OLD | NEW |
| (Empty) |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include <limits> | |
6 #include <vector> | |
7 | |
8 #include "base/base64.h" | |
9 #include "base/memory/scoped_ptr.h" | |
10 #include "crypto/random.h" | |
11 #include "crypto/secure_util.h" | |
12 #include "google_apis/cup/client_update_protocol.h" | |
13 #include "testing/gtest/include/gtest/gtest.h" | |
14 | |
15 namespace { | |
16 | |
17 std::string GetPublicKeyForTesting() { | |
18 // How to generate this key: | |
19 // openssl genpkey -out cr.pem -outform PEM -algorithm RSA | |
20 // -pkeyopt rsa_keygen_pubexp:3 | |
21 // openssl rsa -in cr.pem -pubout -out cr_pub.pem | |
22 | |
23 static const char kCupTestKey1024_Base64[] = | |
24 "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC7ct1JhLSol2DkBcJdNjR3KkEA" | |
25 "ZfXpF22lDD2WZu5JAZ4NiZqnHsKGJNPUbCH4AhFsXmuW5wEHhUVNhsMP6F9mQ06D" | |
26 "i+ygwZ8aXlklmW4S0Et+SNg3i73fnYn0KDQzrzJnMu46s/CFPhjr4f0TH9b7oHkU" | |
27 "XbqNZtG6gwaN1bmzFwIBAw=="; | |
28 | |
29 std::string result; | |
30 if (!base::Base64Decode(std::string(kCupTestKey1024_Base64), &result)) | |
31 return ""; | |
32 | |
33 return result; | |
34 } | |
35 | |
36 } // end namespace | |
37 | |
38 #if defined(USE_OPENSSL) | |
39 | |
40 // Once CUP is implemented for OpenSSL, remove this #if block. | |
41 TEST(CupTest, OpenSSLStub) { | |
42 scoped_ptr<ClientUpdateProtocol> cup = | |
43 ClientUpdateProtocol::Create(8, GetPublicKeyForTesting()); | |
44 ASSERT_FALSE(cup.get()); | |
45 } | |
46 | |
47 #else | |
48 | |
49 class CupTest : public testing::Test { | |
50 protected: | |
51 virtual void SetUp() { | |
52 cup_ = ClientUpdateProtocol::Create(8, GetPublicKeyForTesting()); | |
53 ASSERT_TRUE(cup_.get()); | |
54 } | |
55 | |
56 void OverrideRAndRebuildKeys() { | |
57 // This must be the same length as the modulus of the public key being | |
58 // used in the unit test. | |
59 static const size_t kPublicKeyLength = 1024 / 8; | |
60 static const char kFixedR[] = | |
61 "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do " | |
62 "eiusmod tempor incididunt ut labore et dolore magna aliqua. "; | |
63 | |
64 ASSERT_EQ(kPublicKeyLength, strlen(kFixedR)); | |
65 ASSERT_TRUE(cup_->SetSharedKeyForTesting(kFixedR)); | |
66 } | |
67 | |
68 ClientUpdateProtocol& CUP() { | |
69 return *cup_.get(); | |
70 } | |
71 | |
72 private: | |
73 scoped_ptr<ClientUpdateProtocol> cup_; | |
74 }; | |
75 | |
76 TEST_F(CupTest, GetVersionedSecret) { | |
77 // Given a fixed public key set in the test fixture, if the key source |r| | |
78 // is filled with known data, |w| can be tested against an expected output, | |
79 // and the signing/verification for an given request becomes fixed. | |
80 // | |
81 // The expected output can be generated using this command line, where | |
82 // plaintext.bin is the contents of kFixedR[] in OverrideRAndRebuildKeys(): | |
83 // | |
84 // openssl rsautl -inkey cr2_pub.pem -pubin -encrypt -raw | |
85 // -in plaintext.bin | base64 | |
86 // | |
87 // Remember to prepend the key version number, and fix up the Base64 | |
88 // afterwards to be URL-safe. | |
89 | |
90 static const char kExpectedVW[] = | |
91 "8:lMmNR3mVbOitbq8ceYGStFBwrJcpvY-sauFSbMVe6VONS9x42xTOLY_KdqsWCy" | |
92 "KuiJBiQziQLOybPUyA9vk0N5kMnC90LIh2nP2FgFG0M0Z22qjB3drsdJPi7TQZbb" | |
93 "Xhqm587M8vjc6VlM_eoC0qYwCPaXBqXjsyiHnXetcn5X0"; | |
94 | |
95 EXPECT_NE(kExpectedVW, CUP().GetVersionedSecret()); | |
96 OverrideRAndRebuildKeys(); | |
97 EXPECT_EQ(kExpectedVW, CUP().GetVersionedSecret()); | |
98 } | |
99 | |
100 TEST_F(CupTest, SignRequest) { | |
101 static const char kUrl[] = "//testserver.chromium.org/update"; | |
102 static const char kUrlQuery[] = "?junk=present"; | |
103 static const char kRequest[] = "testbody"; | |
104 | |
105 static const char kExpectedCP[] = "tfjmVMDAbU0-Kye4PjrCuyQIDCU"; | |
106 | |
107 OverrideRAndRebuildKeys(); | |
108 | |
109 // Check the case with no query string other than v|w. | |
110 std::string url(kUrl); | |
111 url.append("?w="); | |
112 url.append(CUP().GetVersionedSecret()); | |
113 | |
114 std::string cp; | |
115 ASSERT_TRUE(CUP().SignRequest(url, kRequest, &cp)); | |
116 | |
117 // Check the case with a pre-existing query string. | |
118 std::string url2(kUrl); | |
119 url2.append(kUrlQuery); | |
120 url2.append("&w="); | |
121 url2.append(CUP().GetVersionedSecret()); | |
122 | |
123 std::string cp2; | |
124 ASSERT_TRUE(CUP().SignRequest(url2, kRequest, &cp2)); | |
125 | |
126 // Changes in the URL should result in changes in the client proof. | |
127 EXPECT_EQ(kExpectedCP, cp2); | |
128 EXPECT_NE(cp, cp2); | |
129 } | |
130 | |
131 TEST_F(CupTest, ValidateResponse) { | |
132 static const char kUrl[] = "//testserver.chromium.orgupdate?junk=present&w="; | |
133 static const char kRequest[] = "testbody"; | |
134 | |
135 static const char kGoodResponse[] = "intact_response"; | |
136 static const char kGoodC[] = "c=EncryptedDataFromTheUpdateServer"; | |
137 static const char kGoodSP[] = "5rMFMPL9Hgqb-2J8kL3scsHeNgg"; | |
138 | |
139 static const char kBadResponse[] = "tampered_response"; | |
140 static const char kBadC[] = "c=TotalJunkThatAnAttackerCouldSend"; | |
141 static const char kBadSP[] = "Base64TamperedShaOneHash"; | |
142 | |
143 OverrideRAndRebuildKeys(); | |
144 | |
145 std::string url(kUrl); | |
146 url.append(CUP().GetVersionedSecret()); | |
147 | |
148 std::string client_proof; | |
149 ASSERT_TRUE(CUP().SignRequest(url, kRequest, &client_proof)); | |
150 | |
151 // Return true on a valid response and server proof. | |
152 EXPECT_TRUE(CUP().ValidateResponse(kGoodResponse, kGoodC, kGoodSP)); | |
153 | |
154 // Return false on anything invalid. | |
155 EXPECT_FALSE(CUP().ValidateResponse(kBadResponse, kGoodC, kGoodSP)); | |
156 EXPECT_FALSE(CUP().ValidateResponse(kGoodResponse, kBadC, kGoodSP)); | |
157 EXPECT_FALSE(CUP().ValidateResponse(kGoodResponse, kGoodC, kBadSP)); | |
158 EXPECT_FALSE(CUP().ValidateResponse(kGoodResponse, kBadC, kBadSP)); | |
159 EXPECT_FALSE(CUP().ValidateResponse(kBadResponse, kGoodC, kBadSP)); | |
160 EXPECT_FALSE(CUP().ValidateResponse(kBadResponse, kBadC, kGoodSP)); | |
161 EXPECT_FALSE(CUP().ValidateResponse(kBadResponse, kBadC, kBadSP)); | |
162 } | |
163 | |
164 #endif // !defined(USE_OPENSSL) | |
165 | |
OLD | NEW |