Check that usage isn't empty when generateKey() is called

content/child/webcrypto/test/rsa_ssa_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "content/child/webcrypto/algorithm_dispatch.h"
 #include "content/child/webcrypto/crypto_data.h"
 #include "content/child/webcrypto/status.h"
 #include "content/child/webcrypto/test/test_helpers.h"
@@ skipping 326 matching lines @@
 
   // Successful WebCryptoAlgorithmIdRsaSsaPkcs1v1_5 key generation (sha256)
   const unsigned int modulus_length = 256;
   const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
   blink::WebCryptoAlgorithm algorithm =
       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                                      blink::WebCryptoAlgorithmIdSha256,
                                      modulus_length,
                                      public_exponent);
   bool extractable = true;
-  const blink::WebCryptoKeyUsageMask usages = 0;
+  const blink::WebCryptoKeyUsageMask public_usages =
+      blink::WebCryptoKeyUsageVerify;
+  const blink::WebCryptoKeyUsageMask private_usages =
+      blink::WebCryptoKeyUsageSign;
+  const blink::WebCryptoKeyUsageMask usages = public_usages | private_usages;
   blink::WebCryptoKey public_key;
   blink::WebCryptoKey private_key;
 
-  EXPECT_EQ(Status::Success(),
-            GenerateKeyPair(
-                algorithm, extractable, usages, &public_key, &private_key));
-  EXPECT_FALSE(public_key.isNull());
-  EXPECT_FALSE(private_key.isNull());
+  EXPECT_EQ(Status::Success(), GenerateKeyPair(algorithm, extractable, usages,
+                                               &public_key, &private_key));
+  ASSERT_FALSE(public_key.isNull());
+  ASSERT_FALSE(private_key.isNull());
   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
   EXPECT_EQ(modulus_length,
             public_key.algorithm().rsaHashedParams()->modulusLengthBits());
   EXPECT_EQ(modulus_length,
             private_key.algorithm().rsaHashedParams()->modulusLengthBits());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha256,
             public_key.algorithm().rsaHashedParams()->hash().id());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha256,
             private_key.algorithm().rsaHashedParams()->hash().id());
   EXPECT_TRUE(public_key.extractable());
   EXPECT_EQ(extractable, private_key.extractable());
-  EXPECT_EQ(usages, public_key.usages());
-  EXPECT_EQ(usages, private_key.usages());
+  EXPECT_EQ(public_usages, public_key.usages());
+  EXPECT_EQ(private_usages, private_key.usages());
 
   // Try exporting the generated key pair, and then re-importing to verify that
   // the exported data was valid.
   std::vector<uint8_t> public_key_spki;
   EXPECT_EQ(
       Status::Success(),
       ExportKey(blink::WebCryptoKeyFormatSpki, public_key, &public_key_spki));
 
   if (SupportsRsaPrivateKeyImport()) {
     public_key = blink::WebCryptoKey::createNull();
-    EXPECT_EQ(Status::Success(),
-              ImportKey(blink::WebCryptoKeyFormatSpki,
-                        CryptoData(public_key_spki),
-                        CreateRsaHashedImportAlgorithm(
-                            blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
-                            blink::WebCryptoAlgorithmIdSha256),
-                        true,
-                        usages,
-                        &public_key));
+    ASSERT_EQ(
+        Status::Success(),
+        ImportKey(blink::WebCryptoKeyFormatSpki, CryptoData(public_key_spki),
+                  CreateRsaHashedImportAlgorithm(
+                      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
+                      blink::WebCryptoAlgorithmIdSha256),
+                  true, public_usages, &public_key));
     EXPECT_EQ(modulus_length,
               public_key.algorithm().rsaHashedParams()->modulusLengthBits());
 
     std::vector<uint8_t> private_key_pkcs8;
     EXPECT_EQ(
         Status::Success(),
         ExportKey(
             blink::WebCryptoKeyFormatPkcs8, private_key, &private_key_pkcs8));
     private_key = blink::WebCryptoKey::createNull();
-    EXPECT_EQ(Status::Success(),
-              ImportKey(blink::WebCryptoKeyFormatPkcs8,
-                        CryptoData(private_key_pkcs8),
-                        CreateRsaHashedImportAlgorithm(
-                            blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
-                            blink::WebCryptoAlgorithmIdSha256),
-                        true,
-                        usages,
-                        &private_key));
+    ASSERT_EQ(
+        Status::Success(),
+        ImportKey(blink::WebCryptoKeyFormatPkcs8, CryptoData(private_key_pkcs8),
+                  CreateRsaHashedImportAlgorithm(
+                      blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
+                      blink::WebCryptoAlgorithmIdSha256),
+                  true, private_usages, &private_key));
     EXPECT_EQ(modulus_length,
               private_key.algorithm().rsaHashedParams()->modulusLengthBits());
   }
 
   // Fail with bad modulus.
   algorithm =
       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                                      blink::WebCryptoAlgorithmIdSha256,
                                      0,
                                      public_exponent);
@@ skipping 37 matching lines @@
 
   // Key generation success using exponent with leading zeros.
   exponent_with_leading_zeros.insert(exponent_with_leading_zeros.end(),
                                      public_exponent.begin(),
                                      public_exponent.end());
   algorithm =
       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                                      blink::WebCryptoAlgorithmIdSha256,
                                      modulus_length,
                                      exponent_with_leading_zeros);
-  EXPECT_EQ(Status::Success(),
-            GenerateKeyPair(
-                algorithm, extractable, usages, &public_key, &private_key));
+  EXPECT_EQ(Status::Success(), GenerateKeyPair(algorithm, extractable, usages,
+                                               &public_key, &private_key));
   EXPECT_FALSE(public_key.isNull());
   EXPECT_FALSE(private_key.isNull());
   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
   EXPECT_TRUE(public_key.extractable());
   EXPECT_EQ(extractable, private_key.extractable());
-  EXPECT_EQ(usages, public_key.usages());
-  EXPECT_EQ(usages, private_key.usages());
+  EXPECT_EQ(public_usages, public_key.usages());
+  EXPECT_EQ(private_usages, private_key.usages());
 
   // Successful WebCryptoAlgorithmIdRsaSsaPkcs1v1_5 key generation (sha1)
   algorithm =
       CreateRsaHashedKeyGenAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                                      blink::WebCryptoAlgorithmIdSha1,
                                      modulus_length,
                                      public_exponent);
   EXPECT_EQ(
       Status::Success(),
       GenerateKeyPair(algorithm, false, usages, &public_key, &private_key));
   EXPECT_FALSE(public_key.isNull());
   EXPECT_FALSE(private_key.isNull());
   EXPECT_EQ(blink::WebCryptoKeyTypePublic, public_key.type());
   EXPECT_EQ(blink::WebCryptoKeyTypePrivate, private_key.type());
   EXPECT_EQ(modulus_length,
             public_key.algorithm().rsaHashedParams()->modulusLengthBits());
   EXPECT_EQ(modulus_length,
             private_key.algorithm().rsaHashedParams()->modulusLengthBits());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
             public_key.algorithm().rsaHashedParams()->hash().id());
   EXPECT_EQ(blink::WebCryptoAlgorithmIdSha1,
             private_key.algorithm().rsaHashedParams()->hash().id());
   // Even though "extractable" was set to false, the public key remains
   // extractable.
   EXPECT_TRUE(public_key.extractable());
   EXPECT_FALSE(private_key.extractable());
-  EXPECT_EQ(usages, public_key.usages());
-  EXPECT_EQ(usages, private_key.usages());
+  EXPECT_EQ(public_usages, public_key.usages());
+  EXPECT_EQ(private_usages, private_key.usages());
 
   // Exporting a private key as SPKI format doesn't make sense. However this
   // will first fail because the key is not extractable.
   std::vector<uint8_t> output;
   EXPECT_EQ(Status::ErrorKeyNotExtractable(),
             ExportKey(blink::WebCryptoKeyFormatSpki, private_key, &output));
 
   // Re-generate an extractable private_key and try to export it as SPKI format.
   // This should fail since spki is for public keys.
-  EXPECT_EQ(
-      Status::Success(),
-      GenerateKeyPair(algorithm, true, usages, &public_key, &private_key));
+  EXPECT_EQ(Status::Success(), GenerateKeyPair(algorithm, true, usages,
+                                               &public_key, &private_key));
   EXPECT_EQ(Status::ErrorUnexpectedKeyType(),
             ExportKey(blink::WebCryptoKeyFormatSpki, private_key, &output));
 }
 
 TEST(WebCryptoRsaSsaTest, GenerateKeyPairRsaBadModulusLength) {
   const unsigned int kBadModulusBits[] = {
       0,
       248,         // Too small.
       257,         // Not a multiple of 8.
       1023,        // Not a multiple of 8.
       0xFFFFFFFF,  // Too big.
       16384 + 8,   // 16384 is the maxmimum length that NSS succeeds for.
   };
 
   const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
 
   for (size_t i = 0; i < arraysize(kBadModulusBits); ++i) {
     const unsigned int modulus_length_bits = kBadModulusBits[i];
     blink::WebCryptoAlgorithm algorithm = CreateRsaHashedKeyGenAlgorithm(
         blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
         blink::WebCryptoAlgorithmIdSha256,
         modulus_length_bits,
         public_exponent);
     bool extractable = true;
-    const blink::WebCryptoKeyUsageMask usages = 0;
+    const blink::WebCryptoKeyUsageMask usages = blink::WebCryptoKeyUsageSign;
     blink::WebCryptoKey public_key;
     blink::WebCryptoKey private_key;
 
     EXPECT_EQ(Status::ErrorGenerateRsaUnsupportedModulus(),
               GenerateKeyPair(
                   algorithm, extractable, usages, &public_key, &private_key));
   }
 }
 
 // Try generating RSA key pairs using unsupported public exponents. Only
@@ skipping 14 matching lines @@
     blink::WebCryptoAlgorithm algorithm = CreateRsaHashedKeyGenAlgorithm(
         blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
         blink::WebCryptoAlgorithmIdSha256,
         modulus_length,
         HexStringToBytes(kPublicExponents[i]));
 
     blink::WebCryptoKey public_key;
     blink::WebCryptoKey private_key;
 
     EXPECT_EQ(Status::ErrorGenerateKeyPublicExponent(),
-              GenerateKeyPair(algorithm, true, 0, &public_key, &private_key));
+              GenerateKeyPair(algorithm, true, blink::WebCryptoKeyUsageSign,
+                              &public_key, &private_key));
   }
 }
 
 TEST(WebCryptoRsaSsaTest, SignVerifyFailures) {
   if (!SupportsRsaPrivateKeyImport())
     return;
 
   // Import a key pair.
   blink::WebCryptoAlgorithm import_algorithm =
       CreateRsaHashedImportAlgorithm(blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
@@ skipping 300 matching lines @@
                                 public_exponent),
                             true,
                             blink::WebCryptoKeyUsageSign,
                             &public_key,
                             &private_key));
 
   EXPECT_EQ(0, public_key.usages());
   EXPECT_EQ(blink::WebCryptoKeyUsageSign, private_key.usages());
 }
 
+TEST(WebCryptoRsaSsaTest, GenerateKeyPairEmptyUsages) {
+  const unsigned int modulus_length = 256;
+  const std::vector<uint8_t> public_exponent = HexStringToBytes("010001");
+
+  blink::WebCryptoKey public_key;
+  blink::WebCryptoKey private_key;
+
+  ASSERT_EQ(Status::ErrorCreateKeyEmptyUsages(),
+            GenerateKeyPair(CreateRsaHashedKeyGenAlgorithm(
+                                blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
+                                blink::WebCryptoAlgorithmIdSha256,
+                                modulus_length, public_exponent),
+                            true, 0, &public_key, &private_key));
+}
+
 TEST(WebCryptoRsaSsaTest, ImportExportJwkRsaPublicKey) {
   struct TestCase {
     const blink::WebCryptoAlgorithmId hash;
     const blink::WebCryptoKeyUsageMask usage;
     const char* const jwk_alg;
   };
   const TestCase kTests[] = {
       {blink::WebCryptoAlgorithmIdSha1, blink::WebCryptoKeyUsageVerify, "RS1"},
       {blink::WebCryptoAlgorithmIdSha256, blink::WebCryptoKeyUsageVerify,
        "RS256"},
@@ skipping 139 matching lines @@
 
     const base::DictionaryValue* test;
     ASSERT_TRUE(tests->GetDictionary(test_index, &test));
 
     blink::WebCryptoKeyFormat key_format = GetKeyFormatFromJsonTestCase(test);
     std::vector<uint8_t> key_data =
         GetKeyDataFromJsonTestCase(test, key_format);
     std::string test_error;
     ASSERT_TRUE(test->GetString("error", &test_error));
 
+    blink::WebCryptoKeyUsageMask usages = blink::WebCryptoKeyUsageSign;
+    if (key_format == blink::WebCryptoKeyFormatSpki)
+      usages = blink::WebCryptoKeyUsageVerify;
     blink::WebCryptoKey key;
     Status status = ImportKey(key_format, CryptoData(key_data),
                               CreateRsaHashedImportAlgorithm(
                                   blink::WebCryptoAlgorithmIdRsaSsaPkcs1v1_5,
                                   blink::WebCryptoAlgorithmIdSha256),
-                              true, 0, &key);
+                              true, usages, &key);
     EXPECT_EQ(test_error, StatusToString(status));
   }
 }
 
 }  // namespace
 
 }  // namespace webcrypto
 
 }  // namespace content