1 // Copyright 2015 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/ssl/ssl_platform_key_util.h"
6
7 #include "base/lazy_instance.h"
8 #include "base/logging.h"
9 #include "base/strings/string_piece.h"
10 #include "base/task/single_thread_task_runner.h"
11 #include "base/threading/thread.h"
12 #include "crypto/openssl_util.h"
13 #include "net/cert/asn1_util.h"
14 #include "net/cert/x509_certificate.h"
15 #include "net/cert/x509_util.h"
16 #include "third_party/boringssl/src/include/openssl/bytestring.h"
17 #include "third_party/boringssl/src/include/openssl/ec_key.h"
18 #include "third_party/boringssl/src/include/openssl/evp.h"
19 #include "third_party/boringssl/src/include/openssl/rsa.h"
20
21 namespace net {
22
23 namespace {
24
25 class SSLPlatformKeyTaskRunner {
26 public:
SSLPlatformKeyTaskRunner()27 SSLPlatformKeyTaskRunner() : worker_thread_("Platform Key Thread") {
28 base::Thread::Options options;
29 options.joinable = false;
30 worker_thread_.StartWithOptions(std::move(options));
31 }
32
33 SSLPlatformKeyTaskRunner(const SSLPlatformKeyTaskRunner&) = delete;
34 SSLPlatformKeyTaskRunner& operator=(const SSLPlatformKeyTaskRunner&) = delete;
35
36 ~SSLPlatformKeyTaskRunner() = default;
37
task_runner()38 scoped_refptr<base::SingleThreadTaskRunner> task_runner() {
39 return worker_thread_.task_runner();
40 }
41
42 private:
43 base::Thread worker_thread_;
44 };
45
46 base::LazyInstance<SSLPlatformKeyTaskRunner>::Leaky g_platform_key_task_runner =
47 LAZY_INSTANCE_INITIALIZER;
48
49 } // namespace
50
GetSSLPlatformKeyTaskRunner()51 scoped_refptr<base::SingleThreadTaskRunner> GetSSLPlatformKeyTaskRunner() {
52 return g_platform_key_task_runner.Get().task_runner();
53 }
54
GetClientCertPublicKey(const X509Certificate * certificate)55 bssl::UniquePtr<EVP_PKEY> GetClientCertPublicKey(
56 const X509Certificate* certificate) {
57 crypto::OpenSSLErrStackTracer tracker(FROM_HERE);
58
59 base::StringPiece spki;
60 if (!asn1::ExtractSPKIFromDERCert(
61 x509_util::CryptoBufferAsStringPiece(certificate->cert_buffer()),
62 &spki)) {
63 LOG(ERROR) << "Could not extract SPKI from certificate.";
64 return nullptr;
65 }
66
67 CBS cbs;
68 CBS_init(&cbs, reinterpret_cast<const uint8_t*>(spki.data()), spki.size());
69 bssl::UniquePtr<EVP_PKEY> key(EVP_parse_public_key(&cbs));
70 if (!key || CBS_len(&cbs) != 0) {
71 LOG(ERROR) << "Could not parse public key.";
72 return nullptr;
73 }
74
75 return key;
76 }
77
GetClientCertInfo(const X509Certificate * certificate,int * out_type,size_t * out_max_length)78 bool GetClientCertInfo(const X509Certificate* certificate,
79 int* out_type,
80 size_t* out_max_length) {
81 bssl::UniquePtr<EVP_PKEY> key = GetClientCertPublicKey(certificate);
82 if (!key) {
83 return false;
84 }
85
86 *out_type = EVP_PKEY_id(key.get());
87 *out_max_length = EVP_PKEY_size(key.get());
88 return true;
89 }
90
AddPSSPadding(EVP_PKEY * pubkey,const EVP_MD * md,base::span<const uint8_t> digest)91 absl::optional<std::vector<uint8_t>> AddPSSPadding(
92 EVP_PKEY* pubkey,
93 const EVP_MD* md,
94 base::span<const uint8_t> digest) {
95 RSA* rsa = EVP_PKEY_get0_RSA(pubkey);
96 if (!rsa) {
97 return absl::nullopt;
98 }
99 std::vector<uint8_t> ret(RSA_size(rsa));
100 if (digest.size() != EVP_MD_size(md) ||
101 !RSA_padding_add_PKCS1_PSS_mgf1(rsa, ret.data(), digest.data(), md, md,
102 -1 /* salt length is digest length */)) {
103 return absl::nullopt;
104 }
105 return ret;
106 }
107
108 } // namespace net
109