ssl_platform_key_util.cc 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107
  1. // Copyright 2015 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/ssl/ssl_platform_key_util.h"
  5. #include "base/lazy_instance.h"
  6. #include "base/logging.h"
  7. #include "base/strings/string_piece.h"
  8. #include "base/threading/thread.h"
  9. #include "crypto/openssl_util.h"
  10. #include "net/cert/asn1_util.h"
  11. #include "net/cert/x509_certificate.h"
  12. #include "net/cert/x509_util.h"
  13. #include "third_party/boringssl/src/include/openssl/bytestring.h"
  14. #include "third_party/boringssl/src/include/openssl/ec_key.h"
  15. #include "third_party/boringssl/src/include/openssl/evp.h"
  16. #include "third_party/boringssl/src/include/openssl/rsa.h"
  17. namespace net {
  18. namespace {
  19. class SSLPlatformKeyTaskRunner {
  20. public:
  21. SSLPlatformKeyTaskRunner() : worker_thread_("Platform Key Thread") {
  22. base::Thread::Options options;
  23. options.joinable = false;
  24. worker_thread_.StartWithOptions(std::move(options));
  25. }
  26. SSLPlatformKeyTaskRunner(const SSLPlatformKeyTaskRunner&) = delete;
  27. SSLPlatformKeyTaskRunner& operator=(const SSLPlatformKeyTaskRunner&) = delete;
  28. ~SSLPlatformKeyTaskRunner() = default;
  29. scoped_refptr<base::SingleThreadTaskRunner> task_runner() {
  30. return worker_thread_.task_runner();
  31. }
  32. private:
  33. base::Thread worker_thread_;
  34. };
  35. base::LazyInstance<SSLPlatformKeyTaskRunner>::Leaky g_platform_key_task_runner =
  36. LAZY_INSTANCE_INITIALIZER;
  37. } // namespace
  38. scoped_refptr<base::SingleThreadTaskRunner> GetSSLPlatformKeyTaskRunner() {
  39. return g_platform_key_task_runner.Get().task_runner();
  40. }
  41. bssl::UniquePtr<EVP_PKEY> GetClientCertPublicKey(
  42. const X509Certificate* certificate) {
  43. crypto::OpenSSLErrStackTracer tracker(FROM_HERE);
  44. base::StringPiece spki;
  45. if (!asn1::ExtractSPKIFromDERCert(
  46. x509_util::CryptoBufferAsStringPiece(certificate->cert_buffer()),
  47. &spki)) {
  48. LOG(ERROR) << "Could not extract SPKI from certificate.";
  49. return nullptr;
  50. }
  51. CBS cbs;
  52. CBS_init(&cbs, reinterpret_cast<const uint8_t*>(spki.data()), spki.size());
  53. bssl::UniquePtr<EVP_PKEY> key(EVP_parse_public_key(&cbs));
  54. if (!key || CBS_len(&cbs) != 0) {
  55. LOG(ERROR) << "Could not parse public key.";
  56. return nullptr;
  57. }
  58. return key;
  59. }
  60. bool GetClientCertInfo(const X509Certificate* certificate,
  61. int* out_type,
  62. size_t* out_max_length) {
  63. bssl::UniquePtr<EVP_PKEY> key = GetClientCertPublicKey(certificate);
  64. if (!key) {
  65. return false;
  66. }
  67. *out_type = EVP_PKEY_id(key.get());
  68. *out_max_length = EVP_PKEY_size(key.get());
  69. return true;
  70. }
  71. absl::optional<std::vector<uint8_t>> AddPSSPadding(
  72. EVP_PKEY* pubkey,
  73. const EVP_MD* md,
  74. base::span<const uint8_t> digest) {
  75. RSA* rsa = EVP_PKEY_get0_RSA(pubkey);
  76. if (!rsa) {
  77. return absl::nullopt;
  78. }
  79. std::vector<uint8_t> ret(RSA_size(rsa));
  80. if (digest.size() != EVP_MD_size(md) ||
  81. !RSA_padding_add_PKCS1_PSS_mgf1(rsa, ret.data(), digest.data(), md, md,
  82. -1 /* salt length is digest length */)) {
  83. return absl::nullopt;
  84. }
  85. return ret;
  86. }
  87. } // namespace net