID_sha1; |
114 break; | 111 break; |
115 case SSLPrivateKey::Hash::SHA256: | 112 case SSLPrivateKey::Hash::SHA256: |
116 hash_nid = NID_sha256; | 113 hash_nid = NID_sha256; |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
161 } | 158 } |
162 | 159 |
163 if (!android::RawSignDigestWithPrivateKey(key_, input, signature)) { | 160 if (!android::RawSignDigestWithPrivateKey(key_, input, signature)) { |
164 LOG(WARNING) << "Could not sign message with private key!"; | 161 LOG(WARNING) << "Could not sign message with private key!"; |
165 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED; | 162 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED; |
166 } | 163 } |
167 return OK; | 164 return OK; |
168 } | 165 } |
169 | 166 |
170 private: | 167 private: |
171 SSLPrivateKey::Type type_; | 168 int type_; |
172 ScopedJavaGlobalRef<jobject> key_; | 169 ScopedJavaGlobalRef<jobject> key_; |
173 size_t max_length_; | 170 size_t max_length_; |
174 android::AndroidRSA* legacy_rsa_; | 171 android::AndroidRSA* legacy_rsa_; |
175 | 172 |
176 DISALLOW_COPY_AND_ASSIGN(SSLPlatformKeyAndroid); | 173 DISALLOW_COPY_AND_ASSIGN(SSLPlatformKeyAndroid); |
177 }; | 174 }; |
178 | 175 |
179 } // namespace | 176 } // namespace |
180 | 177 |
181 scoped_refptr<SSLPrivateKey> WrapJavaPrivateKey( | 178 scoped_refptr<SSLPrivateKey> WrapJavaPrivateKey( |
182 const X509Certificate* certificate, | 179 const X509Certificate* certificate, |
183 const JavaRef<jobject>& key) { | 180 const JavaRef<jobject>& key) { |
184 SSLPrivateKey::Type type; | 181 int type; |
185 size_t max_length; | 182 size_t max_length; |
186 if (!GetClientCertInfo(certificate, &type, &max_length)) | 183 if (!GetClientCertInfo(certificate, &type, &max_length)) |
187 return nullptr; | 184 return nullptr; |
188 | 185 |
189 android::AndroidRSA* sys_rsa = nullptr; | 186 android::AndroidRSA* sys_rsa = nullptr; |
190 if (type == SSLPrivateKey::Type::RSA) { | 187 if (type == EVP_PKEY_RSA) { |
191 const int kAndroid42ApiLevel = 17; | 188 const int kAndroid42ApiLevel = 17; |
192 if (base::android::BuildInfo::GetInstance()->sdk_int() < | 189 if (base::android::BuildInfo::GetInstance()->sdk_int() < |
193 kAndroid42ApiLevel) { | 190 kAndroid42ApiLevel) { |
194 // Route around platform limitations: if Android < 4.2, then | 191 // Route around platform limitations: if Android < 4.2, then |
195 // base::android::RawSignDigestWithPrivateKey() cannot work, so try to get | 192 // base::android::RawSignDigestWithPrivateKey() cannot work, so try to get |
196 // the system OpenSSL's EVP_PKEY backing this PrivateKey object. | 193 // the system OpenSSL's EVP_PKEY backing this PrivateKey object. |
197 android::AndroidEVP_PKEY* sys_pkey = | 194 android::AndroidEVP_PKEY* sys_pkey = |
198 android::GetOpenSSLSystemHandleForPrivateKey(key); | 195 android::GetOpenSSLSystemHandleForPrivateKey(key); |
199 if (!sys_pkey) | 196 if (!sys_pkey) |
200 return nullptr; | 197 return nullptr; |
(...skipping 21 matching lines...) Expand all Loading... |
222 GetSSLPlatformKeyTaskRunner())); | 219 GetSSLPlatformKeyTaskRunner())); |
223 } | 220 } |
224 | 221 |
225 scoped_refptr<SSLPrivateKey> FetchClientCertPrivateKey( | 222 scoped_refptr<SSLPrivateKey> FetchClientCertPrivateKey( |
226 const X509Certificate* certificate) { | 223 const X509Certificate* certificate) { |
227 return OpenSSLClientKeyStore::GetInstance()->FetchClientCertPrivateKey( | 224 return OpenSSLClientKeyStore::GetInstance()->FetchClientCertPrivateKey( |
228 certificate); | 225 certificate); |
229 } | 226 } |
230 | 227 |
231 } // namespace net | 228 } // namespace net |
OLD | NEW |