1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 #include "net/cert/pki/simple_path_builder_delegate.h"
5
6 #include <memory>
7 #include <set>
8
9 #include "net/cert/pki/cert_errors.h"
10 #include "net/cert/pki/signature_algorithm.h"
11 #include "net/cert/pki/test_helpers.h"
12 #include "net/cert/pki/verify_signed_data.h"
13 #include "net/der/input.h"
14 #include "net/der/parse_values.h"
15 #include "net/der/parser.h"
16 #include "testing/gtest/include/gtest/gtest.h"
17 #include "third_party/boringssl/src/include/openssl/nid.h"
18
19 namespace net {
20
21 namespace {
22
23 // Reads the public key and algorithm from the test data at |file_name|.
ReadTestCase(const char * file_name,SignatureAlgorithm * signature_algorithm,bssl::UniquePtr<EVP_PKEY> * public_key)24 void ReadTestCase(const char* file_name,
25 SignatureAlgorithm* signature_algorithm,
26 bssl::UniquePtr<EVP_PKEY>* public_key) {
27 std::string path =
28 std::string("net/data/verify_signed_data_unittest/") + file_name;
29
30 std::string public_key_str;
31 std::string algorithm_str;
32
33 const PemBlockMapping mappings[] = {
34 {"PUBLIC KEY", &public_key_str},
35 {"ALGORITHM", &algorithm_str},
36 };
37
38 ASSERT_TRUE(ReadTestDataFromPemFile(path, mappings));
39
40 absl::optional<SignatureAlgorithm> sigalg_opt =
41 ParseSignatureAlgorithm(der::Input(&algorithm_str));
42 ASSERT_TRUE(sigalg_opt);
43 *signature_algorithm = *sigalg_opt;
44
45 ASSERT_TRUE(ParsePublicKey(der::Input(&public_key_str), public_key));
46 }
47
48 class SimplePathBuilderDelegate1024SuccessTest
49 : public ::testing::TestWithParam<const char*> {};
50
51 const char* kSuccess1024Filenames[] = {
52 "rsa-pkcs1-sha1.pem", "rsa-pkcs1-sha256.pem",
53 "rsa2048-pkcs1-sha512.pem", "ecdsa-secp384r1-sha256.pem",
54 "ecdsa-prime256v1-sha512.pem", "rsa-pss-sha256.pem",
55 "ecdsa-secp384r1-sha256.pem", "ecdsa-prime256v1-sha512.pem",
56 };
57
58 INSTANTIATE_TEST_SUITE_P(All,
59 SimplePathBuilderDelegate1024SuccessTest,
60 ::testing::ValuesIn(kSuccess1024Filenames));
61
TEST_P(SimplePathBuilderDelegate1024SuccessTest,IsAcceptableSignatureAndKey)62 TEST_P(SimplePathBuilderDelegate1024SuccessTest, IsAcceptableSignatureAndKey) {
63 SignatureAlgorithm signature_algorithm;
64 bssl::UniquePtr<EVP_PKEY> public_key;
65 ASSERT_NO_FATAL_FAILURE(
66 ReadTestCase(GetParam(), &signature_algorithm, &public_key));
67 ASSERT_TRUE(public_key);
68
69 CertErrors errors;
70 SimplePathBuilderDelegate delegate(
71 1024, SimplePathBuilderDelegate::DigestPolicy::kWeakAllowSha1);
72
73 EXPECT_TRUE(
74 delegate.IsSignatureAlgorithmAcceptable(signature_algorithm, &errors));
75
76 EXPECT_TRUE(delegate.IsPublicKeyAcceptable(public_key.get(), &errors));
77 }
78
79 class SimplePathBuilderDelegate2048FailTest
80 : public ::testing::TestWithParam<const char*> {};
81
82 const char* kFail2048Filenames[] = {"rsa-pkcs1-sha1.pem",
83 "rsa-pkcs1-sha256.pem"};
84
85 INSTANTIATE_TEST_SUITE_P(All,
86 SimplePathBuilderDelegate2048FailTest,
87 ::testing::ValuesIn(kFail2048Filenames));
88
TEST_P(SimplePathBuilderDelegate2048FailTest,RsaKeySmallerThan2048)89 TEST_P(SimplePathBuilderDelegate2048FailTest, RsaKeySmallerThan2048) {
90 SignatureAlgorithm signature_algorithm;
91 bssl::UniquePtr<EVP_PKEY> public_key;
92 ASSERT_NO_FATAL_FAILURE(
93 ReadTestCase(GetParam(), &signature_algorithm, &public_key));
94 ASSERT_TRUE(public_key);
95
96 CertErrors errors;
97 SimplePathBuilderDelegate delegate(
98 2048, SimplePathBuilderDelegate::DigestPolicy::kWeakAllowSha1);
99
100 EXPECT_TRUE(
101 delegate.IsSignatureAlgorithmAcceptable(signature_algorithm, &errors));
102
103 EXPECT_FALSE(delegate.IsPublicKeyAcceptable(public_key.get(), &errors));
104 }
105
106 } // namespace
107
108 } // namespace net
109