1 // Copyright 2017 The Chromium Authors
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "simple_path_builder_delegate.h"
16
17 #include <memory>
18 #include <set>
19
20 #include <gtest/gtest.h>
21
22 #include <openssl/nid.h>
23 #include <openssl/span.h>
24
25 #include "cert_errors.h"
26 #include "input.h"
27 #include "parse_values.h"
28 #include "parser.h"
29 #include "signature_algorithm.h"
30 #include "test_helpers.h"
31 #include "verify_signed_data.h"
32
33 BSSL_NAMESPACE_BEGIN
34
35 namespace {
36
37 // Reads the public key and algorithm from the test data at |file_name|.
ReadTestCase(const char * file_name,SignatureAlgorithm * signature_algorithm,bssl::UniquePtr<EVP_PKEY> * public_key)38 void ReadTestCase(const char *file_name,
39 SignatureAlgorithm *signature_algorithm,
40 bssl::UniquePtr<EVP_PKEY> *public_key) {
41 std::string path =
42 std::string("testdata/verify_signed_data_unittest/") + file_name;
43
44 std::string public_key_str;
45 std::string algorithm_str;
46
47 const PemBlockMapping mappings[] = {
48 {"PUBLIC KEY", &public_key_str},
49 {"ALGORITHM", &algorithm_str},
50 };
51
52 ASSERT_TRUE(ReadTestDataFromPemFile(path, mappings));
53
54 std::optional<SignatureAlgorithm> sigalg_opt =
55 ParseSignatureAlgorithm(StringAsBytes(algorithm_str));
56 ASSERT_TRUE(sigalg_opt);
57 *signature_algorithm = *sigalg_opt;
58
59 ASSERT_TRUE(ParsePublicKey(StringAsBytes(public_key_str), public_key));
60 }
61
62 class SimplePathBuilderDelegate1024SuccessTest
63 : public ::testing::TestWithParam<const char *> {};
64
65 const char *kSuccess1024Filenames[] = {
66 "rsa-pkcs1-sha1.pem", "rsa-pkcs1-sha256.pem",
67 "rsa2048-pkcs1-sha512.pem", "ecdsa-secp384r1-sha256.pem",
68 "ecdsa-prime256v1-sha512.pem", "rsa-pss-sha256.pem",
69 "ecdsa-secp384r1-sha256.pem", "ecdsa-prime256v1-sha512.pem",
70 };
71
72 INSTANTIATE_TEST_SUITE_P(All, SimplePathBuilderDelegate1024SuccessTest,
73 ::testing::ValuesIn(kSuccess1024Filenames));
74
TEST_P(SimplePathBuilderDelegate1024SuccessTest,IsAcceptableSignatureAndKey)75 TEST_P(SimplePathBuilderDelegate1024SuccessTest, IsAcceptableSignatureAndKey) {
76 SignatureAlgorithm signature_algorithm{};
77 bssl::UniquePtr<EVP_PKEY> public_key;
78 ASSERT_NO_FATAL_FAILURE(
79 ReadTestCase(GetParam(), &signature_algorithm, &public_key));
80 ASSERT_TRUE(public_key);
81
82 CertErrors errors;
83 SimplePathBuilderDelegate delegate(
84 1024, SimplePathBuilderDelegate::DigestPolicy::kWeakAllowSha1);
85
86 EXPECT_TRUE(
87 delegate.IsSignatureAlgorithmAcceptable(signature_algorithm, &errors));
88
89 EXPECT_TRUE(delegate.IsPublicKeyAcceptable(public_key.get(), &errors));
90 }
91
92 class SimplePathBuilderDelegate2048FailTest
93 : public ::testing::TestWithParam<const char *> {};
94
95 const char *kFail2048Filenames[] = {"rsa-pkcs1-sha1.pem",
96 "rsa-pkcs1-sha256.pem"};
97
98 INSTANTIATE_TEST_SUITE_P(All, SimplePathBuilderDelegate2048FailTest,
99 ::testing::ValuesIn(kFail2048Filenames));
100
TEST_P(SimplePathBuilderDelegate2048FailTest,RsaKeySmallerThan2048)101 TEST_P(SimplePathBuilderDelegate2048FailTest, RsaKeySmallerThan2048) {
102 SignatureAlgorithm signature_algorithm{};
103 bssl::UniquePtr<EVP_PKEY> public_key;
104 ASSERT_NO_FATAL_FAILURE(
105 ReadTestCase(GetParam(), &signature_algorithm, &public_key));
106 ASSERT_TRUE(public_key);
107
108 CertErrors errors;
109 SimplePathBuilderDelegate delegate(
110 2048, SimplePathBuilderDelegate::DigestPolicy::kWeakAllowSha1);
111
112 EXPECT_TRUE(
113 delegate.IsSignatureAlgorithmAcceptable(signature_algorithm, &errors));
114
115 EXPECT_FALSE(delegate.IsPublicKeyAcceptable(public_key.get(), &errors));
116 }
117
118 } // namespace
119
120 BSSL_NAMESPACE_END
121