[Collections] Signing (all, 1): certificate and key types

This is part 1 of a series of PRs to support package collection signing on **all** platforms. Originally swiftlang#3238.

Depends on swiftlang#3259

Author: yim-lee

Sources/PackageCollectionsSigning/CMakeLists.txt

@@ -19,6 +19,7 @@ add_library(PackageCollectionsSigning
   Key/ASN1/Types/ASN1Integer.swift
   Key/ASN1/Types/ASN1ObjectIdentifier.swift
   Key/ASN1/Types/ASN1OctetString.swift
+  Key/BoringSSLKey.swift
   Key/Key.swift
   Key/Key+EC.swift
   Key/Key+RSA.swift
@@ -36,7 +37,8 @@ target_link_libraries(PackageCollectionsSigning PUBLIC
   $<$<NOT:$<PLATFORM_ID:Darwin>>:dispatch>
   $<$<NOT:$<PLATFORM_ID:Darwin>>:Foundation>)
 target_link_libraries(PackageCollectionsSigning PRIVATE
-  Crypto)
+  Crypto
+  CCryptoBoringSSL)
 # NOTE(compnerd) workaround for CMake not setting up include flags yet
 set_target_properties(PackageCollectionsSigning PROPERTIES
   INTERFACE_INCLUDE_DIRECTORIES ${CMAKE_Swift_MODULE_DIRECTORY})

Sources/PackageCollectionsSigning/Certificate/Certificate.swift

@@ -12,6 +12,8 @@ import struct Foundation.Data
 
 #if os(macOS)
 import Security
+#else
+@_implementationOnly import CCryptoBoringSSL
 #endif
 
 #if os(macOS)
@@ -107,24 +109,114 @@ struct CoreCertificate {
 
 #else
 final class BoringSSLCertificate {
+    let underlying: UnsafeMutablePointer<X509>
+
+    deinit {
+        CCryptoBoringSSL_X509_free(self.underlying)
+    }
+
     init(derEncoded data: Data) throws {
-        fatalError("Not implemented: \(#function)")
+        let bytes = data.copyBytes()
+        let x509 = try bytes.withUnsafeBufferPointer { (ptr: UnsafeBufferPointer<UInt8>) throws -> UnsafeMutablePointer<X509> in
+            var pointer = ptr.baseAddress
+            guard let x509 = CCryptoBoringSSL_d2i_X509(nil, &pointer, numericCast(bytes.count)) else {
+                throw CertificateError.initializationFailure
+            }
+            return x509
+        }
+        self.underlying = x509
     }
 
     func subject() throws -> CertificateName {
-        fatalError("Not implemented: \(#function)")
+        guard let subject = CCryptoBoringSSL_X509_get_subject_name(self.underlying) else {
+            throw CertificateError.nameExtractionFailure
+        }
+        return CertificateName(x509Name: subject)
     }
 
     func issuer() throws -> CertificateName {
-        fatalError("Not implemented: \(#function)")
+        guard let issuer = CCryptoBoringSSL_X509_get_issuer_name(self.underlying) else {
+            throw CertificateError.nameExtractionFailure
+        }
+        return CertificateName(x509Name: issuer)
     }
 
     func publicKey() throws -> PublicKey {
-        fatalError("Not implemented: \(#function)")
+        guard let key = CCryptoBoringSSL_X509_get_pubkey(self.underlying) else {
+            throw CertificateError.keyExtractionFailure
+        }
+        defer { CCryptoBoringSSL_EVP_PKEY_free(key) }
+
+        var buffer: UnsafeMutablePointer<CUnsignedChar>?
+        defer { CCryptoBoringSSL_OPENSSL_free(buffer) }
+
+        let length = CCryptoBoringSSL_i2d_PublicKey(key, &buffer)
+        guard length > 0 else {
+            throw CertificateError.keyExtractionFailure
+        }
+
+        let data = Data(UnsafeBufferPointer(start: buffer, count: Int(length)))
+
+        switch try self.keyType(of: key) {
+        case .RSA:
+            return try BoringSSLRSAPublicKey(data: data)
+        case .EC:
+            return try ECPublicKey(data: data)
+        }
     }
 
     func keyType() throws -> KeyType {
-        fatalError("Not implemented: \(#function)")
+        guard let key = CCryptoBoringSSL_X509_get_pubkey(self.underlying) else {
+            throw CertificateError.keyExtractionFailure
+        }
+        defer { CCryptoBoringSSL_EVP_PKEY_free(key) }
+
+        return try self.keyType(of: key)
+    }
+
+    private func keyType(of key: UnsafeMutablePointer<EVP_PKEY>) throws -> KeyType {
+        let algorithm = CCryptoBoringSSL_OBJ_obj2nid(self.underlying.pointee.cert_info.pointee.key.pointee.algor.pointee.algorithm)
+
+        switch algorithm {
+        case NID_rsaEncryption:
+            return .RSA
+        case NID_X9_62_id_ecPublicKey:
+            return .EC
+        default:
+            throw CertificateError.unsupportedKeyType
+        }
+    }
+}
+
+private extension CertificateName {
+    init(x509Name: UnsafeMutablePointer<X509_NAME>) {
+        self.userID = x509Name.getStringValue(of: NID_userId)
+        self.commonName = x509Name.getStringValue(of: NID_commonName)
+        self.organization = x509Name.getStringValue(of: NID_organizationName)
+        self.organizationalUnit = x509Name.getStringValue(of: NID_organizationalUnitName)
+    }
+}
+
+private extension UnsafeMutablePointer where Pointee == X509_NAME {
+    func getStringValue(of nid: CInt) -> String? {
+        let index = CCryptoBoringSSL_X509_NAME_get_index_by_NID(self, nid, -1)
+        guard index >= 0 else {
+            return nil
+        }
+
+        let entry = CCryptoBoringSSL_X509_NAME_get_entry(self, index)
+        guard let data = CCryptoBoringSSL_X509_NAME_ENTRY_get_data(entry) else {
+            return nil
+        }
+
+        var value: UnsafeMutablePointer<CUnsignedChar>?
+        defer { CCryptoBoringSSL_OPENSSL_free(value) }
+
+        guard CCryptoBoringSSL_ASN1_STRING_to_UTF8(&value, data) >= 0 else {
+            return nil
+        }
+
+        return String.decodeCString(value, as: UTF8.self, repairingInvalidCodeUnits: true)?.result
     }
 }
 #endif

Sources/PackageCollectionsSigning/Key/BoringSSLKey.swift

@@ -0,0 +1,59 @@
+/*
+ This source file is part of the Swift.org open source project
+
+ Copyright (c) 2021 Apple Inc. and the Swift project authors
+ Licensed under Apache License v2.0 with Runtime Library Exception
+
+ See http://swift.org/LICENSE.txt for license information
+ See http://swift.org/CONTRIBUTORS.txt for Swift project authors
+ */
+
+//===----------------------------------------------------------------------===//
+//
+// This source file is part of the Vapor open source project
+//
+// Copyright (c) 2017-2020 Vapor project authors
+// Licensed under MIT
+//
+// See LICENSE for license information
+//
+// SPDX-License-Identifier: MIT
+//
+//===----------------------------------------------------------------------===//
+
+#if !canImport(Security)
+import Foundation
+
+@_implementationOnly import CCryptoBoringSSL
+
+protocol BoringSSLKey {}
+
+extension BoringSSLKey {
+    // Source: https://github.com/vapor/jwt-kit/blob/master/Sources/JWTKit/Utilities/OpenSSLSigner.swift
+    static func load<Data, KeyType>(pem data: Data,
+                                    _ createKey: (UnsafeMutablePointer<BIO>) -> (KeyType?)) throws -> KeyType where Data: DataProtocol {
+        let bytes = data.copyBytes()
+
+        // Not doing `CCryptoBoringSSL_BIO_new_mem_buf(bytes, numericCast(bytes.count))` because
+        // it causes `bioConversionFailure` error on *some* Linux builds (e.g., SPM Linux smoke test)
+        let bio = CCryptoBoringSSL_BIO_new(CCryptoBoringSSL_BIO_s_mem())
+        defer { CCryptoBoringSSL_BIO_free(bio) }
+
+        guard let bioPointer = bio, CCryptoBoringSSL_BIO_write(bioPointer, bytes, numericCast(bytes.count)) > 0 else {
+            throw BoringSSLKeyError.bioInitializationFailure
+        }
+        guard let key = createKey(bioPointer) else {
+            throw BoringSSLKeyError.bioConversionFailure
+        }
+
+        return key
+    }
+}
+
+enum BoringSSLKeyError: Error {
+    case failedToLoadKeyFromBytes
+    case rsaConversionFailure
+    case bioInitializationFailure
+    case bioConversionFailure
+}
+#endif

Sources/PackageCollectionsSigning/Key/Key+RSA.swift

@@ -8,10 +8,25 @@
  See http://swift.org/CONTRIBUTORS.txt for Swift project authors
  */
 
+//===----------------------------------------------------------------------===//
+//
+// This source file is part of the Vapor open source project
+//
+// Copyright (c) 2017-2020 Vapor project authors
+// Licensed under MIT
+//
+// See LICENSE for license information
+//
+// SPDX-License-Identifier: MIT
+//
+//===----------------------------------------------------------------------===//
+
 import Foundation
 
 #if os(macOS)
 import Security
+#else
+@_implementationOnly import CCryptoBoringSSL
 #endif
 
 #if os(macOS)
@@ -86,29 +101,69 @@ struct CoreRSAPublicKey: PublicKey {
 
 // MARK: - RSA key implementations using BoringSSL
 
+// Reference: https://github.com/vapor/jwt-kit/blob/master/Sources/JWTKit/RSA/RSAKey.swift
+
 #else
-final class BoringSSLRSAPrivateKey: PrivateKey {
-    var sizeInBits: Int {
-        fatalError("Not implemented")
+final class BoringSSLRSAPrivateKey: PrivateKey, BoringSSLKey {
+    let underlying: UnsafeMutablePointer<CCryptoBoringSSL.RSA>
+    static let algorithm: OpaquePointer = CCryptoBoringSSL_EVP_sha256()
+
+    deinit {
+        CCryptoBoringSSL_RSA_free(self.underlying)
     }
 
     init<Data>(pem data: Data) throws where Data: DataProtocol {
-        fatalError("Not implemented: \(#function)")
+        let key = try Self.load(pem: data) { bio in
+            CCryptoBoringSSL_PEM_read_bio_PrivateKey(bio, nil, nil, nil)
+        }
+        defer { CCryptoBoringSSL_EVP_PKEY_free(key) }
+
+        guard let pointer = CCryptoBoringSSL_EVP_PKEY_get1_RSA(key) else {
+            throw BoringSSLKeyError.rsaConversionFailure
+        }
+
+        self.underlying = pointer
     }
 }
 
-final class BoringSSLRSAPublicKey: PublicKey {
-    var sizeInBits: Int {
-        fatalError("Not implemented")
+final class BoringSSLRSAPublicKey: PublicKey, BoringSSLKey {
+    let underlying: UnsafeMutablePointer<CCryptoBoringSSL.RSA>
+    static let algorithm: OpaquePointer = CCryptoBoringSSL_EVP_sha256()
+
+    deinit {
+        CCryptoBoringSSL_RSA_free(self.underlying)
     }
 
     /// `data` should be in the PKCS #1 format
     init(data: Data) throws {
-        fatalError("Not implemented: \(#function)")
+        let bytes = data.copyBytes()
+        let key = try bytes.withUnsafeBufferPointer { (ptr: UnsafeBufferPointer<UInt8>) throws -> UnsafeMutablePointer<EVP_PKEY> in
+            var pointer = ptr.baseAddress
+            guard let key = CCryptoBoringSSL_d2i_PublicKey(EVP_PKEY_RSA, nil, &pointer, numericCast(data.count)) else {
+                throw BoringSSLKeyError.failedToLoadKeyFromBytes
+            }
+            return key
+        }
+        defer { CCryptoBoringSSL_EVP_PKEY_free(key) }
+
+        guard let pointer = CCryptoBoringSSL_EVP_PKEY_get1_RSA(key) else {
+            throw BoringSSLKeyError.rsaConversionFailure
+        }
+
+        self.underlying = pointer
     }
 
     init<Data>(pem data: Data) throws where Data: DataProtocol {
-        fatalError("Not implemented: \(#function)")
+        let key = try Self.load(pem: data) { bio in
+            CCryptoBoringSSL_PEM_read_bio_PUBKEY(bio, nil, nil, nil)
+        }
+        defer { CCryptoBoringSSL_EVP_PKEY_free(key) }
+
+        guard let pointer = CCryptoBoringSSL_EVP_PKEY_get1_RSA(key) else {
+            throw BoringSSLKeyError.rsaConversionFailure
+        }
+
+        self.underlying = pointer
     }
 }
 #endif