diff options
Diffstat (limited to 'libtransport/src/test/test_auth.cc')
| -rw-r--r-- | libtransport/src/test/test_auth.cc | 223 |
1 files changed, 157 insertions, 66 deletions
diff --git a/libtransport/src/test/test_auth.cc b/libtransport/src/test/test_auth.cc index db1c3b52f..5440d3741 100644 --- a/libtransport/src/test/test_auth.cc +++ b/libtransport/src/test/test_auth.cc @@ -1,5 +1,5 @@ /* - * Copyright (c) 2021 Cisco and/or its affiliates. + * Copyright (c) 2021-2022 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: @@ -15,10 +15,15 @@ #include <gtest/gtest.h> #include <hicn/transport/auth/crypto_hash.h> -#include <hicn/transport/auth/identity.h> #include <hicn/transport/auth/signer.h> #include <hicn/transport/auth/verifier.h> #include <hicn/transport/core/content_object.h> +#include <openssl/rand.h> + +using BN_ptr = std::unique_ptr<BIGNUM, decltype(&::BN_free)>; +using RSA_ptr = std::unique_ptr<RSA, decltype(&::RSA_free)>; +using EC_KEY_ptr = std::unique_ptr<EC_KEY, decltype(&::EC_KEY_free)>; +using DSA_ptr = std::unique_ptr<DSA, decltype(&::DSA_free)>; namespace transport { namespace auth { @@ -37,7 +42,7 @@ class AuthTest : public ::testing::Test { TEST_F(AuthTest, VoidVerifier) { // Create a content object - core::ContentObject packet(HF_INET6_TCP_AH); + core::ContentObject packet(HICN_PACKET_FORMAT_IPV6_TCP_AH); // Fill it with bogus data uint8_t buffer[256] = {0}; @@ -50,14 +55,27 @@ TEST_F(AuthTest, VoidVerifier) { } TEST_F(AuthTest, AsymmetricRSA) { - // Create the RSA signer from an Identity object - Identity identity("test_rsa.p12", PASSPHRASE, CryptoSuite::RSA_SHA256, 1024u, - 30, "RSAVerifier"); - - std::shared_ptr<Signer> signer = identity.getSigner(); + // Create the RSA keys + std::shared_ptr<EVP_PKEY> privateKey(EVP_PKEY_new(), EVP_PKEY_free); + std::shared_ptr<EVP_PKEY> pubKey(EVP_PKEY_new(), EVP_PKEY_free); + RSA_ptr rsa(RSA_new(), ::RSA_free); + BN_ptr pub_exp(BN_new(), ::BN_free); + + BN_set_word(pub_exp.get(), RSA_F4); + if (1 != RSA_generate_key_ex(rsa.get(), 2048u, pub_exp.get(), NULL)) + throw errors::RuntimeException("can't generate the key"); + RSA_ptr rsa_pub(RSAPublicKey_dup(rsa.get()), ::RSA_free); + RSA_ptr rsa_priv(RSAPrivateKey_dup(rsa.get()), ::RSA_free); + if (1 != EVP_PKEY_set1_RSA(pubKey.get(), rsa_pub.get())) + throw errors::RuntimeException("can't generate the key"); + if (1 != EVP_PKEY_set1_RSA(privateKey.get(), rsa_priv.get())) + throw errors::RuntimeException("can't generate the key"); + std::shared_ptr<AsymmetricSigner> signer = std::make_shared<AsymmetricSigner>( + CryptoSuite::RSA_SHA256, privateKey, pubKey); // Create a content object - core::ContentObject packet(HF_INET6_TCP_AH, signer->getSignatureSize()); + core::ContentObject packet(HICN_PACKET_FORMAT_IPV6_TCP_AH, + signer->getSignatureSize()); // Fill it with bogus data uint8_t buffer[256] = {0}; @@ -68,64 +86,112 @@ TEST_F(AuthTest, AsymmetricRSA) { // Create the RSA verifier std::shared_ptr<Verifier> verifier = - std::make_shared<AsymmetricVerifier>(identity.getCertificate()); + std::make_shared<AsymmetricVerifier>(pubKey); - EXPECT_EQ(packet.getFormat(), HF_INET6_TCP_AH); + EXPECT_EQ(packet.getFormat(), HICN_PACKET_FORMAT_IPV6_TCP_AH); EXPECT_EQ(signer->getHashType(), CryptoHashType::SHA256); EXPECT_EQ(signer->getSuite(), CryptoSuite::RSA_SHA256); - EXPECT_EQ(signer->getSignatureSize(), 128u); + EXPECT_EQ(signer->getSignatureSize(), 256u); EXPECT_EQ(verifier->verifyPackets(&packet), VerificationPolicy::ACCEPT); } TEST_F(AuthTest, AsymmetricBufferRSA) { - // Create the RSA signer from an Identity object - Identity identity("test_rsa.p12", PASSPHRASE, CryptoSuite::RSA_SHA256, 1024u, - 30, "RSAVerifier"); + // Create the RSA keys + std::shared_ptr<EVP_PKEY> privateKey(EVP_PKEY_new(), EVP_PKEY_free); + std::shared_ptr<EVP_PKEY> pubKey(EVP_PKEY_new(), EVP_PKEY_free); + RSA_ptr rsa(RSA_new(), ::RSA_free); + BN_ptr pub_exp(BN_new(), ::BN_free); + + BN_set_word(pub_exp.get(), RSA_F4); + if (1 != RSA_generate_key_ex(rsa.get(), 2048u, pub_exp.get(), NULL)) + throw errors::RuntimeException("can't generate the key"); + RSA_ptr rsa_pub(RSAPublicKey_dup(rsa.get()), ::RSA_free); + RSA_ptr rsa_priv(RSAPrivateKey_dup(rsa.get()), ::RSA_free); + if (1 != EVP_PKEY_set1_RSA(pubKey.get(), rsa_pub.get())) + throw errors::RuntimeException("can't generate the key"); + if (1 != EVP_PKEY_set1_RSA(privateKey.get(), rsa_priv.get())) + throw errors::RuntimeException("can't generate the key"); + std::shared_ptr<AsymmetricSigner> signer = std::make_shared<AsymmetricSigner>( + CryptoSuite::RSA_SHA256, privateKey, pubKey); - std::shared_ptr<AsymmetricSigner> signer = identity.getSigner(); std::string payload = "bonjour"; std::vector<uint8_t> buffer(payload.begin(), payload.end()); signer->signBuffer(buffer); - std::vector<uint8_t> sig = signer->getSignature(); + utils::MemBuf::Ptr sig = signer->getSignature(); - std::shared_ptr<X509> cert = identity.getCertificate(); - AsymmetricVerifier verif(cert); - bool res = verif.verifyBuffer( - buffer, std::vector<uint8_t>(sig.data(), sig.data() + sig.size()), - CryptoHashType::SHA256); + std::shared_ptr<AsymmetricVerifier> verif = + std::make_shared<AsymmetricVerifier>(pubKey); + bool res = verif->verifyBuffer(buffer, sig, CryptoSuite::RSA_SHA256); EXPECT_EQ(res, true); } TEST_F(AuthTest, AsymmetricBufferDSA) { - // Create the DSA signer from an Identity object - Identity identity("test_dsa.p12", PASSPHRASE, CryptoSuite::DSA_SHA256, 1024u, - 30, "DSAVerifier"); + // Create the DSA keys + + std::shared_ptr<EVP_PKEY> privateKey(EVP_PKEY_new(), EVP_PKEY_free); + + DSA_ptr dsa(DSA_new(), ::DSA_free); + unsigned char buf[32]; + if (RAND_bytes(buf, sizeof(buf)) != 1) { + throw errors::RuntimeException("can't generate the key"); + } + if (DSA_generate_parameters_ex(dsa.get(), 1024u, buf, sizeof(buf), NULL, NULL, + NULL) != 1) + throw errors::RuntimeException("can't generate the key"); + if (DSA_generate_key(dsa.get()) != 1) + throw errors::RuntimeException("can't generate the key"); + if (EVP_PKEY_set1_DSA(privateKey.get(), dsa.get()) != 1) + throw errors::RuntimeException("can't generate the key"); + if (1 != EVP_PKEY_set1_DSA(privateKey.get(), dsa.get())) + throw errors::RuntimeException("can't generate the key"); + + std::shared_ptr<X509> cert(X509_new(), ::X509_free); + X509_set_pubkey(cert.get(), privateKey.get()); + std::shared_ptr<EVP_PKEY> pubKey(X509_get_pubkey(cert.get()), EVP_PKEY_free); + std::shared_ptr<AsymmetricSigner> signer = std::make_shared<AsymmetricSigner>( + CryptoSuite::DSA_SHA256, privateKey, pubKey); - std::shared_ptr<AsymmetricSigner> signer = identity.getSigner(); std::string payload = "bonjour"; std::vector<uint8_t> buffer(payload.begin(), payload.end()); signer->signBuffer(buffer); - std::vector<uint8_t> sig = signer->getSignature(); + utils::MemBuf::Ptr sig = signer->getSignature(); - std::shared_ptr<X509> cert = identity.getCertificate(); - AsymmetricVerifier verif(cert); - bool res = verif.verifyBuffer( - buffer, std::vector<uint8_t>(sig.data(), sig.data() + sig.size()), - CryptoHashType::SHA256); + std::shared_ptr<AsymmetricVerifier> verif = + std::make_shared<AsymmetricVerifier>(pubKey); + bool res = verif->verifyBuffer(buffer, sig, CryptoSuite::RSA_SHA256); EXPECT_EQ(res, true); } TEST_F(AuthTest, AsymmetricVerifierDSA) { - // Create the DSA signer from an Identity object - Identity identity("test_dsa.p12", PASSPHRASE, CryptoSuite::DSA_SHA256, 1024u, - 30, "DSAVerifier"); + // Create the DSA keys + std::shared_ptr<EVP_PKEY> privateKey(EVP_PKEY_new(), EVP_PKEY_free); - std::shared_ptr<Signer> signer = identity.getSigner(); + DSA_ptr dsa(DSA_new(), ::DSA_free); + unsigned char buf[32]; + if (RAND_bytes(buf, sizeof(buf)) != 1) { + throw errors::RuntimeException("can't generate the key"); + } + if (DSA_generate_parameters_ex(dsa.get(), 1024u, buf, sizeof(buf), NULL, NULL, + NULL) != 1) + throw errors::RuntimeException("can't generate the key"); + if (DSA_generate_key(dsa.get()) != 1) + throw errors::RuntimeException("can't generate the key"); + if (EVP_PKEY_set1_DSA(privateKey.get(), dsa.get()) != 1) + throw errors::RuntimeException("can't generate the key"); + if (1 != EVP_PKEY_set1_DSA(privateKey.get(), dsa.get())) + throw errors::RuntimeException("can't generate the key"); + + std::shared_ptr<X509> cert(X509_new(), ::X509_free); + X509_set_pubkey(cert.get(), privateKey.get()); + std::shared_ptr<EVP_PKEY> pubKey(X509_get_pubkey(cert.get()), EVP_PKEY_free); + std::shared_ptr<AsymmetricSigner> signer = std::make_shared<AsymmetricSigner>( + CryptoSuite::DSA_SHA256, privateKey, pubKey); // Create a content object - core::ContentObject packet(HF_INET6_TCP_AH, signer->getSignatureSize()); + core::ContentObject packet(HICN_PACKET_FORMAT_IPV6_TCP_AH, + signer->getSignatureSize()); // Fill it with bogus data uint8_t buffer[256] = {0}; @@ -134,51 +200,76 @@ TEST_F(AuthTest, AsymmetricVerifierDSA) { // EXPECT_EQ(signer->getSignatureSize(), 256u); signer->signPacket(&packet); std::shared_ptr<Verifier> verifier = - std::make_shared<AsymmetricVerifier>(identity.getCertificate()); + std::make_shared<AsymmetricVerifier>(cert); - EXPECT_EQ(packet.getFormat(), HF_INET6_TCP_AH); + EXPECT_EQ(packet.getFormat(), HICN_PACKET_FORMAT_IPV6_TCP_AH); EXPECT_EQ(signer->getHashType(), CryptoHashType::SHA256); EXPECT_EQ(signer->getSuite(), CryptoSuite::DSA_SHA256); EXPECT_EQ(verifier->verifyPackets(&packet), VerificationPolicy::ACCEPT); } TEST_F(AuthTest, AsymmetricBufferECDSA) { - // Create the ECDSA signer from an Identity object - Identity identity("test_ecdsa.p12", PASSPHRASE, CryptoSuite::ECDSA_SHA256, - 256u, 30, "ECDSAVerifier"); + // Create the ECDSA keys + std::shared_ptr<EVP_PKEY> privateKey(EVP_PKEY_new(), EVP_PKEY_free); + std::shared_ptr<EVP_PKEY> pubKey(EVP_PKEY_new(), EVP_PKEY_free); + EC_KEY_ptr ec_priv(EC_KEY_new_by_curve_name(NID_secp256k1), ::EC_KEY_free); + EC_KEY_ptr ec_pub(EC_KEY_new(), ::EC_KEY_free); + EC_KEY_set_asn1_flag(ec_priv.get(), OPENSSL_EC_NAMED_CURVE); + if (EC_KEY_generate_key(ec_priv.get()) == 0) + throw errors::RuntimeException("can't generate the ecdsa key"); + if (1 != EVP_PKEY_set1_EC_KEY(privateKey.get(), ec_priv.get())) + throw errors::RuntimeException("can't generate the key"); + EC_KEY_set_group(ec_pub.get(), EC_KEY_get0_group(ec_priv.get())); + EC_KEY_set_public_key(ec_pub.get(), EC_KEY_get0_public_key(ec_priv.get())); + if (1 != EVP_PKEY_set1_EC_KEY(pubKey.get(), ec_pub.get())) + throw errors::RuntimeException("can't generate the key"); + + std::shared_ptr<AsymmetricSigner> signer = std::make_shared<AsymmetricSigner>( + CryptoSuite::ECDSA_SHA256, privateKey, pubKey); - std::shared_ptr<AsymmetricSigner> signer = identity.getSigner(); std::string payload = "bonjour"; std::vector<uint8_t> buffer(payload.begin(), payload.end()); signer->signBuffer(buffer); - std::vector<uint8_t> sig = signer->getSignature(); + utils::MemBuf::Ptr sig = signer->getSignature(); - std::shared_ptr<X509> cert = identity.getCertificate(); - AsymmetricVerifier verif(cert); - bool res = verif.verifyBuffer( - buffer, std::vector<uint8_t>(sig.data(), sig.data() + sig.size()), - CryptoHashType::SHA256); + std::shared_ptr<AsymmetricVerifier> verif = + std::make_shared<AsymmetricVerifier>(pubKey); + bool res = verif->verifyBuffer(buffer, sig, CryptoSuite::RSA_SHA256); EXPECT_EQ(res, true); -} +} // namespace auth TEST_F(AuthTest, AsymmetricVerifierECDSA) { - Identity identity("test_ecdsa.p12", PASSPHRASE, CryptoSuite::ECDSA_SHA256, - 256u, 30, "ECDSAVerifier"); - - std::shared_ptr<Signer> signer = identity.getSigner(); - std::shared_ptr<Verifier> verifier = - std::make_shared<AsymmetricVerifier>(identity.getCertificate()); - // Create a content object + // Create the ECDSA keys + std::shared_ptr<EVP_PKEY> privateKey(EVP_PKEY_new(), EVP_PKEY_free); + std::shared_ptr<EVP_PKEY> pubKey(EVP_PKEY_new(), EVP_PKEY_free); + EC_KEY_ptr ec_priv(EC_KEY_new_by_curve_name(NID_secp256k1), ::EC_KEY_free); + EC_KEY_ptr ec_pub(EC_KEY_new(), ::EC_KEY_free); + EC_KEY_set_asn1_flag(ec_priv.get(), OPENSSL_EC_NAMED_CURVE); + if (EC_KEY_generate_key(ec_priv.get()) == 0) + throw errors::RuntimeException("can't generate the ecdsa key"); + if (1 != EVP_PKEY_set1_EC_KEY(privateKey.get(), ec_priv.get())) + throw errors::RuntimeException("can't generate the key"); + EC_KEY_set_group(ec_pub.get(), EC_KEY_get0_group(ec_priv.get())); + EC_KEY_set_public_key(ec_pub.get(), EC_KEY_get0_public_key(ec_priv.get())); + if (1 != EVP_PKEY_set1_EC_KEY(pubKey.get(), ec_pub.get())) + throw errors::RuntimeException("can't generate the key"); + + std::shared_ptr<AsymmetricSigner> signer = std::make_shared<AsymmetricSigner>( + CryptoSuite::ECDSA_SHA256, privateKey, pubKey); + + std::shared_ptr<AsymmetricVerifier> verifier = + std::make_shared<AsymmetricVerifier>(pubKey); for (int i = 0; i < 100; i++) { - core::ContentObject packet(HF_INET6_TCP_AH, signer->getSignatureSize()); + core::ContentObject packet(HICN_PACKET_FORMAT_IPV6_TCP_AH, + signer->getSignatureSize()); // Fill it with bogus data uint8_t buffer[256] = {0}; packet.appendPayload(buffer, 256); signer->signPacket(&packet); - EXPECT_EQ(packet.getFormat(), HF_INET6_TCP_AH); + EXPECT_EQ(packet.getFormat(), HICN_PACKET_FORMAT_IPV6_TCP_AH); EXPECT_EQ(signer->getHashType(), CryptoHashType::SHA256); EXPECT_EQ(signer->getSuite(), CryptoSuite::ECDSA_SHA256); EXPECT_EQ(verifier->verifyPackets(&packet), VerificationPolicy::ACCEPT); @@ -191,16 +282,15 @@ TEST_F(AuthTest, HMACbuffer) { std::make_shared<SymmetricSigner>(CryptoSuite::HMAC_SHA256, PASSPHRASE); // Create a content object - core::ContentObject packet(HF_INET6_TCP_AH, signer->getSignatureSize()); + core::ContentObject packet(HICN_PACKET_FORMAT_IPV6_TCP_AH, + signer->getSignatureSize()); std::string payload = "bonjour"; std::vector<uint8_t> buffer(payload.begin(), payload.end()); signer->signBuffer(buffer); - std::vector<uint8_t> sig = signer->getSignature(); + utils::MemBuf::Ptr sig = signer->getSignature(); SymmetricVerifier hmac(PASSPHRASE); - bool res = hmac.verifyBuffer( - buffer, std::vector<uint8_t>(sig.data(), sig.data() + sig.size()), - CryptoHashType::SHA256); + bool res = hmac.verifyBuffer(buffer, sig, CryptoSuite::RSA_SHA256); EXPECT_EQ(res, true); } @@ -210,7 +300,8 @@ TEST_F(AuthTest, HMACVerifier) { std::make_shared<SymmetricSigner>(CryptoSuite::HMAC_SHA256, PASSPHRASE); // Create a content object - core::ContentObject packet(HF_INET6_TCP_AH, signer->getSignatureSize()); + core::ContentObject packet(HICN_PACKET_FORMAT_IPV6_TCP_AH, + signer->getSignatureSize()); // Fill it with bogus data uint8_t buffer[256] = {0}; @@ -223,7 +314,7 @@ TEST_F(AuthTest, HMACVerifier) { std::shared_ptr<Verifier> verifier = std::make_shared<SymmetricVerifier>(PASSPHRASE); - EXPECT_EQ(packet.getFormat(), HF_INET6_TCP_AH); + EXPECT_EQ(packet.getFormat(), HICN_PACKET_FORMAT_IPV6_TCP_AH); EXPECT_EQ(signer->getHashType(), CryptoHashType::SHA256); EXPECT_EQ(signer->getSuite(), CryptoSuite::HMAC_SHA256); EXPECT_EQ(signer->getSignatureSize(), 32u); |