1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/ssl/ssl_platform_key_util.h"
6
7 #include "base/lazy_instance.h"
8 #include "base/logging.h"
9 #include "base/macros.h"
10 #include "base/strings/string_piece.h"
11 #include "base/threading/thread.h"
12 #include "crypto/openssl_util.h"
13 #include "net/cert/asn1_util.h"
14 #include "net/cert/x509_certificate.h"
15 #include "net/cert/x509_util.h"
16 #include "third_party/boringssl/src/include/openssl/bytestring.h"
17 #include "third_party/boringssl/src/include/openssl/ec_key.h"
18 #include "third_party/boringssl/src/include/openssl/evp.h"
19 #include "third_party/boringssl/src/include/openssl/rsa.h"
20
21 namespace net {
22
23 namespace {
24
25 class SSLPlatformKeyTaskRunner {
26 public:
SSLPlatformKeyTaskRunner()27 SSLPlatformKeyTaskRunner() : worker_thread_("Platform Key Thread") {
28 base::Thread::Options options;
29 options.joinable = false;
30 worker_thread_.StartWithOptions(options);
31 }
32
33 ~SSLPlatformKeyTaskRunner() = default;
34
task_runner()35 scoped_refptr<base::SingleThreadTaskRunner> task_runner() {
36 return worker_thread_.task_runner();
37 }
38
39 private:
40 base::Thread worker_thread_;
41
42 DISALLOW_COPY_AND_ASSIGN(SSLPlatformKeyTaskRunner);
43 };
44
45 base::LazyInstance<SSLPlatformKeyTaskRunner>::Leaky g_platform_key_task_runner =
46 LAZY_INSTANCE_INITIALIZER;
47
48 } // namespace
49
GetSSLPlatformKeyTaskRunner()50 scoped_refptr<base::SingleThreadTaskRunner> GetSSLPlatformKeyTaskRunner() {
51 return g_platform_key_task_runner.Get().task_runner();
52 }
53
GetClientCertPublicKey(const X509Certificate * certificate)54 bssl::UniquePtr<EVP_PKEY> GetClientCertPublicKey(
55 const X509Certificate* certificate) {
56 crypto::OpenSSLErrStackTracer tracker(FROM_HERE);
57
58 base::StringPiece spki;
59 if (!asn1::ExtractSPKIFromDERCert(
60 x509_util::CryptoBufferAsStringPiece(certificate->cert_buffer()),
61 &spki)) {
62 LOG(ERROR) << "Could not extract SPKI from certificate.";
63 return nullptr;
64 }
65
66 CBS cbs;
67 CBS_init(&cbs, reinterpret_cast<const uint8_t*>(spki.data()), spki.size());
68 bssl::UniquePtr<EVP_PKEY> key(EVP_parse_public_key(&cbs));
69 if (!key || CBS_len(&cbs) != 0) {
70 LOG(ERROR) << "Could not parse public key.";
71 return nullptr;
72 }
73
74 return key;
75 }
76
GetClientCertInfo(const X509Certificate * certificate,int * out_type,size_t * out_max_length)77 bool GetClientCertInfo(const X509Certificate* certificate,
78 int* out_type,
79 size_t* out_max_length) {
80 bssl::UniquePtr<EVP_PKEY> key = GetClientCertPublicKey(certificate);
81 if (!key) {
82 return false;
83 }
84
85 *out_type = EVP_PKEY_id(key.get());
86 *out_max_length = EVP_PKEY_size(key.get());
87 return true;
88 }
89
AddPSSPadding(EVP_PKEY * pubkey,const EVP_MD * md,base::span<const uint8_t> digest)90 base::Optional<std::vector<uint8_t>> AddPSSPadding(
91 EVP_PKEY* pubkey,
92 const EVP_MD* md,
93 base::span<const uint8_t> digest) {
94 RSA* rsa = EVP_PKEY_get0_RSA(pubkey);
95 if (!rsa) {
96 return base::nullopt;
97 }
98 std::vector<uint8_t> ret(RSA_size(rsa));
99 if (digest.size() != EVP_MD_size(md) ||
100 !RSA_padding_add_PKCS1_PSS_mgf1(rsa, ret.data(), digest.data(), md, md,
101 -1 /* salt length is digest length */)) {
102 return base::nullopt;
103 }
104 return ret;
105 }
106
107 } // namespace net
108