| Index: net/ssl/ssl_platform_key_win.cc
|
| diff --git a/net/ssl/ssl_platform_key_win.cc b/net/ssl/ssl_platform_key_win.cc
|
| index a7df5021e4f0acc631856154275619c128ba8445..c2684d977fbf982f61238b6a2be959cc9fca8dcf 100644
|
| --- a/net/ssl/ssl_platform_key_win.cc
|
| +++ b/net/ssl/ssl_platform_key_win.cc
|
| @@ -33,13 +33,11 @@ namespace {
|
| class SSLPlatformKeyCAPI : public ThreadedSSLPrivateKey::Delegate {
|
| public:
|
| // Takes ownership of |provider|.
|
| - SSLPlatformKeyCAPI(HCRYPTPROV provider, DWORD key_spec, size_t max_length)
|
| - : provider_(provider), key_spec_(key_spec), max_length_(max_length) {}
|
| + SSLPlatformKeyCAPI(HCRYPTPROV provider, DWORD key_spec)
|
| + : provider_(provider), key_spec_(key_spec) {}
|
|
|
| ~SSLPlatformKeyCAPI() override {}
|
|
|
| - SSLPrivateKey::Type GetType() override { return SSLPrivateKey::Type::RSA; }
|
| -
|
| std::vector<SSLPrivateKey::Hash> GetDigestPreferences() override {
|
| // If the key is in CAPI, assume conservatively that the CAPI service
|
| // provider may only be able to sign pre-TLS-1.2 and SHA-1 hashes.
|
| @@ -50,8 +48,6 @@ class SSLPlatformKeyCAPI : public ThreadedSSLPrivateKey::Delegate {
|
| kHashes + arraysize(kHashes));
|
| }
|
|
|
| - size_t GetMaxSignatureLengthInBytes() override { return max_length_; }
|
| -
|
| Error SignDigest(SSLPrivateKey::Hash hash,
|
| const base::StringPiece& input,
|
| std::vector<uint8_t>* signature) override {
|
| @@ -118,7 +114,6 @@ class SSLPlatformKeyCAPI : public ThreadedSSLPrivateKey::Delegate {
|
| private:
|
| crypto::ScopedHCRYPTPROV provider_;
|
| DWORD key_spec_;
|
| - size_t max_length_;
|
|
|
| DISALLOW_COPY_AND_ASSIGN(SSLPlatformKeyCAPI);
|
| };
|
| @@ -126,21 +121,17 @@ class SSLPlatformKeyCAPI : public ThreadedSSLPrivateKey::Delegate {
|
| class SSLPlatformKeyCNG : public ThreadedSSLPrivateKey::Delegate {
|
| public:
|
| // Takes ownership of |key|.
|
| - SSLPlatformKeyCNG(NCRYPT_KEY_HANDLE key,
|
| - SSLPrivateKey::Type type,
|
| - size_t max_length)
|
| + SSLPlatformKeyCNG(NCRYPT_KEY_HANDLE key, int type, size_t max_length)
|
| : key_(key), type_(type), max_length_(max_length) {}
|
|
|
| ~SSLPlatformKeyCNG() override { NCryptFreeObject(key_); }
|
|
|
| - SSLPrivateKey::Type GetType() override { return type_; }
|
| -
|
| std::vector<SSLPrivateKey::Hash> GetDigestPreferences() override {
|
| // If this is an under 1024-bit RSA key, conservatively prefer to sign
|
| // SHA-1 hashes. Older Estonian ID cards can only sign SHA-1 hashes.
|
| // However, if the server doesn't advertise SHA-1, the remaining hashes
|
| // might still be supported.
|
| - if (type_ == SSLPrivateKey::Type::RSA && max_length_ <= 1024 / 8) {
|
| + if (type_ == EVP_PKEY_RSA && max_length_ <= 1024 / 8) {
|
| static const SSLPrivateKey::Hash kHashesSpecial[] = {
|
| SSLPrivateKey::Hash::SHA1, SSLPrivateKey::Hash::SHA512,
|
| SSLPrivateKey::Hash::SHA384, SSLPrivateKey::Hash::SHA256};
|
| @@ -154,8 +145,6 @@ class SSLPlatformKeyCNG : public ThreadedSSLPrivateKey::Delegate {
|
| kHashes + arraysize(kHashes));
|
| }
|
|
|
| - size_t GetMaxSignatureLengthInBytes() override { return max_length_; }
|
| -
|
| Error SignDigest(SSLPrivateKey::Hash hash,
|
| const base::StringPiece& input,
|
| std::vector<uint8_t>* signature) override {
|
| @@ -164,7 +153,7 @@ class SSLPlatformKeyCNG : public ThreadedSSLPrivateKey::Delegate {
|
| BCRYPT_PKCS1_PADDING_INFO rsa_padding_info = {0};
|
| void* padding_info = nullptr;
|
| DWORD flags = 0;
|
| - if (type_ == SSLPrivateKey::Type::RSA) {
|
| + if (type_ == EVP_PKEY_RSA) {
|
| switch (hash) {
|
| case SSLPrivateKey::Hash::MD5_SHA1:
|
| rsa_padding_info.pszAlgId = nullptr;
|
| @@ -208,7 +197,7 @@ class SSLPlatformKeyCNG : public ThreadedSSLPrivateKey::Delegate {
|
|
|
| // CNG emits raw ECDSA signatures, but BoringSSL expects a DER-encoded
|
| // ECDSA-Sig-Value.
|
| - if (SSLPrivateKey::IsECDSAType(type_)) {
|
| + if (type_ == EVP_PKEY_EC) {
|
| if (signature->size() % 2 != 0) {
|
| LOG(ERROR) << "Bad signature length";
|
| return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED;
|
| @@ -238,7 +227,7 @@ class SSLPlatformKeyCNG : public ThreadedSSLPrivateKey::Delegate {
|
|
|
| private:
|
| NCRYPT_KEY_HANDLE key_;
|
| - SSLPrivateKey::Type type_;
|
| + int type_;
|
| size_t max_length_;
|
|
|
| DISALLOW_COPY_AND_ASSIGN(SSLPlatformKeyCNG);
|
| @@ -251,7 +240,7 @@ scoped_refptr<SSLPrivateKey> FetchClientCertPrivateKey(
|
| // Rather than query the private key for metadata, extract the public key from
|
| // the certificate without using Windows APIs. CAPI and CNG do not
|
| // consistently work depending on the system. See https://crbug.com/468345.
|
| - SSLPrivateKey::Type key_type;
|
| + int key_type;
|
| size_t max_length;
|
| if (!GetClientCertInfo(certificate, &key_type, &max_length))
|
| return nullptr;
|
| @@ -277,8 +266,8 @@ scoped_refptr<SSLPrivateKey> FetchClientCertPrivateKey(
|
| if (key_spec == CERT_NCRYPT_KEY_SPEC) {
|
| delegate.reset(new SSLPlatformKeyCNG(prov_or_key, key_type, max_length));
|
| } else {
|
| - DCHECK(SSLPrivateKey::Type::RSA == key_type);
|
| - delegate.reset(new SSLPlatformKeyCAPI(prov_or_key, key_spec, max_length));
|
| + DCHECK_EQ(EVP_PKEY_RSA, key_type);
|
| + delegate.reset(new SSLPlatformKeyCAPI(prov_or_key, key_spec));
|
| }
|
| return make_scoped_refptr(new ThreadedSSLPrivateKey(
|
| std::move(delegate), GetSSLPlatformKeyTaskRunner()));
|
|
|