| OLD | NEW |
|---|
| (Empty) |
| 1 /* | |
| 2 * Copyright 2004 The WebRTC Project Authors. All rights reserved. | |
| 3 * | |
| 4 * Use of this source code is governed by a BSD-style license | |
| 5 * that can be found in the LICENSE file in the root of the source | |
| 6 * tree. An additional intellectual property rights grant can be found | |
| 7 * in the file PATENTS. All contributing project authors may | |
| 8 * be found in the AUTHORS file in the root of the source tree. | |
| 9 */ | |
| 10 | |
| 11 // Handling of certificates and keypairs for SSLStreamAdapter's peer mode. | |
| 12 #include "webrtc/base/sslidentity.h" | |
| 13 | |
| 14 #include <ctime> | |
| 15 #include <string> | |
| 16 | |
| 17 #include "webrtc/base/base64.h" | |
| 18 #include "webrtc/base/checks.h" | |
| 19 #include "webrtc/base/logging.h" | |
| 20 #include "webrtc/base/opensslidentity.h" | |
| 21 #include "webrtc/base/sslfingerprint.h" | |
| 22 | |
| 23 namespace rtc { | |
| 24 | |
| 25 const char kPemTypeCertificate[] = "CERTIFICATE"; | |
| 26 const char kPemTypeRsaPrivateKey[] = "RSA PRIVATE KEY"; | |
| 27 const char kPemTypeEcPrivateKey[] = "EC PRIVATE KEY"; | |
| 28 | |
| 29 SSLCertificateStats::SSLCertificateStats( | |
| 30 std::string&& fingerprint, | |
| 31 std::string&& fingerprint_algorithm, | |
| 32 std::string&& base64_certificate, | |
| 33 std::unique_ptr<SSLCertificateStats>&& issuer) | |
| 34 : fingerprint(std::move(fingerprint)), | |
| 35 fingerprint_algorithm(std::move(fingerprint_algorithm)), | |
| 36 base64_certificate(std::move(base64_certificate)), | |
| 37 issuer(std::move(issuer)) { | |
| 38 } | |
| 39 | |
| 40 SSLCertificateStats::~SSLCertificateStats() { | |
| 41 } | |
| 42 | |
| 43 std::unique_ptr<SSLCertificateStats> SSLCertificate::GetStats() const { | |
| 44 // We have a certificate and optionally a chain of certificates. This forms a | |
| 45 // linked list, starting with |this|, then the first element of |chain| and | |
| 46 // ending with the last element of |chain|. The "issuer" of a certificate is | |
| 47 // the next certificate in the chain. Stats are produced for each certificate | |
| 48 // in the list. Here, the "issuer" is the issuer's stats. | |
| 49 std::unique_ptr<SSLCertChain> chain = GetChain(); | |
| 50 std::unique_ptr<SSLCertificateStats> issuer; | |
| 51 if (chain) { | |
| 52 // The loop runs in reverse so that the |issuer| is known before the | |
| 53 // |cert|'s stats. | |
| 54 for (ptrdiff_t i = chain->GetSize() - 1; i >= 0; --i) { | |
| 55 const SSLCertificate* cert = &chain->Get(i); | |
| 56 issuer = cert->GetStats(std::move(issuer)); | |
| 57 } | |
| 58 } | |
| 59 return GetStats(std::move(issuer)); | |
| 60 } | |
| 61 | |
| 62 std::unique_ptr<SSLCertificateStats> SSLCertificate::GetStats( | |
| 63 std::unique_ptr<SSLCertificateStats> issuer) const { | |
| 64 // TODO(bemasc): Move this computation to a helper class that caches these | |
| 65 // values to reduce CPU use in |StatsCollector::GetStats|. This will require | |
| 66 // adding a fast |SSLCertificate::Equals| to detect certificate changes. | |
| 67 std::string digest_algorithm; | |
| 68 if (!GetSignatureDigestAlgorithm(&digest_algorithm)) | |
| 69 return nullptr; | |
| 70 | |
| 71 // |SSLFingerprint::Create| can fail if the algorithm returned by | |
| 72 // |SSLCertificate::GetSignatureDigestAlgorithm| is not supported by the | |
| 73 // implementation of |SSLCertificate::ComputeDigest|. This currently happens | |
| 74 // with MD5- and SHA-224-signed certificates when linked to libNSS. | |
| 75 std::unique_ptr<SSLFingerprint> ssl_fingerprint( | |
| 76 SSLFingerprint::Create(digest_algorithm, this)); | |
| 77 if (!ssl_fingerprint) | |
| 78 return nullptr; | |
| 79 std::string fingerprint = ssl_fingerprint->GetRfc4572Fingerprint(); | |
| 80 | |
| 81 Buffer der_buffer; | |
| 82 ToDER(&der_buffer); | |
| 83 std::string der_base64; | |
| 84 Base64::EncodeFromArray(der_buffer.data(), der_buffer.size(), &der_base64); | |
| 85 | |
| 86 return std::unique_ptr<SSLCertificateStats>(new SSLCertificateStats( | |
| 87 std::move(fingerprint), | |
| 88 std::move(digest_algorithm), | |
| 89 std::move(der_base64), | |
| 90 std::move(issuer))); | |
| 91 } | |
| 92 | |
| 93 KeyParams::KeyParams(KeyType key_type) { | |
| 94 if (key_type == KT_ECDSA) { | |
| 95 type_ = KT_ECDSA; | |
| 96 params_.curve = EC_NIST_P256; | |
| 97 } else if (key_type == KT_RSA) { | |
| 98 type_ = KT_RSA; | |
| 99 params_.rsa.mod_size = kRsaDefaultModSize; | |
| 100 params_.rsa.pub_exp = kRsaDefaultExponent; | |
| 101 } else { | |
| 102 RTC_NOTREACHED(); | |
| 103 } | |
| 104 } | |
| 105 | |
| 106 // static | |
| 107 KeyParams KeyParams::RSA(int mod_size, int pub_exp) { | |
| 108 KeyParams kt(KT_RSA); | |
| 109 kt.params_.rsa.mod_size = mod_size; | |
| 110 kt.params_.rsa.pub_exp = pub_exp; | |
| 111 return kt; | |
| 112 } | |
| 113 | |
| 114 // static | |
| 115 KeyParams KeyParams::ECDSA(ECCurve curve) { | |
| 116 KeyParams kt(KT_ECDSA); | |
| 117 kt.params_.curve = curve; | |
| 118 return kt; | |
| 119 } | |
| 120 | |
| 121 bool KeyParams::IsValid() const { | |
| 122 if (type_ == KT_RSA) { | |
| 123 return (params_.rsa.mod_size >= kRsaMinModSize && | |
| 124 params_.rsa.mod_size <= kRsaMaxModSize && | |
| 125 params_.rsa.pub_exp > params_.rsa.mod_size); | |
| 126 } else if (type_ == KT_ECDSA) { | |
| 127 return (params_.curve == EC_NIST_P256); | |
| 128 } | |
| 129 return false; | |
| 130 } | |
| 131 | |
| 132 RSAParams KeyParams::rsa_params() const { | |
| 133 RTC_DCHECK(type_ == KT_RSA); | |
| 134 return params_.rsa; | |
| 135 } | |
| 136 | |
| 137 ECCurve KeyParams::ec_curve() const { | |
| 138 RTC_DCHECK(type_ == KT_ECDSA); | |
| 139 return params_.curve; | |
| 140 } | |
| 141 | |
| 142 KeyType IntKeyTypeFamilyToKeyType(int key_type_family) { | |
| 143 return static_cast<KeyType>(key_type_family); | |
| 144 } | |
| 145 | |
| 146 bool SSLIdentity::PemToDer(const std::string& pem_type, | |
| 147 const std::string& pem_string, | |
| 148 std::string* der) { | |
| 149 // Find the inner body. We need this to fulfill the contract of | |
| 150 // returning pem_length. | |
| 151 size_t header = pem_string.find("-----BEGIN " + pem_type + "-----"); | |
| 152 if (header == std::string::npos) | |
| 153 return false; | |
| 154 | |
| 155 size_t body = pem_string.find("\n", header); | |
| 156 if (body == std::string::npos) | |
| 157 return false; | |
| 158 | |
| 159 size_t trailer = pem_string.find("-----END " + pem_type + "-----"); | |
| 160 if (trailer == std::string::npos) | |
| 161 return false; | |
| 162 | |
| 163 std::string inner = pem_string.substr(body + 1, trailer - (body + 1)); | |
| 164 | |
| 165 *der = Base64::Decode(inner, Base64::DO_PARSE_WHITE | | |
| 166 Base64::DO_PAD_ANY | | |
| 167 Base64::DO_TERM_BUFFER); | |
| 168 return true; | |
| 169 } | |
| 170 | |
| 171 std::string SSLIdentity::DerToPem(const std::string& pem_type, | |
| 172 const unsigned char* data, | |
| 173 size_t length) { | |
| 174 std::stringstream result; | |
| 175 | |
| 176 result << "-----BEGIN " << pem_type << "-----\n"; | |
| 177 | |
| 178 std::string b64_encoded; | |
| 179 Base64::EncodeFromArray(data, length, &b64_encoded); | |
| 180 | |
| 181 // Divide the Base-64 encoded data into 64-character chunks, as per | |
| 182 // 4.3.2.4 of RFC 1421. | |
| 183 static const size_t kChunkSize = 64; | |
| 184 size_t chunks = (b64_encoded.size() + (kChunkSize - 1)) / kChunkSize; | |
| 185 for (size_t i = 0, chunk_offset = 0; i < chunks; | |
| 186 ++i, chunk_offset += kChunkSize) { | |
| 187 result << b64_encoded.substr(chunk_offset, kChunkSize); | |
| 188 result << "\n"; | |
| 189 } | |
| 190 | |
| 191 result << "-----END " << pem_type << "-----\n"; | |
| 192 | |
| 193 return result.str(); | |
| 194 } | |
| 195 | |
| 196 SSLCertChain::SSLCertChain(const std::vector<SSLCertificate*>& certs) { | |
| 197 RTC_DCHECK(!certs.empty()); | |
| 198 certs_.resize(certs.size()); | |
| 199 std::transform(certs.begin(), certs.end(), certs_.begin(), DupCert); | |
| 200 } | |
| 201 | |
| 202 SSLCertChain::SSLCertChain(const SSLCertificate* cert) { | |
| 203 certs_.push_back(cert->GetReference()); | |
| 204 } | |
| 205 | |
| 206 SSLCertChain::~SSLCertChain() { | |
| 207 std::for_each(certs_.begin(), certs_.end(), DeleteCert); | |
| 208 } | |
| 209 | |
| 210 // static | |
| 211 SSLCertificate* SSLCertificate::FromPEMString(const std::string& pem_string) { | |
| 212 return OpenSSLCertificate::FromPEMString(pem_string); | |
| 213 } | |
| 214 | |
| 215 // static | |
| 216 SSLIdentity* SSLIdentity::GenerateWithExpiration(const std::string& common_name, | |
| 217 const KeyParams& key_params, | |
| 218 time_t certificate_lifetime) { | |
| 219 return OpenSSLIdentity::GenerateWithExpiration(common_name, key_params, | |
| 220 certificate_lifetime); | |
| 221 } | |
| 222 | |
| 223 // static | |
| 224 SSLIdentity* SSLIdentity::Generate(const std::string& common_name, | |
| 225 const KeyParams& key_params) { | |
| 226 return OpenSSLIdentity::GenerateWithExpiration( | |
| 227 common_name, key_params, kDefaultCertificateLifetimeInSeconds); | |
| 228 } | |
| 229 | |
| 230 // static | |
| 231 SSLIdentity* SSLIdentity::Generate(const std::string& common_name, | |
| 232 KeyType key_type) { | |
| 233 return OpenSSLIdentity::GenerateWithExpiration( | |
| 234 common_name, KeyParams(key_type), kDefaultCertificateLifetimeInSeconds); | |
| 235 } | |
| 236 | |
| 237 SSLIdentity* SSLIdentity::GenerateForTest(const SSLIdentityParams& params) { | |
| 238 return OpenSSLIdentity::GenerateForTest(params); | |
| 239 } | |
| 240 | |
| 241 // static | |
| 242 SSLIdentity* SSLIdentity::FromPEMStrings(const std::string& private_key, | |
| 243 const std::string& certificate) { | |
| 244 return OpenSSLIdentity::FromPEMStrings(private_key, certificate); | |
| 245 } | |
| 246 | |
| 247 bool operator==(const SSLIdentity& a, const SSLIdentity& b) { | |
| 248 return static_cast<const OpenSSLIdentity&>(a) == | |
| 249 static_cast<const OpenSSLIdentity&>(b); | |
| 250 } | |
| 251 bool operator!=(const SSLIdentity& a, const SSLIdentity& b) { | |
| 252 return !(a == b); | |
| 253 } | |
| 254 | |
| 255 // Read |n| bytes from ASN1 number string at *|pp| and return the numeric value. | |
| 256 // Update *|pp| and *|np| to reflect number of read bytes. | |
| 257 static inline int ASN1ReadInt(const unsigned char** pp, size_t* np, size_t n) { | |
| 258 const unsigned char* p = *pp; | |
| 259 int x = 0; | |
| 260 for (size_t i = 0; i < n; i++) | |
| 261 x = 10 * x + p[i] - '0'; | |
| 262 *pp = p + n; | |
| 263 *np = *np - n; | |
| 264 return x; | |
| 265 } | |
| 266 | |
| 267 int64_t ASN1TimeToSec(const unsigned char* s, size_t length, bool long_format) { | |
| 268 size_t bytes_left = length; | |
| 269 | |
| 270 // Make sure the string ends with Z. Doing it here protects the strspn call | |
| 271 // from running off the end of the string in Z's absense. | |
| 272 if (length == 0 || s[length - 1] != 'Z') | |
| 273 return -1; | |
| 274 | |
| 275 // Make sure we only have ASCII digits so that we don't need to clutter the | |
| 276 // code below and ASN1ReadInt with error checking. | |
| 277 size_t n = strspn(reinterpret_cast<const char*>(s), "0123456789"); | |
| 278 if (n + 1 != length) | |
| 279 return -1; | |
| 280 | |
| 281 int year; | |
| 282 | |
| 283 // Read out ASN1 year, in either 2-char "UTCTIME" or 4-char "GENERALIZEDTIME" | |
| 284 // format. Both format use UTC in this context. | |
| 285 if (long_format) { | |
| 286 // ASN1 format: yyyymmddhh[mm[ss[.fff]]]Z where the Z is literal, but | |
| 287 // RFC 5280 requires us to only support exactly yyyymmddhhmmssZ. | |
| 288 | |
| 289 if (bytes_left < 11) | |
| 290 return -1; | |
| 291 | |
| 292 year = ASN1ReadInt(&s, &bytes_left, 4); | |
| 293 year -= 1900; | |
| 294 } else { | |
| 295 // ASN1 format: yymmddhhmm[ss]Z where the Z is literal, but RFC 5280 | |
| 296 // requires us to only support exactly yymmddhhmmssZ. | |
| 297 | |
| 298 if (bytes_left < 9) | |
| 299 return -1; | |
| 300 | |
| 301 year = ASN1ReadInt(&s, &bytes_left, 2); | |
| 302 if (year < 50) // Per RFC 5280 4.1.2.5.1 | |
| 303 year += 100; | |
| 304 } | |
| 305 | |
| 306 std::tm tm; | |
| 307 tm.tm_year = year; | |
| 308 | |
| 309 // Read out remaining ASN1 time data and store it in |tm| in documented | |
| 310 // std::tm format. | |
| 311 tm.tm_mon = ASN1ReadInt(&s, &bytes_left, 2) - 1; | |
| 312 tm.tm_mday = ASN1ReadInt(&s, &bytes_left, 2); | |
| 313 tm.tm_hour = ASN1ReadInt(&s, &bytes_left, 2); | |
| 314 tm.tm_min = ASN1ReadInt(&s, &bytes_left, 2); | |
| 315 tm.tm_sec = ASN1ReadInt(&s, &bytes_left, 2); | |
| 316 | |
| 317 if (bytes_left != 1) { | |
| 318 // Now just Z should remain. Its existence was asserted above. | |
| 319 return -1; | |
| 320 } | |
| 321 | |
| 322 return TmToSeconds(tm); | |
| 323 } | |
| 324 | |
| 325 } // namespace rtc | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2877023002:
Move webrtc/{base => rtc_base} (Closed)
