1 // Copyright 2016 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/ssl/test_ssl_private_key.h"
6
7 #include <memory>
8 #include <utility>
9
10 #include "crypto/rsa_private_key.h"
11 #include "net/base/net_errors.h"
12 #include "net/ssl/ssl_platform_key_util.h"
13 #include "net/ssl/ssl_private_key.h"
14 #include "net/ssl/threaded_ssl_private_key.h"
15 #include "third_party/boringssl/src/include/openssl/digest.h"
16 #include "third_party/boringssl/src/include/openssl/ec.h"
17 #include "third_party/boringssl/src/include/openssl/evp.h"
18 #include "third_party/boringssl/src/include/openssl/rsa.h"
19 #include "third_party/boringssl/src/include/openssl/ssl.h"
20
21 namespace net {
22
23 namespace {
24
25 class TestSSLPlatformKey : public ThreadedSSLPrivateKey::Delegate {
26 public:
TestSSLPlatformKey(bssl::UniquePtr<EVP_PKEY> key)27 explicit TestSSLPlatformKey(bssl::UniquePtr<EVP_PKEY> key)
28 : key_(std::move(key)) {}
29
30 TestSSLPlatformKey(const TestSSLPlatformKey&) = delete;
31 TestSSLPlatformKey& operator=(const TestSSLPlatformKey&) = delete;
32
33 ~TestSSLPlatformKey() override = default;
34
GetProviderName()35 std::string GetProviderName() override { return "EVP_PKEY"; }
36
GetAlgorithmPreferences()37 std::vector<uint16_t> GetAlgorithmPreferences() override {
38 return SSLPrivateKey::DefaultAlgorithmPreferences(EVP_PKEY_id(key_.get()),
39 true /* supports PSS */);
40 }
41
Sign(uint16_t algorithm,base::span<const uint8_t> input,std::vector<uint8_t> * signature)42 Error Sign(uint16_t algorithm,
43 base::span<const uint8_t> input,
44 std::vector<uint8_t>* signature) override {
45 bssl::ScopedEVP_MD_CTX ctx;
46 EVP_PKEY_CTX* pctx;
47 if (!EVP_DigestSignInit(ctx.get(), &pctx,
48 SSL_get_signature_algorithm_digest(algorithm),
49 nullptr, key_.get())) {
50 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED;
51 }
52 if (SSL_is_signature_algorithm_rsa_pss(algorithm)) {
53 if (!EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) ||
54 !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1 /* hash length */)) {
55 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED;
56 }
57 }
58 size_t sig_len = 0;
59 if (!EVP_DigestSign(ctx.get(), nullptr, &sig_len, input.data(),
60 input.size()))
61 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED;
62 signature->resize(sig_len);
63 if (!EVP_DigestSign(ctx.get(), signature->data(), &sig_len, input.data(),
64 input.size())) {
65 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED;
66 }
67 signature->resize(sig_len);
68 return OK;
69 }
70
71 private:
72 bssl::UniquePtr<EVP_PKEY> key_;
73 };
74
75 class FailingSSLPlatformKey : public ThreadedSSLPrivateKey::Delegate {
76 public:
77 FailingSSLPlatformKey() = default;
78
79 FailingSSLPlatformKey(const FailingSSLPlatformKey&) = delete;
80 FailingSSLPlatformKey& operator=(const FailingSSLPlatformKey&) = delete;
81
82 ~FailingSSLPlatformKey() override = default;
83
GetProviderName()84 std::string GetProviderName() override { return "FailingSSLPlatformKey"; }
85
GetAlgorithmPreferences()86 std::vector<uint16_t> GetAlgorithmPreferences() override {
87 return SSLPrivateKey::DefaultAlgorithmPreferences(EVP_PKEY_RSA,
88 true /* supports PSS */);
89 }
90
Sign(uint16_t algorithm,base::span<const uint8_t> input,std::vector<uint8_t> * signature)91 Error Sign(uint16_t algorithm,
92 base::span<const uint8_t> input,
93 std::vector<uint8_t>* signature) override {
94 return ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED;
95 }
96 };
97
98 } // namespace
99
WrapOpenSSLPrivateKey(bssl::UniquePtr<EVP_PKEY> key)100 scoped_refptr<SSLPrivateKey> WrapOpenSSLPrivateKey(
101 bssl::UniquePtr<EVP_PKEY> key) {
102 if (!key)
103 return nullptr;
104
105 return base::MakeRefCounted<ThreadedSSLPrivateKey>(
106 std::make_unique<TestSSLPlatformKey>(std::move(key)),
107 GetSSLPlatformKeyTaskRunner());
108 }
109
WrapRSAPrivateKey(crypto::RSAPrivateKey * rsa_private_key)110 scoped_refptr<SSLPrivateKey> WrapRSAPrivateKey(
111 crypto::RSAPrivateKey* rsa_private_key) {
112 return net::WrapOpenSSLPrivateKey(bssl::UpRef(rsa_private_key->key()));
113 }
114
CreateFailSigningSSLPrivateKey()115 scoped_refptr<SSLPrivateKey> CreateFailSigningSSLPrivateKey() {
116 return base::MakeRefCounted<ThreadedSSLPrivateKey>(
117 std::make_unique<FailingSSLPlatformKey>(), GetSSLPlatformKeyTaskRunner());
118 }
119
120 } // namespace net
121