Support generation of EC keys using P256 curve and support ECDSA certs.

webrtc/base/opensslidentity.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 28 matching lines @@
 // Random bits for certificate serial number
 static const int SERIAL_RAND_BITS = 64;
 
 // Certificate validity lifetime
 static const int CERTIFICATE_LIFETIME = 60*60*24*30;  // 30 days, arbitrarily
 // Certificate validity window.
 // This is to compensate for slightly incorrect system clocks.
 static const int CERTIFICATE_WINDOW = -60*60*24;
 
 // Generate a key pair. Caller is responsible for freeing the returned object.
-static EVP_PKEY* MakeKey() {
+static EVP_PKEY* MakeKey(KeyType key_type) {
   LOG(LS_INFO) << "Making key pair";
   EVP_PKEY* pkey = EVP_PKEY_new();
-  // RSA_generate_key is deprecated. Use _ex version.
-  BIGNUM* exponent = BN_new();
-  RSA* rsa = RSA_new();
-  if (!pkey || !exponent || !rsa ||
-      !BN_set_word(exponent, 0x10001) ||  // 65537 RSA exponent
-      !RSA_generate_key_ex(rsa, KEY_LENGTH, exponent, NULL) ||
-      !EVP_PKEY_assign_RSA(pkey, rsa)) {
+  if (key_type == KT_RSA) {
+    BIGNUM* exponent = BN_new();
+    RSA* rsa = RSA_new();
+    if (!pkey || !exponent || !rsa ||
+        !BN_set_word(exponent, 0x10001) ||  // 65537 RSA exponent
+        !RSA_generate_key_ex(rsa, KEY_LENGTH, exponent, NULL) ||
+        !EVP_PKEY_assign_RSA(pkey, rsa)) {
+      EVP_PKEY_free(pkey);
+      BN_free(exponent);
+      RSA_free(rsa);
+      LOG(LS_ERROR) << "Failed to make RSA key pair";
+      return NULL;
+    }
+    // ownership of rsa struct was assigned, don't free it.
+    BN_free(exponent);
+  } else if (key_type == KT_ECDSA) {
+    EC_KEY* ec_key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+    if (!pkey || !ec_key || !EC_KEY_generate_key(ec_key) ||
+        !EVP_PKEY_assign_EC_KEY(pkey, ec_key)) {
+      EVP_PKEY_free(pkey);
+      EC_KEY_free(ec_key);
+      LOG(LS_ERROR) << "Failed to make EC key pair";
+      return NULL;
+    }
+  } else {
     EVP_PKEY_free(pkey);
-    BN_free(exponent);
-    RSA_free(rsa);
+    LOG(LS_ERROR) << "Key type requested not understood";

[tommi, 2015/06/15 21:02:42]

[D]CHECK instead?

[torbjorng (webrtc), 2015/06/16 14:11:51]

Caller needs handle this, making no change.

     return NULL;
   }
-  // ownership of rsa struct was assigned, don't free it.
-  BN_free(exponent);
+
   LOG(LS_INFO) << "Returning key pair";
   return pkey;
 }
 
 // Generate a self-signed certificate, with the public key from the
 // given key pair. Caller is responsible for freeing the returned object.
 static X509* MakeCertificate(EVP_PKEY* pkey, const SSLIdentityParams& params) {
   LOG(LS_INFO) << "Making certificate for " << params.common_name;
   X509* x509 = NULL;
   BIGNUM* serial_number = NULL;
@@ skipping 55 matching lines @@
 static void LogSSLErrors(const std::string& prefix) {
   char error_buf[200];
   unsigned long err;
 
   while ((err = ERR_get_error()) != 0) {
     ERR_error_string_n(err, error_buf, sizeof(error_buf));
     LOG(LS_ERROR) << prefix << ": " << error_buf << "\n";
   }
 }
 
-OpenSSLKeyPair* OpenSSLKeyPair::Generate() {
-  EVP_PKEY* pkey = MakeKey();
+OpenSSLKeyPair* OpenSSLKeyPair::Generate(KeyType key_type) {
+  EVP_PKEY* pkey = MakeKey(key_type);
   if (!pkey) {
     LogSSLErrors("Generating key pair");
     return NULL;
   }
   return new OpenSSLKeyPair(pkey);
 }
 
 OpenSSLKeyPair::~OpenSSLKeyPair() {
   EVP_PKEY_free(pkey_);
 }
@@ skipping 47 matching lines @@
   X509_free(x509);
   return ret;
 }
 
 OpenSSLCertificate* OpenSSLCertificate::FromPEMString(
     const std::string& pem_string) {
   BIO* bio = BIO_new_mem_buf(const_cast<char*>(pem_string.c_str()), -1);
   if (!bio)
     return NULL;
   BIO_set_mem_eof_return(bio, 0);
-  X509 *x509 = PEM_read_bio_X509(bio, NULL, NULL,
-                                 const_cast<char*>("\0"));
+  X509* x509 = PEM_read_bio_X509(bio, NULL, NULL, const_cast<char*>("\0"));
   BIO_free(bio);  // Frees the BIO, but not the pointed-to string.
 
   if (!x509)
     return NULL;
 
   OpenSSLCertificate* ret = new OpenSSLCertificate(x509);
   X509_free(x509);
   return ret;
 }
 
@@ skipping 54 matching lines @@
                                        size_t size,
                                        size_t* length) const {
   return ComputeDigest(x509_, algorithm, digest, size, length);
 }
 
 bool OpenSSLCertificate::ComputeDigest(const X509* x509,
                                        const std::string& algorithm,
                                        unsigned char* digest,
                                        size_t size,
                                        size_t* length) {
-  const EVP_MD *md;
+  const EVP_MD* md;
   unsigned int n;
 
   if (!OpenSSLDigest::GetDigestEVP(algorithm, &md))
     return false;
 
   if (size < static_cast<size_t>(EVP_MD_size(md)))
     return false;
 
   X509_digest(x509, md, digest, &n);
 
@@ skipping 58 matching lines @@
 OpenSSLIdentity::OpenSSLIdentity(OpenSSLKeyPair* key_pair,
                                  OpenSSLCertificate* certificate)
     : key_pair_(key_pair), certificate_(certificate) {
   ASSERT(key_pair != NULL);
   ASSERT(certificate != NULL);
 }
 
 OpenSSLIdentity::~OpenSSLIdentity() = default;
 
 OpenSSLIdentity* OpenSSLIdentity::GenerateInternal(
-    const SSLIdentityParams& params) {
-  OpenSSLKeyPair *key_pair = OpenSSLKeyPair::Generate();
+    const SSLIdentityParams& params,
+    KeyType key_type) {
+  OpenSSLKeyPair* key_pair = OpenSSLKeyPair::Generate(key_type);
   if (key_pair) {
-    OpenSSLCertificate *certificate = OpenSSLCertificate::Generate(
-        key_pair, params);
+    OpenSSLCertificate* certificate =
+        OpenSSLCertificate::Generate(key_pair, params);
     if (certificate)
       return new OpenSSLIdentity(key_pair, certificate);
     delete key_pair;
   }
   LOG(LS_INFO) << "Identity generation failed";
   return NULL;
 }
 
-OpenSSLIdentity* OpenSSLIdentity::Generate(const std::string& common_name) {
+OpenSSLIdentity* OpenSSLIdentity::Generate(const std::string& common_name,
+                                           KeyType key_type) {
   SSLIdentityParams params;
   params.common_name = common_name;
   params.not_before = CERTIFICATE_WINDOW;
   params.not_after = CERTIFICATE_LIFETIME;
-  return GenerateInternal(params);
+  return GenerateInternal(params, key_type);
 }
 
 OpenSSLIdentity* OpenSSLIdentity::GenerateForTest(
-    const SSLIdentityParams& params) {
-  return GenerateInternal(params);
+    const SSLIdentityParams& params,
+    KeyType key_type) {
+  return GenerateInternal(params, key_type);
 }
 
 SSLIdentity* OpenSSLIdentity::FromPEMStrings(
     const std::string& private_key,
     const std::string& certificate) {
   scoped_ptr<OpenSSLCertificate> cert(
       OpenSSLCertificate::FromPEMString(certificate));
   if (!cert) {
     LOG(LS_ERROR) << "Failed to create OpenSSLCertificate from PEM string.";
     return NULL;
   }
 
   BIO* bio = BIO_new_mem_buf(const_cast<char*>(private_key.c_str()), -1);
   if (!bio) {
     LOG(LS_ERROR) << "Failed to create a new BIO buffer.";
     return NULL;
   }
   BIO_set_mem_eof_return(bio, 0);
-  EVP_PKEY *pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL,
-                                           const_cast<char*>("\0"));
+  EVP_PKEY* pkey =
+      PEM_read_bio_PrivateKey(bio, NULL, NULL, const_cast<char*>("\0"));
   BIO_free(bio);  // Frees the BIO, but not the pointed-to string.
 
   if (!pkey) {
     LOG(LS_ERROR) << "Failed to create the private key from PEM string.";
     return NULL;
   }
 
   return new OpenSSLIdentity(new OpenSSLKeyPair(pkey),
                              cert.release());
 }
@@ skipping 13 matching lines @@
      SSL_CTX_use_PrivateKey(ctx, key_pair_->pkey()) != 1) {
     LogSSLErrors("Configuring key and certificate");
     return false;
   }
   return true;
 }
 
 }  // namespace rtc
 
 #endif  // HAVE_OPENSSL_SSL_H