OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "extensions/common/cast/cast_cert_validator.h" | 5 #include "extensions/common/cast/cast_cert_validator.h" |
6 | 6 |
7 #include <openssl/digest.h> | 7 #include <openssl/digest.h> |
8 #include <openssl/evp.h> | 8 #include <openssl/evp.h> |
9 #include <openssl/rsa.h> | 9 #include <openssl/rsa.h> |
10 #include <openssl/x509.h> | 10 #include <openssl/x509.h> |
11 | 11 |
12 #include "base/logging.h" | 12 #include "base/logging.h" |
13 #include "base/strings/string_number_conversions.h" | 13 #include "base/strings/string_number_conversions.h" |
14 #include "base/strings/string_util.h" | 14 #include "base/strings/string_util.h" |
15 #include "base/strings/stringprintf.h" | 15 #include "base/strings/stringprintf.h" |
16 #include "crypto/openssl_util.h" | 16 #include "crypto/openssl_util.h" |
17 #include "crypto/scoped_openssl_types.h" | 17 #include "crypto/scoped_openssl_types.h" |
18 #include "extensions/browser/api/cast_channel/cast_auth_ica.h" | 18 #include "extensions/browser/api/cast_channel/cast_auth_ica.h" |
19 #include "net/cert/x509_certificate.h" | 19 #include "net/cert/x509_certificate.h" |
20 #include "net/cert/x509_util_openssl.h" | 20 #include "net/cert/x509_util_openssl.h" |
| 21 #include "net/ssl/scoped_openssl_types.h" |
21 | 22 |
22 namespace extensions { | 23 namespace extensions { |
23 namespace core_api { | 24 namespace core_api { |
24 namespace cast_crypto { | 25 namespace cast_crypto { |
25 namespace { | 26 namespace { |
26 | 27 |
27 typedef crypto::ScopedOpenSSL<X509, X509_free>::Type ScopedX509; | |
28 | |
29 class CertVerificationContextOpenSSL : public CertVerificationContext { | 28 class CertVerificationContextOpenSSL : public CertVerificationContext { |
30 public: | 29 public: |
31 // Takes ownership of the passed-in x509 object | 30 // Takes ownership of the passed-in x509 object |
32 explicit CertVerificationContextOpenSSL(X509* x509) : x509_(x509) {} | 31 explicit CertVerificationContextOpenSSL(X509* x509) : x509_(x509) {} |
33 | 32 |
34 VerificationResult VerifySignatureOverData( | 33 VerificationResult VerifySignatureOverData( |
35 const base::StringPiece& signature, | 34 const base::StringPiece& signature, |
36 const base::StringPiece& data) const override { | 35 const base::StringPiece& data) const override { |
37 // Retrieve public key object. | 36 // Retrieve public key object. |
38 crypto::ScopedEVP_PKEY public_key(X509_get_pubkey(x509_.get())); | 37 crypto::ScopedEVP_PKEY public_key(X509_get_pubkey(x509_.get())); |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
73 common_name_length = X509_NAME_get_text_by_NID( | 72 common_name_length = X509_NAME_get_text_by_NID( |
74 x509_->cert_info->subject, NID_commonName, | 73 x509_->cert_info->subject, NID_commonName, |
75 WriteInto(&common_name, static_cast<size_t>(common_name_length) + 1), | 74 WriteInto(&common_name, static_cast<size_t>(common_name_length) + 1), |
76 common_name_length + 1); | 75 common_name_length + 1); |
77 if (common_name_length < 0) | 76 if (common_name_length < 0) |
78 return std::string(); | 77 return std::string(); |
79 return common_name; | 78 return common_name; |
80 } | 79 } |
81 | 80 |
82 private: | 81 private: |
83 ScopedX509 x509_; | 82 net::ScopedX509 x509_; |
84 }; | 83 }; |
85 | 84 |
86 } // namespace | 85 } // namespace |
87 | 86 |
88 VerificationResult VerifyDeviceCert( | 87 VerificationResult VerifyDeviceCert( |
89 const base::StringPiece& device_cert, | 88 const base::StringPiece& device_cert, |
90 const std::vector<std::string>& ica_certs, | 89 const std::vector<std::string>& ica_certs, |
91 scoped_ptr<CertVerificationContext>* context) { | 90 scoped_ptr<CertVerificationContext>* context) { |
92 crypto::EnsureOpenSSLInit(); | 91 crypto::EnsureOpenSSLInit(); |
93 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 92 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
(...skipping 26 matching lines...) Expand all Loading... |
120 crypto::ScopedEVP_PKEY ica_public_key_evp(EVP_PKEY_new()); | 119 crypto::ScopedEVP_PKEY ica_public_key_evp(EVP_PKEY_new()); |
121 if (!ica_public_key_evp || | 120 if (!ica_public_key_evp || |
122 !EVP_PKEY_set1_RSA(ica_public_key_evp.get(), ica_public_key_rsa.get())) { | 121 !EVP_PKEY_set1_RSA(ica_public_key_evp.get(), ica_public_key_rsa.get())) { |
123 return VerificationResult("Failed to import trusted public key.", | 122 return VerificationResult("Failed to import trusted public key.", |
124 VerificationResult::ERROR_INTERNAL); | 123 VerificationResult::ERROR_INTERNAL); |
125 } | 124 } |
126 // Parse the device certificate. | 125 // Parse the device certificate. |
127 const uint8_t* device_cert_der_ptr = | 126 const uint8_t* device_cert_der_ptr = |
128 reinterpret_cast<const uint8_t*>(device_cert.data()); | 127 reinterpret_cast<const uint8_t*>(device_cert.data()); |
129 const uint8_t* device_cert_der_end = device_cert_der_ptr + device_cert.size(); | 128 const uint8_t* device_cert_der_end = device_cert_der_ptr + device_cert.size(); |
130 ScopedX509 device_cert_x509( | 129 net::ScopedX509 device_cert_x509( |
131 d2i_X509(NULL, &device_cert_der_ptr, device_cert.size())); | 130 d2i_X509(NULL, &device_cert_der_ptr, device_cert.size())); |
132 if (!device_cert_x509 || device_cert_der_ptr != device_cert_der_end) { | 131 if (!device_cert_x509 || device_cert_der_ptr != device_cert_der_end) { |
133 return VerificationResult("Failed to parse device certificate.", | 132 return VerificationResult("Failed to parse device certificate.", |
134 VerificationResult::ERROR_CERT_INVALID); | 133 VerificationResult::ERROR_CERT_INVALID); |
135 } | 134 } |
136 // Verify device certificate. | 135 // Verify device certificate. |
137 if (X509_verify(device_cert_x509.get(), ica_public_key_evp.get()) != 1) { | 136 if (X509_verify(device_cert_x509.get(), ica_public_key_evp.get()) != 1) { |
138 return VerificationResult( | 137 return VerificationResult( |
139 "Device certificate signature verification failed.", | 138 "Device certificate signature verification failed.", |
140 VerificationResult::ERROR_CERT_INVALID); | 139 VerificationResult::ERROR_CERT_INVALID); |
141 } | 140 } |
142 | 141 |
143 if (context) { | 142 if (context) { |
144 scoped_ptr<CertVerificationContext> tmp_context( | 143 scoped_ptr<CertVerificationContext> tmp_context( |
145 new CertVerificationContextOpenSSL(device_cert_x509.release())); | 144 new CertVerificationContextOpenSSL(device_cert_x509.release())); |
146 tmp_context.swap(*context); | 145 tmp_context.swap(*context); |
147 } | 146 } |
148 | 147 |
149 return VerificationResult(); | 148 return VerificationResult(); |
150 } | 149 } |
151 | 150 |
152 std::string VerificationResult::GetLogString() const { | 151 std::string VerificationResult::GetLogString() const { |
153 return error_message; | 152 return error_message; |
154 } | 153 } |
155 | 154 |
156 } // namespace cast_crypto | 155 } // namespace cast_crypto |
157 } // namespace core_api | 156 } // namespace core_api |
158 } // namespace extensions | 157 } // namespace extensions |
OLD | NEW |