1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 #include "simple_path_builder_delegate.h"
5
6 #include <memory>
7 #include <set>
8
9 #include <gtest/gtest.h>
10 #include <openssl/nid.h>
11 #include "cert_errors.h"
12 #include "input.h"
13 #include "parse_values.h"
14 #include "parser.h"
15 #include "signature_algorithm.h"
16 #include "test_helpers.h"
17 #include "verify_signed_data.h"
18
19 namespace bssl {
20
21 namespace {
22
23 // Reads the public key and algorithm from the test data at |file_name|.
ReadTestCase(const char * file_name,SignatureAlgorithm * signature_algorithm,bssl::UniquePtr<EVP_PKEY> * public_key)24 void ReadTestCase(const char *file_name,
25 SignatureAlgorithm *signature_algorithm,
26 bssl::UniquePtr<EVP_PKEY> *public_key) {
27 std::string path =
28 std::string("testdata/verify_signed_data_unittest/") + file_name;
29
30 std::string public_key_str;
31 std::string algorithm_str;
32
33 const PemBlockMapping mappings[] = {
34 {"PUBLIC KEY", &public_key_str},
35 {"ALGORITHM", &algorithm_str},
36 };
37
38 ASSERT_TRUE(ReadTestDataFromPemFile(path, mappings));
39
40 std::optional<SignatureAlgorithm> sigalg_opt =
41 ParseSignatureAlgorithm(der::Input(algorithm_str));
42 ASSERT_TRUE(sigalg_opt);
43 *signature_algorithm = *sigalg_opt;
44
45 ASSERT_TRUE(ParsePublicKey(der::Input(public_key_str), public_key));
46 }
47
48 class SimplePathBuilderDelegate1024SuccessTest
49 : public ::testing::TestWithParam<const char *> {};
50
51 const char *kSuccess1024Filenames[] = {
52 "rsa-pkcs1-sha1.pem", "rsa-pkcs1-sha256.pem",
53 "rsa2048-pkcs1-sha512.pem", "ecdsa-secp384r1-sha256.pem",
54 "ecdsa-prime256v1-sha512.pem", "rsa-pss-sha256.pem",
55 "ecdsa-secp384r1-sha256.pem", "ecdsa-prime256v1-sha512.pem",
56 };
57
58 INSTANTIATE_TEST_SUITE_P(All, SimplePathBuilderDelegate1024SuccessTest,
59 ::testing::ValuesIn(kSuccess1024Filenames));
60
TEST_P(SimplePathBuilderDelegate1024SuccessTest,IsAcceptableSignatureAndKey)61 TEST_P(SimplePathBuilderDelegate1024SuccessTest, IsAcceptableSignatureAndKey) {
62 SignatureAlgorithm signature_algorithm{};
63 bssl::UniquePtr<EVP_PKEY> public_key;
64 ASSERT_NO_FATAL_FAILURE(
65 ReadTestCase(GetParam(), &signature_algorithm, &public_key));
66 ASSERT_TRUE(public_key);
67
68 CertErrors errors;
69 SimplePathBuilderDelegate delegate(
70 1024, SimplePathBuilderDelegate::DigestPolicy::kWeakAllowSha1);
71
72 EXPECT_TRUE(
73 delegate.IsSignatureAlgorithmAcceptable(signature_algorithm, &errors));
74
75 EXPECT_TRUE(delegate.IsPublicKeyAcceptable(public_key.get(), &errors));
76 }
77
78 class SimplePathBuilderDelegate2048FailTest
79 : public ::testing::TestWithParam<const char *> {};
80
81 const char *kFail2048Filenames[] = {"rsa-pkcs1-sha1.pem",
82 "rsa-pkcs1-sha256.pem"};
83
84 INSTANTIATE_TEST_SUITE_P(All, SimplePathBuilderDelegate2048FailTest,
85 ::testing::ValuesIn(kFail2048Filenames));
86
TEST_P(SimplePathBuilderDelegate2048FailTest,RsaKeySmallerThan2048)87 TEST_P(SimplePathBuilderDelegate2048FailTest, RsaKeySmallerThan2048) {
88 SignatureAlgorithm signature_algorithm{};
89 bssl::UniquePtr<EVP_PKEY> public_key;
90 ASSERT_NO_FATAL_FAILURE(
91 ReadTestCase(GetParam(), &signature_algorithm, &public_key));
92 ASSERT_TRUE(public_key);
93
94 CertErrors errors;
95 SimplePathBuilderDelegate delegate(
96 2048, SimplePathBuilderDelegate::DigestPolicy::kWeakAllowSha1);
97
98 EXPECT_TRUE(
99 delegate.IsSignatureAlgorithmAcceptable(signature_algorithm, &errors));
100
101 EXPECT_FALSE(delegate.IsPublicKeyAcceptable(public_key.get(), &errors));
102 }
103
104 } // namespace
105
106 } // namespace bssl
107