| OLD | NEW |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/ssl/ssl_private_key_test_util.h" | 5 #include "net/ssl/ssl_private_key_test_util.h" |
| 6 | 6 |
| 7 #include <stdint.h> | 7 #include <stdint.h> |
| 8 | 8 |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| (...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 59 case SSLPrivateKey::Hash::SHA384: | 59 case SSLPrivateKey::Hash::SHA384: |
| 60 return EVP_sha384(); | 60 return EVP_sha384(); |
| 61 case SSLPrivateKey::Hash::SHA512: | 61 case SSLPrivateKey::Hash::SHA512: |
| 62 return EVP_sha512(); | 62 return EVP_sha512(); |
| 63 } | 63 } |
| 64 | 64 |
| 65 NOTREACHED(); | 65 NOTREACHED(); |
| 66 return nullptr; | 66 return nullptr; |
| 67 } | 67 } |
| 68 | 68 |
| 69 SSLPrivateKey::Type TypeForOpenSSLKey(EVP_PKEY* pkey) { | |
| 70 switch (EVP_PKEY_id(pkey)) { | |
| 71 case EVP_PKEY_RSA: | |
| 72 return SSLPrivateKey::Type::RSA; | |
| 73 case EVP_PKEY_EC: { | |
| 74 switch (EC_GROUP_get_curve_name( | |
| 75 EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(pkey)))) { | |
| 76 case NID_X9_62_prime256v1: | |
| 77 return SSLPrivateKey::Type::ECDSA_P256; | |
| 78 case NID_secp384r1: | |
| 79 return SSLPrivateKey::Type::ECDSA_P384; | |
| 80 case NID_secp521r1: | |
| 81 return SSLPrivateKey::Type::ECDSA_P521; | |
| 82 } | |
| 83 } | |
| 84 } | |
| 85 | |
| 86 NOTREACHED(); | |
| 87 return SSLPrivateKey::Type::RSA; | |
| 88 } | |
| 89 | |
| 90 // Resize a string to |size| bytes of data, then return its data buffer address | 69 // Resize a string to |size| bytes of data, then return its data buffer address |
| 91 // cast as an 'uint8_t*', as expected by OpenSSL functions. | 70 // cast as an 'uint8_t*', as expected by OpenSSL functions. |
| 92 // |str| the target string. | 71 // |str| the target string. |
| 93 // |size| the number of bytes to write into the string. | 72 // |size| the number of bytes to write into the string. |
| 94 // Return the string's new buffer in memory, as an 'uint8_t*' pointer. | 73 // Return the string's new buffer in memory, as an 'uint8_t*' pointer. |
| 95 uint8_t* OpenSSLWriteInto(std::string* str, size_t size) { | 74 uint8_t* OpenSSLWriteInto(std::string* str, size_t size) { |
| 96 return reinterpret_cast<uint8_t*>(base::WriteInto(str, size + 1)); | 75 return reinterpret_cast<uint8_t*>(base::WriteInto(str, size + 1)); |
| 97 } | 76 } |
| 98 | 77 |
| 99 bool VerifyWithOpenSSL(const EVP_MD* md, | 78 bool VerifyWithOpenSSL(const EVP_MD* md, |
| (...skipping 50 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 150 key->SignDigest( | 129 key->SignDigest( |
| 151 hash, message, | 130 hash, message, |
| 152 base::Bind(OnSignComplete, base::Unretained(&loop), | 131 base::Bind(OnSignComplete, base::Unretained(&loop), |
| 153 base::Unretained(&error), base::Unretained(result))); | 132 base::Unretained(&error), base::Unretained(result))); |
| 154 loop.Run(); | 133 loop.Run(); |
| 155 return error; | 134 return error; |
| 156 } | 135 } |
| 157 | 136 |
| 158 } // namespace | 137 } // namespace |
| 159 | 138 |
| 160 const char* SSLPrivateKeyTypeToString(SSLPrivateKey::Type type) { | |
| 161 switch (type) { | |
| 162 case SSLPrivateKey::Type::RSA: | |
| 163 return "RSA"; | |
| 164 case SSLPrivateKey::Type::ECDSA_P256: | |
| 165 return "ECDSA_P256"; | |
| 166 case SSLPrivateKey::Type::ECDSA_P384: | |
| 167 return "ECDSA_P384"; | |
| 168 case SSLPrivateKey::Type::ECDSA_P521: | |
| 169 return "ECDSA_P521"; | |
| 170 } | |
| 171 | |
| 172 NOTREACHED(); | |
| 173 return ""; | |
| 174 } | |
| 175 | |
| 176 void TestSSLPrivateKeyMatches(SSLPrivateKey* key, const std::string& pkcs8) { | 139 void TestSSLPrivateKeyMatches(SSLPrivateKey* key, const std::string& pkcs8) { |
| 177 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); | 140 crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE); |
| 178 | 141 |
| 179 // Create the equivalent OpenSSL key. | 142 // Create the equivalent OpenSSL key. |
| 180 CBS cbs; | 143 CBS cbs; |
| 181 CBS_init(&cbs, reinterpret_cast<const uint8_t*>(pkcs8.data()), pkcs8.size()); | 144 CBS_init(&cbs, reinterpret_cast<const uint8_t*>(pkcs8.data()), pkcs8.size()); |
| 182 bssl::UniquePtr<EVP_PKEY> openssl_key(EVP_parse_private_key(&cbs)); | 145 bssl::UniquePtr<EVP_PKEY> openssl_key(EVP_parse_private_key(&cbs)); |
| 183 ASSERT_TRUE(openssl_key); | 146 ASSERT_TRUE(openssl_key); |
| 184 EXPECT_EQ(0u, CBS_len(&cbs)); | 147 EXPECT_EQ(0u, CBS_len(&cbs)); |
| 185 | 148 |
| 186 // Check the length and type matches. | |
| 187 EXPECT_EQ(TypeForOpenSSLKey(openssl_key.get()), key->GetType()); | |
| 188 EXPECT_EQ(static_cast<size_t>(EVP_PKEY_size(openssl_key.get())), | |
| 189 key->GetMaxSignatureLengthInBytes()); | |
| 190 | |
| 191 // Test all supported hash algorithms. | 149 // Test all supported hash algorithms. |
| 192 std::vector<SSLPrivateKey::Hash> hashes = key->GetDigestPreferences(); | 150 std::vector<SSLPrivateKey::Hash> hashes = key->GetDigestPreferences(); |
| 193 | 151 |
| 194 // To support TLS 1.1 and earlier, RSA keys must implicitly support MD5-SHA1, | 152 // To support TLS 1.1 and earlier, RSA keys must implicitly support MD5-SHA1, |
| 195 // despite not being advertised. | 153 // despite not being advertised. |
| 196 if (key->GetType() == SSLPrivateKey::Type::RSA) | 154 if (EVP_PKEY_id(openssl_key.get()) == EVP_PKEY_RSA) |
| 197 hashes.push_back(SSLPrivateKey::Hash::MD5_SHA1); | 155 hashes.push_back(SSLPrivateKey::Hash::MD5_SHA1); |
| 198 | 156 |
| 199 for (SSLPrivateKey::Hash hash : hashes) { | 157 for (SSLPrivateKey::Hash hash : hashes) { |
| 200 SCOPED_TRACE(HashToString(hash)); | 158 SCOPED_TRACE(HashToString(hash)); |
| 201 const EVP_MD* md = HashToMD(hash); | 159 const EVP_MD* md = HashToMD(hash); |
| 202 | 160 |
| 203 std::string digest(EVP_MD_size(md), 'a'); | 161 std::string digest(EVP_MD_size(md), 'a'); |
| 204 | 162 |
| 205 // Test the key generates valid signatures. | 163 // Test the key generates valid signatures. |
| 206 std::string signature; | 164 std::string signature; |
| 207 Error error = DoKeySigningWithWrapper(key, hash, digest, &signature); | 165 Error error = DoKeySigningWithWrapper(key, hash, digest, &signature); |
| 208 EXPECT_THAT(error, IsOk()); | 166 EXPECT_THAT(error, IsOk()); |
| 209 EXPECT_TRUE(VerifyWithOpenSSL(md, digest, openssl_key.get(), signature)); | 167 EXPECT_TRUE(VerifyWithOpenSSL(md, digest, openssl_key.get(), signature)); |
| 210 | 168 |
| 211 // RSA signing is deterministic, so further check the signature matches. | 169 // RSA signing is deterministic, so further check the signature matches. |
| 212 if (key->GetType() == SSLPrivateKey::Type::RSA) { | 170 if (EVP_PKEY_id(openssl_key.get()) == EVP_PKEY_RSA) { |
| 213 std::string openssl_signature; | 171 std::string openssl_signature; |
| 214 ASSERT_TRUE( | 172 ASSERT_TRUE( |
| 215 SignWithOpenSSL(md, digest, openssl_key.get(), &openssl_signature)); | 173 SignWithOpenSSL(md, digest, openssl_key.get(), &openssl_signature)); |
| 216 EXPECT_EQ(openssl_signature, signature); | 174 EXPECT_EQ(openssl_signature, signature); |
| 217 } | 175 } |
| 218 } | 176 } |
| 219 } | 177 } |
| 220 | 178 |
| 221 } // namespace net | 179 } // namespace net |
| OLD | NEW |