[webcrypto] Don't disallow RSA public key import using SPKI format when on Linux.

content/child/webcrypto/nss/rsa_key_nss.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/webcrypto/nss/rsa_key_nss.h"
 
 #include "base/logging.h"
 #include "content/child/webcrypto/crypto_data.h"
 #include "content/child/webcrypto/jwk.h"
 #include "content/child/webcrypto/nss/key_nss.h"
@@ skipping 37 matching lines @@
 }
 
 bool CreatePrivateKeyAlgorithm(const blink::WebCryptoAlgorithm& algorithm,
                                SECKEYPrivateKey* key,
                                blink::WebCryptoKeyAlgorithm* key_algorithm) {
   crypto::ScopedSECKEYPublicKey public_key(SECKEY_ConvertToPublicKey(key));
   return CreatePublicKeyAlgorithm(algorithm, public_key.get(), key_algorithm);
 }
 
 #if defined(USE_NSS) && !defined(OS_CHROMEOS)
-Status ErrorRsaKeyImportNotSupported() {
+Status ErrorRsaPrivateKeyImportNotSupported() {
   return Status::ErrorUnsupported(
-      "NSS version must be at least 3.16.2 for RSA key import. See "
+      "NSS version must be at least 3.16.2 for RSA private key import. See "
       "http://crbug.com/380424");
 }
 
 // Prior to NSS 3.16.2 RSA key parameters were not validated. This is
 // a security problem for RSA private key import from JWK which uses a
 // CKA_ID based on the public modulus to retrieve the private key.
-Status NssSupportsRsaKeyImport() {
+Status NssSupportsRsaPrivateKeyImport() {
   if (!NSS_VersionCheck("3.16.2"))
-    return ErrorRsaKeyImportNotSupported();
+    return ErrorRsaPrivateKeyImportNotSupported();
 
   // Also ensure that the version of Softoken is 3.16.2 or later.
   crypto::ScopedPK11Slot slot(PK11_GetInternalSlot());
   CK_SLOT_INFO info = {};
   if (PK11_GetSlotInfo(slot.get(), &info) != SECSuccess)
-    return ErrorRsaKeyImportNotSupported();
+    return ErrorRsaPrivateKeyImportNotSupported();
 
   // CK_SLOT_INFO.hardwareVersion contains the major.minor
   // version info for Softoken in the corresponding .major/.minor
   // fields, and .firmwareVersion contains the patch.build
   // version info (in the .major/.minor fields)
   if ((info.hardwareVersion.major > 3) ||
       (info.hardwareVersion.major == 3 &&
        (info.hardwareVersion.minor > 16 ||
         (info.hardwareVersion.minor == 16 &&
          info.firmwareVersion.major >= 2)))) {
     return Status::Success();
   }
 
-  return ErrorRsaKeyImportNotSupported();
+  return ErrorRsaPrivateKeyImportNotSupported();
 }
 #else
-Status NssSupportsRsaKeyImport() {
+Status NssSupportsRsaPrivateKeyImport() {
   return Status::Success();
 }
 #endif
 
 bool CreateRsaHashedPublicKeyAlgorithm(
     const blink::WebCryptoAlgorithm& algorithm,
     SECKEYPublicKey* key,
     blink::WebCryptoKeyAlgorithm* key_algorithm) {
   // TODO(eroman): What about other key types rsaPss, rsaOaep.
   if (!key || key->keyType != rsaKey)
@@ skipping 236 matching lines @@
 
   buffer->assign(encoded_key->data, encoded_key->data + encoded_key->len);
   return Status::Success();
 }
 
 Status ImportRsaPrivateKey(const blink::WebCryptoAlgorithm& algorithm,
                            bool extractable,
                            blink::WebCryptoKeyUsageMask usage_mask,
                            const JwkRsaInfo& params,
                            blink::WebCryptoKey* key) {
-  Status status = NssSupportsRsaKeyImport();
+  Status status = NssSupportsRsaPrivateKeyImport();
   if (status.IsError())
     return status;
 
   CK_OBJECT_CLASS obj_class = CKO_PRIVATE_KEY;
   CK_KEY_TYPE key_type = CKK_RSA;
   CK_BBOOL ck_false = CK_FALSE;
 
   std::vector<CK_ATTRIBUTE> key_template;
 
   AddAttribute(CKA_CLASS, &obj_class, sizeof(obj_class), &key_template);
@@ skipping 282 matching lines @@
       return Status::ErrorUnsupportedImportKeyFormat();
   }
 }
 
 Status RsaHashedAlgorithm::ImportKeyPkcs8(
     const CryptoData& key_data,
     const blink::WebCryptoAlgorithm& algorithm,
     bool extractable,
     blink::WebCryptoKeyUsageMask usage_mask,
     blink::WebCryptoKey* key) const {
-  Status status = NssSupportsRsaKeyImport();
+  Status status = NssSupportsRsaPrivateKeyImport();
   if (status.IsError())
     return status;
 
   if (!key_data.byte_length())
     return Status::ErrorImportEmptyKeyData();
 
   // The binary blob 'key_data' is expected to be a DER-encoded ASN.1 PKCS#8
   // private key info object.
   SECItem pki_der = MakeSECItemForBuffer(key_data);
 
@@ skipping 39 matching lines @@
 
   return Status::Success();
 }
 
 Status RsaHashedAlgorithm::ImportKeySpki(
     const CryptoData& key_data,
     const blink::WebCryptoAlgorithm& algorithm,
     bool extractable,
     blink::WebCryptoKeyUsageMask usage_mask,
     blink::WebCryptoKey* key) const {
-  Status status = NssSupportsRsaKeyImport();
-  if (status.IsError())
-    return status;
-
   if (!key_data.byte_length())
     return Status::ErrorImportEmptyKeyData();
 
   // The binary blob 'key_data' is expected to be a DER-encoded ASN.1 Subject
   // Public Key Info. Decode this to a CERTSubjectPublicKeyInfo.
   SECItem spki_item = MakeSECItemForBuffer(key_data);
   const ScopedCERTSubjectPublicKeyInfo spki(
       SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
   if (!spki)
     return Status::DataError();
 
   crypto::ScopedSECKEYPublicKey sec_public_key(
       SECKEY_ExtractPublicKey(spki.get()));
   if (!sec_public_key)
     return Status::DataError();
 
   const KeyType sec_key_type = SECKEY_GetPublicKeyType(sec_public_key.get());
   if (sec_key_type != rsaKey)
     return Status::DataError();
 
   blink::WebCryptoKeyAlgorithm key_algorithm;
   if (!CreateRsaHashedPublicKeyAlgorithm(
           algorithm, sec_public_key.get(), &key_algorithm))
     return Status::ErrorUnexpected();
 
   // TODO(eroman): This is probably going to be the same as the input.
   std::vector<uint8_t> spki_data;
-  status = ExportKeySpkiNss(sec_public_key.get(), &spki_data);
+  Status status = ExportKeySpkiNss(sec_public_key.get(), &spki_data);
   if (status.IsError())
     return status;
 
   scoped_ptr<PublicKeyNss> key_handle(
       new PublicKeyNss(sec_public_key.Pass(), CryptoData(spki_data)));
 
   *key = blink::WebCryptoKey::create(key_handle.release(),
                                      blink::WebCryptoKeyTypePublic,
                                      extractable,
                                      key_algorithm,
@@ skipping 101 matching lines @@
       return Status::Success();
     }
     default:
       return Status::ErrorUnexpected();
   }
 }
 
 }  // namespace webcrypto
 
 }  // namespace content