1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
// Copyright 2015 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/ssl/ssl_platform_key_util.h"
#include "base/lazy_instance.h"
#include "base/logging.h"
#include "base/strings/string_piece.h"
#include "base/task/single_thread_task_runner.h"
#include "base/threading/thread.h"
#include "crypto/openssl_util.h"
#include "net/cert/asn1_util.h"
#include "net/cert/x509_certificate.h"
#include "net/cert/x509_util.h"
#include "third_party/boringssl/src/include/openssl/bytestring.h"
#include "third_party/boringssl/src/include/openssl/ec_key.h"
#include "third_party/boringssl/src/include/openssl/evp.h"
#include "third_party/boringssl/src/include/openssl/rsa.h"
namespace net {
namespace {
class SSLPlatformKeyTaskRunner {
public:
SSLPlatformKeyTaskRunner() : worker_thread_("Platform Key Thread") {
base::Thread::Options options;
options.joinable = false;
worker_thread_.StartWithOptions(std::move(options));
}
SSLPlatformKeyTaskRunner(const SSLPlatformKeyTaskRunner&) = delete;
SSLPlatformKeyTaskRunner& operator=(const SSLPlatformKeyTaskRunner&) = delete;
~SSLPlatformKeyTaskRunner() = default;
scoped_refptr<base::SingleThreadTaskRunner> task_runner() {
return worker_thread_.task_runner();
}
private:
base::Thread worker_thread_;
};
base::LazyInstance<SSLPlatformKeyTaskRunner>::Leaky g_platform_key_task_runner =
LAZY_INSTANCE_INITIALIZER;
} // namespace
scoped_refptr<base::SingleThreadTaskRunner> GetSSLPlatformKeyTaskRunner() {
return g_platform_key_task_runner.Get().task_runner();
}
bssl::UniquePtr<EVP_PKEY> GetClientCertPublicKey(
const X509Certificate* certificate) {
crypto::OpenSSLErrStackTracer tracker(FROM_HERE);
base::StringPiece spki;
if (!asn1::ExtractSPKIFromDERCert(
x509_util::CryptoBufferAsStringPiece(certificate->cert_buffer()),
&spki)) {
LOG(ERROR) << "Could not extract SPKI from certificate.";
return nullptr;
}
CBS cbs;
CBS_init(&cbs, reinterpret_cast<const uint8_t*>(spki.data()), spki.size());
bssl::UniquePtr<EVP_PKEY> key(EVP_parse_public_key(&cbs));
if (!key || CBS_len(&cbs) != 0) {
LOG(ERROR) << "Could not parse public key.";
return nullptr;
}
return key;
}
bool GetClientCertInfo(const X509Certificate* certificate,
int* out_type,
size_t* out_max_length) {
bssl::UniquePtr<EVP_PKEY> key = GetClientCertPublicKey(certificate);
if (!key) {
return false;
}
*out_type = EVP_PKEY_id(key.get());
*out_max_length = EVP_PKEY_size(key.get());
return true;
}
absl::optional<std::vector<uint8_t>> AddPSSPadding(
EVP_PKEY* pubkey,
const EVP_MD* md,
base::span<const uint8_t> digest) {
RSA* rsa = EVP_PKEY_get0_RSA(pubkey);
if (!rsa) {
return absl::nullopt;
}
std::vector<uint8_t> ret(RSA_size(rsa));
if (digest.size() != EVP_MD_size(md) ||
!RSA_padding_add_PKCS1_PSS_mgf1(rsa, ret.data(), digest.data(), md, md,
-1 /* salt length is digest length */)) {
return absl::nullopt;
}
return ret;
}
} // namespace net
|
