Implement verify() for HMAC using NSS

content/renderer/webcrypto_impl_unittest.cc

Index: content/renderer/webcrypto_impl_unittest.cc
diff --git a/content/renderer/webcrypto_impl_unittest.cc b/content/renderer/webcrypto_impl_unittest.cc
index 8a9a1004b86027bb4f7bcb82d35a669ab4d92840..dab9cafdaf2bdac43d35ad6135ea91430675a8bb 100644
--- a/content/renderer/webcrypto_impl_unittest.cc
+++ b/content/renderer/webcrypto_impl_unittest.cc
@@ -271,6 +271,43 @@ TEST_F(WebCryptoImplTest, HMACSampleSets) {
         input_set[index].mac,
         base::HexEncode(
             array_buffer.data(), array_buffer.byteLength()).c_str());
+
+    bool signature_match = false;
+    EXPECT_TRUE(
+        crypto.VerifySignatureInternal(
+            hmac_algorithm,
+            crypto_key,
+            static_cast<const unsigned char*>(array_buffer.data()),
+            array_buffer.byteLength(),
+            message_raw.data(),
+            message_raw.size(),
+            &signature_match));
+    EXPECT_TRUE(signature_match);
+
+    // Ensure truncated signature does not verify by passing one less byte.
+    EXPECT_TRUE(
+        crypto.VerifySignatureInternal(
+            hmac_algorithm,
+            crypto_key,
+            static_cast<const unsigned char*>(array_buffer.data()),
+            array_buffer.byteLength() - 1,
+            message_raw.data(),
+            message_raw.size(),
+            &signature_match));
+    EXPECT_FALSE(signature_match);
+
+    // Ensure extra long signature does not cause issues and fails.
+    const unsigned char kLongSignature[1024] = { 0 };
+    EXPECT_TRUE(
+        crypto.VerifySignatureInternal(
+            hmac_algorithm,
+            crypto_key,
+            kLongSignature,
+            sizeof(kLongSignature),
+            message_raw.data(),
+            message_raw.size(),
+            &signature_match));
+    EXPECT_FALSE(signature_match);
   }
 }