OLD | NEW |
(Empty) | |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 #include "net/quic/crypto/proof_verifier_chromium.h" |
| 6 |
| 7 #include "base/bind.h" |
| 8 #include "base/bind_helpers.h" |
| 9 #include "base/callback_helpers.h" |
| 10 #include "base/compiler_specific.h" |
| 11 #include "base/logging.h" |
| 12 #include "base/strings/stringprintf.h" |
| 13 #include "crypto/signature_verifier.h" |
| 14 #include "net/base/net_errors.h" |
| 15 #include "net/base/net_log.h" |
| 16 #include "net/cert/asn1_util.h" |
| 17 #include "net/cert/cert_status_flags.h" |
| 18 #include "net/cert/cert_verifier.h" |
| 19 #include "net/cert/cert_verify_result.h" |
| 20 #include "net/cert/single_request_cert_verifier.h" |
| 21 #include "net/cert/x509_certificate.h" |
| 22 #include "net/cert/x509_util.h" |
| 23 #include "net/quic/crypto/crypto_protocol.h" |
| 24 #include "net/ssl/ssl_config_service.h" |
| 25 |
| 26 using base::StringPiece; |
| 27 using base::StringPrintf; |
| 28 using std::string; |
| 29 using std::vector; |
| 30 |
| 31 namespace net { |
| 32 |
| 33 ProofVerifierChromium::ProofVerifierChromium(CertVerifier* cert_verifier, |
| 34 const BoundNetLog& net_log) |
| 35 : cert_verifier_(cert_verifier), |
| 36 error_details_(NULL), |
| 37 next_state_(STATE_NONE), |
| 38 net_log_(net_log) { |
| 39 } |
| 40 |
| 41 ProofVerifierChromium::~ProofVerifierChromium() { |
| 42 verifier_.reset(); |
| 43 |
| 44 // Reset object state. |
| 45 callback_.Reset(); |
| 46 cert_verify_result_.Reset(); |
| 47 } |
| 48 |
| 49 int ProofVerifierChromium::VerifyProof(const string& hostname, |
| 50 const string& server_config, |
| 51 const vector<string>& certs, |
| 52 const string& signature, |
| 53 std::string* error_details, |
| 54 const CompletionCallback& callback) { |
| 55 DCHECK(error_details); |
| 56 error_details->clear(); |
| 57 |
| 58 DCHECK_EQ(STATE_NONE, next_state_); |
| 59 if (STATE_NONE != next_state_) { |
| 60 *error_details = "Certificate is already set and VerifyProof has begun"; |
| 61 DLOG(WARNING) << *error_details; |
| 62 return ERR_FAILED; |
| 63 } |
| 64 |
| 65 if (certs.empty()) { |
| 66 *error_details = "Failed to create certificate chain. Certs are empty."; |
| 67 DLOG(WARNING) << *error_details; |
| 68 return ERR_FAILED; |
| 69 } |
| 70 |
| 71 // Convert certs to X509Certificate. |
| 72 vector<StringPiece> cert_pieces(certs.size()); |
| 73 for (unsigned i = 0; i < certs.size(); i++) { |
| 74 cert_pieces[i] = base::StringPiece(certs[i]); |
| 75 } |
| 76 cert_ = X509Certificate::CreateFromDERCertChain(cert_pieces); |
| 77 if (!cert_.get()) { |
| 78 cert_verify_result_.Reset(); |
| 79 cert_verify_result_.cert_status = CERT_STATUS_INVALID; |
| 80 *error_details = "Failed to create certificate chain"; |
| 81 DLOG(WARNING) << *error_details; |
| 82 return ERR_FAILED; |
| 83 } |
| 84 |
| 85 // We call VerifySignature first to avoid copying of server_config and |
| 86 // signature. |
| 87 if (!VerifySignature(server_config, signature, certs[0])) { |
| 88 *error_details = "Failed to verify signature of server config"; |
| 89 DLOG(WARNING) << *error_details; |
| 90 return ERR_FAILED; |
| 91 } |
| 92 |
| 93 hostname_ = hostname; |
| 94 callback_ = callback; |
| 95 error_details_ = error_details; |
| 96 |
| 97 next_state_ = STATE_VERIFY_CERT; |
| 98 return DoLoop(OK); |
| 99 } |
| 100 |
| 101 int ProofVerifierChromium::DoLoop(int last_result) { |
| 102 int rv = last_result; |
| 103 do { |
| 104 State state = next_state_; |
| 105 next_state_ = STATE_NONE; |
| 106 switch (state) { |
| 107 case STATE_VERIFY_CERT: |
| 108 DCHECK(rv == OK); |
| 109 rv = DoVerifyCert(rv); |
| 110 break; |
| 111 case STATE_VERIFY_CERT_COMPLETE: |
| 112 rv = DoVerifyCertComplete(rv); |
| 113 break; |
| 114 case STATE_NONE: |
| 115 default: |
| 116 rv = ERR_UNEXPECTED; |
| 117 LOG(DFATAL) << "unexpected state " << state; |
| 118 break; |
| 119 } |
| 120 } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE); |
| 121 return rv; |
| 122 } |
| 123 |
| 124 void ProofVerifierChromium::OnIOComplete(int result) { |
| 125 int rv = DoLoop(result); |
| 126 if (rv != ERR_IO_PENDING) { |
| 127 base::ResetAndReturn(&callback_).Run(rv); |
| 128 } |
| 129 } |
| 130 |
| 131 int ProofVerifierChromium::DoVerifyCert(int result) { |
| 132 next_state_ = STATE_VERIFY_CERT_COMPLETE; |
| 133 |
| 134 int flags = 0; |
| 135 verifier_.reset(new SingleRequestCertVerifier(cert_verifier_)); |
| 136 return verifier_->Verify( |
| 137 cert_.get(), |
| 138 hostname_, |
| 139 flags, |
| 140 SSLConfigService::GetCRLSet().get(), |
| 141 &cert_verify_result_, |
| 142 base::Bind(&ProofVerifierChromium::OnIOComplete, |
| 143 base::Unretained(this)), |
| 144 net_log_); |
| 145 } |
| 146 |
| 147 int ProofVerifierChromium::DoVerifyCertComplete(int result) { |
| 148 verifier_.reset(); |
| 149 |
| 150 if (result <= ERR_FAILED) { |
| 151 *error_details_ = StringPrintf("Failed to verify certificate chain: %s", |
| 152 ErrorToString(result)); |
| 153 DLOG(WARNING) << *error_details_; |
| 154 result = ERR_FAILED; |
| 155 } |
| 156 |
| 157 // Exit DoLoop and return the result to the caller to VerifyProof. |
| 158 DCHECK_EQ(STATE_NONE, next_state_); |
| 159 return result; |
| 160 } |
| 161 |
| 162 bool ProofVerifierChromium::VerifySignature(const string& signed_data, |
| 163 const string& signature, |
| 164 const string& cert) { |
| 165 StringPiece spki; |
| 166 if (!asn1::ExtractSPKIFromDERCert(cert, &spki)) { |
| 167 DLOG(WARNING) << "ExtractSPKIFromDERCert failed"; |
| 168 return false; |
| 169 } |
| 170 |
| 171 crypto::SignatureVerifier verifier; |
| 172 |
| 173 size_t size_bits; |
| 174 X509Certificate::PublicKeyType type; |
| 175 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits, |
| 176 &type); |
| 177 if (type == X509Certificate::kPublicKeyTypeRSA) { |
| 178 crypto::SignatureVerifier::HashAlgorithm hash_alg = |
| 179 crypto::SignatureVerifier::SHA256; |
| 180 crypto::SignatureVerifier::HashAlgorithm mask_hash_alg = hash_alg; |
| 181 unsigned int hash_len = 32; // 32 is the length of a SHA-256 hash. |
| 182 // TODO(wtc): change this to hash_len when we can change the wire format. |
| 183 unsigned int salt_len = signature.size() - hash_len - 2; |
| 184 |
| 185 bool ok = verifier.VerifyInitRSAPSS( |
| 186 hash_alg, mask_hash_alg, salt_len, |
| 187 reinterpret_cast<const uint8*>(signature.data()), signature.size(), |
| 188 reinterpret_cast<const uint8*>(spki.data()), spki.size()); |
| 189 if (!ok) { |
| 190 DLOG(WARNING) << "VerifyInitRSAPSS failed"; |
| 191 return false; |
| 192 } |
| 193 } else if (type == X509Certificate::kPublicKeyTypeECDSA) { |
| 194 // This is the algorithm ID for ECDSA with SHA-256. Parameters are ABSENT. |
| 195 // RFC 5758: |
| 196 // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) |
| 197 // us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } |
| 198 // ... |
| 199 // When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or |
| 200 // ecdsa-with-SHA512 algorithm identifier appears in the algorithm field |
| 201 // as an AlgorithmIdentifier, the encoding MUST omit the parameters |
| 202 // field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one |
| 203 // component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with- |
| 204 // SHA384, or ecdsa-with-SHA512. |
| 205 // See also RFC 5480, Appendix A. |
| 206 static const uint8 kECDSAWithSHA256AlgorithmID[] = { |
| 207 0x30, 0x0a, |
| 208 0x06, 0x08, |
| 209 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, |
| 210 }; |
| 211 |
| 212 if (!verifier.VerifyInit( |
| 213 kECDSAWithSHA256AlgorithmID, sizeof(kECDSAWithSHA256AlgorithmID), |
| 214 reinterpret_cast<const uint8*>(signature.data()), |
| 215 signature.size(), |
| 216 reinterpret_cast<const uint8*>(spki.data()), |
| 217 spki.size())) { |
| 218 DLOG(WARNING) << "VerifyInit failed"; |
| 219 return false; |
| 220 } |
| 221 } else { |
| 222 LOG(ERROR) << "Unsupported public key type " << type; |
| 223 return false; |
| 224 } |
| 225 |
| 226 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(kProofSignatureLabel), |
| 227 sizeof(kProofSignatureLabel)); |
| 228 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(signed_data.data()), |
| 229 signed_data.size()); |
| 230 |
| 231 if (!verifier.VerifyFinal()) { |
| 232 DLOG(WARNING) << "VerifyFinal failed"; |
| 233 return false; |
| 234 } |
| 235 |
| 236 DLOG(INFO) << "VerifyFinal success"; |
| 237 return true; |
| 238 } |
| 239 |
| 240 } // namespace net |
OLD | NEW |