1 // Copyright 2015 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/ssl/ssl_platform_key_util.h"
6
7 #include <string_view>
8
9 #include "base/lazy_instance.h"
10 #include "base/logging.h"
11 #include "base/task/single_thread_task_runner.h"
12 #include "base/threading/thread.h"
13 #include "crypto/openssl_util.h"
14 #include "net/cert/asn1_util.h"
15 #include "net/cert/x509_certificate.h"
16 #include "net/cert/x509_util.h"
17 #include "third_party/boringssl/src/include/openssl/bytestring.h"
18 #include "third_party/boringssl/src/include/openssl/ec_key.h"
19 #include "third_party/boringssl/src/include/openssl/evp.h"
20 #include "third_party/boringssl/src/include/openssl/rsa.h"
21
22 namespace net {
23
24 namespace {
25
26 class SSLPlatformKeyTaskRunner {
27 public:
SSLPlatformKeyTaskRunner()28 SSLPlatformKeyTaskRunner() : worker_thread_("Platform Key Thread") {
29 base::Thread::Options options;
30 options.joinable = false;
31 worker_thread_.StartWithOptions(std::move(options));
32 }
33
34 SSLPlatformKeyTaskRunner(const SSLPlatformKeyTaskRunner&) = delete;
35 SSLPlatformKeyTaskRunner& operator=(const SSLPlatformKeyTaskRunner&) = delete;
36
37 ~SSLPlatformKeyTaskRunner() = default;
38
task_runner()39 scoped_refptr<base::SingleThreadTaskRunner> task_runner() {
40 return worker_thread_.task_runner();
41 }
42
43 private:
44 base::Thread worker_thread_;
45 };
46
47 base::LazyInstance<SSLPlatformKeyTaskRunner>::Leaky g_platform_key_task_runner =
48 LAZY_INSTANCE_INITIALIZER;
49
50 } // namespace
51
GetSSLPlatformKeyTaskRunner()52 scoped_refptr<base::SingleThreadTaskRunner> GetSSLPlatformKeyTaskRunner() {
53 return g_platform_key_task_runner.Get().task_runner();
54 }
55
GetClientCertPublicKey(const X509Certificate * certificate)56 bssl::UniquePtr<EVP_PKEY> GetClientCertPublicKey(
57 const X509Certificate* certificate) {
58 crypto::OpenSSLErrStackTracer tracker(FROM_HERE);
59
60 std::string_view spki;
61 if (!asn1::ExtractSPKIFromDERCert(
62 x509_util::CryptoBufferAsStringPiece(certificate->cert_buffer()),
63 &spki)) {
64 LOG(ERROR) << "Could not extract SPKI from certificate.";
65 return nullptr;
66 }
67
68 return ParseSpki(base::as_byte_span(spki));
69 }
70
GetClientCertInfo(const X509Certificate * certificate,int * out_type,size_t * out_max_length)71 bool GetClientCertInfo(const X509Certificate* certificate,
72 int* out_type,
73 size_t* out_max_length) {
74 bssl::UniquePtr<EVP_PKEY> key = GetClientCertPublicKey(certificate);
75 if (!key) {
76 return false;
77 }
78
79 *out_type = EVP_PKEY_id(key.get());
80 *out_max_length = EVP_PKEY_size(key.get());
81 return true;
82 }
83
ParseSpki(base::span<const uint8_t> spki)84 bssl::UniquePtr<EVP_PKEY> ParseSpki(base::span<const uint8_t> spki) {
85 CBS cbs;
86 CBS_init(&cbs, spki.data(), spki.size());
87 bssl::UniquePtr<EVP_PKEY> key(EVP_parse_public_key(&cbs));
88 if (!key || CBS_len(&cbs) != 0) {
89 LOG(ERROR) << "Could not parse public key.";
90 return nullptr;
91 }
92 return key;
93 }
94
GetPublicKeyInfo(base::span<const uint8_t> spki,int * out_type,size_t * out_max_length)95 bool GetPublicKeyInfo(base::span<const uint8_t> spki,
96 int* out_type,
97 size_t* out_max_length) {
98 auto key = ParseSpki(spki);
99 if (!key) {
100 return false;
101 }
102
103 *out_type = EVP_PKEY_id(key.get());
104 *out_max_length = EVP_PKEY_size(key.get());
105 return true;
106 }
107
AddPSSPadding(EVP_PKEY * pubkey,const EVP_MD * md,base::span<const uint8_t> digest)108 std::optional<std::vector<uint8_t>> AddPSSPadding(
109 EVP_PKEY* pubkey,
110 const EVP_MD* md,
111 base::span<const uint8_t> digest) {
112 RSA* rsa = EVP_PKEY_get0_RSA(pubkey);
113 if (!rsa) {
114 return std::nullopt;
115 }
116 std::vector<uint8_t> ret(RSA_size(rsa));
117 if (digest.size() != EVP_MD_size(md) ||
118 !RSA_padding_add_PKCS1_PSS_mgf1(rsa, ret.data(), digest.data(), md, md,
119 -1 /* salt length is digest length */)) {
120 return std::nullopt;
121 }
122 return ret;
123 }
124
125 } // namespace net
126