henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2004 The WebRTC Project Authors. All rights reserved. |
| 3 | * |
| 4 | * Use of this source code is governed by a BSD-style license |
| 5 | * that can be found in the LICENSE file in the root of the source |
| 6 | * tree. An additional intellectual property rights grant can be found |
| 7 | * in the file PATENTS. All contributing project authors may |
| 8 | * be found in the AUTHORS file in the root of the source tree. |
| 9 | */ |
| 10 | |
| 11 | // Handling of certificates and keypairs for SSLStreamAdapter's peer mode. |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 12 | #include "webrtc/base/sslidentity.h" |
| 13 | |
Torbjorn Granlund | 46c9cc0 | 2015-12-01 13:06:34 +0100 | [diff] [blame] | 14 | #include <ctime> |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 15 | #include <string> |
| 16 | |
| 17 | #include "webrtc/base/base64.h" |
torbjorng | 4e57247 | 2015-10-08 09:42:49 -0700 | [diff] [blame] | 18 | #include "webrtc/base/checks.h" |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 19 | #include "webrtc/base/logging.h" |
| 20 | #include "webrtc/base/sslconfig.h" |
| 21 | |
torbjorng | 172f009 | 2015-10-07 04:57:55 -0700 | [diff] [blame] | 22 | #if SSL_USE_OPENSSL |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 23 | |
| 24 | #include "webrtc/base/opensslidentity.h" |
| 25 | |
torbjorng | 172f009 | 2015-10-07 04:57:55 -0700 | [diff] [blame] | 26 | #endif // SSL_USE_OPENSSL |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 27 | |
| 28 | namespace rtc { |
| 29 | |
| 30 | const char kPemTypeCertificate[] = "CERTIFICATE"; |
| 31 | const char kPemTypeRsaPrivateKey[] = "RSA PRIVATE KEY"; |
Torbjorn Granlund | b6d4ec4 | 2015-08-17 14:08:59 +0200 | [diff] [blame] | 32 | const char kPemTypeEcPrivateKey[] = "EC PRIVATE KEY"; |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 33 | |
torbjorng | 4e57247 | 2015-10-08 09:42:49 -0700 | [diff] [blame] | 34 | KeyParams::KeyParams(KeyType key_type) { |
| 35 | if (key_type == KT_ECDSA) { |
| 36 | type_ = KT_ECDSA; |
| 37 | params_.curve = EC_NIST_P256; |
| 38 | } else if (key_type == KT_RSA) { |
| 39 | type_ = KT_RSA; |
| 40 | params_.rsa.mod_size = kRsaDefaultModSize; |
| 41 | params_.rsa.pub_exp = kRsaDefaultExponent; |
| 42 | } else { |
| 43 | RTC_NOTREACHED(); |
| 44 | } |
| 45 | } |
| 46 | |
| 47 | // static |
| 48 | KeyParams KeyParams::RSA(int mod_size, int pub_exp) { |
| 49 | KeyParams kt(KT_RSA); |
| 50 | kt.params_.rsa.mod_size = mod_size; |
| 51 | kt.params_.rsa.pub_exp = pub_exp; |
| 52 | return kt; |
| 53 | } |
| 54 | |
| 55 | // static |
| 56 | KeyParams KeyParams::ECDSA(ECCurve curve) { |
| 57 | KeyParams kt(KT_ECDSA); |
| 58 | kt.params_.curve = curve; |
| 59 | return kt; |
| 60 | } |
| 61 | |
| 62 | bool KeyParams::IsValid() const { |
| 63 | if (type_ == KT_RSA) { |
| 64 | return (params_.rsa.mod_size >= kRsaMinModSize && |
| 65 | params_.rsa.mod_size <= kRsaMaxModSize && |
| 66 | params_.rsa.pub_exp > params_.rsa.mod_size); |
| 67 | } else if (type_ == KT_ECDSA) { |
| 68 | return (params_.curve == EC_NIST_P256); |
| 69 | } |
| 70 | return false; |
| 71 | } |
| 72 | |
| 73 | RSAParams KeyParams::rsa_params() const { |
| 74 | RTC_DCHECK(type_ == KT_RSA); |
| 75 | return params_.rsa; |
| 76 | } |
| 77 | |
| 78 | ECCurve KeyParams::ec_curve() const { |
| 79 | RTC_DCHECK(type_ == KT_ECDSA); |
| 80 | return params_.curve; |
| 81 | } |
| 82 | |
Henrik Boström | 9b5476d | 2015-09-22 14:12:57 +0200 | [diff] [blame] | 83 | KeyType IntKeyTypeFamilyToKeyType(int key_type_family) { |
| 84 | return static_cast<KeyType>(key_type_family); |
| 85 | } |
| 86 | |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 87 | bool SSLIdentity::PemToDer(const std::string& pem_type, |
| 88 | const std::string& pem_string, |
| 89 | std::string* der) { |
| 90 | // Find the inner body. We need this to fulfill the contract of |
| 91 | // returning pem_length. |
| 92 | size_t header = pem_string.find("-----BEGIN " + pem_type + "-----"); |
| 93 | if (header == std::string::npos) |
| 94 | return false; |
| 95 | |
| 96 | size_t body = pem_string.find("\n", header); |
| 97 | if (body == std::string::npos) |
| 98 | return false; |
| 99 | |
| 100 | size_t trailer = pem_string.find("-----END " + pem_type + "-----"); |
| 101 | if (trailer == std::string::npos) |
| 102 | return false; |
| 103 | |
| 104 | std::string inner = pem_string.substr(body + 1, trailer - (body + 1)); |
| 105 | |
| 106 | *der = Base64::Decode(inner, Base64::DO_PARSE_WHITE | |
| 107 | Base64::DO_PAD_ANY | |
| 108 | Base64::DO_TERM_BUFFER); |
| 109 | return true; |
| 110 | } |
| 111 | |
| 112 | std::string SSLIdentity::DerToPem(const std::string& pem_type, |
| 113 | const unsigned char* data, |
| 114 | size_t length) { |
| 115 | std::stringstream result; |
| 116 | |
| 117 | result << "-----BEGIN " << pem_type << "-----\n"; |
| 118 | |
| 119 | std::string b64_encoded; |
| 120 | Base64::EncodeFromArray(data, length, &b64_encoded); |
| 121 | |
| 122 | // Divide the Base-64 encoded data into 64-character chunks, as per |
| 123 | // 4.3.2.4 of RFC 1421. |
| 124 | static const size_t kChunkSize = 64; |
| 125 | size_t chunks = (b64_encoded.size() + (kChunkSize - 1)) / kChunkSize; |
| 126 | for (size_t i = 0, chunk_offset = 0; i < chunks; |
| 127 | ++i, chunk_offset += kChunkSize) { |
| 128 | result << b64_encoded.substr(chunk_offset, kChunkSize); |
| 129 | result << "\n"; |
| 130 | } |
| 131 | |
| 132 | result << "-----END " << pem_type << "-----\n"; |
| 133 | |
| 134 | return result.str(); |
| 135 | } |
| 136 | |
kwiberg@webrtc.org | 67186fe | 2015-03-09 22:21:53 +0000 | [diff] [blame] | 137 | SSLCertChain::SSLCertChain(const std::vector<SSLCertificate*>& certs) { |
| 138 | ASSERT(!certs.empty()); |
| 139 | certs_.resize(certs.size()); |
| 140 | std::transform(certs.begin(), certs.end(), certs_.begin(), DupCert); |
| 141 | } |
| 142 | |
| 143 | SSLCertChain::SSLCertChain(const SSLCertificate* cert) { |
| 144 | certs_.push_back(cert->GetReference()); |
| 145 | } |
| 146 | |
| 147 | SSLCertChain::~SSLCertChain() { |
| 148 | std::for_each(certs_.begin(), certs_.end(), DeleteCert); |
| 149 | } |
| 150 | |
torbjorng | 172f009 | 2015-10-07 04:57:55 -0700 | [diff] [blame] | 151 | #if SSL_USE_OPENSSL |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 152 | |
Torbjorn Granlund | a3dc79e | 2016-02-16 13:33:53 +0100 | [diff] [blame] | 153 | // static |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 154 | SSLCertificate* SSLCertificate::FromPEMString(const std::string& pem_string) { |
| 155 | return OpenSSLCertificate::FromPEMString(pem_string); |
| 156 | } |
| 157 | |
Torbjorn Granlund | a3dc79e | 2016-02-16 13:33:53 +0100 | [diff] [blame] | 158 | // static |
Torbjorn Granlund | 1d846b2 | 2016-03-31 16:21:04 +0200 | [diff] [blame] | 159 | SSLIdentity* SSLIdentity::GenerateWithExpiration(const std::string& common_name, |
| 160 | const KeyParams& key_params, |
| 161 | time_t certificate_lifetime) { |
| 162 | return OpenSSLIdentity::GenerateWithExpiration(common_name, key_params, |
| 163 | certificate_lifetime); |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 164 | } |
| 165 | |
Torbjorn Granlund | a3dc79e | 2016-02-16 13:33:53 +0100 | [diff] [blame] | 166 | // static |
| 167 | SSLIdentity* SSLIdentity::Generate(const std::string& common_name, |
| 168 | const KeyParams& key_params) { |
Torbjorn Granlund | 1d846b2 | 2016-03-31 16:21:04 +0200 | [diff] [blame] | 169 | return OpenSSLIdentity::GenerateWithExpiration( |
| 170 | common_name, key_params, kDefaultCertificateLifetimeInSeconds); |
Torbjorn Granlund | a3dc79e | 2016-02-16 13:33:53 +0100 | [diff] [blame] | 171 | } |
| 172 | |
| 173 | // static |
| 174 | SSLIdentity* SSLIdentity::Generate(const std::string& common_name, |
| 175 | KeyType key_type) { |
Torbjorn Granlund | 1d846b2 | 2016-03-31 16:21:04 +0200 | [diff] [blame] | 176 | return OpenSSLIdentity::GenerateWithExpiration( |
| 177 | common_name, KeyParams(key_type), kDefaultCertificateLifetimeInSeconds); |
Torbjorn Granlund | a3dc79e | 2016-02-16 13:33:53 +0100 | [diff] [blame] | 178 | } |
| 179 | |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 180 | SSLIdentity* SSLIdentity::GenerateForTest(const SSLIdentityParams& params) { |
| 181 | return OpenSSLIdentity::GenerateForTest(params); |
| 182 | } |
| 183 | |
Torbjorn Granlund | a3dc79e | 2016-02-16 13:33:53 +0100 | [diff] [blame] | 184 | // static |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 185 | SSLIdentity* SSLIdentity::FromPEMStrings(const std::string& private_key, |
| 186 | const std::string& certificate) { |
| 187 | return OpenSSLIdentity::FromPEMStrings(private_key, certificate); |
| 188 | } |
| 189 | |
hbos | 6b470a9 | 2016-04-28 05:14:21 -0700 | [diff] [blame^] | 190 | bool operator==(const SSLIdentity& a, const SSLIdentity& b) { |
| 191 | return static_cast<const OpenSSLIdentity&>(a) == |
| 192 | static_cast<const OpenSSLIdentity&>(b); |
| 193 | } |
| 194 | bool operator!=(const SSLIdentity& a, const SSLIdentity& b) { |
| 195 | return !(a == b); |
| 196 | } |
| 197 | |
torbjorng | 172f009 | 2015-10-07 04:57:55 -0700 | [diff] [blame] | 198 | #else // !SSL_USE_OPENSSL |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 199 | |
| 200 | #error "No SSL implementation" |
| 201 | |
torbjorng | 172f009 | 2015-10-07 04:57:55 -0700 | [diff] [blame] | 202 | #endif // SSL_USE_OPENSSL |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 203 | |
Torbjorn Granlund | 46c9cc0 | 2015-12-01 13:06:34 +0100 | [diff] [blame] | 204 | // Read |n| bytes from ASN1 number string at *|pp| and return the numeric value. |
| 205 | // Update *|pp| and *|np| to reflect number of read bytes. |
| 206 | static inline int ASN1ReadInt(const unsigned char** pp, size_t* np, size_t n) { |
| 207 | const unsigned char* p = *pp; |
| 208 | int x = 0; |
| 209 | for (size_t i = 0; i < n; i++) |
| 210 | x = 10 * x + p[i] - '0'; |
| 211 | *pp = p + n; |
| 212 | *np = *np - n; |
| 213 | return x; |
| 214 | } |
| 215 | |
| 216 | int64_t ASN1TimeToSec(const unsigned char* s, size_t length, bool long_format) { |
| 217 | size_t bytes_left = length; |
| 218 | |
| 219 | // Make sure the string ends with Z. Doing it here protects the strspn call |
| 220 | // from running off the end of the string in Z's absense. |
| 221 | if (length == 0 || s[length - 1] != 'Z') |
| 222 | return -1; |
| 223 | |
| 224 | // Make sure we only have ASCII digits so that we don't need to clutter the |
| 225 | // code below and ASN1ReadInt with error checking. |
| 226 | size_t n = strspn(reinterpret_cast<const char*>(s), "0123456789"); |
| 227 | if (n + 1 != length) |
| 228 | return -1; |
| 229 | |
| 230 | int year; |
| 231 | |
| 232 | // Read out ASN1 year, in either 2-char "UTCTIME" or 4-char "GENERALIZEDTIME" |
| 233 | // format. Both format use UTC in this context. |
| 234 | if (long_format) { |
| 235 | // ASN1 format: yyyymmddhh[mm[ss[.fff]]]Z where the Z is literal, but |
| 236 | // RFC 5280 requires us to only support exactly yyyymmddhhmmssZ. |
| 237 | |
| 238 | if (bytes_left < 11) |
| 239 | return -1; |
| 240 | |
| 241 | year = ASN1ReadInt(&s, &bytes_left, 4); |
| 242 | year -= 1900; |
| 243 | } else { |
| 244 | // ASN1 format: yymmddhhmm[ss]Z where the Z is literal, but RFC 5280 |
| 245 | // requires us to only support exactly yymmddhhmmssZ. |
| 246 | |
| 247 | if (bytes_left < 9) |
| 248 | return -1; |
| 249 | |
| 250 | year = ASN1ReadInt(&s, &bytes_left, 2); |
| 251 | if (year < 50) // Per RFC 5280 4.1.2.5.1 |
| 252 | year += 100; |
| 253 | } |
| 254 | |
| 255 | std::tm tm; |
| 256 | tm.tm_year = year; |
| 257 | |
| 258 | // Read out remaining ASN1 time data and store it in |tm| in documented |
| 259 | // std::tm format. |
| 260 | tm.tm_mon = ASN1ReadInt(&s, &bytes_left, 2) - 1; |
| 261 | tm.tm_mday = ASN1ReadInt(&s, &bytes_left, 2); |
| 262 | tm.tm_hour = ASN1ReadInt(&s, &bytes_left, 2); |
| 263 | tm.tm_min = ASN1ReadInt(&s, &bytes_left, 2); |
| 264 | tm.tm_sec = ASN1ReadInt(&s, &bytes_left, 2); |
| 265 | |
| 266 | if (bytes_left != 1) { |
| 267 | // Now just Z should remain. Its existence was asserted above. |
| 268 | return -1; |
| 269 | } |
| 270 | |
| 271 | return TmToSeconds(tm); |
| 272 | } |
| 273 | |
henrike@webrtc.org | f048872 | 2014-05-13 18:00:26 +0000 | [diff] [blame] | 274 | } // namespace rtc |