| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/base/openssl_client_key_store.h" | |
| 6 | |
| 7 #include "base/memory/ref_counted.h" | |
| 8 #include "net/base/test_data_directory.h" | |
| 9 #include "net/test/cert_test_util.h" | |
| 10 #include "testing/gtest/include/gtest/gtest.h" | |
| 11 | |
| 12 namespace net { | |
| 13 | |
| 14 namespace { | |
| 15 | |
| 16 typedef OpenSSLClientKeyStore::ScopedEVP_PKEY ScopedEVP_PKEY; | |
| 17 | |
| 18 // Return the internal reference count of a given EVP_PKEY. | |
| 19 int EVP_PKEY_get_refcount(EVP_PKEY* pkey) { | |
| 20 return pkey->references; | |
| 21 } | |
| 22 | |
| 23 // A common test class to ensure that the store is flushed after | |
| 24 // each test. | |
| 25 class OpenSSLClientKeyStoreTest : public ::testing::Test { | |
| 26 public: | |
| 27 OpenSSLClientKeyStoreTest() | |
| 28 : store_(OpenSSLClientKeyStore::GetInstance()) { | |
| 29 } | |
| 30 | |
| 31 virtual ~OpenSSLClientKeyStoreTest() { | |
| 32 if (store_) | |
| 33 store_->Flush(); | |
| 34 } | |
| 35 | |
| 36 protected: | |
| 37 OpenSSLClientKeyStore* store_; | |
| 38 }; | |
| 39 | |
| 40 // Check that GetInstance() returns non-null | |
| 41 TEST_F(OpenSSLClientKeyStoreTest, GetInstance) { | |
| 42 ASSERT_TRUE(store_); | |
| 43 } | |
| 44 | |
| 45 // Check that Flush() works correctly. | |
| 46 TEST_F(OpenSSLClientKeyStoreTest, Flush) { | |
| 47 ASSERT_TRUE(store_); | |
| 48 | |
| 49 scoped_refptr<X509Certificate> cert_1( | |
| 50 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); | |
| 51 ASSERT_TRUE(cert_1); | |
| 52 | |
| 53 ScopedEVP_PKEY priv_key(EVP_PKEY_new()); | |
| 54 ASSERT_TRUE(priv_key.get()); | |
| 55 | |
| 56 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), | |
| 57 priv_key.get())); | |
| 58 | |
| 59 store_->Flush(); | |
| 60 | |
| 61 // Retrieve the private key. This should fail because the store | |
| 62 // was flushed. | |
| 63 ScopedEVP_PKEY pkey; | |
| 64 ASSERT_FALSE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey)); | |
| 65 ASSERT_FALSE(pkey.get()); | |
| 66 } | |
| 67 | |
| 68 // Check that trying to retrieve the private key of an unknown certificate | |
| 69 // simply fails by returning null. | |
| 70 TEST_F(OpenSSLClientKeyStoreTest, FetchEmptyPrivateKey) { | |
| 71 ASSERT_TRUE(store_); | |
| 72 | |
| 73 scoped_refptr<X509Certificate> cert_1( | |
| 74 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); | |
| 75 ASSERT_TRUE(cert_1); | |
| 76 | |
| 77 // Retrieve the private key now. This should fail because it was | |
| 78 // never recorded in the store. | |
| 79 ScopedEVP_PKEY pkey; | |
| 80 ASSERT_FALSE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey)); | |
| 81 ASSERT_FALSE(pkey.get()); | |
| 82 } | |
| 83 | |
| 84 // Check that any private key recorded through RecordClientCertPrivateKey | |
| 85 // can be retrieved with FetchClientCertPrivateKey. | |
| 86 TEST_F(OpenSSLClientKeyStoreTest, RecordAndFetchPrivateKey) { | |
| 87 ASSERT_TRUE(store_); | |
| 88 | |
| 89 // Any certificate / key pair will do, the store is not supposed to | |
| 90 // check that the private and certificate public keys match. This is | |
| 91 // by design since the private EVP_PKEY could be a wrapper around a | |
| 92 // JNI reference, with no way to access the real private key bits. | |
| 93 scoped_refptr<X509Certificate> cert_1( | |
| 94 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); | |
| 95 ASSERT_TRUE(cert_1); | |
| 96 | |
| 97 ScopedEVP_PKEY priv_key(EVP_PKEY_new()); | |
| 98 ASSERT_TRUE(priv_key.get()); | |
| 99 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key.get())); | |
| 100 | |
| 101 // Add the key a first time, this should increment its reference count. | |
| 102 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), | |
| 103 priv_key.get())); | |
| 104 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); | |
| 105 | |
| 106 // Two successive calls with the same certificate / private key shall | |
| 107 // also succeed, but the key's reference count should not be incremented. | |
| 108 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), | |
| 109 priv_key.get())); | |
| 110 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); | |
| 111 | |
| 112 // Retrieve the private key. This should increment the private key's | |
| 113 // reference count. | |
| 114 ScopedEVP_PKEY pkey2; | |
| 115 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey2)); | |
| 116 ASSERT_EQ(pkey2.get(), priv_key.get()); | |
| 117 ASSERT_EQ(3, EVP_PKEY_get_refcount(priv_key.get())); | |
| 118 | |
| 119 // Flush the store explicitely, this should decrement the private | |
| 120 // key's reference count. | |
| 121 store_->Flush(); | |
| 122 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); | |
| 123 } | |
| 124 | |
| 125 // Same test, but with two certificates / private keys. | |
| 126 TEST_F(OpenSSLClientKeyStoreTest, RecordAndFetchTwoPrivateKeys) { | |
| 127 scoped_refptr<X509Certificate> cert_1( | |
| 128 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); | |
| 129 ASSERT_TRUE(cert_1); | |
| 130 | |
| 131 scoped_refptr<X509Certificate> cert_2( | |
| 132 ImportCertFromFile(GetTestCertsDirectory(), "client_2.pem")); | |
| 133 ASSERT_TRUE(cert_2); | |
| 134 | |
| 135 ScopedEVP_PKEY priv_key1(EVP_PKEY_new()); | |
| 136 ASSERT_TRUE(priv_key1.get()); | |
| 137 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key1.get())); | |
| 138 | |
| 139 ScopedEVP_PKEY priv_key2(EVP_PKEY_new()); | |
| 140 ASSERT_TRUE(priv_key2.get()); | |
| 141 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key2.get())); | |
| 142 | |
| 143 ASSERT_NE(priv_key1.get(), priv_key2.get()); | |
| 144 | |
| 145 // Add the key a first time, this shall succeed, and increment the | |
| 146 // reference count. | |
| 147 EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), | |
| 148 priv_key1.get())); | |
| 149 EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_2.get(), | |
| 150 priv_key2.get())); | |
| 151 EXPECT_EQ(2, EVP_PKEY_get_refcount(priv_key1.get())); | |
| 152 EXPECT_EQ(2, EVP_PKEY_get_refcount(priv_key2.get())); | |
| 153 | |
| 154 // Retrieve the private key now. This shall succeed and increment | |
| 155 // the private key's reference count. | |
| 156 ScopedEVP_PKEY fetch_key1; | |
| 157 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_1.get(), | |
| 158 &fetch_key1)); | |
| 159 ScopedEVP_PKEY fetch_key2; | |
| 160 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_2.get(), | |
| 161 &fetch_key2)); | |
| 162 EXPECT_TRUE(fetch_key1.get()); | |
| 163 EXPECT_TRUE(fetch_key2.get()); | |
| 164 | |
| 165 EXPECT_EQ(fetch_key1.get(), priv_key1.get()); | |
| 166 EXPECT_EQ(fetch_key2.get(), priv_key2.get()); | |
| 167 | |
| 168 EXPECT_EQ(3, EVP_PKEY_get_refcount(priv_key1.get())); | |
| 169 EXPECT_EQ(3, EVP_PKEY_get_refcount(priv_key2.get())); | |
| 170 } | |
| 171 | |
| 172 } // namespace | |
| 173 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 13351006:
net: move openssl and keygen from net/base to net/cert (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src