| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/ssl/openssl_client_key_store.h" | 5 #include "net/ssl/openssl_client_key_store.h" |
| 6 | 6 |
| 7 #include "base/memory/ref_counted.h" | 7 #include "base/memory/ref_counted.h" |
| 8 #include "crypto/scoped_openssl_types.h" |
| 8 #include "net/base/test_data_directory.h" | 9 #include "net/base/test_data_directory.h" |
| 9 #include "net/test/cert_test_util.h" | 10 #include "net/test/cert_test_util.h" |
| 10 #include "testing/gtest/include/gtest/gtest.h" | 11 #include "testing/gtest/include/gtest/gtest.h" |
| 11 | 12 |
| 12 namespace net { | 13 namespace net { |
| 13 | 14 |
| 14 namespace { | 15 namespace { |
| 15 | 16 |
| 16 typedef OpenSSLClientKeyStore::ScopedEVP_PKEY ScopedEVP_PKEY; | |
| 17 | |
| 18 // Return the internal reference count of a given EVP_PKEY. | 17 // Return the internal reference count of a given EVP_PKEY. |
| 19 int EVP_PKEY_get_refcount(EVP_PKEY* pkey) { | 18 int EVP_PKEY_get_refcount(EVP_PKEY* pkey) { |
| 20 return pkey->references; | 19 return pkey->references; |
| 21 } | 20 } |
| 22 | 21 |
| 23 // A common test class to ensure that the store is flushed after | 22 // A common test class to ensure that the store is flushed after |
| 24 // each test. | 23 // each test. |
| 25 class OpenSSLClientKeyStoreTest : public ::testing::Test { | 24 class OpenSSLClientKeyStoreTest : public ::testing::Test { |
| 26 public: | 25 public: |
| 27 OpenSSLClientKeyStoreTest() | 26 OpenSSLClientKeyStoreTest() |
| (...skipping 15 matching lines...) Expand all Loading... |
| 43 } | 42 } |
| 44 | 43 |
| 45 // Check that Flush() works correctly. | 44 // Check that Flush() works correctly. |
| 46 TEST_F(OpenSSLClientKeyStoreTest, Flush) { | 45 TEST_F(OpenSSLClientKeyStoreTest, Flush) { |
| 47 ASSERT_TRUE(store_); | 46 ASSERT_TRUE(store_); |
| 48 | 47 |
| 49 scoped_refptr<X509Certificate> cert_1( | 48 scoped_refptr<X509Certificate> cert_1( |
| 50 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); | 49 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); |
| 51 ASSERT_TRUE(cert_1.get()); | 50 ASSERT_TRUE(cert_1.get()); |
| 52 | 51 |
| 53 ScopedEVP_PKEY priv_key(EVP_PKEY_new()); | 52 crypto::ScopedEVP_PKEY priv_key(EVP_PKEY_new()); |
| 54 ASSERT_TRUE(priv_key.get()); | 53 ASSERT_TRUE(priv_key.get()); |
| 55 | 54 |
| 56 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), | 55 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), |
| 57 priv_key.get())); | 56 priv_key.get())); |
| 58 | 57 |
| 59 store_->Flush(); | 58 store_->Flush(); |
| 60 | 59 |
| 61 // Retrieve the private key. This should fail because the store | 60 // Retrieve the private key. This should fail because the store |
| 62 // was flushed. | 61 // was flushed. |
| 63 ScopedEVP_PKEY pkey; | 62 crypto::ScopedEVP_PKEY pkey; |
| 64 ASSERT_FALSE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey)); | 63 ASSERT_FALSE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey)); |
| 65 ASSERT_FALSE(pkey.get()); | 64 ASSERT_FALSE(pkey.get()); |
| 66 } | 65 } |
| 67 | 66 |
| 68 // Check that trying to retrieve the private key of an unknown certificate | 67 // Check that trying to retrieve the private key of an unknown certificate |
| 69 // simply fails by returning null. | 68 // simply fails by returning null. |
| 70 TEST_F(OpenSSLClientKeyStoreTest, FetchEmptyPrivateKey) { | 69 TEST_F(OpenSSLClientKeyStoreTest, FetchEmptyPrivateKey) { |
| 71 ASSERT_TRUE(store_); | 70 ASSERT_TRUE(store_); |
| 72 | 71 |
| 73 scoped_refptr<X509Certificate> cert_1( | 72 scoped_refptr<X509Certificate> cert_1( |
| 74 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); | 73 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); |
| 75 ASSERT_TRUE(cert_1.get()); | 74 ASSERT_TRUE(cert_1.get()); |
| 76 | 75 |
| 77 // Retrieve the private key now. This should fail because it was | 76 // Retrieve the private key now. This should fail because it was |
| 78 // never recorded in the store. | 77 // never recorded in the store. |
| 79 ScopedEVP_PKEY pkey; | 78 crypto::ScopedEVP_PKEY pkey; |
| 80 ASSERT_FALSE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey)); | 79 ASSERT_FALSE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey)); |
| 81 ASSERT_FALSE(pkey.get()); | 80 ASSERT_FALSE(pkey.get()); |
| 82 } | 81 } |
| 83 | 82 |
| 84 // Check that any private key recorded through RecordClientCertPrivateKey | 83 // Check that any private key recorded through RecordClientCertPrivateKey |
| 85 // can be retrieved with FetchClientCertPrivateKey. | 84 // can be retrieved with FetchClientCertPrivateKey. |
| 86 TEST_F(OpenSSLClientKeyStoreTest, RecordAndFetchPrivateKey) { | 85 TEST_F(OpenSSLClientKeyStoreTest, RecordAndFetchPrivateKey) { |
| 87 ASSERT_TRUE(store_); | 86 ASSERT_TRUE(store_); |
| 88 | 87 |
| 89 // Any certificate / key pair will do, the store is not supposed to | 88 // Any certificate / key pair will do, the store is not supposed to |
| 90 // check that the private and certificate public keys match. This is | 89 // check that the private and certificate public keys match. This is |
| 91 // by design since the private EVP_PKEY could be a wrapper around a | 90 // by design since the private EVP_PKEY could be a wrapper around a |
| 92 // JNI reference, with no way to access the real private key bits. | 91 // JNI reference, with no way to access the real private key bits. |
| 93 scoped_refptr<X509Certificate> cert_1( | 92 scoped_refptr<X509Certificate> cert_1( |
| 94 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); | 93 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); |
| 95 ASSERT_TRUE(cert_1.get()); | 94 ASSERT_TRUE(cert_1.get()); |
| 96 | 95 |
| 97 ScopedEVP_PKEY priv_key(EVP_PKEY_new()); | 96 crypto::ScopedEVP_PKEY priv_key(EVP_PKEY_new()); |
| 98 ASSERT_TRUE(priv_key.get()); | 97 ASSERT_TRUE(priv_key.get()); |
| 99 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key.get())); | 98 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key.get())); |
| 100 | 99 |
| 101 // Add the key a first time, this should increment its reference count. | 100 // Add the key a first time, this should increment its reference count. |
| 102 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), | 101 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), |
| 103 priv_key.get())); | 102 priv_key.get())); |
| 104 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); | 103 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); |
| 105 | 104 |
| 106 // Two successive calls with the same certificate / private key shall | 105 // Two successive calls with the same certificate / private key shall |
| 107 // also succeed, but the key's reference count should not be incremented. | 106 // also succeed, but the key's reference count should not be incremented. |
| 108 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), | 107 ASSERT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), |
| 109 priv_key.get())); | 108 priv_key.get())); |
| 110 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); | 109 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); |
| 111 | 110 |
| 112 // Retrieve the private key. This should increment the private key's | 111 // Retrieve the private key. This should increment the private key's |
| 113 // reference count. | 112 // reference count. |
| 114 ScopedEVP_PKEY pkey2; | 113 crypto::ScopedEVP_PKEY pkey2; |
| 115 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey2)); | 114 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_1.get(), &pkey2)); |
| 116 ASSERT_EQ(pkey2.get(), priv_key.get()); | 115 ASSERT_EQ(pkey2.get(), priv_key.get()); |
| 117 ASSERT_EQ(3, EVP_PKEY_get_refcount(priv_key.get())); | 116 ASSERT_EQ(3, EVP_PKEY_get_refcount(priv_key.get())); |
| 118 | 117 |
| 119 // Flush the store explicitely, this should decrement the private | 118 // Flush the store explicitely, this should decrement the private |
| 120 // key's reference count. | 119 // key's reference count. |
| 121 store_->Flush(); | 120 store_->Flush(); |
| 122 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); | 121 ASSERT_EQ(2, EVP_PKEY_get_refcount(priv_key.get())); |
| 123 } | 122 } |
| 124 | 123 |
| 125 // Same test, but with two certificates / private keys. | 124 // Same test, but with two certificates / private keys. |
| 126 TEST_F(OpenSSLClientKeyStoreTest, RecordAndFetchTwoPrivateKeys) { | 125 TEST_F(OpenSSLClientKeyStoreTest, RecordAndFetchTwoPrivateKeys) { |
| 127 scoped_refptr<X509Certificate> cert_1( | 126 scoped_refptr<X509Certificate> cert_1( |
| 128 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); | 127 ImportCertFromFile(GetTestCertsDirectory(), "client_1.pem")); |
| 129 ASSERT_TRUE(cert_1.get()); | 128 ASSERT_TRUE(cert_1.get()); |
| 130 | 129 |
| 131 scoped_refptr<X509Certificate> cert_2( | 130 scoped_refptr<X509Certificate> cert_2( |
| 132 ImportCertFromFile(GetTestCertsDirectory(), "client_2.pem")); | 131 ImportCertFromFile(GetTestCertsDirectory(), "client_2.pem")); |
| 133 ASSERT_TRUE(cert_2.get()); | 132 ASSERT_TRUE(cert_2.get()); |
| 134 | 133 |
| 135 ScopedEVP_PKEY priv_key1(EVP_PKEY_new()); | 134 crypto::ScopedEVP_PKEY priv_key1(EVP_PKEY_new()); |
| 136 ASSERT_TRUE(priv_key1.get()); | 135 ASSERT_TRUE(priv_key1.get()); |
| 137 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key1.get())); | 136 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key1.get())); |
| 138 | 137 |
| 139 ScopedEVP_PKEY priv_key2(EVP_PKEY_new()); | 138 crypto::ScopedEVP_PKEY priv_key2(EVP_PKEY_new()); |
| 140 ASSERT_TRUE(priv_key2.get()); | 139 ASSERT_TRUE(priv_key2.get()); |
| 141 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key2.get())); | 140 ASSERT_EQ(1, EVP_PKEY_get_refcount(priv_key2.get())); |
| 142 | 141 |
| 143 ASSERT_NE(priv_key1.get(), priv_key2.get()); | 142 ASSERT_NE(priv_key1.get(), priv_key2.get()); |
| 144 | 143 |
| 145 // Add the key a first time, this shall succeed, and increment the | 144 // Add the key a first time, this shall succeed, and increment the |
| 146 // reference count. | 145 // reference count. |
| 147 EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), | 146 EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_1.get(), |
| 148 priv_key1.get())); | 147 priv_key1.get())); |
| 149 EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_2.get(), | 148 EXPECT_TRUE(store_->RecordClientCertPrivateKey(cert_2.get(), |
| 150 priv_key2.get())); | 149 priv_key2.get())); |
| 151 EXPECT_EQ(2, EVP_PKEY_get_refcount(priv_key1.get())); | 150 EXPECT_EQ(2, EVP_PKEY_get_refcount(priv_key1.get())); |
| 152 EXPECT_EQ(2, EVP_PKEY_get_refcount(priv_key2.get())); | 151 EXPECT_EQ(2, EVP_PKEY_get_refcount(priv_key2.get())); |
| 153 | 152 |
| 154 // Retrieve the private key now. This shall succeed and increment | 153 // Retrieve the private key now. This shall succeed and increment |
| 155 // the private key's reference count. | 154 // the private key's reference count. |
| 156 ScopedEVP_PKEY fetch_key1; | 155 crypto::ScopedEVP_PKEY fetch_key1; |
| 157 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_1.get(), | 156 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_1.get(), |
| 158 &fetch_key1)); | 157 &fetch_key1)); |
| 159 ScopedEVP_PKEY fetch_key2; | 158 crypto::ScopedEVP_PKEY fetch_key2; |
| 160 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_2.get(), | 159 ASSERT_TRUE(store_->FetchClientCertPrivateKey(cert_2.get(), |
| 161 &fetch_key2)); | 160 &fetch_key2)); |
| 162 EXPECT_TRUE(fetch_key1.get()); | 161 EXPECT_TRUE(fetch_key1.get()); |
| 163 EXPECT_TRUE(fetch_key2.get()); | 162 EXPECT_TRUE(fetch_key2.get()); |
| 164 | 163 |
| 165 EXPECT_EQ(fetch_key1.get(), priv_key1.get()); | 164 EXPECT_EQ(fetch_key1.get(), priv_key1.get()); |
| 166 EXPECT_EQ(fetch_key2.get(), priv_key2.get()); | 165 EXPECT_EQ(fetch_key2.get(), priv_key2.get()); |
| 167 | 166 |
| 168 EXPECT_EQ(3, EVP_PKEY_get_refcount(priv_key1.get())); | 167 EXPECT_EQ(3, EVP_PKEY_get_refcount(priv_key1.get())); |
| 169 EXPECT_EQ(3, EVP_PKEY_get_refcount(priv_key2.get())); | 168 EXPECT_EQ(3, EVP_PKEY_get_refcount(priv_key2.get())); |
| 170 } | 169 } |
| 171 | 170 |
| 172 } // namespace | 171 } // namespace |
| 173 } // namespace net | 172 } // namespace net |
| OLD | NEW |